was hard on a door tied to job
wouter wouter I still open
sleep drunk
I did that internship in curaçao and I
had worked that night and again
to open the paramotor
I think what is this look at what time it is
30 calls missed and then I thought so
is not good this may be possible
do with the joke that yesterday
on
so I open the door
see internship supervisor still enough
people stand and look at him closely and
the only thing they say is tell me that
it is not true wouter and I watched them
and I said yes I am afraid of it
so a few hours later I come
linea recta to the Netherlands and yes thereto
the customs arrived violently perspiring
I stood there nodding knees
you would almost think that this story is about
a drug smuggler goes but goes straight
about nate isacker
luckily I came through that customs
I just got through that
a bit of calm thought you know I did
a means of not being arrested and
go towards the Netherlands between good
sign I think about the kiosk
and I saw this at the kiosk
and there is an atention curaçao thief
blunder credit card information via hepa
front page news here I was
responsible for
think maybe you went from this story
yet about the ethical hacker are anyway
those people who have good intentions
to have
This is true even run something else and
think that we can learn from this
So just a step back in time how
this could have happened
but as I said I was running the internship
there a cat and she is incredibly angry
night shifts and this took place in
the SMS era
so what we did not have yet and I
was a student SMS costs money
so do it for free of course
and was a website happy and the cows
send a free text message
everyone knew that everyone uses them
also a
well at a given time day to so
quite easy as I might be
two text messages concealer so he is mine
Night shift is a bit of a look with
peeling and yes I am unlimited
texting
then I thought after this I must reported
neatly with that telecom society
I do not email them where I am
wouter i have done this and this and
maybe I can help you
did not get back a few days later
wouter top thank you okay
then I have nothing more from them
still heard that boring
night shifts
night after a short look through
some security songs in your bowl
you could not text certain numbers
so that’s what I at a given moment
to myself then I thought again must
will contact you because it is
just really not good
zurg lee mild so there is now also this
security around this does not seem right to me
wouter thank you exactly the same and me
heard nothing for weeks again so I thought about it
it will not take me seriously if it takes me
maybe a couple nothing worse
I think it is
Well, you know what it is like when you do that
age is also young and you think
of course not about that
consequences then you actually feel
a bit like putting superpower like
I looked had the idea that I was just like that
behind the computer was certainly also proud
my friends to say ah telecom
SMSing society and that’s what it’s all about
beach I said in theory I can
I also believe that there are number sms messages
the hamam the cuffs do a nice job
joke is pretty fun
so yes and they will not be so bad
find because under as still solved and
of course do not think about the
consequences and nature you started thinking
about what to do in my
stupid message what you can come up with
it has become
that the message has become sms now
credit card details to e-mail address and
in a car and the joke was at least
you can not text to an email address
was the idea
so idea was that people would do something like that
have silly message but
opposite happened people went
send their credit card in bulk
to this email address
What I also created a hole because yes
take a look
so outside that yes that email or that
SMS was sent on behalf of the
telecom company because everyone knew them
people trusted that but I sent
also a lot of text messages to the t
rather telephone traffic was disrupted
so people did not receive the message
times other people could not do anything
more with their phone some people
continued to remain a pique phone but
trailer parts day yes and now also had to
a rectification behind
becoming yes we are not
responsible for
well then it went wrong again because it
network because it just does not work
Well, let’s think about how this is
could have happened
I think there are some important lessons
that we can draw from this
no, I think it is very clear
that I may feel very bad
for humor, first of all
also very striking to see that
people so easily you data out
give hands
I ask for my credit card and nobody
hurry what is what the link is
how speed for being used is still
there are now also movies on youtube that
people just
to ask someone else about that question
just what is your password that someone
says evenings ask strange and does not matter
answer to a sequel and the bit
ask questions and also someone says yes okay
it is the first name of a very good friend
and literally give you your password
and so people just do not really think
like about another lesson
perhaps if the company procedures
had finished or had more serious
taken or even seriousness of the situation
that understood
this did not have to happen if they did
perhaps already the returned from well that
we are now doing this and doing what we think
you like me maybe something
felt important and I might
