Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2568 Thanks!
[Music]
so welcome everybody uh this is my first
time at CCC camp is it someone else's
first time as
well
yeah good for us
newcomers H I thought uh this topic uh
is kind of good for this camp and I also
uh have a video next which has music at
least that is good for this camp and
it's kind of relevant to the topic so I
thought I would play it let's see if uh
we can get it to play hopefully the
Wi-Fi works and we can get it to play
it's essentially uh a very old ad that
very old people like me and others who
are old like me will recognize so let's
see do we get
sound we got sound when we tested
but it's the you wouldn't steal a car
the Privacy campaign you wouldn't steal
a bike you wouldn't steal the purse you
wouldn't do that and that it had really
good music so too bad it's if someone
can do some beat boxing right now that
would have be
helpful
and was that a pig beat
boxing nice try anyway
so uh since we're talk talking about
ethics uh this whole campaign was
essentially about not stealing a car and
like privacy is a crime but then someone
on the internet was like well I would
maybe download a car if the owner could
keep the car so that would be kind of
ethical and that would be kind of okay I
guess um how many here would download a
car yeah uh quite a
few
uh okay so to get started on this topic
of Ethics uh hackers uh kind of work in
sometimes in PEC peculiar domains so
sometimes we're you know going on the
boundaries of Law and and so forth so I
thought I would take you through my
short version of the evolution of the
hacker ethics as you would know it and
this goes back even before my time uh it
was like in the' 60s 7s when computers
started being more uh common hackers
would essentially be uh doing all kinds
of things on these computers that were
not really accessible to everyone yet
and they kind of went through this uh
stage where they had this the hacker
ethic there was a guy who wrote a book
and uh Richard stman which is uh
considered the last true hacker uh said
uh about ethics in that book like this
that the hacker ethic refers to the
feelings of right and wrong to the
ethical ideas this community of people
had that knowledge should be shared with
other people who can benefit from it and
that important resources should be
utilized rather than wasted and I think
probably quite a few of us can stand
behind that
statement uh also the hacker ethic uh
can kind of be summarized in into uh in
that era uh exceptional
single-mindedness and determination to
keep plugging away at a problem until
the optimal solution had been found are
well-documented traits of the early
hackers willingness to work right
through the night on a single
programming problem are widely cited as
features of the early hacker computer
culture who here has spent an entire
night figuring out a
problem okay quite a few so you can also
consider yourself you know uh early
hackers in a
way uh and then when we go a bit further
maybe to the 80s things started shifting
there started to be sort of more it
start the ethics started dwindling maybe
a little bit more there was some white
hat black hat stuff going on in the '90s
as well there started to be a little bit
more of a divide uh and people started
going to to jail for doing criminal
stuff so black hats and there started to
be more like a divide of white hats and
black hats and the hacker Manifesto was
written by a guy called the
mentor and essentially
his uh statement in that uh Manifesto is
that this is our world now the world of
the electron and the switch the beauty
of the board we make use of service
already existing without paying for what
could be Dirt Cheap if it wasn't run by
profiteering Glutton and you call us
criminals we explore and you call us
criminals we seek after knowledge and
you call us criminals so it's more like
a activism kind of freedom to all
information and all data kind of
era and then uh to kind of sum up the or
to get back more to today today we have
sort of we don't really have these
clear-cut maybe books well we do have
some books but uh at least for me
working in this industry I don't really
come across that many
ethical uh sort of statements and and
things like that some of them we might
see in ethical hacking certificates but
they're very sort of rudimentary like
don't test without permission don't be a
[ __ ] you know don't break [ __ ] and
steal stuff and so forth and those are
kind of okay but it I feel like there
should be maybe a little bit
more and some of the bug Bounty
platforms uh because I work with bug
Bounty as well some of the bug Bounty
platforms have these kind of code of
conduct so they have like you know you
shouldn't do this you shouldn't do that
that you know respect others you know
and and things like that and don't go
out of scope uh and scope is kind of the
limitation where companies in bug Bounty
programs they say you can test this but
don't test this and then someone goes
and test this and then what should
happen sometimes not
