guys are going to give a fantastic talk and it's going to be really entertaining. Yeah. Thanks for your faith. Yeah. I got a meeting to go to. So, you know, whatever. All right. Let's give him a round of applause. Wow. Is this a Thursday at DEF CON? This place is packed. Thank you, everybody, for coming. Thanks. Yeah. Welcome to Sorry Wrong Number. Mysteries of the Phone System, Past and Present. My name is Patrick McNeil or registered 436 on Twitter. I work for Radware as a security solutions architect and I've got about 15 years of telecom experience, about half of which has been in security. So, I'm Owen. I'm at Linus blog on Twitter and I pretty much started out doing development work. Then I moved on, like breaking stuff more. So, I moved into security, did a bit of apsec, DevOps and most recently Pentestine, so. So, we've been working on a lot of things and we've fully embraced the film noir aspect of this conference. So, we have a pretty black and white deck here. Hopefully we can read it. That's why we're wearing these silver shirts. All right. So, first a brief word from our lawyer. Obviously, everything that we say up here is our opinion only doesn't represent that of our employers and all trademarks, service marks, etc. belong to their holders. We tried to use creative commons where we could, but sometimes you run afoul and it's all fair use at this point. Should be in the slide notes. Most of the slides we attributed. So, some of what we're going to show you today could be used for nefarious purposes or evil. So, some audio. Those who travel wind up in the gut of the prison of the grave. Something bad could happen. Use a life of crime. So, I want to thank DEF CON organizers for letting us speak. It's a great, great time out here today. Why are we doing this?  So, it's a good opportunity to learn, learn a lot, especially from this guy. And I don't know why you're doing it. Well, I mean, obviously, we wouldn't be up here if we weren't having a good time. And I sought to learn as much about stuff from him as he was from me, because I don't really have an app set background. He didn't really have as much of a telecom background. So, you know, it's a good way to get something together. So, you know, plus a lot of people have forgotten the roots of freaking and hacking. You know, the original hackers were essentially the freaks. Long before there was the internet and the bulletin board systems and all that, they were the first ones that said, here's something electronic that I can mess with. They were the ones who really developed, if you will, the hacker ethos. So, we wanted to highlight that some of the things that hackers used to do, or I'm sorry, that freakers used to do, are still somewhat relevant. The mindset, the approach to things, even potentially some of the attacks. You know, you can look at some of the freaking attacks in a slightly different way and now they're relevant for voice over IP.  It was designed to work, designed to generate a source of revenue. And, you know, potentially reduce the number of lines you needed into offices and things like that. So, we're not going to talk about everything. We're going to talk about maybe what's likely to happen. And we wanted to kind of educate a little bit about ways to defend networks rather than just the pen testing and attacking goal. So, kind of known a bit about freaking backgrounds, good. So, we had to have a pie chart. I always love putting pie charts in presentations. Not reflective at all as to what's in the presentation. Really, the percentages are all off. But when you go over history information, you could do some exploitation stuff and there's a little bit of a tool. So, we just move on. All right. So, before users were actually allowed to dial before the little rotary phone, operators were in control of the dialing process. So, if you wanted to call somebody else, you had to pick up the phone and talk to the operator and they would, you tell them in exchange, the exchanges were normally the street name or the intersection where the phone switch was located. And then each of those exchanges had anywhere from three to five digits that were used for the subscriber. So, we have a video clip for you. This example is from a movie called Sorry, Wrong Number, which is the inspiration for our talk from 1948. So, you can play video. Operator, your call, please. Operator, I've been ringing Murray Hill 3, 5097 for the last half hour and the line is always busy. Would you ring it for me, please? Murray Hill 3 is 5097. And this movie, she's supposed to be an Indian. My husband got it. It should have been home hours ago. I can't think what's keeping him or why that ridiculous wire should be sitting. Yeah, she's smoking in there. It's almost 6 o'clock. Thank you. I love how you can have conversations with the operators to explain your situation. Hello, Mr. Stevenson, please. I want to speak to Mr. Henry Stevenson. Hello, who is this? What number am I calling? Excuse me, what's going on here? I'm using this wire. So, it's a little hard to hear, but they were actually talking about a murder plot. And that sort of thing, well... I like today's movies. You know, you see people grabbing stuff and putting it on the other side. That's the depiction of hacking. I don't know if... I can believe this. It was something that could actually happen across wire, basically. So, user dialing. User dialing and getting away from the operator actually came from a relatively unlikely source. Almond Stroger was an undertaker. And he was under the impression that somebody was stealing his business. And he figured out that one of the operators in town was actually married to the other undertaker in town. So, when somebody would call and say, I want to talk to the undertaker, it was his impression that they were putting that caller through to... The operator was putting him through to her husband instead. So, he came up with this thing called the Stroger switch, which is essentially a cylinder. And it would use alternating current pulses to rotate the cylinder. And there would be one per digit dialed. So, the phone that he came up with essentially had three buttons on it. And there was one button for the hundreds place, one for the tens and one for the ones.  So, you better be counting when you did it. And it would turn the cylinder and it would be a little armature that would click in. They ended up being called step by step and eventually acquired by the bell system. So, as implemented by the bell system, however, they got away from those little buttons that you had to press. That's when we first started seeing the actual rotary dial. And when you would turn the rotary and we go click, click, click, click all the way back, well, that's what was actually sending the alternating current pulses and turning the switch. The problem was that was only good within one exchange. And those switches were tied up for the duration, the entire duration of the call. So, eventually, they got around to dialing from exchange to exchange, adding more digits onto the front of the number. But in order to dial from exchange to exchange, you no longer could reference the name of the exchange. So, they had to come up with a way for them to do that. And basically, they said, well, we'll abbreviate all the exchange names and then convert those letters into digits. And that's how we came up or how they came up with the letters that were assigned to every number around the phone dial. Now, of course, nothing really changes without a motivating event. And the motivating event for AT&T was really a combination of workforce growth, the need for efficiencies, the cost of running the network, all those switches that were tied up. So, they ended up having to work on an electronic switch. And the switch that they came up with was the panel on crossbar, which introduced common control. And when you dialed, it would actually build up the number that you dialed in something called a sender before it would send it on for processing. That was good enough for local dialing, but now we had to get to long distance. And long distance dialing, they developed something called the 4A crossbar switch. That was something that used, it was very similar to a old computer punch card that was made out of metal. And there were punches in that that represented the routes from city to city. And there were alternate paths. So you would follow the punches to figure out how to get from one city to the other. And now, of course, we had to introduce the area code so you knew or that the system knew when you dialed which exchange you were trying to get to. Unfortunately, there was a big design flaw that they didn't think about. And a lot of us are familiar with 2600. The reason 2600 is called that is because of the 2600 megahertz tone, supervisory tone. Essentially, the flaw was they were using in-band signaling. So the signal was actually being carried over the same audio path or the path that the subscriber was using. What that meant was if you dialed a toll free number, a long distance number, you could then send the 2600 hertz supervisory tone. And the long distance switch would think that you'd actually hung up the call. From there, you could then send either single or multi frequency tones depending on what that long distance switch supported and dial another number. So that's how people were able to make free long distance phone calls. Let's see. So I thought it was one more slide back because you didn't do that one, did you? Yeah, I just did that. I wasn't paying attention. It's not our first time, I swear. So when we're looking in the future, you've seen a lot of VoIP. Yeah, I can see you. So when you're looking in the future with the VoIP, what could happen? We've got a lot of technology driving innovation. We've got watches, phone, having SIP support added in the latest Android. Why do they do that? And what about WebRTC? WebRTC, we're going to see more people vishing for one-time passwords or credentials. We don't know. We haven't got crystal balls there. We're not going to show you any leaked new exploits. We'll cover tag vectors that are still relevant today based on the phone system and still effectively need to be defended against. And we show you a vector we thought of after Carolina comms sitting at a table just goofing off, mostly created with AGI scripts. We'll get a bit more into that a bit later hold on. So many of you if you're familiar with VoIP at all will have heard of asterisk and it's created in 99. So it's been around a long time. It was created by Mark Spencer and it's now made by or maintained by Digium. There's a confusing number of releases. You've got long-term support and latest stable GPL and a bunch of books. You know you've made it as a product when you have a Fadami's book published after you. So AMI and AGI, the asterisk management interface and the asterisk gateway interface, AGI can be thought of like the CGI for phone systems. You can write scripts and they will do stuff for you. And it's really cool you can do some really cool stuff.  Now you have all these variants. Some of these are real popular. Just making it easier. Asterisk home free PBX and Tricks box are really big. The one that runs on the Raspberry Pi is pretty cool. But the problem is, you know, they don't necessarily take security into mind. It takes them a while to catch up to the latest branch from Asterisk. So what happens is you keep on building stuff and you can't keep up with it.  I think 2013 was the latest update for one of them. Eventually that trash may fall over and anyone's watched idiocracy or, you know, trash could fall into a lawyer's apartment. So we're going to go through some attack and defense. Yeah, so we're going to do attack and defense for several categories of threats. And we used Al Capone on all the slides for the attacker. The famous gangster and J. Edgar Hoover, the original director of the FBI is our defender. So you can see the little icon at the top right and know which one we're talking about. It used to be red versus blue but we decided to do that. It didn't work for film noir. Black hat versus white, I guess. So we're not going to cover every voice threat, right? There's a lot that we could cover. We're going to cover the most likely stuff. Not probable. Yeah. Possible but not probable. Alright, so information leakage. When a system that is designed to be used only by authorized parties gives you stuff you can work with so you can abuse it. So, you know, the freaks were the original phone enthusiasts and they like to explore the phone system. They took advantage of information leakage all over the place because it was not designed to be secure, confidential. You know, the very first thing that they could do is socially engineer operators. The operators were mostly female so some of them, believe it or not, would actually use girlfriends and get their girlfriends to call the operator and say, they were another operator and could you put me through to this number? Yes, hackers or freakers in this case actually had girlfriends. So the other thing they could do is they could pretend to be one of the male workers, one of the test line operators and say, yeah, I'm trying to test this particular number, put me through here and of course the operator was more than willing to oblige. Phone techs were also very proud to work for the company.  