>> We start off with cats. I've got a lot of stuff to cover so it's like, this is a big rant
for me so I want to make sure we get right to it. This is the name of the talk, around the
world in 80 cons. Basically, one of the things I like to do is alternate, it's like, one year
I'm going to do an offensive type team, the next year I want to rant. I said we'd do a
community talk. Last year I did a talk on phishing and social engineering so that was my
offensive talk so we know what year this is right? There we go. So, get ready we're going to
start ranting. They only thing you need to know about me is that I get around a lot. So,
travel and one of the things I like to talk about when I do that though, is I don't just go
to the conference, I'm there for the conference and then I fly out. I like to visit the place
that I'm at. I've spent 11 hours walking to the (indiscernible) district in Bejing. I went from
the (indiscernible) of Cairo up to the Cairo towers which took seven hours. Great Pizza Hut but
the Nile by the way, it was really good. I do that, I like to explore the city, I like to
be there, I like to see what it's about and see what the people are like. I wanted to do
a talk about that and guess what? That talk changed because of what had occurred so this is
a really weird talk for me so just buckle in and we're just going to get through this. One
thing, and most importantly, I'm not speaking for anybody, I'm not speaking for a hacker
movement, I'm not speaking for a community. My perceptions, my perpectives. Russ Rogers said it
the best; I like tacos. That means all hackers like tacos. Right? No, I like pizza. Nothing
against tacos, but no. That's the whole key thing. It's all about different perspectives.
This whole talk as you see through it, is about our perspectives and perceptions and
how they have been changed and manipulated over the years. So, first of all we talk about
computer cultures and the hacking and always, for some reasons we bring in the global
part of it. It always gets to nation state. So, I want to get that crap right out of the way.
So lets start off with the vendor reports that you see. Verizon data breach, the one on
the left. That's one from 2013 – 2014 is the one on the right. Notice how they have covered
more area because that first one was a little shall we say lacking? So, what did the
research team do? They decided, oh, someone reported a breach from Hoboken, New Jersey. Cover
all of America. There was one incident in Wu Shi, China. Cover all of China. Problem solved.
So, now it's a more comprehensive report. I don't want to get in a Twitter war
over this report, I've already done this about this report. It's a good report. It's got
good numbers, and good data and good sales points. But, it's not showing all of the picture. Same
thing with Trustwave, if you see the one on the left. They have a great graphic department, that's
awesome because who doesn't love pie right? It's got some good data and once again, it's not
telling the whole complete picture. And then you have the new reports that came out that
actually looks like a picture of a rave that I wasn't invited to which hurt my feelings. But,
it's still got data that you can use. But, one of my best ones that I love the most and
literally one of the best sites that I love is hackmaggedon.com. Because first of all, not only
do they have pie charts it's like they actually put the flags on the pie because let's face
it, we're in America. It's like the only time we know what a country's flag is when we are
invading it. So, it's really refreshing to actually see flags before that occurs. So, that's
awesome. But, the most important part is this right here. His disclaimer on his site. Again,
no need to repeat that data must be taken very carefully since they do refer only to discovered
attacks (the so-called tip of the iceberg), and hence do not pretend to be exhaustive but
only aim to provide a high level overview of the global Cyber landscape. That is such an
awesome disclaimer that I'm not going to use the word cyber. That's awesome because he is
honestly saying this is what I see. This is not the all, this is not definitive. That concept
of this is what I see and we need more of that. There are more reports out there, some are
more technically accurate, more of them give you a snap shot of data. This is one. I saw this
one tweeted all over the Twittter sphere, no this isn't from War Games by the way. This
is actually a website, digitalattacksite.com, it shows the horrible attack. That's on
May 9th. This was from July 22 of this year. Does the perception change because of the
data? Or is it just the fact we are looking at a snapshot trying to change the story to suit our
needs? That didn't get tweeted all over the twitter sphere. When it's shooting straight up,
when you see that heavy concentration from the middle, that means it's internal denial
of service. We don't want to talk about that part because it doesn't fit our narrative. >>
Other reports are a little more blatant in their obscured perspective of what they see the
world to be like. I have to be honest. I don't know at what point when
Richard (indiscernible) when he was a young boy in school that China came over and stole his
lunch money but it hurt him really bad. I want to get a doll, go up to that guy and say,
show me where on the doll where the China touched your network. (Laughter) >> It's incredible.
