BSides Glasgow 2018 - Andy Gill and Brian Higgins - The Internet of Death

oh yeah this is also marked 18 or above so if you're under 18 Parvati this is an attack and the stock has been in the making for two years two years well it it's been in planning for two years it's actually been in the making for about an hour yeah give or take so before we get started there will be a [ __ ] ton of swearing so deal with it and we have cleared that with the parents of the young people in the room by the way so please don't think that we're being rude on personal there is a small person here and she's happy for us to provide for Fame don't you where are you you here sir

yeah okay so we're good are there any other small people here metrics count as well just you can't call them that okay sorry okay so before we get started and presenters sponsors organizers don't advocate more dos oh okay and this talk is purely a bit fun it's an insight into how dangerous Internet can be and leverage easily I still have from Wikipedia so you can read it yourself is what it's what they put the end of film saying it's not called stealing it's calling sharing best practice okay best practice but what it should be no is mortars bad and illegal and if you wouldn't like it if something to use for please don't do it ten tails

however if you do please don't blame us yeah don't reference our talks so who are these two [ __ ] eejits so go Brian yeah hello my name out there I've got this probably my name is Brian hey that's a am I still on camera though they said stand next to you best way which is not great for my olfactory senses quite frankly thank God you didn't wear the pornhub t-shirt cuz that thing hasn't seen a washing machine since 2014 my eyes right against this is tweet that was made about me a couple of years ago so I used to work for the National Crime Agency down in lung and I used to work in the National Cyber Crime

Unit and my job was cyber crime prevention as anyone in the room ever been served with a cease and desist notice you don't have to yes knows that my idea sorry but they're not legally by so you're fine and they don't show up on your TV clear and silent you're mine didn't so last year before last I was speaking because people actually let me do this for a living is it last year awesome see short-term memory loss early onset Alzheimer's and all the other gear I was I did a talk and then a panel discussion at the institution of civil engineers in Parliament Square in London all about how has any engineers in the room they've got this thing called

building information modeling which is basically a bucket of data that everyone can look at from the CEO to the guys empties the bins and there's no perimeter security and there's no privileged access control so it's really quite shonky and some idiot a couple of years ago they did a BIM for the new build of Victoria cheap station in London there anyone I know I'm wary anyway someone in the government decided in the interest of transparency to put it on the Internet and now there's an office off GCHQ right outside there which is completely vulnerable because you can look at the schematics for their entire building on the internet anyway look it up it's true so I was there that

the institution of civil engineers and someone in the audience asked me why can't we just apply health and safety legislation to the Internet to make it safer because it works everywhere else right health and safety and I said well actually the reason we've got such great health and safety legislation in the UK is because lots of people kept getting killed at work hence murder by internet and I said the only way we're going to make the internet safe is if it starts killing people in large numbers and they tweeted it there's my favorite tweet about me I'm at Brian cyber by the way if anyone wants to follow me I wouldn't recommend it so then I started chatting to him

because I met him about six years ago at a cyber boot camp at Glasgow Callie was running and we started talking about the Internet of death and that's how this was born without discussing killing yeah so if you want to click through the next five slides will say so the reason I got into this is because and also I'm a magistrate in the England I'm a justice of the peace I'm a good person I've never been click on I've never been convicted of a crime I've never done anything bad I've never gotten into any kind of nefarious activity whatsoever I'm a nice person but I do know a bit about murder so here I am one of the two precise my

best one I've still got the same hair yes a real gun no bullets by the way got permission from the Metropolitan Police to do that so I've got a bit of skin in the murder game but I haven't actually ever murdered anyone that I'm aware of so that's me one half of the presenting team for the Internet of death and now I'm always interesting but very ginger I'm very injure if I can't say don't burn like a [ __ ] but yeah so I'm not a murderer can't prevent them the gatech did you did I tell anyone that I bought a blue car does anyone follow me on Twitter does anyone seen the pictures of purple cars great I've been in it

it's very blue and I saw I'm just gonna leave now guys it's not right so this is the top line this this is the plan so let's talk if we've been this talk two years ago when Brian and I were sitting having lunch in Sardis which is a lovely Italian place would highly recommend it and we were we were sitting chatting to a man or something about [ __ ] even havens works in police and then we were trying about killing people and stuff of that not yet this sounds really bad but yeah we're talking about that and we went right we need their confidence talk because there was lots of confidence having the time be said in Romans coming

