[Applause]
last winner I asked my mom how I might
approach today’s talk and then she said
this is my mom when you were a kid you
always loved that outerspace stuff and
computers so maybe you want to begin
with that and then she said you probably
want to talk about your injuries
well mom knows her son this is really a
picture of me and the flash talking
about how we might save the earth
save the universe from the bad guys when
I was a child watching television I
watched people ask computers questions
and then receive answers then I watched
them use a starship to hurt technology
to navigate a starship across the galaxy
at the speed of light I knew that when I
grew up I wanted to work with technology
but going into the sixth grade I still
couldn’t read
finally a teacher noticed my problem
finally contacted my mom took me to the
doctor many visits and then this led to
eye surgery to correct my double vision
this meant that I could finally begin to
learn to read and it also meant that it
was time for me to get up and make that
happen my high school career turned out
mostly okay but when I graduated I still
wasn’t ready for college and this was my
own fault because my mom always told me
you have to go to college so I thought
that I would be in good shape
going to college then I finally did get
to go to school but first I joined the
Coast Guard and a few short years later
I found myself stuck in a low wage job
raising three children attending night
school but hey I mean that wasn’t bad
right I was taking care of my family
going to school
then one evening a driver ran a red
light and smashed into my car leaving me
in the words of my many doctors 100%
permanently and totally disabled I was
lucky though because I had good health
and disability insurance which paid for
me to get back to school and then
eventually to return to work but I was
still totally disabled for over five
years and because of my disability I
lost my job my house and almost my
dignity
if you’ve ever needed to apply for
welfare food stamps or subsidized
housing you get it I found it to be a
humbling and sometimes humiliating
experience but I was extremely grateful
for the help I received and I learned a
lot about myself in the process my body
was so broken that it usually took me
five minutes just to stand up from a
chair and when I finally was able to get
up has drenched in sweat and somehow I
was able to attend college and then my
pain became manageable so that I could
restart my life this meant it was time
for me to get back to work so at this
time I finally rediscovered my love for
technology and decided to jump back into
the field by studying software
engineering if you’ve studied software
engineering you know lots of computer
programming and eventually received
training and servers routers and
switches more computer programming and
eventually and today I seem to be
focused on data forensics and ethical
hacking I think back sometimes to the
technology free life that I led as a kid
and then compared it to the big role
that technology plays in my life today
and it seems like a dream think about it
almost all human knowledge is available
to anyone who owns the device that fits
into a back pocket we can learn about
anything if we just want to I can post a
picture to facebook when I’m at the top
of a mountain many people work from home
and most of us bank and shop online
right
so these are just a few of the good
things that technology makes available
to us unfortunately along with the good
comes the bad and by the bad in the
context of our discussion today I mean
hackers and crackers hackings been with
us for ever it seems as matter of fact
in the early 1900’s a hacker figured out
how to replace a running Morse code
message with his own message so hacking
really became a part of our culture in
about 1979 when hackers realized that
they could manipulate telephone tones to
provide themselves with free
long-distance telephone service which at
the time cost several dollars per minute
and then it’s strange that most of us
don’t even know what long-distance
telephone fees are anymore we should
stop for a second to say that that
people were fighting against aren’t just
the hackers we’re fighting against
another group and they’re commonly
referred to as crackers so hackers may
attack us for whatever reason while
crackers are interested in making a
profit off of their work they are money
motivated so crackers might attack us to
steal our identity to use or sell it to
break into our bank account to take our
money or even work to influence the
outcome of an election hackers like
crackers can have a lot or just a little
technical skill so then guess what it
happened about 18 months ago someone
tried to scam my wife Greta and me into
purchasing a used camper for what seemed
to be a good price on Craigslist the
scammer went by the name of Rebecca and
she told us that her husband had just
died leaving her with three small
children and that she just wanted to
sell this camper Jeep as soon as
possible as you can see she provided us
with what appeared to be an authentic
eBay invoice and then she said go to the
store and go purchase several PayPal
gift cards scratch till the numbers that
are located on the back side
then take pictures of the exposed
numbers oh and finally email all of that
to me then she said fax all of that to
ebay because then they will release the
camper to you completing the sale she
called this an eBay quick sale right
we’ve never heard of such a thing either
so my wife Greta gets online does a
quick internet search and finds this
very tactic to be an online scam we even
found the same image images being used
in other scams so I got busy trying to
trick Rebecca into a meeting or calling
me I even tried posing as a senior
citizen who knew very little about the
internet and nothing about making
purchases online nothing I tried worked
so we finally decided to report the
incident to the sheriff and to the FBI
because scammers often live outside of
the United States and because the
authorities receive reports of incidents
like this all of the time we weren’t
surprised when they weren’t able to help
us so I got the thinking what can I do
to stop or discourage people like this
from using the internet to successfully
