This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
in a fag pose.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll school you on burning dreamcast. You need some ISO? Let me through my hard drive rifle.
Our exchange you could never stifle. Get a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattle in your bones when I tell you we just hacked out Jones?
And NASDAQ leaves you flat on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the crackers.
Serial code, source code, ISO, RAM, SIF.
Good evening and welcome to Binary Revolution Radio, episode number 125 for December 6, 2005.
I'm Strom Carlson, and our special guest co-host this evening is Lance James from Secure Science Corporation.
Say hi, Lance.
Hi.
So, Black Ratchet is not here tonight.
He's busy filling out paperwork for something or other, and he can't make it.
So, damn the paperwork, and he'll be back next week.
But, anyway, Lance, I should introduce him before we get into the show.
Lance, well, why don't you introduce yourself?
You're the author of something recent.
Yeah.
Hi, my name's Lance.
It's actually an acronym.
Just kidding.
I'm the author of Phishing Exposed.
That's with a PH, which is basically a forensic manual for dealing with phishing.
And it also has a lot of prediction-based events that will happen at some point.
And already, since the release, there's been at least two events that have happened that are in the book.
So, my background is I've been in the information security field for probably 10 years, and that means I was 17 at the time, which means, you know, you can have your own inference there.
So, I've been kind of a hacker-type person for quite a bit, and I just, you know, do a lot of research on protocols, cryptography, reverse engineering.
And then, recently, in 2003, I got into tracking phishers.
Cool.
We're going to – our show is live tonight, so if you have questions for myself or Lance tonight, you can call in.
If you're calling from the United States, call toll-free 800-732-0442.
Again, 800-732-0442.
Or if you're calling from outside the U.S., country code 1-213-415-1047.
Again, 1-213-415-1047.
Dr. Zygman will answer your call and send you on over to us.
So, let's get into – oh, so some housekeeping.
Obviously, no black rights just tonight.
And the map of our listeners that we set out last week, that's at Frapper.com, F-R-A-P-P-R.com, slash Binary Revolution Radio Listeners.
We have 80 listeners so far on there, which is a pretty sizable number.
And if you're listening and you haven't posted yet, go to that website, Frapper.com, slash Binary Revolution Radio Listeners, and post where you are.
Put your pin on the map so we can see where everyone is.
Time for some email.
Our first email, it's an idea from Delete, and he says,
Hey, dudes, the turducken is actually a Cajun food.
I live in Louisiana, and I can say that these people stuff crap where it shouldn't go all the time and then eat it.
The weird thing is that a lot of it is good.
Time for some antacid.
So, Lance, you're a vegetarian, right?
Yeah, I am.
Yeah, so no experience eating a turducken, and neither have I.
Yeah, lots of crazy, weird food.
I thought it was some modern thing, but I guess it makes sense that it might be a Cajun food.
And personally, Delete, I'd stay away from using the phrase stuff crap where it shouldn't go when trying to advertise Cajun food.
Just a thought.
Or any kind of good food.
Yeah, exactly.
Because then you get this idea that it's just full of crap.
Yeah.
And then our next email is from, who asked us?
It's from Linux Nightmare sent in this email, and he said,
Do you guys know if you could send me the MP3 of the closing music from episode 124?
That song was the shit.
That song is called Rocked by Rape.
It's by the Evolution Control Committee.
And thankfully, like every single song that you will hear on BINREV Radio, it's free, totally free.
And you can get that at httpevolution-control.com slash sounds.html.
G.I. Joe writes,
Hello, while you're talking to ICANN about getting .int opened up, could you put in a word for .su as well?
Thanks.
You know what .su is, right, Lance?
Yeah, it's of your union.
Yeah, of course.
And actually, their entire zone transfer is open.
If you do a DNS dig zone transfer, you can actually pull all of .su's domains.
That's funny.
Can you still sign up for .su?
I don't know if you can sign up for them.
I haven't really looked into signing up for them.
But the best thing to do is maybe go to www.su and see if that works.
Hold on, let me give it a shot.
So, you need to try this.
Sometimes, a lot of times, you'll find out.
Welcome to .su.com.
Vacation packages, hotels.
It doesn't look like I can do it.
Phoenix, Novosibirsk.
Let's turn that.
No, it doesn't look like it's freely available to do it.
Yeah.
There is.
There's probably something you have to go.
Yeah, it might be being phased out just because the Soviet Union has been for it for like 15 years now.
Yeah, yeah.
But it is funny because I see them being used.
There was one, Nevesta, N-E-V-E-S-T-A dot S-P-B dot S-U, I think what it was.
So, people are adding like subdomains to them because they own them still.
Or S-B-P, one of these two.
I'm trying to know.
One of those two.
But basically, I'm seeing a lot of, you know, dot S-U sites, but they're always, you know, subdomains because I think that the old ISP holders are just giving them subdomains.
Anyway.
Yeah, interesting.
Okay, our next email is from NUI.
He says,
Hello, I've been assigned by my group members to gather data as to how much bandwidth is used in Internet radio streams.
I'm kind of tired, so please excuse any sloppiness.
I have a group presentation at school, and the assignment is,
Someone donated $250,000.
Yeah, $250,000, didn't put a comment there.
To the college, and we are to do something with the money to benefit the school and community.
We picked to do an Internet radio station, and immediately, I thought, Rant Radio and Binrev.
I've done some research, and I've run into a problem, so I decided to ask you about how much bandwidth per day slash month with,
I'll start with 100 listeners max at two bit rates, 24 and 96, or 128, preferably two channels.
I found this example, but I don't understand it entirely.
He has 96 kilohertz times 24-bit times two channels stereo equals,
sorry, divided by one equals,
I think by one, equals 4,608 kilobits a second,
and 4,608 kbps divided by eight is, times 60 seconds equals,
34,560 kilobits per minute of audio,
34.5 megabytes.
And he says,
I don't understand if that is per listener or what,
and so, if,
and if so,
then wouldn't you go through 50 gigs a day,
just for one listener?
Hold on.
Is the above example probably before compression?
Anyway, if you could help me in any way,
it would be much appreciated.
Thanks, Eric.
By the way, you guys rock.
Yeah, let me look at math right there.
Yeah.
So, while you're looking at that,
I'll just say, you know,
pretty much the figure is per listener,
but bear in mind that stereo at 96 kilohertz
is totally insane for bandwidth.
What we do for bin rev radio is we sample with 22,000,
yeah, 22,000 samples per second,
mono, 24 kilobits a second.
And the bit rate is really the defining factor,
because no matter what your sample rate is,
it's the bit rate that you have to worry about
in the stream side of things.
And when compressed,
we stream MP3,
and the podcast ends up being roughly the same size
as the live show.
So, 90 minutes of audio is typically about 15 to 17 megabytes.
So, whenever we have a listener listening for 90 minutes,
it's 15 to 17 megabytes for that listener over 90 minutes.
So, that's about 240 megabytes per day per listener,
assuming that the listeners are all sitting there
listening constantly, 24-7.
The bin rev radio itself typically has,
let's see how many people are listening to it right now.
Let me go to the website here.
We've only got 15 listeners,
but typically we have between 20 and 30 listeners
listening to bin rev radio.
It's because I came on the show.
Beg your pardon?
It's because I came on the show.
Yeah, everyone hates you, Lance.
Everyone hates you.
But yeah, no, typically we do have between 20 and 30 listeners.
And although, I've looked at the stream schedule,
and it tends to be, you know,
most of the, during the day,
it's about two people listening, sadly.
So, I really don't,
if you guess like 240 megabytes a day per listener,
imagine at least one person listening constantly,
you could do the math there.
But it depends also on what you want to stream.
If you're going to stream, you know,
just talk,
then you can get away with doing something like
24 kilobits a second, 22,000 hertz.
Yeah, that's what I was about to say.
If it's a radio show,
and you're not doing too much music,
you know,
and it's not based around music,
it's more of a talk show,
then you can definitely have multiple,
anything you could offer multiple bit rates
and multiple kilohertz,
you know,
streaming rates.
That's what I was thinking.
Because it could get heavy duty.
I mean,
I think this algorithm is proper.
I think he's technically accurate.
Mm-hmm.
So,
because you're already saying that,
how many,
what did you say earlier?
You said your show was,
I mean,
when you pop it into an MP3,
how big is it?
It's about 15 to 17 megabytes.
Right.
And,
we know that they're going to stream that
a little bit less.
Because,
are you,
how are you encoding your MP3?
It's 22,000 hertz,
24 kbps,
mono.
Okay.
So,
yeah,
I mean,
you're going to save on,
you know,
yeah.
And that's usually standard,
I think,
radio show,
talk show,
type anyways.
You're not going to need,
you know,
I mean,
some people probably do stereo,
but,
you know,
most people listening onto it
are not going to be concerned
with all the high fidelity
if it was a radio station,
that would be a different story.
And that's obviously,
the people who are running radio stations
with music
or Yahoo music
and people who have
gigabit backends and stuff.
But,
I think his outlet rhythm
is about right.
But,
he should just lower it down
to 22 kilohertz
or,
he could even try 64
and see how that works.
You know,
something like that.
Or 48,
I'm sorry,
48 times 24
and then see if that works out
and has a better,
you know.
So,
depending on their pipe
is really how they're going
to judge it
and depending on the content
as well,
I would think.
Unless,
correct me if I'm wrong,
you're the one running the show.
Yeah.
No,
I'm not the one running
the server.
Oh,
no,
I meant like you're talking
though,
so,
you know.
Yeah.
I'm just the pseudo guest host.
Hey,
your input is always appreciated.
And everybody hates me.
There's five less viewers today.
Yeah.
Well,
I'm looking at like,
we had 17 a second ago
and now it's 16,
so.
Yeah,
yeah,
just because I said
something stupid,
see.
Yes,
we want you all
to die now
and stop listening.
Yes,
don't listen anymore.
Oh,
shoot,
we just got 20 users.
It's that whole
reverse psychology thing.
