>> Hello... Alright, we're here. Thank you so much for coming to DEF CON and umm, also for coming
to our talk here on how to disclose and exploit without getting in trouble. As an
initial matter, you should know that uh, I have to tell you I guess. I'm an attorney >> Boo.
>> Just put that (Laughing) >> Yay. >> Actually I am an attorney, I represent hackers.
And uh one of the things I think you might like about this talk, I hope, is that, in addition to
TOD's excellent portion of it. Is that this not about the law. It's not about what the law is.
It's not about what the law should be. I uh don't like going to those talks myself. And I
imagine you like them even less. What this really about is it's about trying to keep you safe,
enabling you to continue to do the research that you want to do without getting in trouble. It's
that simple. And there's basically a few pointers that we're trying to get across and
some techniques and some ideas about how research can be done and how disclosure can be done
that will increase the safety for the research community. We can't -- one of the things we're
not going to be able to do is completely eliminate risk. This is sort of a risky business in a
lot of ways. And what we can do is manage it and we can be aware of it and we can reduce it and
mitigate it as much as we possibly can. So with that said, I should tell you this is part
two of a talk I gave in a 20-minute slot here last year. It's worth giving an update on,
because some things have happened since then. In particular, the United States
department of justice and their computer crime section are now actively engaging with the
research community and they're getting together. They're having sit downs and they're looking
for a way forward because they recognize that there is potentially a chilling effect to
the way computer crime laws are being interpreted and being enforced. And they recognize
there is a public good in research that's going on and they want to find a way to make
sure that the bad guys or the right bad guys, as we define them, are deterred from doing
bad stuff. But the good guys are still enabled to continue to do what they do. So as an initial
matter, I should introduce. Oh my God oh oh >> I work at Rapid 7. I work mostly in metasploit.
Maybe you heard of it. And I deal with a lot of disclosure issues all the time. We
sometimes find our own 0-day and then go through a disclosure process that is pretty easy and
straight forward. Sometimes people come to us and say like hey I have this awesome bug and
I don't know what to do with it and so we just kind of help them say what we think they should do
and sometimes people just drop 0-day on med display in the form of a poll request so hurray um
you know I think that approach is totally effective at getting some attention on it and it's
probably the highest possible risk you could take. Especially if you are standing in a
jurisdiction that shares jurisdiction with the vendor that you are dropping 0-day on
and that could be a problem But anyway, I'm Todd. That's my PGP key the first one is the one
that lived on my phone. So it's okay. The second one lives on um in here actually, it's here. So,
good luck. And that's it. >> So my contact info is here as well PGP, red phone, tech secure,
sound circle, et cetera. Twitter as well. Anything works. So this again is an over view of what we
are gunna cover here is two types of risks, the risk that comes from the activity, the
research activity itself. And then there's the risk that comes on the back end when you
disclose the research that maybe no one else knew about before. Risk mitigation strategies some
ways you might be able to do disclosure while keeping that risk to a minimum. Overall the
point of this is to make yourself a harder target. Okay so what are the kinds of the
activities, it is always worth getting this out there. What are the activities that are
potentially risky. They are on a spectrum there are no real answers there are some things
that are probably not too risky and there are some things that are really they are much more
risky. On the sort of less risky end one might be changing an ATTP query strain and seeing
somebody's utility bill. This seems like a relatively innocent thing. Technically yes this
could be a violation of the computer fraud and abuse act. We will get to why this is not a
big risk for you if you do that. But technically, this is technically a violation of a law
in almost any context. Another example would be you find out your neighbor's WiFi or no
password and you're able to access files and see some things on that net work. A little more
risky, you break some DRM or write a better RAT and start using it out there somehow. So
the risk, the bad things that could happen, your research could get buried. You could be
barred from disclosing it by court order usually by a vendor perhaps or there maybe some
pressure from a government who is also interested in this not coming out. You might get sued
and umm, you might accidentally disclose a zero day. So all these things happen, I don't
want to put too negative a spin on it. Because there are some rewards for disclosure. As you
can see, It's just not -- it's not really that bad. Kind of. But really just I think as we'll
find out the best you're likely to get is some recognition hopefully, if we do it right,
that'll be it. So the main thing everyone's concerned about right now is the computer fraud and
abuse act, because there have been some high profile prosecutions of some members of
the community that have a lot of sympathy. And the sort of act of, without going into the
details of it because we don't need to in for presentation, is the meat of it, the ambiguity