thinking of looking let us joke
but equally failure
obviously does not speak well I am the one
that joke was carried out and I think
the most important thing we might have here
see from hoof is yes
a stupid student joke
who can have telephone traffic
disrupt so what if someone
we want to leave real evil
look at some examples
2012 and have an anti bag that publishes
a list with so-called ipad addresses
scada systems online
scada systems are system to
to control measuring equipment outside
reading you can think of locks ground
bridges sewerage that kind of business
he does he has found out that
those systems directly to the internet
were linked and often not even one
password earlier so he could just
at the peer panel and locks and ground
to open and sometimes it was waiting
not changed
so one had your admin admin or something
like that many people think
than
so yes that is not good, he thought
so he is going to the national cyber
security center stepped
that is a yes branch of the government
specialized in home gerty
said you two weeks and then
I post everything online
well that he has done completely
anonymously that list came online when
there has been another work there
ethical hacker
who has looked at that list is one
green
him but his way solved that
he himself has birders of locks
determine and who has said
I listen I can leave the broth
to undergo this see well but on such
bear those who say yes I know
how that works so than all
not on the internet how do you get involved
so they break the connection and
dietetic hackers are like he is
not taken seriously it is the name
then that bear calls the still
back to support it until it is full
are really no harm you have quite
much technical knowledge needed for this
because they can control
Okay, but I work with that daily
systems say ethically hacker that what
is that for a nonsense argument
it is not good I can do everything here
I can leave it the other way around
working connection was broken he
think after this I have to do something with you
so that has a light on twitter
I do not hear taken seriously
manage this and that
one today has picked it up
their item is made of room questions
come over and it is in fast shipping
is solved but of course the Netherlands
of course not the first country where this is
naturally does not happen in America
a few years ago someone has left
distance cell door open
exactly in this way the consequences are
can be huge and yes the biggest
enemy of the Netherlands or one of the
biggest enemies is the water
well maybe you think yes to hackers
that is not one of those einzelgängers
corner sitting with a black t-shirt
that mathematical genius that can do everything
but that is not the case
9 out of 10 times or at least not
always nine of ten times
incredibly easy
well in this example of the locks
just like you use google for something
you also have to search for a system
search engine dress on the slide and you see
I search system in Netherlands I
got eight and half million results
then I can also get a lot of junk
properties so I can say now give
me but that
those scada systems and then I can
go see what is wrong with it
so what the heck has anti sec
done is nothing else
way we throw in some search terms and
just look by hand or that bowl
login
that’s all and that can be gigantic
affect
dance it but like this in the evil other
maybe a 13-year-old who comes
fences or natural interests
that stupid student in curaçao can
also complex and even bigger
consequences also an example of what is
actually happened in 2010 is one
virus
pieces just called that as a goal
to overturn the Iranian nuclear program
throw and the fascinating thing about this virus
is the way it is distributed
the virus is first in Iran
spread grams in normal people who
had nothing to do with the nuclear power plant
the nuclear power plants are closed
the internet was extremely secure
So nothing in there or come in
Outside
what have they done with the virus in
iran is that gram multiplies
one god the virus is doing is okay I am looking for
another computer and put it
themselves in the good hope that
eventually to virus in someone
would end up with something like that
nuclear power plant and which the
light that via a USB stick
would take in and would use
the computer and exactly that is after one
number of months happened and then only went
the viruses work when it was top location
what has it done there has the
centrifuges from that nuclear plant
it turned off
very important of this virus
in the meantime it did leave it to the bear
know that everything was okay that Saturday
their screens with all those meters
all green check marks top
nothing wrong months this is so
continued
meanwhile that virus is also outside here
ate of course continue to spread in
eventually also came to Russia
for example
there a security company has that
has it picked up that go figuring out
that came after it is called the focus
in Iran
when we were clear what the purpose was of
this virus
the virus does not come to be deleted
or something like that she was so complex and
difficult it was completely designed too
just to not be detectable
the creator had an end date
built in one after two years it is out
himself disappeared
it shows what the consequences can be
are what if this is wrong
hands and ends up instead of
to someone who turns off the nuclear power plant
it might just leave overtime
