So, I am going to talk about some experiences that I have had with building communities. Basically, two experiments that I accidentally ran over the last few years, mainly because I wasn't intending to run two experiments. I didn't think I was an academic or any sort, I was just trying to figure out how to make a living. But, what I realized retrospect is that I did end up running two very different approaches to organizing community, one very top-down, one very bottom-up, which has little interesting results. So, I only have about four of my slides, which I basically made in the last half an hour, just to give you a bit of background, and then it's going to be a discussion after that. So, basically, some background on what I have done, I used to hang out on bulletin boards back in the 90s, got my first understanding of how communities work online in the 96 to 98 period. This was when 200 people were online in India, and that was about it. And I was quite lucky to be part of small groups like this, who had absolutely nothing in common with each other, apart from the fact that they had some kind of connection that was not on the internet, that was entirely on phone networks. And from there, I became part of the Mumbai and Bangalore Linux-related groups. I used to work in Mumbai's chip magazine in 1999. I put Red Hat 6.0 on the cover of chip magazine in August 1999, and a lot of people here discovered Linux to one of the series. Either it was the series that I put out, or the series that I think it was put out in this request. Obviously, Apple did it a lot more regularly than I did. And after a while, I got involved with the bar camp community. I did the first bar camp in Bangalore in 2006, and it's now the 14th edition. So it's become a moment that's pretty much taken off by itself. So after doing all of these things, I basically learned a bunch of things about how community events work. And I'd say, these are all common things, you know, one, project does never work. Usually it's two reboots, and by the time you have gotten the project to working, your web page is gone. If you have a speaker trying to use a web-based slide show, you know, the guy's a rookie. He's never done a content stock before because he can't load his slides anymore. Who seen this happen? You've never seen someone have trouble loading slides. This is once this morning. So mics go off by themselves all day. I am sure you've heard all kinds of quicks and boobs and what not coming from the mics since morning. I've seen a conference with 18 parallel tracks. I don't know how to manage it. I have no idea who knows how anything works. If you're lucky, the talk will actually happen after all the problems with getting the talk going. If it's up to one hour late, it's all right. It's that's normal. So now these things I'm sure you identify with as being fairly common with how events work. Does that sound all right or does it sound exciting? I hope I haven't lost you all day. No one's got a comment. Does this sound normal? This stuff. So this was basically the thing that got me fairly bugged after so many years of being part of community and how community events work. And I figured this is the point where you got to fix this. You've got to do this right because we keep being amateurish because we take pride in not doing even professionally because all of us say, hey, we're here for the content in the community. We're not here to make the trains run on time or make the slides run on time and so forth. So I got fed up enough to say, I'm going to fix this. I'm going to figure out how to run events properly. So I did that. And one of the things you need to accept when you start doing things like this is normally we think of communities as being a free place for anyone to do what they feel like. But if you want to make an event run on time, you can't do that.  You don't say, it's OK. You can go along half an hour late and we'll just keep the audience waiting. That stuff doesn't work anymore. So this essentially forces you to think of how you're going to impose order on the community. You're going to make sure that the talk starts on time. You're going to make sure you harass the speaker to make sure he shows up on time. That's his computer on time. Make sure everything runs on time. And this means that it is not an open community anymore. You're imposing order. You're forcing people to do things for the greater good. But you're the tyrant here.  And so this was something that I had to accept and say, if this is the way to make events work properly, I'm going to do that. And basically what you've managed to do in the last four and a half years since I started doing this is I managed to organize more than 30 conferences, hosting more than 10,000 people across these 30 conferences. Also managed to get this going as a business so that we have 10 people at least full-time all the time, running market rate salaries, and created five events that are now well-known brands within this country. And those are the five up there. So this has been possible while still running an open source company. So the GitHub website there is where you can find a source code to everything that you've done. It's got 50 plus repositories. It's had over 30 people contributing to something or other over the last few years. Tens of thousands of lines of code. One of the projects is created. It's called Funnel. And this seems really empty to talk about because Funnel was confusing some people over what it was funneling. This has also been used by PyCon India. It's been used by FOSTA, NITC. It's been used by an IT Bombay event and so forth. Now this is a tool for scheduling talks at a conference, for selecting and scheduling talks. Being accepted by the community used a lot. If you're going to see it online, it's at talkfunnel.com. This is what it looks like. Right now you can see a list of events that are coming up that are based on this event. I mean, they're a base that are coming up right now. And if you pick one, you can submit a talk to it and so forth. So this is a tool that has essentially been the tool by which we imposed order on the community. You tell the community that if you want to talk at an event, you fill out a submission form right here, online, submit it, and anybody can look at what you submitted and tell you whether you like it or not. As an event organizer, I can see these little aeroplane icons that tell me that this guy is not in the city in which the conference is being organized. Therefore, there are logistical issues to deal with if I take the speaker. So build tools like this as a way to just get things going and so forth. Now, in the process of doing all this, I kept running into one request that I did not think I'd ever be interested in. And there was people asking me this question. So someone says, hey, that was a nice talk. Can you help me find a Python programmer? And you say, okay, maybe there's somebody in this group here, but I don't know you guys. It's not like I've seen your resumes. So if you ask me and say, okay, finally a Python programmer is like, I'm sorry, but I don't know these people. People don't come to the conference and give me resumes and say, help me find a job at the end of this process. So this was something that would keep happening over and over again. Yeah, was there a question up there? Or somebody on a phone? So this would keep happening and this was the problem I had absolutely no interest in. And this question of what do I do now? It's gotten to the point where I'm being harassed about this. So I figured we're going to build one more community tool that takes care of this particular problem. But given that this is a problem where I'm not interested in solving, unlike, say with events, I knew I wanted it to work in a certain manner. So we were going to fix that. So we set about creating procedures for imposing order on a community. In this case it's about saying, please help yourselves, do not bother me. And essentially saying, go away. Sort this out for yourself. So we started doing that. We built a site that people could use to post jobs for themselves. This is also an open source website. I'm sure you've seen this at some point or other because a lot of people have seen this without realizing that this is the site that they saw last time. So how many of you people haven't seen this before? Is this new for you? Have you guys seen this site before? Not seen the site? All right, so if you haven't seen the site, go ahead and explore it.  Somebody wants a senior share point developer. This is what they're offering. And basically says, this is the requirements. This is what they want. If you fit the bill, if you have all of these characteristics and sounds interesting, then apply for a job. And apply for the job basically means a lot of forms submitted and you have sent your resume to the employer. It's up to them to decide if they're like you or not. They'll respond to you. So this is a site that basically does not take up any of my time on a digital basis. I simply make sure the site does not crash. It runs by the community. People help themselves and to give you some stats, by doing events, I managed to basically get about 30 conferences organized, helping about 10,000 people over a four and a half year period. But when you build a site that the community runs by itself, and then you go and see what they've managed to do. It gets a lot more interesting. This will probably take a while to load because you don't know what the connection is like. So while it's running, this is a site that's now used by this many people in the last 24 hours. So at about between call to 1 p.m. today, there have been 206 anonymous users on this website looking at jobs. And this is basically someone who is currently active on the website. And this is a little low compared to what it was yesterday. For the last two weeks, you can see that it's on average being used by 3,390 users on a day. That's a slightly higher peak. Two weeks back it was 0 and 600 users on a day. So this is a site that unlike the previous one, where it was completely about saying, I want to impose order on the community, which means that I'm going to look at every single aspect of operation and push people into doing it the right way. So it's about pushing people into getting things done and time pushing people into making sure that coordination happens on time, that things are done well, food is properly cooked, whatever else. On this hand is something that I don't bother with at all and yet it works. And if I could choose by a lot more people, then something that actually takes up so much of my time to do by myself. So once again, you want to get a bit of stats on how many people are actually using this stuff? I didn't go to login to the server, give you stats on the database directly so you know what's going on. I don't know if you guys can see the number at the bottom of the screen over there. It's a little faint, but basically it says there have been 47,984 users on this website since we started acquiring logins which was about two years back. So example of a site that works. And what I want to talk about is how is it possible that something that runs by itself can also do better and still work, whereas some other things require you to force the community to behave in certain ways. And this is the part where I want to turn it over and say let's talk about what your experiences have been with bottom-up self-organizing system versus top-down order-based systems. And which one works for what context for you? Satish, I'm going to put a mic at you if you don't speak up. So you've done a bit of community organizing and you've been nice to have your thoughts on what you've seen work and not work. I haven't seen if you have a prescription that you can do that at this particular situation and takes top-down and all that. But the one thing that I've realized is that if you have a lot of people invested in achieving an objective that's fairly well-defined and understood, self-organizing communities get things done better, much faster than if you try even if it's denouvelin dictatorship. That doesn't work out. So over the period of time what I've come to understand is that if you can define the objective better, you have a better self-organized community. You do have to put in processes for self-organization. That infrastructure is still there. So everyone else, I'll take a look at this. So we have something actually pointed out of putting that self-organizing communities. They work well better, but we've got to put some writings around that. And we pointed out that in the top-down approach, you did put some order, but then it's not open anymore. But I suddenly disagree with that because most of the communities anyway, they try to build bottom up, but then they put somebody at the top to actually manage things and put some ordinances at the same time remaining open. And comparing communities like, for example, the Fedora community here. I'm associated with the Python community. So the Python community and the way Python's work versus the way Haski conferences work. There's still a little difference because I haven't seen that much of volunteer-driven work happening with Haski conferences. Because still there's not a lot of probably a much larger content and no single goal for a community to push behind. And probably that's the reason why there's more focus and more order required from the top-down approach as compared to the communities coming together. And then also agreeing to the top-down approach or the order that is applied, whoever it is. But in general, I would also say that community that organize themselves, set their parts, but also like somebody to have put some order so that there is people are in order behaving as they're supposed to be, making sure that the events actually go down the way they should go. What makes this? This is an interesting