Can you hear me? Yes?  What a great, great turnout. I'm so happy you're all here. Good afternoon, everyone, and welcome to Alden Library. I'm Janet Holm, and I'm excited to usher in Alden's first ever summer series of Authors at Alden. This summer, we are focusing on authors that have a connection to the region, either by research focus, locality, or both. Right now, I'm going to introduce to you our guest for today. I think Sharon probably doesn't need any introduction from what I've seen so far, but I'll go ahead and do this. Sharon Hatfield is the author of Never Seen the Moon, The Trials of Edith Maxwell, University of Illinois Press 2005, and co-editor of an American-Vane Critical Readings in Appalachian Literature, Ohio University Press 2005. Hatfield is a native of Ewing, Virginia, where she grew up reading Nancy Drew Mysteries. She holds a master's degree in journalism from Ohio University and an MFA in creative nonfiction from Goucher College in Maryland. Hatfield received a Creative Writing Fellowship from the Ohio Arts Council that allowed her to research Never Seen the Moon, which subsequently won the Weatherford and Chaffin Awards for nonfiction. She has taught creative writing workshops in Kentucky and Tennessee and currently works as a freelance book editor. Hatfield and her husband, Jack Wright, have made their home in Athens County since the 1980s. Both serve on an advisory committee for the Janko Foundation Fund of the Foundation for Appalachian, Ohio, and Nelsonville. Hatfield has a long-time interest in local history and is a member of the Athens County Historical Society. She is currently immersed in the fascinating world of 19th century spiritualist, Jonathan Coons, which she has begun studying, or which he has been studying for the past six years. Our interviewer today is alumna, Kelly Riesbeck. She received her bachelor's degree in journalism from Ohio University Script School of Journalism in 1991, yay again. Since returning to Athens in 2000, she has worked as a freelance science writer, a PR liaison for the Kennedy Museum of Art and writer, public information officer for the College of Fine Arts. She's also the executive director of the Southeast Ohio History Center, formerly known as the Athens County Historical Society and Museum. She has been a host for WOUB Public Media's radio show, Conversations from Studio B for 10 Years, where she covers research and creative activity at Ohio. She has been the assistant director of Ohio's Advancement Communication and Marketing since 2011 and recently was named the managing editor of Ohio Women in an imprint of Ohio University's alumni magazine, Ohio Today. And managing editor of Ohio Today's website, OhioToday.org. So without further ado, I will turn this over to Kelly. Thank you, Janet. Hi, Sharon. Hi. It's been a while since we've talked for a little bit longer than a couple minutes, but I'm really glad to be here today. I was fortunate enough to have read this book. You gave this to me a long time ago, and you even wrote in it, and I wanted to bring it so that I can show everybody that this famous author actually did write a little inscription for me. So I'm very thrilled to have read this. I just finished it a couple of weekends ago, and I was really sad to put it down. It's a page-turner. Well, thanks. Yeah, we're gonna talk about that a little bit. Thanks, everybody, for coming today. It's super hot out, so it's really great that it's all nice and cool in here. Hi, everyone, and friends. We're gonna take this conversation through a journey of who Sharon is as a person, also as she has developed as a writer, and also how she has been writing for different publications, and also for her two books that she's written, Never Seein' the Moon, The Trials of Edith Maxwell, and also her current project with the working title, The Enchanted Ground. So without further ado, let's get started with our questions. So I wanted to talk a little bit about your career as a writer. You've been a writer for, I don't know, what would you say? How many years would you say? If you said, okay, that was really the beginning of me being a writer. Well, as a little kid, I was always into writing stories and little poems, or getting up and reciting little nursery rhymes or things like that. But I think my first paid piece of writing was like for a children's magazine. If you wrote in a little item, they would send you $10. So that was my first paid gig, yeah. That was enough to be a good beginning, man, because it kept you going. Yeah, and then by the time I was in high school, I was a serious student of poetry. I thought I was going to be a poet. Oh, really? Okay. But I kind of went through that phase and then I got to college and I was trying to decide what I wanted to be when I grew up. And I was very curious about science. I thought about being a scientist at some point, a biological scientist. So I did get an undergraduate degree in biology just in case, as well as in English. But of course I chose writing and I never had the idea that I was going to live in a garret and white tables and sacrifice for my art. I had very middle-class expectations that I was going to get paid to write. And so I told people, as I was getting ready to graduate college, well, I might just be a reporter. And they said, well, you couldn't be a reporter. You're too bashful. You couldn't do that. And they weren't trying to be mean about it. They were just being sincere. And I actually took one journalism class in college that we did not have a journalism program, but I took the class and the teacher told me that I would be a good society editor. In fact, he offered me a job as a society editor. And I said, no. And he said, well, you know, I understand you're talking about being a reporter, but I just don't believe that you could go up on a mountaintop and cover a plane crash. I just don't think you could do that. And I agreed with, I said, well, you're right. I probably couldn't. Very interesting.  Yes. Okay. But anyway, I did get into journalism because he wants to live with mom and dad the rest of your life. So I did get into that. So my first paid job was in Norton, Virginia, working for a paper there, The Coalfield Progress. And that paper was covering the Edith Maxwell case as well during the time, right? Back in the day, they did cover it, yes, in 1935. As did many others, and we'll get into that later. But so we learned a little bit about what tugged to you make you want to be a writer.  Some of those publications you worked for, The Coalfield Progress, what are some other papers that you worked for? And then also you've done some freelance editing and work like that, right? Yes, I work a little bit here at The Messenger when I was in graduate school. But a lot of jobs I've had have been more in publishing, scientific publishing, and also some marketing. Okay, good. So you've really had a breadth and depth away from nonfiction, doing sort of the more practical stuff onto all the way to nonfiction. And let's talk a little bit about your teaching career. You've had a little bit of background in teaching, and you've taught a couple of places, and talk about that. Well, I taught writing at Hawking College for 13 years, and taught everything from essay writing to tech writing. Okay, okay. And I'm sure it helped a lot of students along the way there, and you also mentioned your freelance career. Now, let's talk a little bit about your nonfiction writing career. There have been a couple of books. We'll just mention that in American vein, Critical Readings in Appalachian Literature is one of the books that you worked on. But the first big nonfiction book was the Never Seen the Moon Trials of Edith Maxwell. So let's start talking about that a little bit. I'm gonna kinda run this around a little bit. So one thing that struck me when I read this book and about some of the things that you are writing about now was you like to write about the local. It says something that William Carlos Williams coined, and it's something that's this sort of not going far beyond what you know to write about it. Can you talk a little bit about what draws you to write about the local as just as a writer? Well, I love details. I just think the odd factor detail is what still makes different parts of the country different. Like back in the 30s when this story took place, different regions of the country really were different. You didn't have a Walmart on every corner. People had different ways of speaking and looking at life. And so I still try to find those little facts wherever I can find them. And I have a friend, Garni Norman, who's the Poet Laureate of Kentucky, a few years back. And he always talks about the national media being the big eye. It's looking down from afar. And that if you're kind of a local historian or local person, you're the little eye and you're seeing the details. You're down on the ground level. So that's sort of a guiding principle. And would you say that the resource is a local writer and a local reporter who's known in the region the resources they have and the people they know offer quite the advantage over that national reporter? And I think if you really outlined that really well, I think in the book about how the national press was seeing the mountain people in one way and the local people were not very pleased with that characterization. And I think both perspectives are valuable. Because I asked the question there in the preface, who can best tell the story of any area or any region? And certainly the local people can, but also the outsiders. And I think a blend of that is really important in getting at the truth. Of course, in this case, there was a lot of stereotyping of Appalachian people. And when I began doing the research, I used to get really angry. I'd be down in the basement. A library, you're looking at microfilm. And I would just get really upset with some of the things that were said. Well, let's give an example so people can understand. So you can illustrate some of the things that were said about this culture that were just completely misguided. Well, they would talk about how that women couldn't serve on juries in Wise County, Virginia. Because women were not regarded or well thought of there. When, in fact, in about half of the states of the United States in the 30s, women were barred from serving on juries by law. Until it became a federal law that it had to be the same everywhere. Later on, I believe, right? Well, it was state by state. State by state, OK. So not only does the book go into issues of feminism, but the book really does go into four larger issues. So the story on the surface is about this woman who had multiple trials to try her for the murder of her father. But what the story is really about to me was these four larger issues. And you mentioned this in your preference. Feminism, domestic violence, prejudice against people who are different, and the news being delivered as entertainment as opposed to factual record. So I wanted to talk a little bit about each quickly. I