The Cavalry Isn't Coming: Starting the Revolution to Fsck it All!
Percoco, Nicholas J.
Corman, Joshua
We have some good news and some bad news. The good news is that security is now top of mind for the people of planet Earth. The bad news is that their security illiteracy has lead to very dangerous precedents and this is likely just the beginning. The reactionary stances taken by the hacker community has induced burnout and fatigue with many of us watching our own demise. We're here to help us all hit rock bottom in the pursuit of something better. At some point the pain of maintaining inertia will exceed the pain of making changes, so it is time for some uncomfortable experimentation. While it may be overwhelming to think about, this is what we do. We hack systems. Finding flaws in the digital world comes naturally to us. We can and must do the same to the physical world; the media, governments, and lawmakers in order to survive the next decade. Let's get started. Nicholas J. Percoco has more than 16 years of information security experience and leads SpiderLabs at Trustwave. Prior to joining Trustwave, Percoco ran security consulting practices at VeriSign, and Internet Security Systems. As a speaker, he has provided unique insight around security breaches, malware, mobile security and InfoSec trends to public (Black Hat, DEFCON, SecTor, You Sh0t the Sheriff, OWASP) and private audiences (Including DHS, US-CERT, Interpol, United States Secret Service) throughout North America, South America, Europe, and Asia. Percoco and his research has been featured by many news organizations including: The Washington Post, eWeek, PC World, CNET, Wired, Network World, Dark Reading, Fox News, USA Today, Forbes, Computerworld, CSO Magazine, CNN, The Times of London, NPR, Gizmodo, Fast Company, Financial Times and The Wall Street Journal. Joshua Corman is the Director of Security Intelligence for Akamai Technologies and has more than a decade of experience with security and networking software. Most recently he served as Research Director for Enterprise Security at The 451 Group following his time as Principal Security Strategist for IBM Internet Security Systems. Mr. Corman's cross-domain research highlights adversaries, game theory and motivational structures. His analysis cuts across sectors to the core security challenges plaguing the IT industry, and helps to drive evolutionary strategies toward emerging technologies and shifting incentives. Mr. Corman is a candid and highly-coveted speaker with engagements at leading industry events such as RSA, DEFCON, Interop, ISACA, and SANS. As a staunch advocate for CISOs, Corman also serves as a Fellow with the Ponemon Institute, on the Faculty for IANS, and co-founded Rugged Software - a value-based initiative to raise awareness and usher in an era of secure digital infrastructure. His passion for challenging the status quo won him the title of Top Influencer of IT by NetworkWorld magazine in 2009. Corman received his bachelor's degree in philosophy, graduating Phi Beta Kappa and summa cum laude, from the University of New Hampshire. He resides with his wife and two daughters in New Hampshire.
 Okay. Good morning, everybody. I'm Nick. This is Josh. We're going to do a few introductions and then we'll jump right into the content here. So I'm Nick Prococo. I have always been and I currently am a hacker. Yeah. And let's try that again. In my day life, day job, I actually run a small team called Sputter Labs at Trustwave. And some of the backgrounds, I've done a lot of speaking. I'm the eighth time speaking here at DEF CON. And I spoke on stage at TED. I've also keynoted RSA this past year. And here's Josh. Good morning. So I'm Josh Corman. In my day job, I am director of security intelligence for Acomai. My comments today are my own. It may not reflect those of my employers. I've kind of been wrestling with being a philosopher in a hacker community. But I think I've come to own it. And I think my research is trended from things like espionage or malware to things that affect our personal lives and human rights and public safety. And that's really taken me down a path for today's topic. So a little bit about where we came from and where we're going. This talk is actually not a presentation. This is a discussion. This is a discussion between me and Josh here on stage. And a discussion with all of you. And this is not a finished presentation. So if you're expecting at the end of this to have us to solve the world's problems here, that's not the intent. This is the start of a conversation. And we also have right there in sort of mid-audience there. We have a microphone. It's there for you to use. If you have a question, you have a comment, you want something to add to the conversation, please use it. But also note that we have a finite number of time here on stage, 45 minutes to be exact. And so please, if you can't fit your comments and questions in 140 characters, please save it for the Q&A session. And we will have a Q&A. There's no Q&A room. But afterwards, please join us in the Chill Out Lounge to continue the discussion. You know, part of the impetus for this is that for how many of you have been to DEF CON before? Okay. A lot of new people here this year. I don't know if you noticed. It's both encouraging and overwhelming. But a lot of us got into hacking because it was our hobby, right? And when we weren't paying attention, how many of you noticed that it kind of accidentally became our profession, right? It kind of messed up. But actually, we weren't paying attention again. Now, IT security, which was our hobby, and then our job is now permeating every aspect of our personal lives and our personal safety and our kids. We're putting software in places it does not belong and is not married. We have medical devices that are completely vulnerable with no encryption whatsoever on their Bluetooth stacks that are unnecessary. As I tried to buy a car, I couldn't find one without a hackable operating system. If you go to showdan, you can find default user names and passwords for control systems, for power grids, for hydroelectric dams. This isn't FUD. This is real. And as we depend on software in places, it needs to be dependable. And in the presence of attackers, it needs to be defensible. And I guess every time I want to quit security, I realize that our failures are going to be inherited by me, my body, my mind, my soul, and my family. So don't think that today is how do you get better at your day job. Think about how do you actually hack your personal life and your personal freedoms. And that should be the scope of today. So a couple of weeks ago, I decided to do a juice cleanse. Has anybody ever done one of those before? A couple people. Yeah. So you spend three days drinking six bottles of juice and nothing else. Besides having interesting bowel activity, it also gave me very vivid dreams when I would sleep. And so at night, I would go to bed at night and I would wake up in the morning with these sort of memories, these odd memories. You know, when you wake up in the morning or you wake up from a dream and you're sort of disoriented and you think, oh, that was real. That was almost a real experience within a dream. Well, I had a few of those a couple of weeks ago. The first dream that I jotted down that I took notes about, I was on a bus. The whole dream just sort of took place on a bus and I didn't know really where we were going. I was a little bit confused. But I saw people I recognized. I saw people sitting with paperwork in front of them, with computers in front of them. And I started to ask questions. You know, where are we? Where are we going? And I soon realized that we're all going to apply for federally issued software development licenses. That each of us, and somebody actually showed me they had one that was expired. They needed to renew their license. Or they could not even write a bit of code. So I thought that was pretty interesting to sort of have that dream. One of the other dreams I had that I took notes about, I was actually in a hotel. I travel quite often. I actually travel all over the world almost constantly. And in the morning when you walk out of your hotel in the USA Today paper is sitting there on the floor and you see the headlines, sort of how you get woken up in the morning. I remember looking, glancing down at that paper as I was off to a meeting and saw on the headlines, and it said Florida man. It said Florida man arrested for hacking tools, possession of hacking tools. And I remember flipping open the paper, reading page seven about what that story was about. And it showed a logo of metasploit. And it mentioned NMAP and Nessus and other tools on there that people might have in their possession. I thought that was interesting. And then another dream that I had, and I started soon realizing that these weren't necessarily dreams. They were vivid. But they were actually nightmares. And this third dream, I was walking down the street in Chicago, sort of dusk, you know, suns going down, turned down an alley and walked up to a door. I rang the bell and I remember being able to see sort of there was a camera shining on me. I rang the bell and they buzzed me in. I went up, walked up three flights of stairs, walked up into a Chicago apartment. And there was guys and girls milling about having discussions. One side of the room there was a maker bot. Other side of the room there was a cluster of monitors. And another area there was some electronics laying about. And of course a lot of cables all over the floor. Somebody I recognized actually handed me a beer and said, hey, welcome. Discussion is going to start in a little while. So I sort of took my seat and started saying hi to people. And then all of a sudden the lights went out, electricity went out, all the power went out in this apartment. And one of the initial reactions, I remember someone in the background saying, fucking, come on, Ed, the power went out again. But then we started hearing banging on the front door and then banging on the back door. And men came into the room wearing black shirts, black pants, black boots. And they started to say we were under arrest for the violation of some act. I can't really recall what that act was. And they lined us up against the wall and then one by one started to zip tie us, our arms and our legs and carry us down the stairs. Now, this was a nightmare that I had. Obviously it's not real. But it's very much grounded in reality and the things that we experience today, if you extend what is going on today, five, 10 years from now, I can see a time when some place like DEF CON can't exist. But we don't have to. There's a better way. I can see a time when friends are being arrested for writing tools. We're being criminalized for research, but we don't have to. So when Nick told me his dreams, I had two thoughts. First, I'm never doing a juice cleanse. And I said, you know, this isn't fun. Let's get real. These are actual precedents. Whether you love or hate Weave, the Weave's case is very dangerous precedent for the criminalization of research. This community does and lives and thrives on our ability to do pervasively do security research. If you saw the aggressive prosecution of the late Aaron Schwartz and all the Aaron's law discussions coming from this, do you know there's a state law in Texas that makes it technically illegal to do a port scan? And from my international friends, Germany and France have already specifically outlined certain hacker tools that are really just assessment and end map type things. And I actually learned last night that Brazil, after some actress had some nudie photos revealed, they passed under duress a law that basically makes it criminalized to have things like end map or any port scanning tools at all. So this isn't fun or fear. This is things that are actually happening. And it's up to us in lieu of any adults in the room to be the adults. Now, that should terrify you, right? But it dawned on me over the last couple of years, you know, I was researching anonymous here two years ago at DEF CON. And one of the things I was concerned about is some sort of neo-McCurthyism when you had a lot of aggressive high profile acts and demonstration of hacking will. Whether you like them or not, it captured hearts and minds and it scared policy makers. And when powerful people are uninformed, they make powerfully uninformed knee jerks. And he started off in his intro saying he is now and always was a hacker. I fear the need to say I am not now nor have I ever been a hacker in our near future. And if you're not worried about it, you really, really should be. Because policy makers aren't as technically literate as this community is. And that's really the thrust of this talk is that I think a lot of us, even our best and brightest researchers, even our, you know, A-listers, so to speak, every time I ask them why they aren't more concerned, they're like, yeah, someone's going to come fix it. Let me tell you something. No one's coming. The people who are going to fix it are to the left of you, to the right of you, or in your own chair. And that was really the big flip for me. So another part of this is that, you know, for personal reasons, I basically hit rock bottom in January. I lost my mom at 58. Had a pretty tough year last year. It really throws into context what's important to you and how much time you have. And I felt like I was diminished that I couldn't really contribute. And what I realized is, you know, people don't really make changes until they hit rock bottom, right? If you want to be a science person, no one changes until the pain of maintaining inertia exceeds the pain of making change. Well, it hurts pretty bad right now. It sucks. There's a general malaise here. Yes, we've had a great week at DEF CON, but there were more talks about burnout and suicide and depression. And there were also a lot of talks that had absolutely nothing to do with security because there's an implicit defeatism. And we don't have to accept that defeat. So there's actually a value in hitting rock bottom. And that value says when no one's coming to save us, it falls to us, right? And if you don't see good things happening, we can put good things in. So at my mom's funeral, I said, you know, the absence of heat is, you know, cold is the absence of heat. Black, darkness is the absence of light. And maybe it's not that there's evil in the world, but maybe there's an absence of good. And I realized that each one of us can finally take matters in our own hands and put in that leadership that's sort of lacking. Nature abhors a vacuum, and I can hear the sucking sound. And it's time to fill that vacuum. Now, what that means is no matter how much we hate certain things, the alternative is worse. So we continue to fail. We don't have to fail in the same way, right? So we're actually suggesting some pretty radically uncomfortable experimentation. I can't believe we're at DEF CON and we're actually going to suggest these things, but we haven't really engaged in the formal process and how things work in the world. You know, there's no senators or congressmen who are experts on stem cell research. They rely on subject matter experts, think tanks, lobbies, et cetera. And as much as we hate these ideas, we're going to ask you to both tolerate and participate in a series of very uncomfortable and very unnatural acts. And this means we already have EFF, EFF has done fabulous things for our community. We haven't really had a voice of interest for our profession and for our talent and expertise. So now we're actually going to be suggesting and starting. We're doing it with or without your help, but we'd love your help. A 501C3 think tank for professionalization of research. Number two, a 501C4 lobby, even though we think they're horribly corrupt and corruptible, it's finally time that we have access to the corridors of power. We're also going to professionalize. We're going to do it very carefully so that we don't become the monsters we fight. But just like the Bar Association for Lawyers or the American Medical Association, giving a voice to the priorities of this community that is public and can give commentary on public policy and public events that's credible, literate and a voice of reason. And then possibly most importantly, we need to integrate a PR or media campaign to win hearts and minds. We have some of the best social engineers on earth, but we've done a really, really bad job setting the narrative. I love seeing Nick on the mainstream news or on Ted stage, but more often than the last few years we've seen Legate. So once again, we can take that microphone and bully pulpit and we can have the right spokespeople with the right messages to actually represent our community interests. Do you have anything to add? What the chain of influence. So whether we like it or not, what we do, what we say, how we dress, what we do in our everyday lives influences people. The words that are coming out of my mouth right now on stage may be influencing you in a positive way, maybe influencing you in a negative way. You may take something that Josh and I have said and talk to somebody else and that message will relay to them. But that chain continues. Now unfortunately, when we take someone from our community, someone who is a hacker from our community and put them in front of a policymaker or a senator or a global government, this is not just a U.S. issue, this is a global issue, what they see is not someone they trust and someone who is an expert, but they see a hacker. And so while the research that that hacker is doing may be vital to our existence, it may have life-benefiting needs behind it. They still see a hacker. And so what we're doing within this movement is trying to organize, better organize. You can have the breakers, you can have the hackers. They're vitally important to our community. But then you also need people who go and come up with the fixes. Now the breakers may be the same people that come up with the fixes, but they don't have to be. So if you're someone who out here likes to break things, how many people like to break things in the