[Applause].
Hello everyone I'm Ryan Lackey and Marc Rogers and the Grugq not here as you can see.  I think he had severe traveling difficulties and there's sketchy details so I'm not too filled in on it but we worked with him on this project for the last year and awhile have been in contact with him so... I actually work for Cloud Farea company that does CDN DDoS stuff.  Marc looks for Look Out. Working on this as kind of a side project, a fun thing.  The Grugq is an OpSec consultant and works on a variety of cool projects.
>> I'm mostly the head of security here so I apologize for shouting at you.
>> Laughter

>> So we're excited to be here and show off this cool thing we've been working on.  So we're going to go over why you want to hide.  We're using software that will let you hide in network traffic.  We're going over principles of operational security which is really Grugq's main area of study and he's the pretty much the most interesting person in the field taking how larger organizations learn about op sec and applying it to the hacker and activist community and other groups that don't have a huge intelligence arm or anything.  We will go over serious op sec fails and what happens to people then how technical counter measures are used against people, existing tools, travel routers, and how to use these things for safety measures of the tools and then we're going to bring in the exciting new technology the travel routers.  
So, just to start why would you ever want to hide?  If you're doing normal stuff we're not talking about helping people hide from doing all sorts of bad stuff.  You're in your normal life.  There's a lot of reasons why you would want to hide.  A lot has become much more clear in the last couple years. Especially post Snowden. But even before that it was fairly widely understood at least within this community.  Part is to avoid a global drag net. You want to make sure that if somebody is monitoring all the communications that you're not swept up in that.  Because the problem is, while you might be doing nothing at all wrong somebody next to you or somebody you have a phone call from or in any loosely connected way might do something and due to how software works and scoring that plus another interaction plus something else depending on where you live could actually get you droned.  Not just on a watch list but signature strike or something like that.  Prevents all sorts of problems but really it's like none of your business.  Why would you want to be monitored?  It doesn't benefit you in any way so if you can avoid it you should possibly do it.
	>> There’s also the fact that you are doing something you   

don’t want people to watch. Maybe it’s illegal, maybe it’s just 

something you want to maintain OPSEC for your project, OPSEC for 

your company. People are actively trying to steal secrets for 

both national security reasons and security reasons and because 

they want to steal your secrets. 

>> And the crazy thing is people that were in various illegal activities knew this and people that were in the hacker community knew this but now there's a whole new realm of people that really need to worry about this kind of thing that you would never think of as spies or hackers.  Journalists giving any kind of activism in an environment where their adversaries are well resourced these people have this as a serious concern and it's crazy and it's an asymmetric problem where there's people that have problems now and don't have the resources.
>> There's two important takeaways we get from this.  One number OPSEC not new.  We like to talk about OPSEC as though it is a new thing that we've discovered.  It's probably as old as mankind.  And many of the techniques to protect are just as old.  The other one is the tools and stuff we're talking about there's no rocket science here. We are talking about using exiting tools, existing technique. 
[Inaudible].
The difference is we're showing you how you can use it in a seamless way so you don't have to think about it and you avoid the number 1 problem, human error.
>> So Grugq has sort of distilled OPSEC basic principles which are listed here.  We're not going to go over them but he's done this many, many times and it's  okay.  So Biggy Small actually had a great song about how drug dealers apply OPSEC to selling crack and it's been analyzed by law professors and everyone else as pretty good actionable advice for people involved in any sort of activity and it's not just crack dealers that need these.  It's people involved in complaining about spying systems being installed in their loan port system in Oakland or Human Rights abuses or really anything.  So it's a pretty universal kind of problem a lot of people have.  But on the other hand what happens when it goes wrong?  This is a photo from Somalia where the U.S. Marines were going in to intervene and try to distribute aid and food and stuff and get rid of war Lord' s.  They did this opposed beach landing which they hadn't done since Normandy in World War II but it was a big opposed beach landing.  And unfortunately the media knew about it in advance so they were doing this landing with a bunch of little rubber boats and everything else with a bunch of journalists sitting there with cameras waiting for them on the beach putting the things live on satellite TV that all the war lards saw.  So that could definitely have gone a lot worse.  And... Yeah.  Then we've got other examples of basic OPSEC failures bringing down an organization that many people think was sort of a libertarian commercial market.