That's not just me. I did a Google search for mandiant report, I kid you not, I am
being totally honest. This was the first image result. (Laughter) >> Up until just
recently, that, to me, was one of the most offensive kind of like scurred, xenophobic type
attacks, until Crypteria showed me this. You are telling me your product is so great ‑ ‑ I'm
sorry, not great, what's the word? Stupid, the only way to stop the attack is an engine
filter looking for Chinese characters and that's your product? That's where your only
threat is coming from? Disgusting. I didn't block out their name, I didn't censor
their name. They can stand by that if that's what they want to show, that's World War II
propaganda style right there. I'm not going to say which side, the Allies or the Germans, it's
still World War II propaganda material. It's ridiculous in this day and age to have
something like that as a decent marketing campaign. Indecent maybe. Let's break it down. I
want to get this out of the way real quick. Let's break it down. China is bad, right? That's what
we hear. China is bad because they spy on their citizens, they spy other countries, they infect
other nations computers with malware, they try to sensor the press and try to suppress
protesters. Isn't that horrible? (Laughter) You know what? We've got to address this. It's an
uncomfortable thing because I'm going to Bejing next week. But it's like, let's break it down
bit by bit. I want to take a look at each one of these individually. They spy on their
citizens. That's horrible. Oh wait, this isn't China is it? I love the fact that it's like,
you know, Congress is all, well if you have nothing to hide why are you worried about
monitoring? Oh my god, the CIA was monitoring computers that they own that we were using.
That is horrible. That outrage for them, but not us. The best part about it is this CIA
apologizes. So, in other words, other countries, other nation states, when you hack us make
sure you sure you send an apology letter and it's all good. I guess that was the part
that was missing. You can't just steal the data, you've got to say sorry. So, there is that.
They spy on other countries. I will have to tell you this. Two points, first of all how bad of
a person or country do you have to be to make a German that sad? (Laughter) >> I mean, seriously?
She got groped by George W, and she didn't look that bad. One of the other things that gets me is
in the lower left, you see and Italian magazine that says U.S. spies listen to the Pope,
Vatican says unaware. Guys, I don't care what religion you are, atheist, Buddhist,
whatever, we all have to admit, seriously this is a pretty good Pope, I like this Pope, he's a
cool Pope. He takes selfies, for god's sake, how cool is that? He's a pretty good freaking
Pope. Why not the other Pope, the guy with the red shoes? He looked a little sketchy ok? I
could understand that, but you are actually spying on this Pope? That's just not cool. They
are doing that. They infected other nations computers with malware, which that is horrible.
That should be an act of war. Oh wait, except for when we do it, that's cool. One of the best
denials of an attack I have ever seen is from the U.S. when they were like "no, we did not hack
into those centrifuges in Iran," that wonderfully orchestrated, brilliantly executed, well
thought out, masterpiece of an attack, wasn't us. That was great. I thought that was
awesome. They try to sensor the press. Well luck for us, we have the freedom of speech, the first
amendment rights to protect us except when we don't, so that's not cool. Like a roller coaster
‑ ‑ not amusing, and it's not, I like this one here, they try to suppress protesters, because
this is hilarious. This is actually what they were called, free speech zones that George W
set up. You may not be able to notice this, the machine guns and the iron fences. That was
the free speech zones when you protested at some his rallies. So that was good; where we had a
free zone. And the other one where the U.S. Army hired spies to go undercover, you know what
the anti‑war protesters are talking about? The Quakers, that's your threat, one step
above the Amish and you're going after those guys? That little living room meeting -- going
around eating coffee and crumpets is dangerous. So, they are doing that too. Basically
what I am trying to get at is stop saying this country is doing X. It's all countries are
doing X. This is a report by command and control servers all around the world, they are
everywhere, every country is doing these kinds of attacks, even in Canada. Canada! I can
just imagine how the hackers over there -- excuse me, pardon me, I have to pawn your network
now and I apologize. That is exactly how I'm imaging it, it's like, oh you should have
(indiscernible) on the internet, that's too bad, sorry. Even Canada is doing it. It's like,
so you know that's bad. So, now that we have that crap, I mean that stuff out of the way, let's
get to the real stuff. I wanted to start talking about the hacking cultures I have seen
around the world and how they are different. I will give one experience of my perception and
then I want to give an actual survey I sent out around the world and had them fill it out
and how it started changing the way my talk was going to be. Let's start with China, Asia,
South Pacific. I was going to start talking about how one of my first experiences when I went
to China four or five years ago, but I have a new one now. A couple weeks ago I invited Dave
Kennedy over to the Bejing Institute of Technology to give a lecture there. And Dave was a
little trepidatious, a little like okay, Jayson, you expect a black van at the airport, he had
preconceived notions just like I did. He was like, okay this is the way it's going to be. When I
first went all I knew was what I saw in the media, the press. By the time the trip was over, he
was like, Jayson that was one of the best experiences of my life. It opened his eyes and he got
the view of the other thing going on. That is a beautiful that we all need to do and we
all need to understand. It's not just what we are being told but we need to experience, see for
ourselves how that stuff actually works. Let's go with the survey I sent out. I sent a
lot of questions. These are the ones I centered on the most. What country are you familiar
with? I do not edit what they are saying. I currently live in China, I spend half between the
U.S. and China, how did you find out about hacking? Just a simple thought, how can I get unlimited
gold and rice at the beginning and beat Romance and Three Kingdom, which is made by
(indiscernible). It is Nintendo white/red game box in the late 1980s when I was 20. He had a
need, as a hacker, a necessity. Who doesn't want to beat video games and who wants to work that
hard to do it. So boom, let me find it, right? It's like in your region how is hacking seen
by the general public? Overall it still trends towards negative, public lack of
understanding, even people who accepted hacking as a skill, a method but most people stay away
from it. Is hacking in our region seen more as crime, activist nation state or other?
