Off The Hook - 1997-04-22

[00:03.020 --> 00:04.620]  [SPEAKER_11]: All the rest of you have made this work.
[00:04.620 --> 00:11.080]  [SPEAKER_11]: I'm looking at a whole battery of people down here at KPFK in Los Angeles and those of you in KPFA.
[00:11.220 --> 00:11.780]  [SPEAKER_11]: Thank you very much.
[00:11.860 --> 00:12.680]  [SPEAKER_11]: We'll be with you tomorrow.
[00:12.820 --> 00:14.340]  [SPEAKER_11]: This is Jerry Brown for We The People.
[00:35.570 --> 00:37.730]  [SPEAKER_10]: That's small, deep, singing street life.
[00:37.990 --> 00:41.250]  [SPEAKER_10]: Do you think Shakespeare would have liked rap if he was still alive?
[00:41.890 --> 00:42.350]  [SPEAKER_05]: Probably.
[00:42.550 --> 00:43.390]  [SPEAKER_05]: He would have liked some of it.
[00:44.090 --> 00:52.270]  [SPEAKER_10]: This Tuesday at 10 p.m., the Arts Magazine celebrates Shakespeare's birthday, born the week of April 23rd, 1564.
[00:52.710 --> 00:54.510]  [SPEAKER_10]: Tremell, how would the rappers say that?
[00:54.750 --> 00:55.830]  [SPEAKER_10]: It's party time.
[00:56.270 --> 00:56.770]  [SPEAKER_10]: That's right.
[00:56.770 --> 00:58.250]  [SPEAKER_10]: This Tuesday at 10 p.m. on WBAI 99.5 FM.
[01:12.030 --> 01:20.570]  [SPEAKER_15]: And it's exactly 8 o'clock, which means it's time for another edition of Off the Hook, here on WBAI New York.
[01:26.690 --> 01:40.970]  [SPEAKER_03]: The telephone keeps ringing So I ripped it off the wall I cut myself while shaving Now I can't make a call I couldn't get much worse I
[01:46.120 --> 01:48.500]  [SPEAKER_16]: hope that's understood But make me move!
[02:42.040 --> 02:42.800]  [SPEAKER_04]: I...
[02:42.800 --> 02:43.940]  [SPEAKER_04]: I...
[02:43.940 --> 02:43.960]  [SPEAKER_04]: I...
[02:43.960 --> 02:48.140]  [SPEAKER_04]: But never young ass boy Random blonde boy I...
[02:48.140 --> 03:06.580]  [SPEAKER_04]: Identity Random blonde boy Blonde country Blonde identity You are my droid boy I real boy Speak to me, boy Doctor Dean I'm cracking, boy You getting wet, boy Big, big time, boy I said there, boy Babes and babes and babes
[03:19.730 --> 03:27.830]  [SPEAKER_15]: And it's another fun-filled edition of Off the Hook, the show about computer hackers, technology, Big Brother, all kinds of other things.
[03:27.910 --> 03:28.730]  [SPEAKER_15]: Phiber Optik is here.
[03:28.870 --> 03:29.310]  [SPEAKER_15]: Hello, Phiber.
[03:29.490 --> 03:29.750]  [SPEAKER_15]: Hello.
[03:29.930 --> 03:30.270]  [SPEAKER_15]: How you doing?
[03:30.550 --> 03:30.790]  [SPEAKER_02]: Okay.
[03:30.950 --> 03:32.010]  [SPEAKER_15]: It's been an exciting week, hasn't it?
[03:32.250 --> 03:32.710]  [SPEAKER_02]: Oh, yeah.
[03:32.790 --> 03:34.610]  [SPEAKER_15]: There's been so much going on, I don't know where to begin.
[03:34.970 --> 03:40.490]  [SPEAKER_15]: Well, it's kind of hard always to figure out where to begin, but we've got a number of things to talk about this week.
[03:41.190 --> 03:48.090]  [SPEAKER_15]: And I guess, why don't we start with one of the things we mentioned last week, and that was something known as Internet Spammers.
[03:48.630 --> 03:49.170]  [SPEAKER_15]: Spammers.
[03:49.250 --> 03:50.550]  [SPEAKER_15]: What's an Internet Spammer, anyway?
[03:51.170 --> 03:59.010]  [SPEAKER_02]: Someone, or among other things, someone who gets great pleasure out of bombarding people with junk email.
[03:59.110 --> 04:01.010]  [SPEAKER_15]: And sometimes great profit as well.
[04:01.250 --> 04:01.570]  [SPEAKER_15]: Sometimes.
[04:01.870 --> 04:07.870]  [SPEAKER_15]: Although it's hard to imagine how somebody could, with such a hated thing, get any kind of profit whatsoever.
[04:08.570 --> 04:12.970]  [SPEAKER_15]: You know, it's really kind of, I don't know, it's weird to me.
[04:12.970 --> 04:18.830]  [SPEAKER_15]: But anyway, last week we talked about this a little bit, and shortly after the program, I'm not saying there's any kind of connection here.
[04:19.050 --> 04:20.230]  [SPEAKER_15]: I hope not, anyway.
[04:20.590 --> 04:22.450]  [SPEAKER_15]: I hate to think we have that kind of power.
[04:22.670 --> 04:30.650]  [SPEAKER_15]: But somehow, somebody took down a site, a site known as Aegis.net.
[04:31.190 --> 04:33.210]  [SPEAKER_15]: Now, I believe they're what?
[04:33.250 --> 04:37.810]  [SPEAKER_15]: They provide service for various mail spammers all over the net?
[04:37.830 --> 04:39.690]  [SPEAKER_15]: Well, Aegis themselves don't.
[04:39.850 --> 04:42.170]  [SPEAKER_02]: Aegis is a network service provider.
[04:42.170 --> 04:42.530]  [SPEAKER_02]: Uh-huh.
[04:42.610 --> 04:45.030]  [SPEAKER_02]: And they're connected to Mae East.
[04:45.950 --> 04:48.690]  [SPEAKER_02]: They're a larger company that provides internet service.
[04:49.830 --> 04:53.270]  [SPEAKER_02]: Obviously, a client of theirs is the one actually doing this.
[04:53.410 --> 04:58.250]  [SPEAKER_15]: Well, I've heard people say that a lot of their, a lot of the spammers come from Aegis.
[04:58.610 --> 05:02.290]  [SPEAKER_15]: A great majority of them get their service through that particular provider.
[05:02.570 --> 05:02.730]  [SPEAKER_15]: Really?
[05:02.990 --> 05:03.950]  [SPEAKER_15]: Yeah, that's what I've heard.
[05:04.110 --> 05:07.690]  [SPEAKER_15]: I'm not sure if that's borne out in figures or facts or anything like that.
[05:07.690 --> 05:09.230]  [SPEAKER_15]: But that's, that's what I've heard.
[05:09.410 --> 05:13.970]  [SPEAKER_15]: And rumor has it in the computer underground that that's why they were targeted.
[05:14.390 --> 05:20.250]  [SPEAKER_15]: Now, it's rare for someone to be targeted to have their entire, entire internet connectivity affected.
[05:20.810 --> 05:29.230]  [SPEAKER_15]: But this, this mail bombing, well, I don't know if you want to call it mail bombing, but spamming, just getting all this junk mail, you know, to sell products.
[05:29.830 --> 05:31.990]  [SPEAKER_15]: It's really annoying, a lot of people.
[05:32.210 --> 05:38.930]  [SPEAKER_15]: Let me read you what, um, what's up on their website on the, um, uh, date of April 18th.
[05:39.170 --> 05:42.630]  [SPEAKER_15]: Aegis has suffered a concentrated and systematic attack of our network.
[05:42.930 --> 05:52.790]  [SPEAKER_15]: At this time, we cannot provide any further details except to inform you that a federal investigation is underway and that Aegis is assisting in every facet of this investigation.
[05:53.310 --> 05:57.250]  [SPEAKER_15]: And that has something to do with, uh, their Washington, um, point of presence.
[05:57.250 --> 05:59.790]  [SPEAKER_15]: Is it Washington State or D.C.?
[05:59.790 --> 06:00.550]  [SPEAKER_15]: You know, I'm not sure.
[06:00.690 --> 06:01.670]  [SPEAKER_15]: I imagine it's D.C.
[06:01.750 --> 06:03.930]  [SPEAKER_15]: because they would probably refer to it by city if it was a state.
[06:04.370 --> 06:06.250]  [SPEAKER_15]: Yeah, and, and Aegis is East Coast.
[06:06.410 --> 06:08.110]  [SPEAKER_15]: I would think that they're, that it would be D.C.
[06:08.250 --> 06:08.470]  [SPEAKER_15]: Yes.
[06:08.770 --> 06:10.430]  [SPEAKER_15]: Can I have the printed material right there?
[06:10.550 --> 06:12.850]  [SPEAKER_15]: Because there's something there that I really want to share with the probes.
[06:12.910 --> 06:13.310]  [SPEAKER_15]: Thank you very much.
[06:13.930 --> 06:16.550]  [SPEAKER_15]: Uh, that is, that is something called cyber promo.
[06:17.630 --> 06:19.610]  [SPEAKER_15]: Now, can you tell us what cyber promo seems to be?
[06:19.690 --> 06:25.590]  [SPEAKER_02]: Cyber promo, uh, would appear to be, um, cyber promo's a mailing list.
[06:25.850 --> 06:26.070]  [SPEAKER_02]: Uh-huh.
[06:26.070 --> 06:33.110]  [SPEAKER_02]: Yeah, and, uh, join over 2.3 million people who enjoy reading our informative emails.
[06:33.150 --> 06:35.830]  [SPEAKER_15]: Now, this is from www.cyberpromo.com.
[06:35.830 --> 06:46.750]  [SPEAKER_15]: And if anything, if anything would inspire somebody to become a cyber terrorist, and I, I hate both of those words, but, uh, if anything would inspire someone to do that, it's reading over this website.
[06:46.890 --> 06:53.650]  [SPEAKER_15]: Because they're just so obnoxious and so blatant in what it is that they're doing as far as clogging up people's mailboxes with junk.
[06:53.650 --> 07:03.990]  [SPEAKER_15]: Now, if you listen to this, send all the bulk email you wish at lightning fast speed from your own local dial-up account without the risk of account termination without stealing other people's resources.
[07:04.430 --> 07:07.310]  [SPEAKER_15]: Well, only that last one is something that sounds halfway decent.
[07:07.510 --> 07:13.190]  [SPEAKER_15]: But listen to this, send over 150,000 emails an hour with a 28.8 modem.
[07:13.190 --> 07:15.650]  [SPEAKER_15]: Your local dial-up account won't be shut off.
[07:15.810 --> 07:18.030]  [SPEAKER_15]: Your email campaign will be completely legal.
[07:18.030 --> 07:26.930]  [SPEAKER_15]: Now, the way that they, that they, they allege to do this is, um, is to perform all this, this trickery.
[07:27.790 --> 07:33.790]  [SPEAKER_15]: Uh, Cyber Promotions is now presenting three new technologies that will only work properly if used all together.
[07:33.790 --> 07:41.210]  [SPEAKER_15]: The first technology can change the message ID of your, of your piece of mail before your email leaves your computer.
[07:41.430 --> 07:49.030]  [SPEAKER_15]: The second technology allows you to send over 150,000 emails an hour with a single computer and modem without stealing other people's resources.
[07:49.210 --> 08:00.710]  [SPEAKER_15]: And the third technology will relay your email messages through Cyber Promotions' own proprietary high-speed relay network without identifying the domain name or IP address of the origin.
[08:00.710 --> 08:09.470]  [SPEAKER_15]: The end result is that you will be able to send all the bulk email you wish at lightning fast speed from your own local dial-up account without the risk of account termination.
[08:10.090 --> 08:12.230]  [SPEAKER_15]: And they say, wasn't that worth reading?
[08:12.530 --> 08:15.350]  [SPEAKER_15]: If you thought that was good, then wait till you read this conclusion.
[08:15.690 --> 08:25.650]  [SPEAKER_15]: Introducing Cyber Promotions Pride and Joy, the ultimate solution, the package that will forever change the bulk email industry, the one and only brand new Cyber Bomber.
[08:26.350 --> 08:30.690]  [SPEAKER_15]: They're actually marketing a piece of software called Cyber Bomber.
[08:30.710 --> 08:31.410]  [SPEAKER_15]: Cyber Bomber.
[08:31.590 --> 08:33.430]  [SPEAKER_15]: I mean, are these people out of their minds?
[08:33.810 --> 08:34.830]  [SPEAKER_15]: I mean, what is it?
[08:35.190 --> 08:37.110]  [SPEAKER_15]: They're indulging in some sort of hatred campaign?
[08:37.110 --> 08:39.650]  [SPEAKER_15]: They want to win the most hated person on the net?
[08:39.770 --> 08:41.190]  [SPEAKER_15]: Because they're well on the way to doing this.
[08:41.890 --> 08:43.070]  [SPEAKER_15]: This is unbelievable.
[08:43.450 --> 08:44.630]  [SPEAKER_15]: Have you seen things like this before?
[08:45.210 --> 08:48.370]  [SPEAKER_15]: No, I've never seen anything quite this blatant before.
[08:48.590 --> 08:49.470]  [SPEAKER_15]: Blatant is the word.
[08:50.290 --> 08:53.510]  [SPEAKER_15]: And, you know, I can only imagine what kind of response it's going to get from people.
[08:53.750 --> 08:54.550]  [SPEAKER_15]: I mean, is this true?
[09:00.710 --> 09:01.910]  [SPEAKER_02]: There's a message when it's going out.
[09:02.130 --> 09:07.990]  [SPEAKER_02]: But, I mean, as you yourself saw when you did a trace route, that you could see who their provider was.
[09:08.110 --> 09:08.670]  [SPEAKER_02]: Oh, yeah.
[09:09.170 --> 09:09.950]  [SPEAKER_02]: That's true.