shake people down especially senior
citizens like my mom who usually have no
idea as to the danger that these
criminals pose so after I spent some
time thinking and doing online research
and came across three technologies that
cyber security professionals might
consider putting into place or even
modifying to identify and capture these
criminals now the three technologies are
the watering hall steganography and file
streaming let’s use my craigslist
experience to explore how these three
technologies might be used to protect us
online file streaming is a technique
where we programmatically attach a new
file which I refer to as an appended
file to the end of an existing known
good file for our purposes the appended
file contains computer programming code
and better yet when we look at the files
on a computer screen they appear as one
file this means that if we send such a
file to an attacker and they click to
open it the computer programming code
hidden and embedded in the appended file
can run automatically the computer
programming code can be used to allow us
to capture data some of the data we can
collect is their location browser
information as well as information about
their operating system this technology
already exists and can probably be
implemented by anyone with average
computer programming skill one drawback
though is that its success depends upon
the attacker being somewhat
unsophisticated in technology another
technology we might put to work is known
as a watering halt as you probably know
wiring holes in the wild our isolated
places that every animal in the area
must visit to get a drink right the key
is that they get that drink the animal
must come to the watering hole to get it
usually a great risk in a technical
watering hole scenario rather than us
emailing payment images to the attacker
the attacker is directed to a website to
download them the catch is that when the
attacker connects the website computer
programming code hidden and embedded in
the website’s homepage can run
automatically allowing us to capture
data the same data that we captured
using file streaming this is just a
sampling of some of the data that we can
collect by the way your browser whatever
device you’re using sends this
information that every website that you
visit and the Internet Protocol or IP
address is like a complete street
address this means that we can use it to
calculate the GPS coordinates of the
device associated with that IP address
and you see that on the slides graphic
so we use the IP address to calculate
the attackers location and then web
programming to learn
the rest well this might seem to be a
good solution it assumes that we can
entice an attacker to come to our
website to gain access to the payment
images which may not always be true and
as before this technology already exists
and can be implemented by anyone with
average computer programming school
skill I say that lightly like anybody
can program right his one drawback is
that it also assumes that the attacker
is somewhat unsophisticated in
technology the last item for today’s
discussion is based on an old trick
known as steganography
spies have used steganography for a long
time to send hidden messages to each
other
steganography is a process not
necessarily a technology you wear
something usually a message is hidden or
nested inside of something else most of
us are familiar with Russian nested
sometimes called babushka dolls right
these are a great example of the use of
steganography in the real world for our
purposes though steganography is a
technology because we embed computer
programming code rather than a simple
message inside of a file ok so now let’s
think this through using steganography
the instructor or the attacker asks for
payment images as before we take a
picture of the exposed numbers but this
time we embed computer programming code
inside of one or all of the images next
we email the payment images to the
attacker and then the attacker clicks to
open the image meaning that our computer
code hidden in embedded inside the image
file can run automatically
unfortunately this technology is not yet
fully developed because for computer
programming code embedded inside of an
image to run we need a framework
sometimes called a code handler to
recognize the code and then motivate it
to run so as the concept of embedding
computer programming code inside of an
image
we need to create that framework the
code handler as well as a workaround for
the possibility of antivirus protection
software which may be installed on the
attackers PC and might stop our code
from running at all as you can see we
have a number of technologies that are
exposed at our disposal of that cyber
security professionals might put to work
to stop or discourage online scams
therefore the point of our discussion
today is to issue a clarion call to
action to the global cyber security
community be included to join the effort
to further develop watering hole and
steganography technologies obviously our
goal is to get up and capture these
criminals who are probably working at
this very minute to create online scams
like the one I personally experienced I
believe that as we work together as a
global community that we will develop
the tools and technologies that we need
to dramatically improve the experience
and security of those who live and work
online lastly I overcame my disability
to become a marathon runner and
triathlete and I was even lucky to
complete a sub four hour marathon back
in 2013 but then about three years ago I
felt the return of a familiar old enemy
in the form of intense sciatic pain
running down both of my legs to the tips
of my big toes my legs felt like they
were literally on fire somehow emergency
surgery
good family care and lots of physical
therapy helped me to mostly regain my
health and I’ve probably completed some
twenty half marathons in as many
triathlons since then my mom died about
two months ago
but if there’s one thing that she
drilled into my head it was to never
give up
I haven’t give up quitting to work on my
overcoming my disability and I will not
give up my work to identify and capture
these cyber criminals so let’s get up
and let’s get them
[Applause]
[Applause]