Don't think about
pink elephant,
they think about
pink elephant.
Here's a topic,
T-Mobile,
Paris Hilton attack,
that hack that happened
a few months ago
or maybe six months ago,
whatever.
Yeah.
Turns out it sold
sidekicks.
Everybody was like,
oh my gosh,
she's got a sidekick?
Oh,
we should get one.
It was better than
her endorsement
on television.
That's hilarious.
Yeah,
so it actually
upped the sales.
Wow.
So keep hacking
T-Mobile,
you'll up their sales.
Funny.
That is funny.
But yeah,
again,
I'm not an expert
on streaming,
so someone who
actually lives
and breathes
this stuff
can probably
help you
better than we can.
Yeah,
but the algorithm
does look accurate.
I would just lower the,
if you're doing
the talk show,
lower it down
to 22 kilohertz,
you don't need
a 24-bit
and two channels.
You can go
into mono mode,
so that'll
exponentially
drop you down
a bit.
Yeah,
in fact,
the only reason
we could actually
stream it
at far less
than what we
stream it
at now,
we could probably
stream it
at like
maybe 16 kilobits
a second
and 8,000
samples a second
since we are
talking on the phone,
but because the show
does incorporate music,
then we have to
stream at the higher
bandwidth.
And if you're
thinking of streaming
all music all the time,
better look into
high volume
optical carrier
for your connection.
Yeah,
call Akamai.
Akamai or
AT&T or
somebody.
Yep.
All right.
So,
management companies.
Exactly.
So,
personal stories.
I guess I'll
start off,
actually,
no,
what have you
been doing
recently,
Lance?
What have you
been doing
in the hacking
world?
In the hacking
world?
Now you've got to
think about stuff
that I'm allowed
to talk about.
Hold on.
Well,
recently,
I guess I can
kind of tell it,
probably in this
channel,
since you only
have like 80
top viewers or
whatever right
now,
our listeners.
Ultimate IRCD
is cracked.
Yesterday,
I cracked another
encryption that a
phisher was using
to hide their
blind drop.
I've done some,
oh,
some neat stuff.
Okay,
well,
this is like a
long story,
but it's okay.
I'll try to get it
short.
I've been
watching over
53 phishing
groups,
but there's a
certain phishing
group that I
like to watch
because they're
fun and very
aggressive and
very Russian.
And they're
very technical,
and so I
actually have
kind of a
deep understanding
of respect for
them,
even though I
want to see
them go down.
So this
group is
very aggressive
and they send
out malware.
Anybody
doesn't know
malware,
it's malicious
software.
It's like a
virus that
steals your
key logs,
any kind of
information you
send on your
computer.
But basically
their techniques
are really
neat,
but I've
gotten to the
point of
identifying their
attack pattern
and I know
when they're
going to hit.
And I know
so well that I
actually am
like two days
ahead of them.
So the last
time they set
up some
malware,
actually before
the last
time,
so it was
one time
before that,
basically what
I did was
predict where
it was going
to be tested
at.
So I found
their test
sites twice
and basically
analyzed the
malware and I
basically reverse
engineered it and
found where
they actually
send all the
data to and
I got those
shut down
before they
ever sent
them out.
So when they
tried to send
it out,
they got
confused and
thought the
malware was
broken and
probably complained
to the author
of the malware.
So it actually
delayed them
about four
weeks.
Recently they
sent out another
one and I'm
just basically,
my hack on
this one was
basically I'm
just stealing
the data back
every single
hour in real
time and
returning it to
the banks.
So they're
basically on
an arrival.
So my whole
thing is fishing
the fishers.
Awesome.
That's my
hack of the
week.
Totally
awesome.
Yeah, I
haven't done
any major
hacking this
week.
There's some
interesting
telephone stuff
which I've
been talking
with Lucky
225 and
Natus and
they discovered
something
interesting which
will be published
in Binary
Revolution magazine
so I'm not
supposed to talk
about it yet.
Although I
wrote a thing
on it like six
months ago and
it slashed out but
this one's slightly
different so give
Lucky his props.
He's got something
very cool going.
I can't wait to
see it.
Yeah.
But a
highlight is
everybody go
ahead right now
and buy T-Mobile
so when it's
published they're
already in good
standing.
Yeah, I'm sure
I can hint at it.
I don't think
Lucky will kill
me.
Yeah.
But this past
weekend I went
down to San
Diego and went
to the book
release party for
a book called
Fishing Exposed
by someone who
was it by?
Oh yeah, you.
Oh yeah, that
guy.
Yeah, the guy
in the corner
that everybody
hates.
Yeah.
Good food, good
booze, good
people and fish
center people.
It was a good
turnout.
Yeah, it was a
great party.
Yeah, my mother-in-law
actually is the one
who set that all
up.
I prefer to Porsche
but they gave me a
party instead.
No, I'm just
kidding.
Yeah, so it
turned out nice.
I was glad to see
you there actually.
It was kind of, I
guess you got a
last minute invite.
Yeah, I got
invited on the
night before.
What happened?
Josh.
Yeah, Josh
messaged me while
I was at LA 2600 on
Friday night at
like 10 p.m.
and said, drop
what you're doing
and come on down
here.
There's a book
release party.
Yeah.
Sweet.
So I ran back
here, grabbed my
suit and drove
down there late
at night saving
off narcolepsy.
Yeah, no.
Oh, you know
what?
It's funny that you
say narcolepsy
because, or not
narcolepsy but
something to do
with sleep.
That night though,
I had a Murphy's
Law but here's the
funniest thing is
like all of my
developers showed
up for the party
at my company and
they came from all
over Seattle, Canada,
New York and
stuff and Riverside.
And it's funny
because I hadn't
seen one of the
guys from Seattle,
Tony, for eight
years and we were
kind of like, you
know, we used to be
hackers in the day
and it was crazy.
And what happened
is like, when I
used to hang out
with him, it was
just the same.
We'd always be
pretty much living
on sleep depth
because we were
such, you know,
hacker types.
We'd stay up late
hours and then
just crash, you
know.
And it's funny
because when he
came, just Murphy's
Law just hit in
my, you know, I
got to my hotel.
They all stayed
at the same hotel
and stuff and
basically what
happened was I
went back and
said, okay, I
got to get home,
you know, two
o'clock in the
morning or three
o'clock in the
morning and I
go to the parking
lot and when I
even didn't have
my Visa card, my
wife had my
wallet and I'm
like, oh, great,
you know, and so
Tom was nice enough
to owe me his
Visa card.
I head back there
and my car, his
lights were on
all night and my
car's battery was
dead and pretty
much even though I
got a, you know,
like someone to do
a, you know, the,
you know, the,
what do they call
it, the bumper, the
jumper cables, you
know, it didn't
charge.
It was totally dead.
One of those
things where it was
just one of those
nights so I was
screwed because I
had to buy a
battery.
So I went back to
the hotel with
them and we stayed
up and got two
hours of sleep
and, you know,
went to breakfast
to have to drop
off one of the
guys at the
airport and
install a battery.
We bought a
bunch of, I
don't know if
anybody knows
the ball drink,
B-A-W-L-S.
Of course, a ton
of sleep deprivation
jokes on that
drink.
But, you know,
it's funny because
it just happened to
me that, you
know, that party
was like completely
never ended and it
was on accident
the whole time.
So anyway, it
was just funny.
That's hilarious.
Yeah, so that
was an interesting
night for me because
it was more than
I was ready for.
But it was a fun
party.
Thanks for coming,
Strom.
I really appreciated
seeing you there.
Oh, hey, thanks for
inviting me.
Had I had your
email address earlier,
you would have been
invited a lot earlier.
Oh, cool.
Well, now you've got
it.
So, yes, I do now.
So it's actually
pretty easy.
Yeah, pretty damn
easy.
The cool thing...
I think I'll go
announce it for all
the spammers
listening.
Just kidding.
Yeah, yeah.
Well, it's on my
website, so you
just want to just
go to StromCarlson.com
and spam me from
there.
No, the cool thing
about the party was
that the whole
thing was fish
themed.
Oh, yeah, and you
got your own beta
fish.
Yeah, yeah, I got
one of the center
pieces on the
tables were betas
and little fish
bowls.
So I've got one,
and now he's
sitting on my
desk.
And he is the
official fish of
Fishing Exposed,
I think.
Yeah, yeah, he's
official.
I mean, he's...
It was so funny
because, like I was
saying earlier, my
mother-in-law came
up with the whole
idea of that and
everything.
And my mom
actually came up
with it, and she
wasn't there, but
she came up with
the bookmark.
And it's funny.
Did you get a
bookmark?
You know, I
grabbed a bookmark,
and I can't find it
in my book, so I
think it must have
dropped out.
Anybody who ever
writes a book and
you ever do a
promotional party
about your book or
just a release party,
take your book and
put all the stuff on
a bookmark because
it's a great gift
for when you get
someone's book.
And it's just a
great promotional
tool.
So all those
hackers out there
are just writing a
book or working on
a book.
So the idea to your
publishers, well, if
they ever put together
something or things
like that or hand
out bookmarks because
they're a great
marketing tool and
it's not like they're
huge, so you don't
have to carry them
around everywhere and
you just kind of have
them in your books.
Yeah, totally.
So, but it was neat
because my mom works
at a bookstore, so
she's used to book
signings, so she
came up and said,
here's something that's
popular.
So, anyways, it is a
neat party.
I enjoyed it and I
hope you enjoyed it and
I think most people
did.
Oh, yeah.
And, of course, I got
my own autographed by
the author copy of
Fishing Exposed.
Yeah, what did I say
about you, Ken?
You wrote, hi,
Strom, keep the
freak in you, Lance.
So, yeah, I thought
that was neat.
That was pretty cute.
So, yeah, I signed my
own copy for me and I
said, just kidding.
No, hi, Lance.
To myself, but
the way that
really often die.
Everybody else hates
you, but as long as
you like yourself, you're
okay.