And in most cases they were willing to share. I mean, anybody who's proud of their job, you might be willing to talk about it. Especially if you're not told any of this is confidential. And then of course there was really obvious stuff. You're picking up the phone and you're dialing, you're hearing all kinds of clicks and you dial a long distance number and you hear the tones, you start to wonder, well what are those things if you're our type of mentality? And they started recording them on tapes and slicing up the tapes and eventually figured out, well we could build something called a blue box and actually replicate those tones by pressing a button. And of course I would say the biggest gift to the Freakers was actually a 1960 technical journal, Bell Technical Journal. They published these on a regular basis and it actually published the single frequency and multi-frequency tones that were required to send from exchange or from one longest and switch to the other. So they basically said, oh yeah, by the way, if you want to control our longest and switches, here are the exact frequencies you need to send. Perfect if you're trying to put together a blue box, right? So, and then of course, exhaustive dialing of numbers quickly figured out that those metal dials were abusive on your fingers so they'd use pencils and just dial all kinds of numbers that were outside of the normal phone range and discovered that, hey there are special codes that you can use for routing in certain directions, avoiding charges, accessing certain features. And then of course there was something called a loop around, which was really supposed to be for testing by the field technicians and Freakers figured out that if you could stand to listen to the annoying tone that was on the loop around, you could connect two people together and just chat, just have a exchange of information. If you could get over the, you said an annoying tone on that, right? Yeah, it was a supervisory tone that would play. Yes. Yes, a T-Prophet said, yeah, they accepted collect calls. So, the world was largely oblivious to the freaking community and they really found out in this 1971 Esquire article called Secrets of a Little Blue Box and some of the people that were made famous or infamous in that included Joe Ingressia, Mark Brunet and John Draper, aka Captain Crunch. They were certainly not the first Freakers as we've kind of seen because freaking was around for a long time, but they certainly became the more popular ones. On a bit of a side note, AT&T was at the time the monopoly owner of the phone system and they had a policy in terms of service that said you couldn't hook anything to the phone system that was not sold by them. So, Freakers decided, well, that's no fun and we want to share some jokes. So, basically the first answering machine was made. Didn't actually record anything, but it would play jokes. Joke lines became really popular. So, that's pretty much the bulk of the history that I'm going to try to dump on you today. So, I would definitely recommend exploding the phone by Phil Lapsley. It's a great read. It's entertaining and he's done a lot of really good research. So, the phone companies eventually stopped blue boxing by moving to something called common channel interoffice signaling. What they did, essentially, was they put in another line from office to office using a modem so they could digitally signal the calls. So, you no longer had the signaling over the call path. As Freakers figured out what was going on there, it's like, well, wait a minute, if the phone company can use modems to send information digitally from point to point, maybe we can with these new personal computers that we're discovering. And very quickly they figured out that they could now connect over things like a bullet import service instead of having to do it over the phone. So, this is where we started to see a little bit of segmentation between the PC hackers and the Freakers. And of course, the protocol that they used to communicate over these modem lines eventually was IP. And that started the downhill roll. It turned into, you know, let's make an IP card that you can jam into the back of your old switch. And eventually, well, let's make it all IP so it performs better and we'll just have a gateway that goes on to the TDM network. And of course, the subsequent step from that is, hey, now we have virtualization. Let's just make a virtual thing that we can run on a laptop and, you know, use a soft client instead of an actual phone. So, nowadays, information leakage, I mean, you can do a lot of stuff that you would normally do with any sort of scan or pen test. You know, your basic port scanning, send a SIP message and see what comes back for your stacked fingerprinting extension enumeration where you're just sending like a register message or an invite message to every possible phone number that you think might be in that range and just see what comes back. And of course, if you're actually looking at the SIP signaling, SIP in and of itself leads information like crazy. The user agent might tell you what type of software is being run by the PBX or the endpoint you're talking to. The methods that are supported by that endpoint may tell you a little bit more about what it is. Yes, it's very similar. If you take a look at it to the way HTTP works, you've got your allow methods and the interesting parts are really in yellow. Yeah, it's text-based. So, what does that mean? We can man in the middle of that because we can easily write a little script that says, if I see this, do this to it instead. And SIP, unfortunately, is still using the crypto that Time Forgot, MD5. So, you know, you can cram anything over TLS and SRTP and hopefully make it more secure, but oh my god, certs are hard. So, nobody wants to issue client certificates. And basically, yes, you can get some integrity and maybe a little bit of confidentiality out of having that flow, but there are still TLS attacks. So, you know, I'll get into later what I recommend here, but obviously having TLS doesn't guarantee security. It's worth to note too, the MD5 doesn't change. It's the same for every phone call that session makes. And I asked, why didn't you just change it to a more secure algorithm and can't be that hard to... ROCs man, go argue with the IETF. Alright, so when actually gathering information on a phone system, you know, start with the basic stuff, don't think of this as a phone system, do your Google searches, scan, you know, do DNS queries, scan job boards, figure out what somebody is running through a side channel basically and you can actually make phone calls and listen to the voicemail prompts for people that aren't there and you can usually figure out about what phone system they might be running just because they're standard prompts with the voice they use. Yeah, exactly, which you'll hear later. And of course, if you're internet connected, SIP options is generally used by many scanners to try to detect the presence of a PBX, but a lot of vendors have either patched against that or they put in rules that say, don't allow options from anybody except this specific endpoint. So use something like an invite or even a cancel message, something that will evade that. And then of course you can look for X headers, which are unique to particular vendors, you know, do your extension enumeration by sending lots of register messages, basically just see everything you can get to come back. When you're doing your port scans, remember that the, at least most people use Nmap, so they don't change the default options always. Yeah, you gotta mess with the default options or add in new options, so definitely scan UDP because SIP is generally sent over UDP, but also include the ports for AMI and AGI interfaces that are not part of the default port range. You will miss them if you don't add in those ports. Scan slow so you don't get picked up by something that's looking at rate-based. When you're using a tool, and I think this goes without saying, but understand what the tool is doing rather than just accepting it and running it. A good example is SIPvicious that's used by about 99% of the people scanning for SIP services, has a default user agent string that just about everybody has patched against now. So you'll see a friendly scanner come in, not, and you know that's SIPvicious. Didn't SIPvicious make a bunch of people's phones ring in Korea too? Exactly. So scan with a different tool name, a user agent name, scan with a different method like an inviter cancel. The Metasploit scanner is pretty good because it randomizes everything, but it doesn't do at least the modules that I've seen so far haven't done credential cracking. And also not many of the VoIP scanners around today are being actively maintained, with two exceptions. One is VipRoy, and actually if you go to the VoIP hacking seminar or whatever, the session being held by Fatih, he actually maintains that, and BlueBoxNG is also maintained. But the others still work, so yeah, for the most part. So the next exercise, Patrick looked at the Rapid7 GMAP data and came up with some interesting analysis. Yeah, I noticed that they basically just collected SIP-UDP. They had just an initial options response, so if I was doing it, I might have used a different method just to maybe get some more information back, but it is what it is. It's a big dataset, and what was interesting was the numbers that came back weren't as big as I thought they were going to be, because there's an awful lot of SIP stuff out there that is connected to the internet. So maybe people put in ACLs to block their scanner or something, but we got 52 to 53,000 that came back as just generic asterisk, and nearly 11,000 that said asterisk PBX, and the interesting one for us, which you'll see why later, was this asterisk PBX, and what was it? The phone core. That's actually Tricksbox, which is asterisk installed on a piece of hardware. It's a virtual machine. Yeah, it's sold as sort of a quick startup. Yeah, like an all-in-one point-click configure type. And of course, as I expected, we saw a lot of small to medium business systems, lots of old MTA software releases, and the stuff that totally blew me away was the couple instances of like a NordTel DMS 100. This is like a big, big switch. Who would put that on the internet? There were a lot of user agents that just said camera, and they all seem to be based in China, which was kind of weird. And then lots of MTAs that are being deployed in Germany, that there's been a really active push for that, and lots of Huawei and Iran. You know, I'm guessing because not many American companies are going to be selling in Iran. What's the Fritz OS? Yeah, Fritz OS was the MTA deployed in Germany. All right, so what can you do to defend yourself against this information leakage? Number one, security by obscurity. Change your default user agent. There's no reason that you need to have it. It's not really used by anything. So call it asterisk when you're on a VIAS system or something else, right? So it's not used. You could try that. It may work. Block known bad user agents. We have a bunch of known bad user agents that are in an IP tables on our GitHub. I did some sip honey pot research for a while, so I had about three years of data that I just parsed through and you know, here's a list of them for you. Especially if you're on asterisk, use this. Always off reject. Essentially the error code that's returned is usually different if an extension exists versus if you've got a bad password. In this setting basically returns the same error message for everything so you can't quite tell. So the question was, are you setting that for every sip pure? Yes. There's no reason... Yeah, there's no reason to have it otherwise. So you're going to use fail to ban, to block IPs that are repeatedly trying to hammer you? What happened to your video? Yeah. Thanks a lot, Master Chen. Try plugging it back in while you're the laptop doing that. Before I even get to the good stuff too. Oh my god. I saw something happen. What might that do again? Shift F5 resumes at your current slide. All right. That was weird. Who's messing with it? Okay, and then lastly, use a security appliance that will block sip skins. So exploitation, we don't really need the definition for this rule here. Using it something for the greatest possible advantage for shellfish users. So how did the freaks use it? Yeah, so exploitation usually has this connotation of being malicious, but for the most part, the while the freaks was similar to the medical profession, do no harm. It was all about just exploration and it was fairly innocent for the most part. Knowledge search. So nowadays it's pretty much anything you can imagine you got fraud, DDoS, botnets, profit, whatever you want to do. I mean bad guys are going to use it for however they want. So we take a look at the Tricksbox example that we were talking about earlier. There's 1200 on there. And what's this? Quality software. Last updated and what's that? June 18th, 2013. It's got five stars on