[00:00.000 --> 00:00.640]  Many hands.
[00:02.360 --> 00:03.660]  I'm not raising my hand.
[00:05.740 --> 00:15.880]  We got a lot of, well, first I want to, before I introduce this talk, I want to mention a couple of workshops that are going on this morning on the sixth floor.
[00:17.460 --> 00:25.240]  There is a amateur radio, you know, federal, you know, FCC licensing exams.
[00:26.580 --> 00:36.820]  Start at 10, but it ends at 1, so if you get there after this talk, you'll have plenty of time to take an examination, become a federal licensed amateur radio operator or ham.
[00:37.000 --> 00:59.740]  We have a station set up on the 18th floor, Space Rogue, who contacted us a while ago and proposed to do this, I think, a really necessary talk about media coverage of hackers, which I'm sure many of us have been going back decades reading some of these crazy stories about hackers did this or that.
[00:59.740 --> 01:05.440]  I have personal experience with mainstream media reporting just wildly inaccurate things.
[01:06.240 --> 01:12.060]  And it's, it's a problem that we can all play a part in trying to fix.
[01:12.880 --> 01:18.520]  And it, but it's important to understand how the problem happens and why it happens.
[01:18.960 --> 01:27.460]  And Space Rogue is going to go into some of that and some other things and give some really entertaining examples of hacker stories that the media got wrong.
[01:28.300 --> 01:30.260]  So, I'm sure it'll be very interesting and entertaining.
[01:31.000 --> 01:31.900]  Spacer, take it away.
[01:33.840 --> 01:34.440]  Thanks, Bernie.
[01:39.040 --> 01:42.740]  So, yeah, big thanks for Bernie and Emmanuel and everybody else who's putting the con on.
[01:43.000 --> 01:45.300]  I've been to HOPE, I don't know, five or six times now.
[01:45.420 --> 01:47.600]  And this is probably one of the best ones I've seen so far.
[01:48.140 --> 01:52.900]  Well, it's actually on time, which is a big, a big, a big plus, I think.
[01:53.520 --> 01:53.780]  All right.
[01:54.040 --> 01:56.940]  So hackers and media hype, big hacks that never really happened.
[01:57.200 --> 01:59.200]  Let's, uh...
[01:59.200 --> 02:00.400]  Okay, is this going to work?
[02:00.560 --> 02:00.660]  No?
[02:03.460 --> 02:04.400]  Let's try this again.
[02:05.600 --> 02:06.040]  There's that.
[02:06.520 --> 02:06.880]  All right.
[02:06.960 --> 02:09.120]  Let's talk about a blue screen.
[02:10.660 --> 02:11.400]  Come on.
[02:13.100 --> 02:13.760]  I did.
[02:14.180 --> 02:15.740]  Why is my arrow keys not working?
[02:16.580 --> 02:17.220]  Here we go.
[02:17.300 --> 02:17.900]  We'll just do this.
[02:18.060 --> 02:18.780]  We'll do it the hard way.
[02:19.580 --> 02:19.880]  All right.
[02:20.020 --> 02:21.220]  So, yes?
[02:21.640 --> 02:22.060]  No?
[02:25.420 --> 02:26.080]  Hang on.
[02:26.260 --> 02:27.540]  I am on the last slide.
[02:27.680 --> 02:28.420]  Thank you very much.
[02:29.940 --> 02:31.600]  Somebody's hacking my presentation already.
[02:32.060 --> 02:35.420]  See, that's why I put the last slide and the first slide together at the same time.
[02:37.920 --> 02:39.020]  Um... Now it works.
[02:39.680 --> 02:40.240]  You got him.
[02:40.500 --> 02:40.660]  All right.
[02:40.900 --> 02:41.380]  Now it works.
[02:41.560 --> 02:41.720]  Yeah.
[02:41.920 --> 02:42.400]  So, who am I?
[02:43.400 --> 02:47.680]  I recently took a job with Trustwave Spider Labs, hence the logo in the slides.
[02:48.440 --> 02:51.520]  And before then, I never really used my real name.
[02:51.520 --> 02:53.120]  So, you have my real name now.
[02:53.660 --> 02:56.120]  I've been known as Space Rogue for the last 20 years or so.
[02:56.340 --> 02:58.200]  I was a member of L0pht Heavy Industries.
[02:58.200 --> 03:00.260]  If anybody remembers who the hell they were.
[03:00.920 --> 03:01.720]  Um... Thank you.
[03:02.000 --> 03:04.060]  I created the WhackedMac archives.
[03:04.480 --> 03:06.860]  I testified to Congress with computer security and government.
[03:07.340 --> 03:09.200]  I was editor of the Hacker News Network.
[03:09.340 --> 03:10.040]  Not once, but twice.
[03:11.140 --> 03:13.840]  Uh... Threat intelligence manager at Trustwave Spider Labs is what I do now.
[03:15.480 --> 03:18.380]  So, uh... I spoke at DEFCON Source, a bunch of places.
[03:18.860 --> 03:24.300]  I've been sort of doing media stuff for a very long time without really knowing I was doing media stuff.
[03:24.300 --> 03:28.540]  As part of running the Hacker News Network, you run across...
[03:29.300 --> 03:30.740]  I can't even talk this morning.
[03:30.780 --> 03:31.760]  I had too much to drink last night.
[03:32.940 --> 03:37.820]  You run across a lot of news stories that don't make any sense.
[03:37.940 --> 03:39.520]  And that's sort of why this talk is here.
[03:40.240 --> 03:41.560]  And what we're going to talk about today.
[03:41.700 --> 03:44.640]  So, we're going to talk about... We're going to try to define what media hype really is.
[03:45.540 --> 03:47.500]  I'm going to go over quite a few examples.
[03:48.500 --> 03:52.260]  And then we're going to talk about how to identify hype so that you can sort of...
[03:52.260 --> 03:56.460]  Most people think they, I think, have a pretty good idea of, oh, this is way too hype.
[03:56.660 --> 04:01.180]  But we'll try to go into some concrete steps so you can identify that.
[04:01.300 --> 04:03.140]  And then how to be a part of the reality.
[04:03.360 --> 04:07.520]  A lot of this talk, I break up into the hype and I break it up into the reality.
[04:08.380 --> 04:10.880]  There's a lot more hype out there that doesn't match the reality.
[04:10.880 --> 04:16.400]  And so, I've only included stories that I could actually find a reality to here.
[04:16.680 --> 04:16.920]  Examples.
[04:17.500 --> 04:18.820]  So, what is media hype?
[04:19.420 --> 04:22.100]  Media, any means of communication, basically.
[04:22.760 --> 04:27.280]  Radio, television, newspaper, magazines that reach or influence people widely.
[04:28.220 --> 04:29.900]  I think that's an important distinction.
[04:30.720 --> 04:34.980]  And hype, the number three definition is probably the best.
[04:35.080 --> 04:39.360]  To intensify by ingenious or questionable claims or methods, right?
[04:39.720 --> 04:41.820]  So, when you add those two together, we get media hype.
[04:41.980 --> 04:45.600]  And we're going to apply that to hackers today.
[04:47.160 --> 04:47.620]  All right.
[04:47.780 --> 04:49.540]  A couple of notes on the examples that I give you.
[04:50.640 --> 04:52.580]  They're not really presented in any sort of order.
[04:53.960 --> 04:55.800]  They're sort of chronological, but not really.
[04:56.880 --> 05:00.280]  The older the story is, the harder it has been to research.
[05:00.960 --> 05:02.980]  Stuff on the web dies very, very quickly.
[05:03.240 --> 05:05.200]  Ask Jason Scott if you saw his talk yesterday.
[05:05.980 --> 05:07.020]  He'll back that up.
[05:07.020 --> 05:11.440]  It's very, very hard to find historical references, especially reality.
[05:11.620 --> 05:13.180]  Because the hype lives forever, right?
[05:13.420 --> 05:15.340]  The reality dies a very quick death.
[05:17.840 --> 05:20.240]  This sorts of stories happen every single day.
[05:20.520 --> 05:26.340]  I could probably find one example related to information security or to hackers in every news cycle.
[05:27.700 --> 05:30.780]  But you can't always find out the reality.
[05:30.960 --> 05:34.260]  Like, you know there's hype in there, but you don't know exactly how bad it is or how good it is.
[05:35.080 --> 05:36.780]  But I can find an example every day.
[05:36.920 --> 05:38.700]  So if you think these are isolated, they're not.
[05:38.940 --> 05:39.080]  All right.
[05:40.020 --> 05:42.880]  I don't know if there's any journalists in the audience.
[05:43.200 --> 05:44.700]  I apologize in advance to you.
[05:44.840 --> 05:47.420]  If you're a reporter and you're in the audience, I don't really care.
[05:48.800 --> 05:52.300]  I define reporter and journalist as two totally separate different things.
[05:52.640 --> 05:52.780]  Okay.
[05:53.980 --> 05:55.520]  And journalists should know better.
[05:55.520 --> 05:59.660]  And if you're one of the people in none of these examples, you shouldn't be.
[06:01.060 --> 06:03.720]  I'm not going to cover theoretical attacks.
[06:03.900 --> 06:04.100]  Okay.
[06:04.100 --> 06:09.240]  We've all heard about ATM jackpotting, you know, attacking the Wi-Fi in your car, that sort of thing.
[06:09.360 --> 06:11.120]  And those things get a lot of media play.
[06:12.300 --> 06:13.820]  That's not what I'm going to talk about today.
[06:14.900 --> 06:15.380]  All right.
[06:15.820 --> 06:17.300]  So let's go into our first example.
[06:17.540 --> 06:18.440]  Is Kevin Mitnick here?
[06:19.100 --> 06:19.460]  No?
[06:19.720 --> 06:20.040]  Good.
[06:20.180 --> 06:20.820]  Let's talk about him.
[06:22.660 --> 06:24.900]  So, you probably have all heard this story.
[06:25.580 --> 06:30.940]  Supposedly, he had the capability of whistling into a payphone and launching nuclear missiles from NORAD.
[06:31.480 --> 06:31.800]  Right?
[06:32.900 --> 06:34.400]  Yeah, we all laugh at this now.
[06:34.620 --> 06:34.940]  Right?
[06:35.140 --> 06:39.100]  Back in, you know, the 80s, this was, like, people took this as a serious shit.
[06:39.260 --> 06:39.360]  Right?
[06:40.420 --> 06:48.120]  So, if you look at the quotes here, a teenager used the computer modem to break into NORAD, foreshadowing the 1983 movie War Games.
[06:49.340 --> 06:53.260]  Mitnick, as a teenager in California, infiltrated NORAD computer system.
[06:53.820 --> 07:00.700]  Mitnick first received national attention in 82, when he hacked into the NORAD, a feat inspired, a feat that inspired the 83 film War Games.
[07:01.120 --> 07:03.220]  There's two things wrong with these quotes.
[07:03.680 --> 07:05.760]  One, of course, Mitnick never broke into NORAD.
[07:05.940 --> 07:06.020]  Right?