To myself with
admiration, love, and
kisses, Lance.
Exactly.
So, yeah, so I wrote
this book.
It's 50 pages shorter
than I wanted, but
that's the publisher's
fault.
Well, including the,
well, not including the
index, the book is, at
the end of chapter 7,
380 pages.
Yeah, it's supposed to
be like 450, really.
So, they're lying to you
when it says it on
Amazon.
But buy it anyways,
it's still worth it.
Yeah.
So, anyway, I guess
let's go into the meat
of our show.
And, by the way, for
those of you listening to
us live, we are live
tonight.
And if you have
questions for myself
or Lance, you can
call us.
I'll announce the
numbers again.
From the United
States, call toll-free
800-732-0442.
Again, 800-732-0442.
Or, if you're
calling from...
I have to call myself.
Sorry.
I'm sorry?
I said, if you don't
call, I'll call myself.
Right.
And if you're calling
from outside the U.S.,
dial country code
1-213-415-1047.
Again, country code
1-213-415-1047.
Yes.
International
callers must pay.
Yes.
Sadly, there's no way.
We tried to get the
toll-free number to at
least work from Canada,
but it doesn't seem to
want to work that way.
Well, you could do the
whole free world dial-up
thing where you can hook
up all the different
international...
We could.
But, I mean, it's just
more reliable to do it
over a real phone number.
Yeah, I know.
And since the majority
of our listeners look
basic, you know, based
on the map, are in the
U.S., the 800 number
works just fine for the
most part.
Yeah, I mean, too, we
have to provide
translators for all the
international callers.
I mean, you can imagine
the headaches we would
get anyway.
So it's better that they
pay because they pay
to speak English.
And poor Zygman, you
know.
Zygman would just die
under the whole, under
the stress of trying to
translate everything.
Yeah, I know.
It'd be fun.
It reminds me of when I
worked at a large
ticketing company that
was doing the Olympics,
the 2004 Olympics.
And I had to call
Athens, Greece, every
time something went
wrong.
And the international
staffing thing, you
know, it's like they
have people from every
country staffing the
call center.
So you get all these
people who speak English
badly, but a different
variety of bad English
every time.
And that was just a
trip.
Yeah, I can imagine.
Yeah, I wouldn't want
to.
You know what it's
worse for me is I get
these Texans, and that's
bad enough for me.
I mean, Texans have
their own little
language, I guess.
You know, hello?
Hello?
Well, no, I was
watching.
I'm looking for a
secure.
It's almost like I
can't even do it.
Well, I was watching
this little video from
the SVC-AT&T merger, and
there was some guy
talking, and it turns
out it's Ed Whitaker
who's the chairman of
the company.
And I'm like, that's
him?
Because his voice, it
starts off, from the
moment human speech
first traveled across a
wire in 1876.
I'm like, my God,
what a hell of a
draw.
No wonder he doesn't
do any of the
spokesperson stuff for
the company.
You know what I get,
though?
What?
It's funny.
I still get these
today.
Last August, or maybe
September of last
year, I sent out an
advisory about
callwave.com, which
is like, if you have
a modem still, it
tells you someone's
trying to call you
in.
And so I did this
exploit where basically
you could terminate
any caller, or not
terminate any caller,
terminate any
subscriber to their
system.
You could actually
shut their accounts
off.
If you knew you
called up a call
wave person, you
could actually do
some real evil.
But the whole point
is that I put an
advisory.
And so somehow in
Google, people will
sort secure signs of
callwave, and they're
trying to call callwave.
I get these people
from Kentucky, and
just totally southern,
older people.
And it's like,
hello, is this
callwave?
No, let me get the
number for you.
There's no number on
their site.
I know they're that
type of company, man.
Let me get it for
you.
So it's just funny
because it's like
totally different.
And so we'll try to
translate that type of
talk as well.
Maybe I'm dissing
everybody.
I don't mean to be.
I'm just jessing
that.
So we appreciate all
Americans of all
sorts.
All right.
So we're going to
put our foot in our
mouth and go to a new
subject.
Okay.
Let's see.
We do.
Okay.
We have a call on
hold, but I think we're
going to get into the
meat of the question.
So let's do this.
Let's start off with
tell us about fishing.
Introduce fishing.
What is fishing?
For all that don't
know, which I would be
really surprised if you
don't on this thing, but
there is a chance.
So we'll just do that
you don't know thing.
And if you don't know,
I'm glad that you're
learning today because
the people that get
gypped don't know.
So basically, fishing
is, I'm going to use
a very broad perspective
of it, but it is
basically social
engineering in the
form of email and
messaging, mainly in
email today, where it
basically tries to trick
people into signing up
for the bank account
that really isn't the
bank.
So what that would
mean is you would get
an email that says,
Dear Citibank user,
there's a problem with
your account.
You need to fill this
information out and
update your account
information immediately.
Click here to sign in
and fill out the
information.
And so what it is, is
when you click on that
link, it looks like it's
a Citibank in your
email, but underneath
that is what they call
an HREF tag, which
basically means where it
really goes to is some
other sites, usually off
of Citibank, unless
Citibank's got a problem
with their website, but
usually off of Citibank,
it'll be some other
site somewhere in the
United States and an
ISP sitting somewhere
that basically looks
like Citibank, but it
really isn't Citibank.
And a lot of people
who are not in the
know will fall for it
and log into it, and
they'll go, thank you
for updating your
security settings, or
it'll pass you back to
the bank, or things
like that.
And so what will
happen is, little
they know, they've
gotten all their
credentials stolen.
And it's funny because
phishing goes back to
the old school days.
So it's like as more
advanced we get, the
attacks go back to the
fundamentals.
So that's kind of
what phishing is in the
long run, and most
people will see an
eBay or an Amazon or a
Citibank or a PayPal
email in their thing
that's definitely, you
know, I don't have an
eBay account, or I
definitely don't have a
LaSalle Bank or a
South Trust Bank
account, or some
credit union out of
there.
And if you guys have
seen that, then you
definitely have seen a
phishing email.
And so what I do from
that perspective is I
actually categorize those
phishing emails and
categorize them in
groups and, you know,
start like saying, hey,
this is this phishing
group, this is this
phishing group.
And, you know, they
all have different
distinct patterns because
they're serial behavior.
Yeah, like I noticed
the introductory part of
your book, there's an
example where you start
filtering these spam
emails, these phishing
emails that you've
received, and you start
narrowing it down by
like, you narrow it
down, and like, so
let's see, what was the
example?
Let me pull it up here.
Capital Letter Hash
Busters on the
subject line.
Yeah, yeah, yeah,
that's right.
So it's like, first you
narrow it down to all the
spam, yeah, with Capital
Letter Hash Busters on
the subject line, and
then you narrow it down to
all the spam messages with
that Capital Letter
Subject Hash Buster, and
then it's time zone of
negative 1,700, which
doesn't even exist.
Right.
And then you can see
this pattern that they
all seem to come from
like someone drumming
their fingers on the
keyboard and typing some
numbers at Yahoo.com.
Yep.
And so basically, from
that drumming, you can
see inside to out, out
to in.
Also, the certain type of
software that we
identified actually had it
where you have to press
the mouse to the submit
key or the send mail key
rather than just hitting
enter, so, and it was on
the right side, and you
can see, like, if someone
types in ASDF or something
like, you know, totally
like that, you can tell
where their hand is on
the mouse.
So there's certain, you
know, positions, and we
wrote some software a while
back that does, like, you
know, metrics based off of,
like, outside to in, and
so it does 75% chance this
person is left-handed or
right, you know, those
kind of things.
So this is what we call
keyboard profiling.
And so we'll see it, like,
we'll see it on IRC
channels where someone
will get upset, too, and
they'll just, like, you
know, dish their hand off
the keyboard, and we'll
measure the sample.
Of course, the bigger the
sample, the better chances
we have, you know.
But, yeah, that was it.
That's, you know, what we
do is basically take
traits, start with the bulk
mailing traits, and then
move them to, also, with
fishing, you can start
looking at the website
traits, certain kind of
code, do they mirror it,
do they refer all the
images, or do they
actually mirror all the
images, or do they do a
mixture of both?
Do they have a dot-dot
flash, you ever see that,
or you see a dot-dot-dot
flash in a phishing email
when you actually go to
the site, so that you can
tell that they probably
hacked in and they're
hiding the actual site.
We also group it and
categorize the type of
attack points, right?
So if you're scanning
a machine, there's, like,
a certain group out there
that'll look for all
cPanel, which is the
ISP in a box, you know,
which is basically a, you
know, cPanel basically
sets it up so you don't
have to think about
your ISP, it's a
management engine for
your customers, and you
just send them a login
and they can start
managing their accounts.
And so, like, we'll see
a lot of those
vulnerabilities and we'll
categorize that.
So we, you know,
basically we'll go,
okay, this group has
sent this type of email,
okay, we already know
what group that is, are
they following the same
traits?
Oh, yes, they are, so
let's put them in phishing
group number two or
phishing group number 20,
which is a city image
group.
One you've probably seen
very often is the city
group type emails, and
what it is, it's an
entire image of the
city group logo and all
the wording inside an
actual image, and the
click is actually the
image's hreft.
Have you ever seen
that before?
I don't know if you
even look at phishing.
Yeah, I've looked at
that, and I think I've
seen it.
Right, and that would
be phishing group number
20, what we call a city
image.
If you look in their
headers, they'll have an
FCC colon, which is a
file card and copy as
well, so their bulk
mailing tool has the
specifics.
There's all these
little things, so we
basically can categorize
them, and we've also
traced back them to being
involved in spam for the
last two plus years, or
that, because a lot
of spammers went
phishing, so they came
from spamming to going
to phish, because of
course, in the end run,
what's the goal here?
Yeah, the end run is to
get your information.
Yeah, well, the end run
is not to get your
information.
What does information
get you?
Money.
Yeah.
