[00:00.000 --> 00:00.800]  Okay?
[00:01.180 --> 00:03.900]  So the war kept on growing and growing.
[00:04.340 --> 00:07.720]  And then all of a sudden, one day they gave up.
[00:07.920 --> 00:10.300]  They tried other things and no big problem.
[00:10.460 --> 00:12.380]  And it got to be a nice little piece for a while.
[00:12.620 --> 00:16.120]  And then Sony came along with what their little trick was.
[00:16.300 --> 00:20.360]  And most of you probably know what happened in the Sony BMG copy protection scandal.
[00:20.580 --> 00:24.920]  They went ahead and installed a rootkit under Windows systems only, naturally.
[00:25.580 --> 00:29.020]  And what happened was it opened a back door that other people could get.
[00:29.020 --> 00:31.020]  Because they actually happened to suck at their code writing.
[00:32.900 --> 00:42.060]  But what it did for me, in my mind anyway, was it brought up the idea that companies are now looking at commercially installed rootkits.
[00:43.120 --> 00:44.620]  And that's going to be a problem.
[00:44.920 --> 00:46.260]  I said, okay, this is a problem.
[00:46.380 --> 00:47.420]  We're going to have issues here.
[00:47.700 --> 00:50.140]  Things aren't going to work out for us in the slightest.
[00:51.240 --> 00:53.840]  And then... Hello?
[00:56.480 --> 00:58.600]  Blizzard came along with World of Warcraft.
[00:59.300 --> 01:00.820]  And the warden came out.
[01:01.680 --> 01:04.420]  And people finally figured out what the warden was doing.
[01:04.600 --> 01:06.460]  The fact that the warden was even running.
[01:06.780 --> 01:10.660]  And then people said, well, gee, this is actually running as a rootkit.
[01:10.880 --> 01:19.020]  It is looking at what you're running on your computer under the words of, we're looking for cheating software.
[01:19.220 --> 01:21.980]  We don't want players to have advantage over other players.
[01:22.700 --> 01:25.440]  My question became, what else is it doing?
[01:27.700 --> 01:29.720]  Again, can we trust them?
[01:29.840 --> 01:31.440]  Have they earned that level of trust?
[01:31.440 --> 01:34.620]  And now recently, this came up in the past couple of weeks.
[01:34.700 --> 01:36.060]  Anybody know about the real ID fight?
[01:37.040 --> 01:38.060]  Anybody's aware of that?
[01:38.480 --> 01:38.960]  Okay.
[01:39.280 --> 01:45.820]  When they announced the real ID, it was basically going to say, we're going to make you all post under your real names now.
[01:46.020 --> 01:51.120]  I was actually dead set against using email accounts as your login names.
[01:51.140 --> 01:54.720]  And I didn't log on for about X number of months.
[01:54.960 --> 01:56.840]  And then my children all want to play.
[01:57.020 --> 01:57.800]  I have four kids.
[01:57.800 --> 02:00.780]  And all four of them have characters in World of Warcraft.
[02:00.940 --> 02:02.160]  And we kind of share two accounts.
[02:02.320 --> 02:03.640]  Yeah, we violate TOS.
[02:03.820 --> 02:04.080]  I know.
[02:04.500 --> 02:05.380]  That's the way it goes.
[02:07.500 --> 02:09.400]  But what else is going on in there?
[02:09.680 --> 02:27.400]  Well, the timing, I thought, was relatively interesting with the real ID, because they came out with the announcement, from my viewpoint, within a few weeks of China saying, basically, their citizens can't post anywhere on the Internet under anything besides their real name.
[02:28.280 --> 02:33.920]  So, in my mind, this wasn't a move to bring the community closer together and help stop the trolls.
[02:34.220 --> 02:40.020]  It was a move to keep untold numbers of players in China playing.
[02:40.020 --> 02:46.960]  And, you know, I have some more colorful expressions about what I thought Blizzard was doing, but I probably won't use them here.
[02:47.060 --> 02:50.260]  Because my 15-year-old is actually here, I think, somewhere.
[02:51.280 --> 02:53.080]  They backed off the requirement.
[02:53.080 --> 02:54.360]  It is now voluntary.
[02:55.360 --> 03:00.380]  But so was the idea of signing up under the email account.
[03:00.640 --> 03:05.420]  It was voluntary initially, then they changed it and made it mandatory.
[03:07.060 --> 03:08.520]  Again, why bother?
[03:09.700 --> 03:18.500]  According to this data that I pulled up off of an article, there are currently 1.5 billion unique estimated registered users of online games.
[03:19.140 --> 03:19.740]  Worldwide.
[03:19.960 --> 03:20.400]  Worldwide.
[03:20.560 --> 03:22.440]  1.5 billion.
[03:22.780 --> 03:24.280]  That's kind of a shitload of people.
[03:25.180 --> 03:25.780]  Worldwide.
[03:25.780 --> 03:34.500]  Now, here's the one interesting thing is I found out that by playing some of these games, geez, a lot of people who play at work.
[03:35.500 --> 03:43.200]  A lot of people who play at work, oddly enough, they advertise the fact they play at work, okay?
[03:43.200 --> 03:46.160]  They tell people in the game, I'm playing at work today.
[03:46.480 --> 04:05.400]  And it's really odd watching some students of the IS department playing at work, and when another researcher wanted to get them to help out doing some work for them, they were told by the supervisor of the person playing at work, no, no, no, they're way too busy.
[04:08.450 --> 04:15.930]  So what it comes down to really is, and oh, by the way, we also found out they were goofing off at work by their Facebook posts on a regular basis.
[04:18.630 --> 04:33.550]  I don't understand the young people today, but my kids, if I walk past one of the computers we have at home, and we have a lot of computers at home, my 16-year-old daughter would go ahead, even at 14, would window out right away her IMing.
[04:34.630 --> 04:36.330]  It's like, what the hell is she trying to hide, okay?
[04:37.250 --> 04:45.170]  Well, it's a problem, and yet on Facebook, they're sharing everything, almost to the point that we're finding out what colored toilet paper there is when they wipe their ass after they poop.
[04:45.870 --> 04:47.470]  And I don't need that kind of information.
[04:47.630 --> 04:48.290]  It's way TMI.
[04:48.750 --> 04:51.810]  I actually have a block of this that I teach in another class.
[04:52.130 --> 04:55.070]  So bottom line is, the game company's worthy of our trust.
[04:56.910 --> 04:58.010]  So what are we doing?
[04:58.370 --> 05:02.090]  Well, we started trying to figure out, how can we look at this in a regular way?
[05:02.090 --> 05:03.590]  Well, we picked three games.
[05:03.790 --> 05:12.830]  We picked Ebony, which, oh, by the way, advertises itself in some very unique ways, mostly by duplication of other people's work.
[05:13.430 --> 05:19.750]  And they advertise themselves as, play at work without being seen, okay?
[05:20.890 --> 05:30.490]  But yet they do make... they make no effort to hide the fact that you're connecting to them, which I find fairly interesting, because I think any 16-year-old knows what a firewall does to pick them up in a heartbeat.
[05:31.810 --> 05:36.110]  Basically, the three games were Ebony, and we also picked Dungeons & Dragons online.
[05:36.530 --> 05:41.290]  And the third game was, we tried to pick up Modern Warfare 2, through Steam.
[05:41.970 --> 05:44.430]  And DDO uses the Turbine engine.
[05:44.690 --> 05:47.630]  We found out they also used something from Panda software.
[05:49.110 --> 05:54.690]  And then the idea was, on task one, boy, actually read those terms of service.
[05:55.310 --> 05:57.170]  Read the privacy policies.
[05:57.270 --> 05:58.730]  Let's see what they actually say.
[05:58.730 --> 06:11.210]  Number two, we actually monitored installations with some software we were playing with, to see that when you install a game, you are installing a lot of crap on your computer, okay?
[06:11.530 --> 06:17.010]  And the third thing was, start using firewalls and then later on packet sniffers to watch the traffic.
[06:17.630 --> 06:22.050]  The reason why I picked Steam was, I won't allow Steam on my computer at home.
[06:23.590 --> 06:31.650]  Because when I look at the other computers that had Steam on them, Steam is doing stuff when no one's on the computer.
[06:33.350 --> 06:33.790]  Okay?
[06:34.250 --> 06:36.070]  So that kind of caught me right away.
[06:36.350 --> 06:38.750]  It reminded me back when I first got Windows 98.
[06:38.750 --> 06:40.030]  I came back from overseas.
[06:41.610 --> 06:43.250]  I've been stationed overseas for a bit.