[07:06.780 --> 07:09.500]  Two, he didn't inspire war games.
[07:09.620 --> 07:10.740]  War games inspired him.
[07:10.860 --> 07:11.440]  And we'll get to that.
[07:11.580 --> 07:11.720]  All right?
[07:12.420 --> 07:20.840]  Now, the thing that I find interesting here, and when I go through some of these examples, if I forget to mention it, make note of the date of the articles.
[07:21.060 --> 07:21.140]  All right?
[07:21.420 --> 07:22.700]  The first one here is in 94.
[07:23.140 --> 07:24.240]  The second one's in 95.
[07:24.820 --> 07:26.940]  CNN is reporting it in 99.
[07:27.320 --> 07:27.660]  Okay?
[07:30.720 --> 07:36.300]  The reality was, in 96, Katie Hafner, who was a...
[07:37.040 --> 07:38.560]  I have it here on my notes here somewhere.
[07:38.560 --> 07:40.400]  Senior editor and co-author of the Cyberpunk.
[07:40.680 --> 07:41.120]  She was...
[07:41.120 --> 07:42.760]  Oh, she was senior editor for Newsweek.
[07:43.040 --> 07:43.180]  All right?
[07:43.940 --> 07:50.120]  And in 96, she went on the record and said she could find no evidence that the NORAD story was anything but myth.
[07:50.300 --> 07:54.600]  But remember, back in 1999, CNN is reporting it as fact.
[07:56.760 --> 08:00.760]  Now, I emailed Kevin and I said, hey, dude, what's up with this whole NORAD story?
[08:01.080 --> 08:02.960]  And he totally ignored me and didn't respond.
[08:03.540 --> 08:06.280]  Probably because he wanted me to read his book because that's where the answer was.
[08:08.060 --> 08:14.460]  Leon Wideman, who was the prosecutor for his case, made one of the most outrageous statements that have probably ever been uttered by a federal prosecutor in court.
[08:14.680 --> 08:18.180]  He told the magistrate that I could start a nuclear holocaust.
[08:18.320 --> 08:21.380]  He can whistle into a telephone and launch nuclear missiles from NORAD.
[08:23.020 --> 08:28.120]  I don't have an actual date of when this was, but it was before.
[08:28.680 --> 08:33.100]  It happened after... this court case happened after War Games came out.
[08:33.700 --> 08:43.500]  So it's highly likely that the prosecutor saw the movie and then attributed what he saw in the movie to Mitnick, as opposed to the other way around where Mitnick was the inspiration for the movie.
[08:46.520 --> 08:48.120]  So, hype and reality.
[08:48.500 --> 08:49.040]  Next example.
[08:49.180 --> 08:50.100]  Satellite health for ransom.
[08:50.560 --> 08:53.940]  I come up with... these satellite stories come up about once every five or ten years.
[08:53.940 --> 08:55.480]  I've seen like three of them so far.
[08:56.300 --> 08:57.720]  This one was in 1999.
[08:59.740 --> 09:01.020]  It was just crazy, right?
[09:01.080 --> 09:04.540]  There was a small story in this newspaper called The Sunday Business, which was based in the UK.
[09:04.760 --> 09:05.580]  It came out on a Sunday.
[09:05.800 --> 09:06.760]  Sunday Business, right?
[09:08.420 --> 09:09.880]  And it was picked up by Reuters.
[09:10.480 --> 09:12.200]  Hackers seize Britain's military satellite.
[09:12.520 --> 09:14.700]  Britain's military satellite held by hackers.
[09:14.860 --> 09:17.520]  Crackers reportedly take British military satellite.
[09:19.240 --> 09:21.940]  The whole article was like four paragraphs long.
[09:22.060 --> 09:23.560]  This is the whole article right here, right?
[09:23.960 --> 09:28.580]  I don't know if you can actually read those small fonts, but I'll quote some of the choice parts for you.
[09:29.300 --> 09:32.400]  Quoting security sources altered the course.
[09:32.680 --> 09:37.320]  The sources said... said one intelligent source, one security source said...
[09:37.320 --> 09:39.140]  There's no named sources here, right?
[09:40.960 --> 09:46.240]  There's no way for anybody who's reading this article to go back and verify what the hell happened.
[09:46.240 --> 09:49.000]  There's no one you can pick up the phone and call, right?
[09:49.080 --> 09:51.360]  And say, hey, you know, did you actually give this quote to this newspaper?
[09:51.600 --> 09:53.820]  Did something... did satellite really get taken over?
[09:54.960 --> 09:59.320]  So, this occurred back when I was running HNN the first time, Hacker News Network.
[09:59.660 --> 10:02.960]  And I put up a big thing on the site saying, you know, this is total crap.
[10:03.080 --> 10:04.600]  I totally don't believe this happened.
[10:05.060 --> 10:06.560]  This makes absolutely no sense.
[10:07.240 --> 10:14.820]  And so, Reuters eventually published a retraction after they published a second story.
[10:15.240 --> 10:17.240]  ZDNet published a story as well.
[10:17.760 --> 10:24.420]  But I can almost... I could... it took me days to find these reality links when I went to look for them.
[10:24.660 --> 10:29.660]  And I know there was a lot more stories about the reality part of this story than I could find.
[10:29.660 --> 10:34.100]  And it's just basically an example of how the reality just doesn't live on.
[10:34.340 --> 10:39.760]  I could find several examples of the original story, but not of the reality.
[10:39.960 --> 10:51.460]  And in fact, in 2008, there was an article in PCMag, the 10 most mysterious cyber crimes, where this particular hack, if you will, was listed as number two.
[10:51.940 --> 10:56.620]  It was the number two most mysterious cyber crime listed by this article in PCMag.
[10:56.620 --> 11:00.840]  So, I saw this PCMag story, and I kind of went a little apeshit, but...
[11:00.840 --> 11:05.040]  And I looked up who wrote it, and this guy by the name of... or girl, I guess, I don't...
[11:05.040 --> 11:08.320]  Corinene Iozzo, who wrote the story.
[11:08.980 --> 11:10.980]  And I researched who this reporter was.
[11:11.880 --> 11:14.500]  Basically, he or she is a freelancer.
[11:15.180 --> 11:18.880]  And this is the only InfoSec article they've ever written, ever.
[11:20.000 --> 11:20.580]  All right.
[11:20.820 --> 11:27.000]  Before this, all they've written was stuff about the cheapest MP3 players, or what's the best printer for your buck, right?
[11:27.180 --> 11:28.340]  The best bang for the buck for your printer.
[11:28.640 --> 11:38.020]  And so, if you look through this guy's autobiography, he has, you know, cheapest MP3 player, best printer, oh, 10 most mysterious cyber crimes.
[11:38.200 --> 11:40.840]  And then he goes right back to cheapest printer, whatnot.
[11:41.660 --> 11:44.300]  I don't know how he came up with these 10 things.
[11:44.400 --> 11:45.680]  I sent him several emails.
[11:46.240 --> 11:48.600]  I sent... I never got any response.
[11:48.880 --> 11:51.720]  I sent emails to the editor of PCMag, and they finally...
[11:52.440 --> 11:54.820]  They put a blurb at the top of their story or something.
[11:55.180 --> 11:56.480]  But the story's still up there.
[11:57.120 --> 11:58.380]  I think the link still works.
[12:01.440 --> 12:01.960]  So, yeah.
[12:02.240 --> 12:02.600]  Interesting.
[12:02.760 --> 12:03.520]  Interesting example.
[12:05.120 --> 12:07.500]  As we go through these two, I also want you to point out...
[12:07.500 --> 12:09.180]  Look at some of the sources that I'm quoting.
[12:09.280 --> 12:10.600]  Sometimes I may forget the sources.
[12:11.620 --> 12:12.560]  Particularly in this one.
[12:12.560 --> 12:13.440]  The hype.
[12:13.660 --> 12:15.140]  Al-Qaeda uses steganography.
[12:16.620 --> 12:19.460]  USA Today, terror groups hide behind web encryption.
[12:20.160 --> 12:20.520]  Wired.
[12:20.880 --> 12:23.080]  Bin Laden, steganography master.
[12:23.640 --> 12:25.220]  And then Cryptogram, Bruce Schneier.
[12:25.360 --> 12:26.080]  I love Bruce Schneier.
[12:26.160 --> 12:27.500]  The man's way smarter than I am.
[12:27.640 --> 12:33.100]  But it just kind of goes to show that some of the times, all of us can sort of get taken in by the hype part.
[12:33.600 --> 12:35.200]  Terrorists use steganography.
[12:35.840 --> 12:38.860]  Now, for those of you that don't know what steganography is, it's ancient.
[12:39.000 --> 12:39.960]  It goes back to ancient Greece.
[12:39.960 --> 12:44.200]  And basically puts words inside of pictures or other media.
[12:44.720 --> 12:45.800]  So that you can't...
[12:45.800 --> 12:46.260]  It's sort of...
[12:46.260 --> 12:47.680]  It's not really encrypted, but it's hidden.
[12:49.160 --> 12:51.840]  The USA Today story quoted U.S.
[12:51.940 --> 12:53.120]  officials and experts.
[12:53.580 --> 12:54.920]  And one guy from eye defense.
[12:58.220 --> 13:01.920]  Although, the eye defense guy sounds like he's responding to hypothetical questions.
[13:01.920 --> 13:02.880]  You know, if you read the article.
[13:03.280 --> 13:05.680]  So, I don't really know where the source of this came from.
[13:05.900 --> 13:07.740]  It doesn't make a whole lot of sense to me.
[13:08.480 --> 13:11.200]  Remember, in 2001, everybody's freaking out about terrorists.
[13:11.340 --> 13:12.120]  Well, I guess they still are.
[13:12.840 --> 13:14.820]  And, of course, terrorists were using the Internet.
[13:15.080 --> 13:15.920]  And now they've got steganography.
[13:16.400 --> 13:16.740]  Oh, my God.
[13:16.820 --> 13:17.700]  The world's going to end, right?
[13:18.360 --> 13:19.840]  But the reality was...
[13:19.840 --> 13:21.920]  And I want to quote these guys' names.
[13:22.740 --> 13:26.780]  The Center for Information Technology Integration, Niels Provost and Peter Honeyman.
[13:26.900 --> 13:32.380]  They did a report where they went out and they downloaded two million images from the Internet.
[13:32.920 --> 13:34.720]  And scanned them all for steganography.
[13:34.720 --> 13:36.480]  They found nothing, all right?
[13:37.780 --> 13:39.740]  You'd think that if it was prolific...
[13:39.740 --> 13:45.700]  As prolific as the news articles were making out, that there would at least be one or two images that had something in them.
[13:45.840 --> 13:47.580]  Even if it wasn't a terrorist image.
[13:49.420 --> 13:50.400]  This was the reality.
[13:50.520 --> 13:51.020]  This was the report.
[13:51.120 --> 13:53.000]  The report was published in August 31st, 2001.
[13:54.040 --> 13:55.380]  Now, if you remember, I said mention...
