[00:00.000 --> 00:11.220]  ...will be around until about 2, down on the second floor, and at about 1.30, I think they stopped giving the tests for the ham license, for the tech license.
[00:13.560 --> 00:16.660]  With that, I introduce number 1.30 and number 1.08.
[00:22.580 --> 00:23.460]  That's not going to work.
[00:28.300 --> 00:31.440]  All right, I'm going to stand at the podium because I want to be like Hitler, I guess.
[00:33.840 --> 00:34.940]  This isn't going to work either.
[00:37.780 --> 00:43.740]  And yesterday, I was laughing at Catonic because he was so hungover, and now that it's happening to me, it's not as funny.
[00:46.180 --> 00:52.040]  All right, so this presentation is Vulnerabilities in a Connected Future, and I apologize for the confusing title.
[00:52.340 --> 00:58.460]  It's actually a lot of smart home hacking and some other stuff, too.
[00:58.700 --> 01:00.760]  We actually modified the presentation a bit.
[01:00.820 --> 01:05.540]  It's way too long, so we're going to fly through some of the stuff to try to get as much in as possible.
[01:05.540 --> 01:17.000]  And both me and Qui-Gon are veterans, and we have a little bit about the whole veterans' identity theft thing that's been going on.
[01:19.380 --> 01:20.060]  Change.
[01:21.740 --> 01:24.020]  All right, pass that.
[01:24.320 --> 01:25.260]  Document versioning.
[01:25.360 --> 01:27.880]  HackerPimps.com forward slash docs dot html.
[01:28.980 --> 01:29.420]  HackerPimps.com forward slash docs dot html.
[01:29.420 --> 01:31.000]  All right, a smart home, huh?
[01:32.360 --> 01:33.460]  The caller sucks.
[01:37.050 --> 01:41.290]  I guess you're just going to have to listen to me talk and trust what I have to say.
[01:41.490 --> 01:42.970]  It's much more entertaining that way anyway.
[01:43.130 --> 01:44.930]  That way you get to see me stumble all over my words.
[01:45.910 --> 01:48.510]  Smart homes are a new breed of homes.
[01:48.730 --> 01:50.810]  They have a very connected nature.
[01:51.450 --> 01:57.970]  And they also do really cool things like identify information about you, trend that data, and make decisions about you.
[01:57.970 --> 02:00.930]  So, exploiting a system like that could be very fruitful.
[02:03.830 --> 02:05.690]  There's a description that you can't read.
[02:06.230 --> 02:11.890]  There's a couple of smart home projects in the world of academia right now.
[02:12.530 --> 02:18.150]  Two of the most well-known are MIT's House N and Georgia Tech's Aware Home.
[02:18.510 --> 02:23.330]  And they both have websites, although last I checked, the Aware Home site was down for some reason.
[02:23.490 --> 02:24.190]  I have no idea.
[02:26.650 --> 02:28.790]  All right, info on this presentation.
[02:29.310 --> 02:36.050]  Some of the motivating factors for doing this presentation was, I was sitting on my couch one night watching the Science Channel.
[02:36.250 --> 02:38.970]  And they were exploring, you know, homes of the future.
[02:39.110 --> 02:40.650]  And they were showing different things you could do.
[02:41.070 --> 02:45.290]  And this guy got, like, a text on his phone.
[02:45.290 --> 02:47.750]  It said one of the alarm sensors in his house went off.
[02:47.750 --> 02:49.890]  So, he wanted to see what was going on.
[02:50.030 --> 02:56.610]  So, he logged into the admin interface and connected to his home and started looking at a bunch of video cameras in his house.
[02:56.790 --> 02:58.890]  And I started screaming, oh, my God, that's HTTP!
[02:59.710 --> 03:01.250]  You know, I was like, what are these people doing?
[03:01.410 --> 03:04.210]  And then, you know, there was countless other things they were showing.
[03:04.370 --> 03:08.210]  And I just kept jumping off the couch going, oh, my God, I can't believe they're going to sell that to people.
[03:08.210 --> 03:15.170]  And I can't even imagine what's going to happen once manufacturers actually start, you know, mass-producing this technology.
[03:15.570 --> 03:18.150]  It's going to get a lot worse, which is actually kind of fun.
[03:19.790 --> 03:21.290]  Okay, I already went past that.
[03:23.090 --> 03:25.190]  Basically, that last slide said I was a nerd.
[03:28.130 --> 03:31.990]  Smart homes have typically, in the past, they've been focused on luxury.
[03:32.310 --> 03:34.410]  You know, I mean, not everybody can afford the clapper, right?
[03:34.410 --> 03:40.370]  So, what ended up happening is they started seeing a tremendous use for this in assisted living.
[03:40.530 --> 03:50.650]  You know, with the elderly or medically disabled, which brings in some more really interesting aspects when you're talking about attacking smart home technology, you know, you could actually be affecting somebody's life.
[03:53.670 --> 03:58.210]  Okay, in the future, smart homes and their components will be a part of everyone's life.
[03:58.390 --> 03:59.470]  And why is that?
[03:59.610 --> 04:01.130]  It's because we all love getting owned.
[04:04.380 --> 04:05.760]  Now, this is really interesting.
[04:05.960 --> 04:08.480]  I wanted to, like, you know, throw, like, little cool pictures in here.
[04:08.980 --> 04:10.380]  And I found this picture.
[04:10.540 --> 04:12.560]  I wanted a guy in a wheelchair to show the disabled.
[04:12.560 --> 04:17.220]  And it's really funny because the very first thing that came up in Google Images was this picture.
[04:17.220 --> 04:18.560]  And it says, my son's hit me.
[04:18.720 --> 04:19.940]  It says wheelchair-bound man.
[04:20.240 --> 04:25.280]  And then it says, the 80-year-old man claims that his son slapped him and tried to push him down a slope.
[04:25.840 --> 04:26.940]  And it's kind of twisted.
[04:27.100 --> 04:28.380]  Okay, anyway, never mind.
[04:28.640 --> 04:29.420]  Forget that slide.
[04:31.720 --> 04:33.400]  The contents of a smart home.
[04:34.820 --> 04:42.100]  You're going to have some components like servers, connected appliances, cameras, furniture, jewelry, etc., etc., etc.
[04:42.620 --> 04:48.280]  Many newer devices come with some sort of connected capabilities, even if it's just for getting updates.
[04:48.500 --> 04:51.800]  I mean, if your toaster wants a firmware upgrade, it's going to have to connect somehow.
[04:52.280 --> 04:56.320]  I mean, you know, I'm sure, you know, it's not going to be like flashing a BIOS.
[04:56.320 --> 04:59.760]  You're going to have to, you know, you're going to lose control of all your appliances.
[04:59.980 --> 05:01.860]  So some third party is going to have to manage that.
[05:04.240 --> 05:05.460]  Interfacing with the smart home.
[05:05.940 --> 05:09.360]  There's many different ways that smart homes will be interfaced with.
[05:09.800 --> 05:13.880]  The phone, the web, wireless, and all its, you know, capabilities.
[05:14.340 --> 05:19.160]  RFID, power outlets, Cat5, fiber, and countless interfaces that haven't even been developed yet.
[05:19.160 --> 05:22.060]  So, that's a lot of different interfaces.
[05:23.680 --> 05:27.200]  Smart homes, on the flip side, interface with us.
[05:28.720 --> 05:32.440]  You know, technology can actually affect the way we feel.
[05:32.600 --> 05:38.040]  And we'll get into that later with the psychological aspects and actually hacking a person, which is actually kind of cool, too.
