Full transcript
0:00Alrighty. Hey everyone. Look, thanks so much for tuning in. This is going to be something a little bit fun, a little bit funny because I got together with my good buddy Flangic. And this is one of the first times we've been able to hang out in person. We're here in Vegas, right? Defcon shenanigans. But what we thought we would do for a cool
0:15collaboration would just be watching some old hacking movies or oh, cyber security scenes, hacking in the media, and then talk about like, okay, for one thing, is that realistic? and how could it be done if it were to be really done? Maybe walk through a little bit. What's the scenario look like? Could we make that real one way or another?
0:36>> Okay, so the first scene up. Uh this is a classic and I I don't know how we are going to be able to make this real, but let's just let's just show the scene first and then we'll see what works out there. >> No way. I'm getting hacked. >> Porsches. >> No. No. This is major. They've already
0:53burned through the NCIS public firewall. We'll isolate the node and dump them on the other side of the router. >> I'm trying. It's moving too fast. >> Oh yeah. Get in there. Get in there. >> The double key. The double player. Love it. >> Database. Seate. >> I can't. It's a point attack. He or she is only going after my machine.
1:10>> It's not possible. There's DoD level 9 encryption. It would take months. >> The DoD level five decryption. Encryption. I think that's the worst encryption, man. What are you going to do about that? Getting hacked with the DoD level five encryption. You're screwed, John. I feel like there's a buzzword of like military grade encryption. Uh DoD obviously like oh
1:28reference the Department of Defense kind of thing, but [clears throat] it's genuinely a joke. I feel like you have to be making fun of the fact when someone says military grade encryption. Take it tongue and cheek. >> No, they're trying to make it more fancy, right? They're trying to say it in another way. And the whole what was
1:43there? He's blasting through the initial public facing firewall. That is probably the only legitimate term in here. >> Firewall. >> We'll isolate the node and dump them on the other side of the router. >> This is obviously jargon. This is ridiculous. Obviously, this was before Chatt, but this is the equivalent of chat GPT, please give me 20 random
1:58phrases related to cyber security and then trying to put it together to hack two people on one keyboard. Do you do you usually do that during forensics when you get >> Absolutely not. I we would not be able to fit both of our hands on your keyboard, >> right? I feel like the closest realism here is like king of the hill and you're
2:12for what you have two split keyboard. I don't know. This is ridiculous. So, >> yeah, this one would not work. >> There there is literally no way to make this legitimate. like you're you're not defending against the hack by two people jamming on the keyboard. Uh you're not actively defending against the hack like you are playing football. That's not
2:28from just how it works. I guess the closest one is she is watching alerts and logs pop up from the sim system. Uh as I am they are investigating and attempting to repair damage the attacker is doing. But that's never that fast for one thing. No, no, definitely. >> If you're looking through logs, for one
2:49thing, it's pretty much, oh, one thing, one row, one entry after the next, and it's not, yeah, just an in the- moment thing. >> Yeah, it's ridiculous. And then at the end here, the guy comes in, just pulls the plug for the computer, which is, you know, that's that's what you do when you get hacked. Just make sure all the
3:02evidence is gone, so you can't recover [ __ ] right? >> Make it all offline. >> Oh, imagine how many instant response cases have appeared where, oh, what did you do to the server hog? Oh, it took it offline. They pulled the plug like [ __ ] great. And don't just isolate it, right? This is up there in the
3:16ridiculousness. >> So, we are 0 for two on realism right now. >> We are. Okay. >> Actually, let's pull this. This is an interesting one. It's an old one. It's from the movie called Sneakers. Some people might be mad now me calling old 1992. I mean, I think it was before both you and me were born, right? You're How
3:31old are you again? >> Uh, that that beats me up. >> That beats me too. Yeah, we're young kids here for sure. >> I'll be honest. [laughter] >> So, let's watch the scene and see what's going on here. >> You know what? I really love the sound of your voice. Really? >> I always thought it was kind of nasal
3:49and pinched. >> Oh, no, not at all. It's lovely. And um there's this one word. I've always loved the sound of this word. >> Oh, no. No. What? Oh, no. You wouldn't. No, I would. I would. >> What? Please. What? >> All right. [laughter] I would really
