[00:31.380 --> 00:36.980] It's impossible to find a place not to have the light in my eyes. [00:38.020 --> 00:39.100] Hello, everyone. [00:42.340 --> 00:48.380] I will talk for quite a while about VoIP in security. [00:48.560 --> 00:59.180] I try to do it as lighter and funny as possible, knowing that it's really late and all of you are really tired because of this intense day. [00:59.180 --> 01:18.080] I choose the title, Italians do it better, because the story I will explain is about Italian people in a Germanic hacker camp, but I will talk about this later. [01:19.060 --> 01:21.600] First of all, I'm quite nervous. [01:22.100 --> 01:26.660] I'm really honoured of being here to talk with you. [01:26.660 --> 01:28.600] I'm from Italy. [01:29.460 --> 01:31.020] I'm Italian, obviously. [01:31.980 --> 01:39.220] And I view up reading of this conference, this group, people that are now, today. [01:40.140 --> 01:43.860] And being in this room with this name is incredible for me. [01:45.280 --> 01:49.460] When I was a child, I never thought I would be here today. [01:49.460 --> 01:52.500] I work... Thank you. [01:54.100 --> 02:01.360] In Italy, I work as a security evangelist in a company called Alba that mainly takes care about security. [02:01.680 --> 02:07.560] And it is the way I have money to pay rates, car, and so on. [02:07.800 --> 02:10.840] But security, in my opinion, is something more. [02:11.120 --> 02:27.320] This is the reason for which I use all my free time inside some no-profit groups, some more formal, some more informal, that have a common aim to create awareness about security problems. [02:27.460 --> 02:37.320] Technology has to make our lives simple, but security risks exist, and we have to face it before it became a trouble. [02:38.240 --> 02:43.440] So, why I go around the world talking about VoIP? [02:43.860 --> 02:57.440] Mainly because there is no newspaper, no conference, no technology thing that doesn't contain something, an article, a lecture about VoIP. [02:57.440 --> 03:06.860] It's fashion, it's exploding, it's growing, it will be so diffused in next years. [03:07.260 --> 03:13.100] I don't know, I don't know if those numbers are true, but it's obviously growing. [03:14.140 --> 03:21.460] And the problem, in my opinion, is not a technology problem about security. [03:22.060 --> 03:27.140] Yeah, you know, there are some flaws, some bugs, and so on. [03:27.140 --> 03:34.640] But, mainly, the problem is how people see phones, how people look at phones. [03:35.260 --> 03:44.020] People are used in having whole analog phones that always work, never had views, never had problems. [03:44.020 --> 03:57.620] In Europe, often, the person that has to take care about IT infrastructure is also involved in telephone infrastructure. [03:57.920 --> 04:09.260] They usually have always working PBX and always, often, non-working servers and PC because of buildings and so on. [04:09.260 --> 04:11.880] So, telephones are secure. [04:12.380 --> 04:15.640] Nothing bad can happen with telephones. [04:15.640 --> 04:21.080] But, you know, John Grapper shows us... No, not this John Grapper. [04:23.600 --> 04:33.920] Those two guys, and Grecia and John Grapper, shows us that public infrastructure of telephone have problems. [04:33.920 --> 04:38.280] It's a problem that we know since last century. [04:38.980 --> 04:40.420] It's a very old problem. [04:40.920 --> 04:48.580] And being a very old problem does not mean that nowadays everything has been solved. [04:48.580 --> 05:01.420] For example, this scandal, this scandal in Greece, in my opinion, there was not enough talking about this. [05:02.180 --> 05:17.560] Vodafone, that is one of the hugest telco in Europe, in Greece implemented the public mobile service being compliant with CALEA requirements. [05:19.020 --> 05:27.220] After some months, they started a new service about sending some SMS text messages. [05:27.860 --> 05:31.200] And they realized that this service was not running. [05:31.520 --> 05:39.620] They called Ericsson, that was the manufacturer of the PBX, asking why this application is not working. [05:39.620 --> 05:57.860] We are thinking about a device with a firmware, with fixed memory allocation, and they realized that there was something that was using the memory allocation space that the new application was trying to use. [05:57.860 --> 06:13.320] They started investigating, and they discovered that someone wrote a route kit for an Ericsson PBX and was using their CALEA system to use drops on politicians, judges, journalists, people. [06:13.320 --> 06:18.260] So, I don't believe so much in CALEA system. [06:19.000 --> 06:23.280] It's often required by law, but it's really, really dangerous. [06:23.560 --> 06:32.000] If you have to manage one of these systems, you have to take a lot of care, because to turn in something bad against you. [06:32.000 --> 06:34.260] And this shows how. [06:35.320 --> 06:42.960] But here, we are still in traditional telephony, so the problem doesn't disappear on traditional telephony. [06:44.020 --> 06:48.040] But start being public about VoIP. [06:49.000 --> 06:54.200] John Todd is one of the top posters of the VoIPSA mailing list. [06:54.500 --> 07:06.020] VoIPSA is a consortium with programmers, developers, vendors, consultants, or people that they care about VoIP security. [07:06.600 --> 07:15.340] On this mailing list, this message was the first one that was pointing to a wide attack. [07:16.560 --> 07:39.260] VoIP-specific direct to a public server, made with a specific tool for VoIP, not with some tools like Hydra, written by a friend Van Hauser from Europe, but a tool written specifically for VoIP. [07:39.680 --> 07:43.160] And we have also some examples. [07:43.520 --> 07:45.440] This one is here from USA. [07:45.720 --> 07:50.480] You know, in Europe, we always look at USA because everything happens here. [07:50.480 --> 07:52.420] There will arrive later. [07:52.840 --> 07:54.380] And so, also, Froak. [07:55.460 --> 07:57.580] This guy is one of my heroes. [07:58.100 --> 08:00.660] He comes from South America. [08:00.980 --> 08:04.680] He comes here, so all people are rich, all people have money. [08:04.960 --> 08:06.540] And he talks, I want money too. [08:06.800 --> 08:09.060] How to have money in a very short time? [08:09.880 --> 08:10.780] Non-legal way. [08:10.780 --> 08:25.580] So, he paid a guy to hack into some VoIP servers, reroute VoIP traffic, and then put on a tie and start selling this traffic to companies. [08:26.180 --> 08:31.220] How much do you pay a phone call, a one-minute phone call to Europe? [08:31.480 --> 08:33.120] Oh, one dollar a minute. [08:33.400 --> 08:36.500] Oh, I can sell it to you at 50 cents for minutes. [08:36.720 --> 08:37.020] It's okay? [08:37.020 --> 08:46.920] Those guys were able to sell, in six months, ten millions of minutes of conversation. [08:47.560 --> 09:02.620] They were able to earn some million dollars, with which they bought three BMWs, one huge building in Miami, one yacht. [09:03.380 --> 09:11.560] This photo is taken from the website of the transmission, Americans Most Wanted. [09:13.810 --> 09:15.820] He is very famous. [09:16.100 --> 09:28.540] Those girls are