From Hollywood, the Hollywood Radio Theater, starring Del Maritter, Terry Moore, and Stephen McNally in Pick Up on South Street. Ladies and gentlemen, your producer, Mr. Irving Cummings. Greetings from Hollywood, ladies and gentlemen. Tonight's story has a most unusual cast of characters. A pickpocket who discovers he has stolen an important piece of microfilm from a sultry messenger for the commulus. And an unforgettable creature known as Moe. We bring these fascinating characters together in a hard-hitting drama from 20th Century Fox, Pick Up on South Street. And as our stars, we have glamorous Terry Moore, talented Stephen McNally, and Del Maritter to recreate a great portrayal of Moe. Now act one of Pick Up on South Street, starring Stephen McNally as Skip McCoy, Del Maritter as Moe, and Terry Moore as Candy. I had come to New York from Washington. We had one good suspect, a girl. Our only hope was that she'd lead us to the other. It was a Tuesday morning, shortly before 9 o'clock, and yet my assistant was with me. I was a subway train. I was jammed with office workers early morning.  I never would have noticed the young man if I hadn't been watching her. Then his right hand started to move. I watched him fascinated. He was an expert, all right. I saw him open up first, and we move along. And then suddenly we'd stop to the station. People were shoving their way in and out. The young man disappeared among them. Then the girl walked out, and your tonight were behind her. Look, why don't I follow the girl and you try to pick him up? You got a good look at him, didn't you? Try and find him downtown New York in the morning rush hour. You sure he was a thief? You sure she didn't know he was taking that woman? I'm not sure of anything. Hold it, hold it. Look. The girl had stopped walking. She was looking in her handbag frantically. Then she hurried into a drugstore and went into a phone booth. Oh, I had it with me when I left. I know I had it. Somebody must have picked my purse. I'm sure of it. Joy, what'll I do? You better come back here. Maybe I should go up and see him anyway. I said come back. He's scared. She should be. Don't lose her in here. Where you going? Police headquarters. Have a seat, Mrs. Aram.  You're in charge of the pickpocket squad? Right. Well, Captain, I'm looking for a man, but I don't know his name. Then we're in trouble. He stole a wallet out of a woman's purse on the subway. You know what he looks like? Yes. Then we're in business. Let's look at the files, Mrs. Aram. They kind of hinted upstairs the communists that mixed up in this. The girl he stole the purse from has been passing military information to commie agents. You know the man she was passing the stuff to? No, we got a line on everyone else except him. He's Mr. Big. All we know is as soon as he gets his hands on that film, he'll cross the ocean with it. Film? This film was in our wallet? Yes. Say, how many photographs have you got here? I've known pickpockets. Soon about a thousand. Yeah. How long will it take to go through them? All day. Maybe longer. Then I'd better start, hadn't I? I don't know what more I can tell you, Joy. It's just one of those tough breaks. The guy who picked your purse, we've got to find him. In New York? How? You're crazy. Got to find that film. Film? That's right. A piece of film. Microfilm. Maybe three inches long was in your wallet. What's so valuable about a piece of film? It's a new patent for a chemical formula. You're talking like... like it was hot. Look, how many times do I have to tell you we're not criminals? But this is big business. Cutthroat business. I'm in a spot. Joy, look, I'm sorry it happened, but there's nothing I can do about it. All you can do is tell your boss I had my bag picked. You'd walk out on me now. Look, we made a deal. You promised me no more deliveries after we broke up. And you promised me that you'd make this last one for me. Well, sure I did, but I can't help it.  You can figure out a way to find him. But I don't know anything about pickpockets. Well, you know people who know people. You're going to throw that in my face again. You've got to help me, Candy. You know what he looks like. If I had your contacts, I wouldn't be begging like this. Well, maybe. Maybe I can get you a lead. Look, Candy, you find that pickpocket for me and I'll never bother you again. Never. All right, Joy. All right, I'll try. An hour went by. I was getting nowhere with that mountain of photographs in Captain Tiger's office. I asked if there wasn't some faster method of running down that pickpocket. Well, as one character can help us out, maybe. It's not exactly easy, Mr. Zaram. Well, we're fighting time. Well, maybe Moe can speed it up a little. Who's Moe? With any luck, you'll find that out in about 20 minutes. Let me see what I can do. Moe was a little old woman. She wandered into the office carrying a battered little case. She put it on the Captain's desk and opened it up. It was filled with ties. Neck ties. I got a polka dot job that was just made for your personality, Tiger. It's a good thing you buzzed me, huh? Yeah, yeah, that's a beauty. Only, I'm not buying ties. Oh, no ties, huh? Who's that creep? What's he in for? He looks like a second-story cat burglar. He's a friend of mine. We've got to get quick action. Yeah, everything around here is always an emergency.  No. I got no killers on my table. I want to stay in business long enough to feed this kitty. How's it doing, Moe? That's getting sad. I got almost enough to buy the stone and the plot. You lose that dough at Spidersfield, eh? This I do not think is a very funny joke, Captain Tiger. Well, I just meant you ought to be more careful how you carry a background.  I got a place picked out on Long Island. It's private. You've got to be screened before they'll let them put you in there. That's how exclusive it is. No ties, huh? Uh-uh. So what's the score? We're looking for a cannon to bring the girl in the subway for a wallet. Well, ain't he pigeon-holed with the mile buzzers? We haven't got time to go through all those files. I thought maybe you knew some first-class grifter who'd been working the subways. Who's he? The victim's old man? No. He's the big thumb. That tie you're wearing, Mr. Striped Job would give you more personality. I'll remember that, thanks. You get a good look at this grifter? Yes, about six feet, dark hair. Ah, medium, short, tall, dark, light, fat, skinny. Thousands of cannons look like that. It's the technique. Every one of them's got his own trademark. Now, um, how about this tie here? Striped, see? Look what it does for him, Tiger. It's yours for a buck. Okay, here. Thanks. Uh, well, tell me, Mr. When does this happen? A couple of hours ago. Rush hour, crowded subway. Was he standing to the left of her or to the right of her or behind her? Behind her, then he moved around and faced her. Carrying a newspaper? Yes. Rolled or folded? Folded, I think. What do you mean, you think? What kind of a big sum that we got here? Listen, mister, you gotta be sure. Tell you all these cannons got their own way of doing things. All right, it was folded. The top side, was it the front page or the classified ads? Classified. Southpaw? No, he used his right hand. He held the paper in his left. Kind of at an angle? Kind of like this? Yeah. Did you see him close the purse after he lifted the wallet? Yes. He put the paper over it like this when he closed it? Yes. And violins were soft and sweet and, um... Maybe I know your boy. You better wait out, no, Mr. Sarn. I'm not so sure I like this. It's the way she works just for a minute. Thanks. Well, we gotta work fast. Look, let's not go into that again. What do you want from me, Tiger? Do I personally raise the price on hamburgers and pork and beans and frankfurtas? Is it my fault that the cost of living is going up? Now, this here is my account book. See, my price list. Want I should tell you? Go ahead, Tommy. Here in my little book are my prices as of this morning. When the cost of living goes up, my prices go up. When the cost of living goes down, my prices go down. In my book, the price on the board for a cannon is 50 bucks. 50 dollars?  You don't make such a millionaire sorry you can afford to pay me for all my tips. 35 dollars. I'll tell you what I'll do, Tiger. I'll give you the name of eight cannons that fit the job. See, three for nothing. But I'll bet you 38 dollars and 50 cents that one of them buzzed that mall's wallet. I'll bet you 38, 50, you're wrong. You got a piece of paper or write down the name. They're on the desk. Hey, come in, Mr. Sarn. She wrote down eight names. The captain got their photographs out of the files. Yes, it was that simple. This one, are you sure, Mr. Sarn? I'm sure. He skipped McCoy. He got out of prison a week ago. Looks like he's begging for another conviction. Well, he's got to live too, Don. Where can I find him? Haven't even got a lead on him. You don't know. Thought you knew everything about everybody. He hasn't been out long enough to settle. But I know how he operates. He's holed up somewhere. If you don't mind, uh, Tiger, you and me, we got a little wager. Okay, okay. Here. Uh, you never was a good loser, Tiger. That's 40 bucks. Give me the change. Keep your shirt on. About McCoy. Yeah, it's gonna be pretty hard to run him down, huh, Tiger? Might take you almost a week. What are you angling for, a side bet? Well, every extra buck has the meaning all its own. It just so happens I haven't got any left. And it just so happens that I know where he's shucked up. That's part of the bet? Listen, Tiger, do you realize that the cost of living has gone up 50% today? No, I got no more time. Then what are you stalling for? Why don't you name me a pitch? Okay, okay. Next time I'll give you odds. Two to one. How's that? The promise? Yeah. Well, this givlin' and gabblin'. Give me that pencil and another piece of paper. Well, I learned a lot that morning. I learned about Moe, who sold neckties. And information. In the hope that someday she'd have money enough for a respectable funeral. But more important, I learned where we could find Skip McCoy. His residence was on the waterfront.  McCoy was home. He watched us with amusement while we turned the shack upside down. We found nothing. All that lookin' around. You must be worn out. Want a beer? Yeah, maybe I will, McCoy. How about you? No. There's no electricity here, but the beer's always called... Keep away from that window. I'm just gettin' the beer. You see this rope? It's tied to a wooden box. The box is down there on the water, and the beer's in the box. Smart, eh? Once upon a time, they sold bait here. Live bait and fishing tackle. That's how they kept the bait alive in a box like this. Is, um... Is this a picker? You've been out only a week, and right away those fingers got to play the subway circus. What did you do with the wallet you lifted from the girl this morning? Me? Grifting a dame in a subway? Okay. Arrest me. You were spotted lifting that wallet. The girl was carrying a TNT, and it's gonna blow up right in your face. What girl? I'll jam that grin right down your cheek.  