[13:55.380 --> 13:56.040]  Look at the dates.
[13:57.620 --> 13:59.880]  Cryptogram newsletter was September 30th, 2001.
[14:00.060 --> 14:01.120]  A month after the report.
[14:02.460 --> 14:05.360]  New scientists reported in September 25th...
[14:06.080 --> 14:09.820]  This was the only article that the reality got.
[14:09.980 --> 14:11.660]  It was the only press that the reality got.
[14:12.200 --> 14:15.680]  So, the hype got at least these three, right?
[14:15.760 --> 14:17.140]  And probably a dozen more.
[14:17.700 --> 14:21.020]  The reality got two or one, right?
[14:22.660 --> 14:27.800]  Sort of reinforces the idea that, you know, hype lives forever and reality dies quick.
[14:28.360 --> 14:31.020]  But this story didn't die then.
[14:31.020 --> 14:32.020]  It lived on.
[14:32.100 --> 14:33.680]  And I don't understand this next part.
[14:33.920 --> 14:46.960]  In 2012, in March this year, there was a reporter in Germany who claimed to have seen documents indicating that Al-Qaeda had been using steganography inside a video, right?
[14:47.720 --> 14:56.680]  And that there was over a hundred documents found in this video that detailed all kinds of attacks, cruise ship attacks, city rampages, etc.
[14:57.460 --> 14:59.400]  But there's no source for this story.
[14:59.620 --> 15:05.780]  The only source is this reporter, and I use the term reporter, who actually saw the documents.
[15:06.060 --> 15:07.440]  He didn't have any government sources.
[15:07.460 --> 15:08.960]  He didn't quote anybody else.
[15:08.960 --> 15:16.080]  He's just like, oh, I saw these documents, and they were, you know, the steganography, Al-Qaeda, terrorists, world's gonna end, blah, blah, blah.
[15:17.640 --> 15:20.320]  CNN doesn't report on the story for a month and a half later.
[15:20.500 --> 15:21.980]  I don't know why it took him so long.
[15:22.680 --> 15:25.980]  It sounds like a pretty sensationalist story, which is right up CNN's alley.
[15:27.620 --> 15:34.880]  And again, when Bin Laden was captured, he was captured with a lot of porn, if everybody remembers the news reports, right?
[15:36.020 --> 15:46.140]  And you would think that if they were using steganography, that the head guy in charge of Al-Qaeda would have some images of his porn with steganography in it, right?
[15:46.260 --> 15:49.820]  But there was no reports that there was any steganography found in any of his porn.
[15:49.900 --> 15:51.380]  Maybe there was, and it didn't make it into the press.
[15:51.540 --> 15:52.820]  Maybe this reporter found it.
[15:53.500 --> 15:54.060]  I don't know.
[15:54.140 --> 16:00.180]  There's not enough information here to determine what the hell actually happened and what's the reality and what is the hype.
[16:02.740 --> 16:03.940]  I don't know.
[16:03.940 --> 16:04.160]  Where am I?
[16:05.120 --> 16:05.840]  All right.
[16:06.720 --> 16:08.300]  Another great story.
[16:08.600 --> 16:09.600]  This one...
[16:09.600 --> 16:10.820]  I hate this one.
[16:11.360 --> 16:11.600]  All right.
[16:12.800 --> 16:19.100]  60 Minutes did a huge story on this blackout that happened in Brazil, right?
[16:21.440 --> 16:27.380]  60 Minutes claims that they had a half a dozen sources in the military intelligence and private security communities.
[16:28.040 --> 16:31.460]  Now, a lot of people complain about the echo chamber in InfoSec.
[16:31.580 --> 16:33.100]  We're all just kind of talking to ourselves, right?
[16:34.460 --> 16:38.680]  If you want to see a bigger echo chamber, go look at the intelligence community.
[16:38.940 --> 16:41.220]  These guys do nothing but talk to themselves, right?
[16:42.880 --> 16:47.240]  60 Minutes never named any of their sources, but they claimed they had half a dozen of them.
[16:47.240 --> 16:56.120]  And according to the 60 Minutes report, basically hackers broke into the power company in Brazil and caused this big massive blackout.
[16:58.520 --> 16:59.720]  So, reality.
[17:00.300 --> 17:02.560]  Now, remember, again, look at the dates.
[17:02.560 --> 17:05.280]  The first Wired report was October 28th.
[17:05.460 --> 17:08.240]  The 60 Minutes report was November 8th of 2009.
[17:10.300 --> 17:18.680]  And then in November 9th, right, of 2009, Wired reports that the blackout was traced to sooty insulators, not hackers.
[17:20.580 --> 17:28.800]  Brazil's Independent System Operator Group later confirmed that the failure of the 345 kilovolt line was provoked by pollution in the chain of insulators due to deposits or soot.
[17:29.740 --> 17:37.920]  But, I mean, it was so apparent that this is what happened, that the national agency in Brazil that regulates power companies fined this power company $327 million.
[17:38.500 --> 17:39.300]  It's a pretty big fine.
[17:39.440 --> 17:42.040]  I mean, they fined them in reals, but...
[17:44.180 --> 17:45.060]  It's still...
[17:45.060 --> 17:48.200]  Even after this came out, CNN would not issue...
[17:48.200 --> 17:54.420]  I mean, 60 Minutes would not issue a retraction for their story about it being caused by hackers.
[17:54.900 --> 18:00.040]  Because they stood by their half a dozen sources in the intelligence community.
[18:02.060 --> 18:04.680]  Now, I kind of got an idea of how this sort of happened.
[18:05.060 --> 18:08.580]  There was probably one guy who was in a room with a bunch of other folks.
[18:08.960 --> 18:12.300]  And they were probably, you know, having coffee in their donuts or whatever.
[18:12.620 --> 18:14.860]  And I was like, hey, remember that Brazil blackout?
[18:14.980 --> 18:16.180]  You know, I wonder if hackers did that.
[18:17.140 --> 18:19.460]  And then it went from that to, oh, hackers did do it.
[18:19.880 --> 18:20.080]  Right?
[18:21.200 --> 18:25.340]  And then it got reported, repeated and repeated and repeated inside their echo chamber.
[18:25.480 --> 18:26.960]  And then it got leaked out to 60 Minutes.
[18:27.000 --> 18:29.000]  And 60 Minutes stood by it and never...
[18:29.000 --> 18:35.500]  Even though you have this report from the National Agency for Electric Energy in Brazil, 60 Minutes are like, no, we have our sources.
[18:35.700 --> 18:36.680]  We're going to stick by those.
[18:38.060 --> 18:38.540]  All right.
[18:40.020 --> 18:41.060]  How am I doing on time?
[18:41.240 --> 18:42.780]  Whoa, I'm burning through these slides.
[18:44.740 --> 18:45.300]  All right.
[18:45.500 --> 18:46.380]  This next one's kind of funny.
[18:47.020 --> 18:48.580]  A Twitter hacker shot my wiener.
[18:48.660 --> 18:50.380]  I think I put this in here just because I want to say wiener.
[18:52.480 --> 18:53.660]  I don't know if everybody remember.
[18:54.180 --> 18:55.540]  This guy's from New York, I think.
[18:55.680 --> 18:56.500]  Representative Wiener.
[18:57.860 --> 19:02.600]  He evidently had some pictures, naked pictures of himself posted to his Twitter account.
[19:03.660 --> 19:05.800]  And he blamed the hacker right away.
[19:06.020 --> 19:06.100]  Right?
[19:06.240 --> 19:07.800]  Computer hacker had apparently had...
[19:07.800 --> 19:12.040]  It's interesting to see the words that these guys, that the press uses on stories like this.
[19:14.300 --> 19:18.940]  NBC said right away, Representative Wiener's hacked Twitter account.
[19:19.100 --> 19:19.180]  Right?
[19:19.780 --> 19:23.260]  Reuters says it's an alleged Twitter hacking.
[19:23.500 --> 19:25.700]  And then Huffington Post says it's an alleged Twitter hack too.
[19:25.940 --> 19:26.040]  Right?
[19:26.860 --> 19:32.320]  It's interesting though, if my Twitter account is hacked, why am I hiring a lawyer first?
[19:32.800 --> 19:33.420]  You know?
[19:33.540 --> 19:34.720]  Wouldn't I call the cops or something?
[19:36.780 --> 19:40.240]  But no, Wiener had to hire a lawyer.
[19:40.380 --> 19:44.260]  Which kind of is the first tip off that, you know, maybe this isn't really a hacking incident.
[19:45.700 --> 19:54.640]  So the reality was, of course, like three days later, he publicly lied about a photo of himself sent over Twitter to a college student in Seattle.
[19:54.640 --> 19:56.160]  I take full responsibility.
[19:56.160 --> 19:57.860]  The picture was of me and I sent it.
[19:58.120 --> 19:59.260]  So it wasn't a hacker after all.
[20:00.080 --> 20:10.000]  But I put this example in here because it's one of many, many examples involving celebrities or quasi-celebrities, especially in their social media accounts.
[20:10.140 --> 20:10.200]  Right?
[20:11.460 --> 20:16.340]  Haley Williams claimed that she was hacked after she tweeted a topless picture of herself.
[20:16.980 --> 20:18.700]  Paul Pierce of the Boston Celtics.
[20:18.760 --> 20:20.900]  He blamed hackers after a tweet calling for a broom.
[20:21.200 --> 20:23.340]  Showed up in his Twitter stream.
[20:24.240 --> 20:24.720]  All right?
[20:24.860 --> 20:28.740]  The broom content, of course, being in reference to sweeping the Orlando magic.
[20:29.660 --> 20:31.500]  Jay Berg Gaffney of the Washington Redskins.
[20:32.800 --> 20:36.380]  Evidently, he tweeted a series of profane tweets about his wife and other family members.
[20:36.560 --> 20:40.540]  And then later said that his account was hacked and it wasn't him after all.
[20:41.880 --> 20:44.160]  So this sort of thing happens a lot.
[20:44.160 --> 20:47.620]  People say things that they didn't mean to, especially in social media, especially celebrities.
[20:47.920 --> 20:49.400]  And they say, oh, it was hackers.
[20:49.680 --> 20:49.780]  Right?
[20:54.250 --> 20:55.590]  Especially if you watch TMZ.
[20:55.710 --> 20:56.830]  You see these stories all the time.
[20:58.030 --> 20:58.650]  What's next?
[20:58.790 --> 20:59.830]  Another satellite hack.
[21:00.110 --> 21:01.570]  This one happened fairly recently.
[21:02.670 --> 21:04.210]  October 27, 2011.
[21:05.950 --> 21:09.250]  Chinese military suspected in hacker attacks on U.S.
[21:09.370 --> 21:09.770]  satellites.
[21:10.170 --> 21:11.290]  Pretty severe stuff.
[21:11.950 --> 21:15.890]  Computer hackers possibly from the Chinese military interfered.
[21:15.890 --> 21:17.430]  What the f*ck does interfered mean?
[21:18.110 --> 21:19.050]  With two U.S.