up so this was just oh this must all be almost be three years ago no Brenda vote December time [ __ ] it the internet a day that's a good title this is how I do talks I can't the table and then have no idea what I'm going to see come conference time and still have no idea what I'm going to see and we're into the common top so I went on Google and I looked up how do you kill someone wouldn't recommend it i yet wouldn't recommend it it's a there's some great BuzzFeed articles on it but yeah so recipe for a murder is a stage one but sort of stay zero which is you need

motivation method and opportunity to commit murder which we'll talk about a second the next stage yeah that was fine he's got ginger hair that's the least visited rabble injured I am I think I find I need a thinker and you're the enforcers and taxi driver sitting on a green t-shirt green orange bat anyway right so then we pecking our target we were going to murder some in the room but then we thought might go down oh I'm contemplating actually now easy I don't know stays here so we have a willing volunteer so we have packing our target and then we profile them so most people in pentesting will have heard of open source intelligence most people

police force will parrot of open source intelligence that's how we're gonna profile someone they're going to be Joe Bloggs do some bits pieces let me pick a location because you can't just murder anyone anywhere but you can but you start need to be near the internet so why five every Starbucks let me actually do the deed like killing the person we're not going to kill someone hopefully and and then we have kind of the aftermath which is probably that the longest part of the the kind of the month or is that where that people don't plan covering your tracks because you see it breaking bad did big Tom from an acid but then you don't think about

right okay you're buying the acid so you're getting proof oh oh yeah okay well thanks dude I'll ruin the plot for any other TV series it's no problem so yeah you've got covering your tracks and then you put destroying evidence which sort of falls under put in the body an acid or and we had a long conversation if you made some rain about how to join a bodies yeah yeah okay yeah with my microphone so I spoke to forensic pathologist a few years ago don't walk across and apparently oh my gosh they're filming they something apparently the best way to a murder somebody is to inject them with poison into the ring of their backside because pathologists

never look in there and it's a tiny needle point thing and B you wrap them in Hessian sacks and garden twine and then dump them in the deepest lake you can find because by the time the Hessian has eroded in the water and dissolved and the garden twine is made of copper that eventually dissolves by the time that's all gone in the water there's nothing left but bones and they sink so if you want to discern more murder technically not Internet related if you want to dispose of a body that's apparently from a forensic pathologist the best way to do it you could you could buy you could buy the the poison on the dark web you could buy the garden

twine from being cue yeah that's technically internet-enabled isn't it quite frankly running out of time and I'm 50 in October right so recipe for a modular we've got motivation method and opportunity so you need to have unibeam or via to kill someone you can't just kind of walk out unless you're a psychopath you can't just walk out stops on the street we are in Glasgow but generally you're not going to go and like [ __ ] I'm gonna kill someone - do you need to have more patience you need to be angry enough or jealous enough or mental enough or sad enough or Scottish it off I'm not going to generalize here you need to have a method as well so the

kind of underlying theme of this talk is the internet but they don't know it's [ __ ] huge it covers everything so we were yet speak we relate the technology so yeah opportunities kind of you pick your time maybe in the middle of night maybe frosting the model it might be when they go to Starbucks maybe when but at work we'll cover that later on other coffee chains are available okay they make me a call me this coffee was great yeah we're not getting sponsored by Starbucks either I might be wearing a green t-shirt but nothing to stop us so planning the devil was in the details when it comes to planning what much like

when it comes to pen testing or red teaming so imagine a martyr like a red team you do that do you do the open source intelligence gathering you find that with a person lives you find it with a work friend of your kids go to school and this is getting to the dark really quickly they're not find this but so you do all that you find out what they do for a job maybe they walk around like like industrial control systems or heavy machinery or I don't know or they make this a we said we weren't gonna mention sex stuff okay or they might have a fetish for an electric nipple claps who knows so we're looking to you

then looking third the person life and what they want we won't tell them that last thing oh [ __ ] this is skinned record anyway

yeah yes so yeah you get it you get your SN you find out all the things about them then you need to plan the whole process what what people when they're murdering someone off to think about as they go yep gonna kill someone they never really planned the aftermath where people are looking for you they're looking for the body they're looking for how is done kind of chain of evidence all that sort of stuff so you need to plan it out know if anyone does go and kill someone please don't blame me cause I'll tell you how to do it just just clarification and see you get all your things together you get your tools you get your your location

you've got the aftermaths you burn the body you drove an acid dump it in the sea whatever you want to do without you or a coke in a week in the clay dry not many bodies in there that's not a river [ __ ] it and and then you can have a build process you then build your alibi so you've been you can ask what were you doing at 3:00 in the morning the code you have was a jet ski yeah okay maybe I've not got the best I'll avoid I'm not gonna kill someone that's probably not the best they do anyway so so then we get to profiling our target these were meant to be like