[05:38.240 --> 05:39.360]  And I'm going to quit saying the word cool.
[05:39.480 --> 05:39.860]  That sucks.
[05:41.180 --> 05:48.580]  Mood pendants, photo albums, prediction of activities, and prediction of content, and actually making decisions.
[05:50.020 --> 05:50.600]  You know what?
[05:50.600 --> 05:54.100]  I can see the slides better over on this side of the screen than you can out there.
[05:54.140 --> 05:54.760]  That's really funny.
[05:57.440 --> 06:01.400]  Well, if, yeah, yeah, let's rotate it around so everybody can see the back, right?
[06:01.880 --> 06:02.160]  Ha-ha.
[06:04.080 --> 06:04.880]  Prediction technologies.
[06:06.040 --> 06:07.600]  You know, what do you want for breakfast?
[06:08.160 --> 06:09.380]  What do you watch on TV?
[06:09.740 --> 06:10.720]  Now, this could be cool.
[06:10.940 --> 06:11.960]  What do you watch on TV?
[06:12.120 --> 06:16.460]  Your TV, and we've already seen this with, like, TiVo, it'll start to make decisions for you, right?
[06:16.560 --> 06:17.600]  Based on what you watch.
[06:17.840 --> 06:19.780]  Now, what if your friends get a hold of that, you know?
[06:19.880 --> 06:24.640]  I mean, my friends come to my house, they sit down, and there's, like, 100 episodes of Will & Grace on my DVR.
[06:24.740 --> 06:25.760]  It's like, what are you doing, dude?
[06:26.200 --> 06:31.140]  You know, so our favorite television shows, you know, what type of food you like.
[06:31.600 --> 06:33.760]  These systems hold a vast amount of data.
[06:33.760 --> 06:35.720]  They're going to have a vast amount of data on us.
[06:36.160 --> 06:36.740]  Think about...
[06:36.740 --> 06:38.460]  That's like an advertiser's dream.
[06:38.820 --> 06:50.740]  You know, a marketing company's dream is to have all this information on exactly what you like to do and exactly how you like to do it and how many times a day you do it, which I wouldn't want somebody knowing exactly how many times a day I do certain activities,
[06:51.120 --> 06:53.780]  but my house would know, and that's what's scary.
[06:54.380 --> 06:57.860]  And it's done through context-aware computing, and we'll get into that in a minute.
[06:58.940 --> 07:00.120]  Oh, yeah, okay, go ahead.
[07:02.460 --> 07:06.280]  So what does all of this stored, predictable information about us mean?
[07:06.560 --> 07:10.120]  That we're going to have to read our usage agreements very close with third parties.
[07:10.380 --> 07:20.200]  When we start buying this technology, we have to make sure we read the fine print and not say, you allow us to take all this information and send it right back to us so we can use it against you later.
[07:20.860 --> 07:27.700]  We're going to have to be mindful of the exploitation of these systems and the different ways that these systems would be vulnerable and that information can be extracted.
[07:29.220 --> 07:33.520]  And our personal prawn archives could actually be ripped off, and that's what I'm scared about.
[07:36.140 --> 07:37.960]  Okay, context-aware computing.
[07:38.680 --> 07:44.640]  Context-aware computing involves, you know, sensors and logic in order to analyze movement and activities of you.
[07:44.740 --> 07:46.920]  And this is done through sensors placed all throughout your house.
[07:46.920 --> 07:53.780]  I mean, on, you know, on sugar containers, on drawers, on the walls, on light outlets, all of this.
[07:54.140 --> 08:03.460]  And this is an extremely oversimplified example, but just to give you an idea of what I mean, say there's two people that live in a house, you know, Alice and Bob.
[08:03.660 --> 08:15.220]  When Bob walks into a room, right before, you know, walking into that room, the lights come on with a red tint because the house knows that Bob's about to walk in the room, and damn it, he hates green lights.
[08:15.400 --> 08:17.080]  So they're going to turn on lights red.
[08:17.280 --> 08:19.740]  But when Alice walks into the room, she hates red lights.
[08:20.020 --> 08:24.340]  Her logic actually overrides the other logic, and when she walks into the room, the lights turn on green.
[08:24.700 --> 08:25.720]  Really simple example.
[08:26.940 --> 08:29.060]  And so I have a bunch of pictures that you probably...
[08:29.060 --> 08:30.660]  Well, you can probably see those fairly well.
[08:30.840 --> 08:34.720]  And this is from MIT's house, and they call those little...
[08:34.720 --> 08:37.960]  the little chips, they call them mites, which is actually kind of cool.
[08:38.120 --> 08:39.920]  MIT, E-S-C, get it, joke.
[08:39.920 --> 08:44.140]  And all these sensors are on, you know, sugar, flour.
[08:44.460 --> 08:46.900]  They're on the light outlets.
[08:47.100 --> 08:49.000]  They're on the drawers where the silverware is.
[08:49.200 --> 08:55.060]  And that information is being back to a central computer, and it has a tendency to learn things about you.
[08:55.360 --> 08:56.200]  And you can actually...
[08:56.200 --> 09:06.000]  There's actually a picture on MIT's house end where they have a PDA, and they're pointing it at different things, and the PDA knows that's a fork, you know, that's a spoon, that's a knife.
[09:06.000 --> 09:10.700]  It actually learns about your activities and about the physical items in your environment.
[09:12.340 --> 09:14.620]  Okay, now we can get to some of the fun stuff.
[09:14.840 --> 09:16.160]  Impacts of vulnerabilities, right?
[09:16.420 --> 09:18.940]  Think about the impact of your computer being compromised.
[09:19.200 --> 09:20.020]  That's pretty bad.
[09:20.320 --> 09:29.040]  You know, you may have passwords, social security numbers, bank accounts, credit cards, tax return, prawn, browsing activities, and how stupid your screen name is.
[09:29.200 --> 09:33.400]  I mean, people actually could learn that about you by, you know, exploiting your computer system.
[09:33.860 --> 09:37.560]  Now, think about the impacts of vulnerabilities in your home.
[09:37.960 --> 09:42.300]  So, you could actually have internal video cameras, which to me is just utterly scary.
[09:42.480 --> 09:44.640]  I don't know why anybody would put video cameras inside their home.
[09:44.780 --> 09:49.760]  I'm paranoid enough to put them on the outside of my house, but, yeah, I can't...
[09:49.760 --> 09:51.200]  Especially, like, wireless cameras.
[09:51.280 --> 09:53.720]  Why would anybody put wireless cameras on the inside of their home?
[09:55.140 --> 09:56.180]  Yeah, it's porn driving.
[09:58.320 --> 09:59.480]  All right, keep going.
[09:59.820 --> 10:00.020]  Okay.
[10:00.880 --> 10:08.520]  Internal video cameras, arm and disarm alarms, change, prescriptions, what you like on your DVR, temperature of your house, which could actually be really funny.
[10:08.640 --> 10:09.440]  We live in Florida.
[10:09.600 --> 10:10.680]  It would be nice to turn up the heat in the summertime.
[10:13.200 --> 10:23.200]  Temperature you like in your house, mischief with connected appliances, learn your true habits, location technologies, and know if your kids are home, which it's always fun to scare people with their kids.
[10:23.440 --> 10:25.020]  I mean, advertising companies do it all the time.
[10:25.120 --> 10:26.180]  The president won an election with it.
[10:26.280 --> 10:26.780]  You know, all that stuff.