[21:19.110 --> 21:25.190]  government satellites four times in 2007 and 2008 through a ground station in Norway, according to Congressional Commission.
[21:25.910 --> 21:28.910]  May have used an Internet connection at the salvage bad...
[21:28.910 --> 21:29.670]  I can't pronounce that.
[21:29.810 --> 21:29.910]  Sorry.
[21:30.070 --> 21:31.850]  Satellite station in Spitsburg, Norway.
[21:33.110 --> 21:40.730]  Business Week, when they reported on this, they referenced a draft report from the U.S.-China Economic and Security Review Commission.
[21:41.090 --> 21:42.150]  Who the f*ck are they?
[21:42.390 --> 21:42.430]  Right?
[21:43.230 --> 21:43.730]  I don't...
[21:43.730 --> 21:45.610]  Like, this is a big, massive story.
[21:45.770 --> 21:46.410]  This is important.
[21:46.470 --> 21:49.930]  If this actually happened, why is this no-name agency reporting on it?
[21:50.170 --> 21:51.250]  That's my first question.
[21:51.550 --> 21:54.630]  My second question is, I'm looking at, what does it interfered with mean?
[21:55.050 --> 21:56.590]  And how do you come up with may have?
[21:56.750 --> 21:57.830]  Like, don't you have proof?
[21:58.190 --> 21:59.190]  Did it happen or didn't it?
[22:00.470 --> 22:06.090]  And then if you do a little research, even basic research, the Salisbury Satellite Station is a commercial station.
[22:06.330 --> 22:06.790]  All right?
[22:06.870 --> 22:07.970]  It's not a government station.
[22:08.090 --> 22:10.530]  It's a commercial station that controls commercial satellites.
[22:11.310 --> 22:14.190]  As well as probably outsourced to some government satellites as well.
[22:14.370 --> 22:21.430]  But if I'm a commercial entity and somebody's blaming me for being hacked, I'm going to come out and say something one way or the other.
[22:21.570 --> 22:21.750]  Right?
[22:21.890 --> 22:23.410]  I'm like, no, no, we weren't.
[22:23.490 --> 22:25.970]  Or, yeah, we were and we're taking steps to do it.
[22:25.970 --> 22:26.130]  Right?
[22:26.330 --> 22:30.110]  Because either way, it's not good for your business.
[22:30.670 --> 22:31.070]  Right?
[22:31.150 --> 22:35.130]  Nobody's going to put your satellite with your station if you're getting hacked all the time.
[22:35.250 --> 22:35.330]  Right?
[22:36.510 --> 22:38.030]  These guys had no comment whatsoever.
[22:38.130 --> 22:42.030]  And nobody bothered to call them and say, hey, what the hell's going on?
[22:42.110 --> 22:45.510]  What's up with this report from the U.S.-China Economic and Security Review Commission?
[22:45.910 --> 22:47.190]  You know, did this really happen?
[22:47.390 --> 22:48.290]  Do you guys have any comment?
[22:49.350 --> 22:53.170]  Business Week never bothered to call them at all and get any code of confirmation whatsoever.
[22:57.180 --> 22:59.020]  And I've totally missed this spot.
[22:59.160 --> 23:05.360]  By the time the U.S.-China Economic and Security Review Commission put this in the report, the event was supposedly three years old.
[23:05.880 --> 23:08.920]  Like it happened three years before and nobody said anything about it.
[23:11.000 --> 23:11.940]  The reality.
[23:13.100 --> 23:15.380]  Now, look, here we've got Business Week, right?
[23:15.480 --> 23:17.540]  Pretty established media outlet.
[23:17.800 --> 23:20.420]  The reality comes out in NASA Watch, a blog post.
[23:21.720 --> 23:23.780]  NASA experienced two suspicious events.
[23:23.900 --> 23:25.540]  What the hell is a suspicious event?
[23:25.820 --> 23:28.420]  With a terrorist spacecraft in the summer and fall of 2008.
[23:28.600 --> 23:33.420]  There was no manipulation of data, no commands successfully sent to the satellite, and no data captured.
[23:33.560 --> 23:34.560]  So what the f*ck happened?
[23:35.320 --> 23:35.540]  Right?
[23:36.640 --> 23:39.300]  And then, of course, China denied it, obviously.
[23:39.300 --> 23:47.100]  And unfortunately, because they get blamed for so much stuff and they deny it all, you can't really add or detract based on what they say.
[23:48.840 --> 23:51.280]  But it's interesting that they came up with their denial.
[23:51.780 --> 23:54.080]  And so here we have the hype, right?
[23:54.300 --> 23:55.140]  Here we have the reality.
[23:55.140 --> 23:56.180]  I still don't know what the hell happened.
[23:57.060 --> 23:57.780]  No idea.
[23:59.440 --> 24:01.860]  This next example, though, we do know what happened.
[24:02.000 --> 24:02.700]  At least we think we do.
[24:03.180 --> 24:04.180]  Illinois' water utility.
[24:04.320 --> 24:06.400]  Again, a fairly recent one happened last November.
[24:08.020 --> 24:15.580]  So basically, in a small water utility outside of Chicago, a pump failed.
[24:16.680 --> 24:20.580]  And for some reason, they had to call in Homeland Security.
[24:21.860 --> 24:24.020]  You know, if my pump fails, I don't call in Homeland Security.
[24:28.400 --> 24:29.920]  Yeah, I don't think they're going to show up.
[24:30.760 --> 24:32.200]  Hey, can you come fix my water pump?
[24:32.400 --> 24:33.580]  I think hackers did it.
[24:38.740 --> 24:42.780]  So I think the best title of any of the media reports that I saw was, of course, the wired one.
[24:42.880 --> 24:45.380]  Hackers 2-0, Attack City Water Station Destroys Pump.
[24:45.920 --> 24:46.120]  Right?
[24:46.800 --> 24:49.860]  And again, Krebs on Security, fairly reliable source, right?
[24:50.280 --> 24:52.900]  Cyber intrusion, blamed for hardware failure, water pump.
[24:52.900 --> 24:58.480]  At least Krebs put the blamed part in his title and he didn't automatically assume, you know, it was the bad guys.
[24:58.700 --> 24:59.920]  Had bad guys being hackers.
[25:00.140 --> 25:03.860]  The interesting part about this story is that even in the hype, right?
[25:05.200 --> 25:08.000]  They are already disproving their articles in the hype.
[25:08.180 --> 25:09.620]  They already know it didn't happen.
[25:09.960 --> 25:12.780]  All the way down at the bottom of the article in the threat level report.
[25:13.980 --> 25:18.620]  Threat level was unable to reach anyone at the utility company Thursday night to confirm the breach.
[25:19.760 --> 25:22.640]  DHS spokesman Peter Beauregard, they actually have a name source, right?
[25:23.100 --> 25:29.340]  At this time, there's no credible corroborated data that indicates a risk to critical infrastructure entities or a threat to public safety.
[25:29.480 --> 25:32.500]  So they have two bits of information that say this never happened.
[25:33.480 --> 25:36.080]  Or at least one bit of information and then no confirmation.
[25:37.700 --> 25:46.260]  The actual source for the story, and I'm not going to mention his name because he's fairly respected, is a respected security guy.
[25:47.240 --> 25:49.380]  Actually, I don't have it in my notes so I can't mention it anyway.
[25:51.900 --> 25:53.080]  But he's a fairly respected guy.
[25:53.200 --> 25:55.720]  That's probably why I didn't put it in there because I want to give him a column out.
[25:56.780 --> 26:00.820]  So he has a copy of a draft report from a fusion center.
[26:00.960 --> 26:08.860]  A fusion center is sort of a civilian government corroboration between Homeland Security and civilian law enforcement.
[26:09.060 --> 26:18.980]  So he has a draft report from this fusion center that basically said hackers broke into the Illinois water plant and destroyed this pump.
[26:19.460 --> 26:22.540]  And so he's talking to Wired, Kim Zetter at Wired.
[26:23.000 --> 26:26.680]  And I'm talking to Kim and I immediately call bullshit on this story when I see it.
[26:26.720 --> 26:29.900]  I'm like, there's no way to verify this story.
[26:29.960 --> 26:31.800]  All it says is a computer security expert, right?
[26:32.680 --> 26:36.080]  And I'm talking to Kim and I'm like, why are you printing this crappy story?
[26:36.120 --> 26:36.840]  You have no proof.
[26:36.940 --> 26:38.400]  He's like, oh, so-and-so said it.
[26:38.480 --> 26:39.600]  He's a reliable source.
[26:39.800 --> 26:41.680]  I'm like, he is not your source, right?
[26:41.820 --> 26:48.100]  This unreleased report that he's quoting from and he won't show you, that's your source and you don't even have access to the primary information.
[26:49.600 --> 26:51.060]  And I don't think she got it.
[26:51.120 --> 26:51.460]  I don't know.
[26:51.740 --> 26:57.620]  And I hate to, you know, rag on Kim because she's actually pretty good at what she does usually, except for this story.
[26:59.480 --> 27:13.260]  So the reality, basically, there was a consultant who used to work at the plant, who was on vacation in Russia, who still had remote access and remoted access back in while he was on vacation in Russia.
[27:13.760 --> 27:19.540]  So the IP addresses from Russia show up in the report and everybody freaks out, right?
[27:20.080 --> 27:25.500]  Nobody bothered to call this guy and say, hey, you know, your login was used on the Illinois water.
[27:25.640 --> 27:27.720]  Did you happen to log in while you were on vacation?
[27:28.240 --> 27:29.040]  Nobody called them.
[27:29.320 --> 27:32.980]  They just immediately assumed, oh, IPs in Russia must be hackers, right?
[27:33.560 --> 27:41.380]  Now, I don't want to... I'm not even going to go into the whole point of why you have a contractor who still has remote access and who is allowed to access in from outside the country.
[27:41.540 --> 27:42.680]  That's a whole other story.
[27:43.960 --> 27:45.620]  Yeah, there's a bunch of fail here.
[27:49.480 --> 27:50.020]  All right.
[27:51.720 --> 27:52.240]  All right.
[27:53.420 --> 27:54.260]  This one...
[27:55.260 --> 27:56.760]  This example is just kind of weird.
[27:57.660 --> 28:06.700]  So there was a report, again, here we have a TSA memo in this case, instead of an unreleased Fusion Center report, that an attack was executed on a Northwest Rail Company.
[28:06.700 --> 28:08.800]  They don't actually name which railroad company.
[28:09.420 --> 28:12.740]  That disrupted railway signals for two days in December.
[28:13.000 --> 28:14.880]  I don't know what that means, disrupted signals.
[28:15.200 --> 28:17.780]  Okay, so here we go again with this interference word, right?
[28:18.420 --> 28:21.540]  Rail schedules were delayed for 15 minutes after the interference.
[28:23.120 --> 28:27.040]  And this was the TSA memo from a summary of a December 20th meeting.
[28:31.420 --> 28:35.180]  Infosecurity.com, Pacific Northwest train signals disrupted by hackers, says TSA.
