[00:00.000 --> 00:02.220]  Johnny Long with No-Tech Hacking.
[00:02.340 --> 00:05.960]  I know some of you guys have heard about a lot of the nonprofit stuff he's been doing.
[00:06.540 --> 00:09.000]  Johnny Long is a tremendous force for positive good in the community.
[00:09.140 --> 00:11.440]  I know he's probably not going to mention a whole lot of that.
[00:11.500 --> 00:12.660]  You're all here to hear No-Tech Hacking.
[00:12.760 --> 00:18.700]  But guys, give Johnny Long a huge round of applause for everything he does in the community and what he's going to be talking about right now.
[00:18.820 --> 00:19.460]  Thank you very much.
[00:31.900 --> 00:32.420]  That's me.
[00:32.620 --> 00:33.000]  Thank you.
[01:02.290 --> 01:03.090]  And there it is.
[01:03.310 --> 01:03.630]  Hi.
[01:06.430 --> 01:08.610]  I like when it's more conversational like that.
[01:08.770 --> 01:09.690]  It's nice.
[01:09.990 --> 01:10.170]  Hi.
[01:10.790 --> 01:11.190]  Hi.
[01:11.590 --> 01:12.210]  Hi there.
[01:12.570 --> 01:13.150]  Thank you.
[01:13.290 --> 01:13.790]  Okay, that's enough.
[01:15.190 --> 01:15.970]  Yo, J-Lo.
[01:16.250 --> 01:16.650]  Yo.
[01:17.770 --> 01:18.890]  Hey, what's up, man?
[01:18.990 --> 01:19.870]  Front row seat.
[01:20.570 --> 01:22.810]  Good friend Blue Boar is sitting in the front row.
[01:22.890 --> 01:23.790]  It's a rare treat.
[01:25.170 --> 01:29.030]  All right, I'm going to go ahead and... Show of hands, how many people have seen this talk?
[01:30.130 --> 01:30.530]  Okay.
[01:31.030 --> 01:33.110]  Everybody look at the people that put their hands up.
[01:33.810 --> 01:36.930]  Because those are the people that could ruin it for me.
[01:38.450 --> 01:43.210]  All right, if you've seen this talk, you know there's like some surprises and there's like some fun stuff.
[01:43.490 --> 01:46.170]  Those people that put their hands up can kill it dead.
[01:46.830 --> 01:48.270]  Just make the talk suck.
[01:49.430 --> 01:58.090]  So, if you're near them and they start to make the talk suck, just ask them to stop.
[01:59.990 --> 02:01.350]  All right, so let me give my intro.
[02:02.490 --> 02:04.810]  You don't look at me when I do the intro, you look there.
[02:05.170 --> 02:05.930]  This is me.
[02:06.290 --> 02:08.150]  And as most of you know, I do this.
[02:08.950 --> 02:13.070]  I'm a devoted one of these, which some people think is this, and some people think is this.
[02:13.610 --> 02:16.850]  Whatever you think it is, I'm definitely not one of these unless it's this kind.
[02:18.350 --> 02:20.110]  I'm also a professional one of these.
[02:20.270 --> 02:23.750]  Although I'm not dead yet, I'm more like one of these without the bad haircut.
[02:24.710 --> 02:31.790]  I must be one of these because every time I load a page like this in my browser, it autofills this.
[02:36.530 --> 02:40.870]  I'm also one of these for these nice folks, as evidenced by all of this.
[02:42.470 --> 02:47.750]  Now, I'm proud to say that I don't have to take sides in this debate because I'm both.
[02:47.970 --> 02:55.250]  I know you're skeptical, but I'm actually practicing one of these because I'm a student of this, this, which translates into this, which most of you know is this.
[02:55.810 --> 02:57.170]  I currently have this.
[02:57.310 --> 02:58.430]  I'm very close to getting this.
[02:58.630 --> 03:04.410]  But I'm also one of these, like this, but not the LEGO kind, more like this, the cool kind.
[03:05.670 --> 03:11.950]  But in all honesty, I'm a blood relative of this guy, who most of you know better from this picture.
[03:14.270 --> 03:21.890]  So even though I'm this and this and this and this and this, I'm pretty passionate about my role as this.
[03:21.890 --> 03:26.610]  I'm the founder of this, which some of you like better by this name.
[03:27.650 --> 03:33.170]  So what we do is we put hackers to work on charitable projects in exchange for references from industry leaders.
[03:33.370 --> 03:37.310]  So these can get these by designing things like this.
[03:37.590 --> 03:46.810]  We also build classrooms like this using donated equipment like this and this, so that children in underdeveloped countries can attend computer classes like this.
[03:47.470 --> 03:51.870]  The idea is that they'll become self-sufficient, which is really the only way to break the cycle of poverty.
[03:52.150 --> 04:02.870]  So if you want to do this for these, or if you're tired of doing this, and you'd like to land that real job, come to us to get some of this by working with us.
[04:03.030 --> 04:09.450]  So stop by our website, send us lots of money, buy a t-shirt, or buy the No-Tech Hacking Book.
[04:09.450 --> 04:11.470]  All Proceeds Go to Feed African Children.
[04:12.090 --> 04:12.650]  That's it.
[04:20.400 --> 04:20.840]  Okay.
[04:21.260 --> 04:22.640]  But most of you aren't here for that.
[04:22.790 --> 04:23.720]  You're here for the talk.
[04:24.460 --> 04:36.720]  This is not a talk about high technology, which is stuff like this, which is, you know, wireless and viruses and Trojans and password cracking and lockpicking and packet sniffing and all that stuff.
[04:36.720 --> 04:39.020]  This is not about no-tech.
[04:39.200 --> 04:40.220]  This is not about high tech.
[04:40.360 --> 04:44.440]  This is about no-tech, which is the subject of this book.
[04:45.520 --> 04:50.440]  Before I give you an idea of what this is, let me just tell you where this idea came from.
[04:50.920 --> 04:56.340]  I worked with this guy named Vince, who was into physical security, and the guy was an absolute legend.
[04:57.260 --> 05:04.920]  You know, the first gig that I went on with this guy, we had to break into this really secure facility that had this immense door.
[05:05.820 --> 05:07.560]  You know, one of these skiff-looking doors.
[05:07.820 --> 05:11.210]  You drive a truck in to the door, the truck bounces, that kind of door.
[05:12.060 --> 05:13.700]  We had to break into this facility.
[05:13.920 --> 05:19.920]  And so we're outside sort of milling around, and Vince is watching people go in and out.
[05:20.260 --> 05:28.660]  And I'm thinking, you know, based on this guy's reputation, I see the little prox reader over there, and I'm thinking, he's going to break out like the alligator clips, right?
[05:28.980 --> 05:34.720]  He's going to do something with like an LCD screen, and there's going to be like an odometer flipping, you know, like in the movies.
[05:34.920 --> 05:41.060]  Or there's going to be like that Mission Impossible thing where you get really close to the floor and then sweat on it, and everything goes to hell in a handbasket.
[05:41.280 --> 05:42.260]  You know, that's what I'm thinking.
[05:42.960 --> 05:46.100]  But after a few minutes, Vince goes, I got to go.
[05:47.140 --> 05:49.140]  I was like, oh, okay.
[05:49.740 --> 05:54.140]  So I don't really know this guy, so I'm thinking it's like some stomach virus or something.
[05:54.680 --> 05:55.880]  I want to honor that.
[05:57.000 --> 05:59.200]  So I'm like, okay, let's go.
[05:59.200 --> 06:00.740]  We drive back to the hotel.
[06:01.020 --> 06:01.760]  Park's out front.
[06:02.020 --> 06:02.720]  He comes out.
[06:02.940 --> 06:04.860]  And after a few minutes, he's got this...
[06:04.860 --> 06:09.120]  He's got a wire coat hanger and a wet washcloth.
[06:10.800 --> 06:12.860]  I'm still thinking stomach disorder.
[06:15.620 --> 06:17.160]  We drive back to the building.
[06:17.440 --> 06:18.220]  It's like 6.30.
[06:18.260 --> 06:19.380]  It's after working hours.
[06:20.580 --> 06:21.900]  Nobody's really around.
[06:22.140 --> 06:23.380]  Obviously, government facility.
[06:25.380 --> 06:26.480]  He walks up to the door.
[06:26.600 --> 06:29.300]  And while he's walking up to the door, he's fiddling with this coat hanger.
[06:29.460 --> 06:30.840]  He makes it into a long piece of wire.
[06:30.960 --> 06:32.160]  He puts the coat hanger on the end.
[06:32.280 --> 06:33.320]  Folds the whole thing in half.
[06:33.580 --> 06:34.560]  Walks up to the door.
[06:34.800 --> 06:37.360]  Jams the coat hanger through the crack in the center of the door.
[06:38.120 --> 06:39.960]  Slides it down and starts flapping it around.
[06:40.080 --> 06:41.040]  I hear it on the other side of the door.
[06:41.100 --> 06:41.600]  Flap, flap, flap.
[06:42.020 --> 06:42.340]  Click.
[06:43.380 --> 06:44.500]  I hear the door unlock.
[06:45.100 --> 06:45.880]  He goes in.
[06:46.800 --> 06:47.480]  Walks right through.
[06:47.880 --> 06:49.040]  Leaves me on the sidewalk.
[06:50.000 --> 06:51.280]  Looking at the security camera.
[06:54.040 --> 07:00.000]  What he had done was defeat this multimillion dollar security system with like trash.
[07:01.220 --> 07:03.400]  I mean, trash and treasure thing, right?
[07:03.500 --> 07:04.900]  He took this to a whole new level.
[07:05.980 --> 07:12.900]  And when I finally got up the nerve to just go into the building with him, I was like, dude, what was that about?
[07:13.360 --> 07:15.380]  And he's like, didn't you look at the door?
[07:15.520 --> 07:18.440]  I said, well, yeah, there, you know, there was a push bar on the back of the thing.
[07:18.540 --> 07:19.460]  He's like, no, it wasn't a push bar.
[07:19.560 --> 07:20.300]  It was a touch bar.
[07:21.100 --> 07:24.800]  That doesn't know the difference between a wet washcloth and a human hand.
[07:25.800 --> 07:33.080]  So I learned a lesson about touch bars, but the really important lesson that I learned was how to not complicate things.
[07:33.300 --> 07:39.780]  Now, you've been through this conference and probably several others, and you've heard all sorts of high tech solutions for breaking stuff.
[07:40.060 --> 07:41.800]  And I think those are incredibly cool.
[07:41.940 --> 07:42.540]  Don't get me wrong.
[07:42.760 --> 07:48.600]  My point is, I think there's a lot of room for simple situations, you know, solving problems in simple ways.
[07:48.720 --> 07:49.980]  And that's what this is about.
[07:50.300 --> 07:59.380]  But because this is a hacker conference, and it's not your, you know, corporate suit and tie conference, I'm going to give you the lowdown on what this really is, because we're going to drop skills.
[07:59.500 --> 08:02.120]  I'm going to teach you how to do some unbelievable things.
[08:03.480 --> 08:08.980]  True to the spirit of a conference like HOPE, I'm going to teach you these things, the real Jedi wave.
[08:09.080 --> 08:10.860]  I'm going to show you how x-ray vision works.
[08:10.900 --> 08:26.860]  I'm going to show you how to blend in with the feds, how to pass through walls in a puff of smoke, get into locked cabinets without using your hands, hack workstations with one keystroke, suck data off machines with your mind, sniff email and network traffic without a computer,
[08:27.060 --> 08:29.380]  and defeat physical security with trash and stuff.
[08:30.140 --> 08:31.080]  How's that sound?
[09:03.710 --> 09:05.110]  Nice.
[09:05.110 --> 09:06.770]  Now, I want to get to who a person really is.
[09:06.870 --> 09:07.790]  For example, this guy.
[09:08.510 --> 09:10.410]  What can you tell me about this guy?
[09:11.950 --> 09:12.670]  He's sitting.
[09:12.850 --> 09:13.230]  Excellent.
[09:14.130 --> 09:15.510]  You've got a future in this.
[09:16.390 --> 09:17.350]  He's at the airport.
[09:17.510 --> 09:17.910]  Very good.
[09:18.130 --> 09:18.710]  Very good.
[09:18.730 --> 09:19.410]  He's got a hat.
[09:19.550 --> 09:20.210]  This is great.
[09:20.630 --> 09:21.670]  We're warming up.
[09:23.370 --> 09:24.250]  Ex-military.