So, I mean, yes, the
attack point, the vector
that you're looking at, the
threat is that you've got
to protect your
information, but spamming
even was about money, and
that's already a shady
business, and they had
hackers that they hired
to basically steal
mailing lists or harvest
them, and so black hat
techniques were always
used there, too.
Yeah, I remember
actually, I worked at a
company one time, and
they got this amazing
idea up their ass to
spam people to get more
customers.
They said, this is a bad
idea, this is a dumb
idea, don't do it, don't
do it, but they
eventually pressed ahead
with it anyway, and I
was kind of reluctantly
ended up writing screen
scrapers to go filter
through web pages and
grab email addresses
from mailing lists and
whatnot.
Actually, chapter three,
I think it's chapter three,
in there I even show how
people put in those no
spam things, and I do a
regex command line piped
into wget, and basically,
or something, I can't
remember what I did there,
I think it was, yeah, I
was piping into wget, and
then I did a regex
command, and I basically
sorted it all out, and
then basically what would
happen is you'd have an
emailing list, right, just
off of using your
command line tools.
Now, imagine all the
tools out there that
are, you know, heavily
thought out, you know,
there's a lot of
harvesting tools out
there.
Oh, yeah, here it is,
wget.
Oh, yeah, definitely.
Chapter three, page
117, it's crazy.
Yeah, in fact.
Basically, I just took
the seclist.org, you
know, the security
lists out there that,
like, you know, bug
track and all that, and
it even bypasses the no
spam, you know, little
stuff that they put in
there and some of that
stuff, and then
basically just make a
sorted mailing list,
and I think we
gained, like, I
don't know how many,
we got 174 names just
on one initial pass.
Wow.
That were unique.
So, you know, and
they're looking for,
obviously, between 100,000
and a million per mailing
list.
Now, the bigger groups
use less, smaller mailing
lists per shot.
Right.
They regionalize them as
well.
Now, speaking of the
whole money thing, we
have Ionix on the
line.
Who is it?
Sorry?
Ionix.
You there, Ionix?
Yes, I'm here.
All right, cool.
You had a question about
money, didn't you?
I did have a couple of
questions.
The first one was, how
lucrative is fishing?
I'm assuming it has to be
at least fairly lucrative,
but I would say.
Oh, it's very, it's
very.
And here's what we're
going to tell you the
truth about.
Okay, the groups that
are involved in fishing,
let's talk about the
really organized ones,
like professionals, and
let's not talk about the
ones that are disorganized
in Romania and kind of,
you know, make a daytime job
of it or whatever.
Those guys probably make
$10,000 to $15,000 a month.
Now, the lucrative, you
know, that's okay, but in
Russia, the organized
groups, the larger groups
that are filled with like
13 plus, you know,
individuals, just in
fishing.
Now, we're talking just
the scams, and this
includes malware, too, and
money moving and all the
different phases of it.
They're averaging out an
individual person in that
group making $300,000 a
month.
Wow.
So that's an individual
person.
So they're making
millions a month.
Now, the worst part
about this is that these
guys are not just into
fishing, though.
The entire racketeering of
them, they're involved in
child porn.
They're involved in Russian
bride sales.
They're involved in lead
stealing, hacking, of
course, for money.
They're involved in like
spam, of course, malware,
and malicious software.
Like, for instance, I was
one of the co-authors of
Who Wrote So Big?
And if you go on Google, and
we wrote it anonymously at
the time, but I'm not too
worried about them now.
But that's Kevin, who
wrote So Big?
And there's a whole paper.
And we identified the
author of So Big by name.
And that guy made a little
good living until we wrote
that paper.
So, you know, but the
spamming industry alone is a
multi-million dollar
industry.
Okay?
The selling of
information, I mean, look at
Napster.
Why did Napster get bought
up?
Because of their
demographics, not because of
their activity.
They had how many
users?
Yeah.
So, it's the sale of
information.
They have actually kiosks in
Russia that they sell.
Here's a hard drive with all
these people's information.
You know?
Wow.
And so, it's big money.
I mean, look at just lead
companies alone.
They make, you know, average
of, you know, good lead
companies can make an average
of a few million a month
just selling leads to loan
officers fairly.
So, what if you're doing it
illegitimately?
You know, and you're
stealing money, plus you're
selling the information back
to spammers or possibly lead
companies.
So, you have multiple
venues to sell that
information and resell that
information.
Imagine how much information
they have on you.
Plus, these guys do credit
checks.
They know how much money
you have.
So, they know if you own a
house.
They know, you know, what
you're paying on your house.
And they know if you have
some TD Waterhouse account
somewhere and say, oh, this
guy's got bigger money.
Let's go after him personally
and, like, do a bigger
scam.
You know?
That's why I never get
those emails.
That's why I never get
those emails.
Protect yourself from
saying, get broke.
Yeah, yeah.
My protection is the fact
that I'm so far in debt
that no...
Yeah, yeah.
You know, that's a good
protection, honestly.
You know?
They're probably not going
to steal a penny off of you.
You know, but, yeah, there's a
lot of money to be made.
And the organized crimes have
it on tap.
And, you know, even the
smaller players, they're
making about, you know, some
of them are claiming about
$100,000 a month.
You know?
So, I mean, they're claiming,
though.
This is out of their mouth.
So, they could be, you know,
boosting their numbers just to
look cool.
But I know that they're at
least making...
Or they could be, like,
downplaying them.
Yeah, the money laundering,
though, per shipment, though, is
average about four grand.
So, if you're doing the
money laundering, where you're,
like, selling stolen goods,
the per shipment space of that
is about four grand.
And that's in a week, usually.
The guy will do it within a
week.
Maybe if they're real
aggressive, they'll do it
three times in a week.
So, if you do it four times
three, that's 12 right there.
Right?
So, think of that.
You're at least going to be
making, if you're doing
shipments of four grand,
three times a week, 12 grand,
12 grand, 12 grand, 12 grand.
What is that?
10, 20, 30, 40?
That's at least $50,000,
$60,000.
So, I mean, they have
multiple people doing that.
Three times as much as I do
in a year.
Sorry?
I was just saying they make
about three times as much
in a month as I do in a year.
Yeah.
They're making a lot of money.
They're moving money.
And the more aggressive
groups are going to be
faster at it.
Plus, if you're organized
more careful and you don't
get busted, you're going to
be in business a long time.
The worst part is that now
we also have malware.
And which, actually, even
when phishing started, there
was malware.
2003 is technically when
officially phishing started.
And so, malware was actually
up in.
Burbu was logging all these
keystrokes from people.
And it was quite clandestine.
No one knew about it.
I actually had a copy of
Burbu that was nine months
old that the antivirus
vendors didn't pick up.
And that was pulling in
gigs and gigs and gigs
and gigs of people's data.
We're talking like, I mean,
I have the hard drives.
And so, I've got at least
like from one or two weeks,
it was like 13 gigs, you
know, off of people.
And some of the data was
still available, but they had
scripts that they set up and
would target certain banks.
And, you know, basically,
those were the productive
banks.
And so, I really believe it
when they're making, you
know, $300,000 per individual.
I don't doubt it, you
know.
So, it's a pretty big game.
But don't start it, you
know.
No, no, no.
I wasn't.
No, I'm just being funny.
So, in fact, we all
feel like we're in the
wrong business, but.
Yeah.
But, yeah, it's a big
money game.
Wow.
Well, you pretty much
answered the question.
Supposedly, did you read
that article, Rob?
Did you read the article
that's saying that cybercrime
has surpassed drug crime
now in money?
Yes, I have.
I thought that was
interesting.
Yeah.
Although, I don't know
what kind of drug dealers
and cybercrime people are
sort of submitting their
tax forms.
You know what I'm saying?
Yeah, I know.
Well, they're doing, it's
interesting how they came up
with their numbers.
I don't really buy the
numbers because they're
also sliding piracy in
that.
And, no offense, I don't
really look at piracy as a
severe cybercrime.
I mean, my level of
Oh, they submitted it in
on cybercrime.
I was wondering if they
were sliding in on the
drug side.
You know, I was
going to sell the drugs
and, like, watch the
Matrix, you know?
Yeah, cocaine, pot, and
some Mariah Carey albums.
Yeah.
Yeah, well, you know,
yeah, like, oh, you
said it was right.
Does that count?
So.
So they were sliding
that into cybercrime.
Yeah, I think there was
a lot of things there.
I think, I don't think
that the article had
enough substantial
statistics to really make
me feel like that's
completely, entirely
accurate, so.
Yeah.
We're getting up there.
I distrust statistics
to begin with, but that
one, the only thing that
I did have to say when I
finished reading that
article was, uh, drug
dealers of the world,
step up, man.
I mean, you guys are
slacking.
Yeah.
Get on IM and start
dealing, you know,
instant messaging
everybody and telling
them, hey, do you
want some weed?
No.
Just start selling
your asses off, because
you guys are getting
beat, man.
I know.
You've got a bunch of
computer nerds are
beating the drug dealers.
Like, that's what
happened on the streets,
they'd get shot.
We're going to see the
fishers and the drug
dealers start combining
forces soon, and we'll
get an email from your
local drug store has
your weed for pickup.
Well, if we're talking
about the Russians, then
they probably already
have.
Probably.
Well, I know the
idea, though, is just
to see, you know, what
this is going to produce,
is that you made a
really good point there.
Maybe intertwining a
drug dealing and cyber
crime together.
Like, hey, we could use
your IT infrastructure to
help us sell.
You know?
So, I'm sure that at
some point, well, if not
it's already being, is
going to be there.
But, because, I mean,
we're finding, like, a
lot of American fishers
are meth freaks.
They're, like, totally
doing it to pay off their
meth at it.
You know, so...
Yeah, that's why I got
robbed at gunpoint once,
so the guy could pay off
his meth habit.
Yeah, wow, sorry to
hear that.
Okay, all I got in my
wallet was, like, $2 and
credit cards were all
canceled before he got
away.
Well, you're lucky he
wasn't completely, like,
freaked out, because, like,
some of those guys are
very unpredictable.