transparent characters I should clarify and are racist is they're not killing people so yeah we pick a habit of a target so we go and find out maybe they've got idea we've seen maybe they're like me in every lunchtime there goes a coffee shop so you know they're going to be there at that certain time they're gonna be there for an hour so or maybe that they really think the the commute to watch so they leave the house eight for every morning or like I was late whatever or maybe they do things in their spare time maybe maybe they go to strip clubs or I don't know why this yeah running running things stop pacing

maybe the wastegate there anyway so you Peck Adele the things that the defining of the person and you could play on to kill so once we get once we sort of have an idea we pick a location for the month or so when it comes to internet internet able things there's maybe two mean locations you've got your house and probably got where you work so home related stuff I'm fine just it's just the boring bit he's got low self-esteem is all okay yes would be didn't have yes now yes you pick you pick where the kind of the mean of use case would be so home a lot of people have got enabled posters no got

like light bulbs you feel biases you've got control systems to your house you get smart locks you get smart washing machines you name it there's probably some smart content you name it Ken's probably hacked at some point so you've got that then you get to deal with a tendency may be it may be they go to a coffee shop and maybe that coffee shop uses smart coughing shoes look you thought of that maybe that you can kill them if they're smart formidable you can you can plan they're going to be location that sort of thing so once we've got a sort of plan together we actually do the deed so we use the different appliances of the house we we

we find out in their house they've got a smart gas fire because somebody thought it was a good idea and we we set we set the gas on we leave the gas ruin all day typical leave it all day and then with it when they get home you'd make a switch dead quite on the host thing great that's one method or if they've really by the epsy you set the lights to flash really quickly several things a second that I can kill you with a pork chop but it's kind of dependent on you not being Jewish that's yeah cuz I freeze holiday and then refreeze it and then when you ate the pork chops a

diet that's not in the quiz though we don't advocate murder under any circumstances neither do our sponsors or our employers which I don't have one over the moment so feel free to offer me a job anybody crack on every opportunity you get you're just ask for a sharpening you need a job yes so home appliances have you get fired just a quick you didn't kill anyone no no I didn't either yes if you get smart devices you get smart phones internet all the things something suggestive last night why can't you just order a hit man on the dark web and get them to kill someone's like oh yeah that's technically using internet but it's not to the methods

that we are hoping to achieve yeah yeah you want it you want to be smart but these things and play about them so then you pick maybe piece of work maybe maybe they work in a hospital maybe that posture uses smart devices like maybe they're bit smart x-ray machines or something this isn't in your quiz if I ruin your question medical stuff and maybe maybe they work in national infrastructures this industrial control systems that you can really hack using shorter and we'll find out that the use they're not water valve or something turn the oil profit and the work that way and they're dead then you get random other [ __ ] so like nobody's just about anything to connect

their net so if you're working in a place of work like my one of my powers is a tattooist and you can get IOT tattoo guns because that was a good idea I actually came up with a plan last year for an exercise for the government to train people in cybersecurity where I was gonna murder Clare Balding anyone a fan of Clare Balding she's not here is she because she heard about this and she's got really upset basically we were going to infiltrate the AV network at the BBC know the BT sport studios at the Olympic Park where I live in London and while she was doing a live piece to camera we were going to manipulate the

sound waves in her earpiece and blow her head up like on scanners she wasn't best pleased but it's that I think still doable the science is good anyway so we've got that way we kill the person so so we've got a target we'd killed them oops no no we have the thankful so now we've got the kind of rate we need tip me to cover our tracks so they're kind of final stats we take we did destroy our evidence me to sort of build an alibi why we were hanging about as a Starbucks or coaster or console or whatever it feel modern or McDonald's or Burger King I like a Burger King KFC or Nando's or

whatever while you're hanging of it wherever you were at 3:00 in the morning now you need to sort of get away with it or try and get away with it and then you need think who I'm going to kill next what's the aftermath so destroying the evidence when it comes to destroying the evidence you want to kind of augment the chain of evidence the chain of custody the forensic process so take a laptop or whatever you've used to hack into what you're going to do and you destroy it wouldn't recommend thermite doesn't work I haven't tried it personally but there's a great talk on it was a DEFCON 13 or something a guy called Zedd talked about harddrive

destruction and all the various ways you can destroy a hard life that don't work I would highly recommend you check it out and I'll put on Twitter later on and so destroy your machine and the the best way of doing it is using like magnesium or something so you can buy that their net use that to destroy your laptop's fight and then you want to kind of start to letter your your your path with random [ __ ] so so that you're not getting straight and straight out your good little bits here and there they can I throw the police off obfuscation that's the one obfuscation it's too early in the morning for big words so