[09:24.250 --> 09:24.530]  Why?
[09:26.070 --> 09:28.590]  The footwear, the haircut, the boots.
[09:28.890 --> 09:30.350]  Anybody know the brand name for those?
[09:32.130 --> 09:32.930]  High-tech.
[09:33.190 --> 09:34.830]  The irony is thick, isn't it?
[09:35.490 --> 09:36.590]  High-tech boots.
[09:36.670 --> 09:37.090]  Very nice.
[09:37.370 --> 09:40.670]  He's also got the sleeves rolled up, which says an awful lot about him.
[09:43.030 --> 09:44.910]  He's watching stewardesses walk by.
[09:45.030 --> 09:45.990]  That says something else.
[09:47.050 --> 09:48.750]  So he's probably straight.
[09:48.910 --> 09:49.570]  The Oakleys.
[09:50.090 --> 09:53.230]  Now, there's a nickname for this style of Oakley.
[09:53.230 --> 09:54.890]  I've heard him referred to as shooters.
[09:56.270 --> 09:59.190]  Because people that wear them shoot.
[10:01.190 --> 10:03.270]  There's also the thing that's written on the back of his hat.
[10:03.370 --> 10:04.250]  Can anybody read that?
[10:05.430 --> 10:07.730]  It says... it's not bananas.
[10:07.930 --> 10:08.610]  That's different too.
[10:08.830 --> 10:12.110]  It's benelliusa.com.
[10:12.250 --> 10:13.330]  Anybody know what Benelli is?
[10:13.910 --> 10:14.350]  Shotguns.
[10:14.350 --> 10:14.610]  Yes.
[10:14.970 --> 10:18.350]  Now, they don't just make shotguns for, like, shooting ducks.
[10:18.810 --> 10:19.210]  Right?
[10:19.470 --> 10:22.030]  They shoot shotguns that, like, blow up tanks and stuff.
[10:22.030 --> 10:23.450]  I mean, like, I guess.
[10:23.630 --> 10:26.250]  I was in the military, obviously, because shotguns don't blow up tanks.
[10:26.430 --> 10:29.930]  But they sell special purpose guns.
[10:30.550 --> 10:31.830]  So he's in the airport.
[10:32.470 --> 10:33.750]  Benelli USA hat.
[10:34.070 --> 10:36.770]  Now, you can get an idea of this guy's profile.
[10:37.090 --> 10:39.790]  But there's one piece of information missing.
[10:39.790 --> 10:41.890]  This guy pre-boarded my flight.
[10:43.070 --> 10:44.250]  By himself.
[10:44.750 --> 10:45.290]  Sky Marshal.
[10:45.830 --> 10:46.130]  Right.
[10:46.370 --> 10:47.070]  Sky Marshal.
[10:47.350 --> 10:49.570]  The irony is, he's not just a Sky Marshal.
[10:49.670 --> 10:51.150]  He's an undercover Sky Marshal.
[10:51.870 --> 10:52.450]  All right.
[10:52.530 --> 10:53.390]  So you see how this works.
[10:53.510 --> 10:54.390]  Seeing through people.
[10:54.530 --> 10:55.490]  Taking a look at somebody.
[10:55.850 --> 10:56.330]  Observing.
[10:56.570 --> 10:57.350]  Figuring stuff out.
[10:57.350 --> 10:59.010]  What can you tell me about this guy?
[10:59.950 --> 11:00.370]  Married.
[11:06.640 --> 11:08.380]  I'll go with the married one instead.
[11:08.580 --> 11:09.100]  That's good.
[11:09.300 --> 11:09.600]  Married.
[11:09.660 --> 11:09.820]  Good.
[11:10.140 --> 11:10.860]  He's literate.
[11:10.920 --> 11:11.960]  He's literate.
[11:12.220 --> 11:12.640]  Right.
[11:12.940 --> 11:14.860]  The magazine is not upside down.
[11:15.500 --> 11:16.500]  That's good.
[11:17.860 --> 11:19.120]  Vitamin E deficiency.
[11:20.260 --> 11:21.220]  He's got that.
[11:21.500 --> 11:22.000]  Anything else?
[11:22.000 --> 11:24.080]  What's the yellow tag on his luggage?
[11:24.080 --> 11:24.720]  You're peeing.
[11:25.980 --> 11:26.960]  No, I'm not peeing.
[11:28.880 --> 11:31.020]  The yellow tag is his baggage.
[11:31.300 --> 11:32.500]  That's his baggage-y thing.
[11:32.840 --> 11:35.180]  That's good because that's a transfer tag.
[11:35.280 --> 11:36.440]  It means he's come from somewhere.
[11:37.060 --> 11:37.320]  All right.
[11:37.380 --> 11:38.880]  He's also got a vitamin E deficiency.
[11:38.900 --> 11:40.080]  I'm not sure if you picked that up.
[11:40.320 --> 11:43.440]  There's other stuff that you can look at to figure out some stuff about this guy.
[11:43.640 --> 11:44.380]  What would you use?
[11:45.480 --> 11:46.280]  Government seal.
[11:46.660 --> 11:47.060]  Yeah.
[11:47.240 --> 11:49.120]  Somebody's picking up the seal on the bag.
[11:49.220 --> 11:49.940]  See it on the floor there?
[11:49.940 --> 11:50.960]  Here's the seal.
[11:51.880 --> 11:52.160]  U.S.
[11:52.500 --> 11:53.620]  Nuclear Regulatory Commission.
[11:55.480 --> 12:00.400]  Now, I know for a fact that he didn't get this at their conference because their conference sucks.
[12:02.120 --> 12:04.580]  So he probably works for the U.S.
[12:04.680 --> 12:05.900]  Nuclear Regulatory Commission.
[12:06.300 --> 12:10.240]  And we can get more information about him by looking at things like his SkyMile tags, all this stuff.
[12:10.440 --> 12:14.500]  So my question to you is, do you think that the information about where the U.S.
[12:14.600 --> 12:18.420]  Nuclear Regulatory Commission is headed and when is valuable?
[12:18.420 --> 12:21.080]  I would guess that it probably is.
[12:21.560 --> 12:24.240]  So here's a guy from said agency, right?
[12:25.020 --> 12:25.940]  Traveling around.
[12:26.200 --> 12:28.200]  He's probably security conscious, right?
[12:28.600 --> 12:29.460]  The bag.
[12:30.580 --> 12:31.180]  Well...
[12:31.180 --> 12:32.080]  Lives in Atlanta.
[12:32.220 --> 12:33.240]  Lives in Atlanta.
[12:33.460 --> 12:34.220]  That was hardcore.
[12:34.740 --> 12:35.900]  You actually know the dude?
[12:36.620 --> 12:39.010]  All the time.
[12:39.190 --> 12:39.510]  Fed.
[12:39.770 --> 12:40.510]  I'm just kidding.
[12:44.960 --> 12:48.140]  I want to draw your attention to the blurred areas in this photo.
[12:48.260 --> 12:49.020]  See him on the sides?
[12:49.980 --> 12:55.480]  That's my arm and my side because I'm taking the picture with my back to him.
[12:55.600 --> 12:57.040]  Like putting the camera in my armpit.
[12:57.280 --> 12:58.040]  Shooting like this.
[12:58.200 --> 12:59.960]  It's an advanced ninja move.
[13:00.120 --> 13:01.120]  It's very delicate.
[13:03.340 --> 13:04.440]  Like that one.
[13:07.660 --> 13:09.580]  No, that was the computer nerd move.
[13:09.740 --> 13:10.260]  That's different.
[13:11.800 --> 13:12.200]  Yeah.
[13:12.300 --> 13:16.240]  Well, the funny thing is, I think after a while this guy caught on to what I was doing.
[13:22.230 --> 13:24.270]  Funny thing is, he didn't do anything about it.
[13:24.350 --> 13:25.730]  That's also sort of the sad part.
[13:26.170 --> 13:27.210]  I'm in an airport.
[13:27.430 --> 13:30.030]  Creepy looking guy taking pictures of him and his stuff.
[13:30.670 --> 13:34.050]  I mean, he's sitting next to an undercover air marshal, for God's sakes.
[13:34.190 --> 13:35.590]  You could have told him, but he didn't.
[13:35.890 --> 13:35.990]  Okay.
[13:36.090 --> 13:36.410]  One more.
[13:36.510 --> 13:37.390]  What can you tell me about this guy?
[13:38.950 --> 13:39.270]  Yep.
[13:39.610 --> 13:40.210]  He works out.
[13:40.370 --> 13:40.470]  Good.
[13:40.750 --> 13:42.530]  No, he...
[13:43.830 --> 13:44.230]  That's right.
[13:44.310 --> 13:45.690]  No, actually you're seeing half of it.
[13:45.810 --> 13:46.710]  This is from Dark Knight.
[13:46.950 --> 13:47.810]  This is Two-Face.
[13:48.010 --> 13:48.910]  The other side's...
[13:48.910 --> 13:50.050]  The other side's good.
[13:50.190 --> 13:50.930]  But yeah, military.
[13:51.650 --> 13:51.970]  Married.
[13:52.230 --> 13:52.550]  Married.
[13:52.710 --> 13:52.830]  Good.
[13:54.430 --> 13:55.250]  The Iron Man.
[13:55.490 --> 13:55.610]  Okay.
[13:55.870 --> 13:57.010]  Let's dig a little bit deeper.
[13:57.110 --> 13:58.290]  What else can you tell us about him?
[13:58.370 --> 13:59.670]  What operating system is he using?
[14:00.210 --> 14:00.650]  Good.
[14:01.310 --> 14:03.030]  Let's confirm the military thing.
[14:04.050 --> 14:04.630]  U.S.
[14:05.150 --> 14:06.330]  military casualty statistics.
[14:06.710 --> 14:08.710]  He reports to a lieutenant colonel.
[14:09.110 --> 14:10.950]  There's the subject of his email.
[14:11.590 --> 14:13.910]  So, looking at people is one thing.
[14:14.150 --> 14:14.450]  Okay.
[14:14.550 --> 14:16.530]  But I've also employed another skill here.
[14:16.670 --> 14:17.550]  This is skill number two.
[14:17.730 --> 14:20.090]  Sucking data off of machines with your mind.
[14:21.270 --> 14:22.810]  And you tell people you can do this.
[14:22.870 --> 14:24.310]  You've got to keep this close held, right?
[14:24.430 --> 14:25.690]  You know, like a magician has a trick.
[14:25.810 --> 14:27.770]  He tells people how it's done and it sucks.
[14:28.290 --> 14:30.190]  You've got to not tell people how it's done.
[14:30.370 --> 14:32.970]  Just tell them that you have the skill and they'll be like, ooh.
[14:33.950 --> 14:34.230]  All right.
[14:34.370 --> 14:35.890]  But it used to be called something else.
[14:36.010 --> 14:37.330]  It used to be called shoulder surfing.
[14:37.690 --> 14:40.110]  Now it's sucking data off machines with your mind.
[14:42.030 --> 14:43.830]  There's a definite art to shoulder surfing.
[14:44.070 --> 14:45.850]  You have to be pretty bold to do it.
[14:45.950 --> 14:46.810]  I'm not very bold.
[14:46.950 --> 14:54.870]  I mean, do I look like the kind of guy that's just going to wander around, hovering over people's shoulders, taking pictures of their laptops, regardless of where they are?
[14:55.110 --> 14:56.310]  That's why you're so good at it.
[14:56.350 --> 14:57.450]  That's why I'm so good at it.
[14:57.710 --> 14:57.830]  Yeah.
[14:58.570 --> 14:58.810]  Yeah.
[14:58.950 --> 15:00.770]  So, yeah, I do this.
[15:00.890 --> 15:06.910]  The funny thing is, though, before we get to the actual meat of this, which is what's on the screen, it's not the keyboard.
[15:07.110 --> 15:08.670]  That's how it started, looking for passwords.
[15:08.850 --> 15:09.490]  It's the screen.
[15:10.310 --> 15:13.890]  Before we get to the screen, though, there's other things you can look at on the laptops.
[15:14.130 --> 15:14.870]  I love this.
[15:15.250 --> 15:16.250]  The business card.
[15:16.570 --> 15:18.850]  I got, like, all this personal information about him.
[15:18.990 --> 15:22.710]  You know, where he lives, where he works, phone number, email address, all that stuff.
[15:22.830 --> 15:27.770]  Fortunately, this isn't a common occurrence for people to put business cards and stickers on their laptops.
