[00:56.830 --> 00:58.410]  No audio, keep talking.
[00:59.450 --> 01:12.010]  Hi, I'm Michael Fitzgerald and I'm a journalist who was asked to moderate this panel because I wrote a piece on Where the L0pht Is Now that got published last year in CSO Magazine and just won an award.
[01:12.230 --> 01:15.730]  You guys are award winners or something.
[01:16.090 --> 01:18.350]  So thank you.
[01:18.970 --> 01:24.610]  My job is mostly to stay out of your way and also to make sure that they don't get boring.
[01:25.830 --> 01:29.030]  So I have a big task ahead of me.
[01:29.630 --> 01:33.230]  Please throw fruit at them when they do start to fall off track.
[01:34.750 --> 01:44.950]  Basically what we're going to do here is we're going to talk for an hour about issues that have emerged from the days that the L0pht is being formed in the security field and we'll talk a bit about where they are.
[01:45.430 --> 01:48.350]  And we're going to have them start by each of them is going to introduce himself.
[01:48.990 --> 01:58.710]  They are going to talk about what their handle was, whether they're still using the handle now, why they picked the handle, whether they're still using it now, and what they're doing today.
[01:58.950 --> 02:00.650]  They have two minutes to introduce themselves.
[02:01.790 --> 02:09.510]  They can all take a drink if they succeed in keeping it under two minutes, except Mudge, who can only drink if he does not exceed two minutes.
[02:12.670 --> 02:14.590]  Okay, so take it away guys.
[02:16.450 --> 02:17.690]  I guess I'll start at the end.
[02:18.130 --> 02:25.210]  Chris Wysopal, also known as Weld Pond, not formally known as, because occasionally people still refer to me to that.
[02:25.510 --> 02:28.810]  There's nothing shady that happened that I'm trying to hide from.
[02:29.910 --> 02:38.550]  The name originally came because I was forced to pick a name to enter a BBS in Boston called The Works.
[02:39.190 --> 02:42.210]  And they said, we don't allow anyone to use their real name.
[02:42.570 --> 02:44.110]  And I said, ooh, this is going to be interesting.
[02:44.810 --> 02:46.350]  But then I said, I have to pick one.
[02:46.550 --> 02:48.190]  And I really wanted to log in.
[02:48.490 --> 02:50.750]  And so I didn't spend a lot of time doing it.
[02:50.770 --> 02:53.050]  I just had a map on my wall.
[02:53.170 --> 02:54.050]  And I pointed at the map.
[02:54.050 --> 02:58.230]  And I pointed to Weld Pond, which is in, I think it's in Braintree, Massachusetts.
[02:58.290 --> 02:59.590]  I've never actually been there.
[03:02.050 --> 03:03.670]  I was living in Somerville at the time.
[03:04.330 --> 03:07.730]  And so, you know, it's completely goofy and random.
[03:07.850 --> 03:09.490]  And it just seemed to work.
[03:09.490 --> 03:10.450]  So I stuck with it.
[03:11.010 --> 03:12.510]  And so what am I doing now?
[03:14.210 --> 03:20.370]  I was one of the ones who actually stayed the whole purgatory of AtStake, I guess.
[03:20.570 --> 03:21.870]  Good times and bad times.
[03:22.590 --> 03:27.290]  Lasted the whole time from when L0pht was there until the company got sold to Symantec.
[03:27.970 --> 03:29.710]  And then I was at Symantec for another year.
[03:29.850 --> 03:33.630]  And now I'm working with Christian Rioux down the end.
[03:33.830 --> 03:35.870]  And we are the co-founders of Veracode.
[03:36.890 --> 03:37.170]  Thanks.
[03:37.190 --> 03:37.950]  You may take a drink.
[03:41.570 --> 03:42.830]  I'm John Tan.
[03:43.630 --> 03:54.210]  I picked that name because of the safe company that protects the crown jewels for the royalty in London there.
[03:54.510 --> 03:57.390]  The John Tan safe company.
[03:57.610 --> 03:59.430]  So that's just a physical security reference.
[03:59.430 --> 04:11.110]  And for the same reason everybody else, you know, has done it in the past, is just be anonymous online for one thing to protect your identity in the same way that it just makes common sense.
[04:11.590 --> 04:13.550]  You tell your children to do the same thing, right?
[04:15.910 --> 04:18.130]  And now I'm in the finance industry again.
[04:18.250 --> 04:20.190]  I spent 10 years before L0pht in finance.
[04:20.310 --> 04:23.950]  And after AtStake, I'm back in the finance industry once again.
[04:25.210 --> 04:26.530]  You may also take a drink.
[04:28.390 --> 04:29.330]  I should have brought alcohol.
[04:31.230 --> 04:32.090]  I'll drink for a minute.
[04:33.270 --> 04:33.590]  Cheers.
[04:34.790 --> 04:35.110]  Okay.
[04:35.730 --> 04:36.050]  Yeah.
[04:36.350 --> 04:36.550]  Okay.
[04:36.590 --> 04:37.830]  I thought we were going to have five minutes.
[04:37.830 --> 04:40.750]  I thought we were supposed to go through with what we've done the past 10 years.
[04:41.990 --> 04:42.430]  All right.
[04:42.510 --> 04:43.650]  Tell me when I can start.
[04:44.230 --> 04:48.010]  Because my wife was nice enough to, so one of the things is I got married.
[04:48.110 --> 04:48.490]  I'm Mudge.
[04:49.470 --> 04:51.590]  And in the last 10 years, let's see, I'm currently...
[04:51.590 --> 04:51.990]  How did you pick the name?
[04:52.310 --> 04:53.530]  I'll get to that at the end there.
[04:53.750 --> 04:55.610]  If you're interrupting, I get some extra seconds there.
[04:56.590 --> 05:04.070]  I'm currently the Technical Director of National Intelligence Research and Applications for BBN, a little company that invented the internet for silent running torpedoes.
[05:04.190 --> 05:05.090]  Lots of stuff like that.
[05:05.530 --> 05:09.590]  I was made a plank owner of one of the current destroyers, along with Madeleine Albright and Richard Clark.
[05:10.390 --> 05:13.410]  I've been giving a lot of talks at universities associated with CyberCore.
[05:13.570 --> 05:16.270]  CyberCore is the president's scholarship for service.
[05:16.270 --> 05:17.930]  This is kind of like a cyber-ROTC.
[05:18.210 --> 05:27.310]  You get your college paid for, and then you have to go do two years or four years working for a national lab, working for the CIA, the NSA, or one of those places.
[05:28.390 --> 05:33.530]  I provide reports and input to the Intelligence Science Board and the Director of National Intelligence.
[05:33.530 --> 05:39.350]  I was visiting scientists for two, three years at Carnegie Mellon, a couple IEEE awards.
[05:40.070 --> 05:47.730]  Oh, I got a congratulatory letter from the CIA for contributing to their critical mission, which they didn't say what that was.
[05:49.350 --> 05:51.870]  I briefed the Democratic Policy Committee.
[05:52.090 --> 06:06.990]  Senator Edwards, I'm currently providing input to one of the presidential candidates that's running right now on critical infrastructure, and I was the person who testified against Vonage and shut them down for Verizon as an expert witness, so that's really working for the devil.
[06:08.710 --> 06:09.690]  Got married, all that fun stuff.
[06:09.690 --> 06:11.190]  You can start throwing fruit any time now.
[06:11.310 --> 06:11.470]  Yep.
[06:11.650 --> 06:15.370]  So the name, I give people who say, where did Mudge come from?
[06:15.590 --> 06:17.690]  Three choices for the answer.
[06:17.790 --> 06:19.450]  One is the short one, which is an entire lie.
[06:19.610 --> 06:24.470]  The second one is kind of half-truth, and the third is long and boring, and the actual story.
[06:24.470 --> 06:28.730]  Almost everybody goes for the first one, and I say it's my middle name, and they say how nice, and they walk away happy.
[06:30.330 --> 06:31.390]  So what's the real start?
[06:33.070 --> 06:34.190]  In 15 seconds.
[06:35.230 --> 06:39.490]  I didn't like somebody whose last name was Mudge, and I figured if I was going to get busted, they'd go to his house first.
[06:42.470 --> 06:43.490]  You may take a drink.
[06:43.650 --> 06:43.990]  Thank you.
[06:45.350 --> 06:45.950]  Space Rogue.
[06:47.350 --> 06:48.490]  Hi, I'm Space Rogue.
[06:48.890 --> 06:53.530]  I think I'm the only one left who still uses their handle exclusively, at least at HackerCons and stuff.
[06:54.470 --> 07:03.110]  I do that not because of trying to hide anything or anything bad that happened, but it's more of a perception thing for me.
[07:03.210 --> 07:10.050]  I can't really put Space Rogue down on my resume and expect people to sort of take me seriously or not try to do some Google searches.
[07:10.330 --> 07:17.630]  And despite the perception of the word Hacker and whatnot in this room, it's still very different out in the real world.
[07:17.630 --> 07:28.630]  And so when I'm trying to apply for a position as an IT manager and people see weird things on the resume or they do a Google search on my real name, I'd prefer they didn't link the two together.
[07:28.930 --> 07:35.010]  In some cases it would be a benefit, but I think in most cases it would actually still be a detriment, unfortunately.
[07:35.010 --> 07:41.310]  So while I still need to remain employed and pay my mortgage, the handle and the real name stay separate.
[07:41.910 --> 07:46.050]  So right now I'm currently working as an IT manager for a small marketing company in Somerville.
[07:47.310 --> 07:53.330]  It's interesting to me because basically I'm in charge of everything in the company, from the computers to the security system to telephones.
[07:53.330 --> 07:55.630]  So it's good, it's good work.
[07:55.950 --> 07:56.310]  Thanks.
[07:56.310 --> 07:56.970]  I'll make two minutes.
[07:57.050 --> 07:57.790]  You may take a drink.
[07:58.970 --> 07:59.630]  I need it.
[08:00.350 --> 08:01.370]  I need it.
[08:01.570 --> 08:02.670]  Hi, my name is Paul Nash.
[08:02.830 --> 08:04.810]  I used to go by the handle of Silicosis.
[08:06.110 --> 08:08.930]  Early on in the AtStake days it was interesting going into clients.
[08:09.170 --> 08:13.110]  I think in the beginning we started off, some of us using handles or some combination of the both.
[08:13.490 --> 08:17.790]  But early on it was one of those things where we were doing some really, really cool research.
[08:18.110 --> 08:20.570]  And the landscape and environment had really changed.
[08:20.950 --> 08:27.710]  It was no longer as big of a deal coming out with advisories or notifying companies or vendors of security issues and whatnot.
[08:28.190 --> 08:30.830]  So some of the research we were doing was really cool.
[08:30.990 --> 08:34.710]  So I just wanted to associate my real name so that, looking back, I can put it on my resume.
[08:35.450 --> 08:38.550]  I can go forward, I'll have white papers and whatnot I could reference and look back.
[08:39.510 --> 08:40.790]  So what am I doing today?
[08:40.930 --> 08:42.270]  I am actually still at Symantec.
[08:42.490 --> 08:44.790]  I am the only law person still at Symantec.
[08:45.090 --> 08:48.650]  And so, you know, a lot of people ask me, well, why are you still there?
[08:49.010 --> 08:49.710]  Everyone has left.