[09:10.230 --> 09:11.750]  [SPEAKER_15]: It wasn't any real big secret there.
[09:11.870 --> 09:16.750]  [SPEAKER_15]: But can you send out a piece of mail and have it not be detectable?
[09:17.030 --> 09:17.370]  [SPEAKER_02]: No.
[09:17.510 --> 09:25.830]  [SPEAKER_02]: It's always going to say, whoever receives the email, if you receive the email, in the header of the message, it's going to say what system that email came from.
[09:27.450 --> 09:42.330]  [SPEAKER_02]: Even if that system decided to modify its header, if it was used as a relay, if that system modified the header of the message before it reached you, that is, if it was in the middle, then all you're going to see is the fact that it came from the last hop.
[09:42.470 --> 09:44.290]  [SPEAKER_02]: But you're still going to see that it came from somewhere.
[09:44.630 --> 09:54.710]  [SPEAKER_02]: Now, the only way that these people would be hiding where it is that this email is coming from is if they were redirecting the outgoing email to other people's mail servers.
[09:54.710 --> 09:59.350]  [SPEAKER_15]: Which they say they did at one point, but they don't do that anymore because the people got angry.
[09:59.890 --> 10:01.450]  [SPEAKER_15]: Well, I'd get angry...
[10:01.450 --> 10:03.370]  [SPEAKER_15]: Yeah, in fact, some people were doing that at 2600.
[10:03.510 --> 10:06.530]  [SPEAKER_15]: We noticed some things bouncing around that weren't coming from us.
[10:06.670 --> 10:08.270]  [SPEAKER_15]: And that's kind of nasty.
[10:08.430 --> 10:14.590]  [SPEAKER_15]: But they're claiming that they no longer need to do that because of this new method of disguising where they're coming from.
[10:14.870 --> 10:18.190]  [SPEAKER_15]: And you have to wonder, how legitimate can these people possibly be if all they have...
[10:18.190 --> 10:21.690]  [SPEAKER_15]: You know, they're sending out 150,000 of these things an hour.
[10:23.090 --> 10:28.870]  [SPEAKER_15]: And their main goal is just to remain totally anonymous and not be found.
[10:29.410 --> 10:34.890]  [SPEAKER_15]: I mean, you know, that's fine for somebody trying to get across a message of some sort that there's some risk involved in.
[10:34.930 --> 10:38.050]  [SPEAKER_15]: But these are people trying to sell, quote-unquote, legitimate products.
[10:38.550 --> 10:40.270]  [SPEAKER_15]: I don't think people like that.
[10:40.670 --> 10:41.690]  [SPEAKER_15]: I mean, I don't like...
[10:41.690 --> 10:43.830]  [SPEAKER_15]: How much junk mail do you get in your mailbox now?
[10:43.990 --> 10:45.950]  [SPEAKER_15]: I get junk mail every single day.
[10:45.990 --> 10:48.350]  [SPEAKER_15]: Over the past few months, I think it's grown.
[10:48.490 --> 10:49.350]  [SPEAKER_15]: It's skyrocketed.
[10:49.470 --> 10:49.650]  [SPEAKER_15]: Yeah.
[10:49.650 --> 10:49.670]  [SPEAKER_15]: Yeah.
[10:49.970 --> 10:54.490]  [SPEAKER_15]: Now, what can we, as mere mortals, do to fight this?
[10:54.550 --> 10:55.290]  [SPEAKER_15]: Oh, we can...
[10:55.290 --> 10:55.570]  [SPEAKER_15]: Can we do anything?
[10:55.770 --> 10:58.990]  [SPEAKER_15]: We can only hope that the powers that be take down sites like this.
[10:59.250 --> 11:02.010]  [SPEAKER_15]: See, now, I don't usually advocate things like this.
[11:02.130 --> 11:11.030]  [SPEAKER_15]: But, I don't know, when you get this worked up about it, when you see people just blatantly bombing you with all kinds of junk, you've got to do something about it.
[11:11.130 --> 11:12.970]  [SPEAKER_15]: You know, what's going to stop these people?
[11:13.270 --> 11:13.430]  [SPEAKER_15]: Yeah.
[11:13.570 --> 11:14.950]  [SPEAKER_15]: They have to get the message somehow.
[11:14.950 --> 11:22.570]  [SPEAKER_15]: Now, obviously, they don't want to hear the message from us because you can't mail them back and say, you know, I really hate you with a passion that you just could not believe.
[11:22.570 --> 11:23.390]  [SPEAKER_15]: They won't hear that.
[11:23.690 --> 11:26.270]  [SPEAKER_15]: So, you have to communicate to them in some other method.
[11:27.530 --> 11:30.790]  [SPEAKER_15]: And if it can be kept on the net, I think that's perfectly civilized.
[11:31.450 --> 11:33.530]  [SPEAKER_15]: Hopefully, that's where it will stay.
[11:33.530 --> 11:36.850]  [SPEAKER_02]: Why don't they just spam public places like Usenet?
[11:37.150 --> 11:37.670]  [SPEAKER_02]: Well, they do.
[11:37.810 --> 11:38.090]  [SPEAKER_02]: They do.
[11:38.090 --> 11:38.310]  [SPEAKER_02]: People, yeah.
[11:38.450 --> 11:45.590]  [SPEAKER_02]: Well, it used to be, you know, that used to happen a lot more often than it did in email, at least from my perspective.
[11:46.050 --> 11:46.170]  [SPEAKER_17]: Yeah.
[11:46.330 --> 11:51.530]  [SPEAKER_02]: Every so often, I would be reading a news group, and I'd see a message come across that had nothing to do with the news group.
[11:52.110 --> 11:56.790]  [SPEAKER_02]: And, obviously, you know, that was some moron who was just spamming every single solitary news group.
[11:56.810 --> 11:57.730]  [SPEAKER_02]: You saw his address.
[11:57.930 --> 11:58.090]  [SPEAKER_15]: Right.
[11:58.310 --> 12:02.710]  [SPEAKER_15]: Everybody replied to it to tell the person what a doofus he was in the first place for doing that.
[12:02.710 --> 12:06.570]  [SPEAKER_15]: And, basically, you know, he slunk away and formed a new identity and did it all over again.
[12:06.690 --> 12:06.730]  [SPEAKER_15]: Right.
[12:06.730 --> 12:07.970]  [SPEAKER_15]: But that's just how it works.
[12:08.130 --> 12:08.410]  [SPEAKER_02]: Right.
[12:08.510 --> 12:13.390]  [SPEAKER_02]: But now, it's become all too easy for these same people to do email spamming.
[12:13.450 --> 12:13.550]  [SPEAKER_15]: Yeah.
[12:13.550 --> 12:14.710]  [SPEAKER_15]: We don't even know that these are people.
[12:14.970 --> 12:20.270]  [SPEAKER_15]: I mean, these could be just, you know, dedicated machines devoted to annoying us over and over and over again.
[12:20.790 --> 12:21.410]  [SPEAKER_15]: I don't know.
[12:21.470 --> 12:23.230]  [SPEAKER_15]: I feel pretty helpless and perilous.
[12:23.370 --> 12:24.430]  [SPEAKER_15]: I think it's nothing I can do.
[12:24.550 --> 12:31.610]  [SPEAKER_02]: It's every system administrator's responsibility to disable mail relaying on their mail server.
[12:31.710 --> 12:32.030]  [SPEAKER_02]: Absolutely.
[12:32.030 --> 12:38.430]  [SPEAKER_02]: Every single system administrator who is not running a mail server for the purpose of relaying...
[12:38.430 --> 12:38.790]  [SPEAKER_02]: Well, okay.
[12:38.830 --> 12:40.410]  [SPEAKER_02]: What's the concept of mail relaying?
[12:40.730 --> 12:41.170]  [SPEAKER_02]: Basically...
[12:41.170 --> 12:41.410]  [SPEAKER_02]: Very briefly.
[12:41.810 --> 12:42.010]  [SPEAKER_02]: Okay.
[12:42.110 --> 12:42.550]  [SPEAKER_02]: Briefly.
[12:42.810 --> 12:54.830]  [SPEAKER_02]: If you're running a mail host and, say, you have multiple domains, you have people calling in from all different places, and you host a variety of domains, you can set up your mail...
[12:54.830 --> 13:02.490]  [SPEAKER_02]: You're going to think that the easiest thing to do is, okay, I'm just going to allow my send mail, for example, to relay all mail.
[13:02.670 --> 13:09.950]  [SPEAKER_02]: That is, if the destination of the email message isn't on the system that the actual mail host is, then the mail can be relayed to another site.
[13:10.190 --> 13:16.170]  [SPEAKER_02]: Well, when you install send mail, by default, it will forward on any mail to anywhere.
[13:16.310 --> 13:22.190]  [SPEAKER_02]: So, in essence, any mail host is a mail relayer, unless you take the steps to disable that.
[13:22.190 --> 13:25.830]  [SPEAKER_02]: Now, what possible good reason is there to have this enabled?
[13:26.670 --> 13:28.750]  [SPEAKER_02]: Nowadays, there is absolutely no good reason.
[13:28.850 --> 13:29.970]  [SPEAKER_02]: Okay, back in the old days.
[13:30.130 --> 13:33.970]  [SPEAKER_02]: Back in the old days, we wanted to encourage people to use email.
[13:34.150 --> 13:34.430]  [SPEAKER_02]: Uh-huh.
[13:34.770 --> 13:37.490]  [SPEAKER_02]: So that if you didn't really know...
[13:38.250 --> 13:49.050]  [SPEAKER_02]: Let's say, for example, you have access to, you know, some crappy machine that has email access, provides you with email access, but it doesn't really know how to route email everywhere in the world.
[13:49.330 --> 13:49.410]  [SPEAKER_02]: Uh-huh.
[13:49.670 --> 14:01.110]  [SPEAKER_02]: Well, just by crafting your email address, you can direct where the mail is going to go, so that you can tell it to go to a major relay host that will know how to deliver that mail anywhere in the world.
[14:01.310 --> 14:01.470]  [SPEAKER_02]: Uh-huh.
[14:01.830 --> 14:04.830]  [SPEAKER_02]: You are actually in control of your email routing, which you still are.
[14:05.210 --> 14:11.470]  [SPEAKER_02]: But if everyone goes and has to disable the fact that their send mail will relay mail, then that won't be true anymore.
[14:11.470 --> 14:13.310]  [SPEAKER_02]: But it isn't really necessary anymore.
[14:13.610 --> 14:13.710]  [SPEAKER_17]: Uh-huh.
[14:13.710 --> 14:16.130]  [SPEAKER_02]: And I think it's just a remnant of a bygone era.
[14:16.730 --> 14:21.130]  [SPEAKER_02]: Now, all mail hosts know how to deliver mail everywhere, so it isn't really necessary.
[14:21.450 --> 14:23.390]  [SPEAKER_02]: I guess that default will be changing pretty soon.
[14:23.510 --> 14:24.170]  [SPEAKER_02]: I hope so.
[14:24.310 --> 14:36.610]  [SPEAKER_02]: Right now, if you go to www.sendmail.org, right on the first page, there are instructions for administrators how to modify the send mail rules so that you will disable relaying of mail.
[14:37.650 --> 14:42.270]  [SPEAKER_15]: And I guess that's becoming increasingly necessary with all these morons out there that are bombarding us.
[14:42.270 --> 14:48.050]  [SPEAKER_15]: You know, I was thinking, though, one of the main things that I guess these people really hate is to have their privacy invaded.
[14:48.490 --> 15:02.770]  [SPEAKER_15]: You know, if you find out who is responsible, you know, an individual that is responsible for sending out, you know, hundreds of thousands of these things to, you know, unwilling receivers, I guess giving that information out is probably about the best thing you can do.
[15:03.410 --> 15:05.430]  [SPEAKER_15]: You know, maybe that will stop it once and for all.
[15:05.550 --> 15:10.190]  [SPEAKER_15]: If you know a person that is doing this, then I don't know how to, you know, find out that information.
[15:10.190 --> 15:14.230]  [SPEAKER_15]: You have to do it in an elaborate amount of, you know, tracing mail and figuring things out that way.
[15:15.050 --> 15:18.130]  [SPEAKER_15]: But if enough people do it, we'll get an answer somehow.
[15:18.390 --> 15:18.570]  [SPEAKER_15]: Yeah.
[15:18.710 --> 15:23.370]  [SPEAKER_15]: So, yeah, this is something I guess we'll be seeing this get to be more of a problem as the years go on.
[15:23.790 --> 15:34.090]  [SPEAKER_15]: It's always been a slight problem, but I just, I've really noticed it, especially when I got the mail last week saying, you can have 5 million, you know, pieces of email addresses or whatever, so you can do this too.
[15:34.290 --> 15:34.470]  [SPEAKER_15]: Yeah.
[15:34.730 --> 15:35.890]  [SPEAKER_15]: You know, that was just too much.
[15:36.150 --> 15:40.870]  [SPEAKER_15]: Because obviously these people don't want to be mailed, yet, you know, you're giving out their private information.
[15:41.030 --> 15:42.070]  [SPEAKER_15]: It's not really private information.
[15:42.190 --> 15:43.250]  [SPEAKER_15]: I mean, it is an email address.
[15:43.430 --> 15:49.170]  [SPEAKER_15]: But still, you're invading their privacy by bombarding them with junk that they obviously do not want.
[15:49.670 --> 15:52.610]  [SPEAKER_15]: I mean, I don't know what the, with the U.S.
[15:52.710 --> 15:55.610]  [SPEAKER_15]: mail, you can tell them to stop sending you mail.
[15:55.610 --> 15:58.910]  [SPEAKER_15]: Well, here you can't, because they're not telling you who they are.
[15:59.690 --> 16:00.750]  [SPEAKER_15]: So, that's...
[16:00.750 --> 16:09.290]  [SPEAKER_02]: Well, to me, the way it's like is, say, for example, you live in an apartment building, and somebody's delivering food to another apartment in your building, right?