[15:28.870 --> 15:31.190]  Yeah, it is a common occurrence, but at least they're small.
[15:35.740 --> 15:36.860]  Caution, ultra-sensitive.
[15:36.880 --> 15:37.640]  Handle with care.
[15:37.960 --> 15:40.140]  And it's written in Chinese and bright orange.
[15:41.200 --> 15:42.300]  I think it's a target.
[15:42.460 --> 15:44.060]  TSA missed this one, by the way.
[15:45.640 --> 15:46.140]  All right.
[15:46.320 --> 15:47.480]  So, yeah, shoulder surfing.
[15:47.660 --> 15:48.760]  You get really close to somebody.
[15:49.100 --> 15:50.680]  Sometimes you risk bumping into him.
[15:50.700 --> 15:51.360]  It was no big deal.
[15:51.440 --> 15:53.160]  He didn't mind or didn't seem to, anyway.
[15:53.900 --> 16:01.620]  But I can tell things about him, like he's the VP of acquisitions, and I should steal his laptop because acquisition data is just excellent.
[16:01.620 --> 16:04.160]  But there's other things you can look at as well.
[16:04.380 --> 16:05.940]  For example, the taskbar.
[16:06.500 --> 16:08.660]  Now, StankDawg wrote a really good paper about this.
[16:08.740 --> 16:10.080]  He called it electronic deduction.
[16:10.320 --> 16:11.780]  I really like this idea.
[16:12.200 --> 16:18.200]  The idea is you can tell an awful lot about a person by looking at their screen, specifically things like their taskbar.
[16:18.540 --> 16:22.020]  For example, what can you tell me about some of these icons on the screen?
[16:22.120 --> 16:23.540]  What about the two yellow balls there?
[16:24.100 --> 16:24.540]  Trillion.
[16:24.880 --> 16:25.260]  Trillion.
[16:25.560 --> 16:26.480]  What's its status?
[16:27.980 --> 16:28.420]  Unconnected.
[16:28.540 --> 16:28.780]  Good.
[16:28.780 --> 16:30.040]  Two over.
[16:30.180 --> 16:31.360]  What's the little yellow man?
[16:31.740 --> 16:32.180]  AIM.
[16:32.560 --> 16:32.820]  Yes.
[16:33.000 --> 16:33.760]  What's its status?
[16:35.260 --> 16:35.860]  Connected.
[16:35.860 --> 16:35.940]  Connected.
[16:36.140 --> 16:36.280]  All right.
[16:36.340 --> 16:36.860]  Let's pause.
[16:39.920 --> 16:45.720]  Trillion, which includes AIM support, and AIM, both running and both connected.
[16:46.640 --> 16:49.100]  Tell me about the technical ability of this person.
[16:49.100 --> 16:53.700]  On a scale of 1 to 10, with 1 being the lowest, how would you rank this person?
[16:54.580 --> 16:54.980]  Zero.
[16:58.400 --> 16:59.200]  Negative 31337.
[16:59.420 --> 16:59.860]  Good answer.
[17:00.280 --> 17:00.680]  Nice.
[17:01.380 --> 17:01.760]  Okay.
[17:01.980 --> 17:04.120]  Now, what about a profile?
[17:04.520 --> 17:05.300]  This person...
[17:05.300 --> 17:05.380]  Yeah.
[17:05.640 --> 17:09.160]  Somebody noticed the antivirus, the red shield with the X.
[17:09.260 --> 17:11.440]  That means the machine can't be hacked, so...
[17:14.430 --> 17:17.130]  I always get them backwards, and it screws me up all the time.
[17:17.130 --> 17:21.110]  I attack the wrong shield-colored machines, and it all just goes down.
[17:21.570 --> 17:21.730]  All right.
[17:22.810 --> 17:27.310]  Now, we know what this person's doing, but what are they?
[17:27.450 --> 17:29.990]  Running, like, two AIM clients at the same time.
[17:30.110 --> 17:31.970]  I mean, what do you think maybe they do for a living?
[17:35.220 --> 17:36.460]  Not touching that one.
[17:37.840 --> 17:39.140]  They talk to people.
[17:39.200 --> 17:40.460]  They talk to people.
[17:40.940 --> 17:43.420]  Maybe, I don't know, management, pedophile.
[17:44.320 --> 17:49.180]  I mean, there's lots of possibilities, but the technical level is low, we all agree, right?
[17:49.700 --> 17:53.340]  Now, let me expand the taskbar, and I want to show you one icon.
[17:53.760 --> 17:57.800]  And based on the one icon, I want you to reconsider who this person is and what they do.
[17:58.820 --> 17:59.180]  Tor.
[18:00.440 --> 18:00.880]  Tor.
[18:01.200 --> 18:02.400]  It's the Vidalia onion.
[18:02.700 --> 18:03.020]  Yeah.
[18:03.040 --> 18:05.340]  So, they're encrypting all of their web traffic.
[18:05.620 --> 18:06.380]  It's on.
[18:06.580 --> 18:07.260]  It's enabled.
[18:07.760 --> 18:09.400]  Hard encryption, right?
[18:09.880 --> 18:11.300]  They're using jump-off points.
[18:11.320 --> 18:12.760]  That's my word for proxy.
[18:13.860 --> 18:14.220]  All right.
[18:14.340 --> 18:17.840]  So, the people sniffing the traffic can't see what they're doing or where they're going.
[18:18.000 --> 18:19.280]  What's the technical level now?
[18:20.140 --> 18:21.200]  They have a smart son.
[18:21.480 --> 18:22.640]  They have a smart son.
[18:22.780 --> 18:23.100]  That's good.
[18:25.340 --> 18:27.220]  I mean, it's not like a 10, right?
[18:27.220 --> 18:28.040]  But they're smarter.
[18:28.300 --> 18:30.700]  You know, they're a little bit farther above the curve.
[18:30.860 --> 18:31.720]  They're up to something.
[18:31.960 --> 18:33.920]  The point is, that's one little icon.
[18:34.280 --> 18:38.280]  So, looking at one little icon like that, you can completely profile somebody.
[18:38.440 --> 18:42.040]  And that was Stank Dog's idea with this thing, is that it doesn't take much.
[18:42.620 --> 18:46.380]  Now, if you get a little more real estate, like, God forbid, you get their browser.
[18:46.560 --> 18:48.760]  You get a look at their browser and you see all of this crap.
[18:49.380 --> 18:50.700]  You can tell even more.
[18:50.840 --> 18:53.560]  Or if you get the whole screen, like this one.
[18:53.700 --> 18:54.920]  This one's captured in the field.
[18:55.300 --> 18:56.180]  Let's pull it apart.
[18:56.520 --> 18:57.400]  What's the OS?
[19:00.040 --> 19:00.840]  That's too easy.
[19:01.980 --> 19:02.440]  All right.
[19:02.560 --> 19:04.560]  What Office software do they have installed?
[19:05.360 --> 19:05.720]  Microsoft.
[19:06.160 --> 19:06.820]  It's very easy.
[19:07.360 --> 19:07.960]  All right.
[19:08.360 --> 19:09.620]  This is a harder one.
[19:09.960 --> 19:11.880]  What type of business are they in?
[19:15.000 --> 19:15.480]  Sales.
[19:15.740 --> 19:16.100]  Very good.
[19:16.540 --> 19:20.020]  What one piece of hardware do they probably have on them besides their laptop?
[19:20.300 --> 19:20.600]  Laptop.
[19:22.620 --> 19:23.100]  Specifically.
[19:23.380 --> 19:23.680]  Palm.
[19:24.220 --> 19:24.680]  Very nice.
[19:25.700 --> 19:27.780]  So, this is already a target, right?
[19:27.880 --> 19:30.380]  Because they probably have their palm backed up on this laptop.
[19:30.380 --> 19:32.960]  So, even if you're just a common thief, this is a target.
[19:33.280 --> 19:35.400]  What business software do they use back at the office?
[19:36.480 --> 19:37.160]  Very good.
[19:37.360 --> 19:38.260]  How do they connect to it?
[19:39.760 --> 19:40.540]  Secure remote.
[19:41.660 --> 19:43.240]  Anybody know what secure remote is?
[19:45.240 --> 19:45.860]  That's right.
[19:46.060 --> 19:48.000]  This is checkpoint VPN software.
[19:48.700 --> 19:51.780]  If you didn't know what that is, search will work fine.
[19:52.120 --> 19:53.380]  Profile this person for me.
[19:57.860 --> 19:58.320]  Shiny.
[19:59.120 --> 19:59.820]  Shiny's good.
[20:00.620 --> 20:01.280]  That's good.
[20:02.140 --> 20:02.940]  Technical level.
[20:04.340 --> 20:05.060]  Pretty high.
[20:05.280 --> 20:07.540]  Yeah, I mean, this guy has how many console windows open?
[20:08.160 --> 20:08.700]  All right.
[20:09.060 --> 20:09.540]  Like three.
[20:09.740 --> 20:11.580]  For him, a GUI is just like some excuse.
[20:12.400 --> 20:15.380]  For not having to hit Alt F1, Alt F2, Alt F3.
[20:15.520 --> 20:16.660]  I mean, all right.
[20:16.700 --> 20:17.920]  So, he's got a high technical level.
[20:17.920 --> 20:21.220]  He's looking at some sort of, you know, high tech code or something.
[20:21.540 --> 20:21.900]  All right.
[20:21.900 --> 20:22.600]  What about this guy?
[20:23.000 --> 20:24.380]  What do you think he does for a living?
[20:28.580 --> 20:30.260]  Professional paintball is an option, right?
[20:30.340 --> 20:30.800]  Go with that.
[20:32.700 --> 20:33.660]  Army Navy surplus.
[20:33.920 --> 20:35.380]  Army Navy surplus worker.
[20:35.380 --> 20:36.120]  That's good, too.
[20:36.680 --> 20:36.840]  All right.
[20:37.200 --> 20:39.100]  Well, let's just assume that he's in the military.
[20:39.300 --> 20:39.880]  It's safe.
[20:40.040 --> 20:40.980]  We'll go with that.
[20:41.200 --> 20:46.020]  Now, I know for a fact that I have no chance of sneaking up on this particular guy because he's read the code.
[20:47.340 --> 20:53.100]  He's read the road warrior code, which states that road warriors are wary and alert travelers.
[20:58.120 --> 21:03.360]  They also prevent against public display of content, AKA shoulder surfing.
[21:04.560 --> 21:05.100]  Road.
[21:06.040 --> 21:06.580]  Warriors.
[21:06.920 --> 21:12.000]  So, the odds of me getting close enough to lick this guy's neck to take a picture of the screen.
[21:13.480 --> 21:14.380]  Pretty slim.
[21:15.340 --> 21:15.540]  All right.
[21:15.740 --> 21:17.620]  Now, can we tell his dermatological condition?
[21:17.620 --> 21:21.420]  We can also see that he's logged into a BEA WebLogic server as admin.
[21:23.520 --> 21:24.920]  Bad member of the military.
[21:25.500 --> 21:26.280]  Here's another one.
[21:26.360 --> 21:27.720]  This is a killer shoulder surf...
[21:27.720 --> 21:30.780]  I mean, sucking data off of machines with your mind exercise.
[21:31.800 --> 21:34.960]  It's hard to see, but this is me shooting across the aisle on a plane.
[21:35.260 --> 21:37.720]  The guy next to me is not with me.
[21:37.860 --> 21:44.840]  We're not traveling together, so I had to, you know, put up my coat to serve as a barrier so he wouldn't get suspicious when the flash went off.
[21:47.580 --> 21:52.820]  But anyway, he puts the laptop away and this guy over here is pulling out some paperwork and eventually he pulls out this.
[21:52.960 --> 21:57.640]  I know it's hard to read, but it's the Government Systems' EW and SIGINT 2006 Strategic Plan.
[21:59.140 --> 22:02.800]  Not knowing exactly what an EW and SIGINT was, I had to look it up.
[22:02.940 --> 22:07.060]  It's the Electronic Warfare Signal Intelligence 2006 Strategic Plan.
[22:08.140 --> 22:10.780]  The date on the photo is 2005.
[22:12.720 --> 22:17.000]  But I'm here to say that I'm not all about doom and gloom.
[22:17.120 --> 22:21.800]  I mean, the days of sucking data off of machines with your mind is long gone.
[22:22.040 --> 22:23.200]  Call it shoulder surfing.
[22:23.320 --> 22:24.220]  Call it whatever you want.
[22:24.320 --> 22:25.060]  It is dead.