[08:49.710 --> 08:52.450]  You know, the thing is, it's actually a really cool environment.
[08:52.890 --> 08:54.830]  Symantec, obviously, is a multi-billion dollar organization.
[08:55.090 --> 08:57.890]  And that gives us great aperture into large organizations and whatnot.
[08:58.410 --> 09:03.610]  So just being able to advise CSOs for Fortune 50, Fortune 10, Fortune 100 companies.
[09:03.730 --> 09:04.610]  I mean, we're all over the board.
[09:04.730 --> 09:10.270]  And so I think Symantec really gives us the opportunity to go in there and actually solve hard problems.
[09:11.610 --> 09:13.950]  The L0pht was a lot of fun.
[09:14.090 --> 09:14.690]  It was very interesting.
[09:14.870 --> 09:17.590]  But we were very tightly focused on technology and whatnot.
[09:17.970 --> 09:24.970]  And security is a hard thing to solve, especially when you have 250,000 employees or tens of thousands of systems and whatnot.
[09:24.970 --> 09:27.410]  So I think that it's just an interesting problem.
[09:27.610 --> 09:28.590]  And I like to solve problems.
[09:29.530 --> 09:31.190]  And so why Silicosis?
[09:31.430 --> 09:33.170]  Oh, yeah, Silicosis.
[09:33.310 --> 09:34.290]  It's a black lung.
[09:34.450 --> 09:37.450]  It's a coal miner's disease, which I found out after choosing the handle.
[09:40.310 --> 09:46.230]  Yeah, but the origination, back when I was in fourth grade, I read a short story that had silicosis as one of the characters in there.
[09:46.230 --> 09:48.490]  And it was just a really cool-sounding name.
[09:48.650 --> 09:49.890]  And so it just stuck with me over time.
[09:50.050 --> 09:53.970]  So that when I was getting into the scene doing research and whatnot, it just gravitated back towards that.
[09:54.650 --> 09:56.650]  One of the few L0pht owners who never smoked, also.
[09:57.190 --> 09:58.050]  Yeah, exactly.
[09:58.370 --> 10:00.350]  But I forgot, or Space Rogue.
[10:00.470 --> 10:01.050]  Why Space Rogue?
[10:02.810 --> 10:06.830]  There's actually, there's a game that's called Space Rogue that I didn't know about when I picked the handle.
[10:07.450 --> 10:13.450]  It just came out from Free Word Association when I first, I think it was the works board that I first signed into that required a handle.
[10:13.450 --> 10:17.750]  And I was sitting there at the prompt, like, what the hell is my name going to be?
[10:18.090 --> 10:22.150]  And I just sat there for five minutes and did basically Free Word Association, and that's what I came up with.
[10:22.650 --> 10:25.450]  And then I found out there's some stupid, cheesy game called Space Rogue.
[10:26.250 --> 10:28.670]  Wasn't it also a John Bruner Shockwave Rider?
[10:28.710 --> 10:29.090]  No, no, no.
[10:29.170 --> 10:31.730]  Shockwave Rider is my other handle, Sandy Halflinger.
[10:31.770 --> 10:32.610]  Oh, right, right, right.
[10:32.630 --> 10:37.370]  It's the main character in Shockwave Rider by John Bruner, which if you've never read, I highly recommend.
[10:38.050 --> 10:40.850]  It talks about the worldwide internet like, you know, 20 years ago.
[10:41.110 --> 10:43.090]  Weren't you also known as Space Rouge occasionally?
[10:44.430 --> 10:48.010]  No, that comes out because of Spaceronics, which is where Space Rouge comes from.
[10:48.310 --> 10:49.370]  That's a whole other topic.
[10:50.070 --> 10:51.110]  We'll save that for later.
[10:51.270 --> 10:52.110]  You can take another drink.
[10:52.390 --> 10:52.910]  I can take that.
[10:53.530 --> 10:53.930]  Dil.
[10:54.270 --> 11:01.390]  Alright, Dil, I go by, I've gone by Dil, DilDog, a bunch of other unsavory names.
[11:03.250 --> 11:08.690]  I guess, yeah, I don't really use a handle anymore.
[11:09.070 --> 11:11.950]  I've mostly been in a cave writing code for the last few years.
[11:12.810 --> 11:30.630]  I did a lot of work over the course of years at AtStake and now at Veracode on decompilation technologies, making sort of the theoretically possible decompilation process actually fractal for, you know, analyzing large binaries.
[11:34.230 --> 11:42.370]  The name DilDog, I actually wanted to pick something that sounded dirty.
[11:43.430 --> 11:44.630]  Well, not unoffensive.
[11:44.750 --> 11:45.990]  I guess that's not the word I was looking for.
[11:49.680 --> 11:58.720]  I don't know, I had seen a lot of handles like names like Evil Superkiller or Lord Digital or some other thing that was just too, like, maybe pretentious.
[11:58.900 --> 12:00.560]  I wanted to have something that was approachable.
[12:00.560 --> 12:06.180]  So I picked the name without quite realizing that it needed the hyphen in the right place.
[12:08.420 --> 12:10.340]  You know, it's like, it's like the expert's exchange.
[12:10.880 --> 12:12.800]  You know, if you take the hyphen on text, anyway.
[12:15.560 --> 12:24.740]  But, yeah, so the DilDog name is actually the name of the Dogburt character from the Dilburt comic strip before it was syndicated.
[12:25.180 --> 12:30.540]  Scott Adams had named all the characters Dilburt, DilDog, Dilcat, Dil etc.
[12:31.380 --> 12:33.560]  And the editors wouldn't let him print it.
[12:33.740 --> 12:37.500]  They censored it and made him change the name because it had the substring dildo in it.
[12:37.800 --> 12:40.740]  I actually didn't notice that part of the thing.
[12:41.960 --> 12:43.940]  I always capitalize the two Ds.
[12:44.180 --> 12:49.360]  So it wasn't obvious to me until I got laughed at a pound hack on IRC when I first came in there.
[12:51.860 --> 12:53.920]  But, yeah, that's basically it.
[12:54.540 --> 12:59.720]  And does anybody quickly want to talk about Kingpin and Brian Oblivion and whether they're still in the business?
[13:01.540 --> 13:07.120]  Well, Kingpin now has Grand Idea Studios and he does a lot of hardware hacking.
[13:07.280 --> 13:14.340]  He designed the badges for DEFCON last year, LED, and I think they had wireless capability.
[13:14.760 --> 13:15.700]  Last two years, I think.
[13:15.880 --> 13:16.620]  Last two years.
[13:17.040 --> 13:20.620]  So he's on the board of advisors for Make Magazine.
[13:22.220 --> 13:32.760]  And now, as Mudge was saying, he's working on a documentary much like the Monster Garage type shows where people are basically doing hardware hacking.
[13:33.020 --> 13:34.220]  It's a do-it-yourself show, isn't it?
[13:34.300 --> 13:37.080]  I mean, like a regular thing on Discovery Channel or something?
[13:37.560 --> 13:39.640]  Discovery, I think he's going to air in September.
[13:41.440 --> 13:48.180]  And Brian, as far as I know, is working on wireless systems, secure military wireless systems.
[13:48.420 --> 13:50.080]  I just saw him four days ago.
[13:50.280 --> 13:52.580]  He was actually up in Boston for one day.
[13:52.680 --> 13:54.280]  He had to come into BBN.
[13:54.700 --> 13:56.240]  We used some of the boards that they were doing.
[13:57.060 --> 13:59.720]  He's out there doing his hardware and wireless stuff.
[14:00.340 --> 14:00.920]  All right.
[14:01.060 --> 14:02.580]  So, let's get into the meat of this.
[14:02.580 --> 14:05.780]  What's this taking down the internet in 30 minutes comment?
[14:05.960 --> 14:06.800]  Where did it come from?
[14:07.680 --> 14:08.980]  Did you ever really try it?
[14:10.100 --> 14:11.820]  Well, it came from me, unfortunately.
[14:13.220 --> 14:18.400]  And it was something that the media keyed in on during our Senate testimony in 1998.
[14:18.780 --> 14:21.440]  And what we were talking about was BGP.
[14:21.520 --> 14:32.860]  Well, were BGP attacks against the National Access Points or metropolitan area ethers, which were the major kind of muxes for long-haul inter-carrier exchange of information.
[14:33.740 --> 14:35.800]  It was entirely possible to do.
[14:36.040 --> 14:41.740]  Actually, the L0pht web server sat on a cable being pulled out of MAE East.
[14:41.880 --> 14:45.440]  So, anybody could actually get there, and nobody had BGP filters in place at the time.
[14:46.000 --> 14:52.040]  Even with the current best practices of BGP, they don't have the protective mechanisms in place for it.
[14:52.040 --> 15:02.240]  It actually did happen a few times as well, just accidentally, where people basically black-holed the entire internet by publishing bogus routes accidentally.
[15:02.700 --> 15:06.840]  Anything you can do accidentally just through, you know, sloppy work, you can intentionally do.
[15:07.460 --> 15:10.360]  This went down for a couple hours here or there.
[15:10.620 --> 15:12.640]  Case in point, YouTube and Pakistan.
[15:12.820 --> 15:15.040]  Oh, yeah, very similar one just happened with YouTube and Pakistan.
[15:15.040 --> 15:16.780]  You can take countries off pretty easily.
[15:18.020 --> 15:18.940]  What's happened...
[15:18.940 --> 15:19.460]  What's happened...
[15:19.460 --> 15:20.760]  Yeah, well, Estonia's a bit different.
[15:23.080 --> 15:31.020]  What's happened since then is that we've gone to a lot of private peering agreements with places, and there are a lot more internet exchange points or internet peering points.
[15:31.240 --> 15:36.760]  So, rather than 30 minutes, it would probably take about two and a half to three hours to do now.
[15:36.980 --> 15:38.860]  And this is all the actual engagement.
[15:39.040 --> 15:41.920]  There's still a fair amount of setup to get your stuff in place, as there was before.
[15:42.360 --> 15:43.420]  But that's what that was.
[15:43.540 --> 15:48.020]  So, does the fact that it hasn't happened, does that mean that hackers have become beneficent over time?
[15:48.020 --> 15:55.200]  Or why haven't we seen one of these, you know, I guess total outages of the internet?
[15:55.340 --> 15:59.380]  You can't conduct a cyber campaign and go after a target if you've taken out your means of the campaign.
[16:00.360 --> 16:00.940]  All right.
[16:01.180 --> 16:01.600]  Anybody else?
[16:01.600 --> 16:03.800]  You've been spending too much time with defense campaigns.
[16:05.420 --> 16:26.180]  You know, the trend we're seeing overall is as soon as things move from, you know, vanity and bragging rights to criminal activity, which is we're seeing with a trend with malicious code over time, we're seeing wide-scale destruction go against the aims of the people that have the capabilities to,
[16:26.180 --> 16:27.480]  you know, cause harm on the internet.
[16:27.480 --> 16:30.160]  They don't want wide-scale destruction, they want targeted attacks.
[16:30.360 --> 16:37.060]  Even if those targeted attacks are, you know, 50,000 CEOs or 50,000 machines, it's still under the radar.
[16:37.260 --> 16:43.160]  It isn't something where the whole internet jumps up and says, oh my god, we've got to solve this problem, which is what happened with things like code red.
[16:44.220 --> 16:48.600]  It's under the radar, no one's really noticing it, and it's a really, it's a problem.