Sourceforge. So we know it's good. This is a little bit out of the freaking theme, but kind of example of what happens when you keep building technologies upon technologies and not necessarily taking security into consideration. These are the vulnerabilities for asterisk as of a few months ago. You can see there's one for every category in the Denial of Service code execution overflows. You name it. I like the one bypass something. That's cool. There's more you can look into depends what version you're running. So this one's actually written by a guy called AttackTerrorist. If he's here, we want to buy you a few beers. I want to give you a hug. But yeah, he made an unauthenticated cross-site scripting. It's against the help module. It's a basic cross-site scripting. I did a pop-up, but that's a real cool rate. It doesn't work in the newest CRAM Firefox. I didn't test IE because who runs that. So he also found in the same CVE, a local filing inclusion, where you could pretty much include any file you wanted to. You can't read all files on the system because some people know that if you include like proc slash fd, which is your file descriptors, you can write files. And you can do php input filters, which would also allow you to kind of read php code. But once you get an LFI on an asterisk system, or on one of these all in ones, you can pretty much go around reading configuration files. User.conf, you can read those if the permissions aren't set up properly, which they generally aren't. You can read the extensions, what's on there. The amport of config is great because it has your MySQL password in it, and you can also read the asterisk log to see what's going in, going out, what's happening on the network. And was that authenticated or unauthenticated? This is authenticated. So you have to be an admin. So you could generally do this functionality anyway if you were an admin, but it's still a vulnerability, right? So there's also a remote code execution. Great. What this example does is it echoes some php code into shell. And then we call that shell and execute PanTestMonkey's Python shell. So pretty cool. And we have a video for that one. So this is the shell execution. This is also authenticated. I have to press spacebar once more time. Yeah, one more time. There you go. And here's the video. So I'm going to, I'm on the server right there. I removed the shell to show no funny business going on. And this is authenticated again and it's loading echo in the shell with bash. It's not rocket science, but it works. So we go back to the server and Alice again and hey, that's the shell. So the video gets a little funky. I think I mess it up. There's the listener. The listener and my local host and there's the call to the shell. Sort of anticlimactic because it doesn't really do anything, but bam, right there. Yep. So who am I? I'm Asterisk. So yeah, you can kind of do whatever you want there. So that was cool. And then this next one gets a little tricky. So this is using the same LFI we saw earlier, but we do remote code execution by reading the Asterisk logs using a SIP message that I thought, well, if I can read the Asterisk log, maybe I can inject some things. So we play this one. So again, this is authenticated, but you wouldn't necessarily need to be offended where you would to execute it. The local file inclusion, but not to it, submit the script to it. So there's your local file. We're reading passwords file. I do proc CPU for fun. It's cool to see what CPU is running just to make sure it's working and all that. And then this is the Asterisk logs, refresh that. So there you go. The next step what we do is this is Sipsack and I just send a test message that's not even a valid user, by the way. That's just a random user. It's dope. And you'll see that the test message shows up way at the bottom somewhere. So then I just go ahead and echoes the PHP info in there. So we're basically injecting stuff right into log file. Which you can do with Apache too if there's an LFI on Apache. And then there's your PHP info. So you can execute PHP code as you wish. So that's cool. But those are both authenticated. So I thought what I'd do is I'd take the unauthenticated cross-site scripting and then use the remote code execution which is authenticating. You can kind of do a fish. So this is the one that gets kind of really, it makes me confused too. So you use the cross-site scripting and you use this and hide it on mouse over, hide a frame and replace the window location. With this base64 decoded stuff. And then you do your shell echo in there. We've got a video to kind of show this. This one took a little bit of time to get right. But it works. So this is the window that's authentication required and I think I need to press it. That's the fish showing that it doesn't work for an unauthenticated user. So you're going to want to send that payload to somebody you know who has access to the system. I can't do it because I don't have credentials on the server. Just removing the shell again, show you. So this is the logged in user and this is the fish, reload it. And I do it twice just to make sure it works. What is going on here? As most people probably weird as they're moving their mouse around. And you probably changed this so it wasn't that cheesy but you put it in an high frame. Yeah, you put it in an high frame and put it on a popular site or something and then it would do the same thing. So there's your own. So that's from unauthenticated. That's why it's dangerous to oh I don't care about an unauthenticated cross-executive. What could you possibly do with that? Well, you could do something pretty malicious. So how do you defend against this? It's actually really easy for the cross-executive Delify and remote code execution. It's all the same. You make an array of what you want and you feel to embrace upon that. You want us to sanitize input? Yeah, it's simple. Like don't just say what language do you want? Oh, I'm going to try and read that file now. Just English, French, Spanish, whatever you want but don't take anything else. So never trust any input from the end user. And it's not the end user's fault. It's because you can't trust bad people. So it's more defense. We've got to pick it up. Wow. So avoid all and one distributions, update, custom build. It's not hard to do a custom build if you build and you don't build what you don't know and configure it properly like some of the other slides do your firewall and fail to ban.  Yeah, so fraud and abuse, my definition was fraud is when you have no intention to pay for using the services that you're using potentially causes loss or damage to the owner enables criminals to make a profit. And yeah, I guess you could say abuse, manipulation of the telephone network to do something maybe fun or unintended. So skip these? Yeah, I'm going to skip these for now. I had some little Q&As here you can get from the slides you want to get to the good stuff. All right, so making money is a top motivation for phone fraud. International revenue sharing fraud is the top fraud scheme where you compromise a phone system and make lots of calls to a foreign destination. And the owner of the switch at that foreign destination splits the profits with you because of international telecom revenue agreements. Phone companies are forced to pay the peer who delivered the call. And you talked about that last year. Yeah, I talked about that last year at Sky Talks. All online. Caller ID spoofing or back spoofing which is a social engineering vector where you can make a phone number that you don't own pop up on the caller ID display and that has implications for the name that also shows up. We're going to show a demo of that. Telephony denial of service where you basically just target somebody either for purposes of extortion or just maliciousness and keep cramming calls at them so they can't get a call through. The last one was phishing. Yeah, so fraud and abuse demo basically when a number comes into your phone the the person sending that that call doesn't actually send along the caller ID display the CNAME display. That is actually in a database that the phone companies use and you your phone company does a dip to the CNAME database and then says Hey, this is what you need to display on your phone. Well, can it be useful? Yeah, so most companies that offer sip trunking do not allow you to set the number that you're sending as part of the call. You have to tell them in advance you know this is my phone number or they'll assign you the phone number and that's all you can send. It is useful to be able to send a different number especially in something like a call center but usually agreements will be made so that they know what numbers will be coming through. However, some smaller providers look in the terms of service experiment with it. You can set the caller ID information on a sip trunk. And by the way, it is illegal to cause loss or damage as part of spoofing. Or with an intent to cause harm. Intent to harm. So, and while you might not intend to cause harm if you spoof a law enforcement number, I generally wouldn't recommend it. So this is how you set caller ID in asterisk of extensions.conf. It's real easy online. And this is another way this is used in project we'll show you in a .call file for an automated call. But it is worth noting you have to find a provider that will send this on correctly. So these are just two ways we've used it in this demos. So who's calling me? So hey, look who's calling me. I'm sitting on my couch watching Jurassic Park as you do. Bosses, right? He's the reason why we're here. That's enough of that. So that's real fun and stuff. So I got this idea we were sitting around at the table and we were saying, what if you spoofed voicemail? What would happen? Would you answer your phone? I mean, I was originally thinking if you just had your caller ID set to voicemail would people call it back and enter their pin numbers if you randomly called them? But yeah, so we were thinking about it. And here's some scenarios we came up with. Yeah, so you can get a call from your voicemail system and it says, we've been acquired. Punch in your pin number now for security reasons to listen to this message. And here's another one. The tech support fast track. Yeah, tech support fast track entering your date of birth. Things that you'd want to collect for maybe getting through a password challenge. So I created it. It's not really an IVR. It's not interactive voice responses. It's punching the numbers. Yeah, I guess so. So what you do is you configure it, configure SIP trunk, configure up some variables in PHP and you set up a recording of those scenarios we were just talking about. Create a target list of text, text list of phone numbers or you can do a single number just for fun and do a dry run of the recording make sure everything works. You can test against your local phone number and then you run the campaign. And the key here is you dial into the system from your phone. And you designate the targets from your phone. So I thought it was cooler than making a web app to do it but the web app would have been way easier. So it's a little more old school freaker feel rather than just doing it from a script. And they make a web app for it. So this is, I go to press space twice. Yeah. So this is kind of what happens when you dial in. Menu off to turn on press to turn to main menu. What you can't hear is you press all times and it beeps afterwards. Yeah. So basically note that when the call comes in to this mobile phone it's showing up as the voicemail number that's already stored in the phone. So we go to the video. This one starts off really loud. You might want to turn it down. You hear one important recording that we selected. So you can, he enters a pin number and there's the it's console based at this point. I just finished making it so you could dial in and it would tell you. And there's the pin number he entered. So it's cool. It works. So why do we care? I was thinking when I wrote this, oh you can get people's voicemail passwords and you get their pins and read their voicemails and delete them and stuff. But apparently there's more risk to it than just that. Yeah. So you get that pin number and some voicemail systems will let you forward calls, let you originate calls, make a voicemail broadcast to the entire company. What would you do if you had that power? You could also adapt it to get one-time passwords or conference and information. Right. So I have a bunch of fraud and abuse defense stuff that you can see in the slides because I know we're running out of time here. But one of the things that I really wanted to point out as part of this was if you're trying to block international numbers, those revenue sharing numbers, you cannot just block 011 for your international dialing codes at least within the North American numbering plan. There's a lot of Caribbean destinations that are also considered high cost and if you look at them it's just a regular 10 digit. It looks like a regular U.S. number. There's some more stuff. Yup. Set pins on long distance trunks, etc. And... Oh, you got to that already? Yeah. Thanks. That's our GitHub. Thanks a lot everybody. We'll be around.