[22:25.360 --> 22:27.960]  It will never work again after this talk.
[22:28.940 --> 22:29.860]  It won't.
[22:30.380 --> 22:33.320]  Because there's one product on the market that kills it dead.
[22:33.820 --> 22:34.740]  Privacy screens.
[22:34.740 --> 22:35.380]  Nope.
[22:47.700 --> 22:50.440]  A little itchy, a little hot, but it works.
[22:54.900 --> 22:56.240]  It's Japanese, right?
[22:56.380 --> 22:57.980]  It is definitely Japanese.
[23:00.740 --> 23:02.760]  They think of everything first.
[23:03.220 --> 23:05.660]  Most things they think of first are good.
[23:06.820 --> 23:10.480]  Now, this one was an interesting session that I got.
[23:10.480 --> 23:15.240]  I was so excited to actually shoulder surf this computer that I almost missed what it was sitting on.
[23:19.160 --> 23:24.640]  So, the point is, sucking isn't just for shoulder surfers anymore.
[23:24.980 --> 23:26.480]  Sucking data off of machines.
[23:26.960 --> 23:29.980]  This is a section that I call kiosk hacking.
[23:30.160 --> 23:31.820]  For example, here's a kiosk in the airport.
[23:32.000 --> 23:33.100]  This is the Delta kiosk.
[23:33.120 --> 23:33.820]  What's the OS?
[23:35.540 --> 23:37.020]  Yeah, you see how easy this is?
[23:37.020 --> 23:41.540]  Like, if I told a hacker, okay, that Delta kiosk over there, I want the operating system.
[23:41.660 --> 23:43.180]  I want to know, you know, the IP address.
[23:43.340 --> 23:45.780]  I want to know the networking technologies that it's using, blah, blah, blah.
[23:46.000 --> 23:48.760]  The hacker would be like, ooh, okay, I've got to figure out if it's wireless.
[23:48.900 --> 23:50.660]  I've got to figure out what access point it's on, blah, blah, blah.
[23:50.720 --> 23:53.020]  I've got to do some, like, window sizes to figure out.
[23:53.420 --> 23:54.520]  Or you just look.
[23:55.720 --> 23:56.820]  That's no-tech hacking.
[23:57.580 --> 23:59.300]  For example, here's a check-in terminal.
[24:00.440 --> 24:04.680]  This one is the thing that takes your tickets, you know, at the airport.
[24:04.680 --> 24:06.940]  It has some nice error screens on it.
[24:07.500 --> 24:09.460]  Here's one at the grocery store.
[24:09.580 --> 24:10.160]  What's the OS?
[24:12.660 --> 24:14.120]  They never updated it.
[24:14.360 --> 24:16.400]  Yeah, that's really good.
[24:17.140 --> 24:17.540]  Wow.
[24:18.480 --> 24:18.880]  Nice.
[24:20.460 --> 24:21.640]  The grocery store, right?
[24:21.920 --> 24:22.120]  Right.
[24:22.160 --> 24:22.740]  Okay, yeah.
[24:23.300 --> 24:24.700]  But anyway, like, here's...
[24:24.700 --> 24:25.540]  These are out of order.
[24:25.640 --> 24:25.880]  I'm sorry.
[24:26.040 --> 24:31.180]  But if I wanted to tell a hacker to get all that information about this machine, it'd be very difficult unless they moved closer.
[24:31.180 --> 24:32.060]  There it is.
[24:32.180 --> 24:34.720]  The IP is the operating system they're running.
[24:35.080 --> 24:35.220]  Okay.
[24:35.440 --> 24:36.500]  How about this kiosk?
[24:36.560 --> 24:38.520]  This is a nice kiosk, public phone.
[24:38.720 --> 24:42.080]  Figure out the OS and every bad file record segment on it.
[24:43.900 --> 24:44.820]  Easy as well.
[24:45.780 --> 24:47.100]  Talking about kiosks.
[24:47.260 --> 24:48.320]  Here's the next skill.
[24:48.500 --> 24:51.220]  Hacking hardened workstations with one keystroke.
[24:51.360 --> 24:52.120]  What's the keystroke?
[24:54.620 --> 24:55.920]  I haven't heard it yet.
[24:56.600 --> 24:57.440]  One key.
[24:57.660 --> 24:58.140]  Enter.
[24:58.640 --> 24:59.080]  Enter.
[24:59.300 --> 24:59.520]  Okay.
[24:59.680 --> 25:00.320]  Well, here's a kiosk.
[25:00.420 --> 25:01.640]  This is just an employment...
[25:01.640 --> 25:04.040]  You know, one of those employment things at a store.
[25:04.460 --> 25:06.480]  The key is actually shift.
[25:06.900 --> 25:08.180]  You know the old sticky keys thing?
[25:08.500 --> 25:10.560]  Hit shift five times or keep it down.
[25:10.960 --> 25:13.260]  Like, all the kiosks forget about this one.
[25:13.560 --> 25:18.140]  They lock the thing down from, like, everything except that.
[25:18.440 --> 25:19.600]  Works all over the place.
[25:19.740 --> 25:20.900]  Gets you access to this menu.
[25:21.020 --> 25:22.620]  Pops up the start button.
[25:22.760 --> 25:24.020]  Let's you get in and start playing around.
[25:24.020 --> 25:25.660]  Here's one for Barnes...
[25:25.660 --> 25:27.980]  A unknown book...
[25:30.720 --> 25:31.160]  Place.
[25:32.100 --> 25:32.480]  Whoops.
[25:34.060 --> 25:35.360]  Yeah, but anyway, you hit the key.
[25:35.740 --> 25:36.240]  Comes up.
[25:36.360 --> 25:36.900]  There's the menu.
[25:37.160 --> 25:37.860]  One keystroke.
[25:39.780 --> 25:40.220]  Wow.
[25:40.940 --> 25:42.380]  I think you can hold it, right?
[25:42.680 --> 25:42.820]  Yeah.
[25:43.540 --> 25:43.820]  All right.
[25:43.960 --> 25:46.080]  Well, tell the joke right when you do it.
[25:46.160 --> 25:47.180]  It'll come off better.
[25:48.820 --> 25:54.280]  Now, let me talk about the granddaddy, one of the granddaddies of all kiosks.
[25:54.280 --> 25:55.280]  Do you guys have, like...
[25:55.280 --> 25:56.980]  You have the red light cameras around here, right?
[25:57.460 --> 26:02.040]  You go through a red light, it takes your picture of your license plate, mails you a ticket.
[26:02.300 --> 26:03.740]  How much does that suck?
[26:04.280 --> 26:07.500]  Now, as hackers, we have to hate something like that.
[26:07.520 --> 26:08.480]  We have to.
[26:08.940 --> 26:16.220]  Because it's technology that makes us pay money to do something that should be free.
[26:19.080 --> 26:21.940]  It's dangerous, granted, but it should be free.
[26:22.160 --> 26:24.440]  So, as hackers, we have to hate this.
[26:24.600 --> 26:30.700]  So, every opportunity I have to figure out what happens behind the scenes of those, like, systems, I'm all over it.
[26:30.900 --> 26:38.060]  So, imagine the look on my face when I drove by this intersection that had a red light camera, and I see this.
[26:38.640 --> 26:41.800]  Two guys inside the box working on the system itself.
[26:42.340 --> 26:54.620]  So, I immediately pulled off the road, ran over a curb, drove my car into a bush, forward shoulder roll, came up with the camera, got the picture, car explodes.
[26:56.100 --> 26:57.200]  I planned it all out.
[26:57.300 --> 26:58.080]  The guy's distracted.
[26:58.080 --> 26:59.820]  He walks away, like, oh, it's an accident.
[27:00.040 --> 27:01.080]  No, it's not how it happened.
[27:01.320 --> 27:03.080]  I just walked up to him.
[27:04.400 --> 27:04.800]  Right?
[27:05.060 --> 27:08.980]  And I thought, you know, this shooting pictures from the bush thing is just tired.
[27:09.720 --> 27:12.820]  So, I just walked up to him, and I'm like, is that a computer in there?
[27:17.960 --> 27:20.960]  And the two guys turn around, and they just look at me.
[27:21.980 --> 27:23.160]  I didn't get that.
[27:24.300 --> 27:26.720]  Computer guys, you know, we're supposed to represent.
[27:28.700 --> 27:30.040]  So, I switched tactics.
[27:30.240 --> 27:32.200]  He was obviously not buying the whole thing.
[27:32.360 --> 27:37.380]  I said, yeah, I know that sounds really weird, but I'm a computer guy, too.
[27:37.700 --> 27:40.620]  And, dude, I think you have the coolest job in the world.
[27:42.480 --> 27:46.540]  He looks at his friend, looks at me, big smile on his face.
[27:47.940 --> 27:49.740]  He's like, yeah, this is pretty cool.
[27:49.740 --> 28:01.140]  He's like, yeah, this is a wireless system, and we don't really have to open the boxes, because we can use wireless keyboards and mice to actually control it from, like...
[28:06.150 --> 28:07.390]  So, I said, really?
[28:07.470 --> 28:10.350]  That's probably, like, really specialized, like, high-tech.
[28:10.550 --> 28:12.590]  He's like, no, it's just like Microsoft, you know, wireless.
[28:12.590 --> 28:13.950]  You get it at, like...
[28:13.950 --> 28:16.570]  And then he sort of got this look.
[28:16.830 --> 28:18.650]  Like, he had just said the wrong thing.
[28:18.790 --> 28:21.110]  I'm like, I don't... dude, you're a little bit over my head.
[28:22.590 --> 28:26.550]  I was like, I think this is cool, but you're a lot smarter than me.
[28:26.630 --> 28:29.030]  You mind if I just take a picture so that I can, like, show my friends?
[28:29.110 --> 28:29.910]  He's like, yeah, sure.
[28:33.610 --> 28:34.450]  Took the picture.
[28:34.970 --> 28:39.870]  Remember our little exercise from electronic deduction, how much you can get from these things?
[28:40.110 --> 28:44.550]  Well, there's two icons that just made me, like, instantly fall over when I took the picture.
[28:48.130 --> 28:51.570]  Internet Explorer and Symantec PC Anywhere.
[28:52.870 --> 28:55.230]  And I said, Symantec PC Anywhere?
[28:55.410 --> 28:56.370]  I've heard of that.
[28:56.490 --> 28:58.990]  That's, like, you know, remote control software.
[28:59.470 --> 29:03.110]  He's like, yeah, but, you know, we're on a closed wireless network.
[29:06.070 --> 29:07.550]  I said, what do you mean closed?
[29:07.690 --> 29:10.870]  He's like, well, we use 10 addresses, so, you know, you can't really...
[29:10.870 --> 29:12.770]  It doesn't get to the Internet, so it can't be...
[29:12.770 --> 29:14.350]  And then he got that look again.
[29:17.530 --> 29:19.390]  Yeah, I left after that.
[29:21.690 --> 29:23.970]  All right, so here's... this is a great one.
[29:24.070 --> 29:26.370]  I love the other granddaddy of kiosks.
[29:26.470 --> 29:29.210]  Guess the operating system of this kiosk.
[29:33.110 --> 29:36.790]  An ATM machine that needs to be activated in seven days.
[29:39.170 --> 29:40.850]  Get your money out quick, people.
[29:43.230 --> 29:50.150]  I'm wondering if, like, proceeds, like ATM fees, actually go to pay for the license to make it legitimate or not.
[29:50.570 --> 29:51.090]  Okay.
[29:52.030 --> 29:55.330]  So here is... here is skill number three.
[29:55.770 --> 29:59.490]  Okay, skill number three is network and email sniffing without a computer for less than $3.
[30:00.510 --> 30:01.890]  Okay, here's how it works.
[30:02.030 --> 30:03.190]  I'm going to do it from here.
[30:03.310 --> 30:04.870]  Can anybody tell me where I'm going to start?
[30:05.590 --> 30:06.030]  TV.
[30:07.290 --> 30:07.710]  Very nice.
[30:07.950 --> 30:09.010]  It's not just any TV.
[30:09.150 --> 30:10.670]  It's a TV with one of these in the drawer.
[30:11.870 --> 30:12.310]  Hmm.
[30:13.310 --> 30:19.710]  It's protected, though, with a high-tech physical security system called a piece of plastic.
[30:20.810 --> 30:22.990]  In the biz, we call this a collar.
[30:24.290 --> 30:27.630]  It's very high-tech because you have to have a special tool to open it.