learned that the National Women's Party wanted to use the Maxwell case to launch a bid to do what you just said, to give women a federally sanctioned right to serve on juries. And the woman who came down from Maine, the lawyer who came down from Maine, what was her name? Gail Laughlin. Gail Laughlin insisted that everyone should be truly tried by a jury of their peers. So when an all-male jury was seated for Edith's trials over and over again, she really insisted that that wasn't a jury of her peers. And that was one of the things that she wanted to really use the case to forward her agenda. Exactly. And so, I mean, when you found out that that was happening, that's a national-scale type of problem, small on the local level. And that was one of the things that made me realize that this story was more than just a typical murder trial because that was a big issue throughout the country that I'd never heard of the National Woman's Party. I didn't know that Alice Paul was a national hero. In fact, I kind of wish I had written a biography of her as well. Once you got into learning about who she was. But the real irony of the story is that Edith Maxwell was not politicized. She was just a pawn in the game because she really didn't want to be a feminist crusader. She wanted to get married and have kids. And she was afraid that her association with feminism would cause people not to want to marry her. And that is a reflection of the times across the country that was not specific to an Appalachian culture. And I think that's what the news media was trying to paint it as, is something that only in this part of the country could you find somebody who was seeing the world so small according to them. So I thought that was interesting. And again, I didn't know about the National Woman's Party and what their stake in the game was. So that was really interesting. Domestic violence wasn't really talked about a whole lot until this case. And it really started coming out. Maybe you can just give people a really brief explanation about what she would have alleged to have done. OK, Edith Maxwell was a 21-year-old school teacher. She was on her summer break in July of 1935. And she came home late one night. She'd been out to a bar. And even though it was, well, prohibition had just ended. But she wasn't really, because she was a school teacher, she wasn't supposed to be out drinking or out even at a bar. She and her father, 52-year-old Trig Maxwell, had an altercation. He was waiting for her when she got back home. He ended up having head injuries. He was found outside with his body in the kitchen and his head on the porch. And he died of head injuries that evening. And both Edith and her mother were arrested and charged with murder. And the initial thought was the murder weapon was her. Was her shoe. Her heel shoe, yes. And so that's a story that, of course, any paper would love to cover. And they did love to cover it. Yes, they did. Somehow in Washington, DC, the Hearst newspapers found out about this. And there's a lot of speculation. What did somebody there in the county call them in? And so who was it? Right, right. Well, like you said before, all of these little details just lead to other little surprises along the way when you were doing the research of this book. And I just think that would have been a joy in addition to making you angry. I'm sure it brought you a lot of joy when you were doing that type of research that every writer has to do when they write a nonfiction, especially covering a story with this breadth and depth that it had over the whole nation at that time. So it was a little bit about domestic violence. And that was something that people across America, but not even specifically in the region, people didn't really talk about some of the battles that were played inside the privacy of your home. Yes, intrigue was alleged to be an abuser. Her father was alleged to be a very heavy drinker and that he would be a very mild-mannered person when he was sober, that he'd become this other person when he was drinking. And that's supposedly, according to her, she was attacked by him that night in a drunken rage. And there definitely was a sense that you just didn't talk about these kinds of things out in public and the fact that it was brought out there. Maybe it did make people more aware that these things were going on even way back when in the mid-30s. So that's one thing that I thought was interesting. We touched a little bit about the different people. Reference in your book is the use of the novel, Trail of the Lonesome Pine, that the media used to sort of wash over this whole story. Let's tell our audience a little bit about the Trail of the Lonesome Pine if they don't already know. Trail of the Lonesome Pine was a novel written by John Fox Jr. It is also set in Wise County, Virginia. It was published around 1908 and then three motion pictures have been made of the Trail of the Lonesome Pine. You may have actually seen the color version. There were two black and white movies made of it in the 20s and then the 36th version was in Technicolor. It's one of the first color movies. And the premise of this is that local girl meets an engineer from the city. She falls in love and he has to send her away to become cultured. It's to send her away to get city-fied so she will be good enough for him. And then she has feuding relatives and so forth. Right. So that whole story premise was sort of placed upon this entire story of Edith Maxwell and because of the popularity of that novel, really people ate it up in all of the newspapers and there was lots of wars to get people to buy their newspaper and their version of the story during which this whole time story was more entertainment than news based on your book and what you found out was as much more yellow journalism type of thing. So one of the things that I did note was this journalist author Medford. He had a high regard for Edith because he said that she was cultured. She went to college, she got out allegedly and went and had a college degree but that the rest of them he wrote that mountain people were slatternly women and gangly men who rise each day to take up the doll business of living. So it's the type of picture was being printed and conveyed to their audience. That's a great quote you chose. It really shows you the positive stereotyping that was going on with Edith and she could do no wrong and she was above everybody else in the community according to the tabloids. Right. And so that juxtaposition of this negative and positive stereotyping really led to a lot of pretrial publicity that was very unfavorable to her on the local level. Correct, right. So it didn't really help her at all. Do you think that perceptions have changed all that much since the Maxwell trial? It's a loaded question, I'll admit it, but I thought I had to ask it. Well, I think the media is better, certainly better than they were in the 30s. We don't call women, girls in the paper or we don't call developmentally challenged people morons. I mean, we have improved in our language at least, but there are still some pockets. I was reading about the Pactin murders and I believe it was the Daily Beast and... That's gonna be an interesting story. It was really, really kind of getting into that, to me, that yellow journalism area of... Stereotyping. Describing the people there. It'll be interesting to see how the media covered that for sure. As it unfolds. So how does the way Appalachians are perceived in society today affect or inform your writing? Do you keep in mind the way that the perception is of Appalachian people when you write or do you just write? Does it influence your writing and your choices? I don't think so, not a whole lot. I mean, this one book, that's the book I wrote about representation and I'm ready to move on. Okay, okay. So the way Jonathan Keynes was represented, he also lived in Appalachia, but it was totally different. So it's not been a huge factor in this new project. Okay, good. So we talked a little bit about the news as entertainment and we talked slightly about how the coverage helped or hurt Maxwell's case and ultimately influenced so-called blind justice, but as you just described, elevating her as a cultured person because she went to college did not help her in terms of the perception of her locally, but it did help her from some newspapers' perspectives elevate her as somebody who was better than the rest of the people she was living among. So that was part of the whole story in your book and you just play it out so nicely. I really encourage everybody to read this. It is literally a page turner and I really enjoy reading it. I also, when I read it, I could hear your voice and your song of your voice in my head and that made it even more pleasurable, so. It was a great read. Thank you. So let's talk a little bit about writing craft. We were gonna talk about this earlier, but I feel like we can, now that we've established this incredible amount of research and I think you, this was published in 2005 and as Janet mentioned, it did win the W.D. Weatherford Award for Nonfiction and Appalachian Studies in 2005 and then the next year it won the Thomas and Louie D. Chaffin Celebration of Appalachia Writing Award and so that's a huge back-to-back awards for something that was so informative to the culture. So, 10 years? How long did you work? Try 12. 12, okay. 12. 12 years in writing and researching. I'm trying to speed that now. Yeah, okay. Well, don't go too fast because this was really good. I don't want to miss anything. So, all right, let's talk a little bit about the writing process and the writing craft and you touched on this a little bit. You asked in your preface what lessons did her story have to teach them and us and so it's been 11 years since this was published in 2005. What was your answer after you finished the book to that question about what lesson did her story have to teach us and what did it teach you as a writer? Well, I think it taught me that both the perspectives were valuable, that nobody has a corner on a story. It's a fact of history. You can't copy right there, it's everybody's story and both perspectives were very valuable even though one was rather distorted at times. What's the value, would you say, you had to say what the value of that distorted view was, was it to just illustrate how wrong directional it was, that it wasn't going in the wrong direction? Well, I guess I think more of the women's party and they were able to say, well, why should it be that women can't serve on juries? Why should it be that women can't go out at night like men can and nobody thinks anything about it? So, they were willing to kind of upset conventional thinking. Okay, yeah. And what was your answer, since you wrote the book, has your answer changed in terms of what lessons did her story teach you? So, it's been 11 years since you wrote the book. You've had a lot of people that you've talked to that read the book, probably a lot of people that are from the region that maybe knew the family or knew them. Has your perception changed about what it taught you now that you're 11 years out and you've said, okay, then they're done that, what have I learned as a writer now that this has been done for about 11 years? I don't think I've really found out a lot of new information that really changed the conclusions. I did, I was contacted later on by a granddaughter of Earl Maxwell, and she was able to- Earl Maxwell was her brother and her chief supporter in all of her trials. I did not know where this woman's whereabouts when I was writing the book. She was able to provide more detail on it, but nothing that really changed the conclusions. Okay, okay. So maybe one of the lessons you learned is that the story will continue, but you're ready to kind of move on.  