Public media defines, depends on official needs, today it may be a crime, next day is national
heroes. Some days it is a technical challenge. Like most of the places it's a mixture,
some of criminals to be used for national interest under certain control, official security
workers may conduct hacktivist or crime in his or her leisure time. Some can be hired overseas
interests. I have actually seen different hacker groups creating out, bot nets through other
countries to hack so it looks like it's coming from China, because who cares it's coming
from China, not knowing it's actually America or Russia, or Asia but the one sponsoring the
attack. So, let's go to the next one, let's talk about Europe. One of my experiences now was
(indiscernible) if you are not familiar with (indiscernible) it's a DEF CON conference,
viewed by 2000 people, a huge thing at Euro Disney, it's DEF CON in a 24 hour period.
Literally, it's Night of Hacks, it goes all night. They start off talks around 8:00, 10:00 in
the morning and 8:00 at night it's workshops, you have a (indiscernible) village, you've
got hardware hacking, it is the true distilled essence of – you've got a massive capture the
flag going on, that was the main draw, but the essence of DEF CON, pure socializing and
hacking and learning as much as you can crammed into this one time frame. Bring a lot of
No-Doz and 5-Hour Energy drinks with you because they don't have them readily available because
it's at Euro Disney. I had to bring up one of the creepiest moments of my life, being a
hacker at Charles De Gaulle Airport in a hoodie, a suitcase and sunglasses, with stickers on
the suitcase waiting for the Disney shuttle. (Laughter) I actually had this little girl
walking next to me and her dad pulled her aside and I thought dude, I'm not even mad. That was
a good call. I look sketchy right now. But it's at Euro Disney, great conference,
hacking Paris, the Black Hat version, but less sucky. It's a good place to go check out.
Let's talk about the survey. He's from Croatia, I traveled a lot but since I've lived here
all my life, the answers is the same. He found out hacking, the term, probably from the movie
"Hackers". I love a lot of international responses I got were from different movies. I do
personally believe that Angelina Jolie has done more for starting the hacker movement than any
other movie around. Thank you, Angelina, I still want my awkward hug. In your region how
has hacking seen by the general public. The media portrays hackers as criminal master minds
that infiltrate system from their dark rooms. I am sure you know the cliché quite well.
Unfortunately, yes, I do. Is hacking in your region seen more for crime, hacktivist, nation
state or other. Once again, crime. Seeing a theme here, people? It continues. My last, I
went to Brazil once, for a conference, and I remembered going to the speaker dinner and
the guy was like, this is hackers aren't only a big thing down here, it's not illegal to
hack so it's not cool and no one really – they just think we're nerds. I don't think that we are
hip or part of it or edgy, stuff like that. I'm like, I am sorry, maybe you'll get arrested soon.
(Laughter) >> I don't -- good luck with that. I don't know. How do you answer that? The good
news for him is that now they've enacted laws and now Brazil does have cybercrime law and now he's
an outlaw. Yay, for him, I guess. So that was my experience in Brazil. Let's talk to someone
who has there in Brazil, lived there. How did you find out about hacking? One of the best
answers I have ever gotten on the survey. "Trying to get things done." Exactly right.
That's the truest essence of hacking. I am trying to get something done. Most discoveries
are because I am trying to get something done. How is hacking seen by the general public in
your region? Good and bad, at this point in time unless you are doing something you wouldn't
be aware of hacking, online banking being implemented in 96, 97, bankers activity started
increasing in Brazil. Banker's activity means credit card fraud, bank theft online, things
like that. Is hacking in your region seen more as a crime, hacktivist, nation state or
other. Considering those who don't know anything about it seeing stuff in the news mostly
tied to crime and sometimes hactivism. In the corporate world a better understanding to
ethical hacking. I am getting these over the course of a month, I'm getting these other
surveys, better reports and still seeing the same trend. It does get me angry. My first
experience to Africa was to go to Cairo. Some people say that's Egypt, that's Middle East. It's
on the continent of Africa, it's Africa. I went to Cairo, it was an awesome conference. But
hackers don't dress like hackers, or my mental image of what hackers are in my
perception. Everybody was in suits. They made me wear a suit. A disadvantage, it made me look
normal. They thought I was normal and they were disabused once I started talking. That is
actually me giving two students the rabbit ears as they are getting picture with Jayson. All
good. My best photo bomb I have ever done, one student taking the picture behind the banner,
we all take that picture, you are doing it, behind the DEF CON banner, you've got to take that
picture and be like "I'm here." So he is taking that picture at his first conference ever,
taking the picture not knowing that 20 feet behind him in my suit I'm going. (Laughter) >> I
love that picture. That was a very, very polite, very official, very sedate crowd. I
talked later, met with them after the conference and all of a sudden it all changed, but the
organization, the group, was a little different. Let's talk about what's going on in Egypt.