[16:09.490 --> 16:15.650]  [SPEAKER_02]: And while they're in your building, now that they've gained access to your building, they're sticking menus under everyone's door.
[16:16.670 --> 16:18.950]  [SPEAKER_02]: And let's just say that they're doing this...
[16:18.950 --> 16:20.330]  [SPEAKER_02]: That's a problem in your building, isn't it?
[16:20.450 --> 16:20.650]  [SPEAKER_02]: Yeah.
[16:21.410 --> 16:22.250]  [SPEAKER_02]: How do I guess?
[16:22.250 --> 16:25.570]  [SPEAKER_02]: Let's say that this happens half a dozen times every day.
[16:25.710 --> 16:26.990]  [SPEAKER_02]: That could get really irritating.
[16:27.150 --> 16:27.330]  [SPEAKER_02]: Yes.
[16:27.690 --> 16:30.190]  [SPEAKER_02]: Well, that's what it's like if you get mail-bombed every single day.
[16:31.050 --> 16:32.470]  [SPEAKER_15]: To me, that's how it feels.
[16:32.470 --> 16:37.050]  [SPEAKER_15]: So, for all you New York tenants out there that are listening to this, that's what it's like.
[16:37.750 --> 16:38.610]  [SPEAKER_15]: Keep it in mind.
[16:48.620 --> 16:55.880]  [SPEAKER_15]: And this week on Off the Hook, we have a guest with us all the way up from Boston, Massachusetts.
[16:56.340 --> 17:00.060]  [SPEAKER_15]: We have someone from an organization known as the L0pht.
[17:00.120 --> 17:06.120]  [SPEAKER_15]: Just to let you know what kind of mischief these guys are up to, here's a story that I got mailed to me about 50 times in my mailbox.
[17:06.500 --> 17:07.300]  [SPEAKER_15]: Yeah, I did too.
[17:07.420 --> 17:09.720]  [SPEAKER_15]: I don't know how this happens either, but it's just, you know...
[17:09.720 --> 17:17.620]  [SPEAKER_15]: I mean, sometimes it's interesting stuff because you can, you know, actually read it and it's got something to do with your life, so I don't mind getting it that many times over.
[17:17.720 --> 17:20.000]  [SPEAKER_15]: I can just delete all the duplicates and keep one of them.
[17:20.200 --> 17:21.680]  [SPEAKER_15]: But anyway, let's get to the story.
[17:21.840 --> 17:26.240]  [SPEAKER_15]: A group of Boston-based sophisticated computer hackers called the L0pht...
[17:26.820 --> 17:28.800]  [SPEAKER_15]: Pronounced L0pht because it's not spelled that way.
[17:28.820 --> 17:31.060]  [SPEAKER_15]: It's spelled L-0-P-H-T.
[17:31.260 --> 17:34.900]  [SPEAKER_15]: And I guess I would confuse a lot of people if they didn't tell you how it was pronounced.
[17:35.980 --> 17:41.060]  [SPEAKER_15]: Anyway, they're continuing the assault of Microsoft's Windows NT operating system.
[17:41.300 --> 17:44.060]  [SPEAKER_15]: The L0pht is made available for download via their website.
[17:46.740 --> 17:54.260]  [SPEAKER_15]: With other publicly available programs, that is, that they claim can be used to steal the entire registry of passwords off a Windows NT network.
[17:54.620 --> 17:58.740]  [SPEAKER_15]: That's according to CMP Media's EE Times Online.
[17:59.280 --> 18:09.080]  [SPEAKER_15]: If you have an NT network and you have that network connected to the Internet, you're in deep trouble, says Mudge, co-author of the program, L0phtCrack.
[18:09.440 --> 18:11.500]  [SPEAKER_15]: And also an encryption expert.
[18:11.500 --> 18:31.420]  [SPEAKER_15]: Microsoft officials contacted by EE Times Online last week said they were not familiar enough with L0phtCrack to comment specifically on the more serious threat to Microsoft's flagship network operating system than other hacks that have come to light in recent weeks because it employs a spreadsheet-like interface that is far easier to use.
[18:31.520 --> 18:35.240]  [SPEAKER_15]: And you know, I think this thing is printed off the column again because that sentence didn't make any sense.
[18:35.400 --> 18:37.400]  [SPEAKER_15]: So let's just do this.
[18:37.520 --> 18:39.120]  [SPEAKER_15]: Let's bring Mudge on.
[18:39.160 --> 18:39.600]  [SPEAKER_15]: Mudge, are you there?
[18:39.820 --> 18:40.320]  [SPEAKER_15]: Yes, I'm here.
[18:40.440 --> 18:40.880]  [SPEAKER_15]: How are you doing?
[18:41.040 --> 18:41.320]  [SPEAKER_07]: All right.
[18:41.360 --> 18:41.760]  [SPEAKER_07]: How are you guys?
[18:41.900 --> 18:42.200]  [SPEAKER_15]: Okay.
[18:42.740 --> 18:49.380]  [SPEAKER_15]: So, now, how true is this story that we read part of as far as you guys taking down Microsoft and causing them terror?
[18:49.560 --> 18:53.480]  [SPEAKER_07]: Well, like any media article, there's a couple grains of truth in there.
[18:54.300 --> 18:59.980]  [SPEAKER_07]: There's a couple places where the author botched some of the information and seemed to have a couple notions of his own.
[19:00.420 --> 19:02.260]  [SPEAKER_07]: You know, what are you going to do?
[19:02.940 --> 19:04.300]  [SPEAKER_15]: Yeah, well, you tell people about it.
[19:04.340 --> 19:05.040]  [SPEAKER_15]: That's the main thing to do.
[19:05.160 --> 19:05.660]  [SPEAKER_07]: Yes, you do.
[19:06.280 --> 19:09.220]  [SPEAKER_07]: Well, you want to start going through and debunking this thing right now?
[19:09.320 --> 19:11.380]  [SPEAKER_15]: Well, let's start with what you guys did.
[19:11.540 --> 19:13.340]  [SPEAKER_15]: Now, you have this program called L0phtCrack.
[19:13.600 --> 19:14.320]  [SPEAKER_15]: What does it do?
[19:14.760 --> 19:20.920]  [SPEAKER_07]: Well, a while back, a person named Jeremy Allison, who works for Sigma Software, came out with a program called PWDump.
[19:21.140 --> 19:38.020]  [SPEAKER_07]: And what that does is it deobfuscates, basically, Microsoft had kind of hidden the way it stores its username and passwords in their registry so that it could be used with a public domain tool called Samba, which is a tool that is used to let Unix systems and NT systems share files back and forth between each other.
[19:39.300 --> 19:56.400]  [SPEAKER_07]: Once he came out with the program, the same day we wrote the initial L0phtCrack, and it takes the passwords, the user password file in its encrypted form, and runs through various and sundry mechanisms to hand back the actual user's passwords.
[19:57.580 --> 20:07.360]  [SPEAKER_07]: We have a couple unique and novel things that we had done in there, such as brute forcing through the entire key space, which for a while Microsoft was saying, well, gee, you really need to choose.
[20:07.520 --> 20:08.560]  [SPEAKER_07]: This is common sense.
[20:08.720 --> 20:09.500]  [SPEAKER_07]: Good passwords.
[20:09.820 --> 20:10.680]  [SPEAKER_07]: Don't choose cat.
[20:10.840 --> 20:11.620]  [SPEAKER_07]: Don't choose dog.
[20:12.020 --> 20:14.640]  [SPEAKER_07]: Don't choose love, sex, secret, god, money, system.
[20:14.880 --> 20:17.600]  [SPEAKER_07]: Or if you're over in Europe, Fred seems to be the most common one.
[20:17.600 --> 20:19.100]  [SPEAKER_15]: Okay, they saw the film, so they know.
[20:19.300 --> 20:19.660]  [SPEAKER_07]: Exactly.
[20:21.780 --> 20:31.200]  [SPEAKER_07]: And this kind of negates that to the point of saying, well, don't choose any password under 14 characters, even if it's A75, pound, bang, star, yada, yada, yada.
[20:33.240 --> 20:34.520]  [SPEAKER_07]: This was the initial one.
[20:34.620 --> 20:46.780]  [SPEAKER_07]: We had actually called up the people who wrote MT Crack before they had come out with it and explained how we were doing it, which, much to our chagrin, they turned around and came out with one a couple days later before we released ours, which is great,
[20:46.800 --> 20:50.720]  [SPEAKER_07]: because you need more of them out there, different people taking different views and approaches to things.
[20:53.680 --> 21:02.800]  [SPEAKER_07]: The initial version that went out, one of the notable things, which I guess made most of the press, was the fact that it had a nice, gooey graphical user interface to point and click.
[21:03.520 --> 21:08.560]  [SPEAKER_07]: Nobody's excited about, well, gee, Microsoft only does one round of DES encryption as opposed to 24.
[21:08.780 --> 21:09.720]  [SPEAKER_07]: Gee, they have no salts.
[21:10.600 --> 21:12.620]  [SPEAKER_07]: You know, they have this horrible LANMAN protocol.
[21:12.820 --> 21:15.420]  [SPEAKER_07]: They're like, ooh, nice point and click interface.
[21:15.420 --> 21:16.780]  [SPEAKER_07]: Anybody can use this.
[21:17.760 --> 21:23.120]  [SPEAKER_07]: So I think that's the reason it's getting a lot of the press, which is a good thing.
[21:23.200 --> 21:30.320]  [SPEAKER_07]: I mean, if you've got to figure out how the press plays their game, if you want to expose an underlying problem, maybe you have to candy coat it and present it in a nice package to them.
[21:30.520 --> 21:33.220]  [SPEAKER_07]: It's kind of sad to realize that's the way it works.
[21:33.280 --> 21:37.680]  [SPEAKER_15]: Well, I think we can pretty much predict how the press is going to react to something like this.
[21:37.780 --> 21:41.100]  [SPEAKER_15]: They're going to get most of the facts wrong and they're going to rely on panicking.
[21:41.100 --> 21:43.360]  [SPEAKER_15]: But how is Microsoft reacting?
[21:43.840 --> 21:51.260]  [SPEAKER_07]: Well, the funny thing, the one-line Microsoft officials contacted last week said they were not familiar enough with L0phtCrack to comment specifically about it.
[21:51.340 --> 21:52.280]  [SPEAKER_07]: I find that rather funny.
[21:52.700 --> 22:05.420]  [SPEAKER_07]: I talked to one of their head marketing people and his big comment was, well, gee, if you can brute force all of our passwords in a matter of two, three days, let's say, why can't you find something more productive to do with those two, three days' worth of time?
[22:06.740 --> 22:09.420]  [SPEAKER_07]: Well, of course, the response is, well, the computer's doing it.
[22:09.460 --> 22:11.640]  [SPEAKER_07]: I tell it to run and I am doing more productive things.
[22:13.780 --> 22:14.540]  [SPEAKER_15]: That's amazing.
[22:15.760 --> 22:19.420]  [SPEAKER_15]: So is that really the only... you haven't gotten any kind of legal threats or anything like that?
[22:19.580 --> 22:21.940]  [SPEAKER_07]: No, we haven't gotten any legal threats.
[22:22.480 --> 22:31.540]  [SPEAKER_07]: I don't think we presented it the way, well, from our advisories and our information on it, which is if you grab the package off of the L0pht, all is there.
[22:32.380 --> 22:51.020]  [SPEAKER_07]: I mean, we tried to present it in a very nice fashion, saying, look, you know, this is a problem, you know, here are a couple of purported solutions, and, you know, we really need the public to be more aware of what Microsoft's doing, and what Microsoft's doing is they're pandering relatively crappy solutions and saying they're secure because,
[22:51.280 --> 22:51.960]  [SPEAKER_07]: quote, they're secure.
[22:52.980 --> 23:06.180]  [SPEAKER_07]: And, you know, the average Joe user who's, you know, using it at work or using it at home might not necessarily have the technical expertise or the tools or the resources to actually go in and say, well, gee, what's this thing really doing?
[23:06.820 --> 23:10.260]  [SPEAKER_07]: You know, that's a large part of the L0pht's main directive.
[23:10.760 --> 23:10.980]  [SPEAKER_15]: Uh-huh.
[23:11.060 --> 23:14.280]  [SPEAKER_15]: And what kinds of things have you done in the past that also followed that?
[23:14.300 --> 23:20.620]  [SPEAKER_07]: We ripped apart S/KEY, which is a one-time password algorithm developed by BELLCORE.
[23:20.620 --> 23:25.000]  [SPEAKER_07]: We found flaws in Kerberos 4, which was developed out of MIT.
[23:25.500 --> 23:31.100]  [SPEAKER_07]: We've done numerous attacks on the Sun Microsystems operating systems.
[23:31.900 --> 23:49.040]  [SPEAKER_07]: We've done some hardware projects, such as POCSAG decoder kits, which allow you to listen to people's pages going across to their beepers, much in the same fashion that you could tune into cellular frequencies on a wideband transceiver scanner and listen to those.
[23:50.660 --> 23:54.400]  [SPEAKER_07]: Other things that we've done, we've created mischief many years ago.
[23:55.780 --> 24:12.300]  [SPEAKER_07]: We've found that we don't necessarily have the time to take the beatings from some of that, so we create our own mischief internally on our own systems now and try and basically post the output, the outcomes, the results to the general populace so that they can consume it and hopefully open up and look at things in a new perspective.
[24:12.560 --> 24:14.500]  [SPEAKER_15]: Well, how does the general populace react?
[24:14.620 --> 24:16.720]  [SPEAKER_15]: I mean, how do you get feedback from the general populace anyway?
[24:16.720 --> 24:21.780]  [SPEAKER_07]: Well, we release our exploits, if you will, on different mailing lists.
[24:22.440 --> 24:24.740]  [SPEAKER_07]: We don't do much in the way of actual printed form.
[24:25.460 --> 24:29.300]  [SPEAKER_07]: We do it through our web page, which is currently getting about 50,000 hits a day.
