What I learned about security working minimum wage at Hollywood Video

hello good morning still welcome to the second day of b-sides villages talks uh again it's our first year doing this so thank you for being a part thank you for presenting Ben um Ben is going to talk to us today about some of the blurry lines between uh physical and digital security and all that he learned while working at Hollywood Video uh he's coming from iot Village so make sure you stop by there as well and without further Ado let's give it up for Ben all right thanks uh very much to b-sides and I hope you all enjoy this extremely serious conversation about security I'm sure it won't be silly at all so I have to start off by including the

slide and saying what actually is Hollywood Video you know I uh had a revelation as I was putting this together that there may be some younger people or people from different parts of the country who haven't even heard of this place before but we used to have this thing called a video rental store that you could go to and instead of going on Netflix and just streaming something you actually had to receive a tape from somebody and scan a membership card to get a video and you keep it for a few days and return it you didn't just stream it what an amazing thing uh you might get if you're if you're a lucky kid like I was you might be able to get

yourself a VHS tape and an N64 game to rent on the same day if you're really feeling lucky um other things you should know about Hollywood Video and what it is is yes uh I did make minimum wage there which at the time was five dollars and fifteen cents an hour and yes they did make me wear a fake bow tie and cummerbund uh to do this and demean myself every day but I did it at that very Hollywood Video on Reisterstown Road in Baltimore Maryland so I could get that lovely 1990 Toyota Camry DX my very first car so it was worth it it was a lot of fun um real quick who is ISE who are we so I

wanted to give you my perspective here ISC is a security consulting company we actually run the iot village if you want to check it out after the talk we're over in the Village area um we do a number of white box security assessments pen tests device hacks Etc I help people with Scopes and things like that um we also offer something called start um if you want to learn more about it feel free to come see me after the uh talk there were some issues working at Hollywood Video it wasn't exactly the tightest ship to give you a sense uh the uh a day at Hollywood Video would go from 9 00 a.m to 1 a.m those were our

typical business hours and we had four people working the entire day so we would have people working from 9 to 5 PM two people and then 5 P.M to 1 am two people it was not a great situation you saw how big that store was we had to cover that entire place you may notice all the fire this is fine that's because the HVAC in the place stunk and so when I had to wear that stupid bow tie and cummerbund every day I had to sweat it out because there was no air conditioning we actually accepted checks back in the day to pay for videos and we had a terrible point of sale system that

was a real POS and I don't mean point of sale there's also just a stuff going on at a video store I mean uh the experience at the time was I would go in you would have a bunch of tapes that were already already returned people were coming in asking for Stuff trying to check out you had to put things back on the Shelf you had to rewind tapes doing all this stuff and keep the store clean and maintain it and you had two people to do all this stuff including a manager who may have been in the back counting out a register or something like that so it was a really chaotic situation working at this

place for someone making minimum wage a 16 17 year old kid there was one other issue that really is the point of this whole discussion at Hollywood Video which is that we had a big problem with shrinkage now you may know shrinkage from the Seinfeld episode but shrinkage in the concept of retail is loss of inventory and assets and at Hollywood Video it was a sieve for this kind of thing um we lost all kinds of stuff all the time theft was a constant problem and that's kind of the premise here we're going to go through some of the things that happen at Hollywood Video and I want to give you a sense of why it

happened and what you can take away from it so when you create your own sort of threat modeling or come up with your own security strategy you can sort of keep these lessons in mind so why did all this stuff happen there was tapes cash and food constantly missing our inventories were never right we would lose money there are things I can't even talk about that we lost uh we should really want to know if those security controls that we had in place were proper was it the right approach or was it just we had lost because we weren't doing it in the proper way I think it's really also important to ask what was the actual culture of security

like at Hollywood Video did they actually care about security or is it just sort of lip service was it just something they said uh and what do people care about so what did the customers care about what do the employees care about what do the managers care about and what did corporate care about and what's the proper level of care because fundamentally you know I'm saying right now that we lost all this stuff there was all these losses and things like that but was that by Design what did Hollywood Video actually care about what is acceptable loss what is acceptable risk we really should get into that so let's walk through sort of a basic

