Down the Rabbit Hole by Ken Weston

okay yeah perfect I just emailed you

for all those who are waiting we got about 10 minutes to the next session so uh hunker down and we'll get started shortly

because the way that we've had it set up so there's a few things that we can do you can use this security

or I can click for you um

um

going on

everybody

um

correct

I forget

there's humidity here but it still make you sweat and uncomfortable oh all right so here's the wireless mic all you can use the physical mic whichever you prefer okay so this is the actual mic part I probably hooked up somewhere closer to the lanyard but maybe I'm talking about thank you

okay

thank you

that's recording yeah so

um

you can unmute it and then you can just do a touch very fast if you want testing testing one two three can you guys all hear me all right testing testing one two three

so let me actually you have a video

foreign

so

buttons left and right and you're good to go all right thanks uh you need a water if you need water they're here we need more they're here

good

it

is

thank you

guys

exactly

yes

all right okay so we're ready to move along we have our next great session here with Mr Ken Weston I'll go ahead and do a quick introduction Mr Weston Ken Weston is a security strategist with Panther Ken has been in the security field for over 15 years working with companies to increase their security posture through threat hunting Insider threat programs and vulnerability research in the past he has worked closely with law enforcement helping to unveil organized crime groups his work has been featured in wired Forbes New York Times Good Morning America and others and he is regularly reached out to as an expert in cyber security cyber crime and surveillance with all that being said without further

Ado Mr Ken Weston thank you thank you so much appreciate it and uh thanks for having me yeah hi my name is Ken Weston so we're gonna be talking today um about a concept that I actually uh kind of came about I was asked to do a keynote speech for besides Portland where I'm from I'm from actually from Oregon uh so this is a bit of a long flight for me and I feel like a vampire here because I'm melting um but uh but that talk was around like they wanted to say how did you get into security like they wanted me to talk to students and I really thought about it and I was like I don't even know how the

hell I got into there right I just started you know doing uh things around technology I was really interested in it and I feel like in a lot of ways the infosec community actually brought me into it it chose me so um again I've been an Oregon native I grew up without the internet kind of give you an idea how old I am we didn't have the internet I grew up out in the country out in the woods of Oregon uh spent more time doing cow tipping than I did actually on the computer um but I also had some learning disabilities um I'm just graphic I can't write at all um and uh I had a lot of challenges in

school around that um and I also had ADHD that came with that um and so I didn't do very well in school and I actually grew up believing that I was stupid and lazy because that's what you know people would tell me teachers and things like that so I'm still a little angry about it um but uh but it wasn't until like I started actually getting to computers once I was actually diagnosed then um I was given access to computers and word processors and when I got access to computers then I feel like I actually had a superpower I was finally able to communicate I'd always read tons of books um I remember we moved to this house and

there was this huge library of books in the basement where my bedroom was um I ended up just reading I loved reading um teachers always would say like you know uh you know Ken just doesn't apply himself I can ask him questions and he can tell me what he read but when he writes it down he just doesn't take time um so um so when I got into more and more into computers I really started realizing that it is superpower and I started getting more into programming I actually ended up going to college I I got a my first degree in um a ba in English literature uh and then I went on later on and got a master's in Internet

systems development um and I've been in security for quite a while I actually had a startup called Gadget track which I'm going to talk about some of the cases I worked on and how I kind of stumbled into that and that's kind of what I kind of talk about where rabbit holes is I do sort of stumble into these things like one thing leads to another I I really see that there's these sort of dots that get connected when you're doing an investigation or even in your career and my hobbies are I'm a guitar and record hoarder um I have quite a few guitars I love playing guitar playing a band and I like records as well uh some of us still like

to to be offline um so what is it about rabbit holes like what do I mean by this um but if anyone have ADHD you don't have to raise your hand but like a lot of us do um and in some cases there is um sort of a superpower too around being able to do hyper Focus um and so sometimes it's hard for us to keep track of certain things but once we get um our teeth into something we're really passionate about whether it's like an investigation if I'm tracking a criminal or something like that I don't give up like I remember there would be two or three days what I wouldn't sleep when I'm when I was coding stuff when I

was tracking people um and a lot of times people would didn't think that some of this uh technology that I was building was even possible right so I think that's one thing like especially if you're a student if someone tells you especially someone an authority figure tells you something is impossible now that's that's you know your life goal is to make that possible so um why do I say um also uh Rabbit Hole like I feel like um you know if you guys like Alice in Wonderland um I I like cyber security because we're all a little different I think in order to be in cyber security you have to think differently we're out here we're breaking things we're not