You also write in the preface that, how can I and Appalachian women tell you the story in a way that would honor the culture we both shared without papering over some unpleasant truths? This is a tough question and it's probably gonna be a little unfair, but do you have a definition of what an Appalachian woman is today or is the very question sort of absurd? Well, there's many different ways to define it. Like when we were doing the book about Appalachian literature, me and my co-ed, it's, well, how do we know what to include? What is an Appalachian writer? Yeah. So I would say it's people who write about the region or their stories are set in the region or they're from the area. Do you have sort of a definition of writing craft that you stick with when you start writing? Do you sit down and say, this is my method, this is the way I do things, this is the way that works best for me, this is where I shine, this is where I could use some work? Well, the first, the 80th Maxwell book, I did all the research and then I wrote it. I had these stacks of paper everywhere and I was like, what do I do now? So I don't do that anymore. And so why, can you tell me why you chosen to take it the different way? Is it just because it was just too untenable and it just was too much to really organize all at once? Yeah, I think it's thought more efficient if you write up what you find as you go along. Okay. At least in sentence form, it may not be in chapter form or even paragraph, but I think it's better to write it up as you go along and it helps you reflect on what you just found out. Okay, okay. And can you, we just talked about this a little bit. What do you feel like your greatest strength is as a writer? You, Sharon, what do you think you bring to the page better than most people can? Well, usually I leave it up to other people to say, but going back to the details, it's kind of a blessing and a curse because a lot of times I get sidetracked into other stories and I think, is this going to be a spin-off or is it going to be part of the book? For example, when I was doing Never Seen the Moon and learned that a Hollywood movie had been made out of it, that completely blew my mind and I ended up getting to go to California and do research on the movie and I ended up writing some articles about epilogue and women's portrayal in films. So it can turn into a whole other thing of its own sometimes. So I would say that your strength is just that insatiable curiosity? Yeah, I like that. Okay. I like that. Can we also say that it sometimes ends up being your greatest weakness? Because it definitely gets you sort of off track and I suffer from the same inflection, by the way. So I have the same problems too. I get very curious about things too much. Well, it does affect the pacing of your story. If you're, you know, the reader will tolerate a certain amount of backstory, but some people will just put the book down and say, you know, it's taking too long to get to the action. Get to the action. Would you say that a really good editor helps with that tremendously? Mm-hmm. Okay. Yep. And did you have the editor, do you wanna talk a little bit about the editor for this book? It was published through the University of Illinois, right? Mm-hmm. Okay. I had a really great editor named Judy McCullough but also prior to that, I had gone through the Goucher MFA program and I actually had four writing mentors during the course of the two-year program and all of them had a hand in editing, especially Diana Hume George, who has been here on campus as a visiting professor. She really helped me with it a lot. So all that happened prior to working with Illinois. Oh, okay, okay. So that was the final step. So your greatest strength and your greatest weaknesses are sort of that insatiable curiosity. But again, I just think it really informed the reporting on this book and it was just a joy to read. It really was. I highly recommend it. So let's go on to having, let's talk a little bit about the new project, which I know that you've been working on for how long have you been, from beginning to today, would you say how long have you been working on this book? When I started in the summer of 2010. In 2010, okay. And some of the locations that you've been to, to research this book, tell us where those have been. Well, the story is about Jonathan Coons, who moved here in 1835 from Bedford, Pennsylvania. And that's one place that my husband and I have been to do research there at their historical society. And I'm hoping to possibly go out to Illinois, which is where he lived after he moved away from here in 1858. Okay. And I think locally you've been to the Southeast Ohio History Center as well. Yes, I've had a lot of help there from John. I don't know how I would have navigated all the documents there without his help, but it's been great. No question. And I believe the Coons family, well, let's back up a little bit. It's about spiritualism. The whole book is, well, it's about him, but the overarching theme is spiritualism. Can you tell our audience what that is and when it started and the impact it had as far as you've been able to tell so far on American culture? Spiritualism started in 1848 in New York State. There were two young girls there, the Fox sisters who thought that they could communicate with a peddler's spirit, as peddler had allegedly been murdered in the basement of their rented home and they thought that they could, through rapping noises, yes and no, that they could communicate. And this spawned a very popular movement in the late 1840s, early 50s that continued on through the 19th century and even around World War I. It's quite popular. And spiritualists believe that the soul or consciousness does survive death and that through the seance, one can access those spirits. Okay. The access of spirits, which is really strange that that noise just happened. Just gonna make that notion right there. Spirits meaning people that are not all the way parted because they have something else to do. There's a reason why they're here. The reason why people who were able to contact the spirits were hired essentially to bring those people back at least temporarily to make peace with the living. Is that about what it was? To offer them comfort and advice and to assure them of the immortality of the soul. That they need not grieve so much because it was really just like stepping into another room. Interesting, okay. And it was also a reform movement. There were many reform movements in the 1840s. Women's rights were coming into the fore. There was clothing reform.  And so they were looking at clothing reform. They were looking at, of course, temperance was another thing and abolition was huge.  So all those were reform movements and a lot of spiritualists, you'll find that they're interwoven with these other things. And they were very much trying to reform Christianity. That's what my next question was, reforming what Christianity? So what unpacked that a little bit? What does that mean, reform Christianity? Well, Calvinism was still very prevalent in that day and time. And Calvinists believed in the total depravity of human beings, that they were born, that's their literal creed, that they were born in sin and that only the elect, only those chosen of God would go to heaven.  And so spiritualists didn't really believe in hell. They believed that you could progress through many layers of self-improvement even after you had passed. So this was very comforting to a lot of people. Mm-hmm, okay. And this was in tandem with all these other kinds of reform movements happening throughout the U.S. Okay. So your research process continues or are you done with the research now when it comes to getting all the information that you feel like you need to write the book? We've talked about this privately about how you could just research forever based on our affliction that we share. But would you say that you have enough now to really begin the writing process as it remains a work in progress? I'm nearing the end of the research, but I'm always so interested in hearing about anybody who have any information about it. Maybe somebody here today. Possibly, hopefully, yeah. Okay. So we're talking at least, what, 2010, so six years that you've been researching this. You've gone to Pennsylvania. You've been here. I mean, you hope to go out to Illinois, you said? I forgot to mention Lillydale, New York and Casadaga, Florida. We have been there as well. And those are two main spiritualist communities in the United States today. Oh, okay, so this movement continues today, the spiritualism movement. So some people still practice it a little bit? But it's not really as widespread as it was back then. Right, okay. But it has a lot of spinoffs, of course, New Age, what we called it in the 70s or 80s. There's spinoffs from it, but not too many people are actually spiritualists anymore. Can you characterize the folks that you met in both of those locations? You said New York and in Florida. You know, did they, I mean, when you met with them, did you interview any of them? Did you talk to some of their organizers? Well, I went to see a medium in Lillydale, New York because I wanted to understand the experience. Because I realized that these people who went to the mediums, whether or not it was fake or real, many of them did have a religious experience. And if you think about shamans, a lot of what they did or still do could involve some manner of deception, but yet people find meaning in the experience. So that was one of the reasons I went. Okay. And that experience for you was just as you expected or something different? I'm sure you had a notion of what you thought might happen. Well, I was pretty skeptical about, I know there are some people that really are talented and can tell you things that they might not have any way of knowing, but I was pretty skeptical and I had my expectations were kind of low. But you create the narrative with the person. Okay, so that's how it kind of work.  