I love this one. Caught a virus in 2005, a certain person downloaded a pirated game and it
was back doored, wonder how those virus worms worked. Learned some programming by
first doing sample virus sources and walked the road and never went back. [Applauding] That's
what it's about. Oh my gosh, I got pawned. That's sort of cool, how did that happen? Let me
figure it out. I love that answer. How is hacking seen by the general public? In your
region how is hacking generally viewed by the public. It is viewed as hacking other people
people's Facebook and Yahoo accounts. People that is a depressing and sad. They still
use Yahoo. Take a moment, sink that in. Horrible. Hacking, in your region is seen more as
crime, hacktivis, nation state, other. Most view as a crime. Few knew about hacktivism, still
seen as a crime than hacktivism. Still is something done by criminals and nefarious people
trying to get freedom. I have gone to the Middle East and I have broken into places, they
let me back, which is awesome. One of the first trips there, Beirut, Lebanon, really cool
guy, what's going on? Wanted to show me something so look on my laptop, he shows me the screens
and I'm like, what is that? Oh, that's the national telecom system. I am admin on in, root
on it. I have had access for four years. I am like what are you doing with it? Not paying
your bill? Getting into other peoples' account? I still pay my bill, I just have access is that
cool? I thought that was awesome, he's just an adventure explorer. I don't suggest you do
that in your country's telecom system, but it was like the Wild Wild West, totally cool,
adventurist spirit, not the lawyer spirit. So let's talk about Lebanon, how did you find
out about hacking, from the BBS, mIRC. In your region how do you think hacking is seen by the
general public. There is huge lack of awareness, lack of exposure of countries hacking
wise and hard for young people to grow up with good access to that culture. A lot of the
internet over there is 3G, 4G, it's like they are all cellular, not many land lines with direct
connections to people's houses. You carry your Internet with you. Is hacking in your region
seen more as more of a crime, hacktivist, nation state or other. Again, lack of awareness
results in people hearing about hacking on the news. Since media just reports on cyber criminals,
this is the way they see hackers in general. I am seriously telling you I am getting pissed.
There was an extra boost of Pepsi consumption during getting these surveys. Let's go on to
North America. I will qualify: One of the main nonconsensual, awkward hugs that I will
continue to get is from Bruce Potter, he hates them so much, but Heidi gives me permission so
too bad for Bruce. Let me talk about (indiscernible) and Def Con and in Derby Con. There are
some many conferences here that you get to see groups of people, and I want to center on DEF CON
and it's just because I'm here and I am trying to play to the crowd, I'm being honest. This is
my tenth anniversary here. If you know me and knew me before that you will realize I have
created a family here and I see these people all the time. (Applause) >> I know more what's
going on with hackers in different parts of the world, places here than I know what's
going on with my real family. I hope they are not watching, but still, this has given me a home,
a place to be. I would not be here, not even around if it wasn't for the people I met. I
am grateful for that and humbled by the acceptance of these people. That's my experience in
America with DEF CON. Let's talk about what country we are more familiar with. Canada is in
North America so I didn't go American but familiar, like all Canadians I am stupidly aware of
the USA. How did you hear about hacking? I don't know, that's what it was called until many
years later. I presumed everyone took things apart to figure out how they worked. I ultimately
put two and two in the late 80's when I was going back and forth between data pack and figured
outgoing between Datapac and Fidonet. In other words, it's human nature. Just what it was.
We don't know our prejudice, we don't know what we are supposed to shun until we are taught by
someone older usually. But as children we don't have that, we have to learn it from others. In
your region how is hacking seen by the general public. It's a media terminology, most
universally reviled, hacking, doing cool stuff is very well received. Is hacking in your
region seen as more of a crime, hacktivist, nation state or other. The media terminology is
seen as a negative thing comprised largely of (indiscernible) and hacktivism.
Where did we come from, people? Is this okay with you? That this is what is seen? That no matter
what region my talk was supposed to be about how Malaysian hackers are more into hacker
spaces, how the Germans love encrypted protocols, how the Brazilians do banker cards. I
was trying to do a talk about the diversity of the hacking culture and I found a single
thread that unites us: We're seen as criminals. I am not happy about that, because this
is who we come from. This is who we come from. Allen Turing, the godfather photography saved
thousands on thousands of lives during World War II helping crack the Enigma machine. After
the war his thank you was castration until he drove himself to suicide because he
wasn't socially acceptable by the people he saved. What about Tesla, the godfather of open
source, because we are so befret of his inventions, because he didn't want to make a profit.