Very twitchy.
Yeah, very twitchy.
I mean, I got, like, one
time I had a weird story
where this guy came up to
my car and was like,
I'll kill you, man!
And I'm like, I don't
know who you are or what
your deal is, but, you
know, like, he was on,
like, some moped or
something.
It was a really weird
movie, but fully strung
out, you know, like, oh,
wow.
Moped checking.
Yeah.
Yeah, no, that was
weird, but, yeah, so
there's a lot of different
motivations for people
getting involved in it, and
so to the point of, you
know, but, yeah, the top
fishers are making some
soothed cash, because, you
know, you've got to look
at it this way.
Russia, culturally, right
now, is, you know, they're
saying that tax evasion is
kind of a sport over there,
so, you know, so it's, you
know, it's a different
economy, and the politics
behind it is, it kind of
makes sense, and I don't
mean to diss America, but
in a way, from their
perspective alone, they
kind of look at it like
F you America, because you
put us in this position, you
said, oh, democracy, and
then we said, oh, let's go,
guys, you know, and so
from their perspective, it's,
you know, become a corrupt
country, because they're
stuck in bread lines, and
they've got to make money,
so that's, you know,
you know, kind of
probably, culturally, that's
how they look at us right
now, so, it doesn't mean I
agree with it, but it's how
they're looking at us right
now.
So, yeah, well, thanks,
Ionic, for calling in.
Thank you.
No problem.
Thank you for having me.
You're very welcome, and if
anyone else wants to call in,
again, the number toll-free,
800-732-0442, from within
the U.S., and from outside
the U.S., country code 1-213-415-1047.
Thank you, Ionic.
See you later.
Okay, he's gone.
No dial-toon?
You do that in your show,
have a dial-toon.
Yeah, well, I just pick up my
speakerphone here, and then
there's our dial-toon.
There we go.
He's been hung up on.
Yeah.
So, yeah, so freaking is
lucrative.
Yeah, yeah, yeah, yeah.
Fishing is definitely...
It's not about freaking.
Yeah, you know what?
I was about to say about
freaking, because I just caught
you on the word.
It's lucrative there, too.
There's a lot of fishers
using freaking to actually
get by.
There'll be a soundbite that'll
come back to haunt me.
Yeah, no, but no, it's true.
I mean, if you can spoof
caller ID, you can do a lot of
damage to scamming people.
So, I mean, obviously, that's a
big thing.
Phone phishing, I guess,
which is in Chapter 6, you know.
So I go into detail on, you know,
all the phone problems with
phishing.
So I think let's get into the
evolution of phishing, which is
what you really wanted to talk
about.
Yeah, yeah, a little bit.
Well, here's my big issue right
now, and I'm going to just rant
for a sec, if you don't mind,
Strom.
Go ahead.
Okay, cool.
I just want to make sure I don't
ruin your radio show or anything
going on.
No, I think this radio show
historically has been nothing
but rants, so you're on
safe ground.
Well, my rant is this.
Most people in the game of
anti-phishing, fuck you.
You don't know what you're
talking about.
That's my rant.
So, here's my problem, and I'm
going to diss this out
personally.
It's my chance to say this, but
basically, anti-phishing
working group and all those
types of people out there are
all vendors, and all they're
doing is trying to make money
off people's, like, not
understanding the problem.
And I have a big problem with
that because, you know, I
technically am a vendor, but I
do not sell them what I call
snake oil.
I do not, you know, and I don't
go around selling them.
I'm actually more of a good
Samaritan more than anything.
So, they can come to us when
they need stuff, and that's
usually how we do things.
But, the whole point is, is
that from a true security
standpoint, and BinRev is all
about supporting, you know, the
hackers and the freakers and the
crackers out there.
And the reason why is because
they are the cornerstone to
keeping our technology in, you
know, in check, you know.
So, from my perspective, I take
the same stance when I dealt
with phishing is that these
people, these vendors out there
go, oh, look, we've got this
cool technology called PassMark,
SiteKey.
Let's give it to Bank of
America.
And what that is, is basically
it's a two-way, two-factor
authentication, also known as
market speak.
And what that does is shows you
a picture of, like, something,
and you choose these pictures
and stuff.
The worst part is, if anybody
knows anything about two-factor
authentication, you're not
supposed to do it in-band,
you're not supposed to set it
up in-band, and you don't go
releasing a press release on it
and saying, hey, phishers,
guess what, we just installed.
You know?
Dumb, dumb, dumb, dumb, dumb.
Exactly.
So, my point is to say, yeah,
then I see the next email come
out.
Dear phished user, we're putting
in our new SiteKey system.
Please sign up now to, you know,
sign up for your SiteKey, you
know.
And they sign up, and it turns
out that the phishers are sending
them their SiteKey and doing
that in the middle of attacks on
this stuff.
Plus, I hate to say that,
PassMark Security's product does
not stop phishing.
It does not even address malware,
and I hate to say it, the
evolution of phishing will be
malware.
People are sitting there saying,
oh, you know, anybody notice
that the phishing has gone down?
Or they'll say, oh, yeah, the
takedowns are really lowering
those phishing numbers.
Well, here's the news to you.
Taking down things is a bad
thing right now.
You know why?
Because the majority of phishing
spoof sites, you know, the
malicious sites, are hosted in
the United States.
That is to our advantage right
now.
Why?
Because ISPs are your friends.
And there's this nice little law
called Title 18 of USC
1030 that allows you, with the
Terms of Service, to defend
yourself and your network.
And so the ISPs can take some
action that don't require the
FBI or, you know, having to
wait on the bureaucracy of the
government to actually take some
action.
So what's happening is people
are going, oh, I want to take
this down and, like, you know,
get these sites down in, you
know, 15 minutes or 30 minutes.
One, phishings are moving
anyway, so they're not really
going to take your problem as a
threat.
Two, guess what I saw today?
A Roadrunner account that
actually was compromised in using
their site.
How do you take down a modem user?
Do you cut off the Internet?
How do you get a hold of Time
Warner to do it?
You know?
Or what happens when it's five
different modem users from
different things and they
basically start distributing the
actual information?
Or they just move to Korea or
China and countries that don't
want to talk to you or even
help you, right?
Whereas if you didn't take down
and you actually said, hey, why
don't we monitor this and, like,
build something where we can
kind of, like, sever them off into
this corner and we can get more
intelligence on them, you know,
and understand what they're
doing and do the data recovery
and find out what they're
stealing.
Because if you can find out what
they're stealing, you just give it
to the bank that they stole it
from and the bank can handle
actually doing the actual
mitigation of risk.
So instead of sitting there going,
take downs, because they're still
going to get those numbers and
everybody's still black boxed in
what they stole, you know, put
monitoring systems in place or
snort alert files that say, hey,
this looks like a phishing site,
let's keep an eye on it.
Instead of sitting there going, oh,
gosh, we don't want the users to
log in.
And education is one step in the
defense in depth, you know, model
here.
And education, the people that are
getting phish or grandma and
grandpa, they're never going to
hear about it.
And guess what they're running?
Windows 98.
So they don't have Service Pack 2.
They don't have any information
connecting them.
And the malware is going to hurt
them more, you know.
So my rant on this is that, you
know, vendors need to be careful
what they're buying because
there's keyboards out there.
Like, virtual keyboard is another
thing that they've sold out to
these companies.
Citibank, I gave a, Strom, do
you have the link?
Yeah, it's a, let me actually
tiny URL it here.
Okay.
So go ahead about virtual
keyboard.
Yeah, so basically Citibank in
India has engaged in the virtual
keyboard.
What that is is basically
everybody is talking on the news
about key logging, which means
it's logging your keystrokes.
Now, the problem is, is that if
any vendor actually took the time
to analyze all the malware that
actually was involved by phishers,
and this malware would be Burbu,
Mick Glider, Snapper, Hackstore,
PWS Bank, or, you know, things
that are actually, like, designed
to steal your data off your
bank, they don't use keyboard
logging.
They don't actually log the
buffers in your keyboard because
it's unscalable.
Imagine having to try to keep
track of that.
Have you ever put a key logging
hardware device on something and
looking through a notepad and
saying, wow, what a mess?
I can certainly imagine.
That tiny URL, by the way, is
tinyurl.com slash B as in boy, M-M-U-W.
Okay.
And so that's the Citibank's, like,
virtual keyboard.
If anybody actually uses, like,
tamper data or live HTTP headers,
go ahead and, like, fake log into
that.
Like, don't really log into it and
just, like, set up something fake.
And hit submit.
And you'll see the actual HTTP headers
that get sent.
It's a post content that gets sent
to the server.
Well, when you get hit with malware,
it doesn't actually do keyboard
logging.
It actually does what's called
form grabbing.
It logs your posts and your get
sent, you know, submissions.
So when you send submit, it doesn't
matter if you have a virtual
keyboard because it's not looking
at the keyboard.
It's looking at your browser.
And it's actually logging in via
a browser helper object.
And so it'll hook into your
browser and, you know, basically
you can see the malware send
your data off, actually, if you
had, like, headers on, on your
IE, if you were infected.
So, like, it actually takes that
and so it bypasses any of the,
you know, keyboard, you know,
strokes or anything like that.
It has nothing to do with it
because it's more scalable just
to say, hey, look, here's the
URL.
It's hdbbankofamerica.com or
citibank.com slash, you know,
here's the information and then
here's the content in their post.
And their content will show their
password and their login, you
know, plus their cookies sometimes
depending on what they're
gathering.
But the whole point is that
virtual keyboards do not work.
So don't let some vendor, like,
you know, sell you this because
it's crap.
It's crap software.
You know, so my biggest issue
there is that another rant is
that vendors need to start,
you know, the banks, the
institutions need to start
taking more responsibility.
Image versus reality.
The banks don't really care about
you, I'm sorry to tell you.
Did you have something to say,
Strom, I thought?
Yeah, well, I was going to say,
well, if this doesn't work,
what does work?