>> When you look at many of the big busts, issues that have happened recently you will see the OPSEC failures behind them are basic.  Really, really basic.  Take for example Silk Road, the largest most successful online could not band, 957,000 user accounts, 9.5 million coins and the guy behind it allegedly runs over it.  Russ Albrect (sp.)  used his personal Gmail account when setting up an account that he then used as the administrator, an account with Altoid. He then used that Altoid account to host jobs, advertise for people to come in and do coding for Silk Road related projects. He also advertised Silk Road using this same account. He later on kind of caught up to this and changed his handle, changed his Gmail handle to Frosty.com but once you've opened the door the information is out there.  The internet doesn't forget.  And if you start then building it all becomes fruit of the poisonous tree and everything you do from that point onwards is tainted.  Next one.  Sabu - Even worse.  Sabu, a skilled hacker knew what he was doing.  Except every now and then he would forget and log into IRC.  Just once is enough in this day and age.  It used to be you could get away with one mistake but now in this world where it's possible for people to wholesale, capture and store just in case there's something interesting that one mistake will hang you.  Perhaps even worse than that he also used his home address to use stolen credit cards to buy car parts and had them shipped to his home address.  These kinds of OPSEC failures are really obvious.  Not surprisingly he was busted.  Mark Karpeles,   allegedly we don't know exactly what's going on but we do know around the time that they had completely run out of money there were things he used to prove that they still had liquidity.  Those accounts are still around and active.  So people started looking at them and guess what?  You follow the chain and looked to them, they still had money in them.  Way more than he allegedly had.  Unsurprisingly when people started talking about it he miraculously found another pile of bit code that he didn't know about.
>> So what are the common mistakes and vulnerabilities here?  These are just three  examples.  There's a bunch more.  Insider threat is the most difficult to resolve and also the easiest to find in almost any organization.  People making mistake, human error and data leakage.  People using the wrong channels for the wrong kind of data.  Then there's more serious technical threats.  You have people tearing down either seizing your hardware or getting semi rather access or going live or cold analysis on it.  You have people doing network or RF monitoring of your systems.  You have people tearing down remote servers.  Then you have acts of tampering.  These are pretty sheers threats and maybe it's not worth trying to mitigate the most difficult thing.  Start with the easy things.  Then of course there's the financial audit trails left by any system people interact with.
>> One of the most important things you can't take care of everything.  You can't think about everything.  But if you can automatically catch the low hanging fruit and protect a certain segment of your stuff that you don't have to thinking about you can then focus the rest of your resources on the more complex problems.
>> So network forensic pretty widely understood.  Metadata of course being the target of almost everything.  Metadata is so much easier to process from the attacker side.  They don't need to bother translating it into the native language or normal lies the data.  It's there and automated and trusted and reliable.  So we've seen a lot of recent attacks where metadata really was the focus of the attack.
>> And it is very much the low hanging fruit.  As we saw from the talk that was given.  Even data that you think is encrypted such as some of your personal information on the iPhone is not because when the device is running certain segments of device are unencrypted.  That means it's accessible and in fact the only time the iPhone is secure is when it's powered off.
>> So there's all this data you would attack from a desktop system, any sort of server you're attacking.  It's pretty clear.  And on cell phones which are basically computers you have fairly similar kinds of targets.  They have some additional threat factors because they connect to telephone networks and we can tell you horror stories and the fact they're with you at all times and taken out of secure spaces and taken back into secure spaces and taken out over and over again it's a more interesting threat but it's not really terribly novel.
>> This is all low hanging fruit.  This is easy stuff that can be gotten.  Almost every cell phone with commonly available tools without expending too much effort.