the girls that BMW sent to the party for which he gave, because he had his free new BMW. [09:29.260 --> 09:30.780] So, incredible. [09:31.620 --> 09:39.580] Obviously, someone at Carrier's started noticing that not everything was going in the right way. [09:40.020 --> 09:42.360] So, FBI started investigating. [09:43.460 --> 09:44.480] He was caught. [09:45.340 --> 09:50.620] So, then, he started having this process. [09:50.880 --> 10:00.640] I don't know very well the USA legal system, but after he got arrested, he was able to went away waiting for the process. [10:01.240 --> 10:03.600] And nowadays, he's still on the fly. [10:03.780 --> 10:05.580] They are not able to find him. [10:06.120 --> 10:12.260] Americans Most Wanted say he should be in the south of America frowning with VoIP some other people. [10:12.500 --> 10:13.300] People don't know. [10:14.880 --> 10:21.680] In bibliography, you will find the FBI report about this case that is quite funny to read. [10:21.880 --> 10:37.200] But the incredible thing is that when he got arrested, the guy, the technical guy that was able to intrude into the VoIP systems, get to the police and say, hello, I'm guilty. [10:37.200 --> 10:43.940] He had some month, six, I think, of jail. [10:44.540 --> 10:48.220] Came out and obviously, all newspapers tried to interview him. [10:49.320 --> 10:56.080] And the first question was, how were you able to introduce into those systems? [10:56.420 --> 10:57.800] What incredible hack. [10:59.680 --> 11:01.060] Incredible hack. [11:01.840 --> 11:04.060] I'm citing him. [11:04.840 --> 11:06.780] So easy a caveman. [11:11.300 --> 11:13.060] This is true. [11:13.460 --> 11:25.220] As I said before, yeah, VoIP has some flaws, have some bugs, but the problem is system administrators that use weak passwords, that use stupid configuration. [11:25.640 --> 11:32.240] When we will have resolved all these issues, then we can start thinking about that. [11:32.240 --> 11:38.860] And the incredible thing is that people is talking to me about new risks of VoIP. [11:40.400 --> 11:41.040] New risks? [11:41.920 --> 11:44.420] Obviously, risks are underrated. [11:44.720 --> 11:52.300] I said before, people look at phone and think about analog phone, but we are talking about something that is Ethernet connected. [11:53.360 --> 11:57.240] Something that have all the flows that IP networks have. [11:58.680 --> 12:12.200] And this is the natural evolution of all technologies we have that are moving from a disconnected, isolated environment to a networked environment. [12:12.640 --> 12:20.360] From proprietary programs, languages, cabling, to a standard way of communicating. [12:20.360 --> 12:34.740] And in the case of VoIP, for example, a lot of things that was running on ESDN, think about GSM gateway, for example, are now turning into IP GSM gateway. [12:35.140 --> 12:44.100] So, the problem is quite different, because you don't have something with one cable of which you are sure about the two endpoints. [12:44.100 --> 12:50.020] You have these things that have three ESDN ports, for example, and one Ethernet cable. [12:50.240 --> 12:57.840] This means that you have not to trust what is arriving from what you suppose is your public line. [12:58.060 --> 13:03.980] Because on that Ethernet network, anyone, let's say anyone, can do everything. [13:04.500 --> 13:12.000] On Ethernet network, many in the middle attack are terrible more than on ESDN network, for example. [13:12.000 --> 13:23.480] And no one is thinking about this, because they are reading a brochure of vendor VoIP's fashion, they are implementing it, and they are not thinking about those problems. [13:24.040 --> 13:27.380] They are talking to me about new risks. [13:27.660 --> 13:30.080] New risks are, for example, speed. [13:30.480 --> 13:33.980] I think someone had talked about this before me today. [13:34.960 --> 13:53.440] Someone realized that spam works because I can send a lot of messages, which is paid not much, and even if a little fraction, statistics talk about 1%, buy the product, the operation was okay, from a money point of view. [13:54.160 --> 14:07.920] So, if every newspaper is writing that VoIP is cheaper, VoIP is cheap, VoIP is free, why not use VoIP to reach people and advertise products? [14:08.180 --> 14:20.560] Think that having a lot of spam messages in your mailbox is bad, but you choose when to sit in front of your computers and erase the messages. [14:20.860 --> 14:27.220] Think about having your mobile ringing many and many times a day during night. [14:27.220 --> 14:32.480] And we are thinking not about things that, I don't know here, but in Europe are quite common. [14:32.980 --> 14:35.960] People calling you trying to sell something. [14:36.340 --> 14:50.240] We are talking about the server connected in some state with a load that permitted with a registered, a recorded message, an MP3, that calls a lot of phone and plays a message. [14:52.000 --> 14:56.900] This system is able to reach even not analog form. [14:57.200 --> 15:02.180] My grandma has still old ring form. [15:03.260 --> 15:08.040] That ring and he hello by Viagra. [15:08.340 --> 15:08.780] No. [15:10.100 --> 15:11.620] I don't want this. [15:12.660 --> 15:25.400] And obviously, if someone realize that using spam to fraud people pretending to be a bank, for example, it's so simple to do the same by the phone. [15:26.260 --> 15:27.740] Change your caller ID. [15:28.000 --> 15:30.700] Call someone with his bank number. [15:30.980 --> 15:31.580] Hello. [15:32.040 --> 15:33.240] We are your bank. [15:34.080 --> 15:37.560] There is something strange on your account. [15:37.840 --> 15:38.060] Please. [15:38.540 --> 15:40.340] Digit your credit card. [15:40.680 --> 15:42.040] Digit on Dialpad. [15:43.900 --> 15:44.620] Simple. [15:45.660 --> 15:46.540] Too simple. [15:47.660 --> 15:50.740] A lot of people are able to do this. [15:52.860 --> 15:56.880] and they are talking to me about new vector. [15:57.900 --> 16:00.940] In all those things of new, I see VoIP. [16:01.980 --> 16:03.900] Vector are old. [16:04.380 --> 16:05.880] Spam is old. [16:06.180 --> 16:07.280] Fishing is old. [16:07.800 --> 16:10.360] Calling a lot of numbers is word dialing. [16:10.480 --> 16:11.120] I see... [16:11.120 --> 16:15.560] I saw Matthew Broderick doing that in the 80's in War Games. [16:15.560 --> 16:19.000] It's not a new attack vector, in my opinion. [16:19.760 --> 16:20.720] Colerade is two things. [16:20.860 --> 16:22.640] Oh, new attack vector. [16:23.280 --> 16:25.880] So, there is nothing new. [16:26.560 --> 16:33.820] But, those new, these old vectors, are applied again to an emerging technology. [16:34.860 --> 16:35.500] Emerging. [16:35.600 --> 16:38.280] It's emerging since last century, but it's still emerging. [16:39.540 --> 16:56.400] Okay, I travel a lot around the world and I found really useful having a program on my PC that allow me to connect to my PBX in Italy and call all people in Italy paying the national rate. [16:57.080 --> 16:58.680] It's really good for me. [16:58.680 --> 17:09.980] the problem when you are using it when you are a big company and you are deploying this on thousands of laptops it's about endpoint