[Music]
while we're waiting for people to sit
down let's do a little informal poll how
many people came here to hear a super
serious discussion about
security good not many of you because
this isn't going to be that
serious who here came because they
wanted to understand the experience of
what it was like working at a place like
Hollywood Video something that does not
exist anymore I had a feeling that might
be the case all right one more question
who here really just showed up because
they wanted to know whether they really
made their employees wear bow
ties all right well you might find that
out too all right great uh I think we
can get started can we put the slides
up all right great um thanks for coming
today really appreciate it everybody I
hope you find this interesting I want to
make this as entertaining and fun as
possible and I definitely want to give
you guys a chance to ask questions at
the end even if it's not serious this is
a pretty fun subject and I'm hoping you
all really enjoy it uh my name is Ben
I'm the Senior Solutions consultant at
independent security evaluation I'll
talk about that a little bit in a moment
uh but today I'm going to talk about
what my experiences working at Hollywood
Video in the year 2000 taught me about
security I I have to
start I had to put this slide in because
I realized as I was putting this
together that some people might not
actually know what Hollywood Video is uh
you know certain parts of the country
this place didn't exist at all uh they
had their own Regional chains you know
people know Blockbuster Family Video
whatever some people are so young that
they never went to a video store uh but
anyway Hollywood Video you know we
didn't have the internet back in my day
we couldn't just go and download
whatever movie we wanted off of Netflix
we had to go to an actual store and if
you were lucky your parents would let
you maybe rent a video and an N64 game
for the weekend and you were pleased as
you could be that you had the
opportunity to play Kong Racing all
weekend um you you could hold on to this
stuff for 3 days and return them into a
big metal box or pay fees in theory
there was a policy that we would find
you all the time if you didn't rewind
the tapes but as I can tell you from my
experiences rewinding thousands of tapes
that that did not happen uh we sold
snacks and you have even had to have a
membership card we had to license you to
rent movies because it's such an
important
responsibility a few other things about
Hollywood Video uh the commercial is
accurate that uh Gentleman on the left
uh looked kind of similar to how I did
in the year 2000 they did in fact make
us wear fake bow ties uh cumer buns uh
vests and tuxedo shirts to go to work to
make
$5.15 an
hour um that is the actual picture of
the Hollywood Video Store I worked at in
Baltimore Maryland I'm somehow managed
to find this old picture the building
does not exist anymore it was demolished
uh that's on rer toown Road in in
Pikesville Maryland if you want to do a
little homework on that and that beauty
of a car down there is the 1990 Toyota
Camry DX um I happen to be fortunate
enough to use my money working at
Hollywood video All Summer to get a
really nice car uh with 990,000 M miles
and a worn out clutch U but that's why I
did it uh but who is ISC uh we're a
security consulting company uh we
discovered a lot of vulnerabilities
things in IOS and Android uh unhackable
cars we were managed to hack if you go
to our website you can see all sorts of
cool research we've done um We Run The
iot Village at Defcon and other events
like this one if you go downstairs in
the vendor Hall we're doing a couple
things today we're having a CTF where
you can win a lifetime badge to
cyphercon as well as some hacking demos
that we're going to run throughout the
day if you want to learn a little bit
more about device hacking web app
hacking and stuff like that
uh we specialize in white box security
assessments pen tests whatever the way I
put it is if you have a product that you
want to really find the true
vulnerabilities on and do manual testing
that's what we do uh we also offer a
product called start uh back there the
guy taking pictures of me right now
Scott is uh at the start Booth literally
right outside the door it's a different
part of our business it's third party uh
vendor risk management I'm not going to
talk about it that much if you're
interested in learning more about it I
definitely encourage you to go out there
we have a demo uh up uh what do I do uh
I actually help people figure out an
approach to managing the assessment
process it may not surprise you that a
lot of times when people are getting
into pen testing or application security
uh they haven't done this before uh
maybe someone's knocking on their door
and they're telling them that they need
to do this for a sock 2 or something
like that and so I'm usually the person
they talk to about scoping what their
products run on front end back end stuff
like
that so uh there were a few issues uh
working at Hollywood Video it uh might
not surprise you that this wasn't the
tightest run ship um uh it was very much
run on a shoestring budget uh typically
we would have uh two people working
shifts um there were two shifts 9:00
a.m. to 5:00 p.m. and 5:00 p.m. to 1:
a.m. and you would work an eight hour
shift uh typically and there were two
people now you you guys saw that picture
of the store before two people have to
cover that entire store and at certain
times of day that got pretty hectic it
also was bad because the HVAC did not
work and so as you wearing your bow tie
around you were sweating uh
uncontrollably we had a terrible point
of Sal system that used computers that
were uh that were fossils at the time
that we were using them like green
screen stuff and there was just a lot of
stuff going on like um you know on a
typical day people would come in they'd
return tapes you had to get the tapes
back on the shelves you have to you know
people would have complaints all the
time that things weren't working I'm
going to get into that a little bit more
you had to maintain the store make it
look clean vacuum stuff up management
stuff counting the registers all sorts
of stuff um so it was a really uh
challenging job for uh a
17-year-old uh we had one other
problem uh we had a little bit of uh
shrinkage uh I don't know if you know
it's a term uh shrinkage is the term for
uh loss and theft in retail and we had a
lot of it uh all sorts of problems uh
keeping their assets under control so
the bigger point of this talk is that uh
we're going to sort of analyze the
situation in Hollywood Video we're going
to understand what they actually
controlled what security controls we had
in place how we dealt with this and sort
of what we could learn from it because I
don't want to make too many judgments
about Hollywood Video you have to think