[16:48.820 --> 16:56.120]  It's something that, you know, I don't think we have the means to deal with these under-the-radar types of attacks that are going on.
[16:56.120 --> 17:00.360]  Do you want to make the analogy that Dan did in his speech about the symbiotic relationship?
[17:01.940 --> 17:02.080]  No.
[17:02.380 --> 17:15.740]  Yeah, well, that's another point, and I think Dan was, you know, Dan took something that Mudge said probably, I don't know, five or six years ago, that he noticed on machines that were compromised that they were the best managed machines in the network.
[17:15.880 --> 17:17.460]  They were up to patch level, they were hardened.
[17:18.040 --> 17:20.420]  Their log files weren't filling up and choking the system.
[17:20.420 --> 17:24.980]  Some extraneous, extraneous processes that weren't being used for any purpose were removed.
[17:24.980 --> 17:25.220]  Sure, yep.
[17:25.720 --> 17:42.440]  So, and so Dan made this analogy from the medical analogy from going from, you know, basically, you know, virus to parasite, which the parasite wants to have the host live, to symbiotic, where the symbiote actually wants the host to get better.
[17:42.440 --> 17:50.660]  And so I think that's a great analogy on the machine level, but we're seeing that on the internet level with things like, you know, like the storm bots and things like that.
[17:50.780 --> 17:53.800]  It doesn't want to harm your productivity.
[17:53.840 --> 17:56.180]  It wants your network to run well.
[17:56.260 --> 18:00.660]  So maybe we'll have, you know, the storm bots actually making the pipes run better.
[18:00.800 --> 18:01.240]  Who knows?
[18:01.760 --> 18:10.120]  Well, another thing that we're seeing is we don't, we're having attacks that are coming out that are able to actually target geographic areas.
[18:10.120 --> 18:19.500]  When we saw the distributed amount of service attack against the major root name servers that provided .org and .mil, and it only took them out in particular geographic areas.
[18:19.500 --> 18:25.900]  This is because they've started using something called Anycast for responses, for DNS requests.
[18:26.100 --> 18:32.860]  So within a particular area, you're always going to, you think, the same IP address, but that's a locally pushed out responder to you.
[18:33.120 --> 18:40.840]  So now, I mean, if you could do this with BGP, which you can, you can take off particular autonomous systems, you can take off particular organizational areas.
[18:41.360 --> 18:55.660]  But even in the distributed amount of service with some of the defensive mechanisms they've put in, you're able to say, I want to take this particular region off the net and keep them off the net, and that still enables me to use the rest of the net's resources or the components that I want.
[18:55.820 --> 18:57.920]  This is a much more devastating attack.
[18:59.240 --> 19:05.100]  So are we safer or not as safe as we were 10 years ago when you guys were in front of Congress?
[19:06.220 --> 19:06.860]  Talking about...
[19:06.860 --> 19:10.260]  Well, we're more dependent and the security hasn't improved much.
[19:10.440 --> 19:12.680]  So I guess that, by definition, means we're less safe.
[19:13.880 --> 19:14.940]  Anybody else have a thought?
[19:15.020 --> 19:19.300]  I think education has improved about security vulnerabilities significantly.
[19:20.860 --> 19:27.900]  The fact that a lot of the attacks are becoming automated has scared the pants off.
[19:27.900 --> 19:32.620]  the people enough that I think that we realize that the defenses have to become automated too.
[19:33.080 --> 19:34.300]  Otherwise, we'll never keep up.
[19:34.580 --> 19:37.580]  Yeah, but your education level varies depending on your audience.
[19:37.820 --> 19:38.000]  Yeah, clearly.
[19:38.000 --> 19:41.140]  I mean, your audience is probably... your education level is probably pretty high.
[19:41.260 --> 19:42.020]  Well, I...
[19:42.960 --> 19:45.600]  There's the people that consume code and people who write it.
[19:46.080 --> 19:50.380]  You know, if you don't write bugs as much, then there's less problems to exploit.
[19:51.100 --> 19:53.140]  This may be just a simple linear factor.
[19:53.360 --> 19:55.080]  There may always be configuration issues.
[19:55.600 --> 20:00.300]  You know, there's always a human element and we do have to find ways of dealing with that.
[20:00.760 --> 20:14.260]  And to harken back to Dan Geer's speech again, you know, some of these problems may not get solved until control is wrested from the user of the machine and placed in the hands of somebody who actually knows what they're doing.
[20:14.400 --> 20:31.700]  Now, that doesn't necessarily mean that, you know, people should not be allowed to use their computers or that somebody should be controlling it or monitoring it, but that security and, you know, may become dependent on a certain amount of centralization in terms of management of,
[20:31.860 --> 20:33.060]  you know, the things that are vulnerable.
[20:33.900 --> 20:34.600]  It's a thought.
[20:35.260 --> 20:37.420]  I also think that, to some degree, we are a lot better.
[20:37.620 --> 20:38.980]  I mean, if you look back...
[20:38.980 --> 20:41.620]  I mean, back in 98, not many companies had security contacts and whatnot.
[20:41.620 --> 20:45.180]  They had no internal process and procedures around receiving vulnerability information.
[20:45.440 --> 20:46.520]  And I think that's really changed.
[20:46.640 --> 20:48.680]  From an operational standpoint, I think companies...
[20:48.680 --> 20:50.780]  I mean, some companies may be better off than others.
[20:51.120 --> 20:59.480]  But for those that are controlling some critical assets or have some very valuable information and whatnot, they have a lot of the process and procedures in place to actually handle the incidents.
[20:59.760 --> 21:02.160]  Because, I mean, there's always going to be zero days out there.
[21:02.220 --> 21:04.020]  There are always going to be vulnerabilities and exploits and whatnot.
[21:04.040 --> 21:10.140]  But you really need to have the strong process and procedures on the back end to know what to do and how to correctly handle that situation.
[21:10.140 --> 21:17.060]  And I think that if you... I think there's a huge increase in maturity around that over the last 10 years.
[21:17.260 --> 21:20.880]  I mean, I think that there's still more work that needs to be done, but I think that we're better off from 98.
[21:21.200 --> 21:24.640]  Except for utility sectors, because SCADA and DCS are just an abomination.
[21:24.900 --> 21:25.720]  We're not SCADA again.
[21:27.340 --> 21:28.200]  Well, it's funny.
[21:28.300 --> 21:30.560]  I mean, it's been making the news recently.
[21:30.760 --> 21:38.260]  And this was something that the L0pht had an article that was in the New York Times around the time that we had testified to the Senate that we could shut the internet down in 30 minutes.
[21:38.260 --> 21:45.520]  And I said, I can get into the, you know, the plant control and plant information networks of 30 utility grids that actually have nuclear generators on them.
[21:45.620 --> 21:47.220]  Yeah, like core goes up, core goes down.
[21:47.240 --> 21:47.640]  Nobody cared.
[21:47.660 --> 21:48.140]  Core goes up.
[21:48.640 --> 21:51.100]  And so now we're, you know, it's finally coming up there.
[21:51.180 --> 21:58.680]  But we've moved from these dedicated systems to Microsoft boxes, talking Modbus and WorldFips on their serial networks.
[21:58.680 --> 22:03.420]  And the stacks alone won't hand up for these systems, won't stand up to like an NMAP scan.
[22:04.280 --> 22:12.080]  But we're spending billions of dollars and maybe tens of billions of dollars in certainly the corporate community, corporate world, on security.
[22:14.120 --> 22:18.680]  Methodologies, on products, on, you know, consultants, you know.
[22:19.400 --> 22:23.400]  You're kind of saying, it sounds like you're kind of saying that at least in some sectors of the economy, it's irrelevant.
[22:23.720 --> 22:25.760]  It hasn't made a bit of difference.
[22:25.920 --> 22:26.860]  Yeah, out of sight, out of mind.
[22:27.860 --> 22:28.540]  Anybody else?
[22:28.540 --> 22:30.620]  Well, you look at the banking industry, right?
[22:30.780 --> 22:37.720]  And I see a lot of things that, before I was with L0pht, the banking industry was in one state.
[22:37.860 --> 22:44.520]  And I think definitely the maturity has risen in that you don't have to prove that a buffer overflow is a dangerous thing anymore.
[22:44.720 --> 22:44.980]  Good point.
[22:45.180 --> 22:47.300]  Now it's more like quality assurance.
[22:47.720 --> 22:50.080]  It's like you have to go and clean everything up.
[22:50.140 --> 22:52.720]  We just want a laundry list of everything that's out there and we believe it.
[22:52.720 --> 22:54.560]  So, the maturity has definitely gone up.
[22:54.680 --> 22:59.280]  But then, by the same token, now they want to push out new stuff like mobile banking.
[22:59.480 --> 23:03.180]  So, you've got all these new territories that are just as bad as the old one used to be.
[23:03.300 --> 23:05.260]  And maybe they've cleaned up a little bit on the back end.
[23:05.540 --> 23:07.200]  In the case of finance, for instance.
[23:07.520 --> 23:07.580]  Yeah.
[23:08.320 --> 23:10.760]  So, at least in some places, the money's paying off.
[23:11.400 --> 23:12.800]  NASDAQ's backup is still...
[23:12.800 --> 23:15.520]  In one area, but they'll grow a new area that's just weak.
[23:15.780 --> 23:17.420]  But they're still missing certain things.
[23:17.520 --> 23:21.900]  Like NASDAQ in New York, their backup site is within 15 miles.
[23:21.900 --> 23:22.620]  Oh, absolutely.
[23:22.800 --> 23:22.860]  Yeah.
[23:22.860 --> 23:27.240]  Which is just ridiculous if you're talking about a natural catastrophe or a targeted hit.
[23:27.860 --> 23:30.360]  So, we've got vulnerabilities all over the place, even now.
[23:30.520 --> 23:40.120]  But you guys spent really almost a full decade during the 90s trying to address these, you know, call attention to vulnerabilities, things like that.
[23:40.260 --> 23:45.120]  I mean, did the way that you go about it, did it help?
[23:45.900 --> 23:50.540]  Can you look at sort of the full disclosure wars and sort of say, yeah, that worked?
[23:50.540 --> 23:52.300]  Or maybe we should have gone in a different direction?
[23:52.860 --> 23:55.100]  Well, it created an industry that really wasn't there before.
[23:56.000 --> 23:59.720]  If nothing else, then the selling of exploits to certain organizations.
[24:00.020 --> 24:06.960]  But I think, and Marcus Rayn will always argue the opposite, and this was in something recently, that we did make a big difference.
[24:07.600 --> 24:15.080]  If you look at Microsoft and their response, we helped them out tremendously by rattling their cage, kicking the hornet's nest, as it were.
[24:15.080 --> 24:24.280]  Intel, as Silicosis was just mentioning, they didn't have a security responder until we came up with their crypto box, the vulnerabilities and that.
[24:24.600 --> 24:34.340]  People started realizing that if they weren't going to be responsive to the problems that we were bringing up, you know, we'd take it public and we'd drag them through the muck.
[24:34.340 --> 24:40.400]  And, you know, large organizations that are, you know, dependent upon their share values didn't want this to happen.
[24:41.520 --> 24:48.960]  That changed pretty quickly as people realized, because we got a lot of notoriety and publicity off of a lot of the vulnerabilities that I and others published.