security. [17:10.360 --> 17:13.880] Yeah, you are encrypting call phone. [17:14.140 --> 17:16.620] You are encrypting signaling. [17:16.960 --> 17:20.660] You are hardening the whole infrastructure. [17:21.000 --> 17:43.360] But, for example, if on the endpoint there is a malware or some rootkit that is recording the phone call after the soft phone the cryptedit it's a big trouble and you have to have whole endpoint secure or your telephone infrastructure is not secure. [17:43.820 --> 17:45.280] So quite big problem. [17:46.500 --> 18:20.920] And about how people say things always about what is cheaper a lot of companies create connection from their company to a telco through a VoIP protocol think about SIP about IAX and so on and they use that to reach some destination it's cheaper yeah but often this trunk as in clear text VoIP market is emerging a lot of people are seeing a lot of money in this market so little telco Two men, [18:21.580 --> 18:30.300] three servers, we are a big telco, selling you web services, are emerging, are rising like mushrooms. [18:32.240 --> 18:36.840] In Italy, we say this to say a lot. [18:37.680 --> 18:38.340] In USA, no. [18:44.000 --> 18:47.460] So, those companies does not encrypt nothing. [18:47.460 --> 18:53.880] So, often, your VOIP provider is not your bandwidth provider. [18:54.280 --> 19:09.060] Your bandwidth provider, in this way, is able to, if it drops your phone calls, is able to shut down you and connect like you and start calling, billing to you and pretending to be you. [19:09.280 --> 19:14.320] So, no good if you are... I hate this for me as a person. [19:14.320 --> 19:17.680] For my company, it could be really, really, really bad. [19:19.180 --> 19:23.060] And the problem is not only about small telcos. [19:23.280 --> 19:24.320] It's always... [19:24.320 --> 19:26.880] It's also about big vendors. [19:26.880 --> 19:36.280] I expect vendors to be experts in this field, to sell products well-studied, secure. [19:37.200 --> 19:50.420] Well, a vendor that creates a phone without transfer button means that the engineer that designed that phone never used a phone before. [19:52.140 --> 20:02.000] If this is their aptitude towards this technology, their level of expertise, we are f*cked up. [20:04.500 --> 20:06.700] So, it was a little boring. [20:07.360 --> 20:10.000] So, let's start with a case history. [20:10.560 --> 20:14.200] I talked a lot about which case history to present. [20:14.200 --> 20:21.740] And I was tempted to present to you the case history, that is not real, but is often presented to... from Dan York. [20:21.860 --> 20:23.760] Dan York is part of VoIPSA. [20:24.580 --> 20:30.960] We talked about a system engineer that thinks that his company doesn't pay him enough. [20:30.960 --> 20:36.760] They are not having in him enough. [20:39.520 --> 20:43.620] So, he is the system engineer. [20:43.940 --> 20:45.660] They implement VoIPSA. [20:45.660 --> 20:58.180] He starts dropping on network, recording the traffic, and converting it into listenable files. [20:58.180 --> 21:03.380] I think that Wireshark could convert the traffic dump into a web file. [21:03.600 --> 21:06.240] But you can use a lot of programs like this. [21:06.540 --> 21:20.960] I usually love ORECA because he is able to understand a lot of protocols and have MySQL support, a web interface so you can use drop a lot, have everything ordered in the database, make some queries. [21:21.260 --> 21:21.600] Wonderful. [21:23.220 --> 21:40.820] So, this system administrator have all phone calls, put the phone calls on iPod, and while driving home at evening, listen to home management phone calls, and learn a lot of important things about what's happening in the company. [21:40.820 --> 21:46.920] But think that he can use this also for revenge, for example. [21:47.180 --> 21:59.140] Because Joe, that f*cking guy that is working in the sales accounts, that always talks to me in a very bad way, Joe is working from home. [21:59.760 --> 22:01.520] So, he connects to the company. [22:01.680 --> 22:03.200] He has a VoIP phone at home. [22:03.200 --> 22:08.700] When his boss calls him, hi Joe, are you at home, are you working on the report? [22:09.620 --> 22:10.520] Yeah, yeah, I'm here. [22:11.120 --> 22:11.860] RTP inject. [22:13.400 --> 22:18.820] You can send any sound you want inside the conversation, even one way. [22:19.400 --> 22:20.100] Dog barking. [22:20.380 --> 22:23.700] Oh, you are at the park with the dog, not at home working on the report. [22:25.780 --> 22:28.000] No, no, hang on, hang on, hang on. [22:28.560 --> 22:32.220] And now I hear the sounds of Luna Park. [22:32.580 --> 22:33.920] Yeah, you are not working. [22:34.280 --> 22:34.940] And so on. [22:35.060 --> 22:37.220] So, revenge against colleagues. [22:37.780 --> 22:45.980] And obviously, he has so much way to f*ck colleagues and company that is not a good thing. [22:46.320 --> 22:51.140] But, this is plausible, but not a true story. [22:51.140 --> 22:54.420] And I wanted to tell you a true story. [22:54.920 --> 22:59.160] So, I have to confess you a secret. [23:03.480 --> 23:06.440] One day, I received a spam email. [23:06.720 --> 23:10.340] I always read spam, because it contains a lot of interesting things. [23:13.380 --> 23:26.920] And in this mail, they were promising me that they have a device for 20 dollars, 20 euros, excuse me, about 35 dollars, that is able to change me in a women. [23:27.580 --> 23:28.480] Yeah, I want it. [23:31.860 --> 23:34.580] So, I made a terrible thing. [23:34.800 --> 23:38.140] I bought a product that was advertised by spam. [23:38.460 --> 23:39.140] Excuse me. [23:40.500 --> 23:41.980] But, I received it. [23:42.100 --> 23:43.080] This is a photo. [23:46.240 --> 23:47.600] It's so small. [23:47.820 --> 23:48.860] Oh, I have here. [23:49.040 --> 23:49.720] Just one moment. [23:49.720 --> 23:54.480] Elisa, in my bag, in the bag, there is a key strike inside the device. [23:54.840 --> 24:03.040] This little device has a lever to choose men or women. [24:03.540 --> 24:04.820] I have a microphone. [24:06.260 --> 24:09.300] And here something. [24:09.940 --> 24:16.960] And they have different connectors for PC, for phones, for mobile, from Nokia, Motorola, and so on. [24:17.400 --> 24:18.360] So, I received it. [24:18.460 --> 24:19.960] I connected it to my phone. [24:20.180 --> 24:23.440] And for the first thing, I called my best friend. [24:37.900 --> 24:43.420] We are friends since we were 16. [24:44.400 --> 24:47.520] He's going to be at my wedding. [24:47.860 --> 24:49.540] The guy next to me. [24:49.540 --> 24:50.220] Best friend. [24:50.560 --> 24:51.140] Best friend. [24:51.380 --> 24:51.520] Best friend. [24:54.060 --> 24:56.300] I phoned him as a female. [24:57.040 --> 24:59.480] He just bought a new moto. [25:00.400 --> 25:00.960] Hello. [25:01.440 --> 25:03.260] I'm Sarah from Ducati. [25:03.960 --> 25:04.700] Hello, Sarah. [25:04.840 --> 25:05.240] How are you? [25:06.040 --> 25:15.660] I'm phoning you because I know you have a new motorcycle and I want to know if you are satisfied, if it's clean, if everything is okay. [25:16.640 --> 25:17.820] Yeah, yeah, yeah. [25:18.020 --> 25:21.740] We were