Companies didn't want to invest in it, until he died alone in his hotel room it took two days
to find his body. Thank you for your inventions, sir. What about Ada Lovelace, one quick mention
on women in tech debate, Ada Lovelace was the first programmer, women started this
industry, that's all there is to that. (Applause) >> First computer programmer shunned and
exiled from her family, died from treatment of cancer, not the cancer itself. What about
Paul Ottlet from Belgium? He created and (indiscernible) the Internet. Sorry Al Gore. Died in
1944, penniless and broke but everyone is still using his indexing system but that whole
other dream of being together as a community and uniting the world, we don't have time for
that. I would talk about Leonardo Da Vinci, because he is the uber hacker, he is the
inspiration for every hacker to try to be but he died really well, people loved him, the
prince gave him a mansion to retire in, but we will forget that guy. Those are the
inventors. Hacking is artistry, it is invention. I see something here, let me make it better.
That's not what we see now. When did it change? When did we become the villains in this
story? It wasn't 200 years ago because 40 years ago there were plenty of other changes. But let
me give you a snapshot of the current justice system today. I am not going to talk about why
or who they should be or the (indiscernible) was just but talking about sentencing. Jeremy
Hammond, 10 years for hacking, Angie "Weev" Auenheimer 10 years for hacking, which was basically
essence that he was enumerating URL's that were publicly addressable. You are in the 90s,
going to the websites with the picture folders, you did the same thing. But that's what he
was arrested for and given 10 years for. Max Ray Butler, 13 years for hacking. Roman Vega,
18 years for hacking. Albert Gonzales, 20 years for hacking. Is that fair? Some people would
say yes. People like me think maybe a little excessive. Ma'Lik Richmond one year for rape.
Gerhard Becker, one year for involuntary manslaughter of a firefighter. Trent Mays, two
years for rape, the person who was actually exposed the two rapists will probably get 10 or
20. Seth Hornberger, 3 to 6 years, voluntary manslaughter. And don't forget Jessica
Fraraccio, five years for murder of a 23 month year old toddler that she was babysitting. She
bashed his head in. Us hackers would like to be mysterious, on the outside, guess what? Juries
are made of people and what people don't understand they fear and what they fear they try
to destroy. I was told at a conference, a guy gave me a piece of insight I never thought
of before. It's sad and depressing, he said dude, the reason is hacking is new,
unknown. We have gotten thousands and thousands of years to get used to murder. Juries
know murder very well. We know about rape, killing, stealing, stabbing, those things. The
computer thing is new. We are more fearful of that. How twisted, sick and right is that?
What about these criminals? Straight up criminals actually admit it, Bill & Paul hacked a
company's accounting file to try to get free computing time, got access to the administrator's
password used to steal the company's internal accounting file. Allen doesn't go into
detail on how they got the password, hoping to get free accounts, got caught, the
company booted them. Bad guys, hacking our network, stealing our data, grabbing our access,
we will teach you a lesson. You don't get more free computing time at school. What about these
two thieves? Straight up hood. (Laughter) >> What did they do? They sold illegal equipment to
defraud a legitimate working business of profits they were entitled to, the service they
were providing. But we showed them, didn't we? Everybody raise up your iPhone. Exactly. That's
what happened to those criminals, just 40, 50 years ago that's how we handled hackers.
Four years ago, not so much. Another young man who already founded a multimillion dollar
company broke into a utility closet at MIT, hooked up a laptop to the campus network
downloaded four million academic journals, most in the public domain from a paid archive to
which he had a subscription he paid for. He was arrested, indicted twice, had a trial that
had begun in April, could have faced 50 years in federal prison and a million dollar fine. His
name was Aaron Schwartz and he took his life because of it. He was actually hounded to death
because of that crime. That's now acceptable. That's what we are supposed to say is okay. No,
that is not okay. To have such an ignorant government telling us this is the crime and letting
them show us the laws. Letting them keep the laws on the books without trying to make a change
on it. We need to start. Because if we don't, they will keep doing this. Look at some of
these pictures, people. I mean the one on the right looks like the (indiscernible) coming after
me. Every time I see that picture I want to throw a ring at it, not because I like it.
