[00:00.000 --> 00:03.840]  I thought so.
[00:04.260 --> 00:06.540]  We're getting into the post-caffeine phase, I notice.
[00:07.660 --> 00:10.940]  So, moving to the next drug of choice, and after that we'll see what happens.
[00:11.420 --> 00:14.880]  So, we're getting towards the end of the Friday in terms of the talks up here.
[00:15.060 --> 00:17.800]  I just want to let you in on a couple of the scheduling things.
[00:17.980 --> 00:21.940]  As you know, there's a concert starting at around 11.30 down on the Mez.
[00:22.000 --> 00:24.100]  That'll go probably to about 2 or 3 in the morning.
[00:24.200 --> 00:25.620]  Should be a lot of fun, pretty rockin'.
[00:25.620 --> 00:27.340]  Some Chip...
[00:27.340 --> 00:29.680]  Yeah, yeah, yeah.
[00:30.160 --> 00:31.060]  Shameless plug.
[00:31.540 --> 00:33.900]  He spoke at 12 o'clock, Shodan...
[00:33.900 --> 00:34.300]  What was it?
[00:34.380 --> 00:35.380]  Shodan for pen-testers.
[00:35.780 --> 00:37.100]  Good speech, by the way.
[00:37.960 --> 00:39.360]  Oh, it went out already.
[00:43.080 --> 00:45.060]  The demo gods are speaking.
[00:47.460 --> 00:48.380]  Right click.
[00:50.540 --> 00:51.620]  Control, delete.
[00:56.000 --> 00:56.680]  Yeah.
[00:58.980 --> 01:05.120]  All right, so, detecting and defending your network using nepetis, or nepentis, however you want to say it.
[01:05.900 --> 01:06.940]  So, who am I?
[01:07.840 --> 01:09.520]  Marco Figueroa, Marco Hacker.
[01:10.780 --> 01:13.680]  Neil Caffrey, Michael Weston, if you don't know him, look him up.
[01:13.760 --> 01:15.420]  I definitely recommend you look him up.
[01:16.720 --> 01:20.800]  So, some of the people that don't know me here, they might think of me as this.
[01:22.940 --> 01:26.920]  But, for my boys and everybody in the crowd might think of me as this.
[01:28.100 --> 01:32.200]  But at the end of the day, when it's all said and done, I want to be known as this.
[01:32.500 --> 01:33.600]  Who wouldn't want to be?
[01:33.720 --> 01:35.100]  Einstein, my idol.
[01:37.580 --> 01:39.720]  So, let me paint the picture for you.
[01:39.940 --> 01:41.200]  Oh, credibility slide.
[01:41.340 --> 01:46.860]  While I'm here, I spoke at DEFCON 16, spoke at The Last HOPE, now I'm at The Next HOPE.
[01:47.180 --> 01:51.220]  I consulted for Fortune 100 companies, published for Hakin9.
[01:51.980 --> 01:52.720]  Raise up, Kev.
[01:52.980 --> 01:54.000]  Kevin, raise up, man.
[01:54.320 --> 01:55.940]  I got to give him a shameless plug, too.
[01:55.940 --> 01:56.500]  Get up, bro.
[01:57.340 --> 01:59.300]  This is my brother, Kevin Figueroa, right here.
[02:00.680 --> 02:04.580]  I got to give him a little credit, because 10 years ago, he brought me here.
[02:05.460 --> 02:07.540]  And that was the first con I ever been to.
[02:07.660 --> 02:12.500]  And I've been addicted, like a crackhead, to hacking ever since.
[02:12.660 --> 02:13.340]  So, thank you, Kev.
[02:15.140 --> 02:15.580]  All right.
[02:15.660 --> 02:18.300]  So, let me paint the picture for you, and let me get into the meat of this.
[02:18.700 --> 02:23.780]  Back in 2003, Canada, a grid basically blew.
[02:23.780 --> 02:27.580]  It cascaded down into New York, and there was a blackout.
[02:27.860 --> 02:29.700]  Obviously, the people from New York, remember?
[02:30.300 --> 02:40.060]  Now, what they didn't tell you was that in 2003, that same week, the slammer worm came out and infected that network.
[02:40.560 --> 02:47.360]  So, allegedly, allegedly, I'd like to use that word, it infected, and that's the reason why there was a blackout.
[02:49.220 --> 02:53.080]  But, I would say, just do your own research, look it up.
[02:53.320 --> 02:56.060]  But, from my perspective, that's the reason why the blackout occurred.
[02:59.380 --> 03:02.360]  So, cyber insecurity, this came out in April.
[03:02.580 --> 03:05.840]  Tony Blair testifies at the Intelligence Committee.
[03:07.200 --> 03:12.180]  Malicious cyber activity is growing at an unprecedented rate.
[03:12.760 --> 03:16.020]  Google search, NPR, cyber insecurity.
[03:16.200 --> 03:18.820]  He's saying, we are losing the battle.
[03:19.600 --> 03:23.060]  It's just too much for us to handle.
[03:23.260 --> 03:24.080]  And that's the government.
[03:24.360 --> 03:26.220]  Americans, whatever you want to call it.
[03:26.420 --> 03:29.300]  The private sector, the government sector.
[03:30.700 --> 03:33.680]  Shit is going to shit, but we gotta fight back.
[03:33.800 --> 03:34.980]  So, here's my hacker highlights.
[03:35.660 --> 03:40.980]  Back in June 2007, 20 terabytes was stolen from the government.
[03:40.980 --> 03:47.800]  Now, what I can't understand is how 20 terabytes are stolen and nobody knows.
[03:47.980 --> 03:50.440]  20 terabytes is the Library of Congress.
[03:50.600 --> 03:51.660]  You know how much data is that?
[03:51.880 --> 03:52.940]  It's a lot of data.
[03:53.680 --> 03:57.260]  So, August 2008, during the campaigns and stuff like that.
[03:57.340 --> 03:58.360]  Way to go, body on.
[03:59.260 --> 03:59.620]  Late.
[03:59.780 --> 04:00.960]  Fashion would be late, bro.
[04:02.380 --> 04:07.000]  Hackers gained access to the McCain and Obama headquarters and basically hack emails.
[04:07.000 --> 04:12.340]  July 2009, cyber attacks were launched against the government and private sector.
[04:13.180 --> 04:14.940]  Now, here's the cake.
[04:16.020 --> 04:19.540]  Virginia Social Security Agency was basically hacked.
[04:19.800 --> 04:28.020]  They basically encrypted all the Social Security numbers for Virginia and basically asked for a ransom for $10 million.
[04:29.040 --> 04:30.520]  Guess what Virginia did?
[04:31.380 --> 04:32.140]  Any guess?