point. How much of top-down control do you need versus how much of bottom-up? And yeah, so I need a mic volunteer. Can someone pick up one of the mics and pass them around? So it'll make it easier to have a conversation. And guys, please come forward. I'm not coming all the way back to give you a mic. So I am reminded of an article. I'll try to find it, which is an interesting analysis of how Wikipedia works, whether it's actually a top-down community or a bottom-up community, because there's actually debate on that. Is it top-down or bottom-up? So I'm going to try finding the article, and PJP, you have a point of view. Yeah, I think the distance between has to do with the personal incentives. In the case of why Hashtag works so well without any intervention is because he made a point that Hashtag works without any intervention. And whereas for any content problem, you have to be a person within a model. And my point on that is it has a lot to do with the personal incentives. The person who is coming to the conferences has an incentive of giving a class, but not so much on giving it on time or doing it properly. So if he could manage to track that incentive class, it's not going to happen, but it's on time properly. The self-government aspect of it comes from the incentive part. So I think incentive is a fairly interesting point. So I'm still searching for the article. Anyone else want to take a go? So I've contributed to a problem of communities by now. I find that the distance between the community is organized around what they define as a member of the community. There's a path to membership. And that is the incentive for you to be organized around the activities of the community. And if I take a different community, for instance, I contribute to Mozilla. Mozilla has a path, but you don't need to follow that path. And it is way more confusing in Mozilla unless you have the self-motivation to drive your contribution if you're actually going to work. Because there's a lot of blocks along the way and all the time. The same kind of block that was happening in Ubuntu, the thing is there's a membership, and there's this sort of feeling of community that comes with being a member, that it somehow works. And the other small point is that Mozilla has some oversight, Ubuntu has some oversight with the community council. But it's only got one Venezuelan dictator who can mitigate his way, but he needs a majority. He has a veto, but he doesn't do it very often. And then you have the community council driving the leadership to the most extent. Okay, so I think this is something worth going into deeper, you know, Ubuntu versus Mozilla as communities that you and I are familiar with. For the others here, it will probably be Fedora versus Mozilla. What do you see working for one community and not working for other communities and so forth? So how many people here are members of at least two communities like this? Okay, you guys want to talk about what do you see different between the way these communities are managed? So while we're doing that, so this is the article I was trying to look for. It's called, The Bottom is Not Enough. It was published a few years back. I don't see a date on it, but let's see. So one of the things that this article makes is the 2008 article. So obviously it's been a while, but Kevin Kelly is the founder of Viad Magazine, Viad Magazine's internet edition. He is the guy who basically built one of the first websites that was commercially backed versus just being a hobbyist website. And he also was one of the editors of the Whole Earth catalog. That's the magazine that Steve Jobs cited when he said, stay hungry, stay foolish. So Kevin Kelly is essentially Steve Jobs' intellectual mentor. And he's still alive and he's still writing. And in 2008, he made an interesting post saying that he does not believe that Wikipedia is a bottom-up community-driven encyclopedia. He thinks it's in fact top-down. And this is his article explaining why he thinks so. And he essentially says that in any community, you will find that there is always a small core group of highly motivated individuals who keep pushing the community forward. And if you do not have this core group, the community as a large mass will not move towards outcomes. Again, I thought this was very interesting. But no matter what you're trying to do, if you want to make progress, you're going to have to do this top-down. So interesting point, I think it's useful to just read the article and see if you can find anything in it strictly or not. It's easy to find, it's kk.org slash the technium slash the dash bottom dash is dash n. Yeah, I'll read it. And I guess it's also not very readable on screen, but yeah, we'll read the link so you can have a look at it. So over there. One of you guys had something to say, right? So I was asking you guys about communities. Which communities are you part of? Hi, I'm Lala. So I actually initially- Lala, turn the camera, point it to yourself. No, that's fine. So I initially started a group into community because I had no idea about anything. So I stumbled upon Linux and find out this and that these stuff. And somebody, I went to some PyCon and saw people, you know, laptop is open too. So I came home and directly installed a module on my desktop and started logging. So what I understood from community, obviously like Sankash and said, right? The rules are different for different community, but they're common, couple of common grounds, for example. So if a community is walking towards a goal, how common the goal is or how many people kind of rise? Is there a goal as well? Yeah, is there a goal? And how many people can connect to it? Second, you need definitely infrastructure for them to grow. If somebody wants to come and contribute, if you do not have a basic infrastructure to kind of make his, I mean, there has to be some way. Maybe it might be difficult or easy, depending on the situation, but you need a way. I mean, if he doesn't find his way, he will be lost or maybe go somewhere else. So you need infrastructure. And when you put infrastructure in place, you need some people to make sure that the infrastructure works more so that I evolve gradually as the community kind of makes sure, so evolve around it.  He does not change his rules much. He has this common three or four rules which have been falling from the day one till now. And other things is very flexible. I don't care whatever other people does around it, right? So even, I mean, I'm see Fedora where a lot of people self-driven. I've seen some toys where a couple of people drive the whole thing. So basically, you need a common goal where many people can connect and it can describe motivation out of it or walk towards it. And you need infrastructure. So like we keep it. We keep it as a basic infrastructure and let you actually contribute. Think about it if they don't have infrastructure and expect the community to build infrastructure, I really doubt if you'd have been gone to this far. How many of you here are active editors of Wikipedia? And yeah, so what infrastructure do you use as editor? Unlike, say, someone just reading Wikipedia. I didn't get you. I mean, is there any particular infrastructure that you use as an editor? Apart from the edit window, so is there anything else that helps you with editing? I mean, if you think contribution is just one part, then they have boards and people who can come and look at a contribution and see if it's a marketing material or you do have enough references. I mean, it's actual fact or somebody just made up a few words and put it in Wikipedia. And you have a server which kind of mirrors across multiple blobs so people can easily access Wikipedia and stuff like that. So essentially what you're saying is that the critical part is not just the edit window, but even knowing what to edit based on other activity happening on this page. Including whether a bot has been busy cleaning up this page or you can see a trusted editor who's been flagging this page for something or other. So essentially the entire discovery process before you get to editing a page. The discovery process, like how do you know what to contribute to is a discovery, right? Yeah, yeah, yeah. So there is systems in place to help you discover. Exactly, exactly. And people with the formatting, media, Wikipedia formatting, they have made up, made like documentation so I can easily read and kind of contribute. Yeah, so this is a useful point that if you want a community to take you know, ownership or something and contribute to it, then you're depending on the community to have an onboarding process. That makes it easy because I want to say how do I start contributing to this thing? Where do I start from and what do I get out of it? Should be well defined. So it can't just be some guy at the top saying I have this vision and everybody else figure out how to achieve my vision. That won't work. Essentially that, right? Yeah. You can put a common motivation in place and make sure that you kind of follow that, the basic rule and then the other rules evolve around make sure that other people come and contribute. Anyone else got a comment? We have less than 10 minutes left, so might as well make the most of it. So who else has been part of multiple communities? What have you noticed this difference between these communities? No one else? I have not been part of multiple communities, but I have just working part of Petra. What I have seen is that one doesn't need to be convinced of the goal before joining community. I may like it as long as I keep contributing and understand hopefully what I have found is that I may get convinced at later point of time, but I don't need to be convinced to start with. Probably my initial goals are something else as I start. I haven't given much thought to the community goals as such, but it could be some selfish goals also, but then as I keep contributing and as I start starting, once it becomes a bigger, then it no longer becomes, I personally feel that being convinced of the community goal should not be a starting point as such. I mean it could be something else, but you will just start along as you keep. Personal goals. Yeah, you start with personal goals and you see as you keep going along, your personal goals might get inclined with the goals of the community. Yeah, and I think the easy example is say Wikipedia. You read content first before you edit, so obviously you're getting content of Wikipedia as personal and receivable before you say, okay, how do I contribute to this content? Or with Mozilla, you get Firefox browser for free to start with. And from there you can say, okay, how do I contribute to Mozilla? The right way to put it is there's some problem that I want to solve for myself. If it solves 10 more problems, okay, good enough, but then it's fine. And from there you can possibly build up and go on. So does anyone else have a point of view to offer on this? I think it boils down to the same incentive part which affects your action towards anything. So if you want 100 people to act in certain order, there has to be some incentive for them to do that. Otherwise, we see it every day that people don't always follow which is right or which is in the best interest of everything, for every person. It could be like wearing helmet or not honking on the street or just starting a talk on time and problem. It boils down to the incentive aspect of that. Sorry, so since we are out of time, I think just to briefly summarize, there are two ways to organize communities. You can do it either very top-down where you say you think this is disorganized and therefore you'll bring some order to the space and force people into accepting order. Obviously with feedback, so you're not a dictator. And the second order is to say, we're going to design a system so that everything is done by people entirely by themselves without a leader on top, without someone watching over and saying, we will do things, we will tell you what to do. And what happens in most real world communities is there ends up being a mix of this. Whether you look at Wikipedia or Mozilla or Ubuntu, Ubuntu for instance, very clearly defined, I would say every six months there will be a release. And this is important. This is the unviable goal. You can't not make a release. Now if you have to make a release, let's figure out how you can organize community around that goal. And I think that works really well. And I think this is basically why Ubuntu became so successful so quickly, that this was the rallying point for the crowd. Six months make a release. You can't effort to say, I will do this two years later when I feel like it. So that's worked as an example of saying one top-down goal and some infrastructure to ensure that goal happens. And everything else bottom up saying, how do you work towards that goal? Or on Wikipedia, it's the systems of rules that they have. They impose rules on the fact that you must have a neutral point of view. You can't advertise and so forth. These are all very top-down approaches. Somebody in the leadership has decided that this is what Wikipedia is going to be. And they will ensure that happens. And everything else is entirely done by volunteers saying I'm going to edit and add to it in some way. And if it violates some top-down rules and somebody is going to comment smack me and say undo the edit and so forth. No, so it's an interesting system that some top-down, some bottom-up usually works. And this is one useful thing to say if you're trying to build a community, you'll have to work out and say how much of this needs to be top-down? How much of it needs to be bottom-up? And how do you know you're doing it the wrong way or the right way? All right, so does anyone else have anything else to add or does you can say close this and more to the next talk? All right, I think we're done. So thanks again.