Right. Okay. And the one in Florida was similar to that experience? Down there I went to a service. I didn't. Tell me what that is. I went to a spiritualist temple there in Casadaga. Okay. And it was a wonderful service. Tell me what happened. Well, it was a lot like, I don't know, not a lot. One of the things they did, which was really interesting is they had you do a meditation in church and you would sit and the minister would guide you through a meditation from head to toe and it was all about love and being love and it was really nice. Sounds lovely. And the only part that was really different, well there were a couple parts. If you were there and you wanted healing, you would go to the back and they had these chairs set up in the back of the auditorium and the different healers would come and work with them. And then the only really, really unusual thing about the service itself, the sermon, is they would pick out people in the audience and say, I see your spirit. The spirit is here over your left shoulder and this is so and so and that was really different. Very different indeed. What was the reaction of the people in the service? They attended before, so this was expected or did they have some newcomers in there that were really blown away and just really had a big reaction to the service? I really am not sure whether they were newcomers or were it regulars, but they did feel they could connect with the story in some way. They seemed to. Okay, so that's all part of your research, in addition to, tell us what kind of research you've done at the library, at the Lebring Library at Southeast Ohio History Center and did you do any here and uncover anything here at Alden Library? I've done research here at Alden. Yes, I have found some local history items here in the archives. Also, one of the things we've done at Historical Society is I'm a big believer in looking at deeds. Why is that? Because deeds can tell you a lot about an area and what's going on. When I first started to do Never Seen the Moon, I had read a book called Feud by Altona Waller, which you can guess what feud it was about, right? And she went through and looked at deeds and I decided to do that for this book and then for the one now, John has helped me look through all years worth of deeds for the Coon's family and for his in-laws, the bishops. Now I haven't really, I don't know if I have the time, but I wanted to say a mention about his wife, John's and his wife, Abigail. Okay. One of the real challenges of this book is there's such a small female presence in it because it really was a man's world and women were very seldom mentioned in these papers. They didn't write in to these papers, so it's much harder to get a woman's presence in a story like this. Jonathan Coon's had a rather unusual wife. She was the minister's daughter, but as he said, she was a free thinker, which was a term back then. Okay, and how would you characterize that term today? Let's talk about that in modern terms. What does free thinker mean? What do you think he meant by free thinker? Well, somebody that's progressive, somebody that's willing to entertain different ideas, especially about religion was a big thing. But anyway, she was an herbalist. Abigail was an herbalist. They lived out on Mount Nibbo. And she was also supposedly a medical clairvoyant. Tell me what that is. Well, it's someone who goes into a trance state and diagnoses someone's illness. To us, that kind of sounds like quackery, perhaps. But back then, there was a very little differentiation between the trained doctors and the untrained. And physicians were not regulated up till Civil War. And they had really different ideas about who could help you possibly. And even the trained physicians used a lot of mercury compounds in their healing, as well as the bloodletting. So it was one as clear cut as it would be today. Okay, interesting. I've never heard that term before. So I'm guessing you write some about that. You will be writing some about that in the book. So we can look forward to that, for sure. Well, let's do a little bit of, let me see.   I feel like we've already had like 12 since we started talking about it. But do you have a fun fact, another fun fact about the whole movement or about the, about Mount Nebo, about the Koonzes that you wanna share with us? Well, it's interesting. The number of people in the 19th century who were spiritualists, Harriet Beecher Stowe was. Garrison, the abolitionist editor, he was one.  There's a great book out now about that called The Witch of Lime Street. And that's from the post-world one era. So there were a lot of famous people connected with it. Interesting. I guess here on the local level, I've just been amazed to see the German influence that we had here in the county. We hear so much about the New England influence, and rightly so, they've recreated, you know, the Harvard on the Hawking here. But there are tremendous amounts of German, numbers of German people who migrated here from Pennsylvania. And like whole neighborhoods would just get up and move here. Interesting. And in fact, in Ohio, we had the Bedford County Association people. There were so many people that had moved over here. They had their own little social club. Bedford County, Pennsylvania. Yes. Okay. Which is where John Coose is from. Okay.  Here. Okay. Interesting. Can I go back really briefly to why you feel like deeds are so informative to your work, especially for both of these books? Well, one thing I found out about the Dotsons and the Maxwells and the Edith Maxwell story, there was a rumor in the tabloids that there was a feud between the two families, which is a big motif in the Appalachian way at the feud. And so by looking at the deeds, I was able to see that these two families, the Maxwells and the Dotsons, they went in together and bought property for Edith's father and mother so they could get married and have a farm, which is about the farthest you could get from them being feudists. So... Interesting. Okay. So it did sort of really inform what was really going on, despite what maybe the tabloids were saying or maybe even what the local people were trying to say that was not correct. What about the deed research that you've done for the Coons family? How instructive was that? Well, it does show their migration into the area and the years that they showed up. Also most interesting has been the story of the Bishop family and their efforts to start a high school in a Homer township. And they attempt, her father, Abigail's father, attempted to start a seminary there, but his project never got off the ground and he ended up in court and lawsuits over it, but it's all there in the deed record. Interesting, okay. And I know you'll probably review some of that as well in the book. Let's do a little bit of a reading from the book that we talked about. This is from the working title of this is, what is the time do we have here? I've got 10 till or nine till. Here we go, right on time. The enchanted ground is the working title of your book. Okay, well, this is a scene that takes place at Donathan's home place, which is on Mount Nebo. They didn't call it Mount Nebo then, but it's such a beautiful name. I've been using it. This was in the millfield area up on top, above Chansey. And he has already become a spiritualist and he's starting to open up his house and have seances for the public. And I think the only names in here, the sons are named Nim, it's Nahum, but they called it Nim and Samuel and his wife is named Abigail. On a November day in 1852, Jonathan Coons was digging for treasure. He was spading up the ground under a hickory tree in the woods near his house, just as the spirits had told him to. The adventure had begun the day before when his sons Nim and Samuel, age 15 and 12, were herding some cattle home from a grazing lot about a mile away. While passing by a scattering of stones that circled the hickory, the boys felt something plucking at their arms, grabbing their wrists, trying to pull them off the path and toward the rocks. Spook, they returned home and wasted no time in telling Abigail what had happened. Mrs. Coons guessed that spirits were trying to communicate, so she, Jonathan and likely Nim repaired to the spirit room, that's this little tabernacle beside of their house, to find out the meaning behind the boy's scare. The shade of an Indian chief revealed that he and another entity had accosted Nim and Samuel to call attention to what was actually a burial place. There the chief said, Jonathan would find the ashes of his body together with his weapons. Giving his name as Joana Gianna Muscoe, the invisible explained that his tribe had been at war with another tribe that was allied with the whites. So I'll skip over this one section where Muscoe talks about the battle that took place between two Native American tribes. Despite the ferocity of Muscoe's attacking force, he himself was fatally struck by narrow. To honor his dying request, Muscoe's warriors burned his body on a pile of wood and buried his ashes and personal effects under the hickory tree, placing the stones around it. As proof of his authenticity and as an example to unbelievers, the spirit asked Coons to take two neutral observers to the spot and dig up the relics. The message made sense to Jonathan and may have come as no surprise. He had whittled a rude homestead out of the forests of Mount Nebo on the highest elevations in the county in an area that repeatedly had been a sacred spot to the Shawnee Indians. Maps made much later would depict the Mount Nebo trail threading along the ridgetop, possibly a reference to a time-worn path trod by the Native Americans. By the time Abigail and Jonathan took up farming there, the Indians had long been driven out. Yet here in this western land, their spirits still lurked among the glades in which they had sported. Just a few miles from Mount Nebo, found out the broad expanse of Wolf's Plains where monuments to a much earlier Indian presence remained. Here along the Hawking River, the ancient people had constructed the three square mile complex of circular structures. Settlers had noticed not only conical burial mounds, but an unusual earthen enclosure that reminded them of an old fort. Later scholars, however, would interpret this open-air structure as a ceremonial theater where shamans, often under the influence of hallucinogenic drugs, saw entry to the spirit world. Here, perhaps two millennia before Jonathan Abigail, Native Americans had donned wolf skins and lit fires, performing their sacred rites under the light of the moon. In his role as ambassador and guide, the shaman would contact spirits from the other side, sometimes those of animals and sometimes those of the dead. The magnetic pull of the buried man's instructions led Jonathan to the woods where the boys had been affrighted. Little Samuel was not with them, but Jonathan had convinced two neighbors to join him and them on the quest. They had only walked about three quarters of a mile in a southerly direction when they encountered a hickory of some considerable magnitude and had begun digging, quote, near a broken strata of sand rock that projected from the bluff point of an adjacent hill, end quote. With Ames Township residents, Emmanuel Evans and George Kearns looking