[10:30.540 --> 10:32.680]  Okay, attack vectors for a smart home.
[10:33.080 --> 10:33.680]  Very cool.
[10:33.900 --> 10:34.880]  Multiple attack vectors.
[10:35.120 --> 10:41.580]  You have, you know, people in the home, connected appliances, outlets, picture frames, which is very cool.
[10:41.820 --> 10:49.200]  And, you know, the actual medium, you have, you know, wireless, telephone lines, Cat5 fiber.
[10:50.060 --> 10:50.400]  Go ahead.
[10:51.600 --> 10:56.220]  So, we know that these homes are going to have to have some sort of administration interface.
[10:56.800 --> 10:58.860]  Have to have some kind of administration interface.
[10:59.160 --> 11:09.040]  So, most likely, they're going to be, have issues with regular admin interfaces that we already have, whether it be programming logic, passwords, tokens.
[11:09.800 --> 11:24.340]  But plain text, plain text authentication, which probably won't, I mean, some, some manufacturers are actually smarting up a little bit, so this may not be as much of an issue when they start rolling this out, but they may have some weird backward compatibility that actually has HTTP built into it,
[11:24.340 --> 11:28.500]  and maybe people will accidentally just use that interface versus an HTTPS interface.
[11:29.480 --> 11:39.420]  Man-in-the-middle attacks, telephone, you know, you can bring war dialing back, wireless war driving, and basically, admin interfaces will be known to an attacker ahead of time.
[11:39.560 --> 11:54.140]  So, if, if the manufacturer tries to, you know, obfuscate the admin interface, say, by switching the port, you know, like, nobody would ever figure out that they switched the, the port from 80 to, you know, 1337, or something like that, they would never figure that out.
[11:54.280 --> 11:59.460]  Even though they publish it in their information, hell, you have to connect to it, so everybody's going to know it ahead of time.
[11:59.620 --> 12:08.340]  If you're specifically targeting an attack at a smart home, you'll already have that information, so you won't even bother going, looking anywhere else if you know exactly where the information is to begin with.
[12:09.700 --> 12:10.740]  Third-party issues.
[12:12.980 --> 12:21.660]  These future smart homes most likely will have third-party interfaces because people are too stupid to run their own stuff.
[12:21.840 --> 12:32.560]  So, you're going to have this wonderful third-party that connects to your, your smart home for either monitoring, operation, administration, and it all depends on the technologies marketed and maintained.
[12:33.480 --> 12:40.080]  You know, mostly, most likely people will need to be connected to a third-party, even if it's just for updates of some kind.
[12:40.440 --> 12:46.820]  And we all know that, that our computers never send information that we don't know about back to a, you know, a big company that starts with an M, right?
[12:47.640 --> 12:48.040]  Okay.
[12:49.500 --> 12:52.740]  And that'd be really funny to have Windows genuine advantage on your home.
[12:52.940 --> 12:59.400]  So, then they disable your updates and you get owned like all over the place because you had like pirated copies of XP running your home.
[12:59.580 --> 13:00.180]  That'd be really funny.
[13:01.300 --> 13:05.620]  There's a big potential for misuse and exploitation by third parties just like any third party.
[13:05.860 --> 13:18.600]  You know, I'm always scared like the, the alarm on my house doesn't have a two-way communicator which I think is really funny because I know some of the people that work at like ADT and SafeTouch and all these other companies and, you know, in the middle of the night it's,
[13:18.720 --> 13:20.680]  you know, there's nothing else to do.
[13:20.960 --> 13:23.380]  You know, I can just see somebody going, hey, let's listen to this one.
[13:23.780 --> 13:24.720]  Let's listen to this one.
[13:24.900 --> 13:25.320]  Oh, man.
[13:25.400 --> 13:25.800]  Oh, man.
[13:25.860 --> 13:26.580]  What's he listening to?
[13:26.700 --> 13:27.540]  Okay, let's listen to this one.
[13:27.660 --> 13:30.260]  You know, and you end up with people scrumping and everything else.
[13:31.000 --> 13:37.040]  So, you know, and this technology can definitely be outsourced.
[13:37.260 --> 13:50.160]  So, now you have, you know, people in another country listening to you have sex or watching your video cameras or doing, you know, anything, you know, they're probably relatively unskilled and these, they have a vast amount of information about people at their fingertips.
[13:50.460 --> 13:52.540]  That could be very easy to sell.
[13:56.340 --> 13:59.480]  Weak protections in place for admin and user lockout.
[14:00.600 --> 14:05.120]  You know, it just seems that although technology changes, stupidity is timeless.
[14:05.460 --> 14:06.660]  People are going to forget things.
[14:06.920 --> 14:12.540]  I mean, I'm sure the first, the first caveman that invented the stone wheel was like, ah, and, you know, he saw the vision.
[14:12.960 --> 14:14.020]  This wheel will change the world.
[14:14.180 --> 14:16.940]  There was like 400 other cavemen standing around going, I don't get it.
[14:18.720 --> 14:22.260]  You know, no lockouts could mean, you know, automated attacks.
[14:22.660 --> 14:27.420]  I can just see people getting pissed off after like a three lockout, you know, time period.
[14:27.440 --> 14:35.620]  And if you're talking about, like, you know, medical issues or something involving health, you wouldn't be able to lock people out because you could kill somebody.
[14:37.260 --> 14:38.060]  Third-party...
[14:39.040 --> 14:40.340]  manufacturer backdoor accounts.
[14:40.920 --> 14:43.420]  Manufacturers are going to have ways to get in and update.
[14:43.560 --> 14:44.780]  They're going to have accounts on the system.
[14:44.980 --> 14:47.080]  You also have third-party and support accounts.
[14:47.420 --> 14:52.340]  So, you know, now you have all these other people that can connect to your home and get into your accounts.
[14:52.340 --> 15:00.800]  And also, you know, if an attacker exploits one of these backdoor accounts or third-party account, They have the same access to the systems that you would.
[15:01.680 --> 15:05.180]  And people, you know, still choose, you know, weak pins and passwords.
[15:07.100 --> 15:16.960]  Phishing attacks on your house could start to happen, depending on when people start realizing, you know, how valuable this information really is and how much it's worth.
[15:18.400 --> 15:27.380]  Home logins could be, you know, the keys to the castle, allowing an attacker to view if anyone's home, disarm alarms, steal personal information, and voyeurism, which is the only one we agree with.
[15:27.920 --> 15:31.320]  And access to technology is going to be done through mobile devices.
[15:31.480 --> 15:33.880]  So you have PDAs, laptops, cell phones.
[15:34.220 --> 15:39.140]  And if you lose one of those, we all know that everybody... it can't be recovered, right?
[15:39.200 --> 15:41.900]  Because everybody locks their PDA or their phone or whatever.
[15:41.900 --> 15:48.500]  So nobody would ever be able to analyze that PDA or smartphone and get anything off that.
[15:48.760 --> 15:54.300]  And most likely, people will store the passwords or pins on the device itself.
[15:54.300 --> 15:55.780]  So you won't even have to attack it.
[15:55.860 --> 15:56.700]  You already have the information.
[15:58.940 --> 16:02.140]  These smart homes are also going to have servers and operating systems.
[16:02.700 --> 16:10.520]  So the same vulnerabilities that affect, you know, the Windows box at work, you know, is also going to affect, you know, the Windows box in the smart home.
[16:12.480 --> 16:14.220]  So what OS are they going to be using?
[16:14.320 --> 16:16.360]  Are they going to be using Microsoft, Linux, Cisco?