yeah you throw off the scent you throw thought the kind of the path that the police are taking I just stop [ __ ] about with them so like if you've murdered someone at three they want to start going out at random times a day so that if they've got something said that said your house you're fine if you're getting profile for a government clearance probably do it as well because you've done deviate somewhat yeah so throw it through off em I say so ever so then they you need to build your alibi so this sort of falls under the prerequisites like I just discussed previously it's it's you need to plan it before you do it so you see it's all

fine and well going right q I'm going to kill Brian tomorrow but then if you don't plan what you do the next day or the next day or the next day yeah it gets a bit can get a bit kind of tight and awkward sometimes okay this is these are the last sort of slates and then you have the gateway so where do you go from here once you've killed someone once you've dissolved the body head the body covered your tracks did you go and fly another modular if you go and move the site first you go and do something else other countries are available do you move to Vegas you Peck we're gonna do

and then you just go with it and run and that that's that's how you cancel no we've brined excellent there's some stuff the kind of the underlying point here is a little bit serious in that we all work in InfoSec or whatever else you would call our profession what don't walk across I'm covering up your logo because Ken won't give me a job um with my ass we're kind of the gatekeepers of the digital world because we work in InfoSec cybersecurity whatever name you want to give it and very seriously don't wanna be a buzzkill it will get funnier in a second the skills that you need you were marred iam using its points I thought but I was

mostly laughing at you ginger hair the skills you need to plan effectively conduct and then escape from a murder or some of the skills that you actually need to protect the digital estate as well so as randy has said a lot of the skills that you need to kill people with the Internet are the skills you need to help to defend the Internet as well so hopefully you'll take something away from this in that you need to be a little bit more outward thinking about your approach to whatever your day job is whether it be pen testing or Intel gathering or whatever but now in order to demonstrate the reason why this is becoming an issue and the people can be

murdered with the internet we're gonna have a little bit of an audience participation exercise because I've written a game show called the Internet of death you like to load up the slide please mr. whatever-your-name-is right so here we go yeah it's definitely not gone right so there are four rounds of this quiz but we've ditched the SEC's round because Ken's on later and he's going to talk about sex and I didn't want to steal his thunder so we've only got three rounds so I'm gonna need three people I have picked who I want to do it already and so what we've got here say for example the medical round there are five examples of how medical technology

connected to the Internet may potentially be used to murder somebody and one of them's actually true and the other ones I just made up an hour ago before you came into the room so come on you can come and play the first round so roll applause for our willing victim now you just got basically pick a number from one to five then you can help what number should he pick audience shout five right pick number five clicked once number five please in round one right then so my granny went to hospital and somebody hacked the network and upped the morphine drip into her arm and killed the old bird stone-dead do you think that's true or I made it up it's

true of I made it up it's true do you think it's true so you click the answer button please no it's fake right now click back to main board pick another number what about number three did someone say pick number three see where I'm going with this right right always another one yes oh my granny before she actually died from the morphine drip she was in a hospital bed someone hacked into the smart bed and started waggling her leg up and down like that until she died of a deep vein thrombosis did you think that's true anyone it's a true is it fake lies Oh Santa please Andy yes it's fake let's go back right all

right number four anyone number four they saw a guy number four comma right then I can't remember what I said about this one yeah yeah so someone's hacked the traffic management radio system in the ambulance service and made them all line up outside the hospital so no one was picking up any patients for dropping them off that's fake or true fake fake or true fake well it's kind of true because the NHS did it to themselves the other day but actually it's fake where I go back to the main board now what about number one let's look at number one everyone looks good right yeah so number one they've got yeah they've got a robot

doctors in America apparently one went rogue last year because the robot doctor with his artificial intelligence have been told to cure cancer and the robot doctors approach was to kill all the humans because they're the only ones that have cancer hair for curing cancer right - or fake fake giving it's true or fake someone said true it's real fake Andy it's fake as well eyes go back to number two kind of giving away the game here right brain implants apparently if you've got a brain implant that it's wirelessly enabled it can be manipulated into causing you to kill yourself or other people true or fake true it's the last one so kind of yes Andy