Welcome to the Naval Surface Warfare Center here at West Bethesda, Maryland. We're really trying to characterize and predict the performance of these ships and these submarines in full scale by testing scaled models in the water, collecting information like resistance, powering, drag, and all the motions that the model goes through. Every Navy ship that's ever been commissioned has come through Carderock. So we have done the hydrodynamic evaluations and testing on every class of ship that's out there.


This is Stink Tech, Hawaii. Community Matters here. Welcome to the Cyber Underground. I'm your host Dave Stevens. Welcome back. Thanks for joining us again. We have some great guests, a co-host today. We're from the ISC squared in Hawaii, and we're going to be talking about the Equifax hack, and we're going to do a couple of rants on that. But first, we're going to talk to one of the business leaders here in the community. It does a lot of contracting, a lot of cybersecurity, has a lot of community outreach as Booz Allen Hamilton. And with us today, lead scientist and data analyst, Chalmer Lowe from Booz Allen. Welcome, man. Good to have you aboard. Appreciate the chance to be here. Excited. Where are you from? How'd you get here? What's your history? Okay. Originally, it came from the east coast, transferred to Hawaii about three years ago. I was requested by Booz Allen Hamilton to come out here and work on one of the teams that's located down here. You're new to the islands? Okay. So totally new to the island. Soon as I got here on the island, I looked around for people like myself, people who had a cybersecurity background and or who had kind of a programming slash data analysis background. Found a number of those folks in the community, but I found kind of an opening, a gap, I guess you could say, in particularly the programming community related to Python, which is strongly used for data analysis. So I founded an organization out here called Pi Hawaii and we do a lot of community outreach, trying to help people understand the benefits and the usefulness of Python to solve problems, to automate work, and to do data analysis. Well, that's great. And you worked for Booz Allen. So tell us a little bit about Booz Allen Hamilton, EAH. Booz Allen Hamilton, it's a consulting and technology firm. Been around for about 100 years now, a little over 100 years. Got a strong position in several different markets, cybersecurity being one of them, analysis, solutions, engineering, defense, and the commercial market. Myself, I've done work for Booz Allen Hamilton in the commercial market, working with financial organizations to help them evaluate their cybersecurity posture and or respond to things. I've also worked in the government sector and a variety of other areas of Booz Allen Hamilton, predominantly focused on data analysis and mentoring and coaching folks on how to use Python to solve data analysis challenges. So why Python? What is about Python? I have to emphasize this is P-Y-T-H-O-N. P-Y, so Pi Day is P-Y Day, right? So tell us a little bit about Python. Python is programming language. It is an incredibly powerful language from the standpoint of you can do a wide variety of things with Python. It runs much of the foundation behind Google, YouTube, Facebook, Twitter, LinkedIn. I mean, the heavyweights in the social media world are relying on Python to run much of their infrastructure. If you've seen Big Hero 6, you've seen Star Wars, all those computer-generated graphics, that all resides on an underlayment of Python. It's installed by default on just about every Linux and Unix system out there. So if you want to use Python, it's available for you. It's also installed on Macs, right? Right, because Mac has a BSD Unix, I guess, mutation. It's called Darwin. That's their distro, and that's underneath the fancy GUI. So Macs got that by default. Absolutely. And Python is by design intended to be easy to read, easy to write, and easy to understand. I'll give you one example. In the UK in the last year, the BBC has released a product called MicroBit.  It runs Python on it, and that was distributed to all of the 11-year-old students in the UK. A million students in the UK are studying Python and making MicroBits, turn lights on, run motors, detect things. The MicroBit's got an accelerometer in it, and a compass, and it's got buttons, and it's got a little LED display. And these kids are just tearing it up with Python, right? At the age of 11. Cool and scary. Simultaneously. Absolutely. But that's a symbiotic relationship. We've got to deal with that. We've got to educate our kids, and then hope they don't go nuts, right? Okay, yeah, let's talk about hats. We've got white hat, gray hat, black hat, and we want them to stay white hat, ethical hacking at the best, right? And I don't want them to wander off with the situational morals thing, right? So tell us a little bit more about what you do to get this into the community. So in the community, I do several things with Python, and I do a variety of things also with cybersecurity. So I kind of cover both of those issues. With Python, I said I run Pi Hawaii. Boozell and Hamilton has been a long-term sponsor of that. And we have meetings every two weeks, and we, as a community service, offer up beginner sessions and advanced sessions and puzzle solving sessions. All at the same time, or do you? We do them all in the same time frame. So that way the new folks who've never played will start to see a little bit of the art of the possible when they see what we demo and show to the advanced students. And then when we, as a group, solve puzzles, we talk about how do we solve a puzzle? And we write the code on the screen. Everybody gets to see it run. We make the puzzle work, and we get an answer. And then we walk through how do we improve this? How do we make the code more efficient? How do we make it take up less space on the screen in terms of reducing the number of lines of code? How do we simplify it so it's easier to read, easier to understand? Those kinds of things.  It's never done. Yeah, it's never done. It's never done. You're always coming back. I can make it better. I can make it better. I was drinking a beer when I did that one. I can make it better. That's the problem with coding. But it's great. You put in critical analysis, critical thinking in there, so you're solving a problem. You're kind of taking a word problem, putting it into code. And that's what happens in the real world, right?  Someone says, I need to solve this problem. I don't know code. How do I solve this problem? I need to do x. And you say, hey, I know Python. It's right here. Let's do it. And that's what you teach people, right? You have a couple of events coming up. You want to talk about that? Sure. So in terms of cybersecurity, the kinds of things that I like to be engaged in, I like to work with folks and engage their minds. So Booz Allen Hamilton is sponsoring a couple of events that are really geared toward helping people learn and helping people to grow their skills. The first one is going to be a cyber networking and hacker trivia night. We're going to put on this hacker trivia event, try and get folks from across the cybersecurity community, both folks who are new to that community and folks who are gray beards and have a strong understanding, trying to get them all in a room, they'll socialize, and we're going to present them with hacker trivia questions, right? Things focused on the entire spectrum of cybersecurity skills, whether it be forensics, reverse engineering, malware, the history of cybersecurity. You go all the way back to freaking. It's far back as we can. It's technology too. Okay, cool. Captain Crunch whistles and stuff. So we've got all these questions, and you can get together in teams of up to six, and we can help you form a team at the event. If you don't have one, if you've got a group of folks you want to come with, that's fine too. And you basically compete for props and prizes and bragging rights. So that's going to be on the 11th of October. Another event that I run out here, it's focused on Python. We've got a Python programming competition. It's kind of a capture the flag style of event. And we present puzzles to folks, much like the ones that we solve at Pi Hawaii, and we just cut them loose. Pizza's on the table and a bunch of red bulls and monsters, and you have three hours. Oh, that's all I'm having. Yeah. You have three hours. You solve as many of these puzzles as you possibly can, get as many points as you can. And that'll be on, I think, the 13th of October. And then on the 14th, and this is more cybersecurity related, we're going to do almost an identical thing. We're going to have a capture the flag.  And you have to solve these puzzles and get those points. And again, there's going to be plenty of plenty of food, plenty of stuff to keep you keep you alert. We've got a good sponsor, Booz Allen. Yeah, Booz Allen. They've been very generous to try and, you know, set these things up. We want to have folks in the community who are cognizant of cybersecurity risks and able to support the community in protecting ourselves from these cybersecurity risks. Without a good talent pool, right? We are all at risk. That's a philosophy. Now, if I was listening to the show, because we do podcast also, so we don't have any visuals, but if you could tell people where to go to see all this information on a website and maybe get in on a mailing list so you can find out when the events are coming in, when you blast those out to people. Gotcha. Tell you what, I will possible send you several URLs because they are posted on Eventbrite. But once you sent me this morning. Yeah. Okay, I got those. Is there possibly the Booz Allen Hamilton website has these links? Booz Allen corporate website doesn't have these links, but we will get you something. Okay, we need to sponsor you a website. Yeah. You have a Chalmer Low, Booz Allen Hamilton, Python, Cyber Security website. Absolutely. That's what we need because this is good stuff. You're getting out there in the community. Can you give us some examples of people that you've had on these events that have actually gone on to support the community doing these activities? Cyber, Python? So I'll give you an example of one thing that we did this summer. It's not quite folks have come out of these events, but it's something that Booz Allen was engaged in. We had 12 interns from UH Manoa and from West Oahu Common. They worked at Booz Allen Hamilton over the summer. So just so the folks out there who are not in Hawaii know, both of those universities are four-year institutions. One's research-based, one is applied-based, and they're both part of the University of Hawaii system, and they're at opposite ends of Oahu, right? UH West is out in the Kapolei area. UH Manoa is the first UH that we had, and it's out here in the Honolulu area. So just so you know where they're coming from. You took from those two, and you said you had another intern from someplace else, Toledo, Ohio? Yeah, we had a young lady, Ashley, she came and joined us from Toledo, Ohio. A woman in cyber. Good, thank God. Absolutely. And actually, in our interns, we had a total of, I think, four women in our intern program this year, which is pretty good. 33%. Yeah. I mean, that's pretty good. Wow, that's awesome. So when I first started, maybe it was like 0.01% or something? Yeah. So these interns were with us for about 10 weeks over the course of the summer, and they were part of what we call a Booz Allen summer games, and Booz Allen, you know, our desire to have interns come and work for us cost us to put together the summer games type activities. The interns worked together. They created individual projects that were focused on our customers' needs, and then we flew all of these intern teams back to Virginia, and they competed. They gave presentations on all their projects, and the two teams that we had out here in Hawaii did really, really well. One of those teams, our cyber team, actually made it into the finals out of about 80 different teams. Oh, wow, that's great. So we were pretty excited. Yeah, that's exciting. University of Hawaii was representing. Nice that we can represent.  