[24:31.180 --> 24:35.000]  [SPEAKER_07]: And the general public has been really happy for the most part.
[24:35.300 --> 24:49.060]  [SPEAKER_07]: Once in a while you get some people who are just upset and think we're nothing but troublemakers, but they're relatively few and far between, which we're really happy to say, because we always try and come out with solutions or, if nothing else, to say,
[24:49.160 --> 24:59.060]  [SPEAKER_07]: look, this is a coding mistake done in the way they developed this program, and hopefully other people doing development work will be able to say, oh, jeez, I was going to do that in my program here.
[24:59.060 --> 25:12.500]  [SPEAKER_07]: Where, now with this explanation and this example and a proof of concept showing why it's a problem, because without a proof of concept showing it's a problem, people will just brush over it, you know, hopefully they'll improve their software and everybody will have a better product.
[25:12.700 --> 25:16.260]  [SPEAKER_15]: So, how would you compare yourself to an organization like CERT, for instance?
[25:16.900 --> 25:17.320]  [SPEAKER_15]: Oh.
[25:18.880 --> 25:20.500]  [SPEAKER_15]: Without it using any profanity.
[25:20.980 --> 25:21.640]  [SPEAKER_07]: Oh, thank you.
[25:23.160 --> 25:25.920]  [SPEAKER_07]: Well, A, we don't make any money off this.
[25:26.540 --> 25:36.400]  [SPEAKER_07]: CERT being originally a government-funded organization, which now seems to be entirely funded by the private sector and in it for the money, we give credit where credit's due.
[25:37.140 --> 25:47.660]  [SPEAKER_07]: If we based our work off of somebody else's work, you know, we're right up front with it, and we try and give it to people in a timely fashion, none of which are things that CERT seems to do.
[25:48.840 --> 25:53.400]  [SPEAKER_07]: CERT is a bit of an old boy's network, and it's internal.
[25:53.720 --> 25:57.500]  [SPEAKER_07]: And a couple of the things that they have really hinder them in their work.
[25:58.280 --> 26:09.380]  [SPEAKER_07]: One, they have such a huge name recognition that they get people on board, and within a matter of a week, having no previous experience in the field, they're labeling themselves as, you know, experts in the industry.
[26:10.820 --> 26:27.820]  [SPEAKER_07]: The other thing is that they have a policy where, whereas if a problem is found in a piece of software or a piece of code or something that's, you know, on the Internet that could put a lot of people at risk, say, for instance, an operating system that's holding all of your financial data,
[26:29.060 --> 26:37.920]  [SPEAKER_07]: they will not go public with it until they've contacted that company, which is a good thing, and contacted all the other companies that they think it's affected.
[26:38.280 --> 26:43.120]  [SPEAKER_07]: And then all the other companies have come back and said, either we have a fix or we don't have a fix.
[26:43.440 --> 26:47.100]  [SPEAKER_07]: Now, here's a really interesting thing to do if somebody has a lot of spare time on their hands.
[26:47.540 --> 26:51.160]  [SPEAKER_07]: We were thinking, actually, about releasing a L0pht advisory on CERT advisories.
[26:51.600 --> 26:59.880]  [SPEAKER_07]: You can go through the CERT advisories and find the standard companies that they list that they've been working with, such as Harris Computing, Sun Microsystems.
[26:59.880 --> 27:05.240]  [SPEAKER_07]: And you'll definitely find a lot of older Department of Defense groups working with them.
[27:06.160 --> 27:15.300]  [SPEAKER_07]: They will only mention the company in an advisory if that company is not vulnerable or if they were vulnerable and already have a fix in place.
[27:15.300 --> 27:23.260]  [SPEAKER_07]: If the company is vulnerable and either refuses to fix it or, you know, doesn't have a fix for it at the time, they will leave them absent.
[27:23.260 --> 27:32.360]  [SPEAKER_07]: And it is quite apparent through a little traffic analysis in what names you see and all of a sudden somebody is notably absent that this person is still vulnerable.
[27:33.040 --> 27:33.480]  [SPEAKER_15]: Wow.
[27:33.660 --> 27:34.240]  [SPEAKER_15]: You're right.
[27:34.440 --> 27:38.600]  [SPEAKER_15]: I mean, you see one advisory and then the next one suddenly doesn't have this name.
[27:38.880 --> 27:42.500]  [SPEAKER_07]: Yeah, it lists Sun and Apple and Next and, you know, SGI.
[27:42.520 --> 27:45.960]  [SPEAKER_07]: And the next one lists Sun and Apple and Next.
[27:46.220 --> 27:47.160]  [SPEAKER_07]: And that's it.
[27:47.400 --> 27:51.260]  [SPEAKER_07]: And you realize, well, gee, that was the printing subsystem.
[27:51.260 --> 27:53.440]  [SPEAKER_07]: And they're all based off the same printing subsystem.
[27:53.680 --> 27:53.920]  [SPEAKER_15]: Uh-huh.
[27:54.060 --> 27:58.520]  [SPEAKER_07]: You know, they weren't listed either as not vulnerable or vulnerable, and here's the fix.
[27:58.740 --> 28:01.440]  [SPEAKER_15]: So CERT will let this go on for an unlimited amount of time?
[28:01.700 --> 28:01.920]  [SPEAKER_07]: Yes.
[28:02.520 --> 28:03.720]  [SPEAKER_15]: Now, how about you guys?
[28:03.900 --> 28:05.320]  [SPEAKER_15]: Do you give any lead time whatsoever?
[28:05.600 --> 28:06.160]  [SPEAKER_15]: And if so, how much?
[28:06.260 --> 28:07.560]  [SPEAKER_07]: It depends on what it is.
[28:07.860 --> 28:13.880]  [SPEAKER_07]: If, for instance, the Kerberos advisory, we found that if we give them a lot of lead time, they don't do anything about it.
[28:14.080 --> 28:17.900]  [SPEAKER_07]: So we've approached companies like Security Dynamics, who make the secure ID card.
[28:18.240 --> 28:18.460]  [SPEAKER_07]: Right.
[28:18.460 --> 28:25.880]  [SPEAKER_07]: We've approached Cygnus, who is the current maintainers of the Kerberos crypto and authentication system.
[28:27.120 --> 28:32.900]  [SPEAKER_07]: And a lot of times it seems that if you say, here's a problem, and they'll come back and say, who knows about this?
[28:33.240 --> 28:36.400]  [SPEAKER_07]: And they're like, well, you know, us and potentially other hackers.
[28:36.700 --> 28:40.100]  [SPEAKER_07]: You know, anybody else who spent the time to go looking for it.
[28:40.320 --> 28:41.300]  [SPEAKER_07]: Like, oh, that's it?
[28:41.420 --> 28:43.320]  [SPEAKER_07]: Well, yeah, okay, thanks a lot for the info.
[28:43.320 --> 28:44.380]  [SPEAKER_07]: We'll look into it.
[28:44.580 --> 28:45.620]  [SPEAKER_07]: That's it, end of story.
[28:45.620 --> 29:02.900]  [SPEAKER_07]: If their customers, you know, where they're getting their money from, aren't bitching and moaning and complaining about it, then it's not worth, in their eyes, their time to pull their top developers off of whatever project they are, adding new bells and whistles to their software to go in and clean up the problems.
[29:03.220 --> 29:15.100]  [SPEAKER_07]: In reality, all they're doing is keeping their customers in the dark and keeping them vulnerable to the people who know the problems, which are the hackers, which are the people rummaging through their systems with impunity at that point.
[29:15.640 --> 29:21.220]  [SPEAKER_07]: You know, they keep their software dumb intentionally in the name of the all-powerful dollar.
[29:21.420 --> 29:23.480]  [SPEAKER_15]: So, once they do that, what's your reaction?
[29:23.660 --> 29:24.780]  [SPEAKER_07]: Oh, we go public with it.
[29:24.980 --> 29:25.120]  [SPEAKER_15]: Uh-huh.
[29:25.240 --> 29:26.300]  [SPEAKER_15]: I mean, how much time do you give them?
[29:26.360 --> 29:27.460]  [SPEAKER_15]: 48 hours a week?
[29:28.100 --> 29:28.720]  [SPEAKER_07]: We've done...
[29:28.720 --> 29:32.120]  [SPEAKER_07]: We played with SecureID, and we gave them about a year's lead time.
[29:32.260 --> 29:32.420]  [SPEAKER_15]: Really?
[29:32.520 --> 29:33.660]  [SPEAKER_07]: And they did absolutely nothing.
[29:33.900 --> 29:39.140]  [SPEAKER_07]: So, we ended up helping do some work on a paper that was released publicly out of Canada.
[29:39.460 --> 29:39.720]  [SPEAKER_15]: Uh-huh.
[29:39.720 --> 29:43.860]  [SPEAKER_07]: We were a bit nervous because they seemed that they really wanted to play hardball for a while.
[29:44.540 --> 29:46.600]  [SPEAKER_15]: Meaning, legally, they wanted to come out on you?
[29:46.720 --> 29:46.740]  [SPEAKER_07]: Yeah.
[29:47.540 --> 29:50.520]  [SPEAKER_07]: They seemed to be of the oak where...
[29:50.520 --> 29:53.760]  [SPEAKER_07]: And, great, I'll probably be getting a call from their lawyers saying, that's a slander.
[29:53.940 --> 29:54.160]  [SPEAKER_07]: Yes.
[29:55.280 --> 29:56.960]  [SPEAKER_07]: In my opinion, what...
[29:56.960 --> 30:04.200]  [SPEAKER_07]: or how it appeared to be was that they were more than happy to try and keep track of us for a while.
[30:04.400 --> 30:06.500]  [SPEAKER_07]: We kept trying to, you know, get them to change things.
[30:07.800 --> 30:21.480]  [SPEAKER_07]: And, after they were able to say, okay, this is over X amount of dollars, $500,000 worth of our money, just to try and keep track of it, try and do damage control on some of the questions you were asking, we can hand this over to the feds now because it's a federal incident.
[30:22.100 --> 30:22.400]  Uh-huh.
[30:22.440 --> 30:24.920]  [SPEAKER_07]: Because we're purporting this amount of monetary loss.
[30:25.600 --> 30:35.860]  [SPEAKER_07]: So, we were like, well, all you had to do was spend the time, you know, take your developers off what they're doing for like a day or two, have them fix this stuff, and then you're offering your customers a much better solution.
[30:35.860 --> 30:38.140]  [SPEAKER_15]: Aren't you actually doing them a favor by telling them this?
[30:38.200 --> 30:44.420]  [SPEAKER_07]: Yeah, we're doing them probably, you know, so much money's worth of free work that it's not even funny.
[30:44.660 --> 30:54.340]  [SPEAKER_07]: You have seven people who are highly talented in computer security and operating system design and secure coding practices and hardware and, you know, you name it.
[30:56.380 --> 31:05.540]  [SPEAKER_07]: And if a company actually had to pay somebody like that, you know, like we'd actually make this, you know, those would probably be, you know, a high five-digit, two, six-digit salaries each.
[31:07.340 --> 31:10.180]  [SPEAKER_15]: Has any company ever thanked you for what you've done?
[31:10.420 --> 31:16.660]  [SPEAKER_07]: Yeah, actually, one company was extremely cool about it, which was Lotus, of all companies.
[31:17.520 --> 31:21.020]  [SPEAKER_07]: Weld Pond found some problems in Lotus Domino.
[31:21.740 --> 31:28.740]  [SPEAKER_07]: And this is the same one that I forget the comedian's name who does their advertisement, Dennis Leary, that's it, saying, oh, it's secure.
[31:30.160 --> 31:31.760]  [SPEAKER_07]: So he said, well, it's not secure.
[31:31.900 --> 31:32.820]  [SPEAKER_07]: Here's the post.
[31:32.980 --> 31:36.280]  [SPEAKER_07]: Here's how to impersonate any other user where they say you can't be done.
[31:36.440 --> 31:39.420]  [SPEAKER_07]: Here's how to remove people's documents without the authority to do it.
[31:40.160 --> 31:49.240]  [SPEAKER_07]: And Lotus turned around the very next day, put up on their main Domino web page a nice, you know, here's credit to where, you know, credits due.
[31:49.360 --> 31:50.160]  [SPEAKER_07]: They did the research.
[31:50.160 --> 31:51.140]  [SPEAKER_07]: They found the problem.
[31:51.160 --> 31:51.960]  [SPEAKER_07]: And here's our fix.
[31:52.720 --> 31:53.760]  [SPEAKER_07]: We loved that.
[31:53.980 --> 31:55.380]  [SPEAKER_07]: You know, we were tickled pink.
[31:56.100 --> 32:01.960]  [SPEAKER_07]: Usually we come out with something and all the hackers say, oh, this is great, thanks, which, hey, that's a fair game.
[32:02.060 --> 32:03.040]  [SPEAKER_07]: Anybody knows it now.
[32:04.000 --> 32:05.300]  [SPEAKER_07]: And the companies do nothing.
[32:05.420 --> 32:11.200]  [SPEAKER_07]: They keep trying to spin their wheels so that, you know, they can make money and not have to worry about it, shove it under the carpet.
[32:12.360 --> 32:17.300]  [SPEAKER_07]: And then some organization like CERT will come along, post an advisory about it two months later and take credit for it.
[32:17.940 --> 32:18.340]  [SPEAKER_15]: Interesting.
[32:18.460 --> 32:19.940]  [SPEAKER_15]: Yeah, that is exactly how it works.
[32:20.340 --> 32:33.360]  [SPEAKER_15]: I was speaking with Mudge from the L0pht up in Boston about the latest, I guess, hack into Windows NT that's being misreported all over the place by the press and reacted to in various ways by Microsoft entities.
[32:33.980 --> 32:38.320]  [SPEAKER_15]: Phiber Optik here as well and I think you had something to say about S/KEY, right?