that causes so much trouble is that what you need to do to follow in this statute is to
access someone else's system without authorization or exceed the authorization that you had
been granted. And it's very hard to figure out what is authorization? How is it
granted? Especially when you're out in a public internet, because we're not engaging in
this back and forth, can I be here? Okay. Come in, no you just show up. That makes it really
hard to answer the question. But we can kind of break it down into a simple checklist. If you
can check all of these boxes, there's going to be some risk. Are you connected to your
internet. Well if you are just in your own box doing your own thing, you might do something
else that runs into trouble, but at least you don't have this problem. Are you accessing a
remote system that's not yours? Do you have permission to access it? We don't know right, That's
what we were just talking about. And did you obtain information? Probably did. Otherwise what
happened? It's not a valid point of being there if you didn't. Here's some examples and this is
really where people start getting concerned. Because these are not, the point of these
cases is to give you an idea of what kind of activities are to be charged under the computer
fraud and abuse act. In some of the cases the charges were ultimately dropped or dismissed
or reversed on appeal and so on. But this is not about the law, this is about am I going to get
arrested? And even if win in the end, this it's already too late, so what kind of things that get
you in trouble in the first place? Since we're in Vegas, a good one to mention is the case
of Nestor who exploited a bug in video poker. And what he was able to do is play one game. And
switch into a bit up and switch into another game and get out these huge pay outs. He didn't
actually connect anything into the computer poker machine, didn't change any code and
didn't hack a machine. He caused a code that was written for that machine to execute the exactly
the way it was supposed to execute. It just gave out too much money. He was charged under
the computer fraud and abuse act under a hacking statute for that. There is another defendant
that had other people use their valid employee log in credentials to obtain
information from the first gentleman's former employer. No one hacked anything, but access
was made to that system. Of course there is the case of Aaron Swartz who, among other
things, spoofed his MAC address. Andrew Auernheimer who had a script to run queries on public
facing API and get a lot of e-mail addresses and then Jeremy Hammond who pulled whole lot of
e-mails out of Stratfor. These are the type of activities that you are the subject of high
profile computer fraud and abuse act prosecution. But there's also the risk of civil
prosecution. And ironically, you are far more likely to be sued on the civil side than by the
criminal side. There's hundreds and hundreds of cases where employees, actually, get sued by
their employers because the employee has been terminated or left for some other reason and
decides to take some documents with them. So this is, usually there's some other trade secret
claims, other intellectual property claims that you see in these cases but the computer
fraud and abuse act gets loaded on with that too. But, even though some -- even though many
of the activities that these researchers were engaged in seem to be just really basic things
that you should be able to do, why can't I query this public facing API? I can do this all
day long, that's not unauthorized, they made it available right? So no passwords
were required to do it? But what we find, what you'll see is that in the cases that are getting
actually getting prosecuted, there are these aggravating factors, these extenuating
circumstances that make that prosecution feasible and make it happen. This is what we want to
cover. We want to get to a point where we know that if I do X, I can not run into legal trouble.
Well we could have another talk with what that law might look like. That's not the law we
have. But none the less, we can take the look at the cases that are out there and see what these
people did beyond just the technical act. And this is where you can reduce your risk,
because even if you have to hit that public facing API in order to do the research, there may be
no other way to find out if the systems work. So you may have a technical violation of the
computer fraud and abuse act, but the question is, is the DOJ going to come and get you. In
the case of video poker, this guy didn't just find out this bug, make a hundred bucks and
say cool, and disclose it to the vendor. He made, he pulled out over half a million dollars of
the machines to do that. Great, great use of the exploit. But that's going to, grab a, that's
going to get some attention, right? And in the case of Nozzle, where you're -- he had
used the -- he had other employees in the company use their valid credentials to
download highly sensitive documents that he was going to use in a competitive way against
his old employer. Aaron Swartz entered the premises to connect equipment. Maybe that certainly
might not have been a dispositive reason why the prosecution continued, but it
certainly heightens the stakes when something like that happens. Of course Andrew
Auernheimer , famous as a troll, that made him less sympathetic as a defendant. And beyond that,
he harvested over a hundred thousand e-mail addresses. And certainly far more were
necessary to prove that, to make his point that the system was insecure. In the case of Jeremy
Hammond the intentional disclosure of the sensitive documents for the point of