[04:32.360 --> 04:33.560]  Besides the people in the front row?
[04:35.580 --> 04:37.000]  Yeah, they paid that $10 million.
[04:37.580 --> 04:38.840]  But here's the cool shit.
[04:38.920 --> 04:39.720]  Here's the cool shit.
[04:39.940 --> 04:41.680]  The guy was really honest.
[04:42.640 --> 04:47.160]  He basically gave them back the information and was like, you know what?
[04:47.160 --> 04:55.420]  Not only you can have your shit back, and I won't post it up in a forum, but here's what I did to hack it, and here's the fix to it.
[04:56.140 --> 05:01.820]  So, I thought that was kind of like honest in a sort of way, like pen-testing way.
[05:02.420 --> 05:06.100]  Like, I broke into your shit and then now you gotta pay me.
[05:06.320 --> 05:07.500]  Alright, now here's the fix.
[05:07.500 --> 05:11.760]  So, I thought that was cool and I was just like, holy shit, man.
[05:12.040 --> 05:13.220]  That dude got some sacks.
[05:16.000 --> 05:19.620]  So, this, I don't know if any of you seen Zeus.
[05:20.200 --> 05:23.940]  I gave it, me, the malware award of the year.
[05:24.300 --> 05:32.500]  Now, I don't know how many working corporations, large corporations, and you have these applications to push out your apps and stuff like that.
[05:33.200 --> 05:38.780]  The Zeus back-end has the ability to push out applications.
[05:38.780 --> 05:40.820]  I would roll it out in my corporation.
[05:41.140 --> 05:43.880]  So, I don't give a damn what anybody says.
[05:44.060 --> 05:47.160]  Like, if it was me, this is what I'll use.
[05:47.180 --> 05:48.760]  Because you can push applications.
[05:49.040 --> 05:50.740]  You can format hard drives.
[05:51.140 --> 05:53.500]  You can do a lot of cool stuff with this.
[05:53.620 --> 06:00.860]  If you Google Symantec Zeus, the first link, they have a video on the underground, like, websites.
[06:00.860 --> 06:02.940]  Obviously, they block it out, but we hackers.
[06:03.120 --> 06:05.440]  We know exactly where these forums are.
[06:06.060 --> 06:10.100]  And they have, like, botnets for sale that's running Zeus.
[06:10.640 --> 06:15.640]  Like, $400, I think, gets you, like, four or five hundred machines.
[06:15.900 --> 06:21.880]  And if you want to pay a lot of money, like, $1,000, $10,000, you get a lot of machines.
[06:22.480 --> 06:24.400]  So, definitely look this up, man.
[06:24.500 --> 06:26.840]  This is one of the baddest malwares.
[06:26.840 --> 06:30.820]  And another thing I want to say, this isn't one person creating this.
[06:30.960 --> 06:32.540]  This is like a crime family.
[06:32.780 --> 06:35.880]  This is like a team of people in Brazil, China.
[06:36.200 --> 06:37.560]  This is a whole team doing this.
[06:37.700 --> 06:39.900]  So, I mean, kudos to them.
[06:40.980 --> 06:42.480]  Probably got an SVN somewhere.
[06:45.000 --> 06:46.480]  So, what is Nepenthes?
[06:46.540 --> 06:47.220]  What is a honeypot?
[06:47.440 --> 06:49.480]  It's a versatile tool that collects malware.
[06:50.700 --> 06:54.200]  Nepenthes, emulates known vulnerabilities.
[06:54.820 --> 07:01.620]  Basically, when a binary hits the box, it downloads it for you to go ahead and reverse engineer and find out what the hell is going on.
[07:03.660 --> 07:04.160]  So...
[07:04.780 --> 07:06.160]  Come on, work, clicker.
[07:07.060 --> 07:08.020]  Know thy enemy.
[07:08.540 --> 07:11.700]  AV and IDS refine signatures to detect it.
[07:11.800 --> 07:15.360]  So, if there's no signature, it won't detect it.
[07:16.000 --> 07:18.760]  And, I don't know about you, but Symantec...
[07:18.760 --> 07:20.280]  Anybody work for Symantec here?
[07:20.480 --> 07:20.960]  Please?
[07:21.240 --> 07:21.560]  No.
[07:21.900 --> 07:22.360]  Alright, cool.
[07:22.700 --> 07:23.400]  They're shitty.
[07:24.280 --> 07:26.440]  For that, don't even have an AV.
[07:26.660 --> 07:28.400]  Yeah, they're really, really bad.
[07:29.240 --> 07:29.500]  Yeah.
[07:29.980 --> 07:30.460]  Yeah.
[07:32.700 --> 07:45.520]  So, the better and more we know about malware, you know, we could push up to them, give them the information they need to set us, give us a signature and stuff like that, and you know your environment, what's going on.
[07:45.820 --> 07:54.980]  So, when collecting malware, you also could generate statistics for your employer and tell them, listen, this is what we need.
[07:55.080 --> 07:57.460]  We need you to roll it out and we need it now.
[07:57.660 --> 08:04.680]  So, it gives you the statistics you need to basically go ahead and have the ammunition to get your shit.
[08:06.360 --> 08:11.720]  So, I was consulting at a company that has 200,000 workstations.
[08:11.980 --> 08:14.620]  Now, that is insane.
[08:14.940 --> 08:18.500]  It's hard to manage, it's hard to know what's going on everywhere.
[08:18.860 --> 08:25.480]  So, when they got infected, and I think maybe like 10,000 machines got infected, they told me, you know what?
[08:25.580 --> 08:26.420]  We have the money.
[08:26.940 --> 08:30.220]  We're a Fortune 100 company, it doesn't matter.
[08:30.220 --> 08:31.940]  We'll throw money at the problem.
[08:32.560 --> 08:35.960]  Virus impact, that's not a problem, we'll throw money at it.
[08:36.600 --> 08:50.820]  What happened was, their manufacturer facility, where they manufacture their drinks, soft drinks, so you have an idea of where I was consulting at, basically got hit with a virus and it came to a halt.
[08:50.980 --> 08:53.420]  And they was like, oh my God, what do we have to do?
[08:53.520 --> 08:55.420]  So, they sent us to Brazil to fix it.
[08:55.580 --> 08:57.640]  And I was like, you see, you should have listened.
[08:58.480 --> 09:07.380]  So, what I did was introduce Nepenthes, and when I introduced it, I was like, first we need to know, where's our attack vector?
[09:08.120 --> 09:18.800]  And then, once we figure out what's going on, and we find out the signatures and stuff like that, we can update the clueless AVs, so they could give us the signature, so then we could push it out.
[09:19.060 --> 09:22.960]  So, the last thing I like to say about Nepenthes is free 99.