[30:28.010 --> 30:38.170]  Or, like my friend Serbo likes to do, you can just jam a whole bunch of toilet paper down in there to lock up the little coax nut in there and jam all this toilet paper in there and then just turn the collar.
[30:38.350 --> 30:41.650]  And because it's so jammed up in there, the coax thing turns, you pull it right off.
[30:42.150 --> 30:43.170]  That's step one.
[30:43.650 --> 30:44.730]  It's a little technical.
[30:44.930 --> 30:46.490]  I know I'm stretching just a little bit here.
[30:47.070 --> 30:47.190]  All right.
[30:47.470 --> 30:48.910]  Step two is to buy this device.
[30:49.050 --> 30:50.670]  I got it for $2.99 at a thrift store.
[30:50.770 --> 30:56.450]  This is a circa, like, 1994, back when HOPE started, cable tuner, right?
[30:56.950 --> 31:07.710]  You hook it up to the cable box and TV out, and then you can adjust the TV stations because that's the second layer of security on the system is they lock the TVs down so you can't get to just any station.
[31:08.350 --> 31:13.630]  So this bypasses that, lets you go to whatever station you want, put the TV on three, use your cable box.
[31:13.770 --> 31:15.450]  You start to see things like this.
[31:16.390 --> 31:18.290]  Talk about sniffing network traffic.
[31:19.330 --> 31:23.570]  People logging, you know, doing their bills for their room.
[31:23.710 --> 31:36.430]  Here's an administrative console on the hotel network because, gee, it's just more expensive to put the hotel's administrative network for all the billing and the pay-per-view network on, you know, separate drops.
[31:37.210 --> 31:41.230]  You pay for the network once and you put it all together, right?
[31:41.350 --> 31:45.910]  That's what lets people look at hotel check-in from their room.
[31:46.970 --> 31:55.810]  Okay, well, this particular admin console lit up really early in the morning and started browsing porn.
[31:58.890 --> 32:03.030]  Not only was he browsing porn, but he got a pop-up that says, you've had too much.
[32:05.170 --> 32:07.510]  Never really heard of anybody get cut off.
[32:07.750 --> 32:08.310]  This is...
[32:08.870 --> 32:10.010]  It's a new thing.
[32:10.730 --> 32:17.310]  But I can watch guests log into eBay and, you know, log into their American Express account, go into their Internet banking account.
[32:17.550 --> 32:18.670]  You know, all this stuff.
[32:18.790 --> 32:21.910]  Remember, this is network sniffing without a computer for less than $3.
[32:21.910 --> 32:22.990]  This is the skill.
[32:23.530 --> 32:25.090]  Now, this was an interesting story.
[32:25.230 --> 32:25.690]  I was at a...
[32:25.690 --> 32:27.270]  I was at a DOD conference.
[32:28.730 --> 32:30.230]  And I did this little thing.
[32:30.350 --> 32:30.790]  And I see this...
[32:30.790 --> 32:38.750]  This person go back to their room after the conference and they get on to the Yahoo, the Air Force message groups and start reading message...
[32:38.750 --> 32:45.650]  You know, I'm like, I got to like a person that goes to a conference, goes back to their room after the conference and keeps working.
[32:45.650 --> 32:46.990]  I mean, that's like dedication.
[32:47.410 --> 32:48.670]  I mean, I like this guy already.
[32:48.910 --> 32:49.690]  I was like, this is...
[32:49.690 --> 32:50.590]  This guy's cool.
[32:50.990 --> 32:53.150]  You know, he's looking through all these messages and everything.
[32:53.350 --> 32:54.690]  He sends an email off to his wife.
[32:54.830 --> 32:57.130]  He's like, long day, really tired, going to bed.
[32:57.810 --> 33:00.210]  I'm like, dude, that's cool.
[33:00.710 --> 33:03.810]  You know, I wanted to go and like order him like room service or something.
[33:03.970 --> 33:05.110]  Just lighten up.
[33:05.270 --> 33:05.570]  You know, that's cool.
[33:05.950 --> 33:12.070]  Well, after he sends the email, he does a Google search for brothels in Las Vegas and finds his way to the Shady Lady Ranch.
[33:12.070 --> 33:14.350]  It prints out directions.
[33:15.310 --> 33:17.250]  Well, technically, I don't think he was lying.
[33:17.550 --> 33:19.190]  I think he did go to bed.
[33:21.450 --> 33:22.090]  All right.
[33:22.330 --> 33:24.530]  Skill number four, seeing past vehicles.
[33:24.850 --> 33:26.830]  This is the x-ray vision number two.
[33:28.070 --> 33:32.030]  We're using words and twisting them and making them puns.
[33:32.130 --> 33:33.150]  This is supposed to be funny.
[33:33.270 --> 33:34.430]  It's not seeing through vehicles.
[33:34.610 --> 33:38.590]  It's seeing through the weak exterior that tries to hide what they really are.
[33:39.310 --> 33:39.850]  This is...
[33:39.850 --> 33:41.130]  For example, what's this?
[33:41.770 --> 33:42.170]  Fed.
[33:42.730 --> 33:43.830]  Yeah, it could be a Fed.
[33:44.010 --> 33:49.850]  It's actually an undercover police car because they write police interceptor on the back of undercover police cars.
[33:50.430 --> 33:52.410]  So that they can stay undercover.
[33:53.310 --> 33:54.130]  Don't get that.
[33:54.550 --> 33:54.710]  All right.
[33:54.850 --> 33:55.650]  What about this one?
[33:57.710 --> 33:58.110]  Government.
[33:59.170 --> 34:00.970]  This is the van with the candy.
[34:01.170 --> 34:01.750]  Yes, it is.
[34:03.370 --> 34:04.010]  All right.
[34:04.210 --> 34:04.470]  U.S.
[34:04.550 --> 34:05.070]  government vehicle.
[34:05.210 --> 34:07.310]  Okay, what does the driver of this vehicle do for a living?
[34:12.530 --> 34:13.890]  He doesn't get out much.
[34:14.770 --> 34:15.410]  Ba-da-da-dump.
[34:15.890 --> 34:16.070]  All right.
[34:16.550 --> 34:18.130]  What about the social status of this person?
[34:20.050 --> 34:21.070]  Yes, they're a geek.
[34:21.210 --> 34:23.090]  But the question is, are they a real geek?
[34:23.090 --> 34:24.850]  You have to judge from the reading material.
[34:25.050 --> 34:26.390]  It's Stephen King's The Cell.
[34:27.350 --> 34:32.170]  If they throw it out the window while it's flaming, then they're probably a true geek.
[34:33.610 --> 34:38.050]  Otherwise, they're just a tool that's reading another Stephen King book, which, I'm sorry, kind of sucked.
[34:39.310 --> 34:39.930]  All right.
[34:40.210 --> 34:41.590]  Driver of this vehicle.
[34:42.050 --> 34:43.190]  I'll give you a clue.
[34:45.870 --> 34:52.910]  Now, I really don't know a whole lot about Navy Chiefs, because I wasn't in the military, but I watched movies.
[34:54.150 --> 34:57.010]  And I know a little bit about Navy Chiefs.
[34:57.090 --> 34:59.490]  Now, this particular Navy Chief was in custody.
[34:59.490 --> 35:01.050]  He's in handcuffs.
[35:01.270 --> 35:06.510]  He's literally chained to his seat in, like, an airport, and he's got two escorts.
[35:06.990 --> 35:07.590]  All right?
[35:07.890 --> 35:17.590]  So, he smashes the face of one escort with his own face and does this to his other escort, again, with no hands.
[35:18.350 --> 35:20.770]  He's beating people up with his face.
[35:22.210 --> 35:24.170]  And he seems okay with that.
[35:25.550 --> 35:26.130]  Right?
[35:26.250 --> 35:30.110]  But this is not just any ordinary Navy Chief.
[35:31.290 --> 35:33.330]  What else can you tell, looking at the stickers?
[35:33.810 --> 35:34.390]  NRA.
[35:35.010 --> 35:35.590]  NRA.
[35:36.270 --> 35:37.070]  Mm-hmm.
[35:37.910 --> 35:42.410]  American rifle this, you know, rifle that, guns this, guns that.
[35:42.870 --> 35:44.890]  This is actually a gun-loving Navy Chief.
[35:46.590 --> 35:51.650]  I'm standing in the parking lot, taking photos of a gun-loving Navy Chief's ride.
[35:53.170 --> 35:58.150]  So, I'm thinking about that, and I'm like, it's probably not the smartest thing I've ever done.
[35:58.430 --> 36:04.390]  So, I'm just getting ready to leave, and I see somebody try to jack Navy Chief's car.
[36:05.390 --> 36:08.130]  And I'm watching this, and I, like, can't believe this.
[36:08.490 --> 36:13.050]  And the person gets in the car, starts it up, and drives away.
[36:13.110 --> 36:14.210]  Not, like, in a rush.
[36:14.490 --> 36:15.630]  Just, like, real casual.
[36:15.630 --> 36:19.830]  And then it dawned on me, this is the Navy Chief.
[36:20.470 --> 36:21.210]  Have a look.
[36:29.220 --> 36:31.060]  All right, so this skill doesn't always work.
[36:33.600 --> 36:37.830]  But if that was really her, I should have been a lot more afraid than I was, because it's subtle.
[36:38.290 --> 36:40.310]  All right, what can you tell me about the owner of this vehicle?
[36:41.280 --> 36:46.410]  If they're parked where they work, for example, could you tell me where they live?
[36:46.700 --> 36:48.370]  How would you maybe go about doing that?
[36:48.870 --> 36:49.430]  Parking stickers.
[36:49.540 --> 36:50.020]  Or suburbs.
[36:50.430 --> 36:51.350]  Stickers, very good.
[36:51.480 --> 36:52.120]  Looking at stickers.
[36:52.290 --> 36:53.250]  You can look at parking stickers.
[36:53.640 --> 36:55.460]  Here's an oil change sticker.
[36:55.660 --> 36:58.120]  It has an address on it, if it's not where they're parked.
[36:58.330 --> 37:01.600]  If the address isn't for where they're parked, it's for, like, where they live.
[37:01.810 --> 37:03.200]  All right, you can tell stuff like this.
[37:03.450 --> 37:05.640]  Looking at this parking lot, what does a hacker see?
[37:05.720 --> 37:07.290]  What's the one vehicle that stands out?
[37:08.870 --> 37:10.700]  DoD sticker on the red car.
[37:11.080 --> 37:12.200]  Very nice, right there.
[37:12.450 --> 37:14.220]  Just screams Fed, right?
[37:14.910 --> 37:15.720]  Here's the sticker.
[37:15.930 --> 37:17.480]  Military District of Washington.
[37:18.680 --> 37:21.350]  These things are all over the place.
[37:21.810 --> 37:23.770]  You know, but it's just...
[37:24.520 --> 37:26.540]  I'm not going to bash the government here, right?
[37:27.020 --> 37:31.560]  But I'm looking at this, and I'm like, okay, these all say the same thing for George G.
[37:31.700 --> 37:32.160]  Meade, Maryland.
[37:32.310 --> 37:33.370]  I have no clue what's there.
[37:33.540 --> 37:34.910]  It's like there's nothing really there.
[37:34.910 --> 37:40.680]  All right, but I can't get past the fact that they're, like, it's the same thing, and it's in different colors.
[37:40.830 --> 37:41.910]  And I'm like, that's really stupid.
[37:42.750 --> 37:47.980]  Oh, before I forget, how many people have, like, social engineering, have you ever, like, heard of social engineering?
[37:48.250 --> 37:50.350]  Like how that works a little bit?
[37:50.790 --> 37:51.540]  Oh, that's later.
[37:51.850 --> 37:53.060]  It's, like, farther.
[37:53.220 --> 37:54.040]  I'll tell you about that later.
[37:54.180 --> 37:55.000]  But anyway, back to my rant.
[37:55.250 --> 37:57.850]  This thing about these colors, this is idiotic.
[37:57.960 --> 38:00.330]  Why have different colors that say the same thing?
[38:00.330 --> 38:02.500]  Civilian officer and enlisted.
[38:02.770 --> 38:03.220]  Civilian.
[38:03.350 --> 38:04.350]  Which one's civilian?
[38:04.520 --> 38:04.790]  Green.
[38:05.060 --> 38:06.160]  Oh, green is civilian.
[38:06.770 --> 38:06.930]  Oh.
[38:07.390 --> 38:07.930]  What's red?