[32:38.440 --> 32:59.800]  [SPEAKER_02]: Yeah, I was curious about what you think about the fact that we've more or less been forced into using an older version of S/KEY that it's sort of nobody really ever got a chance to vote, but everybody supports S/KEY using MD4, Message Digest 4, instead of MD5 or something stronger.
[33:00.040 --> 33:22.200]  [SPEAKER_07]: Yeah, the difference between MD4 and MD5 which are both one-way hash algorithms, meaning that you hand an input that generates a random output that you won't get by handing any other input in, the main difference seems to be that it is possible in extreme cases to create duplicate hashes with MD4 as opposed to MD5.
[33:22.480 --> 33:26.980]  [SPEAKER_07]: The actual usefulness of this attack is pretty minimal.
[33:27.220 --> 33:35.320]  [SPEAKER_07]: The other thing is you can grab somebody like Vita Wenema's log daemon utilities which has S/KEY and you can compile an MD5 very easily.
[33:35.500 --> 33:38.260]  [SPEAKER_07]: They are, you know, drop-in routines to put in place for it.
[33:38.780 --> 33:52.380]  [SPEAKER_07]: What kind of chagrins me is the fact that BELLCORE released S/KEY publicly with a free version, then later put some fixes in and handed it out as a commercial version and wouldn't let...
[33:52.380 --> 33:53.600]  [SPEAKER_07]: They wouldn't let us...
[33:53.600 --> 33:57.740]  [SPEAKER_07]: They approached us a while back saying, geez, you did a lot of hacking on S/KEY.
[33:57.980 --> 33:59.620]  [SPEAKER_07]: What do you think of the new version?
[33:59.800 --> 34:02.480]  [SPEAKER_07]: I said, well, send us an example copy to play around with.
[34:02.600 --> 34:04.080]  [SPEAKER_07]: Well, you have to buy it.
[34:04.360 --> 34:05.580]  [SPEAKER_07]: I don't think so.
[34:07.160 --> 34:07.600]  [SPEAKER_15]: Wow.
[34:08.060 --> 34:14.580]  [SPEAKER_15]: Just for the benefit of those people that I know are tearing their hair out in frustration, what is S/KEY?
[34:14.660 --> 34:15.720]  [SPEAKER_15]: Just very, very briefly.
[34:15.720 --> 34:17.300]  [SPEAKER_07]: S/KEY stands for...
[34:17.300 --> 34:19.040]  [SPEAKER_07]: Well, geez, I hope I remember what it stands for.
[34:20.300 --> 34:21.960]  [SPEAKER_07]: Secure key or single key.
[34:22.300 --> 34:29.700]  [SPEAKER_07]: What happens is normally if I want to log into a computer system, so I connect to that computer system and it says, what's your username?
[34:29.920 --> 34:30.440]  [SPEAKER_07]: I say, Mudge.
[34:30.760 --> 34:31.740]  [SPEAKER_07]: It says, what's your password?
[34:31.860 --> 34:34.060]  [SPEAKER_07]: I say, love or sex or...
[34:34.060 --> 34:34.820]  [SPEAKER_07]: You know the movie.
[34:34.860 --> 34:36.140]  [SPEAKER_15]: Yeah, all the passwords we're allowed to use.
[34:36.260 --> 34:36.640]  [SPEAKER_07]: Of course.
[34:38.780 --> 34:48.980]  [SPEAKER_07]: Anybody who's sniffing on the wire and sniffing on the wire is analogous to the old party line telephones where if you pick up the line and hear your neighbor talking, out of politeness, you put it back down.
[34:49.120 --> 34:54.040]  [SPEAKER_07]: Well, if you continue to listen, that's the same thing as sniffing on an Ethernet wire or sniffing on the network.
[34:55.460 --> 35:08.700]  [SPEAKER_07]: In order to prevent you from using the same password over and over again, so that somebody sees it going by or hears it on the phone and they say, oh, I know his password is love, so now I'm going to connect and say, oh, my name is Mudge and my password is love.
[35:08.780 --> 35:09.180]  [SPEAKER_07]: Ha, ha, ha.
[35:09.220 --> 35:10.040]  [SPEAKER_07]: I'm into his system.
[35:10.040 --> 35:14.400]  [SPEAKER_07]: So what S/KEY does is S/KEY says, you know, greetings, what's your username?
[35:14.760 --> 35:14.920]  [SPEAKER_07]: Mudge.
[35:15.100 --> 35:17.580]  [SPEAKER_07]: Okay, here's your challenge and it hands you back a number.
[35:17.820 --> 35:24.180]  [SPEAKER_07]: And you plug that number into a little piece of software called a calculator and it generates the response.
[35:24.420 --> 35:27.360]  [SPEAKER_07]: And that number challenge that you get is different every time.
[35:27.360 --> 35:37.340]  [SPEAKER_07]: So, although my password might be love, I compute love against, or the software computes love against this challenge and gives me a unique response.
[35:37.580 --> 35:53.360]  [SPEAKER_07]: So I type in that response and the person watching it on the wire, if they get that response, which will be five non-sequitur terms like dog, boy, cat, bike, mountain, which, jeez, I'd love a little Freudian analysis on this.
[35:54.960 --> 35:58.480]  [SPEAKER_07]: You know, that's useless because it was only good that one time.
[35:58.700 --> 36:03.820]  [SPEAKER_07]: If they try and connect in and say, huh, I'm going to pretend I'm Mudge, my name's Mudge, it's going to give them a different challenge.
[36:04.160 --> 36:09.760]  [SPEAKER_07]: And unless they know what my secret password was that I plugged into my calculator, they don't know what the response is supposed to be.
[36:10.320 --> 36:12.300]  [SPEAKER_15]: I was curious, why is it always words?
[36:12.760 --> 36:13.960]  [SPEAKER_15]: Well, it's not always words.
[36:14.740 --> 36:16.660]  [SPEAKER_15]: I've always seen words when I've ever used this.
[36:16.760 --> 36:18.880]  [SPEAKER_07]: Yeah, that's the way that they default set it up.
[36:19.000 --> 36:27.500]  [SPEAKER_07]: You can build it in two different fashions, one where it gives you the words, one where it gives you the actual message digest hash, which is the pseudo-random string.
[36:27.760 --> 36:31.080]  [SPEAKER_07]: The words are simply so that it's easier for you to type them in.
[36:31.300 --> 36:45.140]  [SPEAKER_07]: If you had to type in 16 characters being AE375B16, yada yada, or if you can type in five words, you know, dog, boy, cat, etc., you have much less of a chance of making a mistake typing it in.
[36:45.220 --> 36:47.800]  [SPEAKER_15]: Right, I just figured most people were cutting and pasting, so it didn't really matter.
[36:47.880 --> 36:48.340]  [SPEAKER_07]: Yeah, exactly.
[36:49.640 --> 36:52.220]  [SPEAKER_15]: Okay, we're taking phone calls, 212-279-3400.
[36:52.360 --> 36:53.460]  [SPEAKER_15]: We have Mudge from the L0pht on.
[36:53.580 --> 36:54.900]  [SPEAKER_15]: I hope you can stay with us.
[36:55.000 --> 36:55.240]  [SPEAKER_15]: Oh, yeah.
[36:55.240 --> 36:55.880]  [SPEAKER_15]: Great, okay.
[36:56.080 --> 37:06.720]  [SPEAKER_15]: If you have any kinds of questions for him or about the organization, what those people up in the L0pht are doing, and are there other organizations that you know of that do similar things?
[37:08.080 --> 37:10.460]  [SPEAKER_07]: I'm sure there are lots of little hack groups all over the place.
[37:12.140 --> 37:16.020]  [SPEAKER_07]: There was one up in Massachusetts which is pretty much disbanded at this point.
[37:16.060 --> 37:19.960]  [SPEAKER_07]: It seems like everybody is relocating to California that was called New Hack City for a while.
[37:21.620 --> 37:24.200]  [SPEAKER_07]: There is the Cult of the Dead Cow, the infamous.
[37:24.500 --> 37:24.840]  [SPEAKER_07]: Yes.
[37:24.840 --> 37:28.040]  [SPEAKER_07]: Which a couple of the members of that are actually members of the L0pht, such as myself.
[37:28.400 --> 37:30.060]  [SPEAKER_07]: So I have to give a little plug for them in there.
[37:30.280 --> 37:31.920]  [SPEAKER_15]: People still bow down when you say that.
[37:32.240 --> 37:33.780]  [SPEAKER_15]: I can attest to that right now.
[37:36.000 --> 37:36.960]  [SPEAKER_07]: Too, too funny.
[37:37.180 --> 37:37.420]  [SPEAKER_15]: Yes.
[37:38.140 --> 37:41.960]  [SPEAKER_07]: Well, did you want to actually run through the article the E.E.
[37:41.960 --> 37:42.560]  [SPEAKER_07]: Times would a little bit?
[37:42.640 --> 37:46.800]  [SPEAKER_07]: Because there are some parts that you missed that are actually much more scary than what the press let out.
[37:46.940 --> 37:49.160]  [SPEAKER_07]: Not to help, you know, fan the fire, but...
[37:49.160 --> 37:53.860]  [SPEAKER_15]: Okay, well, this article is pretty much quoting the article from E.E.
[37:53.860 --> 37:54.080]  [SPEAKER_15]: Times.
[37:54.240 --> 37:55.240]  [SPEAKER_15]: It's not the article itself.
[37:56.560 --> 37:59.120]  [SPEAKER_15]: So I guess I'll read what I have here.
[37:59.380 --> 37:59.700]  [SPEAKER_15]: Okay.
[37:59.820 --> 38:02.920]  [SPEAKER_15]: But keep in mind, occasionally our printer went off the page, so it might not make any sense.
[38:02.920 --> 38:03.380]  [SPEAKER_07]: That's fine.
[38:03.460 --> 38:05.100]  [SPEAKER_07]: I have a copy in front of myself, too.
[38:05.220 --> 38:05.340]  [SPEAKER_15]: Okay.
[38:05.680 --> 38:16.240]  [SPEAKER_15]: While L0phtCrack, like other hacks before, it requires that a user have network administrative privileges to access an NT network's password encryption file, hackers note that common workarounds already exist if you know where to find them.
[38:16.320 --> 38:18.460]  [SPEAKER_15]: However, that could change soon, E.E.
[38:18.460 --> 38:25.740]  [SPEAKER_15]: Times online reports, as a worldwide network of hackers who communicate via the internet prepare an all-out assault on Windows NT.
[38:26.440 --> 38:27.780]  [SPEAKER_15]: I must have missed the battle cry.
[38:28.060 --> 38:34.100]  [SPEAKER_07]: Yeah, there was, let's see, let's see, while these hacks, yada, yada, yada, already defined them.
[38:34.300 --> 38:37.080]  [SPEAKER_07]: Much said, Microsoft has to change the way it undertakes product development.
[38:37.380 --> 38:40.700]  [SPEAKER_07]: Let's see, where was the part about Rev2?
[38:40.960 --> 38:49.300]  [SPEAKER_07]: I think what he was trying to refer to is, in our advisory, Microsoft's hiding behind, first they were hiding behind, well, don't choose simple passwords.
[38:49.820 --> 38:57.680]  [SPEAKER_07]: So then we came out with a tool saying, well, you know, good luck getting users to always choose passwords that are more than 14 characters in length.
[38:58.280 --> 39:01.380]  [SPEAKER_07]: I can't even remember some of my eight-character long Unix passwords.
[39:02.700 --> 39:11.240]  [SPEAKER_07]: But in version two, we made a claim that we were working on, well, let me back up for one second here.
[39:11.540 --> 39:14.600]  [SPEAKER_07]: Microsoft said, okay, no simple passwords.
[39:14.740 --> 39:21.000]  [SPEAKER_07]: Then they said, well, these are all non-issues, because you have to be the administrator of the system in order to get the password dumps to begin with.
[39:22.140 --> 39:34.340]  [SPEAKER_07]: What we've found are, it appears that there are actually two ways to get the administrator to get the dumps of the user registries, which are their users and the encrypted passwords, without being the administrator.
[39:35.260 --> 39:43.860]  [SPEAKER_07]: And that is pretty much going to hurt Microsoft from the standpoint of that's what they're hiding behind in their marketing right now.
[39:43.960 --> 39:45.680]  [SPEAKER_07]: That's how they're trying to downplay all of this.
[39:46.540 --> 39:57.220]  [SPEAKER_15]: Yeah, well, they're saying, to quote them, the L0pht makes a claim here, but the claim that you can basically get administrator privileges without knowing the admin password is a pretty significant claim that's unsubstantiated.
[39:57.620 --> 39:58.020]  [SPEAKER_07]: Right.
[40:00.560 --> 40:01.680]  [SPEAKER_07]: Microsoft contacted us.
[40:02.280 --> 40:05.380]  [SPEAKER_07]: We have it working in our network environment.
[40:06.280 --> 40:07.100]  [SPEAKER_07]: It is working.
[40:07.200 --> 40:10.300]  [SPEAKER_07]: You have to kind of hobble it along, so it's not really a real-world situation.
[40:10.760 --> 40:12.800]  [SPEAKER_07]: We're confident that we're going to be able to get it to work.
[40:13.300 --> 40:16.460]  [SPEAKER_07]: It's just a matter of, you know, the L0pht is not a full-time thing.
[40:16.620 --> 40:17.620]  [SPEAKER_07]: It doesn't pay us any money.
[40:17.860 --> 40:25.680]  [SPEAKER_07]: You know, we do it out of the kindness of our hearts or, you know, whatever other statistic drives or, you know, sadomasochism thing keeps us going.
[40:27.520 --> 40:29.760]  [SPEAKER_07]: Microsoft, let's see, they came back with that one.
[40:29.760 --> 40:32.780]  [SPEAKER_07]: It was funny because there's another line in here that goes along with that.
[40:32.840 --> 40:41.320]  [SPEAKER_07]: If I could find it, something saying to the extent of, well, gee, within three days, within a day, Mudge was inundated with three email messages.