able to talk about five minutes of clock. [25:22.240 --> 25:22.980] Five minutes. [25:23.340 --> 25:24.940] Then he started trying to date me. [25:25.640 --> 25:26.820] And I decided, no. [25:29.180 --> 25:31.780] I stopped the conversation. [25:32.080 --> 25:34.080] I thought, it's not possible. [25:34.420 --> 25:36.660] I changed mail. [25:36.860 --> 25:38.940] So, made me a voice like this. [25:38.940 --> 25:40.840] I called him again. [25:41.420 --> 25:42.040] Hello. [25:42.720 --> 25:44.900] I'm Lucio. [25:45.520 --> 25:47.040] I'm the boss of Sarah. [25:47.780 --> 25:54.940] And, excuse me, sorry if I have to call you again, but you know, it's the first day at work of Sarah. [25:55.220 --> 25:56.560] She's not so expert. [25:56.880 --> 26:03.540] And I hear he was not so happy because he was talking bad about Sarah. [26:04.820 --> 26:08.780] I was able to have another two minutes of phone calls with him. [26:09.720 --> 26:26.160] If I were able, with a 20 euros device, to social engineer, my best friend, think with a software on my PC and a soft phone, what I can do with unknown people, with head desks and so on. [26:26.160 --> 26:32.180] So, VoIP gives you a lot of things more useful to do these things. [26:32.320 --> 26:35.080] But, in my opinion, this was not enough funny. [26:36.120 --> 26:44.780] So, I decided to talk about the Italian Hacker Embassy experience at the Hacker Camp of CCC last year in August. [26:45.680 --> 26:55.520] The camp is organized by Chaos Computer Club, who don't know them, shame on you, are one of the more important European Hacker Group. [26:55.760 --> 26:57.180] They are based in Germany. [26:57.720 --> 27:02.360] The huge group, I think the hugest in Europe, very whole. [27:02.900 --> 27:10.400] They fought a lot of fights for freedom, liberty and so on, and about technology. [27:10.400 --> 27:15.140] And every four years, they organized a camp, an acre camp. [27:15.380 --> 27:21.100] Last year, it was held in an old East Germany airport. [27:22.220 --> 27:28.100] It was a huge place with about 2,200 people. [27:29.080 --> 27:31.340] All between planes with their tents. [27:32.180 --> 27:36.520] To enter that camp, you had to wear this bracelet. [27:37.100 --> 27:41.000] You can see it on a lot of people inside here. [27:41.840 --> 27:44.200] It's like something religious. [27:45.760 --> 27:52.020] And there were, of course, a lot of Italian people there to drink old German beers and have fun there. [27:53.420 --> 27:56.420] This was our embassy. [27:57.600 --> 28:06.540] The first place was the public place where we invited people and inside there were people working with their computers and so on. [28:07.580 --> 28:10.380] And we were trying to give impression. [28:10.620 --> 28:11.400] We are Italian. [28:11.660 --> 28:12.520] We have an identity. [28:12.780 --> 28:15.020] We want to make friendship with you. [28:15.760 --> 28:16.380] Talk with me. [28:17.000 --> 28:27.380] Our aim was to meet as much people as possible, to talk to as much people as possible, to have information, to give information, to exchange knowledge. [28:28.520 --> 28:32.680] And we did it offering food, for example, Italian food. [28:33.980 --> 28:35.080] Offering coffee. [28:35.340 --> 28:38.160] Today I have some problem in organizing myself. [28:38.420 --> 28:43.940] So I start preparing coffee at 8 o'clock in Hack Center. [28:44.360 --> 28:47.180] Tomorrow you will find me there with this. [28:47.420 --> 28:50.560] And if you want, come there to have Italian coffee. [28:51.220 --> 28:53.040] And obviously we are Italian. [28:53.240 --> 28:54.060] We love alcohol. [28:54.220 --> 28:56.180] We offer also a lot of grappa. [28:57.840 --> 29:05.340] And that was our way of advertising our party to come, to have people come. [29:05.540 --> 29:10.840] We were shouting outside the Italian embassy, Italian grappa! [29:11.080 --> 29:16.100] And we were continuously shouting this and people arrived to drink grappa. [29:16.280 --> 29:17.620] It was incredible. [29:18.740 --> 29:27.580] But it was a camp, you know, being in a camp for a whole day always drinking grappa is not good. [29:28.140 --> 29:30.480] So we tried to organize something else. [29:30.700 --> 29:32.480] We organized a live chess game. [29:32.780 --> 29:33.700] It was wonderful. [29:34.360 --> 29:43.800] We stopped all unknown people that was walking in the main street of the camp, put them on the chess and start the game. [29:43.800 --> 29:48.100] In the middle of the game, you see one person talking with another. [29:48.340 --> 29:50.960] You hear about that new technology, that new bug? [29:51.080 --> 29:52.080] Do you have that exploit? [29:52.620 --> 29:53.040] Another one. [29:53.260 --> 29:56.520] And do you remember, am I a tower or a horse? [29:59.180 --> 30:00.500] It was incredible. [30:01.920 --> 30:12.540] But it was so funny that nature rebel again against us and alluvium take on the camp. [30:12.760 --> 30:13.300] Terrible. [30:13.680 --> 30:17.820] Not so terrible as my friend pretend he's on his knees. [30:22.140 --> 30:30.580] After grappa completely drunk, I tried to resolve the situation but I was not able until the fireman arrived to help us. [30:31.100 --> 30:31.560] But I tried. [30:31.560 --> 30:39.880] But the result was we had an enormous hacker camp full of mud. [30:40.220 --> 30:41.120] What we can do? [30:42.180 --> 30:48.820] So we organized a wonderful football match inside the mud. [30:48.820 --> 31:01.740] I worked, I'm not joking, three days to find the photos with Nicolas Farr with his style running in the mud trying to have the balloon. [31:02.580 --> 31:03.800] I didn't find it. [31:03.960 --> 31:06.340] But if you look at this photo, it's incredible. [31:06.860 --> 31:11.320] It looks like strange people but the first here is one. [31:11.320 --> 31:22.140] It's Paul Bohm from MetaLab, the organizer of one of the most important conferences in Europe, in Austria. [31:22.360 --> 31:24.460] But now at this moment I don't remember the name. [31:24.580 --> 31:25.060] Excuse me. [31:25.380 --> 31:27.760] I'm nervous. [31:28.260 --> 31:28.800] And so on. [31:28.980 --> 31:29.540] Other people. [31:29.920 --> 31:38.660] It was incredible seeing those people that the most important movement that do is this. [31:38.660 --> 31:48.240] I was running in the mud searching to reach the football and trying to play. [31:48.480 --> 31:49.280] Terrible. [31:49.700 --> 31:52.780] But the important thing was the party. [31:54.060 --> 31:57.240] We were organizing a party every night. [31:58.220 --> 32:03.780] In that embassy that I showed you arrived every night about 100 people. [32:03.780 --> 32:17.500] The first day to have those people I went from 10 to 10 by feet for the whole airport asking, we have a party this night, come there, free grappa for everyone. [32:18.820 --> 32:19.200] Wonderful. [32:19.700 --> 32:24.780] But I was quite tired and I was thinking about doing something different the second day. [32:24.780 --> 32:30.840] So, we start thinking, what we can do to advertise our party. [32:31.720 --> 32:36.440] And a navy light was on my head. [32:37.360 --> 32:37.820] Event Fondie. [32:38.320 --> 32:49.840] Event Fondie