[38:09.020 --> 38:09.540]  Enlisted.
[38:09.770 --> 38:10.250]  Enlisted.
[38:10.430 --> 38:11.770]  See, this is social engineering.
[38:13.410 --> 38:14.850]  Twenty years ago, anyway.
[38:15.370 --> 38:19.790]  You just ask questions, and you social engineer them, and suddenly now you know civilian and enlisted.
[38:19.790 --> 38:20.250]  That's...
[38:20.670 --> 38:20.850]  Sorry.
[38:20.960 --> 38:21.500]  That's how it works.
[38:21.620 --> 38:21.810]  All right.
[38:21.910 --> 38:23.870]  But yeah, I have a big collection of these stickers.
[38:24.060 --> 38:27.600]  I'm driving along, and I just, you know, I'm taking pictures, like, out the window of these things.
[38:28.160 --> 38:28.980]  It's a sickness.
[38:30.250 --> 38:31.140]  It's a disease.
[38:32.540 --> 38:36.540]  But I have this talk, and so I guess it's all worth it.
[38:37.390 --> 38:38.770]  I get good ones every now and then.
[38:38.950 --> 38:40.250]  This is Fort Huichukka.
[38:41.480 --> 38:41.850]  Huachuca.
[38:42.600 --> 38:43.160]  Bless you.
[38:43.720 --> 38:44.080]  Okay.
[38:44.620 --> 38:46.790]  And this is the I Hid Napserf Wersen.
[38:50.060 --> 38:54.980]  I think the Hachuca or whatever, I think that one sounded better than I Hid Napserf Wersen.
[38:55.310 --> 38:57.680]  But what is the I Hid Napserf Wersen?
[38:57.680 --> 38:58.180]  Anybody know?
[38:58.750 --> 39:00.020]  It's a Surfer's Club.
[39:00.140 --> 39:01.310]  It's a Surfer's Club.
[39:02.140 --> 39:02.620]  That's...
[39:02.620 --> 39:03.160]  Maybe.
[39:03.720 --> 39:06.980]  Or it could be the Indian Head Naval Surface Warfare Center.
[39:07.220 --> 39:13.180]  Now, this next picture, I just love this next picture because I defied death to bring it to you.
[39:13.180 --> 39:17.680]  I mean, literally, this car blows past me like 200 miles an hour.
[39:18.700 --> 39:20.060]  Like a red streak.
[39:20.850 --> 39:23.160]  And I realized it was a Saturn Coupe.
[39:24.640 --> 39:26.620]  And I thought, something's up.
[39:28.520 --> 39:33.120]  So, I eventually caught up with them to try to figure out what was going on.
[39:33.430 --> 39:36.220]  I risked my life because I don't have a great car.
[39:37.280 --> 39:43.020]  But when I caught up with this vehicle and got a picture of the license plate, I was suddenly very happy that I was able to keep up.
[39:47.970 --> 39:48.770]  All right.
[39:48.870 --> 39:53.710]  But it's definitely not the funniest or most ironic vehicle I've ever gotten a picture of.
[39:53.790 --> 39:54.510]  How about this one?
[39:56.770 --> 40:03.430]  This is the Trojan Horse Trucking Company, a contractor for the U.S.
[40:03.550 --> 40:06.530]  Postal Service that delivers mail.
[40:06.690 --> 40:10.850]  So, somebody in the government hired a trucking company called Trojan Horse.
[40:14.010 --> 40:14.790]  All right.
[40:14.870 --> 40:15.950]  Let's try your skills again.
[40:16.170 --> 40:17.050]  Here's a vehicle.
[40:17.570 --> 40:18.830]  I'll warn you right now.
[40:18.990 --> 40:21.270]  Before you start profiling this person, you're probably wrong.
[40:21.450 --> 40:22.250]  But give it a shot.
[40:22.630 --> 40:23.470]  Tell me about this person.
[40:23.570 --> 40:23.970]  NYU.
[40:26.570 --> 40:27.330]  What's NYU?
[40:28.190 --> 40:29.190]  New York University.
[40:29.310 --> 40:29.450]  Yeah.
[40:29.570 --> 40:29.690]  Okay.
[40:29.750 --> 40:30.990]  So, it's a college student.
[40:31.770 --> 40:33.170]  They like Max.
[40:33.690 --> 40:33.970]  Nope.
[40:34.510 --> 40:35.150]  It's all a decoy.
[40:36.030 --> 40:36.790]  It's actually...
[40:36.790 --> 40:40.950]  It's a subtle disguise to twist with your brain and screw you all up.
[40:41.110 --> 40:46.070]  Because to figure out what they really are, you have to look in the front window to see this.
[40:46.070 --> 40:46.550]  It's...
[40:47.870 --> 40:49.690]  It's actually a ninja driving the car.
[40:50.310 --> 40:51.630]  Ninjas screw with you, man.
[40:51.810 --> 40:52.770]  They do that.
[40:52.970 --> 40:54.730]  You've got to watch that stuff.
[40:54.850 --> 40:54.970]  All right.
[40:55.010 --> 40:55.710]  Here's another exercise.
[40:56.010 --> 40:58.810]  Tell me exactly how much money this person makes a year.
[40:59.110 --> 41:00.010]  To the penny.
[41:00.870 --> 41:02.030]  How would you do it?
[41:03.010 --> 41:03.910]  To the penny.
[41:06.530 --> 41:07.390]  Tax records.
[41:07.390 --> 41:08.230]  Tax records.
[41:08.410 --> 41:08.850]  Too high tech.
[41:11.710 --> 41:13.970]  Are you one of the ones that saw the talk?
[41:14.550 --> 41:15.230]  Okay, good.
[41:15.230 --> 41:15.870]  Well, yes.
[41:16.070 --> 41:18.250]  Because the paycheck is actually sitting on the front seat.
[41:18.370 --> 41:19.430]  There's their earnings statement.
[41:19.710 --> 41:21.730]  Shows exactly how much money they're making.
[41:22.650 --> 41:26.010]  Lists their social security number, their, you know, banking information, all that sort of stuff.
[41:26.190 --> 41:33.890]  I will tell you that it is just north of $250,000 per year because they pay smart people lots of money.
[41:35.270 --> 41:35.790]  All right.
[41:35.990 --> 41:37.010]  Skill number five.
[41:37.730 --> 41:41.890]  Sucking sensitive data from a corporate network from the parking lot without a wireless device.
[41:42.530 --> 41:46.190]  This one takes a long time to say, but it's, it really comes in handy.
[41:46.350 --> 41:47.990]  We could do it against this building.
[41:48.170 --> 41:49.130]  How would we do that?
[41:52.470 --> 41:53.130]  Dumpster diving.
[41:53.130 --> 41:59.050]  Dumpster diving, which is punchy and has a nice feel to it and is significantly shorter than sucking sensitive data from a corporate network.
[41:59.330 --> 41:59.430]  Right.
[41:59.710 --> 42:01.070]  But I'm sorry.
[42:01.970 --> 42:03.850]  This is not dumpster diving.
[42:06.470 --> 42:09.050]  It does involve a dumpster, but there's no diving.
[42:10.270 --> 42:13.510]  In fact, none of these required dumpster diving.
[42:13.510 --> 42:16.570]  This was all sucking data off a corporate network without a wireless device.
[42:16.770 --> 42:19.610]  It's, you just stick your head in the open door of the dumpster these days.
[42:19.950 --> 42:21.130]  Find stuff like this.
[42:21.470 --> 42:26.510]  Service order requests, administrative printouts, project diagrams, purchase orders.
[42:26.670 --> 42:27.730]  This is a Watts thing.
[42:27.970 --> 42:29.870]  You know, it's just a wide area telephone.
[42:30.070 --> 42:31.250]  You guys know what a Watts is, right?
[42:31.290 --> 42:34.350]  Here's purchase orders, private line tariffs, something or others.
[42:35.430 --> 42:38.930]  I don't know what this is, but I can't leave it on the screen for too long because it's proprietary.
[42:40.790 --> 42:43.850]  There's this, which is a key sales authorization form.
[42:44.090 --> 42:48.590]  This is salesman, how much commission they made on a contract and their social security numbers.
[42:49.950 --> 42:50.790]  Comes in handy.
[42:50.870 --> 42:51.510]  Here's how it works.
[42:51.610 --> 42:52.410]  You find a dumpster.
[42:52.530 --> 42:55.050]  You optionally look around to see if there's people watching.
[42:57.310 --> 42:57.710]  Irrelevant.
[42:57.910 --> 42:58.870]  Doesn't seem to matter.
[42:59.190 --> 43:01.270]  I actually waved to some people and they wave back.
[43:01.490 --> 43:02.330]  That's clever.
[43:03.450 --> 43:05.530]  Stick your head in and start taking pictures.
[43:05.850 --> 43:07.370]  This is the sort of stuff that you see.
[43:07.370 --> 43:09.250]  Another document I can't leave up for very long.
[43:09.390 --> 43:10.990]  It's customer confidential information.
[43:11.830 --> 43:13.570]  Here's a healthcare invoice.
[43:13.770 --> 43:15.810]  Again, confidential healthcare information.
[43:16.410 --> 43:21.790]  This is a healthcare provider actually throwing away, you know, medical data.
[43:22.910 --> 43:28.310]  There's this thing, this really high-tech device that you're supposed to put it in before you put it in the trash.
[43:28.370 --> 43:29.850]  It's like a pasta machine.
[43:30.030 --> 43:33.510]  I forget the name of it, but it's new technology.
[43:33.510 --> 43:37.610]  All right, how many dumpster divers are out here?
[43:37.670 --> 43:38.610]  How many people can...
[43:38.610 --> 43:40.910]  Tell me the best thing you ever found in a dumpster.
[43:42.290 --> 43:42.650]  Money.
[43:43.450 --> 43:44.810]  Whew, that's hard to beat.
[43:45.270 --> 43:47.570]  Because you can just buy the other stuff with the money you found.
[43:47.690 --> 43:48.510]  That's tough.
[43:48.650 --> 43:48.990]  What else?
[43:52.390 --> 43:53.270]  Ooh, that's nice.
[43:53.430 --> 43:54.090]  What was that in the back?
[43:54.090 --> 43:55.050]  I got an IMA
[44:00.760 --> 44:01.400]  mark on it.
[44:01.520 --> 44:02.040]  Oh.
[44:02.500 --> 44:03.440]  I missed all the OS.
[44:03.680 --> 44:03.980]  It's fine.
[44:04.300 --> 44:04.700]  Nice.
[44:05.200 --> 44:05.720]  That's...
[44:05.720 --> 44:06.800]  That's well done.
[44:07.580 --> 44:08.100]  More!
[44:08.100 --> 44:08.140]  Wow.
[44:08.520 --> 44:09.440]  That's no-tech.
[44:09.800 --> 44:10.580]  Security cards.
[44:10.640 --> 44:11.600]  Security cards?
[44:11.780 --> 44:12.580]  All right, you're all lame.
[44:12.860 --> 44:13.300]  Come on.
[44:13.660 --> 44:14.660]  Ass a micrometer.
[44:14.880 --> 44:16.200]  Oh, an ass...
[44:16.200 --> 44:16.520]  What?
[44:17.880 --> 44:18.920]  Ass a micrometer.
[44:19.760 --> 44:20.640]  Oh, that sounds cool.
[44:20.980 --> 44:21.500]  Lame.
[44:23.620 --> 44:24.320]  All right.
[44:24.800 --> 44:37.580]  We could go on all day, but you're just not going to beat me on this, because I have perfected This skill, I have found the coolest thing in a dumpster ever, as long as we can extend it just a little bit and assume that a landfill is just a big dumpster,
[44:37.680 --> 44:37.820]  right?
[44:39.280 --> 44:39.640]  Right?
[44:39.820 --> 44:43.560]  So I'm driving by a landfill, and I see this guy pulling in.
[44:46.990 --> 44:48.990]  So I was like, dude, are you done with that?
[44:49.050 --> 44:49.570]  He's like, yep.
[44:57.800 --> 45:04.860]  So yeah, the next time somebody tells you about their Asp... what that thing and saying, did you hear the thing about the Air Force jet?
[45:04.940 --> 45:05.680]  It even had to pilot.
[45:05.900 --> 45:07.900]  That was like... cool.
[45:09.120 --> 45:12.300]  All right, skills number six and seven, the Jedi wave and the Fed blend.
[45:12.580 --> 45:19.680]  Blending in with the Feds and having a conversation with them, I mean, it's a valid skill, because they'll tell you about Fed stuff.