[40:42.200 --> 40:48.820]  [SPEAKER_07]: Well, obviously, this guy hasn't gotten mail-bombed in a while because inundated with three email messages is not inundated at all.
[40:49.040 --> 40:51.240]  [SPEAKER_15]: That wasn't a typo by any chance, was it?
[40:51.440 --> 40:51.820]  [SPEAKER_07]: No.
[40:51.820 --> 40:56.780]  [SPEAKER_07]: Well, what I had told him was, yeah, he said, have you gotten a lot of email based off this?
[40:56.840 --> 40:57.360]  [SPEAKER_07]: I said, sure.
[40:57.480 --> 41:00.520]  [SPEAKER_07]: You know, I've been getting, you know, deluged with, you know, wonderful messages.
[41:00.520 --> 41:02.880]  [SPEAKER_07]: Some people going, well, you know, I can't get it to work.
[41:03.220 --> 41:04.960]  [SPEAKER_07]: Some people saying, oh, this is great.
[41:04.960 --> 41:05.880]  [SPEAKER_07]: I really appreciate it.
[41:05.900 --> 41:07.640]  [SPEAKER_07]: We're able to audit our NT networks now.
[41:07.920 --> 41:09.600]  [SPEAKER_07]: Some hackers going, this is fantastic.
[41:09.600 --> 41:12.720]  [SPEAKER_07]: I have some good examples out of the code that you're using, you know, all of which I love.
[41:14.280 --> 41:24.600]  [SPEAKER_07]: There were three email messages that stood out that were people going, in your advisory you state that in revision two you plan on being able to do this without being administrator.
[41:25.080 --> 41:27.300]  [SPEAKER_07]: We think we know two ways of doing it.
[41:27.560 --> 41:29.000]  [SPEAKER_07]: You know, how are you doing it?
[41:29.540 --> 41:35.140]  [SPEAKER_07]: And what was really unique about that was we're working on the ways we're doing it number two also.
[41:35.740 --> 41:39.980]  [SPEAKER_07]: So we're like, hmm, chances are these people found the same things.
[41:41.040 --> 41:46.980]  [SPEAKER_07]: So we're confident that if we don't come out with it in the near future based upon time constraints that somebody else is going to post it.
[41:47.040 --> 41:49.140]  [SPEAKER_15]: Oh yeah, that's inevitable that it's going to get out somehow.
[41:49.360 --> 41:57.300]  [SPEAKER_15]: The thing is you guys are making it, you know, open to everybody and that makes it much more likely that it'll be addressed at some point.
[41:57.440 --> 41:59.060]  [SPEAKER_15]: And that's the way it should be, I think.
[41:59.280 --> 41:59.560]  [SPEAKER_15]: Absolutely.
[42:00.260 --> 42:02.000]  [SPEAKER_15]: All right, 212-279-3400.
[42:02.140 --> 42:03.500]  [SPEAKER_15]: Let's take our first phone call.
[42:03.840 --> 42:04.380]  [SPEAKER_15]: Good evening.
[42:04.380 --> 42:04.900]  [SPEAKER_15]: You're on the air.
[42:05.540 --> 42:05.980]  [SPEAKER_08]: What?
[42:06.300 --> 42:07.360]  [SPEAKER_15]: You're on the air.
[42:07.560 --> 42:07.840]  [SPEAKER_15]: Oh.
[42:07.940 --> 42:09.240]  [SPEAKER_15]: Do you remember calling a radio show?
[42:09.400 --> 42:09.660]  [SPEAKER_08]: Oh.
[42:09.940 --> 42:10.540]  [SPEAKER_08]: Whoa, hey.
[42:10.760 --> 42:13.060]  [SPEAKER_15]: I know you've been on hold a long time, but...
[42:13.060 --> 42:13.440]  [SPEAKER_08]: Yeah.
[42:13.780 --> 42:14.060]  [SPEAKER_08]: Okay.
[42:15.020 --> 42:15.940]  [SPEAKER_08]: Hi, wow.
[42:16.080 --> 42:16.500]  [SPEAKER_15]: How you doing?
[42:17.540 --> 42:18.900]  [SPEAKER_15]: Do you have a question for our guest?
[42:20.120 --> 42:20.860]  [SPEAKER_08]: Actually, no.
[42:21.260 --> 42:24.300]  [SPEAKER_15]: Say something totally off-topic as is the case usually on this show, right?
[42:24.380 --> 42:24.580]  [SPEAKER_08]: Yeah.
[42:24.760 --> 42:25.000]  [SPEAKER_08]: Okay.
[42:27.080 --> 42:27.860]  [SPEAKER_08]: Remember Sami?
[42:28.740 --> 42:29.440]  [SPEAKER_15]: Oh, yeah.
[42:29.720 --> 42:30.440]  [SPEAKER_08]: I read the article about him.
[42:30.620 --> 42:32.160]  [SPEAKER_15]: Right, you know, I'm glad you mentioned that.
[42:32.360 --> 42:35.560]  [SPEAKER_15]: Sami was the guy that was harassing his poor family in Ontario.
[42:35.780 --> 42:36.740]  [SPEAKER_15]: We read about him last week.
[42:36.840 --> 42:39.000]  [SPEAKER_15]: Turns out it was the son in the same house.
[42:39.280 --> 42:39.520]  [SPEAKER_08]: Yeah.
[42:39.800 --> 42:41.780]  [SPEAKER_15]: I mean, how could they not have known that?
[42:41.860 --> 42:46.200]  [SPEAKER_15]: That was so simple to prove that it was the same person who was in the house already.
[42:46.200 --> 42:53.260]  [SPEAKER_15]: But yeah, it was not some super hacker someplace that was controlling the electric and the TV, you know, changing the channel on the TV set.
[42:53.420 --> 42:53.580]  [SPEAKER_15]: Yeah.
[42:53.900 --> 42:57.940]  [SPEAKER_15]: You know, it's likely that somebody in the house, they just figured it out now.
[42:58.380 --> 42:59.820]  [SPEAKER_07]: Yeah, like the old Hitchcock movies.
[43:00.240 --> 43:05.580]  [SPEAKER_15]: The mother says she's not going to press charges and they're going to seek counseling.
[43:06.160 --> 43:07.500]  [SPEAKER_15]: And that's where that stands.
[43:07.980 --> 43:12.400]  [SPEAKER_08]: It's kind of funny because if you go through the original article, it just makes it crack up.
[43:12.920 --> 43:19.440]  [SPEAKER_08]: like, you know, how this, they put, what, 600 volts through the guy's phone line?
[43:19.980 --> 43:21.780]  [SPEAKER_15]: They sent 600 volts down the phone?
[43:21.920 --> 43:21.940]  [SPEAKER_15]: Yeah.
[43:21.940 --> 43:22.680]  [SPEAKER_15]: Yeah, I don't know where they sent it.
[43:22.680 --> 43:28.360]  [SPEAKER_08]: And then the kid on the extension in the basement or something saying, oh, what did you do try to blow out my equipment?
[43:28.660 --> 43:37.200]  [SPEAKER_15]: Yeah, I mean, he knew everything that was going on, obviously, so that's why he was able to listen to conversations inside the house with the phone on the hook, you know?
[43:37.740 --> 43:39.960]  [SPEAKER_15]: Because he was in the house having the conversation.
[43:40.200 --> 43:40.440]  [SPEAKER_08]: Yeah.
[43:41.080 --> 43:41.660]  [SPEAKER_15]: Oh, boy.
[43:41.760 --> 43:44.380]  [SPEAKER_15]: I guess, you know, those Canadian Mounties, they need a little more practice.
[43:46.320 --> 43:47.160]  [SPEAKER_15]: Anything else, sir?
[43:47.320 --> 43:47.820]  [SPEAKER_08]: I don't know.
[43:48.120 --> 43:50.040]  [SPEAKER_15]: Okay, well, thanks for reminding us of that.
[43:50.200 --> 43:50.360]  [SPEAKER_15]: okay.
[43:50.720 --> 43:52.900]  [SPEAKER_15]: Glad that we settled that.
[43:53.660 --> 43:55.100]  [SPEAKER_15]: Okay, let's take another phone call.
[43:55.100 --> 43:56.880]  [SPEAKER_15]: 212-279-3400.
[43:57.020 --> 43:57.360]  [SPEAKER_15]: Good evening.
[43:59.780 --> 44:02.840]  [SPEAKER_15]: Okay, well, that's not really on topic either, I don't think.
[44:03.120 --> 44:04.040]  [SPEAKER_15]: Good evening, you're on the air.
[44:05.300 --> 44:06.720]  [SPEAKER_15]: Wow, he has two phones.
[44:06.840 --> 44:07.480]  [SPEAKER_15]: Wow, cool.
[44:07.780 --> 44:08.960]  [SPEAKER_15]: Okay, let's try again.
[44:09.120 --> 44:10.000]  [SPEAKER_15]: Good evening, you're on the air.
[44:11.600 --> 44:12.740]  [SPEAKER_15]: Don't belch, please.
[44:13.300 --> 44:13.560]  [SPEAKER_15]: Hello?
[44:13.920 --> 44:14.240]  [SPEAKER_09]: Hello.
[44:14.460 --> 44:15.080]  [SPEAKER_15]: Yes, go ahead.
[44:15.600 --> 44:20.380]  [SPEAKER_09]: Hi, Mudge, great work, keep it up, but this is nothing to do with you.
[44:20.740 --> 44:22.700]  [SPEAKER_09]: I've been out of the loop for over a year.
[44:22.840 --> 44:24.020]  [SPEAKER_09]: Whatever happened to Bernie S?
[44:24.260 --> 44:25.460]  [SPEAKER_15]: Ah, Bernie S.
[44:25.540 --> 44:25.940]  [SPEAKER_15]: Bernie S.
[44:26.140 --> 44:29.780]  [SPEAKER_15]: was released in October following all kinds of abuse.
[44:31.060 --> 44:34.380]  [SPEAKER_15]: He's currently living in Philadelphia and trying to get his life back together.
[44:34.740 --> 44:38.420]  [SPEAKER_15]: And if you want more information, you should visit our website where we have the whole updated story there.
[44:38.820 --> 44:40.080]  [SPEAKER_09]: Wonderful, thank you very much.
[44:40.220 --> 44:40.840]  [SPEAKER_15]: Okay, take care.
[44:41.700 --> 44:44.260]  [SPEAKER_15]: You think we're going to get a single call having to do with the subject tonight?
[44:44.520 --> 44:44.660]  [SPEAKER_15]: No.
[44:44.880 --> 44:45.800]  [SPEAKER_15]: Last week was good.
[44:46.000 --> 44:48.040]  [SPEAKER_15]: Last week we got almost every call having to do with the subject.
[44:48.040 --> 44:49.500]  [SPEAKER_07]: Yeah, we'll open it up to anything.
[44:50.380 --> 44:52.120]  [SPEAKER_15]: Well, if I do that, there's no hope whatsoever.
[44:52.900 --> 44:54.440]  [SPEAKER_15]: Okay, let's try this one over here.
[44:54.500 --> 44:55.040]  [SPEAKER_15]: This one looks good.
[44:55.100 --> 44:56.220]  [SPEAKER_15]: I like the looks of this light here.
[44:56.380 --> 44:56.720]  [SPEAKER_15]: Good evening.
[44:56.780 --> 44:57.240]  [SPEAKER_15]: You're on the air.
[45:00.320 --> 45:02.980]  [SPEAKER_15]: How long do you think it'll take them to realize that they're in fact on the air?
[45:03.280 --> 45:06.620]  [SPEAKER_15]: What if people go away and, you know, have food and things?
[45:06.720 --> 45:07.160]  [SPEAKER_15]: Call waiting.
[45:08.500 --> 45:10.460]  [SPEAKER_15]: Okay, let's try another one.
[45:10.480 --> 45:10.840]  [SPEAKER_15]: Good evening.
[45:10.960 --> 45:11.420]  [SPEAKER_15]: You're on the air.
[45:12.940 --> 45:13.340]  [SPEAKER_13]: Hello.
[45:13.600 --> 45:13.880]  [SPEAKER_13]: Yes.
[45:14.180 --> 45:18.260]  [SPEAKER_13]: Yes, I was going to ask a question of the gentleman, Mr. Mudge.
[45:18.400 --> 45:19.080]  [SPEAKER_13]: Sir, you are a guy.
[45:19.220 --> 45:19.500]  [SPEAKER_13]: Go ahead.
[45:19.600 --> 45:20.220]  [SPEAKER_13]: Ask your question.
[45:20.360 --> 45:20.580]  [SPEAKER_13]: Sure.
[45:20.860 --> 45:34.420]  [SPEAKER_13]: I wanted to, first of all, I'm an attorney in the area of copyright and internet and I wanted to ask both your and your guest's opinion about the U.S.
[45:34.500 --> 45:39.100]  [SPEAKER_13]: government's position concerning the new encryption codes and the key.
[45:39.560 --> 45:55.340]  [SPEAKER_13]: We had a lecture at the Harvard Club from a Mr. Kenneth dam where he was saying that the European and the German and the other countries are trying to develop a free world of information concerning encryption and yet the U.S.
[45:55.640 --> 46:06.180]  [SPEAKER_13]: government seems to be kind of torn in different directions on whether they want people to have that kind of information and I'll hang up and I would really appreciate you guys' response and the program is excellent.
[46:06.320 --> 46:06.580]  [SPEAKER_13]: Thank you.
[46:06.720 --> 46:06.960]  [SPEAKER_15]: Thanks.
[46:07.120 --> 46:09.560]  [SPEAKER_15]: And Mudge, I'll have to ask that you limit your remarks to 45 minutes.
[46:09.560 --> 46:10.660]  [SPEAKER_15]: No problem.
[46:12.100 --> 46:12.940]  [SPEAKER_07]: Well, boy, yeah.