[28:35.460 --> 28:42.780]  So you have a memo from a meeting that immediately goes into this massive attack confirmed by the TSA.
[28:42.980 --> 28:45.460]  Interesting how that goes around like that.
[28:46.360 --> 28:50.800]  The reality was there was no targeted computer-based attack on a railroad.
[28:51.680 --> 28:54.680]  The memo on the story was based on numerous inaccuracies.
[28:54.980 --> 28:57.460]  What the hell does... what does that mean, no targeted attack?
[28:57.460 --> 28:59.100]  Was there an untargeted attack?
[29:00.140 --> 29:03.980]  These qualifying statements that don't actually get defined really upset me.
[29:04.620 --> 29:06.400]  I still don't know what the hell happened here.
[29:07.000 --> 29:08.900]  There's nobody on the record saying anything.
[29:09.520 --> 29:12.880]  And so maybe it wasn't a targeted attack.
[29:13.040 --> 29:13.900]  Maybe it was just malware.
[29:14.040 --> 29:14.700]  Who knows, right?
[29:15.060 --> 29:15.540]  Yeah.
[29:15.680 --> 29:18.460]  Could have been weather.
[29:19.360 --> 29:19.900]  Yeah, I don't know.
[29:20.060 --> 29:20.680]  Therefore, malware.
[29:21.340 --> 29:21.820]  Right?
[29:23.620 --> 29:25.360]  And we'll come into that again in a second.
[29:26.040 --> 29:28.620]  Don't forget that guy.
[29:30.260 --> 29:31.280]  What's this next one?
[29:31.640 --> 29:32.880]  Oh, this was interesting.
[29:33.820 --> 29:34.180]  Oh, yeah.
[29:34.400 --> 29:34.680]  Okay.
[29:34.740 --> 29:35.160]  I'm doing all right.
[29:36.460 --> 29:39.840]  So Hillary Clinton came out in 2012.
[29:40.980 --> 29:41.680]  U.S.
[29:41.760 --> 29:43.520]  hacked Yemen Al Qaeda sites.
[29:45.820 --> 29:46.740]  A top U.S.
[29:46.780 --> 29:48.860]  official has explicitly acknowledged that the U.S.
[29:48.940 --> 29:52.480]  government hacked into websites run by Al Qaeda's affiliate in Yemen.
[29:55.620 --> 30:02.600]  Secretary of State Hillary Rodham Clinton says cyber experts based at the State Department hacked Yemeni tribal websites.
[30:03.240 --> 30:04.780]  This is pretty big news, right?
[30:04.840 --> 30:09.480]  This is an official admission by a senior government official that the U.S.
[30:09.580 --> 30:11.800]  government does offensive cyber attacks.
[30:12.720 --> 30:17.440]  That's probably not as big a news as it was, you know, back in May, but it's still pretty big news, right?
[30:18.980 --> 30:20.240]  Especially because the U.S.
[30:20.320 --> 30:23.800]  now considers a cyber attack as an act of war, right?
[30:23.900 --> 30:26.720]  And has reserved the right to retaliate with the traditional weapons.
[30:27.220 --> 30:30.520]  So does this mean that Yemen can now bomb us because we cyber attack them?
[30:32.000 --> 30:33.080]  Yeah, interesting question.
[30:33.820 --> 30:37.820]  Reality was that the remarks were made at the Special Operations...
[30:37.820 --> 30:40.340]  Later on, she says, this is the actual remarks.
[30:41.880 --> 30:45.360]  Our team plastered the same sites with altered versions of the ads.
[30:46.880 --> 30:51.080]  So basically, they broke into a web forum or made...
[30:51.960 --> 30:57.720]  So this is the actual remarks that she made at the Special Operations Command gala dinner.
[30:57.720 --> 31:00.480]  Those remarks resulted in these news stories.
[31:01.380 --> 31:03.260]  So they changed some ads.
[31:03.840 --> 31:05.460]  Or maybe they bought the ads.
[31:07.560 --> 31:10.600]  So they went from buying ads to hacking websites.
[31:14.390 --> 31:15.250]  Yeah, exactly.
[31:15.450 --> 31:16.230]  Very broad definition.
[31:17.410 --> 31:21.750]  So the Washington Post, a previous version incorrectly said that cyber expert had hacked into Al-Qaeda states.
[31:21.950 --> 31:23.430]  They did not engage in hacking.
[31:23.630 --> 31:24.870]  No, they did an ad buy.
[31:28.530 --> 31:29.070]  Yeah.
[31:29.650 --> 31:34.250]  A couple of more recent examples that I didn't actually have time to make slides for.
[31:35.350 --> 31:38.050]  Article on Ars Technica about a cyber gang war.
[31:38.650 --> 31:41.330]  A couple of defacements between Israel and Pakistan.
[31:41.590 --> 31:43.810]  I don't know how that comes out to a gang war on the Internet.
[31:45.150 --> 31:48.930]  Anonymous just deleted cbs.com and took down Universal.
[31:50.730 --> 31:52.870]  Okay, CBS is not a small website.
[31:53.990 --> 31:56.170]  If you're deleting it, it's going to take a little bit.
[31:56.450 --> 31:56.910]  All right?
[31:57.990 --> 32:01.510]  I mean, it takes like a minute for me to delete my latest movie that I downloaded.
[32:02.050 --> 32:09.830]  If I had all of cbs.com spread over multiple servers and probably multiple data centers across the country, it's going to take a little bit to delete it.
[32:10.930 --> 32:15.070]  I think what ended up happening was it was a DNS poisoning, what have you.
[32:15.070 --> 32:18.090]  And the CBS article, of course, has no quotes from CBS or Universal.
[32:19.590 --> 32:20.030]  None.
[32:20.290 --> 32:21.130]  There's no verification.
[32:21.370 --> 32:24.270]  They just typed in cbs.com and got no page.
[32:24.350 --> 32:26.270]  It says, oh, Anonymous must have deleted it.
[32:30.440 --> 32:31.220]  There you go.
[32:31.420 --> 32:32.200]  Whole site's down.
[32:34.000 --> 32:35.400]  Two other recent stories.
[32:36.340 --> 32:39.700]  The air raid siren story was mentioned in the last talk or yesterday, I think.
[32:39.840 --> 32:40.700]  I heard it here before.
[32:40.700 --> 32:43.060]  And again, there was a...
[32:43.060 --> 32:44.480]  I don't know why it's in Illinois.
[32:44.660 --> 32:45.700]  A lot of stuff happens in Illinois.
[32:46.800 --> 32:47.800]  Nothing to do there.
[32:47.900 --> 32:48.700]  Nothing to do there.
[32:50.080 --> 32:51.240]  Isn't Chicago in Illinois?
[32:51.400 --> 32:51.660]  I don't know.
[32:52.080 --> 32:54.460]  So the air raid sirens go off in this small town.
[32:55.060 --> 32:56.380]  Nobody knows how the hell that happened.
[32:57.780 --> 33:00.640]  And the cops quoted as saying, we don't know what happened.
[33:00.760 --> 33:01.580]  We think we got hacked.
[33:01.960 --> 33:02.280]  Great.
[33:02.820 --> 33:03.040]  Yeah.
[33:03.240 --> 33:06.900]  What they said was that there was no evidence of mechanical failure.
[33:07.080 --> 33:08.720]  And therefore, we believe they had been hacked.
[33:08.820 --> 33:09.000]  Right.
[33:10.340 --> 33:11.980]  It couldn't have been an electronic failure.
[33:12.120 --> 33:13.360]  They just said there was no mechanical failure.
[33:14.040 --> 33:14.360]  Therefore...
[33:14.840 --> 33:17.240]  I think the quote was, nobody else can get into our systems.
[33:17.440 --> 33:18.600]  Or something to that effect.
[33:21.560 --> 33:21.960]  All right.
[33:22.060 --> 33:22.800]  And there was one story...
[33:22.800 --> 33:24.560]  Everybody saw the San Diego fireworks video?
[33:24.820 --> 33:26.100]  All the fireworks blew up at once?
[33:27.660 --> 33:30.920]  I don't know if there's actually been a post-mortem done on that as to what exactly happened.
[33:30.940 --> 33:33.760]  But there was one news article that said it was a virus.
[33:35.280 --> 33:38.740]  I don't know if he actually quoted anybody or if he just made that up when he wrote the article.
[33:39.200 --> 33:40.300]  I had no idea.
[33:41.100 --> 33:41.900]  The contractor...
[33:41.900 --> 33:42.000]  The contractor...
[33:42.000 --> 33:42.980]  It was New Jersey contractor.
[33:43.220 --> 33:45.740]  They admitted that they'd send it all fire demand.
[33:47.420 --> 33:47.980]  That's good.
[33:48.200 --> 33:48.480]  Yeah.
[33:48.720 --> 33:48.960]  Okay.
[33:49.000 --> 33:49.420]  That's fine.
[33:49.520 --> 33:50.180]  I can accept that.
[33:50.200 --> 33:51.820]  That was after the media reported...
[33:52.440 --> 33:52.840]  Yeah.
[33:53.040 --> 33:53.520]  So, yeah.
[33:53.520 --> 33:54.180]  I saw one report.
[33:54.260 --> 33:55.060]  Oh, maybe it was a virus.
[33:55.160 --> 33:57.000]  I'm like, where the hell are you getting this from?
[33:57.440 --> 34:00.100]  Like, are you just making this up by pulling it out of your ass or what?
[34:02.160 --> 34:03.360]  I need to get page views.
[34:03.360 --> 34:04.560]  I'll put the word virus in.
[34:05.740 --> 34:06.200]  All right.
[34:06.440 --> 34:07.300]  Where am I on time?
[34:07.520 --> 34:07.720]  Okay.
[34:07.840 --> 34:07.920]  Good.
[34:08.900 --> 34:13.860]  All these examples that I've shown you so far are sort of...
[34:13.860 --> 34:15.740]  I don't want to say malicious examples.
[34:15.880 --> 34:16.400]  They're sort of...
[34:17.200 --> 34:22.320]  They're sort of malicious, but they're more accidental and more like, I need page views, so I'm going to hype this story up a little bit.
[34:23.560 --> 34:26.760]  This next example is sort of the actual opposite of that.
[34:26.760 --> 34:30.680]  The reporter actually went out and tried to create hype on purpose.
[34:31.260 --> 34:31.820]  All right.
[34:31.900 --> 34:33.080]  And some of you may remember this.
[34:33.260 --> 34:37.360]  The Michelle Madigan affair at DEFCON, DEFCON 15, I think.
[34:37.800 --> 34:40.580]  She was a producer for NBC Universal and Dateline.
[34:40.740 --> 34:45.040]  Remember, Dateline is famous for the To Catch a Predator series, which is about as hyped up as you can get.
[34:47.300 --> 34:53.900]  She wanted to go to DEFCON to portray the criminal hacker underground because all the criminals go to DEFCON.
[34:55.400 --> 34:58.260]  People in Kansas would be very interested in what is going on at DEFCON.