only do we have to understand technology we have to understand it to a point that we can actually uh break it and modify it enhance it make it more secure right that takes a very discipline a different type of mindset I think than you'll even find in other technology um so in a in house in Wonderland right they say we're all mad down here and I I believe that's true we all think a little bit differently this is sort of one of my walls of Shame so these are uh criminals uh some of them are people that have actually retrieved some of their devices for um some of the faces are blurred out to protect the guilty

um but um I had technology where we'll talk about some of this I started with USB devices then I started figuring out okay well how can I track a laptop and I was able to go in and actually look at a lot of the techniques that um like cyber criminals were using and I applied them for good for the purpose of theft recovery and the cool thing about that is lost cyber criminals they can't patent that technology I now have two Pat um well I did a talk on Defcon around some of this Defcon 23 I ended up getting docks as a result of it when I was talking about all this stuff um some of the media they don't

understand uh when you start talking about this technology they start thinking it's BioWare you know it's all malicious but there were a lot of controls that I actually put in place it was very responsible how we approached some of this stuff uh I think the meet the real life Rister robot that's total Hyperbole and a little little kind of pissed me off um but when I'm doing investigations too like uh you know this is true for you know these types of Investigations or if you're doing um any sort of cyber security investigation in your sim you know it's never just one alert if you're just sitting there and you're you're looking at your sim and you're just

looking at your alerts and okay that's false positive uh let's just go wipe the system right that's not uh that's not conducting an investigation uh an alert like that is actually the first clue and then it's your job to then go out and find additional Clues whether it's going into your Splunk instance or whatever you're using for your security data Lake um and oftentimes um there's going to be a lot of evidence that you're going to be able to gather to tell the larger story of that particular incident anyone know who this is

anyone heard this phrase this is Edmund lecard so he is the the sort of the grandfather of forensic science uh he was in France he was the sort of the French they call him the French Sherlock Holmes um he actually developed a lot of uh uh Concepts and principles that we use in forensics today some of the precursors like even before like fingerprinting and things like that um he's uh really uh a brilliant uh guy and he had this concept and he said every contact leaves the trace and the idea there is that when someone commits a crime not only do they take something with them they leave something behind so we think about that with physical

crimes right there can be a blood splatter sometimes he had some cases where there was like metal shavings and someone's pocket to identified like he was there at this location and some sort of a Mining facility like there's all these sorts of little clues that if we know where to look for them we can actually identify that and what I believe is this actually carries over in the digital world as well especially nowadays with all of the logging that we have available to us all of this information that's available in our fingertips everything we do right now we're being tracked if you think about what's in your pocket you think about you know the photos you post and I'm

going to talk to to you guys about some of those examples throughout this talk so I got started um I was I was a web developer I was uh ended up being a one-man wet mommy for a company where my first exposure to security was actually managing a web server um and I had to protect it secure it if it's a basic lamp stack um as well as building the websites and things like that the company that I was at they had a new technology new product that was blocking USB flash drives from being plugged into networks oh it was becoming an issue where you know it's great you can hack from outside you know try to get into

the network but it's a hell of a lot easier when you're inside the network and you can just plug a flash drive in you can do all sorts of fun malicious things or you can also steal data and so the this technology would block it and that's when I started getting really interested this I started actually looking at some of these different tools that were being utilized to steal data and I started making my own to try to test our technology and uh then I said hey I'm gonna put this up on a website I think people would really want to learn more about this particularly like system administrators they don't understand the threat so I actually made a bunch of

these tools available on a website called usbhacks.com that's the first time the FBI contacted me so the idea was I would build a happy little spyware I was actually working on my Master's dissertation at the time and so what I did was I took some of this technology I'm like I don't need to be too invasive I can gather just enough information that if you know someone stole a flash drive or external drive you know if they plug it in I could take over that system and gather some information uh for for law enforcement and I put it out there for free and um I think I put it on dig for all you young guys that's but it used to be uh

before Reddit we had to dig and this website got dug to the ground it was on shared host I had 20 000 people that were signing up for it it went crazy the cool thing about that too though is I also had additional information to gather information about the devices that were being connected so as I was gathering that information and people were using the tool I had a whole list of all the devices that I could actually track I had everything from external hard drives GPS systems remember before you actually had it in your phone your car you had these devices that you would then plug in and to update the maps you had to connect it