[09:23.420 --> 09:29.200]  If you don't know what's free 99, anything free for me, I want.
[09:29.640 --> 09:31.720]  So, I know you said Shodan.
[09:31.840 --> 09:34.240]  I'm going to take a look at that tonight, as soon as I jump off.
[09:34.400 --> 09:35.640]  So, it's free.
[09:35.880 --> 09:36.720]  It's up to you.
[09:37.400 --> 09:38.380]  So, yeah.
[09:40.660 --> 09:43.920]  So, this is how we basically rolled it out in that corporation.
[09:44.820 --> 09:49.280]  They have a business unit in every country in the world.
[09:49.500 --> 09:52.160]  So, what we did was, we didn't want to do that.
[09:52.440 --> 10:02.040]  We took the Nepenthes collector and put it in the biggest business unit in that company, and then we pushed it up to CW Sandbox, which is an automated analysis suite.
[10:03.080 --> 10:03.940]  Here's the thing.
[10:04.500 --> 10:05.480]  That's not free.
[10:05.680 --> 10:07.100]  It costs $12,000.
[10:07.460 --> 10:08.820]  But here's a trick, right?
[10:08.820 --> 10:09.720]  We're hackers, right?
[10:10.260 --> 10:11.460]  So, you call the company.
[10:11.740 --> 10:12.780]  You didn't hear this from me.
[10:12.960 --> 10:13.700]  Not from Marco.
[10:14.280 --> 10:15.260]  You call the company.
[10:15.660 --> 10:17.500]  You ask them, I want to try your product out.
[10:17.840 --> 10:19.980]  Give me a 30-day trial.
[10:21.900 --> 10:23.040]  Do I have to say more?
[10:23.720 --> 10:24.660]  I don't think so.
[10:24.800 --> 10:27.500]  So, once they give you that 30-day trial, there goes your software.
[10:27.880 --> 10:31.200]  Now, depending on how good are you, I think you can get it for free.
[10:33.680 --> 10:34.040]  Exactly.
[10:34.040 --> 10:43.360]  So, once we put it on the network, we seen 150 to 200 malware binaries hitting these boxes.
[10:43.360 --> 10:44.520]  It was rampant.
[10:44.720 --> 10:45.980]  And we was like, you see?
[10:46.220 --> 10:47.500]  You should have listened to me earlier.
[10:47.680 --> 10:48.860]  We didn't spend that much money.
[10:49.000 --> 10:50.960]  Now we know where we're getting hit at.
[10:51.720 --> 10:53.360]  And it was better for us.
[10:54.100 --> 10:56.380]  And it was free, so I looked like a superstar.
[10:56.520 --> 10:57.160]  I was like, you see?
[10:57.340 --> 10:59.160]  Now you don't have to spend $100,000.
[10:59.260 --> 11:00.260]  You could give me that money.
[11:02.260 --> 11:03.500]  They didn't do it, by the way.
[11:04.160 --> 11:06.560]  So, Nepenthes has vulnerability modules.
[11:07.000 --> 11:11.560]  I'll get into later why I think Nepenthes has limitations.
[11:12.260 --> 11:16.380]  You could add, basically, like modules to it.
[11:16.500 --> 11:18.580]  They don't have good documentation on it.
[11:19.300 --> 11:20.000]  The shellcode...
[11:20.000 --> 11:20.520]  Thank you, Kevin.
[11:21.300 --> 11:24.400]  Shellcode handler and download handlers they have as well.
[11:24.520 --> 11:25.600]  I don't know if you could see that.
[11:28.730 --> 11:31.810]  What I've seen, there's not a lot of updates with Nepenthes.
[11:32.690 --> 11:36.290]  I think the last thing there is MS05.
[11:36.730 --> 11:36.850]  Yeah.
[11:37.450 --> 11:38.990]  So, it hasn't been updated.
[11:39.130 --> 11:40.210]  I think that was shitty, too.
[11:41.390 --> 11:42.410]  You know, if you're gonna put out...
[11:42.410 --> 11:46.890]  Even though it's a good honeypot, I think you should basically update it on a consistent basis.
[11:47.110 --> 11:47.850]  And they don't do that.
[11:48.110 --> 11:50.630]  So, the Windows lovers in here, I'm sorry.
[11:51.230 --> 11:55.430]  They don't have a binary for you guys, so you could install Nepenthes.
[11:55.430 --> 12:01.870]  But here is the installations for BSD, DBN, Zero Chaos, Gentoo.
[12:02.090 --> 12:02.250]  Woo!
[12:04.050 --> 12:04.690]  Source.
[12:05.130 --> 12:06.130]  Your source is there.
[12:06.330 --> 12:07.610]  So, it's easily...
[12:07.970 --> 12:14.170]  You could just basically run it, download it, just type Nepenthes, and it starts working.
[12:14.430 --> 12:17.550]  It's just right there waiting for it to capture some binary.
[12:17.550 --> 12:18.870]  So, that's what's cool about it.
[12:21.030 --> 12:21.490]  Okay.
[12:22.630 --> 12:23.630]  Come on, clicker.
[12:26.930 --> 12:27.910]  Yeah, there we go.
[12:28.250 --> 12:31.290]  So, here's some of the malware analysis captured with Nepenthes.
[12:31.490 --> 12:35.910]  As you see, CWS version, which is a little old.
[12:36.230 --> 12:39.470]  But when it stores files, it stores it with an MD5 hash.
[12:39.470 --> 12:42.790]  You could basically see the log path, what's going on.
[12:43.050 --> 12:44.590]  The file name, MD5.
[12:45.310 --> 12:46.090]  If you go to the...
[12:46.090 --> 12:47.690]  I'm going to the next slide right now.
[12:48.190 --> 12:52.910]  So, if you see towards the bottom, it tells you the create process and the installation.
[12:53.230 --> 13:00.370]  And once it installs, you see the destination file called Windows System 32, armin.exe.
[13:00.870 --> 13:02.810]  Now, that is pretty fast.
[13:05.790 --> 13:09.270]  So, you see the PID, the file name.
[13:09.510 --> 13:12.430]  If you look down, it has the start time, create process.
[13:12.670 --> 13:13.830]  So, here's the interesting stuff.
[13:14.370 --> 13:18.490]  Now, it's starting to look to go ahead, the armin.
[13:18.710 --> 13:21.270]  It's looking to connect to...
[13:21.270 --> 13:22.910]  My niece, close your eyes.
[13:23.050 --> 13:26.790]  There's seccc.serveftp.com.
[13:27.050 --> 13:28.570]  So, it tries to connect there.
[13:28.730 --> 13:29.390]  It can't resolve.
[13:30.210 --> 13:31.910]  And then it goes to the next one.