That's right. It's hard to believe, but this little tiny state in the middle of the Pacific is actually on the forefront of some really dangerous stuff. You know, we have some enemies on the Pacific Rim here that we have to be cognizant of, and there's a ton of military presence out on these islands. So this kind of stuff, cybersecurity, we're at the vanguard of the assault if something should happen. We need to know what's going on, and this is really helping. Thank you. What else can you tell us before we go to commercial? We had a couple of minutes here. Give us some more info. One more item that's coming up in early October to be on, I think, Tuesday the 4th of October. Here in Hawaii, University of Hawaii and the Hawaii Business Round Table host a conference every year called Future Focus. I think this is like the sixth or eighth year that they've done this. And at Future Focus, they look at items that are going to impact Hawaii and the Pacific for years to come. And every year, they have something associated with cyber. And this year, again, they're going to have cyber. And part of what they're offering at this particular conference is they are hosting the kickoff of an organization that's going to be hopefully prominent and powerful in Hawaii called Cyber Hawaii. Cyber Hawaii is essentially the local chapter of an organization called CyberUSA. And CyberUSA's mission is to improve community engagement, bring together educational resources, and improve the understanding of cyber and the resilience to cyber attack to members of the business and public and private communities. Build that awareness, maybe make a cyber network of these folks so they can talk to each other, which is an important point. When you put somebody in, okay, let's be real, when we do our jobs, we're in a windowless room with 66 degrees, you know, we're usually alone, right? You got to get those people talking to other folks, right? Because that's when you share information. Hey, I saw this open source program has a hole in it. Be sure to patch before this date or whatever. And that can prevent bad things from happening. Cisco has a system that automatically shares. But even though those networking, that environment is sharing information, you still need the people. And you can learn things. You get blinders on a lot of times, where you think you're the only one trying to resolve this issue. And then you reach out to talk to some people, and all of a sudden you go, oh, yeah, I'm doing the same thing. And then you start building the synergy. But there's also, among companies, there's also a fear of sharing things as well, because you have reputations to protect them. Sure. And proprietary information, maybe. So trying to get past that is a challenge as well. So we're going to go to commercial, but we're going to come back. That's a great segue into what we're going to rant about in just a minute. That's what we're here for. Hope people are sharing more than Equifax did. Obviously, there wasn't a network to support those folks, but mistakes happen, and we're going to rant. We're going to go to commercial, pay some bills. We'll be right back. Stay safe. Ted Rawson here, folks. You're a host on where the drone leads our weekly show at noon on Thursdays here on Think Deck. When we talk about drones, anything to do about drones, drones, remotely piloted aircraft, unmanned air christmas, whatever you want to call them, emerging into Hawaii's economy, educational framework, and our public life. We talk about things associated with the use, the misuse, technology, engineering, legislation with local experts as well as people from across the country. Please join us noon on Thursdays and catch the latest on what's taking place in the world of drones that might affect you. Hello, everyone. I'm DeSoto Brown, the co-host of Human Humane Architecture, which is seen on Think Deck, Hawaii, every other Tuesday at 4pm. With the show's host, Martin Desbang, we discuss architecture here in the Hawaiian Islands and how it not only affects the way we live, but other aspects of our life, not only here in Hawaii, but internationally as well. Join us for Human Humane Architecture every other Tuesday at 4pm on Think Deck, Hawaii. Welcome back to the Cyber Underground. Again, I'm your host, Dave Stevens, and we're about to talk about the Equifax hack. If you haven't heard about it, you should crawl out of that cave you're in because everybody heard about it. In fact, at 143 million people in the United States, that's basically the adult population of the United States of America, and we're going to talk about how Equifax is handling that situation right now with Jeff Milford, the president of the ISC2 chapter here in Hawaii, and Chalmer Lowe, lead scientist data analyst for a Booz Allen Hamilton. Welcome back, guys. Thank you. I'm going to give it to you, man. Okay. This just in. Okay. It's not 143 million. And how many? It's 200 million. Oh, we haven't had, how many people do we have in the U.S.? That's, that's like everybody. Yeah, well, that's according to Visa and MasterCard. They sent out a not public announcement, and if you follow security, Brian Krebs is the guy who stays on top of all this stuff. This is KrebsOnSecurity.org, right? KrebsOnSecurity, the guy. Or is it .com? I think it's .com. It's KrebsOnSecurity. KrebsOnSecurity, Brian Krebs. So what he was reporting, and this, this is a pattern that just drives me wild, because you get the announcement that says, we may have been hacked. Really, you may have been hacked. You wouldn't be announcing it if you hadn't been hacked. This is beyond possible. And then the numbers are always going to change for every breach. And if, listen, listen to the timeline. This is, this is what kills you. Okay. So on March 7th, there was a zero day exploit, which means the vendor doesn't know that there's a security bug in their software. Well, zero day means nobody should know about it. Except the hacker. Right. So there's no signature for a virus scanner to catch this. Right. It's, and it was seen in the wild on March 7th. Oh, so this has been observed. Yeah. On March 7th. On March 7th. It has to do with Apache struts for their web software. So this is a website software made by Apache, which is an open source tool. So open source means it's free to the general public. There's a community supporting it. Community supported. But it's free and you can use it. And this is protecting all of our credit information. That's the gate to all of our data. Yeah. In their defense, the very next day, they released a patch. March 8th. There was a patch available. So the community really supports, right? They support, the community supports Apache said, oh, a zero day. We're going to take care of that. They did within 24 hours. Right. Okay. So according to Equifax, which of course we can believe them, mid-May, sometime in mid-May was when the theft occurred. They didn't discover it until July 19th, which again follows the pattern of these breaches. Right. They didn't announce that they had been hacked until September 7th. What did, are they doing damage control? Are they trying to figure out how much, I guess they're trying to figure out how much was taken? Right. So this is the incident response process. How much, how much trouble. Something occurred. What do we do now? And they got to go through their process, right? I think they're supposed to notify people before this. So they should have done their due diligence. And their executives should not have been selling stock in the meantime, which happened. $2 million worth of stock. And the defense for that was, well, we wouldn't do anything that obvious. I mean, it looks like insider trading. Yeah, exactly. That's because it is. It looks like a duck sometimes. That's a duck. Exactly. Of course it was. Yeah. Well, we're not going to burn all of our stock, just, you know, $2 million between the three of us. I haven't checked on the stock, but I know right after this was announced to the public, the stock tanked 13%. So those people that sold some stock saved some serious money. Sure they did. And the SEC is interested already, and I've already read that a New York law firm is investigating this. So those three people, I think it's only three are being investigated already. Thank God someone's picking up the blinders and they're looking. Finally, maybe something's going to come of this because they're not regulated. I was reading the argument being made that, well, you can't penalize them because then that makes the other two companies targets. Really? They're already targets. Yeah. And this is the keys to the kingdom. So we should reiterate, this is the top three vendors in their industry for credit monitoring and risk management of users. All of our personal information. And we don't sign up for it. No. We go to apply for a loan or credit card or something, and all of our information gets sent to them. We have no choice. We can't opt out. They're the cornerstone to one of the trust factors in our financial economy and our well being here in the United States. And one of them, 33% of this trust has just been removed. And basically every adult in the United States has been affected. And I think they actually handle multinationals. So there's a lot more people out there. I can't believe that the executives of this company will let this happen. Okay. It's one thing to be breached. It's another thing not to let people know right away. It's another thing totally to sell your stock before you announce. Then what did they do when they actually announced? They charged people for the credit freeze. And then they're surprised that people rose up. They got out the pitch for it. Let's discuss the credit freeze. The credit freeze is what is that and why is that a good thing to do now that we've been hacked and we know our data is going right? That's at least a proactive step you can take to freeze your report so that somebody in theory can't see your credit report. If a lender comes to them, your credit report doesn't exist. It's frozen. They can't use it to open an account or get a loan or something like that. You can do this over the phone. Or you can do it online if their servers are responsive again. They kind of had a little trouble with the response time. Some of the people on the phones, I think they had to put a bunch of people that weren't used to being customer support on the phones too because there were a lot of stories going around. I would imagine the call volume went way above that. What also went missing is the credit card data, the name, and the expiration date. Right there, putting a credit freeze on is good, but if this starts getting sold on the dark web, people are still going to be able to buy things, buy and give certificates. Monitor your credit report, your statements. This also can happen using a debit card, credit debit, where