WEBVTT 00:00.000 --> 00:09.460 This is dedicated to all the hackers and the crackers, to the hackers and the crackers. 00:09.760 --> 00:15.520 I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you 00:15.520 --> 00:16.600 and a fag pwned. 00:16.720 --> 00:21.640 In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold. 00:21.900 --> 00:26.440 I was a dick with my 56, now with my cable I'm able to get that stable. 00:26.440 --> 00:32.460 On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero. 00:32.680 --> 00:38.360 In a flash, I'll screw you on burning Dreamcast. You need some ISO? Let me through my hard drive rifle. 00:38.700 --> 00:43.520 Our exchange you could never stifle. In a digital hug, you just caught the love bug. 00:43.840 --> 00:47.540 I bootlegged your CD, I caused a fight between Un and Jay-Z. 00:47.880 --> 00:52.100 Your CG, it's all gonna be free, whether we take it by force or we take it nicely. 00:52.220 --> 00:56.280 You feel that rattling your bones? When I tell you we just hacked out Jones. 00:56.440 --> 01:00.720 And NASDAQ leaves you flat on your back, cause I am he who loves to hack and crack. 01:00.960 --> 01:03.440 Cause I am he who loves to hack and crack. 01:03.920 --> 01:06.740 This is dedicated to the hackers and the crudents. 01:07.080 --> 01:11.640 Serial codes, source codes, ISOs, RANs, SIFs, SIFs. 01:11.880 --> 01:14.200 This is dedicated to the hackers and the crack. 01:14.200 --> 01:18.180 Hello everybody and welcome to Binary Revolution Radio. 01:18.180 --> 01:23.440 Back once again this week for episode number 186. 01:23.680 --> 01:28.240 This episode is coming to you on February 13th, 2007. 01:29.160 --> 01:34.140 I am Stank Dog back with you again this week and probably for another few weeks coming up. 01:34.140 --> 01:40.400 And I am actually very happy to have on the show this week a new first-time co-host. 01:40.980 --> 01:43.800 But someone I've been corresponding with via email here recently. 01:43.920 --> 01:47.380 And someone whose work that I have read for several months now. 01:47.860 --> 01:51.380 And that person is, of course, Scott Baranato. 01:51.580 --> 01:56.140 Who is a senior editor and writer for CSO and CIO Magazine. 01:56.880 --> 01:58.140 So Scott, welcome to the show. 01:59.160 --> 02:00.580 Thanks for having me. I'm looking forward to it. 02:00.580 --> 02:04.060 Now, I mentioned that I've been reading some of your work for a while now. 02:04.660 --> 02:06.540 Mostly through CSO Magazine. 02:08.220 --> 02:11.380 CIO Magazine, excuse me, CSI would be a completely different topic. 02:11.940 --> 02:13.640 CIO Magazine as well. 02:14.060 --> 02:17.940 But how long have you been writing, actually, about security and about technology? 02:19.020 --> 02:20.260 Well, I started with the technology. 02:20.380 --> 02:22.820 I've been at the technology for about 10 or 12 years. 02:22.960 --> 02:26.440 I sort of cut my teeth in grad journalism school on technology. 02:26.440 --> 02:31.160 I got a technology beat in Washington right as Netscape went public. 02:31.400 --> 02:36.320 I was actually in Washington when that happened, writing about it for kind of mid-sized newspapers around the country. 02:36.420 --> 02:37.600 That was part of my grad program. 02:38.220 --> 02:39.740 So I was kind of right place, right time. 02:39.880 --> 02:43.740 And then I spent a few years at PC Week picking up some fun beats. 02:43.820 --> 02:46.160 And that's where I started with security. 02:46.160 --> 02:49.480 And then from PC Week went to CIO Magazine. 02:50.660 --> 02:53.680 CIO, I wrote almost exclusively about security after a while. 02:54.360 --> 02:58.360 And was part of the team that launched CSO Magazine at CXO Media, the company, 02:59.040 --> 03:02.360 which was dedicated, obviously, to security, those topics. 03:02.540 --> 03:08.020 So it's been about four years now with CSO as sort of my primary responsibility. 03:08.780 --> 03:11.080 And actually, I read several of those magazines. 03:11.240 --> 03:14.920 Actually, isn't PC Week, that's E-Week now, right? 03:16.160 --> 03:16.720 That's correct. 03:16.800 --> 03:19.900 It had switched over right as I was leaving there, actually. 03:20.240 --> 03:22.460 So I was burnt out on the new stuff. 03:22.540 --> 03:23.800 I covered the Microsoft trial. 03:24.320 --> 03:25.940 I covered the early days of the viruses. 03:26.320 --> 03:32.740 And when you do that at a weekly, which is really daily deadlines, it kind of kills you after a while. 03:32.960 --> 03:37.280 And I had aspirations of doing feature writing, which I've been able to do at CIO and CSO. 03:37.280 --> 03:41.640 Yeah, and actually, since you mentioned that, that's kind of a good point for me to mention, 03:41.740 --> 03:47.520 that I just got my new issue of CSO Magazine like three or four days ago from this episode. 03:48.320 --> 03:54.160 And you have the cover story in that one, the copper, the metal story. 03:54.160 --> 03:59.120 I've got to tell you, it was a really great story to research and write, a really fun story. 04:00.080 --> 04:06.380 I hope you Lerscheners get to take a chance to look at it because it's something that you sort of never see coming. 04:06.380 --> 04:11.320 And when I started researching it, I couldn't believe, you know, what I was hearing out there. 04:11.520 --> 04:18.520 And essentially what happened was China needs a lot of metal, and we have a lot of metal here. 04:18.700 --> 04:24.580 And what's happened is there's been sort of all sorts of little gangs of people here stealing metal to sell it to scrap yards, 04:24.680 --> 04:26.460 and then the scrap yards in turn sell it to China. 04:27.220 --> 04:31.340 And you've ended up with this epidemic of copper theft around the country. 04:31.340 --> 04:41.100 And it seems to map very closely to where there's crystal meth problems for reasons that in the story become clear but are quite surprising. 04:42.020 --> 04:47.300 And it's really an incredible story about just what's going on out there. 04:47.480 --> 04:54.360 You have no idea until you start reading the stories about where people are going to steal copper and what they're doing to get their hands on it. 04:54.900 --> 04:59.040 Well, and I think we mentioned on an episode, very briefly, just passively on an episode, 04:59.040 --> 05:04.920 because I had seen something about there's a problem, I guess, with people. 05:05.880 --> 05:11.540 I think it was nickels and pennies specifically where the value of, for sure, the penny, 05:11.620 --> 05:17.000 and I think the nickel is included, where the value of the metal in the coin is worth more than the actual coin itself. 05:17.840 --> 05:20.900 And the government was having to have some sort of crackdown where they say, 05:21.300 --> 05:24.240 remind people that destroying currency is a federal offense. 05:24.900 --> 05:28.320 You know, let us waste money to make money that's not worth the money we're making. 05:28.320 --> 05:30.960 But it's a federal offense for you to destroy it. 05:31.040 --> 05:33.400 I mean, there's actually people melting them down, right? 05:34.420 --> 05:36.140 Yeah, the economics are amazing. 05:36.260 --> 05:40.140 Now, you have to remember, copper, about five years ago, was about 65 cents a pound. 05:41.100 --> 05:43.080 And that was sort of historically low. 05:43.820 --> 05:49.420 And then China started buying it up, and people weren't making enough to replace what China was buying. 05:49.420 --> 05:56.020 And last year, it got so high, up to just about $4 a pound on the London Metals Exchange, 05:56.700 --> 06:02.380 that it started to become more expensive to produce coinage than what the coins were worth. 06:02.480 --> 06:06.440 So, for example, it cost about a penny and a half to make a penny, 06:06.680 --> 06:10.060 which means every penny you make, you lose money. 06:10.440 --> 06:14.020 And, you know, people have been trying to get rid of pennies for decades and decades. 06:14.020 --> 06:18.260 And for the life of me, I can't figure out why we don't have them, but why we haven't done that. 06:18.340 --> 06:21.860 But what people don't realize is that, you know, nickels, quarters, 06:22.100 --> 06:28.100 these coins are almost all copper underneath what you see on top, 06:28.160 --> 06:32.860 which is usually a thin layer of nickel or some other metal. 06:32.860 --> 06:36.620 So, there's lots of copper to be melted down in money. 06:37.260 --> 06:41.460 And, yeah, people are melting it down to sell it as sort of raw material. 06:42.180 --> 06:45.320 Well, yeah, it like goes back to the old days where people were grave robbing 06:45.320 --> 06:47.500 to get the gold teeth and stuff and melt them down. 06:47.620 --> 06:50.000 I mean, that's kind of... 06:50.260 --> 06:50.700 Isn't it... 06:50.700 --> 06:52.400 Come on now, it's a little bit silly. 06:52.760 --> 06:54.980 It costs a penny and a half to make a penny. 06:56.120 --> 06:56.400 How... 06:56.400 --> 06:57.400 Yeah, now it's... 06:57.400 --> 07:00.660 Only the American government could pull that off. 07:00.660 --> 07:04.240 You know, the arguments have been made ad nauseum. 07:04.400 --> 07:08.260 If you start doing research on it for eliminating the penny, it has no value. 07:08.720 --> 07:13.760 And, interestingly, one of the things they think keeps it around is retail companies 07:13.760 --> 07:17.560 and marketing because the penny allows them to charge $2.99, 07:17.780 --> 07:19.720 which sounds a lot better than $3, actually. 07:20.920 --> 07:22.260 Wow, that's... 07:22.260 --> 07:27.160 I believe it's the reason that people are reticent to get rid of the penny 07:27.160 --> 07:30.480 because then advertising is going to have to sort of just round up 07:30.480 --> 07:33.620 and then they can't say $2.99 because they can't make that change, 07:33.680 --> 07:34.620 so they'd have to say $3. 07:35.520 --> 07:37.900 Yeah, that's really interesting. 07:38.040 --> 07:39.360 I never thought about that at all. 07:39.480 --> 07:40.300 That's very... 07:40.300 --> 07:43.180 That's a neat little kind of social engineering tactic there. 07:43.340 --> 07:47.480 It does make people think differently when they see $2.99 versus $3 or whatever. 07:47.520 --> 07:50.980 That's going to kill Walmart, who tries to shave every little penny off. 07:51.780 --> 07:52.640 Well, think about that. 07:52.700 --> 07:55.540 Walmart, you know, is a pretty large company with pretty large influence, 07:55.540 --> 07:57.160 so think about that for a little while. 07:57.740 --> 08:02.480 Yeah, we've talked about those big Walmart-type corporations on the show before 08:02.480 --> 08:05.540 and the power that some of these people wield. 08:06.580 --> 08:10.080 And, actually, we might come into some of that later on in the show. 08:10.780 --> 08:13.760 But, anyway, let's actually go ahead and move on. 08:13.820 --> 08:17.800 We have some incredible, some really, really good email, I think, this week 08:17.800 --> 08:18.580 that I want to get into. 08:18.580 --> 08:22.220 So, why don't we take a second here and move into the mailbag. 08:38.780 --> 08:47.400 Okay, and our first email this week comes from our good friend Iron Geek, 08:47.400 --> 08:51.480 long-time listener and supporter of the show, Iron Geek, 08:51.860 --> 08:53.380 writes in to us to say, 08:53.500 --> 08:54.800 Hi, Stanky Wanky. 08:54.840 --> 08:58.220 See, that's a little, you know, that's a little, what's the word? 08:58.220 --> 09:00.100 Yeah, I was worried about what I should call you on the show, 09:00.180 --> 09:01.480 but now I'm not so worried anymore. 09:01.700 --> 09:04.220 Yeah, what's a term of endearment, we'll say. 09:05.280 --> 09:07.000 And co-host, and that would be you. 09:07.680 --> 09:10.400 I was listening to episode 185 on ads, 09:11.040 --> 09:12.860 and I thought I'd throw in a few comments. 09:12.860 --> 09:16.980 My experience as a publisher with various ad services has been as follows. 09:17.900 --> 09:18.300 AdSense. 09:18.660 --> 09:22.400 They won't run ads with me and won't tell me exactly why either. 09:22.520 --> 09:25.120 I know it's because of my quote-unquote hacking content, 09:25.520 --> 09:28.040 but they seem to have a huge double standard on this 09:28.040 --> 09:32.400 as they do run ads with other publishers of similar material. 09:34.100 --> 09:36.140 I'm going to read the whole email and then come back. 09:36.280 --> 09:39.480 I'm tempted to jump in right there, but I'm going to keep going. 09:39.480 --> 09:43.160 For, let's see, what was the next one he has is Canoodle, 09:43.360 --> 09:46.360 K-A-N-O-O-D-L-E, if you want to search for that. 09:46.800 --> 09:51.160 They were okay for a bit, but for some reason their ads stopped showing up on my site 09:51.160 --> 09:54.900 and emails to Canoodle asking why got no response. 09:55.640 --> 09:57.000 Well, that's not a good sign. 09:57.280 --> 10:00.440 It speaks volumes, I guess, about their customer service. 10:00.540 --> 10:04.120 But, you know, one experience, maybe that was just a bad day or something, 10:04.200 --> 10:04.800 or it got lost. 10:04.800 --> 10:06.340 I'll chalk that one up. 10:06.420 --> 10:08.880 So if anybody else has some Canoodle experience, by all means, 10:08.980 --> 10:10.620 write in and let us know. 10:11.940 --> 10:16.680 Third on his list is Yahoo, who never got back to him on getting into their beta. 10:17.820 --> 10:21.040 And the last one that he singles out here is Adbrite. 10:21.500 --> 10:24.920 I've been using them for about six months, and I'm having good luck. 10:25.080 --> 10:28.320 I wish their ads were better targeted like AdSense seems to do. 10:29.220 --> 10:32.940 Adbrite seems to serve ads based on keywords I use to describe my site 10:32.940 --> 10:35.740 as opposed to ones that were spidered by a search engine. 10:36.240 --> 10:41.520 On the bright side, Adbrite doesn't give a darn about the content I have 10:41.520 --> 10:42.980 or where I put the ads. 10:43.360 --> 10:47.060 A downside is that their control panel does not automatically use SSL 10:47.060 --> 10:48.680 in all of the places it should. 10:49.180 --> 10:52.760 Just authentication unless you tell it explicitly in the URL. 10:53.440 --> 10:55.440 Thanks for the show, Iron Geek. 10:56.980 --> 11:01.860 Well, I tell you what, Scott, I have some things to say about this, 11:01.860 --> 11:04.080 so I'm going to go ahead and start and jump in and interrupt me 11:04.080 --> 11:07.340 if you disagree or have something on this. 11:07.500 --> 11:12.360 But Google AdSense, first of all, has a lot of people have had problems with this. 11:12.460 --> 11:15.940 They pulled a fast one on a lot of different people 11:15.940 --> 11:19.100 by canceling their accounts without ever saying a word. 11:19.220 --> 11:20.760 They're just saying, we have canceled your account. 11:20.840 --> 11:21.680 They don't give you any reason. 11:21.740 --> 11:22.900 They don't give you any explanation. 11:24.100 --> 11:28.340 That being said, however, we know that hacking is against their terms of service. 11:28.340 --> 11:31.560 It's against the terms of service for all of these things for the most part. 11:31.860 --> 11:35.420 They're going to put in their legalese, for lack of a better word. 11:35.700 --> 11:40.200 They're going to put these type of topics in there to cover themselves. 11:40.640 --> 11:44.880 The issue is how hard are they going to actually enforce them. 11:45.420 --> 11:48.920 Are they putting it in there just so they have that back door to get out of something 11:48.920 --> 11:50.300 if something does become a problem? 11:50.300 --> 11:55.920 Or are they going to be real anal retentive and absolutely anything even close to the word hacking, 11:56.060 --> 11:59.580 whatever they think the word hacking means, something that they're going to ban? 11:59.780 --> 12:03.700 So, again, I'm not going to get on a big soapbox, 12:03.800 --> 12:06.820 but Binary Revolution is about that exact topic. 