4:11like to hear you say the word passport. >> Passport. >> Okay. So, while I haven't seen this movie, I have some insight onto what's going on. >> Yeah. What is the context here? So the context here is that there's this group of hackers, again I haven't seen the movie, just short context that are
4:32trying to break into this building or this system and there's voice authentication and they need this individual here to be able to use his voice to say a specific sentence. One of which the words are passport. >> Gotcha. >> And this is really interesting because she's just using a tape recorder. You're stitching it together, making him say
4:49it. But in today's modern era, this would be super real because you would give this to some sort of AI model and you would be able to generate any sentence, any wording you want based on that really. I think the the the services I've seen only need samples like 30 seconds, 15 seconds of voice and it doesn't have to be great. It doesn't
5:07have to be super clear. You can get it from everybody and you're able to obviously to various degrees of success generate full sentences that it sounds like that person is saying it, which they definitely didn't know was going to happen in 1992. >> Yeah. I mean, I think of even a couple different like banks or online services,
5:22not you know, physical real world services that you use that will ask you over the phone for like a passphrase, a verbal passphrase. What is it for your as like part of a security questionnaire, part of security onboarding? I know that process happens for oh banks or anything that you might authenticate to just over the phone. So
5:39saying simply or getting the voice sample of saying the word passport or whatever it might be could totally be used in that scenario. And just as you were mentioning, I think it's uh 11 Labs. 11 Labs is an online service that can do that voice cloning. And yeah, it takes a minimum of 10 seconds, which is kind of wild. Obviously, just the word
5:57passport will not take 10 seconds, but you have a conversation with someone, you're recording the entire thing. Hey, you and I are already we're screwed. >> I mean, our thousands of videos, thousands of content out there. >> Done. Done. Done for I have a couple of hours of streaming content out there and my voice is Why are you giving out
6:13ideas, John? >> I'm sorry. Look, >> you want to get ripped off here? How many loans in your name do you want? >> True enough. >> No, but what is funny, I think what is just interesting here is they are predating themselves so much. Like I they could have not known in any way that this would be related to being able
6:27to generate fullon voices from real people just based on 10-second samples back in '92. So, I thought it was interesting. I thought it was an interesting social engineering scene. I guess we should mention that that the whole point here is that the individual is trying to social engineer this guy into saying the phrase passport so they can record it and use it to access this
6:43building. We didn't mention that. I guess you have to be specific, right? >> But I'm glad we could latch on to that immediately cuz that is that is realistic%. This this is I would say one for one. There's nothing social engineering is definitely a form of hacking. There's nothing unrealistic going on here at all. This is one for
6:58one. >> Maybe this is a tangent. I'm sorry. We're falling down the rabbit hole. But there are some folks, you know, whining out on the internet. Social engineering isn't real hacking. And I'm like, what? Dude, are you kidding me? Like that is >> that is literally No, no. You are you're hacking humans. You are abusing the abundant trust other humans have in each
7:15other to make them leak information or do stuff that they are not supposed to do. In my job, we do this on every single engagement. We do perform targeted socialing attacks against humans, you know, gathering tons of uh information through Oent and using that to build trust and essentially get people to do what we want them to do in
7:32order to breach uh the company's premise. >> You hear that YouTube commenters, Twitter mobsters, >> social engineering is hacking. >> This is the beer talking. [laughter] >> No, no. Social engineering is definitely definitely hacking it. And that's the thing. Hacking doesn't have to be technical. >> True. >> No, true. It doesn't have to be technical. Picking would you say picking
7:50a lock in order to gain access to building is hacking? Nothing technical about that. >> True. >> Cyber security wise, of course, obviously you have to be rather technical to pick a lock. But wording aside, nothing technical to that. Okay, moving on. Let's do something silly again here. Let's do Transformers. This This is right up your alley. This is
8:07This one's for you, John, specifically. They're hacking the network again.
8:27>> Uh-oh. Oh my god, this is a direct match to the signal in guitar. Are you running a diagnostic? >> Should I be? >> Yes, you should. >> Yes, I am.