it takes money right out of your bank account. Monitor your bank account because they can rip money right out of there too. If you let it go on for too long, the chances of you getting that money back are just nil. One of the people pointed out, what I've traditionally done is once a year, you can go get your three credit reports from annual credit report topic, which somebody said, well, I get mine at one every four months, which is a really good idea because that's a closer monitoring of your financial situation. But Brian Krebs again pointed out that annualcreditreport.com, guess what software it uses? A patch history. It's been patched since... I hope so. Because that's the one that the government recommends. Well, basically it's the only one you can go to for your free credit report. So we should emphasize, I think, that there's two types of people in countries and in companies. There's the people that run the country or the company and the people that work there. So the people that work at Equifax are probably really good folks. People that are running Equifax should be fired, in my opinion. What's something lawyers that advised them to circle the wagon to charge people? That was wrong. That should not have happened. They should have supported the people that, you know, if you're going to get hacked, at least do the right thing. Don't try to charge money. And going to tell us about the terms of service, if you signed up for the free credit monitoring service, the terms of service... Oh, yeah. You waive your legal rights. Hidden in that language, yeah. You waive the right... That everybody reads, of course. Yeah. Oh, yeah. That's the best sleeping pill ever. Read the terms of service or something. Yeah, sign up for our free credit monitoring and, oh, by the way, you've signed away your rights completely. What do you think about this? I mean, it's pretty crazy. And you mentioned this is kind of international, right? So there were customers in Canada and in the UK affected, I believe, if I understand it correctly. The response time from the Apache Foundation, which runs just about all of the Internet, was top notch. 24 hours or so. They have this patch available. But part of the due diligence for any given company is to ensure that you are attempting to look for the patches, apply the patches, etc. And that is a process. Don't get me wrong, because when a patch comes out, you don't want it to break everything you're running. So you've got to do some testing. You've got to do due diligence and then apply the patches. It doesn't sound like that occurred here, right? Well, there also doesn't seem to be layers. You're supposed to do defense and depth. You're supposed to layer your security. This is one hack that got the keys to the kingdom. Unencrypted database. Unencrypted data. Probably some easy username and password to manage also. Admin, admin. Admin, admin. What about DLP? Where's the data loss prevention? Credit card numbers follow a certain format. They're 16 digits. Unless the hacker was so... Wow, I don't want to come up with that idea. Unless they chunked it somehow and then reassembled it later to slip it past some kind of DLP. But all these things exist now. These aren't future technologies to protect us. And you get these guys that are paid millions of dollars a year. Look at the target breach. For one of $500,000 worth of gear, they actually had in place, but they were outsourcing the log reads. And they were warned that people were eating the logs that was outsourced. They were telling them, hey, look, there's something bad here going on. And nobody pays attention and nobody pays for it except for us. We aren't customers anymore. A long time ago, I saw something at the phone company when I was working there. Used to say, today's customer service depends on you, as the employees came into work.  And it changed. And it started saying today's stock price depends on you. And these companies don't see us as customers. They see us as wallets. Well, we changed the culture in this country. We went from protecting the stakeholders, which includes the employees, to protecting only the shareholders, which is what Equifax was doing today. So in the last minute, you guys have any last second rands? Give me 20 seconds of a rant. One thing about the Equifax item is we're not customers of Equifax. We are their product. They gather data about us, and then they use that to help other folks make decisions about our lives.  Should I not get a loan? Should I be allowed to rent, not rent? We are Equifax's product. I didn't sign up to be in Equifax's database, but I'm the guy who's going to pay for it. And this is a big failure. Yeah, this is a bad one. Jeff? And if you're ever going to be active politically, start writing people about this. Let Congress, senators, people like that know that you're upset with this, that it's time to put an end to it. Put some laws in place. Start regulating them. At least put penalties in place so it becomes very expensive for companies to be exposed like this. So let me take my last 20 seconds on. Here's my rant. I know that businesses don't want to be regulated. They want government out of their space, right? But if that's going to occur, then they have to be more responsible and more ethical. So if you want to not be regulated, you have to do it right. Otherwise, Uncle Sam's going to come in. That's it. Thank you, everybody. We're out of time. Come back next week. We'll have some great stuff for you. Until then, stay safe.


Hi everyone, nice to meet you here virtually. I'm very glad to have this opportunity to share some good practices of Korean ecotourism with you today. Successful ecotourism development requires many elements already other speakers talked about such as good policies, local communities, capacity, and economically sustainable business development. But I would like to emphasize the importance of governance amongst stakeholders and apply sustainability criteria into the whole process of ecotourism development and operation. We have several public authorities promoting ecotourism in Korea as you can see on the screen. But with the given limited time I would like to focus on the ecotourism destinations designated by the Korean Ministry of Environment. Since December 2013, we have a total of 29 national ecotourism destinations. One of the key requirements for these destinations is the establishment of a local ecotourism association as a leading group of the development and management of ecotourism, but engaging various stakeholders. Another important requirement is continued capacity building programs under a multiple year plan covering social, economic, cultural, and environmental sustainability. And we assess the destinations activities every three years in terms of their sustainability achievement level. The environmental ministry and the local government jointly support the destinations activities financially, but the funds is small compared to other government local supporting projects. But the small funds focus on the residential capacity building and the collaborative decision making process having brought to many successful stories. I mentioned about the regular assessment of sustainability earlier. We apply 23 criteria to assess the destination as you can see on the screen. I'm not sure how much you're familiar with the global sustainable tourism criteria known as the GSTC criteria. There are two sets of criteria for any types of tourism destinations and the industry mainly covering hotels and tour printers. Anyway, we developed these 23 criteria based on the GSTC destination criteria. One of the achievements of the Korean ecotourism destinations that I would like to highlight today is that the destinations, basically the communities, clearly understand the goals of ecotourism such as the welfare of residents along with the conserved environment. I have been leading the assessment since 2016, the year we started assessment and when our team go to the destination to assess them, we do check if they monitored the number of visitors, but we pay more attention to the quality of the number. Therefore, we assess if the visitor numbers was under their carrying capacity, how the profits were distributed, how much satisfied with the ecotourism situation the resident was, etc. So one of the most impressive stories is a resident around the table discussion which all residents gather and discuss different issues including the direction of ecotourism development. Across all age groups from the elders to the children attend the discussion and raise their voices. It makes the resident listen to different voices and also they have to take responsibility on their decision because they decide which way they will go and the which resources they will use for ecotourism development. The resident group also leads the environmental monitoring activities with local experts support before focusing on what product they will sell to tourists that they focus on learning about their nature and their culture and also focus on a more sustainable lifestyle. If they are not sustainable, how do they ask the tourists to be sustainable? So these are some of the vineyards at the destination cell in the visitor center and these are essay and poem books. These are local grandmothers and the grandfathers wrote and painted as one of community ecotourism development activities. And to curious what content the books have, we should not ignore economic sustainability of course if there are no steady profits you know it may be more difficult to protect the natural environment from the typical development pressure. Gradually the ecotourism destinations in Korea are establishing more community-based social enterprises. So far the local associations have led many different activities such as serving meals and the ecotour activities based on the reservation because most people are farmers you know so they have no time to have 24 hours open restaurants or shops so it's basically they got the reservation. Many of these nations now have reached a certain level of capacity and decided to establish community-based but more systematic ecotourism enterprises so they can secure more economic sustainability. Social enterprises or other businesses run by local ecotourism associations have a transparent reporting system and then they also have they have to re-invest a certain agreed percentage of the profits in both environmental conservation and the community welfare enhancement. These are included in our assessment criteria. Of course they are not perfect. They are always complete big and small amongst stakeholders and then there are risks of ecotourism and then they also confront you know with difficulties of securing businesses socially and economically sustainable and then there are big rooms to improve for mitigating climate change more aggressively but sustainable tourism is about a journey. Ecotourism destinations in Korea have started their journey towards sustainable ecotourism and then they are contemplating and solving problems together through open discussion. I'm very proud of these destinations as they are overcoming the COVID-19 pandemic crisis by focusing more on capacity building and then pursuing of being more sustainable. They really want to you know get some tangible achievement as just sustainable communities sustainable community members. I wish you have a chance to visit our ecotourism destinations and then enjoy listening to more touchable their stories in addition to the beautiful nature and culture. Thank you very much.