threat modeling exercise obviously this is not a full threat model but this is how you should probably think of protecting some kind of uh organization so we had a number of assets at Hollywood Video obviously the first would be things like tapes and those are the actual tape things that we would have those cases uh there was also stuff like food so we actually sold popcorn candy sodas ice cream Etc and we had a ton of it it would come in all the time there's obviously cash in the register you know that people were very concerned about making sure that we didn't lose money uh it wasn't exactly a high Revenue place so if things were stolen

that would be a real problem uh I think it's really important to think about the operation of the store as an asset too so if the place isn't open if things aren't running if people can't rent tapes if the systems don't work there is no revenue and none of it even works in the first place uh finally the employees and the customers themselves so uh we were instructed if someone was came in with a gun or something and wanted to Rob us just give them what they want they didn't want us to get involved they didn't want us to put ourselves in danger for good reason you know they have insurance and things that cover

that stuff and also the customers need to be comfortable in the store right if Hollywood Video was a place where people didn't feel comfortable doing business then we couldn't keep making Revenue things wouldn't keep uh worrying about so uh before I go on I mean what do you guys think in the audience what do you think is the most important asset Hollywood Video has any volunteers sure maybe how much do you out of curiosity how much do you think a tape cost to rent in in 1999 like in other words when Hollywood Video would get a tape to rent how much do you think that tape cost Hollywood Video no actually uh if you were to buy you

know one of the popular titles we had back then was the movie Star Wars episode one and if you were buying a copy of the tape to rent you had to pay like 80 bucks a tape just to rent it because of Licensing stuff so losing a tape was actually a lot more than losing a tape you might buy at Suncoast another place that no longer exists um my argument would be that the asset that they cared about the most was probably the operation of the store and the employees because a lot of these things are kind of replaceable if the store isn't safe if its store is not a good place to work at or shop at I don't

think any of these things matter we had a number of threats and adversaries as well so I I put a couple things here so we had common thieves people who would come in and they might walk out with a tape or open up one of those tape cases and put in their pocket or steal candy or whatever or or whatever um but more importantly there might be someone who's actually dangerous you know I don't think fundamentally I was we were too worried about someone walking off with a tape life would move on but if someone came in with a gun or was threatening us that was something that was a real concern to the operation

of the store but there's another aspect and even though this guy looks really friendly with his bow tie and cummerbund and he looks like he couldn't harm a fly he's actually kind of an Insider threat because there's things like accidents uh compromises on policy which I'm going to talk about in a second and then just straight up dishonesty where employees would take stuff and I would definitely never have done that that's definitely not something I did at Hollywood Video as a kid we did have a few security tools in place to help protect us and make things a little bit better but you might notice that none of these things are particularly foolproof yes what you had

to do in 1999 was get a little membership card laminated so you could get permission to rent a tape and if you didn't have your membership card I'm sorry I couldn't rent a tape to you which was the cause of many arguments with customers we also had things like the locks on the doors the alarm system Etc but these were mostly meant to protect people from breaking into it and as you may have seen from the picture it was a pretty much a glass building if somebody wanted to get in they could have probably gotten in we had things like manager oversight um it might not surprise you that when I was making minimum wage the assistant

manager who would be in the store wasn't making a whole lot more than that so expecting these managers to be high level Security leaders was probably a little unreasonable we had things like an inventory system and a point of sale system that didn't really work well that unfortunately I couldn't find a picture of the actual point of sale system but it didn't totally uh um differ from that right there as like a blue screen thing that was extremely slow it barely worked at all it would print even at the time it was considered Antiquated we also had things like the lock box that we would use so when people wanted to return tapes we had this big container and you