But I'm sure you're going to
get into that in a short way.
Oh, yeah.
Well, I don't want to pump my
technology, but I do want to pump
like some common sense into
people.
You know, like we did build some
technology that actually, you
know, can see someone mirroring
your site.
We can see when they actually
like start testing your site.
So we see the fish way in advance
and it sits on the bank.
But all we did was actually study
how fishing works.
All I'm saying to the sellers of
the world that sell people in our
fishing, stop doing it for money
and do it for actually solving the
problem because really no one's
going to solve the problem for
tomorrow.
They're going to just solve it for
this second, you know.
And they go, oh, look, two-factor
authentication.
By the time they install that, a
bank takes about a year and a half
to get anything installed, okay.
By the time they install that, we're
moved on and the fishers have
to, you know.
So it's like you have to be a
little bit more realistic.
What's going to work in the long
run?
Find the weaknesses in how
fishing works, okay.
Look at the methodology that they
use and say, hey, what's obvious
in all of these things?
And then start building that off of
those weaknesses so that you force
them into a corner of making it
more difficult to evolve.
Because the name of the game is
numbers when it comes to fishing.
There is no absolute security.
There's no silver bullet.
So what's going to happen is
basically you've got to play the
numbers game, just like in spam.
So what you do is make fishing
difficult.
If you really make it difficult,
you throw away all the kitties that
are doing it and picking it up
just in Romania, you know.
And then what happens then is you
basically, you know, have a few
people that you can focus on and
then go after and go for
apprehension.
Right now, everybody's like, oh,
gosh, I'm overwhelmed with all
this fishing.
Well, that's because you guys are
making it easy for them, you know.
So you've got to know how to
actually, like, you know.
Anybody who wants to, like,
interest in learning more, just,
you know, email me offline, you
know, info at securescience.net.
And, you know, I can go into
detail about, you know, more
common sense, especially if you're
an ISP listening.
You know, we've got a free service,
you know, counter phishing your
ISP, you know, so that you can
basically, you know, have some
things stepped in so that you can
see if a fisher's about to set up
shop and things like that.
So, you know, you know, but I'm not
here to promote our stuff.
I mean, most of the stuff we do for
ISPs is free anyways.
So, but, you know, the image
versus reality problem I'm having
is that basically what's happening
is these banks and these
institutions are more concerned
with their image of what people
will think because they don't want
to lose their customers rather than
the reality that the customers are
still getting owned but they don't
see it.
You see, the fishers, you know,
the numbers are looking like they
go down because the fishers are
evolving to more clandestine
techniques.
So what's happening is malware and
things like that.
You know, the Windows 98 users have
no clue that it's been infected for
ages and that they're sending off
data.
And I mean, like, I'm literally
looking at a file right now that
I'm grabbing and I'm actually, you
know, like I told you about that
hack earlier and the personal hacks
and I'm, you know, getting this
data live and the average per day
is about 10 megabytes of stolen
data, you know.
So these people are getting their
data stolen like a horde of 10
megs at a time, you know.
And so, and, you know, it's still
working and the numbers are still
keeping up and these malwares last
like two to four weeks with
undetectable, you know.
And so, from our perspective, you
know, just because you don't see
phishing hitting your site doesn't
mean that you're not getting owned
and that's also, you've got to
remember all the stuff they stole in
2004, you don't know about.
You know, I do.
I actually have a site with 400 gigs
of stolen data on it.
So it's free.
So any bank that's out there
possibly listening, you know,
you know, come and, again, send us
info at Secure Science and say,
hey, you know, I want to find out
if our customer's data has been
stolen and we'll send you a PGP
file and set you up to go so that
you can help, you know, your
customers mitigate the risk.
In three months' time, we're
actually, we've invested in some
stuff that's neat.
What we're going to do is an
identity theft system, basically
all the data that we have, we're
going to start giving it to the
customers.
Now, we're not going to give them
the sensitive data.
We're going to give them the
numbers to call to the banks that
they've been compromised from.
So if they've been compromised
like Wells Fargo, it'll say
Wells Fargo and their 1-800
number for their hotline.
What this will do is push the
banks into, you know, it'll
basically provide pressure on
the banks from the customers
because now the secret's out,
you know.
The banks aren't doing their
job, you know.
So basically, you know, so
that's where I'm coming from
there.
And so instead of taking this
image of we're not getting
phished, start applying and
learning about malware.
Learn how to analyze malware.
You know, we're doing training
sessions, if I can promote
myself a little bit.
We do do training sessions on
actually malware analysis and
how to look at this stuff and
actually how to do shortcut
tools.
Also, I'll be speaking at
Shmookon.
There's a free talk for you,
you know, other than
registration.
Go there and I'm showing a
lot of shortcuts to actually
how to look at phishing
malware and recover the data.
Yeah, definitely.
Although an attack that
occurs to me, you know,
based on what you just said
is, you know, send an
email, we believe your data
has been compromised.
Please call the bank at
800 number and they call
it and it sounds like
Wells Fargo, but in reality
it's just something you've
set up on an asterisk box.
Right.
Now, the whole thing
about that is what we are
going to do is we have
daylight fraud prevention in
there.
So, if you're not at the
site, we're going to, you
know, provide, you know,
we're going to provide as
much education.
Plus, I mean, the problem
with this is that that's one
of the reasons why we
didn't put the information
online to these people
because, I mean, it's a
Fisher's gold mine, you
know.
But what we're going to do is
out of band SMS messaging
and, of course, there's SMS
spoofing out there, but we're
going to basically have it
more of an extendable system
so that they don't
necessarily run into the
email.
Because we're going to
say, we will not email you
this information.
We will not email you this
at all.
You know, so that basically
they are going to, you
know, we're going to have to
provide some information to
these people.
But the people going to
this site are already going
to be interested in finding
out if their identity is
stolen.
So they're going to be eager
to learn how to take
certain precautions.
So there's going to be a
lot of education on the
site.
So if they're already there,
then obviously, thank God
you're there because then
you're looking at education,
learning how to be more
careful with your data, and
you're going to find out
if you've got any stuff
stolen.
Another thing that we're
doing, though, with that
program is eventually we're
going to work with, like,
other, you know, institutions
and plug an API in there.
So if a user logs in, it
lets the institution know
right away that we've seen
some data in our
intelligence, you know, get
compromised with their stuff
so that the bank can be
responsible and say, oh, in
real time we let you know
and we basically will work
with you and then we can
have an ActiveX thing that
will rid the malware off your
system.
So from the bank, though.
And, I mean, there's
phishing and still social
engineering.
There are so many ways to
get someone to fool them.
But it's an old-school
scam.
You could do it via fax.
You could do it via home
mail.
I mean, that's unfortunate
about that part.
But at least you'll have some
more technical knowledge of
how to be online safer in that
sense.
I mean, I don't want to
discourage anybody from using
online banking.
But, you know, a lot of it is
just having common sense.
If you feel any inkling that
anything is suspicious, then
call your bank the number you
have on the back of your
credit card.
You know?
And so that's one of the
things I would promote.
It's like, you know, just
take the common sense
precautions and trust your
instincts.
If you don't trust it, don't
follow through.
Don't click on that link.
But speaking of image versus
reality, also another problem
we have with those image
people.
T.D.
Waterhouse doesn't get
phished yet, I guess.
I mean, they do.
But with mail, we're not
actually like a phishing
email.
You know, there's a few
little TV companies that
have been, like their bank
and everything.
But they're an investor
house and such like that.
And so I put up a link,
which you can probably put a
tiny URL to as well.
Yeah, I just tiny URL'd it.
It's tinyurl.com slash,
as in Apple, L as in Lion,
V, V as in Volkswagen,
Volkswagen, O.
That's it.
A-L-V-V-O.
Or if you want to type in
the full thing, it's
ip.securescience.net
slash exploits
slash td.html.
Yeah, as in T.D.
Waterhouse.
And what that does is you
click on that link and it
shows you that we're
actually using the real
www.tdwaterhouse.com
site.
That's 404ing.
Is it?
Yes.
Hold on.
T.D.
Waterhouse did?
Okay, hold on one second.
Well, it says not found.
URL exploits
td.html is not found on the
server.
That's weird because I
just went there.
Oh, I'm sorry.
I sent you the wrong
link, my butt.
Okay.
tdwaterhouse.html.
Okay.
My bad.
Well, let me
tiny URL that for our
listeners.
And that's
T as in David,
three, six.
T as in Tom,
the number two.
Yeah.
So it's tdwaterhouse.html
after the exploits.
And if you log into that,
basically what will happen
is it's a setup where if you
type in any credentials,
it's, you know, the domain
actually says www.tdwaterhouse.com.
That's because we're there,
but we're using a cross-site.
Well, we're doing HTML injection
that enabled cross-site scripting.
So we're actually like took over
the entire site.
So the bottom frame is
secretly ours.
And so if you hit log in,
it'll say,
thanks for your passwords.
They taste great.
And then the next page will take you
to our secure science site
underneath of that,
showing that that could have
been a fisher doing that.
And I told them six months ago
that this was occurring
and they still have not fixed it.
And it's, you know,
featured in my book on how to
actually set up the attack.
Yeah, so let's see.
It uses the,
the top is actually
the bottom frame.
Yeah.
And we could, I mean,
if you want to,
I can get real technical
and we can do a JavaScript
that would take over both frames
using the parent frame DOM API.
I'm looking at it.
I don't see anywhere
that says secure science.
Yeah, it's pushed all the way
to the end.
So you'd have to highlight
the entire URL.
Oh, okay.
So.
Yeah, you see how it's
all the way over there?
Um, I'm not seeing it.
Okay.
Um.
Oh, yeah, yeah.
There it is.
IP.securescience.net.
Yep.
So, yeah.
So basically on my site
underneath and then
if you log in,
it's just those,
uh, JavaScript popped in.
Now you can take over
the entire site,
which you can do
some real damage to.