8:48>> Okay, so it's a longer scene here, but this is really the major part. So, I think it's really interesting that the hack starts by him loosening two hard drive trays and just like ripping them out, you know, like that's how he's accessing this data by disconnecting two hard drives. This scene is obviously science fiction, right? We're having an
9:04alien robot connecting to a terminal on board the Air Force One while flying trying to get access to data. And what is happening on the ground or what what is sort of the realistic approach is that they're I guess doing either forensics or incident response. Maybe incident response with the right burning here and they're looking at this data
9:20that looks like waveform like looks like audio but this >> Yeah. So here I I can believe a portion of this, right? Like if you were to be looking at what might be aw like a wave file, MP3 audio or whatever, you can use a lot of tools like sonic visualizer. I think Audacity might even still be able
9:37to do this, right? You can look at the spectrogram of the wave frequency amplitude stuff. And there is a very cutesy trick and a lot of like capture the flag challenges or exercises or activities to learn techniques in cyber security. So there's that steganography technique where you hide and mask data like in the visual readout of the
9:58amplitude waves and things like that. Granted that takes a lot more to process and handle and make sense of. So that I guess is realistic in a sense, but the really cool popup that I thought was hysterical where it saw the foreign signal detected. >> That's Hollywood. That's the me that's the media. That's the movie. I don't
10:16know anyone that has any detection engineering rules uh or or telemetry for audio signals, but maybe we should. Maybe we're behind and transformers is leading uh the next wave of security. >> This is definitely like very CTF. Like this is very common like I wouldn't say maybe entry level entry level beginner
10:37CTF wise doing the secondary where you do that embedded into audio wave. What's the realism here? guy is excfiltrating data through that method and that's what they are detecting. They're seeing audio files flying. That could actually be the correct way, right? >> Totally doable, >> right? Right. He's excfiltrating data from this terminal through audio files that is pulling online to some server
10:58and that's what they are seeing or through the through some sort of connection and that is what they are seeing and they're able to match that to a previous Xfiltration method used by the same attacker but by in a different hack. If that were real, which it again could be, that'd be pretty cool. I I would think that's neat. But that would
11:15mean aliens or whatever that this entity body, sorry, the Transformers movie would have something that would like parse and process and evaluate and understand and rip out the real data that came out from the audio signals themselves. That takes a little bit more tech. That takes a little bit more processing to it, but like if it happened, it'd be cool. I'm not going to
11:34lie. I mean from a technical perspective if I had a custom implant and that implant had functionality to exfiltrate data through this method of stego then I mean totally real I don't see why I would do it as an attacker I don't see what it gains me there's way less suspicious ways of embedding data into other data than a freaking audio wave
11:52right >> it would be a cutesy >> concept right but yeah so I guess that actually is I I I can't think of anything more appropriate realwise I think that just has to be it right an attacker X retaining data and choosing that method for stego or that stego method hiding it in audio wave from your system at the same time.
12:11>> Code red, we have a breach. Air Force One, someone on board. >> And this is interest response, right? We have somebody in the building. We need we need the CIA to go take that alien down now. Disconnecting from the terminal. And then we're seeing them isolate the system, I believe, in a second or few here. >> Whatever they want, they are getting it.
12:28Sir, >> can you imagine just like walking around the server room [laughter] looking out? >> Yeah. Where's the hacker who got onto Air Force One doing this, right? Connection terminated. So, I guess server isolated. The attacker can't access the data anymore. Interesting though. I'm actually surprised we managed to find such a realistic
12:49approach or such a real not use case, but like anything real in this because this is pure science fiction. Really? >> Yeah. But so let me please clarify obviously fiction but the components of this could probably work in all real like pieces bits and pieces. >> Yeah. Was that like a I know we had maybe a one on the board for when we did
13:11sneakers there. But this was this a.5? >> Yeah. I don't think I don't think we can give it a one. Half a point. Okay. Let's do the core. >> Ooh, >> this is interesting. And this is also one of those slightly in the realm, I would say. I would say >> okay, it's a f. Just a f.
13:34>> Rat, we got a big problem. A lot of people are going to die. [music] We need your help. >> What kind of help? >> Information control. >> We [music] need you to control the flow of information on the internet. >> You're dreaming. Nobody controls the net. Could you with unlimited resources?
13:55>> You want me to hack the planet? >> Goosebumps. Goosebumps. >> He said the thing. >> He said the thing. [music] >> You've got free long distance on that phone >> forever. >> Okay, let's not say anything. People watching, especially the younger generation here, you think this is real?
14:16Do you think this is remotely based on something real or is it complete sci-fi made up? >> Let us know in the comments. >> Let us know in the comments. Right. So, this is rather interesting. This is again a hacking technique that predates both you and me. We're talking ' 60s7s I believe. This isn't specifically isn't real, but this is based on something
14:35called phone freaking which was a way and he's he's sort of displaying like a crude way of doing it. He's picking up a phone and then he's uh I I don't I don't remember the exact frequency. I think it's 26,000 MHz. >> Uh I honestly don't know the number off the top of my head, but I think that's
14:50right. >> I think something like that. And you are basically able to communicate directly with the phone systems and able to give yourself free long distance for that call. Skip like paying for as again this predates us. I I don't want to go out and say I know too much about this, but this is based on a real hacking
15:06technique called phone freaking that uses audio waves just like he's trying to make with his mouth and the piece of gum here to control parts of the phone system. So, I might get some of the history wrong just because again this is this is a gray area for us. But there I think even in old school cereal boxes
15:22there was a whistle that came as like a toy in uh I think it was Captain Crunch. I think it was Captain Crunch >> like a blue whistle, right? >> Blue whistle. And that was what was just so infamous in the early early early phone freaking scene. That was the origins and beginnings of hackings. >> Had the perfect pitch. Just had the
15:38perfect pitch. >> Trivia fact. I think Steve and Wnjak uh back at their college dorm actually made something called like a blue box which was an automated way to don't do phone freaking where they would have like a keypad and they would connect it up to the phone and they would be able to emulate these sounds through the keypad
15:55and then you know not have to use their mouth for all the tools and make it a bit more easier. So facts fun facts for there. So this is based on real stuff but the issue here is I would say the time this movie is from early late ' 90s I believe. I want to say 1999. Let's
16:09actually just fact check that, right? 2003. And those phone systems, especially from the mobile device that he is using, was long gone. >> This is seven way back. This is way back. So, it isn't quite realistic. And it definitely isn't realistic that the guy would get free long distance forever. That would imply something totally different. that would imply that
16:27you're able to hack into the telecom provider and change the setting related to your SIM card or again I I'm I'm kind of sort of not I don't have the knowledge completely on this but I would think it it it's something that CL the client or the user on the end wouldn't be up to >> so I said you know as a joke as memeing
16:43oh let us know in the comments but genuinely school yeah I would we would love to understand and get a little bit more that that history lesson even for us yeah teach us that one so I would say realism like 0.5 maybe it's definitely based on something Maybe maybe even one because it is based on a real attack.
