DEFCON 20: Owning Bad Guys {And Mafia} with Javascript Botnets

Conference delivered by Chema Alonso ( mypublicinbox.com/ChemaAlonso ) in Defcon 20 about How to own bad guys {and mafia} using Javascript Botnets created by a Rogue "Anonymous" Proxy Server. White Paper at: www.slideshare.net/chemai64/ow...

[@IdoruFalls]

Chema is great, very impressive that he can get through a 40 minute talk with pretty broken English and still remain not only perfectly coherent but very funny.

[@MrSpiderman1321]

his english is actually very good but he has such a strong accent

[@BanAaron]

Mr Wednesday Broken English? He speaks English more properly than most english people :P

[@Kakerate2]

Aaron Barratt lol more properly

[@GamerShock]

Paul Ahrenholtz not only does he make a great point, he reinforces it. well done.

[@Freakschwimmer]

+Mr Wednesday unfortunatiringtly his accent is extremly strong. Kinda makes listening to him quite tiring :/

[@SomeInfo-ib3wz]

This guy is a legend, great talk. Equal parts comedy and information. And he's multilingual...respect.

[@igrewold]

He is the real Mr. Robot ;D

[@chrisdab-]

English is the only language needed,. what?

[@misterchief5378]

chema is actually a legend in spain, he is so awesome.

[@igrewold]

He is great and I like his free style and jokes in the presentation but I find it weird that he never thought of using virtualization (VMware, VirtualBox, Qemu..etc.) as a solution at the end!

[@Albinorama]

no he is not.

[@konic40]

thumbs up for the guy that loves his country

[@boo24998]

Another way of being patriotic

[@boo24998]

I love that he still is willing to make fun of his country.

[@knowmad1919]

He is not patriotic, just likes and show some things in his country.

[@shoegum7362]

Came for the topic stayed for the dude

[@Hexecutable]

Wow this guy was amazing. Even though his english wasnt that clear he made it very easy to understand him. I hope to attend this event some time soon.

[@quranalone5824]

+ultimash00ter5 It's hold in America. Near Las Vegas. It's called DefCon.

[@yam2050]

ultimash00ter5 have you been there yet???

[@dk0money]

I like this, it illustrates the fact that at the end of the day you are going have to trust the administrator of the proxy machine, be that a company or your trusted hacking buddy who sets it up.

[@yomocy]

fucking modern day inigo Montoya right here

This was... quite simple.

[@FuckitnFightit]

i want to e'stay in e'spain sometime. Looks e'beautiful.

[@tho207]

haha don't make fun of us, we don't have words that start with s it's kind of unnoticeable if nobody tells us the first time or we don't realize

[@FuckitnFightit]

+TH it's all good brotha, I was just messing around.

[@tho207]

+LocChokingVMorningG I know I know, just commenting humorously ;)

[@tho207]

A C H my bad, I meant double closed consonants. and when we have we tend to relax them. consonants would become consonans. it's simply consonantes for us

[@tho207]

A C H yeah kinda the same. you can think of it as a more flexible version of the japanese pronunciation. obviously a trained spaniard would perfectly speak English, but there are almost no opportunities for that in the day to day life. yup, that's the magic of human languages and culture. it'd be interesting to see if a more complex language really correlates to anything valuable for the culture at issue.

[@fred.flintstone4099]

In modern browsers with modern JavaScript you can do interesting things. Such as run code in the background in WebWorkers, and connect to a C&C with bidirectional communication using WebSockets. Then you can perform denial-of-service attacks using loops with Ajax calls or looping the loading of images. Your C&C could also push code over WebSockets to be evaluated on the client-side with eval(), before the evaluation it could be decrypted.

[@boxbox6290]

Ill be bsrnybif u teach me n intro helder

[@Elyx0]

***** Ajax might be less powerful indeed because of cross domain, even if a lot of ressources (ie:robots.txt & such) are still "ajaxable." (Cf the IE seclists.org/fulldisclosure/2015/Feb/0 )

[@arsaeterna4285]

50% awesome presentation 50% awesome accent

[@TheTurlututuchapeaup]

Great video, injecting JS payload is a simple way to get over HTTPS, but nothing mentionned about the fact to add a Content-Security-Policy in response header from webapp (if CORS not required). It should prevent from this kind of JS payload.

[@tzisorey]

I wonder what results you'd have if you put a .JS file online, downloaded it again using various proxy services, and compared them to the original.

[@coooooooooool1000]

the result would be that is slightly bigger

[@SamJakob]

Tzisorey Tigerwuf that's actually a cool hypothesis

[@michaellewis4750]

this guy is so cool. I imagine he's a fun guy to chill with

[@dom252]

I haven't seen that many, but this is my favourite Defcon talk so far :)

[@RiDankulous]

Entertaining! The humor helps a lot for technical presentations.