last winner I asked my mom how I might
approach today’s talk and then she said
this is my mom when you were a kid you
always loved that outerspace stuff and
computers so maybe you want to begin
with that and then she said you probably
want to talk about your injuries
well mom knows her son this is really a
picture of me and the flash talking
about how we might save the earth
save the universe from the bad guys when
I was a child watching television I
watched people ask computers questions
and then receive answers then I watched
them use a starship to hurt technology
to navigate a starship across the galaxy
at the speed of light I knew that when I
grew up I wanted to work with technology
but going into the sixth grade I still
couldn’t read
finally a teacher noticed my problem
finally contacted my mom took me to the
doctor many visits and then this led to
eye surgery to correct my double vision
this meant that I could finally begin to
learn to read and it also meant that it
was time for me to get up and make that
happen my high school career turned out
mostly okay but when I graduated I still
wasn’t ready for college and this was my
own fault because my mom always told me
you have to go to college so I thought
that I would be in good shape
going to college then I finally did get
to go to school but first I joined the
Coast Guard and a few short years later
I found myself stuck in a low wage job
raising three children attending night
school but hey I mean that wasn’t bad
right I was taking care of my family
going to school
then one evening a driver ran a red
light and smashed into my car leaving me
in the words of my many doctors 100%
permanently and totally disabled I was
lucky though because I had good health
and disability insurance which paid for
me to get back to school and then
eventually to return to work but I was
still totally disabled for over five
years and because of my disability I
lost my job my house and almost my
dignity
if you’ve ever needed to apply for
welfare food stamps or subsidized
housing you get it I found it to be a
humbling and sometimes humiliating
experience but I was extremely grateful
for the help I received and I learned a
lot about myself in the process my body
was so broken that it usually took me
five minutes just to stand up from a
chair and when I finally was able to get
up has drenched in sweat and somehow I
was able to attend college and then my
pain became manageable so that I could
restart my life this meant it was time
for me to get back to work so at this
time I finally rediscovered my love for
technology and decided to jump back into
the field by studying software
engineering if you’ve studied software
engineering you know lots of computer
programming and eventually received
training and servers routers and
switches more computer programming and
eventually and today I seem to be
focused on data forensics and ethical
hacking I think back sometimes to the
technology free life that I led as a kid
and then compared it to the big role
that technology plays in my life today
and it seems like a dream think about it
almost all human knowledge is available
to anyone who owns the device that fits
into a back pocket we can learn about
anything if we just want to I can post a
picture to facebook when I’m at the top
of a mountain many people work from home
and most of us bank and shop online
right
so these are just a few of the good
things that technology makes available
to us unfortunately along with the good
comes the bad and by the bad in the
context of our discussion today I mean
hackers and crackers hackings been with
us for ever it seems as matter of fact
in the early 1900’s a hacker figured out
how to replace a running Morse code
message with his own message so hacking
really became a part of our culture in
about 1979 when hackers realized that
they could manipulate telephone tones to
provide themselves with free
long-distance telephone service which at
the time cost several dollars per minute
and then it’s strange that most of us
don’t even know what long-distance
telephone fees are anymore we should
stop for a second to say that that
people were fighting against aren’t just
the hackers we’re fighting against
another group and they’re commonly
referred to as crackers so hackers may
attack us for whatever reason while
crackers are interested in making a
profit off of their work they are money
motivated so crackers might attack us to
steal our identity to use or sell it to
break into our bank account to take our
money or even work to influence the
outcome of an election hackers like
crackers can have a lot or just a little
technical skill so then guess what it
happened about 18 months ago someone
tried to scam my wife Greta and me into
purchasing a used camper for what seemed
to be a good price on Craigslist the
scammer went by the name of Rebecca and
she told us that her husband had just
died leaving her with three small
children and that she just wanted to
sell this camper Jeep as soon as
possible as you can see she provided us
with what appeared to be an authentic
eBay invoice and then she said go to the
store and go purchase several PayPal
gift cards scratch till the numbers that
are located on the back side
then take pictures of the exposed
numbers oh and finally email all of that
to me then she said fax all of that to
ebay because then they will release the
camper to you completing the sale she
called this an eBay quick sale right
we’ve never heard of such a thing either
so my wife Greta gets online does a
quick internet search and finds this
very tactic to be an online scam we even
found the same image images being used
in other scams so I got busy trying to
trick Rebecca into a meeting or calling
me I even tried posing as a senior
citizen who knew very little about the
internet and nothing about making
purchases online nothing I tried worked
so we finally decided to report the
incident to the sheriff and to the FBI
because scammers often live outside of
the United States and because the
authorities receive reports of incidents
like this all of the time we weren’t
surprised when they weren’t able to help
us so I got the thinking what can I do
to stop or discourage people like this
from using the internet to successfully