to a computer well I could hijack uh your computer as a result of that um and you know I put this out there and then I actually decided um that I was going to do a startup around it and we started actually getting some actual cases I was just kind of curious if it would work we had the first case and the first thing that you know people have in their username it was the name of the family that of the kid that stole an iPod and then we um kind of expanded this there was a professor that was using this and um he had his uh a dissertation on a flash drive that was

taken from uh his um his classroom and we're getting some information I was kept getting IP address pings uh that were from at T that's not really helpful um from an ISP unless I have to go to law enforcement then I have to you know have them do a bunch of paperwork it's a huge pain in the ass to get information on the IP and then of course it changes um it could have been a Starbucks you don't know but we started getting additional connections from a university um and we looked at the time stamp for it and I was able to see that work with the campus security we identified that it was coming from a specific computer

lab and in that computer lab they had actually had a bunch of laptops that were stolen the year prior so they had the key card and they also had cameras that were available for us so I also had the students who one who was in there there was three or four students that were in there and from that they were able to identify the student that had it they waited for them outside of a classroom and he got his flash drive back that was one of my first cases and so some of the word about about this uh got out and there was a company called FLIR a lot of people in the military probably

know FLIR yeah so FLIR makes these really expensive thermal imaging cameras they're anywhere from like three thousand to three hundred thousand dollars and so they actually they came to me and they're like is there a way that you could you know put your your theft tracking um on us not only for um for tracking thefts they're also having issues with export controls some of these cameras can't go to certain countries because of uh the um embargoes like has a like the abuse for nuclear purposes and things like that so um one of the tricks though was that um the storage is on an SD card and if someone pulls an SD card out and they

put a new one in my little Trojan executable won't run so what I did was we worked with them and we actually installed something in the firmware that would actually reinstall the agent if it wasn't on there and that's my cat this I actually just disguised the executable as an image and that's my cat knobby um and then we uh we actually ended up get getting some uh uh tracking they couldn't tell me some of the uh that was stolen but they did tell me it helped uh considerably with some of the export control issues that they were having I believe they identified a distributor that was selling these cameras to places they shouldn't so again further down the rabbit hole I

didn't want to stop there I was like well you know uh you know these flash drives are all great but what people really care about it was their laptops and at that time most uh laptops started having web cameras you know it's hard to believe like back this is that's how old I am right um I was alive on web cameras or when web cameras weren't um installed on laptops so um you also uh at the time the first iPhone to come out and I was really interested like how did this iPhone not have a GPS chip and it was doing tracking and they was using Wi-Fi positioning and they were using this company called Skyhook to do it so I

reached out to them and I told them about my idea and I got a special license from them to use it on Mac and I helped them debug a lot of this stuff so the idea is that if someone steals your laptop activate tracking we'll take a photo of the person that's using your computer we'll get the location and then we'll also get other network information that can be helpful for law enforcement this was a game changer for law enforcement because at that time they were dealing primarily with a company called absolute software it was doing this but that required a back door into the system you had to give this that that company um even though they were a bunch of like

retired law enforcement folks uh back-end access to your system whereas I wanted to make this much more self-sufficient so you don't have to give that um access up so I didn't want to have set up a server I didn't want to have to secure it particularly given the nature of this uh the technology at the time and it was just me so um made it so we actually integrated with a photo sharing website called Flickr so what we would do is you would uh you know create an account on Flickr and then I would use their API and that's where we'd upload the images and other information and I ended up getting our first recovery and it was in New York

a guy a customer had his uh laptops along along with a bunch of camera equipment and we traced it to this uh this one uh it was looked like it was in a tattoo parlor we had we had the photo we had the general location and I had to deal with a police officer there who was a total [ __ ] he was uh like oh God I gotta I hate dealing with this technology I gotta go do a bunch of paperwork and like yeah sorry you have to do your job um and I was like but you don't have to do that it's not like the other technology where you have to go get the