[06:43.350 --> 06:45.330]  And I came back from overseas, bought a Windows 98 computer.
[06:45.330 --> 06:53.150]  And all of a sudden, every few nights, every couple of nights at around midnight, my computer would dial-up the modem.
[06:54.810 --> 06:57.010]  And that seemed relatively odd to me.
[06:57.110 --> 06:58.870]  And I went and started tracing and figuring it out.
[06:58.970 --> 07:01.370]  And I'm 95% sure it was my mouse.
[07:01.670 --> 07:05.930]  The Microsoft mouse was calling up every night.
[07:05.930 --> 07:07.770]  And that was in the first release of Windows 98.
[07:10.110 --> 07:13.470]  Anyway, what we're trying to do is a little bit of academic rigor on this.
[07:13.690 --> 07:17.550]  I'm trying to teach her how to go be a good grad student and get paid to go to grad school.
[07:17.730 --> 07:20.570]  I think no grad student should pay for college if they're any good.
[07:20.930 --> 07:21.410]  All right?
[07:21.510 --> 07:24.350]  I think grad students should all be funded in some way or another.
[07:24.590 --> 07:25.690]  So the emphasis...
[07:25.690 --> 07:27.010]  Yeah, seriously.
[07:28.330 --> 07:31.170]  The emphasis for me is on the repeatability of experiments.
[07:32.390 --> 07:34.850]  Can someone go ahead and take our work and repeat it?
[07:35.530 --> 07:46.550]  Well, down the road, what I really like to think of is that we can develop some kind of real-time monitor of games with some kind of constant vigilance because software updates are pushed to you all the time.
[07:46.950 --> 07:51.890]  However, I'm well aware of the fact that if the user has to make any kind of effort, they're not going to do it.
[07:52.010 --> 07:53.470]  It takes away their reason for playing.
[07:53.730 --> 07:56.910]  Once you take away your reason to play a game, to have fun, it becomes effort.
[07:57.150 --> 07:58.390]  Now, no one's going to do it.
[07:59.350 --> 08:01.430]  But I'm more concerned with ubiquitous computing.
[08:02.610 --> 08:04.790]  We all have our little smartphones now.
[08:05.070 --> 08:06.230]  My son got upset yesterday.
[08:06.390 --> 08:13.690]  One of the people asked how many folks have smartphones, and 97% of the room raised their hand, and he doesn't have a smartphone.
[08:13.710 --> 08:16.730]  So I got a little bit airful about how come he has no smartphone right now.
[08:18.930 --> 08:20.190]  But there's an app for that.
[08:21.190 --> 08:25.290]  But again, every time my kids download an app, because this becomes a new toy.
[08:25.370 --> 08:33.550]  So I mentioned yesterday, if you're on a trip driving somewhere to a swim meet or a basketball game or something, the kids want my cell phone to go start playing games.
[08:34.610 --> 08:36.930]  But how do I know where that software comes from?
[08:36.970 --> 08:38.670]  I'm just not really a very trusting person.
[08:40.190 --> 08:43.690]  So the first one, and you'll probably have some fun with this one.
[08:43.690 --> 08:46.270]  How many folks actually read privacy policies?
[08:47.730 --> 08:48.250]  Okay?
[08:48.670 --> 08:51.950]  And listen, you guys are the knowledgeable ones.
[08:52.430 --> 08:53.130]  All right?
[08:53.570 --> 08:57.570]  I ask other people, and everyone, I use a swim meet, I talk to people.
[08:57.810 --> 08:58.830]  No one reads that crap.
[08:58.850 --> 08:59.290]  How come?
[09:00.910 --> 09:02.290]  They're hard to read.
[09:02.450 --> 09:03.870]  They're written in legalese.
[09:04.370 --> 09:04.890]  All right?
[09:05.070 --> 09:13.790]  And I've never, ever, ever trusted lawyers, because anyone who needs their own language to describe their work they do is probably untrustworthy.
[09:14.490 --> 09:15.090]  All right?
[09:15.250 --> 09:17.490]  And I'm a retired military officer, by the way.
[09:17.670 --> 09:17.950]  Okay?
[09:18.110 --> 09:19.310]  I retired back in 97.
[09:19.710 --> 09:22.350]  And we have our own language as well.
[09:22.970 --> 09:23.530]  All right?
[09:27.270 --> 09:32.410]  The average privacy policy, according to a CMU study in 2008, was about 2,500 words.
[09:32.570 --> 09:34.150]  And those are the small documents.
[09:34.710 --> 09:38.330]  Terms of service, ascriber agreements, everything else, those kinds of things, they're even worse.
[09:39.330 --> 09:40.310]  We read them.
[09:40.430 --> 09:41.470]  Even my teenagers helped.
[09:41.630 --> 09:46.290]  And I'll probably use a couple of words that my 15-year-old actually used at some point.
[09:46.910 --> 09:47.910]  Interesting stuff here.
[09:48.810 --> 09:56.350]  Account information will be stored and processed in the United States, or any other country in which the company or its affiliates, blah, blah, blah, blah, blah.
[09:56.610 --> 10:00.690]  So basically, they're covering their ass.
[10:01.890 --> 10:12.670]  Privacy policies really started off as a movement by the government to say, if you don't legislate yourselves in the industry, we will legislate you.
[10:13.030 --> 10:14.790]  The idea is to protect the consumer.
[10:15.150 --> 10:15.590]  Okay?
[10:15.810 --> 10:20.530]  And you can go to Wikipedia, privacy policies, and find out all the information about this kind of stuff.
[10:20.910 --> 10:22.210]  It's interesting.
[10:22.870 --> 10:27.790]  But what happened was, in my mind, primarily the job is to cover the ass of the company.
[10:28.130 --> 10:28.590]  All right?
[10:29.350 --> 10:34.850]  And if you look down here, I blocked out Ebony's name, but, you know, this is from Ebony.
[10:36.770 --> 10:41.590]  Does anybody know what the thought source of Ebony is?
[10:44.350 --> 10:48.410]  Yeah, the old World of Warcraft Chinese gold farmers is what's supposed to be Ebony.
[10:48.590 --> 10:52.790]  And they went ahead and it rumored that they only spent about $10,000 developing it.
[10:52.950 --> 10:54.550]  But they got a crap load of money.
[10:56.790 --> 11:04.470]  And if you buy coins from them to play the game, the free game, if you buy coins from them, it goes to a company in Hong Kong.
[11:06.470 --> 11:10.910]  Anyway, another thing that's always interesting to see in privacy policies, we wrote a generic one-pager.
[11:11.210 --> 11:15.230]  This privacy policy may change from time to time, so please check back periodically.
[11:15.630 --> 11:20.590]  Bottom line is, for the most part, the responsibility of checking the privacy policy is on you.
[11:21.470 --> 11:23.270]  You have to go look at it.
[11:23.610 --> 11:23.970]  All right?
[11:24.150 --> 11:28.530]  If they change it and you play the game, you're still bound by it.
[11:28.570 --> 11:30.830]  Although, I'm really interested to see what happens when this hits court.
[11:31.610 --> 11:36.750]  I'm curious how all these EULAs and privacy policies will survive court challenges.
[11:37.090 --> 11:42.510]  I'm not sure how many of them might be legal, but I usually don't talk to lawyers to ask them, because lawyers kind of scare me.
[11:45.630 --> 11:46.810]  Here's another interesting one.
[11:47.030 --> 11:51.770]  Your web browser or client software may transmit certain geographic information, information regarding your computer.
[11:52.030 --> 11:53.170]  Blah, blah, blah, blah, blah.
[11:53.290 --> 11:54.110]  It goes on from there.
[11:55.290 --> 12:00.070]  Information regarding billing, your account, your Internet connection, the product, service installed on your computer, upload to the server.
[12:01.150 --> 12:02.950]  So that's the privacy policies.
[12:04.210 --> 12:11.510]  Now you start looking at the generic terms of service, the EULAs, the subscriber agreements, the various things that you agree to.
[12:12.410 --> 12:14.530]  Turbine actually had three of them.
[12:14.990 --> 12:17.430]  They have a terms of service and a EULA.
[12:17.990 --> 12:20.110]  Both of the lengths I described there.
[12:20.310 --> 12:23.350]  And it's written in very high-tech legalese.
[12:23.890 --> 12:25.510]  Ebeneez is 10 pages long.
[12:25.510 --> 12:28.290]  Um, Steam has 12 pages.
[12:30.230 --> 12:37.290]  Now, on Ebony, it was pretty much a complete duplicate of another game.