[13:31.910 --> 13:34.910]  Sexyc.ath.cx.
[13:35.550 --> 13:37.530]  And it resolves to that IP address.
[13:37.770 --> 13:42.110]  So, that malware basically went out to connect to a botnet.
[13:42.390 --> 13:44.910]  So, if you see in the next slide, here's the cool shit.
[13:46.170 --> 13:49.750]  It connected to 6666.
[13:50.090 --> 13:51.570]  Protocol IRC.
[13:52.250 --> 13:53.950]  Look at the nick it tried to use.
[13:54.090 --> 13:55.810]  X-P-D-E-U.
[13:56.150 --> 13:56.370]  Hmm.
[13:56.690 --> 13:57.190]  Windows?
[13:58.690 --> 14:01.610]  It's the channel name is pound pound tibia2.
[14:01.890 --> 14:03.890]  The password is tibiablow.
[14:04.010 --> 14:05.750]  So, right now, you got half the battle.
[14:05.950 --> 14:15.290]  So, not only can you submit to Symantec the signature of where it's infecting, but as well as the signature for your IDS.
[14:21.140 --> 14:23.380]  So, it connects...
[14:23.380 --> 14:26.040]  It opens up a local port at 1910.
[14:26.340 --> 14:27.700]  Socket 1392.
[14:28.540 --> 14:30.040]  Let's get to the meat of it.
[14:30.960 --> 14:31.480]  Alright.
[14:31.700 --> 14:32.760]  Your general approach.
[14:33.400 --> 14:37.800]  So, when you set up a controlled environment, you want to obviously have VMware and stuff like that.
[14:37.900 --> 14:43.700]  You want to perform behavioral analysis and examine the interaction with the environment.
[14:44.320 --> 14:49.940]  Like, there's 90% you can use CW Sandbox to do stuff like that.
[14:50.020 --> 14:54.840]  But then there's the other 10% that you're going to have to basically do it manually.
[14:54.840 --> 15:00.420]  You're going to have to go into IDA Pro, Ali Debugger, Win Debugger to go ahead and find out what you're missing.
[15:02.560 --> 15:06.760]  So, here's some of your toy chest, what you should have in your toy chest.
[15:08.120 --> 15:09.840]  Obviously, VMware, Ghost.
[15:10.100 --> 15:14.860]  You want to monitor your local workstation and basically your network.
[15:15.820 --> 15:21.620]  I use fake DNS or HoneyD is another honeypot you can use.
[15:21.740 --> 15:23.180]  My favorites are IDA Pro.
[15:24.090 --> 15:25.420]  What else I use?
[15:25.880 --> 15:27.100]  Yeah, Windy Bugger.
[15:28.040 --> 15:29.960]  I had one in...yeah.
[15:30.860 --> 15:31.380]  Pen 2.
[15:31.440 --> 15:32.200]  Pen 2.
[15:32.600 --> 15:32.720]  Yeah.
[15:33.720 --> 15:35.640]  The three downloads that it has.
[15:39.220 --> 15:41.240]  Nah, it's...anybody ever heard of Backtrack?
[15:42.120 --> 15:43.020]  Raise your hand.
[15:43.900 --> 15:45.780]  So, I'm going to give my boy a shameless plug.
[15:46.680 --> 15:48.860]  He claims that Pen 2 is better.
[15:49.180 --> 15:51.400]  So, I gave you a shout out, bro.
[15:52.740 --> 15:54.140]  He got...how many...
[15:54.140 --> 15:55.080]  There's what?
[15:55.160 --> 15:56.300]  A hundred downloads for that?
[15:58.780 --> 16:00.780]  So, here's the limitations with...yeah.
[16:01.000 --> 16:03.340]  Here's the limitations with Nepenthes.
[16:04.060 --> 16:06.000]  It only downloads binaries.
[16:06.200 --> 16:13.620]  If you put it on the edge of like, let's say for your home users, you put it on the edge, you're not going to see the HTML that flies by it.
[16:13.620 --> 16:14.540]  It'll just drop it.
[16:15.780 --> 16:21.500]  Like, you start seeing some weird shit for home users that want to do it and put it on the edge, Nepenthes.
[16:21.660 --> 16:23.880]  You start seeing some crazy, crazy shit.
[16:24.140 --> 16:32.040]  What I wanted to figure out as well was that one night, Kev, we was...the China was hitting our box, right?
[16:32.040 --> 16:33.900]  Yeah, it was hitting our box.
[16:35.700 --> 16:37.220]  And...yeah, I copied it.
[16:37.420 --> 16:39.440]  I did a...yeah, I did a print screen.
[16:39.840 --> 16:41.440]  So, China was hitting our box, right?
[16:41.680 --> 16:43.640]  And I'm like, yo, Kev, look at this, man.
[16:44.000 --> 16:45.100]  We're getting attacked.
[16:45.380 --> 16:46.980]  But Nepenthes, what it was doing?
[16:47.120 --> 16:49.180]  It wasn't a binary, so it was dropping it.
[16:49.420 --> 16:50.580]  And I was like, damn.
[16:50.580 --> 16:53.780]  So, what I did was I basically did a print screen.
[16:53.980 --> 16:56.040]  I did an end map to that box.
[16:56.180 --> 16:58.200]  And it was basically...it was a bot.
[16:59.020 --> 17:04.520]  It was a server, though, in China that was basically taking over and they was doing attacks from that box.
[17:05.680 --> 17:06.500]  But it was cool.
[17:06.740 --> 17:09.640]  It was, I think, what they were selling, watches like Rolexes.
[17:09.820 --> 17:11.360]  You know, it was fake because it was from China.
[17:13.160 --> 17:15.920]  So...and malware is getting smarter.
[17:16.260 --> 17:19.940]  There's some cool shit that you're starting to see with the binaries.
[17:19.940 --> 17:21.300]  It's really, really good.
[17:21.720 --> 17:26.760]  I recommend you definitely put it on the edge and capture stuff.
[17:26.940 --> 17:28.220]  Put it on your corporate networks.
[17:28.400 --> 17:34.900]  Put it in your home, inside, internal, on your internal network to see if there's any traffic that's going on.
[17:35.060 --> 17:37.580]  Because people get infected and don't even know.
[17:38.060 --> 17:39.860]  So, this is one way you can do it.
[17:40.160 --> 17:42.920]  So, that was the first part of the presentation.
[17:42.960 --> 17:45.540]  So, I definitely wanted to make an announcement.
[17:45.800 --> 17:48.720]  And this is the right forum to do it on.
[17:48.720 --> 17:51.300]  So, it's called for all hackers.
[17:51.920 --> 17:54.100]  It's called ShaolinTools.com.