is a group that manages a voice infrastructure at CCC events. [32:49.840 --> 32:57.000] They come there with a huge PDX and cover with DECT the whole camp for the whole conference. [32:57.520 --> 33:14.460] They come there with a huge VoIP system and permit for free to everyone to connect their DECT or their VoIP phone, both cordless, both fixed, have everyone interconnected and to phone outside for free to fixed number of Germany. [33:16.660 --> 33:21.780] We are talking about a quite big infrastructure for Europe. [33:23.160 --> 33:30.960] Multi-protocol, a lot of account, a lot of people that are talking together in the same moment. [33:34.290 --> 33:41.890] And we start asking ourselves, why don't we use this infrastructure to advertise our party? [33:43.910 --> 33:47.850] Well, before going on... [33:47.850 --> 33:50.150] Those guys are incredible. [33:50.570 --> 33:55.270] They are good and they are also able to configure in the right way all devices. [33:55.870 --> 34:00.470] The only problem they have is they trust Italian people. [34:04.870 --> 34:09.050] So our goal was to reach every phone in the camp. [34:09.630 --> 34:11.870] And obviously have fun during that. [34:12.210 --> 34:21.230] Remember that we were doing this between a live chess game and a match soccer football game. [34:22.470 --> 34:27.930] So, the first thing we have to do was to record a message. [34:28.210 --> 34:30.230] I hope it would be... [34:30.910 --> 34:32.350] You can hear it. [34:32.870 --> 34:34.150] It's Italian Embassy. [34:34.630 --> 34:41.850] We are calling you to inform that this evening there will be a party with Italian grappa. [34:42.550 --> 34:47.510] And we are calling it at the end of the block in front of the debate inside the Italian Empire [35:16.210 --> 35:19.530] Park line, dialed FIGA to reach us. [35:20.370 --> 35:20.970] Buongiorno! [35:22.530 --> 35:26.510] Well, I wanted to show you this message divided into two parts. [35:26.670 --> 35:27.850] And you will see with why. [35:28.570 --> 35:30.570] The important thing is that... [35:31.910 --> 35:36.490] Dialed FIGA to reach us in Italian means dialed pussy. [35:37.050 --> 35:39.030] But no one was able to understand that. [35:39.190 --> 35:40.030] It was quite funny. [35:40.590 --> 35:41.090] But... [35:41.090 --> 35:44.330] Take something typical of your country. [35:44.670 --> 35:46.590] Obviously, German people arrived with beer. [35:47.050 --> 35:50.530] Someone arrived with enormous fish cooked in a strange way. [35:51.030 --> 35:51.950] So, very incredible. [35:52.250 --> 35:53.130] We loved it. [35:53.410 --> 35:55.050] And a lot of people were there. [35:55.870 --> 35:58.110] So, we have the message. [35:59.350 --> 36:05.430] So, we need the directory of people to call to play this message. [36:06.090 --> 36:13.070] We start thinking about writing something able to do enumeration against their DBX. [36:14.210 --> 36:19.830] And then start thinking, why don't use a tool that is still ready, available. [36:19.830 --> 36:27.450] This one is written by Sandro Gauci, that is a German guy, that is a friend of mine, that works a lot on this suite. [36:27.870 --> 36:29.050] I really love this definition. [36:30.570 --> 36:31.170] And... [36:31.170 --> 36:32.110] Integrated Suites. [36:32.210 --> 36:34.870] Only Microsoft Office define himself in the way. [36:36.890 --> 36:37.490] And... [36:37.490 --> 36:38.210] It's incredible. [36:38.450 --> 36:41.290] We installed on our laptop this program. [36:41.890 --> 36:42.710] We run... [36:42.710 --> 36:44.830] We didn't run the... [36:45.690 --> 36:50.590] The scanner, because we already know what the IP address of the PBX. [36:51.970 --> 36:52.770] But... [36:52.770 --> 36:53.690] We run... [36:54.690 --> 36:56.890] The enumerating modules. [36:57.850 --> 37:02.110] And we obtain the full directory of active accounts. [37:03.430 --> 37:05.030] Think that... [37:05.650 --> 37:06.050] There... [37:06.050 --> 37:09.610] There was a mandatory password of a lot of charts. [37:09.610 --> 37:17.850] But usually, if you use this on public servers, on customers, PBXs, and so on... [37:17.850 --> 37:21.090] Usually, phones have no authentication at all. [37:21.290 --> 37:27.870] This means that you must configure your soft phone with username, and you're connected and able to call. [37:28.570 --> 37:28.990] Or... [37:28.990 --> 37:35.640] Don't ask me why, but everyone thinks that the right password for a VoIP phone is four-digit numbers. [37:37.140 --> 37:42.620] Four-digit numbers, found as a password, need about... [37:42.620 --> 37:45.800] Five seconds, six seconds, something like that. [37:47.370 --> 37:48.260] With this module. [37:51.140 --> 37:51.840] But... [37:52.330 --> 37:52.680] There... [37:52.680 --> 37:54.940] We didn't try to brought the password. [37:55.220 --> 37:56.640] I think there were mandatory... [37:57.580 --> 38:03.520] I don't remember, but ten or twelve-digit passwords, half-anumericals. [38:03.520 --> 38:04.080] So... [38:04.080 --> 38:04.600] Good password. [38:05.720 --> 38:06.480] So... [38:06.480 --> 38:08.140] We had our message. [38:08.660 --> 38:11.940] We had our directory of numbers to call. [38:12.620 --> 38:19.480] We started thinking about not creating a denial of service attack against their PBX. [38:19.620 --> 38:23.660] So we decided to use, at maximum, five contemporary calls. [38:23.900 --> 38:28.980] Because we want to play, not to create damage with their infrastructure. [38:30.340 --> 38:31.100] So... [38:35.020 --> 38:36.980] The first message... [38:36.980 --> 38:40.280] Was without the conference call at the end. [38:40.720 --> 38:42.980] Was only advertising about the party. [38:43.880 --> 38:44.360] So... [38:44.360 --> 38:45.160] Looked like speech. [38:45.760 --> 38:46.360] Looked like... [38:46.960 --> 38:47.860] Advertised and stopped. [38:47.860 --> 38:48.000] So... [38:48.000 --> 38:49.660] We decided... [38:49.660 --> 38:51.300] To re-invite... [38:51.860 --> 38:52.840] Using... [38:52.840 --> 38:54.280] The SAP method. [38:54.860 --> 38:56.140] Re-invite method. [38:57.000 --> 38:57.700] All... [38:57.700 --> 38:58.740] The phone calls... [38:58.740 --> 39:01.000] In a conference room on our servers. [39:01.900 --> 39:04.220] Five calls on their servers. [39:05.400 --> 39:08.200] Infinite people on our servers. [39:08.200 --> 39:09.040] So... [39:09.040 --> 39:11.560] Not any of service on their servers. [39:12.080 --> 39:12.640] And... [39:12.640 --> 39:13.200] Our servers... [39:13.980 --> 39:15.560] In our opinion, it was okay. [39:15.840 --> 39:16.780] It was working. [39:17.020 --> 39:17.660] Very good. [39:17.860 --> 39:19.380] While testing it... [39:19.380 --> 39:20.640] We started calling people. [39:20.800 --> 39:22.820] People started entering the conference room. [39:22.940 --> 39:24.260] People started talking with them. [39:24.660 --> 39:25.080] Bam! [39:26.500 --> 39:27.140] And... [39:27.140 --> 39:27.960] Of... [39:27.960 --> 39:30.440] Internet inside our tab. [39:30.620 --> 39:33.080] We don't have enough bandwidth to manage... [39:33.080 --> 39:34.940] So huge conference room. [39:34.940 --> 39:37.220] Think that inside the conference room