can see it right there where people just slide things in it was locked up and uh in the morning somebody had to go go in and reach in and pull out all the tapes that were in there and we also had those little anti-theft things that are put near doors that make noise all the time that nobody ever does anything about when they make noise because people just walk right through them it's not exactly foolproof security controls so let's talk real quick about what actually happened at Hollywood Video and what actual stuff we lost so tapes and video games we had a number of issues the first thing that I saw all the time was a customer would come in and say

yeah I returned it let me rent another tape well you know according to the system here you did return well no I returned it and the truth is as an employee who is making not that much money I wasn't going to sit there and argue with them about it the job if they argued the manager would just let them go on and you'd rent the next tape to them there was other things like broken inventory things that actually did break you know VHS tapes were a little bad in certain areas you sometimes had to splice them and things like that I could talk all about that but there was also broken inventory where a customer would

come in and they would say hey this N64 game doesn't work you know Donkey Kong 64 isn't booting up I don't know what's happening and we had these two drawers that were filled with the inventory that was claimed to be broken now when someone comes to you and says this tape doesn't work it's not like I'm going in the back and testing the tape and doing all all this stuff are they saying the N64 game's not working I'm going to test it you just put in the door and give them the credit and then that's it one day one of my managers said to me hey Ben you know these you're a video game guy you collect video games there's

all this stuff in the drawer we need somebody to go test this bring it home and figure out what actually works and what doesn't and you know none of those games worked it's a mirror I don't know what happened to them they just none of them worked they definitely didn't stay in my house and I definitely don't still have them uh we also had things like common thefts I mean it's pretty self-explanatory um and other stuff like that another thing that happened to me personally was Cash losses uh one day I was working until five and my manager at the time told me hey just clock out and go home I'm going to count down your register

and we're gonna just keep it running and I see someone in the audience already shaking their head the next day I came in and the manager said to me hey Ben I'm gonna write you up your register was 40 bucks short I didn't take the money nothing happened but we didn't follow policy uh someone I didn't count down my drawer and so somehow the money wasn't aligned up the next day I wonder who took it um the food was also interesting so we had all this popcorn and candy and soda and all this other stuff and after a few hours managers would straight up tell me hey Ben go grab an ice cream sandwich go

grab some candy or whatever they just let you take things so they would give us a message that it's really important to track inventory it's really important to make sure the cash is right but go ahead and take whatever else you want just take things even though we do count them even though we do put them towards inventory so we were just constantly losing things there's also another incident I can't even talk about it was so significant uh why did this happen why were there so many losses why did this why was this such a problem a lot of this was based on constraints there was only so many things we can do and it's really

important that you acknowledge when it comes to security there are going to be limitations in what you can reasonably achieve the first thing is employee safety right we weren't supposed to argue with customers about what was done and what wasn't if somebody came in and was violent you let them do whatever they want you don't get in the way you just you just uh take care of them our inventory controls were terrible we had to do inventory once every few months and the way inventory worked is they would close the store entirely and they expected two employees to go through the entire store and scan every piece of inventory in the store probably 10 000

tapes and games and a countless number of other sort of things accessories candy whatever uh that wasn't really realistic and inevitably our inventories were always messed up and we were always losing stuff or things would come back you know all of a sudden you thought they were lost then you find them later in some other place um checking tapes was just not something that was going to happen and the store is just huge you just can't see everything that's going on in a place like this if somebody's in back is messing with things at the back wall I would have never known about it it's just gonna happen we're not supervising this stuff the other problem was just the bad

Management in place they had policies but nobody followed them nobody cared it wasn't enforced and we had a culture that was very permissive about taking things it was more about getting through stuff than actually being secure so what should you do with this information in my opinion the thing you should really do if you're trying to protect your home your your personal stuff your organization your business whatever is to create some kind of threat model Batman gets it Batman knows what he needs to do to protect his organization who has asked what his assets are who he's trying to protect what tools he has to protect the bat cave and other things in place and and