on, Jonathan scraped aside the husks of last summer's leaves and removed one foot then two feet of dirt. The black forest loan began to yield to red clay and still not a trace of anything unusual had turned up. The neighbors might have wondered if they had been called away from their chores to run a fool's errand. Finally at the three foot level, Jonathan hit something. Just as foretold by the Indian, he pulled from the grave a stone battle axe, arrows and a stone breastplate. These artifacts, Jonathan believed, would make a fine display at his home, yet another proof of the wonders as if any more proof were required. Very nice, thank you. Thank you. I think we're gonna do a couple minutes of Q and A if people wanna stick around for that. Any questions anybody has for Sharon? Raise your hand and we'll bring you the microphone. You said the boys were a-frighted. Can you just say about the use of that word and how you, is that a word that's in your everyday vocabulary? Well I was in a writing workshop up in Chautauqua, New York a couple years ago and I read a little piece, not this one but a different one. And one of the participants in my class said, oh, I notice you're using these 19th century words. And I'm like, oh really? Okay, so now I've made a conscious effort to do that because I think it's wonderful words. The process of just writing that piece there, how much research would you say goes into just, just writing something, I just wanna give people a sense of how much it takes, information it takes to, to get to just one, you know, one or two pages here. It's a big effort. Well, yeah, the book that most of this account came out of, Jack and I went to Columbus to the State Library a few years ago and got a very old, old book that Jonathan Coons and a doctor from Columbus, Dr. Everett, had put together a book of these sayings and messages in 1853. So, you know, he figured a day going to Columbus and eating at the short north and then other parts of it came from letters that I found and so it's just hard to say, really. Right, okay, okay. Anybody else have any other questions? I think we have one over here. Sharon, when you were reading your piece, it was really clear that you write in a very conversational way.  That's one of the things I think I loved about reading the book was that I just felt like you were talking to me. At the same time, you were packing in so much information about the way the direction the thing was shaped. Do these sentences kind of flow out or how do you mix the conversation and pack in? You know, what sort of process is going on there? Well, I think it's always a challenge to try to write in things as much as you can and I tend to just write everything out as an exposition the first time or maybe the first three or four times and then go back and try to put in things. Could you tell us a little bit about how the local community rejected or embraced the Coons family? Well, he got a lot of attention here in the county and you know, he got different reactions. Some people were really curious and they went there and participated in séances but the local churches mainly, he thought it was mainly the Methodists. Sorry if there's any Methodists. But they did not like this because they were conflating the idea of spiritualism with devil worship which are completely two different things that spiritualists don't really believe in the devil. I mean, they're not into that at all and so they're talking about communicating with their loved ones and so forth. So there was a quite a negative reaction here in the community and that led them to someone to burning down Jonathan Coons' barn in December of 1852. They burnt his barn and burned up all of his crops and for that year and his tools. So somebody was sending a message. And it is true. Oh, go ahead. What about the death of the daughter church's refusal to participate? Well, Jonathan had a 12 year old daughter who died of what they call an enlarged heart. I tried to look into, is that rheumatic fever or exactly what would cause that? I don't know. But she died in September of 1851 before he became a spiritualist and we were speculating that might've actually driven him in that direction but he wanted some of the ministers here in town to come out there which was quite a ways, six miles on horseback or buggy or whatever it was an effort. He himself was an infidel. He did not belong to a church. And so he tried to, he sent an inlaw of his relative to try to get ministers to come out here from Athens and preach the daughter's funeral and they refused to do so. But I don't think they did it because he had these weird beliefs. I think they just didn't know who he was and there just wasn't enough of a connection there is my opinion. For them to make that journey? Yes, they weren't part of, he wasn't part of their flock. And he took this to mean that they were very sectarian and very narrow minded. And he did not think that he had been well served by the ministers. And one last thing, it is true that people from all over the Eastern United States would come to visit the Coon's family. Seon's room, is that what it was called? Spirit room, yeah. Because they were very well known as people that can reach past into the afterlife and do that comfort and healing piece for their customers, I guess. Well, it's interesting you say customer because they did not accept donations. Okay. I mean they did accept donations, excuse me. But they didn't charge admission to their Seon's. But they also, we should mention the Tippi family. They also had a spirit room. Here in Athens County? It was about two and a half miles from Jonathan. They had been his disciples, they had learned from him how to set up a circle. And they had a spirit room at their house too which was just over the line in Ames Township. Interesting, okay. And they got the same type of people coming from the east to get their needs taken care of. So it was kind of like spiritual tourism. Yeah, right. And they, people would come and board at one place and then they'd go and board at the other place and it kinda, they worked together on it, I think, rather than being rivals. Well, it definitely was an interesting movement. One more question? Yeah, is there anything left of it? Well, supposedly there is a, maybe a foundation of where the cabin was but there is no buildings left. Do you have a question, Jim? Well, this may be a little far afield but when you were talking about spirit rooms, I realized that Carl Jung, he had his own spirit room. He built this tower on the lake in Switzerland and he was born in 1875. And his family, his mother's family, they were all into spiritualism and into seances and this interest went with Jung throughout his life and was, sometimes he referred to it as spookery when he was talking to Freud maybe. But I just wondered, I just wondered if, I think the spiritualism movement is kind of maybe trivialized in a way and that maybe, I would wonder how you would comment on its further development in the psychology of Jung. If you see that that was an important side of evolution from native shamans on through modern psychology, I guess. Well, that's a pretty heavy duty question, Harriet. I've really been influenced by Carl eating a lot in my own thinking about life and the collective unconscious and so forth. So I don't think that the ideas of the spiritualists were in any way in conflict with a lot of his ideas about archetypes and so forth. I wouldn't like to address what you said about trivializing the thing and that's kind of a challenge in writing a book like this. You might have noticed that when I read the part about the spirits communicating with Jonathan, I didn't put allegedly or purportedly or supposedly because that would really just deaden the whole thing but you kind of have to get into their world and just say that think, I'm not necessarily saying this happened that way but it's how they perceive it. And people kind of, they don't know whether to laugh or not laugh and it's just, if you need to laugh, it's okay but I do want to try to avoid trivializing what to some people was a very serious religious matter and to other people was just purely entertainment. I'm hoping Sharon will stick around for a little while for more questions and I just want to thank both Kelly and Sharon for being here today and for all of you for joining us today. Also, just so you know, on July 16th, Robert Geipp will be here and you can find more information about him and his book on the back table and some freebies and there's an opportunity to sign up for announcements. So thank you all.


Morning. My name is Rick Wesson and I'm here to talk about abuse and the global infection rate and I know that I was hungover and didn't get up until noon yesterday So I expect it to be pretty light. We'll take questions at the end and We're probably gonna give away a few beers to just help everybody out if you're hungover the best way to do it It's just start again what I'm gonna talk about today is We're gonna go over the problem a definition of what abuse is a definition of what bots are Is that better can I get a little volume? Good everybody hear me in the back. Is there anyone in the back? We're gonna go over the anatomy of a botnet. What does it do? What's it look like? I'm gonna give you one. We're gonna have a little contest to see who can either take it down or own it We're gonna look at how botnets affect corporations and then we're gonna take it back up to 30,000 feet and look at What the internet looks like at a global scope and in economic terms how this affects us and Then we're gonna hopefully conclude with how we fight this problem But it's been a long fight and we haven't been successful So the problem is it's really difficult to understand when your network is Compromised or when some of the hosts on your network are compromised and they're affecting other networks It usually involves other networks because if your network is abusing your own network You know about it. You see the traffic. I don't know about it But when your network is abusing other networks that I hear about I see it and I can record it And I can tell you about it and I can tell other people about it The numbers are really starting to get out of hand We're talking about millions of nodes in a week new nodes every week getting compromised and The numbers are starting to get so significant that people are saying one out of five hosts that are live on the internet at any given point are Compromised that's a huge number And so essentially, how do we unfuck this because it's fucking up the internet. It's messing in my network and yours And so the first thing that we're gonna we're gonna look at is What what is the scope of abuse? What is The things that we think are bad or affecting other networks in a malicious way So obviously sending spam Ucee hosting open proxies. We're having open proxies pop up all the time Which are used sometimes for click fraud sometimes for sending spam Certainly used for distributed dial denial of service or abusing IRC in