Uh, in my book,
I actually show how
to break their SSL as well.
So you can actually,
like, end up compromising
SSL where you won't
get a warning.
You'll have a full block
up, um,
lock down at the bottom
that says, you know,
webbroker.tdwaterhouse.com
The top domain says that.
It's HTTPS.
Everything's perfect.
Just as how people
are taught to,
you know,
the basic information
that's taught to make
sure your SSL cert
is, you know,
accurate.
You can view the SSL cert
or say, you know,
you're at VeriSign
tdwaterhouse.com
But secretly underneath,
it's my SSL cert
embedded in there
that's actually doing
the encryption and decryption
because I've taken over
the frames.
So it's, it's,
you don't need the secret
key to break SSL.
News to some people,
but, you know.
Yeah, and I turned
a lot again that says,
thanks, your password
tastes great
and it takes me
to your page.
Yeah, it does.
So, and it shows you
which frame I'm in.
So, but yeah,
so, so, you know,
those are the things
that I'm concerned with
is like, you know,
the evolution of it
is they are getting smarter.
Recently when this book
got published,
the IRS,
I don't know if some people
saw it in Yahoo News
and Google News
that IRS got phished.
And what they used
was govbenefits.gov's
website.
And they did a redirect
attack.
So what happened
was it had an URL
where you could put
any arbitrary URL to it.
And so they basically
sent it to their phishing
site, but in their email
it actually was
to a .gov site.
So you'd go to the
gov site and then
take them to the
news site.
Now there are better
attacks, like Gmail
has one and Yahoo
both have one,
where if you're not
logged in,
what you can do
is set up a redirect,
a bypasser filters,
and basically you can
redirect people.
So once you log in
and then it takes you
to a phishing site,
so you could actually
set it up where it
just says, you know,
you log in the first
time and then it
shows an error page
saying, can you log in
again, you didn't
enter your password
right.
And then that second
time the attacker
would steal your
Gmail account,
things like that,
and then just pass you
right back to Gmail
again.
And then you would
be logged in looking
at your mail.
So you would never
know you left the
site because you kind
of didn't.
So it's kind of
interesting.
So that's what I
call vendors lending a
hand or institutions
lending a hand to
phishers.
In my book I
highlight how you
can do an Amazon
site without ever
having a spoof site
altogether.
So there's a lot of
different problems
with a lot of
different vendors.
And about 30
different banks I've
counted have the
similar problems.
So you just got to
be very careful and
the vendors need to
take responsibility.
There's things that
they can do to
detect phishing and
prevent phishing and
definitely not lend
a hand to phishers.
So I think my rant's
over.
Why don't you
explain how cross-site
scripting works?
Because I saw a
presentation on this
tour con.
It was very
interesting.
But I think a lot
of people...
Oh, you saw
Brian's little
thing, yeah.
Yeah.
Yeah, cross-site
scripting is basically
the concept.
I don't know if you've
explained SQL
injection or if your
listeners know how
SQL injection works.
Well, yeah.
Let's go over
basically what's
equal.
Yeah, it's
pro-parameter
manipulation.
And it's a
combination of
where, you know,
because of lack of
input validation, you
can put in certain
things like quote,
back, dick, left,
right, you know,
the greater and
lesser signs and
things like that.
And so what will
happen is if you take
like apple.com, for
example, and you go to
their search engine,
go ahead and type in
the strikeout, which
is in HTML would be
less than S, greater
than, and then type
in test.
You turn that in,
you'll see that the
word test reflected,
but it's striked out.
So what's happening is
it's actually injecting
your code as the
query as well.
And instead of
actually interpreting
it and converting it
to like a filtered
query and saying,
hey, you can't do
that, or it converts
it to the HTML version
of the HTML character
code set, it's
actually interprets
it, your browser
interprets that code
and executes it.
So cross-site scripting
can be very dangerous
because basically what
will happen is the
target site can be an
enemy to you because a
hacker or a fisher can
come along and use the
target site and gain
misplaced trust by
attacking your browser
and you still think
you're at the right
site and it's doing
the right things.
Because the problem
with the web itself is
it's blind safe.
When you go to your
website, you expect it
to work right.
If you go to your
bank, you expect them
not to be compromised
and that they're secure
and that there's nothing
wrong with their site.
But you really don't
know.
It's like driving out
every day.
Every time you go out
on the highway, you
don't know what to
expect.
So it's the same thing.
So in that sense,
cross-site scripting and
cross-user attacks, I
might chapter 4 and 5
get really detailed and
like there's so many
different layers of
HTTP type of attacks.
But cross-user
attacks is how I group
them up.
What happens is
basically you're using
the target server to
attack the browser.
So the end user
basically gets hurt.
And at the same time,
it compromises the
integrity of both the
target site and the
browser.
Does that make sense?
Hopefully that was a
decent description.
Yeah, it makes sense.
Okay.
So there's a lot of
different issues.
I mean, there's
obviously redirect attacks.
I mean, there's so many
different things you can
do to people.
But basically, it's
client-side attacks.
So that you're
basically, you know,
phishers are going to
employ these techniques.
They already do.
So with the malware
and the distribution,
they basically do IE
exploit code.
So that basically, you
know, launches something
on their computer.
So.
Don't be too quiet,
Strom.
I get me.
Well, I mean, no,
it's very interesting.
And you know so much
more about this than I
do that it's, you
know, it's...
Yeah, well.
I think you do some
pretty cool stuff.
You just don't talk
about all of it.
Yeah.
Well, I mean, at least
not within the context of
this show.
There's a lot of stuff
that I'd love to talk
about.
But, uh...
Yeah, you want to
keep your job.
No, I'm just kidding.
Yeah, my job is...
I like the ROI that I
live in.
Risk of incarceration
is a good thing.
But, yeah, so
basically, that's me
in a spiel.
I research fishing.
I track over 53
fishing groups, and I
have fun doing it, and
I do a lot of
forensics.
And, you know, if
you're an ISP out
there listening, you
know, feel free to
send me an email or
send Strom one to
say, hey, how can I
get a hold of that
guy?
You know, and, you
know, just talk to me.
If you're a bank out
there, definitely, you
know, we need to talk
too, because there's a
lot of steps that you
can do to help your
customers and keep your
image since you're
worried about it, you
know.
But that's...
I'm just going to tell
it how it is.
Anti-phishing toolbars
don't work, so don't
bother buying them.
People who, you know,
know what phishing is
aren't the problem, and
it's not going to lower
any numbers because you
already know what it is.
All they do is
basically make more
money for the vendors
so that they can feed it
to IDS systems that
also charge the IDS
vendors, so they're
basically just using you
for intelligence and
information to send to
them so that they can
make even more money
than what you've already
paid.
So, you know, there's a
lot of secure-by-marketing
companies out there, so
just be very careful any
banks that buy anything.
You know, we do do
product evaluation, so if
we, you know, you come to
us and say, what do you
think of these products in
the anti-phishing space,
we're going to be real
blunt with you about it.
And we're not going to,
you know, we're not
trying to sell you our
product or say our
product's better.
We believe there are good
products in the market, but
we just want people to be
very careful because those
guys are fishing for money
in the same way fishers are
fishing for your
information.
So just be careful out
there.
Yeah, if you want to go
to Lance's site, it's
www.securescience.net.
Yeah, com works now, too.
Yeah, and .com.
It's pretty bland, and
we're getting a new site
set up and stuff, but, you
know, my book information
is on the front page if
you're interested in
getting a copy.
Yeah, Fishing Exposed by
Lance James, it just came
out, awesome book.
The list price is $49.95,
but Amazon has it for how
much, like $32?
$32, and BookPool, once
they get back in stock, had
it for $28, but they're
not in stock.
They sold out pretty
quickly.
But you can go also on
eBay.
I'm sure there's some
different vendors out there
that are selling it, so
it's a neat book.
I mean, from my
perspective, I'm glad that I
got the information out
there.
Books like that, more
books need to be written
like this, in the sense
of, you know, it has its
market.
I didn't sit there and
go, hey, this is a
fishing site, this is what
fishing is, because anybody
who's buying this book
already knows what that
is, because they're
dealing with it already.
And the people that get
victimized aren't buying
the book anyways, because
they don't know they were
victimized.
Right.
This book jumps right
into the meat of the
matter.
Yeah, law enforcement
programmers, security
professionals, you guys are
the ones who want to buy
this book.
You know, it's not really,
you know, for the faint at
heart on technology.
It's pretty heavy duty.
So, and it'll give you a
lot of techniques to
basically keep track of
fissures, and, you know,
I kind of spill my beans
in there.
At the same time,
Microsoft made a comment,
they go, you do a great
job of holding on to your
trade secrets while still
remaining detailed.
I'm like, well, $50 I
can, you know, I'm not
going to sell myself to
Microsoft for $50.
You know, but, yeah, so
it's a very detailed book,
and I really hope that
some people who are into
this or want to do more
research into it, check it
out, and, you know, and
feel free to contact me
any time, and if you have
any questions about the
book, I think Singres,
the publishing company,
also has an about, a
contact the author page,
so you can do like a
solutions worksheet and,
you know, contact me
through them as well.
Yeah.
Your email address is,
do you want to give
that out on the air?
Well, I'll give out
info at
SecureScience.net, it
will get to me.
Yeah, info at
SecureScience.net, or
if you, if you just
email us at
BinRevRadio, and it's
for Lance, we will, we
will gladly forward it
on.
I do have a top-level
domain email address
that I'll hand out.
Oh?
FL at WS, flaws.
SL at WS?
Yeah, yeah, FL at WS,
that's Frank,
Oh, flaws, flaws,
that's hilarious.
Yeah, at WS, so it'll
get to me as well, so.
That's awesome.
Yeah.
If your client
supports it, it's
technically, you know,
not working in a lot
of clients, which is
technically a violation
of RFCs, but whatever.
Anyways, but yeah, so,
yeah, feel free to email
me if you have any
questions, or, you
know, or email Strom,
or, you know, just go
grab the book and email
Singres or whatever.