making those documents public as a statement. So there are some -- in this context of this
really over-broad statute that everyone recognize sweeps in legitimate security research and
in light of these aggravating factors that seem to get the attention of the department of
justice in bringing case, the question is well what do we do? What it's a take away? With
respect to the research itself, stick the proof of concept. Don't go beyond that and hold
down a hundred and ten thousand e-mail addresses. Hold down ten if that's what it is, and then
you can do this responsible disclosure as we'll get to in a little bit. That'll keep it much
safer, and makes it look like a legitimate researcher and not somebody with an agenda and or
on a mission. In disclosing, be professional. I can quote Mr. Pink from Reservoir Dogs "We're
supposed to be professionals right? " I, keep it that way. And in that regard, one of the
things you really got to be careful about, and this can't be over emphasized, when you make a
disclosure, don't ask for anything, at all, Because then it starts to look like
extortion. I know even if intentions are good, I'm sure we've all heard many cases where
this happened or been involved in them yourselves where you approach a vendor and they
become very hostile to the disclosure right off the bat. And once you're in this
adversarial relationship, it could go bad quickly and to the extent you've asked for
anything. Even disclosure, if you've asked a vendor to disclose it even that could be
taken as a threat. So nothing, don't ask for money, don't ask for recognition, don't ask for
disclosure and don't is ask for employment. Any of those things, you're welcome too, to do that,
of course, but these increase, this is about we are trying to decrease the risk of getting in
trouble, that will decrease the risk. You can ask for anything you want. You get the risk that
comes with that. Beyond that, when you're making a disclosure, not just to the vendor, but if
you're blogging about something you found, you want to talk about it, there's some basic
things you want to do that can help keep it safe for you. Seems kind of obvious, maybe, don't
direct technique information if someone you know might use it illegally. That starts heading
in the wrong direction for you. In that vein, be careful providing support. If someone
has questions for you about your, the vulnerability and you're not sure exactly what
their intentions are or who they might be, I'd be very careful about answering questions or
discussing it further. A few more points Don't, consider not disclosing, not discussing it
directly with individuals. Keep it, the keep the public, so you don't get, so you reduce the
risk of having conspiracy with other individuals. Don't prompt it on forums that known to
support or promote illegal activity. Maybe disable comments to avoid being in a conversation
about it with somebody who might be using it illegally. And then of course, use secure
communications as much as you possibly can. (Accumulative chatting.) >> Well go on >> Ah
this is great. Do I get to too? >> Oh you think so now Raise your hand if you're a new
speaker today. (Applause.) >> We're not kidding in the last one there was a situation like
this and the guy in your position got Jack Daniels spilled all over him. So we'll
give that to you. >> Cheers >> To our first time speaker! (Applause.) >> Thank you.
Delicious. Alright so going on >> Go ahead, keep doing your thing >> Thank you, thank you
so much. >> Nice work, congratulations >> I promise I am actually part of this talk
>> We will switch over in a second. Some basic ideas about disclosure here, you might want
to think about whether or not you've done everything right, as you're making your disclosure.
If you that, if you feel very confident in the fact that you haven't broken any law and
nobody thinks you're breaking any laws and your clearance is not gunna be at risk. Go ahead
and acknowledge your identity and put it out there and have the have at it. Absolutely,
there's some others, we'll talk about some additional ways that can happen to do that
responsibly. One of the things you might want to consider if you're a little bit concerned,
but not terribly concern is to offer that vulnerability up with a, well we'll get into this in a
minute. Let me hold off on that. So, as we were saying, if you aren't sure if you did
everything right, you may want to stay anonymous. I'll have more about how to make that
happen effectively. As a last note, I want to introduce this concept to everyone and get some
feedback. The goal here is just to get some feedback to the community. One of the things I'm
working on, in connection with the good folks at Bug Crab, is an open source responsible
disclosure frame work. What we're trying to do is essentially create a procedure,
a process that we can all kind of agree on that will enable researchers to continue to do
their work, enable companies to accept that work, and reduce the risk. Again, it's about reducing
the risk to researchers and reducing the risk to the companies so everyone can be
comfortable with that and there by promote the research. So you can find this online if you
Google That. The basic concept, is that the company, whoever is being pen tested essentially,
publishes their scope ahead of time. What kind of domains you look at, what kind of tests you
can run, what you can hit, what you have to stay away from. The researcher agrees to stay in
scope ,of course. And that includes avoiding pulling out personal identifiable
information, disruption to the service, or whatever else the company wants to keep off of.