>> All this stuff used to be hard.  People haven't taken that into account that it's changed and become a lot easier to go after.  Used to be you had one agency in the U.S. and one in the Soviet Union to worry about.  Now pretty much everybody with RF equipment can be your threat.  Anybody with a network router in your path can be your threat.  Anybody running a service can be a threat.  Anybody that gets access to your equipment.  So it's a much, much wider population of people tracking you.  If you're not attractive to the government as a target, perhaps you are to a different government or to an individual or organization. It’s really the democrazation of SIGNIT and attacks.
>> One interesting thing from the slide is everyone is talking about Snowden and how everyone is moving to more encrypted.  It has had an effect on the traffic on the internet.  We’ve gone from in the U.S. 2.2% was deemed to be SSL traffic.  Today it's 3.8.  That's a really big increase.  Right?
>> A lot of that traffic is unencrypted which leaves all this data available.  Even if the data is encrypted you can get a lot of information from pure traffic analysis.  You can see source and destination of target.  You can see the type of traffic in a flow and you can actually in a lot of cases get content information from the size of packets because it’s not data dependent and it's pretty terrifying.
>> What you have to realize is you don't have control over this.  Vast majority of this traffic is backend traffic. This is your application talking to application server.  You don't have a choice to say I’ll only use encryption to the dev that built your app.
>> It's pretty bad when you pop up a commercial operating system on a new computer the first time and has all this software you're not familiar with and you don't really know what's phoning home when.  Cell phones are even scarier because you actually do have pretty good information that they're phoning home all the time.  They're always in contact with the tower and they're relaying an awful lot of information you don't really see as a user but it's there and is a threat.  And the scary thing is while you might trust your operator and you might trust your phone vendor over the air a lot of this data can be gathered just from passive monitoring and anybody else over the air can do a lot of the stuff.  Then we've got examples of when you travel to places like China.  It's a great place to visit but they have a fairly restrictive international firewall.  The great firewall and you don't really know where  it's not really one firewall.  It's different in every province and different operators have different policies but in addition to being monitored there's just a basic problem of stuff is blocked and it's really annoying when you go and you want to connect to your services.  You want to basically operate like you would at home.  You would think just a VPN would protect you and allow you to bypass this stuff but it's like a whack a mole game they play where they block things all the time, it’s a pain to deal with.
>> One last thing on the Chinese firewall they are getting smart on how they look out for VPN's.  Before it was identification VPN end points, then they get blocked.  Now as we see with Tor since 2011 they're actively scanning suspected nodes and they're doing things like talking Tor to suspected nodes and they can block it.  Now that makes it real difficult, now you have folks who are actively looking for your all your tools and blocking.  So whatever you have to do has to be robust enough to protect it.
>> So there are a bunch of tools people use to protect themselves.  Basic principles that make certain tools easier to use and more privacy protecting than others.  Tools generally are tools used by smaller communities rather than a wider tool are going more likely to work in a given scenario.  Although there's an engineering quality issue of a tool not used by many users generally not of high quality.  Generally I like things that aren't realtime, things asynchronous like email based systems, rather than connection oriented systems.  However we really moved to the World Wide Web and everybody was connection based systems.  And then encryption even if it doesn't provide you with full protection it provides with you a little bit of contact protection in a lot of cases even if it's not implemented fully.  So if you have the choice always add encryption.  And there's a lot of common tools that can be reconfigured.  VPN's were never intended as an anonymity technology, it just happened to be useful in certain circumstances. They do provide some privacy and some firewall busting just because people don’t want to block all VPNs because it will block a lot of business traffic.  It's an interesting thing.  And then the really interesting thing is that cheap hardware has gotten so cheap that you can dedicate hardware to a certain task. It's hard to build a secure multiuser multiapplication operating system.  It's really much simpler challenge to build a single purpose device and dedicate it to a certain thing.