[17:58.430 --> 17:59.430]  There you go, bro.
[17:59.710 --> 18:01.050]  Give one to body on.
[18:02.590 --> 18:03.110]  Sorry.
[18:04.050 --> 18:05.590]  This is part of the announcement.
[18:06.530 --> 18:07.510]  Not...there you go.
[18:07.670 --> 18:08.190]  There you go.
[18:08.670 --> 18:16.690]  So, it's basically up...if you go to ShaolinTools.com, you'll see the countdown.
[18:17.770 --> 18:26.870]  And the start of ShaolinTools, it started with being denied for Black Hat three times.
[18:27.230 --> 18:36.030]  Now, if you don't know what Black Hat is, I think it's the next two weeks from now, in Las Vegas, they have a conference called Black Hat.
[18:36.030 --> 18:37.270]  It's Wednesday and Thursday.
[18:37.590 --> 18:40.530]  That's like the only conference that I haven't spoke at.
[18:40.830 --> 18:43.190]  And I've been submitting to them.
[18:43.210 --> 18:44.450]  And I'm pissed.
[18:44.770 --> 18:45.710]  I'm frustrated.
[18:45.910 --> 18:47.050]  I'm like...
[18:47.050 --> 18:47.650]  Dude!
[18:48.070 --> 18:48.270]  Yeah.
[18:48.270 --> 18:49.810]  I'm gonna have to do B-sides.
[18:50.810 --> 18:51.210]  But...
[18:51.210 --> 18:51.810]  Whatever.
[18:52.550 --> 18:57.610]  So, I was questioning my judo and my kung fu and my ninja skills.
[18:57.830 --> 18:59.010]  I'm like, damn, man.
[18:59.150 --> 18:59.750]  What am I doing?
[19:00.810 --> 19:04.530]  When I received the denial this year, I was really, really pissed.
[19:04.690 --> 19:08.690]  So, I took two days and I said to myself, what the hell am I gonna do?
[19:09.430 --> 19:12.650]  That, number one, next year, I'm gonna be accepted.
[19:13.230 --> 19:20.930]  Number two, two or three years from now, I'm gonna still be accepted, regardless if I wanna talk about rats and roaches.
[19:22.550 --> 19:26.810]  So, I came up with this thing called 36 Chambers of Shaolin Tools.
[19:27.070 --> 19:28.210]  And that's what it was born.
[19:28.470 --> 19:28.650]  Yeah.
[19:29.390 --> 19:35.510]  Now, Shaolin Tools, or 36 Chambers of Shaolin, people might think of Wu-Tang.
[19:35.670 --> 19:39.170]  But there was a movie that was created back in 1978.
[19:39.270 --> 19:42.050]  I definitely recommend you watch that.
[19:42.050 --> 19:45.610]  So, what is Shaolin Tools?
[19:45.930 --> 19:49.330]  So, 36 Chambers of unreleased tools.
[19:50.250 --> 19:52.810]  Offensive and defensive security tools.
[19:53.070 --> 19:56.190]  Straight, hacking, whatever you wanna do.
[19:56.190 --> 20:01.710]  If you're a programmer, basically, you know, you're willing to join.
[20:01.870 --> 20:07.370]  If you write documents, if you do beta testing, if you do websites, we need that as well.
[20:08.150 --> 20:10.090]  So, it's open to everybody.
[20:10.090 --> 20:11.210]  It's an open forum.
[20:12.290 --> 20:13.910]  So, it gets better.
[20:15.670 --> 20:20.270]  So, the making of Shaolin Tools, I was saying, well, how can I document this?
[20:20.670 --> 20:27.050]  How can I show the world the process of one year from something when it starts to the end of it?
[20:27.050 --> 20:32.390]  How can it be epic and be, you know, I'm thinking leave a legacy or something.
[20:32.630 --> 20:35.550]  Give it to my kids so they can carry on and say, hey, that's what he was doing.
[20:36.210 --> 20:48.370]  So, what we're doing is giving all programmers and beta testers the flip video HD camera so they can start recording documentaries and stuff like that.
[20:48.570 --> 20:51.770]  So, here's a little trailer that I brought up.
[20:51.850 --> 20:52.970]  That's why I needed that wire.
[20:53.450 --> 20:55.070]  If it's too loud, I'm sorry.
[20:56.270 --> 20:56.750]  So...
[21:00.140 --> 21:08.100]  You know, when it comes to a project this big, you know, it's really about consistency and how much you're willing to put in it.
[21:11.800 --> 21:14.120]  Phase four, number four, gold pairs.
[21:14.320 --> 21:14.860]  Let's see how it goes.
[21:14.860 --> 21:15.180]  Mail it, mail it.
[21:21.550 --> 21:25.390]  There's going to be... I'm telling you, there's going to be ups and downs in here.
[21:25.490 --> 21:26.970]  Catch it, there's going to be all your ideas.
[21:27.530 --> 21:29.130]  Whatever you want, random ideas.
[21:35.730 --> 21:43.430]  I just need... I know I'm focused on it and other people are like, that's a great idea, but I understand when it comes down to it.
[21:44.830 --> 21:46.330]  It's called P.I.
[21:46.430 --> 21:46.870]  Fusgate.
[21:47.210 --> 21:47.450]  P.I.
[21:47.530 --> 21:48.170]  Fusgate, come on.
[21:49.410 --> 21:51.370]  The market needed it.
[22:07.830 --> 22:09.030]  It's their gift.
[22:09.330 --> 22:15.590]  But when it comes down to it, you have to look yourself in the mirror at 3, at 4 a.m.
[22:15.670 --> 22:16.530]  when you're coding.
[22:17.650 --> 22:19.690]  Well, this is for the love, man.
[22:27.670 --> 22:28.430]  Go, dude!
[22:28.670 --> 22:30.790]  1,507 systems in one day!
[22:31.110 --> 22:33.050]  This is zero cool, man!
[22:38.900 --> 22:43.820]  When it's all said and done, Einstein changed the world.
[22:44.840 --> 22:46.420]  Yeah, so that's a quick trailer.
[22:46.620 --> 22:47.660]  That's going to be coming out.
[22:48.760 --> 22:49.160]  Yeah!
[22:51.600 --> 22:52.680]  Is the editor here?
[22:52.800 --> 22:53.780]  Did he get here yet, Kev?
[22:55.160 --> 22:56.620]  Oh, sucks to be him!
[22:58.520 --> 23:00.200]  So, that's what's going on.
[23:00.460 --> 23:02.400]  Like I said, it's open to everybody here.
[23:03.040 --> 23:05.260]  The website right now was up.
[23:05.540 --> 23:08.780]  It's down now, so I gotta check it out once we get off the stage.