[24:49.340 --> 24:55.080]  But, and I think a lot of other people who got into the field did it for self-serving, you know, trying to boost their own reputation, their ego.
[24:55.080 --> 24:58.300]  Ours was really, look, these vendors are not listening.
[24:58.460 --> 25:02.280]  The only thing we can do is publicly flog them until they respond.
[25:02.840 --> 25:06.700]  And now the vendors do respond and people are still trying to publicly flog them.
[25:06.780 --> 25:10.180]  It's like, no, no, no, we have to, you know, step up to the next level to try and help elevate.
[25:10.380 --> 25:15.220]  I think some people kind of misunderstood, like, you know, the goal of vulnerability research.
[25:15.380 --> 25:18.640]  It's not like we're going to find all the vulnerabilities in the product and tell the vendor.
[25:18.640 --> 25:25.600]  It's just like we're going to point out the most egregious ones, and the vendor's going to have to then go in and change the way they build software.
[25:25.940 --> 25:29.300]  So, you know, it's, you can't have an external QA process.
[25:29.400 --> 25:31.560]  You actually have to build the software the correct way.
[25:31.680 --> 25:35.040]  And all we were doing is pointing out that they weren't doing it.
[25:35.380 --> 25:37.520]  You know, vulnerability research itself isn't the solution.
[25:37.660 --> 25:38.860]  The vendors had to respond.
[25:38.880 --> 25:43.120]  And, you know, the vendors that have, you know, do have substantially better code.
[25:43.260 --> 25:48.620]  But, you know, the way I look at it is people only start writing better code once they get picked up.
[25:48.620 --> 25:51.580]  And they start getting picked on once they get enough market share.
[25:51.820 --> 25:56.180]  So all the things with small market share, no one is picking on it.
[25:56.280 --> 26:00.380]  All that stuff is actually very fragile and has a lot of vulnerabilities in it.
[26:00.520 --> 26:02.660]  As it starts to get market share, it gets picked on.
[26:03.000 --> 26:05.100]  And then they say, hey, wait a minute.
[26:05.200 --> 26:07.760]  So there's like a long cycle when a company comes to market.
[26:07.920 --> 26:11.100]  There will be like three or four years of revisions as they grow.
[26:11.280 --> 26:12.600]  And all of a sudden they get picked on.
[26:12.700 --> 26:14.240]  And then they start writing secure code.
[26:14.400 --> 26:22.140]  So because of the way the market is like that, you know, and half the software is written by companies that are probably, you know, a few hundred employees.
[26:23.160 --> 26:24.920]  We have a lot of vulnerabilities still out there.
[26:25.060 --> 26:28.060]  Even with Microsoft and Oracle and Apple doing a good job.
[26:28.620 --> 26:29.020]  So...
[26:29.020 --> 26:32.440]  I want to add one thing in there that I agree with what Weld said.
[26:32.620 --> 26:43.700]  One thing that's still disturbing is that when people point out a particular vulnerability, let's say it's a buffer overflow, let's just say it's a stack overflow in a particular line of code, that the vendors oftentimes, not always, but still oftentimes,
[26:44.000 --> 26:46.240]  will just go and fix that one particular problem.
[26:46.400 --> 26:51.380]  And what you're really trying to point out is you are making this particular type of mistake.
[26:51.380 --> 26:53.760]  You need to go back and fix all of those areas.
[26:53.780 --> 26:56.220]  And instead they just say, oh, this is what you found.
[26:56.280 --> 27:03.460]  We will fix that rather than learning from it and actually saying, oh, any place where we have an unbounded copy, we should bound this copy to prevent overflows.
[27:03.460 --> 27:04.920]  And that's disturbing to see.
[27:04.960 --> 27:13.080]  There's a big cost, though, to go in through a product, to something as large as, you know, a Microsoft operating system or an Oracle application and finding everything that's in there.
[27:13.180 --> 27:14.220]  I mean, that's not trivial.
[27:14.420 --> 27:15.480]  Sure, it's a big cost for that company.
[27:15.500 --> 27:20.160]  And I'll argue that it's a bigger cost for the person who gets popped by it if it's a real targeted nasty attack.
[27:21.100 --> 27:21.440]  All right.
[27:21.820 --> 27:23.360]  So is there, you know...
[27:23.360 --> 27:27.760]  Well, in speaking, I wanted to go back to you were talking about smaller companies and the fact there's still a lot of vulnerabilities out there.
[27:27.840 --> 27:30.540]  We saw several bug-a-day kind of episodes.
[27:30.960 --> 27:33.320]  Sort of like, you know, pick your month, we'll have a different thing.
[27:33.520 --> 27:34.460]  And, you know, Apple got picked on.
[27:34.580 --> 27:35.680]  A couple other companies got picked on.
[27:36.200 --> 27:38.460]  You know, is there still really a role for that?
[27:38.580 --> 27:38.940]  Did that...
[27:38.940 --> 27:42.940]  Is that the kind of thing that needs to happen for those companies as well?
[27:43.140 --> 27:48.420]  Or, as some people said at the time, was it really just kind of grandstanding on the part of the people who were doing it?
[27:49.080 --> 27:55.000]  Well, I think that the bug-a-day, a little bit of it is trying to, you know, focus your energy in one time.
[27:55.160 --> 27:56.680]  And it's a little bit of a marketing spin.
[27:58.160 --> 27:58.960]  I think...
[27:58.960 --> 28:02.540]  I'm not sure that they really make any more of a difference to do that.
[28:02.700 --> 28:07.260]  I mean, it probably gets it in the press more, which gets their customers to know about it a little bit more.
[28:08.840 --> 28:15.000]  But I haven't seen anyone who's been hit with a bug-a-day for a month actually change that much.
[28:16.680 --> 28:18.980]  But it took a long time for Microsoft to change.
[28:19.140 --> 28:19.700]  I mean, you guys were...
[28:20.460 --> 28:25.540]  You and others pounded on them for a long time before they finally said, we're going to spend a billion dollars and fix this.
[28:25.840 --> 28:27.260]  When did you first...
[28:27.260 --> 28:28.680]  The towel of Windows Overflows?
[28:28.900 --> 28:30.840]  Send the IE overflow to...
[28:31.240 --> 28:33.040]  The first IE overflow was when?
[28:33.140 --> 28:37.220]  Yeah, the Internet Explorer 4.0 had an overflow that I did a while back.
[28:37.340 --> 28:39.160]  It was the Res overflow.
[28:39.240 --> 28:40.000]  I did a stack one.
[28:40.160 --> 28:41.880]  I did a heap one with the MK overflow.
[28:42.040 --> 28:44.440]  Those two came out within like a month or so of each other.
[28:44.540 --> 28:45.260]  And it was like 1997.
[28:46.020 --> 28:47.820]  And then Bill Gates came out with his memo in 2002.
[28:48.960 --> 28:49.140]  Yeah.
[28:49.140 --> 28:54.400]  So, it took a lot of stuff to build up to get to the point where they would actually make the investment.
[28:54.580 --> 28:57.160]  Well, you also remember what their first response was when...
[28:57.160 --> 29:02.640]  I took some of Hobbit's work on what eventually became part of L0phtCrack.
[29:02.840 --> 29:13.400]  And their first response was to try and take us out to dinner and then offer us their source code under non-disclosure agreements which would then stop us from being able to publish any more vulnerabilities that we found.
[29:15.560 --> 29:16.840]  We told them we already had it.
[29:16.840 --> 29:17.360]  Yeah.
[29:17.700 --> 29:17.720]  Yeah.
[29:21.020 --> 29:21.860]  How was the dinner?
[29:22.760 --> 29:23.140]  Free.
[29:23.500 --> 29:23.840]  Yeah.
[29:24.240 --> 29:24.740]  It was good.
[29:25.480 --> 29:29.460]  So, kind of segwaying from that though, there was the motive issue.
[29:29.580 --> 29:33.520]  There was a lot of controversy from certain people who were really looking to get paid for finding vulnerabilities.
[29:33.840 --> 29:38.160]  What's your take on whether, you know, is that valid?
[29:38.340 --> 29:40.420]  Should people be paid for finding vulnerabilities?
[29:40.640 --> 29:42.040]  There's a few ways of looking at that.
[29:42.140 --> 29:46.820]  I mean, clearly, you've got the standard consulting model where people are paid to pay.
[29:46.820 --> 29:51.860]  They find vulnerabilities for a particular company and not tell anyone except that company.
[29:52.420 --> 29:55.700]  But then you've got the markets that have grown up around vulnerabilities.
[29:56.240 --> 29:58.420]  And, you know, some of them are more legitimate than others.
[30:01.440 --> 30:11.480]  But, you know, the thing that I've noticed, I guess, is that, you know, there's a price now for a particular vulnerability or its type.
[30:12.020 --> 30:15.820]  And, you know, back in the day, you know, you were just kind of finding vulnerabilities.
[30:15.820 --> 30:21.340]  And there was sort of an infinitesimal or infinite value depending on the way you looked at it.
[30:21.980 --> 30:27.660]  Nowadays, you know, a particular overflow in a particular platform is, you know, $70,000.
[30:28.100 --> 30:35.860]  And that generally would suggest that someone else is making a penny too somewhere off those vulnerabilities.
[30:35.860 --> 30:45.940]  So I have to ask the question, you know, does, you know, a vulnerability-sharing market result in crime or not?
[30:47.160 --> 30:51.860]  Well, as we were mentioning when we talked right before the paneling, people should be paid for their research.
[30:53.520 --> 31:03.660]  And this is cognitive dissonance for me because I'm of the mindset that you should be sharing all the nasty, dangerous details of it, even if there's not a fix.
[31:04.060 --> 31:15.100]  Because if people are at least aware of it, they can potentially mitigate the effectiveness of the attack, even if there's not a defense against that particular attack, by moving resources, changing network, et cetera.
[31:15.640 --> 31:20.180]  And I'm saying this, of course, and my biggest clients are the intelligence community and the DOD now.
[31:20.180 --> 31:22.280]  So I'm in a bit of a quandary because...
[31:22.280 --> 31:23.780]  Do they share all the vulnerabilities they know?
[31:24.000 --> 31:25.840]  I don't share shit anymore.
[31:30.280 --> 31:31.760]  But that's an interesting tech.
[31:31.880 --> 31:34.720]  I mean, the reason they don't share a lot of the stuff is a lot of stuff is offensive in nature.
[31:34.980 --> 31:37.140]  And a lot of the stuff is defensive as well.
[31:37.280 --> 31:42.140]  And you don't want other people to know about the total capabilities that you have.
[31:42.280 --> 31:50.900]  And when you see the commercial sector go the same way, well, you got to kind of think that there's some of this evil scariness going on in the commercial sector that we've always been thinking about that the Feds do.
[31:52.480 --> 31:54.160]  And that's a disturbing trend.
[31:56.880 --> 31:57.680]  Nodding of heads.
[31:58.100 --> 32:02.720]  Well, since we're talking money, I feel like I have to ask you guys, was it worth it to sell out?
[32:06.200 --> 32:07.740]  I don't think we had a choice, really.
[32:08.820 --> 32:12.120]  At State cost me $75,000, personally.
[32:12.700 --> 32:15.780]  It was not worth it.
[32:15.780 --> 32:20.520]  I think that you have to, you know, look at what was going on at the time.
[32:20.720 --> 32:21.540]  We weren't in a vacuum.