>> Before we move off of VPN's one amusing thing came up in our discovery as we were playing around.  We discovered that you can actually weaponize it - great firewall works and detects a node doing something it doesn't like it floods it with reset packets. And it’s not really doing much to validate the source address so... 
[Laughing].
It's also quite nice it floods it with reset packets for sometimes up to 30 seconds.  So it's an amplifier.  So oh I was just playing around like I mentioned and I watched as the great firewall flooded him for the next couple of hours.  And he couldn't do anything.
[Applause].
>> I think not demoing that live on the stage is a good idea.
>> Although,I highly advocate doing this.  But carefully.
>> So yeah we've got things  the other thing is Java script.  You have to have a separation between your data and code, bad things happen with that and when the addressing information is completed with the messages so the OSI stack isn't kept as separate as it should be or where code is mixed with data this leads to bad stuff.  As we said cheap hardware is great. Prevents a lot of user errors. The problem with a lot of these secure systems is users use them incorrectly and if you give somebody a single device and say that's to talk to go one other person it's a much easier user model then you need to enter in code every time you use it and authenticate them and do all sorts of other stuff.
>> A great real life example of this literally yesterday as part of my goon job, I had to provide protection for John Mc. We were walking around with John who is a colorful character.  With his security detail who are even more colorful. Especially the one who remembers faces.  And he is talking about security of his phone.  He said he always uses burner phones, I’m very careful.  Once I used a phone for a certain amount of time I attach it to a (Unknown) and it goes off all around the country and they can follow that and they always track me down within a couple days and they can follow me.  I had a chance and I said by any chance do you regularly call the same kinds of numbers.  He said yes.  That would be why.  It doesn't matter if you're changing your phone if you keep calling your mom.
>> So one of the issues is again if you go buy this hardware and order, this whole problem if you order hardware if you're receiving it internationally, say you’re the Grugg, it's 
going to be high that, that hardware will not come as the hardware vendor intended it and you probably want to start buying stuff off the shelf that's preconfigured or sort of a commodity thing.  It's unlikely they will back door every hardware but the one piece of hardware that Grugg orders that could very likely be back doored and cash is great.
[Indiscernible].
And the same thing applied to accounts.  So VPN's are sort of near and dear to my heart.  I ran a VPN provider for a year.  Then we shut it down when the (indiscernible) happened. They're definitely a useful tool.  There are some concerns.  They're not really designed for anonymity so they don't give it.  You have to use them correctly for stuff like that.  Of course there’s  the problem if you trust the operator of service to one operating in a certain way.  And two it's really, really a bad idea to expect a third party to break the law on your behalf for like $3 a month.  It's not going to happen.  So you will have data turned over.  The third party doctrine in the U.S. means a third party has little tool protect their customer data if it's sought by another customer.  Tor is a great tool.  It can keep you anonymous.  I believe Snowden has it's endorsed, others have endorsed it.  It has a recognizable signature, high profile.  Lots of people looking for it.  And it's pretty complicated and not really so simple for users to understand.  So you have to build systems on top of it to make it useable.  Tor browser, bundle, are great, but you pretty much need additional tools to make it a useful tool.   However it's gotten myself.  If you try to use it in like China they're getting better and better at if it’s the default Tor protocal blocking it.  D packet inspection can block it and of course if you have exfiltrated data network that logs everything there might be a human analyst and the traffic will be obvious so whoever sent the tour traffic... So people realize this is a problem and there's transports which are great tools.  There's 7 alive.  Think is still accurate and there's a couple much more popular than the others.
>> The benefit of the Tor transports is they're recognized there is no one tool that will solve the problem. There’s no silver bullet. Whatever solution you use needs to be variable because if you keep doing the same thing eventually someone will catch on to it.  Plus you will get some real genius and some of these travel transports are phenomenal.  The general concept of this is transform traffic so it doesn't look like it and the next level is take the traffic and make it look like some other form of traffic.