That's ridiculous! That is what they see. That is what the public sees when they look at
you and you say you are a hacker. I have a cold computer room. Okay? I have extra air
conditioning unit in the window. I have never been so cold that I need the hoody up and a ski mask
on to work. How do they get the images? Sometimes we help. I told Mikko, I had to make fun of
him, the other guys are (indiscernible) I didn't want to piss them off. We like to help
with that image, because we like being cool. I don't know about you, but in high school I was
not very cool. At all. Okay, junior high I wasn't very cool. Elementary, never been cool,
dudes, didn't happen. >> AUDIENCE: You are now. >> Thank you for that. We say that, and
we want that, want to be that different, that outside. But they are using it against us. So
what are we going to do? You have to start changing the story. I really hate this
because this actually shows you, this is from Night to Hack on the left talking about pirates,
but if you are a good guy, working with Raytheon and contractors, doing Ninja, screw
that, I am a Ninja, sorry pirates. Those geeks on the computers using Windows are not
Ninjas. Ask my kids. My daughter got in trouble on the bus fighting, defending my Ninja
honor. There was a sad conversation that day when I said it was a secret within the
family. We see stories being skewered and manipulated. Look at this one. Just based on a
video game, been criticized for promoting hacking. What the heck is wrong with us? What the heck
is wrong with him? Being on the wrong side of Glenn Beck is being on the right side, as far
as I am concerned, my personal opinion. Okay? I like to think that's a witty comeback but
nothing was wittier than this. From Bravo Hacks, I hear Watch dogs teaches you to hack, going
to expense for educational training purposes and submit for CISSP creds. That is awesome.
Here's another one and I will do my one over and rant now, over here, after DerbyCon we had a
guy come on, this is Sterling Riggs jerkoff, by the way, my personal nickname for him, we
are that close, Sterling Riggs jerkoff posted on Facebook, I can't talk in his voice, I don't
know how I feel about this DerbyCon happening at the Hyatt downtown, it's a convention for
computer hackers! Sessions include password cracking, hacker war games and a lot
pavilion. Thoughts? Guess what? There were some thoughts. It's the Internet, don't we all have
them? Greg Troutman, the LPD and FBI should raid the convention and arrest of the people were
doing the training. They were in training, idiot! Darcy Fraiser, so overcome she could only use
an emoticon. Connie (indiscernible) I bet no arrests, more like employment
opportunities. Very good ones, actually. Jenny Smith, wow, that's insane. Have you read the
rest of the comments? Sean Goodman, what about classes on mugging, car and theft? Brenda
(indiscernible), Sean, that's next week, she's the witty one in the bunch, LOL. Amber Nicole
says, I think it's stupid. Amber, you didn't capitalize "I", I think you are stupid. And
then (indiscernible) goes arrest them all. I seriously expected the targeted advertising on
Facebook would be for pitch forks and fire. Guess what happened? (Indiscernible) geek
saw it: Posted on Twitter, hey, guys check out this insane thread going on, so what did we
do as hackers? We started commenting. At first we think my gosh, must have been horrible.
We started informing, educating, telling people what it was about, trying to change their
perception, trying to show them, this is what hacking is, this is what the conference was about,
try to come next year. We were trying to bring an olive branch out, stop fearing us. So,
Sterling Riggs jerkoff did the only responsible thing a good reporter could do and he
destroyed the thread, the only screen shots of this thread because he deleted it, it was no
longer filling his narrative. That's horrible, right? Well, no, it's just his right. I agree
with you, but guess what else? I am guilty of the same exact thing. I am a hypocrite. I don't
mind, I am being honest. Because I loved making fun of this lady. I loved making fun of the
McDonald's hot coffee lady, because it was hilarious. Oh, I spilled coffee, million dollars
please. The judge was on Jay Leno, everybody liked to make fun of this. Everybody loved to
make fun of the hot coffee lady. She was the reason why we say "water is wet, coffee is hot.
Please don't stick this in your eye." Isn't that ridiculously stupid? Until you meet her. You
realize she received third degree burns over 50% of her body that required skin grafts.
All she asked for was emergency room expenses, treatment, and they said here's $800. Until you
realize she went to court to get expenses paid. The court awarded her not what she asked for, but
two days, two days coffee sales." Just two days of their coffee sales profit. That
totaled up to $2.9 million. She received less than $500,000. I have met the McDonald's coffee
lady and she is us. That story was changed because they had a voice and thought they could
change it, and they got away with it for a long time. How long will we let them get away
with making that story about us stick? We have to do something about it. I am glad to say, we
are. We are starting to understand what the problem is. Knowing is half the battle.
Knowing is half the battle, we are not understanding we have a problem to deal with it. I have
good news. We are starting to get people out spreading the news, actually changing the
narrative. I love, got Evan booth, Kaminski, (indiscernible), Brian Krebs, a
reporter is starting to tell the accurate story about what's going on. Also to mention, I
love Dave Kennedy, you may have seen him on fox news, CNN, MSNBC, the Katie Couric show,
every time I see him in real life, I freak out. He needs one, like one of those holographic
ones but these are great voices. We like these voices, people talking about, getting in the
media and talking about hacking. We like great speakers and orators and knowledgeable
hackers going out and talking on television, maybe not everybody. Maybe not everybody. Let's not
get carried away. Not everybody has to write narrative to go with, not everybody is equipped
to tell the story, but there's quite a few, and my question, my challenge to you, my biggest ‑
‑ seriously. This is what I would like to see happen. Why not you? You don't need a group.