to my channel so I decided to kinda give you a little bit of a favorites video but do it more so vlog style, more relaxed and on top of it kinda give like a home tour. I'm planning once the family room is done which you guys are gonna see today and once the girls room is done probably like the end of summer to do a real home tour. Probably, it will probably be very long. But anyways, so but I decided to just do a walkthrough in the house, show you guys some of my favorites. These are things that you guys have either asked about or wanted links to whether it was on Instagram or here on YouTube. I mean like I'm not gonna go through and say the link is below, the link is below, the link is below because everything will be listed below and you guys can go down there and scroll through everything. I'll probably try to list it in the order that it was mentioned in the video. And some of this stuff maybe won't have a link to. I'm gonna just point it out and show it to you guys and if I can't find the link I'll just make a little note below that I couldn't find the link for it. So I think I'll just go ahead and get started. The girls are not here right now, they're actually with my mom today so this was perfect timing plus yesterday. I really went through the house and cleaned up a lot. So I figured you know what, well it's kind of half decent looking. I might as well go through the house and see if I can show you guys a few of the things that I've gotten recently or things that have been favorites for a long time. Okay so I'm starting out here in our room and if you guys have been watching for a while you know this room has been a work in progress but I wanna point out these curtains really quickly. They are in both our room and the girls room. They're a blackout curtain and I've shown them to you guys before. The reason I like to show them is because the first set of white blackout curtains that I got I was not that happy with. They were almost shiny but these are like a linen texture and so they look like real curtains from the inside. The other thing I love about them is they are white on the other sides. A lot of blackout curtains are actually black on the other side. These plants here are from TJ Maxx and so is that basket. Okay so next thing on the list which was an Amazon find is our headboard and there you can see it. And the reason that I'm showing it to you guys is because I like scoured the internet to find a metal framed headboard for a king size bed that did not cost a fortune and this one didn't. It was a really really great price and then these lights are also from Amazon. Love them if you have a room that doesn't have a overhead light. They are absolutely excellent. In the pictures they do feature them with a Edison light but we just have regular like daylight light bulbs because I try to use mostly daylight just brightens up the room. And I do get questions about these nightstands all the time and you guys I found them along the road and they were like a pea color and gold with gold detailing and I repainted them a couple times but yes absolutely love them. They'll probably be something I'll hang on to for a long time. This stand up mirror if I can find it it was from Walmart and it was insanely cheap. So if I can find the link for it I will definitely put that below as well and that's right inside the door and then this sign is actually what's gonna be hung above our bed but it is really really heavy. I found it at Ross and so Corey was looking at it the other night and he was like oh my word that's gonna fall on our heads if it's not up there right. So we have to have the right stuff to mount it up above the bed. Going to the hallway here and this is the girls room and this is kind of what I was talking about. Their bedding is in the laundry so it's just kind of random blankets over there right now but it's just a very blank slate and I'm gonna be telling you guys soon what I'm thinking about doing in here but it's just blank right now. So this is the play room and I absolutely love this room. I've mentioned on Instagram before this is like my favorite room in the house right now. Starting over here I'll throw the link for this. I've talked about this TP a lot lately so I'm not gonna go into detail but I will throw the link for this below. I have a discount code as well. This pillow I love. It's a recent find from Target and a lot of people comment about this piece. It's actually one of the girls' bed springs or crib springs from their crib and I just spray painted it and hung it up there and they put their art on it. All right so a few things here. One of them is this tea set which is that and the little canisters up here. They say tea, sugar, coffee, one's missing a lid and then this little piece and it comes with a few other pieces. They're actually all from Hearth and Hand from Target. I'll leave the link below. The girls absolutely love this set and they really play with it all the time. This kitchen is a Amazon find as well and a lot of people ask about this. I love it. The ice maker even works on it and the girls think that it's a real kitchen. I mean, why wouldn't they? It looks so cute and petite. I'm gonna quickly pop open their toy closet here because there was something in here that I've been getting questions about recently and whenever I show the girls playing with it and this was actually another YouTuber that showed this on their Instagram page and I was like, oh my word, that's the coolest toy ever. So it's an Amazon find as well and it has little bits that go onto the screw gun. This thing lights up and they can screw these in to design them. If you guys remember, what were they called? I think they were called light brights or something like that where you could put the pegs in. I know as a kid, we loved playing with those. Well, this is a similar idea but takes a lot more motor skills and it has a little adjuster on the back where you can actually reverse it and pull the screws back out. They just look like this and they're an excellent toy for both boys and girls. I have three girls and they love playing with it. Also, while I'm in here, another little mommy tip. Oh my goodness, this has saved us so much headache. So the girls, even with crayons, kind of started going wild, oh my word, like about six months ago, and coloring on stuff and I really just got tired of telling them not to and cleaning it up. So we get the mess-free stuff from Crayola. They have coloring books. I know Amazon has so many different ones. We've gotten ones off of Amazon and another little tip to do with this is they have the plain ones and I just ripped them out and Google coloring pages and literally you can print through your printer on those papers and do anything you want to so that they can color with these markers. They also make a paint too which I actually need to get them some more but I absolutely love it because everything is clear. Like if they paint on something, it's actually clear. It only works on this paper. Okay, don't mind my messy desk situation over there. The last thing I'm gonna mention is this rug. I love it. It was an Amazon find as well. In fact, this rug is so popular right now and everybody under the sun is buying this rug I think but I love it because it hides stains and like being in a playroom, it's super easy to clean. It's a really low pile and I would definitely purchase it again. In fact, I thought about buying the same rug for the girls room but I think I'm gonna go with something a little different, something similar but a little bit different just to have some variation but again, I would highly, highly recommend this especially for high traffic areas. All right, so going down the hallway here this is our bathroom which I'm actually going to be finishing up. I'm gonna do the shiplap in here as well. It has some paint touch ups that need to happen. So this is our bathroom upstairs and then going down the steps, our house is kind of in three levels so this is kind of like what I would consider our living room and then we have a family room as well and I actually just ordered a rug for in here and I'm not sure if I'm gonna like it in here or not, the size might be a little bit off. This room is kind of awkward as far as what size rug to get because it's a very large room but you have this walkway going on right here. So yeah, I'm excited to see what it looks like. In fact, I will link this rug below that I ordered because it's on insane sale and it's super cute. So if you guys wanna see what it looks like you can go and check out the link below. All right, so over here, I thought I would quickly show you this because I get questions about it and I did do a partnership with them quite a while back but they're from Amazon. So it's this company called Rosa Vinci and they make letterboards but this is the star of the show and that is a, here hang on, I'm gonna set it down here. It's a letter organizer for letterboards and I've been getting questions for the link for this so that's why I'm going ahead and showing you guys but it's so handy because I can literally spell out words so fast and then they have little shapes and stuff. They have a lot of really cool extra emojis and things that come with their letterboards so I really love that and I would highly recommend it and I also feel like this makes an excellent gift and it comes, the one I'll link below comes with that letterboard and this and like a tote bag, it's kind of a kit. All right, while I'm up here in our entryway I thought I would just show you these shoes, excuse my dirty closet here but I got a set for each of the girls and they're from Target and I tell you what, these have been the best shoes. They've been left out in the rain. They've been washed up. They have them in a lot of different sizes for little girls here and then every laser down there but yes, I just thought I would suggest these because they seem to be really durable and they work as a great dressy shoe or one that could be even just worn up as every day and they've held up really well for the last couple of weeks and the girls have been outside in them. They've really loved them and another thing is I actually ended up getting them a little bit too big for them and these adjust as well so you can tighten everything down even if they're a little big. I figured, hey, they will work until it gets too cold to wear them and they kind of remind me of like a Birkenstock. Back into the living room here. Okay, I get a lot of questions about these signs too and they're actually from Walmart and last week I was in Walmart going through the decor aisle and I saw them restocking them so check your Walmart out. I will look for a link. I think I've looked for a link before and couldn't find one but I'll see if I can find one for you. They were super cheap. I think there were like $9 or something like that so yeah, check out your Walmart, see if they have them and then these were also an Amazon find and I wanted to let you guys know that we've actually had these a couple of months with no wear at all to them. They're extremely sturdy and they come in packs of two for different size. I think you can get different sizes in them. Coming around this way, if you guys watch often you already know this but this is like our dining room and then that goes into the kitchen and then down there goes the family room. So this is actually my grandfather built this clock and it wasn't working at all and actually I feel very lucky to have it because my mom is from a family, a very, very, very large family and I was the one that ended up with it. So I actually refurbished it, repainted it, took the guts out of it and put the shelving in. Yeah, just love the way it looks and it's a very treasured piece that's something I will always have and people comment about this being screwed in, it is.  