[16:17.180 --> 16:19.900]  And all these OSs have never had security problems, right?
[16:20.180 --> 16:20.280]  Okay.
[16:22.220 --> 16:26.560]  From an OS level... I'm repeating myself because I'm not looking at the slides, sorry.
[16:27.080 --> 16:32.560]  And, of course, you have malware, worms, spyware getting on your home.
[16:32.780 --> 16:33.720]  And that's just not good.
[16:34.820 --> 16:35.960]  So exploiting the medium.
[16:36.700 --> 16:38.020]  And, like I said, I apologize.
[16:38.280 --> 16:39.480]  There's so many slides.
[16:39.640 --> 16:40.460]  We're trying to go through them all.
[16:40.620 --> 16:43.980]  And we're trying to put some of the most interesting stuff up here.
[16:44.120 --> 16:51.760]  So exploiting the medium, the physical medium, you know, there's definitely multiple mediums communicating over...
[16:51.760 --> 16:54.200]  Or multiple protocols over multiple mediums.
[16:54.280 --> 16:57.600]  So you'd have wireless, fiber, coax, power lines, CAP5, et cetera, et cetera, et cetera.
[16:57.600 --> 17:00.540]  All these mediums can be tapped or just connected to.
[17:01.420 --> 17:03.860]  From a protocol perspective, it looks like one network.
[17:04.280 --> 17:07.600]  I mean, TCP/IP doesn't really care what it communicates over.
[17:07.860 --> 17:11.420]  So, I mean, your toaster can ping your computer.
[17:11.660 --> 17:13.660]  And your toaster can be plugged into the power outlet.
[17:13.760 --> 17:16.160]  And your computer plugged into your CAP5 lines in your house.
[17:16.760 --> 17:21.440]  So, well, this means that the lowest hanging fruit can be exploited from a medium standpoint.
[17:21.800 --> 17:25.560]  There are a couple mediums that actually extend beyond your house.
[17:25.560 --> 17:29.840]  So, it wouldn't even require you to be in the home to exploit them.
[17:29.980 --> 17:31.560]  And that's wireless and EOP.
[17:34.360 --> 17:36.240]  Just, we're not going to go into wireless.
[17:36.500 --> 17:40.220]  I mean, that wireless security has obviously been beaten into the ground.
[17:40.220 --> 17:43.100]  So, we should all know that, you know, wireless security.
[17:43.840 --> 17:43.920]  Okay.
[17:44.780 --> 17:50.880]  EOP, on the other hand, allows Ethernet communications basically over your household power lines.
[17:51.120 --> 17:52.880]  And this is very cool technology.
[17:52.880 --> 17:58.700]  And, you know, just thinking about it, you're like, okay, you know, Ethernet over power.
[18:00.160 --> 18:02.120]  You know, how far does that go?
[18:02.460 --> 18:04.460]  And I actually have some of these devices.
[18:04.460 --> 18:06.260]  And I had them, you know, plugged into my house.
[18:06.300 --> 18:09.100]  And I was like running around my house inside.
[18:09.100 --> 18:11.840]  And, of course, I was getting a great ping on everything.
[18:12.040 --> 18:15.680]  And then I went outside and started hitting up the outlets on the outside of my house.
[18:15.880 --> 18:17.020]  And had a great ping.
[18:17.020 --> 18:18.660]  And then I was going to my neighbor's house.
[18:19.040 --> 18:23.540]  And come to find out, we're still doing research into finding out just how far that signal goes.
[18:24.340 --> 18:28.420]  And think about, you know, connected technologies like this in like a skyscraper.
[18:28.480 --> 18:30.320]  I mean, I work in a skyscraper.
[18:30.340 --> 18:34.300]  And I can't even imagine how far that that would travel through the electrical system.
[18:34.300 --> 18:41.020]  So you could actually get an office next to, you know, a company that you're trying to, you know, perform espionage on.
[18:41.160 --> 18:44.900]  And actually possibly get into their local network if they had some of this technology going.
[18:45.380 --> 18:46.240]  That was nasty.
[18:48.180 --> 18:48.600]  Okay.
[18:48.800 --> 18:49.020]  Go ahead.
[18:49.300 --> 18:51.600]  They only go as far as a transformer.
[18:52.080 --> 18:53.100]  As far as the transformer?
[18:54.080 --> 18:54.500]  Yeah.
[18:54.700 --> 18:56.260]  I don't think you can get the Ethernet through a transformer.
[18:56.700 --> 18:58.520]  Plug at the bottom of the streetlight.
[18:59.040 --> 19:00.360]  Plug at the bottom of the streetlight?
[19:01.300 --> 19:01.720]  Hmm.
[19:01.960 --> 19:02.320]  Hmm.
[19:03.960 --> 19:04.660]  Go ahead.
[19:05.580 --> 19:06.180]  Yes.
[19:08.600 --> 19:10.140]  So fingerprinting a home.
[19:11.040 --> 19:12.160]  That's very cool.
[19:13.180 --> 19:17.440]  This takes on a whole new approach when you're talking about IPv6.
[19:18.180 --> 19:27.880]  So if you have every, you know, if your toaster, your fridge, everything has a globally routable IPv6 address, it would be possible to fingerprint a home.
[19:27.880 --> 19:37.960]  So now you're talking about, you could be giving, you know, a thief a pretty good idea of, you know, your plasma TV, your, what kind of fridge you have.
[19:38.380 --> 19:39.440]  All this information.
[19:39.740 --> 19:51.080]  And I can foresee in the future if this technology starts rolling out and becoming widely accepted, you'll actually have databases, fingerprinting databases that will, you know, tell you, oh, that's, you know, probably a toaster.
[19:51.080 --> 19:59.400]  You know, it may even be built into Nmap, you know, toaster version two, you know, or fridge version one, outdated, you know, exploit.
[19:59.800 --> 20:04.060]  That would be really funny to see, like, the Metasploit project with, like, you know, exploits built in for fridge.
[20:04.060 --> 20:05.000]  I got a shell!
[20:05.340 --> 20:05.520]  Yes!
[20:08.820 --> 20:11.100]  Vulnerabilities don't just have to be buffer overflows.
[20:11.320 --> 20:15.140]  Companies are really good at creating their own vulnerabilities through process.
[20:15.440 --> 20:21.600]  So, you have process vulnerabilities which are, can be exploited by taking advantage of the way they do things.
[20:21.760 --> 20:27.340]  Whether, you know, it's a vulnerability in authorization or a vulnerability in authentication.
[20:29.420 --> 20:30.100]  Let's see here.
[20:30.260 --> 20:31.680]  Because, yeah, okay.
[20:32.260 --> 20:35.780]  Process vulnerabilities take advantage of steps in the process that are not properly checked.
[20:36.400 --> 20:37.940]  Because they are not thought of ahead of time.
[20:38.100 --> 20:40.080]  Because the manufacturers didn't care at the time.
[20:40.200 --> 20:41.760]  All they do want to do is sell you stuff.
[20:42.200 --> 20:45.120]  Because they don't know how to stop it and wanted to make money anyway.
[20:45.320 --> 20:48.960]  And usually an authorization issue and stupid picture frame example.
[20:49.220 --> 20:50.700]  I wasn't supposed to say that out loud.
[20:51.320 --> 20:58.620]  The, like, an example of that would be, say, you have a picture frame technology where you can send pictures to, to, uh, grandma.
[20:59.300 --> 21:03.900]  And the, the technology works on, it creates an email address for itself.