[45:20.640 --> 45:26.020]  You warm up to them real quickly, you get them talking, you drink, you know, it just starts coming.
[45:26.440 --> 45:27.380]  That's the Fed blend.
[45:27.900 --> 45:36.760]  There's also the Jedi wave, which is just a little wave that makes the guards just, like, flip out and go lose their mind and say, you can pass, right?
[45:37.780 --> 45:39.120]  It's the Jedi wave.
[45:39.260 --> 45:45.120]  Well, they both center on the same exact piece of high technology, the one seen here in this picture.
[45:46.060 --> 45:48.080]  The badge, right?
[45:48.220 --> 45:57.860]  Both of these skills require a very high-tech device called a badge, which is a laminated piece of paper on a lanyard.
[45:58.580 --> 46:04.540]  Now, you can get very high-tech with them, but if you use them properly, if you just have it on casually... oh, thank you.
[46:05.040 --> 46:05.680]  Very nice.
[46:05.900 --> 46:06.600]  Like this.
[46:06.760 --> 46:10.420]  This is far beyond... and it has a button.
[46:10.820 --> 46:13.580]  Well, back away.
[46:15.220 --> 46:26.680]  So... if you use the laminated piece of paper properly, like, you know, you're walking with a bunch of people, and you see the guard, and you do the wave with the thing, the guard's like... works for me, all right?
[46:26.900 --> 46:28.240]  It's the badge that's the key.
[46:28.520 --> 46:30.160]  The thing is, they're absolutely everywhere.
[46:30.320 --> 46:32.100]  Sometimes they travel in packs, like here.
[46:32.840 --> 46:36.680]  In fact, you don't even have to go out of your house to, like, pick up badges.
[46:37.120 --> 46:38.440]  I saw this one online.
[46:40.880 --> 46:42.700]  This is the Google recruiting video.
[46:43.560 --> 46:44.440]  I like that one.
[46:44.580 --> 46:45.520]  Here's more badges.
[46:45.680 --> 46:48.620]  All these badges were taken at a cookout that I was not invited to.
[46:50.160 --> 46:52.960]  They fed me and let me take pictures of their badges.
[46:53.120 --> 46:54.700]  Nobody noticed that I was shooting low.
[46:55.500 --> 46:59.900]  Here's this lady, all her junk on her lanyard and post-it notes.
[47:00.100 --> 47:00.880]  She's got a little note there.
[47:01.000 --> 47:04.280]  It says, bring a copy of yesterday's All Hands to DSSHQ.
[47:05.320 --> 47:08.020]  DSS, of course, being the Defense Security Service.
[47:08.220 --> 47:11.320]  You know, those people who tell you not to wear your badges in public.
[47:11.900 --> 47:13.960]  That's who she's talking to.
[47:14.260 --> 47:16.180]  There's these mysterious blue badges.
[47:16.480 --> 47:18.200]  I don't know what they work for.
[47:20.920 --> 47:22.100]  The feds were quiet.
[47:22.240 --> 47:22.400]  Good.
[47:22.640 --> 47:23.100]  All right.
[47:24.420 --> 47:31.000]  So, sometimes people put their badges away and they just, you know, they'll put the site badge away so that you can't take a picture of it and print it out and copy it.
[47:31.060 --> 47:32.780]  But they'll leave, you know, the prox card out.
[47:33.140 --> 47:35.680]  Breaking these is, you know, very high tech.
[47:36.060 --> 47:41.880]  You have to, you know, there's like RFID and you have to understand frequencies and there's this challenge response.
[47:44.020 --> 47:50.380]  Or you can just use the high tech digits that are printed on here, put them into a telephone.
[47:50.640 --> 47:51.780]  That's a 1-800 number.
[47:51.980 --> 47:56.740]  And read the nice lady on the end the numbers at the top of the card and say, where does this thing work?
[47:56.820 --> 47:57.780]  I got like 20 cards.
[47:57.920 --> 47:58.080]  I don't know.
[47:58.180 --> 47:58.940]  And they tell you.
[47:59.560 --> 48:00.820]  It works at this building.
[48:00.920 --> 48:01.760]  It works at this place.
[48:01.900 --> 48:03.040]  Here's the door that it opens.
[48:03.320 --> 48:04.140]  All sorts of stuff.
[48:04.260 --> 48:05.580]  Here's a nice badge that I got.
[48:06.200 --> 48:07.200]  It's a red badge.
[48:07.280 --> 48:09.060]  This lady didn't notice I was shooting really low.
[48:10.660 --> 48:15.860]  This badge will let you walk on to the BWI airfield.
[48:16.900 --> 48:19.880]  Just, just walking onto the airfield.
[48:20.040 --> 48:21.300]  I know, you're skeptical, right?
[48:21.380 --> 48:27.320]  You can't just take a picture of that and laminate it or whatever and be like, walking on the airfield.
[48:27.820 --> 48:31.200]  You actually need one of these to really round out the look.
[48:32.160 --> 48:33.600]  The clothes really make it.
[48:33.680 --> 48:34.900]  You get one of these and you're golden.
[48:35.400 --> 48:38.180]  The problem is, it's not like I'm going to get one of these anytime soon.
[48:38.320 --> 48:39.440]  They just don't go missing.
[48:42.940 --> 48:46.580]  Well, they might go missing, but it's not like one's going to just show up in my luggage.
[48:50.380 --> 48:51.920]  No cause for concern.
[48:53.880 --> 48:55.160]  But yeah, the clothes make it.
[48:55.260 --> 48:57.500]  You can be just about anybody to get the right clothes.
[48:57.500 --> 49:03.340]  You can be the delivery guy or gas and electric guy or the phone guy or whatever just by getting the clothes.
[49:03.500 --> 49:07.140]  And don't think for a second that you have to be sneaky when you take these pictures because you don't.
[49:07.260 --> 49:10.260]  I just walk up to them and I'm like, my son likes big trucks.
[49:10.320 --> 49:11.060]  Can I have your picture?
[49:12.960 --> 49:13.360]  Okay.
[49:13.360 --> 49:13.760]  Done.
[49:14.060 --> 49:18.880]  You don't even have to put any like enthusiasm into it or social engineering or just whatever.
[49:19.280 --> 49:21.320]  Just be sort of dopey and it works.
[49:21.840 --> 49:22.180]  All right.
[49:22.240 --> 49:25.180]  The next skill, passing through walls in a cloud of smoke.
[49:25.960 --> 49:26.880]  This is a good one.
[49:27.920 --> 49:31.520]  It's easier to describe this skill if I just tell you how it unfolded for me.
[49:31.660 --> 49:32.880]  I couldn't get in the front door.
[49:32.980 --> 49:34.480]  This is the lady at the smoker entrance.
[49:36.800 --> 49:40.640]  She's got her hand up in answer to my question, which was, the front door's locked.
[49:40.780 --> 49:41.640]  Can I get in this way?
[49:42.420 --> 49:46.080]  Her answer was, she waved me in.
[49:46.200 --> 49:47.440]  I did show her my badge though.
[49:54.140 --> 49:56.540]  The tie obviously is Photoshopped.
[49:59.520 --> 50:00.380]  How about this one?
[50:00.680 --> 50:02.840]  Accessing locked cabinets with no hands.
[50:05.020 --> 50:07.340]  Get someone else to do it, but they'd have to use their hands.
[50:07.500 --> 50:08.660]  It's like a chicken and egg problem.
[50:10.360 --> 50:12.940]  Do it with your face?
[50:13.600 --> 50:16.640]  Yeah, you could be the Navy chief and just beat through it with your head.
[50:18.220 --> 50:21.700]  Or you just sort of walk along and there it is.
[50:23.200 --> 50:25.540]  As I said, accessing locked cabinets.
[50:25.700 --> 50:26.480]  I didn't say opening.
[50:26.660 --> 50:28.880]  You've got to be careful how you phrase these skills.
[50:29.300 --> 50:30.520]  I thought this was great though.
[50:30.520 --> 50:31.840]  This is a long haul fiber cabinet.
[50:31.960 --> 50:34.860]  It even shows you instructions on how to wire stuff up.
[50:35.520 --> 50:35.980]  That was great.
[50:36.460 --> 50:36.640]  All right.
[50:36.760 --> 50:38.940]  Defeating physical security with junk and stuff.
[50:40.000 --> 50:40.960]  Skill number nine.
[50:41.440 --> 50:43.140]  Pick the most secure lock.
[50:43.360 --> 50:43.440]  Okay.
[50:43.620 --> 50:44.440]  Pick is a bad choice.
[50:46.000 --> 50:47.880]  Select the most secure lock.
[50:49.560 --> 50:50.380]  I hear it.
[50:50.640 --> 50:50.860]  I hear it.
[50:51.140 --> 50:53.000]  No, kryptonite's really good if you're locking up Superman.
[50:54.280 --> 50:55.580]  But we'll start with that one.
[50:55.620 --> 50:56.360]  Here's the kryptonite.
[50:56.460 --> 50:57.020]  How's it broken?
[50:57.860 --> 50:58.560]  Very nice.
[50:58.800 --> 50:59.500]  Use a pen.
[50:59.840 --> 51:00.740]  Here's how it's done.
[51:03.780 --> 51:04.760]  Put it right in the lock.
[51:04.920 --> 51:05.120]  Turn.
[51:05.660 --> 51:06.320]  Pops open.
[51:06.600 --> 51:07.020]  Very nice.
[51:07.380 --> 51:07.660]  All right.
[51:07.740 --> 51:08.480]  How do you break this one?
[51:09.020 --> 51:09.420]  Shim.
[51:10.140 --> 51:10.520]  Very good.
[51:10.740 --> 51:11.480]  But high tech.
[51:11.480 --> 51:12.020]  Bump.
[51:12.220 --> 51:13.060]  Sort of high tech.
[51:13.180 --> 51:13.500]  Bumping.
[51:13.880 --> 51:14.560]  Even more high tech.
[51:15.020 --> 51:15.380]  Hammer.
[51:15.520 --> 51:16.420]  I like the hammer trick.
[51:16.560 --> 51:17.860]  It means you got to have a hammer in your pocket.
[51:18.040 --> 51:18.500]  A little bulky.
[51:19.220 --> 51:23.140]  So we're going from high tech to medium tech to slimming down.
[51:23.680 --> 51:26.140]  Some you can pull open.
[51:26.320 --> 51:28.720]  But I think it's more funny to just use the flosser.
[51:28.940 --> 51:30.020]  The electric flosser.
[51:30.580 --> 51:33.200]  Snip the end off there and put it in the lock.
[51:33.300 --> 51:33.680]  Turn it on.
[51:37.240 --> 51:38.360]  It's a lock pick gun.
[51:39.780 --> 51:40.140]  Nice.
[51:41.960 --> 51:42.280]  Nice.
[51:42.280 --> 51:42.760]  Here's a good one.
[51:42.840 --> 51:43.980]  How do you get into this one?
[51:45.400 --> 51:46.140]  Very nice.
[51:46.340 --> 51:46.940]  Very nice.
[51:47.080 --> 51:47.640]  Thank you, Tool.
[51:47.900 --> 51:48.700]  Thank you, Barry Wells.
[51:48.780 --> 51:49.940]  You guys absolutely rock.
[51:50.080 --> 51:51.500]  Here's Barry showing you how it's done.
[51:51.880 --> 51:54.300]  You roll the toilet paper roll up into a little cylinder.
[51:54.440 --> 51:55.200]  Cut a piece of it.
[51:55.460 --> 51:55.680]  Here we go.
[51:55.680 --> 51:56.400]  Take it in the lock.
[51:57.400 --> 51:58.720]  You twist it a little bit.
[52:02.100 --> 52:07.880]  And open.
[52:11.020 --> 52:11.440]  All right.
[52:11.540 --> 52:12.080]  How about this one?
[52:13.080 --> 52:13.400]  Shim.
[52:13.480 --> 52:13.480]  Shim.
[52:13.640 --> 52:14.400]  Still a little technical.
[52:14.600 --> 52:15.920]  Not as funny as what I got.
[52:18.700 --> 52:20.020]  I think you all said it.
[52:20.140 --> 52:20.460]  But yeah.
[52:20.640 --> 52:21.420]  You use these.
[52:22.440 --> 52:22.760]  Right?
[52:22.860 --> 52:23.840]  You can brute force it.
[52:24.100 --> 52:29.700]  You know, you put a little tension on there and it's got sticking points all the way around the lock.