[12:39.550 --> 12:48.090]  It was a complete duplicate of another game, of which they are rumored to have been a primary source of artificial currency on.
[12:48.710 --> 12:51.950]  So I don't want to name the name, because I might be accusing them of doing bad things.
[12:52.090 --> 13:12.590]  But if you read, um, World of Warcrafts, and you read Ebony's, and this is as of about three weeks ago, I've already verified it, they are word-for-word identical, including some of the lines I've put here, because Ebony doesn't do this stuff.
[13:13.930 --> 13:14.410]  Okay?
[13:14.950 --> 13:16.250]  So, and this is their caps.
[13:16.890 --> 13:23.590]  When running the game, may monitor your computer's random access memory in our CPU process for unauthorized third-party programs running concurrently with Ebony.
[13:25.410 --> 13:27.190]  They're a web browser game only.
[13:27.250 --> 13:30.170]  It turns out, we found out, they really don't install anything on your system.
[13:30.330 --> 13:34.530]  It actually truly seems to be, seems to be truly only in the browser.
[13:34.790 --> 13:39.170]  And you can actually download the Ebony client off BitTorrent, although you didn't hear that.
[13:39.170 --> 13:44.730]  Um, when running the game, may monitor your computer's stuff.
[13:45.590 --> 13:49.430]  And how do they know, how do they determine what's unauthorized?
[13:49.970 --> 13:52.470]  So obviously, it's an area of concern for us.
[13:53.850 --> 14:01.830]  Now, in the event that the game detects an unauthorized third-party program, the company may communicate that information back to them.
[14:02.850 --> 14:03.450]  Okay?
[14:03.730 --> 14:06.350]  And again, I don't know what the word unauthorized means.
[14:06.950 --> 14:11.170]  And, it can go ahead and grab all kinds of hardware information about you.
[14:11.430 --> 14:13.410]  Now, is this actually a bad thing normally?
[14:14.050 --> 14:16.670]  If we are trusting people, is this a bad thing?
[14:18.750 --> 14:22.750]  Well, they're trying to optimize the game to see what the user base is using for machines.
[14:22.990 --> 14:23.230]  Okay?
[14:23.410 --> 14:25.090]  I can actually understand that.
[14:25.430 --> 14:27.610]  But, is that all they're taking?
[14:28.530 --> 14:33.770]  When you go ahead, and most people go ahead and do online banking for whatever bank they're in.
[14:33.770 --> 14:34.390]  Okay?
[14:34.890 --> 14:35.690]  What happens?
[14:36.030 --> 14:38.310]  They hit every default thing, right?
[14:38.630 --> 14:45.150]  So, everyone who banks online with Chase Manhattan has everything in the same directory with the same file names.
[14:45.650 --> 14:47.450]  Easy to snatch right off, right?
[14:47.670 --> 15:04.590]  If people don't accept file sharing easily, one guy one year went and grabbed a bunch of people's tax returns off their computers, and then called them and told them you don't realize when you have file sharing turned on, you forgot to install it properly and only allow certain directories.
[15:04.930 --> 15:07.790]  So, anything on your computer is gettable as if they're there.
[15:11.230 --> 15:15.410]  They may disclose everything about you and your activities to anybody they want, pretty much.
[15:16.990 --> 15:19.990]  Some words from Turbine kind of scared me here.
[15:20.250 --> 15:34.970]  You're responsible for all charges incurred as well as, for yourself as well as any third, for us and any third party, even people you know or don't know are with or without your authorization.
[15:37.830 --> 15:41.230]  I'm not sure that's enforceable in the slightest, okay?
[15:42.050 --> 15:44.750]  But they probably get away with bullying a lot of people.
[15:45.210 --> 15:48.990]  Again, I'm trying to build this little case to say, do we trust these people?
[15:50.310 --> 15:54.270]  And then, of course, they come up with this little line, from time to time, we may scan your computer.
[15:56.290 --> 15:59.290]  The little thing in parentheses, then, is not in quotes.
[15:59.510 --> 16:02.050]  That's my little attitude.
[16:03.610 --> 16:05.710]  Steam has basically the same thing.
[16:05.890 --> 16:13.850]  They can scan your computer for anything they think is causing you unfair advantage over competitors, which means they can scan your computer for anything.
[16:14.950 --> 16:15.990]  For anything.
[16:17.570 --> 16:18.830]  All right, so task two.
[16:19.370 --> 16:20.890]  We're pretty much done with task one.
[16:20.890 --> 16:24.350]  There's no really, there's no really big follow on work for those three games.
[16:25.170 --> 16:37.910]  There is a, there is a study going on right now where somebody's going ahead and looking at how frequently a lot of the major companies are changing their online privacy policies without telling you.
[16:38.190 --> 16:41.470]  They're looking at that kind of thing to see how, how quickly changes go, go through.
[16:42.470 --> 16:42.990]  All right.
[16:43.330 --> 16:47.670]  When we first started off, we're trying to figure out, I'm going to start with the baseline system.
[16:48.150 --> 16:50.110]  I'm going to take a snapshot of the baseline.
[16:50.550 --> 16:54.770]  I'm going to install the software, take another snapshot, and then track all the differences.
[16:55.550 --> 16:56.070]  All right.
[16:56.270 --> 16:57.930]  It seems like a relatively simple thing to do, right?
[16:58.410 --> 17:00.090]  We have software that does that rake shut.
[17:00.230 --> 17:01.990]  We have in control five, does it pretty well.
[17:02.950 --> 17:06.490]  The problem is they always actually kind of differ some.
[17:07.770 --> 17:10.130]  They don't catch the same things.
[17:11.510 --> 17:13.910]  So that kind of caused a little bit of concern for us.
[17:14.090 --> 17:21.270]  And I've done previously work, previous work on steganography, where we've done this procedure to um, uniquely identify software.
[17:22.150 --> 17:24.650]  Um, that's some work I've done separately from this.
[17:24.650 --> 17:27.270]  So we've done this process plenty of times.
[17:28.350 --> 17:39.990]  It turned out our software that we had built, the script we had built to take care of all this for us, which basically does this automatically, installs a new OS on a laptop, does its stuff, takes a snapshot, has digital signatures of every file.
[17:40.630 --> 17:46.390]  And we were sure, because it was homegrown software, it was catching everything changed, because we wrote the code.
[17:46.870 --> 17:49.310]  Again, did I write rake shot?
[17:49.610 --> 17:49.970]  No.
[17:50.570 --> 17:52.370]  Do I know how exactly how it works?
[17:52.630 --> 17:53.090]  No.
[17:53.370 --> 17:58.030]  All I can do is black box test it, go by their words, and then see if the two match.
[17:58.530 --> 18:05.090]  In control five, that caused another problem for us, because in control five, doesn't do MSI files, only did executables.
[18:06.330 --> 18:11.050]  So if you're installing through an MSI file, it's not catching, it's not going to work.
[18:12.070 --> 18:16.630]  So we're actually using our homegrown software now for the next set of tests.
[18:16.810 --> 18:18.790]  We've done these tests several times.
[18:20.130 --> 18:21.390]  Problem areas for us?
[18:23.450 --> 18:26.750]  Stuff not related to the installation is always going on your computer.
[18:27.810 --> 18:42.130]  One thing we kind of forgot about, Lindsay was going ahead and doing it, I forgot to mention to her, be careful of this, is that when you turn on the computer, or when you log into the computer, it automatically starts checking for all kinds of operating system updates,
[18:42.390 --> 18:44.230]  and all your software starts checking for updates.
[18:44.930 --> 18:49.490]  So we're catching a lot of stuff that was not game related.
[18:49.790 --> 18:51.050]  That was causing us some issues.
[18:51.310 --> 18:54.530]  And then we go through, we manually go through all the results.
[18:54.730 --> 18:58.510]  Now we're starting to build our own tools to go through the results and do all the comparisons for us.
[18:58.510 --> 19:08.850]  And actually, hopefully, we can build our own tools to add on to them that will scan everything for us, go out and gather information on the Internet about all the processes that are being added to your system.
[19:11.430 --> 19:14.910]  And we're not really completely sure what happens in the browser-based game.
[19:15.930 --> 19:20.070]  It shows... what we've done so far shows nothing's being installed.
[19:21.570 --> 19:24.470]  But we're going to have to find some better ways of looking at that.
[19:25.630 --> 19:27.430]  Basically, Ebony seemed to install nothing.
[19:27.650 --> 19:29.990]  The first time we ran it, about 40 mods were done.
[19:31.150 --> 19:35.270]  And then, about a week later, we said, hmm, this may seem kind of funny.