>> I will go through this really quickly.  A lot of the censorship tools out there are quite crude.  What they do is use regular expressions to look at the protocol and make judgments as to what they think it is.  If you use those same expressions yourself you can play to them and make your traffic look like whatever you want.  The screen here is transformed traffic that has been put through a transform that makes I look like an SSH.  While it won't stand up to immediate scrutiny.  The point is with this vast volume of traffic going through the only people who will get that special extra special scrutiny are people that popped the red flag.  This is about not popping up the red flag.  So if your traffic hides amongst the general Tor traffic, there's going to be no reason for them to dive deep enough for them to say this is suspicious.
>> And there’s an additional tool, where if you have a cooperating end point on the other end, you can actually, like Google App Engine, I’ve talked about this with Cloud Flare. Various providers, you can encode your traffic as normal HTTP traffic, put it inside HTTPS, you can make it look like it's going to a regular website and do cool stuff there so... Then I guess the ultimate thing is to make it look like natural language.  Banana phone does this.  Obviously it won’t stand up to a human analyst looking at this after the fact. If you aren't routinely sending literature back and forth to someone but you can imagine a scenario where there's an automated or you built a system on top of that.  And there's of course the classic network tools that are primarily used for getting around like captive portal, authentication systems where DSL huddle, at a hotel such as the Rio and these are pretty cool.
>> The point of going through these is these are the tools we looked at for building the travel router.  The travel router itself there really isn't that much to it.  We looked at all the best tools out there and built them into this as a library so you have an OS build that's going to sit on a device.  You can carry it anywhere.  It's tiny and all these things will be available to you to choose.  And we're hoping to build some intelligence on to it as well so it makes choices for you to say are you sure you wanted to select that?  That might not be the best thing here.
>> There’s not silver bullet so it’s a bunch of separate tools combined, So as we were thinking of this, we tried to figure out because we had the practical concern we travel a lot and go to places and we're not the most interesting targets.  I know a lot of people that are greater targets and it's really difficult I can build something I can use myself mostly out of existing software.  But building something I can have somebody else use that's easy for them to use, simple that I don't have to then go with them all the time is a much harder problem.  We looked at a lot of VM systems. VMs are great, but the problem is, if something gets subverted the top level operating system there's problems. Fingerprinting stays the same then there's really no way to know that the system is intac.  I work with TPM and it's still not quite there.  And the other problem is this stuff is expensive if you build is out of pure software on dedicated high end laptops, virtualization with bunch of 16 giga ram Mac Book Pros, you can't afford it.  Most of the people really that need this stuff are also people that are not rich.  They're also not willing to throw away a 3,000dollar laptop.  So it wasn't really the most ideal target.  So we looked at something that would be providing much of the same protection but be a lot cheaper a lot easier to support.  Ideally something people already have to use and we came up with a secured travel router being the sweet spot.  They're pretty awesome.  They're , I have a whole box of them. They’are about $20-100 each. They are about made by a bunch of vendors, TP Link, Linksys, DLink.  All the low end network companies make this stuff.  They're available everywhere.  But a lot of people use them when you go to a hotel and you have to pay per WiFi device this lets you share a wired connection in a hotel with a lot of a lot of connections. There’s a lot of really cool stuff you can do, but they weren’t explored as a security tool very much. 
>> One of the problems we have is the hardware is variable.  So some of them have flash memory, some have no flash memory.  So the code, we, the next version is going to have another kitchen tool and what you'll do is put in the version of travel router you're working with, how much resources it has and it will can look it up in the library and it will tell you which modules you can then select.  So you can have Tor plus these transforms and if you don't have secure voice you can have these other things added in just enough to squeeze it in without filling it up.