other ways Hosting botnet command and control servers moving those command and control servers around rapidly BGP right route hijacking when you hijack a route that has some corporate identity and Abuse that or leverage it to to send or deliver some information Under their identity Hosting splogs are manipulating links link rank and hosting insecure web servers so what is Incentivizing people to create these networks and abuse other people's networks. There's an economic incentive here and Essentially as if we look at the revenue that you can derive from a botnet or how much it costs to deploy one then we can We can understand if These two overlap the revenue that you can derive from sending spam Which is high right now and the cost to deploy a botnet which is low and these are inversely proportional to each other It creates an incentive where these two lines in These slide overlap on the left and that's the incentive to continue to create new Networks to abuse other people's networks to deliver malicious activity Because the cost to deploy it is so low and the revenue that you can derive from it There's always going to be incentive as long as these two lines overlap Our job is to make these lines move apart and hopefully in a few years We'll be able to move the revenue that you can derive from sending spam or click fraud lower and The cost to deploy a botnet higher Make it harder for them to be deployed make them live less long So once we can move these two lines further apart actually we can separate and make sure that there's no Overlap that there is a gap between them. That's our incentive and today What I'm going to try and put is a number on this incentive on both sides of the map So that you can understand in economic terms what these are to the US population to businesses individuals So let's let's actually dig into a botnet You're gonna get one in a few minutes. It's been live for I think somewhere around 90 days We've I've actually requested people to kill it. I've sent information to the registrar that hosts it And I'd really love to see if somebody could take it out by the time I get off stage or own it And if you can I'll give you a beer a good beer, which is hard to find in this town I had to bring it from San Francisco so Let's take a look at this botnet. We're gonna look at its controller capabilities We're gonna look at the the proxies that it offers. It has a nice little web controller front-end There's commands that you can make it do different things FTP stuff we're gonna look at the the drop file that it creates this happens to be a key logging botnet and Who what and where got compromised this should be really interesting both for the corporations and people that are interested in porn and See if somebody can own it or kill it by the time I get off stage So this is the controller and for the people in the front of the room You can see the domain name here and for the people in the back It's yops y o p s dot biz slash UK is the controller and the drop file So everything that I'm telling you here you can go and vet until somebody takes it out This is the view that you see when you log in. There's no password protection. You can You can If you have wireless you can go to it right now So on the left it has the IP addresses the ports for the socks proxy this ID String in the center, which I'll show you what it's for in a minute And then if you look there's also the country in the city and state and if it's connected and the city and state So they they've got some nice geo IP going on here Here's some more you can see that they're from Canada Belgium United States, which is in her in Virginia Princeton and what this is valuable for is for understanding if you need to send a click and that click needs to go from Princeton Or you need to go do a transaction From some of the information we've captured out of the drops file You can make that appear as though it's from that geographic area by using these various Identity keys that are in the the middle of your screen It has a lot of other capabilities that you can exploit you can upload files You can FTP something from another file. You can HTTP get something From any particular machine in this network and have it execute that file or you can have all of them do it at once You can upload host file So if you'd rather everyone's clicks to any you know pick your your company or domain You can have all of those hosts then send it to the IP address by By manipulating the host file on each one of the machines, so probably not new not news for a lot of people here Do they send spam certainly using the the machine identifier two URLs one for the message body one for that where you're gonna spam Fill out the form send it off Everything goes and does the bidding for you Pretty nice web front-end for a botnet Like I said, it's a key logging botnet and It it logs data This is one little picture one one of the data drops there We go through in detail what each section is first the remote address So if you look this happens to be one of AOL's outbound proxies Fortunately they copyrighted this stuff so it's a smash by SARS The IP address so the the 10 net internal address of the host they all happen to be a internet explorer The next two lines are the gentleman's Password and user ID for his pop mail account the next couple of lines this key logging botnet liked anything that had HTTPS in it or HTTP that had a User ID and password in it so if it had a password field it was gonna get captured it was gonna get put in this little drop thing and After it had accumulated enough of them it would send it up to the command and control server where you can download this file And you can see the third Thing that this guy went to the third URL was McAfee so if you go to the first one you'll get about a hundred pop-up and And It was pretty obvious to even to him that he'd gotten owned and needed to go do something about it Of course the guy is littered through the file. Nothing ever helped him So if we drill down actually into the drop file, we reviewed 30 days of data Like I said, it's it's been around for 1690 days So at the time that we reviewed it. It was about 80 megabytes. I think it's like 211 last time I looked and In that 30 days we had 793 uniquely infected systems With 17,000 data captures from those so it was it was sending up multiple data captures per host and In those data captures were multiple form logs. We got 35,000 Form logs from this is a small bottom. This is like 200 hosts online At any time 100% of them were Microsoft Windows It would capture passwords for pop I map tell that HTTPS posts form data And then it would do regexes through the file system and if it found anything it would add that to the data drop and Send it up to the command and controls server So we're gonna compromised out of all this stuff We're able to collect 54,000 logging credentials That's a lot of those 281 unique credit card numbers and that was just what we could easily identify We got Over 2,000 email addresses of your friends and family So this would go down through the file system look for email addresses look through your address book pull them out Send them up and then we can collect and send spam from those even from your house 299 identities which is names addresses and phone numbers and if I had written some better Analyzers like actually gone through a lot more of the HTTP URL encoded data I could have extracted a lot more There were posts in there for Credit card applications for college loans for home mortgages anything that we consider e-commerce today This botnet is an example of what's being collected and if you have a company that hosts Some service that's available over HTTPS some portion of your clients that have logins into that system are being compromised No matter whether this stuff is SSL encrypted or not it is being captured. It's being captured before it even hits the liar So what companies got affected? We looked at all the URLs that were able to identify that had passwords that we could use we had user IDs and passwords Essentially logins and the companies are all over the map You probably know every one of these except for the pay tax dot Nat dot gov dot TW or us that army mill I didn't even go touch that one But we've got everything Walmart speed pay eBay Verizon Passport Craigslist MSN Capital one everything that you can think of so there were 1200 businesses approximately 35 brokerages 86 bank accounts 174 e-commerce accounts. This was just for the 30 days that we looked at it Haven't gone to see if the decent numbers have doubled 863 porn accounts if you like porn just go pick up the drop file There's plenty of it there. You'll never need another porn account 245 email addresses that were unique that were in different posts. So if we want to value this stuff One thing that we found was to look at how much could we sell these accounts for or how much are they being bought for? And so if you have a brokerage account The this is just one line items out of the whole file a brokerage account, which we identified 35 Figured that we were able to find $40 Someone would buy them from us for $40 apiece if they had less than $3,000 if they had more than $70,000 So we needed to go log in figure out how much money they had Build a little set for sale and we could have made averaging almost $2,500 So there's value even in a small botnet one of the other things that we do is we capture identities And this is outside of the the botnet, but support intelligence the company that I work for Is able to intercept a certain amount of identities that are being bought and sold? And so there's an economy between people that are capturing identities and selling them and We've verified a number of these identities by well first notifying VC USA and the FBI FTC some reporters We were kind of getting a little slow with all those people. We didn't feel like they were really reacting So we we tried to notify the victims we were seeing them in the botnets We were seeing them when we intercepted them And we realized that at the end of each one of these is an individual And so we thought we'd call some of them and see how they felt about all these things And so when we when we first started calling them we gave them their name and Birthday and their mother's maiden name their social security number credit card number and they They wouldn't tell us anything But I made a few mistakes and I want to share one of them with you I made a couple of phone calls and There wasn't nobody picked up and so I thought I'd leave a message the message went like this Last name Milford social security number 267 18 64 94 69 plus your palace Lane Sacramento, California mother maiden name Lewis visa four five eight three two four six eight nine one eight five Four one six two Expires 1107 security code 102 this identity has been compromised and I Left work is at the end of the day Next day I come in I've got like 47 missed phone calls and so I Waited around. I knew the guy would call back. He called 47 times the last two hours Phone rings pick it up. Okay. I says I want to talk to your manager. Okay. Hold on a second Hello, I Want to talk to your owner. I own the business. He's like, what are you doing leave a message on my phone? Who are you? And I I said we're we're working with the security and he didn't give me that next thing.  