[32:21.720 --> 32:24.060]  This industry was becoming a professional industry.
[32:24.600 --> 32:27.860]  People were getting paid to do this kind of research.
[32:28.140 --> 32:36.820]  And it was becoming security... the whole idea of security research was becoming commercialized, whether we liked it or not.
[32:37.420 --> 32:44.560]  So, you know, it was either do we want to stay outside that or do we want to contribute to it and try to make it as good as we can?
[32:44.560 --> 32:45.740]  Try to lead it and help.
[32:45.740 --> 32:46.360]  Try to lead it.
[32:46.680 --> 32:47.280]  Involve or die.
[32:47.900 --> 32:48.160]  Exactly.
[32:49.140 --> 32:59.440]  The point that L0pht was at that point, prior to At State, I mean, we would have continued on if we had continued doing our same thing in the same way, but we would have eventually just died out.
[33:00.780 --> 33:05.160]  The L0pht as it was, I don't think it was a sustainable model for any length of time beyond At State.
[33:05.380 --> 33:10.420]  If we hadn't tried to do something big, I mean, to make the effort, we're like, this is our shot.
[33:10.420 --> 33:12.860]  We're going to change the world, make a dent in the universe.
[33:13.380 --> 33:14.980]  It didn't, unfortunately, work out that way.
[33:15.100 --> 33:16.440]  But that was the goal when it started.
[33:17.260 --> 33:19.500]  And so, was it worth it to sell out?
[33:19.580 --> 33:20.580]  I think we had to give it a shot.
[33:21.020 --> 33:28.120]  Well had a great analogy a long time ago saying, like, you know, you can be the best, you know, garage band in the world.
[33:28.120 --> 33:33.140]  And the only people that are inspired or hear your message are the people that live in, you know, a couple block radius of you.
[33:33.600 --> 33:41.160]  And you have an option of, you know, trying to, you know, change the world and influence people and hopefully do good by staying at that garage band.
[33:41.320 --> 33:46.380]  Or you can try and make some educated and, you know, and careful compromises.
[33:46.560 --> 33:50.280]  Get a promoter and, you know, go to the big venues and try and, you know, spread.
[33:50.280 --> 33:53.720]  Maybe your message will be a little diluted, but at least it's still your message and you're hitting more people.
[33:53.720 --> 33:59.740]  And that gave me a lot of solace and hope, you know, that we tried to do that.
[33:59.800 --> 34:01.860]  I think we did change the industry in certain ways.
[34:01.900 --> 34:08.000]  I mean, for the first year and a half of that stake, we were the only ones that really were not beholden to any vendors.
[34:08.120 --> 34:10.440]  We wouldn't take kickbacks for recommending anybody's stuff.
[34:10.560 --> 34:17.760]  We paid for our own equipment that we were going to do analysis on because we wanted to follow the consumer reports model where people could actually trust what we're doing.
[34:17.980 --> 34:24.220]  When the bubble started to burst and people were kicking out consulting agencies, the big five at the time, were getting booted out.
[34:24.300 --> 34:28.840]  And they were keeping AtStake because AtStake was like, well, they're only thinking about our particular problem.
[34:29.100 --> 34:37.240]  But even then, you know, the executive team and the market influences, eventually those morals, those directions, I should say, started to erode.
[34:38.100 --> 34:39.440]  But it was an effort.
[34:40.060 --> 34:42.620]  Yeah, I mean, at the time we were a small software shop.
[34:42.740 --> 34:43.580]  I mean, we had L0phtCrack.
[34:43.780 --> 34:44.960]  Making money in spite of ourselves.
[34:45.100 --> 34:45.700]  No, yeah, exactly.
[34:45.960 --> 34:49.180]  I think if we had more business acumen, we probably would have raised the price of L0phtCrack.
[34:50.920 --> 34:51.240]  But...
[34:51.240 --> 34:52.320]  It was only, what, 50 bucks or something?
[34:52.420 --> 34:53.400]  Yeah, 50 bucks.
[34:53.520 --> 34:55.920]  I think Symantec was selling it for 1,500, but...
[34:55.920 --> 34:57.280]  The Maylife version was free.
[34:57.540 --> 35:00.320]  You should have gotten the open source model in charge for support.
[35:00.860 --> 35:03.240]  I mean, we were a small product shop.
[35:03.360 --> 35:04.580]  We did also had consulting as well.
[35:04.720 --> 35:07.040]  I mean, we were doing some very cool projects with network, flight recorder, and whatnot.
[35:07.400 --> 35:15.120]  But I mean, we were cobbling together systems out of garbage and whatnot, and just trying to build, I mean, like I remember sitting at a desk with, like the desk came out of the garbage and so did the chair.
[35:15.120 --> 35:19.540]  We just were all cobbled together working in a room that had no AC and 100 degree heat.
[35:20.260 --> 35:24.180]  But we needed to go to the next level so we could continue the great research that we were doing.
[35:24.380 --> 35:28.560]  And we saw that that next level was attainable.
[35:28.700 --> 35:31.380]  I mean, it's funny, we did a lot of this technology reclamation.
[35:31.420 --> 35:33.820]  I think somebody at the L0pht coined that might have been well.
[35:33.920 --> 35:34.420]  Dumpster diving.
[35:34.540 --> 35:35.320]  Yeah, dumpster diving.
[35:35.460 --> 35:36.180]  Technology reclamation.
[35:38.080 --> 35:40.660]  And at one point, I was doing some work.
[35:40.800 --> 35:48.000]  I was running training classes at the NSA and some other things, and word got around to the National Security Council and the Executive Office of the President.
[35:48.020 --> 35:58.520]  So I convinced the other L0pht guys that we should allow these feds to come over to our secret establishment as a sign of goodwill so they can see that we're not a risk, you know, and we're not a threat to them.
[35:58.520 --> 36:03.380]  And hopefully we'll actually even be able to call in a favor if, you know, other agencies like the FBI hated us.
[36:04.420 --> 36:07.840]  You know, got riled up and didn't know how to take us.
[36:07.920 --> 36:11.340]  And so we give them a tour, and Richard Clark was there at the time.
[36:11.460 --> 36:14.120]  This is like, what, 97, 6, something like that.
[36:14.120 --> 36:14.760]  He was around there.
[36:15.400 --> 36:20.560]  And they walked outside, and they all kind of like grouped together and started talking and huddled whispers.
[36:20.680 --> 36:22.560]  And we're watching them go, and we're like, what the hell's going on?
[36:22.620 --> 36:23.720]  What are they whispering about?
[36:23.780 --> 36:25.020]  They could have gone back to a skiff.
[36:25.120 --> 36:27.220]  They could have gone back to D.C., talked about this.
[36:27.220 --> 36:32.160]  So, you know, having enough Irish courage in me at the end of that evening, I said, oh, I'm going to put an end to this.
[36:32.300 --> 36:35.740]  So I just go tromping over in the middle of the discussion and say, we invited you into our house.
[36:35.820 --> 36:38.760]  We opened up the kimono and showed you everything that we were doing.
[36:38.820 --> 36:41.300]  And now you're, you know, you're whispering and you're making us all nervous.
[36:41.480 --> 36:43.440]  You have to tell me what you were just talking about.
[36:43.880 --> 36:46.680]  And they all kind of stepped back and they looked at D.C.
[36:46.700 --> 36:46.820]  Clark.
[36:46.960 --> 36:49.840]  And until that point, I don't think we had realized that he was kind of the head honcho.
[36:51.220 --> 36:54.520]  And he said, all right, I'll tell you what we're thinking about.
[36:54.520 --> 37:03.120]  The CIA and other folks have been giving us briefings saying that what you've shown us and what you've accomplished is only doable by funding from a foreign nation state.
[37:05.680 --> 37:08.340]  And you've changed our threat model.
[37:08.500 --> 37:09.540]  And this is great.
[37:09.700 --> 37:13.260]  I mean, it's scary, but you've really changed what we have to think about.
[37:13.540 --> 37:14.760]  And so this was wonderful things.
[37:14.840 --> 37:22.680]  Of course, he followed up with the, so I have to ask if any foreign nation states approached you and offered to pay for your services.
[37:22.680 --> 37:25.320]  And I said, no, but if you'd like to be the first, we're willing to entertain it.
[37:27.480 --> 37:31.800]  We had that nice Russian radio copy that showed up right next door.
[37:31.960 --> 37:33.360]  Yeah, the Russian mafia right above us.
[37:33.500 --> 37:38.700]  Right next door to the L0pht, there was a Russian radio station next door that had a satellite uplink.
[37:38.900 --> 37:41.200]  And we were always kind of like, what the hell are they doing in there?
[37:41.200 --> 37:41.500]  Yes.
[37:43.960 --> 37:45.360]  Never saw anyone ever go in or out.
[37:45.520 --> 37:45.840]  No, no.
[37:47.020 --> 37:57.780]  So I was curious whether you think that the model that you tried to do with AtStake, could it work now that we're, you know, not in that kind of recession era, really in the technology market of depression almost?
[37:57.960 --> 38:00.240]  If you start a company, try not to tie revenue to headcount.
[38:00.720 --> 38:01.340]  Try not what?
[38:01.640 --> 38:03.060]  Try not to tie revenue to headcount.
[38:03.480 --> 38:03.700]  Yes.
[38:03.700 --> 38:04.120]  Okay.
[38:04.760 --> 38:05.260]  All right.
[38:05.640 --> 38:07.060]  I don't think so.
[38:07.180 --> 38:17.760]  I think the thing that was accomplished, well, the thing that I take most pride of for AtStake, which, you know, and there's a lot of it I'm not fond of, not happy memories, was that we did influence the consulting field at the time.
[38:17.800 --> 38:22.960]  And we did kind of introduce the kind of McKinsey-Bain high-end technical research.
[38:22.960 --> 38:34.660]  And I think that other companies like Frank Height's organization, Leviathan, with Matt Miller, you know, escape from the Metasploit project and everything, are able to do now because of that foray that we went into.
[38:34.860 --> 38:35.620]  Can you do it again?
[38:35.720 --> 38:40.260]  No, because the industry has already changed that opening and that influence that we had.
[38:40.460 --> 38:42.100]  There's other areas to be influenced now.
[38:43.140 --> 38:46.640]  So, some of you have taken the further selling out step of getting married.
[38:50.430 --> 38:52.390]  How has that affected your hacking life?
[38:52.430 --> 38:52.810]  Not at all.
[38:54.070 --> 38:55.090]  What was the line?
[38:55.170 --> 38:56.310]  No longer client number eight?
[39:00.870 --> 39:01.570]  Sorry, honey.
[39:05.290 --> 39:07.050]  That could be a chilly evening for me.
[39:07.290 --> 39:08.990]  That's why we have this conference right now.
[39:09.090 --> 39:10.230]  I'm married to the director of it.
[39:10.790 --> 39:11.710]  Yeah, I think it's interesting.
[39:11.890 --> 39:12.890]  I mean, I'm now...
[39:12.890 --> 39:15.330]  When I first started doing the L0pht stuff, I was single at the time.
[39:15.370 --> 39:16.410]  Now I'm married and I have two kids.
[39:16.730 --> 39:19.490]  So, you know, I just change focus now.
[39:19.650 --> 39:20.790]  And now I'm looking at my two sons.
[39:21.050 --> 39:22.490]  And it's a lot of...