12:06.940 --> 12:07.820 So I'm sorry you were going to say? 12:08.460 --> 12:12.040 Yeah, no, those legal disclaimers are always so broad that they can do something like that. 12:12.080 --> 12:16.260 They can just sort of by fiat make a judgment call like that. 12:16.260 --> 12:19.540 But you have to wonder when you apply a blunt instrument like that. 12:19.680 --> 12:22.460 You're going to get some of the people you're targeting, 12:22.620 --> 12:24.840 but you're going to get a lot more kind of caught up in that too. 12:25.500 --> 12:29.480 Yeah, and I look at these legalese sometimes, 12:29.600 --> 12:32.880 and I like the ones that say, instead of saying quote-unquote hacking, 12:33.120 --> 12:38.160 which it is a vague term, it really is, and everybody's got a different definition. 12:38.380 --> 12:39.880 I like the ones that I read. 12:40.220 --> 12:42.660 I read them that says no illegal activity. 12:43.000 --> 12:45.600 That's a much more clear definition to me. 12:46.260 --> 12:49.940 Because hacking is just curiosity and stuff like that. 12:50.400 --> 12:53.320 Hacking is innocent the majority of the time. 12:55.080 --> 12:57.060 That's something we're going to talk about a little later too, 12:57.220 --> 13:03.520 is at what point does research end and hacking begin and cracking and all of that. 13:03.800 --> 13:07.000 So it's not a very good term for a legal document, that's for sure. 13:07.300 --> 13:08.040 Yeah, exactly. 13:08.800 --> 13:10.980 But, again, we're not naive here. 13:11.300 --> 13:12.920 We didn't just fall off the turnip truck. 13:12.920 --> 13:15.560 We know that they're going to put that hacking rule in there. 13:15.700 --> 13:19.560 And you just hope that one day, over time, more people will take it out, 13:19.660 --> 13:22.200 and they will further define illegal activity. 13:22.680 --> 13:24.780 And they single out spam a lot. 13:24.860 --> 13:26.160 They single out porn a lot. 13:26.320 --> 13:27.560 You can't have a prawn server. 13:27.640 --> 13:30.060 A lot of companies will have clear rules about that. 13:30.140 --> 13:31.580 But hacking is just such a vague term. 13:32.360 --> 13:35.260 Well, hopefully we'll continue to change minds about that. 13:35.260 --> 13:37.140 But that's definitely a long-term process. 13:37.780 --> 13:41.020 The other thing, too, and I don't know if you'll agree with me on this, 13:41.100 --> 13:44.820 but from my standpoint, hackers spend a lot of money. 13:45.060 --> 13:47.880 Hackers really do buy a lot of technology, some of them. 13:47.920 --> 13:48.740 Some of them don't. 13:48.880 --> 13:51.780 But, you know, I have my Arcos device. 13:51.940 --> 13:53.020 I travel for a lot. 13:53.100 --> 13:55.700 I've got frequent flyer miles on every airline you can imagine. 13:55.920 --> 13:58.520 I buy every gadget that comes out, new computers. 13:59.120 --> 14:00.240 I spend a lot of money. 14:00.240 --> 14:05.100 You would think from a business standpoint you wouldn't single out clientele like that 14:05.100 --> 14:07.760 that are known to spend money and buy a lot of technology. 14:07.900 --> 14:09.460 If anything, you would want that. 14:10.600 --> 14:11.300 Well, it's funny. 14:11.420 --> 14:13.640 You know, when you think about it, you look at a company like Google, 14:13.740 --> 14:15.800 which is so big now, and a company like Apple. 14:15.900 --> 14:17.720 It's another one I've had experiences with recently. 14:18.160 --> 14:22.160 You reach a certain level of success and, in fact, sort of public phenomenon. 14:24.040 --> 14:28.240 And it's bizarre how the sort of rules of commerce get inverted, 14:28.240 --> 14:31.180 and suddenly you can sort of pick and choose who you want your customers to be 14:31.180 --> 14:33.400 because you're just kind of swimming in money, you know. 14:33.580 --> 14:34.240 Well, exactly. 14:34.560 --> 14:37.800 And customer service goes away and all those things go away. 14:38.120 --> 14:39.780 So who knows, really? 14:40.000 --> 14:44.180 But, you know, what I wonder is if they're thinking, you know, 14:44.360 --> 14:48.800 that people who are technically savvy, hackers, crackers, what have you, 14:49.120 --> 14:54.780 are blocking ads anyway and that they're part of the sort of ad blocking phenomenon. 14:55.680 --> 14:57.220 And that's something you're worried about. 14:57.220 --> 14:57.820 I don't know. 14:57.820 --> 15:00.520 From a browsing standpoint, yeah, most hackers, 15:01.220 --> 15:03.960 most technically savvy people, if you use a more broad term, 15:04.180 --> 15:06.040 probably are blocking the ads. 15:06.200 --> 15:09.680 But as far as serving them up on our sites to other hackers, 15:09.880 --> 15:12.600 well, I guess, yeah, we're serving them to other hackers who might be blocking them. 15:12.680 --> 15:17.440 But at the same time, the ones that do see them may be more likely to buy stuff. 15:17.540 --> 15:20.900 I mean, you're going to have a higher click per action 15:20.900 --> 15:24.920 where you pay for each action or sale that results out of it if you're using that. 15:24.920 --> 15:28.340 That seems like a good method for that particular audience. 15:28.340 --> 15:29.480 But I don't know. 15:29.620 --> 15:33.540 The other thing is you would have to assume that as business people they've done some research on this. 15:33.600 --> 15:34.620 And maybe I'm just way off. 15:34.680 --> 15:41.240 Maybe they do know for a fact that generally the hacker community or technological savvy community 15:41.240 --> 15:42.860 doesn't click on ads as much. 15:42.900 --> 15:43.740 And I don't realize that. 15:43.800 --> 15:46.460 It seems to me they would, but maybe I'm way off on that. 15:46.460 --> 15:47.700 I'd like to know if there were some studies. 15:47.800 --> 15:50.320 I might have to do a little after-show research on that. 15:51.620 --> 15:56.220 For me, the thing I would think is, as a general, the bigger the company, the less customer-centric. 15:56.920 --> 15:58.780 And it's not a conspiracy or anything. 15:58.980 --> 16:00.820 It's just that's what happens to big companies. 16:01.000 --> 16:03.980 They kind of lose focus with what made them a ton of money. 16:04.240 --> 16:04.600 Exactly. 16:04.840 --> 16:06.640 And especially once they go public, 16:06.880 --> 16:09.920 and then suddenly you're answering to shareholders whose bottom line is profit. 16:10.400 --> 16:11.620 That changes a lot of things. 16:11.740 --> 16:12.920 It makes a lot of decisions, too. 16:12.920 --> 16:15.940 Actually, and you know what, as a quick aside here, 16:16.040 --> 16:23.300 a good story about that or a good anecdote that I've heard about that was actually about Walmart. 16:24.100 --> 16:30.580 It kind of blew my mind one day that Walmart had crossed this line of how much power they had. 16:32.040 --> 16:38.020 Typically, the way grocery stores and other places work that carry food items is 16:38.020 --> 16:43.320 because they give the different vendors so much shelf space to sell their product. 16:43.380 --> 16:43.620 That's right. 16:44.040 --> 16:44.300 You know? 16:44.620 --> 16:48.020 Walmart was the first company that got so big and changed the scale, 16:48.100 --> 16:49.480 the playing field of the whole thing, 16:49.900 --> 16:56.500 where the vendors actually had to bid and pay money to get shelf space on Walmart's shelves. 16:56.500 --> 17:04.820 Frito-Lay, Coca-Cola, the Pepsi, the cola companies are paying money to get shelf space 17:04.820 --> 17:10.540 or to get more shelf space and try to push out the other companies so they're buying more shelf space. 17:10.640 --> 17:13.980 They're actually bidding against each other, which, of course, plays to Walmart's favor. 17:15.120 --> 17:19.300 And they've got the power to do that because you want your stuff in those Walmart shelves 17:19.300 --> 17:20.380 because they're so big. 17:20.380 --> 17:24.740 It's really changed the playing field. 17:26.160 --> 17:29.780 And think of the effect of that is that the companies with more money at their disposal, 17:29.920 --> 17:33.380 which are generally larger companies, are going to win those biddings. 17:33.460 --> 17:37.680 So you have fewer and fewer companies and less and less competition represented on the shelf. 17:38.760 --> 17:42.280 Yeah, and we probably could go into a whole Walmart episode at this point. 17:42.440 --> 17:42.720 Yeah, we could go on and on. 17:42.720 --> 17:46.040 I guess we should probably reel it back in because Walmart has really – 17:46.040 --> 17:49.320 that was just the tip of the iceberg, and now they've changed a lot of other things. 17:49.320 --> 17:53.400 And, yeah, there's been documentaries done on that and articles written on that, 17:53.420 --> 17:55.040 so we'll let them speak for themselves. 17:55.940 --> 18:00.720 But, again, back to this topic of – well, I guess we started with Google AdSense, 18:00.780 --> 18:04.740 but the whole hacking terms of service, you know, you still have that mindset 18:04.740 --> 18:07.620 that we're out there to rape, pillage, and steal and all that kind of good stuff, 18:07.800 --> 18:09.540 and it's going to take time to change it. 18:09.660 --> 18:13.540 But to me – and I'm probably oversimplifying, I'll admit that – 18:13.540 --> 18:18.120 but to me, why can't it just simply be you catch someone trying to commit click fraud, 18:18.120 --> 18:20.560 you ban them, and possibly more. 18:20.800 --> 18:24.220 You know, if they commit a crime, if they break the law, they break the rules, 18:24.320 --> 18:27.840 whatever you want to call it, or all of the above, period, ban them. 18:28.080 --> 18:32.800 End of story, file charges, cross that line, whatever you want to do, it's that simple. 18:32.980 --> 18:39.060 But banning people from Google AdSense or other services because of something they might do, 18:39.740 --> 18:42.540 I mean, that's kind of a George Orwell kind of feeling there. 18:42.540 --> 18:47.060 That's a little bit too Orwellian, you know, or was it – there was a movie. 18:47.160 --> 18:47.820 I never actually saw it. 18:47.840 --> 18:51.220 Was it Minority Report or something where they were – 18:51.220 --> 18:54.620 Yeah, that was the Tom Cruise vehicle, right, Steven Spielberg? 18:55.020 --> 18:58.660 Yeah, something – maybe I'm messing up my movies now. 18:58.720 --> 19:00.280 Maybe I'm pulling a savant here. 19:00.420 --> 19:05.360 But the one where they were saying, in the future, we know you're going to commit this crime, 19:05.400 --> 19:06.820 so we're going to arrest you now. 19:07.740 --> 19:09.340 Yeah, that was the movie. 19:09.620 --> 19:12.440 And, you know, again, we're going to talk about this a little bit later when it comes to disclosure 19:12.440 --> 19:15.660 because, you know, we recently interviewed Eric McCarty, 19:15.660 --> 19:21.960 who was, you know, recently pled guilty to breaking into the USC website. 19:22.120 --> 19:23.340 We'll talk a little bit about that later. 19:23.600 --> 19:31.820 And his contention is just that, that he was found guilty of, you know, doing something with – 19:31.820 --> 19:35.340 basically his ability to do it is what made him guilty. 19:35.340 --> 19:36.580 Yeah, I love fear. 19:36.580 --> 19:39.780 So that's his contention, and we can talk a little bit about that later too. 19:39.980 --> 19:44.960 Yeah, yeah, and that is a common cry is, you know, they want to throw the book at things they don't understand or fear, 19:45.040 --> 19:47.000 so they'll, you know, kind of go a little overboard. 19:47.120 --> 19:49.780 We got – oh, man, I'm getting on a soapbox here. 19:50.160 --> 19:53.360 We got drug dealers that are back out in the street, you know, the next day, 19:53.440 --> 19:58.940 but we're going to bust some, you know, kid or some person who didn't really – 19:58.940 --> 20:00.120 anyway, I'm not going there. 20:00.160 --> 20:01.260 Let's back up for a second. 20:02.100 --> 20:02.580 Next email. 20:02.580 --> 20:03.660 Yeah, let's see. 20:04.080 --> 20:04.540 Let's see. 20:04.580 --> 20:05.480 Oh, double standards. 20:05.560 --> 20:11.000 I wanted to talk to double standards, and this also ties into large companies getting too big 20:11.000 --> 20:12.720 and abusing their power or whatever. 20:13.040 --> 20:18.140 And as far as double standards, well, there's a site called Hackaday, hackaday.com, which is a blog. 20:18.260 --> 20:23.380 It's one of the Jason Calacanis slave labor sites that I've had issues with for a long time. 20:23.380 --> 20:30.520 Somebody who makes multi-millions of dollars by putting ads on other people's work and paying them peanuts. 20:30.680 --> 20:32.100 But anyway, I'll back off of that. 20:32.140 --> 20:34.080 I don't want to get you in any trouble there. 20:35.100 --> 20:36.700 But this is a hacking site. 20:36.880 --> 20:42.200 Hackaday has different – it's a blog with new posts every day, and it's definitely clearly hacking. 20:42.300 --> 20:42.900 It's in the title. 20:42.900 --> 20:49.340 Google, but not only does Google allow them to have ads on there, and not only do they support and let them do that, 20:49.400 --> 20:51.400 but they allow them to break their rules. 20:51.780 --> 20:56.240 We talked about in the last episode that you're only allowed to have three ads per page. 20:56.620 --> 21:00.760 Well, unless you're one of these larger companies where you can make it worth their while, 21:00.900 --> 21:05.180 a multimillion-dollar company, you can give them more ads, make them more money. 21:05.280 --> 21:08.560 Oh, well, you're allowed to break the three ads per page limit. 21:08.560 --> 21:12.700 So they can pick and choose who they want to enforce their rules to. 21:13.140 --> 21:14.400 So I don't know. 21:14.480 --> 21:17.480 That kind of defeats the point of rules to a certain extent, I guess. 21:18.740 --> 21:19.820 But, hey, you know what? 21:20.200 --> 21:20.820 Google is a phenomenon. 21:21.540 --> 21:21.860 Yeah. 21:22.360 --> 21:25.320 They're going to be the force to reckon with. 21:25.440 --> 21:28.880 We talk about this a lot in our office, how it sort of happened. 21:29.020 --> 21:35.040 We saw Microsoft's waning influence coming for a while, but it really picked up pace the last couple of years, 21:35.120 --> 21:36.380 and Google is just everywhere. 21:36.380 --> 21:42.360 Yeah, and Google is making some mistakes right now, but that's probably another topic for another show, too. 21:42.420 --> 21:45.900 I think that YouTube buyout was the stupidest move I've ever seen in my life. 21:46.180 --> 21:48.100 But, anyway. 21:48.420 --> 21:49.840 That's definitely a whole other topic. 21:49.960 --> 21:53.380 Yeah, well, I mean, basically that's a site that's – well, yeah, never mind. 21:54.340 --> 21:55.620 So, yeah, do no evil. 21:55.740 --> 21:57.440 That's the whole thing that Google is founded on. 21:57.700 --> 21:59.700 Yeah, I'm sorry, but that's BS. 21:59.700 --> 21:59.780 Yes. 22:00.900 --> 22:06.820 And as far as the Yahoo beta, I actually have been involved in the Yahoo program for a long, long time. 22:06.920 --> 22:08.940 I jumped on really early when they first announced it. 22:09.160 --> 22:12.180 I had to wait like a month or two, but once I got in there, it was great. 22:12.260 --> 22:14.100 I have to say I really, really enjoyed it. 22:15.060 --> 22:17.080 I put ads on only a couple of our sites. 22:17.080 --> 22:21.340 They are hacking-related sites, my hacking blog, the digitaldogpound.org blog that we have, 22:21.620 --> 22:26.940 and over on hacktv.com, which is our video show, our TV show, which is clearly hacking-related material. 22:27.900 --> 22:29.940 And they have not canceled me all this time. 22:31.120 --> 22:33.320 So they're perfectly legitimate. 22:33.480 --> 22:34.680 I'm not doing any click fraud. 22:34.760 --> 22:36.060 I'm not doing any fancy stuff. 22:36.580 --> 22:42.600 So, again, a hacker on hacking content-related sites, but I'm not doing anything wrong. 