I wanted to tell him which agents we were working with but the guy was so livid And he happened to be a police officer. He was ready to come over to San Francisco and arrest me Even though he was in Milwaukee or something like that So the victims are highly pissed when we can tell them all about them We had another one where we were we identified Identity we saw it come across the wire called the Person up actually ended up with the mother on the phone And she said she had just registered bought something for her son off of a website and that was it was her son's name It wasn't her name that we had seen and that was 10 minutes from sale To on the wire soul. So let's look at how botnets affect corporations We've we've looked at that they exist that they're logging data. You have one that you can go play with You can evaluate everything that I've said you can use it or you can take it down if you can But let's look at how they operate and how they affect companies Being a San Francisco corporation. We went through a bunch of companies names That were in our database. They were also in the 9-5 or 9-4 area codes And this was a list of some of the companies that that we identified that we have some information on We're gonna drill down in three or four of these real quick and see what they've got but you all should recognize some of these companies, they're not small and Some of them get unhappy when they get their names on the screen So if you see yours ask politely, I'll take it off. There's plenty other companies to put on here First one's HP A lot of people want to know is Silicon Valley compromised a lot of computers out there a lot of big companies that run e-commerce HP isn't a commerce company That I would classify as but we looked at a hundred and forty unique IP addresses that were under HP's network space Many of them were outbound mail servers We run a pretty large spam trap and we identified a fair amount of their marketing mail in our spam trap but we also found a fair amount of information of hosts that were claiming to be Starwood hotels or Geo cities Or carpet blessed on info we said those aren't HP's hosts, but they're coming from HP's network That can't be good. Why are they sending us this mail? Why is it landing in our spam trap? Charles Schwab another financial organization but this is a company that you can point to and say these people are doing a good job they have a bit of marketing mail that We've been able to identify but We haven't been able to identify any bots Pretty good. It's important to point out when people are doing a good job Lucasfilm this was interesting because they've been flat-lined for a really long time And then one day one day they sent out a whole bunch of stuff Maybe somebody brought in a compromised laptop put it on the the vendor area network or One of these networks where you segment your guests Which we've seen It was all phishing and and and spam vertisements and it was fixed within 24 hours and they've been flat-lined never since So that's good. We can detect when these things are happening and we can tell when they are So this was the fun one Chevron, Texaco They're consistently in our traps But what's in our traps? It's not marketing information It's spam vertized adult material and this is an indication. This is a symptom of the disease It's chronic and persistent. It's been there for a long time and we can show that it happens at regular intervals And we're also going to go down and look at who derived information or who derived some value from this What's the value chain of the spam or adult material that was disseminated using Chevron, Texaco's IP address reputation and Before we do that. I just I have to show you what they were delivering Something natural and safe. Certainly. I'm sure many of you have seen this before maybe not This is what the corporate network was being leveraged by a third party to deliver to other mailboxes Size does matter here So Chevron's penis enlargement problem Which was botnet spam delivered through their corporate MX Spamvertized the link that traversed three web servers with 302 moved the domains were hosted across three registrars with three different identities There were obviously faults With the hosting services running from the USA Germany Russia China and the final web server that was advertising that wonderful little piece about enlargement was in China and I don't expect Chevron to have the capabilities to go and figure all that stuff out But I do expect that they have the capability to keep it from emanating from their network So let's go back up and look at the global scope and some trends and statistics About the larger internet We've seen that the botnets exist their key logging that we can identify some of those by the Abuse how they send it out or abuse other networks And now we're going to look at what the whole world looks like and this is 100 million 101 million events that we received over six months It's turned out to be roughly 48 million unique IPv4 addresses It's been 12,000 of The 22,000 routed ASN's so for those of you that have network clue the next part It's really about the global internet one of the big numbers that we want to Flag that I want to put in the ground or a stake is 267,000 that I know about knew a day So we looked at the ASN's and and we said what number of ASN's do we have? that That have a malicious activity that we can identify and this is a very granular The amount of address space routed by ASN's is vastly different, but it's a it's a it's a Very broad brush that I'm painting with here 55% of the ASN's that we looked at I could identify something on 48% appeared clean Now My my business partner Steads he asked me says well how much of the how much of the routed address space is that? Because just looking at the ASN's is a really broad way of reviewing this So if we look at how much address space is actually routed by these various ASN's that we have Information about compromise systems on 95% of it We can finger That's significant So then we said how can we break these things up geographically and look at them by countries and it was actually pretty hard There were there were some AS's that we couldn't look at They're they're AS's that are satellite, you know, there's no geography attached to them But from what we could do it was pretty easy and people know that China is a huge problem Here they're a quarter of it of the entire planet's worth The EU which is a whole bunch of countries which we have some separated out later the USA is number three With almost three million hosts that we're able to identify and Then it goes down from there Korea Germany France Brazil Spain Japan The ones that we couldn't classify that are mostly satellite Taiwan Poland India Italy the UK They're classified in the EU. Sorry So let's look at China in that backbone everybody knows about this one This is the number of new IPs daily. I'm still wondering what the big spike is and this was for Six months So then we tried to look at the most compromised prefects is by number of events that we were able to identify and Again China in that backbone, but then they tail off pretty rapidly and this is the first I don't know 20 top 20 something like that With most of them being in the 221 slash 8 So let's bring this back to costs We've been able to see that that these things exist a certain number of them are key loggers That they're pervasive They're all over the world. They're in every country and I want to bring it back home a little bit the FTC has some statistics out there on identity theft and What I'm trying to assert here is that botnets are using key logging to perform identity theft and I need to put an economic value on that and And what that value is I'm using these numbers from the FTC from 2003 and Specifically we're looking at the misuse of existing accounts So when a botnet captures an existing account, certainly they might capture an identity That would be the new accounts and other frauds column if that identity was used to create a new account For the purposes going forward. We're just looking at the cost to businesses Of people that have accounts that exist That are being compromised Which I've shown you in the botnet drop zone in the botnet drop files You'll see here that average per victim cost to the business is $2,100 2003 average We're going to use that number Well, let me back up one more the global I'm the the the whole scope for this is $47 billion For all ID theft For businesses That number is about this next line the profit margin if We look at the profits That one can take from identity theft and let's say they have an 80% margin That would make the identity theft industry the largest most profitable business in the United States Walmart, Microsoft, Conoco, Chevron, GE, Bank of America and Exxon I'll make less than the industry of identity theft in the United States using 2003 numbers Want to do a little bit of math here? We're going to look at the number of keyloggers the average number of credit cards that a keylogger gets That puts us in the existing accounts column it gives us an average keylogger impacting Impact of $700 per month We're looking at monthly statistics which are all generated from our 30-day view of our evaluation of the botnet drop file So if we look at the bot population Times the number of keyloggers Times the percent of captured identities with existing accounts Times the cost per incident which we got from the FTC We look at new infections and I'm just going to pick on eight companies here in the United States because we're talking about numbers from the FTC Verizon AOL Comcast SBC This is new infections per month from our Infection data, and we're looking at 120,000 new infections from Verizon a month Let's look at the economic impact on the businesses that those infected computers are Having on American business This is losses per month estimated from new infections of botnets For just that one column on the FTC report. We're looking at 90 million dollars Per month from Verizon Does that number bother anyone? SBC AT&T in bell south of really one company you could aggregate those and it would be another 50 Million dollars per month the smallest one on here you you net comes in at ten million dollars as impact US businesses per month because of the compromised systems on Their network. I'm not saying that these companies are losing this money I'm saying it's these companies customers are losing this much money from business If we look at annual estimated losses It's almost two billion dollars annually using 2003 estimates and current infection rates This is worrisome if if you could convince these eight companies To somehow help Their customers clean up their systems. It would save American businesses two billion dollars or four percent of The 2003 estimated identity theft problem So let's go back to the economic theory of abuse. Our idea is that we need to make botnets botnets Harder to deploy so that they cost more money. So it's more difficult and That the revenue derived from them Is less But right now what I'm saying is that incentive is around two billion dollars a year For botnet operators to deploy more stuff That's what our fight is What do we do about it? We we're working on detection Hopefully we can tell you who is compromised. We got to do something about remediation or it's never gonna end and Then we finally we have to protect them and until we do they're compromised and they're People are losing their identities their credit cards.  