room? Okay. How many people also like to fix things or like to fix things? So you're part of this as well. But it's not just the people in this room. We also need people to continue that chain. And we need people from all different backgrounds. Also people who represent the various industries. So when we go follow that chain and we put someone in front of policymakers or we put someone who's on national television or international news, they may be someone who has one foot in our community and one foot in the industry that we're focusing on, whether it's the medical community or the auto-emotive industry or the transportation networks, whatever that may be. So we've got to think like hackers, right? So I want to recognize somebody who's done some outstanding work in the room, Jay Raghda. Can you stand up? So much like the hair club for men, Jay is not just a researcher, but he's also a client. So Jay hacked his insulin pump a couple years back and has since done some hacking on several different medical devices. And one of the frustrating things for me is I watched this and I said that research matters. It really matters. It affects public good. And maybe he did it because he didn't want to die or get hacked at an airport. But a lot of the research we do is fun, but does it really matter? We're going to find the 700th piece of Android malware. Is that really going to differentiate you as a researcher as you try to make fame and glory for yourself or for our name? When we throw these over the fence, does it work? So I really dug into this and I saw the work that Jay and others have done and also the huge loss of Barnaby Jack. Those two were really doing some outstanding work and it's a huge loss. We were already planning to include Barnaby in this. That's very ‑‑ there's no words for that. But when we looked at it, they really have a hard time, right? It's hard to ‑‑ we thought about the kill chain. Everyone knows the Lockheed Martin kill chain for how bad guys get stuff out of your network. We need a kill chain. And what I saw was it was really tough for him to get and procure more devices to test. He did a really good job testing it and finding vulnerability, but then he went to the vendor and didn't work. The vendor pushed back, you know, ridiculed, denied, defused, and I'm sure some vendors are better than others. But we really had a really hard time getting that into affecting some sort of change. And instead of us looking on activities like I found Ode or I published a phone or I have some different presentation at some different conference, we wanted to see how do you pull that through all the way through to a result. So I went to this guy, Kevin Fu, who is a Ph.D. in industry and he's been studying a lot of these medical device flaws. There's way more than you could possibly imagine. And we're still not getting through. So I asked why and the FDA is one of the bottlenecks. They didn't have the ability to reject devices. And they're not actually putting in new framing to allow for better granularity. So an individual researcher can have a really hard time going through multiple gates and multiple obstacles. And really what we want to do is we want to work with people in the industry and map that chain of influence and then fuzz it and try and iterate and fail fast. And focus on, we're not done until we actually see some sort of substantive change in how we raise the bar and do care for putting elective attack surface on life-saving technologies. So that's just a deep example on one of these. But these are tractable. They look overwhelming. And maybe it's not Jay who's going to be the one on CNN or maybe he's not going to be the one who does the driver development to fix it. But we have the talent in the room for every single step along the way. So there might be some people, even when Josh and I were first talking, you know, thinking, well, this is really hard. This is going to be very hard. This is not going to be something that's going to be easy. But we often do very difficult things. And there's dozens and dozens of talks here at DEF CON about very, very difficult things that are being done in the technical world. So to put it a little different perspective, we have a little clip to show you. If you can dodge a wrench, you can dodge a ball. What? So if we can hack something, X, fill in something, an iPhone, a SCADA system, if you can hack anything, we can hack this. But we have to be organized. We have to work together. We have to put the right people in the right roles to get this done. Like we mentioned earlier, you can't put a hacker in front of a center because they see a hacker. But we have to put the right people. And we have people in this room that can fill all those roles. Every single one of you has a role to play and can use their best skills, their best techniques to help drive this home. Jailbreaking the system. It's incredibly difficult to find a jailbreak and implement it and to weaponize something in order to perform a jailbreak. Very, very complicated. We can do that with this system. And as Josh mentioned earlier, some of our best social engineers are in this room or at this conference. Some of the best social engineers in the entire world are in the hacking community. But that doesn't mean we need to be dishonest and try to deceive people. But we use those skills. It's exactly the same skills that the best CEOs on the planet have for selling their investors on something. We need those people to step up and actually play that role as well. So how do we do this? Yeah, I really like the fact that we're calling out that everybody does have a role. It's not a platitude. We really mean it. I mean, right when I said on Twitter that Jay was giving a presentation of B-Sides and I said one of the biggest bottlenecks is getting devices. And three people we've never heard of replied and said, oh, I know how to get them. You have something you can do. And I was talking to a young guy from Portland, Maine yesterday and he pointed out one of his first jobs was doing device drivers at a local Skata systems operating system shop. You don't even have to be a hacker. You can just write really, really solid security-aware code for one of those vendors. So I couldn't find an O-Day to save my life, but I've been very accepted by crossover into talking to government people. He did a TED talk. I was in Vanity Fair. It's like I can take the technical stuff we do here and I can actually make it mainstream accessible and get in front of policymakers. There are actually six of us hacker types at a UN meeting in Toronto this spring. There's Jeff Moss, me, Baitlick, Miko, Pona and some others. And they were listening to us as the technical voice of reason. Now, the bad news is we didn't get very organized, but you don't have to be a rock star, you know, A-list name to actually contribute to the research that we're actually carrying to the outside world. Now, when I say anybody can play a role, I'm also speaking to those pillars in our industry, our tribal chieftains, because this is going to be really, really hard. And in a leadership role, we're going to need our toughest battles require our strongest warriors. So we really, really need not just grassroots kind of like yeah, yeah, rah, rah. We need people to take leadership roles as executive directors on some of these different manifestations. Now, forget the term platform per se. This is a straw man, but we think we've put a lot of thought to this and reiterated this. So for sake of beating up, in fact, we're going to be using this to take it to the meeting in eight weeks, which we will discuss. But we really see that there's three ways to secure our future. We have to keep a very small list of priorities so we don't spread ourselves too thin. We can learn how to do this on a few topics and then we can move out. But essentially, I think we need to focus on public good and safety. And that's really why I wanted to call out Jay and Charlie Miller, by the way, and Chris Valesek. Did you see their amazing car hack? Now, whether they did it for altruistic reasons or not doesn't matter. My neighbors were asking me about it. I got a flood of emails from people who don't know anything about our industry. I had absolutely no idea how much of a car can be controlled via software. So we have a few people doing research like this, but I would like to challenge us through this program to say let's get a critical mass of lots of you. If you're going to pick an Android malware, don't. Go pick a medical device. Go pick an auto OS. Go pick a control system. Because if we can demonstrate that we are doing a unique public good for public safety, guess what we can save off? We can actually carve off and demonstrate and earn the permission with the hearts of minds that what we're doing is critically necessary and therefore requires that we can save off the criminalization research. This is your first time speeding at DEF CON, huh? No. What? Are you lying? No. This is your first time. No, it's not. I don't think we're going to get away with it anyhow. Oh, good. Nice. You've gotten it. I was shocked when you told me this. I think he's spoken here before. But fuck you now. We're getting trolled by PW Crack. Okay. But, you know, even if you don't care about the public good and public safety, you just want to be a narcissistic vulnerability pimp to avoid that criminalization, this is how we're going to do it, right? So if you're going to pick something next year, pick something that matters. Whether you're a father or a mother or an uncle or an aunt, it doesn't really necessarily matter if you want to help public good. Be selfish. If we do some things that are clearly valuable that no one else can provide and we do it in an intelligent way, we give the right PR and air cover for that. We're going to demonstrate that this isn't something to be criminalized. I don't know if you saw the Obama clip about Snowden. He's not going to scramble jets for a 29-year-old hacker. We're going to take that back and demonstrate that we can do this. The last bullet, and this one that really my anonymous research and my research in the UN and ITU, is I'm very, very worried that technology and civil liberties and human rights are not compatible. We're seeing the battle and the entanglement between the two and civil liberties and human rights are losing. They're losing big time. And part of it is because people are evil. And part of it is people like power. But another huge part of it is they're just illiterate. You know, I had very powerful people in government say we should empower the carriers to do deep packet inspection to stave off the erosion of intellectual property to China by enabling the deep packet inspection to do signature antivirus. And I spit out my drink. I'm like, you do realize the efficacy of signature antivirus for state sponsored adversaries is zero. And essentially that's really bad math, right? So I can't stop them from questioning should we trade civil liberties and force the amendment for safety, but I can tell them that it won't actually grant them safety. So we need to do that for ourselves because we live in the world, too. If you're really squint, what we're basically describing will resonate, a little piece of that will resonate with almost everybody in the room, but more importantly, almost everybody in the mainstream because really what we're talking about is protecting our bodies, our minds, and our souls. So there's some next steps. So as we spoke about earlier, this isn't a ‑‑ we don't have the answer for you, but we have some next steps that we want to discuss. So the first of the next steps is naming the movement. We don't have a name. We have some stickers up here that have some phrases on it, but we actually don't have it name the movement. So if you have ideas, please let us know. We're very interested. We're all ears. There's also forming an executive and advisory board. Now, this is not going to just be people from our community. We want to identify those people. We want to identify those people that have one foot in our industry and another foot in another because that's where we'll get the most traction. Also holding a constitutional Congress, a meeting of anybody who wants to participate. Let's get these things on paper. Let's brainstorm how we're going to organize. And this isn't hand waving. The guys at Derby have given us a space eight weeks from now. We will be holding the first Hacker constitutional Congress for interested parties at DerbyCon. For those that can't make it, we're going to look into some way to remote people in. But our tribal chiefs and coalition of the willing and the folks that actually want to make sure that we do this intelligently and we have the right platform and the right issues to promote, we're going to do this right. The other piece is to share the results. We're not forming a secret society here. We want to share these results with people. We want you to have feedback into those results and understand what's going on at all times. So we do have a Twitter account you can follow. We're working on ways to better communicate. And a lot of that will be figured out at the Hacker constitutional Congress and what the protocols will be using. And then of course executing projects, building the think tanks to be able to take the medical research and put it in front of the right people that can change the way they think about what we're doing. So, if we're not going to teach you to be experts on all the different international and domestic legal organizations, but what we can do and hope to do is just flip that one bit. If you thought someone was going to come fix this for you, we want you to realize that the Calvary isn't coming. It's you. Now, it's going to be difficult. It's going to take time. We're going to have struggles. We're also fairly cynical groups. So we're going to point out all the ways this won't work. But it's time to start failing fast and iterating. And I'm willing to take the lumps and bruises. I'm looking at this as a marathon and not a sprint. And if not now, then when. And if it's not you, then who? So, yes, we have stickers. Yes, we have Twitter handles. But what we really need is you. So I have a question for you. And I know some of you were itching to get to the mic, but how are you going to help make this real and who's in? Stand up. Stand up if you're in. The adults. The microphone, yes. Hi there. Gary Reimer. This is my first DEF CON. And I've been coming here because I want to get full blown into the security world. And while I'm not a secure geek like a lot of the people here, I can communicate with anybody from a CEO to a janitor. If I can understand it, I can help them understand it. And you had me sold five minutes ago, which is why I want to be first on the mic. I'm going to give you my cards. I want to get your cards. I want to be part of this. I don't know how I can contribute, but darn I want to. Yes. I just want to say the Fourth Amendment is already the middle ground between the government can do anything it wants and the government can't do anything at all. We wrote a specific set of rules that they have to follow, a warrant based on probable cause and witnesses. This is as far as we should go, period. The second part of that is more rules and more laws and more regulations are not going to fix this. We had some cognitive ‑‑ I appreciate your comments. We had some cognitive dissidents about this because we tend to be a fairly libertarianish group. We tend not to like formal power structures. That's why I was saying we need to hold our nose and eat our lime of beans. And even if you hate these things, this is a set of value levers. And when you're jailbreaking an iPhone, you don't think about how it should or shouldn't be. You find a way to get it done. And I still carry cognitive dissidents over this. I'm the guy who called PCI the No Child Left Behind Act. The last thing I want to do is push more and more regulation and brittle things. I think the spirit of this is using every available mechanism. And we haven't tried these yet. And I'm not sure they'll work. I had some very critical people say you need to be transgressive. You need to be more aggressive. You have to take 10 notches or something like that. And I thought historically about things ‑‑ I'm not trying to equate this to it. But the Black Panthers were very aggressive. They were scaring people. They weren't really causing substantive legal change. And then you had the civil rights movement, which was more moderate, and engaging in system. And it's unclear if one could have succeeded without the other. But I don't want to leave these options on the table. And even if I get my butt kicked and we're ridiculed and made fun of, it's okay because we have to try something. And I think that's why we want to have the Hocker Constitutional Congress. We really want to establish what are our first principles and how do we avoid becoming the monsters that we fight. So I'm hyper conscious of your concern. I share it. And I also just want to connect the dots with some things that are happening. EFF does their part. There's also Fork the Law. There's also a whole bunch of amicus briefs written for WEVE to try to work with the judicial process. And there's a whole bunch of law professors here. And the thing that broke my heart was none of those little groups were talking to each other. So some of the pieces contradicted each other. So even if it's just aligning and getting critical mass on the existing initiatives to force multiply them, that's reasonable. I think some of us are more angry and more aggressive than others. And I hope that's why we're going to figure out what we can agree on and make sure that we keep ourselves honest. It's going to take a lot of work. So I do share your concerns. Thank you. Hi. My name is Sarah Jeffery. And I actually am really very, very grateful that you brought up WEVE's case. I do prison support for WEVE, Andrew, I mean Jeremy Hammond, Barrett Brown, and Bradley Manning. And all four of them have a CFA charge in their rap sheet. I was at the defense of Bradley Manning. And for about six hours of the