I am the Calvary. Great thing to start and ‑ ‑ you ‑ ‑ news stories happen and your local
news covers it. Call your newspaper, television show, if you have information and can
tell a good narrative in a way people can understand, do it. Do not try to pimp yourself out for
PR, but educate the public. That's what it's about. If you are not here to try to learn to
take it back, educate people to be better, then you are wasting your time here. We need to start
educating outside of the echo chamber, start communicating with the people that don't know
how to run computers, do a [indiscernible], need to start educating them, letting them
know who we are. [Applause] >> This is what we are getting to. At 7:00 this morning, without
any Pepsi, I am starting a movement because it's a cool thing to do. I don't have a
website out for it yet. No, I haven't got a logo, but I stole art from Google like everybody
else. What I want is not a group. I don't want an organization. I don't want a
whole bunch ‑ ‑ I just want one website with the simple thing, instructions on how to talk to
the press. Simple instructions on how to talk with users. That's it people, no meetings,
no talks about it, nothing else, but informational standpoint for you to individually start trying
to make a change in this place and make it better. That's what we need. We're so cynical, upset
with the way things are. We're so tired. You are not powerless. You are not someone that just
gets to sit on the sidelines, make funny witty comments and think it's funny. You have a
responsibility to do something about it. You are a hacker, that's what we do. We do it
freaking well. BloodKode started here because one of our own needed blood. What did we do? We
created a blood drive at DEF CON, first year, the lady of the blood bank was in tears because
it was from 9:00 to 5:00 on one day. By 9:00 a.m. the slots were all full, she had to spend the
rest of the day turning people away. The second year, we had it for longer. Guess what? It was
the biggest blood drive in Nevada state history at the time. The Ninja party was giving
out invites that might have helped. But it still happened. What else occurred? The next
year, last year, I gave no prizes, there were no raffles, no gimmicks, no nothing. The
second largest blood drive in Nevada state history at the time. Guess what happened this
year? Not too much. We had a bus. Next year I will get in trouble, announce what we are
going to try to do, which is a bleeding edge track, have speakers come in, in a room,
have 30 minute sit down with the actual people donating. You actually get one-on-one time
with different DEF CON speakers and called it the bleeding edge track. Hopefully, if I can get
them ok with that but you know it's better to ask for forgiveness than permission, so
I am already announcing it. I want that to happen. Because I want ‑ ‑ recently, last year or
so another company, UNC or something, announcing the biggest blood drive in the state
history. That is not cool. It should be hackers. People were telling Julie, the blood drive,
why are we doing this? What do I tell them Jayson? Not just to make computers better, but make
the world better. This is a great way to do it. That's what we do. Stop trying to narrow it
down, make it about hackers and computers, the network. That's not what being a hacker is. It's
not. There's also "be the match," Tom Wilson helped get the BloodKode 2 started, I
dropped the ball. He did it while he was working on Be the Match. All that takes is to go
to the contest, do a swab, you are in Vegas, you put worse things in your mouth this
weekend. You can actually help save a life. It's about saving lives, making a change for the
better, because we like doing that. There we go. I am not going to talk about hackers for
charity, I'm not talking about Johnny Long, we know about hackers for charity, we know
about Johnny Long and the great work he's doing. Who's that guy in the middle? That's China
Eagle, the Johnny Long of China. He helps put computer systems in schools in western rural China,
help getting education out there. He's doing great work in his country to help his people.
He's a humanitarian and a patriot. He hates cybercrime. He thinks most of the hackers,
should be more nationalists, political, helping their country. A thing I like about
that statement, Americans don't realize, oh wait, there can be patriots in other countries? I
am not sure how I feel about that. Yes, we can't think about hacking in a community unless we
are thinking about a global community. Hackers are everyone. Borders shouldn't differentiate
us. It should be that we are hackers and accepted. That's the way it was before Instagram,
before Twitter, you could see the person you were talking to. In the IRC days you assumed guys
are guys, girls are guys, and 14 year olds are FBI agents. You know, that's the way it was the
olden days. Start doing that, understanding we are a community and can't just think hacking is
based on borders, computers or ‑ ‑ I have news for you. It's starting to change. Hacking is
about creativity. It is about artistry, changing, inventing, doing something new. These are
some of the examples. You've got Dual Core expressing, educating vastness through his music.