>> We've used a lot on that.  There's a lot of open source firmware.  I think the 54D was the grand daddy where it came with crappy firmware.  Fortunately wireless hardware has moved on to newer stuff.  That whole wireless hacking community has been going on for a while.  The EFF started working on a project to make secure routers for home use.  Primarily focused on protecting them from outside threats as opposed to using them for security tools themselves and that's a huge improvement over the status quo even a year ago.  The problem with these things is they're embedded systems like a billion different ones of them.  They're too weak and it's a pain.  It's not a huge pain like dealing with true very minimal resources embedded stuff but still not the easiest thing to use.  Other people worked on this before.  There's a safe plug which is cool.  They have 4.  They don't do pluggable transports.  It's more for home use.  Onion pie which another company has is like a learn how to do something project.  It uses a device, raspberry pie and has external hardware and I have been looking at this stuff individually and he talked to Grugq and I realized the guy that was working on it I talked to so it was an obvious thing to do.
>> There is only one Grugq.
>> It's not that rare of a name.  So we worked on this.  The original portal from a couple years ago have pluggable transports but it was a pain to install.  And it did a lot of stuff but it wasn't like an all in one thing.  So out of this full range of hardware we needed to come up with an initial piece that we needed to support.  It was awesome but the problem is  it's an awesome piece of hardware.  We wanted to have a prebuilt image with multiple ports and wanted to power off the USB because you can use USB batteries and power off your lap top and you can use the Nexis7 or cell phone and you want your mobile phone to talk to this device which has a WiFi connection or a 3G connection plugged into it.  So having something that can be battery powered is great but putting a battery in a small cheap device is more of a consumer engineering challenge.  So we're not all hardware guys so we try to make it as simple as possible.  And obviously needs to be easy to use.  But there's some problems.  A lot of the hardware is designed to be as cheap as possible when you make it in like million unit quantities.  The price difference between like 64mg chip is snacks the quantities so they put the minimum on a ram, absolute tiniest flash they can do and we wanted to have multiple radios and Ethernet.  It wasn't really a common use.  The other problem is we're in the middle and USB2 is still the most wide spread power protocol we can use so we're limited to 500 milliamps.  Quality is really, really bad.  They're using antennas and then we wanted to make it ourselves but making quantity like a thousand  making quantities is easy because you can make it yourself.  Making a hundred thousand or a million of something is also fairly easy because you can justify amortizing your debt costs but making a thousand of them or 5,000 is still a pain point.  And we looked at the cost of making them and you can buy the travel routers for a hundred bucks, $20 or whatever.  For us to make a small quantity would be really expensive and if we make the special secret spy router, one we have to distribute it to the people that want it and it's suspicious.  So the guy carrying around the super secret spy device will get special attention and that's the last thing you want in any of the states.  So we were kind of 
>> Speaking of someone who gets special attention every time he goes to the airport I can tell you it's a real drag.
>> So we really had no idea I've been working on this as a hardware thing and ended up selling. I was looking at doing something and I ended up selling my company instead.  So it was like a back burner thing then I was like oh what are we going to do.  Then we were saved by China. There's apparently a company in China that makes the perfect device.  It appears to be a clone of a much more popular device but it happens to have a huge amount of ram and rom and they're really cheap.  It’s this box, the good life GLI net box.  You can buy them for about $215 for 10 of them. You get them in 3 days.  They're awesome.  It does everything you want.  It's pretty much the perfect packing platform for this kind of hardware.  It's got two ethernet ports on it, USB and micro spkr power. It’s a pretty good deal, and the RAM that we need. So we have portal.com, we have tools loading up there that will let you use the old portal chain and additional pluggable transports on it.  Building the service is maybe a little ambitious at this point but definitely the client side of the hardware will work with existing services.
>> That's it.
>> We would actually like questions at this point.  It would be great to talk to people.
>> Obviously we welcome a ton of feedback because we want to shape this into a tool that's genuinely useable.  This is no good if it's hard to work with, it doesn't quite meet all the cases.  We want this to be the kind of thing you put in your pocket and a journalist can take and go to a foreign country and use it for secure coms without even thinking about it.  Thank you.
>> Open source of course not commercial.

[Applause].
>> If anyone has questions we'll be happy to answer them.