first day, they were discussing the difference between an EXE file, installable file, and a shortcut of a CD on a given drive. What? Okay. And this is part of the court martial or one of the biggest leaks. Okay. Get the fuck out. This is important. The reason I'm not backing down is because every single one of you here are being persecuted like the actual activists. And WEVE has had 60 days of admin segregation for tweeting from prison. Barrett Brown has detoxed opiates without medication. Jeremy Hammond has been in over 80 days of confinement for making inmates create anonymous paraphernalia during their art projects. Bradley Manning has been tortured for six months naked 23 hours a day. And they call them a hacker just like the way they did with Snowden. And they're using the word W get as a hacker tool. These are all in the actual court proceedings. You can read them from Freedom Press Foundation. They're coming for all of you. So you guys need to put the egos aside. That's all I wanted to say. Thank you for your comments. That falls directly in line with the discussion of the preservation of security research. As a security researcher, I've done things in the last couple of years which I may not want to do today. Just because of the chance of the broad application of CFAA. So thank you. Hi. You guys have talked a lot about legislation that you don't want governments to institute against hackers. What about any legislation that you might want to institute that would provide a counteracting effect? Like for example, holding vendors of vulnerable systems more accountable? I'm not sure people heard that. I had a little echo there. But again, that cognitive dissonance is ever present in my mind that I don't want to necessarily add a ton more legislation. It's more about fixing existing ones whenever possible. I think we should use it sparingly. But one of the things we've realized is there's a lot of things that divide us back to the prior comment. Some people are like, why are you talking about an amicus brief or weave? He's a raging troll asshole or something like that. And I said, it doesn't matter if you think he's a raging troll asshole. Even if you don't like him, it's like the people versus Larry Flint. You didn't have to like pornography to like free speech. In case law does dictate things, that's one of the reasons we have to hack some of the judicial process and work on participating in the working groups that are looking to rev CFAA. And it's not just for even the criminalization research. People who are looking at defending themselves with hacked back or active defense are various things that are also controversial. But one of the things that a lot of us that do application security realize is there's absolutely no software liability whatsoever. So if a toaster burns your house down, you can sue the people who make the toaster. If the Rx35 machine gives you a lethal dose of cancer, you can't sue and win. And I don't think ‑‑ there's lots of good reasons for that. I've done a ton of research as to why the U.S. doesn't want to add more regulation and hurt GDP and competitive edge and other places. But there's plenty of precedent in medical devices. You have the FDA. In cars, you have the five star crash rating system. So it's about shoehorning in and hacking existing regulations and laws to maybe just tweak them instead of creating them from whole cloth. Doug? Two quick questions. Pick what you want. Most of the populations you're talking about trying to channel here tend to prefer true democracy, one person, one vote, one voice, one vote. What we work in for the most part to do legislation is representative democracy, which is a very different system. How do you plan to resolve that without alienating people? And then the other one is got a lot of people standing up here. It's awesome. I love to see that, too. How are you going to keep those people enthusiastic at six months, 12 months, 18 months, 24 months? Great points, great questions. I think the reason we want to have that constitutional Congress is we want to decide how we're going to make decisions. You decide how to decide. And they'll be trade‑offs to all those. And anything volunteer‑esque is going to have its ups and downs. I think the reason this will have some staying power, especially if we get some early movement and wins, is regardless of your motivational structure, if you're altruistic, if you want to do good, there's plenty of built‑in motivation to do it. But even if you're a narcissistic vulnerability pimp, once we have this hearts and minds thing in place, I was talking to someone who was like, I don't care, I just want to get famous. I said, okay, well, how much access and relationship do you have with CNN or Vanity Fair or whatnot, we could be a force multiplication and platform as a service for broadcasting good work. So there's some built‑in incentives regardless of your motivational structure to get some benefit out of this. And I think because we're so frustrated and because there is no other line of defense, and it falls to us, I'm hoping that that gets a little bit of movement. Plus, we just need to get an early win. And I think we have a couple in mind. We've done a lot of pre‑homework. Did I answer the second question? Yeah. So I just wanted to say, while it is easier to subvert existing processes, we can use the same lobbyist organization or professional board or whatever to advocate repeal of existing law that we disagree with. We don't necessarily have to just roll with whatever is there. A voice is a voice. And we can use that to repeal law whole‑cloth. So for people who have reservations about that. That's true. Absolutely. Thank you. Again the choice between two questions. One is we know we can save people. Okay. We can save ‑‑ okay. We can swoop in and rescue the public. But how do we make this more public? How do we shout out that we've done this? And the second is if you're familiar with the 501 medical device registration and where that fits in in the class 2 FDA, could you speak to how we can get software elevated to even a class 3 device? Okay. So I'm not the expert on the medical device pump. But that's why we've sought out people like Kevin. In fact, Kevin does a great job within his scope and remit. But when I talked to him about the Bluetooth, just a tiny anecdote before we run out of time. He said ‑‑ I said why do you even need Bluetooth on an insulin pump? And he said ‑‑ it's not like it's a pacemaker where it's under the skin. And he said, well, it's the bacon principle. What the hell are you talking about? And he said, everything's better with bacon. Everything's better with Bluetooth. So one manufacturer did it. And then they all had to do it because it was cool. And what you have is something that's not medically relevant that's highly attackable in a life‑saving situation. So we need those subject matter experts to answer the spirit of your question. And that's what we mean by mapping these. I think the roles and responsibilities we're hoping each of you can do is once we've mapped that kill chain for a particular industry, then we can start iterating. And the pushback I gave him was he said, well, Josh, the FDA had a choice between failing to approve a medically life‑saving technology or being afraid of a theoretical hack. And I said, okay, fine. They had to rubber stamp it. But they could have also said by 2015 anyone putting elective remotely accessible technologies on medical advice will incur additional scrutiny for adversarial testing and validation. There's ways to look at this as a marathon. Even if they couldn't do it with current things, you keep iterating. I'm not trying to trivialize it. It's actually far more complicated than that. But keeping at it and asking the questions and being the tenacious hacker that fuzzes that kill chain and fuzzes the chain of influence, we're going to have a win. So, first of all, I think that a lot of people, like my mother, couldn't put together that hacking is related to safety. And it was a matter of teaching her, well, you know, you have to find these vulnerabilities. When you find them, then they can be fixed. And until that point, somebody could exploit them without you being aware. So putting the spin on it, being about the safety of our families is super important. And second of all, how will you prevent an organization of hackers from being open to abuse? Because I feel like every time I see hackers organized, they do things like horde exploits that it just doesn't work out so well. A concern that's come up often is one of the things we said in our anonymous research was it was prone to infiltration and hijacking. And there were several governments and political groups infiltrating and trying to hijack. But one of the things about hackers that's interesting, I think this is what Quinn Norton said, they're prone to influence but you can't control them. So we're really hard to control. It's almost the virtue of us being so chaotic. I think this is going to be hard. I think keep bringing these criticisms. In fact, this is probably one more question. We want to flag every single one of these. We don't want to just try something. We want to actually succeed at something. So keep raising these concerns. Oh, look, it's Jay. Last question, how fitting is Jay Radcliffe? All right. So guys, this week I spent all week talking to media about a talk I gave at Black Hat and Beesides, which a software flaw put me closer to death than I would have liked. And when I approached the vendor about this, they said, you should have read the manual. And we're not fixing that. If you think that, you know, these things are in the future and that they're coming, they're not. They're here right now. And we need to change these things right now. And I can find 100 medical device flaws and I'm still going to get the same response. It's going to take a mass movement. It's going to take all of us getting on the same page to make this problem change. I can do all these things, but I'm not going to move the rock an inch forward without more help. Exactly like Josh is talking about. In the media, in lobbying groups, in places that we haven't been before and there's no reason that we can't get together and move that system. Thank you. So we're out of time, but this conversation doesn't have to stop. Please join us for Q&A in the Chillout Lounge after this talk. Thank you.
 Okay. Good morning, everybody. I'm Nick. This is Josh. We're going to do a few introductions  and then we'll jump right into the content here. So I'm Nick Prococo. I have always been  and I currently am a hacker. Yeah. And let's try that again. In my day life, day job, I  actually run a small team called Sputter Labs at Trustwave. And some of the backgrounds,  I've done a lot of speaking. I'm the eighth time speaking here at DEF CON. And I spoke  on stage at TED. I've also keynoted RSA this past year. And here's Josh. Good morning.  So I'm Josh Corman. In my day job, I am director of security intelligence for Acomai. My comments  today are my own. It may not reflect those of my employers. I've kind of been wrestling  with being a philosopher in a hacker community. But I think I've come to own it. And I think  my research is trended from things like espionage or malware to things that affect our personal  lives and human rights and public safety. And that's really taken me down a path for  today's topic. So a little bit about where we came from and where we're going. This  talk is actually not a presentation. This is a discussion. This is a discussion between  me and Josh here on stage. And a discussion with all of you. And this is not a finished  presentation. So if you're expecting at the end of this to have us to solve the world's  problems here, that's not the intent. This is the start of a conversation. And we also  have right there in sort of mid-audience there. We have a microphone. It's there for you to  use. If you have a question, you have a comment, you want something to add to the conversation,  please use it. But also note that we have a finite number of time here on stage, 45  minutes to be exact. And so please, if you can't fit your comments and questions in 140  characters, please save it for the Q&A session. And we will have a Q&A. There's no Q&A room.  But afterwards, please join us in the Chill Out Lounge to continue the discussion.  You know, part of the impetus for this is that for how many of you have been to DEF CON  before? Okay. A lot of new people here this year. I don't know if you noticed. It's both  encouraging and overwhelming. But a lot of us got into hacking because it was our hobby,  right? And when we weren't paying attention, how many of you noticed that it kind of accidentally  became our profession, right? It kind of messed up. But actually, we weren't paying attention  again. Now, IT security, which was our hobby, and then our job is now permeating every aspect  of our personal lives and our personal safety and our kids. We're putting software in places  it does not belong and is not married. We have medical devices that are completely  vulnerable with no encryption whatsoever on their Bluetooth stacks that are unnecessary.  As I tried to buy a car, I couldn't find one without a hackable operating system. If you  go to showdan, you can find default user names and passwords for control systems, for power  grids, for hydroelectric dams. This isn't FUD. This is real. And as we depend on software  in places, it needs to be dependable. And in the presence of attackers, it needs to  be defensible. And I guess every time I want to quit security, I realize that our failures  are going to be inherited by me, my body, my mind, my soul, and my family. So don't think  that today is how do you get better at your day job. Think about how do you actually hack  your personal life and your personal freedoms. And that should be the scope of today.  So a couple of weeks ago, I decided to do a juice cleanse. Has anybody ever done one  of those before? A couple people. Yeah. So you spend three days drinking six bottles  of juice and nothing else. Besides having interesting bowel activity, it also gave  me very vivid dreams when I would sleep. And so at night, I would go to bed at night and  I would wake up in the morning with these sort of memories, these odd memories. You  know, when you wake up in the morning or you wake up from a dream and you're sort of disoriented  and you think, oh, that was real. That was almost a real experience within a dream. Well,  I had a few of those a couple of weeks ago. The first dream that I jotted down that I  took notes about, I was on a bus. The whole dream just sort of took place on a bus and  I didn't know really where we were going. I was a little bit confused. But I saw people  I recognized. I saw people sitting with paperwork in front of them, with computers in front  of them. And I started to ask questions. You know, where are we? Where are we going? And  I soon realized that we're all going to apply for federally issued software development licenses.  That each of us, and somebody actually showed me they had one that was expired. They needed  to renew their license. Or they could not even write a bit of code. So I thought that  was pretty interesting to sort of have that dream. One of the other dreams I had that  I took notes about, I was actually in a hotel. I travel quite often. I actually travel all  over the world almost constantly. And in the morning when you walk out of your hotel in  the USA Today paper is sitting there on the floor and you see the headlines, sort of how  you get woken up in the morning. I remember looking, glancing down at that paper as I  was off to a meeting and saw on the headlines, and it said Florida man. It said Florida man  arrested for hacking tools, possession of hacking tools. And I remember flipping open  the paper, reading page seven about what that story was about. And it showed a logo of  metasploit. And it mentioned NMAP and Nessus and other tools on there that people might  have in their possession. I thought that was interesting. And then another dream that I  had, and I started soon realizing that these weren't necessarily dreams. They were vivid.  But they were actually nightmares. And this third dream, I was walking down the street  in Chicago, sort of dusk, you know, suns going down, turned down an alley and walked up to  a door. I rang the bell and I remember being able to see sort of there was a camera shining  on me. I rang the bell and they buzzed me in. I went up, walked up three flights of stairs,  walked up into a Chicago apartment. And there was guys and girls milling about having discussions.  One side of the room there was a maker bot. Other side of the room there was a cluster  of monitors. And another area there was some electronics laying about. And of course a  lot of cables all over the floor. Somebody I recognized actually handed me a beer and  said, hey, welcome. Discussion is going to start in a little while. So I sort of took  my seat and started saying hi to people. And then all of a sudden the lights went out,  electricity went out, all the power went out in this apartment. And one of the initial  reactions, I remember someone in the background saying, fucking, come on, Ed, the power went  out again. But then we started hearing banging on the front door and then banging on the  back door. And men came into the room wearing black shirts, black pants, black boots. And  they started to say we were under arrest for the violation of some act. I can't really  recall what that act was. And they lined us up against the wall and then one by one started  to zip tie us, our arms and our legs and carry us down the stairs. Now, this was a nightmare  that I had. Obviously it's not real. But it's very much grounded in reality and the things  that we experience today, if you extend what is going on today, five, 10 years from now,  I can see a time when some place like DEF CON can't exist. But we don't have to. There's  a better way. I can see a time when friends are being arrested for writing tools. We're  being criminalized for research, but we don't have to.  