[19:35.430 --> 19:39.510]  So we went ahead and just started the Internet browser without logging on to the game.
[19:40.310 --> 19:42.310]  And pretty much all those mods were done.
[19:43.310 --> 19:45.290]  So the mods weren't Ebony related.
[19:47.170 --> 19:48.470]  Dungeons & Dragons Online.
[19:48.470 --> 19:49.970]  We did a few times we learned.
[19:50.110 --> 19:53.870]  The first time we did it, we got almost 2,800 mods upon installation.
[19:54.710 --> 19:58.830]  Because it was having a lot of non-game related stuff being installed.
[19:59.350 --> 20:02.310]  Again, the importance of some kind of experimental rigor.
[20:02.710 --> 20:05.010]  That's why we're running these things several times.
[20:05.610 --> 20:08.330]  Certainly, there's lots of people doing these kind of tests.
[20:08.490 --> 20:11.590]  We're trying to lay down some kind of foundation for repeatability.
[20:11.990 --> 20:21.190]  So that way, if we ever actually publish these results in a journal somewhere, all of you guys can go out and repeat the test and find out relatively similar results.
[20:21.190 --> 20:28.890]  So basically, on the future runs, we're getting almost 600 changes to your computer after you install Dungeons & Dragons Online.
[20:29.390 --> 20:31.630]  And again, the problems with manually checking everything.
[20:31.950 --> 20:33.990]  Most were registry changes.
[20:34.810 --> 20:36.210]  Which I found interesting.
[20:37.270 --> 20:41.850]  I'm more interested, though, in files being dropped in the computer.
[20:42.450 --> 20:46.350]  Especially anything executable, any kind of DLL, I want to find out.
[20:46.450 --> 20:50.590]  Because those are the things I want to watch for extra traffic in Task 3.
[20:54.560 --> 20:55.520]  Whoops, back up.
[20:56.720 --> 21:01.500]  On Steam, they had about only 180 or so mods of the system.
[21:01.500 --> 21:02.480]  And that surprised me.
[21:03.860 --> 21:10.700]  Because I would have thought, based on my previous exposure to its behavior, that it probably would have made a hell of a lot more mods.
[21:11.420 --> 21:17.160]  I remember having to try to uninstall it off one of my laptops one time, because my son had installed it on the laptop.
[21:17.820 --> 21:20.680]  And then I had all kinds of problems getting it uninstalled.
[21:22.380 --> 21:23.440]  So it was kind of an issue.
[21:23.580 --> 21:25.620]  And so I thought, oh my gosh, this is going to be a nightmare.
[21:25.900 --> 21:26.820]  Only 180.
[21:26.820 --> 21:32.440]  And then when we put Modern Warfare 2 on it, we could have another 160 or so.
[21:32.700 --> 21:34.920]  But I'm not so worried about Modern Warfare 2.
[21:35.140 --> 21:37.300]  I don't think the game itself is the problem.
[21:37.420 --> 21:38.480]  I think Steam is the problem.
[21:38.700 --> 21:40.940]  And here's an example of some of the files I added.
[21:41.340 --> 21:42.640]  Several pre-fetched files.
[21:43.860 --> 21:46.040]  Most of you know what the pre-fetched directory does?
[21:46.640 --> 21:47.600]  What they're trying to do?
[21:48.380 --> 21:48.820]  Okay.
[21:49.420 --> 21:51.820]  I'll assume that's yes, since nobody said hell no.
[21:51.980 --> 21:52.520]  She'd give us more.
[21:53.460 --> 21:53.800]  Huh?
[21:56.280 --> 22:00.920]  Oh, when an operating system runs a process, all right?
[22:01.100 --> 22:03.680]  Well, you have an executable file on the computer, right?
[22:03.900 --> 22:05.220]  And that's your program.
[22:05.720 --> 22:08.100]  A program becomes a process.
[22:08.100 --> 22:10.060]  I teach operating systems, by the way, so...
[22:10.060 --> 22:18.920]  A program becomes a process by then getting a PCB assigned to it and then being thrown into the long-term scheduling queue.
[22:20.100 --> 22:20.740]  Okay?
[22:21.420 --> 22:23.660]  A process is an active entity.
[22:23.940 --> 22:30.680]  The PCB contains all the pointers, all the memory spaces, the instruction counter, where you're going for the next instruction.
[22:30.980 --> 22:37.980]  So lots of things are stored in that PCB, but only a piece of it is actually the executable code...
[22:37.980 --> 22:40.040]  I mean, the link to where to go with executable code.
[22:40.040 --> 22:50.240]  So now, when your process swaps out, that PCB gets updated constantly so it can come back in again and go back and forth, that way you have multitasking.
[22:50.900 --> 22:51.000]  Okay?
[22:52.260 --> 23:01.040]  The way it goes about building that PCB and setting up all the files it needs, and all the handles it grabs, and all the other kind of stuff is time intensive.
[23:01.520 --> 23:05.160]  When you double click on a Windows computer or any other computer, what do you expect?
[23:06.720 --> 23:07.780]  Something to happen, right?
[23:08.680 --> 23:11.600]  Well, they use the pre-fetch directory.
[23:11.840 --> 23:15.940]  One of the reasons why they use it is to go ahead and have all the stuff already pre-set.
[23:16.320 --> 23:22.540]  Each time you run a program, it'll probably have very similar PCBs, so it sets all that stuff up ahead of time.
[23:23.040 --> 23:23.500]  Okay?
[23:23.740 --> 23:24.800]  That's what the pre-fetchers do.
[23:25.360 --> 23:30.280]  Interesting, a lot of people don't know about pre-fetch, including a lot of investigators.
[23:30.600 --> 23:50.220]  In one of my previous functions, I was part of the DOJ effort to lay down the, I was about a year, technical working group, to lay down the requirements for computer forensic examiners from the associate's degree level all the way through bachelor's, graduate degrees,
[23:50.220 --> 23:55.500]  and then on into post-training, on-the-job training type stuff.
[23:55.600 --> 23:59.320]  So I was part of a committee that met six times over the course of a year doing that.
[24:00.200 --> 24:02.720]  And they put us up in Marriott's, so that was kind of sweet.
[24:05.280 --> 24:07.600]  The Marriott's not going to compare to this hotel, okay?
[24:09.720 --> 24:13.420]  Now, the second thing we try to do is, what's not getting uninstalled?
[24:15.460 --> 24:19.580]  So you see all the artifacts that are being left, we're trying to see all the artifacts left behind.
[24:19.580 --> 24:22.660]  We did this also in the Saganography work that I was working with.
[24:23.660 --> 24:32.020]  But the Sagan... so we install a system, then we uninstall it right away, using what everyone else will use, the Windows Uninstaller, right?
[24:32.660 --> 24:33.260]  Makes sense?
[24:33.580 --> 24:35.240]  That's what the everyday humans use.
[24:35.600 --> 24:38.240]  So we're looking for... I call them residuals.
[24:38.440 --> 24:40.840]  The company I was working with calls them artifacts.
[24:41.620 --> 24:44.620]  We're looking for whatever's left over after you uninstall.
[24:46.320 --> 24:48.600]  Now, wow, plenty of time.
[24:50.080 --> 24:56.900]  On DDO, Dungeons & Dragons Online, I was really surprised at the fact that almost nothing was removed.
[24:57.820 --> 25:07.360]  When you compare the install snapshot with the uninstalled snapshot, almost nothing was uninstalled.
[25:08.440 --> 25:09.040]  Okay?
[25:09.380 --> 25:13.020]  That includes the Pando software...
[25:13.960 --> 25:15.020]  I said Pando?
[25:15.320 --> 25:15.460]  Lord.
[25:16.140 --> 25:17.340]  Okay, I'm a retard.
[25:17.560 --> 25:20.980]  Pando software, which is some kind of accelerating.
[25:21.280 --> 25:24.660]  It helps them be able to move faster from what I gather from what it's doing.
[25:25.460 --> 25:36.280]  On Steam, the Steam Valve combination of software, actually, most was removed, but not Steam.exe, SteamService.exe, SteamTMP.exe.
[25:36.380 --> 25:39.280]  Those kinds of things were still there after you uninstalled.
[25:40.420 --> 25:40.980]  Okay?
[25:41.300 --> 25:46.540]  Which is odd, because if you uninstalled it, you're probably not going to be logging on to it anymore, right?
[25:49.240 --> 25:50.060]  Just odd.
[25:51.160 --> 25:54.940]  All right, academia, and this is one thing about being in the military.