the drawing. So I'd start lead generating before there was email and social media and all that stuff. God, it's so funny. Right? We've all done that in here, right? Yeah. There were a key component of lead generation. I don't think anybody does those anymore. No, no. Well, now you're not fishing with lead boxes.  It's a six-week program for 300 bucks and when you lose the 20 pounds, we give you your $300 back. Oh, wow. Or we'll double the $300 and apply it towards the 12-month program. So we get two to 300 people sign up on that program when we promote it for one of our FitBody locations and then about 50% stay.  Oh, that's huge. But now can they retain? So that's the other formula. Retention results, right? And then referrals, the 3Rs, retention results, referrals.  So we go open up a gym, go into debt and then have a lot. Will that ever happen? I mean, are you open to that for a moment? They go, hey, we want to license your stuff and put it into our certifications. I will go, here you go. License it. License it from me. I'm always open, but they always want to sell more level one, level two, functional this and posterior. Why do you think there's such a high fail rate for gyms? You think it's because guys go in there opening a gym like, I like to work out. So I'm going to open a gym and then that's it. I like to work out. I give my clients in 24-hour fitness or LA Fitness amazing results. Therefore I'll be really good on my own. And the big box gym is the bad guy. They forget as much as I hated the big box gyms, those are the trenches and I'm eternally grateful for them giving me the sales training they gave me, putting the pressure on me like they did. But again, it's a reframe. They put so much pressure on me. I look at it as, thank God they put that pressure on me so that I could learn and ask what I'm like. Prepares you. Yeah, exactly. Going into battle without a rifle.  So they go into battle without a rifle and they go, oh, what happened? What a niche. What a niche is. And you certainly don't know how to deliver results and by the way, results are not just fat loss. Results come from confidence. See, most people think like trainers. You got to think like a coach. When you can become turn from a trainer to a coach. In other words, a trainer knows where the muscle originates and inserts. A coach knows, man, you know what? Sal doesn't look like he slept a lot today.  A coach knows how to cajole you into getting a better workout. A trainer just knows how to program a workout and hope that you follow it and stick to it. So there's coaching. So results is showing them. Results is them coming in. Results is them sticking to the program. The confidence, the self-esteem, self-image. Results is getting referrals. No one teaches that stuff and until a trainer is like almost broke and they do that Google search to find my YouTube videos or my blogs, that's the only way they find me. I need them to find me in the certification for my videos. That's why I was saying that I think that going through a big box gym is so invaluable for somebody who's just getting into the fitness industry for those reasons because there's just not a lot of resources and places that you're going to find. And even the ones that do sometimes still don't even make the connection. I don't know how many conversations I had with trainers on their way out the door and saying, hey, Adam, thanks for the two years of training and teaching me how to be a great trainer.  I'm going to be like, whoa, whoa, whoa, I'm learning in the morning and developing leaders. And so I was OK with them even though that was going to make my job challenging and I had to find another one, I like that. I like developing them, seeing them go off and succeed, but many times they wouldn't. And many times they wouldn't because they didn't realize what they were getting inside that facility. And I don't think there's a lot of people that talk about that. And I too remember being a trainer starting and thinking that the end goal was having my own gym but running just one gym and even the ones that make it, right.  That's it. I look at systems like an acronym and systems to me stand for save yourself time effort and money and People forget to replicate themselves through other humans, right? It's like how many times you get that email? How much do you charge and every time you retype that email? You know, there's something called canned response in Google in Gmail. You've typed that email out once Save it in canned response and now you can have staff deploy that instead of you having to retype it every time Right same with how do you answer a phone? There's one of the top 20 questions you get over the phone Write that down record it and teach it and this is the stuff that this is why franchise have a high success rate because we just Systemized the fuck out of everything because a federal trade commission makes us because if we have a high failure rate like Quiznos Which is why it's going out of business. They can't sell any more franchises I would not be allowed to sell more franchises if I have a high failure rate So fit by the boot camps can't fail.  How did we not cover that?  Yeah, wow now, okay, so at one point you were 640 upside down you said earlier, yeah, and I'm assuming that you didn't have a 2% fail rate at that time or did you even at that time? We had a massive failure rate because we were teaching our owners here go do this run this Facebook ad Well, we don't know if they ran it We don't know if Facebook stopped that ad and they didn't try again because they don't have the emotional resilience We want them to have so it went from go do it yourself to done for you So now we have an in-house marketing campaigns that we run for them.  What did that transition look like? I mean how long did the transition look like this it took us three years to start breaking even Right, so in 2011 we were six hundred forty thousand dollars in debt I was a horrible leader had a business partner who I didn't share a vision with We had a very tense relationship and I had five employees who at best at best I was lucky if they showed up on time and I was really lucky if they Clocked out at five o'clock and not four forty five And this is a reality man. I was a horrible leader So as my leadership changed around 2013 14 the business began to change as I parted ways With my business partner and as I started hiring team members and Training them to become team members instead of employees employees clock in clock in a little late clock out a little early Do the bare minimum to maintain employment a team They go hey, that's our opponent. We're a unified team with one unified outcome, which is to win So I have team members right so for example if after this I'm going to Arizona But let's say I was with the family But if I was going to Arizona to go film something everything that Ed there captures here Right, I've got a videographer with me for those listening everything that he captures He's gonna go and edit while the other videographer would meet me in the airport And we've done this before Jonathan would meet me at the airport then we'd fly out to Actually st. Louis we went to st. Louis and he so I've got a team members who don't give a fuck if it's a weekend They don't like they are as determined to have chips on their shoulders I hire people who are underdogs now and I train them to become fighter jets and we give them a rope and We go build a ladder because if you don't you're gonna build a noose and hang yourself And you can ask it right now or after this like I have high performance coaching days for my team members Not just the stuff that I teach my coaching clients who pay me 50 G's I teach them because I need them to become the tip of the spear and Videography and operations and sales and marketing and compliance Right, and so we started creating these really badass systems And that allowed our success rate to go through the roof and we started raising our price franchise price went from $5,000 buy-and-fee to $25,000 buy-and-fee and by the way the more people pay the more they pay attention And so we're getting better qualified owners on board. They're not serious. Yeah, you know that right? Yeah Yeah, I remember charging more as a personal trainer and getting clients that were more serious. Absolutely When we interviewed Ben Pekolsky This was something I kind of dug in on him a little bit and you know I picked up on it real quick because he had said some things real similar to you And I know stuff that I challenge was challenged with was when you're kind of the underdog guy And you've got this chip on your shoulder a lot of your success has been on your own fight your own You've learned to be successful me.   They know we have to sell friend. Yeah, I know I signed the we all think everybody right I signed the front of the check Of course, I'm gonna be more motivated. They signed the back of the check. They're not as motivated, right? That's just a reality. My name is on the lease their name is not on the lease I have more to lose.  We just instinctively look for how can I cut corners?  He's obviously on edge.  I'm gonna work less effectively instead of more effectively, right? So communication become a better communicator be more decisive I make faster better decisions these days because like anything else decision-making is a muscle and you can improve it people go How do I make those big decisions really?  Oh, where do you want it? Where do you want it? Should we see a movie first or dinner first make a decision? We're hey, honey We're having sushi at eight o'clock and then we're gonna go see the Expendables after this because I'm a Sylvester Stallone fan. Okay, and if she has a problem with it She'll tell you and then I don't want sushi gives me diarrhea. So I'm gonna have steak or whatever, right? I've got a twisted sense of humor.   It just goes.  Am I gonna wear a hat today? Am I not gonna wear a hat make a decision don't him and ha take forever Just make a decision tomorrow's another day. You can wear a different hat or no hat, right? But it's so it's great communication skills. It's being open to give and take feedback It's being decisive having clarity of vision. I know I want 2,500 fit-by-to-boot camp locations by the year 2020 With less than 1,000 owners That means each owner has to have two to three fit-by-to-boot camp locations because I don't want to serve a lot of owners Which means I have to have a big bloated Team sure right? I want a small team of 40 or 50 team members serving a thousand owners whom 2500 locations Collectively and I know the date that I want to buy and I know the path that we used a week to get there Which is Facebook Instagram YouTube those are my marketing platforms and so clarity of vision is very important And finally you have to develop a team for you to develop a team You have to be a want to leader not a half to leader so I'll finish off with that I want to leader is someone that for example if I'm working for you guys I want to make you happy. I want to please you.  