And in exchange for that, the company agrees not to pursue legal claims against the
security researcher. And in exchange for that, the vendor, sorry the researcher will agree
to keep the bug confidential for a period of time until a patch can be put in. So anyway we're
just going down this road now and kicking around these ideas and we'd be delighted to hear
any feedback that you might have, and with that. >> Hello, cool so, one of the things that
you need to do if you're going to be disclosing through an attorney, as we, as I did a
couple months ago. You have to train your lawyer. I don't have to train Jim at all. His name is
Cyber Law on twitter he knows kind of what he is doing. He's got the text secured. He's got
the red phone, and the PGP. I asked him yesterday, so when you go to your bar association
barbecue, how often do you talk about PGP and secure mail, he's tells me it never ever comes up
and this is a problem. So one thing I want to do is figure out, how do you train your
lawyer? And so last year when Jim presented, I saw his talk and he said some things that I
thought seem a little fishy. So we worked out a procedure where in we could pen test it, we
could test drive it. How do I disclose anonymously with my attorney cut out? And the
biggest thing I get out of that is this notion of attorney-client privilege, and
umm, the idea is if I'm a vulnerability researcher, I can find my valn, I can see if that
works. I can try not to violate CFA too hard. And then hand it over to my attorney. And say,
here, you go. I need to talk to these people. Don't mention my name and if they ask you, say
just no thanks. And this, we believe, is fairly effective. Unfortunately, we didn't get
investigated or prosecuted by anybody. So we really couldn't get to that end point. So maybe
next time we'll give the DOJ a heads up or something. The biggest thing we need to do
though is, obfuscating the meta data of the material you hand to your attorney. When I do
vulnerability disclosure, I'm almost always am armed with a metasploit module. One of the,
if, if I hand over a metasploit module to a vendor or cert CC or whatever coordinating body I am
handing it over, I'm pretty much giving away who that author is. It's a really great paper. It's
the authorship analysis in cyber crime investigation. It is the tiny little URL there, but just
Google it. You'll find it. It's -- I think it's fairly seminal. It gets cited a lot and it's all
about authorship analysis. Some people do -- sorry, some people do like you know, they will just
always have like a return faults unless not, not, something. Which is a bizarre way to say
true, I think. I dunno it's really hard, it gets uses and this looks like a fingerprint.
You can fingerprint people off the code all the time. So first step is don't provide proof of
concept code unless you secure this hold harmless clause, because otherwise, if you open
with that, you've given up the game. So that's the big thing. When you go down this path, the
big thing you have to know is your adversary. If you are going against a uh, if you have a
disclosure that you believe would be interesting to the NSA, don't talk on your phone, all
that stuff. Don't talk on the phone, don't get photographed with your attorney, and don't do
anything on your computer and should probably just walk away. There's very little you could do
to defend against that adversary. If you're merely dealing with a litigious
multinational corporation, chances are good you can still talk about this stuff on the
phone as long as you're aware of like where you are and who you're with and your bosses is
one cube over and maybe you're dropping 0-day on your employer, like don't do it at work,
obviously. Which has happened, we've had, I haven't had anybody - not lately at least, I haven't
had anybody at least drop 0-day on their own employer, at least through metasploit. If you're
doing it on some free and open source software project, again you could probably talk on the
phone, you could probably meet up a lot. You could do a lot of clear text e-mail. You don't
have worry about PGP. It's a shame PGP is so difficult. How many people ever tried to teach
a non-professional PGP and was successful? Hey look at that. That's like a solid half a
percent? Yeah. Congrats. (Laughing) just keep up that good fight. Text secure and red
phone are both fairly easy to use. And umm, but they have their own issues, by the way, if
you try to text secure me, I can't -- text secure believes I'm a user of text secure so all
I get cyber text so don't send it, do it for Jim al day long. If it's an important free open
source software project, you might want to tread a little lightly cuz again, you may be
attracting the attention of things like the department of homeland security, whatever the
equivalent is in your home country. You want to air on the side of anonymity at least until
you get a hold of this hold harmless clause. But it all comes down of taking some kind
of reasonable precautions. You don't have to be super cloak and dagger about this. More is
better, but it turns out, secure communications is really hard, me and Jim are both like pretty
well versed in security. And we screwed up like at least three times. We totally gave away the
game. We were using PGP and then at one point, one of us, I'm not naming any names, mentioned the
vendor in the subject line of the e-mail. Whoops, so like if we were actually trying to like
avoid attention with the NSA that would have been not greatest. Oh and the other
unspoken adversary all the people that like all the people who like to drop docs on
hackers. If you're 0-day in your e-mail in the clear, you may find that you get your stuff
disclosed before you are planning to, right? So moving onto our case study, so this is
a vulnerability that is present in Yokagawa's Centium 3,000 Human Interface System, This is
a piece of software. Yokogawa makes a human interface system disc data software that runs on
Windows, like you do. It controls things like really expensive turbines and factory
floors and all that stuff. It's real popular in Japan, not so much here, but they have a have
a fair number of customers in Europe, UK, I'm almost positive in Russia and probably Ukraine.