I'll see you hit the backyard without pay for a year. What's the matter, Captain Tiger? Are you nervous? McCoy, all we want is the wallet. If you got rid of it, tell us. If you threw the film away, tell us where. Who's your friend? Answer him. I'll tell you again. I've been clean ever since I got out. Why don't you haul that girl down here to identify me? We don't have to. I saw you in the subway. But you've got to nail the goods on me, mister. And I'm clean. That film you stole had classified government information on it. We've been following that girl for weeks. Just as we were about to grab a top-red agent receiving that film from her, you broke up the ballgame. Now, can't you see how important it is? You cooperate, and I'll drop the charges. You don't know how I'd like to make this rap stick, but what he's got to do is more important. Oh, you boys are talking in the wrong corner. I'm just a guy keeping my hands in my pockets. If you refuse to cooperate, you'll be as guilty as the traitors that gave them the A-bomb. You're waving a flag at me. I'm warning you, McCoy. And I'm warning you. I didn't grift that film, and it can't prove that I did. And if I said I did, you'd slap a wrap across my teeth no matter what promises you made. McCoy, do you know what treason means? Who cares? Make your pinch a get-out. McCoy wouldn't budge. He stood there grinning at us when we left. It wasn't until days later that we learned how McCoy had fooled us. After we left, he hauled up that case of beer again, hauled it up out of the water. But this time McCoy wasn't thirsty, just curious. The wooden beer case had a false bottom, a compartment, sort of a shallow drawer held in place by a couple of metal pins. He made it completely watertight. Inside, carefully wrapped in oil skin, was a collection of jewelry, some cash, and a tiny metal tube. In the tube was the microfilm. But what was on it that was so important? There was one way for McCoy to find out. He went to the public library, to a room marked periodical department, microfilm library. May I help you, sir? Yes, I'd like to see a copy of The New York Times. January 5th, 1947. Fill out this card, please. You got it on microfilm? Yes, I think so. Well, I just wanted to see the front page. How do I look at it? Oh, it's quite simple, sir. We put the film in one of the viewers over there that's magnified through the glass. You'll have no trouble finding what you want, I'm sure. Well, thanks. Thanks a lot. I'll fill out the card. McCoy hadn't the slightest interest in the front page of that newspaper. When he was certain no one was looking, he removed the film with the newspaper and inserted the strip of stolen film. But what he saw told him very little, just a series of numbers and letters. Well, all this was going on. The girl from the subway was trying to find him. Her search took her down to the Bowery to a cheap rooming house. She found Moe on the second floor. So, are you Moe? You want to buy some neckties for your boyfriend? You've been recommended as the best pickpocket stooley in the business. What kind of talk is that? Calling me a stooley. I was brought up to report any injustice to the police authorities. I call that being a good citizen. But you get paid for it. You're gonna knock it? I'm looking for the pickpocket who lifted my wallet this morning in a subway. Oh, so you're the muffin. What do you mean? One cannon talks to another when word gets around. What was in the wallet? What was in it is personal. How personal? What difference does it make? He didn't know what was in it when he took it. How do you know? You got a boyfriend, ain't you? Look at these beautiful ties. I happened to carry a complete line of personality, neckwear, and bargain prices. Look, I'll tell you just what happened, nothing else. You want to do business or not? You got any happy money on you? Happy money? Yeah, money that's gonna make me feel happy. What else? How happy? $50? I'm not sure. Maybe I have. Sit down, honey. Like you said, you just tell me what happened. It was dark when Skip McCoy returned to his shack. The waterfront was deserted. He started up the catwalk. But suddenly he saw something, the gleam of a flashlight through the broken boards at the shack. He waited at the door. When it opened, he swung hard. It was some moments before the prowler recovered. You play for keeps, don't you? Well, how did I know it was a dame? Now, what were you looking for? I want my wallet. What wallet? One you lifted from my bag this morning.  You sure do. Okay, what about my purse this time? Is there anything left? It's all there, including those crummy neckties. How much did Mo get out of you? I figure it cost you about $50 to find me if I know Mo. Well, don't look so scared. Mo is all right. She's got to eat. Look, did you throw it away? Mr. McCoy, I've got to find that wallet. Why? It's no good to you or anyone else. No. There was a piece of film in it. Oh. You mean you came all the way over here just to find a piece of film? Well, you got me in an awful mess when you took it. What kind of a mess? You working for some blackmailer? Oh, no, nothing like...of course not. Look, there are pictures of my brother, Mickey. He...he was killed in Korea. My mother was waiting to see those pictures. Oh, oh, oh. Well, why didn't you go to the cops, honey? Well, I...I got in a little trouble with him, and my mother just died. Well, you know what I mean. Oh, yeah, sure, sure. You're feeling better now? I mean where I clipped you. I guess I'm all right. Uh, you and the cops. What kind of trouble, honey? Oh, well, girl makes mistakes. Oh, sure. I was only asking because I... Because what? Oh, I don't know.  You look for oil. Sometimes you hit a gusher. Am I talking too much? No, you're nice. I like to hear you talk. I like to hear you talk, too.  What do you want? Blood? I just want to make your mother happy, that's all. Then you do have the film. But you see, muffin, there might be another little old lady looking for pictures of her boy. I gotta make sure it's your brother, Mickey. Okay. I'll tell my mother. Yeah. Yeah, you do that. Good night, Mr. McCord. Good night. And come back again, honey, huh? Real soon. A cue I'll pick up on South Street in a moment. Our servicemen around the world have a wonderful opportunity to observe new customs and traditions. And they're finding out that these ideas of other people aren't so strange after all. For instance, in many areas, there's a belief that trees and their products bring good luck. This undoubtedly dates back to the earliest existence of man, what continues to the culture of other people. On many Pacific islands, branches are used to ward off evil spirits or to cure diseases. In some of the western countries, certain trees are thought to be lucky for the person who touches them. Well, this might sound strange, but as our servicemen have observed, it's reflected in our own culture too. We say that when we want good luck for the future, we knock on wood. Now, that doesn't make us superstitious or primitive, we may not even believe in it, we just do it from habit. We also put a lot of stock in the Christmas tree. And the people of some other countries, this business of bringing trees into the house may look pretty strange. We have another very delightful belief in the effectiveness of a sprig of mistletoe, particularly if a pretty girl's standing underneath it. So you see, we share in our own way this age-old belief of other people. True enough, the customs and traditions of people vary around the world. But while a way of doing things may be different, the ideals remain the same. These customs and traditions are important to the people who follow them. And our servicemen are helping to maintain goodwill by observing the customs of other people in other lands. Now, our producer, Mr. Cummings. Act U of Pick Up on South Street, starring Thelma Ritter as Moe, Terry Moore as Candy, and Stephen McNally as Skip, with Dan Riss as Mr. Zara. We were waiting on South Street, Captain Tiger and I. We trailed the girl. She went back to the apartment in Midtown to Joey's place. Did you plan him? Has he got it? Yes, but he knows Joey. He knows what's on the film. Oh, well, I had to go through to run that guy down. A professional stool pudge and took me for $50. Oh. She calls herself Moe. She lives at 134 Bowrie up over a tattoo parlor. Sells neck ties as a front. What did you mean? He knows what's on it. He's been around, Joey. He's shaking you down. You mentioned my name. No, no. You know where I live. What are you getting so excited about? You should be celebrating. I found him for you, didn't I? I'll give you his address. You can go over and make a deal. No, no, I can't take a chance. Well, I like that. You can't take a chance, but you sent me over there. Look, it's different with you, Candy. In what way? Well, he might have been hired for the job. You think he knew what he was stealing? That could be. Then why didn't he contact you? It doesn't make sense. Look, he might be playing both hands against the middle, don't you see? No, I don't see. Maybe there's something about that film that you haven't told me, Joey. No, look, Candy, there's nothing complicated about it. It's just that, well, if he knew what I was after, he jumped the price, that's all. I told you I was in a cutthroat business. These manufacturers do anything to eliminate each other. That's the reason that I've got to keep on it. And that's the reason that you've got to go back to him. Well, I'm not going to.  He hit me. Oh, come on now, Candy. Listen to me. This is all part of your last delivery. You started the job, finish it. Look, here's $500. Offer him $50. If he holds out for more, give him another $50. Whatever's left is yours, honey. You can buy a lot of nice clothes for $400. Yeah. Yeah, I can't. Good. You come back with a film. I'll wait for the office. Why the office? Because Fenton's waiting for it. Fenton's waiting at the office. Come on in, honey. Come in and sit down. All alone, huh? Uh-huh. Uh, where's your mother? She couldn't come. Oh, that's too bad. You bring some money?  Honey, the last time I worked the subway, I was in short pants. The last time was this morning. How many times have you been caught at it? Well, I'll tell you, baby, whenever I'm caught, it's always an accident. Like, oh, maybe I just don't feel so good, you know. Or maybe I'm just not concentrating. I've been tapped once or twice. That's part of the business. Red side of the ledger. You mean if they caught up with you this morning, you'd be sent to prison? Nothing happens when I'm concentrating.  How much money do you think people carry around? How much would you be carrying around right now? Come on, give. Your hand, you've got fingers like an otter. Yeah, yeah, but when they stay empty, they get nervous. Come on. How'd you get to be a pickpocket? How does anybody get to be what they are? Things happen, that's how. Look, don't get sore.  I only ask because I'm interested. Interested? How much is it worth to you? How much is what worth it to me? Well, you're here to buy, aren't you? Look, you're not going to raise the ante by smearing my lipstick. Then why the pitch? You want to hear something funny?  Everybody likes everybody when they're kissing. And everybody's always different.  Look, I've kissed a lot of guys, Skip. But honest, I never felt like this.  How much did you bring, baby? I don't want to talk about it. How much? $500. I was going to offer you $50. Five bills. Keep it. Keep it and go back.   Hey, you people are supposed to have all the answers. Tell you what, I don't even know... Oh, come on. Drop the act.  Your money's as good as anybody else's. I'm a rat. Me. I know what you're after and I know what it's worth. So help me, I don't know what you're talking about. You know, all right, but what you don't know is that after I grifted your wallet, the cops came down and paid me a little visit. You know how hard it is to spot my fingers in action? It can't be done. But a guy did it. You know how he did it? He was watching you. And that guy you were supposed to pass the film to. There's nothing about him either, huh? He's still waiting, muffin. He's itching for it. Look, Skip, the way I feel about you, I wouldn't lie to you. You've got to believe it. I've got to believe nobody. I'll do business with a rat, but I don't have to believe one. Oh, that's quite a wallop, you pack, honey. But don't make me mad. You just tell your old lady, I'm shaking you rats down for 25 grand. And I want it tonight. See, I've been waiting for you. Hello, Mr. Fenton. Where's Joey? He's here. Joey told me you'd have something for us. Well, I don't. I don't. Oh, what a line he gave me and me falling for it. You know what's crazy about the whole thing? You know what he wants? $25,000. $25,000 for that film. Did you ever hear of such a crazy thing? You know why? You know what he said? Well... He's crazy. He said I was a commie. Did you ever hear of such a thing? What makes people like that? What do they get such ideas? All right. He wants to shake you down. But to start calling us commies... Joey! And you know what else he told me? Sit down. Joey! You don't have to say it all over again, I heard. You should have taken care of him yourself. You know I couldn't take a chance. I know you're getting paid to take him. Joy that man in there. The other room. Who is he? It doesn't matter, Miss, who I am. Mr. Fenton. Yes, sir? I'll tell you over the last time. Security is not interested in all this confusion. That film must be delivered to me by tomorrow night. That's all I have to say. I'm leaving too, Joey. Like the man said. Get that film. You can't do it, Joey! No, Joey! Joey, where do you live?  Joey, look, I know we're all washed up. But I still owe you something for the break you gave me. I don't want to see you end up on a slag. All right! I'll find him myself. I'll find him the same way you... No! No! I'll tell you. He lives at 704 West 47th Street. Near 10th Avenue. In the basement. We knew the three men Candy had seen Joey Fenton and the stranger, but there was still someone bigger. All three were trailed when they left, so was Candy. She took a cab to the rooming house over the tattoo parlor. I didn't know who else to go to. What can I do? Please tell me what can I do? Why don't you go to the cops? Who'd believe it? I didn't know what was in my purse. Would you believe me? Do you know what they do to people who hand out government secrets? Times like this, my neck tie business don't seem so important. Oh, Mo, you've got to promise me. When Joy asked you, you don't know. You don't know where Skip lives. Joey won't find me. He knows where you live. Then why ain't he here? I gave him a phony address for Skip McCoy. He's looking for him now. Why don't you tell Skip? Oh, he won't believe me either. Uh-uh. So he crawled under your skin, too. He's as shifty as a snake, but I love him. You sold him out for $50. Oh, look, some people settle apples, land chops, attic pills. Me, I peddle information. Skip ain't sorry, understand? We live in a different kind of a world. Oh, once in a while he gets hot under the collar if I sell him shorts. But you wouldn't sell him to a commie. What do you think I am, an informer? Thank you. Thank you. This muffin's a real softy. Okay, kid, hand me my box of ties. Maybe I'll go out and do a little peddling. Give me a cup of coffee, Oscar. Give me that. How are you, Skip? Hi, Mom. How's business? It's okay. You're eating late, huh? I've been busy. I've been looking all over for you. Stay away from your shack, Skip. There's a guy gunning for you. Well, he won't have any trouble finding me. Everybody in town knows where I live. I didn't pinpoint you're honest. I gave Tiger the name of eight cannons, but it was with him.  How much did you raise on me for your stone and plot? Oh, now don't get sore. Skip, they'd have caught up with you in a few hours anyway. I just, you know, chopped down the time a little. Yeah, that's mighty nice of you. Who's gunning for me? What's the matter with you? Playing footsies with the commies. Are you waving a flag, too? Listen, I knew you since you was a little kid. I was always an honest crook. Well, I need money. Who don't? I just never figured you for a while. Oh, drink your coffee, ma'a. Stop breaking my heart. Even in our crummy business, you gotta draw the line somewhere. And that muffin you're grifted. She's okay. She stuck her chin way out for you. Oh, you look tired, ma'a. You better go home. Yeah. Only stop using your hands, Skip, and start using your head. Also, that kid's fallen for you. Bye, Skip. See you, ma'a. Bye, Mrs. You wanna buy a tie? Mo went home. She started her tinny phonograph with her favorite number.  With a little luck, she'd have that headstone and cemetery plot all paid for and maybe one more year. Yeah, with any kind of a break, she'd make it. And then the door opened and a man walked in. What are you buying, Mr. The name and address of the pickpocket you sold to a girl the night. Oh, well maybe I forgot. Come on, here's a hundred dollars to help you remember.  Two hundred. What's this guy made out of, diamonds? Just the name and address. I ain't as young as I used to be, Mr. Things kinda go and come in my mind. Maybe I'll remember it in a couple of days. Maybe you won't be around in a couple of days.  Well, you ask a silly question, you get a dopey look. What are you holding back and may you sell anybody for buttons? Yeah, but not to you, Mr. Look, I haven't got a lot of time. You haven't got a lot of time. Listen, Mr. When you come in here tonight, you're seen an old clock running down. I'm tired. I'm full. Happens to everybody sometimes. It'll happen to you someday, too. With me, it's a lot of things. My headache and my back aches. And I can't sleep night. It's so hard to get up in the morning and walk the streets and climb the stairs. I go right on doing it. What do you want me to do? Knock it? I'm making a living so that I can die. But even a fancy funeral ain't worth waiting for if I got to do business with crumbs like you. And I know what you have to do. What? What do you know what? I know you commies are looking for some film that don't belong to you. You just talked yourself into an early grave. What else do you know what? What do I know about commies? Nothing. Well, I know is I just don't like them, so I don't get to have the fancy funeral. Well, anyway, I tried.  And you might as well, because if you don't, I'm going to the cops. And I'll tell them about you. Two hours later, Skip Malone was in police headquarters. Not in Captain Tiger's office, but upstairs in homicide. Looks like we've been waiting time, McCoy. That phone called just now. They say you're clean. Who says Captain Tiger? Tiger. Surprising, isn't it? He loved an A-lieu, McCoy, but he says to turn you loose. About Moe, where did that happen? She was lying on her bed with the phonograph going shot and killed. She got no folks, nobody at all. Maybe somebody'll claim her. Yeah. And what if they don't? You know the answer. Potter's Field. More than anything, she wanted a swell funeral. Somewhere out in Long Island. I know it's all written down in her book. Only Moe was a little short of cash, as far as we know. I, uh... I got a couple hundred dollars. Make it Long Island. That's something for you and the morgue to talk about. Use the other phone if you want to. I gotta call the captain. Skip and McCoy stayed clear of the shack that night. The next morning he went out to Long Island. He returned to a shack early that afternoon. Candy was waiting for him. Moe's dead Skip. Last night, she was killed. Yeah, I know. You bring the money? No. Then what are you doing here? I'm not sure I know myself. Skip, I... I went to Moe last night. I begged her not to tell Joey where you live. She wouldn't sell you Skip. Who is Joey?  You're not listening. Is Joey your old lady? Yes, I told Moe all about him. I knew he'd find her. You think he did it? He was ordered to find you. I saw him take a gun, but on a Skip, I didn't think he'd kill me. It's my fault, but I didn't know... I got no right to yell at you. She just didn't figure to go in that way. I've been up all night just walking the street. Yeah, it's all right. I didn't know where to go. When I read about it in the papers, but... Oh, I just had to see you Skip. I had to tell you how it happened. Yeah, I know. You've been so wrong about me. Take it easy. I had nothing to do with it. I told you it's all right. I see the whole picture now. This Joey, where does he live? He's got a gun. Don't worry, I'll let the cops handle him. Where does he live? 340 West 96th Street. You're not going there. Why not? I've got a piece of film that he wants. He better have that 25 grand ready. The girl watched him as he hauled the wooden beer case out of the water. As he opened the hidden compartment and took out the tube containing the film. Skip couldn't see her. He couldn't see her take one of the empty bottles from the shelf and bring it crashing down on his head. She left the shack a moment later. I was waiting across the street. She led me straight to police headquarters to Captain Tiger's office. Here's the film you've been looking for. Thank you. Thank you very much. It's the film the commies want. Skip told me to bring it to you right away. Skip told you? Yeah. Somebody followed me here. I took a cab. He was in another car. I followed you. Just take a chair, please. This film, can you tell? Let me see it against the light. Now just relax, miss, and answer a few questions. Well? How did you contact Skip McCoy? A lady called Mo. Your friends have anything to do with the murder? Yes. You'll say that under oath? I'll tell you everything I know under oath. Do you know what was on this film when Skip lifted it from your purse in the subway? Look, mister, I didn't say anything about anybody lifting anything from my purse. I came here to help you out. That's the way Skip wanted it. All right, so he's changed as possible, isn't it? Let him be decent if he wants to. And what's the difference why he sent me? I'm here with the film. That's enough. How long have you known Joy was a communist agent? I didn't know until Skip told me honest. You want to help us fight commies, don't you? That's why Skip sent me to help you. What I'm going to ask you to do might be dangerous. I'm here. Go back to Joy with this film. Carry through with the original plan. Now whether you make delivery or Joy does, it won't matter. We'll jump when the film passes to the man we want. Will you do it? Yeah, sure. Here's the phone. Call him up. Tell him you've got the film. Now? Yes. Okay.  Maybe so. Joy, this is candy. I've got it. I've got the film. A final act of pick up on self speed in a moment. When the 84th engineering corps was stationed south of Seoul in Korea, a young North Korean was employed in the kitchen. He was most appreciative of the work, cleaning vegetables, washing dishes, scrubbing the floor, for which he was paid about $15 a month. One morning when he reported for work, he brought the news that a new baby had arrived during the night. Happy and proud as he was over the event, he confided in embarrassment that he and his wife had not been able to provide clothing for the child, because there was nothing to buy in the stricken city. The young mess sergeant under whom he served wrote to his wife about all this, and she promptly bought an entire layout and sent it to her husband to give to the Korean parents. The Korean father, when handed the package, couldn't control his emotion and wept tears of joy that from so far away such wonderful gifts should come to his small son. Such acts as these by you and your friends today are shaping our world of tomorrow. Pause now for station identification. The curtain rises on act three of pick up on South Street, starring Terry Morris Candy, Stephen McNally's skip, and Thelma Ritter as Moe, with Dan Riss as Mr. Zara. Yes, Candy was doing exactly what we wanted her to do. She told Joey on the phone that she'd have the film in half an hour to pick it up at her apartment. We took our positions on the street and waited for Joey to leave, but Joey had more on his mind than just that piece of film. Well, I got it, Joey. Here, here in this envelope. Real anxious to give it to me, huh? Real anxious to get me out of here. You've been screaming for it ever since we've... McCoy, I went where you told me. What did you give me a phony address? I had to. Why? Because I knew what you'd do to him. I didn't want you to kill him. I didn't want you to go to the chair. Where have you been since last night? With him. Part of the time. You're going to tell me the truth? The truth? What are you up to? What are you trying to pull on me? Go ahead, rough me up if you don't believe me, but I got the film. How did you get it? You wanted $25,000. How did you do it? How? Doesn't matter. Look, I wasn't lying to you, Joey. I just didn't want to see you getting trouble. Oh, you know how I feel about you. I'd do anything for you, Joey. I'd give you anything. You wouldn't do anything for me, huh? This film, part of its missing, he cut off one of the frames. Now, where does he live, McCoy? Where'll I find him? He's gone. I don't know where he is. Joey! Where does he live? I don't know! I don't know!  We heard the shots from the street. We left a man at the front and rear entrances and rushed into the apartment house. Joey was gone. The girl was pretty bad off, but still alive. I was phoning for the ambulance when we heard two more shots from the street.  Yes, sir. Gibbs and he killed him. Gibbs didn't even have a chance to pull his gun. What about the girl? Still unconscious. The film? Gone. I better call the commissioner. You got the file on Joey? Yeah, sure. We've got to find him. Well, find him and listen to an hour every cop on the force will know what he looks like. If he's recognized, I want him followed, Captain. No matter what happens, I don't want an arrest until he passes the film. Yes, sir. First more than the girl here than Gibbs. Who's next, Mrs. Zara? I got the answer to Captain Tiger's question late that night in the hospital. The girl was able to talk now, but all she'd talk about was Skip McCoy and how we had to protect him. Joey was going to kill him. McCoy was still very much alive when we picked him up the following morning. We told him about Candy. He said he wasn't interested. But when he left us, he went straight to the hospital. Skip? Yes. You all right? I guess so. The nurse was just popping off about you. How come? I don't know. I suppose I've been giving them a bad time. I was afraid they wouldn't find you in time. They found me. That piece of film. How would you know? Joey. He'd sure I knew. I had to tell you before I got to you. I'd play everything smart with you. I'm breaking a beer bottle over my head, taking the film. You still get rid of it, Skip. Get rid of it. Sure. You know your sound just like you mean it. Every word. I'm sorry. I bought you a big score. A thousand dollars.  And I'd rather have a girl who talked without a twist. I told you before. I wouldn't lie to you. Does Joey know where I live? Yes, I didn't. Who did? Your dresser. Had it written down in my purse. It was on the table when Joey came for the film. Now it's gone. Mr. Zara told me it's gone. Please, not till I find Joey. He did this to you? Yeah.  Yeah. Why? I wasn't telling him where you lived. Thanks, sir. I'll be back to see you tomorrow. Macquarie went to his shack early that night.  Then he climbed down below the shack, crawled out on the beams and pylings over the water, and waited. Almost three hours went by before they showed up. Joey and the man named Fenton. He's not here, and why is a lantern? It means it's coming back. Why didn't you get in touch with me early? I couldn't take a chance to look out so often. What makes you think they're off? I'm sure this is the right place. She wrote it down on a card. I found it, of course. How much time have we got? That much. Thirty minutes. You'd better deliver what you've got. Mr. Bigger's getting angry. Maybe it's better for you, Tenzo. I'll stay here. Wait for Macquarie. I'll wait. Get going, Joey. Tell the boss I'll meet him at the airport with the other frame, but not to wait. Yeah. Yeah, I'll tell him. Joey headed for a subway station a block away. Macquarie followed some distance behind him. In the subway station, Macquarie bought a newspaper. He folded it at the classified ad section and waited for the train. He watched as Joey entered the car, then sat down at the other end. As they passed 33rd Street, Joey got up and waited in the vestibule. Macquarie didn't move, and the train went on to Times Square. This was what Skip had been hoping for. People, crowds of people pushing their way into the subway. The after theater crowd. Closer to Joey. He was next to him now. Pretending to read a newspaper. His right hand moved toward Joey. In a moment his fingers finally closed on what he wanted. But now the train was stopping. 70 seconds. Joey got off. So did Macquarie. In the station washroom a man was waiting for Joey. He took the envelope with the film and started out. But in the doorway blocking his way was Macquarie. That film, Buster? There's a frame missing. What? You get out of my way! It's me, Joey. Macquarie. I've been looking for you. Yes, I know. This is going to be easier than I hoped for. Is it? Your gun's gone, Joey. I got it. I figured I was all through picking pockets from the subway. Guess I'll never reform, huh? Oh, anyway. You wanted money, we can still do business. What's it worth to you? All I want is you, Joey. There's a name named Moe's death. And another name who's still in the hospital. There's your gun, Joey. Now go on.  I went back to Washington the following day, but before I left, I stopped by the hospital with Captain Tiger. Look, you keep telling me it's all over, but what happened? Ask him, ask McCoy, the big hero. Tiger's mad, baby.  I got Joey before they did. He also got the man we really wanted. You can stop worrying, Miss. They're both in jail. Skip. It may interest you, Miss. The police, well, they're giving McCoy a clean bill of health. Here's the paper, honey. Just about broke Tiger's heart. It wasn't my idea with the commissioners.  Next time, Zara and the big wheels won't be around to run interference for you. Look, you've got no right to talk to him like that. I don't care what he was. Why don't you give him a chance? That's telling the muffin. Him? I give him 30 days before I pick him up again with his hand in somebody's pocket. You want a bet?  You never give up, do you, Captain?  I'd make him look soft in front of his girlfriend. We got a solid citizen in there, Mr. Zara. Let's keep him solid. In a moment, our stars will return. Make a friend and you make an ally. There's a thought for you to keep in mind as many another American has. Today, one of our outstanding ambassadors of goodwill is Nelson Rockefeller, grandson of John D. With his brothers, Nelson has invested $3 million in a business partnership with South American Nationals. The official title of this venture is the International Basic Economy Corporation, what South Americans call it, Alplan Rockefeller, with American equipment and techniques. Among other things, Nelson Rockefeller has built a profit-showing fishery in Venezuela, a reconversion plant to turn powdered milk imported from the United States back into fluid milk, a food warehousing and distribution concern, a series of model and self-supporting farms, and a 300-acre hog farm. Throughout South America, the Rockefeller plan has set up thriving businesses, enthusiastically supported by the people and the governments of the two nations. Part of the plan's profits go back into other projects for food production and distribution, where little or no production has been done before. Part will help finance the American International Association, a non-profit organization set up to study scientific nutrition, sanitation, hygiene, and child welfare. In 10 years, when the International Basic Economy Corporation is fully established, its stock will be sold to citizens of the countries in which it now operates. As Nelson Rockefeller put it, the people of South America don't want Santa Claus gifts, they want to be partners, and with us do the job of helping themselves. Mr. Rockefeller knows only too well that by helping others, you help your country. Now, here's Mr. Cummings with our stars. And here they are, three very nice people, Steve McNally, Terry Moore, and Belmaret. Belma, we can't tell you how happy we are that you came all the way back from New York again to play the part of Moe. Well, I enjoyed every minute of it. Now, I don't want any of you to miss next week's play because by popular demand, we have invited that scintillating comedian, Glamrs Roslyn Russell, co-starring with that fine-established actor, Robert Young, in a sparkling comedy from Warner Brothers Studio, It's Goodbye My Fancy, a lighthearted story of a smart, sophisticated congresswoman who returns to her alma mater and tries to recapture an old romance. I'll be listening from New York. Good night. Good night. Good night. Come again. Hollywood Radio Theatre is produced by Mr. Irving Cummings, our orchestra directed by Rudy Schrager. This is Ken Carpenter inviting you to be with us again next week for another worldwide presentation of Hollywood Radio Theatre, brought to you through the facilities of the United States Armed Forces Radio and Television Service.


Hi I'm Dan Quinn, head coach for the Atlanta Falcons. I'm proud to be the honorary chair of the inaugural DAV 5K Run, Walk, Roll and Motorcycle Ride on Saturday, November 14th at Piedmont Park. The DAV 5K honors the service and sacrifice of America's veterans and gives our community the chance to say thank you to the brave men and women who have served. Veterans went all the way for us, join me to go 5K for them. I hope to see you November the 14th. Register today at DAV5K.org


Welcome to the annual DEF CON convention, this meeting was held in exciting Las Vegas, Nevada, for July night, for the 11th, 1999, the SD to set up a prior role in gateways. If you missed maybe like you're here sitting listening to me talk about gateways and actually secured servers because you're dealing with like pretty much a lot of the same concepts by that point and the target implementation is with net VSD on the grounds that that's what I'm running, that's what I can field questions on and it runs on a lot more platforms, stable under one source base. You can't see it, but it's a work in progress. It's a work in progress, which means that things are still under development, I'm still working on scripts to automate things, still fine tuning and getting the examples set up and eventually this will all be on a website so you can take a look at how this is all laid out and you can actually really easily see the example code, example configuration. Yes, VSD is a Berkeley derived code. It is open source. It is underneath the Berkeley copyright, not the Canoe public license and I actually prefer the Berkeley copyright versus the Canoe public license just due to the way the Canoe license is set up as far as getting other companies interested and so forth. Does that answer your question? Theoretically, a lot of the concepts are the same. How you might go about implementing it may or may not be the same. I'm not, when I say it's targeting that VSD, that's because if you ask me about command line options and so forth and you're running like Pico BSD or something and Pico BSD doesn't have the dash QZZ option of some command, I'm not going to know how to do the equivalent because I don't run Pico BSD. That's why the slides actually say net BSD because that's the platform that I actually did this on. No, this is actually, actually hold on, let me see what I can do. This is such a hack. Okay, firewall versus gateway versus secure server. Basically, this is all depending on the purpose of the machine. One of the key things you want to avoid is overloading the purpose of the machine. If you're putting a single machine out on the network, don't necessarily want to have that one machine do everything. You basically want to isolate it by task, if at all possible. By the time you get down to a personal server trying to locate like four or five machines out on the net simultaneously, each doing their own function may not be feasible. Actually, some of the topics I cover help isolate down multiple functionalities on the same machine and protecting individual functionalities from each other. But generally, you want to try to avoid overloading a particular machine such that if something gets compromised in one area, you lose the whole thing. As you're building these machines, yeah, you can use net BSD for firewall. If you're a corporate entity, you've got to look at various threat levels and the cost versus the threat. If you've got a lot of information, we have a lot of reputation capital that needs to be protected. You probably don't want to use any UNIX-based firewall.  Basically, because that's all it does. It protects your machine. It's a firewall. It's dedicated. And if you're a major corporation, you may want to go that route. It's all based on cost versus threat models.  So you're expecting people on one side coming in and attacking on the inside. There's no whiteboard. In order for people to actually get work done when you've got a firewall in place, you've got to allow various services to be able to pass through that. If you don't, people are going to attempt to find ways around the firewall and open up other security holes which basically undoes your carefully laid plans. Users are very tenacious when it comes to what they want to do. So especially in a corporate environment, you've got to have mechanisms in place to ensure that what you're doing and what you're blocking and what you're allowing is what the users want, need. There's times when, yes, users may want a particular thing that you have to say no. You need to have a corporate policy and a fact that says you can say no, otherwise you're going to try to go around it and there's nothing you can really do. Basically, you've got this machine sitting in between two networks and there are times where you need to allow the inside to get out into the open area and sometimes you need the outside to have the ability to get in. If you've got your personal machines fireballed off on the internet, it works really good when you're at home sitting right in front of it. But when you go out and you're roaming, you've got your laptop and you've got your ricochet or other wireless or remote connectivity means and you suddenly realize that you've left a phone number at home and it's sitting on your machine at home. You tend to really, really want to be able to log into your home machine and get at that number. So there are mechanisms to allow you to get back into your machine behind the firewall securely. A lot of times if you've got multiple machines on the inside, you may want to set up proxy servers. Most common is the web proxies. This also helps with caching and so forth and a lot of times most corporations will locate this on separate machines to not bog down the actual firewall machine itself. As home users, you can consolidate this into one machine. Especially in the case of home users, unless you've got nice fast cable modems, you may want that caching if you've got a lot of people on the inside hitting that same site. There's a couple different levels that we're going to talk about as far as dealing with what you're firewalling. Okay, who did that? Here's some routing you can do to help you protect against firewalls. Protect your internal network through the firewall. You can have your firewall routing different packets into different networks and ensuring that that traffic goes to this destination. Filters, you can start protecting things at the IP level, not allowing certain traffic to go to certain machines on the inside, but allowing the rest of the traffic to go to other machines. This basically cuts down on the number of attacks people can hit on those machines. In the case of small corporations, small offices, it will help prevent individual users from starting to run their own programs and their own machines that allow access into your network. A common thing is for people to run remote access servers on their machine, not tell anyone in the IS department just so they can log in from home. Same thing applies to people setting up modems on their personal work stations to allow people to dial in that immediately bypasses any firewall you can put up. That's really dangerous because it doesn't take much now for a user to get something like that up. It's a few mouse clicks under windows and suddenly anybody can dial in to that work station and have access to your internal network and a firewall will do absolutely nothing to protect that. You can actually have TCP wrappers to watch what's going on and determine what's connecting to what service that BSD actually has as TCP wrappers built in. It's something that comes with the VLS as far as filtering. IP filtering is built in and ships with the VLS, so it's like right there out of the box. You can start writing rule sets and so forth to actually deal with that and you don't have to worry about downloading additional software. It's all right on the box from the beginning. By writing rule sets you can work cut down on the number of attacks. Scanners, it is actually possible to go out and get software that will look at TCP streams coming in and analyze them for certain textual sequences.  So basically if they can see it's like tar, XF, root kit, it's like wait a minute something's wrong here, someone's unpacking a root kit from a remote site on an internal machine, kill off this connection, log the attempt and notify someone. So you can actually, there's actually software out there that will do real time analysis of the streams going through a machine. Personally I'm opposed to that just due to privacy considerations and if you're running SSH like you all should be, your streams going through your firewall are encrypted anyway, so running that sort of scanner's not going to work. Logging is also very important because we can collect and look at and have available at our fingertips all the data that's going through the machine constantly, but if we don't do anything with it, if we don't do the correct things with it, it's absolutely useless. So the key point is if you log to the machine itself if it ever gets compromised, people can mess with the logs. So what you want to do is set up another machine internally, highly locked down, that is basically a log server. The only thing it does is it takes syslog messages and writes them to disk. I've actually seen cases where they've gone to the extreme since syslog is UDP based and doesn't require an AC. They've actually taken machines that are plugging the network via the A UI connectors, the old start connectors, and have cut off the transmit pin from the machine so the machine could not possibly talk back to the network. So the only thing that can happen is that machine can receive UDP packets. There is no way to really break into a machine like that because the only thing you can fire at it is UDP. You're never going to get a TCP connection. You're never going to get a response back. So you're really, really limiting what can be done. The worst case in that is someone can attempt to try to fill up the log disk on that machine and then try more malicious attacks. But disk space is very, very cheap. You can go out and get 10 plus gigs for under 200 bucks. So trying to fill up that much space before someone notices is very, very difficult. But the main point is logging is very important. Routing. A lot of sites will only need to set up static tables as far as the routing of their internal network. Most people will only have one connection to the outside world and the static tables are fine. If you're on a larger corporate style network we may have multiple paths to the outside world. Maybe running dynamic routing protocols and one of the key things you got to watch for is various poisonings of your routing tables. At home actually had a little bit of a problem in Fremont a few months back when a user broadcast a VGP packet out to the routers that basically told them to get to anywhere in the world, you go to that machine. It's pretty much shut down Fremont. Network address translation NAT is very common amongst home users and small offices turning a single IP address or a small handful of IP addresses that were given to you by your service provider into a fairly large pool. In my bedroom I've got probably eight or nine machines. My network connection they've given me one IP address. It's working just fine for me. Had no problems with it. Works great. And you can actually deal with real sets. I'm so dead by the end of this. Yes. Yeah. It's a little bit more difficult but I mean a lot of the cache poisonings I've seen it's theoretically possible on a single pipe out. Actually probably was I don't know what set of slides I actually used earlier but I've worked with VGP and Pancas on presentations before and I've seen a lot of those slides and it's possible with a single pipe. I don't know if I can dial up or something. Is that going to put a load on your server that you might experience? Not really because with NAT you're only changing a few bits and you're doing some checks and recalculation at one level higher but you're doing a lot of that calculations and twirling of bits next layer down anyway because you've got to drop it out on the wire on the internet so you're writing a new MAC address into it so you're changing fields anyway. So it's not going to... Yeah. It's work to be done so yes it's going to add a load but it's not all that significant. I've seen 486s doing IPsec that are saturating 10 megabit lengths so the grant that was like single does but you can't buy a 486 anymore so anything you're going to find now you shouldn't have any problem even when you start trying to do IPsec and encrypting everything. IP filters, this is the core of what you need to do in order to protect a machine. You've got to have a really good set of filter rules to make sure that what's getting through is what you want to get through. Basically if you've got a set of IP filter rules in the file that contains those rules about half of those lines should be rules. The other half of those lines should be textual comments as to exactly what you're trying to accomplish with those rules. I've seen instances in corporations where people have, in different departments have requested I ask, oh well I need this port open and IS has gone in and opened the port and the need for that port being open dies off after several months. IS has never notified that that port is no longer needed open but IS didn't document who requested the port to be opened, why it's open, so it gets left in there for basically all eternity. So if someone sits down and says okay fresh start, we're going to lock everything out and wait for people to complain. This usually gets IS into a lot of hot water in I'd say 99% of the companies because a lot of times those security groups just don't have the political power within the organization to be able to stand up to marketing. The company is driven by marketing and a lot of times they can, oh well we need this and management will say okay well you guys make this happen, allow them to do this and a lot of companies just can't stand up to that. But your IP filter rules are really important in what you're protecting and how you protect it so you really have to use those to lock down your system. Basically the rule of thumb is deny everything and then only allow through what you want to allow through. A lot of rules that's out there that are attempting to like block certain ports. If you know what you're doing you can get away with just blocking certain ports. However the safest bet is to deny everything, pass through what you want, pass through. Like I said, actually we jumped ahead of a slide there. Like I said comment what is allowed when, by whom and any authority that said this has to happen. An additional point is note that if that rule is ever to expire that is if we need this port open from now until next February. Note that it can be closed off next February. That way you don't end up with this huge file with all sorts of ports open and nobody knows how long it's supposed to be open. You can go back and deal with cleaning up your rule sets. You also want to make sure that when you're opening up a port you find out what that port needs to go, what machine it needs to go to. So you don't want to open up a port on all the machines going through because that can be used to attack other machines that may not be running that server or maybe having other resources and other types of servers running at that port address which can then be attacked because one group needed a port open for only their servers but it was opened up for everybody's. TCP wrappers basically allow you to deal with monitoring who's connecting to what and dealing with services and basically give you another layer of denying control. This is at the next layer up. Basically you're trying to establish a connection rather than just looking at the raw packets. This gives you better control over application based security and wording things.  It's up to your particular implementation and what you feel more comfortable with. Yeah, that would be one way of putting up because it's assuming that all your, well at least some of the BSD kernel, all your routing and your filter rules are happening in user land that may, I mean starting to kernel space and other implementations, some of those packets may be popping up into user land. If you know you can deny connections, you want to get them, those packets, out of the mix as soon as possible. It's less work for your higher up layers if you can just eliminate them as soon as you know you can eliminate them. As we got scanners looking for bad things happening, a couple of products I want to mention that's out there, port sentry, which was formerly abacus sentry, can set this up to start watching people trying to connect. This is working off of your IP filter logs. So if you don't have services running on 65,531 of your ports, but you have services running on just those last remaining four, you're going to want to be able to detect if someone's trying to scan you. You don't want to wait until they stumble across those four ports that you actually have something bound to. You want to see that, hey, someone's trying to pass packets on all these other ports and trying to find out what's open. So software like port sentry will help you determine what's going on. Tripwire is actually software that tends to run on the machine itself. It'll allow you to determine if the machine has been compromised by doing checksums of the binaries, looking for things that have been replaced, trojaned, et cetera. Content scanning, like I mentioned earlier, we're looking at the individual streams, looking for people typing suspicious or malicious content through the wire. Usually these things are fairly flexible in setting that up so you can determine what exactly you want to look for. And it's not limited to just interactive telnet sessions. You can scan basically pretty much any IP stream looking for this potentially bad content. Logging, like I mentioned, the best logging is both remote and secure. You want to be able to protect that logging machine because generally you're not going to set up a logging machine for every machine you want to attempt to log to. So you're going to be coalescing a lot of your logging functions onto one machine, so you want to make sure that that machine is really, really secure. I've got a machine called... Sorry? Go ahead. Yeah, you can actually tell SysLog to log to a remote machine, and that's a capability built in. There is secure versions of SysLog out there that add additional layers, so if someone else does manage to compromise an internal machine, they can attempt to set up a sniffer or something. They can block out... There we go. It's a little strange to be jumping that far ahead. Providing services. So you've got machines out there that need to do something. Aside from just having your firewall to keep protecting your network, you do need to have machines that need to talk to the internet as a whole. Web servers, mail servers, FTP servers, et cetera. So in order for any site to be useful, you've got to be able to offer services and you've got to do something to be able to protect them. Web is basically broken down into two categories. The web service itself, where people browsing the web will connect and get pages down, and the other half of that is content management. You've got to have some way of dealing with the web content that's there, and a lot of times you want to break this off into two categories as far as how you want to to lock down the permissions. Interactive traffic is a hard one to nail down because you're opening up the system to allow people to log into it, and one of the reasons you may want to do this is for content management of a web server or an FTP server so that people can update it and keep it fresh. You can deal with content and other logs. The other thing that people may need to have a direct account on the machine is for them hopping out either from inside the firewall onto the firewall and then out to the outside world, or in some instances you may need to allow people in through the firewall. So being able to access resources both on the outside and on the inside of the firewall may need some sort of an interactive capability. Administrative considerations, basically you've got this machine there. It's going to require some administration to deal with it. You need to be able to protect the access that's required to actually administer the machine since administration requires additional privileges. You've got to be a lot more careful about how people who are doing administration of the machine are going to do it. If you've got a large machine or a lot of machines, what you would need to do is decide on, with multiple administrators, decide on who is going to be doing what and what they're actually going to need to do in order to get their job done. One thing you want to avoid in a corporate environment is role-oriented or role-based accounts, basically an account called Web Admin. If you have like one account with us called Web Admin and you've got five web administrators, you really don't want to have all of them trying to log into this one account with one password because now you've got five people with one password to one account. If any individual writes it down on a post-it note, loses his day-runner with it in it, it's harder to track how that password got compromised. And there's also no accounting of who did what. If someone decides they want to reorganize the entire website, there's no trail saying oh well, this person came in as administrator, changed all these directories around. If you've got an administrator who has multiple duties and you've decided that he needs multiple access on Web and FTP, but you've got other administrators who only need Web, only need FTP, one solution is to provide them with their own Web administrator account. Then another FTP administrator account. So the admin who has to manage multiple services would have multiple accounts so that he knows that he is logging in to do this function. And it's a little bit more work for the administrator to deal with the additional passwords, but at the same time he's not likely to accidentally do damage to another service area. So once you actually have all these accounts, one of the things that you're going to want to do is reduce the privileges down to what is absolutely needed to get the job done. All these people who have their own accounts, those should not all be root equivalent accounts that defeats the purpose. This is a little harder in Unix-based systems than systems that have B2 level security where you actually have a capabilities-based permissions model where you don't have a root account other than an account called root that just happens to be, by default, assigned all priorities. Some of those higher-end systems have need accounts like backup, which basically gives read access to all files, write access to tape drives, and that's it. They can't change or modify or create any file they want. They can read anything. They can write to a tape drive, and actually they can read from the tape drive and write to a restore area, and that's it. Unfortunately, this hasn't gotten popular amongst even most of the commercial Unixes and hasn't hit the free OSes yet. It is something I would like to see because it vastly improves security because you can really lock down who can do what. Another thing that you're going to want to pay attention to, and there's mechanisms to do this, is compromise protection. This is an era where we've got a lot of free software out there, and by that same token, we can't always guarantee the code quality, so any given version of Apache may have a bug that allows YouTube to compromise the root onto the system. Sendmail is notorious for having this problem where you can break Sendmail and get read access. The problem is once you've got read access through Sendmail, in most installations you now have read access over the entire machine. So as you're reducing your privileges, you have to understand that there's faults maybe way too open as far as what permissions are set on what directories and how things are set up. This is done a lot of times because a lot of the newer users are expecting to be able to do things easily with their own accounts, so rather than really securing a system and getting tons of email from new users saying, well, let me do this, I've actually seen instances where people from various OS camps have opened up the security on the OS just to stop getting emails saying, well, let me do this. Unfortunately, that's not the best route. The best route would have been to educate the users and provide more upfront information saying, hey, you've got to do this and this first. So the real big things that we're going to need compromise are web and your mailers. FTP occasionally has had some problems, but it's not as much. We still want an attempt to do some compromise protection for web and Sendmail. So how do we do this? There's a wonderful, wonderful system called CHROOT. And with it, we can change what the system will allow the route of the directory tree to be. So basically, we've got four, five key areas here. We've got user space, basically areas of the directory tree that users need to be able to access, or various applications need to be able to access to do their job. We've got things in slash dev that allow things to communicate within and out of the system. We've got shared files, which are basically files that are needed by more than one service, such as if you're providing web, the web server needs to be able to access the files, so does the people who are administrating the content. VAR is needed in a lot of instances, because you've got your mailers who are pulling mail in and they want to be able to write to VAR. And at the same time, you've got people who are reading mail who also want to see the same VAR school that the mailer sees so they can actually pick up their mail. So a neat way of getting users into these CHROOTed cages is by starting up SSH in its own CHROOTed area. This will allow any user who logs in via that particular SSH demon to end up in the CHROOTed cage, which is then very carefully built to only put into that cage what is necessary for them to do what they need to do. To get things into these CHROOTed cages, especially like in the shared areas, our goal is to protect the outside from being able to access it. So we've got to take care to deal with permissions, but the user IDs and the group IDs, the way we get things into these cages is their actual disk on disk storage lives in another portion of your directory. What you'll do is make local mounts from that point in the file system into the CHROOTed cage. Some links will not cross a CHROOT boundary, but if you mount something inside a CHROOTed area, it will show up. By doing this, we can control exactly what any individual cage sees. And as we're mounting these files systems into these CHROOTed cages, we can take advantage of a lot of mount options, such as not being able to exec, not being able to make device nodes, not being able to run set UID binaries, not being able to allow core dumps, so forth, basically all your mount options. So you can really lock down the web as possible. If you're mounting your binary tree for users to execute certain programs, you may want to mount that weed only, so that if the cage does get compromised, they can't change any of the binaries. CHROOTed is actually a system call, so it's down at the kernel level, and basically it doesn't allow you to traverse above a certain point, wherever you CHROOTed into, you'll give CHROOTed an argument of a directory and then an executable, and the executable is relative to that directory. The program that is then fork exec off of that, its root, as far as the root file system is concerned, is the directory that you pass as that argument to CHROOT, and it just can't go any higher than that, and so it's locked into that portion of the directory tree. So, now we get to... The PowerPoint slides will eventually be available as soon as I can convert them into a real format, and they will be available, actually, on this website. Unfortunately, I got caught up with my real job, and I spent the past three weeks writing and then giving two courses on a particular API set that I wasn't planning on, and basically that consumed three solid weeks of my time, which I lost a lot of sleep over. SDF-1, any anime fans out there may recognize SDF-1, so I actually have a machine named SDF-1 that is sitting out on the net, and on it I've got right now a web server that is managing three domains, and each one of those has content that is in varying degrees of completion, and due to the fact that I can completely overwork because work likes to just hit me with can you please design a course and teach it next week? I've gotten a couple of friends, or suckered a couple of friends, I hope they're not in here, to actually do content management for a couple of those sites, so I then realized, okay, I've got to let these guys be able to log into this machine to be able to edit these web pages. My original plan was to create all the content on my machine at home, and have a really simple script that allowed me to SSH in with RSA authenticated keys, so it's basically a good mutual authentication, push a new tar file of the entire web content up, and a script would run that moved the old content out of the way, dumped the new content in, and everything was happy with no user intervention, or logging in, really limited ability. Unfortunately, I don't have that type of time, so I had to let them log in. And of course, they do not want to sit there the entire time. They do not want to sit there the entire time and use VI to create the content they want to be able to create this content in the comfort of their own home, so I had to provide them a way with getting the content up to the machine. And they're unfortunately all on Windows machines, which doesn't have a nice neat, secure copy interface installed, so I had to provide them with FTP, and the last