[39:22.490 --> 39:24.570]  We play a lot of games and exercises and whatnot.
[39:24.570 --> 39:28.410]  Just trying to inspire creative thinking and just creative problem solving.
[39:28.950 --> 39:33.350]  Just to get them to think different and just come up with different approaches and whatnot solving problems.
[39:33.530 --> 39:35.690]  It's not always a linear path to get from point A to B.
[39:36.130 --> 39:37.610]  And just trying to encourage that at a young age.
[39:37.670 --> 39:38.390]  I think that's...
[39:38.390 --> 39:39.570]  In my mind, I think that's the future.
[39:39.750 --> 39:41.170]  Your kids are really lucky to have you as a father.
[39:41.790 --> 39:42.230]  I'm serious.
[39:42.710 --> 39:44.970]  And being a dad has been good for your hacking, it sounds like.
[39:44.970 --> 39:51.050]  Yeah, and actually, yeah, my youngest son is actually a perfectly good fuzzer who's actually found some problems just by matching with the keyboard.
[39:51.890 --> 39:52.930]  So, it's interesting.
[39:53.150 --> 39:54.230]  We found some interesting back problems.
[39:54.670 --> 39:56.370]  Well, has this been your experience?
[39:56.730 --> 40:00.630]  Well, I think I was the only guy who was married when I joined the L0pht.
[40:01.170 --> 40:01.710]  Oh, that's right.
[40:02.410 --> 40:05.330]  The oldest of the group.
[40:05.750 --> 40:07.210]  Well, it wasn't Count Zero.
[40:07.770 --> 40:10.670]  Brian Oblivion got married while he was at the L0pht.
[40:11.170 --> 40:13.350]  Wasn't Brian Oblivion's wife who kicked you guys out?
[40:15.330 --> 40:23.570]  Well, actually, the way that we started with our space was actually Brian Oblivion's wife who kicked him out of...
[40:23.570 --> 40:24.190]  She didn't...
[40:24.190 --> 40:24.890]  As soon as...
[40:24.890 --> 40:27.370]  He would do a lot of technology reclamation.
[40:27.870 --> 40:34.330]  So, he would keep bringing, you know, monitors and PCs and network cabling into the house constantly.
[40:34.570 --> 40:37.470]  And then when he started to stack it up in the bathtub...
[40:37.470 --> 40:39.970]  See, that was the limit.
[40:39.970 --> 40:41.750]  She said, you really have to get this stuff out of here.
[40:41.750 --> 40:43.630]  He ran his BBS out of the kitchen cabinet.
[40:43.930 --> 40:44.070]  Yeah.
[40:44.870 --> 40:52.050]  So, that's actually how we started was Brian Oblivion's wife had a small loft space in the south end of Boston where she made hats.
[40:52.710 --> 40:53.510]  She was a hat maker.
[40:54.470 --> 40:57.850]  And, you know, the hat business wasn't doing so well.
[40:57.910 --> 40:58.650]  She said, you know what?
[40:58.650 --> 41:00.530]  I can rent half my space to these guys.
[41:00.930 --> 41:01.270]  They can...
[41:01.270 --> 41:05.570]  You know, I can get my husband to take all his stuff out of the house.
[41:05.570 --> 41:08.350]  And that's really how it started.
[41:10.790 --> 41:13.550]  I just got married this last August.
[41:14.010 --> 41:14.810]  First time.
[41:14.990 --> 41:15.450]  Only time.
[41:16.610 --> 41:18.330]  I never intended to get married.
[41:18.590 --> 41:25.510]  And I met a brilliant and beautiful mathematician who now actually will do my math for me.
[41:26.630 --> 41:28.150]  So, it's been great.
[41:28.150 --> 41:30.950]  Now I can actually, you know, say, honey, you know, this is what I'm doing.
[41:31.170 --> 41:34.610]  You know, is there a neat mathy way that you can represent this as an algorithm?
[41:34.770 --> 41:37.530]  And so, you know, the work just looks that much more professional.
[41:38.130 --> 41:39.450]  And actually, you didn't get to finish.
[41:39.590 --> 41:40.130]  Oh, sorry.
[41:40.130 --> 41:43.150]  Did it help your hacking life to have a spouse?
[41:45.350 --> 41:47.430]  I'm not sure if it never really helps.
[41:51.670 --> 41:58.590]  So, but I think she was, you know, she was definitely motivated me to make the at-stake transition.
[41:58.750 --> 42:00.450]  She's like, you know, you love doing this.
[42:00.510 --> 42:02.490]  Why don't you do this as your full-time job?
[42:02.730 --> 42:04.450]  You know, and make a run at it.
[42:04.630 --> 42:04.910]  So...
[42:04.910 --> 42:07.110]  I remember picking you up when we were going over to Battery.
[42:07.370 --> 42:08.530]  You're like, do I wear a suit?
[42:08.670 --> 42:12.930]  And both your wife and I were like, when we're asking somebody for $10 million, you put a fucking suit on.
[42:16.370 --> 42:18.090]  Yeah, she was like, I like this guy.
[42:20.770 --> 42:28.390]  So, the other thing that we sort of talked about talking about was the idea of, you know, security vendors and are they selling snake oil?
[42:29.910 --> 42:31.390]  And, you know, what do you think?
[42:31.530 --> 42:39.170]  I mean, is the AV market really, you know, not very effective in intrusion detection, all the other kind of areas and sectors within security?
[42:40.350 --> 42:43.130]  You know, there's an awful lot of hype and a lot of confusion.
[42:43.430 --> 42:45.170]  As someone that works for a security vendor...
[42:46.410 --> 42:47.110]  Started one.
[42:47.310 --> 42:47.870]  Started one.
[42:48.470 --> 42:49.310]  Selling out again.
[42:49.490 --> 42:49.990]  Selling out again.
[42:51.630 --> 42:52.570]  This time with feeling.
[42:56.370 --> 42:56.770]  Yeah.
[42:57.750 --> 43:00.490]  You know, I think it all has so many promises you make.
[43:01.170 --> 43:08.250]  You know, if you are honest about what you're delivering, if your, you know, product is transparent such that, you know, you...
[43:08.250 --> 43:17.890]  You know, people pay an honest amount for a good day's work, regardless of how you generate that, you know, be it by manpower or through automation or through clever algorithms or whatever your process is.
[43:18.390 --> 43:31.650]  You know, if the perception by your, you know, by a team of intelligent people who writes code, your customers or whatever, if, you know, if they're driving benefit, then you have a business.
[43:31.650 --> 43:37.750]  And, you know, I think the snake oil products were making a lot of promises in the past.
[43:37.990 --> 43:40.650]  You know, we've had a lot of things that...
[43:42.730 --> 43:47.390]  The story that gets me is the anti-spyware products that install the spyware on your systems.
[43:47.610 --> 43:53.930]  You know, there's a certain level of unauthenticness that I think we are getting better at identifying now as a group.
[43:55.110 --> 44:03.310]  And, you know, the, the real needs for the real, for the tools that are out there, you know, are the, you know, are starting to bubble to the, to the surface.
[44:03.490 --> 44:04.230]  That's the good stuff.
[44:04.350 --> 44:09.210]  You know, the bad stuff, throw it out with the back, you know, just flush it down the drain.
[44:09.350 --> 44:13.330]  You know, we get a lot of... products don't last if they, if they build up a bad reputation.
[44:13.710 --> 44:14.490]  That's just the way it is.
[44:15.530 --> 44:16.170]  That's a good point.
[44:16.390 --> 44:20.950]  I mean, I think just you commented on AV and working for Symantec, so I should respond to that.
[44:21.990 --> 44:23.690]  You know, it's, it's unfortunate right now.
[44:23.790 --> 44:27.510]  I mean, there's tens of thousands, if not hundreds of thousands or millions of viruses out there and whatnot.
[44:27.790 --> 44:30.470]  And so someone always said, well, you know, it's not going to detect everything.
[44:30.570 --> 44:31.370]  And you're absolutely right.
[44:31.370 --> 44:34.170]  There's always going to be these new viruses that don't have signatures written and whatnot.
[44:34.550 --> 44:38.190]  But the thing is, you'll catch 99.99% of the other ones out there.
[44:38.290 --> 44:41.970]  And so, I mean, I've been at client sites and whatnot, and we found a, a compromised system.
[44:41.970 --> 44:44.950]  It's like, well, we've actually found like one of the root Trojans or the binaries and whatnot.
[44:45.170 --> 44:53.510]  We were able to kick it back to the internal research lab where they completely reverse engineered it, reverse engineered it, dissected it, came out with a new signature that we immediately flushed out.
[44:53.690 --> 44:59.210]  And so out of like 25,000 systems, we knew exactly how many systems were infected with it, and we could just target those and clean them up.
[44:59.390 --> 45:03.130]  So, I mean, yeah, I think that there is some value in antivirus software to that degree.
[45:03.350 --> 45:08.830]  I mean, will it prevent everything, or prevent attacks against every thing out there?
[45:08.890 --> 45:09.590]  No, absolutely not.
[45:09.610 --> 45:11.170]  But it does a good job at what it does.
[45:11.970 --> 45:23.530]  So, I think you just need to invest time and have those operational procedures and whatnot to be able to properly respond to those pointed attacks where there is no signature or it's a new style attack that nobody has seen before.
[45:24.370 --> 45:24.850]  Go ahead.
[45:24.950 --> 45:27.810]  I think the problem is the marketing, not the technical side.
[45:27.810 --> 45:33.730]  I think when you talk to the technical people at companies that have these products, they're pretty honest about what their capabilities are.
[45:33.730 --> 45:40.530]  But what the communication to the consumer is, I think McAfee's is called total protection.
[45:41.510 --> 45:44.990]  You know, it's like, no, there is no total protection.
[45:45.250 --> 45:50.190]  You know, you have to be honest with your customer that there is always going to be some risk.
[45:50.930 --> 46:01.510]  And you have to be honest about... and I think the whole industry has to start to say, you know, what percentage of, you know, attacks can they protect against?
[46:01.510 --> 46:05.090]  And exactly, you know, in the grand scheme of things, what they're delivering.
[46:05.270 --> 46:10.310]  Because unless you know what it's missing, how, as a customer, can you try to mitigate what it's missing?
[46:10.710 --> 46:14.670]  And so, it's really, you know, all technology has limitations.
[46:15.370 --> 46:17.710]  And, you know, I think the marketing just has to be a little more honest.
[46:18.050 --> 46:18.930]  I've got an issue.
[46:19.230 --> 46:20.690]  I want to chime in here on a second.
[46:22.270 --> 46:23.930]  Yeah, I agree with what's being said there.
[46:24.010 --> 46:30.450]  But one of the things that nobody seems to be pointing out is, what sort of vulnerabilities are these solutions introducing to the systems themselves?
[46:30.810 --> 46:40.330]  I don't know, I can't tell you how many systems that I've broken into that I've used the port and the application, that is the antivirus, listening for its updates in order to compromise the system.
[46:40.650 --> 46:42.790]  So, yes, they're protecting against certain things.
[46:42.910 --> 46:48.390]  But these people protecting against other vulnerabilities in code, oftentimes aren't looking at the security of their own code themselves.
[46:48.790 --> 46:49.370]  And this is...
[46:50.050 --> 46:56.130]  Yeah, I actually went to a talk by Sinan from Immunity earlier.