So, what this bug does is we've, somebody, I'm not naming any names, discovered this. And I've
learned about it and said hey Jim, I totally have an 0-day for you. Let's test this process. So
we did it. So we went through, what happened was, let me back up a little bit. You can see the
details. I don't have to read this slide to you. I think it's published on the blog now. Yeah
if you go there you will see all the details on it. That's what I was doing over here I was
prepping it up and finishing it up the blog. That was fun and then drank. So our disclosure on
this was sometime after the last DEF CON, Rapid 7 and Jim we entered into an attorney-client
relationship. On April 14th, we -- I'm obviously blowing Rapid 7's cover right now. But that's
okay, because it's important to show that we actually tried to do this and it was really hard.
On April 14th, I disclosed all the details to my attorney. And then we had some negotiation and
back and forth on how we're going to present this. And this is where we came up with the
whole authorship analysis thing. And gee, we probably shouldn't give the metasploit modules. One
of the best things we did -- well let me back up a little bit on, May 1st about two weeks
later. We offered the details. We, Jim, actually wrote to Yokagawa offering details of
this vulnerability in exchange for some hold harmless thing. Which by the way I don't know is
this exchange for hold harmless thing not extortion too? I don't know. I don't know. Maybe it is.
Like I'm going to promise not to sue you and that extortion, I don't know. But any way, they
didn't reply at all. They didn't get angry, they didn't demand to know who it was, they just
didn't say anything. And I'm suspecting that when people get random unsolicited
communications from attorneys, that is probably the way to go. You don't -- maybe you don't
want to talk to they will. But we are offering this vulnerability details on their
software. But they were not -- I don't know why they didn't respond, but they didn't
respond. On June 25th, after giving them several weeks to give us some kind of guidance on
what they want to do with this, we disclosed to Cert CC, not to be confused with U.S. cert, they
are totally different. We disclosed to Cert CC. Fairly complete details minus the
metasploit module of course, but we have a nice PDF about it and talking about all the technical
details of this bug. Which by the way, the bug is, if you are on the same net work as one of
these things, you can use some undocumented UDP based commands to rewrite the file system that
is all, so it's pretty good. And so then today, details got published right there. I did it.
So here's some source code. Because it's not a DEF CON talk without source code, I'm going
to step through every line. So hang on. You can read about it yourself. It's up on the blog,
up on Github. It's merged to master right now. If you happen to have access and authorization
to own some Yokagawa gear, you're -- today's a good day for you. This is a disclosure doc we
sent to Cert. Like I said, it details out fairly completely what the vulnerability is like
hey maybe you should put some communication mechanism in front of these like store and reter
commands instead of just like letting them get run. And umm, the surprising thing to me was,
I wasn't super surprised that Yokogawa didn't reply, I was surprised that we didn't get
much response from Cert for this. I deal with cert a lot as under my own name, but Jim I
guess doesn't deal with cert too much so maybe they don't know who this dude is and maybe they
think it's a scam or something like that. But we didn't get any reply from them. I'm super
curious to talk to them almost immediately after this talk. And I was hoping Art would be here
but he's not. Anyone work at cert CC? No? Aw guys, gosh you should totally come. Well I'll
hook up with him later. And I think that's it for my part. I've already disclosed one. You
can see what it is. Obviously by disclosing it I'm blowing my cover, but the point of this
particular flavor of anonymity is that we wanted to keep -- we wanted to be able to give this
talk and be able to disclose a vulnerability. Imagine I just did a whole long boring talk
about Yokogawa. I want to be able to do that. The point is it's not anonymity forever. It's
anonymity for three months or four months or something like that. That's fairly useful for
people in our community. So if you have bugs to disclose, feel free to tell me. Maybe retain
Jim he was super cheap. (Laughing) in fact, I think I make money out of this deal
because I'm the co-speaker too. But yeah, that's all I got. Anybody have any questions?