16:59>> I.5 point I agree. I agree. I agree. Cool scene though. And honestly the I guess rat is also a point like they call this hacker the rat which is remote access tool or remote access for right which is real term. >> Let's do one that is potentially possibly real John. >> Okay. So >> this is from the matrix.
17:18>> Ooh. >> Oh hang on. >> This is good. Still no sight. I don't know what they do, but they only got 2 minutes left. [music]
17:41>> So, I think this first screenshot here is the most interesting. >> Can we look at those commands here? >> So, we're seeing SSH nuke, and I actually think that is a reference to a real exploit for SSH v1. Yes. SSH nuke attack attacks open version prior to 23.1. It's it's a real exploit vulnerability originally discovered by
17:59Michael Sansinski. >> Okay. Okay. So, the reference there cuz the GitHub commits are 6 months ago. >> Okay. Silly. >> How old is this thing? 2001. >> Yeah, makes sense. So, this is actually So, the movie is actually attempting to reference a real SSH exploit that she's using to reset the root password for the user. >> Oo, looks like that, right? SSH nuke
18:18pointing at the IP of that's a local IP. She's obviously on the network sitting inside the terminal looks like and then root setting the root password as an argument to that and then being able to to access the system over SSH using that root account and the password she just set. >> Does the SSH command take L to specify a
18:35username? Do you know off the top of your head? >> No, that should be in front, right? >> Usually >> that should be username at 100%. >> Can you check the man page for SSH? I'm sorry. And if we're getting super hyper nerdy stupid dumb, she's already at a root terminal. You can see by the hashtag the prompt. You can see like the
18:52octase >> L is logged in. >> It works. Okay. >> It's it's a totally legit command. >> You don't actually have to supply that because it'll use your username by default. And since you're already logged in as root here, you didn't need to supply that to begin with, but that's me being pedantic splitting hairs. This is I'm going to say legit to rebal. And
19:09then what is this? Is like >> Yeah, there's a quick moment there. Enter password. Okay, that isn't a default SSH. That's not usual. No, no, no. That is obviously solely just to make it very specific or very explicit for users, right? Typing in her password. I just said access. Sure. Do >> we have another scene of the code?
19:31>> Yeah. Yeah. Yeah. >> So, she has in and she's at terminal called RRF control. Shouldn't this say her username? So >> that could be configured in that index. >> That's possible. That could be the shell that's set for that system that user if you are on a Linux system slash should set password shadow whatever you can set a user's
19:52shell like the program that gets ran as they log in interactively via the terminal to whatever you want. It could be bin bash as like default or it could be something like another program that manages RF control supposedly and could take commands like that. So, and that would supposedly make sense for the end she's attacking, right? >> Yeah. And the very top of the screen
20:13does show her running end map or at least this end map output. >> That's a reference to a real tool, right? >> And it's got basically pretty I would say almost realistic output of like, oh, port 22 SSH is open. Can't figure out the OS, but that worked. >> System open access level 9. And then I guess the password prompt is
20:30unrealistic, but other than that, this is a one for one. [music] Disable grid nodes 21 248. I mean that could be valid input arguments for whatever uh program that is ran here which is essentially the CLI for RF control right >> I give it a point I >> 100% I want to I want to give it two we
20:47can't do that but but I want and you get the question back and then disabling the nodes and this is an easy one if if we can't be yeah we can't be splitting hairs here this is an easy easy onep pointer for sure >> the like window display here the realistically TUI is totally a possible text user interface in a lot of
21:05different terminals. So that could work. It could display the alert or the mobile or like those window banners even if it is. So yeah, I'm cool with it. >> Yeah, it's one 100% Mr. Robot. >> Yeah, >> it's been a while since I've seen that. How long ago did that final season come out? 2018, 2019. >> Feels like forever ago.