people... [39:37.900 --> 39:39.220] Have the phone ringing. [39:39.800 --> 39:41.020] Listen to the message. [39:41.280 --> 39:42.940] Found themselves in the conference room. [39:43.120 --> 39:43.880] Hello, hello. [39:45.760 --> 39:46.780] Pronto, pronto. [39:47.000 --> 39:48.020] Someone else in Italian. [39:48.480 --> 39:49.260] Someone else in German. [39:49.460 --> 39:50.400] Someone else in Spanish. [39:50.840 --> 39:51.360] So... [39:51.360 --> 39:54.340] Only to handshake the language... [39:54.340 --> 39:54.840] One minute. [39:56.160 --> 39:56.720] So... [39:56.720 --> 39:58.660] We have a huge problem. [39:58.960 --> 40:00.080] Obtaining bandwidth. [40:00.300 --> 40:03.100] Enough bandwidth to run a conference room... [40:03.100 --> 40:04.640] With all those people inside. [40:04.640 --> 40:09.820] We went outside the event from the tent. [40:10.320 --> 40:12.860] We found a violet cable. [40:13.400 --> 40:15.980] And we started following the violet cable. [40:16.220 --> 40:18.120] Think that it was a camp. [40:18.720 --> 40:21.000] Following the violet cable means... [40:21.000 --> 40:22.060] In the grass. [40:22.280 --> 40:23.120] On the hills. [40:24.020 --> 40:26.120] And we arrived at CCC office. [40:26.280 --> 40:27.220] Where there were... [40:27.220 --> 40:27.900] A guy... [40:28.740 --> 40:29.540] There... [40:30.360 --> 40:30.760] To... [40:31.160 --> 40:31.920] Keep... [40:31.920 --> 40:32.980] Safe the switch. [40:37.100 --> 40:40.640] The switch was in the center, in the middle of the camp. [40:41.360 --> 40:41.960] So... [40:41.960 --> 40:45.160] Virtually anyone could go there and connect something. [40:45.340 --> 40:46.260] They didn't want this. [40:46.420 --> 40:48.280] And so put someone to verify. [40:48.640 --> 40:49.220] Right. [40:50.500 --> 40:51.180] Hello. [40:51.720 --> 40:52.400] Grappa. [40:55.670 --> 40:59.610] We are running a server to offer free calls to Italy. [40:59.810 --> 40:59.910] Help. [41:00.090 --> 41:00.510] More Grappa. [41:02.230 --> 41:04.370] Important for us to don't have bandwidth. [41:04.630 --> 41:05.130] More Grappa. [41:05.910 --> 41:13.490] And yet we were able to connect our servers to the backbone and to have enough bandwidth to do everything. [41:13.490 --> 41:14.530] It was incredible. [41:17.250 --> 41:18.210] Thank you. [41:24.250 --> 41:32.530] So, the script I show you is not a tool intended to be released as a real tool. [41:33.050 --> 41:34.790] It's like a proof of concept. [41:34.950 --> 41:40.290] It's something that we wrote completely drunk of drop pad during an afternoon in the camp. [41:40.290 --> 41:43.390] Remember, we were doing a game. [41:43.650 --> 41:44.010] Playing. [41:45.050 --> 41:51.930] So, we start creating in the Hasterys configuration the methods to... [41:51.930 --> 41:54.610] From here, I am not able to... [41:54.610 --> 41:56.110] So, it's better if I move here. [41:56.350 --> 41:56.690] Excuse me. [41:59.880 --> 42:12.020] We defined that when people answered, the first thing to do was to play the hand of the play of the message to connect people to the room. [42:12.520 --> 42:20.600] The problem was that we wanted to hear what people were saying inside the meeting room. [42:21.120 --> 42:25.820] So, we created also a direct number to enter the conference room. [42:29.260 --> 42:41.760] Then, we create the method that we run everything on our PBX, but uses their PBX to reach every people. [42:42.080 --> 42:42.500] Remember? [42:42.960 --> 42:44.820] Five each time. [42:45.460 --> 42:48.820] Reading the directory from this file. [42:51.480 --> 42:55.800] Then, when we had to decide which... [42:55.800 --> 43:02.880] language used to do the script, a friend of us told us, I only know PHP. [43:03.300 --> 43:05.220] So, I had to write it in PHP. [43:05.600 --> 43:12.800] So, we were able to find this open source module to use PHP to interact with an asterisk PBX. [43:14.860 --> 43:19.640] And we use it to create this little script. [43:21.460 --> 43:25.040] The core part is always in the next slide. [43:25.040 --> 43:32.060] So, first thing, connect to the PBX or advertise us that the domain was failed. [43:32.640 --> 43:43.720] If connection is okay, open the directory file, the list, and initialize a counter. [43:45.120 --> 43:50.820] Then, if you are able to arrive here, then... [43:52.780 --> 43:53.500] Use... [43:53.500 --> 43:53.680] Oh! [43:54.400 --> 43:55.000] Excuse me. [43:55.300 --> 43:55.640] Hey. [43:57.280 --> 44:03.480] Use this method, the one that uses MP3 and connect to the meet me room. [44:07.420 --> 44:09.480] I am not able to read from here. [44:09.780 --> 44:09.960] Excuse me. [44:10.680 --> 44:10.880] I am not able to read from here. [44:10.880 --> 44:26.000] And we get the status of the phone call and we have some output printed on our screen to understand if the script was running, if someone was not responding or busy and so on. [44:27.720 --> 44:38.280] And every file connection, we stopped for 20 seconds to allow people to flow inside the conference room and have their PBX free. [44:39.420 --> 44:41.000] There was a place... [44:41.620 --> 44:43.000] Maybe in the next slide... [44:44.140 --> 44:44.420] No. [44:46.080 --> 44:47.360] We were managing errors. [44:47.560 --> 44:53.420] All errors were written in the same file, so the procedure continues to loop on the same list. [44:53.420 --> 44:58.840] If someone doesn't respond or was busy, we'll try it later. [44:59.740 --> 45:13.700] So, we were able to do... to reach all our goals, logging what was happening and recording what people were saying inside the conference room. [45:13.700 --> 45:24.020] So, on 800 people, we were able to reach 700 people in an afternoon to advertise our party. [45:24.340 --> 45:25.700] A good result, in my opinion. [45:27.660 --> 45:35.000] But I want to show you what people were thinking about us during... during inside the conference room. [45:37.020 --> 45:39.800] Do you want to go into the Italian finish? [45:42.160 --> 45:43.620] Yes, I know. [45:43.860 --> 45:49.260] Actually, phones may shut down the conference room and then press the floor. [45:53.680 --> 46:01.760] Those are CCC engineers that don't appreciate our initiative and want to unplug our cable. [46:01.760 --> 46:04.720] But not everyone thinks in the same way. [46:14.800 --> 46:18.660] This was the results inside the conference room. [46:18.960 --> 46:24.140] But the problem was that we were calling people that were in the same camp as us. [46:24.740 --> 46:31.360] So, same people that we met at coffee shop, at ice cream shop. [46:32.200 --> 46:33.360] At... and so on. [46:34.680 --> 46:35.200] And... [46:35.680 --> 46:37.140] I was... in a queue, waiting for my coffee, and... a guy started talking with me. [46:43.120 --> 46:46.140] You are a spitter, you must stop that... f*cking... so on. [46:48.600 --> 46:50.400] I tried to explain him. [46:50.660 --> 46:52.440] No, no, it's just a game. [46:53.000 --> 46:53.700] It's everything. [46:53.840 --> 46:57.000] Okay, we want to check if we are able to do that. [46:58.240 --> 46:59.280] And then... [46:59.280 --> 47:00.860] Come to the party, come there. [47:00.860 --> 47:02.800] Ah, wonderful! [47:03.300 --> 