22:42.680 --> 22:43.480 I'm not breaking any law. 22:43.480 --> 22:45.160 So this is what I kind of like to see. 22:46.020 --> 22:53.060 My click-through ratio is like 0.3 to 0.5, somewhere in that range, which is very normal for a site of my size. 22:53.620 --> 22:58.320 And they're allowing me right now, knowing my content, to continue operating. 22:58.320 --> 23:01.880 Now, they can at any time, of course, just like we mentioned earlier. 23:02.100 --> 23:07.020 In their rules, it does probably forbid quote-unquote hacking or something to that effect. 23:07.320 --> 23:08.580 So far, they've let me go. 23:08.580 --> 23:13.800 They're not choosing to be as anal retentive about it or enforce it as strongly as Google was. 23:14.480 --> 23:19.100 So at any point, though, I realized I could get an email from them saying, hey, we're canceling your account. 23:19.180 --> 23:21.200 You have hacking whatever on your site. 23:21.540 --> 23:29.300 So, so far, though, they seem to – either they haven't noticed or they actually can differentiate between hacking and illegal activity 23:29.300 --> 23:30.800 and realize that they're not synonyms. 23:30.900 --> 23:32.180 They're not synonymous with each other. 23:32.560 --> 23:34.400 So, you know, so far so good. 23:34.400 --> 23:35.400 Well, it'll be interesting to watch. 23:35.520 --> 23:41.580 This comes down to that sort of net neutrality thing is, you know, how these different companies react to their business partners 23:41.580 --> 23:45.740 because this is – you know, suddenly they're making value judgments, you know. 23:46.000 --> 23:50.440 The ISPs for so many years were just sort of plumbing, you know, just let every bit go through. 23:50.680 --> 23:52.580 And you guys worry about what's good and what's bad. 23:52.880 --> 23:55.060 So it'll be interesting to see how this plays out. 23:55.180 --> 23:58.540 We might have to have you on another upcoming show to talk about net neutrality 23:58.540 --> 24:00.860 because we actually have not done a full show about that. 24:00.860 --> 24:06.280 So we try to stay away from kind of quote-unquote political topics, but that's not really – it's political, 24:06.440 --> 24:09.960 but it affects the hacking community as well as the entire Internet community. 24:10.080 --> 24:12.020 So we might have to do an episode on that. 24:12.720 --> 24:13.080 Okay. 24:13.360 --> 24:19.120 As far as the others he mentioned, I have not tried those, so thanks for sending information about those. 24:19.220 --> 24:21.140 AdBright and Canoodle I've never tried before. 24:21.380 --> 24:22.880 I'm not really into it to make money. 24:22.960 --> 24:26.900 I'm doing it more for the fact that I wanted to learn how they worked and see what they do, 24:26.900 --> 24:28.140 and, you know, I find it interesting. 24:29.020 --> 24:32.640 That may be changing now with our server costs rising, but that's a whole other topic also. 24:32.740 --> 24:33.840 So let's move on to another email. 24:34.700 --> 24:36.060 Boy, we're really falling behind now. 24:36.160 --> 24:36.740 So let's see. 24:36.820 --> 24:39.720 The next email is from rhnnet, who says, 24:39.800 --> 24:42.460 Hello, host and co-host, in a very creative way. 24:42.480 --> 24:42.900 I like that. 24:43.380 --> 24:45.280 I was listening to episode 185. 24:45.420 --> 24:48.800 Stank was complaining the lack of GUIs for GPG. 24:48.900 --> 24:49.860 There are, in fact, many. 24:49.860 --> 24:57.580 On Linux, I use KGPG, tinyurl.com, 2-K-F-O-M-L. 24:58.220 --> 25:01.860 So if anybody wants to check that out, we've had several people email us, some others as well, 25:01.940 --> 25:03.760 so that's very cool to know that there are some out there. 25:04.360 --> 25:14.700 On Windows, I use WinPT, or Windows Privacy Tools, which is at tinyurl.com slash 3C28PM. 25:16.000 --> 25:18.800 Unfortunately, it's not as good as KGPG, but it gets the job done. 25:18.800 --> 25:21.780 It's gone out of development, so if someone wants it, they should contact the developer. 25:22.200 --> 25:23.520 Programs are GPL. 25:23.820 --> 25:25.520 I'm reading it fast forward to try to catch up here. 25:26.400 --> 25:31.860 And actually, this next part is the part that I wanted to talk about, and that's, he says, 25:32.200 --> 25:34.340 Another topic on the show was click fraud. 25:35.100 --> 25:40.800 I was thinking about data the browser sends to the site, browser, resolution, color, JavaScript status, referring page, etc. 25:41.300 --> 25:44.140 Are these factors looked at when deciding on click fraud? 25:44.140 --> 25:49.240 What if the clock skew was measured and compared over time to aid in catching click fraud? 25:49.360 --> 25:50.020 Just an idea. 25:50.500 --> 25:52.000 Thanks for the show. 25:52.780 --> 25:55.200 So, RHNNet, thank you for the email. 25:56.540 --> 25:59.440 Yes, I'm going to quickly run through this, if I may, Scott. 26:00.420 --> 26:00.600 Yeah. 26:00.740 --> 26:02.040 Because this is kind of… 26:02.040 --> 26:02.480 I'm going to step back. 26:02.480 --> 26:03.360 Yeah, it's kind of… 26:03.360 --> 26:07.860 Well, it's technical, but it's not too technical, so I'm going to try to choose my words carefully here. 26:09.120 --> 26:13.380 First of all, any pattern can be traced, and it's important to realize that. 26:13.480 --> 26:19.960 Any pattern, that's why they call them patterns, and we explained this on the last episode in regards to click fraud 26:19.960 --> 26:25.400 and writing a script to automatically click on ads, which is what everybody thinks is the way to go, and they can write this. 26:25.940 --> 26:30.980 Well, there are many, many, many, many, many, many ways to get caught doing this. 26:31.440 --> 26:37.400 It comes back to a term that I used, not that I made up or anything, but a term that popped into my head was… 26:37.400 --> 26:42.100 I had given that presentation called The Art of Electronic Deduction that I gave at Interzone and Hope last year. 26:42.800 --> 26:47.840 And the term I used then is very applicable now, and that is a preponderance of evidence. 26:47.840 --> 26:55.300 So all of these things that you just mentioned in the email, lots of people can have the same screen resolution. 26:55.780 --> 26:57.400 You know, there are common default resolutions. 26:57.740 --> 27:00.860 Many people are using the same browser, even the same versions of browsers. 27:01.380 --> 27:09.700 So none of those things by themselves can individually target anybody or find anything, the operating system or any of these other common elements. 27:09.700 --> 27:20.440 But these can be used to build a profile, to create a preponderance of evidence, and that is kind of a legal term, but the concept fits here. 27:20.520 --> 27:24.540 By combining all those things together, you can absolutely create a pattern. 27:25.280 --> 27:31.580 The data itself can be data mined, and this is exactly what data warehousing, the whole concept of data warehousing is and data mining. 27:31.580 --> 27:41.860 You can go out there and data mine and pull out these transactions, which in this case are visits to your site or clicks through on your ads or whatever, that have multiple data elements in that record. 27:42.000 --> 27:43.600 They have multiple data elements in common. 27:43.700 --> 27:48.060 If they have several with the same screen resolution, that's not such a big deal. 27:48.160 --> 27:53.400 But if they also did use the same browser and the same OS, then you're getting a little closer. 27:53.840 --> 27:56.540 Now, that's still a little vague because those are common things. 27:56.540 --> 28:03.940 But when you start adding other patterns in there, you're never going to be able to tell 100% truth. 28:03.940 --> 28:12.140 Well, you may be able to, but you can get it so that you're pretty close and that any pattern is going to draw attention to you and probably get you busted for it. 28:12.140 --> 28:15.620 So it's really not worth it for what you're going to get out of it. 28:15.700 --> 28:17.100 And the reason why is this. 28:17.140 --> 28:19.440 It's something that Natis mentioned on the last show. 28:19.980 --> 28:25.240 And probably the biggest point from that show, and I don't think we emphasized it enough when Natis brought it up, 28:25.240 --> 28:29.900 let's just say, for argument's sake, that you do script everything right. 28:29.980 --> 28:34.440 You write a script that has a random timer so that you don't have a regular pattern of click timing. 28:34.580 --> 28:36.440 You know, if you hit every 10 minutes, you're busted. 28:36.900 --> 28:38.120 You know, they're going to find that easily. 28:38.640 --> 28:44.060 So let's say you have a random pattern where it clicks every 5 minutes plus or minus 20 more minutes. 28:44.140 --> 28:46.720 So it fluctuates a big range of fluctuation there. 28:47.180 --> 28:48.260 You use proxies. 28:48.520 --> 28:50.440 You change and update your proxies frequently. 28:50.560 --> 28:52.560 You maybe even shuffle some in and out of your list. 28:52.560 --> 28:58.500 You write another script that makes the proxies mix up so they don't see hits coming from that same proxy server and over and over 28:58.500 --> 29:00.000 because proxies can be easily blocked. 29:00.880 --> 29:02.880 You randomize your agent string, the OS. 29:03.000 --> 29:04.300 All that stuff can be modified. 29:04.900 --> 29:07.120 You can modify all that stuff and randomize it. 29:07.380 --> 29:08.860 But you're still going to get busted. 29:09.140 --> 29:10.320 And here's the reason why. 29:10.360 --> 29:11.040 It's what Natis said. 29:11.080 --> 29:13.320 There's going to be an anomaly in the statistics. 29:14.360 --> 29:20.500 Natis explained on that episode that your bot is basically clicking on an ad every single time it hits the page. 29:20.500 --> 29:27.300 So if you click on every single ad that comes up on the page every single time, your click-through ratio is going to be 100%. 29:27.300 --> 29:29.020 And that's pretty unusual. 29:29.200 --> 29:30.480 That's going to draw some attention. 29:30.640 --> 29:31.420 That is an anomaly. 29:31.540 --> 29:32.540 It doesn't work that way. 29:33.240 --> 29:38.760 Like I said earlier, my click-through ratio is 0.3, 0.5, somewhere in that range, 29:39.180 --> 29:42.960 which means basically four clicks out of every 1,000 impressions that we deliver. 29:43.060 --> 29:44.960 So every 1,000 times the ad is shown. 29:45.360 --> 29:48.980 On normal traffic, you're going to get about four people that click through like that. 29:48.980 --> 29:54.740 Now, it can fluctuate as much as 10 out of those 1,000, and it's not completely anomalous. 29:55.460 --> 30:03.120 But if you suddenly mix in a script that's going to be adding one click for one impression that it makes, 30:03.580 --> 30:06.960 let's say your bot only hits it 100 visits, which is not a lot. 30:08.300 --> 30:13.200 And you had 1,000 impressions in the example used earlier, so you just added 100 more clicks to that. 30:13.200 --> 30:17.020 So basically you're going to bring your math to, instead of four clicks out of 1,000, 30:17.140 --> 30:19.840 you're 104 clicks out of 1,100. 30:21.080 --> 30:25.240 So basically you just added a few more clicks onto your normal traffic. 30:25.400 --> 30:28.860 So basically I'm not using an example of 100% because that's kind of ridiculous. 30:29.200 --> 30:30.240 This is more realistic. 30:30.800 --> 30:32.980 104 clicks out of 1,100 impressions. 30:33.340 --> 30:38.320 If you do the math, you've got a click-through ratio there of 10.5% persistently. 30:38.320 --> 30:44.540 And if you don't think that that's going to draw immediate attention to you, you are sadly mistaken. 30:45.400 --> 30:50.260 So making that small of a change is going to get you noticed, and it really only got you 100 clicks. 30:50.540 --> 30:52.620 That's not going to make you any money anyway. 30:53.460 --> 30:56.700 So what I'm trying to get across here, what I'm saying is if you have some delusions 30:56.700 --> 31:01.860 that you're going to write a script that's going to go out there and hit ads and make you a lot of money, 31:02.320 --> 31:03.000 you're not. 31:03.000 --> 31:08.980 I will say, in my opinion, theoretically, you could write a script that you could sneak in there, 31:09.080 --> 31:13.000 keep that click-through ratio lower but higher than it would normally be, 31:13.100 --> 31:14.880 and probably not get noticed so much. 31:15.160 --> 31:15.840 But you know what? 31:15.880 --> 31:17.660 You're going to make a dollar or two. 31:18.520 --> 31:24.640 Is it really worth going federal, pound me in the prison to make an extra couple of bucks? 31:25.560 --> 31:27.320 Get rich not that quick. 31:27.320 --> 31:33.560 Yeah, it's exactly, you know, it's, yeah, it's a lot harder than a lot. 31:33.700 --> 31:34.920 I mean, this is a very common thing. 31:35.000 --> 31:40.740 I've heard so many hackers talk about this and think that it can be done easily, and it really can't. 31:41.100 --> 31:42.340 So, yeah. 31:42.560 --> 31:46.580 So this seems to speak to the sort of division of understanding, too. 31:46.660 --> 31:49.960 A lot of the people who are getting caught doing this are doing it just like you say, 31:50.060 --> 31:52.300 and having 10%, 20% hit rates. 31:52.300 --> 31:57.380 And it's just, for anybody investigating, those are the low-hanging fruit. 31:57.500 --> 32:01.560 They're just plucking them, sort of saying, sorry, Charlie, you know, it's way too easy. 32:01.780 --> 32:06.900 Well, and also, you know, it crosses that line, and again, soapbox, whatever you want to call it, 32:06.920 --> 32:10.060 it crosses that line where, you know, you're not a hacker anymore. 32:10.240 --> 32:14.160 When your intent is to go out there and commit click fraud to make a lot of money, 32:14.280 --> 32:15.540 that's a whole different scenario. 32:15.720 --> 32:18.620 You've crossed a different line, and, you know, that's not hacking. 32:19.460 --> 32:22.180 You've left the realm of hacking when you cross that line. 32:22.560 --> 32:26.320 So, anyway, we'll rein back from that as well, 32:26.420 --> 32:28.860 because that's certainly something we've beaten to death on this show. 32:29.980 --> 32:32.240 Next email, and I'm trying to really speed up here. 32:32.660 --> 32:35.340 Next email, I'm not even going to read the full email, 32:35.960 --> 32:38.600 but I'll just mention the spirit of what it is, 32:38.660 --> 32:40.760 is basically we got an email from Matt, 32:41.120 --> 32:44.020 who was saying he was having some problem with the audio quality, 32:44.080 --> 32:46.480 where he's getting high-pitched squealing and stuff like that. 32:46.480 --> 32:51.480 He did follow up later and say that he did find out that it was actually, 32:52.000 --> 32:55.300 with the player on his end, handling the low bitrate files that we put out. 32:55.480 --> 33:02.040 So, I just wanted to mention on the air that when we mix and record and edit all these shows together, 33:02.260 --> 33:04.460 I definitely listen to them before I send them out. 33:04.540 --> 33:05.800 I can only speak for myself, of course. 33:05.860 --> 33:06.700 I don't know about the other guys. 33:06.700 --> 33:08.840 But when I do it, I listen to it. 33:08.940 --> 33:10.520 I make sure that the sound quality is there, 33:10.560 --> 33:12.740 and I'm not going to send it out if it's bad, 33:12.800 --> 33:14.740 or I'll send it out as best as I can, I should say. 33:14.800 --> 33:17.540 But for the most part, I listen to everything ahead of time. 33:17.620 --> 33:19.600 So, if you ever do have any audio problems on the show, 33:19.980 --> 33:21.340 tweak your settings a little bit. 33:21.540 --> 33:26.440 There might be background noises that are in my recording from the room, 33:26.520 --> 33:29.240 maybe the ceiling fan I forgot to turn off or something like that, 33:29.240 --> 33:35.100 or the computer next to my speaker phone is putting out a hum or something like that. 33:35.140 --> 33:39.040 So, you can usually tweak that for the most part on your end and make it go away easily. 