[25:56.280 --> 25:58.100]  Whenever we're done with a mission...
[25:58.100 --> 25:59.380]  How many folks are in the military here?
[26:00.460 --> 26:05.940]  Okay, whenever you're done with a mission, the first thing you do when you come back is go over where you screwed up.
[26:07.260 --> 26:08.480]  What didn't work?
[26:08.700 --> 26:11.260]  What expectations weren't there on the ground?
[26:11.420 --> 26:13.740]  You don't pat yourself on the back, all right?
[26:14.000 --> 26:21.620]  And maybe nowadays they do a little more, but, you know, we go back and we debrief and we try to make it better next time, because when we screw up, people die.
[26:22.320 --> 26:23.700]  That's a bad thing, okay?
[26:23.960 --> 26:25.840]  So we're always trying to perfect things.
[26:26.160 --> 26:31.820]  So in academia, this is not well looked upon, looking at where we screwed up, all right?
[26:31.960 --> 26:33.020]  But with you guys, it's okay.
[26:33.160 --> 26:34.000]  Here's where we screwed up.
[26:34.480 --> 26:37.240]  We're going to redo everything again with our homegrown software.
[26:37.440 --> 26:37.760]  Why?
[26:39.080 --> 26:40.020]  We trust it.
[26:40.920 --> 26:44.660]  We're going to trust it better that it's telling us the information we want to see.
[26:45.140 --> 26:46.260]  What's the problem with rootkits?
[26:46.740 --> 26:52.080]  Rootkits get in there, tell you what they think you want to see, not what you really want to see.
[26:52.260 --> 26:53.320]  That's a problem with rootkits.
[26:53.420 --> 26:53.880]  So we build...
[26:53.880 --> 27:00.280]  A lot of my students build software that bypasses Windows calls, so we can try to defeat rootkitting.
[27:00.820 --> 27:03.720]  And we're building double checks and, you know, that kind of stuff.
[27:04.140 --> 27:07.980]  So I want to make sure that I have what I'm looking for.
[27:08.440 --> 27:10.880]  And the only way to do that is to write your own software.
[27:10.880 --> 27:12.960]  And I'm not a hardware hacker, by the way.
[27:13.020 --> 27:13.840]  I'm a software hacker.
[27:14.980 --> 27:18.760]  I was a calm computer officer, and I can know my way around hardware somewhat.
[27:19.020 --> 27:23.080]  But I defer the hardware stuff a lot of times to people who are smarter if I'm short on time.
[27:24.420 --> 27:29.820]  We're also going to build better comparator tools because Lindsay has really enjoyed the research.
[27:30.360 --> 27:36.920]  She's looking forward to actually being part of the community, I think, at some point, unless she's bullshitting me, which is always possible.
[27:37.460 --> 27:40.460]  Is $4,000 doing this over the summer better than a mall job?
[27:41.260 --> 27:42.120]  Oh, shit, yeah.
[27:42.420 --> 27:44.120]  So she's probably going to tell me whatever I want to say, right?
[27:44.480 --> 27:51.980]  But she seems to be interested in doing follow-on work and keep on doing this, and I want her to because I think we can actually get a paper out of this, an academic paper.
[27:53.660 --> 27:57.920]  We're going to build better tools to make us so she has to manually do everything on our own.
[27:58.280 --> 27:58.700]  All right?
[27:58.760 --> 27:59.920]  That's really a pain in the ass.
[28:00.480 --> 28:03.380]  And sometimes my teenager, my older teenager daughter would help.
[28:03.480 --> 28:03.980]  She's 16.
[28:05.200 --> 28:10.620]  The success, though, that we had was we learned this is worth looking at.
[28:11.540 --> 28:18.720]  If anybody's ever done any kind of academic research, we're not trying to find answers in academic research.
[28:19.080 --> 28:20.480]  What are we trying to find?
[28:22.020 --> 28:24.380]  The right questions to ask.
[28:25.560 --> 28:31.780]  If you listen to a lot of talks here, as I've listened to, you learn, first of all, privacy is a big deal.
[28:31.960 --> 28:33.700]  That's why I actually put this work in.
[28:33.920 --> 28:35.160]  I applied for this work.
[28:37.480 --> 28:40.440]  But they're always looking for the right questions to ask.
[28:40.540 --> 28:45.900]  So I think a lot of them may not have the academic rigor, but they have the mind behind doing academic research.
[28:46.160 --> 28:47.600]  They're not trying to find solutions.
[28:47.740 --> 28:49.240]  They're trying to find what the next thing is.
[28:49.300 --> 28:50.020]  What's the questions?
[28:50.340 --> 28:52.620]  And I think that's one of the best research comes out of.
[28:53.880 --> 28:55.340]  Task three, monitoring traffic.
[28:55.500 --> 28:56.680]  We only did a little bit of this.
[28:56.680 --> 28:58.400]  We're still working on some details.
[28:59.940 --> 29:01.880]  We tried a few firewalls.
[29:01.960 --> 29:02.860]  Then we went with a zone alarm.
[29:03.800 --> 29:05.440]  We have some anomalies.
[29:05.720 --> 29:10.340]  Definitely worth investigating in the behavior of DDO and Steam.
[29:11.240 --> 29:15.860]  Ebony had no traffic when you weren't playing, which is kind of expected.
[29:15.940 --> 29:17.260]  It's a browser-based game, right?
[29:17.900 --> 29:22.880]  So only when the browser is open, assuming we're trusting what we see so far, is there issues.
[29:22.880 --> 29:25.580]  It's true in other aspects of the game as well.
[29:25.880 --> 29:26.700]  Anybody play Ebony?
[29:28.200 --> 29:28.760]  No?
[29:29.260 --> 29:39.620]  Okay, I used Ebony last fall as an online game, as part of a course called Vulnerability Assessment.
[29:40.480 --> 29:55.380]  So what they had to do was we downloaded the client, we started looking at the code, and we're trying to figure out ways we could build additional tools that would read the traffic flow, that would give us competitive advantage, and play in the game.
[29:55.760 --> 29:56.180]  Okay?
[29:56.800 --> 30:00.240]  Now I have a college class trying to figure out how to do this kind of stuff.
[30:01.120 --> 30:01.680]  Why?
[30:02.320 --> 30:03.580]  Because you like playing games?
[30:03.780 --> 30:04.140]  No.
[30:04.660 --> 30:08.840]  A game is a convenient way to look at all distributed processing.
[30:08.840 --> 30:11.840]  All distributed processing is going this way.
[30:12.520 --> 30:12.940]  Okay?
[30:13.740 --> 30:16.540]  It's gonna be the same, a lot of the same techniques are being used.
[30:18.700 --> 30:21.300]  Um... No software was installed that we saw so far.
[30:21.440 --> 30:30.060]  So that's why we use the game as really a mechanism for when they get out in the real world, they know how assholes like me and people like you are gonna go ahead and start attacking their software.
[30:30.780 --> 30:31.320]  All right?
[30:31.520 --> 30:33.440]  That's the reality that we're trying to create.
[30:33.820 --> 30:37.420]  Some guys have moved on to computer security, you know, defensive areas.
[30:37.760 --> 30:41.020]  Most are going on to programming jobs anyway, even the computer security major.
[30:41.280 --> 30:44.400]  And I gotta tell you, the first question I get from every employer is what?
[30:46.300 --> 30:47.320]  Are they trustworthy?
[30:48.220 --> 30:51.640]  I'm not sure I want to hire a computer security guy to do programming for me.
[30:52.200 --> 30:59.460]  And I always tell them, yeah, you do, because he knows how people like me are gonna attack software like you, and it's all going online.
[30:59.460 --> 31:07.240]  Even software not meant to be online back in the 80s is still online, even though it was built with a shelf life of 15 years expected.
[31:07.940 --> 31:11.580]  If you've been in the community along... I hit 50, by the way, so I've been around for a little while.
[31:13.300 --> 31:18.700]  Um... While playing DDO, the dndclient.exe is a regular traffic flow connection.
[31:19.000 --> 31:22.420]  It consistently talks to the same IP address mostly.
[31:23.300 --> 31:25.600]  But every once in a while, pops up a different one.
[31:26.140 --> 31:27.300]  Okay, that's worth looking at.
[31:28.120 --> 31:38.840]  But while you're playing, you're signed in and playing, the turbine launcher file generates outgoing connects intermittently as well.
[31:39.280 --> 31:43.560]  Like every 15 to 45 minutes, it would do something on an outgoing connect.
[31:44.060 --> 31:47.080]  So now I'm gonna run some packets to try to figure out exactly what it's doing.