[46:56.350 --> 47:02.670]  And he went through about how Immunity penetrated a very, very secure organization.
[47:02.850 --> 47:06.730]  They did a long-term analysis of how are they going to try to get in before they got in.
[47:06.970 --> 47:12.470]  And they determined that the weakest point in the whole organization was the antivirus mail gateway.
[47:13.190 --> 47:15.170]  That was the weak point.
[47:15.170 --> 47:17.290]  That was the point that you used to get in.
[47:17.450 --> 47:19.770]  They decided that that was what they were going to attack.
[47:20.310 --> 47:21.390]  And they attacked it.
[47:21.530 --> 47:22.110]  And guess what?
[47:22.450 --> 47:23.210]  They got in.
[47:23.330 --> 47:25.030]  And it's not just the antivirus stuff.
[47:25.530 --> 47:35.690]  Unfortunately, there was a trend for a while of doing these roll-ups, of all these kind of disparate security solutions, and then trying to loosely bundle them together with some really bad glue logic and duct tape.
[47:36.250 --> 47:45.110]  And now you have all these extra moving parts and extra inflection points that, as a complex system, complexity in the security field, that's an anathema concept.
[47:45.350 --> 47:47.170]  You don't even have to worry about the complex systems.
[47:47.290 --> 47:55.210]  I mean, there's a recent case in point where there's a bunch of USB drives that were recently shipped that used the RFID chip and security and encryption.
[47:55.430 --> 47:57.070]  And this was, you know, plastered all over the packaging.
[47:57.330 --> 48:00.330]  Secure, encryption, you know, transfer data with us.
[48:01.330 --> 48:04.390]  Come to find out, the encryption was really only used for the RFID chip.
[48:04.470 --> 48:06.350]  The data itself was the simple XOR.
[48:06.750 --> 48:09.770]  And those sorts of things are on the market right now.
[48:10.150 --> 48:15.270]  The end user consumer has really no way of knowing, has no way to believe that packaging.
[48:15.410 --> 48:17.810]  And there's no rules or regulations to control it.
[48:17.810 --> 48:26.990]  And actually, I wanted to actually use our two IT people on the panel, our two sort of people working in companies who are being sold snake oil all the time.
[48:27.270 --> 48:45.410]  You know, Tan and SR, can you talk a bit about whether there is more realism in what companies are presenting to you, at least in corporate environments, and, you know, also what it's like to look at this whole sort of security industry from that perspective of the people who are,
[48:45.690 --> 48:46.710]  in fact, trying to stay secure?
[48:47.770 --> 48:48.270]  Sure.
[48:48.670 --> 48:58.970]  I think, like today, what I'm seeing, at least from financial industry in terms of snake oil, is one of the things that is being forced on the banks regulation-wise is multi-factor authentication.
[48:59.610 --> 49:04.470]  The idea there is something you have and something you know, like a secure ID type solution, right?
[49:04.630 --> 49:19.910]  And what they've been doing is these companies have been coming up with software-only multi-factor authentication, which basically means there's a JavaScript that goes and looks at, you know, profiles your computer, and that's the thing you have, is this profile that's,
[49:19.930 --> 49:21.890]  you know, just generated through JavaScript.
[49:22.110 --> 49:27.470]  The same stuff you can call when you're exploiting them via cross-site scripting or whatever.
[49:27.750 --> 49:30.430]  So, to me, it seemed really weird.
[49:30.530 --> 49:47.790]  And the reason is because there's a whole industry around this, you know, like a check box or whatever, they're going to look for snake oil, something that's cheap, something that won't break their operations because it's not really doing anything.
[49:48.050 --> 49:50.450]  And the auditors require that little check box still?
[49:50.710 --> 49:51.110]  Oh, yeah.
[49:51.350 --> 49:54.410]  And for some reason, they have accepted it to date.
[49:54.730 --> 49:59.350]  So, that to me is where the snake oil is today, I think, that I've seen.
[49:59.350 --> 50:06.210]  How do you explain that to sort of, you know, your management, people who aren't technical, who are just saying, well, we've got to, this is a problem, we've got to solve it.
[50:06.310 --> 50:08.090]  Don't implement your own crypto, period.
[50:10.290 --> 50:12.610]  Well, I mean, we've demonstrated its weaknesses.
[50:12.910 --> 50:16.730]  And it's like the group that I work for, our job is to identify the risks.
[50:16.850 --> 50:20.950]  So, it's up to the managers to make the decisions on how to manage that.
[50:21.130 --> 50:24.410]  But quite often, it's just, you know, the bottom line.
[50:24.710 --> 50:28.670]  It's too expensive, they all feel, to go toward a real multi-factor authentication.
[50:29.550 --> 50:31.130]  Which is kind of surprising to me.
[50:31.890 --> 50:34.470]  Even in your world, that's a world reputation for spending.
[50:34.650 --> 50:38.950]  I mean, Amex in 2000 had the blue card with the smart chip right on it.
[50:39.050 --> 50:47.490]  So, I mean, the form factor is there to slip it into your existing ATM card and use the ATM card maybe from home through some smart card reader or something.
[50:47.690 --> 50:50.370]  But instead, they're going to settle for JavaScript.
[50:51.190 --> 50:59.110]  Wouldn't it be nice if they had to do differential power analysis to get the secrets off rather than just, you know, popping some cross-site scripting on some sort of message board?
[50:59.410 --> 51:00.210]  That would be nice.
[51:00.530 --> 51:02.050]  And that's how you're in a smaller company.
[51:02.190 --> 51:03.250]  Yeah, I'm in a smaller company.
[51:03.410 --> 51:05.110]  And I get people trying to sell me stuff all the time.
[51:05.250 --> 51:13.050]  But the one thing I notice now that's probably different from ten years ago is that when you read the product literature, you always see the word security.
[51:13.050 --> 51:15.830]  There's usually a paragraph on the back page that says, oh, secure.
[51:15.990 --> 51:19.670]  We use this encryption and this many bits and we do this and that.
[51:20.330 --> 51:21.910]  And it's all buzzword stuff.
[51:22.110 --> 51:28.510]  And as a consumer, as an end user, as a purchaser of this equipment stuff, I have no idea what the hell is in it.
[51:28.730 --> 51:30.810]  I mean, yeah, so they're using 256-bit AES.
[51:30.810 --> 51:31.570]  What the hell does that mean?
[51:32.410 --> 51:34.450]  What part of the product are they using that in?
[51:34.510 --> 51:35.730]  How are they implementing it?
[51:35.890 --> 51:37.450]  Is it really as secure as they're claiming?
[51:37.650 --> 51:40.550]  I have nowhere to go to verify their claims.
[51:40.550 --> 51:44.270]  There's no rules that they have to say what their stuff is or what it does.
[51:45.690 --> 52:01.170]  So while I think it's more, people are more aware of security now, especially in the marketing departments, I don't think the education level of the people purchasing this stuff is high enough to know exactly what it is they're buying.
[52:01.270 --> 52:05.050]  Well, you're saying that the vendors are basically putting the new and improved label on it.
[52:05.050 --> 52:05.130]  Right, exactly.
[52:05.130 --> 52:06.430]  And you don't know if it's new or improved.
[52:06.570 --> 52:08.150]  So we're almost out of time here.
[52:08.150 --> 52:12.110]  I wanted to ask a question and then open it up a little bit to the audience.
[52:12.570 --> 52:15.750]  So the last question is, what makes you scared as hell?
[52:17.390 --> 52:18.110]  I'll start.
[52:18.830 --> 52:36.810]  What scares me is sort of the proliferation of devices that we're now plugging into our general purpose PCs, like picture frames and iPods and USB drives that are being made in countries like China for basically, you know, the cheaper and faster we can make it,
[52:37.250 --> 52:39.830]  the more I'm going to be able to sell.
[52:39.830 --> 52:42.910]  That doesn't really make a high security device.
[52:43.150 --> 52:47.550]  And we've been seeing that these devices, we came up with this term last night, are coming certified pre-owned.
[52:49.990 --> 53:09.190]  So they're coming with back doors on them, whether it's by mistake because some employee, you know, brought their laptop into work and sort of infected the manufacturing network, or whether there's actually malicious actors that are using this as a way of owning up a lot of machines and sort of seeding their bot network.
[53:09.510 --> 53:12.050]  It doesn't actually even matter, right?
[53:12.270 --> 53:14.930]  There needs to be a way to detect this situation.
[53:16.010 --> 53:17.090]  That's pretty scary.
[53:17.490 --> 53:18.050]  Tan?
[53:19.850 --> 53:22.190]  Oh, not much keeps me up at night.
[53:23.470 --> 53:24.490]  He's fearless.
[53:24.490 --> 53:25.950]  Pretty heavily just pass out.
[53:27.530 --> 53:28.010]  Much.
[53:29.350 --> 53:41.510]  Current administration and having to get onto a panel with the other L0pht guys after 10 years, given all the pain that we went through and put each other through during certain parts of AtStake.
[53:41.750 --> 53:42.490]  Yeah, don't remind us.
[53:43.710 --> 53:45.290]  SR, what scares the hell out of you?
[53:45.290 --> 53:46.310]  James Atkinson.
[53:49.500 --> 53:51.160]  I don't want to be anywhere near that guy.
[53:52.920 --> 53:53.400]  Paul?
[53:53.880 --> 53:58.700]  I think some of the trends with virtualization is kind of scary.
[53:58.960 --> 54:05.740]  Before you'd have 200 physical systems and they'd be all running on separate segmented networks and whatnot.
[54:05.960 --> 54:10.680]  But you're seeing now clients actually want to take those 200 systems and they want to condense them down onto one or two systems.
[54:10.860 --> 54:18.880]  And so now you have these massive systems with multiple terabytes of data, terabytes of memory, terabytes of drive space and whatnot.
[54:18.880 --> 54:24.020]  And it has like maybe 16 network interfaces, but those are virtually mapped across 200 different systems.
[54:24.180 --> 54:25.920]  So just from a security standpoint, it gets very, very interesting.
[54:26.880 --> 54:30.440]  I think there's a lot of research that's being performed right now, and I think that's going to be the future.
[54:30.480 --> 54:38.020]  As companies are trying to cut back costs and whatnot and move towards these virtual systems, I think it's going to be a new paradigm for security and whatnot.
[54:38.160 --> 54:41.740]  A lot of new areas of interesting research and potential attacks.
[54:42.360 --> 54:42.720]  Christian?
[54:44.280 --> 54:47.820]  Embedded systems, things that are getting hooked up to the Internet.
[54:49.160 --> 55:00.060]  You know, I shuddered when I realized that, you know, after seeing like eight vulnerabilities in LibTIF over the last two months, that class three fax is LibTIF, okay?
[55:00.680 --> 55:02.380]  You know, you send a fax, it's sending it as TIFF.
[55:02.720 --> 55:07.520]  And you know that those low-level drivers are going to be shared all over the place and based on some old TIFF reading code.
[55:07.520 --> 55:13.260]  You've got multi-function devices that are bridging the fax network, the phone lines with your internal LAN.
[55:13.560 --> 55:16.540]  You know, you've got your printer, fax, scanner, multi-function device.
[55:16.700 --> 55:21.840]  Those things are, you know, opening up all kinds of, you know, complexity.
[55:21.840 --> 55:26.400]  You know, I noticed that my DVD player has its own CPU on it.