[@TheFatlazyguy]

Favorite defcon talk. Guy was hilarious and English wasn't even his first language.

[@mysticx0]

what a genuine guy. absolutely great talk!!

[@spydergs07]

This is why if I ever need to connect to anonymously I use TOR and proxies. Also always runs on a live linux USB :) After you are down, shut down and boot back into the live USB and it's like a whole new clean system.

[@99devops63]

Hacker who was hacking was hacked.. nice...

[@shareb1t]

And that guy was me lol

[@boo24998]

I love this guy

[@kevinflorenzdaus]

Your a good speaker! Awesome presentation man!

[@mishevi3071]

Congrat's !!..Great show...Thank you!!! Greetings from Macedonia!!!

[@Prydestalker]

Prejak show ima Chema. :D

[@gevanlappido1304]

Hod did you zoom in on a windows machine that nicely??

[@SoftDatCLS]

Good Job !! Thanks for your video Conference Chema

[@thejohnmcduffie]

I'm a bit late, but so what? This was interesting. I was hooked from, "you only have to run faster than the bulls." While off topic, the topic was interesting also.

[@iii-ei5cv]

bro I love this!! quite hilarious!

[@0one1zero]

this guy is hilarious :D

[@josemariarodriguez3226]

yeha, but ikd

[@MichaelBerthelsen]

I love how he can't say Spain without putting the 'E' in front... =D

[@GrantWill]

They were using proxies and not vpns?

[@TheCrystalon]

After listening to this, I am reading all of the comments in his voice. I can't help it, I hear his voice in everything now. XD

[@007mrthomas]

great talk, great guy

[@SheikhAltijdGezeikhh]

I cried at 'linke-ding' x'D

[@quranalone5824]

+SheikhAltijdGezeikhh LOL.

[@TheJeorgen]

Just when i red it he said it HAHAHA

[@Blxckmxtt3r]

maestro!

[@Reth_Hard]

Very nice talk! I always suspected anonymous proxy servers. You know, when it's too good to be true... Also, people tend to under-estimate the Javascript exploits's potential. Javascript is Evil! :D

[@Sacre0493]

Magic Alonso!!!

[@tehKap0w]

So fucking simple, too. Thanks Chema, for a great talk.

[@bcassol]

Awesome!

[@GAFO777]

his jokes are just awesome hahah xD

[@fanenthusiast3802]

Cool vid bro

[@arpitrohela1596]

this guy is legend......

[@ismaelkababasmillah1690]

I love his voice and he is slick

[@dannyphehe]

Spain has good heroin.

[@tecmedimagen]

dannyphehe 😂😂

[@FranciscoSoteloWeb]

8:35 con los protagonistas de bricomanía llevando camisetas de foca juajuajua

[@Carlomanization]

Eh, tío, pero cuelga el código!

[@asderamen]

el chema se ha sacado la ciberpolla

[@imshaunnurse]

i know this was suggested to me because ive been watching def con but I also play a game called brown dust and its the tomatina even where they want you to spend money and sure enough.... boom he talks about tomatina

[@undergroundcentral]

Legend

[@mattw2135]

what botnet was he using and what bots will work with this?

[@svenhoek]

Matt W If you had to ask, you need not know

[@TerryTheTutor]

+Conky Jr And if you know, you need only ask.

[@quranalone5824]

+Terry The Tutor Ask, Know.

[@tarikahmed5795]

So amusing.

[@eprofessio]

I had a dream I was showing someone a dvd player that used to run on java that I hacked into a mini pc.

[@conductive13]

I hope your crops are going well....

[@sayamqazi]

It sucks to see that the ID cards of people getting scammed with UK job were from my country.

[@ericsbuds]

wow.. those Microsoft tiles... I thought that was a new thing LOL

[@reboureyn139]

he says cookie very funny. i love it. coo key

[@reformCopyright]

Volkswagen probably can help you detect when your DNS is being tested.

[@Infinity-wf3my]

grate

[@herreroarriero]

Topicazos..

[@theeyenzier8190]

its not mr.robot its Señor robot

[@SRFColonel]

Great talk, but seriously, anybody know the name of the girl at 18:40? It's for academic purposes.

[@solux3324]

+Marcus Romul No, sorry we can not help your _academic_ purposes. ;)

[@quranalone5824]

+Marcus Romul Lol you really sound like those creeps in the show.

[@NatiiixLP]

+Marcus Rommul, FAP = For Academic Purposes

[@SamJakob]

M Romul axionqueen 😉

[@MegaTroy12]

he is cool,want to visit spain,

[@IMredesMMIX]

ahí ahí, fomentando el turismo para combatir la crisis xD

[@pissfiss]

Gansta

[@BlasterTheMaster]

I wish I knew hacker language. This seems super interesting.