33:39.960 --> 33:42.800 And the other thing he mentioned in his response at the very end was 33:42.800 --> 33:45.220 that it would be nice to have an AUG feed. 33:45.920 --> 33:49.200 So, yeah, we've wanted to do an AUG feed from day one. 33:49.200 --> 33:51.820 Back then, we didn't have the disk space on that server. 33:52.440 --> 33:54.800 So, now that we just switched over to a new server, 33:54.940 --> 33:57.360 that is coming back up as a topic of discussion. 33:57.360 --> 34:00.440 So, we may see if we can make that happen at some point. 34:00.520 --> 34:04.640 But we've got 186 episodes to go back through and re-encode from the Masters, 34:04.740 --> 34:07.220 which is going to take quite a bit of time. 34:07.420 --> 34:10.200 So, yes, we want to do it, but bear with us. 34:10.240 --> 34:12.480 I don't know how soon we can make that happen. 34:14.140 --> 34:14.840 You know what? 34:14.980 --> 34:18.180 And let's see, Scott, I think maybe what we should do here 34:18.180 --> 34:20.480 is kind of jump ahead into the main topic. 34:20.780 --> 34:22.880 And I had a couple more emails I wanted to talk about, 34:23.620 --> 34:26.800 but I want to make sure we have time to talk. 34:26.800 --> 34:30.380 So, I'm going to put these other emails off until next episode 34:30.380 --> 34:34.520 and kind of segue into our main topics of the evening. 34:34.860 --> 34:37.780 And the main topic is going to be disclosure. 34:37.940 --> 34:39.800 That's going to be our main topic of the evening. 34:39.960 --> 34:44.460 But before we do, if I may, let's talk about the article. 34:44.660 --> 34:47.180 See, I contacted you for a specific reason. 34:47.240 --> 34:50.580 I read a lot of magazines, a lot of trade magazines. 34:50.580 --> 34:55.320 I have mentioned I subscribe to over 50 magazines a month that I sit and read all the time. 34:55.520 --> 34:57.760 So, this article caught my eye. 34:58.240 --> 35:00.460 And there's a reason I singled you out to have you on the show. 35:00.540 --> 35:05.540 Not to get all weird and corny or anything here, but the reason that I noticed it. 35:06.340 --> 35:09.360 And this article, by the way, which I should have given a tiny URL to, 35:09.440 --> 35:13.160 but you can go to CSOonline.com and do a search for the title. 35:13.160 --> 35:16.580 It's called The Bad Guys Get Smarter. 35:18.580 --> 35:23.720 And this is an article by Mr. Baranato here who talked about a few interesting topics 35:23.720 --> 35:24.940 that I'd like to go into here. 35:25.200 --> 35:28.760 But the reason that it caught my eye is because throughout the flow of the whole article, 35:29.300 --> 35:33.520 even the title of the article, The Bad Guys Get Smarter, not The Hackers Get Smarter. 35:33.520 --> 35:37.840 And if anybody listening, if there are any other writers out there listening, 35:37.940 --> 35:39.600 if there's any security professionals listening, 35:39.680 --> 35:43.360 if there's anybody out there who thinks that people don't catch and notice this kind of thing, 35:43.840 --> 35:45.180 I'm here to tell you we do. 35:45.760 --> 35:50.480 You know, I read these articles and I see the word hacker thrown around and demonized quite a bit. 35:50.860 --> 35:52.960 So, it catches my eye when I read this article. 35:53.540 --> 35:56.160 And with a couple exceptions towards the end, which were very minor, 35:56.520 --> 35:59.360 there are several parts of this article where you could have easily said, 35:59.360 --> 36:05.560 hackers do this and hackers would seek to have a bank employee with data's unwillingly logged. 36:05.820 --> 36:07.180 But you didn't use the word hacker. 36:07.300 --> 36:11.900 You used the word attack or attacker very, very consistently. 36:12.260 --> 36:14.820 That's the reason I invited you to have you on the show. 36:14.900 --> 36:16.320 And I'm glad that you actually followed up. 36:16.380 --> 36:17.620 You could have easily dismissed the email. 36:17.840 --> 36:22.540 So, first of all, I appreciate you coming on the show to talk about this topic. 36:22.580 --> 36:26.240 Now, let's talk about this particular article, if you will, since you obviously wrote it. 36:26.740 --> 36:28.600 I'm going to shut up a little bit and let you talk about it. 36:28.600 --> 36:31.200 Because the first topic in here, advanced phishing. 36:31.300 --> 36:32.880 We've done phishing on the show quite a bit. 36:33.320 --> 36:39.440 But what you found out here in your research was a new type of phishing technique, if you will, that's going about. 36:39.520 --> 36:40.660 So, can you talk about that a little bit? 36:41.480 --> 36:42.260 Sure, absolutely. 36:42.460 --> 36:49.180 And, you know, it's interesting you say that, you know, we're trying to use bad guy, attacker, malicious hacker sometimes. 36:49.480 --> 36:53.480 You know, part of it's the writing game is you don't want to use the same word over and over again. 36:53.480 --> 37:01.200 But I think part of it, too, is this transition away from kind of, you know, which has been going on for a long time now, 37:01.240 --> 37:11.460 but this kind of sort of tinkering kind of damage from attacks to really targeted, really devastating financially attacks. 37:11.840 --> 37:17.700 It's actually easier sometimes to write about it in terms of bad guys because it's so clear that's what they are. 37:17.700 --> 37:20.000 This isn't a defaced website, in other words, you know. 37:20.200 --> 37:20.480 Right. 37:21.160 --> 37:23.080 These are people going for money at a bank. 37:23.680 --> 37:23.900 Right. 37:24.280 --> 37:26.140 But I appreciate your having me. 37:26.320 --> 37:27.600 I'm glad you noticed that. 37:27.660 --> 37:29.600 We do try as hard as we can. 37:29.680 --> 37:31.700 We don't always succeed to distinguish. 37:32.400 --> 37:38.420 And this particular one caught our eyes because we're journalists, and this was about journalism. 37:38.420 --> 37:45.280 It actually came to me from the CISO at the bank, which I can't name. 37:45.320 --> 37:46.040 He's a source of mine. 37:46.100 --> 37:46.620 He's a friend of mine. 37:46.700 --> 37:47.200 Of course. 37:47.320 --> 37:51.840 Who emailed me one morning and said, I'm in a world of hurt, and here's why. 37:51.920 --> 37:56.060 And he sent me the screenshot, which you'll see with the email. 37:56.660 --> 38:01.900 And essentially what happened was an attacker got the rolls for his company's emails. 38:02.900 --> 38:09.000 Whether they just figured out the naming convention for the emails and then found a bunch of names of employees who worked there, 38:09.520 --> 38:17.120 it seems like they had a little bit more intelligence than that and were able to send one-off emails to these different employees, 38:18.120 --> 38:26.340 essentially posing as a reporter, which is what I do, and saying it says something to the extent of, 38:26.340 --> 38:34.700 I'm a reporter for the financial news, I've heard your company lost customer records and that you commented on it in a story, 38:34.800 --> 38:36.020 and I'm following up on that. 38:36.560 --> 38:37.680 Here's a link to the story. 38:38.100 --> 38:38.940 Could you give me a call? 38:39.280 --> 38:40.380 Regards, Gordon Riley. 38:40.380 --> 38:48.960 Well, what's interesting about this for us is this is an email that, you know, not verbatim, 38:49.100 --> 38:55.060 but, you know, almost, you know, sort of structurally, I send out almost every day. 38:56.680 --> 39:01.000 You know, I'm talking to hundreds of people all the time for all different stories, 39:01.120 --> 39:04.540 and when we need somebody to comment that we don't know well or somebody inside, 39:04.820 --> 39:06.380 we're trying to get around PR or whatever, 39:06.380 --> 39:08.940 and we'll send an email that says, I'd love to talk to you. 39:08.980 --> 39:10.940 Here's a link to what I wrote or what's been written. 39:11.660 --> 39:12.460 Could you give me a call? 39:12.540 --> 39:13.600 Regards, Scott Baranato. 39:15.180 --> 39:16.580 It's so well-crafted. 39:16.580 --> 39:25.580 The English is so perfectly on the nose, even though the email doesn't come from the U.S., it turns out, 39:26.240 --> 39:33.560 and the link is so innocuous-looking that they've engineered this thing beautifully to get the person to click, 39:33.560 --> 39:39.220 and, in fact, I can't remember the exact number, but 70 people, anyway, within the bank clicked on it. 39:39.600 --> 39:45.580 You know, from the fact that it wasn't a blast email, there's no way for a spam filter to pick up on it. 39:46.040 --> 39:46.440 Right. 39:47.600 --> 39:55.080 That it's the English is right, and the social engineering of scaring someone by saying, 39:55.820 --> 39:57.700 hey, your bank lost customer records, you know. 39:58.200 --> 40:01.280 I noticed this, and I noticed you were quoted in an article. 40:02.540 --> 40:06.020 You know, if you're on the receiving end of that, think about your reaction a little bit. 40:06.380 --> 40:06.740 Right. 40:06.920 --> 40:10.940 You know, you're reading through this thinking, first of all, oh, my God, my bank lost customer records. 40:11.680 --> 40:13.460 And, second, somebody quoted me in an article. 40:13.600 --> 40:13.820 What? 40:14.120 --> 40:16.980 I'm going to want to look at that article that that person's talking to. 40:17.520 --> 40:17.920 Right. 40:18.320 --> 40:22.220 So he sent this email to us, and we were just, you know, 40:22.220 --> 40:28.560 there's always that sort of dual impression of sort of being horrified and also impressed at the same time. 40:29.540 --> 40:35.720 We felt like this was a step up in the social engineering game and worth looking at. 40:35.840 --> 40:39.780 Well, it's obviously, you know, it's a perfect description, the word targeted. 40:40.140 --> 40:43.400 I mean, you don't get any better targeted than what they did. 40:43.400 --> 40:44.100 They targeted. 40:44.240 --> 40:47.740 They had their specific victims in mind, and they targeted them, 40:48.040 --> 40:50.880 and they did their research, obviously, to find out the employees' names. 40:51.560 --> 40:55.780 Most big companies or banks or any other large company or even small companies, 40:56.360 --> 41:01.080 they can have about pages on there that tell some of the employee names and some of the people to contact. 41:01.360 --> 41:06.720 Or they may have a list on the website of phone numbers and employees and stuff like that. 41:06.760 --> 41:09.520 And if you know the naming convention of how they do it, is it, you know, 41:09.520 --> 41:13.780 first initial dot last name at whatever dot com? 41:13.980 --> 41:14.840 It's kind of easy. 41:15.020 --> 41:19.680 It's, you know, footprinting a company like that is something that's very, very easily done. 41:19.680 --> 41:23.640 And so it's obvious that they singled out and targeted them directly. 41:24.340 --> 41:28.080 But there's also, from the social engineering of how would you react if you got this, 41:28.380 --> 41:32.880 I think there's another one in there that's kind of maybe not as obvious is, 41:33.440 --> 41:36.100 yeah, you get the email saying that you may have been quoted, 41:36.240 --> 41:39.360 which is, you know, might spur you to check it out going, wait a minute, what's that about? 41:40.360 --> 41:43.700 Believe it or not, I do think that there might have been a couple people that also thought, 41:43.700 --> 41:50.000 hey, wow, I can be on TV, I can be in the newspapers, a vanity effect. 41:50.640 --> 41:53.200 There's no question for me, you know, from a journalist's point of view, you know, 41:53.240 --> 41:54.580 there are different types of sources. 41:55.120 --> 41:59.180 There are ones who are reluctant, obviously, depending on the nature of the situation as well. 41:59.240 --> 42:03.600 But there are certain people you talk to who are so enamored of the idea of being interviewed. 42:03.860 --> 42:04.120 Yeah. 42:04.120 --> 42:06.260 And there's nothing wrong with that, you know. 42:06.320 --> 42:08.660 Sometimes they have very good things to say, sometimes they don't. 42:09.100 --> 42:12.060 Sometimes people keep coming back to you wanting to be quoted over and over, 42:12.320 --> 42:13.360 and you don't want them to. 42:13.420 --> 42:17.740 But there is a small, you know, a subset of the population that is so enamored of the idea 42:17.740 --> 42:20.000 that somebody wants to hear what they have to say about this situation. 42:20.520 --> 42:23.080 And you see this all the time on the TV news, right, in broadcast news. 42:23.280 --> 42:23.600 Oh, yeah. 42:23.620 --> 42:25.400 Which I consider a whole different form of journalism. 42:25.400 --> 42:29.500 But you'll see people, you know, the next-door neighbor who wants to get on saying, 42:29.600 --> 42:32.400 you know, he seemed like such a nice guy, that kind of thing. 42:32.400 --> 42:37.980 So, absolutely, there is a sense that if you're going to send that to, say, 70 people inside the bank, 42:38.060 --> 42:44.200 200 people inside the bank, some group of that people is going to want to comment for a published story. 42:44.480 --> 42:48.100 The specter of publication is appealing to some people. 42:48.280 --> 42:48.640 Absolutely. 42:48.940 --> 42:49.200 Yeah. 42:50.060 --> 42:52.680 Well, and let's jump ahead to the next one here. 42:53.340 --> 42:56.940 And another advanced form of attack here, a new form of attack, 42:57.140 --> 43:00.900 is using instant messaging as a distributed network. 43:00.900 --> 43:03.480 Now, what exactly are we talking about here? 43:05.240 --> 43:10.580 Well, this is more of a game of economics and statistics. 43:11.920 --> 43:15.680 If you can get into instant messaging, which, you know, we found some people had, 43:16.460 --> 43:21.860 and get enough handles, IM handles, whatever, I don't know what they're called these days, 43:21.900 --> 43:22.660 what the kids call them. 43:22.780 --> 43:22.940 Yeah. 43:22.940 --> 43:25.380 Get enough people. 43:25.520 --> 43:31.400 You can find ways to sneak in, interrupt conversations with very innocuous-looking messages. 43:31.660 --> 43:38.840 You can, in some cases, even make it look like a friend or a buddy of the person who's chatting has chimed in 43:38.840 --> 43:39.960 and said, hey, check out this link. 43:40.720 --> 43:48.360 Now, this really goes way beyond in terms of social engineering in the sense that if I put this person on my buddy list 43:48.360 --> 43:53.980 and they're saying, hey, check out this link or this picture or whatever, I have no reason to distrust that. 43:53.980 --> 43:57.580 I'm thinking, you know, StankDog sent me a quick message. 43:57.660 --> 43:58.320 He's in a brush. 43:58.620 --> 43:59.300 Check out this link. 43:59.340 --> 44:00.240 I want you to look at it. 44:00.900 --> 44:04.280 I'm going to have no reservation about clicking on that. 44:04.420 --> 44:09.360 But even if you can't get the buddy's name, if you can do, in the AOL network, 44:09.440 --> 44:11.220 I think there's 2 million chat members or something. 44:11.480 --> 44:11.840 Right. 44:12.000 --> 44:14.960 And, you know, I'm not trying to be unkind or judgmental, 44:15.100 --> 44:20.220 but a good portion of the AOL instant message crowd is probably less technical, correct? 44:20.380 --> 44:20.800 They're dumb. 44:20.860 --> 44:21.400 You can say that. 44:21.480 --> 44:21.660 Go ahead. 44:21.800 --> 44:22.460 I'll say it. 44:24.080 --> 44:25.160 I can't say that. 44:25.220 --> 44:26.140 I'll say it. 44:26.860 --> 44:29.540 Certainly it's a network where they're going to have less technical users. 44:29.940 --> 44:30.300 True. 44:30.300 --> 44:35.320 They're going to be able to, even if it's a stranger jumping in saying, check out this link, 44:35.840 --> 44:38.220 and you have no reason to trust it. 44:38.220 --> 44:43.180 But, you know, given you have 2 million IM handles at your, you know, disposal, 44:43.320 --> 44:48.620 this is the old phishing idea, which is if you send it to enough people, 44:48.660 --> 44:52.560 even if you get a .01% hit rate, you're going to get the job done. 44:52.920 --> 44:56.460 Well, and that's the whole spammer concept. 