much so this was kind of the super quick
uh background of hacker ethic
and what really got me into this talk
was the kind of the things that I've
seen recently that made me think okay
maybe we should have even more
discussions about ethics uh when it
comes to security testing and especially
in the bug Bounty space where I work a
lot and if you're not aware of bug
Bounty it's essentially security testing
uh for a reward so you do some testing
and you send in a report through usually
a bu Bounty platform and the company
will pay a reward based on how severe
the issue
is and some of the things that I've seen
will kind of touch upon both security
testing and the bug Bounty area uh
because that's what I know so probably
there's much more uh sort of things that
go on but these are the things that I
thought I would share with you because
it might not be that well known some of
them at least but we'll start with the
really simple ones you're testing with
permission and then you bring down some
servers it's probably happened to a few
maybe here does it has it happened to
any of
you yeah okay a couple I see my
colleagues over there as
well uh we've done this unfortunately
quite a few times and it really boils
down to maybe we should have do done
more due diligence maybe the computers
that we were testing were in a broom
closet somewhere or was it like a
Raspberry Pi that really couldn't handle
many requests so it just cannot handle
anything automated and it just dies so
we're not really doing a service for the
customer or the individual that we're
testing and probably not anyone else and
it's not really nice getting a call from
the client saying ah you brought our
servers down what are you doing stop
doing whatever you're doing it's not
cool our production is down and then you
find out their production is running on
potatoes so that's also a good finding
in
itself all right so now for the more
gray area of uh the things that I have
seen
recently someone popped the champagne
and that's
great and I have introduced this
arbitrary Gandalf the grayscale some of
of you might not see it but there's uh
depending on how gray I believe it would
be there's a number of Gandalf in there
to represent how
gray this uh thing might be
so let's get started with uh the first
one so the first one kind of goes from
the first example we had testing without
permission and then bringing down
servers for example I would give it
maybe like one Gandalf I mean it's kind
of like yeah and in some cases it's
maybe not that legal as well in some
countries you know you're not really
allowed to test without permission
so I'll give it one Gandalf
maybe then the other one is stumbling
across a vulnerability without
permission but then you kind of notify
the target company through for example
your local CT and the local CT in many
of our European countries especially
protect the hacker from the company if
they want to pursue to you as a as a
hacker so they protect you uh as an
individual as well so you don't get
pursued because it's a CT contact in the
company I'll give this maybe like a one
Gandalf maybe not even a single Gandalf
maybe a hobbit I don't
know um and then we have uh this really
awesome thing uh testing without
permission and then blackmailing the
target reward me or
else something will happen someone will
hack you it's not me but here's my full
name
and a lot of times uh we've seen these
types of individuals contact companies
directly and saying like they have a
terrible vulnerability and it's really
critical and you need to pay me right
away and and then when you start asking
okay what is this vulnerability actually
and then it's like okay well you have a
file that shouldn't be there or you know
it could be really almost nothing and
they want a reward for it sometimes it
could actually be something but uh you
don't really know until you get into
this super annoying conversation and
usually it's almost like spam or like a
scam where they really like try to get
you they might send the CEO of the
company this email and they scramble all
the Jets like whoa something is going on
and it's not really good for business
either so it's quite erupting as
well so you're not really benefiting
anyone I would say I'll give it one
maybe two
gandal uh and then there's a new really
cool uh Trend marketing Trend where you
test without permission with your super
awesome service that finds
vulnerabilities and then you send a
email to the company saying my super
cool service found hundreds of
vulnerabilities in your company
let's meet up and have an online meeting
and
talk so they're trying to sell it to you
and it's
usually like there's a different scale
of how aggressive they are some of them
are very aggressive some of them might
for example contact everyone in the
organization to try and sell this
service that they have uh we've seen it
it's really cool and it really doesn't
get you any sales at least if you
contact us um but for some it might work
I would give this maybe one Gandalf two
Gandalf depending on how aggressive it