[34:58.560 --> 35:09.360]  Now, her plan was to get either an undercover federal agent to admit that he was an undercover federal agent at DEFCON or to get people to admit that they had committed crimes on camera.
[35:09.980 --> 35:11.080]  That was her plan.
[35:11.260 --> 35:12.540]  That's why she went there.
[35:14.800 --> 35:16.760]  She was at DEFCON 15 in 2007.
[35:16.760 --> 35:18.240]  She did not get press credentials.
[35:18.460 --> 35:19.980]  She went as a human.
[35:19.980 --> 35:20.660]  Right?
[35:22.920 --> 35:24.860]  Well, that's how DEFCON has the badges.
[35:25.100 --> 35:26.800]  Human, goon, press, whatever.
[35:27.280 --> 35:28.440]  And normal people get humans.
[35:30.580 --> 35:33.100]  DEFCON has very, very strict press rules.
[35:33.540 --> 35:35.780]  I ran the press room there one year.
[35:36.060 --> 35:42.420]  And it's very important that media identify themselves as media and wear a press badge at all times.
[35:42.420 --> 35:48.200]  Now, I know journalists that go to DEFCON as humans all the time.
[35:49.040 --> 35:52.580]  For some reason, they feel that people will talk to them more if they don't have a press badge on.
[35:52.720 --> 35:52.780]  Right?
[35:53.340 --> 35:53.980]  And that's fine.
[35:54.080 --> 35:54.920]  I don't have any problem with that.
[35:55.120 --> 35:57.540]  They usually identify themselves as the people they're talking to.
[35:58.680 --> 36:01.300]  And they're human as well as press, so they can go as human.
[36:02.340 --> 36:05.560]  But in this case, somebody at Dateline...
[36:06.320 --> 36:14.140]  Actually, the story is that somebody at Dateline ratted out Michelle to the DEFCON organizers and told them what was going on.
[36:15.560 --> 36:18.620]  So, Jeff and the other goons, they went up to her and said, Look, we know your press.
[36:18.680 --> 36:20.380]  We know you're here to do a sensational story.
[36:20.560 --> 36:22.140]  We really want you to register as press.
[36:22.360 --> 36:22.680]  Right?
[36:22.700 --> 36:23.880]  We would like you to get press credentials.
[36:24.520 --> 36:25.520]  And she refused.
[36:26.540 --> 36:29.060]  Supposedly, she was asked numerous times to get press credentials.
[36:32.240 --> 36:35.440]  So, she's sitting in one of the talks.
[36:35.580 --> 36:40.260]  And Jeff Moss, the head guy at DEFCON, gets up on stage and says, You know, we have a special guest here.
[36:40.820 --> 36:42.260]  She's here to do a sensationalist story.
[36:42.460 --> 36:43.420]  It's Michelle Madigan.
[36:43.460 --> 36:44.100]  She's sitting right here.
[36:44.600 --> 36:46.660]  And then she just turns all red and runs out of the room.
[36:48.760 --> 36:50.480]  Probably not the best way to handle that.
[36:51.200 --> 36:56.020]  So, of course, she was chased out of the con by all the other reporters, like, Oh my God, what's going on?
[36:58.980 --> 37:02.320]  And this is a picture of her actually running out of the con to get to her car.
[37:02.480 --> 37:03.980]  There's actually a video of it if you look on YouTube.
[37:05.100 --> 37:07.220]  And it's like, you know, all the reporters are running after her.
[37:07.340 --> 37:08.520]  Like, Michelle, what do you have to say?
[37:08.580 --> 37:09.160]  And she's just running.
[37:09.340 --> 37:11.700]  You know, like she would do to somebody else.
[37:11.860 --> 37:11.920]  Right?
[37:12.400 --> 37:13.320]  She became the story.
[37:13.560 --> 37:14.600]  She became the story.
[37:15.620 --> 37:15.900]  Exactly.
[37:16.560 --> 37:19.240]  I mean, she could have just stood up and said, Yeah, okay, I'm press.
[37:19.380 --> 37:20.040]  Here, give me a badge.
[37:20.480 --> 37:21.040]  I'm outed.
[37:21.160 --> 37:21.620]  You know, whatever.
[37:21.720 --> 37:22.400]  And then sat back down.
[37:22.480 --> 37:23.140]  It would have been all fine.
[37:23.140 --> 37:24.820]  But she didn't handle it very well.
[37:25.040 --> 37:28.640]  But the reason I bring this up, like I said, it's not an isolated case.
[37:29.420 --> 37:35.140]  There are at least two other reporters that I know that attend DEFCON regularly as humans, as opposed to press.
[37:38.240 --> 37:39.400]  So, it's just...
[37:39.400 --> 37:43.100]  The reason I bring this story up is because it reverses the role.
[37:43.360 --> 37:43.440]  Right?
[37:44.440 --> 37:45.640]  Previous to this, this...
[37:45.640 --> 37:48.560]  Previous to this, all the other examples are...
[37:48.560 --> 37:49.920]  Again, they don't...
[37:50.560 --> 37:51.680]  They don't come out...
[37:51.680 --> 37:53.080]  They don't start out to create the hype.
[37:53.180 --> 37:54.420]  That's not the purpose of the article.
[37:55.180 --> 37:56.640]  Other than to get page views, probably.
[37:56.920 --> 38:00.180]  In this case, she actually wanted to manufacture hype on purpose.
[38:00.180 --> 38:02.800]  So, I felt it was important to include her in here.
[38:03.560 --> 38:04.120]  Okay.
[38:05.720 --> 38:07.740]  This isn't a hyperreality story.
[38:08.040 --> 38:16.060]  There was an article in the New York Times-Center Review that tried to examine where all the cybercrime losses were going.
[38:16.520 --> 38:16.960]  Okay?
[38:17.660 --> 38:23.900]  Supposedly, there's an annual direct consumer loss of $114 billion worldwide related to cybercrime.
[38:23.900 --> 38:25.420]  That's a lot of freaking money.
[38:25.540 --> 38:26.760]  That's 114 Instagrams.
[38:32.040 --> 38:37.560]  Basically, what they found was that the estimates used to calculate cybercrime are based on very bad statistical methods.
[38:37.840 --> 38:42.940]  Basically, they used political polling methods and then extrapolated that information to get their total number.
[38:43.300 --> 38:44.580]  But when you're doing...
[38:44.580 --> 38:50.700]  When you do it that way, you give outliers a much higher weight in your data than they should have.
[38:50.940 --> 38:51.040]  Okay?
[38:52.100 --> 38:53.160]  And most of the...
[38:53.160 --> 38:58.440]  They found that most of the estimates for these cybercrime totals, these dollar amounts, come from basically two people.
[39:02.560 --> 39:05.300]  Most credit cards sold online are sold for pennies.
[39:05.820 --> 39:06.180]  Right?
[39:06.340 --> 39:09.280]  Your Track 2 data, your name and information, your credit card number.
[39:09.560 --> 39:12.720]  They're not sold for hundreds of billions of dollars.
[39:12.840 --> 39:16.600]  They're sold for pennies because it's very hard to monetize credit card information.
[39:17.480 --> 39:19.740]  And you don't see cybercrime billionaires out there.
[39:19.860 --> 39:25.240]  If there's $114 billion floating around, you'd figure there's at least one person who earned a billion.
[39:26.000 --> 39:28.860]  Otherwise, there's a hell of a lot of cybercriminals making pennies.
[39:29.660 --> 39:30.840]  And I don't know...
[39:30.840 --> 39:34.600]  There aren't really any companies that have lost billions due to cybercrime.
[39:34.840 --> 39:34.960]  Right?
[39:35.140 --> 39:36.680]  Where is all this money coming from?
[39:36.680 --> 39:39.200]  If there's $114 billion worth of loss.
[39:39.380 --> 39:45.440]  And I put this story in here because it's very factual, I want to say.
[39:45.760 --> 39:48.120]  Maybe not to be the right word, but it's very non-hype.
[39:48.180 --> 39:50.780]  And it pulls a lot of the hype out of a lot of the other stories that you read.
[39:50.920 --> 39:53.480]  And it helps put those things into an example.
[39:53.640 --> 40:02.920]  So the next time you read a story that says, oh, hackers cost this much money, cost us this much in losses, you know, maybe you can sort of take that with a grain of salt and say, well, maybe they didn't.
[40:04.720 --> 40:05.780]  How am I doing on time?
[40:05.780 --> 40:07.360]  I'm going too fast as usual.
[40:07.800 --> 40:07.940]  All right.
[40:08.440 --> 40:09.240]  Reality of hype.
[40:10.020 --> 40:16.420]  Hype does have one small benefit that I like to think of, is that it can be used to raise awareness.
[40:16.720 --> 40:17.080]  All right?
[40:17.340 --> 40:18.080]  People can...
[40:18.600 --> 40:23.620]  People who may not have normally paid attention to a story may pay attention to it because of the hype.
[40:23.940 --> 40:25.480]  And that may be a good thing.
[40:26.160 --> 40:28.980]  But there's a lot of bad things that happen because of hype.
[40:29.400 --> 40:29.640]  Right?
[40:29.860 --> 40:31.220]  You have the chicken little effect.
[40:31.480 --> 40:32.880]  Oh my God, the sky is falling.
[40:34.140 --> 40:35.000]  Not a good thing.
[40:35.000 --> 40:36.080]  The boy who cried wolf effect.
[40:36.260 --> 40:36.900]  Same idea.
[40:37.680 --> 40:39.500]  After you do it enough time, nobody's going to listen to you.
[40:40.900 --> 40:42.740]  Hype is used a lot by PR flax.
[40:43.040 --> 40:44.360]  If you're on in any...
[40:44.360 --> 40:55.940]  If you're in the infosec community and you work at a security company and you get email from press releases and stuff, it's like a big story breaks 20 minutes later, you get a press release from some other company saying, oh, we can solve that problem.
[40:55.940 --> 40:57.760]  We have the solution for you.
[40:59.140 --> 40:59.840]  Excuse me.
[41:01.180 --> 41:05.400]  Politicians use FUD and hype all the time to pass laws.
[41:05.680 --> 41:06.880]  And you'll see this all...
[41:06.880 --> 41:16.660]  As the budget review cycle comes around and there's a specific law on the floor that's getting ready to be passed, the hype machine starts ramping up.
[41:16.940 --> 41:18.560]  And you'll see all these stories come out.
[41:18.560 --> 41:23.120]  And you'll be like, why are suddenly we getting all these stories about this thing that nobody cares about?
[41:23.400 --> 41:27.120]  Well, it's because there's a new law that's going to get passed and they're trying to drum up support for it.
[41:27.700 --> 41:28.140]  All right.
[41:28.440 --> 41:30.120]  And of course, it makes us all look bad.
[41:30.580 --> 41:32.960]  It doesn't matter whether you're a hacker or a security professional or whatever.
[41:33.400 --> 41:34.840]  The hype just is...
[41:34.840 --> 41:36.520]  You know, we're going to cause the end of the world.