21:23>> So for top cover here, most of Mr. Robot is pretty well realistic. I think that's well known a lot of across a lot of folks. Maybe some folks or no genuinely they do a good job recreating the hacking scenes. And can I say this is because they like genuinely brought in cyber security experts. Uh one of which
21:42I know we'll talk about in a little bit. But for a little bit of fun fact history when I had attended what was cyber security competition or capture the flag event. The event was called Cyber Seed way back uh years ago, maybe 2017, maybe 2016, but they had a panel part of the event where they brought in the I don't
22:00know if it was I'm not sure if it was one of the writers even for Mr. Robot or but it was absolutely the cyber security consultants that they had brought in to you know consult and prepare a lot of the the tech and the hacking scenes in uh Mr. Robot which was very cool and yeah we'll get into exactly how that
22:18came to life in a sweet scene here. So I'm I'm going to stop right over here. So she's using a real tool called set social engineering toolkit. It's a bit dated, right? It is. >> It's it's had it glory days. I mean back in the day of Java applet attacks. We miss those. Uh and fun thing is this
22:38this tool is mainly developed by by my boss Dave Kennedy. >> Dave Kennedy >> which was also one of the technical consultants on the show. He was brought in to help out with these technical scenes. So shout out to him obviously. Dave is incredible the best guy. >> So she's inside of the set framework. She's in module one which is performing
22:55a web attack. I'm going to guess that's the Java applet attack. She's based on we don't see we're seeing set three third party modules one focy crypto wall. There we go. They even add guys [laughter] this is not like they they're running K Linux and they went in and maybe probably even Dave went in and change
23:15the code to reference a module for F so Society which is something in the show. Not only are they using real tools they're merging elements from the movie into the actual open source tool itself in order to use it for the movie which is incredibly cool. >> That is very cool. >> Nerd points 100. Yes. >> So they're setting up this Society
23:33crypto wall attack. We're setting a local IP address. >> Not quite. 192. So, it's not a local IP address, but it is a totally real remote IP. >> It's within like the syntax of what an IP can be for sure. Yeah. Specifying a port. And then, do you want to use the crypto wall recursive attack to all
23:50computers? No. Yes. And type the name of the attack file. Crypto wall.exe. Enter secret passphrase. Oh, yeah. They're setting up like a USB key. create auto run which is something you would typically find on it's not in use anymore. It doesn't run by default anymore but back in like Windows XP days you could just place that on the remote
24:08if I call it correctly you could place that on a memory stick just jam that into any computer and whatever was configured set and it would just run on the computer. So just running around with the memory stick putting into all laptops would totally like do code execution on them. [music] Auto run has been exported. Copy auto
24:23run IM and F society M2 flash drive. I guess that's a continuity mistake here, right? Because now they're referencing a whole totally different EC file than what she initially typed in. >> Granted that could happen to do that, right? The tool might to make it match with the other one might rename it and then the file she's like she has on her
24:43actually color machine is what she's typing in here and then just renaming it when copied. So spitting hairs, right? >> The percent s is interesting and neat. Yeah, because that should be replaced, right? >> Yeah, normally that's like a format string in like a print f or c like style. Granted, it's not I I don't think set is written in C or C++.
25:01>> Python or Python. >> Did it 11 months ago. >> He's still cooking. He's still he's hacking away at this one. >> That's I thought for sure this was long dead, but he merged a pull request updating it for Python 3.12. Set is still alive. [laughter] What? What the hell, Dave? Wow. Scroll down a smidge. Can we see the language percentage? 78%
25:22Python on the right hand side. >> Okay. Right. There we go. Yeah. So it's it's Python. The other stuff is just templates probably used in different tag models. Right. So 100% Python. >> If you look back at the video, it's pretty cool. You can see the banner that's like, hey, uh, big kudos, big credit thanks to trusted sec.
25:35>> There we go. Trusted.com. Free advertisement >> sponsor. [laughter] >> Thank you to today's sponsor. >> I should be wearing a trust t-shirt. Ah, I feel bad now. Okay. Obviously completely like 100% one for one. They're using real open source tools. It's been modified, you know, in in the context of a movie by this attacker performing this crypto wall attack. It's
25:54totally real. I guess what is if I'm if I'm spinning hairs here, what is outdated here is the attack itself because unless this corporation is running Windows XP boxes, which they definitely shouldn't be doing in 2018, this wouldn't do anything. It would require at least manual handling after you put in the memory s just run what's on it. Right. I'm getting my facts right
26:13on the other one stuff, right? >> I agree. I I I used to auto execute on old old machines, but it certainly no longer does. >> Explorer would at the very least ask you, "Hey, what do you want to do with this file?" If you were to plug in a USB drive, what do you want to do with this
26:29drive? And then you would need at least some manual intervention one way or another for sure. Yeah. Yeah. >> Thank you for shopping with us. Get the hacky Gibs and remember, hugs are worth more than Chase. That's nice, right? >> Heck yeah. Yeah. And then run a couple Linux commands. >> He's unmounting the flash, right? Yeah. >> Which is called flash apparently. Okay.
26:50Different scene here. >> But that's the part of my brain I need to start ignoring. [music] >> This is either a Linux image skinned to look like Windows. That's what this is. It's got to be. Yeah, it's got to be >> opening up Putty, which looks like the Windows version of Putty. >> That's weird. >> Yeah, this is actually a bit Why just
27:09not have a Windows machine up? >> Yeah. Does Putty run? >> I don't know. I was about to say I couldn't be sure if if this putty theme indicates that it's Windows because I don't know [clears throat] if as you said putty even runs on if there's a Linux compiler version for but there's probably right. So he SSH into his
27:25calling machine looks like [ __ ] X. >> Is that a real tool? It probably is. Have you heard about it? >> I don't think so. >> [ __ ] X >> IRC. >> It's an RC. Oh wow. [laughter] We just exposed ourselves so bad. We're young guys. We we grew up on MSN and Skype. I had some moments on IRC, but mainly MSN
27:46was my >> I was in AOL guy like >> Oh, so I should be [laughter] Yeah, it's been cool hanging out with you guys. See you later. >> See you later, guys. Yeah, I did get into Jabber at some point though. Jabber was my J. Remember the u like end to end encryption plugin X amp or whatever. I
28:02remember using a lot with Jabber privacy and all that. Again, we exposed our age a bit here, but yeah, [ __ ] is a total real RC client if that is indeed what they are referencing. >> Oh, totally lost chatting with white rose, right? >> Something >> settings. No, it's connecting to server. >> Dude, if we press two frames forward, we
28:22would have seen it was IRC. Okay, cut us some slack. >> Yeah. Yeah. Again, we're we're young, guys. We're young. We didn't know. We're going to get so much [ __ ] in the comments for that. I'm actually afraid of including it. >> We can't release a video anymore, dude. No, this [laughter] is done. So, he's running pseudo app update on the KI
28:36machine SSH into. He's on RC on one of the other ones. I can't quite make out what he's doing on that's definitely some pseudo code potentially. See, >> uh I think there was a shot of it just a bit ago at like >> probably comes back up. We'll see. [music] Sorry, John. >> You're good. >> Step one, identify the target and its
28:54flaws. There are always flaws. [music] I learned that early in >> See, >> I think this is Ruby. >> This is Ruby Metaswat module. This is Ruby for - module 100%. >> Yeah. Yeah, definitely. Metas module. That's cool. Deaf is the same keyword indicator like within Python, but it'll not use colons as you can see. And that'll have an end block to close it
29:12out. >> Definitely not having looked at Ruby code that much. Definitely very similar to Python. >> Oh, yeah. Yeah. Yeah. Yeah. >> And he's using uh >> Vim. >> Vim. Thank you. >> The local library, a vulnerable FTP server and it's AS400. A far cry from the Android zero days I'm using to own the FBI standard issue smartphone.
29:32>> Rewind. I need to hear that. >> We got to process that again. >> Library. A vulnerable FTP server. And it's >> okay. Vulnerable FTP server. That's fine. >> And it's AS400. That's AS400. Oh, that's that's a FTP service, isn't it? >> I don't know if it's a server kind. >> Hey, isn't that like a Okay. Mainframe
29:51thing, >> maybe. >> Again, we're exposing ourselves so >> Yeah, it's not even a main frame. Yep. Yep. Yep. I haven't been yelled at for taking down such a machine, but I I know people who have been yelled at. I mean, an end map scan is pretty much enough to take down. >> Yeah, that'll break it. >> A far cry from the Android zero days I'm
30:07using to own the FBI standard issue smartphone. >> So, he's talking about he has developed an O day for Android devices being owned by the FBI aka like their standard issue devices, which is if if he has done that, he's incredible. >> Well done. >> And he's also a millionaire, right? What those these old old days for like
30:24Android like a full chain one that breaks out of the sandboxes and stuff. I don't know for Android devices, but for iOS devices there are like millions right on the back market. >> Sure. Oh yeah, >> they're hard to come by. >> The library was a test to see if I could even get into the system. I've since set
30:38greater goals. For instance, step two, [music] build malware and prepare an attack. At my fingertips, the zero days wrapped in code like a Christmas present. >> This is very not fantasizing, but like he's uh is romanticizing a word. totally like glorifying. >> Yeah. Yeah. He's like >> I know he's he says he's writing malware but like hey dude you defined a
30:57function. >> Yeah. [clears throat] Yeah. You're just talking about bytes and encoded payload here. Like this is >> which is like the beginning steps. >> It's the rapper right? >> Yeah. But he is typing slow for this to be happening. >> Yeah. He's obviously a lead hacker though because there's no code syntax highlighting here. He's just in in the
31:16comments. >> He knows his syntax, bro. True. Probably ran first try as well. I live for this [ __ ] >> Oh, this is good. Okay, so we're He is again. He's He's still >> He did a quick reax replace down at the bottom, didn't he? >> So, he's doing he's he did the the update and now he's installing tour.
31:34[laughter] >> Uh >> this feels like very disperate things. >> Yes. >> Log into IRC, download, write a Ruby module for while you're unzipping the tour config and tour keys and stuff. So, you're setting up like a tour server. Yeah. Var marketplace. >> Okay. >> Yeah. Okay. >> The thing is while like all of this makes sense separately, I think it's
31:55just the bottom two that actually makes sense for what he's No, I remember this scene. You remember? Yeah. Yeah. You remember the context of the scene? I think I do. I think he's being kept hostage and he has to help somebody doing like illegal activities, set up a tour server. And while he's doing that at gunpoint, he's also secretly
32:13developing an exploit or whatever in order to get out of a situation he's in or help whatever this individual at the RC server is at. So he's doing two things as one. So they are separately they they make sense. But but yeah, I think that's that's enough Mr. Robot. Again, Mr. Robot has great great technical accuracy. They also have a
32:30bunch of hack five references and hack five hack five products in there, right? Okay, let's do I'm thinking Skyfall. >> We should go, Mom. Board of Inquiry begins in 30 minutes. >> I want to know what's on that computer. >> So the context here I think is there've been there has been sort of attack against the MI6 branch or whatever the Q
32:47branch or whatever this Skyfold James movie and they're essentially doing forensics work on this laptop. This is this is up your alley. >> Now looking at Silva's computer, it seems to me he's done a number of slightly unusual things. He's established failsafe protocols to
33:08wipe the memory if there's any attempt to access certain files. >> He's established file safe protocols. >> I think fail safe >> fail safe fail safe protocols to wipe the memory of the computer if we are to touch files. Now wipe the memory of a running computer. That would be the equivalent of just brushing it right using it. Then the memory would be
33:27wiped, right? So, he's essentially from like a real perspective, it would just be files that are set up to trigger actions in order to wipe or shut down the computer. Uh, which you could totally do. >> That's totally doable. >> Totally doable. Just setting shortcuts on files or just hiding files as shortcuts or whatever. You could do that
33:43easily on the Windows system. >> Only about six people in the world could program safeguards like that. >> Well, um, not so sure about that. >> Yeah, more people can do that. I wouldn't even say it would need programming uh to be fair, but maybe some light scripting, but sure. >> There are Can you get past them?
34:01>> I invented them. >> Right then. >> Do you usually plug uh computers you're doing forensic work on straight into your network, John? >> No. >> No. >> No. >> Let's see if there's a reason for that. >> Let's see what you've got for us, Mr. Silva.
34:21We're in. >> Oh, the screen. Okay. So, I don't quite get what's happening there, but the screen just went from being weird to being not weird, and you can see what's on it. I'm not sure that how how that qualifies to Hollywood. Yeah, that's the movie end of it. >> Sir, what do you make of this?
34:48>> This [music] is Omegaite. most encrypted level he has. >> I can't make out >> encrypted levels. >> Confuscated code to conceal its true purpose. >> Fancy way of saying that, but sure. >> Security through obscurity. >> Real term. >> Okay. Yeah. >> Actual real term. Used 100%. >> He's using a polymorphic [music] engine
35:08and you take the code. Whenever I try to gain access, it changes. >> Technically, I hate the term. I hate the term. I hate the term. Have you done Have you talked about this before? I hate the term. polymorphic engine to mutate the code. This is true. This is okay. Correct. Code can be polymorphic to manipulate and change how it runs.
35:27>> So, it's just it's it's changing itself at runtime. It's making modifications or doesn't have to be lasting modifications, but it's changing how it's it's a I I don't like the term at all honestly. It just doesn't make much sense. But yeah, it is a real term. And there is claimed even commercial products claim to do this on like a
35:44protective level. If you have cold that you need copyright protector or whatever >> it's like solving a Rubik's cube. >> I think we have to address the giant graph in front of us. [laughter] >> Uh this is just ridiculous. This has actually the thing on the right side here might be something you could see at like a it's a hex dump kind of thing,
35:59right? Would be something you would see in like either pro or something like that. >> Solving a Rubik's cube that's fighting back >> fight because it's fighting back. You got to be careful. >> This thing on the left side here is just junk. This has nothing. This is like I I guess the if we're forcing it, the
36:16closest thing would be the function three or like the what's it called? The is it the function tree? >> Oh, yeah. >> Inside of right. Yep. Yep. >> Did James Bond just say >> I think he said stop. >> Okay. Because he saw something. >> Yeah. But if he was looking at oh the highlighted words in the hex dump,
36:36that's not hex. It's like g r a n. >> That doesn't that doesn't follow the spec for sure. about there's multiple invalids in there. >> Go in on that. [laughter] >> So hex dump is a representation of the bytes of the data. Computer program code
36:58can be usual zeros and ones. Oh, you know, processor shenanigan stuff, but can be represented in zero through 16 possible characters. And the way that you do that is you do 0 through 9 and then a through f. But that means it stops at possible characters after F. So G is not one. R is not one. N or U by
37:19any means. >> If you're looking at if you're looking for strings in there like that, it would be looking at the ask >> which is hysterical. Nothing else in that page is not out of the 16 characters. Like everything else is valid hex other than Graham bro. [laughter] >> Yeah. So yeah, if if they just moved if
37:36you just made like another table on the left side here and made that as instead of Yeah, but no, we got to merge it. >> Remember remember road it's an old tube station on [music] the Metropolitan line been closed for years. Use that as a key.
37:57Data feed O2. He said try as a key. >> Yeah, use that as a key. >> Okay. Yeah. And that [music] turned everything red. [laughter] >> Oh, look. It's a map. >> Yeah. This is just a complete hall of visualization of decrypting data. I
38:17guess that's what they're trying to show, right? This is absolutely all of So interesting parts that I guess could somewhat maybe in a far far stretch could be made of like some malware, some file, some computer program that will decrypt itself at runtime based off of a a key, a cryptographic key. Uh, and maybe potentially that could be left in
38:36plain text like, oh, Granboroough could have been really the key used to decrypt [clears throat] the rest of the program's execution, but if it were to be found in hex in that hex dump or even just in strings on its own, it wouldn't usually just be outright like that. >> Like from like a red team perspective, we often use keyings to make sure that
38:55our payloads detonate on the right machines. And then the key is obviously for safety reason never actually embedded into the payload. there is often something that we know we can find on the system. So it could be a host name, could be the uh short name or long name for the domain that the machine of the active directory domain that the
39:11machine is tied into, could be some red key values, could be a remote look up to a DNS record, could be whatever, right? It's usually never in the binary. So them finding the key that is used for encryption in the binary is bad practice, whatever. But we're we're still like this is stretch like this whole discussion issues.
39:26>> And more often you'd probably see like a drop deadad resolver or something which would be kind of really cool of like oh we don't even want to put a reference to the key in the uh binary or the payload itself. You'd [clears throat] put a reference to something else that points to something else. So if that little
39:42intermediary thing were to ever be changed or rotated out, you've got the control there. And the secret is never ever potentially accessible. >> Multiple ways to do that for sure. >> Yeah. It's London. Subterranean London. >> What's going on? >> Why are there doors in the floor like that? That would that would be my
40:03immediate question. >> Why are there floor doors? >> Why are the doors open? >> Now they're hacked. >> James immediately understands that they're hacked. [music] >> System security breach. What EDR do you think these guys have? I was about to say Huntress, right? [laughter] Q branch system alert se level Q9
40:26security protocols contact system administrator. I mean that last one is probably the only uh >> Can someone tell [music] me how the hell he got into our system? >> You plugged them into your network. [laughter] >> That could be >> You're right. >> That could that could be you probably didn't segregate that network properly. Q.
40:49>> Oh [ __ ] something. >> How did he get to our network? Oh, the network cables I plugged in. >> He literally gave him like 2 GB of capability, but with two cables, right? So, >> that's so funny. >> Okay, so that was a Jame Bond scene. Realism wise, hex dump is the most realistic thing we saw there. An invalid
41:10hex dump to some extent, >> I guess. 22 maybe. I feel like I feel bad getting into the other decimals that aren't even a a half. It's got to be I don't know. Round it rounded down as a zero for me. No. >> Okay, let's let's leave it at zero. >> Is that fair? >> That's very fair. I think compared to
41:28how what's given the others, I think [laughter] zero is completely fair. Okay, guys. That was it for the scenes that we had to react to. If you want us to do more like this, go bother John. I would love to meet up again and look at dumber scenes and try to make sense of them. Thank you so much for having me on,
41:43John. I really appreciate it. Thank you for doing this. This was super fun. I know we've been just behind the scenes we've been trying to align schedule for the week and it's been an absolute mess. Apparently, walking around on the Defcon show floor can be a bit timeconsuming job. >> Uh it's very sweet. It's very fulfilling, but I feel like yeah, I've
41:58been running ragged trying to keep up [laughter] with everything going on this week. But it's super good to finally hang out, have a drink, and relax. Thank you, man. Seriously, thank you. >> Yeah, I know. No, all the thanks is so much. And cheers, John, so much. And yeah, I hope we can do this again sometime. We will.