is and then uh another really nice Trend
that we have seen recently is that you
purchase stolen credentials of the dark
web and then you ask the company to give
you an award so they submitt it to a bug
Bounty program so maybe they found the
credentials of one of your employees
maybe it's an the admin and then they
submit it to a bug Bounty program in
hopes for a reward
and they in their submission they say I
purchased these off the dark
web okay well you know if if you're a
company it's like if you say that we
can't really you know reward you because
that's not legal to buy stolen stuff so
as nor Well normally companies can't do
it some do it anyway and some some have
been known to pay for them as well uh I
know some I'm not going to name names
but there's it has been happening and
the rewards have in sometimes been
pretty substantial I'll give it maybe
three gandal uh maybe four um one of the
issues that I see with this is obviously
there's a meme if you can't see it it
says the secret ingredient is crime so
if you're not not very good at hacking
maybe you can go to the dark web and do
this um but one of the issues that I see
with this is that there's a sort of
basic thing with like how markets work
in general so if you let's say everyone
starts doing it because it's it's very
profitable then we have a huge demand
for stolen credentials right coming in
all the ethical hackers of the world
want to buy stolen credentials and then
the criminals are going like oh [ __ ] we
have a huge demand what should we do all
right let's increase the criminal
activity so we can get some more Supply
and then the supply and demand cycle
just it just starts
going
and yeah I don't know it's uh it's kind
of it's kind of a bit of a problem I
would say uh to do this um maybe later
some of you can discuss how ethical it
really is and is it really ethical
hacker kind of thing to
do then to take this a bit
further is maybe I don't know if you
know but there are services that you can
subscribe
to where you can purchase stolen
credentials of the dark
web oh sorry the the service purchases
the credentials for you from the dark
web so it's kind of like a net Netflix
of crime you know
so it's like okay uh I'll just subscribe
to this service and I'll get all the
stolen credentials and so I don't know
maybe what if you had a Netflix for like
stolen
cars could you would you sub subscribe
to that I don't know but uh this is kind
of it's I mean it gets a little bit more
difficult because now you're just you're
not buying the credentials yourself but
you have a proxy that's buying them and
you're subscribing to the service and
there's multiple services like this um
probably some of you know if you want to
use them don't ask
me um but yeah I would give this maybe
three
gandal um on the gray
scale and of course they when they do
both these things they submit them to
companies running bug Bounty programs in
hopes of
Rewards so yeah that's
great and I kind of like to always take
a step forward and go in further so what
if you exploit the Netflix of crime to
get those credentials and then submit
that to a bug Mony programm in hopes for
a
reward uh I give it maybe five gandal
cuz it kind of kind of goes
like even further so you're doing a
crime on a service that is doing well
buying stolen stuff and selling that as
a
subscription I would give it maybe five
gandal what do you think yeah maybe my
enemy is my
friend the enemy of my enemy is my
friend yeah maybe keep your enemies
close I guess
yeah um then I saw new
trend uh popping up lately we've all
known of credential stuffing in general
as a attack uh used by criminals but
ethical hackers uh in the bug Bounty uh
scene have started using it as well so
they take leaked credentials off the web
and then they try it on everything and
if it works then they submit a report to
the company in hopes for for a
reward and
I don't
know maybe not that gray but should you
really usually in the policies of of
these bug Bounty programs they kind of
say like you're not maybe allowed to do
this kind of things maybe you're not
allowed to get credentials for certain
things but then if you take it from some
leaked dumps online and you use that and
check if they work H maybe I don't know
could be a little grayish
uh maybe I'll give it maybe four three
gands
maybe but then there's uh
purchasing stolen credentials of the
dark web and using those for credential
stuffing so it goes again a step further
I wonder what the next step after this
would be but I guess we'll find out
pretty soon but I would give this maybe
five Gandalf because let's say uh
ethical hacker purchases credentials of
your
company uh online then they take those
credentials they don't give it to you
yet they're just going to test if it
works
everywhere and then if it works which it
might then after that and after gaining
access to a certain system maybe it's
really bad right they go into that
system and then they also check what
their what they can access in that
system of course you know
so it kind of
goes maybe a smidge too far in some