[55:27.020 --> 55:35.100]  And that CPU has its, you know, firmware that can be downloaded to it by the BIOS or by any other, you know, thing that happens to get in early enough.
[55:36.420 --> 55:38.660]  You know, Ethernet cards are updatable.
[55:39.120 --> 55:45.500]  You know, just the thought of somebody going through and Trojan-ing a whole bunch of Ethernet cards and selling them at the flea market is a little scary.
[55:46.520 --> 55:52.500]  You know, so I mean, there's a whole lot of stuff out there that's now, you know, not burned into ROM but is upgradable.
[55:52.760 --> 56:02.220]  And software that's running in weird little places on CPUs that, you know, didn't use to, you know, have its own, you know, memory CPU and bus on itself.
[56:02.220 --> 56:04.780]  So that stuff is really interesting.
[56:05.820 --> 56:06.500]  Thanks, guys.
[56:06.760 --> 56:09.100]  Do we have time to have a couple questions from the audience?
[56:09.220 --> 56:09.720]  Is that okay?
[56:13.270 --> 56:15.310]  Check, check, check, check, check.
[56:16.590 --> 56:20.570]  This is mostly for Tan, though I think Weld will probably want to weigh in, too.
[56:21.110 --> 56:26.410]  Where is the underwriters laboratory for software and will we see one in our lifetimes?
[56:28.870 --> 56:41.070]  Well, I could answer, but Tan actually wrote the paper in 98 and really came up with the original concept because he was looking at the way that other security products, pre-software, were certified.
[56:41.070 --> 56:53.910]  And with things like safes and other security devices, you had an independent certification of its capability and a rating or they couldn't sell it.
[56:54.390 --> 56:54.690]  Right?
[56:54.930 --> 57:02.750]  But today, we buy software devices, security products, and we have absolutely no idea whether this stuff really works or not.
[57:03.370 --> 57:12.170]  And it wasn't that there was a rating of it's safe, it was like the original underwriters lab saying it only takes X amount of time before the integrity...
[57:12.170 --> 57:13.170]  Go for it, Tan.
[57:13.210 --> 57:18.910]  I just think that it hasn't come about because there hasn't really been a credible entity that's jumped on it.
[57:19.170 --> 57:30.350]  Like maybe someone like the post office or someone that's kind of removed from things could be anyone that could be a notary public or something like that could have, you know, run this as a program from a brand name perspective.
[57:31.070 --> 57:33.690]  So I don't know if Veracode is looking at doing that.
[57:33.690 --> 57:37.270]  At Veracode, we do have ratings that we can rate software.
[57:37.490 --> 57:46.470]  It's not sort of our main business is doing ratings, but we can produce one if someone sends us software from a vulnerability perspective, not from a does it functionally work.
[57:46.710 --> 57:50.830]  There is one organization which does have that brand, which is getting into this, which is Moody's.
[57:50.950 --> 58:00.330]  And Moody's is coming out with operational risk ratings and they will, you know, they have a process of certifying your organization at the organization level.
[58:00.910 --> 58:02.890]  So I think it will slowly happen.
[58:03.130 --> 58:04.850]  You know, it almost happens in every industry.
[58:05.030 --> 58:06.010]  It's a normal maturation.
[58:06.310 --> 58:13.270]  There's also Alberto Savoia, who I think is a co-founder of Agitar, has a side project he calls CRAP.
[58:13.370 --> 58:19.930]  And I forget what the acronym is, but you can upload your code and they'll tell you it's crappiness level.
[58:21.790 --> 58:24.830]  That's basically Veracode service, but we call it security review.
[58:26.970 --> 58:27.750]  Super CRAP.
[58:28.010 --> 58:28.970]  Super CRAP.
[58:29.170 --> 58:30.270]  It's like CRAP, but better.
[58:31.070 --> 58:31.730]  Only better.
[58:32.210 --> 58:33.150]  Okay, any other questions?
[58:33.450 --> 58:34.490]  I saw some hands out there.
[58:36.590 --> 58:37.790]  Oh, it's down here in the front.
[58:38.190 --> 58:39.490]  Has the L0pht ever been owned?
[58:40.770 --> 58:41.730]  That's a good story.
[58:42.970 --> 58:44.050]  Did you guys hear the question?
[58:45.370 --> 58:47.010]  Has the L0pht ever been owned?
[58:47.390 --> 58:48.250]  Well, they're...
[58:48.250 --> 58:48.830]  Mine owned.
[58:49.190 --> 58:49.330]  Yeah.
[58:50.790 --> 58:51.150]  They're...
[58:51.150 --> 58:55.990]  First off, anybody who ever tells you that their systems have never been compromised, doesn't know what the hell they're talking about.
[58:56.410 --> 59:01.590]  The best you can really do is say, not to the best of our knowledge was it ever owned.
[59:01.730 --> 59:19.190]  And one of the things that we used to do is certain people who would terrify me when I was rebuilding the kernel and kind of running some of the main systems is I'd actually go and offer root access to certain people who I thought would probably target us and would have a high likelihood of successfully getting in and then once telling them that I was going to give them the root password,
[59:19.350 --> 59:21.690]  that if anything bad happened to the system, I would come after them.
[59:22.330 --> 59:25.810]  This is kind of like Microsoft offering the source code and trying to put you under an NDA.
[59:25.810 --> 59:27.990]  So we learned from certain things.
[59:28.290 --> 59:28.810]  We did...
[59:29.410 --> 59:31.630]  We did on one April Fool's own...
[59:31.630 --> 59:33.690]  April 1st, we owned ourselves.
[59:33.990 --> 59:34.030]  Yeah.
[59:34.990 --> 59:39.230]  And to paste our own web page and got a lot of people calling up and laughing.
[59:39.410 --> 59:42.950]  And we did run a bulletin board system as well.
[59:43.210 --> 59:46.510]  And that one was outside of our internal network.
[59:46.810 --> 59:51.510]  Did not have any trust relationships between things.
[59:51.730 --> 59:54.980]  And I'm sure people popped each other's accounts on that, but not the actual L0pht core to the best of my knowledge.
[59:58.640 --> 59:58.900]  Yeah.
[59:59.160 --> 01:00:01.240]  There were a couple of incidences where there was a little...
[01:00:01.240 --> 01:00:07.040]  Not completely owned, like root access, but there was an incident where one of our shell users...
[01:00:07.040 --> 01:00:07.580]  Deth Veggie.
[01:00:07.720 --> 01:00:08.340]  Deth Veggie.
[01:00:08.580 --> 01:00:09.780]  The Deth Vegetable.
[01:00:11.040 --> 01:00:16.880]  We required SSH remotely to get into, but he had an account on an internal box.
[01:00:17.040 --> 01:00:18.880]  And he SSHed into the internal box.
[01:00:19.220 --> 01:00:23.420]  And then he telneted from the internal box to l0pht.com to read his mail.
[01:00:23.420 --> 01:00:26.460]  And someone sniffed his password.
[01:00:28.180 --> 01:00:32.440]  Then there was an incident where there was a widespread SSH attack going on.
[01:00:32.740 --> 01:00:36.620]  But we were running l0pht.com on an Alpha box.
[01:00:36.880 --> 01:00:38.720]  And no one had written shell code for Alpha.
[01:00:39.520 --> 01:00:41.760]  So we got hit with that and it just crashed.
[01:00:41.900 --> 01:00:43.360]  An Alpha box running OpenBSD.
[01:00:43.360 --> 01:00:49.760]  So, you know, using weird architectures on your Internet-facing machines is definitely beneficial.
[01:00:49.980 --> 01:00:56.060]  And the fact that we actually had a $30,000 or $50,000, because they were tough to come by, sunscreen.
[01:00:56.300 --> 01:00:57.940]  That was kind of a prototype one.
[01:00:58.100 --> 01:01:01.420]  Non-addressable interfaces when Sun Microsystems was still putting it together.
[01:01:01.560 --> 01:01:05.760]  And it was a really cool, really well-done system that nobody had really seen.
[01:01:05.760 --> 01:01:08.140]  This was prior to like the whole firewall ones and everything else.
[01:01:08.260 --> 01:01:12.160]  It's a firewall that runs completely off of a CD.
[01:01:12.520 --> 01:01:17.160]  So you have to burn a new copy of the CD every time that you want to change the configuration.
[01:01:17.440 --> 01:01:20.760]  But it basically kind of makes it very difficult to...
[01:01:21.280 --> 01:01:23.120]  And it didn't have any addressable interfaces.
[01:01:23.400 --> 01:01:25.120]  Yeah, so there was no IP address.
[01:01:25.300 --> 01:01:28.240]  It was all Ethernet and it did its own stack translation and all that stuff.
[01:01:28.360 --> 01:01:28.860]  It was a bridge.
[01:01:29.300 --> 01:01:30.260]  A bridge, yeah.
[01:01:30.700 --> 01:01:31.400]  But good question.
[01:01:31.400 --> 01:01:33.260]  Okay, any other good questions?
[01:01:37.220 --> 01:01:38.760]  Anybody want to talk about Mudge and the address?
[01:01:39.600 --> 01:01:43.260]  Yeah, do any of you have any contact info you'd like to give out for the Internet viewers?
[01:01:44.560 --> 01:01:49.940]  Well, we don't have the L0pht.com address anymore because it's owned by Symantec.
[01:01:50.440 --> 01:01:51.580]  They own a lot of domains.
[01:01:51.760 --> 01:01:55.780]  We have L0pht.com, which Space Rogue runs.
[01:01:56.460 --> 01:01:59.920]  It's one page, it's got a picture and some links and an email address.
[01:02:00.100 --> 01:02:03.520]  So if you need to get a hold of anybody, you can send it to whatever the email address is.
[01:02:03.520 --> 01:02:07.620]  It's an L0pht.com site and I'll route it to whoever you want it to go to.
[01:02:10.240 --> 01:02:13.560]  Okay, without any further questions, I want to thank you guys again for being here.
[01:02:14.600 --> 01:02:15.020]  Thank you.
[01:02:18.910 --> 01:02:26.030]  For further information on the Internet, visit www.mediaarchives.com.
[01:02:26.030 --> 01:02:27.410]  And a big thanks to Stacey for putting the whole thing on.
[01:02:28.010 --> 01:02:28.770]  Thanks, Stacey.
[01:02:29.250 --> 01:02:29.350]  Yeah.
[01:02:30.650 --> 01:02:35.070]  And also, don't forget, we do have DVDs, presentations, if anybody's interested.
[01:02:35.070 --> 01:02:36.650]  They're right outside the door.
[01:02:36.870 --> 01:02:39.230]  20 apiece or 10 for 100.
[01:02:43.430 --> 01:02:44.650]  Thank you, everybody.
[01:02:45.150 --> 01:02:46.470]  But it turns out.
[01:02:46.850 --> 01:02:51.370]  We're going to put the slides online, check the website in a couple of weeks.
[01:02:53.310 --> 01:02:54.470]  Sessions are outside.
[01:02:54.530 --> 01:02:58.490]  And thank you for being the founding attendees of Source Boston.
[01:02:58.490 --> 01:03:02.430]  So, thank you for joining us and today.
[01:03:02.430 --> 01:03:02.950]  Thank you, Mrs. Issa.
[01:03:07.590 --> 01:03:08.170]  We're done.
[01:03:08.590 --> 01:03:09.510]  We were doing that.