[23:09.920 --> 23:10.440]  But...
[23:13.350 --> 23:15.050]  Not yet, not yet, not yet.
[23:15.290 --> 23:19.550]  So, we do have an SVN server to push up all the stuff, all the packages.
[23:19.550 --> 23:21.530]  It's on a secret website.
[23:22.010 --> 23:23.430]  So, we won't get...
[23:23.430 --> 23:25.430]  Yeah, so we won't get pwned and owned.
[23:25.990 --> 23:27.390]  Especially by Shodan.
[23:29.470 --> 23:34.330]  So, the release date for that is July 27th, 2011.
[23:35.110 --> 23:36.210]  It's one year.
[23:36.430 --> 23:37.190]  It's basically...
[23:37.190 --> 23:40.570]  I'm putting my validity and credibility on the line with this.
[23:40.730 --> 23:43.910]  I believe in what I've come up with.
[23:44.110 --> 23:45.690]  I think I have the right team.
[23:45.810 --> 23:48.710]  And I'm willing to accept all comers, man.
[23:48.790 --> 23:53.090]  It doesn't matter if you're Asian, South Korean, European.
[23:53.090 --> 23:54.230]  It doesn't matter.
[23:54.390 --> 23:54.910]  If we...
[23:54.910 --> 23:57.710]  If you can type in English...
[23:57.710 --> 23:57.830]  Hey.
[23:58.150 --> 23:58.610]  Whoa, whoa.
[24:00.190 --> 24:00.750]  Sorry.
[24:01.110 --> 24:02.570]  If you could program, it's open.
[24:03.670 --> 24:04.150]  It's...
[24:04.150 --> 24:04.710]  Oh, shit.
[24:04.990 --> 24:05.570]  Here we go.
[24:06.270 --> 24:07.050]  Wait, wait, wait, wait.
[24:07.110 --> 24:07.610]  I said...
[24:07.610 --> 24:08.250]  I said if...
[24:08.250 --> 24:09.810]  If we had hecklers, so...
[24:09.810 --> 24:10.670]  Yeah.
[24:11.590 --> 24:12.930]  Well, this is the thing.
[24:13.090 --> 24:15.670]  Usually, when we have hecklers, right?
[24:15.870 --> 24:17.670]  Me and my brother started this tradition.
[24:17.950 --> 24:20.150]  We really get on them and bitch them.
[24:20.630 --> 24:20.890]  Right?
[24:21.190 --> 24:22.170]  So, that's...
[24:22.850 --> 24:23.330]  So...
[24:23.330 --> 24:24.690]  What can you say to a man that looks like...
[24:27.110 --> 24:27.550]  Nice move.
[24:28.670 --> 24:29.150]  So...
[24:29.150 --> 24:29.730]  So...
[24:31.610 --> 24:32.570]  So, what...
[24:32.570 --> 24:33.150]  I decided...
[24:33.150 --> 24:33.650]  I decided...
[24:33.650 --> 24:34.210]  My brother...
[24:34.210 --> 24:36.870]  If you look at DEFCON 16...
[24:36.870 --> 24:40.970]  My big brother right here embarrassed this 300 pound dude.
[24:41.370 --> 24:44.090]  And basically challenged him to a fist fight.
[24:44.270 --> 24:45.750]  Like, in the middle of the conference.
[24:45.910 --> 24:46.650]  Was like, you know what?
[24:46.810 --> 24:48.090]  We're gonna stop this.
[24:48.190 --> 24:51.570]  And how about you come outside and let's fight?
[24:51.910 --> 24:53.590]  Right in the middle of the conference.
[24:53.770 --> 24:55.470]  And I'm like, Kev, you know what?
[24:55.970 --> 24:57.190]  Let's finish first.
[24:57.330 --> 24:58.130]  And then you handle that.
[24:58.130 --> 25:02.930]  So, Tuna, you've been a nut ass this whole little hour right here.
[25:03.190 --> 25:03.470]  So...
[25:03.990 --> 25:05.370]  Come up and take your shot.
[25:06.150 --> 25:06.510]  Yes!
[25:06.570 --> 25:07.310]  I'm gonna be a mess.
[25:07.430 --> 25:08.270]  He's gonna...
[25:08.270 --> 25:11.010]  Look at the camera, cause you want you to just shine, right?
[25:11.130 --> 25:12.070]  Oh yeah, well you're gonna do one with me, right?
[25:12.070 --> 25:12.690]  Look, look, look.
[25:12.870 --> 25:13.470]  No, no.
[25:14.410 --> 25:15.490]  You're a heckler, bro.
[25:16.150 --> 25:16.870]  You heckling.
[25:17.010 --> 25:17.730]  You gotta get it.
[25:18.370 --> 25:18.550]  Yeah.
[25:20.510 --> 25:22.870]  Tuna, look at the camera, cause you're on the camera, man.
[25:23.510 --> 25:24.350]  You're on the camera.
[25:24.350 --> 25:24.810]  There you go.
[25:24.910 --> 25:25.190]  You're good.
[25:25.330 --> 25:26.130]  You can sit down now.
[25:26.470 --> 25:28.090]  Now you can just...
[25:28.090 --> 25:28.410]  Shut up.
[25:31.950 --> 25:32.470]  So...
[25:33.130 --> 25:33.650]  Yeah.
[25:34.410 --> 25:37.990]  So July 27th, 2011 is the release date.
[25:38.370 --> 25:47.070]  I'm working on getting a five hour track at Black Hat, or at least a block of time, so we could present these tools at Black Hat.
[25:47.370 --> 25:52.970]  And I think if I release the tools, 36 of them, I don't think he's gonna deny me.
[25:54.530 --> 25:55.570]  That's just me.
[25:56.150 --> 25:56.250]  That's just me.
[25:57.090 --> 25:57.690]  So...
[25:58.870 --> 26:02.830]  All the Shaolin tool monks, cause that's what we call it.
[26:02.990 --> 26:03.990]  The monks stand up.
[26:04.150 --> 26:04.530]  That's here.
[26:06.590 --> 26:09.770]  One, two, three right there.
[26:10.710 --> 26:11.310]  Four.
[26:12.750 --> 26:13.050]  Yeah.
[26:13.390 --> 26:14.750]  And there's like three down there.
[26:15.070 --> 26:16.510]  There's one over there.
[26:16.950 --> 26:19.010]  So these are the monks we have so far.
[26:19.010 --> 26:22.210]  You know, it's gonna be a journey.
[26:22.370 --> 26:23.090]  It's gonna be a ride.
[26:23.190 --> 26:24.170]  I'm telling you right now.
[26:24.650 --> 26:28.210]  So if you're willing to come on board, I have no questions, man.