[21:04.060 --> 21:08.600]  And all you have to do to send a picture to the picture frame is just email the picture to it.
[21:08.780 --> 21:14.140]  Well, you know, without any authorization or authentication, you could send whatever picture you wanted to, to the picture frame.
[21:15.700 --> 21:18.440]  And it's going to take manufacturers a while to get it right.
[21:19.160 --> 21:21.820]  Um, Google hacking the home is possible.
[21:22.320 --> 21:24.260]  Um, it would be really interesting to see.
[21:24.260 --> 21:31.320]  Once again, once this technology gets widely accepted, if, you know, Google's going to spider your home and find different interfaces.
[21:31.680 --> 21:38.560]  Uh, the, uh, search technologies, um, admin interfaces, user interfaces, um, can be used for fingerprinting this, you know, the system.
[21:38.800 --> 21:41.920]  And, of course, your robots.txt will save you every time, right?
[21:42.660 --> 21:44.760]  Um, video services.
[21:45.080 --> 21:47.820]  Um, these video services are usually marketed at safety.
[21:47.820 --> 21:49.620]  And I got this off of Sentinel Vision.
[21:49.980 --> 21:55.560]  And what's really funny is, is that it doesn't, it's really hard to see, but I circled it in red.
[21:55.740 --> 21:58.760]  Because, uh, it says, know if kids are home.
[21:59.040 --> 22:00.560]  It doesn't say, know if your kids are home.
[22:00.620 --> 22:01.980]  It just says, know if kids are home.
[22:02.040 --> 22:04.040]  And I'm wondering if they're marketing this to pedophiles.
[22:04.200 --> 22:07.100]  So they, like, and, and I didn't realize it at the time.
[22:07.220 --> 22:09.180]  But there's, there's a, there's a guy laying on the floor.
[22:09.320 --> 22:11.580]  And it says, feel secure with panic services.
[22:11.920 --> 22:13.420]  And I'm like, what the hell is that?
[22:13.420 --> 22:16.180]  But that's sentinelvision.com.
[22:16.540 --> 22:20.440]  And, uh, they're, that's, they're marketing internal video cameras for your home.
[22:20.560 --> 22:21.720]  And I'm sure they're secure.
[22:21.900 --> 22:26.520]  I'm, I'm almost thinking about buying the service just to find out, you know, what's going on with it.
[22:26.660 --> 22:27.460]  And how it's accessed.
[22:27.640 --> 22:29.680]  But I know it's remotely accessible.
[22:30.840 --> 22:32.720]  Uh, electronic portraits.
[22:33.040 --> 22:35.160]  This is gonna be very, very, very fun.
[22:35.340 --> 22:37.560]  And Siva is actually marketing this already.
[22:38.680 --> 22:41.280]  And, uh, you know, they're called, uh, digital family portraits.
[22:41.280 --> 22:43.040]  They're connected portrait technologies.
[22:43.300 --> 22:44.900]  Uh, you can remotely send pictures.
[22:45.560 --> 22:51.820]  Uh, wouldn't it be funny for grandma to wake up one morning with goatse and tub girl on all of her picture frames in her house?
[22:53.000 --> 22:54.480]  That's what I foresee happening.
[22:55.120 --> 22:57.920]  Um, and the logical move is to make these things wireless.
[22:58.920 --> 23:02.160]  Because people don't want wires running all over their walls, right?
[23:02.300 --> 23:04.200]  So, eventually they're gonna make these things wireless.
[23:04.480 --> 23:06.000]  Most likely not gonna be protected.
[23:06.440 --> 23:09.100]  And then grandma gets goatse and tub girl all over her walls.
[23:09.720 --> 23:12.840]  And, like, and she doesn't change them because she doesn't know how.
[23:14.240 --> 23:16.760]  And that'd be funny if she had a church meeting that morning.
[23:16.940 --> 23:17.540]  It's like, ah!
[23:20.180 --> 23:24.060]  When you bring medical systems into the picture, there's some life-threatening consequences.
[23:24.180 --> 23:27.400]  Because medical systems can be remotely monitored, remotely exploitable.
[23:27.580 --> 23:30.200]  And what about a DOS to, you know, a dialysis machine?
[23:30.660 --> 23:33.860]  I mean, it's really not funny because it would kill somebody.
[23:33.860 --> 23:36.560]  But that's the technology that they're pushing.
[23:37.260 --> 23:39.180]  And what if it accidentally happens?
[23:39.320 --> 23:42.700]  What if a, you know, what if a worm is just scanning the crap out of everything?
[23:42.700 --> 23:44.980]  And it scans a dialysis machine or something?
[23:45.320 --> 23:47.560]  Meaning you could actually kill somebody and not even do it.
[23:47.680 --> 23:50.620]  So then I guarantee they try to crucify whoever wrote the virus.
[23:52.380 --> 23:53.240]  Medicine cabinets.
[23:53.500 --> 23:56.820]  It would be really funny to replace grandpa's heart medication with Viagra.
[23:56.820 --> 24:00.520]  He's wondering why, you know, he has a loss of blood pressure or something.
[24:03.980 --> 24:11.240]  And not even just the attacks, but what about a malfunction of a medical system because of malware, you know, viruses, things like that?
[24:11.400 --> 24:13.080]  Yeah, your toes are just blue screened.
[24:13.300 --> 24:13.400]  Yeah.
[24:16.620 --> 24:17.520]  Gesture pendants.
[24:17.720 --> 24:18.420]  These are really cool.
[24:18.680 --> 24:23.660]  These are wearable jewelry that you can actually do different things with.
[24:23.660 --> 24:27.760]  So you point at a device and the gesture pendant knows that you're pointing at it and it turns on the TV.
[24:27.780 --> 24:31.500]  So you can actually, you know, break dance and point and do different things.
[24:31.840 --> 24:35.280]  Well, what about false positives or false negatives?
[24:35.580 --> 24:40.820]  I mean, are you going to like turn off your fridge and be like, damn it, you know, false negatives.
[24:41.100 --> 24:45.740]  And the assumption about this technology is that people are going to use it the way it's intended.
[24:46.200 --> 24:49.340]  I can foresee what I would use a gesture pendant for.
[24:49.660 --> 24:50.700]  Gesture pendant for.
[24:51.380 --> 24:54.260]  And, you know, we all know this worked real well in the past.
[24:54.380 --> 24:56.660]  Like, you know, you're only supposed to use things for their intended use.
[24:56.920 --> 25:00.780]  And someone is going to have sex with one of these on and it's going to be flying all over the place.
[25:01.200 --> 25:04.980]  And, you know, who knows what's going to turn on, turn off, the shades will open up.
[25:05.480 --> 25:06.440]  It'd be very funny.
[25:06.860 --> 25:08.700]  Somebody has to videotape that and put it on the Internet.
[25:10.140 --> 25:11.780]  This is one from Georgia Tech's aware home.
[25:11.980 --> 25:13.480]  It's got a bunch of little cameras in it.
[25:13.900 --> 25:15.540]  And it, you know...
[25:15.540 --> 25:16.080]  Sorry.
[25:16.080 --> 25:17.420]  You didn't want to see that anyway, did you?
[25:18.600 --> 25:18.920]  Fine.
[25:18.920 --> 25:19.380]  There it is.
[25:19.540 --> 25:20.160]  Gesture pendant.
[25:20.520 --> 25:23.920]  So, you can see he's pointing at something and he's got a whale on his...
[25:23.920 --> 25:25.020]  There's a dolphin on his shirt.
[25:26.360 --> 25:26.820]  I don't know.