absolutely true last week in the register Belgian scientists said they could manipulate a wirelessly enabled brain implant and make you kill yourself or someone else anyone got a brain implant no I mean yes are you scratching your head sorry oh because that's where the implant is right well your round of applause for this idiot there you go game is a prize right now I need someone it where's Thomas Thomas come and play round two ran applause for Thomas my friend Thomas right round two is all based on terrorism all right let's just go one two five because I basically lost interest by this point what's number one driving so you can hack into military drones and make them

land on people's heads and kill them anyone think that's true is it true is it true and II know it's fake I saw it in a film number two what are you doing no what's number two in terrorism yeah so actually this right I'll go into trouble for this one do you any one know what universal credit is judging by the dress code today I'm assuming quite a lot of you I cracked that joke before so I was on a security event at BT Centre in London and the guy after me was here and Martin does anyone know who he is yeah he's the director of the national cybersecurity Center at GCHQ and someone asked me whilst I was standing here

doing this basically but without sunglasses if I was going to launch a terrorist attack against the UK what would I do and I said I'd hacking to universal credit and cut people's benefits off because I'm a magistrate I used to take people's benefits away if they haven't paid their council tax and it's the most thing that causes the most pain and the most anguish and those angering people is to stop them getting their benefits so if you turned off universal credit there'd be a riot ten times the size of Duggan in about 10 minutes so is that you know is that true or do I make it up what's the answer yeah I think it's fake

he thinks it's fake you think it's fake yeah it is very curry up come on yes fake next one what's number three terrorism warships right I didn't exercise at the British military tournament the very last one they ever had at I was caught where we had a scenario where some people had infiltrated the GPS network of an ocean-going vessel and basically the captain thought he was at sea in open water but he was actually 5 foot away from the coast of Somalia and then loads of pirates got on board and killed him do you think that's true or fake that's possibly true possibly true anyone what up this morning quick click the button comedy timing kill Christ number four

we're nearly there right there's only one more round and it's not about sex right GM foods who thinks that terrorist could infiltrate the food network and they do a lot of this in America where they're growing corn and stuff and put things into our food chain that might kill us all do you think that's true yeah fake fake you think it's fake fake its fake quick what's number five could it be true that's the water filtration plant who thinks terrorists might have infiltrated the SCADA Network of one of these things potentially in the middle of a Syrian civil war killing loads of people because they up the chlorine content of the water so no one could

drink it any one thing let's treat quick what's the quiet the answer this trailer was in the register so it must be true ten minutes give me a break Thank You Thomas Iran applause right round three we're nearly finished actual ways you can use the internet to kill people so now round three is not sex because we ditched it and but I don't know the slides didn't work so it's actually services so the services that we all use so where's my final vana play services come on there will be a prize but I haven't got to the shops yet round of applause for player three Rylan so these are things that I think you could use the internet to kill people

with so number one Andy please what's number one no no no in the other bit there right that's traffic management systems right so if you hacked into the office where they run the traffic lights and the roundabouts and stuff and then you turn them all red or green and people crash all their cars do you think that's true or fake fake anyone else yes it is I saw it on diehard 4.0 Thank You number two there's a theme here number two power stations right do you think hackers could get into terror it people get into the power stations to turn off the electricity and the gas true or fake fake everyone yes they have support here is it fair yes that was on

daya 4.0 as well number three banking you think people could get into the banking system and make sure there's no money coming out of the ATM one thing is fake is it fake yeah that was on diehard 4.0 as well number four do you think people would hack into like the airports and peas and making sure that the like the traffic air traffic control couldn't make the planes land or take off and stuff fake everyone think it's fake yes come on I'm not feeling the love here yes it is fake that was in all the diehards I think that last one a car wash right where your dad takes the car to and then he took his to one the other day it's

very blue it's even more balloon Abby's cleaned it do you think people could get into the computers that control the carwash and make the carwash kill people too or fake you think it's true it's absolutely true what's the answer how many yeses on the register as well people can kill you in the carwash well done thank you very much of an applause I'll get you a prize later that ladies and gentlemen that's the Internet of death version 1.0 chapter 1 there's more to come when we actually get off [ __ ] together but the concept I think is a valid one in that eventually the internet will be used to kill people in larger numbers than it already is we've

demonstrated real ways you can do it the science is valid I don't know if people have actually dead yet exactly so please don't tell everyone we told you how to get away with it but bear in mind that the Internet is a tool of homicide should it be needed and on behalf of Andy and myself thank you for listening hope we were on time questions that we got any don't god really what on earth do you want to ask about that how are we for time are we done I don't know well if you've got questions we'll be outside later because we're the first up so we're done now we can basically kick butt oh [ __ ] we didn't do that one

yeah we had some applause slides as well but just applaud us now come on awesome thanks very much [Applause]