[26:28.370 --> 26:32.430]  As long as you got some skill and you're willing to work, that's what it is.
[26:33.210 --> 26:35.410]  So there's two chambers already completed.
[26:35.410 --> 26:36.730]  There's 34 left.
[26:37.690 --> 26:40.970]  And I know Tuna, don't even reply to me.
[26:41.130 --> 26:43.890]  But he's working on some cool stuff with phones.
[26:44.370 --> 26:47.750]  And the project that I'm working on is called Shaolin Honeypots.
[26:47.930 --> 26:55.170]  And since I've been working with honeypots for a while, I've seen a lot of stuff that honeypots are missing.
[26:55.170 --> 27:02.350]  So I'm gonna incorporate with the Shaolin Honeypot a web interface with Ruby and Rails because I program in Ruby.
[27:02.510 --> 27:04.410]  I know there's a lot of Python programmers here.
[27:05.170 --> 27:05.730]  Yeah.
[27:06.930 --> 27:07.070]  Yeah.
[27:09.970 --> 27:12.250]  So it's gonna be real cool, man.
[27:13.030 --> 27:20.690]  Anybody interested, I'm just gonna let you know that we're probably gonna have some pizza downstairs on the second floor.
[27:21.790 --> 27:22.570]  Second floor?
[27:22.570 --> 27:22.910]  Second floor?
[27:23.370 --> 27:23.490]  Yeah.
[27:23.770 --> 27:25.690]  Alright, we're gonna have pizza down there.
[27:25.850 --> 27:28.910]  If you guys wanna hang out with us, we're gonna order it.
[27:29.310 --> 27:32.910]  Like I said, if you're interested, come down there or come up here.
[27:33.070 --> 27:36.570]  Grab a business card because I know it is late night on a Friday.
[27:37.210 --> 27:38.650]  And dual course back there.
[27:38.810 --> 27:39.590]  Are you performing, bro?
[27:40.130 --> 27:40.830]  Last night.
[27:41.490 --> 27:42.810]  Last night you performed.
[27:43.030 --> 27:44.950]  We gotta get an 85 award in.
[27:45.350 --> 27:46.150]  Oh, man.
[27:46.470 --> 27:47.530]  You performed last night?
[27:47.790 --> 27:47.970]  Yeah.
[27:48.110 --> 27:48.550]  Seriously?
[27:50.650 --> 27:51.910]  Not even an email.
[27:52.110 --> 27:53.030]  You see the love I get?
[27:55.750 --> 27:56.170]  Oh.
[27:57.270 --> 27:57.950]  My fault.
[27:58.810 --> 27:59.490]  I'm lame.
[28:00.250 --> 28:02.010]  So, I think I'm really early.
[28:02.170 --> 28:06.390]  I'm like 20 minutes early, but I know it's a Friday night and you guys wanna hang out, eat.
[28:06.570 --> 28:10.830]  If anybody wants a shot that's 21 years old, come and get some.
[28:12.010 --> 28:12.550]  Hold it.
[28:12.650 --> 28:12.990]  Hold it.
[28:13.050 --> 28:14.030]  We need a line like...
[28:15.690 --> 28:17.270]  If you want it, you know what I mean?
[28:17.710 --> 28:18.050]  Do a call.
[28:18.190 --> 28:18.630]  Come up here.
[28:18.770 --> 28:19.290]  You gotta spit.
[28:20.490 --> 28:20.810]  Yeah.
[28:21.130 --> 28:21.270]  Oh.
[28:21.510 --> 28:21.790]  Yeah, yeah.
[28:21.930 --> 28:22.250]  Questions.
[28:22.530 --> 28:23.230]  Sorry, sorry.
[28:23.350 --> 28:23.530]  Whoa.
[28:24.350 --> 28:25.310]  It was a feast.
[28:25.410 --> 28:26.150]  It was like, shots.
[28:26.330 --> 28:26.950]  Hold on.
[28:27.110 --> 28:27.730]  Let me go.
[28:27.910 --> 28:28.230]  Move.
[28:28.230 --> 28:28.290]  Move.
[28:31.140 --> 28:32.340]  Oh, my God.
[28:32.500 --> 28:32.860]  Tuna.
[28:33.260 --> 28:34.580]  Paging doctor.
[28:36.760 --> 28:38.300]  Anybody see that movie?
[28:38.860 --> 28:39.600]  Yeah.
[28:53.150 --> 28:54.550]  Yeah, well...
[28:56.550 --> 28:57.990]  No, awesome.
[28:58.190 --> 28:58.930]  Awesome on that.
[28:59.170 --> 29:05.150]  What was happening with Symantec is that we was waiting four or five days for one signature.
[29:05.530 --> 29:14.090]  Now, if you're infected, you wait four days for a signature update, it's gonna basically infect half your network.
[29:14.090 --> 29:19.710]  So, the big thing was this, with the infections, was the big yellow.
[29:20.410 --> 29:21.850]  Has anybody heard of the big yellow?
[29:22.450 --> 29:24.430]  Which was Symantec.
[29:24.590 --> 29:28.330]  It was a virus, a malware, for Symantec.
[29:29.130 --> 29:31.570]  It basically attacked Symantec.
[29:31.670 --> 29:33.050]  And we didn't have that signature.
[29:33.270 --> 29:34.910]  And we was like six months behind.
[29:35.210 --> 29:37.770]  Man, that's when the 10,000 got infected.
[29:38.750 --> 29:45.770]  So, what we did was, we basically had the Nepenthes, and we had the XML file.
[29:46.610 --> 29:49.010]  So, we would push it to Symantec.
[29:49.150 --> 30:00.830]  And what we did was, since they were stupid, and they didn't want to give us somebody on our, like, work with us, on our network and stuff like that, what we did was we had an enterprise rep.
[30:00.830 --> 30:04.730]  And basically, we would push the XML file with all the details.
[30:04.990 --> 30:08.430]  So, all they had to do was create the signature.
[30:08.710 --> 30:10.610]  Like, you don't have to do any work.
[30:11.050 --> 30:13.930]  Just look at the file, create the signature, and push it back.
[30:14.370 --> 30:18.930]  So, the reason why it took them four days is because we had to submit the binary.
[30:19.230 --> 30:23.690]  They'll basically reverse it, find out what they're doing, and take their sweet-ass time.
[30:24.190 --> 30:26.330]  So, they didn't have an argument for us.
[30:26.610 --> 30:28.090]  We gave you all the information.
[30:28.390 --> 30:31.290]  You don't have to do nothing, except write a signature.
[30:33.530 --> 30:34.910]  So, any other questions?
[30:34.950 --> 30:35.430]  I'm sorry.
[30:35.650 --> 30:36.710]  I just wanted to party.