So right I Have to be in a place where I don't want to let you down Instead of I fear you so many people Run with the iron fist right because they're passive aggressive They hold it in hold it and hold it in an emotionally go off at an employee and the employees now walking on eggshells Do I have the dr. Jekyll Sal or do I have the mr. Hyde Sal? Right, so so all those things matter, but you have to develop your leadership muscles You can't just overnight. It's not a light switch It's a dimmer switch and it took me three and a half years to develop those muscles How much are you enjoying the podcast space? Man, I am really digging it. I was a little awkward at first I spoke very fast when Craig and I did our first maybe dozen or so podcasts Like anything else I went right back to just black giving content. Yeah, I'm like wait a minute This is just like when I'm on stage, you know, it's let me take my time I've got all the time in the world we can edit out to whatever minutes we need it to be and Soon as I got comfortable went back to you know point story metaphor. It was awesome But it was pretty nerve-racking man like oh man, we're on camera. What's gonna happen with this? I Am enjoying it the feedback that we're getting is cool You finding it there I find it therapeutic as hell It's one of the most therapeutic things I've ever done the one that Craig and I do is very like we're gonna Talk about this one specific topic. So there is none of this stuff Which is why the the BK podcast that I'm gonna do at the my gym that I'm opening up BK strength It's gonna be very much like what you guys are doing here We're gonna work out together and we're gonna film and audio record the whole workout And they're gonna finish off in our lobby as we're eating a high-protein meal like final thoughts And it'll just be people who fascinate and interest me from high-performance entrepreneurs to world-class athletes or Navy SEAL friends that I have or whatever. Yeah, do you have a favorite podcast that you've done so far? A favorite podcast that I've done so far. Yeah, good interview question any good Yeah, the the model health show because Shawn just somehow He's a great listener. He doesn't wait to talk and I've been you know I've been watching right like because I'm trying to get into the podcast space myself He's a great listener. He doesn't wait to talk the ones that I don't like so much Lewis house great listener asks wonderful questions As my experience here with you guys amazing I'm not just saying that honestly. I would be very honest with you guys It's it's four dudes bantering and you wait to you listen. You don't just wait to talk The ones that I dislike was when you're coming up at the point and then the host is like, yeah Yeah, yeah, that's right.  I'm like, why why did you ask me to bear shift gears?  Why are we on? Okay, if you're better than me then why are we here? Yeah So I've learned a lot I've learned a lot of what not to do and I've learned a lot of just how to chill like what you guys are doing here Which is why I asked it like hey remember the scene. This is how I want the BK podcast to be like The one that I do with Craig, you know, we're standing up. We're looking at the cameras We're teaching for 18 minutes and that's it, you know, totally different Totally different like this vibe is something that I want to do for my own personal podcast And I've learned a lot just watching you guys and listening to your podcast The best conversations are when everybody's when everybody's relaxed and they feel like they could just open up and the other thing that we learned Jordan Harbinger highly recommend you listen to his podcast He used to be the host of the art of charm now He has a Jordan Harbinger show and he said something that was just recently we had him on and we sucked at interviewing for a long time We were really good by ourselves as soon as we brought someone else in on the show It was like we lost our chemistry and it became like it became like a job interview like okay question one question two It just wasn't good and we slowly started getting better and then Jordan said something else fast And he said you know cuz I asked him I said God sometimes I find it hard to ask The tough questions because I want to be yeah cuz I want to be respectful like it's a guest It's like they're in my house like I don't want to ask this this guy about you know You know why he cheated on his wife or you know the drugs he's used or that kind of stuff Because it feels disrespectful and he says you're not doing the show for him You doing the show for your audience and right away.   Oh good question You know, I really wish a lot. There's no one specific the the fitness motivation influencers That have half a million or more followers are the ones that I have my eyes on because I know what opportunity there The opportunity and I know I just need to peel back a few layers and boom and teach them a few things I teach them to think bigger act bigger get more disciplined and organized. I get it It's also I don't know how much money Simon Panda makes or or any of those guys, right? So I'm not saying like but I look at what Simon's doing You know pushing ebooks and digital programs. That's fantastic. Like how do we think bigger scale? Multiply franchise license, right? Let's go there. Let's go there Let's just explore those things because again it goes back to being curious curiosity Let's be curious about what are the things you have in your wheelhouse, but it again It takes maybe they have a huge following, but if they're dim bulb, I can't help them So I don't know them because I just see them like everyone else does on Instagram But I'd like to get a whole room of them in front of me and then start asking a lot of questions and then saying get out Get out get out get out and then everyone who stays Let me work with you for three years and watch what happens. Is there a way you're targeting these guys right now I'm not I just wait for them tall to come to me.  I want them. They're not ready Yeah, like Pukowski Del Monte Jason Phillips all these guys send me so many great coaching clients Because they talk me up to them and that's how I want people to come to me Versus like hey Baderus is trying to some of his coaching program his name dropping But I don't know if I want to work with him. I think if the resistance wall is up I don't want to deal with them.  I make a ton of money I don't have to yeah, it's you know, I'm not gonna lie I had heard about you in the industry wasn't you know, there's so many of these like hype You know motivational speaker type people. I knew nothing about you So I can I thought maybe you were like one of them Then we heard a lot of good things about you from mutual friends and I'm glad You know, we had we had you on the show definitely a lot way more substance than your those You know motivational, you know kind of rah-rah raw type speakers like lots of substance you get very specific I really appreciate that in our space because I don't think a lot of people are doing that Thank you man, that's a lot true. Yeah raw truth man. Absolutely. Yeah, and thanks for coming on the show man Thank you. I appreciate it. I appreciate the opportunity Designed by Sal Adam and Justin to systematically transform the way your body looks feels and performs With detailed workout blueprints and over 200 videos the RGB Super Bundle is like having Sal Adam and Justin as your own Personal trainers, but at a fraction of the price the RGB Super Bundle has a full 30-day money back Guarantee and you can get it now plus other valuable free resources at mind pump media dot-com If you enjoy this show, please share the love by leaving us a five-star rating and review on iTunes and by Introducing mind pump to your friends and family. We thank you for your support and until next time. This is mind pump


Well, thanks for coming to this talk. I'm Matt Weir. I'm from Florida State University and this talk here, as you can see, is a password cracking on a budget. Before I begin, there's a couple of people I just want to thank. First of all, Bill Glodek, who is another research student, who unfortunately for me graduated, but he did quite a bit of the work here. Professor Sudir Agarwal, my major professor, Professor Brenno, and then also the National Institute for Justice for funding this research. So I really do appreciate that, so I don't have to teach all those Intro to C++ classes there.  As I said before, my name is Matt Weir. I'm currently a Ph.D. student at Florida State University. Before I decided to go back to college and take a significant pay cut, I was a network security engineer for Norser Grumman Task. And the last project I was on, I helped support the JTF Joint Task Force Global Network Operations with some of their forensics investigation. Also, just to let you guys know, I have had my password stolen in the past, so this hits a little close to home. In fact, I discovered that during the course of this research. A lot of what we do is try to figure out how people actually create passwords. And in order to do that, what we do is we look at disclosed password lists. So like a hacker will break into a site, they'll steal all the passwords, they'll post them online, and then we take a look at them to try to figure out what they are. And if they just post the hashes, then we actually have to go ahead and crack those passwords, in order to try to figure out how people create those passwords in the first place. So a long time ago, I played a video game called Batmud, which is way better than World of Warcraft. But unfortunately, they didn't have a very secure website, apparently. So as I was going through these lists here, I was like, oh, hey, I know these people. That's my username. Crap, that's my password. This is hitting a little close to home here for me. But I think that's actually fairly common. If you think that every single website that you've ever entered a username and password into is really secure and never been broken into, you're probably at the wrong conference here. I like to have a disclaimer before I talk, just so you notice and can walk out early if you want to. But I'm a student and I crack passwords in a research-type setting. So we're not really getting hard drives and encrypted files and having to crack them. Instead, we're going ahead and we're cracking these big old password lists here. So some of the tools that we do use may be a little bit different than what you would use in real life here. But hopefully, the techniques are fairly similar. Also, I'll freely admit I've been wrong about many things before. I'll probably be wrong about a lot of stuff in the future. So I certainly don't claim to know everything there is about password cracking. And in fact, quite a bit of what we've been doing, I kind of feel, has been reinventing the wheel. Because password cracking has been something that's been out there for a long time. But it's not really well documented. So we've had to kind of rediscover a lot of it ourselves. And actually, that's kind of the goal of this talk here.  