44:56.460 --> 45:01.420 The other thing that allows is once, say, you get into one of those, 45:01.540 --> 45:03.600 say you send out 100,000, you get a few. 45:04.380 --> 45:07.100 Once you get your bot or whatever you're delivering into one of those, 45:07.100 --> 45:10.780 they can start spreading it amongst their friends and so on and so forth. 45:10.880 --> 45:13.580 So it's really clever, and it's, you know, 45:13.600 --> 45:18.720 it's the old story of highly distributed networks being highly dangerous 45:18.720 --> 45:20.220 if they're exploited the right way. 45:20.660 --> 45:22.680 Well, and if they're going to the, you know, 45:22.680 --> 45:26.280 and then perpetuating themselves once they've been hit one person, 45:26.400 --> 45:28.300 and then you spread out to their friends, and then you spread out, 45:28.340 --> 45:30.400 that's very viral by nature. 45:30.800 --> 45:33.900 So it is definitely an advancement. 45:33.900 --> 45:40.100 Actually, there's one more I want to talk about here and then go into our main topic. 45:40.340 --> 45:42.960 It's actually on the sidebar here because I love the term, 45:43.420 --> 45:47.680 and the term was spearfishing, which I think is really, really a great term 45:47.680 --> 45:48.820 and very memorable. 45:49.780 --> 45:51.220 Now, what is spearfishing? 45:52.280 --> 45:57.200 Well, just think of it as the most specified form of fishing possible. 45:57.200 --> 46:02.440 You know, if you think of spearfishing with the F instead of the PH, right, 46:02.480 --> 46:06.160 you're out there with a big pointed object, and what are you trying to do? 46:06.240 --> 46:09.840 You're trying to get one fish, and you're not casting a net at all. 46:10.140 --> 46:10.440 Right. 46:10.580 --> 46:13.320 You know, you're literally trying to get one fish. 46:13.660 --> 46:18.300 So in spearfishing, it could be as simple as getting an email off the web like mine, 46:18.300 --> 46:24.480 which is pasted everywhere, and concocting a scheme which you think will both 46:24.480 --> 46:29.620 through technical and social skills get me to do something I don't want to, 46:29.720 --> 46:32.260 like cross-site request forgery or something else. 46:32.420 --> 46:32.760 Right. 46:32.760 --> 46:37.780 And one of the reasons this sort of started popping up more, I think, 46:37.920 --> 46:41.100 is because the net casting was getting harder and harder, 46:41.280 --> 46:43.740 and you had to be more and more sophisticated to pull it off. 46:44.820 --> 46:49.280 But this requires a different kind of sophistication on the attacker's part, 46:49.380 --> 46:53.140 and that is you have to be a con man, essentially. 46:53.680 --> 46:56.740 You have to know what's going to make me not suspicious, 46:57.240 --> 46:59.800 what's going to make me want to, you know, compel to action. 46:59.800 --> 47:08.040 And it's a very different model for fishing, but has shown some success. 47:08.700 --> 47:13.220 The case of the advanced fishing we highlighted with the bank, 47:14.000 --> 47:16.560 some people might call that spearfishing. 47:17.240 --> 47:24.900 You know, I think a better example would be that somebody sent the VP of, you know, 47:25.000 --> 47:26.640 marketing or something at that bank something, 47:26.640 --> 47:35.260 where he got access to the roles of customer roles in some way through that interaction with that one person. 47:36.020 --> 47:41.280 But think of it just like literally spearfishing, which is you're not casting a net at all. 47:41.340 --> 47:42.460 You're trying to kill one fish. 47:43.020 --> 47:45.760 Yeah, and that's why I think it's such a brilliant term, 47:46.020 --> 47:48.960 because we all, you know, fishing we're familiar with, 47:48.960 --> 47:54.080 and fishing is very similar in the mindset of spam where you just cast that net, you know, 47:54.100 --> 47:55.900 and that's the metaphor everyone uses. 47:56.000 --> 48:01.860 You're just sending out as many as possible and hoping that one or two idiots out there fall for it 48:01.860 --> 48:07.500 or get back to you, you know, as opposed to spearfishing where you're singling out a person. 48:07.820 --> 48:09.940 And I think the word that's going to come up here, 48:09.940 --> 48:15.100 and I think this is probably the summary of the whole, not only this article and these topics, 48:15.300 --> 48:21.280 but the direction that I think things are going these days is targeted attacks. 48:21.700 --> 48:22.900 People are not changing. 48:23.060 --> 48:28.400 It's a whole 180 degree change from the traditional way of spamming and fishing. 48:28.560 --> 48:30.400 They're completely changing and saying, you know what, 48:30.400 --> 48:34.080 I'm not going to go for hoping that I get, you know, 48:34.180 --> 48:38.340 some little old lady who doesn't understand email and take advantage of her, 48:38.440 --> 48:41.060 which is a very common story and a very sad story. 48:41.520 --> 48:43.700 Instead, they are focusing and saying, listen, 48:44.080 --> 48:47.980 I see this person on eBay just bought a new big screen color TV. 48:48.240 --> 48:49.500 They've obviously got money. 48:49.820 --> 48:52.300 I'm going to focus and do a little research on them 48:52.300 --> 48:56.680 and see if I can't trick them into sending me some of that money or the TV 48:56.680 --> 48:58.360 or whatever the case may be. 48:58.600 --> 48:59.800 So I love the terminology. 49:00.400 --> 49:02.340 And really quickly before we move on, 49:02.740 --> 49:06.560 it makes sense when you think about it in terms of sort of economics 49:06.560 --> 49:10.720 and how sort of criminal enterprises develop. 49:12.280 --> 49:16.640 When you have the net casting sort of thing, it's very inefficient, 49:17.080 --> 49:20.020 and things have been moving toward efficiency for a long time. 49:20.560 --> 49:25.400 And what happens is the cat and mouse of attack type, defense type, 49:25.480 --> 49:29.180 attack type, defense type, kind of, it's sort of like an arms race. 49:29.180 --> 49:32.900 It dials up what you have to invest in order to get your return. 49:33.980 --> 49:37.400 And from the criminal's perspective, you have to invest more in time and energy 49:37.400 --> 49:39.920 and infrastructure and whatever else to get the same return. 49:40.700 --> 49:43.420 What targeting allows you to do, what social engineering allows you to do, 49:43.460 --> 49:44.840 is change that efficiency equation. 49:44.840 --> 49:49.740 If I can spend all that time I was wasting, building up my infrastructure to cast my net, 49:50.520 --> 49:52.880 targeting, I'm going to get a more efficient return. 49:53.000 --> 49:55.080 I'm going to get a bigger return for the same amount of effort. 49:55.340 --> 49:57.480 And it's sort of, in a way, basic economics. 49:57.780 --> 49:59.600 It's kind of fun to look at from that perspective. 49:59.600 --> 50:03.880 Yeah, so the summary, you know, is that these aren't necessarily new attacks. 50:04.120 --> 50:09.020 These are just more sophisticated forms of existing and known terms and attacks, you know. 50:09.900 --> 50:15.340 So, you know, always be skeptical of just about everything on the global interweb that you see. 50:15.400 --> 50:16.260 It's not all true. 50:16.260 --> 50:23.700 See, every time I get those instant messages, the reason I don't go on any of those I am things anymore, 50:24.460 --> 50:28.240 all these times I get the instant messages saying, hey, big boy, my webcam is up. 50:28.320 --> 50:29.640 I mean, are you telling me those aren't real? 50:31.560 --> 50:35.780 These aren't like random hot women that want me for me? 50:35.940 --> 50:36.760 They're spam? 50:37.120 --> 50:39.120 That couldn't possibly be true, right? 50:40.120 --> 50:41.060 It's my sparkling... 50:41.060 --> 50:42.120 It's hard to believe sometimes. 50:42.220 --> 50:42.980 You see some of them. 50:43.060 --> 50:45.600 It's hard to believe, you know, people fall for it. 50:45.600 --> 50:47.460 But they do. 50:47.740 --> 50:49.160 I can't explain it. 50:49.420 --> 50:50.320 Obviously, they do. 50:51.080 --> 50:54.260 All right, well, we are, let's see, we're about 50 minutes into the show. 50:54.320 --> 50:58.660 We've probably got another 20 to 30 minutes left to finish up with our main topic. 50:58.660 --> 51:02.620 And this kind of segues into it is, you know, a different way of looking at things. 51:02.940 --> 51:08.800 And, you know, these fishers that are doing this kind of stuff, that's a whole different, you know, 51:08.860 --> 51:14.500 there's people researching that and looking into that because that's a very clear-cut attack. 51:14.500 --> 51:18.640 It's intent, you know, the word criminal, I think, can very easily define that. 51:18.780 --> 51:25.560 I can't think of any offhand, any situations where there'd be a legitimate reason to try to fish somebody other than maybe a prank or something like that. 51:26.700 --> 51:27.340 There is nothing. 51:27.340 --> 51:36.180 Yeah, so let's kind of shift gears here and talk about disclosure because there are some cases where you may find, 51:36.360 --> 51:39.240 and this is kind of, I guess this is not going away from phishing altogether, 51:39.420 --> 51:46.900 but let's talk about from a hacker standpoint, one of the issues that we deal with is we get labeled and lumped in with fishers 51:46.900 --> 51:50.340 and spammers and attackers and criminals all the time. 51:50.340 --> 51:53.640 And we're kind of used to it and we don't like it, but we deal with it. 51:54.160 --> 52:00.660 And one of the problems is because some of the stuff that we find interesting and that we're into from a technological standpoint 52:00.660 --> 52:06.980 can be used in such a way or can be used by criminals or can be used to attack, 52:07.800 --> 52:12.300 even though we don't necessarily do it to attack or we're not interested in that aspect. 52:12.300 --> 52:22.340 We'll find a flaw or an exploit or a vulnerability and that's what the hackers, that's what hackers do a lot of the times 52:22.340 --> 52:28.360 is they like to take things apart, figure out how they work, and we might find an exploit or a problem or something like that. 52:28.720 --> 52:35.100 So what we wanted to talk about today, since we have both of us on the phone and we both, you know, kind of have different, 52:35.780 --> 52:39.200 well, maybe we do and maybe we don't have different viewpoints of this, talk about disclosure. 52:39.200 --> 52:42.880 Disclosure, and first of all, what is disclosure? 52:43.060 --> 52:53.380 I mean, if I come across some CSO online website or something like that and I find a bug or something that I put in a certain code 52:53.380 --> 53:00.340 and a search thing and it comes back and it gives me the home phone number of the company, the boss of the whole company 53:00.340 --> 53:01.200 or something like that. 53:01.700 --> 53:03.940 So that's obviously not a good thing, right? 53:04.100 --> 53:05.460 And I'm making that up, of course. 53:05.560 --> 53:07.120 There's no such thing on there. 53:07.640 --> 53:07.860 That's right. 53:08.160 --> 53:09.020 Let's make that clear. 53:09.200 --> 53:14.080 Yeah, just to make up an example, let's say I'm surfing on the website. 53:14.440 --> 53:17.740 One of our listeners is reading this article on the website, which I encourage them to do, 53:18.220 --> 53:20.460 and they do stumble across this. 53:21.220 --> 53:22.460 What do you do? 53:22.540 --> 53:25.220 How do you disclose something like that? 53:25.280 --> 53:30.040 Or actually, first question really should be, should you disclose this? 53:30.120 --> 53:32.760 Should you tell anybody about that or should you just keep your mouth shut? 53:32.760 --> 53:43.780 Well, I've got to jump in and say this is probably the number one issue that I think will be dominating conversations both sort of in your circles 53:43.780 --> 53:54.480 and then, frankly, my reader circles to an extent in the coming years because it is really getting interesting and kind of very fuzzy very quickly on the web. 53:54.480 --> 54:00.520 As you know, you have package applications and then you have sort of websites, which are, in a sense, applications. 54:00.520 --> 54:04.660 And how they operate and how they operate and the code underneath them is so different. 54:04.660 --> 54:13.980 And sort of how you build it and maintain it is so different that nobody really knows from what we can tell 54:13.980 --> 54:23.280 and what this story's sort of position is that nobody really knows how you go about finding and disclosing vulnerabilities on the web. 54:23.280 --> 54:29.580 And an important point here is that, I think, is that, you know, all generalizations are bad. 54:29.640 --> 54:30.380 That's the old joke. 54:30.500 --> 54:35.460 But, you know, a good amount of websites have flaws in them. 54:36.140 --> 54:41.780 But here's where it gets tricky is when you have websites that are dynamic, that change, that have tabs on them, 54:41.820 --> 54:50.680 that have Java injected into them on purpose, you know, the state of the website changes, you know, almost minute to minute, day to day, certainly. 54:50.680 --> 54:58.380 And flaws kind of come out, you know, outcrop and then kind of, you know, sort of like outcroppings of rock. 54:58.560 --> 55:02.140 They'll kind of break the surface and then go back down, seduction. 55:02.900 --> 55:04.340 And they kind of come and go. 55:04.560 --> 55:06.460 And, you know, is that a vulnerability? 55:06.780 --> 55:08.820 Is that just the state of websites? 55:09.360 --> 55:10.720 I don't know the answer to that. 55:10.760 --> 55:12.600 I don't think a lot of people know the answer to that. 55:12.780 --> 55:19.840 And what everybody's struggling with now is what is a vulnerability, number one? 55:19.840 --> 55:24.560 And if I find what I think is a vulnerability on the web, what is my responsibility? 55:25.020 --> 55:26.700 What, you know, what's going to get me in trouble? 55:27.660 --> 55:28.580 Nobody really knows. 55:28.640 --> 55:34.320 And we have a couple of really interesting cases that this story was focused on, which highlight this problem. 55:35.020 --> 55:40.300 You know, you say you have a sort of an opinion on it or a sort of a position. 55:40.860 --> 55:41.560 I don't know. 55:41.660 --> 55:43.380 You know, I'm sort of, I'm rudderless on it. 55:44.000 --> 55:45.620 And that's sort of where I'm supposed to be as a reporter. 55:45.620 --> 55:48.360 But I don't think anything's been resolved at all. 55:48.860 --> 55:50.400 No, and that's just the thing. 55:50.580 --> 55:53.580 I'm, you know, I can try to stay neutral in it for the most part. 55:53.700 --> 56:00.040 And I have my personal opinion, which I'm not trying to, I would not try to force out there to everyone else. 56:00.340 --> 56:02.900 I might give some advice on what my opinion is. 56:02.900 --> 56:09.880 But everybody has, like I've had, of course, this conversation happens at our hacker meetings and conferences all the time. 56:10.400 --> 56:17.480 And it's especially further blurred now because we actually have a security industry that we didn't have five years ago. 56:17.940 --> 56:25.560 You know, there was no such thing as chief security officers, you know, not until fairly recently or at least not as widespread as they are. 56:25.620 --> 56:27.860 We didn't have security teams. 56:27.960 --> 56:30.180 We didn't have security in the mindset. 56:30.180 --> 56:37.080 One, I would debate that possibly because of disclosure we've made that happen and created a whole industry. 56:37.300 --> 56:38.700 But that's kind of a stretch. 56:38.780 --> 56:39.780 We'll back away from that. 56:40.300 --> 56:43.540 But more to the point is we have that now. 56:43.540 --> 57:01.720 And how do you work with this new entity such as it is, us as hackers or as security professionals who are hired to do research and they find vulnerabilities as paid employees or whatever. 57:01.720 --> 57:07.840 However, how do you disclose something in a responsible manner or can you, I guess? 