what's out there so what you really need to do is understand what your actual assets are and put a value on them it's not just things like cash or stuff it's things like reputation available to your of your service uh what people think of you their comfort level working with you these are all assets we need to think about things outside of the realm of physical traditional assets you should also understand what your adversaries are at Hollywood Video our adversaries were employees common thieves and robbers pretty straightforward stuff um but you might work in an organization where your adversaries are uh foreign countries and people who work for them it may be uh serious cyber criminals it

may be people you know sophisticated criminals who are really looking to do harm and then finally and maybe most importantly we have to understand the tools are in place and then really make sure that we've tested their effectiveness so we know if we have these tools in place are they getting the job done are they really protecting us the way they are and can we verify that so that we know if something's gonna happen at least we have the right things in place so anyway that's it I didn't want to we're kind of limited on time I wanted to give you guys lots of time to ask questions and most importantly uh contact us and so if you want I have a

QR code here that you can scan if you want a free copy of the book hackable um I will say I know sometimes people have issues with the QR code if you do just come find me I'll make sure you get it um check out the iot village Booth reach out to me you have my email you can contact me on LinkedIn whatever you want happy to talk with you about anything and with all that said happy to answer questions yes ship did you guys can use I could barely hear you thanks um in order for someone to sign up for a membership and get a card back in the day did you require them to fill out a

paper form to put their home address phone number and credit card numbers and did you enter that into a computer that everyone shared the password for uh sort of it was kind of like that so the way a membership would work if I recall correctly I would need a ID like a driver's license type thing I think I had to photocopy it so I had to keep a copy of their ID they would have to give me a credit card and I think it had to be like a real credit card not a debit card so we wouldn't accept that and we did have to key it in and the idea theoretically was well if we have their credit card in and

then they steal a tape or they don't return something we can just charge the card I don't remember a single time where we actually did that I think it was more or less that you asked for these things to sort of scare the customer into thinking they can't just get away with taking stuff forever it was a pretty in uh not tight system and I certainly think that the people at PCI or any number of things like this sort of practice would not be acceptable today taking all this information yeah what other questions you guys can ask any kinds of questions you want especially if they're nostalgic ones anybody any other questions yes was it the same at Blockbuster or were

they better or worse or we were way better than Blockbuster now uh it was a little it was fairly similar so uh Blockbuster in Hollywood I mean to be honest the reason I worked at Hollywood and not Blockbuster I mean I love movies I love video games I still collect video games and things like old retro games um Hollywood was walking distance from my house I could literally just walk there and then people could observe me walking down the street in that goofy uniform and stuff like that in the middle of the summer but anyway they're very similar stores they had a specific kind of culture they operated mostly the same was one better than the other honestly it was six to

one half dozen the other we would have things that they didn't have they would have things we didn't have I was envious that they got to wear Polo shirts and not stupid bow ties um I really hated that um but they're they're equivalent to me anyone else anyone want to ask any other questions anything yes let's he's got a mic I know all the video stores eventually went out of business because they became obsolete but um do you attribute that to uh Hollywood being incompetent or was it just no I mean the business yeah uh the business model so the question was like is it did Hollywood fail because of these kinds of issues or is it because

of something else I mean the reality is Netflix came along and destroyed this model uh streaming uh in particular ended what would make sense I mean people don't want to do this stuff you can still see the remnants of this with things like Redbox or which I think still is around where you rent the things from the machine uh or even like GameFly and some of these other services I think still exist to do rentals but the model is totally different now it's hold on to it as long as you want you know it has to be more consumer friendly just like streaming it has to have that kind of same convenience but you can

tell nobody really does it it's just not worth it nobody wants to drive to a store and pick things up it's so much easier just to pull something from uh Netflix or Amazon Prime video or something like that yes if I approach you afterwards uh would you be willing to talk about the situation you can't talk about uh a little bit I just don't want to talk about publicly but we can talk about it all right it's a big deal but I'll talk about it I want to know about what happened it's pretty it's pretty crazy anybody else anybody else Bueller all right cool all right all right wonderful can I do actually can I do a little selfie with

you guys is that okay

can you just like raise your hands

thank you so much everybody all right give it up for Ben [Applause]