Because a lot of stuff online is pretty much just like run John Ripper or Cain and Abel, and it leaves it at that, or it may give you like a CISSP overview of how to crack passwords. But trying to actually apply that in real life is a lot different I've found. So really, all this talk is just if you're put in that position, how can you maximize the chances of you cracking up that password? So since I do tend to kind of wander a bit, I figure it might at least give you an overview of what we're going to be talking about. At the very beginning, we're just going to start real quick with just some password cracking basics, just so everyone here who wandered in kind of, we're on the same level, and also kind of tell what we've been focusing on as far as our research goes. Then we're going to go ahead and talk about input dictionaries, word lists, a little bit about where to get them, but more about how to generate them yourselves, or at least some of our work is trying to generate them. Because a lot of the word lists online are leave a little bit to be desired there. And then we're going to talk about word mangling rules. How do you go ahead and pick them? A little bit advanced, John the Ripper. And then finally, some of our research that we've been doing on trying to automatically generate word mangling rules, because doing that by hand is a real pain. Also, because this was a 50-minute talk, and that's probably the worst way to give information about technical stuff in the world, please, my email address is here, it's on the slides on your CD. If you have any questions, go ahead and let me know. Also, I'll be available in the Q&A room afterwards. Please show up, grill me, we can geek out about word lists and stuff like that. But it's really important for me that this research actually has some application in the real world. I don't want to just go ahead and write papers that don't really apply to anything. So at the end of the day, if no one's actually using this information, or it's not worthwhile, I'll go ahead and I'll try to research something else. So please, get in touch with me.  And if you have some good ideas that you want me to look at, I mean we're research students, we're always looking for stuff to work on. So please, you're not bugging me if you go ahead and contact me. Also, you might want to copy down that URL at the bottom there because that's not on the slides. All the tools, all the scripts and stuff like that we're providing online. Unfortunately, our main website, which is on the CD, is currently down right now because our system admin took it down to make sure it's all patched up and stuff like that because he said that some people were banging away on that. So I mean that's my fault, and now I learned that before you give a talk at DEF CON, you might want to give more than a week's worth of notice to your system admin there. So I apologize for that, but I threw up it on Google pages there, so it's just reusablesec.googlepages.com. And you can download all tools and scripts. So real quick about password cracking, don't worry it has knocked me a CISSP prep course. So there's really two types of password cracking that people think about it. Online and offline. Online, we really don't care about too much. This is what people are trying to do to our website a couple of days ago. The site's online, or the computer's online, and you're just going to try different username and password combinations to a site that's currently operating. And the research that we've been doing really doesn't apply to it that much because on online password cracking, first of all, it's generally very slow, so you're very limited by a number of guesses you can make. And it's noisy, so the system admin actually looks at the logs, which happens every once in a while, it really shows up. But more importantly too, you're limited by a number of guesses you can make before the system locks you out. So you try four passwords, if you get it wrong, then you're locked out of the system. So what we're really focusing on though is on offline password cracking. This is the computer forensics. So you obtain the warrant, you broke down the door, you seize the hard drive, you get back to your shop, and all of a sudden you realize, well, this hard drive's encrypted, or there's encrypted files on here. How do we go about breaking these? And when you get into that situation there, you're really only limited by the amount of time you can spend trying to crack these passwords and the amount of computing power you can throw at the problem. So I'll be talking about password hashes a lot, and really it just comes down to hopefully your computer, your bank, the website doesn't store passwords in plain text, because then there's no need for password cracking. Someone breaks into the site, they see all the passwords, they're done, they can have a beer. So most sites go ahead and they store a password in a one-way cryptographic function that mangles the password so you can't figure out what it is very easily. So let's say a user goes ahead and creates the password defcon. The computer will not save the word defcon on the computer, hopefully, in Syria anyway. There's a couple of talks about this later where it sometimes does. But instead the computer will hash the password. So the Md5 hash of defcon is that long string there. To log in though, and it stores that hash instead of the actual password. So when you log in, you type defcon in again, the computer hashes that password and it compares it to what it has stored on the computer. If those two hashes match, it goes ahead and logs you in. Cracking passwords is very similar. You just make a whole lot more guesses. So you make a guess, you hash a guess, you compare it to the hash that's on the hard drive. And if those two hashes match, you've cracked the password. So really the question is how do you go ahead and making those guesses intelligently? Because hashing those guesses takes a lot of time sometimes. So there's really two main ways that you go about trying to crack a password. The first one which we're going to be spending most of our time on is the dictionary attack. So you take words from an input dictionary that contain words that you think someone might want to use to create their password. And you mangle it in a way that people normally do when they create passwords. So your input dictionary might have password and you try that. And if that doesn't work, you try password 11 or capitalize P and replace the A. And this is what people normally think about when you talk about password cracking. Now when we crack these lists here, we hit what we kind of call a brick wall after a certain point. And that's really, I mean, initially when we start cracking passwords, we're doing really well because we're cracking lists, you know, a couple thousand passwords, you know. So initially we'll crack, you know, a couple hundred and then we'll like maybe go down to cracking maybe like 10 an hour and then maybe one an hour and then one a day. And then pretty soon we're to the point where we're cracking maybe one a week and we're like why are we doing this? You know, because, and we got to move on to the next list there.  It's like hitting a brick wall where you're not cracking any passwords. And it seems like you're just kind of spinning your wheels. And when you're doing a dictionary-based attack, it's really frustrating because you got to figure out why you're not cracking those passwords and you don't know until you actually crack the password why it was. So, I mean, you could not be just trying to write dictionary words. So your dictionary could be a poor, it doesn't have the word in it, it doesn't have DEF CON in it, so you're not trying that. Or you might not be trying to write word-mangling rule. So the person might have capitalized the first letter, replaced A with an ad symbol and added 11 to the end of it. And you're just not trying that as your word-mangling rules. And it's really hard to figure out when you're trying to crack these passwords, do I try more dictionaries? Do I start with more dictionary words at the problem? Or do I try more advanced word-mangling rules on the dictionaries I'm currently using? Because it's a real trade-off. Because you're always limited by the amount of time, the amount of guesses that you can make. So the bigger your dictionary, the less word-mangling rules you can apply to that dictionary. And vice versa, the more word-mangling rules you do, the smaller dictionary that you have to do to apply those word-manglings to. So it's a real trade-off. And then there's brute force, where you just kind of go through it. We're just going to go try every single possible combination. And don't let anyone tell you anything differently. Brute force is wonderful. I love brute force if you can do it. The problem is this is password cracking on a budget, and generally brute force is not an option for longer passwords. But if there's no password creation policy, it still helps you get a lot of passwords that you normally wouldn't get with a dictionary-based attack. So here's some examples of some real passwords that crack with brute force. Like VPTP. That's not going to be in my dictionary. It's not a real dictionary word. I have no idea how they picked it. But since it's really short, it's easy to crack with brute force. Another one, WF capital X 8 ZJ. Once again, I'm not going to crack it with a dictionary-based attack. And luckily, they didn't make it one more character longer. Because if they did, I wouldn't be able to crack it with brute force. But since it was only six characters long, I was able to crack it. 00K00. So that's kind of just something that they can remember. Once again, it's very resistant to dictionary attacks. And the final one that kind of just annoys me is Wii. For Nintendo Wii, I think. And this just kind of points out that dictionaries are only good when they were made. So most dictionaries are fairly old. If you're looking to crack someone's favorite band is MC Hammer, you're golden. But if they're like Linkin Park, even though they're old, too, you're probably not going to find it. So anything recent, it's very hard to keep these dictionaries up to date. So I want to run a few demos just so I can have stuff breaking in front of a couple hundred people. But I guess the real question is, how good can I do if I just do the kind of script kitty type saying, I go online, I download John the Ripper, I download a couple of these word lists, and just run them? Because that's an honest question. Because if you can do really well with that, then you can just walk out and go to a different talk. You don't have to listen to me talking here. So if you'll excuse me, I'll be kind of lame and just copy and paste these commands so I don't fat finger them. And what I'm going to do is I'm just going to go ahead and run John the Ripper with the default rule set. And so also we're going to go ahead and we're going to crack half the MySpace password list. So a long time ago, one of the most famous disclosed password lists was someone set up a fishing site at MySpace and managed to grab about 60,000 MySpace user names and passwords. So we feel that these passwords are very representative of what normal people would do when they create passwords if there's no strong password creation policy. Also just so you know, we split these password lists up into two different parts. Whenever we get a plain text password list, mainly because it's really easy to create password cracking rules if you know all the passwords beforehand. So this way we'll have a training set and a test set. So we don't look at the test set at all, but we do look at the training set to try to figure out how people create passwords. And then we go