57:07.940 --> 57:11.040 I mean, to be really impartial, can you do such a thing? 57:11.760 --> 57:19.020 Because I'll go ahead and tell you up front, my opinion up front, my personal thing is for the most part, I keep my mouth shut. 57:19.120 --> 57:24.040 I'm just not going to say a word to anybody because the dangers, the risks are too much for me. 57:24.040 --> 57:33.620 I'm sorry if your boss of CSO Online, if I accidentally found out his personal phone number was in a certain weird search thing, I'm not going to call him and tell him. 57:33.680 --> 57:34.600 I'm not going to email him. 57:34.660 --> 57:35.800 I'm not going to contact anybody. 57:35.960 --> 57:43.640 I'm going to keep my mouth shut because I'm not the one that drops this guy's docs and contacts him and freaks him out. 57:43.760 --> 57:45.920 And then I'm the one that's like, hey, how dare you? 57:45.960 --> 57:46.520 What are you doing? 57:47.520 --> 57:49.040 There's no way I would reveal that. 57:50.360 --> 57:51.860 That's where the heat and the energy is. 57:52.080 --> 57:54.400 Now, we talked about this a little bit earlier. 57:55.320 --> 57:56.720 What is the intent there? 57:56.780 --> 57:57.500 You're on the site. 57:57.620 --> 57:58.340 You notice this. 57:58.420 --> 57:59.440 You don't do anything with it. 58:00.080 --> 58:01.020 What's the intent there? 58:01.360 --> 58:09.440 Now, if you go and call me or somebody and say, hey, look, you've got this flaw in your site, I'm going to email you how I came about it. 58:11.160 --> 58:15.320 And this is sort of what happened in the Eric McCarty USD case, which we can talk about a little bit. 58:16.520 --> 58:22.960 You send me that sort of proof of exploit, I guess you could call it, or just proof of flaw. 58:23.480 --> 58:23.840 Right. 58:23.960 --> 58:28.020 We will send a proof of concept code usually if it's something code-based. 58:28.240 --> 58:28.480 There you go. 58:28.680 --> 58:28.840 Yeah. 58:29.180 --> 58:30.760 I now have Exhibit A, right? 58:30.960 --> 58:37.220 You know, regardless of your intent, I can say, hey, look, he hacked my site and here's the code. 58:37.360 --> 58:37.640 I'm sorry. 58:37.720 --> 58:39.140 He cracked my site and here's the code. 58:39.140 --> 58:47.140 And I'm going to throw, you know, depending on how big a company I am, I'm going to throw a ton of lawyers at this because you don't need much to sue someone. 58:47.360 --> 58:49.660 You might need a lot to win a suit against someone. 58:49.740 --> 58:50.240 Or defend a suit. 58:50.240 --> 58:51.580 You don't need much to sue someone. 58:51.580 --> 58:58.920 You need a lot to defend a suit too, and that's the other thing that really sucks to be on the opposite end of it is you get sued by somebody. 58:59.180 --> 59:06.460 You know, a lot of us, you know, a lot of people don't have the money to defend themselves, and all of a sudden we've got this big company or whatever coming after us. 59:06.560 --> 59:09.680 And, you know, what do we get, a public defender, if that? 59:09.680 --> 59:13.820 Yeah, and here's sort of, here's how the back and forth goes. 59:14.340 --> 59:19.680 A defendant in that case, like McCarty, says, you know, I wasn't doing anything wrong. 59:20.380 --> 59:21.780 I had no malicious intent. 59:22.320 --> 59:27.120 Right, and intent is a very, very important word in this whole process. 59:27.340 --> 59:29.520 Intent is going to be the key to the whole thing. 59:30.480 --> 59:33.160 And now the other side says it doesn't matter. 59:33.280 --> 59:34.340 You did it, period. 59:34.340 --> 59:40.660 You know, it's sort of like saying, you know, you're on the inside of a bank, but you haven't stolen anything yet. 59:41.280 --> 59:43.060 And you say, look, I wasn't going to steal anything. 59:43.660 --> 59:44.760 The door was unlocked. 59:44.840 --> 59:46.320 I thought the place was open or something. 59:47.020 --> 59:48.840 And the other side says it doesn't matter. 59:48.960 --> 59:49.580 You've done it. 59:49.840 --> 59:53.180 It doesn't matter whether or not you've completed what we think you were going to do. 59:53.260 --> 59:55.740 You had malicious intent as far as we're concerned. 59:56.460 --> 01:00:00.860 And the other side sort of comes back and says, the other side sort of comes back and says, 01:00:00.860 --> 01:00:06.700 I can't help it if you didn't lock your door, you know, to the jewelry store. 01:00:06.980 --> 01:00:12.600 It's not my fault you built a bad website with all these flaws in it that expose your personal information. 01:00:13.080 --> 01:00:15.380 And by the way, shouldn't you be locking that up? 01:00:16.420 --> 01:00:20.260 That's sort of the sort of overview of how the arguments go back and forth. 01:00:20.300 --> 01:00:23.900 And I'm not saying any side is right, but that's what you see happening. 01:00:23.900 --> 01:00:29.440 Now, what's scary about the McCarty case, I think, to lawyers like Jennifer Granik at Stanford is... 01:00:29.440 --> 01:00:30.240 Good friend of ours. 01:00:31.260 --> 01:00:31.540 Yeah. 01:00:32.240 --> 01:00:35.320 What's scary about that case is he pled guilty. 01:00:36.960 --> 01:00:41.220 And, you know, according to his side of the story, he wouldn't have if he had the resources to defend himself, 01:00:41.320 --> 01:00:45.300 which is scary enough, which is sort of saying if you have enough money and enough lawyers, 01:00:45.400 --> 01:00:47.980 you can, you know, sort of scare someone into fleeing. 01:00:47.980 --> 01:00:55.860 But also that his claim is he contacted them, they kind of blew it off, so he publicized. 01:00:55.980 --> 01:01:01.500 He sort of was doing the shame thing, trying to shame them into, you know, cleaning up their act. 01:01:01.720 --> 01:01:02.160 Right. 01:01:02.160 --> 01:01:09.280 And that what he was eventually pled guilty to was taking seven records that he had taken sort of upon their request. 01:01:09.540 --> 01:01:11.840 They had said, prove it to us that you can do this. 01:01:11.880 --> 01:01:12.520 So he did. 01:01:12.520 --> 01:01:23.300 That is so wrong on so many levels. 01:01:23.300 --> 01:01:25.640 You know, this is McCarty's contention. 01:01:25.640 --> 01:01:31.360 And he's pled guilty, so it's hard for him to come back and say, but this is, you know, really what happened. 01:01:31.640 --> 01:01:33.840 I'm not sort of taking his side or the other side. 01:01:33.920 --> 01:01:39.240 I'm just saying his side of the story is, you know, it's sort of like saying to someone, you know, 01:01:39.240 --> 01:01:40.560 you think you can break into my store? 01:01:40.740 --> 01:01:42.260 And they're like, yeah, I think you can. 01:01:42.440 --> 01:01:43.100 I think I can. 01:01:43.220 --> 01:01:49.120 And then you do it, and they come in the store and say, you know, you're under arrest for breaking into my store. 01:01:50.800 --> 01:01:52.340 That's sort of his contention. 01:01:52.560 --> 01:01:55.540 But that's how hard it's going to be to figure this problem out. 01:01:55.940 --> 01:01:56.220 Right. 01:01:56.440 --> 01:02:00.680 And see, that really is just, that's a contract. 01:02:00.920 --> 01:02:03.960 That's an established, okay, we want you to prove it to us. 01:02:04.040 --> 01:02:08.080 They're giving explicit permission for him to do it. 01:02:08.080 --> 01:02:12.520 And then for him to have to plead guilty because he couldn't afford to defend himself afterwards, 01:02:12.880 --> 01:02:16.000 that's just such a horrible situation. 01:02:16.180 --> 01:02:20.640 And that's why what I said earlier is I try to keep my mouth shut because I don't want to be in that situation. 01:02:20.900 --> 01:02:24.860 I want to help, you know, and my intent would be to say, hey, you've got a vulnerability. 01:02:25.140 --> 01:02:29.520 I can not only show you how to do it and prove it to you, but maybe I can even help you fix it. 01:02:30.380 --> 01:02:32.280 But I'm not even going to try to do that. 01:02:33.040 --> 01:02:37.220 You're not alone, and this is sort of the nexus of the name of the story that Chilling affected. 01:02:38.080 --> 01:02:40.380 You know, it's hard to blame anybody for backing off. 01:02:41.500 --> 01:02:47.500 You know, I don't want to have to go through what Eric McCarty went through because I was finding flaws, 01:02:47.600 --> 01:02:51.080 even though I didn't have any intent to do anything with them. 01:02:51.280 --> 01:02:52.220 It's not worth it. 01:02:52.480 --> 01:02:54.160 And that's completely understandable. 01:02:54.840 --> 01:02:56.840 So, but then the Chilling effect is, so what happens? 01:02:56.920 --> 01:02:58.940 Who's left looking for flaws on websites? 01:02:58.940 --> 01:03:02.860 It's people who aren't concerned with whether or not they're going to jail. 01:03:02.960 --> 01:03:06.720 People who are actually there to exploit criminal elements, attackers. 01:03:06.720 --> 01:03:15.260 It can turn into a really bad situation quickly because code is inherently flawed on websites, 01:03:15.760 --> 01:03:21.280 and you need some kind of vetting process because clearly companies aren't vetting themselves 01:03:21.280 --> 01:03:24.100 because all you have to do is look. 01:03:24.280 --> 01:03:25.600 You know, we mentioned this in the story. 01:03:26.320 --> 01:03:32.440 A hacker named Arsenake started posting cross-site scripting flaws on sites on a discussion thread, 01:03:32.440 --> 01:03:37.160 but hundreds and hundreds and thousands of sites, they're not closing their sites up. 01:03:37.660 --> 01:03:42.280 So there needs to be some kind of audit going on to protect the information on those sites, 01:03:42.360 --> 01:03:43.320 and it's not going on. 01:03:43.920 --> 01:03:46.060 And the more people who are scared to do that auditing, 01:03:46.700 --> 01:03:54.080 the more likely the person who finds the flaws has a lot worse intentions than the research community or the hackers, say. 01:03:54.420 --> 01:04:00.620 Yeah, and I think there are people getting together to try to come up with some standards on how to handle this type of thing. 01:04:00.620 --> 01:04:06.760 But everybody has to be on board from both sides, and I think that's unfortunately sort of an impossibility. 01:04:07.520 --> 01:04:12.500 Even if we were to come up with some sort of standard, like I've heard standards like one month, 01:04:12.580 --> 01:04:17.080 you'll notify somebody of a flaw or a vulnerability, give them one month to fix it, 01:04:17.160 --> 01:04:21.700 or six months, or there's been different things thrown around before you release it publicly or not. 01:04:21.700 --> 01:04:25.080 But you know what, let's kind of step back a little bit, and let's talk about, 01:04:25.460 --> 01:04:31.660 and let's kind of go through a list of some of the things that hackers think about in our audience if they're in this situation. 01:04:31.800 --> 01:04:34.480 So let's kind of go back to a generic. 01:04:34.580 --> 01:04:36.720 Let's not focus on that particular incident. 01:04:37.160 --> 01:04:41.000 Let's just go back and think to yourself, first of all, should you or should you not contact them, 01:04:41.300 --> 01:04:43.000 and the pros and cons of doing that. 01:04:43.000 --> 01:04:46.180 And now that we've got a story behind it, we can kind of apply it. 01:04:46.860 --> 01:04:51.380 The pros, obviously, would be, yes, if you're intent or you're helping to fix a security problem 01:04:51.380 --> 01:04:57.740 or do the right thing or something like that, or maybe even further, maybe, I don't know, 01:04:57.800 --> 01:05:04.000 compensation, maybe a reward, or just even recognition or something like that as a security researcher, 01:05:04.140 --> 01:05:04.900 things like that. 01:05:05.800 --> 01:05:06.580 Those could be the pros. 01:05:06.580 --> 01:05:06.820 And one-off consulting. 01:05:06.820 --> 01:05:12.860 Yeah, but at the same time, the very, very, very big con is exactly what you just said, 01:05:12.920 --> 01:05:19.160 is you could get sued or busted and thrown into jail for it or sued for money and all this kind of stuff, 01:05:19.200 --> 01:05:20.600 which is an enormous risk. 01:05:21.040 --> 01:05:23.580 So are any of those pros enough to outweigh the cons? 01:05:24.520 --> 01:05:31.680 And each scenario, each case that you're in, like I have to weigh to myself, well, you know, if I, 01:05:31.680 --> 01:05:37.680 like, for example, if somebody found a flaw in binrev in our site, I have said out there many times, 01:05:37.740 --> 01:05:39.060 I'm very approachable about that. 01:05:39.120 --> 01:05:44.300 I'd rather find out about it from someone so that I can fix it so that someone else doesn't come along 01:05:44.300 --> 01:05:48.280 with worse and malicious intent and wipe the site out or delete things out of it. 01:05:48.300 --> 01:05:50.080 So I'm more approachable. 01:05:50.460 --> 01:05:52.220 I don't know about CSO online. 01:05:52.220 --> 01:05:55.320 I don't know how approachable, and I'm sorry to keep using that example. 01:05:55.480 --> 01:05:57.220 I guess it's just fresh on the mind or something. 01:05:57.460 --> 01:06:02.340 But, or going to any site, would you feel more – what I'm saying is it's different to approach a company 01:06:02.340 --> 01:06:07.000 like, say, Microsoft versus Joe Bob's Computer Repair Center. 01:06:07.480 --> 01:06:08.220 You've got two different – 01:06:08.220 --> 01:06:13.340 You just don't know how any given company or organization is going to react. 01:06:13.440 --> 01:06:19.120 And, frankly, how people within that organization will react, you might get a very favorable response 01:06:19.120 --> 01:06:21.900 from a security department who understands the stakes. 01:06:22.220 --> 01:06:22.620 Right. 01:06:23.420 --> 01:06:28.700 And that security department might be trumped by somebody else, a marketing department, 01:06:28.820 --> 01:06:33.340 who has, you know, a little piece of script up there they want to keep up there that's making the site vulnerable. 01:06:33.940 --> 01:06:35.440 Cases we've heard of that. 01:06:35.920 --> 01:06:38.880 You know, our snake's experience is pretty telling. 01:06:39.080 --> 01:06:47.520 He put, you know, thousands of pretty basic cross-site scripting flaws and the concept code with them on his site, 01:06:47.520 --> 01:06:52.140 and the reactions to that range from, we're going to shut your site down, 01:06:52.220 --> 01:06:55.920 to thank you very much, we're going to fix that right away. 01:06:56.140 --> 01:06:57.900 So you just have no idea. 01:06:58.160 --> 01:07:04.800 And that uncertainty, like you said, is a real, real big, you know, dissuader. 01:07:04.800 --> 01:07:05.240 Right. 01:07:05.240 --> 01:07:10.940 And, you know, you have to, if you find something like this, you're going to have to make that decision for yourself. 01:07:11.080 --> 01:07:17.460 So if you feel comfortable with a site, like I have, myself, there are some things that I've never told a soul, 01:07:17.580 --> 01:07:24.340 that I've never reported because I don't think that particular site or company or software manufacturer or whatever would accept it very well. 01:07:24.340 --> 01:07:25.840 So I've just kept it to myself. 01:07:26.060 --> 01:07:34.620 There are other cases where I absolutely have contacted people because I kind of got an impression from the site that these people would be open and approachable 01:07:34.620 --> 01:07:36.680 and wouldn't be, you know, make a big deal out of it. 01:07:36.680 --> 01:07:39.680 So case-by-case basis from my experience. 01:07:40.680 --> 01:07:48.420 But no matter what that case-by-case basis is or how lenient or strict or overboard you think they might go, 01:07:48.700 --> 01:07:53.420 no matter what the bottom line is, the risk doesn't change. 01:07:53.900 --> 01:07:55.500 So always keep that in mind. 01:07:55.500 --> 01:08:01.300 And actually, you kind of moved into the next segment I wanted to talk about too, which is kind of a view from the other side. 01:08:01.960 --> 01:08:07.340 Companies that get approached by this, you know, will usually panic for the most part. 01:08:07.400 --> 01:08:10.460 They're not going to like it, obviously, because of just the nature of it. 01:08:10.540 --> 01:08:13.320 But then again, it depends on who you contact. 