ISP and all that I'm saying you this is General location he goes oh I've seen this before like it's just in this the city I can't look around the whole city I'm like no it's within 10 to 20 meters and these his eyes kind of lit up and he was like okay uh and he goes well still a lot of work and I go just I have a photo just take the photo look around that area ask if anyone knows it and he finally did and they ended up finding it was this guy who owns a tattoo shop parlor and then in the back um he has if you see in the background there's keyboards there's mixers there's

all kinds of really cool stuff so he was basically running a fencing operation and they actually went in there finally they recovered like four other laptops all sorts of other uh camera equipment and everything like that as well and then then the cop in that case he wanted to be my friend and he wanted to go to a baseball game next time in New York so pretty cool um and then um I started getting more into this one thing I really started discovering was you know we would find these sort of larger fencing operations uh a lot of this was organized crime in Portland Oregon there's a few Russian organized crime groups uh not necessarily uh the Russian Community

doesn't like them very much these are people that were criminals um they were when the Soviet Union fell they um they kind of pushed them all into all of these other states and then they removed their passports so they couldn't come back and then a lot of them ended up um actually in Portland there's a whole uh kind of group of them um but they uh would go in and we found that they were stealing a bunch of laptops from schools and then they would get replace the laptops a week later they would come back in and steal them again and so this kept happening so I said uh let's set out some bait laptops

so we've installed our software on some laptops didn't even lock them up in the cupboard sure enough within a couple of weeks they were stolen and we were started getting um the location uh from them and some photos this one was a little tricky uh the police detective he went uh to the address again I tell them it's 10 to 20 meters it's not 100 precise you have to do some detective work goes to the address that was listed on there and a guy answers the door and it's the guy that does his roof so he's telling me you don't know what the hell you're doing like you you're wasting the police officers time you can go to jail

for this and just being a total uh douchebag about it I got pissed off again down the rabbit hole I don't like no so I drove out there and I had my my Alpha antenna I was I was stiff in the Wi-Fi network so I was trying to verify that it was correct and I swear I'm I'm parked and I look across the street the Wi-Fi network that we were connected to it said a Russian pride and I look over and right next to the other um the house that they went to was a duplex there was a car and there was a big Russia uh bumper sticker on it and then I'm sitting there sniffing the Wi-Fi and a

guy walks out and he's going to wash his car and he's staring at me and I'm looking like an idiot like I'm just looking for directions right so I told the detectives they came out there finally with like three or four of them and then then they're saying oh yeah you know we did some more research on these guys and um you know that guy's not so bad but the other guy across the street he's bad news like oh thanks guys you know um they ended up busting them there was um there was like six or seven people that were involved in this um they even uh I think they even got a uh recovered a stolen car as a part of

this case as well I thought it was gonna have to go testify I actually started getting a little scared because they were talking about how these guys were were bad news um and but they were able to do it so that I was listed as an anonymous informant um and then um they got them all to rat each other out so I didn't have to go to court um had another one this one was interesting another Russian order grants crime group um this one was a little weird because it was like several weeks after it was stolen and I wasn't getting any pings I was like great they reformat the hard drive or sold it for parts

um and then I started actually getting a connection uh from like it was Missouri or like of all places um and the nice thing about this one is that the guy changed the username on the computer to his full name it was great um and so I had his name um and I started doing more research on him and like I had tons of uh photos with him like he was in a hotel like all kinds of stuff that was he was doing that was pretty nefarious um and so uh on this one I had to ended up Gathering a lot more information because again people didn't understand the technology but I had his name so I

started researching a lot of forums I found that he really likes a Scion car so he was in his forums you know posting photos of his car so I had his license plate number um he was also a power seller on eBay and on eBay he was selling all sorts of car parts and things like that so you can kind of get an idea what kind of business he was in and uh so the uh the D.A that said you know this is a great technology and was the first time we had a sort of case law where they go even if they don't have the laptop with all the information you provided to us we can

still get uh busting for having stolen a property um he ended up selling the laptop as well as a stolen bike to his friend Omar so that was there and what happened was is that uh this was a gift from his father for his birthday um and uh his father was involved in this operation where they would take trucks of stolen goods and they would drive it from Portland to Missouri pick up stolen property there and then drive it to to Portland so they were sort of collaborating and that's how they kind of get around that if you get a laptop stolen first place you're going to look is your local Craigslist and they were

they were smart to that so they knew that they would um you know ship them around um ended up working this uh internationally as well there was a guy he was a Veterinary student he was with his friend in a car um they got carjacked and his friend got beat just to crap and um they had the laptop in the back and then we were able to track this one down and apparently um the police there and it was Apollo they really um linked us because they actually did this to like several people there was 10 different cases that they were involved in with this and then this helped lead them to identify who's doing these uh