ahead and try to make our rules and practice the test set. If the passwords are hashed when we grab them, the whole thing is the test set because you have to break them in the first place. Also just so you know, these passwords are not hashed. So I'm just outputting them to standard out and just seeing how many of them we cracked with John Ripper's rule set. The reason for that is that this is a 50-minute talk and it'd be really boring just to watch his crunch numbers here. If this was hashed with, let's say, MD5, this test here would have just taken about an hour. So at the very end of the talk, we could have looked at it and been pretty boring. If this had been hashed with a stronger hash, like Linux's or Unix's Crip 5, which does 1,000 MD5 hashes, we'd have to definitely extend this talk time a little bit for this. So just to give you an idea, an hour if this was hashed with a very basic hash, 1,000 hours to run this test here, if this was a stronger hash. And we used just the basic words.english.text dictionary, which is the one that you find on all the different password cracking websites. And it ran there and then we managed to crack 3.2% of all the passwords there. So yeah, I mean, if you're only trying to crack one or two, that'd be great. But if you want to tell your boss, hey, you know, we were setting up a forensic shop here and we have a 3.2% chance of cracking these passwords, that's probably not going to cut it very well. So the next question is, could we just be using the bad word list here? Or actually, you always hear about people always using the same common passwords. So why don't we go ahead and use a word list of just common passwords. And this once again is just downloaded offline here. It's like 816 most common passwords. It ran really quick. Only 41,000 guesses versus the 10 million guesses from the previous one. And we cracked 1.71% of the passwords. So once again, I mean, well, that's actually pretty nice. Very few guesses. But still, you're not even cracking double digits here. So let's go ahead and use a bigger dictionary. And this dictionary's description is the big dictionary.  And this is going to actually take a couple of seconds here. And this is actually just saying one of the few good big dictionaries that I've had experiences with. And I'll complain about big dictionaries a little bit more later. But hopefully it'll just take a minute here. Oh, there we go. And finally, we're cracking double digits. But it took much longer there. It took 37 million guesses. But we did manage to crack 19% of the passwords. So this is actually starting to get a little bit semi-respectable here. And finally, we're going to talk a little bit about custom dictionaries in a little bit here. So I might as well go ahead and try one of these here real quick to show you. So this is a custom dictionary. It's actually based off of Wixionary. And Wixionary is a sister project of Wikipedia. It's an open source dictionary. And they actually provide them in a whole bunch of different languages, which is really nice. So this is actually, we're running it off the English dictionary off of Wikipedia that we did.  This only generated about 3 million guesses compared to the 31 million guesses of the big dictionary here. So about 10%. But we still managed to crack 12% of the passwords. So using custom dictionaries can definitely help you, especially if the hash is really strong. Cool, nothing blew up. Okay. And just in case that wouldn't work there, so you can just see graphical representations. That's the top one's the number of guesses, and the bottom one's the number of passwords cracked there. So you can see just how well they did there. So the first thing I guess we should talk about though is word lists. You know, how important is a word list to your password cracking? And as you can see from that previous demo, it actually is extremely important. Unfortunately, it's also boring as hell. I'll freely admit that. If you're not doing password cracking currently, or you don't enjoy organizing your sock drawer, this is probably not going to be the most interesting thing in the world. There's probably actually a big overlap between password crackers and people who do like organizing their sock drawer, actually. But I'll just hit the high points, and once again, if you want to meet afterwards, something like that, we can geek out about word lists. So there's a lot of places to find word lists online. And in fact, most of them have the exact same word lists. So they all steal from each other and try to talk about them being the ultimate word list site. The first one I really want to point out is the openwall.com, the FTP site, is for John the Ripper. If you go to their website normally, they don't really advertise all of their word lists because they want you to spend money and buy their actual big word lists, which I don't blame them. I love capitalism.  The other two sites below that are just kind of general word list sites. One site that's kind of want to make fun of a little bit, please don't hack me if you're in this audience, is the argon.com. And they have the ultimate gigantic word list, they say. It's two gigabytes large. And everyone says, oh, it's got to be good. It's two gigabytes of words.  First of all, it's so large, you can't do any word mangling rules on it. It takes forever to run. And there's just so much duplicate, so much junk in it that it really doesn't crack passwords very well. About the only password I managed to crack was that that impressed me when I just ran it one time, is one guy decided for his password to use an HTML markup tag, which I have to admit is a really good password because there's all the symbols, uppercase, lowercase, and all that. And I wonder what he does for a living. But that was just, in one of the web pages they sucked down, he had the exact same HTML markup tags that was able to crack that. The last site I just want to point out, if you go on BitTorrent and you can find it, is the Exploits Master password collection. It has a ton of different word lists on it. But it also has what looked like passwords on that too. I don't know if they actually are passwords or not, which is why I can talk about it. But it's really good if you're just starting to do your own password cracking research. You can go ahead and log on to that and try your tools against the things on that as well. And they don't have email addresses on it or anything like that, so I don't feel bad about this. It's just random passwords. So with these word lists here, there's a lot of stuff that you need to be really kind of anal retentive when you're dealing with them in order to really help you out later.  But just things you need to think about when you're managing your word list are, you know, you want to avoid duplicate words. It seems pretty simple, but it's actually a pain in the butt sometimes, especially when you have multiple word lists that you're trying and you can't remember which one you did previously and stuff like that. But duplicate words equals wasted work because you already tried those guesses before. You also got to ask yourself, how are those words terminated? Are they terminated by a tab, a space, a new line, or a carriage return? And that's really important. Most password crackers are fairly smart about dealing with that, but if you're writing any custom scripts that can really bite you in the butt, which I found out myself too. Standardized capitalization. How many artifacts are in the word list? How many HTML tags are there? How many timestamps and junk data just shows up there when you try to create the word list because you're not going to go ahead and copy and paste all these word lists here. And then finally, is the word lengths important? And this is not really for the hash that you're doing because most password crackers are fairly smart about that, but more along the lines of if you want to do case-mangling, because if you have a really long word and you want to try every single possible case-mangling in that, you're going to spend all day on that one word just trying to case-mangle it. So you might want to terminate it if you're doing a serious case-mangling. Now, as I said, the word list you find in a line leave a lot to be desired. So first thing you probably might want to do is if you're a forensics investigator, you have the hard drive in front of you, and you're just trying to crack individual files on the hard drive, is to try to find to see if you can find the password anywhere else on that hard drive. And for that type of research, I really want to point you to David Smith at Georgetown University, and he's doing some really good work and he's doing some really good tools for parsing that hard drive, grabbing out potential passwords to try them. Next thing, creating a word list by hand. It's a pain, but in some cases it can be really effective. Probably the best success I've had is swear words in different foreign languages because people using swear words in their password are international type saying. So I've gone to a bunch of different sites, swear words finish, swear words German, and stuff like that, led me to some interesting sites too. But just creating those custom word lists there really worked quite well. Now, if you want to go ahead and script this, on your Backtrack CD there's a WYD Perl script that you can use as well that works a lot better than WGet because it'll actually parse out some of the junk as well. It's not perfect, but it's better than doing it by hand sometimes, in different word lists. Now we created some custom word list generation as well. As I mentioned earlier, Wictionary. A lot of the foreign language word lists were really, really, really poor. They didn't have much in them. Some of the characters were messed up in it and so on. So I wanted to go ahead and create a password or crack passwords in foreign languages because like Finnish and Swedish and all those Norwegians really seemed to like disclosing passwords. So I looked at Wictionary, and I was like, I don't want to do that by hand. So I created a program called WikiGrabber that will go online. You can specify what language you want. It'll go ahead and download it. Since we're doing some passphrase of research as well, you can actually specify that if you want only grabbed nouns or only grabbed verbs or adverbs, it actually makes pretty good word lists. The next step, of course, we are syncing as well. If we're already doing this for Wictionary, why don't we create something for Wikipedia so we can create customized word lists like hacking beer, vodka, and Vegas? And just grab the Wikipedia pages for that. That actually still needs quite a bit of work because I didn't realize it before I started working on this here. But trying to find the right words on Wikipedia is actually fairly difficult. So if you do beer, for example, you'll find out a lot of information about the fermenting of beer and the history of beer and so on, but you're not going to actually find beer names like Amstel Light or Boddingtons. For that, you'd actually have to go to the individual countries and that's actually not linked off the main webpage for beer there. So trying to find that is still hard or still a lot of work to be done to make that a little bit easier, but that's also