cases I would say I would give it five
gandal
maybe so uh just to kind of because
there was some secret ingredients uh in
this presentation and a lot of them had
to do with crime uh I was thinking that
I would kind of just quickly go through
through the legals of Finland because
I'm from Finland so uh if you purchase
stolen goods uh regardless of how much
it costs uh you can get up to one year
and 6 months of jail time and in Germany
you get 5 years or a
fine
chairman like
what or a f like what does it depend on
I don't know but maybe you guys probably
know what it depends on but the judge
the judge okay so if you're good buddies
with the judge you only get a fine yeah
probably it's also depending on how
severe it is and so forth in Canada and
us if the values exceed over
$5,000 so let's say I run a bug Bounty
program someone uh gives they've bought
uh stolen credentials they want me to
give them a reward I'm a US company I
give them a reward over $5,000 I've
committed a federal
crime
this may or may not happen have happened
I may or may not know and I may or may
not say anything uh in Canada you can
get up to 10 years uh in
prison yes so the purchase of stolen
goods is kind of the key wording there
if you purchase stolen goods it doesn't
matter if you purchase it from that guy
or that guy maybe that guy stole it but
he sold it to that guy and then he sells
it to you it's still stolen
goods yeah there is some uh differences
if it's your
own um but it depends on the legal I'm
not a lawyer so maybe consult a lawyer
don't listen to me regarding legal stuff
or well the basics you should know that
it could be a
crime okay
uh and I think at this Camp I already
saw an Italian lawyer uh on stage at one
of the lightning talks so he probably
knows uh a bit more than me about the
legal stuff but uh since some of this is
like a little bit gray area uh or maybe
not uh and some of it might be criminal
or maybe not I'm not sure uh
but what I'm thinking is that also
because maybe some of these stolen uh
Goods or like sto on credentials they're
too accessible maybe that's also a part
of the issue like you can just subscribe
to this Netflix of crime and like get
your crime feed uh into your inbox so
maybe that's part of the problem I'm not
sure um it's not that difficult to go on
the dark web and buy credentials stolen
credentials um or stolen anything really
maybe it's just too accessible so maybe
in some cases for example the ethical
hackers that are doing it maybe maybe
they they're not just thinking too much
about the ethics of it all um they're
just doing it because there's a re
reward at the
end uh another kind of issue that we've
seen uh in The Bu bug Bounty scene
especially is that you hold on to
vulnerabilities in the pursuit of
rewards uh so essentially you have maybe
a cool vulnerability that you've
discovered yourself you're not going to
share it because then others might use
it to get rewards so you want to make
sure that you've collected all the
rewards from all the different
companies um and I'm not sure how
ethical that is um I forgot to put the
Gandalf here but maybe a couple of
gandal uh on that one um essentially the
hacker ethics from the like the early
days at least was to be open and share
uh and I personally I believe in that
being a good thing uh but I can also
understand why they would want to hold
on to certain types of vulnerabilities
if it's in their in their own benefit
obviously everyone has hungry mouths to
feed including their
own uh another issue that I've seen uh
also is it kind of goes into the ethics
uh of bug Bounty as well is that um in a
lot of cases the bug Bounty programs
they Define a policy you're allowed to
do this and that and go so and so far
but the company themselves for example
they pay the researcher or the hacker
the ethical hacker based on the impact
of the finding so in some cases um even
if you have these sort of uh arbitrary
limitations from policy the hackers
might have an in incentive to actually
go further to increase the impact of
their reward uh of the uh impact of the
vulnerability so they can get a higher
reward so there's kind of like a dilemma
uh in this issue because it's like in
theory you shouldn't but if you do you
might get a higher reward so maybe you
should but should you really and it it
really kind of plays back into the
ethical
um boundaries of that particular hacker
how far will they go and we've seen
cases of uh ethical hackers dumping
databases uh and going even further
so I don't know how many
gandal this one should be but maybe both
the hacker and the company should get a
few gandol for this
one and then of course there's uh secret
techniques or open
sharing some prefer to have their secret
Tech techniques and keep them to
themselves uh because there's more
rewards for them and some prefer to
share
everything and I guess one of the
reasons I wanted to talk at this Camp
about these issues as well is that
there's probably a lot of you that also
are interested in discussing in these
things and seeing where they should go