these crimes so then further down the rabbit hole like laptops Aren't Enough let's go into Mobile all right um and this was really interesting uh trying to build uh applications for both IOS as well as for Android um so um so I didn't want to just track it because no one really cares about their their phone if it gets stolen just get a new one right but they do care about is the data and so that's what I started working on was you know what if we can encrypt the data upload it to the cloud in such a way that I don't even have access to it um and that's what we started building um and that's when uh there was a chain

of Sprint stores that actually deployed our technology to uh some of their um all of their test units or the demo units videos are going to work here that's not anyway I'll kind of walk you through the story

that was trippy had a beat would have been good there it is

well I I worked I had I had customers everywhere like they're all over the place you know

he's lied outside the Washington Square Mall with effective place at well the managers in the Sprint Store here at the Washington Square Mall behind me say they're very confident that tracking software developed only miles away from here and put onto their demo phones will lead to an arrest uh this is a 500 phone this ends up being a 450 phone two empty display crates Are All That Remains after someone stole two demo cell phones from the Sprint store in Washington Square Mall only Saturday moments after surveillance video caught the effect on tape employees initiating tracking software installed on the stolen phones they were able to not only find the GPS location of the individuals that say

we're typical but also we've been able to uh so monitor any activity that happens in the phone that activity turned out to be pictured someone put shortly after the phones were stolen tell your police admit It's A Brave New World what has been shares taken on cell phones to be told to send back pictures once they're stolen and that is not only the interest of our investigators right in essence uh here is [Music]

people on the right in front of these I definitely know people go with the head of this man you'll see in the window in four contemporary currents so often said the help of a gadget track investigator on the phone we tracked the stolen phone signal to this Vancouver apartment complex yeah we found the exact temporary permit and uh took this off camera a man she calls Peter that sent this photo to her Saturday evening but says she knew nothing about the phones dislocation

yesterday looking for it we're back live now it's time to watch the Square Mall where we've just obtained within the hour those D and D records on that temporary permit

actually nice and smooth to your patience with that so um so you know when I did that the one thing with the software is that people own the device and they install the software on their own device and I think that ethically that's that's okay uh some of the challenges lately I think around some of the commercial mobile spyware you guys have probably heard of um Pegasus um that was actually being sold to governments and it was being used not against criminals but also against dissidents journalists um and and other folks who are innocent of crimes um and so I've been kind of heavily involved with helping a lot of people with a particularly disinformation

around this there's a lot of um uh some of the countries that are involved with this they're trying to you know throw some of the companies that were sorry some of the ngos that have been doing an unveiling some of this research like amnesty and citizen lab under the bus and uh this stuff really kind of frustrates me and I don't think that we as a society want this kind of technology and I do believe that we do need to have some controls around them so um so one thing with this is that uh when we were doing this investigation some challenges I had some of these devices were their GPS was really crappy and I wasn't getting

um very accurate results but what I was getting from it was um the exif data with the GPS coordinates that were embedded in those images became incredibly helpful um and so this is again further down the rabbit hole I started digging more into the images and how exif data can be utilized for conducting these types of Investigations as well of course you know you also have um the the the trip permit that's just I don't know sometimes you just get lucky right A lot of times you'll find that criminals can be pretty stupid a lot of times we'll lead them to get caught that I found is arrogance and greed those are the two things that usually end up

getting them caught um in this case they actually uh again it was an organized crime group that they'd actually recovered a stolen car on this one too and there were six people that were actually involved in this and these were the younger kids that were kind of the ones that are kind of going out there and stealing phones and then they had another group that was fencing them so um I was curious about exif data one of the challenges I had had though was that there wasn't really a search engine for exif data if I put in um uh you know the the serial number or something like that or make and model of a camera there's no way for you to

search it but what I did find was that a lot of the higher end cameras actually were embedding the make model and serial number of the camera in the images now wouldn't it be great if I could actually search that so I had a friend that had a startup basically they were doing um sort of we created a legal botnet uh basically uh you know study at home that kind of approach like where you have you know distributed computing um they actually had a service where they were you know doing that where you know as a customer I could go hey I got this work I need to get done um and then they'd have like thousands