[@skypeon1]

Grantastic this is not hacker speech, more like programming basics used a little bit malicious, start from html, and other basic scripting languages, learn about proxyes and youll get it

[@BlasterTheMaster]

Thanks, I appreciate it

[@hate2009]

Pionell Winters so if I learned computer programming , is this what hackers learn ?? I always wanted to know what background do the have??

[@skypeon1]

yes, hacking is mostly knowing programming and it's various languages and in that way you know the weaknesses of code that you can use in various ways. Learn programming, if you will - you will learn hacking somewhere down the line

[@SamJakob]

Grantastic Nono you misunderstood, he speaks Spanish

[@bastianlv1653]

5:06 es very difficult sin internet

[@tRuStThEsCiEnCeBiGoT]

"No good, I've known too many Spaniards..."

[@Berberetxo]

La diapositiva de los de Bricomanía xD De verdad se pusieron vuestra camiseta o es fotomón? La referencia es cojonuda, cola blanca y tubillones..ez

[@inwencja2009]

Oh... I know Javascript! :3

[@quranalone5824]

+Magdalena Bartosiewicz Lol.

[@inwencja2009]

Old comment.

[@quranalone5824]

LOL, even more now XD. What are you going got do with basic js skills XD. This swizzle is complex XD.

[@inwencja2009]

I made a functional text editor in JavaScript.

[@quranalone5824]

Magdalena Bartosiewicz Nice. How did you do that?

[@BusinessWolf1]

Remember when that ceo guy said to hire lazy people? This is why.

[@davidgjam7600]

He looks like parrappa the rappa

[@richcohen5936]

LMAO he literally sounds like Brüno!!!

[@jesushimself00]

/* FIXME: add subtitles

[@cmdrhighwarlord6304]

Espain

[@jayl5628]

That's not Ibiza dude... it's "sao tome and principe"...

[@semiruu]

Have you been to Ibiza? Probably not, otherwise you wouldnt have made that comment :p

[@jayl5628]

It turns out that I'm from Barcelona and I've been working in Ibiza MANY summers, and I know pretty well all the locations (calas, beaches, discos, etc). So... NO, that's not Ibiza. A simple reverse lookup of the image in images.google.com can confirm you the correct location.

[@kyebrewer563]

Yeah, It is listed on many sites as Ibiza, but it is clearly Thailand. Looks like Koh Phi Phi

[@lakas1tos]

Eres un crack Chema, WE ARE SPANIARDS!!!!

[@WakeMister]

Young Clooney :D

[@shareb1t]

its was me and friend who hack the website back in years and watching this video 6 years later seeing this lmao

[@kinglouie8554]

thats a funny guy

[@ProNoobDev]

LMAO ! respect

[@elguezj]

What should of gave away that the girl's dating profile was fake was that she was from Keller, Texas hahahahahaha

[@Zhak7]

11:10 XD

[@prodKossi]

Amazing talk, but ads every 10 minutes is annoying as hell..

[@jameseverett4372]

adblockplus.org/

[@MrQuickPro]

vpn's

[@kennethwhite9720]

Because Spaniards.....

[@quranalone5824]

+The Mad-Mapper You just created an infinite loop in PHP. lol.

[@scottcombs3254]

If I have to watch this mexican cowboy ad one more time...

[@boxbox6290]

Adblock. comnthnk me later with a pic of your wife

[@Zei33]

10000th :P

[@aarenskov]

he eentendido mejor tu ingles que el de un estadounidense nativo lol

[@Smart.Potato]

MBP = Macbook Pro.

[@quranalone5824]

+tejas_jj Or Media BOOZER Piew

[@zxcxx]

LMAO.. :p

[@beto154yetc5]

ajjajaja...

[@nonameplsno8828]

it sounds as if he has an acorn up his nose

[@aequabit]

First thought: Micrososft Windows Tech Support

[@hackinfo2488]

you mean non-microsoft tech scammers...

[@Secretforest100]

guy turned out to be a turkish

[@semiruu]

he isnt, thats a spanish-english accent, also the way how he pronnounced Ibiza made it clear :p

[@igrewold]

+SEMIRU interesting remark.

[@nescius2]

atrocious pronunciation! still fun

[@jsmithnevinsky]

Are his coding skills as broken as his language skills?

[@alextwist8]

His accent really bothers me. I would rather hear this in spanish.

[@chasgiver1258]

Suggest speaking more slowly, deeper, clearer and get English speaking training. I had to stop listening it hurt so much.

[@FuckitnFightit]

i want to e'stay in e'spain sometime. Looks e'beautiful.

[@ANGRYmuffin9000]

I have never seen a Spaniard that at least tries to improve their accent

[@tomb2623]

+LocChokingVMorningG Much profit!