turning or an extra warm old until
it may be about heat and exploding or
something like that
about them they assume that the
American government was behind it
but that can not be said with certainty
of course
Well if we take a step back
and this is the global level it
most extreme example
so you probably do not think I have one
locks and ground you may enter the garden or one
nuclear power plant beautiful stories but this is
does not apply to me
but that is not a good idea
principle if you connect yourself with it
Internet a bit so you target
Every day I hear people who say
yes, but I can not get anything
and we have the system again become the piet
you’re a top guy at ten years you do them
work well yesterday asked if he did everything
check the
it does not work like that, it’s not about it
so much always who you are what you too
offer
sometimes it’s just about you
computer power when I am using your computer
can connect somewhere else
then I have your digital
identity
A bit of awareness is very important
also for smaller organizations
earth color
name the stroke to go rent once
in ethical hacking looks very different
against the matter yes because you yourself
is doing
good example for extra awareness
creating is a tool halftime one
pound
that is a bit of acker steel power
I’m actually crazy
and you are probably already there
4 billion accounts online from crazy
databases around the world I think
85% of this room probably link
tim used
linkedin is a few years ago
act those passwords that simply stand
I was online with your e-mail address
can just fill it in here and then
I get your password back to you
imagine I do not think everyone is you
they are regularly being falsified
then had to adjust and yes then I can
that maybe just out of reader
cup of web wants to log in and perhaps continue
help and other systems so terrible
it can be easy
this is hacking so I would say and search
it is on fill in your own data and
Always look emerges
just think about the consequences
are gigantic but it is also
we can actually be incredibly easy
argue that it is simply stumbled
but fortunately there are also good steps
undertaken to counter this
in recent years is a lot
changed and I come in daily with
touch with my work
basically it comes down to people
Slowly those hackers arrive are poor
are not the outsiders who are angry anymore
they want to be good people who want something
want to contribute
one of those measures
yes it is based on this example
made clear I have one last year
found fault
among others the abn amro site I come to the
website and I have this as
demonstration
I have this to the technicians of ABN
amro sent
what I did here is actually it
login form adapted and it seems
as if you can log in with digid
that is not so in the background
what sent to me but because one
arrangements have responsible disclosure
I am the ethical hacker
trust that I will not be prosecuted
and that this with the right people
it ends up
then I get feedback how
they hold the head to have taken seriously
and often I get as a thank you
t-shirt or something like that
very nice
by now, dekkers become tom like what
more appreciated for just a t-shirt
dress very proudly a t-shirt
what I have won but in it
extension of responsible disclosure
are the american companies something
continued to reward hackers
they have just literally said like
If you find something with us you will get there
just a nice reward for that
actually become a kind of
race between hackers to as much as possible
to find buks so if you look at what is there
in recent years through this kind
programs have been found
incredible
all things that you think of
nice what would have happened like this
just in those applications like
remain, for example, well I have
you also participated in it yourself
I thought of this happening to my once
professional field so I must also have one
try it once
Well that went pretty well within a year
I am in the global top 10
come while that top 10 over 4 years
exists now what is it so nice to
you see how the big organizations deal
with a notification but you also see how
others pen testers or you say the
people who test security how
to do that
They can measure it themselves, but what I
most of or the most app from the
app group is actually that
now can say that all is strong
large organizations small bigger
applications does not matter what
it is
everyone continued to draw tom’s with
incredible consequences
Okay we were vulnerable the past
look on the internet are a lot of
examples are still vulnerable
the tricks I did ten years ago
took out
who was I still today
they can just argue about that
they will still be there for a few years
people are vulnerable
errors make those mistakes end up on
the internet and someone makes one
abuse of
organizations and governments that
simply can not do this alone
but can not simply think of it
well that the plot someone else on so it
is very good that we are ethical
hackers have it take example of
those locks
those two ethical hackers were not
who knows what happened
one of the solutions I think is just
around arm that gives hackers that stage
let them tell a story
and also give them that t-shirt
last one to use super power
hug them because before you know it
send your credit card details to
caribbean island and make your student
stay and before you know it, it goes light
from
[Applause]
”
Be First to Comment