So when Nick told me his dreams, I had two thoughts. First, I'm never doing a juice  cleanse. And I said, you know, this isn't fun. Let's get real. These are actual precedents.  Whether you love or hate Weave, the Weave's case is very dangerous precedent for the criminalization  of research. This community does and lives and thrives on our ability to do pervasively  do security research. If you saw the aggressive prosecution of the late Aaron Schwartz and  all the Aaron's law discussions coming from this, do you know there's a state law in Texas  that makes it technically illegal to do a port scan? And from my international friends,  Germany and France have already specifically outlined certain hacker tools that are really  just assessment and end map type things. And I actually learned last night that Brazil,  after some actress had some nudie photos revealed, they passed under duress a law that basically  makes it criminalized to have things like end map or any port scanning tools at all.  So this isn't fun or fear. This is things that are actually happening. And it's up to  us in lieu of any adults in the room to be the adults. Now, that should terrify you, right?  But it dawned on me over the last couple of years, you know, I was researching anonymous  here two years ago at DEF CON. And one of the things I was concerned about is some sort  of neo-McCurthyism when you had a lot of aggressive high profile acts and demonstration of hacking  will. Whether you like them or not, it captured hearts and minds and it scared policy makers.  And when powerful people are uninformed, they make powerfully uninformed knee jerks. And  he started off in his intro saying he is now and always was a hacker. I fear the need to  say I am not now nor have I ever been a hacker in our near future. And if you're not worried  about it, you really, really should be. Because policy makers aren't as technically literate  as this community is. And that's really the thrust of this talk is that I think a lot  of us, even our best and brightest researchers, even our, you know, A-listers, so to speak,  every time I ask them why they aren't more concerned, they're like, yeah, someone's going  to come fix it. Let me tell you something. No one's coming. The people who are going  to fix it are to the left of you, to the right of you, or in your own chair. And that was  really the big flip for me. So another part of this is that, you know, for personal reasons,  I basically hit rock bottom in January. I lost my mom at 58. Had a pretty tough year  last year. It really throws into context what's important to you and how much time you have.  And I felt like I was diminished that I couldn't really contribute. And what I realized is,  you know, people don't really make changes until they hit rock bottom, right? If you  want to be a science person, no one changes until the pain of maintaining inertia exceeds  the pain of making change. Well, it hurts pretty bad right now. It sucks. There's a  general malaise here. Yes, we've had a great week at DEF CON, but there were more talks  about burnout and suicide and depression. And there were also a lot of talks that had  absolutely nothing to do with security because there's an implicit defeatism. And we don't  have to accept that defeat. So there's actually a value in hitting rock bottom. And that value  says when no one's coming to save us, it falls to us, right? And if you don't see good things  happening, we can put good things in. So at my mom's funeral, I said, you know, the absence  of heat is, you know, cold is the absence of heat. Black, darkness is the absence of  light. And maybe it's not that there's evil in the world, but maybe there's an absence  of good. And I realized that each one of us can finally take matters in our own hands  and put in that leadership that's sort of lacking. Nature abhors a vacuum, and I can  hear the sucking sound. And it's time to fill that vacuum. Now, what that means is no matter  how much we hate certain things, the alternative is worse. So we continue to fail. We don't  have to fail in the same way, right? So we're actually suggesting some pretty radically  uncomfortable experimentation. I can't believe we're at DEF CON and we're actually going  to suggest these things, but we haven't really engaged in the formal process and how things  work in the world. You know, there's no senators or congressmen who are experts on stem cell  research. They rely on subject matter experts, think tanks, lobbies, et cetera. And as much  as we hate these ideas, we're going to ask you to both tolerate and participate in a  series of very uncomfortable and very unnatural acts. And this means we already have EFF,  EFF has done fabulous things for our community. We haven't really had a voice of interest  for our profession and for our talent and expertise. So now we're actually going to  be suggesting and starting. We're doing it with or without your help, but we'd love your  help. A 501C3 think tank for professionalization of research. Number two, a 501C4 lobby, even  though we think they're horribly corrupt and corruptible, it's finally time that we have  access to the corridors of power. We're also going to professionalize. We're going to do  it very carefully so that we don't become the monsters we fight. But just like the Bar  Association for Lawyers or the American Medical Association, giving a voice to the priorities  of this community that is public and can give commentary on public policy and public events  that's credible, literate and a voice of reason. And then possibly most importantly, we need  to integrate a PR or media campaign to win hearts and minds. We have some of the best  social engineers on earth, but we've done a really, really bad job setting the narrative.  I love seeing Nick on the mainstream news or on Ted stage, but more often than the last  few years we've seen Legate. So once again, we can take that microphone and bully pulpit  and we can have the right spokespeople with the right messages to actually represent our  community interests. Do you have anything to add?  What the chain of influence. So whether we like it or not, what we do, what we say, how  we dress, what we do in our everyday lives influences people. The words that are coming  out of my mouth right now on stage may be influencing you in a positive way, maybe influencing  you in a negative way. You may take something that Josh and I have said and talk to somebody  else and that message will relay to them. But that chain continues. Now unfortunately,  when we take someone from our community, someone who is a hacker from our community and put  them in front of a policymaker or a senator or a global government, this is not just a  U.S. issue, this is a global issue, what they see is not someone they trust and someone  who is an expert, but they see a hacker. And so while the research that that hacker is  doing may be vital to our existence, it may have life-benefiting needs behind it. They  still see a hacker. And so what we're doing within this movement is trying to organize,  better organize. You can have the breakers, you can have the hackers. They're vitally  important to our community. But then you also need people who go and come up with the fixes.  Now the breakers may be the same people that come up with the fixes, but they don't have  to be. So if you're someone who out here likes to break things, how many people like to break  things in the room? Okay. How many people also like to fix things or like to fix things?  So you're part of this as well. But it's not just the people in this room. We also need  people to continue that chain. And we need people from all different backgrounds. Also  people who represent the various industries. So when we go follow that chain and we put  someone in front of policymakers or we put someone who's on national television or international  news, they may be someone who has one foot in our community and one foot in the industry  that we're focusing on, whether it's the medical community or the auto-emotive industry or  the transportation networks, whatever that may be.  So we've got to think like hackers, right? So I want to recognize somebody who's done  some outstanding work in the room, Jay Raghda. Can you stand up? So much like the hair club  for men, Jay is not just a researcher, but he's also a client. So Jay hacked his insulin  pump a couple years back and has since done some hacking on several different medical  devices. And one of the frustrating things for me is I watched this and I said that research  matters. It really matters. It affects public good. And maybe he did it because he didn't  want to die or get hacked at an airport. But a lot of the research we do is fun, but does  it really matter? We're going to find the 700th piece of Android malware. Is that really  going to differentiate you as a researcher as you try to make fame and glory for yourself  or for our name? When we throw these over the fence, does it work? So I really dug  into this and I saw the work that Jay and others have done and also the huge loss of  Barnaby Jack. Those two were really doing some outstanding work and it's a huge loss.  We were already planning to include Barnaby in this. That's very ‑‑ there's no words  for that. But when we looked at it, they really have a hard time, right? It's hard to ‑‑  we thought about the kill chain. Everyone knows the Lockheed Martin kill chain for how  bad guys get stuff out of your network. We need a kill chain. And what I saw was it was  really tough for him to get and procure more devices to test. He did a really good job  testing it and finding vulnerability, but then he went to the vendor and didn't work.  The vendor pushed back, you know, ridiculed, denied, defused, and I'm sure some vendors  are better than others. But we really had a really hard time getting that into affecting  some sort of change. And instead of us looking on activities like I found Ode or I published  a phone or I have some different presentation at some different conference, we wanted to  see how do you pull that through all the way through to a result. So I went to this guy,  Kevin Fu, who is a Ph.D. in industry and he's been studying a lot of these medical device  flaws. There's way more than you could possibly imagine. And we're still not getting through.  So I asked why and the FDA is one of the bottlenecks. They didn't have the ability to reject devices.  And they're not actually putting in new framing to allow for better granularity. So an individual  researcher can have a really hard time going through multiple gates and multiple obstacles.  And really what we want to do is we want to work with people in the industry and map that  chain of influence and then fuzz it and try and iterate and fail fast. And focus on, we're  not done until we actually see some sort of substantive change in how we raise the bar  and do care for putting elective attack surface on life-saving technologies. So that's just  a deep example on one of these. But these are tractable. They look overwhelming. And  maybe it's not Jay who's going to be the one on CNN or maybe he's not going to be the one  who does the driver development to fix it. But we have the talent in the room for every  single step along the way.  So there might be some people, even when Josh and I were first talking, you know, thinking,  well, this is really hard. This is going to be very hard. This is not going to be something  that's going to be easy. But we often do very difficult things. And there's dozens and  dozens of talks here at DEF CON about very, very difficult things that are being done  in the technical world. So to put it a little different perspective, we have a little clip  to show you.  If you can dodge a wrench, you can dodge a ball.  What?  So if we can hack something, X, fill in something, an iPhone, a SCADA system, if you can hack  anything, we can hack this. But we have to be organized. We have to work together. We  have to put the right people in the right roles to get this done. Like we mentioned earlier,  you can't put a hacker in front of a center because they see a hacker. But we have to put  the right people. And we have people in this room that can fill all those roles. Every  single one of you has a role to play and can use their best skills, their best techniques  to help drive this home.  Jailbreaking the system. It's incredibly difficult to find a jailbreak and implement it and to  weaponize something in order to perform a jailbreak. Very, very complicated. We can do  that with this system.  And as Josh mentioned earlier, some of our best social engineers are in this room or  at this conference. Some of the best social engineers in the entire world are in the hacking  community. But that doesn't mean we need to be dishonest and try to deceive people. But  we use those skills. It's exactly the same skills that the best CEOs on the planet have  for selling their investors on something. We need those people to step up and actually  play that role as well.  So how do we do this?  Yeah, I really like the fact that we're calling out that everybody does have a role. It's  not a platitude. We really mean it. I mean, right when I said on Twitter that Jay was  giving a presentation of B-Sides and I said one of the biggest bottlenecks is getting  devices. And three people we've never heard of replied and said, oh, I know how to get  them. You have something you can do. And I was talking to a young guy from Portland, Maine  yesterday and he pointed out one of his first jobs was doing device drivers at a local Skata  systems operating system shop. You don't even have to be a hacker. You can just write really,  really solid security-aware code for one of those vendors. So I couldn't find an O-Day  to save my life, but I've been very accepted by crossover into talking to government people.  He did a TED talk. I was in Vanity Fair. It's like I can take the technical stuff we do  here and I can actually make it mainstream accessible and get in front of policymakers.  There are actually six of us hacker types at a UN meeting in Toronto this spring. There's  Jeff Moss, me, Baitlick, Miko, Pona and some others. And they were listening to us as the  technical voice of reason. Now, the bad news is we didn't get very organized, but you don't  have to be a rock star, you know, A-list name to actually contribute to the research that  we're actually carrying to the outside world. Now, when I say anybody can play a role, I'm  also speaking to those pillars in our industry, our tribal chieftains, because this is going  to be really, really hard. And in a leadership role, we're going to need our toughest battles  require our strongest warriors. So we really, really need not just grassroots kind of like  yeah, yeah, rah, rah. We need people to take leadership roles as executive directors on  some of these different manifestations. Now, forget the term platform per se. This is a  straw man, but we think we've put a lot of thought to this and reiterated this. So for  sake of beating up, in fact, we're going to be using this to take it to the meeting in  eight weeks, which we will discuss. But we really see that there's three ways to secure  our future. We have to keep a very small list of priorities so we don't spread ourselves  too thin. We can learn how to do this on a few topics and then we can move out. But essentially,  I think we need to focus on public good and safety. And that's really why I wanted to  call out Jay and Charlie Miller, by the way, and Chris Valesek. Did you see their amazing  car hack? Now, whether they did it for altruistic reasons or not doesn't matter. My neighbors  were asking me about it. I got a flood of emails from people who don't know anything  about our industry. I had absolutely no idea how much of a car can be controlled via software.  So we have a few people doing research like this, but I would like to challenge us through  this program to say let's get a critical mass of lots of you. If you're going to pick an  Android malware, don't. Go pick a medical device. Go pick an auto OS. Go pick a control  system. Because if we can demonstrate that we are doing a unique public good for public  safety, guess what we can save off? We can actually carve off and demonstrate and earn  the permission with the hearts of minds that what we're doing is critically necessary and  therefore requires that we can save off the criminalization research.  This is your first time speeding at DEF CON, huh?  No.  What? Are you lying?  No.  This is your first time.  No, it's not.  I don't think we're going to get away with it anyhow. Oh, good. Nice. You've gotten it.  I was shocked when you told me this. I think he's spoken here before. But fuck you now.  We're getting trolled by PW Crack. Okay. But, you know, even if you don't care about the  public good and public safety, you just want to be a narcissistic vulnerability pimp to  avoid that criminalization, this is how we're going to do it, right?  So if you're going to pick something next year, pick something that matters. Whether  you're a father or a mother or an uncle or an aunt, it doesn't really necessarily matter  if you want to help public good. Be selfish. If we do some things that are clearly valuable  that no one else can provide and we do it in an intelligent way, we give the right PR  and air cover for that.  We're going to demonstrate that this isn't something to be criminalized. I don't know  if you saw the Obama clip about Snowden. He's not going to scramble jets for a 29-year-old  hacker. We're going to take that back and demonstrate that we can do this.  