01:08:13.320 --> 01:08:24.980 I mean, there are so many things and so many people involved that it could be a different scenario depending on who you contact and how you contact them. 01:08:26.220 --> 01:08:26.500 That's right. 01:08:26.620 --> 01:08:34.740 And, you know, there's a temporal element here too where in one of the anecdotes we use in the story about a case at Purdue University, 01:08:35.640 --> 01:08:37.900 sometimes it might seem like it's working out just fine. 01:08:38.100 --> 01:08:40.540 You disclose, they say thank you, they fix the flaw. 01:08:40.880 --> 01:08:45.500 But then something happens like at Purdue, then the site got hacked anyway and the police got involved. 01:08:46.060 --> 01:08:49.900 And suddenly the police or some lawyers or somebody are asking for names. 01:08:49.900 --> 01:08:59.200 And even if it's months later or something, how does that person who reacted fine when you disclosed it to them one-to-one, 01:08:59.620 --> 01:09:03.360 how do they react when suddenly an authority figure, a lawyer or the police are saying, 01:09:03.360 --> 01:09:05.840 we need to know who told you about this flaw. 01:09:07.120 --> 01:09:11.340 And suddenly, you know, they're put in a position of basically turning you in. 01:09:11.660 --> 01:09:16.560 So it's not a risk that just sort of goes away if they say, great, thanks for telling me. 01:09:17.160 --> 01:09:18.400 I'll try to get that fixed. 01:09:18.400 --> 01:09:21.840 Right. And you've got to think, why would the company react that way? 01:09:21.920 --> 01:09:24.480 I mean, obviously there's a lot of factors from their standpoint. 01:09:24.620 --> 01:09:25.460 They don't want to be hacked. 01:09:25.540 --> 01:09:30.780 They don't want to have a vulnerability because, well, first of all, there's bad publicity and the embarrassment that could come from it. 01:09:31.160 --> 01:09:38.360 You know, when somebody does get hacked or they do lose private information, get their laptop stolen with everybody's social security numbers, 01:09:38.440 --> 01:09:43.600 whatever the case may be, all these things that happen can be embarrassing and bad publicity for them. 01:09:43.600 --> 01:10:13.580 But, you know, I've got to say – 01:10:13.600 --> 01:10:15.000 or that it's not going to happen to them. 01:10:15.180 --> 01:10:19.240 That's sort of the old, you know, you don't really understand security until it affects you kind of thing. 01:10:19.520 --> 01:10:22.080 But a lot of companies are still operating on that principle. 01:10:22.560 --> 01:10:24.960 Yeah, and I have that here in the show notes too. 01:10:25.060 --> 01:10:27.900 It's the old cliche of ignorance is bliss. 01:10:28.740 --> 01:10:32.060 You know, they'd rather just bury their head in the sand and pretend it's not there. 01:10:32.420 --> 01:10:34.900 So actually, we're running kind of low here. 01:10:34.940 --> 01:10:37.480 We've probably got maybe 10 minutes or less here. 01:10:38.140 --> 01:10:39.560 Let's shoot through a couple things. 01:10:39.560 --> 01:10:45.220 I actually want to put out some – because there's no clear-cut answer on this, 01:10:45.360 --> 01:10:49.860 I'd actually like to dispense a little bit of advice to our listeners who might find themselves in this situation 01:10:49.860 --> 01:10:59.780 and see if we can at least make some positive suggestions to people so that we are able to still help solve some of these things and problems we find. 01:11:00.700 --> 01:11:05.440 First of all, keeping in mind everything we said and the risk that you're taking. 01:11:05.580 --> 01:11:10.620 If you do make the decision that you want to notify somebody about it, where do you go? 01:11:10.700 --> 01:11:11.160 What do you do? 01:11:11.220 --> 01:11:11.960 Who do you contact? 01:11:12.460 --> 01:11:13.780 And we just kind of talked about it. 01:11:14.540 --> 01:11:17.840 I would say, first of all, start with all the common email addresses, 01:11:18.040 --> 01:11:20.860 and that would be like webmaster at and whatever the site is. 01:11:20.860 --> 01:11:26.320 A lot of places have security at, abuse at, admin or administrator at. 01:11:26.400 --> 01:11:28.240 So I would email several of those. 01:11:29.600 --> 01:11:33.000 I'm going to come back to this in a second about – well, actually, I guess I'll go ahead and do it now. 01:11:33.400 --> 01:11:39.560 When I say contact them, I'm going to recommend to you that you don't do it from your email account 01:11:39.560 --> 01:11:43.000 or your home computer or anything that can be traced back to you. 01:11:43.060 --> 01:11:44.080 Submit it anonymously. 01:11:44.520 --> 01:11:46.640 There are lots of anonymous emailers out there. 01:11:47.080 --> 01:11:48.960 And even if you use those, don't do it from home. 01:11:48.960 --> 01:11:54.420 You know, you can – even if you use proxy service, I'm not safe, feel comfortable, feel safe doing that. 01:11:54.780 --> 01:11:56.380 Go out to a public section. 01:11:56.500 --> 01:12:01.220 Go out and use a network that's not directly tied back to you. 01:12:01.860 --> 01:12:05.100 And that way, you're doing the right thing by helping them and notifying them, 01:12:05.340 --> 01:12:09.220 but you're taking – you're not getting as much of a risk in contacting them. 01:12:09.880 --> 01:12:14.180 So to continue on with the concept of contacting, you contact those common email addresses. 01:12:14.800 --> 01:12:18.320 Look and see – and we kind of referred to this earlier – do they have an about page 01:12:18.320 --> 01:12:20.400 that lists some contact information. 01:12:20.780 --> 01:12:24.780 Some sites are even cool enough that they'll say, if you find a security problem 01:12:24.780 --> 01:12:28.000 or if you'd like to report a problem, here's how you contact us. 01:12:28.000 --> 01:12:32.440 Some of them will actually welcome it, and that should give you a sign to be maybe a little more comfortable 01:12:32.440 --> 01:12:33.680 in contacting them with them. 01:12:34.420 --> 01:12:37.480 If those don't work, you can always look up the who is information for the site, 01:12:37.560 --> 01:12:39.280 which will tell you all the technical contacts. 01:12:40.020 --> 01:12:41.400 So you might want to contact them. 01:12:41.400 --> 01:12:45.620 And then the next question is, and we kind of alluded to this earlier too, 01:12:45.740 --> 01:12:49.920 is let's say you don't get any response from any of those or they all bounce back to you 01:12:49.920 --> 01:12:51.480 or you can't find a person to contact. 01:12:52.940 --> 01:12:58.000 Usually the CIOs, the CEOs, the big managers, the higher-up executives, 01:12:58.540 --> 01:13:00.320 you can usually find their information pretty well. 01:13:00.380 --> 01:13:02.840 It's public information, stockholder, all that kind of stuff. 01:13:02.880 --> 01:13:03.460 It's pretty easy. 01:13:03.460 --> 01:13:09.040 Is there ever any reason you would ever want to contact them about something like this? 01:13:09.540 --> 01:13:12.400 And I think half of our audience just went, hell no, really loud. 01:13:13.260 --> 01:13:13.700 Yeah. 01:13:14.380 --> 01:13:16.580 And I have to agree with that. 01:13:17.780 --> 01:13:21.060 Yeah, from my perspective, that's a really difficult thing. 01:13:21.180 --> 01:13:26.260 I would say the higher up the chain you decide to go or you think you might have to go, 01:13:26.640 --> 01:13:29.840 the less effective an anonymous email is going to be. 01:13:30.560 --> 01:13:31.000 True. 01:13:31.000 --> 01:13:34.860 They're just not going to, you know, they're dealing with not only real threats 01:13:34.860 --> 01:13:36.580 but fake threats all the time. 01:13:37.160 --> 01:13:38.040 That's a good point, yeah. 01:13:39.020 --> 01:13:41.480 Unless you're sending them an email with some documentation, 01:13:41.880 --> 01:13:45.100 which, again, we talked about earlier, if you're sending the concept code, 01:13:45.180 --> 01:13:46.640 you're sending Exhibit A in the trial. 01:13:46.880 --> 01:13:47.680 Right, right. 01:13:48.200 --> 01:13:52.500 You know, and regardless of your intentions, malicious or not, 01:13:54.440 --> 01:13:56.200 you know, these guys don't even read their own email. 01:13:56.200 --> 01:14:00.680 So, you know, an anonymous email, if it gets through the spam filter, 01:14:01.480 --> 01:14:05.640 it just probably isn't going to resonate with them would be my sense. 01:14:05.760 --> 01:14:07.240 And I'm not saying do it or don't do it. 01:14:07.320 --> 01:14:09.160 I'm just sort of thinking out loud here. 01:14:09.520 --> 01:14:11.000 No, and that's exactly what we're doing. 01:14:11.020 --> 01:14:14.040 Sort of the higher up the chain you go, the more you're going to have to put yourself out there. 01:14:14.040 --> 01:14:15.800 Absolutely, absolutely. 01:14:16.000 --> 01:14:19.080 So, yeah, the repercussions are that they're not going to react the same way 01:14:19.080 --> 01:14:20.200 because they don't understand it. 01:14:20.940 --> 01:14:23.580 Also, just as a funny aside note, believe it or not, 01:14:23.620 --> 01:14:28.000 it's very, very common for high-up executives to have secretaries 01:14:28.000 --> 01:14:29.960 that print their email out for them and give them to them 01:14:29.960 --> 01:14:34.080 because none of them use computers or even have email that they check themselves. 01:14:34.080 --> 01:14:36.780 But just a little aside comment there. 01:14:37.600 --> 01:14:40.120 So, yeah, I would warn against elevating anything to that level 01:14:40.120 --> 01:14:43.220 unless you want black helicopters and vans outside of your house all the time. 01:14:44.040 --> 01:14:49.020 And the last thing I wanted to mention is if you don't get a response from anybody, 01:14:49.660 --> 01:14:52.780 nobody responds to you, do you resort to public disclosure? 01:14:52.960 --> 01:14:55.180 And this, again, is the story that happened earlier. 01:14:56.080 --> 01:14:59.300 I just want to say there are mailing lists out there like Security Focus, 01:14:59.900 --> 01:15:00.840 plenty of websites. 01:15:01.160 --> 01:15:05.180 There are hacking magazines like 2600 or even our own FinRev magazine. 01:15:05.860 --> 01:15:09.440 There's websites like DocDroppers.org or your own blog, 01:15:09.640 --> 01:15:12.400 as I think the example you mentioned earlier that people can post this on. 01:15:12.400 --> 01:15:17.760 But, again, like you just said, Exhibit A, I want to put out a legal warning. 01:15:17.880 --> 01:15:21.700 I'm not a lawyer or anything, but don't perform any illegal activities 01:15:21.700 --> 01:15:25.360 and then post confidential or personal information publicly. 01:15:26.240 --> 01:15:30.160 You know, even if they ask you to do it like they did to this guy's case, 01:15:31.120 --> 01:15:33.400 that one even backfired on him and that was private. 01:15:33.620 --> 01:15:36.360 You can guarantee that if you post any of that publicly, 01:15:36.360 --> 01:15:40.200 you're definitely not going to get the same kind of response you might have gotten 01:15:40.200 --> 01:15:41.640 if you'd gone to them privately. 01:15:41.900 --> 01:15:46.460 So be aware of what you're getting into when you get into public disclosure as well. 01:15:47.180 --> 01:15:51.600 So only release enough detail maybe to prompt them or embarrassment factor, 01:15:51.660 --> 01:15:52.380 like you said earlier. 01:15:52.380 --> 01:15:55.300 As a last resort, if you do want to do that, 01:15:55.720 --> 01:15:58.500 just release enough detail to maybe prompt them into action. 01:15:58.780 --> 01:16:02.540 And, again, your motivation being hopefully that it will make their security better 01:16:02.540 --> 01:16:03.840 or help them with their site. 01:16:04.400 --> 01:16:07.440 But intent is such a gray area and so hard to define. 01:16:07.600 --> 01:16:11.060 That's the biggest, I think, word in this whole conversation. 01:16:11.060 --> 01:16:13.340 I think that's the most important word of the whole conversation. 01:16:14.960 --> 01:16:15.360 Absolutely. 01:16:15.800 --> 01:16:18.500 The question of intent is so murky right now. 01:16:19.440 --> 01:16:23.260 There's just no understanding it legally from a legal perspective, 01:16:23.400 --> 01:16:24.760 as Jennifer Granik will tell you, I think. 01:16:24.880 --> 01:16:27.580 Yeah, and Jennifer Granik, someone I've spoke to before, 01:16:27.660 --> 01:16:31.860 has been very helpful in our community and very helpful with me personally 01:16:31.860 --> 01:16:35.420 with some stuff that I had to deal with and some friends had to deal with. 01:16:35.920 --> 01:16:40.400 But I find it interesting here, and I'm just going to throw this out totally out of the notes here. 01:16:40.400 --> 01:16:43.280 They're just, I find it interesting that we have things like, 01:16:43.320 --> 01:16:47.680 and I hate, gosh, I'm almost tempted not to make this analogy, 01:16:47.840 --> 01:16:48.740 but I'm going to do it anyway. 01:16:49.700 --> 01:16:50.920 They're completely unrelated. 01:16:51.180 --> 01:16:55.040 But isn't it interesting that we have such thing as murder one, 01:16:55.460 --> 01:16:57.920 murder two, manslaughter, involuntary. 01:16:57.920 --> 01:17:02.580 We have all these levels of crimes and very heinous crimes. 01:17:03.340 --> 01:17:05.140 But we don't have that for hacking. 01:17:05.640 --> 01:17:09.060 You know, the difference between all these different types of murder is the intent. 01:17:09.060 --> 01:17:11.340 You can have involuntary manslaughter. 01:17:11.460 --> 01:17:12.300 You can have accidental. 01:17:12.580 --> 01:17:15.760 You can have all these scenarios, and there are laws, 01:17:15.920 --> 01:17:18.900 and there are punishments that are appropriate to those laws. 01:17:19.520 --> 01:17:24.100 However, in this world, we don't have accidental hacking. 01:17:24.300 --> 01:17:26.880 We don't have accidental vulnerability. 01:17:27.340 --> 01:17:28.520 You know, we don't have like a level. 01:17:28.680 --> 01:17:30.540 You get the book thrown at you. 01:17:31.140 --> 01:17:32.520 There is no happy between. 01:17:32.520 --> 01:17:37.720 So maybe the problem isn't so much working out standards and accepted things 01:17:37.720 --> 01:17:42.620 between the hacking and security community and the business community. 01:17:42.760 --> 01:17:47.540 Maybe the change that we would all need that would solve the problem isn't so much that relationship. 01:17:47.700 --> 01:17:50.880 Maybe it is something that we need to have happen in our legal, 01:17:51.060 --> 01:17:55.800 excuse me, our judicial system to be able to account for these new scenarios. 01:17:55.980 --> 01:17:57.260 I mean, this is a new world. 01:17:57.400 --> 01:18:01.720 We are in a whole new, this is the global interweb, and the game has changed. 01:18:01.720 --> 01:18:07.600 The playing field has changed, and our judicial system might need to adapt with it to have the solution. 01:18:08.440 --> 01:18:12.560 I hate to go there and sort of compare it there, but I understand what you're saying, 01:18:12.660 --> 01:18:16.000 and I think Jennifer Granik, you know, when I talked to her, 01:18:16.040 --> 01:18:23.760 one of the things she did say is we need some kind of specific tiered definition of access, 01:18:24.880 --> 01:18:30.180 penetration, you know, malicious use, all of these different things. 01:18:30.180 --> 01:18:36.300 Because, you know, you talk about sort of murder, manplotter, those differences, those are on a violent scale. 01:18:36.380 --> 01:18:42.220 I think with economic crimes, which, you know, hacking, you know, hacking for profit would be considered, 01:18:42.720 --> 01:18:45.320 it's always been based on how much you steal, right? 01:18:45.440 --> 01:18:47.340 You know, grand larceny versus larceny. 01:18:47.460 --> 01:18:47.720 Right. 01:18:47.800 --> 01:18:48.500 That kind of thing. 