Please go to the mic in the middle. Ya know climb over all each other to do it and uh riot.
>> So Jim, you know this, the hold harmless agreements don't bind criminal prosecution. And
lawyers are prohibited from using privilege to protect conspiracy to do criminal
activity. Doesn't this just mostly kind of theoretically protect against the DOJ and then
they are still gunna smack you around? >> That's a fair point. It's not possible for anyone
except the department itself to say, okay, we're not going to pursue this accident. And even
then, I've spoke with the people in the department, that said can we come -- can we create even a
no action letter sort of thing where we would be able to, the department would say, we don't
think, it would be great if you had a letter from the department of justice, we don't think port
scanning is a crime. That's all you do is port scanning. This is okay, you can't even get that.
So for sure, even if you have this agreement with Yokagawa or whoever it happens to be, give
us the deets on this bug and we promise that we're not going to sue you. But it can go further.
It says we don't sue you, we don't chase you down assuming you are not misrepresenting what
you did if you did something really nasty and you're not telling me about you're telling
me you did this but you actually did that then of course the agreement is not going to fly.
But if you're being honest with me and your telling me you did this or you didn't do whatever
the bad thing is that we think you might have done. We're not going to come after you
ourselves. They can go a little bit farther and say we're not going to support a prosecution
by the department of justice. And that makes a big difference. Because you know >> And
subpoena, but JSTOR didn't support the Aaron Swartz prosecution and look where that
ended up. But MIT did. So that's the difference. When -- so the cases come out in a couple
different ways , CCIPS the computer Crime and Intellectual Property Section of the
department of justice can do its own investigation if it has reason to believe something's
going on. Or some aggrieved party comes whining to the department saying these people
are hacking my system and you need to do something about it. If you are AT&T and do that the
department is gunna listen. If you don't go to them, the department is not, no one can
promise. That's the thing no one can ever promise. But I sit down with folks from DOJ and they
tell me we're not out there hunting the internet for people who are doing slightly fishy
stuff. So it's risk right? It's risk at where you draw the line But we can -- the best we can do
is reduce the risk so people can continue to do the research. >> So if I find an exploit I can
hit you up and you're gunna do it for free, because I know my local lawyer is gunna be like
what are you talking about and ya know I have a thousand dollar retainer. How are we expected to
go out and find an attorney to do this? Because I don't think that is something reasonable for
us to do and pay out of pocket. >> There is a really big interesting question out there
with respect to scale. Right? So we did one bug. And it costs, it's not a -- a dollar would be
too much to pay for this sort of thing. But if you have thousands and thousands of people coming
through the system looking for this measure of anonymity of disclosure to attorneys, it's
not, there needs to be some way to make it work. It's not real clear what that is yet, but
that's definitely an issue. >> So question is any devices coming out from unknown Chinese
vendors with vulnerabilities in them? >> I'm sorry can you say that? >> Devices coming out from
Chinese vendors and their vulnerable and these Chinese companies are. Many times you
don't know who they are, no e-mail address or whatever. And how do you deal with those.