[31:47.360 --> 31:47.740]  Okay?
[31:48.120 --> 31:48.560]  Because why?
[31:48.720 --> 31:49.440]  We don't trust them.
[31:50.220 --> 31:52.280]  Does that seem like odd behavior to you though?
[31:54.040 --> 32:01.780]  Why is the login mechanism trying to talk to the world while you're playing the game and logged in?
[32:02.780 --> 32:12.760]  Now, when you're not signed in, but you have the turbine window up, it still makes an outgoing connect every 15 to 30 minutes and it's using a consistent IP address.
[32:12.960 --> 32:18.240]  So you just leave the window up and it's trying to connect every 15 to 30 minutes.
[32:19.260 --> 32:20.900]  Even though you're typing nothing in.
[32:21.860 --> 32:22.560]  You just have it there.
[32:22.960 --> 32:24.000]  Remember that picture of the lab?
[32:24.180 --> 32:26.140]  We have lots of computers we're playing on, by the way.
[32:26.380 --> 32:28.280]  They're all in different stages of install and install.
[32:29.980 --> 32:39.020]  The steam traffic notes, when you logged into steam, check time, and not doing anything, but you're logged in.
[32:39.280 --> 32:42.840]  We saw outgoing traffic every 15 minutes pretty much on the button.
[32:44.060 --> 32:46.620]  Outgoing connects out of different IPs.
[32:46.940 --> 32:50.480]  Most packets are flagged by zone alarm as data packets.
[32:53.260 --> 32:57.080]  So I'm logged in and not playing the game, and it's dumping information out.
[32:58.640 --> 33:00.220]  So that's worth looking at, right?
[33:00.660 --> 33:01.840]  What are they dumping out?
[33:03.660 --> 33:06.960]  If you've listened to the talks, there's been a lot of cool talks here this time, right?
[33:07.260 --> 33:08.240]  A lot of really good talks.
[33:08.340 --> 33:10.620]  I'm really enjoying being here, sitting in on a lot of sessions.
[33:11.340 --> 33:12.760]  I actually had to sleep last night.
[33:12.840 --> 33:15.260]  It was unfortunate, so I couldn't get the process at all.
[33:15.620 --> 33:25.480]  But the data about you is much, much more valuable than the product you buy from the company.
[33:26.120 --> 33:28.340]  That's why I call the talk No Free Lunch.
[33:28.520 --> 33:30.040]  Steam gives away a lot of shit now, right?
[33:30.640 --> 33:31.780]  They give away a lot of games.
[33:32.500 --> 33:35.680]  But I kind of used to play off a no free lunch theorem in computer science.
[33:36.020 --> 33:38.340]  There's something different, but same idea.
[33:39.000 --> 33:42.400]  The only time you get something for free is when?
[33:42.660 --> 33:44.920]  When someone else is paying for it.
[33:45.820 --> 33:47.860]  And they're paying for it for a reason.
[33:48.100 --> 33:49.360]  Very few people are altruistic.
[33:50.520 --> 33:58.140]  You're probably here meeting more altruistic people in two or three days than you know in your life, okay?
[34:00.720 --> 34:10.420]  Now, when the Steam login window was up, but not logged in, but not logged in, it doesn't outbound connect every 15 minutes.
[34:10.660 --> 34:17.180]  And we got some... all the IPs are coming up wildly different at the Class A level.
[34:18.060 --> 34:20.680]  So we haven't looked at that yet, but there might be an explanation.
[34:20.940 --> 34:23.620]  But to me, that seems amazingly suspicious also.
[34:24.540 --> 34:24.660]  Okay?
[34:25.240 --> 34:29.940]  And I have all the files Lindsey has done and that I've looked at and we've highlighted things.
[34:30.040 --> 34:32.040]  So I can show them to you if we have any minutes at the end.
[34:32.180 --> 34:33.980]  And if anybody actually cares about this stuff.
[34:34.900 --> 34:39.140]  Interesting thing that I saw also, being in, you know, the kind of business for a long time.
[34:39.840 --> 34:43.560]  When we typed in a bad password, no traffic was generated.
[34:48.660 --> 34:51.380]  Which means... where's the password stored?
[34:52.640 --> 34:54.460]  The authenticator is stored locally.
[34:54.980 --> 34:55.340]  Okay?
[34:56.760 --> 34:58.960]  Which means... huh?
[34:59.980 --> 35:00.340]  Yeah.
[35:00.900 --> 35:02.500]  Which means it's easily gettable.
[35:03.440 --> 35:03.920]  All right?
[35:04.060 --> 35:05.260]  And I haven't tried to get it yet.
[35:05.380 --> 35:07.000]  That's not really the purpose of what we're trying to do here.
[35:07.180 --> 35:11.720]  But if I have a student who's interested, I may throw a little bit of money at him in the fall and see if he wants to do it.
[35:13.160 --> 35:14.600]  So what does this all mean for us?
[35:14.960 --> 35:19.700]  Well, privacy policies are supposed to be for you, for us, but they become CYA for the companies.
[35:19.980 --> 35:23.040]  They basically mean nothing, especially since they can change them at will.
[35:24.020 --> 35:27.620]  Terms of service, this is where I quote my 15-year-old son if he's around somewhere.
[35:27.880 --> 35:32.620]  He quoted the best by saying, we can do what we want, when we want, and you can't stop us.
[35:33.600 --> 35:34.140]  All right?
[35:34.480 --> 35:49.820]  So you have 28, between 10 and 28 pages of legal documents, and they do a nice job of separating all these relevant facts across the document, hoping that you get sick and tired of reading it, and your eyes are glossed over, like most people who aren't IT security type people.
[35:50.300 --> 35:50.580]  All right?
[35:51.400 --> 35:55.320]  That it comes down to, we can do what we want, when we want, and you can't do shit about it.
[35:55.900 --> 35:56.480]  Yes, sir?
[35:56.680 --> 35:57.640]  What is CYA?
[35:57.840 --> 35:58.840]  Oh, cover your ass.
[35:58.960 --> 35:59.220]  I'm sorry.
[36:00.460 --> 36:01.440]  CYA is cover your ass.
[36:01.680 --> 36:04.720]  That's another one of those military terms I learned, okay?
[36:07.880 --> 36:10.480]  Lots of stuff gets put on your computer upon installation.
[36:11.040 --> 36:22.760]  I actually, when I was trying to teach her about this really, about trying to bring home the concept, I said, okay, play with Rakeshot, play within Control 5, go ahead and download one of those free screensaver programs.
[36:27.080 --> 36:29.600]  And, yeah, we re-imaged that machine.
[36:32.020 --> 36:39.480]  So, you know, but she got, I think, in that one, I think about 8,500 or so.
[36:40.200 --> 36:43.820]  I think she got about 8,500 things changed on the computer.
[36:44.080 --> 36:56.080]  This includes file attributes, registry entries, files added, files modified, including your Sophos or whatever firewall you use, modifies things as well.
[36:56.200 --> 36:57.920]  It gets modified in there in terms of programs.
[36:59.480 --> 37:03.420]  And then, um, we still need more detailed packet analysis.
[37:03.420 --> 37:05.280]  We are not done yet, okay?
[37:05.500 --> 37:07.500]  We can't go to an academic conference saying we're done.
[37:07.640 --> 37:08.820]  The idea is generate interest.
[37:09.920 --> 37:13.340]  And if other people want to stop following through on this, great.
[37:13.500 --> 37:16.100]  I love getting more people involved whenever we can.
[37:16.720 --> 37:23.360]  Once we get our procedures down, now we're going to expand to a lot of online games, especially kids' games.
[37:23.980 --> 37:29.940]  I have a girl who just turned 17 who plays World of Warcraft and is in the 60-somethingth level.
[37:30.040 --> 37:31.620]  But she's been away for the last three weeks.
[37:31.780 --> 37:33.740]  I have a 15-year-old son who just turned 15.
[37:33.860 --> 37:35.960]  I have an 11-year-old daughter and an 8-year-old son.
[37:36.240 --> 37:39.380]  And they are fanatics about playing games.
[37:39.700 --> 37:42.160]  What's my 11-year-old daughter's favorite game, usually?
[37:42.520 --> 37:43.280]  Club Penguin.
[37:44.100 --> 37:45.040]  What are they doing?
[37:45.240 --> 37:46.440]  What does Disney do?
[37:47.240 --> 37:48.900]  What does American Girl do?
[37:48.900 --> 37:51.040]  All these people throw games up there.
[37:51.340 --> 37:55.340]  If you've ever gone shop at an American Girl store, you know why they're throwing free stuff up.