I think there's a sample
chapter on Singres'
site, the chapter one, so,
you know, it doesn't
hurt to go check it out
before buying the book.
I always like the try
before you buy as well.
And if you're really
into the whole try
before you buy thing,
there's always the age-old
option of going to
Amazon, or sorry, going
to Barnes & Noble, and
just taking the book and
sitting in the aisle and
reading the whole thing.
Yeah, and then supporting
the author and buying it
anyway.
Yeah, buy it anyway.
No, but yeah.
No, but either way, I hope
people enjoy the book, and I
thank you, Strom, for having
me on the show regarding the
book.
Hey, I thank you very much
for coming on the show.
This makes it really
interesting, and it's been a
very interesting technical
show.
Yeah, well, you know.
Yeah, I mean, if people
need me to slow down, they
can call in and say, hey,
man, slow down.
Yeah.
But I figure the people
listening to the show are
pretty aware of, you know,
the problem at the minimum
and pretty technically
capable.
Yeah, and if people actually
have phishing questions that
they send, for those of you
listening, if you want to
email us and ask your phishing
questions, we will forward
them on to Lance.
You get them answered, yeah.
Yeah, and answer them on
the air next week.
Yeah, no problem.
So, cool.
Well, I think we're going to
start wrapping things up.
Let's see.
Announcements.
I don't have any
announcements.
Let me think.
Yeah, no announcements this
week.
I have an announcement.
Announce away?
I got a rabbit, and he
loves me.
A rabbit.
Huh?
A rabbit.
Yeah, no, it's a little
baby rabbit.
He loves me, or he.
I can't tell you.
You can't really tell, but...
Is it the deadly killer
rabbit of, I forget the
name.
Actually, it was funny,
because yesterday I was
like annoying it, like
somehow, I think I was just
playing around, and I don't
know if it was playing or
not, but I got to the
point where usually it's
nice and soft and gentle
and like sniff you out and
stuff.
The minute I put my
finger next to it, it
would do this thing where
it clawed at me.
I thought that was
hilarious.
I was like, whoa, that's
cool, like you're
defending yourself.
But I think it was just
like playing around, and
it was trying to play
around.
You know, we may have
had a misunderstanding, but
you know, there's my
announcement for the
week.
Well, behind the
rabbit.
There's only one
announcement.
It is the rabbit.
Sorry.
I had to do something
like that.
Crazy.
Do you have any
shouts?
Shout outs.
Everybody who went to
my party, you guys rule.
Tom, you rule.
Thanks for shout out to
you for bringing me on the
show in the first place.
Lucky225, you rule, and
we're going to get you
somewhere.
And then Josh
Bishaz, just because I
like to shout out to him
because I know he loves
it.
Let's see, who else?
My wife, if I can, just
because she's cool.
Great.
And hot, too, as you
notice.
Let's see, what else?
Everybody just in 2600, all
around the world, everybody
involved in BinRev,
everybody involved in the
hacker scene.
Just, you know, keep it
real and keep doing the
thing because you're
keeping the technology in
check and that's
important.
There you go.
Cool.
I'm going to give shout
outs also to Josh for
holding me up this weekend
so I can go to your
party.
And shout to Lucky because
Lucky's cool and I had
to, he actually, I don't
know if he's going to kill
me for announcing this on
the show, but he got
extraordinarily drunk at
your party.
Oh, yeah, he did.
Can I imitate him?
I've got to make fun of
him.
Sure, go ahead, go ahead.
Okay, he's hitting on this
chick and she's like the
catering director or
whatever, she was cute,
you know, but he's all,
hey, do you want to be
Seattle?
Do you want to, she's
like, ha ha.
So whatever, do you want
to be Seattle means Lucky.
Props to you, they're still
trying to keep it going.
It was hilarious though.
Yeah, actually we were
walking back from your
party to the car and,
oh, he's messaging me now
saying ha ha ha.
Uh, he's hating us now.
Yeah, we were walking
back.
Um, he's fearing, he says.
Yeah.
Yeah, he was walking
back.
We might have one last
call in quickly.
Uh, he was walking back
from the car, or to the
car and he's like, we're
walking through the park
garage, so he's parked at
the mall next to where you
had your party and he's
like saying to all these
girls and the car's open
windows, I'm way out of
your league.
Oh, I know, I know.
It was like staggering
around.
Nearly like knocked a fish
out of Josh's hands, you
know, and actually at one
point I had threatened him
and I said, you know,
Lucky, if you, um, you
know, if you don't shut up
with this, I'm, you know,
I'm going to hit you on
the head with the book
and he didn't, so I took
your book and I whacked
him on the head pretty
hard.
Didn't it have a great
whopping sound though?
It did.
It made like this awesome
whacking sound that like
reverberated throughout the
parking garage.
It was loud as hell.
It's such a great sound.
My wife hit me with it.
She goes, wow, you wrote a
book that makes a whopping
sound.
I should hit myself on the
head with it just to, just
hear what it sounds like.
So just for demonstration,
that's an awesome sound and
I have a headache.
Yeah, I know.
It's, it's, it's, it's hard
to do over a radio, but you
know, um, yeah, it's such a
cool sound and I'm like, it's
surreal to me that I actually
wrote this thing because you
do everything in chapters so
you don't think about the time
it takes or whatever.
But once it's in like, you
know, book form, you're just
tripping on how much you
actually wrote.
You're like, holy crap.
Yeah.
How much, how long did it
take you to write out of
curiosity?
I, well, the contract was for
three months, but you know, it
took like five to six because
of the fact that I have a real
life.
Yeah.
I can imagine.
So, yeah, so I told them, I said,
you know what, and they were a
little cool about it.
They didn't really care.
They just do that because they
want to be first to market and
they still are.
I mean, there's no other book
like this on the market.
So there's one other fishing
book and I'm not going to
comment, but I've heard from
other people.
It's, you know, it's not
fearing, as Lucky would say.
So, but, yeah, so, yeah.
Oh, you had another call.
Well, we have someone who says
he's going to call in, but he
hasn't even passed through the
screener yet, so.
Yeah, he used to IMD and said,
I don't remember hitting, getting
hit on the head when I was junk
or anything about Seattle.
Yeah, and he messaged me, I fear
Seattle.
I think he feared the chick he
was talking to and he lost his
words.
Yeah, yeah.
Oh, I'm going to announce that
TWAT Radio is back up, if I
would please announce it.
So, yeah, TWAT Radio is back for
all of you people who are
wondering about that and
randomly, yeah.
So, anyway.
Oh, I have an announcement.
Yeah, announce away.
Yeah, Google works.
No, just kidding.
No, my real announcement is I
actually found something that's
kind of scary.
In IE and Netscape, you can
actually, there's like a
default clipboard reader.
So, what happens is in IE, you
can actually pull people's
clipboard information, so if
you ever clipboard your credit
card and stuff, you might want
to clear it before you get
online for those IE users.
Hopefully, there's not many
listening to this show.
Yeah, well, I'm an avid
Firefox user here.
Yeah, I figure most of the
people listening to this show
might be, but just letting you
know if you, you know, were
curious, if you do use Netscape,
it works in Netscape as well.
There's a way to turn it off,
but I'm too lazy to announce
that part next week on
BIMREAD.
Next week on, anyway, our
side of the week is
securescience.net.
Oh, cool.
Yeah, go there, learn, enjoy,
and buy the book.
Yeah.
We're not here...
If you're involved in
tracking phishing, send me an
email, like if you've ever
gotten any stuff where you
actually had some info on
like phishing and stuff, and
I'll put you on my super
secret list.
Sweet.
Yeah, we're not here to
pimp anything majorly
commercial, but Lance...
No, it's all free.
All the stuff I've talked
about is free.
Yeah.
No, but as far as the book,
Lance is a cool guy, and he
deserves your royalty payment,
so buy the book.
Yeah.
It's really, you know, when
you write a tech book, it
ain't about the royalties.
It's just about getting the
information out there.
So get the book just because
you guys want to learn stuff,
right?
Yeah, get the book to learn.
Get the book because
learning is awesome.
Yeah, and then the
publishers can pay me.
Yeah, as always, you can
email at radio at
binrev.com, and our
closing music tonight is
something from
epitonic.com.
It's called Mr. Kennedy by
The Soft Boys, and it
seems like a pretty cool
song.
Anything else you want to
announce before we go?
I'm pregnant.
Just kidding.
No, I don't know.
No, everybody, thanks again
for listening.
Yeah, thank you for
listening, and we'll see
you next week.
Same hack time, same hack
channel.
Coming into Harrisburg, never
seen a body look so dense.
Tell me, Mr. Kennedy, have you
ever seen the clouds so dense?
Come into Cleveland, riding in the
van with Zeppardale.
Tell me, Mr. Kennedy, have you ever seen the clouds so dense?
Maybe it'll rain
Maybe it'll rain tonight
Maybe it'll rain
Maybe it'll rain tonight
Coming into paradise
Thinking that I must have been here once
Me and Mr. Kennedy
Haven't seen a blade of grass in months
Maybe it'll rain
Maybe it'll rain tonight
Maybe it'll rain
Maybe it'll rain tonight
Here she comes
Here she comes again
Here she comes, here she comes, here she comes, here she comes, here she comes
Coming into Pittsburgh
Dreaming of a thousand open shops
Me and Mr. Kennedy
Stretching out to catch the first few drops
Tell me, Mr. Kennedy
Can you make it rain?
Can you make it rain tonight?
Maybe it'll rain
Maybe it'll rain tonight
Maybe it'll rain
Maybe it'll rain tonight
Maybe it'll rain
Masked on Won't totally
kid
Maybe it'll rain today
appeared onäus
My Natalie
Maybe it'll rain tonight
Maybe it'll rain today
Maybe it'll rain tonight
Or two
Could it rain tonight?
Maybe it'll rain tonight
could it burn tonight
Thank you.