[25:27.880 --> 25:28.660]  Memory aids.
[25:29.700 --> 25:37.380]  Memory aids are devices that, you know, help grandma remember that she took her medication or help you remember your shopping list or things like that.
[25:40.180 --> 25:42.220]  So, it enhances short and long-term memory.
[25:42.820 --> 25:44.820]  Attacking these could lead to some interesting results.
[25:44.960 --> 25:46.260]  Although, most of it would be for mischief.
[25:46.320 --> 25:50.020]  I mean, you know, unless you're trying to track, you know, what people were trying to remember.
[25:50.220 --> 25:52.900]  Which, I guess, could have some marketable value.
[25:53.160 --> 25:56.360]  But, you know, making someone think they did something they didn't, like take medication.
[25:57.300 --> 25:59.060]  Messing up a recipe would be really funny.
[25:59.220 --> 26:00.940]  Like, I didn't remember putting that in there.
[26:01.140 --> 26:03.180]  And, you know, creating confusing memories.
[26:03.180 --> 26:07.100]  And also, replacing icons of Tylenol with Tub Girl.
[26:07.340 --> 26:08.800]  You know, that'd be funny.
[26:09.900 --> 26:13.860]  But the larger picture is, if memory isn't used, it's lost.
[26:14.120 --> 26:21.620]  So, in essence, you could kind of say that these memory technologies are actually replacing, you know, your ability to remember yourself.
[26:21.820 --> 26:30.620]  Because part of remembering and using your brain is what, you know, they've actually done research that said, you know, the more you use it, you know, the more you keep it.
[26:30.620 --> 26:36.280]  So, that's why doctors and researchers and everybody typically don't have the memory issues later on in life that some other people do.
[26:38.300 --> 26:39.180]  Hacking your mood.
[26:40.060 --> 26:44.180]  There's a lot of technology going into place that actually finds out your mood.
[26:44.360 --> 26:45.560]  So, it's like, okay, I'm upset.
[26:45.740 --> 26:48.480]  Okay, you know, I didn't realize I was upset, you know.
[26:48.640 --> 26:50.460]  So, but your house will tell you you're upset.
[26:50.620 --> 26:54.620]  And maybe put, like, change, you know, the walls or something to suit your mood.
[26:54.820 --> 26:58.800]  Well, you could actually attack that technology and make people think they were sad.
[26:58.800 --> 27:00.940]  And they're like, damn, I don't remember being, I don't think I'm sad.
[27:00.960 --> 27:02.960]  I was just laughing a minute ago, you know.
[27:03.100 --> 27:04.940]  So, that could be interesting.
[27:04.940 --> 27:09.020]  And also, if people know that when you're angry, things turn red.
[27:09.140 --> 27:12.820]  And they come over to your house, it's like, oh, Billy, oh, shit, I'm out of here, you know.
[27:12.920 --> 27:15.840]  So, you could actually get other people to think you're in a certain mood as well.
[27:16.640 --> 27:19.200]  And this is, that's what I call a mood pendant attack.
[27:21.020 --> 27:23.400]  RFID implants, there was a good presentation on that.
[27:25.320 --> 27:25.880]  When was it?
[27:26.040 --> 27:26.180]  Friday.
[27:26.960 --> 27:28.400]  And it was pretty good.
[27:28.540 --> 27:29.840]  I still would never get one.
[27:30.280 --> 27:32.400]  I think, for one, the technology is too new.
[27:32.560 --> 27:36.860]  And then all the virus jumping and everything else that they're doing, it's just not for me.
[27:37.360 --> 27:50.000]  And the Baja Club in Barcelona uses microchip technology so that they know when their VIP members walk in and they just put drinks on their tab and all that, but they cloned one of the implants on Friday.
[27:50.220 --> 27:52.780]  So, it'd be really funny to walk into the club, yeah, scan me.
[27:53.140 --> 27:55.400]  You know, I'm gonna run off with drinks.
[27:57.920 --> 27:58.720]  GPS implants.
[27:59.680 --> 28:03.840]  This is also, first of all, this is marketed at your kids through fear tactics.
[28:04.560 --> 28:07.760]  The scare tactics employed, well, and you can't blame them.
[28:07.860 --> 28:10.260]  I mean, scare tactics worked for our president and it worked for Hitler.
[28:10.480 --> 28:11.900]  So, I mean, why not use them in marketing?
[28:13.420 --> 28:15.440]  So, it's typically aimed at your kids.
[28:15.700 --> 28:21.020]  And the bigger picture is, what is the real issue that you're looking at?
[28:21.100 --> 28:22.280]  What are you trying to protect against?
[28:22.460 --> 28:29.800]  There's actually a greater chance of risk by doing GPS implants than there are of something actually happening to your kids.
[28:29.960 --> 28:34.180]  People don't analyze the risks well enough when, you know, taking these things into account.
[28:35.120 --> 28:37.500]  And whatever happened to just raising your kids?
[28:40.220 --> 28:46.680]  But, like I said, the larger picture, the bigger risk is the fact that, you know, most likely, it's gonna be kids that get these.
[28:46.860 --> 28:52.280]  So, now you just let everybody know, you know, whether it's through a third party or whatever, where your kids are.
[28:56.570 --> 28:57.910]  Yeah, well, yeah.
[29:00.130 --> 29:01.490]  Go ahead, go past that.
[29:02.610 --> 29:05.130]  Basically, it was misuse and exploitation of that technology.
[29:05.910 --> 29:09.790]  IR and forensics also gets really interesting with connected technologies.
[29:10.110 --> 29:22.010]  I mean, we're making assumptions that, you know, the technology is gonna log properly, you know, when most likely it's just gonna log, you know, critical system errors or something like that because they don't want to use up valuable memory in these technologies.
[29:23.410 --> 29:26.310]  It'd be really funny to, like, do forensics on a toaster, though.
[29:26.870 --> 29:31.210]  Or somebody owns a toaster and then ends up starting to own different companies with it.
[29:31.270 --> 29:31.870]  That'd be really funny.
[29:31.870 --> 29:34.770]  They trace it back and it's like, oh, my God, your toaster's attacking the world.
[29:35.030 --> 29:36.530]  Your toaster attacked China!
[29:39.570 --> 29:47.410]  There are some psychological issues with technology because any time a technological device comes out and they market it at your kids, people try to use that instead of raising their kids.
[29:47.610 --> 29:53.590]  You know, whether it's tracking them or finding out where they are or, you know, just basically putting them on lockdown.
[29:53.650 --> 30:00.270]  And I have a true story about this, which is not very long, but I grew up with this girl who was a strict Bethel Baptist.
[30:00.470 --> 30:02.090]  She couldn't even wear pants, for Christ's sakes.
[30:02.210 --> 30:06.270]  Had to wear, you know, this culotte skirt type things and she hated them or whatever.
[30:06.470 --> 30:09.310]  She grew up to be the biggest slut on the planet.
[30:09.450 --> 30:11.610]  I think she had sex with everybody in school except for me.
[30:11.810 --> 30:12.570]  That's my luck.
[30:12.570 --> 30:19.330]  And, you know, so if you push people too hard one way, it always comes back way worse.
[30:20.490 --> 30:21.750]  Jean's getting IM'd.
[30:22.130 --> 30:22.710]  Yeah, yeah, yeah.
[30:24.130 --> 30:25.770]  Possible rejections with technology.
[30:26.430 --> 30:32.090]  Maybe this technology is, you know, too intrusive and people don't want it, but most likely that's not the case.