[46:13.140 --> 46:27.440]  [SPEAKER_07]: Uncle Sam is really a bit nervous about what's going on with the European countries and basically crypto being developed abroad because for a long time the United States really held the, you know, the keys to the golden kingdom in regards to crypto.
[46:27.680 --> 46:45.600]  [SPEAKER_07]: We had some of the top people, you know, all the way back to Friedman and the Black Chamber stuff and so it was really developed largely, you know, inside the DEZ coming out of IBM with the NSA and in conjunction with Britain's groups of crypto people.
[46:46.300 --> 46:50.320]  [SPEAKER_07]: And they were really happy because it turned around and they said, well, great, we have this.
[46:50.320 --> 46:51.760]  [SPEAKER_07]: We have this as a standard now.
[46:51.860 --> 46:54.320]  [SPEAKER_07]: You know, we have all these other internal things.
[46:54.320 --> 46:55.560]  [SPEAKER_07]: We think we're really up on it.
[46:55.660 --> 47:09.120]  [SPEAKER_07]: We most likely have the ability to get into most of the systems because if you think about it, crypto systems are developed largely for times of war and if you develop a crypto system that even you can't break and the enemies get their hands on it, you know,
[47:09.180 --> 47:10.900]  [SPEAKER_07]: you've just protected the enemies from yourself.
[47:11.940 --> 47:24.540]  [SPEAKER_07]: This is really scaring our government to some extent and we have a horrible situation where, A, they're scared and, B, they're trying, the legal side is trying to really ramp up on the technology because this is all new stuff to them.
[47:25.220 --> 47:40.040]  [SPEAKER_07]: I think over the next, you know, probably year you're going to see a bunch of failed attempts to control crypto coming in, control the use of crypto developed abroad and ultimately it's going to, those attempts are going to fail and you're going to have,
[47:40.180 --> 47:46.660]  [SPEAKER_07]: which, you know, would be wonderful, the, you know, best solution available to you because you'll be able to pick and choose from whoever you want.
[47:46.860 --> 47:49.920]  [SPEAKER_15]: We've been hearing ultimately it's going to fail now though for years.
[47:50.220 --> 47:53.820]  [SPEAKER_15]: When is it finally going to fail and what's going to make it fail decisively?
[47:53.980 --> 47:56.640]  [SPEAKER_07]: Well, what's your favorite encryption cipher right now?
[47:57.240 --> 47:57.640]  [SPEAKER_15]: Oh, gosh.
[47:58.420 --> 47:58.720]  [SPEAKER_15]: Phiber?
[47:59.060 --> 47:59.420]  [SPEAKER_15]: What's yours?
[48:00.500 --> 48:00.940]  [SPEAKER_07]: RSA?
[48:01.900 --> 48:03.200]  [SPEAKER_07]: No, RSA is a good one.
[48:03.300 --> 48:04.180]  [SPEAKER_07]: What about IDEA?
[48:04.340 --> 48:20.200]  [SPEAKER_07]: I mean, if you're using symmetrical keys such as the standard DES stuff, I don't know many people or many organizations, you know, unless they're under government contract that are still, you know, I mean, banks have to still do this to a large extent that are still saying,
[48:20.300 --> 48:28.980]  [SPEAKER_07]: yeah, DES is the way to go and people are saying, well, it's a small key and there's the international data encryption algorithm IDEA developed overseas and that's really taken off.
[48:29.860 --> 48:47.480]  [SPEAKER_07]: Even when you look at something like PGP, that's just using the, you know, RSA-ish mechanism of asymmetrical key exchange and the actual payload in there is encrypted with DES, in this case, or triple DES, or IDEA as it happens to be with PGP.
[48:47.840 --> 48:54.980]  [SPEAKER_07]: So I think you'll start seeing as soon as the RSA patent runs out, you know, the ability for many more people to come up with their public-private key exchanges.
[48:55.460 --> 48:56.540]  [SPEAKER_07]: I think it's already fallen.
[48:57.420 --> 48:58.600]  [SPEAKER_15]: Okay, let's go back to the phones.
[48:58.720 --> 49:00.320]  [SPEAKER_15]: 212-279-3400.
[49:01.320 --> 49:02.440]  [SPEAKER_15]: Good evening, you're on the air.
[49:04.320 --> 49:05.060]  [SPEAKER_15]: Speak up, please.
[49:07.060 --> 49:07.900]  [SPEAKER_15]: Okay, new rule.
[49:08.080 --> 49:08.500]  [SPEAKER_15]: New rule.
[49:08.820 --> 49:09.520]  [SPEAKER_02]: You have to talk.
[49:09.700 --> 49:11.440]  [SPEAKER_15]: You have to be next to the...
[49:11.440 --> 49:14.660]  [SPEAKER_15]: No, I mean, these people, they put down the phone and they go over to the radio.
[49:14.960 --> 49:15.320]  [SPEAKER_15]: All right?
[49:15.380 --> 49:18.220]  [SPEAKER_15]: The only way you're going to do that is if, you know, you're going to have the radio next to the phone.
[49:18.340 --> 49:18.700]  [SPEAKER_15]: You can do it that way.
[49:18.700 --> 49:19.400]  [SPEAKER_09]: We got on the phone.
[49:20.140 --> 49:21.140]  [SPEAKER_15]: Okay, all right.
[49:21.480 --> 49:21.640]  [SPEAKER_09]: Yeah?
[49:22.060 --> 49:22.560]  [SPEAKER_09]: Who's there?
[49:22.740 --> 49:23.220]  [SPEAKER_15]: I don't know.
[49:23.620 --> 49:24.640]  [SPEAKER_15]: Good evening, you're on the air.
[49:27.380 --> 49:28.060]  [SPEAKER_15]: Anybody there?
[49:28.880 --> 49:29.360]  [SPEAKER_12]: I'm here.
[49:29.600 --> 49:30.500]  [SPEAKER_15]: Go ahead, speak up.
[49:31.780 --> 49:32.660]  [SPEAKER_12]: I have a question.
[49:34.440 --> 49:35.860]  [SPEAKER_12]: It's not really pretty mundane.
[49:36.040 --> 49:37.060]  [SPEAKER_12]: It's not related to your topic.
[49:38.160 --> 49:39.780]  [SPEAKER_15]: Okay, well, make it fast, all right?
[49:41.880 --> 49:43.720]  [SPEAKER_15]: Okay, you've got to speak faster than that.
[49:43.760 --> 49:44.040]  [SPEAKER_15]: I'm sorry.
[49:44.540 --> 49:45.780]  [SPEAKER_15]: Good evening, you're on the air.
[49:47.100 --> 49:47.460]  [SPEAKER_08]: Hello?
[49:47.700 --> 49:48.000]  [SPEAKER_15]: Yes.
[49:48.480 --> 49:48.840]  [SPEAKER_08]: Hello?
[49:49.320 --> 49:50.460]  [SPEAKER_15]: Yes, go ahead, speak up.
[49:53.220 --> 49:53.740]  [SPEAKER_15]: All right.
[49:54.020 --> 49:55.080]  [SPEAKER_15]: What's going on today?
[49:55.200 --> 49:56.380]  [SPEAKER_15]: They spray something in the air?
[49:57.240 --> 49:58.720]  [SPEAKER_15]: Okay, I'm going to talk a little.
[49:59.000 --> 50:01.360]  [SPEAKER_15]: Okay, please, talk into the phone.
[50:02.980 --> 50:04.700]  [SPEAKER_15]: All right, I don't know what's going on out there.
[50:04.840 --> 50:09.440]  [SPEAKER_15]: What, people invading or something and spraying stupidity through the airwaves?
[50:09.580 --> 50:11.040]  [SPEAKER_15]: Look, it's very simple, okay?
[50:11.480 --> 50:13.200]  [SPEAKER_15]: We've had, oh, you know what?
[50:13.200 --> 50:13.820]  [SPEAKER_15]: We lost Mudge.
[50:14.400 --> 50:14.760]  [SPEAKER_15]: Did we?
[50:14.760 --> 50:15.900]  [SPEAKER_15]: Yeah, I don't know how we lost him.
[50:16.000 --> 50:16.120]  [SPEAKER_15]: Huh.
[50:16.320 --> 50:17.260]  [SPEAKER_15]: I don't know how we lost him.
[50:18.040 --> 50:18.920]  [SPEAKER_15]: I wasn't talking to him.
[50:19.000 --> 50:19.800]  [SPEAKER_15]: Good evening, you're on the air.
[50:20.960 --> 50:22.380]  [SPEAKER_15]: Watch, this is going to be a question for Mudge.
[50:23.600 --> 50:23.900]  [SPEAKER_15]: Hello?
[50:24.160 --> 50:25.360]  [SPEAKER_15]: Yes, go ahead, speak up.
[50:27.620 --> 50:29.100]  [SPEAKER_15]: Well, I don't understand what's going on.
[50:29.100 --> 50:31.680]  [SPEAKER_15]: Is this some sort of worldwide conspiracy of stupidity or something?
[50:31.680 --> 50:32.600]  [SPEAKER_15]: I don't get it.
[50:33.220 --> 50:36.080]  [SPEAKER_15]: I mean, we've been doing this show now since, what, for years?
[50:36.100 --> 50:37.360]  [SPEAKER_02]: They must be new callers.
[50:38.000 --> 50:39.140]  [SPEAKER_15]: I don't know what's going on.
[50:39.940 --> 50:42.740]  [SPEAKER_15]: Everyone sounds really puzzled when they pick up the phone.
[50:44.460 --> 50:46.340]  [SPEAKER_15]: Okay, I'm really puzzled, I'll say that.
[50:47.120 --> 50:49.080]  [SPEAKER_15]: All right, let's see if this is Mudge again.
[50:49.160 --> 50:49.700]  [SPEAKER_15]: Mudge, is this you?
[50:51.520 --> 50:52.300]  [SPEAKER_15]: Mudge, are you there?
[50:54.340 --> 50:54.700]  [SPEAKER_15]: Okay.
[50:55.040 --> 50:55.520]  [SPEAKER_15]: Hello, Emmanuel?
[50:55.800 --> 50:56.540]  [SPEAKER_15]: Yes, is this Mudge?
[51:01.680 --> 51:04.060]  [SPEAKER_15]: I'm beginning to think there's something wrong with our phone system.
[51:04.200 --> 51:04.980]  [SPEAKER_15]: Mudge, can you hear me?
[51:07.040 --> 51:07.880]  [SPEAKER_15]: I guess not.
[51:08.680 --> 51:10.500]  [SPEAKER_15]: Okay, something's wrong with our phone system.
[51:10.680 --> 51:16.060]  [SPEAKER_15]: In which case, I have to apologize to everybody I've just yelled at because they can't seem to hear me for some reason.
[51:16.960 --> 51:17.280]  [SPEAKER_15]: All right.
[51:19.600 --> 51:21.600]  [SPEAKER_15]: Anybody want to take a look at this board here?
[51:22.440 --> 51:28.040]  [SPEAKER_15]: Okay, either this is a mass conspiracy of some sort and everybody...
[51:28.040 --> 51:28.500]  [SPEAKER_15]: I'm sorry?
[51:29.400 --> 51:30.740]  [SPEAKER_15]: I didn't mess anything up.
[51:30.780 --> 51:32.020]  [SPEAKER_15]: Don't accuse me of messing anything up.
[51:32.060 --> 51:32.820]  [SPEAKER_15]: I didn't touch a thing.
[51:35.320 --> 51:35.720]  [SPEAKER_15]: No.
[51:36.100 --> 51:36.500]  [SPEAKER_15]: No.
[51:36.840 --> 51:37.240]  [SPEAKER_15]: No.
[51:37.940 --> 51:39.360]  [SPEAKER_15]: Okay, I don't know what's going on.
[51:40.100 --> 51:43.880]  [SPEAKER_15]: Someone could maybe verify that we're...
[51:44.800 --> 51:45.760]  [SPEAKER_15]: No, it's not an audition.
[51:46.840 --> 51:48.660]  [SPEAKER_15]: That's the right switch.
[51:49.220 --> 51:49.620]  [SPEAKER_15]: Okay.
[51:50.160 --> 51:53.100]  [SPEAKER_15]: Obviously, nobody can hear us on the phone so we're going to have to...
[51:53.100 --> 51:54.180]  [SPEAKER_15]: We're going to have to wing it.
[51:54.280 --> 51:57.180]  [SPEAKER_15]: We're going to have to wing it and talk about things that have nothing to do with...
[51:57.180 --> 51:57.960]  [SPEAKER_15]: Hold on.
[51:58.180 --> 52:00.400]  [SPEAKER_15]: This is something where an operator can actually...
[52:00.400 --> 52:03.200]  [SPEAKER_15]: and actually help us here.
[52:03.360 --> 52:09.000]  [SPEAKER_15]: Let's contact an operator on the phone and see if they can hear us.
[52:09.460 --> 52:09.960]  [SPEAKER_15]: All right?
[52:10.040 --> 52:13.580]  [SPEAKER_15]: No point subjecting our listeners to this kind of abuse when we can abuse an operator.
[52:14.400 --> 52:14.720]  [SPEAKER_15]: right?
[52:15.680 --> 52:16.420]  [SPEAKER_15]: It's only fair.
[52:17.700 --> 52:18.480]  [SPEAKER_12]: NYNEX, can't they?
[52:18.880 --> 52:19.760]  [SPEAKER_15]: Yes, hello, operator?
[52:20.280 --> 52:20.960]  [SPEAKER_15]: Can you hear me?
[52:21.040 --> 52:22.220]  [SPEAKER_15]: This is the NYNEX operator.
[52:22.500 --> 52:23.300]  [SPEAKER_15]: Yes, can you hear me?
[52:23.900 --> 52:25.080]  [SPEAKER_15]: Operator, can you hear me?
[52:26.120 --> 52:26.760]  [SPEAKER_15]: Why, you...
[52:29.340 --> 52:30.820]  [SPEAKER_15]: See, with NYNEX, it's hard to tell.