[41:36.780 --> 41:37.320]  It's not a good thing.
[41:41.700 --> 41:42.200]  All right.
[41:44.040 --> 41:44.640]  Identifying hype.
[41:45.680 --> 41:49.020]  Just because you see 100 versions of the same story doesn't mean it's true.
[41:49.920 --> 41:53.720]  And hype, this is very, very common because if it's a good...
[41:53.720 --> 41:57.960]  If it's well-hyped, if it's got a lot of good hype, it's going to get republished and republished and republished.
[41:58.060 --> 42:00.820]  And you're going to see it in every news outlet that exists.
[42:01.860 --> 42:03.160]  But don't believe...
[42:03.160 --> 42:05.520]  Just because it's published everywhere doesn't make it true.
[42:05.740 --> 42:07.240]  Just because you say it three times...
[42:07.240 --> 42:08.620]  It's an old Zanzibar reference.
[42:08.720 --> 42:13.180]  Anyway, look for named quotes in a story.
[42:13.360 --> 42:20.800]  If the story has no named quotes or named quotes that don't really matter or they aren't saying anything, it's a pretty good idea that there's a lot of hype involved.
[42:21.000 --> 42:21.140]  Okay?
[42:22.880 --> 42:24.340]  If there's no one to call...
[42:24.340 --> 42:27.920]  Like, if you had the ability to pick up the phone and call somebody and say, Hey, did this really happen?
[42:28.580 --> 42:30.720]  Then maybe that's not as hyped as you think it is.
[42:30.820 --> 42:33.380]  But if that's not there, then ask some questions.
[42:34.640 --> 42:36.460]  If it blames an unknown entity...
[42:36.980 --> 42:37.960]  You know, I don't know, maybe malware.
[42:38.600 --> 42:40.460]  Or China, or hackers, or whatever.
[42:42.320 --> 42:45.960]  Blames an entity that, again, you can't verify or can't speak out for themselves.
[42:47.840 --> 42:52.580]  Look for vague details, few facts, you know.
[42:54.000 --> 42:55.220]  Again, sensational claims.
[42:55.320 --> 42:56.160]  Hackers control satellites.
[42:56.260 --> 42:58.580]  Again, I see that story like every five years.
[42:58.780 --> 43:00.180]  I don't know why it keeps coming up.
[43:00.220 --> 43:01.640]  I guess it's very sensational.
[43:01.920 --> 43:04.820]  Oh my God, they're controlling the lasers above our heads.
[43:04.960 --> 43:05.680]  They're going to shoot us all.
[43:08.240 --> 43:14.500]  Just because you see a story on a trusted website doesn't mean that the story itself should be trusted.
[43:16.100 --> 43:19.240]  If you notice some of the sources that I quoted in here, we had Krebs on Security.
[43:19.400 --> 43:20.220]  We had the Schneier blog.
[43:20.460 --> 43:21.020]  I had Slashdot.
[43:21.260 --> 43:23.380]  Not that Slashdot is trusted, but...
[43:24.240 --> 43:33.960]  Just because it's on a popular site that you read every day, and you trust the person that's giving you that information, doesn't mean you shouldn't question the information based on where it's coming from.
[43:34.220 --> 43:35.100]  Question everything.
[43:36.380 --> 43:36.840]  All right.
[43:37.260 --> 43:38.380]  How not to be part of the hype.
[43:39.500 --> 43:53.900]  If you're talking to press or you're talking to reporters, and I think this was mentioned in the last talk as well, if you're in law enforcement or security professional or hacker, they're always looking for a good quote, especially somebody on video.
[43:55.120 --> 43:55.480]  Don't...
[43:55.480 --> 43:57.460]  If somebody just calls you up and says, hey, can you give me a quote for this story?
[43:57.860 --> 43:58.220]  Don't...
[43:58.220 --> 43:59.540]  Figure out who they are first.
[43:59.940 --> 44:00.300]  Right?
[44:00.360 --> 44:04.360]  Don't be talking to Corineen Azizo, who's never written an Infosec story before in his life.
[44:05.640 --> 44:06.680]  Get their name.
[44:07.040 --> 44:07.960]  Google their name.
[44:08.160 --> 44:09.420]  See what other stories they've written.
[44:09.700 --> 44:13.900]  If they've only written hype stories or they've never written Infosec stories, just say, no, thank you.
[44:13.980 --> 44:15.300]  You can talk to somebody else.
[44:15.700 --> 44:16.260]  All right?
[44:17.700 --> 44:21.560]  It's important to not be a part of the hype, I think.
[44:22.400 --> 44:25.540]  If you can't go on the record, then don't say anything.
[44:26.140 --> 44:30.240]  There's nothing worse than reading a quote from a hype-placed government official.
[44:31.240 --> 44:32.920]  That's no help to anybody.
[44:34.620 --> 44:38.860]  When you are talking to the reporter, be careful when you're making sensational statements.
[44:39.260 --> 44:39.380]  Okay?
[44:39.700 --> 44:43.400]  And especially, for example, the Illinois Water Department hack where the pump broke.
[44:44.080 --> 44:52.060]  There was one respected security researcher who just freaked out when he saw this report, called all the reporters he knew, and just started, you know, freaking out that the sky was falling.
[44:52.560 --> 44:53.400]  Don't be that guy.
[44:54.760 --> 45:00.380]  If you're a journalist, and if you're a journalist, I shouldn't have to tell you this, so if you're a reporter, verify your sources.
[45:00.860 --> 45:01.280]  All right?
[45:01.480 --> 45:03.180]  Don't just take any quote from anybody you get.
[45:03.420 --> 45:06.720]  Now, I know you can't always get somebody to go on the record.
[45:07.260 --> 45:07.680]  All right?
[45:07.820 --> 45:09.440]  Ask them why they can't go on the record.
[45:09.780 --> 45:10.180]  All right?
[45:10.260 --> 45:12.480]  Make sure that they're not just trying to plant a story for you.
[45:13.420 --> 45:15.200]  Find somebody else who will go on the record.
[45:15.540 --> 45:15.920]  All right?
[45:16.000 --> 45:19.440]  If it's a big enough story, you will find somebody who's willing to go on the record and give you a named quote.
[45:20.700 --> 45:24.960]  Ask yourself, as a reporter, is it better to be first, or is it better to be correct?
[45:25.820 --> 45:28.120]  I think we know the answer.
[45:28.200 --> 45:29.440]  Well, we know the answer.
[45:30.180 --> 45:31.180]  Reporters, I don't think, do.
[45:35.590 --> 45:36.270]  All right.
[45:36.310 --> 45:37.430]  Be a part of the reality.
[45:37.590 --> 45:39.450]  If you see something, say something.
[45:40.230 --> 45:43.750]  Remember what I said about the reality, dying a quick death?
[45:44.570 --> 45:48.210]  If you have a question about a story, write a comment on the story.
[45:48.210 --> 45:49.810]  Put it right down there on the bottom of the page.
[45:50.490 --> 45:50.810]  Tweet.
[45:50.990 --> 45:51.610]  Just make a tweet.
[45:51.830 --> 45:52.670]  Oh, I don't believe this story.
[45:52.770 --> 45:53.070]  It's crap.
[45:53.610 --> 45:53.970]  Right?
[45:54.330 --> 45:55.330]  Write a blog post.
[45:55.810 --> 45:56.870]  Make a YouTube video.
[45:57.310 --> 45:58.090]  Give a talk at HOPE.
[45:59.470 --> 46:00.190]  Say something.
[46:00.370 --> 46:09.990]  Because what happens is that people like me, people like Jason Scott, who are looking for the history and looking for the reality, when we go back 10 years later, all we're going to find is that Kevin Mitnick can break into NORAD.
[46:10.370 --> 46:11.870]  And we're never going to find the reality.
[46:12.050 --> 46:16.050]  And so that hype lives on forever and ever and ever and self-perpetuates itself.
[46:17.530 --> 46:19.070]  And I think that's all I have.
[46:19.330 --> 46:21.030]  I have a long bibliography.
[46:22.390 --> 46:29.770]  These slides will be up on my website, SpaceRogue.net, at some point, probably another month or so.
[46:30.370 --> 46:31.950]  Twitter handle, at SpaceRogue.
[46:32.230 --> 46:35.750]  I think I have seven minutes left for questions, if anybody has any.
[46:36.750 --> 46:38.430]  Of course, I can't see anybody's hands.
[46:39.110 --> 46:40.610]  I think we have a microphone over here.
[46:41.010 --> 46:41.550]  Right here.
[46:44.960 --> 46:45.360]  All right.
[46:45.600 --> 46:48.160]  If you can be loud, but you've got to be really loud.
[46:48.340 --> 46:48.980]  Use the mic.
[46:49.160 --> 46:50.120]  Come over here and use the mic.
[46:50.640 --> 46:51.460]  This guy at the mic.
[46:51.460 --> 46:51.860]  You go first.
[46:51.920 --> 46:52.100]  Go ahead.
[46:52.900 --> 46:53.260]  Okay.
[46:53.680 --> 46:56.320]  First of all, I have a comment I just want to say to.
[46:56.440 --> 46:59.720]  Whoever said there's nothing to do in Illinois, I live in the city of Chicago.
[46:59.880 --> 47:01.060]  You're f*cking right.
[47:01.220 --> 47:04.040]  Once you're 45 miles outside of Chicago, there's nothing.
[47:04.960 --> 47:09.360]  And yeah, regarding what Bernie was talking about before about the sirens, I'm 37 years old.
[47:09.480 --> 47:11.840]  I've lived in Chicago most of my life.
[47:12.120 --> 47:15.680]  Those things go off periodically and have been since I was born.
[47:15.920 --> 47:19.520]  So it's like, why all of a sudden are they talking about hackers getting into it?
[47:19.660 --> 47:23.980]  But anyway, I have kind of a two-part question for you.
[47:24.780 --> 47:28.120]  And I think actually you kind of answered the first one.
[47:28.260 --> 47:35.100]  Like how can you determine whether or not the first story was right saying that it was hackers, or the second story saying, no, it wasn't hackers.
[47:36.600 --> 47:49.980]  And the second part of the question is, do you know of any instances where people said, you know what, it was hackers, and then some hacker group came out and said, yeah, we did it, only to find out that the story was refuted later?
[47:50.120 --> 47:51.180]  There's probably...
[47:51.180 --> 47:55.460]  The second part of the question, yeah, there's probably several anonymous examples about that.
[47:55.700 --> 47:57.940]  I don't have one off the top of my head that I can give you.
[47:58.400 --> 48:05.000]  It probably has happened since various factions of anonymous have been claiming responsibility for just about everything.
[48:05.220 --> 48:06.500]  You know, deleting CBS, for example.
[48:08.720 --> 48:12.540]  The first part of your question, now I've already forgot it.
[48:14.120 --> 48:15.880]  Basically, how do you know which story to believe?
[48:16.020 --> 48:16.880]  Oh, the hype versus the reality.
[48:17.140 --> 48:19.160]  How do you know which to believe, the hype of the reality?