>> With things like that, we have run in with that before with metasploit. Typically what
we do is make some kind of effort to find out who it is first. That generally doesn't go
anywhere. So we get in touch, I work with cert CC a lot. And they have a nice long list of
people that they can talk to. We have gone through cert CC and generally cert CC will get in
touch with someone like JP Cert or Cert CR or responsible entities in china, whoever they
are. Possibly they know who it is. The main concern we would have is not so much, you know,
I'm an American, I'm standing in America, and uh, I'm happy to help the people of china. I'm
totally one to do that. But it gets really hard really fast because there are languages
barriers and there is time zone barriers. So I could usually make a play like ICS cert or
department of homeland security and say hey, we have all these boxes of unknown origins, ya
know anybody? And it is, it's a very personal kind of process with a lot of people talking to
other people. It doesn't scale great. But it's -- that's how we do it today. >> So presumably, a
cy -- cyber lawyer would have a fairly finite list of clients. And portions of that list would
be exposed during the litigation. So wouldn't the, wouldn't just communication from
that particular lawyer be a risk of losing your anonymity? >> The fact of the attorney client
relationship itself is confidential. And the identities of criminal defendants in a
criminal case would be. So for example, if someone came to a criminal defense attorney and
said you know I robbed this bank. That is confidential information that only the
attorney has. So it's -- attorney client relationship is probably the most secure
relationship that you could build in terms of disclosure that involves potentially
criminal conduct. >> I know what you're saying here. You're asking more about traffic
analysis. If I'm e-mailing Jim in space and Jim is known to sometimes disclose bug, it gets
real easy real fast to figure out who's talking. So obviously you would want to, if you're
really that concern, again, your adversary, if my adversary is GE or AT&T, they're not, unless
it's AT&T's network, they're not going to be, really have a lot of reach into like getting a
hold of my e-mail. Sure they can subpoena it. They could try to subpoena all day long. Good luck
subpoenaing an attorney for all their points of contact. I don't think any judge would ever do
that ever. They could try to subpoena me, but they already know who I am. I can have
throwaway e-mail addresses and use have PGP because I know his key and that's how Cryptography
works. I don't have to ask him for his first. So I could just say, hey Jim this is Todd and I
know I'm on like hot dudes 22 at Yahoo. But it's really me I promise. Or something like that.
You know? That's how I would solve it just throw away. >> I had a question, like
clarification from the example you present. There was no response from the vendor. But
like if they had responded in a really adversarial way, like if you're a researcher and you get
an unexpectedly hostile response from the vendor, like what should you do then or like how
do you approach that? >> Hire Jim! >> Yeah yeah, you hire Jim, he's very reasonable. So
generally, we have gotten -- I've gotten hostile responses from vendors like that weren't
this. I've disclosed a lot and when we do that, we just, generally try to calm them down,
we assure them we're not asking them anything we're not selling them pen testing. A lot of times
they'll get on the phone and say what do you sell me here? Because I don't need like pen
testing services. I'm like well A. you do, and B. we're not selling that. (Laughing) so I
mean, it's, generally, it's talking like sometimes you have to talk on the phone and be a
person. You know, it's very human hacking to kind of walk them off that edge. >> Thank
you. >> If you're going to go the lawyer disclosure route, where would jurisdiction fall
in? I don't know if that's necessarily the right term, but let's say you live in one state.
Your, the target or, you know, the software group or whatever lives in another, lives works or
whatever. How'd that play in? Would it play in? The answer is jurisdiction never found in New
Jersey. That's for sure (Laughing) . >> Yeah, got to make a New Jersey joke >> That's
a real issue. Because in weev's prosecution, they bought the case against him in New Jersey
and that was THE basis for overturning that conviction. So it doesn't, where matters.
>> Assuming we can't afford a lawyer as a researcher, is it reasonable to contact a vendor
or try to contact them using just a website e-mail then you don't get a response as
indicated and you disclose publicly on a blog or something >> Right. Right right. Yeah,
exactly. Just for the record, this sort of disclosure intermediate thing is not
something I would charge money for. This is something I just do community. It's a project we're
working on. It's not like a service for sale, to be honest for you. And it couldn't scale.
It wouldn't make any sense to do it. To answer your question, that's really I think an
opportunity where this hold harmless agreement could come in. If you're going to stay
anonymous behind the attorney, the hold harmless is not as necessary, because you can't
find out who to go after any way. If you are going to have an identity, this two step process
starts to make sense where you reach out to the vendor and say I found something and I can tell
you about it, but I'd like you to agree not to come after me or support prosecution. There's
going to have to be some negotiation back and forth. If you do something really
horrible, they're not going to be like fine I really do care what you did. I think that can
be worked out, but if that negotiation process can complete successful that would enable
independent researchers to go to companies. And of course the other option would be
>> Metasploit? >> Yes the metasploit module. Exactly do that. >> Like I'm not an
attorney and can't offer the attorney client privilege, but I've done it before for
individual people. They'll come on IRC or ask me on twitter for some reason. Or e-mail me. They
are like hey, I have this bug I don't know what to do with it. And generally I say we can help
you with it, we can write the metasploit module, that's what I get out of it. And we generally
just do, we tell the vendor, we wait 15 days. We tell Cert CC and we wait 45 days, we publish
the metasploit module. That's generally how we do it. It's working so far. I'm not in jail
yet, and that's the door. (Laughing.) >> That's it, Thank you so much for coming
everybody. (Applause.)