The last bullet, and this one that really my anonymous research and my research in the  UN and ITU, is I'm very, very worried that technology and civil liberties and human rights  are not compatible. We're seeing the battle and the entanglement between the two and civil  liberties and human rights are losing. They're losing big time. And part of it is because  people are evil. And part of it is people like power. But another huge part of it is  they're just illiterate. You know, I had very powerful people in government say we should  empower the carriers to do deep packet inspection to stave off the erosion of intellectual property  to China by enabling the deep packet inspection to do signature antivirus. And I spit out  my drink. I'm like, you do realize the efficacy of signature antivirus for state sponsored  adversaries is zero. And essentially that's really bad math, right? So I can't stop them  from questioning should we trade civil liberties and force the amendment for safety, but I  can tell them that it won't actually grant them safety. So we need to do that for ourselves  because we live in the world, too. If you're really squint, what we're basically describing  will resonate, a little piece of that will resonate with almost everybody in the room,  but more importantly, almost everybody in the mainstream because really what we're talking  about is protecting our bodies, our minds, and our souls.  So there's some next steps. So as we spoke about earlier, this isn't a ‑‑ we don't  have the answer for you, but we have some next steps that we want to discuss. So the  first of the next steps is naming the movement. We don't have a name. We have some stickers  up here that have some phrases on it, but we actually don't have it name the movement.  So if you have ideas, please let us know. We're very interested. We're all ears. There's  also forming an executive and advisory board. Now, this is not going to just be people from  our community. We want to identify those people. We want to identify those people that have  one foot in our industry and another foot in another because that's where we'll get  the most traction. Also holding a constitutional Congress, a meeting of anybody who wants to  participate. Let's get these things on paper. Let's brainstorm how we're going to organize.  And this isn't hand waving. The guys at Derby have given us a space eight weeks from now.  We will be holding the first Hacker constitutional Congress for interested parties at DerbyCon.  For those that can't make it, we're going to look into some way to remote people in.  But our tribal chiefs and coalition of the willing and the folks that actually want  to make sure that we do this intelligently and we have the right platform and the right  issues to promote, we're going to do this right.  The other piece is to share the results. We're not forming a secret society here. We want  to share these results with people. We want you to have feedback into those results and  understand what's going on at all times. So we do have a Twitter account you can follow.  We're working on ways to better communicate. And a lot of that will be figured out at the  Hacker constitutional Congress and what the protocols will be using.  And then of course executing projects, building the think tanks to be able to take the medical  research and put it in front of the right people that can change the way they think  about what we're doing.  So, if we're not going to teach you to be experts on all the different international  and domestic legal organizations, but what we can do and hope to do is just flip that  one bit. If you thought someone was going to come fix this for you, we want you to realize  that the Calvary isn't coming. It's you.  Now, it's going to be difficult. It's going to take time. We're going to have struggles.  We're also fairly cynical groups. So we're going to point out all the ways this won't  work. But it's time to start failing fast and iterating. And I'm willing to take the  lumps and bruises. I'm looking at this as a marathon and not a sprint. And if not now,  then when. And if it's not you, then who? So, yes, we have stickers. Yes, we have Twitter  handles. But what we really need is you. So I have a question for you. And I know some  of you were itching to get to the mic, but how are you going to help make this real and  who's in?  Stand up.  Stand up if you're in. The adults.  The microphone, yes.  Hi there. Gary Reimer. This is my first DEF CON. And I've been coming here because I want  to get full blown into the security world. And while I'm not a secure geek like a lot  of the people here, I can communicate with anybody from a CEO to a janitor. If I can  understand it, I can help them understand it. And you had me sold five minutes ago,  which is why I want to be first on the mic. I'm going to give you my cards. I want to  get your cards. I want to be part of this. I don't know how I can contribute, but darn  I want to. Yes.  I just want to say the Fourth Amendment is already the middle ground between the government  can do anything it wants and the government can't do anything at all. We wrote a specific  set of rules that they have to follow, a warrant based on probable cause and witnesses. This  is as far as we should go, period. The second part of that is more rules and more laws and  more regulations are not going to fix this.  We had some cognitive ‑‑ I appreciate your comments. We had some cognitive dissidents  about this because we tend to be a fairly libertarianish group. We tend not to like  formal power structures. That's why I was saying we need to hold our nose and eat our  lime of beans. And even if you hate these things, this is a set of value levers. And  when you're jailbreaking an iPhone, you don't think about how it should or shouldn't be.  You find a way to get it done. And I still carry cognitive dissidents over this. I'm  the guy who called PCI the No Child Left Behind Act. The last thing I want to do is push more  and more regulation and brittle things. I think the spirit of this is using every available  mechanism. And we haven't tried these yet. And I'm not sure they'll work. I had some  very critical people say you need to be transgressive. You need to be more aggressive. You have to  take 10 notches or something like that. And I thought historically about things ‑‑  I'm not trying to equate this to it. But the Black Panthers were very aggressive. They  were scaring people. They weren't really causing substantive legal change. And then  you had the civil rights movement, which was more moderate, and engaging in system. And  it's unclear if one could have succeeded without the other. But I don't want to leave these  options on the table. And even if I get my butt kicked and we're ridiculed and made fun  of, it's okay because we have to try something. And I think that's why we want to have the  Hocker Constitutional Congress. We really want to establish what are our first principles  and how do we avoid becoming the monsters that we fight. So I'm hyper conscious of your  concern. I share it. And I also just want to connect the dots with some things that  are happening. EFF does their part. There's also Fork the Law. There's also a whole bunch  of amicus briefs written for WEVE to try to work with the judicial process. And there's  a whole bunch of law professors here. And the thing that broke my heart was none of those  little groups were talking to each other. So some of the pieces contradicted each other.  So even if it's just aligning and getting critical mass on the existing initiatives  to force multiply them, that's reasonable. I think some of us are more angry and more  aggressive than others. And I hope that's why we're going to figure out what we can  agree on and make sure that we keep ourselves honest. It's going to take a lot of work.  So I do share your concerns. Thank you. Hi. My name is Sarah Jeffery. And I actually  am really very, very grateful that you brought up WEVE's case. I do prison support for WEVE,  Andrew, I mean Jeremy Hammond, Barrett Brown, and Bradley Manning. And all four of them  have a CFA charge in their rap sheet. I was at the defense of Bradley Manning. And for  about six hours of the first day, they were discussing the difference between an EXE file,  installable file, and a shortcut of a CD on a given drive. What? Okay. And this is part  of the court martial or one of the biggest leaks. Okay. Get the fuck out. This is important.  The reason I'm not backing down is because every single one of you here are being persecuted  like the actual activists. And WEVE has had 60 days of admin segregation for tweeting from  prison. Barrett Brown has detoxed opiates without medication. Jeremy Hammond has been  in over 80 days of confinement for making inmates create anonymous paraphernalia during  their art projects. Bradley Manning has been tortured for six months naked 23 hours a day.  And they call them a hacker just like the way they did with Snowden. And they're using  the word W get as a hacker tool. These are all in the actual court proceedings. You can  read them from Freedom Press Foundation. They're coming for all of you. So you guys need to  put the egos aside. That's all I wanted to say. Thank you for your comments. That falls  directly in line with the discussion of the preservation of security research. As a security  researcher, I've done things in the last couple of years which I may not want to do today.  Just because of the chance of the broad application of CFAA. So thank you.  Hi. You guys have talked a lot about legislation that you don't want governments to institute  against hackers. What about any legislation that you might want to institute that would  provide a counteracting effect? Like for example, holding vendors of vulnerable systems more  accountable? I'm not sure people heard that. I had a little echo there. But again, that  cognitive dissonance is ever present in my mind that I don't want to necessarily add  a ton more legislation. It's more about fixing existing ones whenever possible. I think we  should use it sparingly. But one of the things we've realized is there's a lot of things  that divide us back to the prior comment. Some people are like, why are you talking about  an amicus brief or weave? He's a raging troll asshole or something like that. And I said,  it doesn't matter if you think he's a raging troll asshole. Even if you don't like him,  it's like the people versus Larry Flint. You didn't have to like pornography to like free  speech. In case law does dictate things, that's one of the reasons we have to hack some of  the judicial process and work on participating in the working groups that are looking to  rev CFAA. And it's not just for even the criminalization research. People who are looking at defending  themselves with hacked back or active defense are various things that are also controversial.  But one of the things that a lot of us that do application security realize is there's  absolutely no software liability whatsoever. So if a toaster burns your house down, you  can sue the people who make the toaster. If the Rx35 machine gives you a lethal dose of  cancer, you can't sue and win. And I don't think ‑‑ there's lots of good reasons  for that. I've done a ton of research as to why the U.S. doesn't want to add more regulation  and hurt GDP and competitive edge and other places. But there's plenty of precedent in  medical devices. You have the FDA. In cars, you have the five star crash rating system.  So it's about shoehorning in and hacking existing regulations and laws to maybe just  tweak them instead of creating them from whole cloth. Doug?  Two quick questions. Pick what you want. Most of the populations you're talking about  trying to channel here tend to prefer true democracy, one person, one vote, one voice,  one vote. What we work in for the most part to do legislation is representative democracy,  which is a very different system. How do you plan to resolve that without alienating people?  And then the other one is got a lot of people standing up here. It's awesome. I love to  see that, too. How are you going to keep those people enthusiastic at six months, 12 months,  18 months, 24 months? Great points, great questions. I think the reason  we want to have that constitutional Congress is we want to decide how we're going to make  decisions. You decide how to decide. And they'll be trade‑offs to all those. And anything  volunteer‑esque is going to have its ups and downs. I think the reason this will have  some staying power, especially if we get some early movement and wins, is regardless of  your motivational structure, if you're altruistic, if you want to do good, there's plenty of  built‑in motivation to do it. But even if you're a narcissistic vulnerability  pimp, once we have this hearts and minds thing in place, I was talking to someone who was  like, I don't care, I just want to get famous. I said, okay, well, how much access and relationship  do you have with CNN or Vanity Fair or whatnot, we could be a force multiplication and platform  as a service for broadcasting good work. So there's some built‑in incentives regardless  of your motivational structure to get some benefit out of this. And I think because we're  so frustrated and because there is no other line of defense, and it falls to us, I'm  hoping that that gets a little bit of movement. Plus, we just need to get an early win. And  I think we have a couple in mind. We've done a lot of pre‑homework.  Did I answer the second question? Yeah.  So I just wanted to say, while it is easier to subvert existing processes, we can use  the same lobbyist organization or professional board or whatever to advocate repeal of existing  law that we disagree with. We don't necessarily have to just roll with whatever is there.  A voice is a voice. And we can use that to repeal law whole‑cloth. So for people who  have reservations about that. That's true. Absolutely. Thank you.  Again the choice between two questions. One is we know we can save people. Okay. We can  save ‑‑ okay. We can swoop in and rescue the public. But how do we make this more public?  How do we shout out that we've done this? And the second is if you're familiar with  the 501 medical device registration and where that fits in in the class 2 FDA, could you  speak to how we can get software elevated to even a class 3 device?  Okay. So I'm not the expert on the medical device pump. But that's why we've sought  out people like Kevin. In fact, Kevin does a great job within his scope and remit. But  when I talked to him about the Bluetooth, just a tiny anecdote before we run out of  time. He said ‑‑ I said why do you even need Bluetooth on an insulin pump? And he  said ‑‑ it's not like it's a pacemaker where it's under the skin. And he said, well,  it's the bacon principle. What the hell are you talking about? And he said, everything's  better with bacon. Everything's better with Bluetooth. So one manufacturer did it. And  then they all had to do it because it was cool. And what you have is something that's  not medically relevant that's highly attackable in a life‑saving situation. So we need those  subject matter experts to answer the spirit of your question. And that's what we mean  by mapping these. I think the roles and responsibilities we're hoping each of you can do is once we've  mapped that kill chain for a particular industry, then we can start iterating. And the pushback  I gave him was he said, well, Josh, the FDA had a choice between failing to approve a  medically life‑saving technology or being afraid of a theoretical hack. And I said, okay,  fine. They had to rubber stamp it. But they could have also said by 2015 anyone putting  elective remotely accessible technologies on medical advice will incur additional scrutiny  for adversarial testing and validation. There's ways to look at this as a marathon. Even if  they couldn't do it with current things, you keep iterating. I'm not trying to trivialize  it. It's actually far more complicated than that. But keeping at it and asking the questions  and being the tenacious hacker that fuzzes that kill chain and fuzzes the chain of influence,  we're going to have a win. So, first of all, I think that a lot of people,  like my mother, couldn't put together that hacking is related to safety. And it was a  matter of teaching her, well, you know, you have to find these vulnerabilities. When you  find them, then they can be fixed. And until that point, somebody could exploit them without  you being aware. So putting the spin on it, being about the safety of our families is  super important. And second of all, how will you prevent an organization of hackers from  being open to abuse? Because I feel like every time I see hackers organized, they do things  like horde exploits that it just doesn't work out so well.  A concern that's come up often is one of the things we said in our anonymous research was  it was prone to infiltration and hijacking. And there were several governments and political  groups infiltrating and trying to hijack. But one of the things about hackers that's  interesting, I think this is what Quinn Norton said, they're prone to influence but you can't  control them. So we're really hard to control. It's almost the virtue of us being so chaotic.  I think this is going to be hard. I think keep bringing these criticisms. In fact, this  is probably one more question. We want to flag every single one of these. We don't want  to just try something. We want to actually succeed at something. So keep raising these  concerns. Oh, look, it's Jay. Last question, how fitting is Jay Radcliffe?  All right. So guys, this week I spent all week talking to media about a talk I gave at  Black Hat and Beesides, which a software flaw put me closer to death than I would have liked.  And when I approached the vendor about this, they said, you should have read the manual.  And we're not fixing that. If you think that, you know, these things are in the future and  that they're coming, they're not. They're here right now. And we need to change these  things right now. And I can find 100 medical device flaws and I'm still going to get the  same response. It's going to take a mass movement. It's going to take all of us getting on the  same page to make this problem change. I can do all these things, but I'm not going to  move the rock an inch forward without more help. Exactly like Josh is talking about.  In the media, in lobbying groups, in places that we haven't been before and there's no  reason that we can't get together and move that system.  Thank you. So we're out of time, but this conversation doesn't have to stop. Please join us for Q&A  in the Chillout Lounge after this talk. Thank you.
DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_0_107.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_108_203.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_204_1967.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_1968_5627.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_5628_8963.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_8964_11951.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_11952_15611.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_15612_17099.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_17100_18095.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_18096_19595.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_19596_21323.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_21324_24587.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_24588_28859.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_28860_28907.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_28908_28955.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_28956_29003.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29004_29051.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29052_29099.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29100_29159.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29160_29207.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29208_29255.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29256_29303.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29304_29351.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29352_29399.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29400_29507.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29508_29555.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29556_29627.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29628_29675.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29676_29759.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29760_29843.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29844_29891.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_29892_30767.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_30768_31091.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_31092_31775.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_31776_31823.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_31824_34643.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_34644_34727.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_34728_36083.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_36084_38195.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_38196_39611.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_39612_39659.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_39660_39707.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_39708_39779.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_39780_39827.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_39828_39887.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_39888_39935.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_39936_39995.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_39996_40079.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_40080_40343.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_40344_40715.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_40716_41111.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_41112_42095.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_42096_42659.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_42660_43019.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_43020_43451.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_43452_43547.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_43548_43595.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_43596_43667.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_43668_43751.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_43752_67067.png DEF_CON_21_-_Nicholas_J_Percoco_and_Joshua_Corman_-_The_Cavalry_Isn_t_Coming_Ue6JAIDoUFI_67068_67517.png
Okay. Good morning, everybody. I'm Nick. This is Josh. We're going to do a few introductions and then we'll jump right into the content here. So I'm Nick Prococo. I have always been and I currently am a hacker. Yeah. And let's try that again. In my day life, day job, I actually run a small team called Sputter Labs at Trustwave. And some of the backgrounds, I've done a lot of speaking. I'm the eighth time speaking here at DEF CON. And I spoke on stage at TED. I've also keynoted RSA this past year. And here's Josh. Good morning. So I'm Josh Corman. In my day job, I am director of security intelligence for Acomai. My comments today are my own. It may not reflect those of my employers. I've kind of been wrestling with being a philosopher in a hacker community. But I think I've come to own it. And I think my research is trended from things like espionage or malware to things that affect our personal lives and human rights and public safety. And that's really taken me down a path for today's topic. So a little bit about where we came from and where we're going. This talk is actually not a presentation. This is a discussion. This is a discussion between me and Josh here on stage. And a discussion with all of you. And this is not a finished presentation. So if you're expecting at the end of this to have us to solve the world's problems here, that's not the intent. This is the start of a conversation. And we also have right there in sort of mid-audience there. We have a microphone. It's there for you to use. If you have a question, you have a comment, you want something to add to the conversation, please use it. But also note that we have a finite number of time here on stage, 45 minutes to be exact. And so please, if you can't fit your comments and questions in 140 characters, please save it for the Q&A session. And we will have a Q&A. There's no Q&A room. But afterwards, please join us in the Chill Out Lounge to continue the discussion. You know, part of the impetus for this is that for how many of you have been to DEF CON before? Okay. A lot of new people here this year. I don't know if you noticed. It's both encouraging and overwhelming. But a lot of us got into hacking because it was our hobby, right? And when we weren't paying attention, how many of you noticed that it kind of accidentally became our profession, right? It kind of messed up. But actually, we weren't paying attention again. Now, IT security, which was our hobby, and then our job is now permeating every aspect of our personal lives and our personal safety and our kids. We're putting software in places it does not belong and is not married. We have medical devices that are completely vulnerable with no encryption whatsoever on their Bluetooth stacks that are unnecessary. As I tried to buy a car, I couldn't find one without a hackable operating system. If you go to showdan, you can find default user names and passwords for control systems, for power grids, for hydroelectric dams. This isn't FUD. This is real. And as we depend on software in places, it needs to be dependable. And in the presence of attackers, it needs to be defensible. And I guess every time I want to quit security, I realize that our failures are going to be inherited by me, my body, my mind, my soul, and my family. So don't think that today is how do you get better at your day job. Think about how do you actually hack your personal life and your personal freedoms. And that should be the scope of today. So a couple of weeks ago, I decided to do a juice cleanse. Has anybody ever done one of those before? A couple people. Yeah. So you spend three days drinking six bottles of juice and nothing else. Besides having interesting bowel activity, it also gave me very vivid dreams when I would sleep. And so at night, I would go to bed at night and I would wake up in the morning with these sort of memories, these odd memories. You know, when you wake up in the morning or you wake up from a dream and you're sort of disoriented and you think, oh, that was real. That was almost a real experience within a dream. Well, I had a few of those a couple of weeks ago. The first dream that I jotted down that I took notes about, I was on a bus. The whole dream just sort of took place on a bus and I didn't know really where we were going. I was a little bit confused. But I saw people I recognized. I saw people sitting with paperwork in front of them, with computers in front of them. And I started to ask questions. You know, where are we? Where are we going? And I soon realized that we're all going to apply for federally issued software development licenses. That each of us, and somebody actually showed me they had one that was expired. They needed to renew their license. Or they could not even write a bit of code. So I thought that was pretty interesting to sort of have that dream. One of the other dreams I had that I took notes about, I was actually in a hotel. I travel quite often. I actually travel all over the world almost constantly. And in the morning when you walk out of your hotel in the USA Today paper is sitting there on the floor and you see the headlines, sort of how you get woken up in the morning. I remember looking, glancing down at that paper as I was off to a meeting and saw on the headlines, and it said Florida man. It said Florida man arrested for hacking tools, possession of hacking tools. And I remember flipping open the paper, reading page seven about what that story was about. And it showed a logo of metasploit. And it mentioned NMAP and Nessus and other tools on there that people might have in their possession. I thought that was interesting. And then another dream that I had, and I started soon realizing that these weren't necessarily dreams. They were vivid. But they were actually nightmares. And this third dream, I was walking down the street in Chicago, sort of dusk, you know, suns going down, turned down an alley and walked up to a door. I rang the bell and I remember being able to see sort of there was a camera shining on me. I rang the bell and they buzzed me in. I went up, walked up three flights of stairs, walked up into a Chicago apartment. And there was guys and girls milling about having discussions. One side of the room there was a maker bot. Other side of the room there was a cluster of monitors. And another area there was some electronics laying about. And of course a lot of cables all over the floor. Somebody I recognized actually handed me a beer and said, hey, welcome. Discussion is going to start in a little while. So I sort of took my seat and started saying hi to people. And then all of a sudden the lights went out, electricity went out, all the power went out in this apartment. And one of the initial reactions, I remember someone in the background saying, fucking, come on, Ed, the power went out again. But then we started hearing banging on the front door and then banging on the back door. And men came into the room wearing black shirts, black pants, black boots. And they started to say we were under arrest for the violation of some act. I can't really recall what that act was. And they lined us up against the wall and then one by one started to zip tie us, our arms and our legs and carry us down the stairs. Now, this was a nightmare that I had. Obviously it's not real. But it's very much grounded in reality and the things that we experience today, if you extend what is going on today, five, 10 years from now, I can see a time when some place like DEF CON can't exist. But we don't have to. There's a better way. I can see a time when friends are being arrested for writing tools. We're being criminalized for research, but we don't have to. So when Nick told me his dreams, I had two thoughts. First, I'm never doing a juice cleanse. And I said, you know, this isn't fun. Let's get real. These are actual precedents. Whether you love or hate Weave, the Weave's case is very dangerous precedent for the criminalization of research. This community does and lives and thrives on our ability to do pervasively do security research. If you saw the aggressive prosecution of the late Aaron Schwartz and all the Aaron's law discussions coming from this, do you know there's a state law in Texas that makes it technically illegal to do a port scan? And from my international friends, Germany and France have already specifically outlined certain hacker tools that are really just assessment and end map type things. And I actually learned last night that Brazil, after some actress had some nudie photos revealed, they passed under duress a law that basically makes it criminalized to have things like end map or any port scanning tools at all. So this isn't fun or fear. This is things that are actually happening. And it's up to us in lieu of any adults in the room to be the adults. Now, that should terrify you, right? But it dawned on me over the last couple of years, you know, I was researching anonymous here two years ago at DEF CON. And one of the things I was concerned about is some sort of neo-McCurthyism when you had a lot of aggressive high profile acts and demonstration of hacking will. Whether you like them or not, it captured hearts and minds and it scared policy makers. And when powerful people are uninformed, they make powerfully uninformed knee jerks. And he started off in his intro saying he is now and always was a hacker. I fear the need to say I am not now nor have I ever been a hacker in our near future. And if you're not worried about it, you really, really should be. Because policy makers aren't as technically literate as this community is. And that's really the thrust of this talk is that I think a lot of us, even our best and brightest researchers, even our, you know, A-listers, so to speak, every time I ask them why they aren't more concerned, they're like, yeah, someone's going to come fix it. Let me tell you something. No one's coming. The people who are going to fix it are to the left of you, to the right of you, or in your own chair. And that was really the big flip for me. So another part of this is that, you know, for personal reasons, I basically hit rock bottom in January. I lost my mom at 58. Had a pretty tough year last year. It really throws into context what's important to you and how much time you have. And I felt like I was diminished that I couldn't really contribute. And what I realized is, you know, people don't really make changes until they hit rock bottom, right? If you want to be a science person, no one changes until the pain of maintaining inertia exceeds the pain of making change. Well, it hurts pretty bad right now. It sucks. There's a general malaise here. Yes, we've had a great week at DEF CON, but there were more talks about burnout and suicide and depression. And there were also a lot of talks that had absolutely nothing to do with security because there's an implicit defeatism. And we don't have to accept that defeat. So there's actually a value in hitting rock bottom. And that value says when no one's coming to save us, it falls to us, right? And if you don't see good things happening, we can put good things in. So at my mom's funeral, I said, you know, the absence of heat is, you know, cold is the absence of heat. Black, darkness is the absence of light. And maybe it's not that there's evil in the world, but maybe there's an absence of good. And I realized that each one of us can finally take matters in our own hands and put in that leadership that's sort of lacking. Nature abhors a vacuum, and I can hear the sucking sound. And it's time to fill that vacuum. Now, what that means is no matter how much we hate certain things, the alternative is worse. So we continue to fail. We don't have to fail in the same way, right? So we're actually suggesting some pretty radically uncomfortable experimentation. I can't believe we're at DEF CON and we're actually going to suggest these things, but we haven't really engaged in the formal process and how things work in the world. You know, there's no senators or congressmen who are experts on stem cell research. They rely on subject matter experts, think tanks, lobbies, et cetera. And as much as we hate these ideas, we're going to ask you to both tolerate and participate in a series of very uncomfortable and very unnatural acts. And this means we already have EFF, EFF has done fabulous things for our community. We haven't really had a voice of interest for our profession and for our talent and expertise. So now we're actually going to be suggesting and starting. We're doing it with or without your help, but we'd love your help. A 501C3 think tank for professionalization of research. Number two, a 501C4 lobby, even though we think they're horribly corrupt and corruptible, it's finally time that we have access to the corridors of power. We're also going to