47:04.740] Yeah, some grappa... [47:06.860 --> 47:08.900] But the incredible thing. [47:09.320 --> 47:10.140] Happened... [47:10.140 --> 47:11.140] Some months later. [47:11.680 --> 47:12.460] I was in... [47:13.320 --> 47:14.140] Prague... [47:14.140 --> 47:15.860] in East Europe... [47:16.660 --> 47:19.040] in Varsal, excuse me... [47:19.040 --> 47:20.760] at the underground conference. [47:21.020 --> 47:21.600] And a guy... [47:21.600 --> 47:22.720] come to me... [47:24.140 --> 47:25.700] Learned that I'm Italian. [47:26.120 --> 47:27.060] See the brass letters. [47:27.300 --> 47:27.880] Oh... [47:27.880 --> 47:28.680] You are Italian. [47:29.100 --> 47:29.420] Yeah... [47:29.420 --> 47:30.400] Maybe you know... [47:30.400 --> 47:32.420] Those people that did... [47:33.480 --> 47:34.860] that incredible voice... [47:34.860 --> 47:36.040] back at the camp. [47:37.660 --> 47:38.340] Yeah... [47:38.340 --> 47:39.100] I know them. [47:39.360 --> 47:40.800] The recorded voice is... [47:40.800 --> 47:41.840] is mine. [47:42.640 --> 47:43.200] Oh... [47:43.200 --> 47:43.640] Incredible. [47:44.100 --> 47:45.260] I was not at the camp. [47:45.800 --> 47:46.080] But... [47:46.360 --> 47:47.200] I was at home. [47:47.340 --> 47:48.880] I registered my phone... [47:48.880 --> 47:49.420] to the... [47:49.420 --> 47:50.480] Can't PBX. [47:50.560 --> 47:51.960] And I received you call... [47:51.960 --> 47:53.280] at home in Varsal. [47:53.500 --> 47:55.360] I wanted to come to the party. [48:04.890 --> 48:06.270] In the program... [48:06.270 --> 48:07.730] The real problem was... [48:07.730 --> 48:09.030] the Italian grappa slogan. [48:09.030 --> 48:11.030] We were continuously... [48:12.390 --> 48:13.030] shouting... [48:13.030 --> 48:13.610] Italian grappa. [48:13.730 --> 48:13.970] When... [48:13.970 --> 48:15.290] One people start shouting... [48:15.550 --> 48:16.290] Italian grappa... [48:16.290 --> 48:17.370] Someone else... [48:17.370 --> 48:18.590] starts shouting the same... [48:18.590 --> 48:19.430] from the other side... [48:19.430 --> 48:19.990] of the camp... [48:19.990 --> 48:20.390] and so on. [48:21.250 --> 48:21.590] And... [48:22.430 --> 48:23.650] Months later... [48:23.650 --> 48:24.190] at CCC... [48:24.570 --> 48:25.410] in Berlin... [48:25.410 --> 48:26.430] I found... [48:26.430 --> 48:27.030] this guy... [48:27.850 --> 48:28.650] that arrived... [48:28.650 --> 48:29.030] Oh... [48:29.030 --> 48:29.750] you are the... [48:29.750 --> 48:30.610] party guy! [48:31.930 --> 48:32.250] So... [48:32.570 --> 48:33.430] Italian grappa... [48:33.430 --> 48:34.290] became a slogan... [48:34.870 --> 48:36.490] at European events... [48:36.490 --> 48:37.770] where Italian people is there. [48:37.850 --> 48:38.750] Do you have any grappa? [48:38.750 --> 48:39.210] from you? [48:40.470 --> 48:41.590] Yes, I am. [48:43.770 --> 48:44.450] And... [48:44.450 --> 48:45.430] CCC guy... [48:45.430 --> 48:46.930] for the first year... [48:46.930 --> 48:48.610] prepared a table... [48:48.610 --> 48:48.990] for us... [48:49.430 --> 48:49.970] here... [48:49.970 --> 48:50.750] near the family... [48:52.210 --> 48:53.730] to offer coffee... [48:53.730 --> 48:54.230] and grappa... [48:54.230 --> 48:55.250] to all attendees. [48:55.590 --> 48:55.930] So... [48:55.930 --> 48:56.750] as I said before... [48:57.510 --> 48:58.190] tomorrow... [48:58.190 --> 48:58.830] come... [48:58.830 --> 48:59.570] downstairs... [48:59.570 --> 49:00.470] to have some coffee. [49:01.350 --> 49:02.150] I have... [49:02.490 --> 49:03.690] I have no grappa... [49:03.690 --> 49:04.430] I have to say... [49:04.430 --> 49:05.890] I have to say... [49:05.890 --> 49:06.510] no grappa... [49:06.510 --> 49:07.010] yeah... [49:09.250 --> 49:10.250] but... [49:10.250 --> 49:11.670] everything... [49:11.670 --> 49:12.350] was... [49:12.350 --> 49:13.530] a fun game... [49:13.530 --> 49:14.170] because... [49:14.170 --> 49:15.890] we were not malicious... [49:15.890 --> 49:16.830] we were... [49:16.830 --> 49:17.950] having a game... [49:18.170 --> 49:18.930] we were... [49:18.930 --> 49:19.510] doing that... [49:20.030 --> 49:20.730] between... [49:20.730 --> 49:21.730] live chess game... [49:22.230 --> 49:22.890] and... [49:22.890 --> 49:24.510] sorcery in demand... [49:25.130 --> 49:25.630] but... [49:27.070 --> 49:28.510] there was no billing... [49:28.510 --> 49:30.510] all phone calls were for free... [49:33.710 --> 49:34.550] free... [49:34.550 --> 49:36.430] I don't know why... [49:36.430 --> 49:37.350] I wrote for... [49:37.350 --> 49:38.170] free... [49:38.170 --> 49:39.110] drunk people... [49:39.110 --> 49:39.570] were able... [49:40.030 --> 49:40.910] to do this... [49:40.910 --> 49:42.050] imagine something... [49:42.050 --> 49:42.590] that is... [49:42.590 --> 49:43.250] motivated... [49:43.910 --> 49:44.330] paid... [49:44.870 --> 49:45.530] have time... [49:45.950 --> 49:47.030] to do... [49:47.030 --> 49:47.990] something like that... [49:47.990 --> 49:49.310] against the company... [49:49.310 --> 49:49.750] against... [49:49.750 --> 49:51.110] against the infrastructure... [49:51.110 --> 49:52.430] that have billing... [49:52.430 --> 49:52.730] or... [49:52.730 --> 49:53.250] confidential... [49:53.930 --> 49:54.350] information... [49:54.870 --> 49:55.610] to protect... [49:56.170 --> 49:56.550] and... [49:56.550 --> 49:57.530] I'm quite... [49:57.530 --> 49:58.390] scared... [49:58.390 --> 49:59.250] about this... [50:01.550 --> 50:03.500] people nowadays that... [50:04.130 --> 50:04.730] is... [50:04.730 --> 50:06.380] ready to take money... [50:06.790 --> 50:07.540] to manage... [50:07.870 --> 50:09.440] such kind of services... [50:10.350 --> 50:10.910] with VoIP... [50:10.910 --> 50:11.460] for speed... [50:11.870 --> 50:12.540] for fishing... [50:12.970 --> 50:13.620] and so on... [50:16.190 --> 50:16.600] obviously... [50:17.010 --> 50:18.290] I promise I'm... [50:18.290 --> 50:20.370] at the end... [50:20.370 --> 50:21.370] I have to say... [50:21.370 --> 50:22.090] thank you... [50:22.090 --> 50:23.090] to the other guy... [50:23.090 --> 50:23.640] that realized... [50:23.950 --> 50:24.620] all these things... [50:24.830 --> 50:25.370] with me... [50:25.370 --> 50:25.990] alone... [50:25.990 --> 50:26.890] I could do... [50:26.890 --> 50:27.890] nothing... [50:27.890 --> 50:29.050] they... [50:29.050 --> 50:30.270] did a huge part... [50:30.670 --> 50:31.210] of the work... [50:31.210 --> 50:32.310] they are not here... [50:32.310 --> 50:32.830] today... [50:32.830 --> 50:33.630] but... [50:33.630 --> 50:35.530] what I show you... [50:35.530 --> 50:36.910] is the result... [50:36.910 --> 50:37.410] of... [50:37.410 --> 50:38.190] a work... [50:38.190 --> 50:38.890] by... [50:38.890 --> 50:39.470] many people... [50:39.470 --> 50:41.790] that work together... [50:41.790 --> 50:42.630] conclusion... [50:42.630 --> 50:43.690] you are happy... [50:45.110 --> 50:46.070] yeah... [50:46.070 --> 50:47.130] as I said... [50:47.590 --> 50:48.610] at the beginning... [50:48.610 --> 50:49.290] yeah... [50:49.290 --> 50:50.030] bug exists... [50:50.470 --> 50:51.350] flows exist... [50:51.970 --> 50:52.650] there are... [50:52.650 --> 50:53.290] some