and I don't know in my opinion it would
be better if everyone would share but
some people prefer to keep some
techniques to
themselves so what is then actually
ethical hacking I mean there are some
boundaries some of them are legal but
some of them even the legal B like the
legal boundaries are not that well known
there might be also different types of
boundaries depending on the country that
the company is in and also where the
hacker is in so it might be difficult to
sort of set the boundaries even legally
because it depends
sometimes so what should the boundaries
be and who should Define
them what is ethical hacking how and how
can we as a community proove on on these
issues and I guess the final question
what does your moral compass look like
in which direction does it
Point are you a white hat a black hat or
something in between or a mix of them
all and I guess uh this uh presentation
was a lot faster than I was uh planning
on so if in case you need to find me
later you can find me at the salaki
village in cold
North there's my contact details
and apparently I was too
fast thanks
you it looks like we have about 15
minutes for questions if there are any
are there any questions from the
internet none any questions from the
audience please line up over there by
the microphone thank
you uh hi uh I'm not an expert
whatsoever total new so this question
might be a little bit stupid but uh from
what I understood you considered the
interest of the people being hacked and
the interest of the people who were
hacking uh what about the greater good
like what about people who are not
related to the company not related to
the hacker like everybody does it like
isn't that a very relevant question for
whether it's ethical or not does it
benefit everybody what I'm doing as a
hacker or does it worsen the situation
for everyone is do you yeah I
mean and it also depends does it benefit
everybody or a large amount of people or
a few
people it's it's a difficult question
really to answer I don't really have an
answer I
guess e yeah it's
ethics
any hey uh you focused on the legality a
lot and on you know the let's call it
technical hardcore hacks like but some
of the stuff that you had was with
credentials and just yesterday we had a
cool presentation by Kus I don't know if
he's there um on uh social engineering
and I mean you know the most obvious
kind of social engineering is super
duper direct and then it's it's fair in
your face and okay you've got the
credential that's it but once you go for
the higher value targets usually you
start to build up networks and it's
human level trust that you have to build
with a lot of people to build your
network to actually get at the whale
that you're aiming at and then you
betray those people and that can have
real psychological impact on those
people we had a really cool discussion
after the session yesterday with a bunch
of
friends this is not something I see
discussed a lot in ethical hacking you
know the psychological impact on oh [ __ ]
I trusted that guy so what what are your
thoughts on
that yeah
we that's right betraying trust can be
very detrimental like regarding the
person's mental health and we also see
for example a lot of people that are
victims to cyber crime also they suffer
greatly uh sometimes so in some cases I
think we should maybe have some like
victim
healthare like a cyber crime healthc
care station or something I don't know
uh what that would look like but but
it's it's very difficult for people
mentally especially if they're for
example the entry point to a bigger
event then it's very hard on them once
it Dawns on them uh that this really was
uh serious so yeah there's a lot to to
improve on that area as
well any more
questions maybe just a comment U what
you just talked about is What's called
the second victim in uh safety
Literature Like The Pilot who's like you
know like the plane crashed right every
let's say some people died like it's not
good but it's not really the Pilot's
faults almost never the like very rarely
but they feel really responsible and
sometimes commit acts against themselves
let's just put it that way so actually
in General Security I think would
benefit a lot from safety literature but
that's a different discussion to be
had all
right so there's one more question it
seems re new who does the service is
6.8 Million last year um I work for a
big Enterprise this subscribed it so how
do you feel about that Revenue number
6.8 million Revenue what sry Spy Cloud
uh the service Enterprises subscribe to
to get essentially leaks dumps creds of
their own
info yeah that's one like of the
services that you can subscribe subcrib
to I mean I'm not sure how ethical
there's also other sort of cyber threat
to intelligence uh related companies
that provide uh stolen credentials
Etc it's it's gray
area
yeah I don't know that's I guess one of
the questions I also have like I'm not
sure what's right and what's wrong
so probably more discussions are needed
to find the boundaries and on what's
right and what's
wrong