professionalize. We're going to do it very carefully so that we don't become the monsters we fight. But just like the Bar Association for Lawyers or the American Medical Association, giving a voice to the priorities of this community that is public and can give commentary on public policy and public events that's credible, literate and a voice of reason. And then possibly most importantly, we need to integrate a PR or media campaign to win hearts and minds. We have some of the best social engineers on earth, but we've done a really, really bad job setting the narrative. I love seeing Nick on the mainstream news or on Ted stage, but more often than the last few years we've seen Legate. So once again, we can take that microphone and bully pulpit and we can have the right spokespeople with the right messages to actually represent our community interests. Do you have anything to add? What the chain of influence. So whether we like it or not, what we do, what we say, how we dress, what we do in our everyday lives influences people. The words that are coming out of my mouth right now on stage may be influencing you in a positive way, maybe influencing you in a negative way. You may take something that Josh and I have said and talk to somebody else and that message will relay to them. But that chain continues. Now unfortunately, when we take someone from our community, someone who is a hacker from our community and put them in front of a policymaker or a senator or a global government, this is not just a U.S. issue, this is a global issue, what they see is not someone they trust and someone who is an expert, but they see a hacker. And so while the research that that hacker is doing may be vital to our existence, it may have life-benefiting needs behind it. They still see a hacker. And so what we're doing within this movement is trying to organize, better organize. You can have the breakers, you can have the hackers. They're vitally important to our community. But then you also need people who go and come up with the fixes. Now the breakers may be the same people that come up with the fixes, but they don't have to be. So if you're someone who out here likes to break things, how many people like to break things in the room? Okay. How many people also like to fix things or like to fix things? So you're part of this as well. But it's not just the people in this room. We also need people to continue that chain. And we need people from all different backgrounds. Also people who represent the various industries. So when we go follow that chain and we put someone in front of policymakers or we put someone who's on national television or international news, they may be someone who has one foot in our community and one foot in the industry that we're focusing on, whether it's the medical community or the auto-emotive industry or the transportation networks, whatever that may be. So we've got to think like hackers, right? So I want to recognize somebody who's done some outstanding work in the room, Jay Raghda. Can you stand up? So much like the hair club for men, Jay is not just a researcher, but he's also a client. So Jay hacked his insulin pump a couple years back and has since done some hacking on several different medical devices. And one of the frustrating things for me is I watched this and I said that research matters. It really matters. It affects public good. And maybe he did it because he didn't want to die or get hacked at an airport. But a lot of the research we do is fun, but does it really matter? We're going to find the 700th piece of Android malware. Is that really going to differentiate you as a researcher as you try to make fame and glory for yourself or for our name? When we throw these over the fence, does it work? So I really dug into this and I saw the work that Jay and others have done and also the huge loss of Barnaby Jack. Those two were really doing some outstanding work and it's a huge loss. We were already planning to include Barnaby in this. That's very ‑‑ there's no words for that. But when we looked at it, they really have a hard time, right? It's hard to ‑‑ we thought about the kill chain. Everyone knows the Lockheed Martin kill chain for how bad guys get stuff out of your network. We need a kill chain. And what I saw was it was really tough for him to get and procure more devices to test. He did a really good job testing it and finding vulnerability, but then he went to the vendor and didn't work. The vendor pushed back, you know, ridiculed, denied, defused, and I'm sure some vendors are better than others. But we really had a really hard time getting that into affecting some sort of change. And instead of us looking on activities like I found Ode or I published a phone or I have some different presentation at some different conference, we wanted to see how do you pull that through all the way through to a result. So I went to this guy, Kevin Fu, who is a Ph.D. in industry and he's been studying a lot of these medical device flaws. There's way more than you could possibly imagine. And we're still not getting through. So I asked why and the FDA is one of the bottlenecks. They didn't have the ability to reject devices. And they're not actually putting in new framing to allow for better granularity. So an individual researcher can have a really hard time going through multiple gates and multiple obstacles. And really what we want to do is we want to work with people in the industry and map that chain of influence and then fuzz it and try and iterate and fail fast. And focus on, we're not done until we actually see some sort of substantive change in how we raise the bar and do care for putting elective attack surface on life-saving technologies. So that's just a deep example on one of these. But these are tractable. They look overwhelming. And maybe it's not Jay who's going to be the one on CNN or maybe he's not going to be the one who does the driver development to fix it. But we have the talent in the room for every single step along the way. So there might be some people, even when Josh and I were first talking, you know, thinking, well, this is really hard. This is going to be very hard. This is not going to be something that's going to be easy. But we often do very difficult things. And there's dozens and dozens of talks here at DEF CON about very, very difficult things that are being done in the technical world. So to put it a little different perspective, we have a little clip to show you. If you can dodge a wrench, you can dodge a ball. What? So if we can hack something, X, fill in something, an iPhone, a SCADA system, if you can hack anything, we can hack this. But we have to be organized. We have to work together. We have to put the right people in the right roles to get this done. Like we mentioned earlier, you can't put a hacker in front of a center because they see a hacker. But we have to put the right people. And we have people in this room that can fill all those roles. Every single one of you has a role to play and can use their best skills, their best techniques to help drive this home. Jailbreaking the system. It's incredibly difficult to find a jailbreak and implement it and to weaponize something in order to perform a jailbreak. Very, very complicated. We can do that with this system. And as Josh mentioned earlier, some of our best social engineers are in this room or at this conference. Some of the best social engineers in the entire world are in the hacking community. But that doesn't mean we need to be dishonest and try to deceive people. But we use those skills. It's exactly the same skills that the best CEOs on the planet have for selling their investors on something. We need those people to step up and actually play that role as well. So how do we do this? Yeah, I really like the fact that we're calling out that everybody does have a role. It's not a platitude. We really mean it. I mean, right when I said on Twitter that Jay was giving a presentation of B-Sides and I said one of the biggest bottlenecks is getting devices. And three people we've never heard of replied and said, oh, I know how to get them. You have something you can do. And I was talking to a young guy from Portland, Maine yesterday and he pointed out one of his first jobs was doing device drivers at a local Skata systems operating system shop. You don't even have to be a hacker. You can just write really, really solid security-aware code for one of those vendors. So I couldn't find an O-Day to save my life, but I've been very accepted by crossover into talking to government people. He did a TED talk. I was in Vanity Fair. It's like I can take the technical stuff we do here and I can actually make it mainstream accessible and get in front of policymakers. There are actually six of us hacker types at a UN meeting in Toronto this spring. There's Jeff Moss, me, Baitlick, Miko, Pona and some others. And they were listening to us as the technical voice of reason. Now, the bad news is we didn't get very organized, but you don't have to be a rock star, you know, A-list name to actually contribute to the research that we're actually carrying to the outside world. Now, when I say anybody can play a role, I'm also speaking to those pillars in our industry, our tribal chieftains, because this is going to be really, really hard. And in a leadership role, we're going to need our toughest battles require our strongest warriors. So we really, really need not just grassroots kind of like yeah, yeah, rah, rah. We need people to take leadership roles as executive directors on some of these different manifestations. Now, forget the term platform per se. This is a straw man, but we think we've put a lot of thought to this and reiterated this. So for sake of beating up, in fact, we're going to be using this to take it to the meeting in eight weeks, which we will discuss. But we really see that there's three ways to secure our future. We have to keep a very small list of priorities so we don't spread ourselves too thin. We can learn how to do this on a few topics and then we can move out. But essentially, I think we need to focus on public good and safety. And that's really why I wanted to call out Jay and Charlie Miller, by the way, and Chris Valesek. Did you see their amazing car hack? Now, whether they did it for altruistic reasons or not doesn't matter. My neighbors were asking me about it. I got a flood of emails from people who don't know anything about our industry. I had absolutely no idea how much of a car can be controlled via software. So we have a few people doing research like this, but I would like to challenge us through this program to say let's get a critical mass of lots of you. If you're going to pick an Android malware, don't. Go pick a medical device. Go pick an auto OS. Go pick a control system. Because if we can demonstrate that we are doing a unique public good for public safety, guess what we can save off? We can actually carve off and demonstrate and earn the permission with the hearts of minds that what we're doing is critically necessary and therefore requires that we can save off the criminalization research. This is your first time speeding at DEF CON, huh? No. What? Are you lying? No. This is your first time. No, it's not. I don't think we're going to get away with it anyhow. Oh, good. Nice. You've gotten it. I was shocked when you told me this. I think he's spoken here before. But fuck you now. We're getting trolled by PW Crack. Okay. But, you know, even if you don't care about the public good and public safety, you just want to be a narcissistic vulnerability pimp to avoid that criminalization, this is how we're going to do it, right? So if you're going to pick something next year, pick something that matters. Whether you're a father or a mother or an uncle or an aunt, it doesn't really necessarily matter if you want to help public good. Be selfish. If we do some things that are clearly valuable that no one else can provide and we do it in an intelligent way, we give the right PR and air cover for that. We're going to demonstrate that this isn't something to be criminalized. I don't know if you saw the Obama clip about Snowden. He's not going to scramble jets for a 29-year-old hacker. We're going to take that back and demonstrate that we can do this. The last bullet, and this one that really my anonymous research and my research in the UN and ITU, is I'm very, very worried that technology and civil liberties and human rights are not compatible. We're seeing the battle and the entanglement between the two and civil liberties and human rights are losing. They're losing big time. And part of it is because people are evil. And part of it is people like power. But another huge part of it is they're just illiterate. You know, I had very powerful people in government say we should empower the carriers to do deep packet inspection to stave off the erosion of intellectual property to China by enabling the deep packet inspection to do signature antivirus. And I spit out my drink. I'm like, you do realize the efficacy of signature antivirus for state sponsored adversaries is zero. And essentially that's really bad math, right? So I can't stop them from questioning should we trade civil liberties and force the amendment for safety, but I can tell them that it won't actually grant them safety. So we need to do that for ourselves because we live in the world, too. If you're really squint, what we're basically describing will resonate, a little piece of that will resonate with almost everybody in the room, but more importantly, almost everybody in the mainstream because really what we're talking about is protecting our bodies, our minds, and our souls. So there's some next steps. So as we spoke about earlier, this isn't a ‑‑ we don't have the answer for you, but we have some next steps that we want to discuss. So the first of the next steps is naming the movement. We don't have a name. We have some stickers up here that have some phrases on it, but we actually don't have it name the movement. So if you have ideas, please let us know. We're very interested. We're all ears. There's also forming an executive and advisory board. Now, this is not going to just be people from our community. We want to identify those people. We want to identify those people that have one foot in our industry and another foot in another because that's where we'll get the most traction. Also holding a constitutional Congress, a meeting of anybody who wants to participate. Let's get these things on paper. Let's brainstorm how we're going to organize. And this isn't hand waving. The guys at Derby have given us a space eight weeks from now. We will be holding the first Hacker constitutional Congress for interested parties at DerbyCon. For those that can't make it, we're going to look into some way to remote people in. But our tribal chiefs and coalition of the willing and the folks that actually want to make sure that we do this intelligently and we have the right platform and the right issues to promote, we're going to do this right. The other piece is to share the results. We're not forming a secret society here. We want to share these results with people. We want you to have feedback into those results and understand what's going on at all times. So we do have a Twitter account you can follow. We're working on ways to better communicate. And a lot of that will be figured out at the Hacker constitutional Congress and what the protocols will be using. And then of course executing projects, building the think tanks to be able to take the medical research and put it in front of the right people that can change the way they think about what we're doing. So, if we're not going to teach you to be experts on all the different international and domestic legal organizations, but what we can do and hope to do is just flip that one bit. If you thought someone was going to come fix this for you, we want you to realize that the Calvary isn't coming. It's you. Now, it's going to be difficult. It's going to take time. We're going to have struggles. We're also fairly cynical groups. So we're going to point out all the ways this won't work. But it's time to start failing fast and iterating. And I'm willing to take the lumps and bruises. I'm looking at this as a marathon and not a sprint. And if not now, then when. And if it's not you, then who? So, yes, we have stickers. Yes, we have Twitter handles. But what we really need is you. So I have a question for you. And I know some of you were itching to get to the mic, but how are you going to help make this real and who's in? Stand up. Stand up if you're in. The adults. The microphone, yes. Hi there. Gary Reimer. This is my first DEF CON. And I've been coming here because I want to get full blown into the security world. And while I'm