01:18:48.500 --> 01:18:56.400 It's harder to quantify sometimes when TJX companies lose, you know, several million transactions 01:18:56.400 --> 01:18:59.160 or several hundred thousand transaction records. 01:18:59.760 --> 01:19:03.520 It's harder to sort of say whether that's sort of grand larceny versus larceny. 01:19:03.600 --> 01:19:06.880 So what you end up with is this big soup of it's all bad, you know. 01:19:07.140 --> 01:19:07.380 Right. 01:19:07.380 --> 01:19:14.100 And certainly some kind of tiered legal definition is going to be necessary. 01:19:14.320 --> 01:19:16.900 But as you know, I think they're struggling with that. 01:19:17.000 --> 01:19:20.900 And one of the reasons is, you know, what is the vulnerability on the web? 01:19:21.260 --> 01:19:28.240 Well, but those things, I think that's a very good, that's also another good analogy is to larceny, 01:19:28.320 --> 01:19:31.540 grand larceny, grand theft auto, minor petty theft, that sort of thing. 01:19:31.540 --> 01:19:39.180 I think that is, but the difference here is that is after a crime has actually taken place. 01:19:40.380 --> 01:19:44.560 So where do you draw the line of someone who, like, let's go back to the example of the article 01:19:44.560 --> 01:19:48.580 and the research you did, this guy notified somebody of a vulnerability 01:19:48.580 --> 01:19:50.900 and then was asked to provide proof of it. 01:19:51.100 --> 01:19:55.260 He never got any level of money, so it wouldn't come to that scale. 01:19:55.380 --> 01:19:59.980 There's got to be something below there that says he didn't cross the line. 01:19:59.980 --> 01:20:02.740 Right, that's where you cross the line, and he didn't do that. 01:20:02.780 --> 01:20:03.780 It doesn't sound like. 01:20:04.520 --> 01:20:11.320 So there's got to be a tiered scale beneath the actual theft part of the whole thing. 01:20:11.380 --> 01:20:14.920 There's got to be something in there that says, you know, what is minor 01:20:14.920 --> 01:20:18.900 and what is, you know, some intent based in there. 01:20:20.300 --> 01:20:23.200 And, yeah, I admit also it's not something that's easy 01:20:23.200 --> 01:20:25.040 or something that we're going to solve on this radio show, 01:20:25.120 --> 01:20:27.520 especially with, like, three minutes left on it, but. 01:20:27.520 --> 01:20:32.680 And that's sort of what I was saying at the beginning is why I think this is for the next few years 01:20:32.680 --> 01:20:35.660 is going to dominate the conversation because, you know, 01:20:36.240 --> 01:20:41.140 not only are you dealing with people's intent and sort of fuzzing the line there, 01:20:41.200 --> 01:20:43.960 but you're fuzzing the line of the definition of vulnerability, you know, 01:20:44.320 --> 01:20:48.840 because websites interacting with browsers, which are all configured differently 01:20:48.840 --> 01:20:51.940 and changing all the time, are going to create situations. 01:20:52.120 --> 01:20:54.320 And is that a vulnerability when you can get through that? 01:20:54.320 --> 01:20:57.580 And, you know, what is intended use of a website, that kind of thing. 01:20:57.660 --> 01:21:03.040 These are very hard questions, both technical and legal, that just haven't been answered yet. 01:21:03.240 --> 01:21:04.860 Yeah, and they're not simple questions. 01:21:04.920 --> 01:21:07.880 And I think we all need to respect the fact that it is going to take time. 01:21:08.320 --> 01:21:09.780 And we do want to further that. 01:21:09.860 --> 01:21:11.420 And that, again, binary revolution. 01:21:11.580 --> 01:21:16.100 We realize it's going to take time to make changes, and we're going to try to do that. 01:21:16.180 --> 01:21:17.560 And we've been around for several years. 01:21:17.560 --> 01:21:19.000 I think we've made breakthroughs. 01:21:19.540 --> 01:21:23.160 You know, you never saw books on the shelves called Hacking This or How to Hack That 01:21:23.160 --> 01:21:24.360 or Hack Proofing Your System. 01:21:24.800 --> 01:21:26.160 You never had security officers. 01:21:26.260 --> 01:21:29.660 You never had security acknowledgement like we do nowadays. 01:21:29.780 --> 01:21:31.060 So I think we are making progress. 01:21:31.380 --> 01:21:34.980 I think we are kind of taking back the name and all that kind of good stuff. 01:21:35.020 --> 01:21:38.720 So I think we're moving in the right direction, but it's certainly still a long way to go. 01:21:39.200 --> 01:21:43.200 And it is ever-changing, so it's not something that we're ever going to see a finish line or anything. 01:21:43.300 --> 01:21:44.740 It's going to be an ongoing process. 01:21:44.740 --> 01:21:52.200 So to kind of summarize here, and again, I'm not a lawyer. 01:21:52.640 --> 01:21:53.480 Scott's not a lawyer. 01:21:53.660 --> 01:21:57.560 We are just kind of brainstorming here to see if we can – exactly. 01:21:57.700 --> 01:22:02.520 And see if we can just maybe educate people and let people think for themselves 01:22:02.520 --> 01:22:05.240 and kind of maybe throw something out there that somebody will hear 01:22:05.240 --> 01:22:07.420 and prompt them to some action to solve some of this. 01:22:07.760 --> 01:22:13.760 But I still want to come back to say, you know, the best-case scenario is stufu. 01:22:13.760 --> 01:22:14.900 Just keep your mouth shut. 01:22:15.280 --> 01:22:16.700 Don't say anything to anybody. 01:22:17.360 --> 01:22:19.160 It's really not going to be worth the risk. 01:22:19.240 --> 01:22:22.060 That would be my number one advice if somebody asks me about something. 01:22:22.560 --> 01:22:26.420 If you're going to go to that extra level, you can listen to the show and hear some of the things we talked about. 01:22:26.540 --> 01:22:31.220 But I want to emphasize that it's really too dangerous in most cases. 01:22:31.740 --> 01:22:35.960 You try to do the right thing, but – and here's another thing. 01:22:35.960 --> 01:22:42.020 I think you briefly mentioned this earlier, but the other thing that you have to worry about is let's say you do cross that line 01:22:42.020 --> 01:22:43.460 and contact them about it. 01:22:43.980 --> 01:22:45.480 They never respond to you. 01:22:45.660 --> 01:22:47.420 They never hear anything, so you drop it. 01:22:47.420 --> 01:22:54.800 But six months down the road, an actual criminal, an attacker, goes out there, uses the technique that you talked about, 01:22:55.680 --> 01:22:57.040 and breaks into their website. 01:22:57.960 --> 01:23:01.340 They start investigating, and suddenly you're the prime suspect. 01:23:01.340 --> 01:23:05.980 Right, because they're saying you – and we talk about this in the story a little bit. 01:23:06.040 --> 01:23:07.080 We try to use analogies. 01:23:07.160 --> 01:23:07.580 It's hard. 01:23:08.100 --> 01:23:13.580 But if you know your neighbor's door is unlocked and you get up on your roof and you yell that to the neighborhood, 01:23:13.840 --> 01:23:15.280 is that disclosing a vulnerability? 01:23:15.560 --> 01:23:20.560 Is that actually increasing his chance of getting robbed, and are you somehow responsible for that? 01:23:21.140 --> 01:23:26.340 And then, well, what if you get to the roof and say his door is unlocked and he's not home every Thursday at 2 p.m.? 01:23:26.340 --> 01:23:28.460 And you don't just say his door is unlocked. 01:23:29.000 --> 01:23:34.220 So at what point is it stating a fact versus irresponsible disclosure? 01:23:34.520 --> 01:23:34.860 Yeah, response – 01:23:34.860 --> 01:23:35.340 Nobody knows. 01:23:35.520 --> 01:23:36.620 There's lots to consider. 01:23:36.780 --> 01:23:38.760 Yeah, and that – I'm sorry. 01:23:38.800 --> 01:23:40.120 I was going to say I'm glad you used that word. 01:23:40.360 --> 01:23:42.740 Responsible disclosure is what we're talking about here. 01:23:43.440 --> 01:23:45.820 We condone responsible disclosure. 01:23:46.520 --> 01:23:47.060 Excuse me. 01:23:47.120 --> 01:23:49.440 I condone responsible disclosure. 01:23:49.740 --> 01:23:50.780 I'll rephrase that. 01:23:51.260 --> 01:23:53.120 I condone no points of view at all. 01:23:53.680 --> 01:23:54.160 Exactly. 01:23:54.160 --> 01:23:58.700 So other than that, I mean, let's kind of wrap up the show here. 01:23:58.760 --> 01:24:02.020 If you had anything else to put out there, the only other thing is I want to say – 01:24:02.020 --> 01:24:06.540 and we say this on the show a lot, so I know it's repetitive, but don't go looking for trouble. 01:24:06.620 --> 01:24:07.360 That's the other thing. 01:24:07.900 --> 01:24:10.680 You know, if you're out there playing around – I know hackers like to tinker. 01:24:10.780 --> 01:24:13.640 It's like we find a site that's like, oh, I've never seen a site that can do this before. 01:24:13.700 --> 01:24:14.840 Let me figure out how it works. 01:24:15.280 --> 01:24:16.500 Oh, look what I can do. 01:24:16.640 --> 01:24:18.060 Oh, they screwed this up. 01:24:18.400 --> 01:24:22.300 You know, that's all well and good that you're playing around, you're experimenting and all that kind of stuff. 01:24:22.300 --> 01:24:27.920 But there's a certain line that you cross, and there's some conscience that comes in, 01:24:27.980 --> 01:24:31.380 and I know everybody has different levels, but different lines in different places. 01:24:31.740 --> 01:24:36.440 Just be really careful that if you do find something, you find a vulnerability, do not use it. 01:24:36.540 --> 01:24:38.720 Don't go out there and apply it and do something bad with it. 01:24:38.760 --> 01:24:43.780 Don't cross that line because you're leaving the hacker world and entering the criminal world. 01:24:43.880 --> 01:24:46.300 You're leaving the hacker world and going into something totally different. 01:24:46.300 --> 01:24:49.060 And please don't use the name of hacking for that. 01:24:49.620 --> 01:24:53.760 You know, the one thing I say all the time, hacking is about construction, not destruction. 01:24:54.140 --> 01:24:57.360 So always keep that in mind and know when you're crossing that line. 01:24:57.460 --> 01:25:00.160 Just because it's insecure, it's not yours. 01:25:00.280 --> 01:25:01.060 It's not your playground. 01:25:01.220 --> 01:25:01.880 It's not your box. 01:25:02.680 --> 01:25:05.680 Take it and install it on your box at home and hack your own system. 01:25:06.040 --> 01:25:06.720 That's great. 01:25:06.880 --> 01:25:12.780 But don't cross that line where you're infringing on other people's property, intellectual or otherwise. 01:25:12.780 --> 01:25:17.520 So I guess we're going to kind of wrap up the show here, Scott. 01:25:18.220 --> 01:25:18.580 Great. 01:25:18.580 --> 01:25:20.900 We always end up with some shouts at the end of the show. 01:25:21.220 --> 01:25:23.740 I'm going to go ahead and give shouts to everybody at CSO Magazine. 01:25:24.100 --> 01:25:26.800 I do get this every month, and I like reading it. 01:25:26.840 --> 01:25:29.340 I get every issue sent to my door, so I do like reading it. 01:25:30.300 --> 01:25:34.580 And I'm looking forward to this feature article that you have in there this time, 01:25:34.620 --> 01:25:37.180 so I'll be reading that probably after we're done with the show. 01:25:37.960 --> 01:25:39.880 Give some shouts out to Mubix. 01:25:39.880 --> 01:25:42.900 I've been talking to him with some stuff lately, 01:25:43.080 --> 01:25:46.000 so hopefully he and I will be meeting up sometime soon. 01:25:46.440 --> 01:25:50.860 And to FiberOptic, it's really good to see him back around and active in the scene lately, 01:25:51.080 --> 01:25:52.800 so shouts to him as well. 01:25:53.000 --> 01:25:58.260 And to you, Mr. B, anything you want to give shouts out, some coworkers, whatever? 01:25:58.960 --> 01:26:00.580 I would love to give a couple. 01:26:00.700 --> 01:26:02.580 One would be to your listeners, you know. 01:26:02.880 --> 01:26:05.120 And if they want to contact me, please feel free. 01:26:05.120 --> 01:26:08.380 I love getting emails from folks who are out there dealing with this stuff, 01:26:08.460 --> 01:26:09.460 thinking about this stuff. 01:26:09.880 --> 01:26:12.380 Basically, as a reporter, the more people I can talk to, the better. 01:26:12.780 --> 01:26:15.840 So it's always good to hear what people are really thinking, 01:26:16.000 --> 01:26:19.560 because sometimes we can get sort of locked into, you know, 01:26:20.060 --> 01:26:21.620 sort of conventional wisdom and all of that. 01:26:21.700 --> 01:26:24.440 And I just wanted to give shouts to those folks. 01:26:25.060 --> 01:26:26.620 And feel free to email me. 01:26:26.760 --> 01:26:30.800 I'll give StankDog my email, and he can throw it on the website if he wants. 01:26:30.800 --> 01:26:33.940 And, you know, it's also on our website, CSOonline.com. 01:26:34.480 --> 01:26:40.480 Also, shouts to the entire CSO team for, you know, obviously what I think is a stellar magazine. 01:26:40.620 --> 01:26:44.900 We've got Derek, we've got Michael, we've got Sarah, we've got Kendra, we've got Steve, a couple others. 01:26:45.020 --> 01:26:47.060 But shouts to those guys as well. 01:26:47.780 --> 01:26:48.880 Yep, and I second that. 01:26:48.980 --> 01:26:54.380 And if you do want to contact us, of course, anything about the show, radio at BinRev.com, 01:26:54.380 --> 01:26:58.180 and I will be glad to forward anything on. 01:26:59.060 --> 01:27:03.060 Frankly, you're not really a hacker worth a grain of salt if you can't really find the guy's email address. 01:27:03.200 --> 01:27:03.720 Yeah, I know. 01:27:03.760 --> 01:27:04.260 Let's be honest. 01:27:04.420 --> 01:27:07.080 I mean, it's not to throw you under the bus or anything, but come on. 01:27:07.320 --> 01:27:10.100 You're not really a reporter worth a grain of salt if you can't find it either. 01:27:10.100 --> 01:27:11.620 Exactly, exactly. 01:27:12.120 --> 01:27:17.100 So, and yeah, I'm going to be, I'm going to sell out and make our site of the week CSOonline.com 01:27:17.100 --> 01:27:19.400 because the other thing I like is the articles are out there to read. 01:27:19.880 --> 01:27:22.920 You know, you can go out there and read these articles that we're talking about. 01:27:23.540 --> 01:27:28.760 And that's cool because that, again, is the whole hacker spirit, is the sharing of information, the free flow of information. 01:27:29.680 --> 01:27:30.700 So there's nothing wrong. 01:27:30.780 --> 01:27:33.360 I like buying the magazine and having it in my hands as well. 01:27:33.400 --> 01:27:34.500 I just prefer that format. 01:27:34.500 --> 01:27:40.160 But it's also nice if somebody wants to read just an individual article, they can go to the site and look it up. 01:27:40.260 --> 01:27:41.580 So that's very cool as well. 01:27:42.600 --> 01:27:46.960 And our closing music tonight is another song from Chronomicon. 01:27:47.440 --> 01:27:48.700 It's called Enter the Dragon. 01:27:49.300 --> 01:27:50.860 So I hope you enjoy that. 01:27:51.360 --> 01:27:55.800 And Mr. B, Mr. Baranato, thank you for being on the show. 01:27:55.880 --> 01:27:57.420 I do sincerely appreciate it. 01:27:57.560 --> 01:28:02.640 And we might have to get back together and do another episode sometime in the future. 01:28:02.640 --> 01:28:05.640 I've got tons of topics that we can talk about. 01:28:06.020 --> 01:28:08.580 So look forward to possibly working with you. 01:28:08.580 --> 01:28:09.000 It was a lot of fun. 01:28:09.340 --> 01:28:09.580 Cool. 01:28:09.900 --> 01:28:12.060 All right, well, we are going to wrap it up this week. 01:28:12.200 --> 01:28:14.660 But, again, thanks to everyone who sent the email. 01:28:14.800 --> 01:28:17.200 I'll catch up on some of the other ones I missed later on. 01:28:17.320 --> 01:28:20.040 But until then, we will see everybody next week. 01:28:20.400 --> 01:28:21.480 Same hack time. 01:28:21.940 --> 01:28:22.900 Same hack channel. 01:28:22.900 --> 01:28:52.880 See you next week. 01:28:52.900 --> 01:29:22.880 See you next week. 01:29:22.900 --> 01:29:52.880 See you next week. 01:29:52.900 --> 01:29:54.900 See you next week. 01:29:54.900 --> 01:30:08.900 See you next week. 01:30:08.900 --> 01:30:09.200 See you next week.