So yeah, so this is in the dining room. That little piece right there is from Ikea. That is also a Walmart fine but it was a seasonal thing. Something that people ask about a lot too and I'm like, I can't give you a link so it's always be humble and kind and it was like a fall piece from last year. Okay, so coming from the dining room into the kitchen, this is my coffee bar area, I absolutely love it. A lot of this stuff was like TJ Maxx fines and stuff like that so I do love milk glass and I get a lot of it at yard sales and thrift stores so keep your eyes open for them there. You might be able to find them for like a dollar and I think they look so great with green in them. All right, so here in the kitchen, this is another thing that a lot of people ask for the link for, it is off of Amazon and you guys, it is an incredible price. It's a very, very good price. I wanna say it's like $23 on Prime so of course we get it for free shipping, I'm not sure, but I'll leave the link below of the exact measurements of the one that I have. Another thing I get asked about is this little stand right here. It's actually metal and it is from Hobby Lobby so check out your Hobby Lobby. The last time I was there, I saw them. They generally have them like kind of in that middle section where there's a lot of glass pieces and stuff so yeah, they have different sizes too. Okay, so you can kind of get it just, there's the steps, there's the living room and then down here is the family room and if you guys have been watching for the last little while, you know this has been a project so we ripped a wall, it was like a temporary wall down here and put this flooring in and the carpet actually we had put in too because there was old carpet when we moved in here. We do rent this house but it's rented from family and I'm a true believer in taking care of wherever you're living. It doesn't matter who owns it, you should still have respect for the place and take good care of it. So anyways, so down here I'm planning to put this big sign is from Hobby Lobby and I don't think I can find a link for it. It was in their spring shop and a lot of times whenever it's seasonal stuff, you can't find a link for it so I'm gonna stick that above the couch here and then I would like to put another couch in over here but I like to find my couches used if possible on the gray one upstairs I just found on Facebook Marketplace and it was like brand new and paid very little for it. So I'm kind of waiting, I'm checking every day, looking for a piece of furniture for there and then I don't know if I'll put a chair here as well. This is like paneling so it had to be patched because the people that lived here before us, I think one of their kids fell into it and it has a dent in it so it had to be patched so I'd like to do something to hide that so I don't know if I'm gonna do a chair there, we're gonna do a TV up here. I'm kind of waiting to see how full this area feels with another couch over there to see what I wanna do over here but I'm thinking the TV and then maybe like two black framed pictures on either side I'm not sure yet. So I will look, these are actually originally from Amazon but I think the last time I tried to look their link was gone or they were out of stock so I'll check that out for you guys and then these blinds I really hunted and hunted for these, they are from Walmart and again I'll leave the link below, that is the cheapest place I could find them because they are usually not cheap and I didn't even realize when I ordered them that they are the weighted ones so you don't even have the string, you just pull from the top or from the bottom, you lift from the bottom and they go right up. So then down here there's another bathroom which that's a little bit of a project right now and there's me and then this is like our laundry room and eventually this floor, yeah it's old and probably we'll need some work done to it eventually so it's also our back door, that's the garage door and so then this is just our place to do laundry and all the things and another thing I'm gonna link since it's asked about literally all the time, that is my sweeper and it's a Shark Cordless vacuum cleaner, love it. I've had it since Black Friday and my mom actually bought one too, we both love them. I have done house cleaning in the past and for years and years and they are the best cordless vacuum cleaner I have ever used, they have incredible suction and they do really go on hardwood floors and I get that question a lot right now is why do you use your broom if you have that and you love it? The answer to that is because I have little people that put food on the floor and I would just rather not have it in my vacuum cleaner so usually if you see me sweeping either the play room or my kitchen or dining room with a broom it's probably because there was snacks or something on the floor and I would rather just use my broom and then I'll also link my spin mop, love that it is the best investment besides my sweeper, I mean I have the stuff that I really really love, I love everything when it comes to my floor care. Okay I'm gonna set you guys up here on my cabinet and actually show you a few things out of my kitchen that I've been loving and that are kind of mommy-faith. I mentioned these in a vlog the other day but I thought I would go ahead and show you guys again so they are from a brand called Boone and they're these like silicone lids, the girls honestly love them and I am totally sold on my bottle of faithful water bottles, we have a bunch of these, I think the girls each have two or three and we use them for water all the time but I don't like putting milk or juicing them so I was getting the taken toss cups which look like this and they have like a plastic lid that's like this but they kept leaking and I was just getting tired of them leaking so I decided to give these a shot and I absolutely love them so one of the ways I use them is on a like mason jelly jar just like this and in fact my youngest she is almost, she'll be two in August but she's one has slept with this in her crib and we've had zero leaks and then this is how they look on the taken toss cup as well so you can pretty much stick them on anything I think they'd be a great thing to keep in your diaper bag and put across a cup like at the restaurant or something like that okay so this is another Amazon find and I've been loving these and them with goodness can't talk and one of the reasons I'm sharing them with you is because I feel like I've seen them so overpriced so many other places so this is really one of the best deals that I've seen and that is the straws I just have one in here the stainless steel straws and I love them they come with a cleaner you get them in one size or the other so I got a pack of the shorter ones and a pack of the longer ones anyways you guys I have a lot more things I could probably go on and on and on about but I don't want this video to be like insanely long but I did wanna let you guys know that a lot of times on Fridays on my Instagram account I will share a handful of my favorites from the week they're all Amazon usually because of the fact that I work from Amazon so much so if you guys wanna head on over to my Instagram account and follow me there you'll get a lot more tips on great deals and things like that thanks a lot for hanging out with me and if you guys would like to see me do something similar to this every month just showing you things that I've found in the past months that were a great deal and stuff like that let me know in the comments also if I forgot something let me know in the comments this is gonna be kind of my video to refer back to if you guys are asking for links for things that I get asked about a lot so yeah just ask your questions below and if you're new to my channel I would love it if you subscribe I'm a mom of a one, two and three year old I also love God with all of my heart and I just love making like mommy and home content I post videos Monday, Tuesday, Thursday, Friday and I think that's everything I have for you today thanks a lot for watching and I'll see you in my next video you


Whew, good morning Hank, it's Wednesday. Today I want to tell you the strange but revealing story of how I suddenly became a hit with old people. By the way, I'm breathless because I've just come from a workout in my Pizza John football jersey, keepin' dry with my Pizza John hand towel, and of course keepin' hydrated with my Pizza John Nalgene. All of this magic is available only at Pizzamas.com and only for the next 12 days. Okay, so this is a story of recommendation algorithms, Amazon books, and the future of publishing. So last May, my book The Anthropocene Review came out in hardcover, but not in paperback. Traditionally, hardcovers are published about a year before the paperback comes out. The hardcover is a little more sturdy and has some bells and whistles, like they have these nice bands on the spine. They may be imprinted with secret pictures of Tuatara, etc. And the idea is that hardcore fans will pay extra to read the book before the paperback comes out and also to have a beautiful object, and because it's more expensive, everybody, publishers, bookstores, authors, makes more money. Like, for context, with my novels, I make about twice as much per hardcover sale as I do per paperback one. But all of this, like so much of traditional publishing, is of course wildly antiquated, right? Maybe it made sense in 2005 when my first novel came out, but it certainly does not make sense today when people expect, with good reason, I think, to be able to read however they want, whether that's via e-book or audiobook or hardcover or paperback. But because of these antiquated publishing strategies, there is no paperback of The Anthropocene Reviewed. Unless you count the large print edition, which looks like this and is designed for people who want or need to read larger type. So some percentage of people who buy The Anthropocene Reviewed from Amazon just click paperback and accidentally buy the large print edition. And then also, because this is my first book for adults, I am lucky enough to have many older readers or other people who benefit from large print editions, and that's another percentage of the sales. But neither of those is the primary reason why I recently became one of America's leading large print edition authors. The reason, or at least the biggest reason, is that a while back the hardcover of The Anthropocene Reviewed went out of stock at Amazon because a bunch of people ordered it all at once for Sharon McMahon's book club. Like Amazon sold thousands of hardcovers in a single day, and then they didn't have any more, but they did have the large print edition, so the algorithm began marketing that as the primary edition of the book because it was the only print version they had for sale. And so people bought a lot of the large print edition. In fact, they ended up buying more of the large print edition than they had of the hardcover before it went out of stock. And somehow in that process, Amazon's algorithm convinced itself, people prefer the large print edition of this book of essays. That's the one they want, and so that's the one I'm gonna show them. And so for the last four months, whenever people search for The Anthropocene Reviewed on Amazon, they are disproportionately likely to be shown the large print edition. And that is the story of how The Large Print Edition of my book, The Anthropocene Reviewed, became a USA Today bestseller. But the story doesn't end there. Because the Amazon algorithm believes the large print edition is the canonical edition of The Anthropocene Reviewed, and because it therefore sells very well, Amazon also thinks that other people who mostly buy large print editions will love The Anthropocene Reviewed. And this results in more large print edition sales. The people who read those books tend to be elderly, and over the last couple months, I have seen a huge surge in fan mail from older people. Which has been so lovely. They're not reading the book because of my TikToks or the Fault in Our Stars. They've never heard of me, but they still like the book. Or at least if they don't like the book, they don't write me. The point is, a tiny algorithmic quirk has created a self-reinforcing cycle, a phenomenon needless to say also seen elsewhere on the internet. What's the lesson here? Well, first, publishers need to get with the times and publish both special editions for people who want them, and inexpensive paperbacks for people who want those. Also, two algorithms are human-directed and humans are algorithm-directed in ways we do not fully understand. Oh, and also three, get all your Pizzamas stuff before it's too late, pizzamas.com. Hank, I'll see you tomorrow.