shake people down especially senior
citizens like my mom who usually have no
idea as to the danger that these
criminals pose so after I spent some
time thinking and doing online research
and came across three technologies that
cyber security professionals might
consider putting into place or even
modifying to identify and capture these
criminals now the three technologies are
the watering hall steganography and file
streaming let’s use my craigslist
experience to explore how these three
technologies might be used to protect us
online file streaming is a technique
where we programmatically attach a new
file which I refer to as an appended
file to the end of an existing known
good file for our purposes the appended
file contains computer programming code
and better yet when we look at the files
on a computer screen they appear as one
file this means that if we send such a
file to an attacker and they click to
open it the computer programming code
hidden and embedded in the appended file
can run automatically the computer
programming code can be used to allow us
to capture data some of the data we can
collect is their location browser
information as well as information about
their operating system this technology
already exists and can probably be
implemented by anyone with average
computer programming skill one drawback
though is that its success depends upon
the attacker being somewhat
unsophisticated in technology another
technology we might put to work is known
as a watering halt as you probably know
wiring holes in the wild our isolated
places that every animal in the area
must visit to get a drink right the key
is that they get that drink the animal
must come to the watering hole to get it
usually a great risk in a technical
watering hole scenario rather than us
emailing payment images to the attacker
the attacker is directed to a website to
download them the catch is that when the
attacker connects the website computer
programming code hidden and embedded in
the website’s homepage can run
automatically allowing us to capture
data the same data that we captured
using file streaming this is just a
sampling of some of the data that we can
collect by the way your browser whatever
device you’re using sends this
information that every website that you
visit and the Internet Protocol or IP
address is like a complete street
address this means that we can use it to
calculate the GPS coordinates of the
device associated with that IP address
and you see that on the slides graphic
so we use the IP address to calculate
the attackers location and then web
programming to learn
the rest well this might seem to be a
good solution it assumes that we can
entice an attacker to come to our
website to gain access to the payment
images which may not always be true and
as before this technology already exists
and can be implemented by anyone with
average computer programming school
skill I say that lightly like anybody
can program right his one drawback is
that it also assumes that the attacker
is somewhat unsophisticated in
technology the last item for today’s
discussion is based on an old trick
known as steganography
spies have used steganography for a long
time to send hidden messages to each
other
steganography is a process not
necessarily a technology you wear
something usually a message is hidden or
nested inside of something else most of
us are familiar with Russian nested
sometimes called babushka dolls right
these are a great example of the use of
steganography in the real world for our
purposes though steganography is a
technology because we embed computer
programming code rather than a simple
message inside of a file ok so now let’s
think this through using steganography
the instructor or the attacker asks for
payment images as before we take a
picture of the exposed numbers but this
time we embed computer programming code
inside of one or all of the images next
we email the payment images to the
attacker and then the attacker clicks to
open the image meaning that our computer
code hidden in embedded inside the image
file can run automatically
unfortunately this technology is not yet
fully developed because for computer
programming code embedded inside of an
image to run we need a framework
sometimes called a code handler to
recognize the code and then motivate it
to run so as the concept of embedding
computer programming code inside of an
image
we need to create that framework the
code handler as well as a workaround for
the possibility of antivirus protection
software which may be installed on the
attackers PC and might stop our code
from running at all as you can see we
have a number of technologies that are
exposed at our disposal of that cyber
security professionals might put to work
to stop or discourage online scams
therefore the point of our discussion
today is to issue a clarion call to
action to the global cyber security
community be included to join the effort
to further develop watering hole and
steganography technologies obviously our
goal is to get up and capture these
criminals who are probably working at
this very minute to create online scams
like the one I personally experienced I
believe that as we work together as a
global community that we will develop
the tools and technologies that we need
to dramatically improve the experience
and security of those who live and work
online lastly I overcame my disability
to become a marathon runner and
triathlete and I was even lucky to
complete a sub four hour marathon back
in 2013 but then about three years ago I
felt the return of a familiar old enemy
in the form of intense sciatic pain
running down both of my legs to the tips
of my big toes my legs felt like they
were literally on fire somehow emergency
surgery
good family care and lots of physical
therapy helped me to mostly regain my
health and I’ve probably completed some
twenty half marathons in as many
triathlons since then my mom died about
two months ago
but if there’s one thing that she
drilled into my head it was to never
give up
I haven’t give up quitting to work on my
overcoming my disability and I will not
give up my work to identify and capture
these cyber criminals so let’s get up
and let’s get them
[Applause]
[Applause]
Please follow and like us: