Jeff Mann (58:08)
So back in those days, the sort of. The methodology, which ironically is based mostly off of a film that came out in the early 90s called sneakers. Robert Redford and Ben Kingsley were the stars. And that was sort of the first movie that showed what people would more commonly refer to as a Red Team exercise these days because, you know, a combination of computer hacking, but maybe physical penetration testing. The methodology was Simply, back in those days, you have a target, you have a company, an organization. Everybody had their own ip, routable IP addresses. There was no masking back in those days. There were no private addressing. Everything was Internet reachable because everything was connected. So you'd find out what the target was, whether it was a class C address or a series of class C addresses, which is 255 potential addresses. And then you do a probe of each IP address, do some sort of rudimentary scan to see what's alive, what's answering. And so once you found live targets, you do a port scan, which is basically, okay, what's, what's this machine talking on? You know, in TCPIP, there's 65,535 potential channels that you can talk on, and there's some commonly associated reserved ports that are associated with specific protocols, specific services. Start with there. And most of the protocols, communication protocols back then, were clear text. There wasn't a lot of encryption going on. So you would find what they were talking on. And then, you know, that's usually when you could, you know, connect to a system, maybe steal a password, maybe guess a password, maybe force one of the programs that was listening to hiccup and give you access, or there's many different methods of doing it. But the goal then was to get access. And it didn't have to be root, it could just be any user account. And then once you had that foothold, that toe in the door, then you try to elevate your privileges to root. And once you're on the system, there was any number of ways of doing that, including reading the password file, which was world readable. Anybody could look at what the password hashes were. I'm not using the word correctly. The encrypted passwords, they're hashed passwords, but you could copy that and run it into your computer tracking program, which conveniently was called crack. So elevating privilege, I mean, that was sort of the modus operandi. The first thing to do is get to root, because once you're at root, you have access to everything, any file system, any folder, any. Anything that was locked down and protected, root had access to. Because root was what we called the God account, it could go anywhere, it could do anything. Which is why we used to say to our clients, if we've got root, we're done. But they would very rarely understand that, comprehend that, and take it to heart. Which is why it became beneficial to say, okay, you're not getting it, that we have root. But would you understand it if I said we're looking at your financials for the previous quarter and we can see all of it, or we can look at the payroll and tell everybody, know what they're being paid and who got what bonus, and the people sitting next to each other, one person's getting made, paid 15% more and he's a guy and she's a woman and we can blow things up or, you know, research data, or we know where the money is. You know, there's, there's any number of things that tends to be something that, you know, I have no idea what you're talking about getting root, but you can do this, right? I mean, when I was, and I'm blurring the lines a little between my NSA days and my private sector days, but when we first started out doing this at NSA and people started, and we started calling it pen testing and we started being asked not by just, you know, our military customers, but like offices within NSA and other classified networks, you know, within the, the community. We started kind of having to come up with processes and kind of formalize a methodology because we had to get permission to do it. You know, I mentioned early on in the interview the church proceedings in the NSA charter. That became an issue, at least early on, because, you know, even though we were white hat hackers, we're the good guys trying to break in. Because we're nsa, we technically weren't allowed to break into computers and networks that were U.S. owned and operated. But as long as it was in the classified world, it wasn't really that much of an issue. But we did have to start talking to our general counsel. And for whatever reason, I volunteered to do that. I was a business major. So finally I was like, oh, we need organization, we need structure. I can do that. My, my friends that I worked with, they were much more into the gears and the weeds of the technology. I'm like, business processes. I got that. I can do that. So I started talking to the lawyers. I tell a story that. Well, to level set everything that we did in terms of our techniques for breaking into computers and networks when we were working within the classified realm, everything we did by rule had to be classified at the level of our target. So naturally, if we were working on top secret systems, everything that we did was classified top secret. In order to get authorization to do top secret stuff against top secret targets, you had to go through bureaucracy and red tape and get all sorts of permissions, which took a God awful amount of time. I mean, we literally would have to wait weeks to get permission to try to break into something that was even, you know, within nsa, like another organization, another office within nsa. And of course, what, nobody, what we didn't tell the powers to be, we'd already broken in, we already knew how to do it. And then we do the paperwork of, you know, this is the way we're going to try it, this is our attack methodology. And, and then we'd have to go off and get permissions, which was on a typed up piece of paper that had to be signed or initialed by every level of management from our branch on up to the group level, over to the group that was the target and down their management chain. And this was paper passing from desk to desk, secretary to secretary. It might sit on a desk for hours or days. So it would take weeks. I tell this story in a talk I've given a couple different conferences, but usually when I'm telling the story about what was our tradecraft, what do we do? I have to qualify and say, technically I can't tell you what we did because it was top secret. And then at some point I said, okay, I'll tell you one. So I have this big, you know, disclaimer banner, top secret. And I say, okay, are one of our primary cyber weapons that we use to get against top secret systems with something called the ping command. Let that sink in. Or if you don't know what a ping command. It's a system level command that comes with every Unix operating system that's basically, and it's named after a submarine sonar, you know, it sends out a signal and waits for a response. Are you there? Yes, I'm here. And it'll ping every single address on whatever your target space is. Very rudimentary, very common part of the operating system. It's a feature, but because the lawyers looked at it and said, well, you're eliciting response from the target, therefore this has to be considered an active attack, therefore it qualifies as a top secret cyber weapon.