They don't know how to fix their computer They don't know what this stuff means and all of the things that are really important to them That they thought were private Are now owned by somebody else and you can't get another social security number and that's what pisses me off And I want somebody to help It doesn't look like many people are concerned The economic incentives are in favor of the criminals and it's in the tune of billions of dollars That's not new news, but eight companies could change the world for a lot of Americans Hopefully that is news That the levers are ISPs credit card companies and credit bureaus And that spam is just a symptom of the disease That if we have some and it appears that we do some tools to use To prevent or at least to understand who's compromised that we can then focus on Notification and then on remediation If we don't fix these computers It's gonna take our internet away. It's gonna take the trust of the people away and We might still have jobs, but we might not have a network. That's really gonna be leveraged for the people It's gonna be leveraged for the criminals I got to thank a number of people that helped me aggregate information Help our company Without them, we wouldn't be able to bring you these kinds of things Without them, we wouldn't be able to operate Spam house your IBL SURBL the other RBL mirrors that provide us data we leverage To help you understand Which ones are on? Paul Vixie the woodcock for their donations and access to BGP feeds which helps us understand where on the network you are and Everyone else is David Ulivec had opened DNS who gave us a whole bunch of hardware so we could churn numbers Randy by us at Neo tactics for giving us a bunch of hardware so that we could capture spam Aaron Hoover who put together a little demo that I'll give during the Q&A For doing geo IP mapping tool real real-time botnet visualization There's some tools one of them. I make Adam waters. There's also my partner who you can ask. I don't know where he is, but he's around is Is somebody that helped me put this together one of our tools will help you if you're a network operator Understand which hosts are compromised on your network Microsoft makes a tool at post to master dot MSN comm Slash SNDS for understanding if your network has sent them spam. It'll let you Inspect that look at evidence Also, yahoo is building something, but they didn't have a URL for me. So Questions we'll take them at the microphone Estimate the 260 just second let them you can repeat the question two hundred sixty seven thousand per day how you estimate that Pat was asking how we estimated the two hundred and sixty thousand infections per day. We merely took the number of unique Infections that we had seen over the time that we had seen it. It's just an average Can you quantify the source of the Protection efforts on the question is can I quantify the number of home users that might be infected versus corporate users? And that's a very good question I don't have numbers that I could I could certainly do that and and put it someplace But I didn't do it for this presentation and I haven't and one of the reasons that that's difficult to do on a block level is Because of ISPs and network service providers There's a certain amount of granularity That you can identify which blocks or which AS is are of various Categories and there's been some excellent work done at the AS level to understand which which AS is are of military or government educational Network service provider or commercial Good points. Do you have anyone that we can point to that could show us that? It was it was a statement which the microphone is not working and it's difficult for me to regurgitate his statement Sorry Amen. Yes, there we go. So With 95% of ASN's dirty Leads me to a question sort of follows up our conversation at the bar the other night What do you see as the future value or even the present value of Internet reputation systems when Almost everybody is infected. I see the value of internet reputation is With if if everybody's infected if if one out of five computers are infected What is the value of of reputation? It's important for you to not have it stolen. I Think if the value is going to increase on reputation Then we really have to do work to ensure that the reputation is actually intact When you're evaluating it whether it's being stolen because you have a network or a computing platform Operating on your network that you don't own i.e. a botnet that's delivering mail through your corporate mx Advocating penile enlargement That's essentially stealing a reputation of an IP space if you have a Block that's routed that has been compromised by or through the BGP That's not something that a company can even notice I Think that if We have one out of five computers that's compromised. We're going to see more of this We're going to see more spam from corporate identities that have a high reputation and the same Worry exists for the BGP so Those that have good reputations now or reputations that are asserted to be good Should be more concerned than Those that don't Yes, sir. Yeah in 2004 Over a three-month period. I developed some prototype software That is very aggressive in reporting spam as a result. I've done some amazing amount of Analysis and I've come to the conclusion that about I'd say 30 to 40 percent You get an IP address. You've got to find out who that IP address belongs to you have to rely on Aaron Aria ion apnick lapnik and all these other IP block Organizers whoever they are and a lot of times I find that the eye that the abuse email is bogus and I always try to like Try to like advocate some type of effort on the part of apnick to or on the part of the Yeah, apnick or whatever it is to To get their databases up upgrade it what kind of effort is being done to make a to make it easier to track these Hostile activities down and that's Something that I think everybody should address Maybe Paul can help us with this Hi, I'm I'm on the board of trustees for Aaron and I'm not speaking for Aaron here But I'll tell you some of the difficulties with getting that database cleaned up apnick ripe Aaron lacknick They are all membership organizations and so the staff comes to these organizations either because it's a good resume builder Or it's a paycheck nine to five job or they're passionate about it or whatever it is but ultimately they can only do what the members will agree to and it turns out that the The the rest of the community thinks that having a good who is service with accurate abuse contacts is a good thing But the network Operators don't really get a lot of value from that if you're you unit and you make it possible For the community to tell you that you have spammers on your network You're going to be spending a lot of time reading the same reports over and over again that are telling you something you probably already knew and The in the best case you you net loses money when they cancel the Subscription for the spamming customer, so we're asking them to spend money in order to lose money and and until we can remove the asymmetry of This person spends money and that person make makes more money as a result You're not going to see any incentive for the members of these RIRs to tell the staff or tell the board in my case We want this done It's it's it's sad. It is it pisses me off, too This happens to be a hot button, which is why I grabbed the microphone away from Rick This is something I have been pushing for But even being on the board of trustees for Aaron does not give me sort of magical powers to improve that database We're to ask the members to ask us to to improve that database five minutes Rick Any other questions? What's going on here on the screen is a little demo of What happened on Wednesday February 8th at 5 p.m. It I just have the United States here and it's essentially just Drawing dots on a map for every time we see some abuse You can hover over them and then it'll tell you where it came from IP address the reason for it. It's a little tool. We have our visualization I figured that if I'd done it over the internet, I would have been owned by now So I didn't want to do that on stage. You have a question, sir one of the problems is You know, you got two different Issues here. You got the issues of the infected machines that are sending out the spam But you also have the command and control center now as far as the command and control center If you try to attack that one of the biggest problems I've seen is that it takes a huge amount of effort to actually get a CNC shut down But Since they still own the Domain name. It's fairly easy for them to bring it back up usually within less than a month So how would you address that situation? Well, I was going to show you See if yopse was up All right, so how would I address the situation where domains can take them out? whack-a-mole If you're trying to whack-a-mole. It's a big problem solution my Attack is economic I want to I want to find a way to remove the incentive to change the Economics of the situation so that it is vastly more difficult to deploy a successful botnet and vast mean less Revenue can be derived from it. We're not going to win until the incentive has been changed Until the economic incentive has been changed. So I'm not saying let's take out command and control servers I gave you one. It's still up. I nobody came to claim the beer. So it's going to be mine um, I Thought these guys were serious hackers is still there It's not owned. It's The whack-a-mole isn't going to solve our problem. We have to change the economic incentive I know that it makes people feel better and and It's an instant relief to see it taken out and lots of people work on taking them out I agree That taking them out might not be The best way to solve the problem long term I think it's a it's a short-term activity to in that makes it cost more to deploy them It makes it so you can drive less revenue. I think So that answer your question. I think by taking out the incentive to deploy the botnets on the people's computers and that's done by remediation on the nodes that are compromised and Detection remediation and then prevention. I believe that's one way But I think my time is up. So I thank you and have a good day