[30:32.230 --> 30:33.070]  People will eat it up.
[30:33.170 --> 30:35.130]  I mean, look at what happened with Paris Hilton's sidekick.
[30:35.350 --> 30:40.190]  There was this whole thing where her sidekick got owned and that was the way everybody thought it happened.
[30:40.190 --> 30:42.870]  So, everybody's like, oh shit, T-Mobile has a sidekick?
[30:43.070 --> 30:43.910]  Damn, I need to get one.
[30:44.190 --> 30:45.810]  So, we love to get owned.
[30:48.730 --> 30:51.530]  We will forego our privacy because shit's cool.
[30:52.770 --> 30:53.550]  And guess what?
[30:53.730 --> 30:54.490]  Vendors lie.
[30:54.810 --> 31:00.190]  You know, I laugh at all these new commercials that are coming out like city identity theft solutions.
[31:00.190 --> 31:03.750]  Like they have this dizzy blonde and she's like, I got his password online.
[31:03.930 --> 31:05.110]  I mean, that doesn't happen.
[31:05.230 --> 31:10.310]  Or the two redneck guys who bought like motorcycles with some dude's account.
[31:10.450 --> 31:10.970]  I mean, come on.
[31:11.030 --> 31:11.730]  That's not realistic.
[31:12.070 --> 31:15.290]  And another one is AT&T's new security solutions they have.
[31:15.390 --> 31:21.010]  They have this person walking around and I can, you know, I'm saying password in German and I'm doing this.
[31:21.010 --> 31:24.110]  And I can say secure in Chinese, you know.
[31:24.450 --> 31:30.310]  Secure, I tell you what, if you believe that, you better learn to say douchebag in a couple of those languages because that's what you're going to be.
[31:31.650 --> 31:32.150]  Go ahead.
[31:33.230 --> 31:34.330]  Okay, smart cars.
[31:34.550 --> 31:39.430]  Just a little bit about smart cars because we're, like I said, I have no idea how many slides we went through already.
[31:40.310 --> 31:47.930]  But smart cars connect back to the home so you can do, you know, so you can check your house, open your garage door.
[31:47.930 --> 31:50.630]  Well, a little bit more complicated than opening a garage door.
[31:50.870 --> 31:53.430]  I mean, we have that technology now and it hasn't been, you know, too bad.
[31:53.810 --> 31:59.730]  But, you know, turning off your alarms, you know, starting a meal that's in your oven, all that.
[32:00.790 --> 32:05.350]  It's tracked by, you know, if you have GPS, it can be tracked by law enforcement, third parties.
[32:06.430 --> 32:11.110]  And largely because they force the technology down your throat by holding your kids over your head.
[32:11.210 --> 32:13.530]  I mean, OnStar is the best at that.
[32:13.970 --> 32:16.690]  You don't care about my feelings, you know.
[32:17.250 --> 32:18.930]  Okay, that wasn't funny, so don't laugh, please.
[32:20.270 --> 32:25.530]  There's a company in Australia that's marketing this technology.
[32:26.670 --> 32:29.610]  So, let's look at, you know, what happens when somebody steals your car.
[32:29.910 --> 32:32.770]  You know, now they're, you know, connected back to your home.
[32:32.910 --> 32:34.250]  And the company said...go ahead.
[32:34.410 --> 32:42.330]  The company said that, you know, if somebody steals your car, there's no problem with that because they can't get into your home technologies.
[32:42.330 --> 32:44.910]  That's because people always log out like they should.
[32:45.670 --> 32:50.490]  There's always...there's no way anybody would ever program their home address into a GPS that they have in their car, right?
[32:52.250 --> 32:55.350]  People wouldn't want to customize any of the features to suit their needs.
[32:55.490 --> 32:58.710]  And also, people always use devices for their intended purpose.
[33:00.630 --> 33:01.030]  So...
[33:01.030 --> 33:03.930]  Most likely, all you have to do is open the glove box and look for the pin.
[33:05.530 --> 33:07.710]  Integrating biometrics into cars is stupid.
[33:08.070 --> 33:10.250]  I mean, is your car more valuable than a body part?
[33:10.390 --> 33:11.750]  I mean, everybody can see this coming, right?
[33:11.870 --> 33:13.310]  Is your car more valuable than a body part?
[33:13.490 --> 33:13.790]  No.
[33:14.010 --> 33:14.890]  To a crackhead?
[33:15.050 --> 33:15.390]  Yes.
[33:15.770 --> 33:23.430]  So, if you integrate yourself into a car, you increase the chances of having to include yourself in a carjacking.
[33:23.670 --> 33:26.990]  Either you or a body part is going to have to be included in this carjacking.
[33:27.270 --> 33:30.670]  Car theft is not going to stop because of the...what's that?
[33:31.430 --> 33:32.150]  Yeah, I know.
[33:32.330 --> 33:33.610]  That's why I said the warning.
[33:33.750 --> 33:34.590]  Everybody can see it coming.
[33:35.510 --> 33:36.910]  So, that's very bad.
[33:37.110 --> 33:40.470]  I mean, to me, the key works just fine.
[33:40.630 --> 33:44.030]  I get into the car and if somebody holds me up, I'm like, take the shit.
[33:44.110 --> 33:44.950]  I don't know, I'll buy another one.
[33:48.540 --> 33:48.980]  Okay.
[33:48.980 --> 33:52.740]  So, now we're going to get into a little more about vehicle tracking here.
[33:54.200 --> 33:56.480]  Let's discuss OnStar a little bit here.
[33:57.320 --> 33:57.760]  Question.
[33:58.000 --> 34:00.160]  Does OnStar know where I am all the time?
[34:00.160 --> 34:07.780]  No, OnStar does not continuously or routinely monitor, update, or otherwise track the location, etc., etc., etc.
[34:08.320 --> 34:10.600]  We're trying to keep the children safe.
[34:11.400 --> 34:11.920]  Whatever.
[34:12.660 --> 34:15.620]  Plus, I don't want them knowing where I go for all the good hookers.
[34:16.280 --> 34:21.520]  Now, there's a word that they use in that Q&A that's exigent that I had to go look up.
[34:23.300 --> 34:24.920]  Sorry, no college education.
[34:26.700 --> 34:28.800]  Requiring immediate action or remedy.
[34:29.120 --> 34:32.060]  In other words, any time OnStar feels it necessary.
[34:32.180 --> 34:35.460]  You know, when a three-letter organization happens to know where the hell you are.
[42:02.950 --> 42:06.530]  So, they're being touted as the...
[42:06.530 --> 42:08.630]  All right.
[42:09.370 --> 42:10.190]  Thank you.
[42:10.710 --> 42:13.010]  Now I can lower my voice and you can still hear me.
[42:14.110 --> 42:17.110]  Biometrics are being touted as the be-all, end-all security device.
[42:18.650 --> 42:20.710]  And they're really not.
[42:20.870 --> 42:22.190]  Like I said, it's not secret.
[42:22.390 --> 42:26.130]  And we were going to go into more of a rant on this and give you some examples.
[42:26.130 --> 42:31.290]  But a guy named Zamboni did a presentation at last year's DEFCON.
[42:31.490 --> 42:34.470]  And if you go out there, you can download the presentation for free.
[42:34.570 --> 42:39.530]  And it's a very good overview of, you know, the technology, different attack points.
[42:39.770 --> 42:42.290]  You know, and he explains it a lot better than I could.
[42:45.910 --> 42:48.470]  Oh, the protected resource has to be...