technological... [50:53.730 --> 50:54.270] problems... [50:54.270 --> 50:54.890] in VoIP... [50:54.890 --> 50:56.090] our task... [50:56.090 --> 50:57.370] is... [50:57.370 --> 50:57.570] obviously... [50:57.570 --> 50:58.670] to create... [50:58.670 --> 51:00.070] better... [51:00.070 --> 51:00.670] products... [51:00.670 --> 51:01.170] to... [51:01.170 --> 51:02.070] mitigate... [51:02.070 --> 51:02.770] everything... [51:02.770 --> 51:03.110] but... [51:03.110 --> 51:04.290] the first thing... [51:04.290 --> 51:05.390] is to use... [51:05.390 --> 51:06.310] all that... [51:07.610 --> 51:08.110] technology... [51:08.110 --> 51:09.570] give us... [51:10.090 --> 51:10.690] yeah... [51:10.690 --> 51:11.350] VoIP... [51:11.350 --> 51:11.790] have... [51:11.790 --> 51:12.570] all problems... [51:12.570 --> 51:12.970] of... [51:12.970 --> 51:14.110] voice systems... [51:14.110 --> 51:14.310] and... [51:14.310 --> 51:15.150] all problems... [51:15.150 --> 51:15.530] of... [51:15.530 --> 51:16.830] IP networks... [51:16.830 --> 51:17.250] but... [51:17.250 --> 51:17.850] VoIP have... [51:17.850 --> 51:19.270] for example... [51:19.270 --> 51:19.690] all... [51:21.050 --> 51:21.950] mitigation... [51:21.950 --> 51:22.830] services... [51:23.530 --> 51:23.910] of... [51:23.910 --> 51:25.330] IP networks... [51:25.330 --> 51:25.630] in... [51:25.630 --> 51:27.010] traditional... [51:27.010 --> 51:27.770] telephony... [51:27.770 --> 51:28.850] don't exist... [51:28.850 --> 51:29.650] the concept... [51:29.650 --> 51:30.870] of authentication... [51:30.870 --> 51:32.050] of encryption... [51:32.050 --> 51:32.750] you can... [51:32.750 --> 51:33.310] have... [51:33.310 --> 51:34.490] an encrypted... [51:34.490 --> 51:35.190] analog... [51:35.190 --> 51:35.710] line... [51:35.710 --> 51:36.730] using... [51:36.730 --> 51:37.650] traditional... [51:37.650 --> 51:38.230] services... [51:38.230 --> 51:38.790] with VoIP... [51:38.790 --> 51:39.430] you can... [51:39.430 --> 51:39.790] but... [51:39.790 --> 51:40.590] you must... [51:40.590 --> 51:41.130] want... [51:41.130 --> 51:42.410] it's... [51:42.410 --> 51:42.790] available... [51:42.790 --> 51:44.050] but you must do it... [51:44.050 --> 51:45.290] it's not enabled by the... [51:45.290 --> 51:46.130] by default... [51:49.330 --> 51:50.630] I put... [51:50.630 --> 51:52.190] at the end of the slides... [51:52.190 --> 51:53.290] a... [51:53.290 --> 51:53.930] short... [51:53.930 --> 51:56.370] not so comprehensive... [51:56.370 --> 51:58.250] best practices of things... [51:58.250 --> 51:59.090] that you must... [51:59.590 --> 52:00.010] check... [52:00.010 --> 52:00.950] if you run... [52:00.950 --> 52:01.870] a VoIP Network... [52:01.870 --> 52:02.590] if you are... [52:02.590 --> 52:03.890] selling a VoIP Network... [52:03.890 --> 52:04.830] ehm... [52:04.830 --> 52:05.530] or something... [52:05.530 --> 52:06.530] like that... [52:06.530 --> 52:07.230] ah... [52:07.230 --> 52:08.190] first things are... [52:08.190 --> 52:09.490] obviously we need to separate... [52:09.490 --> 52:10.470] separate... [52:10.470 --> 52:11.230] everything... [52:11.230 --> 52:12.490] you don't want... [52:12.490 --> 52:16.150] The first worm to shut down your VoIP network. [52:16.690 --> 52:31.330] You don't want someone that is able to obtain administrative privilege on a secretary PC to be able to run Man-in-the-Middle attack on your layer 2 network. [52:31.750 --> 52:37.730] So you want to divide and create and use all things that technology gives us. [52:38.610 --> 52:40.370] One word about the firewall. [52:41.190 --> 52:42.250] Firewall is good. [52:42.490 --> 52:43.610] Firewall is the solution. [52:43.910 --> 52:47.330] How is it executing your company or how good we have a firewall? [52:47.650 --> 52:48.090] Okay, no. [52:48.550 --> 52:48.930] It doesn't work. [52:50.310 --> 52:58.850] Firewall is good, but if you have a firewall that doesn't know VoIP protocols, the result is you have to open all ports. [52:59.490 --> 53:03.630] Open all ports is equal to having no firewall at all. [53:03.970 --> 53:15.750] So having a firewall that is able to work at layer 7 at application level to understand telephony and open and close port dynamically as needed is really important in this context. [53:15.970 --> 53:22.970] I have a little webography of things that you can find on web. [53:22.970 --> 53:27.350] I suggest you to start from this document. [53:27.710 --> 53:29.690] It's from NIST. [53:30.250 --> 53:35.390] It's not so deep knowledge document, but it's wide knowledge. [53:35.850 --> 53:38.630] All topics are here. [53:38.910 --> 53:41.590] Then you must dip each topic. [53:41.590 --> 53:47.190] This is a collaborative mickey of all vendors of technology. [53:47.650 --> 53:52.210] It saves my life in a huge... in a lot of occasions. [53:52.590 --> 53:56.530] And so I try to write on it as much as I can. [53:56.750 --> 54:00.070] And this is the consortium I told you before. [54:00.850 --> 54:07.270] Those are the two FBI reports I was talking about about the Pinacar case. [54:10.100 --> 54:16.520] Well, I obviously need to say thank you to all these people that were at the camp and made the photos I show you. [54:17.120 --> 54:23.540] And to say thank you to them because they give away the photos under Creative Commons license. [54:24.020 --> 54:29.220] If they put some copyright on the photos and was not able to show you this evening. [54:29.220 --> 54:30.880] So thank you to them. [54:31.060 --> 54:33.440] They have a very huge camera. [54:33.960 --> 54:35.960] And they have those cameras for all the camp. [54:36.340 --> 54:39.120] So they did a large documentation work. [54:39.300 --> 54:41.140] Very useful to my opinion. [54:42.740 --> 54:43.860] Last slide. [54:44.040 --> 54:52.100] I want to advertise that in August this year in Pescara near Rome there will be an acre camp run by Italian people. [54:52.100 --> 54:59.460] I put some marketing on the walls inside the both floors. [54:59.760 --> 55:04.720] If you want any information write me and you'll be our guest there. [55:05.240 --> 55:07.680] And there is also a code for paper. [55:08.140 --> 55:13.240] So if someone of you want to come there to talk about something, you are welcome. [55:13.580 --> 55:14.120] We want you. [55:16.600 --> 55:18.280] Really, really the end. [55:18.440 --> 55:18.860] Thank you. [55:31.820 --> 55:32.300] Question. [55:32.720 --> 55:34.500] If there is something back. [55:34.740 --> 55:35.580] I hope no. [55:36.480 --> 55:37.280] One other question. [55:38.420 --> 55:38.600] Yes? [55:39.100 --> 55:42.460] Sorry if you already answered the text in a little bit, but your bracelets... [55:42.460 --> 55:44.440] You must put the phone lower. [55:44.720 --> 55:44.920] All right. [55:45.200 --> 55:45.800] Your bracelets. [55:46.660 --> 55:47.840] Are those just caps? [55:48.460 --> 55:50.100] Your camp bracelets or what are those? [55:50.160 --> 55:50.620] Yeah, yeah. [55:50.620 --> 55:54.760] When you enter the camp, you must pay a fee. [55:55.400 --> 55:59.020] And when you pay the fee, they put this on your arm. [55:59.340 --> 56:00.920] This is from the summer camp. [56:01.040 --> 56:02.580] This is from the winter...