[52:31.420 --> 52:34.120]  [SPEAKER_15]: I don't know if they wrote this tongue up on me or if...
[52:34.520 --> 52:35.680]  [SPEAKER_15]: Okay, well, it's okay.
[52:35.800 --> 52:38.300]  [SPEAKER_15]: It's not like WBAI needs its phone system or anything like that.
[52:38.460 --> 52:40.320]  [SPEAKER_15]: It's not like we need to be able to talk to our listeners.
[52:41.280 --> 52:42.660]  [SPEAKER_15]: You say anything that's obviously wrong?
[52:44.320 --> 52:45.500]  [SPEAKER_08]: I had to do that one week.
[52:45.660 --> 52:46.540]  [SPEAKER_15]: You had to do that one week?
[52:46.620 --> 52:47.240]  [SPEAKER_15]: You had to hit that little button.
[52:47.340 --> 52:49.020]  [SPEAKER_15]: Let's try NYNEX again and see if...
[52:49.020 --> 52:50.360]  [SPEAKER_08]: Well, why don't you take one of the caller?
[52:51.620 --> 52:53.600]  [SPEAKER_15]: Okay, yeah, you know, it's probably better to take a caller.
[52:53.800 --> 52:54.880]  [SPEAKER_15]: Let's see if we can take Mudge.
[52:55.080 --> 52:55.840]  [SPEAKER_15]: Mudge, are you there?
[52:56.900 --> 52:59.040]  [SPEAKER_15]: See, Mudge is here, but he can't hear us.
[52:59.700 --> 53:01.280]  [SPEAKER_15]: Let's see if we can communicate with touch tones.
[53:04.040 --> 53:04.800]  [SPEAKER_15]: Did you hear that?
[53:05.880 --> 53:07.300]  [SPEAKER_15]: Okay, I don't think you could hear that.
[53:10.100 --> 53:12.180]  [SPEAKER_07]: I don't know, they seem to be having a difficult time here.
[53:12.300 --> 53:13.560]  [SPEAKER_07]: I'm getting a touch tone burst.
[53:13.820 --> 53:14.820]  [SPEAKER_15]: Uh-huh, okay.
[53:17.100 --> 53:18.940]  [SPEAKER_15]: Let's see if we can communicate with Mudge.
[53:19.140 --> 53:20.880]  [SPEAKER_15]: Okay, he's...
[53:22.700 --> 53:23.340]  [SPEAKER_15]: This is...
[53:23.760 --> 53:25.440]  [SPEAKER_15]: Okay, he knows that there's a problem.
[53:25.920 --> 53:27.080]  [SPEAKER_15]: This guy's into cryptography.
[53:27.200 --> 53:27.980]  [SPEAKER_15]: He should be able to figure this out.
[53:28.060 --> 53:30.200]  [SPEAKER_15]: Now, there must be a way to communicate using this somehow.
[53:31.020 --> 53:31.960]  [SPEAKER_15]: Oh, pick up the phone.
[53:32.080 --> 53:34.000]  [SPEAKER_15]: Okay, you know, I could do that.
[53:35.100 --> 53:36.180]  [SPEAKER_15]: Hey, Mudge, can you hear me?
[53:37.780 --> 53:40.320]  [SPEAKER_15]: Actually, maybe somebody else could do that and I could do the radio show.
[53:41.360 --> 53:41.680]  [SPEAKER_17]: Hello?
[53:43.280 --> 53:46.540]  [SPEAKER_15]: Okay, we're trying to communicate with Mudge and tell him that there's a problem.
[53:47.380 --> 53:50.260]  [SPEAKER_15]: Unfortunately, until we figure out what's wrong with our phone system...
[53:51.040 --> 53:52.100]  [SPEAKER_15]: What, you hang up on him?
[53:52.200 --> 53:53.080]  No, I don't know what happened.
[53:53.200 --> 53:56.440]  [SPEAKER_15]: Okay, well, if that line rings again, just tell him...
[53:56.440 --> 53:57.860]  [SPEAKER_15]: Boy, we look like idiots here.
[53:58.060 --> 53:59.020]  [SPEAKER_15]: This has never happened before.
[53:59.460 --> 53:59.860]  [SPEAKER_15]: Okay.
[54:00.760 --> 54:01.840]  [SPEAKER_15]: Well, he can't hear me.
[54:05.040 --> 54:05.760]  [SPEAKER_15]: He can't...
[54:05.760 --> 54:06.580]  [SPEAKER_15]: Mudge, can you hear me?
[54:07.180 --> 54:08.720]  [SPEAKER_15]: No, I'm not hearing their end of the conversation.
[54:09.000 --> 54:09.780]  [SPEAKER_15]: You've got to pick up that phone.
[54:10.120 --> 54:11.020]  [SPEAKER_15]: Put him on hold first.
[54:12.080 --> 54:12.440]  [SPEAKER_15]: Okay.
[54:15.240 --> 54:16.660]  [SPEAKER_15]: Okay, I've got to put him on hold somehow.
[54:18.680 --> 54:20.260]  [SPEAKER_15]: You've got to figure out how that little instrument works.
[54:23.200 --> 54:28.440]  [SPEAKER_15]: Okay, well, we only have two minutes to kill now because we've spent all this time talking about the phone problems.
[54:30.840 --> 54:32.340]  [SPEAKER_15]: Do you want to read this letter that we got?
[54:32.760 --> 54:33.140]  [SPEAKER_15]: Sure.
[54:33.440 --> 54:34.260]  [SPEAKER_15]: Okay, we've got...
[54:34.680 --> 54:38.760]  [SPEAKER_15]: Even though we can't communicate with our local listeners, we are getting mail from people all over the country.
[54:39.880 --> 54:46.180]  [SPEAKER_15]: And those people are sending us mail concerning our PCS discussions.
[54:46.380 --> 54:47.380]  [SPEAKER_15]: Actually, why don't you read this?
[54:47.460 --> 54:47.800]  [SPEAKER_15]: Okay.
[54:47.900 --> 54:49.040]  [SPEAKER_02]: I can deal with the phone over here.
[54:49.160 --> 54:49.480]  [SPEAKER_02]: Okay.
[54:50.620 --> 54:55.000]  [SPEAKER_02]: He says he was just listening to our April 8th edition of Off the Hook, and he loved it.
[54:55.600 --> 54:59.380]  [SPEAKER_02]: He says he wanted to clarify a few things about PCS segment.
[55:00.640 --> 55:06.200]  [SPEAKER_02]: He's an indirect marketer for Primeco, personal communications in Hampton Roads, Virginia.
[55:06.960 --> 55:12.280]  [SPEAKER_02]: And he basically supports the Radio Shacks and Circuit Cities and other indirect retailers.
[55:13.500 --> 55:17.580]  [SPEAKER_02]: They say that they have the third largest PCS presence in the U.S.
[55:17.580 --> 55:19.180]  [SPEAKER_02]: after AT&T and Sprint.
[55:21.880 --> 55:28.740]  [SPEAKER_02]: What he seems to want to do is clarify a few things concerning CDMA versus TDMA.
[55:29.460 --> 55:44.500]  [SPEAKER_02]: And I'm actually in agreement with some of the things that he says about CDMA being the direction that corporations are going in.
[55:45.700 --> 55:48.620]  [SPEAKER_02]: of course with GSM, that isn't the case.
[55:49.020 --> 55:50.740]  [SPEAKER_02]: GSM is currently using TDMA.
[55:53.710 --> 55:54.990]  [SPEAKER_02]: What we...
[55:55.990 --> 56:08.890]  [SPEAKER_02]: I've mentioned in the past that ultimately companies, for example, Omnipoint, which currently use GSM, they ultimately plan on supporting CDMA.
[56:09.410 --> 56:23.990]  [SPEAKER_02]: And they actually have one of the actual standards that they've come out with, IS-661, is actual hybrid of GSM using TDMA as well as CDMA.
[56:25.350 --> 56:33.610]  [SPEAKER_02]: And while this isn't actually in place as of yet, to my knowledge, in New York City, hopefully it will be in the very near future.
[56:34.690 --> 56:37.230]  [SPEAKER_02]: I just think it's cool that we're getting mail from people in, where is that, Virginia?
[56:37.890 --> 56:40.450]  [SPEAKER_15]: He's in Errol's.
[56:41.430 --> 56:42.410]  [SPEAKER_15]: It was you, wasn't it?
[56:42.450 --> 56:43.510]  [SPEAKER_15]: It was Mr. Patch Cable?
[56:43.770 --> 56:44.830]  [SPEAKER_15]: Somebody patched us out.
[56:44.890 --> 56:45.450]  [SPEAKER_15]: How do you like that?
[56:45.730 --> 56:46.770]  [SPEAKER_15]: Mudge, are you back with us?
[56:46.850 --> 56:47.630]  [SPEAKER_15]: Yes, I'm back with you.
[56:47.650 --> 56:51.690]  [SPEAKER_15]: Okay, it was a studio engineer that plugged up a hole there.
[56:52.050 --> 56:53.510]  [SPEAKER_07]: They must be on Microsoft's payroll.
[56:53.810 --> 56:54.130]  [SPEAKER_07]: Okay.
[56:55.210 --> 56:57.210]  [SPEAKER_15]: Well, he'll be doing pennants for a while.
[56:57.530 --> 57:10.090]  [SPEAKER_15]: Okay, well, we only have a minute left, so Mudge, why don't you give out your information so that people can get a hold of and find out more about this interesting bug and things that the L0pht does.
[57:10.430 --> 57:10.790]  [SPEAKER_07]: Great.
[57:11.090 --> 57:18.490]  [SPEAKER_07]: Anybody who's interested in the L0pht and what we do can connect to the website, which is www.l0pht, which is L0PHT.com.
[57:19.470 --> 57:23.210]  [SPEAKER_07]: Email can be addressed to Mudge, M-U-D-G-E at l0pht.com.
[57:23.590 --> 57:29.230]  [SPEAKER_07]: The other seven members, I will definitely forward on to if you don't know who they are or want to find out who they are.
[57:29.330 --> 57:35.710]  [SPEAKER_07]: The other person who helped write the L0phtCrack program is Weld, who can be reached at Weld at W-E-L-D at l0pht.com.
[57:35.930 --> 57:41.290]  [SPEAKER_07]: And the information on the actual program and the program itself are off of the advisories page from the main page.
[57:42.090 --> 57:45.910]  [SPEAKER_07]: And Emmanuel and Phiber, I thank you very much for letting me take part in this.
[57:46.070 --> 57:53.550]  [SPEAKER_15]: Okay, and before we leave, we have with us now the studio engineer who messed up the whole show, who's going to personally apologize to everybody that I've insulted tonight.
[57:55.110 --> 57:56.050]  [SPEAKER_14]: Claude, go ahead.
[57:56.050 --> 57:59.150]  [SPEAKER_14]: Well, they certainly were entertaining insults.
[57:59.330 --> 58:11.610]  [SPEAKER_14]: Um, trying to set up a show beyond, uh, uh-huh, beyond Scott, it's difficult, I'm sorry, and I apologize to you especially, but also to your listeners.
[58:11.830 --> 58:17.210]  [SPEAKER_15]: I mean, I'm sure my listeners can understand this kind of a thing, but this, what is this, what are all these patch cables for?
[58:17.290 --> 58:19.730]  [SPEAKER_15]: Is this some sort of special presentation that you'd like to promote now?
[58:21.170 --> 58:30.710]  [SPEAKER_14]: Actually, at about quarter, quarter of eleven, there will be poison darts, and they have, um, an identical cousin direct from Texas.
[58:30.710 --> 58:31.750]  [SPEAKER_14]: They do that every week.
[58:31.870 --> 58:32.150]  [SPEAKER_15]: I see.
[58:32.690 --> 58:33.010]  [SPEAKER_15]: Okay.
[58:33.970 --> 58:34.290]  [SPEAKER_14]: ISDN.
[58:34.430 --> 58:34.710]  [SPEAKER_15]: All right.
[58:34.970 --> 58:37.050]  [SPEAKER_15]: What, there was an ISDN line you were hooking up just now?
[58:37.230 --> 58:37.590]  [SPEAKER_15]: Mm-hmm.
[58:37.730 --> 58:39.570]  [SPEAKER_15]: So we got victimized by ISDN yet again.
[58:39.790 --> 58:40.110]  No!
[58:41.510 --> 58:42.050]  [SPEAKER_15]: All right.
[58:42.130 --> 58:43.170]  [SPEAKER_15]: Well, that's just fine.
[58:43.310 --> 58:44.930]  [SPEAKER_15]: Okay, that's going to do it for us here this week.
[58:45.090 --> 58:46.570]  [SPEAKER_15]: Thanks very much, much for being part of this.
[58:46.710 --> 58:47.130]  [SPEAKER_07]: My pleasure.
[58:47.230 --> 58:47.750]  [SPEAKER_07]: Thanks for having me.
[58:47.910 --> 58:48.270]  [SPEAKER_15]: Take care.
[58:48.710 --> 58:49.990]  [SPEAKER_15]: We'll be back again next week.
[58:50.090 --> 58:54.230]  [SPEAKER_15]: By the way, Mudge and the L0pht crew will be at Beyond HOPE in August, so be sure to drop by then.
[58:54.290 --> 58:55.070]  [SPEAKER_15]: We'll have more information there.
[58:55.150 --> 58:57.810]  [SPEAKER_15]: Our new website is up now, www.hope.net.
[58:57.870 --> 58:58.330]  [SPEAKER_15]: Check it out.
[58:58.410 --> 58:59.790]  [SPEAKER_15]: We have hotel information finally.
[58:59.790 --> 59:05.210]  [SPEAKER_15]: Of course, those of you who are here in New York City probably won't need that, but then again, those of you listening on the web probably will.
[59:05.650 --> 59:07.110]  [SPEAKER_15]: Until next week, this is Emmanuel Goldstein.
[59:07.370 --> 59:07.930]  [SPEAKER_15]: Have a good night.