[30:37.190 --> 30:38.150]  I didn't want no questions.
[30:38.530 --> 30:38.670]  Yeah.
[30:38.950 --> 30:40.390]  I'm sorry if you didn't party.
[30:40.490 --> 30:41.570]  No, no, no, no, no, no.
[30:41.630 --> 30:42.210]  No, go ahead.
[30:42.390 --> 30:42.670]  Go ahead.
[30:46.480 --> 30:46.880]  Submit.
[30:47.340 --> 30:47.640]  Submit.
[30:47.640 --> 30:49.620]  Well, you're submitting to Symantec.
[30:49.780 --> 30:50.020]  Yeah.
[30:50.140 --> 30:51.980]  So, you're submitting to Sofa, 14.
[30:52.380 --> 30:53.260]  No, no, no, no.
[30:53.260 --> 30:57.700]  Because we had a contract with Symantec, and it was on all our boxes.
[30:58.160 --> 31:00.800]  So, we needed the signatures like yesterday.
[31:02.060 --> 31:03.020]  So, you understand?
[31:04.580 --> 31:05.100]  Yeah.
[31:05.380 --> 31:08.310]  How fast did you get it?
[31:08.690 --> 31:10.810]  It was within four hours.
[31:11.830 --> 31:13.610]  So, it was pretty good.
[31:13.610 --> 31:19.930]  Because we had that relationship with the Enterprise Symantec AV, and they was pushing it back to us immediately.
[31:20.250 --> 31:21.070]  For the four hours?
[31:21.790 --> 31:23.970]  For them to push back the signatures.
[31:26.090 --> 31:30.790]  It took four days before we submitted the XML file to them.
[31:30.870 --> 31:32.490]  Before we went through that process.
[31:32.690 --> 31:38.510]  If we just took a binary and submitted to them, it would take them four days to get back to us.
[31:38.630 --> 31:41.710]  Which was unacceptable in an Enterprise Network, you know?
[31:44.110 --> 31:45.230]  Any other questions?
[31:50.970 --> 31:51.410]  Uh...
[31:51.410 --> 31:52.270]  You never say dual core.
[31:54.050 --> 31:55.530]  Dual core is number one, yeah.
[31:55.930 --> 31:56.130]  Yeah.
[31:56.450 --> 31:57.650]  Even though I told him...
[31:57.650 --> 31:58.070]  Hold on.
[31:58.830 --> 32:00.710]  I hit you up on Facebook.
[32:01.550 --> 32:02.370]  Look at this.
[32:02.710 --> 32:04.990]  Like, two weeks ago, and I was like, you know what, dude?
[32:05.490 --> 32:06.950]  Can I get a favor?
[32:07.170 --> 32:08.270]  Can I get one favor?
[32:08.270 --> 32:11.530]  I was like, how about you introduce me with a rap?
[32:11.930 --> 32:16.790]  And then you close out this show, because I'm going to leave you some time, and you spit some game.
[32:16.970 --> 32:17.870]  How about that?
[32:18.170 --> 32:22.690]  He emailed me back like, dude, we only have a week.
[32:23.130 --> 32:27.610]  And I wanted to hit you up, and I was like, but you don't freestyle and you're not a rapper?
[32:28.990 --> 32:30.250]  Is that what it is?
[32:30.390 --> 32:32.970]  Because I could pull out Wu-Tang, and let me see.
[32:33.070 --> 32:35.970]  Let me go off the top, since I love hip-hop.
[32:37.510 --> 32:42.030]  The Mississippi Masada, I be in the sala, chupin' the naga like the chupacabra.
[32:42.250 --> 32:43.530]  You see, that was off the top.
[32:44.270 --> 32:46.110]  That was off the top, dual core.
[32:46.250 --> 32:47.490]  And I'm not even a rapper.
[32:48.910 --> 32:49.310]  So...
[32:49.730 --> 32:52.610]  I'm not even a rapper, so I'm just saying...
[32:53.410 --> 32:54.210]  Nah, I'm...
[32:54.210 --> 32:55.070]  He'll kill me.
[32:55.270 --> 32:57.270]  I'm scared of that dude when it comes to rap.
[32:57.270 --> 32:58.730]  Any other questions?
[32:59.370 --> 33:01.070]  Hey, dual core, why don't you just spit?
[33:01.230 --> 33:02.490]  Because we do have some time.
[33:02.870 --> 33:03.890]  You could spit a freestyle.
[33:04.110 --> 33:04.710]  Come up here, man.
[33:05.250 --> 33:06.750]  And we could get a line going.
[33:07.030 --> 33:07.450]  Yeah, yeah.
[33:07.590 --> 33:09.130]  We could have a little party in here.
[33:09.270 --> 33:10.030]  It is Friday.
[33:10.330 --> 33:11.430]  It is 10.30.
[33:12.270 --> 33:14.310]  And you could get some shots.
[33:15.950 --> 33:16.330]  So...
[33:16.330 --> 33:17.950]  I'll give you some shine, bruh.
[33:19.510 --> 33:21.750]  Real quick, make some noise for Marco real quick.
[33:27.070 --> 33:30.050]  We spit a couple lines on a freestyle and make it hot.
[33:30.050 --> 33:32.930]  Everybody get up here, get in line, and get a shot.
[33:33.390 --> 33:35.110]  And you say I can't freestyle?
[33:35.330 --> 33:36.150]  Well, believe me.
[33:36.370 --> 33:37.750]  You were rapping in Spanish.
[33:37.930 --> 33:39.190]  I might rap in C.
[33:39.490 --> 33:42.310]  Oh my gosh, I don't know what you do, I put a hole in.
[33:42.450 --> 33:45.290]  Cause I gotta end all of my lines with a semicolon.
[33:45.570 --> 33:50.290]  And anyways, you know they wanna believe me, they resemble me, cause I rap in assembly.
[33:51.310 --> 33:53.110]  X86 Architecture, I rep ya.
[33:53.110 --> 33:54.730]  Hey, it's my man Marco.
[33:55.130 --> 33:56.050]  Go ahead and check ya.
[33:57.310 --> 33:58.830]  Thrillcoremusic.com Holler at me.
[34:03.600 --> 34:04.600]  Thank you, bruh.
[34:04.700 --> 34:05.100]  Thank you.
[34:05.280 --> 34:05.580]  That's it.
[34:07.240 --> 34:10.580]  If any other questions, or you want my business card, just let me know.
[34:10.760 --> 34:11.380]  I got water.
[34:11.960 --> 34:12.440]  You got...
[34:12.440 --> 34:13.040]  Water.
[34:13.380 --> 34:14.020]  You got water.
[34:14.020 --> 34:14.500]  Yeah!