[37:56.580 --> 38:00.300]  I simply don't trust them, but does that stop any of us from playing games?
[38:00.700 --> 38:01.140]  No.
[38:02.140 --> 38:09.060]  And I'm going to finish up by simply saying, again, I view almost everything in life as warfare, including high school dating.
[38:11.180 --> 38:16.020]  If you look at warfare definitions, pretty much everything is warfare.
[38:16.980 --> 38:20.040]  In one of my classes, students have to read Sun Tzu and the Art of War.
[38:20.400 --> 38:24.440]  And they have to take something from every chapter and apply it to information security.
[38:24.740 --> 38:26.400]  That's my intro class, okay?
[38:27.160 --> 38:32.000]  Take something from every chapter, and I usually get at least one-third of the book quoted.
[38:32.140 --> 38:34.900]  It's a nice little online site where every statement is numbered, and they just do that.
[38:35.080 --> 38:35.920]  It works out pretty well.
[38:36.820 --> 38:45.380]  If you want to take over the world, or if I want to take over the world, if I get bored next week, screw this stuff that all the DOD and military is doing.
[38:45.380 --> 38:47.160]  I'm going to go ahead and just write a game.
[38:48.420 --> 38:49.620]  Because everyone will trust it.
[38:49.860 --> 38:53.640]  I have to make it cool enough where people want to download it, or better yet.
[38:56.870 --> 38:57.230]  Okay?
[38:58.490 --> 39:02.790]  And yes, I've had my eight-year-old and 11-year-old download all kinds of little games on my Android.
[39:04.770 --> 39:12.630]  I'm trying to... I bought it so I could teach a class next spring, and how to do an online game... cell phone game development, or cell phone application development.
[39:12.890 --> 39:14.510]  Try to do some context-aware type stuff.
[39:15.690 --> 39:20.010]  And basically, any kind of... and again, I'm an academic, so feel free to critique me.
[39:20.130 --> 39:21.890]  Feel free to hurl general insults.
[39:21.890 --> 39:22.570]  I like being tall.
[39:22.890 --> 39:26.370]  I put the shock picture up here, in case you guys want to tear me apart.
[39:26.670 --> 39:33.270]  And I also put monkey sleeping picture up here from the zoo, because I may have put a few of you to sleep, and I apologize for that.
[39:34.270 --> 39:34.910]  Yes, sir?
[39:35.530 --> 39:35.930]  I
[39:45.710 --> 39:48.790]  wouldn't think there's any reason for them to change, but did you do any analysis?
[39:49.010 --> 39:50.190]  Did they change over time?
[39:50.850 --> 39:54.550]  We haven't looked at that, because we've only started doing this work since May.
[39:55.670 --> 40:00.090]  There's other groups out there starting to look at this stuff, but they aren't doing game-specific.
[40:00.350 --> 40:05.150]  It's certainly something worthwhile, because we can build a little tool that will actually compare two documents very easily.
[40:05.250 --> 40:06.610]  I mean, a little script with a few lines in it.
[40:06.790 --> 40:07.990]  So that's probably something worthwhile.
[40:09.210 --> 40:12.850]  I'd like to get a student... I'd like to throw money at students.
[40:13.790 --> 40:18.750]  I hate when my computer science students have to work at a gas station or work at Walmart, okay?
[40:18.970 --> 40:26.450]  I want to give them all decent jobs, so I'm always begging the dean for more money, because I'll tell you, the students are the cheapest amount of labor you'll ever find on the workforce.
[40:26.850 --> 40:29.950]  And they do good work, and they care greatly, okay?
[40:30.110 --> 40:30.970]  Can I answer the question?
[40:31.130 --> 40:32.350]  The answer is not yet.
[40:32.790 --> 40:36.670]  Maybe if I find a little bit of money to throw... so the students check things once a week, hopefully.
[40:36.950 --> 40:37.510]  Yes, sir?
[40:37.650 --> 40:38.390]  A lot of different
[40:41.480 --> 40:43.680]  changes in the file system, right?
[40:43.820 --> 40:49.540]  And there are overshade tools like analysis, tripwire that are already going with.
[40:49.760 --> 40:53.300]  What's there a particular reason why you decided to spend that amount of time?
[40:54.540 --> 40:59.540]  Well, with tripwire, we want to be able... we just want to do it just upon install, okay?
[41:00.100 --> 41:07.820]  And so I have... we were going to use tripwire, and then it was for Windows, and it's a problem, so we're on a Windows system, but we're going to reevaluate all the tools.
[41:08.440 --> 41:12.400]  And see, if tripwire will do what we want to do, then we'll certainly go ahead and use it.
[41:12.540 --> 41:27.320]  I usually only think of tripwire as an IDS, because that's really what... my old days of tripwire, when he first, you know, before he went off and started his company, it first came out, you know, I was looking at playing with it back then as an IDS.
[41:36.920 --> 41:43.840]  Yeah, we're not playing, we're not using VMware right now, because we're just keeping everything in the Windows environment, because most people have.
[41:44.640 --> 41:48.980]  Linux has not really penetrated into non-IT, you know, non-techies yet.
[41:49.500 --> 41:52.140]  But thank you, I'll go look at tripwire now, see if it's going to do what we want to do.
[42:05.990 --> 42:13.610]  Okay, a little disclaimer, um, I don't play steam games, because most of them are first-person shooters.
[42:14.290 --> 42:23.690]  And when my son one day, um, went ahead and he was going to come to the conference, he looked up, saw the thing about Julian, went ahead and looked, watched the video before I got home.
[42:23.910 --> 42:29.330]  We talked about it a little bit, and I finished off by saying, now do you understand why I don't play first-person shooters?
[42:29.890 --> 42:31.270]  I don't play first-person shooters.
[42:31.690 --> 42:34.230]  So I don't play steam games, because most of them are first-person shooters.
[42:34.990 --> 42:39.030]  So, but, um, I'm sure someone's already written that kind of stuff easily, you're right.
[42:39.910 --> 42:45.050]  Question about, you said it's a web client, but it's also, it's a download, right, you're talking about BitTorrent, you said?
[42:45.690 --> 42:48.870]  Um, the Ebony client-side software is on BitTorrent.
[42:49.050 --> 42:49.970]  We got it from there.
[42:50.090 --> 42:51.170]  Is it a legit client?
[42:51.410 --> 42:54.870]  It is a little bit older version from back in the, um, fall.
[42:55.450 --> 42:56.970]  So do you do analysis on that?
[42:57.110 --> 42:57.370]  Yes.
[43:01.730 --> 43:12.290]  We, uh, we worked on some things, um, making use of that, and, um, we were doing it to build add-on tools to see how easy it would be to intercept traffic.
[43:12.390 --> 43:16.730]  Once you figure out what the software's doing, intercept traffic, build add-on tools to get a competitive advantage.
[43:16.970 --> 43:20.010]  Like, if you get attacked, your little, your little bird flashes.
[43:20.430 --> 43:21.930]  Well, we know it doesn't flash, right?
[43:22.270 --> 43:23.410]  It all fits in two pictures.
[43:24.110 --> 43:25.730]  Don't tell that to a non-tech person.
[43:26.310 --> 43:31.970]  Um, well, what, what signal in the packets tells that to flash?
[43:32.690 --> 43:32.810]  Okay?
[43:33.630 --> 43:42.090]  Well, if you know that, you can, the game has come down to, and this is an example, the game has come down to, um, attacking people when they're offline.
[43:43.130 --> 43:43.550]  Okay?
[43:43.810 --> 44:02.670]  So if your bird flashes, if you leave the client, if you leave an email to an email account, wherever you are, being told, hey, you're being attacked, get to a computer.
[44:03.130 --> 44:07.250]  Because if you're online on Ebony, it's very hard to defeat someone who's online.
[44:07.530 --> 44:08.250]  It's like a city from them.
[44:09.350 --> 44:09.750]  Sure.
[44:12.250 --> 44:13.730]  Yeah, we're going to modify off that.
[44:16.410 --> 44:21.830]  Actually, that's what we're doing, yeah, we did, we did zone alarm first to see if anything was worth looking at.
[44:22.190 --> 44:22.470]  Okay?
[44:22.790 --> 44:25.750]  Because it's easier to take care of and install and look at very quickly.
[44:26.270 --> 44:29.870]  Now that we know the stuff worth looking at, now we're looking, actually, we're looking at Wireshark.
[44:29.990 --> 44:30.630]  We're going to take Wireshark.