on the CD and on our website. Now the next thing we saw was we got a whole bunch of cracked passwords already. If someone used a word in their password before, the chances of someone else using that word are very high. So we wanted to go ahead and parse our cracked password lists and try to make customized dictionaries to crack more passwords. And that actually works extremely well. So the first thing we did was we went ahead and extracted the alpha characters from a password and used that as a word. And you can make certain like judges there so if you have an at symbol between two letters, you can probably change that to an A and so on. You just strip out special characters and so on. And that, as I said, we've had extremely good success with that, but we were a little bit worried that we're just missing words. There's mangling rules there that we don't know about because we're dealing with, you know, tens of thousands of password lists. You're not going to look at each one individually. So we wanted to go ahead and just try to see if we can parse out the low hanging fruit and then look at the remaining ones and try to figure out how they were created. And to do that, we went ahead and decided to use edit distance of passwords. So you're all probably actually familiar with edit distance even if you haven't really dealt with that term because it's used in all the different spell checkers out there. If you type te, instead of za, it realizes, you know, okay, you switch to h and e because that's a very close word there. Well, we thought, why can't we go ahead and use that with passwords as well, with analyzing these? So in the normal edit distance, you have rules like delete, swap, transpose, and insert. So to change Apple to apply, you would have an edit distance of one because you only need to change the e to a y. And you can match the words based upon whoever has the closest edit distance. We decided to add a few more rules to it to simulate how people create passwords. So for example, adding numbers to the end of a password is one edit. So the Apple 99 to Apple would be having an edit distance of one. And this actually worked really well. It had some minuses and pluses, but I'm pretty happy with it, actually. It does produce false negatives. Sometimes they'll say, you know, this word was created from this one, but it actually wasn't. But if the word-mangling rules make it so. And also, initially, I thought this wasn't very good because it's only good as the input dictionary. So if your input dictionary sucks, basically what you do is you have your password list, you have an input dictionary, you give it, and it tries to figure out which rules in the password list match up with rich words in your input dictionary. So if your input dictionary doesn't have the word, it's not going to match up. So, and initially, that was kind of a bad thing. So we're trying to do, like, best of breed. So we feed a bunch of different dictionaries and try to create one good dictionary that's really edited towards it. But what we found out later was that it's actually extremely good, though, for evaluating dictionaries.   So this actually helps us out quite a bit. And also, it goes back to, remember when I was talking about hitting the brick wall, whether the problem is you're not trying to write enough words in your word list or whether you should try more word-mangling rules. This actually gives us an idea of what is the theoretical maximum number of passwords we could crack with this word list here. And so if we try every single word-mangling rule we can think of to crack this password list here, with this dictionary, we're only going to crack this many. So like the really big dictionary can only crack, it will crack about 50% of the passwords. If you try every single word-mangling rule you can think of. So that's kind of the top bar there. The words on English dictionary can crack about 50% of them, even though it has, you know, 200,000 words in it. So that's why we can say this one is not very good. Common password one, you can crack about 5.3% of all passwords, just with 816 words. And the dictionary one, you can crack 32% with 68,000 words. And really, the reason why this is good is you're never going to hit that limit, really, because there's always these crazy word-mangling rules that you just don't have a chance to use. But when you start getting close to that, okay, I probably cracked all the passwords I'm going to crack with this dictionary here. Maybe I need to switch to another dictionary to try this, or maybe go to brute force. So that really helps kind of eliminate the guessing on when you need to do, whether you need to add more words to the problem or whether you need to add more word-mangling rules. Okay, I'm actually going to kick off the next demo here real quick, and then we'll come back to it later when I have a chance to explain it. So hopefully it doesn't crash in the meantime. But this is actually going to be our customized word-mangling rule creator. So the next thing that we're going to talk about is word-mangling rules. So this is what everyone really thinks about with the password cracking, is how do you go ahead, how do you mangle these passwords here to recreate what a user is actually doing? And I have to say, the one thing that's really surprised me when I started doing this is how limited most password crackers were when it comes to word-mangling rules. And I think the reason for that is that Landman hashes, the old Windows hash, really spoiled us. Because old Landman hashes, they capitalize everything. So you don't have to worry about case-mangling at all. And also, they're seven characters maximum, so it became pretty easy to brute-force them after a while. So I think we kind of sat on our rear end there for quite a while with a lot of these password crackers. So it makes password crackers look really good when, in fact, they're not really doing that much advanced stuff. And one thing I found, I mean, it's very easy to crack passwords, not easy, but it's fairly straightforward to crack passwords to have only one simple word-mangling rule applied to them that everyone uses. So, like, 80% of... It's like 80-something percent of all people in these lists that we've been seeing here use two numbers at the very end of their password for when they create passwords. Or... I think that's right. You might want to double-check me on that one. That's why I love slides. I need to have this stuff. But a lot of them do, anyway. So that would be one great word-mangling rule, really easy. But when you start combining word-mangling rules, it gets actually very difficult. So this password here, password 12 was capital P, W, and an at symbol. That is an extremely strong password. I mean, password's going to be in every single person's input dictionary, so that's not a problem. But even though doing that word-mangling rule where you capitalize the first letter, you capitalize the fifth letter, you add two numbers to the end, and you change the A to an at symbol, putting all those word-mangling rules together, it's very unlikely that you're actually going to go ahead and try to be able to crack that password there. So that's an extremely strong password, and you can all see how easy it is to make. Also, if they use a non-standard rule, even one non-standard rule, the chances of you cracking are very small. So like password was just a seven between the P and the A. Since not many people go ahead and use that as a word-mangling rule, I'll be really surprised and kind of impressed if someone cracked that without resorting to brute force. The chances of it are very low, even though it seems like a really simple password. So if you're creating your password as a defender, I highly recommend just don't stick with the pack. Try something even a little bit different, and make your password fairly secure. Now, one question I get when I talk to people here is should I use Keen and Able or John the Ripper? Because these are the two major free password crackers out there. And I love Keen and Able. I have to say it because they put a lot of work into it. It integrates a lot of different things into it. You've got your art poisoning, your sniffing, and everything else. So it's a wonderful program, so I hate to trash it. But really, if you're cracking passwords seriously, you need to be using John the Ripper if it supports the hash that you're trying to crack. And the reason for that is pretty simple. Keen and Able doesn't have very main word-mangling rules at all. In fact, it's extremely trivial. It does adding two numbers to the end of a password and case-mangling. And it doesn't even combine those. So if you have a password with a password one with a capital P, Keen and Able is not going to crack that because it doesn't try capital letters and numbers at the same time. So I mean, Keen and Able is fun to learn how to crack passwords on, but if you're cracking passwords seriously, you don't want to be using it. John the Ripper, on their hand, is configured via a config file. So you can go ahead and you can get really crazy with all the different word-mangling rules you can think of. And in fact, even if John the Ripper doesn't support whatever word-mangling rule you want to use, you can always just create a custom script and pipe those guesses directly into John the Ripper since it's command-line, which is really nice as well. So you can do pretty much any type of word-mangling rule that you want to. Now, when you download John the Ripper, first of all, one second of the block people will say is it doesn't support the type of hash that I need. And the answer to that is it probably does someone's written a patch for it. So go ahead and find it and download and install it. And it actually will support more hashes than Keen and Able does. But you need to go ahead and find those patches, and actually most of them are actually on the John the Ripper website. Also, I'd recommend against using the default John the Ripper config file. It's not actually bad, but you can do a lot better. Now, one thing that's kind of annoying me or it surprised me is even though this is probably one of the most popular password crackers out there, I've yet to find somebody else's John the Ripper config file that they posted online. People just don't like sharing that information for whatever reason. So it's been kind of hard to tell what other people are doing. So I tried to solve that a little bit there. I included a couple of our sample John the Ripper config files onto CD. So that way, at least you can look at what we're doing to go, noobs, you know, you're doing horribly. But at least now you have some examples of what some other people are doing. Also, the John the Ripper config file, it is kind of intimidating a little bit. It's just pain.  