You've got Fab, actually creating sewing machine programs and hacking sewing machines to
create knitting sweaters with QR codes in them. You've got Eddie the Yeti expressing and creating
art, while still doing hacking, yes, I am a hacker and this is also what I can create. That's
what hacking is. I also have news for you. It's not just that, that we have to change. I
have news for you. As hackers are breeding, we're creating offspring. One of the proudest
moments of my life was when I was walking to my daughter's school, a little girl comes up,
my daughter looks up at me, smiles, said this is my daddy, he's a hacker. That's a great
warm story to tell and makes me feel good. Until John (indiscernible), in a class I
took with him said he was at a career day and his daughter said "my daddy is a hacker." He said
he got looks, people thought he was a leper, a criminal. That literally broke my heart. I
didn't tell him. I was sitting back there, I got so deflated thinking about that. Someone had
to go through that, think their child will look at them different because of the people
around them are saying "oh, your daddy is a hacker?" A hacker stole my daddy's credit card, a
hacker put a virus on my daddy's computer. Is that the world we want to live in? Our children
shouldn't have to be ashamed of what we do for a living, we are helping people, we are trying to
be a positive force in the world. They shouldn't think about us wearing a ski mask
while we are on the computer. I want you to understand it's not just them we have to worry
about. We like to think it's one aspect, you don't get to learn to be a hacker. You don't go to
training to be a hacker. You are a hacker. As you are born, you are a hacker, and you are not a
special snowflake in the blizzard. Look at this. A group of kids in Ethiopia were given a
crate that was unopened. Five months later they hacked the security settings and learned
English and hacked the tablets. Five year old kid wasn't allowed in the Xbox account. Microsoft
gave a reward because he found a vulnerability in it. That's hacking. This girl right here in
the lower right, her grandfather has Parkinson's, what did she do? Designed a cup he could
drink out of that's actually getting ready to be mass produced for all Parkinson's
patients. She saw a problem and tried to do something about it. She's a hacker. It is not
something special. It is in our DNA, and until you start telling the other people, stop trying to
be special and say you are as much a hacker as I am, you are just in a different field or not
doing something with it, they will keep looking at us as the odd ones. Hacking is being
human. Period. On a lighter note, just remember we are a community, through the power of
awkward hugs we are one or two degrees away from Kevin Bacon. No matter where you are in the
world, no matter where you live, you are part of the community that is bigger than you, that is
bigger than your neighborhood, bigger than your local hacking group, bigger than this
conference. You are connected to the world, start acting like it. [Applause] >> I have about one
minute for questions, maybe it some good ones or just troll me, I can't care which. >> I have
known you 10 years Jayson, and followed your stuff on Twitter. I wanted to tell everyone here
that didn't see what went down at Black Hat, I appreciate your courage that, you took matters
into your own hands and dealt with something that was pretty embarrassing in the community. I
think for the benefit of everyone you should tell the story. >> I will tell the
unedited version, showing I am not that big of a hero. The person that gets credit is Wendy
451 on Twitter. She saw an offensive disgusting sign at the Black Hat booth area and she did
the mature thing. You can't fault me for not doing the mature thing. I am not mature
and I am upfront about that. She did the mature thing and actually went to Black Hat
officials and said guys, not cool, do something about it. They did. Wendy 451 gets a lot
of the props. I was in the hotel room chilling and I saw the sign that someone else had tweeted. I
got in a rage. I won't describe it. It was disgusting, it's out there if you want to go look at
it, it's horrible. I run down there. I am like running down to the lobby because I am doing
something about this, I don't know what yet but something. I actually run into
(indiscernible) walking and he's like what are you doing? I am going to go start a ruckus. I
keep walking and he follows me a little bit and realizes, crap, he really is about to start a
ruckus. I go to their booth, registration area for Black Hat, because I thought it would be
good material, the sign, say this is wrong with an arrow, stand up out in front of the
booth holding a sign saying this is wrong. As I write it an official from Black Hat comes up
and says what are you doing? I'm about to start a ruckus. I like to be honest. They are like you
can't do that. I am like, yes, I can. I am an attendee and I am expressing my freedom of speech
I am going to protest, I think it's pretty crappy. They are like no, you are not allowed to
do this, this can't be done. I pull out the phone, take a picture, I have a daughter and
he thinks this is okay. He is like I have two daughters. You think this is okay? They are
like, well, you can't mess with their freedom of speech; their First Amendment rights. I'm
like, I am not messing with their First Amendment rights, I'm not telling them to take it
down, just expressing my opinion. They are like – and this is the beauty of it, if you
do your First Amendment right we will do our First Amendment right and I'm like, what is
that? We're going to take you and the sign out of the conference. I'm like, dDo you
understand how the First Amendment works? Then there were ‑ ‑ okay, here comes ‑ ‑
I will finish the story and leave. They are not ‑ ‑ today, fine, whatever. They said we
will see about that. Walk off. I didn't stand up to the thing, go do that, I feel bad about
myself, started walking, got pissed, asked for the guy's business card. He gives me his
business card and asks, are you interested in physical hardware? I said no I think this is a
disgusting advertisement. Horrible booth, you should be ashamed, and that that sign is
better for selling condoms then hardward. Goodbye, and I walked away. That's all I did to it but
that's the only thing I could do. [Applause] >> That was that. That was the drama. The drama
has been taken care of. General manager fixed it. Didn't know it was there, they handled it
responsibly once it was brought to their attention. This guy is actually coming over to tackle
me so this talk is now officially over. Thank you. [Applause]