[48:19.380 --> 48:21.720]  Because sometimes, as you can see in these examples...
[48:21.720 --> 48:23.520]  I mean, how do you know which one is the hype, which one is the reality?
[48:23.520 --> 48:31.620]  Because you still don't have name sources, you still don't have facts, and I like to think that intelligent people can look at both and make up their own mind.
[48:31.760 --> 48:32.000]  Right.
[48:32.860 --> 48:34.920]  Especially if the story changes later.
[48:35.360 --> 48:40.080]  I like to think that the change of the later version is probably more accurate than the earlier version.
[48:40.420 --> 48:44.140]  Not always the case, but that's what I tend to look at.
[48:44.500 --> 48:47.980]  Especially if the first version is totally outlandish and, you know, oh, my God, the world's going to end.
[48:48.160 --> 48:51.420]  And the second version is like, oh, well, no, the world's not going to end.
[48:51.500 --> 48:52.520]  This is kind of normal.
[48:53.240 --> 48:53.520]  Right.
[48:53.960 --> 48:58.240]  So the path of least resistance, the simple answer wins, in my book.
[48:58.560 --> 48:58.760]  Right.
[48:58.840 --> 49:01.660]  It also seems to be they're always blaming hackers for things going wrong.
[49:01.740 --> 49:06.100]  Why don't they actually call hackers when things go wrong and say, hey, you guys can help us fix this?
[49:06.160 --> 49:06.700]  That would be good.
[49:06.860 --> 49:07.420]  That would be good.
[49:07.480 --> 49:08.220]  Yeah, we have five minutes.
[49:08.320 --> 49:10.240]  So let's see if we can burn through some of these questions.
[49:10.240 --> 49:16.380]  Hey, do you have any tips for how do we try to dispel hype in people that are completely non-technical?
[49:16.700 --> 49:18.180]  I have a specific one.
[49:18.300 --> 49:25.920]  I think every month or two, a senior exec at my company asks, is it really true that the cybercrime industry is as big or bigger than the drug trade?
[49:26.720 --> 49:28.740]  That particular bullshit just keeps the impact.
[49:28.940 --> 49:33.020]  I don't even know the source of it, so I have a hard time sort of dispelling.
[49:33.180 --> 49:45.740]  I think if you're trying to convince other people and you don't have the skills to do it yourself, use Google or try to bring in some other people that may know more than you, who can help you with that.
[49:47.140 --> 49:55.980]  It's hard to say if you're being asked to dispel a hype that you have no knowledge of, but you know it's hype, because it's like, well, this is sensational, but I don't know how to disprove it.
[49:56.000 --> 49:57.080]  You can't find a source of it.
[49:57.160 --> 49:57.660]  Yeah, exactly.
[49:57.820 --> 49:58.420]  It's difficult.
[49:58.420 --> 50:05.960]  I mean, it took me a long time to find some of these articles, even though I knew what the truth was, to find the actual proof to put in the talk.
[50:06.200 --> 50:08.220]  And it's... all I can say is difficult.
[50:09.140 --> 50:09.820]  Sorry, man.
[50:12.080 --> 50:13.220]  I think we're down to three minutes.
[50:13.940 --> 50:15.060]  I'll try to keep it short.
[50:15.380 --> 50:22.780]  I've noticed a pattern by journalists, not just reporters, over the past...
[50:22.780 --> 50:30.720]  well, probably for many years, but it's happening in, like, the most major New York Times, Wall Street Journal, CNN, you name it.
[50:31.200 --> 50:32.780]  They will say...
[50:35.440 --> 50:39.740]  and they'll refer to some group like law enforcement.
[50:39.880 --> 50:43.300]  Law enforcement officials believe that such and such happened.
[50:43.360 --> 50:47.200]  Or law enforcement officials believe so-and-so is responsible for doing this and this.
[50:47.300 --> 50:48.000]  Yeah, the unnamed source.
[50:48.400 --> 50:49.440]  Well, not that.
[50:49.440 --> 50:53.520]  It's the saying that this government official believes something.
[50:54.660 --> 50:56.300]  How do they know what they believe?
[50:56.880 --> 51:05.840]  Law enforcement agencies, politicians, corporate officials, do they not misrepresent what they think sometimes?
[51:06.240 --> 51:08.160]  Not just sometimes, it happens all the time.
[51:08.500 --> 51:09.480]  They say... go ahead.
[51:09.620 --> 51:15.680]  I was going to say, sometimes that's the weasley words of the reporter, putting... not putting words in the source's mouth...
[51:15.680 --> 51:15.840]  Sure.
[51:16.040 --> 51:17.920]  ...but to cover their own ass, right?
[51:17.920 --> 51:22.500]  Because the reporter can't say, well, you know, law enforcement said this, but they can say law enforcement believes this.
[51:22.500 --> 51:30.300]  I think this practice should be banned in all of journalism, because there's no way that any journalist or reporter can possibly know what another person believes.
[51:30.440 --> 51:30.860]  Yet it is...
[51:30.860 --> 51:31.440]  I totally agree.
[51:31.720 --> 51:33.380]  If you can count...
[51:33.380 --> 51:36.580]  millions of examples of this happening, it's bullshit.
[51:36.900 --> 51:37.160]  Yes.
[51:39.160 --> 51:41.460]  So, when you see that, ask questions.
[51:41.660 --> 51:41.980]  Yes.
[51:42.160 --> 51:42.480]  Comment.
[51:42.900 --> 51:44.100]  Because it is...
[51:44.100 --> 51:44.720]  It's bullshit.
[51:44.860 --> 51:47.960]  And I have written to many reporters over the years on other things.
[51:48.100 --> 51:50.520]  Every month or so, I'll write to a reporter, and I'll call them on something.
[51:50.660 --> 51:56.060]  And they usually get back to me, and they're sort of stunned that somebody called them on it, and they're like, yeah, I'll be careful more.
[51:56.200 --> 51:58.120]  But if we all did that, I think it would make a difference.
[51:58.140 --> 51:58.800]  That's a good point.
[51:58.960 --> 52:01.180]  Nobody ever emails the reporter or the editor.
[52:01.180 --> 52:02.100]  I do the editor.
[52:02.320 --> 52:02.960]  I try to...
[52:02.960 --> 52:05.140]  What I do is I email the reporter and I CC the editor.
[52:05.280 --> 52:05.340]  Yeah.
[52:05.360 --> 52:06.000]  I got to go on the website.
[52:06.160 --> 52:08.900]  Sometimes you have to really dig to find out who their editor is and what their email address is.
[52:08.900 --> 52:09.760]  Or what their email address is.
[52:09.780 --> 52:09.920]  Yeah.
[52:10.160 --> 52:11.380]  And I send it to both.
[52:11.520 --> 52:11.660]  Yes.
[52:11.760 --> 52:12.880]  So then there's accountability.
[52:13.280 --> 52:13.500]  Yes.
[52:13.700 --> 52:14.200]  Always send it to the editor.
[52:14.200 --> 52:15.020]  And they'll usually care.
[52:15.260 --> 52:15.480]  Yes.
[52:15.540 --> 52:16.720]  If you send it to the editor, they'll care.
[52:16.940 --> 52:17.120]  Yeah.
[52:17.180 --> 52:21.580]  But I send it to both, so then the reporter or journalist knows that they've been busted.
[52:21.740 --> 52:23.380]  I need to add that on this list here.
[52:23.560 --> 52:25.100]  You know, email, editor, and reporter.
[52:25.640 --> 52:25.940]  Simultaneously.
[52:26.140 --> 52:26.200]  Yeah.
[52:26.380 --> 52:26.720]  All right.
[52:26.760 --> 52:28.240]  We got 50 seconds left.
[52:28.800 --> 52:32.140]  In high school, setting off the sirens was the holy grail.
[52:32.400 --> 52:39.160]  And for the record, we never succeeded, but also for the record, the analog system we failed to crack is still analog.
[52:39.580 --> 52:41.000]  Yes, I've been told that as well.
[52:41.500 --> 52:43.200]  And it runs on DTMF tones.
[52:43.440 --> 52:46.580]  Okay, I'm a reporter and an editor and a journalist.
[52:46.760 --> 52:48.020]  You are mostly right.
[52:48.360 --> 52:50.080]  However, I want to say a couple of things.
[52:50.260 --> 52:54.980]  A lot of this comes from people who know and know better talking to people who don't know.
[52:54.980 --> 52:56.920]  A lot of journalists don't know this stuff.
[52:57.140 --> 52:58.420]  They don't understand the security stuff.
[52:58.740 --> 53:02.080]  Second of all, a lot of the hype comes from the security industry itself.
[53:02.600 --> 53:05.760]  Okay, I'm not going to do companies, but there's a big one with a red logo.
[53:05.940 --> 53:06.260]  Agreed.
[53:06.280 --> 53:11.700]  That tells a lot of hype about shady rat and cyber crime.
[53:11.820 --> 53:13.120]  I'm not going to say who they are, but they know who they are.
[53:13.280 --> 53:15.000]  There's another one based in Eastern Europe.
[53:15.160 --> 53:15.940]  Its color is green.
[53:16.120 --> 53:16.820]  Very nice people.
[53:16.940 --> 53:18.400]  They talk about cyber war all the time.
[53:19.360 --> 53:20.380]  Journalists eat this up.
[53:20.500 --> 53:20.900]  Oh, I agree.
[53:21.020 --> 53:21.900]  And that's just the way it is.
[53:21.960 --> 53:23.760]  And they don't understand the technical details.
[53:24.340 --> 53:27.140]  Third, the last guy was right, the two guys are right.
[53:27.280 --> 53:30.180]  If you see something and you think it's bullshit, call us.
[53:30.620 --> 53:31.080]  Tell us.
[53:31.200 --> 53:33.420]  We are always ready to refute a story.
[53:33.660 --> 53:37.020]  I am always happy to say something that's in the media is bullshit.
[53:37.540 --> 53:39.060]  I'm always ready to take a story down.
[53:39.180 --> 53:40.820]  Do you mind if I ask who you report for?
[53:41.000 --> 53:42.400]  My name is Paul Wagonseel.
[53:42.540 --> 53:46.260]  I write for and manage a very small website called securitynewsdaily.com.
[53:46.260 --> 53:46.660]  Okay.
[53:46.920 --> 53:47.880]  This is what we specialize in.
[53:48.080 --> 53:48.300]  Good.
[53:48.720 --> 53:49.000]  All right.
[53:49.540 --> 53:52.820]  I have the L0pht passport stamp with me.
[53:53.000 --> 53:54.480]  If anybody wants it, I'll be in the back.
[53:54.640 --> 53:56.180]  If you have more questions, I'll be in the back.
[53:56.760 --> 53:59.280]  I don't know who the next talk is, but they'll be here in 10 minutes.
[53:59.780 --> 54:00.080]  All right.
[54:00.200 --> 54:00.840]  Thanks all for showing up.
[54:00.840 --> 54:01.560]  Thank you.
[54:01.560 --> 54:01.620]  Thank you.