[44:32.610 --> 44:38.870]  I'm curious why you're interested in the monitor IP that's actually going into the binaries and figuring out what they're doing.
[44:39.470 --> 44:51.850]  Because I think, I remember from the problem online, and actually, in some case, they actually had, I mean, built into the clients which could allow some of the other end to, essentially, execute any, any execute.
[44:52.370 --> 44:52.810]  Yeah.
[44:53.150 --> 44:54.450]  We, we, we did that with Ebony.
[44:54.770 --> 44:57.270]  We actually got, all the hard-coded stuff out of Ebony.
[44:57.450 --> 44:58.810]  We haven't done that yet with this.
[44:59.030 --> 45:00.070]  This is preliminary work.
[45:00.550 --> 45:00.610]  Okay?
[45:00.710 --> 45:01.010]  That's what I said.
[45:01.070 --> 45:03.930]  We, we, we've looked at all this wide range of IPs it's talking to.
[45:04.350 --> 45:05.630]  Next step is not looking at why.
[45:05.870 --> 45:07.090]  This is preliminary work.
[45:07.190 --> 45:07.750]  I apologize.
[45:08.010 --> 45:13.530]  We hope to be farther, but it turned out, um, there, we, we were being caught up by how much was being installed.
[45:13.870 --> 45:15.170]  That took a lot of manual labor.
[45:16.690 --> 45:18.950]  So, yeah, that's, that's the next step in looking at it.
[45:19.550 --> 45:21.690]  Do you have anything else on that, or just tell me I was stupid?
[45:22.970 --> 45:25.810]  I have no problem being told I was stupid, by the way.
[45:26.110 --> 45:26.810]  I, I, I just, I'm an academic.
[45:27.010 --> 45:28.290]  I don't have an ego about this kind of stuff.
[45:28.490 --> 45:30.350]  I just follow interesting things.
[45:30.550 --> 45:31.750]  So, okay.
[45:31.750 --> 45:32.430]  I'm just curious.
[45:32.590 --> 45:32.830]  I've seen
[45:40.160 --> 45:40.880]  it on the client side.
[45:41.040 --> 45:41.340]  Right.
[45:41.800 --> 45:42.680]  Any number of ways.
[45:43.540 --> 45:47.260]  Yeah, it's a, it's a problem especially in, in, in, in, when you look at, at, at corporate espionage.
[45:48.260 --> 45:48.540]  Yes, sir.
[45:48.860 --> 46:02.410]  Can I, at your college that you're saying the law that's gonna look at some of these, some of these end user agreements and see what, how they would really stand up in court, have their opinion on that?
[46:02.510 --> 46:05.210]  No, our university does not have its own corporate lawyer.
[46:06.050 --> 46:10.530]  Um, as a matter of fact, one of the things I wanted to check ahead of time was, can I use the actual game names?
[46:11.250 --> 46:13.010]  And I decided I'm really not saying anything bad.
[46:13.090 --> 46:14.290]  I said maybe one bad thing.
[46:14.810 --> 46:15.270]  All right.
[46:15.370 --> 46:17.390]  And that's about every copying directly.
[46:17.630 --> 46:18.490]  That's validatable.
[46:18.670 --> 46:19.730]  It's not, it's not just me saying it.
[46:19.770 --> 46:21.130]  I have, I have the hard copies here.
[46:21.550 --> 46:24.290]  Um, I'm not saying anything bad, so no one's gonna yell at me too much.
[46:24.470 --> 46:27.390]  I'm doing black box testing, so I don't think I want to violate the MCA.
[46:27.630 --> 46:33.110]  But we're too poor to have, um, it's a small university, about five, six thousand students, and only undergrad.
[46:34.150 --> 46:43.450]  Um, so if, if, there's too many other smart people looking at privacy policies in TOS right now as academic researchers, okay?
[46:43.650 --> 46:46.070]  That was just our first step into doing what we really want to do.
[46:46.530 --> 46:52.830]  But, you know, yeah, if I, I think I have found one intellectual property lawyer in West Virginia so far.
[46:57.650 --> 47:00.750]  Um, West Virginia is very funny.
[47:00.970 --> 47:05.290]  Uh, they're, they're trying to transition Northern, North Central into more, um, academics.
[47:05.950 --> 47:07.270]  Uh, I'm sorry, high tech.
[47:07.810 --> 47:16.450]  Because I don't know if you know this, but the FBI, if you, if they want to fingerprint anywhere in the United States, it goes through 15 miles south of me, 10 miles south of me.
[47:16.770 --> 47:18.910]  That's where the FBI built a fingerprint ID division.
[47:19.310 --> 47:20.610]  Um, Senator Byrd made them.
[47:21.550 --> 47:24.150]  Um, so, they're really changing the high tech.
[47:24.330 --> 47:27.410]  It's a lot of work at WVU, which is about a little bit up the road from us.
[47:27.450 --> 47:28.550]  I do research up there as well.
[47:29.130 --> 47:32.310]  Um, they're, they do a lot of, um, biometric research.
[47:32.410 --> 47:34.950]  They have a couple of very, one very good professor, actually.
[47:35.290 --> 47:39.430]  Um, so, I don't, I'm not going to jump into there because they're going to blow my ass out of the water.
[47:42.730 --> 47:43.530]  Yes, it is.
[47:43.610 --> 47:45.230]  Actually, um, I, I know the building.
[47:45.530 --> 47:47.670]  Um, it's, it's incredibly, um, unmarked.
[47:48.190 --> 47:48.490]  Yeah.
[47:49.550 --> 47:52.890]  Um, the Internet, the Internet fraud and complaint center.
[47:53.350 --> 47:56.290]  And also, we have the National White Color Crime Center there as well.
[47:57.110 --> 47:59.170]  That's, actually, those two are in my town directly.
[47:59.970 --> 48:00.610]  What town?
[48:01.190 --> 48:02.070]  Fairmont and West Virginia.
[48:02.350 --> 48:02.750]  I'm in Fairmont.
[48:02.830 --> 48:04.390]  I go to, I teach at Fairmont State University.
[48:05.030 --> 48:07.590]  I wanted to go to a smaller school to actually work with students.
[48:07.890 --> 48:13.110]  You go to the big schools and you have so much pressure to bring in X number of dollars a year for research.
[48:15.490 --> 48:17.390]  Um, I like doing, I like doing undergrad research.
[48:18.030 --> 48:20.510]  But smaller schools, to me, are the way to go.
[48:21.250 --> 48:23.450]  I just, you know, you get more one-on-one with the faculty.
[48:23.630 --> 48:24.150]  You get to know them.
[48:25.030 --> 48:29.190]  I, as the day after they graduate, I start signing every email by first name.
[48:30.710 --> 48:34.990]  Because to me, once they graduate, we are no longer in the master-slave relationship.
[48:35.270 --> 48:36.270]  We are peers.
[48:36.590 --> 48:37.490]  We are peers.
[48:37.730 --> 48:40.270]  And to me, you're either peers or a master-slave.
[48:41.330 --> 48:41.570]  Huh?
[48:42.850 --> 48:48.430]  Oh, I have people, I have people, I have people, I have people who are making more money than me.
[48:57.070 --> 49:01.810]  Yeah, except for the outgoing.
[49:03.890 --> 49:04.950]  Except for the outgoing.
[49:05.370 --> 49:07.430]  Incoming, I'll deal with because, yeah, I agree.
[49:07.690 --> 49:10.910]  The outgoing, and again, I'm using the word anomalous behavior.
[49:11.170 --> 49:12.630]  I live for anomalies.
[49:13.010 --> 49:13.150]  All right?
[49:13.270 --> 49:16.930]  Because, the bit, you know, I know a lot of people here are anti-Microsoft.
[49:17.370 --> 49:20.570]  To me, there's one big sin Microsoft has done.
[49:21.670 --> 49:26.050]  They taught the world the way to fix most problems is a three-finger salute.
[49:27.030 --> 49:29.350]  And that does not fix a damn thing.
[49:29.470 --> 49:30.950]  It simply delays it for a little bit longer.
[49:31.250 --> 49:33.150]  I like to go figure out why.
[49:35.870 --> 49:37.010]  Am I done with time?
[49:39.230 --> 49:40.050]  Okay, I am.
[49:40.170 --> 49:40.590]  3:55.
[49:40.750 --> 49:41.550]  It's how many stop do you do?
[49:41.550 --> 49:41.730]  5:55.
[49:41.870 --> 49:42.770]  Thank you for your time.
[49:50.130 --> 49:51.250]  Damn, are they going to do that?
[49:52.430 --> 49:52.750]  If...