And they'll be like, oh, that John the Ripper config file, I can't figure that out. It's not that hard, but it just intimidates people a lot. But I mean, there's a rules read me file there. I highly recommend reading it. I have it open all the time when I'm modifying it because I forget how they do it. But I highly recommend if you're going to be doing some serious password cracking, you really need to take the time to learn that. But, because I'm kind of tired about everyone whining about that every single time I mention John the Ripper. I went ahead and I created a custom John the Ripper config file generator. It's menu-driven as long as you don't mind text. Oh, cool, thanks. And it didn't make it to the CD. I'm sorry, it's very bond, the link to it. But once our main list upside, it will get up beyond that. And it's on the download one right now at reusablesec.googlepages.com. I probably should have put that at the top there. I'm sorry. But not only would this allow you to go ahead and create custom config files and stuff like that, but I should ruin a couple of different things that I wanted as well in this kind of feature creep.  You can go ahead and add specialized or password creation policies to this. So that way, you don't have to modify all of your config rules every single time you want to try a different site. So you can specify, like, I want the passwords to be at least eight characters long, have two numbers, two special characters, and so on. Also, I've made it so it's very easy to change the character set as well that it uses. So that way, you can switch between different languages as well, since it seems like all the password crackers out there focus on English, and I kind of want to share to love a little bit there. So that makes things a little bit easier. Now, as I said before, brute force is a wonderful, wonderful thing to use. But usually, you don't have the option to brute force the entire key space. So there is kind of a halfway thing where it's called targeted brute force, where you try to brute force just the format of the passwords. So that way, if your dictionary is poor, you can still maybe crack the password. For example, you might want to brute force six characters followed by two numbers, and that speeds things up a lot. So even though you're brute forcing characters and numbers, you're only trying characters in one spot and numbers in another spot, so it actually narrows down the key space quite a bit. Now, you can do that directly in John the Ripper. It's a bit of a hack. On the CD, there's some additional slides on how to do that, and I included a sample of brute force config file on the CD as well. But in reality, if you really want to get fancy with this, I highly recommend just writing a custom, you know, parole script or something like that and piping into John the Ripper. And that way, you can get really fancy, too, and start adding Markov rules and things like that to really try to help speed up brute force. Okay. Now, with word-mangling rules, though, we quickly found out that it really is a pain to specify them, because the first couple of word-mangling rules are fairly easy. But as you get into more and more less probable word-mangling rules, first of all, they take a long time to run because you add two numbers to an end of a word, you're trying 100 guesses. If you try four numbers on the end of a word, you're trying 10,000 guesses per word in your input dictionary. So you want to kind of narrow it down quite a bit and you end up creating a couple hundred different word-mangling rules and then editing and managing it is a real pain. So this idea was actually Professor Sudhir's idea originally, and it actually really works out pretty well. And that is why we create computers, is why don't we have them go ahead and analyze password lists, try to figure out how passwords were created and create custom word-mangling rules based upon that. So the actual name of this is a probabilistic, context-free, grammar word-mangling rules. So you can tell what we're writing a paper on right now. But really, in theory, all it does is it tries to figure out how passwords are created and it assigns a probability to that word-mangling rule. And it also assigns probabilities to every single number, every single special character, capitalization, and everything else along those lines that it finds in the password list. So it'll say one is much more common to be used than seven and 99 is much more common to be used than 11. And really what it does then is it tries to generate the most probable passwords first. So right now, we have a fairly basic, and the one that's on CD here, a way of figuring out what the word-mangling rule is. So for like password 11, it would say, you know, uppercase the first letter, have seven lowercase letters, and then two numbers. And there's definitely stuff we're looking into adding, you know, for like, it's pretty easy to add onto this, you know, replace the A with an at symbol and stuff like that as well. What it does is that word... that structure there has a probability. The structure of, you know, numbers has a probability. And you can actually even assign probability to input dictionaries. So you can say, this is really, you know, common passwords, so I want to try a lot of word-mangling rules on this. But this is a much bigger input dictionary that I want to try, you know, eventually on some of the more common word-mangling rules. And it'll go ahead and it'll spit out the guesses in order for you. So it might try, you know, like password 12 and then password bang before it tries password 13. So that way it really specifies all these different word-mangling rules really well for us. Now, our current implementation makes guesses and outputs some of the standard out. So that way we can go ahead and pipe this into any other, you know, password-cracking program so we don't have to worry about the hashes and keeping track of which passwords are managed and so on, because I'm lazy and I don't want to have to code all that. So right now, in most of our tests, we actually go ahead and output them standard out and input them into John the Ripper and use John the Ripper just to go ahead and do all the password hashing. Now, I'll admit this structure does have some overhead. That's why I didn't just run it immediately. But the overhead is actually fairly low compared to a strong hash or even a semi-weak hash. So we have used this actually successfully in real-life cases. So it's not saying that, you know, you run for a couple of days and it takes, you know, 10 times as long or so. And because we have a graph and I'll show you the results in a little bit and I'll talk about this graph here afterwards if you want to. But this kind of shows the number of passwords we crack over time versus John the Ripper. So initially, during sort of very high probability rules, we do pretty much the same. In some cases, actually John Ripper slightly does a little bit better. But after a certain point, R starts to do much, much better. And unlike John the Ripper where you have set number of word-mangling rules and it's done, R has just millions of word-mangling rules. They're very small, but they're still, you know, millions upon millions of word-mangling rules. So if we let this run, it'll just keep on going and going and going. And we don't actually have to specify all these different word-mangling rules, which is really nice. So now we get to check to see if anything crashed or not. Oh, cool, it looks like it actually worked here. First time for everything here, yep. So once again, we trained this one on the training set of the MySpace rule and we're trying to crack the test set. If you want to see some graphs and stuff like this of us training on different password lists and then trying to crack other password lists, talk to me in the after-talk room about some graphs and stuff like that, because we've definitely looked at this, too. But like with John Ripper, with the English word list, it cracked 3.2% of the words. With our password cracking thing, we cracked 5.6% of the words. With the common passwords, John Ripper cracked 1.7%, using the same number of guesses, we managed to crack 2.9%. So it's not perfect, but like the Wikipedia English one, John Ripper cracked 12%. We cracked 21%. So in most cases that we found here, I mean, it does much better than John Ripper. And that's pretty much it. Oh yeah, and here's just the graphs so you can see the number of passwords cracked there versus John Ripper. I don't have much of an inside show. That would explain it. So that's it, though. If anyone has any questions, feel free to ask now or talk to me in the after-talk room here. That's my email address. As I said, please email me if you have any ideas or anything like that. If you have any password lists you want us to crack, as long as they're legal, I'll definitely take a look at those as well. And that's a rough bit of it.


The Army Oil Analysis Program, or AOAP for short, is a preventative maintenance tool that can save Army units thousands of dollars each budget cycle in parts and labor costs. Oil Analysis Lab Manager Heidi Vodide explains, The AOAP program has a lot of benefits. We're thinking about proactive maintenance, preventive maintenance, and of course we heard a lot about that as the environmental. Every time a single truck or other rig gets an oil change up to 10 gallons of oil must be added. Costs add up. It actually saves, because like I said, it's a preventive maintenance tool, but it also saves the taxpayer money because we would not have to purchase new oil. Like I said, we extend the intervals and we would not have to pay for the waste oil disposal. We would not have to pay for the disposal of filters. We would not have to pay for the disposal of plastic containers the oil is purchased in. AOAP tests that examines three different criteria that can allow maintenance tech to extend oil life. We are doing three tests AES. We are looking for 15 elements in oil. We are doing the viscosity. Viscosity is one of the most important tests we are doing. On the test, the third test is that we are looking for the contamination, but it's coming in oil. Like water, coolant, that is the test name is FDIR. The 39th transportation battalion at Claibor concern has an active fleet of 6915 alpha tractor trailer rigs each needing the maintenance to strict standards of readiness. These tractor rigs use 10 gallons of oil as well as many gallons of transmission fluid so extended lubricant life can save the unit money. How much money? Program, the number is run with six trucks we got running it's like about 28,800 dollars just for the oil. And those savings don't even include the labor time to change the oil on one of these rigs. To change the oil on one of the landfill tanks for about 30 minutes to include the oil filters and everything. And compare that to the time needed to draw oil and transmission fluid sample. About five minutes to draw a sample. So five minutes versus 30 minutes. Additional savings come from a sharp drop in oil filter usage and oil disposal costs because you guessed it. For every 10 gallons of new oil that get added, 10 gallons of old dirty oil must be discarded. We have only 50 more years maybe, oh we have to be careful how we use it. So bringing regular samples into the lab can extend a finite resource and support a cleaner environment. The lab services organizations far beyond the Kaiserslautern military community area. We support Africa units, we support aviation units, we support the rotational units coming and going out of Europe as we speak. Those are mainly our customers. The lab is located at the U.S. Army Depot just across from Dana Kaserne in Kaiserslautern. I'm Army Sergeant First Class John Fries, 7th Mission Support Command.