[42:49.070 --> 42:51.170]  You know, it can't be more valuable than a limb.
[42:51.430 --> 42:54.430]  It actually ties back into the whole rant about the cars.
[42:55.010 --> 43:02.050]  You know, if it's a fingerprint that's required to get into a building, you know, somebody chops off your finger, you're kind of screwed.
[43:03.990 --> 43:04.350]  Okay.
[43:04.490 --> 43:05.250]  I did put it in there.
[43:05.410 --> 43:06.550]  Zamboni's DEFCON presentation.
[43:06.750 --> 43:07.230]  There's a link to it.
[43:08.570 --> 43:09.970]  Sorry that it didn't stay up there very long.
[43:10.050 --> 43:10.870]  You can get with us afterwards.
[43:11.790 --> 43:12.150]  Okay.
[43:12.490 --> 43:13.870]  Identity theft, which...
[43:13.870 --> 43:16.110]  It's basically fraud, according to Bruce Schneier.
[43:17.010 --> 43:21.810]  You know, scam artists get your info and exploits it via bank account fraud, PayPal, Amazon.
[43:23.290 --> 43:26.230]  I'm sure you all have seen several phishing letters.
[43:26.750 --> 43:29.850]  And they're pretty much all social engineering attacks.
[43:30.750 --> 43:32.610]  Or stolen data, more than a few.
[43:33.450 --> 43:34.730]  They're getting better at it.
[43:34.910 --> 43:35.890]  They're using better English.
[43:36.310 --> 43:39.030]  Scam sites look much more official.
[43:40.210 --> 43:42.430]  Sometimes they even have valid SSL certs.
[43:43.350 --> 43:45.730]  And they obfuscate the URLs.
[43:48.070 --> 43:49.290]  Any veterans in the house?
[43:49.510 --> 43:50.630]  You don't have to raise your hand.
[43:50.730 --> 43:51.870]  Just think about it.
[43:52.270 --> 43:53.290]  Did you get one of these letters?
[43:55.030 --> 43:56.790]  I don't know about you, but I'm pissed.
[44:02.020 --> 44:02.460]  Okay.
[44:02.660 --> 44:12.060]  So we went through and did a little experiment to figure out how much space a 26.5 million record database would take up.
[44:12.060 --> 44:15.200]  And thank the gods for bash scripts on this.
[44:18.720 --> 44:20.320]  Ended up being about 40 gigabytes.
[44:20.780 --> 44:26.180]  Because I was thinking that maybe their mainframe got hacked and they were just using this laptop thing as an excuse.
[44:26.560 --> 44:28.340]  Well, not necessarily.
[44:29.660 --> 44:31.240]  Came out to be about 40 gigs.
[44:31.740 --> 44:33.900]  Pretty easily fits on an external drive.
[44:35.680 --> 44:37.380]  But they recovered the laptop.
[44:37.760 --> 44:38.100]  Yeah.
[44:38.280 --> 44:39.880]  After two f*cking months.
[44:42.140 --> 44:44.520]  Who knows really what happened to it.
[44:45.060 --> 44:47.460]  It's damn easy to mount a hard drive read only.
[44:47.940 --> 44:49.860]  This is a policy issue.
[44:50.140 --> 44:53.760]  The contractor had written permission to take that data out of the building.
[44:54.500 --> 44:55.140]  Yes.
[44:56.200 --> 44:57.160]  Since 2002.
[45:02.380 --> 45:03.000]  Yes.
[45:03.660 --> 45:07.320]  You would think they put a GPS device on the laptop to track it.
[45:07.480 --> 45:07.580]  Yeah.
[45:12.170 --> 45:19.090]  President Asmunch also has been very nice to deny 160 million dollars to protect our veterans.
[45:19.330 --> 45:24.470]  Despite the fact that he starts a useless war and causes more veterans.
[45:28.780 --> 45:31.200]  You don't control your personal data anymore.
[45:32.040 --> 45:33.480]  Visa has had records stolen.
[45:33.760 --> 45:35.300]  MasterCard has had records stolen.
[45:35.820 --> 45:36.640]  State of Oregon.
[45:37.120 --> 45:37.460]  Et cetera.
[45:37.620 --> 45:37.900]  Et cetera.
[45:38.000 --> 45:38.460]  Ad nauseam.
[45:39.940 --> 45:41.680]  Even places you've never done business with.
[45:41.980 --> 45:43.360]  Who the hell is ChoicePoint?
[45:43.780 --> 45:47.800]  And why did they sell 160,000 records to identity thieves?
[45:48.060 --> 45:49.280]  Because they wanted to make money.
[45:50.920 --> 45:52.320]  And they were the only ones paying.
[45:54.080 --> 45:59.340]  So, what happens when that database contains the info for your smart house or your smart car gets stolen?
[45:59.580 --> 46:00.200]  And it will.
[46:01.660 --> 46:04.600]  Now, again, they have full access to your vehicle and your home.
[46:06.300 --> 46:06.740]  Okay.
[46:06.980 --> 46:08.780]  And we made it just in time for questions.
[46:09.040 --> 46:13.180]  So, hopefully, we have some interesting questions that we can't answer.
[46:13.280 --> 46:14.140]  Because those are the best kind.
[46:15.880 --> 46:16.320]  Okay.
[46:16.420 --> 46:16.640]  Thank you.
[46:16.820 --> 46:16.880]  No.
[46:17.540 --> 46:18.180]  Just kidding.
[46:18.180 --> 46:20.340]  Can you put the address for the slides?
[46:20.720 --> 46:21.780]  Oh, for...
[46:21.780 --> 46:22.020]  It's...
[46:22.020 --> 46:22.340]  Yeah.
[46:23.080 --> 46:25.960]  It's hackerpimps.com forward slash docs.html.
[46:26.300 --> 46:27.600]  But since we're lazy, it's not up yet.
[46:28.140 --> 46:28.620]  So...
[46:28.620 --> 46:29.480]  I mean, you put it...
[46:29.480 --> 46:30.780]  You put it up on the...
[46:30.780 --> 46:31.360]  Yeah.
[46:31.900 --> 46:33.260]  He has to go back to it.
[46:33.600 --> 46:35.540]  He's hung over and he's not listening.
[46:35.760 --> 46:36.200]  I am not.
[46:36.700 --> 46:37.720]  Go back to what?
[46:38.180 --> 46:38.940]  Slide two.
[46:39.140 --> 46:39.340]  Okay.
[46:40.980 --> 46:41.560]  Go ahead.
[46:41.560 --> 46:54.280]  Have you guys found while looking at, I guess, various devices, admin interfaces, et cetera, you know, much like, I guess, like Wi-Fi routers, that they have security features, but that they're not enabled by default?
[46:54.420 --> 46:54.840]  That's correct.
[46:55.060 --> 46:56.000]  Even the little...
[46:56.000 --> 47:00.820]  The home plug devices, it says it's got a 56-bit DES encryption.
[47:01.120 --> 47:04.560]  And there's like a little key on the back of it, I guess, but nobody ever uses that.
[47:04.620 --> 47:08.420]  You can plug them right into the wall and have them communicate with your printer or anything else.
[47:08.620 --> 47:09.020]  Nice.
[47:13.530 --> 47:14.730]  We are damn good.
[47:15.010 --> 47:16.490]  We only had one question.
[47:19.730 --> 47:21.010]  Anyway, I hope you all enjoyed it.
[47:21.090 --> 47:21.470]  Thank you.
[47:21.570 --> 47:21.710]  Thanks.