thing I wanted was them typing in their passwords to FTP, so okay, anonymous FTP only. And this was done to allow them to do content management, so the only writable areas are some hidden directories and they're incoming. So in order to accomplish all of this, I set up several CH-rooted cages, one for the web, one for users, one for FTP, and basically inside the user's area, when the SSHN, they end up in a CH-rooted cage and mounted in from another portion of the tree is slash HTML, which is the web content. This exists on another portion of the disk. It's mounted into that area, so they can go ahead and access it. The FTP, which is sitting off in its own CH-rooted cage, the directory that they're FTPing into, that is mounted from that CH-rooted cage into the user's CH-rooted cage, so they can access it. Since I've got to administrate the machine, I've got another SSH running at another port, so that will let me log in and actually get to the real root, so I can really log in and deal with the administration of all of this. With that, I can control and set up these very CH-rooted cages, but the fact that I've got two SSHs going now, two SSHDs going now, I just have to start worrying about dev entries because the way dev permissions are restored is they're set back to 666 for some bizarre reason. Unfortunately, there's not one place that I can go in and tweak the code to say set the mode to zero when you deallocate a TTY pair. It seems that every single demon does this itself. I looked through the SSH code and saw where it did it there. I looked through Telnet and saw where it did it there. I looked through Login and saw that it did it there and went, this is not good. This means that I've got to make changes to several demons every single time I want to upgrade to make sure that TTY permissions are reset correctly so that as I'm going along and people are logging in and out, as I log in as root in one domain, that someone logging in as a user and that CH-rooted cage and sees the dev entries there can't mess with them. So having multiple device nodes was not going to work because of these permissions. So what I ended up doing is creating a sub directory under slash dev that only had hard links from it into the TTY PTY pairs. Hard link into standard in, standard out, standard error, dev zero, dev no, and dev random. And then mounted this sub directory which had a very limited set of dev entries into the CH-rooted user's directory. This allowed the CH-rooted user's cage to have access to the dev entries that it needed but not all the dev entries. So even if someone was able to get root in there, they weren't able to make the dev entries to create dev entries for the hard disk. And basically, you can mount those, the file systems in with the appropriate permissions but set so people cannot deal with creating the dev entries in the slash dev. Mount all the other file systems, no devs so they can't create dev entries anywhere else. And you can really lock the system down and prevent people from making changes even if it was compromised. For situations like FTP, I don't remember exactly what version of FTP I've actually got running, but most of the shell code out there for FTP experts assumes you have a bin SH. There is no bin SH in that CH-rooted cage. You're not going to be able to exact it. It just won't work. The only thing that lives in that directory is the FTPD binary itself. So unless you want to write an entire shell in shell code, even if you can find the buffer overflow in that version of the FTPD, it's not going to do you much good. And even if you are able to break root through FTPD, you now have access to the FTP files. And if I'm serving any FTP out, you're not going to be able to compromise those because those have been mounted weed-only into that CH-rooted area. So the capabilities that you're left with after compromising root are really, really limited because of this extra effort set up to create these particular cages and lock what resources are available down to only what is needed for that service. And the same things can be done for, for send mail, for your pop, any other internet-related services that you need. You just duplicate these CH-rooted cages, on out, and only provide binaries that are absolutely needed. In fact, I haven't had actually any of my users complain yet, but they can't even do a who to find out who's on the system because who doesn't exist in that CH-rooted cage. And even if who did exist, there's no DevKM. So even if they copy in a who binary, it's not going to do them any good because it's just not going to work. And by those tokens, you can really, really keep people out of what you don't want them to do. And if you ever do need to administrate the machine, you've got an entirely different port set up where you can log in as an administrator and do the things that you need. And if we flip back real quick to those IP filtering rules, since you've got a different port lock off for administrator, you can control from what sites someone can log into that port. So basically you can say, I can allow users into the user CH-rooted cage from anywhere. I have no control as to where my friends may actually want to log in from. Or I can limit them to logging in from machines I know they have accounts on. But for logging in in that real root of the directory tree, I know that I really only want people to get in from my disordered account, my remark.ordered account, and maybe my DSL address. So I can lock it down to those three systems and prevent people from getting in. Or I can just leave it as if I want to administrate the machine, use console and just not allow any network access to the root of the tree, but at the same time we still have people able to log in to do work. As I mentioned, we can scan for activity of maliciously users attempting to do things even if they have an account. There's a lot of ways you can detect this. You've got scanners walking down what executables they can actually run. This kind of reeks of Big Brother really hasn't actually even endorsed this. If you're working for a corporation that has a very well written security policy saying this is what you're allowed to do, this is what you're not allowed to do, and if you do something you're not allowed to do, you're fired. We have a better chance of getting away with scanning the interactive traffic to find out what people are doing and logging, shutting down connections as appropriate. Other neat features I've seen in the B-level secure system is the kernel keeps track of what network interfaces you're talking to. And if you attempt to bind to more than one network interface, you can detect this and kill off that process and then log who, what, and when attempted this violation. So basically, if you've got a system that's a firewall and basically you're authorized to log into that internally to manage some content, you're coming in from the internal address. You can go in and say, okay, I can log in, I can do my work, but you wouldn't be able to set up a demon that listens on both the internal and the external to allow it to pass any sort of traffic. So you'd always have to do this. If you're trying to move any content in and out, you'd have to do a sort of a bounce, move the content onto the machine and move the content off and you've got better control over what's going on by adding that additional restriction. Other things that may want that could be done in the future that just aren't really set up smoothly right now is additional login restrictions where you're controlling who can log in from where, when. Basically, time-based, location-based logging in without filtering at the IP level. Basically, you say, okay, it's okay for Joe to log in from home after 5 but before 9 a.m. No problem, he works from home at that time. It's cool, but we don't want to let him log in remotely from 9 to 5. We want him to be here in the office doing his job. So that's an additional direction for the future. Any questions? Sorry. So, back there. I'm on the initial stages of packaging this for general consumption. The machine that I described, SDF-1, it was set up this way. It's been set up that way for quite some time now. And I haven't had too many user complaints. The only thing that has really come up is it would be really nice if we had Pico. So that's been the only comment on that. Any other questions? Occasionally, you enter a situation where your firewall just isn't enough. So you really have to take it to the next level. This may be a little hard to see, but if you talk to John afterwards, that's a GE minigun. And... That's a really cool drawing. You've probably been going back a bit if you actually fired that, but I'd like to see it. I'd like to see the malicious user he was targeting too. So if you're interested in the shirt, back to John. Any other questions? I would compare it as Judaism, Hinduism, Christianity. It gets down to a religious war. I've had lots of luck with NetBSD. I've been running it since I'm probably 93, 94. I probably still have 0.8 install floppies floating around, which is one of the first publicly consumable versions. That was well before the openBSD split. NetBSD runs on currently 16 different hardware architectures, so pretty much it's almost... It's got a 32-bit CPU or greater and an MMU. You've got a good chance of it running or getting it running without too much work. As far as freeBSD, their goal used to be the best optimized free version of aBSD for the internet platform. Linux, unfortunately, it's just way too diversified. Some of its strengths have really contributed to some of its weaknesses. Yes, it's got a lot of drivers available for it because you've got a lot of people writing drivers for it. Unfortunately, you do have a lot of people writing drivers for it, so the code quality may not be the same across the board. From the firewall standpoint, there's a lot of drivers sharing between freeBSD and NetBSD. OpenBSD is in there looking at the same code as well. They're all BSD stack derived. I don't know what Linux did to the BSD code when they moved it into their kernel, but they've been having a lot of problems with it. I know NFR was having issues with running on Linux because the stack just wasn't up to it going at full speed, so Linux may not be the best option in light of that. I haven't had a chance to actually test that out, but that's something I have heard. But there were issues with the Linux stack, so to each his own, but that might be a potential issue. Let's sort of answer your question. Anybody else? Questions, comments? More beer? Okay, thank you. If you have any additional questions or longer questions, feel free to come on up.