not a secure geek like a lot of the people here, I can communicate with anybody from a CEO to a janitor. If I can understand it, I can help them understand it. And you had me sold five minutes ago, which is why I want to be first on the mic. I'm going to give you my cards. I want to get your cards. I want to be part of this. I don't know how I can contribute, but darn I want to. Yes. I just want to say the Fourth Amendment is already the middle ground between the government can do anything it wants and the government can't do anything at all. We wrote a specific set of rules that they have to follow, a warrant based on probable cause and witnesses. This is as far as we should go, period. The second part of that is more rules and more laws and more regulations are not going to fix this. We had some cognitive ‑‑ I appreciate your comments. We had some cognitive dissidents about this because we tend to be a fairly libertarianish group. We tend not to like formal power structures. That's why I was saying we need to hold our nose and eat our lime of beans. And even if you hate these things, this is a set of value levers. And when you're jailbreaking an iPhone, you don't think about how it should or shouldn't be. You find a way to get it done. And I still carry cognitive dissidents over this. I'm the guy who called PCI the No Child Left Behind Act. The last thing I want to do is push more and more regulation and brittle things. I think the spirit of this is using every available mechanism. And we haven't tried these yet. And I'm not sure they'll work. I had some very critical people say you need to be transgressive. You need to be more aggressive. You have to take 10 notches or something like that. And I thought historically about things ‑‑ I'm not trying to equate this to it. But the Black Panthers were very aggressive. They were scaring people. They weren't really causing substantive legal change. And then you had the civil rights movement, which was more moderate, and engaging in system. And it's unclear if one could have succeeded without the other. But I don't want to leave these options on the table. And even if I get my butt kicked and we're ridiculed and made fun of, it's okay because we have to try something. And I think that's why we want to have the Hocker Constitutional Congress. We really want to establish what are our first principles and how do we avoid becoming the monsters that we fight. So I'm hyper conscious of your concern. I share it. And I also just want to connect the dots with some things that are happening. EFF does their part. There's also Fork the Law. There's also a whole bunch of amicus briefs written for WEVE to try to work with the judicial process. And there's a whole bunch of law professors here. And the thing that broke my heart was none of those little groups were talking to each other. So some of the pieces contradicted each other. So even if it's just aligning and getting critical mass on the existing initiatives to force multiply them, that's reasonable. I think some of us are more angry and more aggressive than others. And I hope that's why we're going to figure out what we can agree on and make sure that we keep ourselves honest. It's going to take a lot of work. So I do share your concerns. Thank you. Hi. My name is Sarah Jeffery. And I actually am really very, very grateful that you brought up WEVE's case. I do prison support for WEVE, Andrew, I mean Jeremy Hammond, Barrett Brown, and Bradley Manning. And all four of them have a CFA charge in their rap sheet. I was at the defense of Bradley Manning. And for about six hours of the first day, they were discussing the difference between an EXE file, installable file, and a shortcut of a CD on a given drive. What? Okay. And this is part of the court martial or one of the biggest leaks. Okay. Get the fuck out. This is important. The reason I'm not backing down is because every single one of you here are being persecuted like the actual activists. And WEVE has had 60 days of admin segregation for tweeting from prison. Barrett Brown has detoxed opiates without medication. Jeremy Hammond has been in over 80 days of confinement for making inmates create anonymous paraphernalia during their art projects. Bradley Manning has been tortured for six months naked 23 hours a day. And they call them a hacker just like the way they did with Snowden. And they're using the word W get as a hacker tool. These are all in the actual court proceedings. You can read them from Freedom Press Foundation. They're coming for all of you. So you guys need to put the egos aside. That's all I wanted to say. Thank you for your comments. That falls directly in line with the discussion of the preservation of security research. As a security researcher, I've done things in the last couple of years which I may not want to do today. Just because of the chance of the broad application of CFAA. So thank you. Hi. You guys have talked a lot about legislation that you don't want governments to institute against hackers. What about any legislation that you might want to institute that would provide a counteracting effect? Like for example, holding vendors of vulnerable systems more accountable? I'm not sure people heard that. I had a little echo there. But again, that cognitive dissonance is ever present in my mind that I don't want to necessarily add a ton more legislation. It's more about fixing existing ones whenever possible. I think we should use it sparingly. But one of the things we've realized is there's a lot of things that divide us back to the prior comment. Some people are like, why are you talking about an amicus brief or weave? He's a raging troll asshole or something like that. And I said, it doesn't matter if you think he's a raging troll asshole. Even if you don't like him, it's like the people versus Larry Flint. You didn't have to like pornography to like free speech. In case law does dictate things, that's one of the reasons we have to hack some of the judicial process and work on participating in the working groups that are looking to rev CFAA. And it's not just for even the criminalization research. People who are looking at defending themselves with hacked back or active defense are various things that are also controversial. But one of the things that a lot of us that do application security realize is there's absolutely no software liability whatsoever. So if a toaster burns your house down, you can sue the people who make the toaster. If the Rx35 machine gives you a lethal dose of cancer, you can't sue and win. And I don't think ‑‑ there's lots of good reasons for that. I've done a ton of research as to why the U.S. doesn't want to add more regulation and hurt GDP and competitive edge and other places. But there's plenty of precedent in medical devices. You have the FDA. In cars, you have the five star crash rating system. So it's about shoehorning in and hacking existing regulations and laws to maybe just tweak them instead of creating them from whole cloth. Doug? Two quick questions. Pick what you want. Most of the populations you're talking about trying to channel here tend to prefer true democracy, one person, one vote, one voice, one vote. What we work in for the most part to do legislation is representative democracy, which is a very different system. How do you plan to resolve that without alienating people? And then the other one is got a lot of people standing up here. It's awesome. I love to see that, too. How are you going to keep those people enthusiastic at six months, 12 months, 18 months, 24 months? Great points, great questions. I think the reason we want to have that constitutional Congress is we want to decide how we're going to make decisions. You decide how to decide. And they'll be trade‑offs to all those. And anything volunteer‑esque is going to have its ups and downs. I think the reason this will have some staying power, especially if we get some early movement and wins, is regardless of your motivational structure, if you're altruistic, if you want to do good, there's plenty of built‑in motivation to do it. But even if you're a narcissistic vulnerability pimp, once we have this hearts and minds thing in place, I was talking to someone who was like, I don't care, I just want to get famous. I said, okay, well, how much access and relationship do you have with CNN or Vanity Fair or whatnot, we could be a force multiplication and platform as a service for broadcasting good work. So there's some built‑in incentives regardless of your motivational structure to get some benefit out of this. And I think because we're so frustrated and because there is no other line of defense, and it falls to us, I'm hoping that that gets a little bit of movement. Plus, we just need to get an early win. And I think we have a couple in mind. We've done a lot of pre‑homework. Did I answer the second question? Yeah. So I just wanted to say, while it is easier to subvert existing processes, we can use the same lobbyist organization or professional board or whatever to advocate repeal of existing law that we disagree with. We don't necessarily have to just roll with whatever is there. A voice is a voice. And we can use that to repeal law whole‑cloth. So for people who have reservations about that. That's true. Absolutely. Thank you. Again the choice between two questions. One is we know we can save people. Okay. We can save ‑‑ okay. We can swoop in and rescue the public. But how do we make this more public? How do we shout out that we've done this? And the second is if you're familiar with the 501 medical device registration and where that fits in in the class 2 FDA, could you speak to how we can get software elevated to even a class 3 device? Okay. So I'm not the expert on the medical device pump. But that's why we've sought out people like Kevin. In fact, Kevin does a great job within his scope and remit. But when I talked to him about the Bluetooth, just a tiny anecdote before we run out of time. He said ‑‑ I said why do you even need Bluetooth on an insulin pump? And he said ‑‑ it's not like it's a pacemaker where it's under the skin. And he said, well, it's the bacon principle. What the hell are you talking about? And he said, everything's better with bacon. Everything's better with Bluetooth. So one manufacturer did it. And then they all had to do it because it was cool. And what you have is something that's not medically relevant that's highly attackable in a life‑saving situation. So we need those subject matter experts to answer the spirit of your question. And that's what we mean by mapping these. I think the roles and responsibilities we're hoping each of you can do is once we've mapped that kill chain for a particular industry, then we can start iterating. And the pushback I gave him was he said, well, Josh, the FDA had a choice between failing to approve a medically life‑saving technology or being afraid of a theoretical hack. And I said, okay, fine. They had to rubber stamp it. But they could have also said by 2015 anyone putting elective remotely accessible technologies on medical advice will incur additional scrutiny for adversarial testing and validation. There's ways to look at this as a marathon. Even if they couldn't do it with current things, you keep iterating. I'm not trying to trivialize it. It's actually far more complicated than that. But keeping at it and asking the questions and being the tenacious hacker that fuzzes that kill chain and fuzzes the chain of influence, we're going to have a win. So, first of all, I think that a lot of people, like my mother, couldn't put together that hacking is related to safety. And it was a matter of teaching her, well, you know, you have to find these vulnerabilities. When you find them, then they can be fixed. And until that point, somebody could exploit them without you being aware. So putting the spin on it, being about the safety of our families is super important. And second of all, how will you prevent an organization of hackers from being open to abuse? Because I feel like every time I see hackers organized, they do things like horde exploits that it just doesn't work out so well. A concern that's come up often is one of the things we said in our anonymous research was it was prone to infiltration and hijacking. And there were several governments and political groups infiltrating and trying to hijack. But one of the things about hackers that's interesting, I think this is what Quinn Norton said, they're prone to influence but you can't control them. So we're really hard to control. It's almost the virtue of us being so chaotic. I think this is going to be hard. I think keep bringing these criticisms. In fact, this is probably one more question. We want to flag every single one of these. We don't want to just try something. We want to actually succeed at something. So keep raising these concerns. Oh, look, it's Jay. Last question, how fitting is Jay Radcliffe? All right. So guys, this week I spent all week talking to media about a talk I gave at Black Hat and Beesides, which a software flaw put me closer to death than I would have liked. And when I approached the vendor about this, they said, you should have read the manual. And we're not fixing that. If you think that, you know, these things are in the future and that they're coming, they're not. They're here right now. And we need to change these things right now. And I can find 100 medical device flaws and I'm still going to get the same response. It's going to take a mass movement. It's going to take all of us getting on the same page to make this problem change. I can do all these things, but I'm not going to move the rock an inch forward without more help. Exactly like Josh is talking about. In the media, in lobbying groups, in places that we haven't been before and there's no reason that we can't get together and move that system. Thank you. So we're out of time, but this conversation doesn't have to stop. Please join us for Q&A in the Chillout Lounge after this talk. Thank you.
small team called Sputter Labs at Trustwave. And espionage or malware to things that affect our of the impetus for this is that for how many of paying attention again. Now, IT security, which names and passwords for control systems, for of your hotel in the USA Today paper is sitting things that we experience today, if you extend better way. I can see a time when friends are dangerous precedent for the criminalization of know, I was researching anonymous here two years off in his intro saying he is now and always was for personal reasons, I basically hit rock bottom is, you know, people don't really make changes pain of maintaining inertia exceeds the pain of were more talks about burnout and suicide and falls to us, right? And if you don't see good matters in our own hands and put in that radically uncomfortable experimentation. I can't access to the corridors of power. We're also very carefully so that we don't become the commentary on public policy and public events and minds. We have some of the best social the right spokespeople with the right messages to community, someone who is a hacker from our be vital to our existence, it may have they may be someone who has one foot in our industry and he's been studying a lot of these medical device flaws. There's way more than you if you can hack anything, we can hack this. But best skills, their best techniques to help drive implement it and to weaponize something in order We can do that with this system. And as Josh world are in the hacking community. But that exactly the same skills that the best CEOs on the planet have for selling their investors on I know how to get them. You have something you voice of reason. Now, the bad news is we didn't Miller, by the way, and Chris Valesek. Did you unique public good for public safety, guess what else can provide and we do it in an intelligent can do this. The last bullet, and this one that antivirus for state sponsored adversaries is of the next steps is naming the movement. We just be people from our community. We want to wants to participate. Let's get these things on legal organizations, but what we can do and hope a secure geek like a lot of the people here, I jailbreaking an iPhone, you don't think about how that's reasonable. I think some of us are more preservation of security research. As a security Even if you don't like him, it's like the people what you want. Most of the populations you're much access and relationship do you have with CNN incentives regardless of your motivational accessible technologies on medical advice will hijacking. And there were several governments and that's interesting, I think this is what Quinn all week talking to media about a talk I gave at Black Hat and Beesides, which a software flaw put when I approached the vendor about this, they