of computers where I could get access to their idle computer time to be able to run this um because I was trying to do this while just like trying to try to flicker with just a few few systems I even tried with AWS um and it would have taken forever there was like over four billion images for me to go through um with this approach we had our access to about a thousand computers and then I just had Python scripts that they were all um hoarding and they're all Gathering all this information from Flickr um and then I created a database with it I also found a bunch of other websites like um you know there was a

bunch other photo sharing websites um and Twitter too like even though um Twitter made it so that when you upload a photo um it actually removes all the exif data I was found that a lot of profile photos still had exif data embedded in it um not just like the make and model but also like people's GPS coordinates and things like that luckily hopefully they've fixed that who knows um but um but basically the idea here was that I wanted to create a database of of all these images so you could have a search for your serial number of your camera and we'll identify all of the photos that were taken with that camera that we found on the internet

and it worked uh this is one of those things where you know F around and find out I was just curious if it worked I put it out there for free um it ended up getting in some news websites um and this guy John Heller he's a professional photographer he was on assignment for Getty Images um and he uh ended up having his uh I found it's just like a year later um and he did a search and he found it and we saw that it with the Flicker and then he was able to find that user how to account on Facebook and on Facebook the guy had a photo of all of his photography equipment and he goes holy

[ __ ] that's my camera um and this one the LAPD was involved um and sort of what happened was it got the guy stole it it was like I think it was like seven thousand dollars in camera a gear he'd sold it on Craigslist then he uh that person sold it on eBay and the police went and found the guy on that had it um and uh he said no I got it from this guy on Craigslist this is like a year later and they go do you still have the address and he goes yeah gave him the address the police go to this apartment and sure off they find all sorts of stolen property again so I just think

this was cool because it's like one little piece of information a serial number that's embedded inside of a photo that someone uploaded led to you know this type of crime being unveiled so this is what I get excited about when and I think there's a lot of this kind of thing that we can think about not just in these types of Investigations in the physical world but a lot more in the digital world um I had another one uh this guy uh he was uh I was on Craigslist again I swear I'm gonna start calling a death list um but uh and this guy he was gonna move to California he was selling a bunch of

stuff and this uh guy shows up she even shows him cash goes out to the garage he shows him this camera that he was gonna sell the guy just punches him knocks him to the ground gets the camera jumps in the car and takes off um and then this one was where I had to use a little more OSN skills um I was able to find this guy's account I was able to then also look at all of the exit data they had in his photos and he was changing cameras like every month and he advertised himself as a DJ and a professional photographer for models um and so also on his uh Flickr he was

uploading on some of the other accounts um that were he thought were Anonymous he was uploading photos of himself smoking weed nothing wrong with that but maybe don't take photos of yourself smoking weed going 100 miles an hour down the freeway when you have GPS coordinates that are actually embedded in that image um so the this one the police did not help at all I had all this information and everything but uh they just couldn't be bothered but still kind of cool that we got it um they also yeah he also had some unregistered firearms um this technology ended up um I was approached by um the ice HSI Center they um these people were doing really cool stuff with

um identifying exploited children um You probably heard about some of the work that they've done like where they'll actually get images of like curtains and bed spreads and hotel rooms to identify uh like if a guy takes a photo of a kid and it's an image um then they can try to figure out what hotel or whatever that they're at before something bad happens to that kid um and so they I gave them free access to the API so they had full access to the data the idea here is that if you know if Joe pervert is doing this nasty thing and then he goes on vacation with his family to Disneyland he takes photos

and posts them on Flickr then they might be able to identify someone that's doing this they couldn't tell me if it was actually uh useful if they caught anyone or anything like that of course just given the nature of the cases but I thought this was a really cool application of it so kind of thinking about all this too is like you know there's all these techniques that people can use to track you um and it's not always good people right like we're not always trying to attract criminals the same techniques can be used to track US criminals can use it against us and so I always kind of think about this you know what we've

done is this sort of Quantified Self punk where you know think about all the different pieces of data that you actually have on your phone every single device your vehicles everything um it's it's all available in this search and if I can get access to it right then I can I can do some pretty nasty things what's funny though is that um a lot of us as consumers have lost access to this information um like when exif data um you know Twitter all the social media websites they'll strip that information out but do you think they throw it away they have access to that data they use that data they will sell that data and I

I've found that the um you know people always talk about doxing and things like that I don't even consider that hacking anymore because all it takes is a credit card I get a credit card I can get all the information I need about an individual right so um yeah so people always say like you're doing really nasty things here what do people abuse this people already are and you're paying the money for it another video I'll skip this one this one uh after Defcon we got asked to um I got approached by uh uh TV channel and they wanted me to do this um I mean a friend we actually hacked a smart home um you could see if you do a search for

it it's on it's a crime watch Daily do a crimewatch daily smart home you'll find it um and we were able to actually uh get into this house we had 24 hours to to um to get into it and do all sorts of nasty things we use the cloud cracking service to crack the Wi-Fi password and it was like 200 bucks we could have saved money by doing a little bit of research because the password was the guy's cell phone number that he had posted on his Real Estate website um and uh then um once we got in I was able to uh get access to the surveillance cameras I had access to that I also piped a bunch of

audio in we did like Mr scary Mr robot voice saying we hacked the house because what they did after that was they had this big party a bunch of people came in and then we started messing with them it was a lot of fun we were opening the curtains and stuff like that I was even able to flush the toilet because I had a cleaning mechanism in it um and for that what we were able to do is that um all of the device all the smart devices in the home um all had the default passwords right uh so they didn't actually go through and change it so we got a Wi-Fi pineapple we were doing some research

just finding what the default passwords were it was probably one of the easiest things the easiest hacks ever I've ever done um but if you think about this too like all the data that we actually have out there I kind of call this you guys probably familiar with the hierarchy of Maslow's hierarchy of needs right so this is kind of what I um I kind of think about how our data is being used so there's at the very top there's the data we create and as we go down this pyramid we lose control of that data right uh we we believe that when we have data on our laptop I can delete it however if I upload it to the

cloud and I delete it is it really gone right no so that's where we have data created for us so maybe when we book airline tickets and things like that there's all this information sometimes you can go and you can ask them to delete it but you know did they already sell this are there archives of the data right and then there's that there's data that gets created about us as a result of this where it's actually drawing those connections so I'm kind of what I was talking about with the quantify itself right we're going through and they're actually making those connections and building these rich profiles of individuals and then there's Shadow data and that's

where you're actually getting into going into like the dark websites and um a lot of the the data breaches that have occurred there's a lot of information about us that's available that you know it's kind of scary to think about what's actually out there um another product thing I did uh I was working with uh another case and I ended up stumbling on this uh kind of mail server issue where uh all of a sudden I saw that there was this Prodigy server and I was able to access all of these emails um and then I worked with El economista and Mexico about this um when uh it was telmex acquired uh The Prodigy they made a misconfiguration to

the server and basically all of their email accounts were now being indexed by Google and I could access pretty much all of them we did responsible disclosure and all that to Google as well as to to them but one of the challenges with this one was Carlos Slim uh we were getting a bunch of media attention and there was going to be a big news article about this he put the kibosh on he was able to shut that down because he was that that powerful right so a lot of people didn't even know about this or even know that their emails were potentially compromised the other one I got really interested in was kind of tracking black hats on my

collars um in a lot of these forms I got interested in a lot of the credit card um carting things that were happening and I found that there were these forums where they were actually looking for Insider information for for uh trades you started seeing cryptocurrency uh come out and a lot of people they were interested in finance on the White Collar side Traders and things like that became very interested in cryptocurrency and they started actually colluding with cyber criminals to gather information around uh you know uh it could be like a patent that's going to be released earnings reports things like that information that if you're an Insider in the company it's illegal for you to

trade on that information and I started looking more into this and I saw that there was just tons of money that was being made off of this there was probably uh there was one case I even researched this here this way group um and they made like 30 million dollars and one of the the ring leaders of it he was actually a former VP at Morgan Stanley um and then he now was a church pastor and he had all this money even had a bunch of his people in his church that were trying to raise money for his legal defense um he was found guilty and then just recently there was another case like this uh with the gru officers that

were found that were doing this as well and they were making like over 80 million dollars doing these sorts of illicit traits so some of the work I'm currently doing um purple teaming in detectives code I just recently started a panther we did a workshop yesterday I think some people here attended it it was fun um I've been working a lot with fighting the commercial spyware especially disinformation around that that's that's uh that's been coming out um I like exposing infosec charlatans in particular um and then I've also been refurbishing guitars that's kind of my plan for retirement I want to get off of cyber at some point and just uh just work on guitars

uh with that being said I want to thank you guys all for having me and if you want to reach out to me have any questions my contact information is here don't docs me just Reach Out thank you

thank you thanks for the help on that was awesome

that was awesome yeah you know