[52:29.820 --> 52:29.960]  Right?
[52:30.020 --> 52:30.900]  It doesn't work with all of them.
[52:30.980 --> 52:31.800]  It works with most of them.
[52:31.980 --> 52:34.040]  You find sticking points all around the dial.
[52:34.200 --> 52:37.180]  For example, this one sticks at 1.5.
[52:37.340 --> 52:38.320]  This one sticks at 8.
[52:38.440 --> 52:40.940]  You map all the sticking points all the way around the lock.
[52:41.140 --> 52:42.060]  Put them in a little table.
[52:42.180 --> 52:43.640]  Here they are down the right hand side.
[52:43.640 --> 52:45.880]  Get rid of all the ones that aren't a whole number.
[52:46.100 --> 52:47.220]  You're left with a list.
[52:47.360 --> 52:49.420]  Get rid of all the ones that end in the same number.
[52:49.560 --> 52:50.800]  You're left with one number.
[52:50.960 --> 52:53.500]  If that's the third digit of your lock, you've got a problem.
[52:54.580 --> 53:01.160]  If that is the third digit of your lock, little mod 4 and 2 minutes worth of effort, you can get this lock open.
[53:01.600 --> 53:03.520]  Knocks it down to about 100 combinations.
[53:03.920 --> 53:04.600]  Two minutes.
[53:05.180 --> 53:09.620]  So the answer to this security problem is never to let any of this into your buildings.
[53:12.660 --> 53:16.500]  Isn't it crazy when you get into, like, defending stuff, how complicated it gets.
[53:16.680 --> 53:18.700]  I mean, imagine telling people no more toilet paper.
[53:18.840 --> 53:20.940]  That's a big problem.
[53:22.200 --> 53:23.100]  No more hands.
[53:23.200 --> 53:24.700]  You don't have anything to wipe with and...
[53:27.590 --> 53:29.190]  I'm not going down there.
[53:29.470 --> 53:31.730]  It's actually easier just to put up signs anyway.
[53:38.710 --> 53:41.410]  You just... it's fun to just watch people queue up.
[53:41.610 --> 53:42.810]  I think that's great.
[53:43.050 --> 53:44.610]  Another trash attack.
[53:44.610 --> 53:46.630]  Here's a... I love the gap on this door.
[53:47.170 --> 53:48.790]  This one's just begging for a problem.
[53:48.890 --> 53:51.610]  Looking down, you can actually, you know, see all the yummy parts.
[53:52.390 --> 53:55.850]  Looking at the trash can just outside the door, I see this nice little cable.
[53:55.970 --> 53:57.750]  You stick the cable down there, pop the door open.
[53:58.150 --> 53:59.870]  Using trash to defeat locks.
[54:00.010 --> 54:01.350]  How about defeating these cameras?
[54:01.510 --> 54:05.670]  This is... Russ Handorf has very cool stuff on this subject in the book.
[54:05.810 --> 54:07.210]  How do you defeat these cameras?
[54:08.430 --> 54:09.090]  Very nice.
[54:09.910 --> 54:12.130]  Here's the security camera before.
[54:12.550 --> 54:15.310]  Here's the security camera after shining a light into it.
[54:16.950 --> 54:19.010]  Now, there's a good talk in the... in the previous talk.
[54:19.030 --> 54:21.090]  It was very nice because he talked about simplex locks.
[54:21.230 --> 54:22.710]  And I thought that was really slick.
[54:22.890 --> 54:25.410]  I mean, like even the movies and everything, it was really cool.
[54:26.310 --> 54:31.910]  Of course, one of the biggest problems with these locks is that you have to put the combination in in front of people.
[54:32.550 --> 54:33.350]  That's sort of a problem.
[54:33.470 --> 54:39.930]  So I thought to myself, let me find the most secure facility that uses one of these, and I'll see if I can like capture it.
[54:40.070 --> 54:45.030]  So I went to the airport, found a TSA locked room, and camped out.
[54:45.270 --> 54:46.030]  Here's what I found.
[54:46.130 --> 54:47.130]  See if you can catch it.
[54:54.510 --> 54:59.110]  A little less messy than the whole, you know, torque the thing and push the... This is the pilot ready room.
[54:59.190 --> 55:00.710]  Here's the pilots getting ready for their flight.
[55:00.810 --> 55:03.350]  I shoulder surfed him while I was doing it and got a picture of his badge.
[55:04.170 --> 55:06.630]  I, again, think signs are the answer.
[55:06.950 --> 55:08.350]  You really got to...
[55:12.370 --> 55:12.910]  All right.
[55:13.070 --> 55:19.910]  So as I wrap up, I just want to talk about this little special that was on called Unsolved History of the Ninjas on Discovery Channel.
[55:20.330 --> 55:22.790]  Basically, what they did is they built this little facility.
[55:22.790 --> 55:23.710]  It was one floor.
[55:23.830 --> 55:25.310]  It had windows and one entrance.
[55:25.610 --> 55:35.610]  And they wanted to see how Navy SEALs and Ninjas would both approach the problem of getting to a target inside this facility.
[55:35.790 --> 55:38.590]  So they hired Bruce Cardenas to come in with some of his security guys.
[55:38.730 --> 55:41.190]  And they decided, we're going to put him in the bathtub in the bathroom.
[55:41.230 --> 55:42.030]  There's no windows.
[55:42.330 --> 55:45.690]  The rules are, if you take the hat off the guy, you win.
[55:46.050 --> 55:50.310]  So the SEALs came in, dressed up like Ninjas, brought their tree man, which was nice.
[55:50.470 --> 55:52.810]  The tree man sniper told them the guard's patterns.
[55:52.930 --> 55:54.330]  And here's how it went down.
[55:55.230 --> 56:01.690]  The SEALs made short work of the guards using surprise and overwhelming firepower to get to their target.
[56:02.110 --> 56:03.890]  But how would a ninja fare?
[56:04.210 --> 56:06.250]  Would he be able to get past the guards?
[56:07.550 --> 56:09.290]  You can see why I'm intrigued, right?
[56:10.010 --> 56:11.490]  How would the ninja fare?
[56:11.810 --> 56:13.050]  So then they bring in the ninja.
[56:13.270 --> 56:17.010]  Honest to God, Stephen Hayes, he's, you know, studied under Hatsumi Sensei.
[56:17.090 --> 56:17.910]  He's the real thing.
[56:18.390 --> 56:19.530]  He approached this problem.
[56:19.950 --> 56:21.970]  And the SEALs were high tech.
[56:22.730 --> 56:25.370]  And the ninja was no-tech.
[56:25.550 --> 56:36.990]  Now, I was completely and utterly disappointed because, yeah, I'm thinking ninja, there's going to be beheadings and like blood squirting and like shirk and flying and then more beheadings and then more explosions.
[56:37.370 --> 56:41.810]  I should have known better because I'm practicing the art, but that's not how it went down at all.
[56:41.950 --> 56:42.730]  Here's how it went down.
[56:46.220 --> 56:51.560]  It took Hayes over four hours to wear down the guards and successfully reach the target.
[56:52.160 --> 57:00.120]  What I enjoyed about this assigned mission was it was an opportunity to really show people how the ninja would operate.
[57:00.900 --> 57:06.180]  By going in without any overt weapons actually allowed me to move right into the middle of all that danger.
[57:06.480 --> 57:08.920]  Is it okay if I just get that one one spray right there?
[57:09.160 --> 57:10.280]  I got duped by him.
[57:10.400 --> 57:14.060]  I mean, it was believable that he was the maintenance guy.
[57:14.220 --> 57:15.000]  I screwed up.
[57:16.700 --> 57:22.440]  So ninja puts on a hat, grabs a ladder and some compressed air and walks right into the hot zone as the maintenance guy.
[57:23.160 --> 57:26.160]  And the security guards didn't shoot him because he was spraying cameras.
[57:26.800 --> 57:27.580]  That was it.
[57:28.140 --> 57:29.420]  Talk about no-tech hacking.
[57:29.560 --> 57:31.240]  But this only works for individuals.
[57:31.540 --> 57:33.060]  Sometimes you need to get a whole group in.
[57:33.300 --> 57:34.620]  So I found a way to do that.
[57:34.740 --> 57:38.260]  This is some historical documentation I dug up to show you how to get a group inside.
[58:11.010 --> 58:12.330]  It's a chicken, a fruit.
[58:12.870 --> 58:13.190]  What?
[58:18.590 --> 58:19.350]  A gift.
[58:47.980 --> 58:48.780]  What happens now?
[58:48.780 --> 58:58.880]  Well, now Lancelot, Galahad and I wait until nightfall and then leap out of the rabbit, taking the French by surprise.
[58:59.100 --> 59:01.960]  Not only by surprise, but totally unarmed.
[59:02.720 --> 59:03.820]  Who leaps out?
[59:05.160 --> 59:10.780]  Lancelot, Galahad and I leap out of the rabbit and...
[59:15.940 --> 59:20.020]  Look, if we built this large wooden badger...
[59:34.760 --> 59:36.760]  Like I said, historical documentation.
[59:38.180 --> 59:43.340]  It's comforting to me to know that in this day and age something like this could not happen today.
[59:43.340 --> 59:45.500]  I mean, I'm just... I feel very relieved.
[59:49.690 --> 59:51.710]  Can we just take the Trojan horse in?
[59:51.830 --> 59:52.870]  Can we just leave it here overnight?
[59:53.090 --> 59:54.410]  You're going to pick up tomorrow morning again, are you?
[59:54.510 --> 59:55.410]  Yeah, pick it up tomorrow morning.
[59:55.850 --> 59:57.050]  Right, left-hand side up the next door.
[01:00:05.160 --> 01:00:05.720]  Okay, mate.
[01:00:27.830 --> 01:00:29.270]  Where's the history apartment?
[01:00:29.490 --> 01:00:29.950]  Quadrangle.
[01:00:30.370 --> 01:00:30.830]  Quadrangle?
[01:00:30.970 --> 01:00:31.110]  Yeah.
[01:00:31.590 --> 01:00:31.970]  Thanks, mate.
[01:00:32.350 --> 01:00:32.490]  Yeah.
[01:00:44.400 --> 01:00:45.840]  I'm on the pocket block.
[01:00:46.260 --> 01:00:46.420]  Yeah.
[01:00:46.540 --> 01:00:47.340]  Because we have traffic.
[01:00:55.690 --> 01:00:56.670]  You're just got this...
[01:00:56.670 --> 01:00:57.150]  the Greeks.
[01:00:57.370 --> 01:00:57.770]  The gift.
[01:00:57.950 --> 01:00:58.930]  Can we leave it here for the night?
[01:00:59.190 --> 01:00:59.430]  Yeah.
[01:01:01.730 --> 01:01:02.330]  Hello, God.
[01:01:03.430 --> 01:01:04.470]  Ask the... Consul General.
[01:01:04.670 --> 01:01:05.830]  We just want to leave it here for the night.
[01:01:05.990 --> 01:01:06.270]  Hello.
[01:01:08.010 --> 01:01:09.210]  We can't leave this here.
[01:01:15.820 --> 01:01:16.540]  We've just...
[01:01:16.900 --> 01:01:18.560]  Got this Trojan horse.
[01:01:26.570 --> 01:01:27.790]  Can we leave it here for the night?
[01:01:28.730 --> 01:01:29.310]  What do you mean?
[01:01:29.370 --> 01:01:30.550]  Now I'm sure there's no one inside.
[01:01:30.790 --> 01:01:31.970]  Why would there be anyone inside?
[01:01:32.190 --> 01:01:33.930]  Can we just leave it here at the barracks for the night?
[01:01:34.870 --> 01:01:37.230]  I had no idea he was in there.
[01:01:38.230 --> 01:01:39.470]  I had no idea.
[01:01:49.280 --> 01:01:52.280]  Alright, so those are the skills you've learned.
[01:01:52.560 --> 01:01:53.540]  It's all lost.
[01:01:53.660 --> 01:01:55.580]  Yes, you're absolutely screwed unless you buy this book.
[01:01:56.020 --> 01:01:58.560]  Got all the pictures in there and quite a bit more.
[01:01:58.760 --> 01:02:01.700]  I'm out of time, but here's my website, email address.
[01:02:01.920 --> 01:02:03.540]  Don't forget about iHackCharities.org.
[01:02:03.720 --> 01:02:05.540]  And thanks for having me at The Last HOPE.
[01:02:05.800 --> 01:02:06.540]  Thank you, guys.