about this in terms of risk and loss so
we'll get into that in a little
bit um we're gonna walk through a a
basic threat model that I created uh so
I want to know a few things about the
the situation like why were things like
tapes cash uh snacks you know popcorn
ice cream sodas uh Etc why were they
missing we should also ask were the
security controls in place to protect
those assets proper you know um those
things were lost all the time but stuff
is going to get lost what is Hollywood
what should Hollywood Video invest to
make that happen
uh we want to know what the security
culture was like at Hollywood Video you
know if if we're in a place and nobody
really believes in the security Mission
if they're not really investing the time
if they don't care about it if
Management's not invested on it you're
not going to have a good
outcome and we really want to know what
did Hollywood Video care about and what
do the employees care about ultimately
at the end of the day it's the corporate
entity and the people on the front lines
that are going to have the best results
in in protecting security assets and
ultimately the big question is should
this have been handled differently I'm
not sure we're going to have any
definitive answers to that but I at
least want to get you thinking about
about that as a as a whole and then sort
of apply it to your own situations and
say here are the things that I protect
am I doing the right
things so the first part of our threat
model are assets and I'll talk about a
few funny things about it so on the left
there uh you can see those videotapes in
those actual cases that we had um the uh
video games there I you probably can't
see it in the image but uh it breaks my
heart as a video game collector to see
the burnt in property of Hollywood Video
uh um uh charred into that lovely
cartridge uh they did that to everyone
and it made me sad uh obviously the
tapes and stuff uh were a big asset too
uh I say tapes we had a few DVDs this
new technology called DVD we weren't
sure if it's going to make it this DVD
technology but we had them um uh let me
ask you guys does anybody know know how
much a typical tape might have costed to
buy to rent so if if at Hollywood Video
how much do you think it would cost to
to for us to buy a
tape what did you
say that's right so this gentleman over
here said 70 to 80 bucks so a lot of
people don't know this but when you were
a video store and you would get tapes in
you had to buy a special version of the
tape that would often have trailers and
it was licensed differently because the
the movie companies didn't really want
you know people just renting things all
the time they needed to need to make
their money and so a tape is actually a
little bit more valuable than you might
think it wasn't like just going to Sun
Coast another relic of the past and
buying a VHS tape for 20 bucks um a few
other things we had uh there's a actual
uh thing of popcorn uh bucket and the
butter it was like a play on Beauty and
the Beast that's what Hollywood Video
sold uh we had cash in the registers so
uh you know most people at the time
would use cash to buy things although we
did accept checks if you could believe
that people would write me checks for $8
or whatever to rent a couple tapes and
then of course there's things like the
operation of the store so I consider
that an asset in up itself if the store
doesn't run properly if employee if
employees don't feel safe working there
if customers don't feel good about
coming in then the whole operation is
worthless people have to want to be
there they have to uh get some value out
of
it um and of course the employees
themselves so um one good thing if
you've ever worked in retail or
something like that uh generally the
these companies are really good about
protecting their employees they don't
want you trying to step in the way of
some thief or something they don't want
you to get hurt the employees themselves
are an asset of the company so I'd ask
the group like what do you think
Hollywood Video cared the most
about
anybody yeah money definitely money I I
would argue as a broader concern it's
the general operation of the store um
they need to be able to keep that cash
flow running the only way the store
operates is if people are able to come
in have a pleasant experience have a fun
time get the things they want get in and
out quickly uh if a tape's missing the
customer probably gets over it it's just
a little bit of money uh but if the
store is not a good place to visit if
people aren't coming back day after day
after day then Hollywood is
worthless uh a few adversaries and uh
threats that are out there so the first
is is just common thieves I found this
little picture I was a shoplifter you
can see the exposing today's most
alarming crime ring uh fortunately I
didn't have any situations like that uh
but but they did have to talk to us
about people who might rob the store you
know it's not uh it's not necessarily a
given that uh on a day-to-day basis that
someone doesn't walk in with a gun
unfortunately and tries to rob us uh we
were instructed that if somebody comes
in and they want to do something violent
just give them what they want you know
if somebody said you know points a gun
at you and says give me all the cash in
the register you go here you go would
you like some cash in my wallet just
take whatever you want maybe you want a
few tapes maybe want some popcorn have a
nice weekend give them whatever they
want um the other adversary is employees
so I put another picture of this
gentleman he looks really nice but deep
down he has a dark secret which is that
he's part of the security problem um
there's a few issues here some of it's
just accidents right you didn't scan the
tape back in you put the tape in the
wrong place on the Shelf you tripped
over and dropped something you broke
something whatever um but there's also
compromises on policy so if you don't
follow the rules if you're not scanning
the things in properly if you're not
following the policies that happen
you're basically an adversary you're an
Insider threat and then there's just
straight up dishonesty uh I'm going to
get into it a little bit but the
employees at Hollywood
Video myself included uh kind of took
advantage of some of this stuff to their
own benefit but you'll understand why in
a moment
uh a few of the security tools we had to
protect against these things the first
is the actual video card itself or I'm
sorry the membership card itself um you
know there was a process to get a v a
membership card uh you had to provide me
a driver's license that had your name
and address on it and they actually
required us to take credit cards so that
if somebody went and rented a bunch of
tapes and walked off that theoretically
we could charge them you know I don't
know if that ever actually happened but
I think the idea was to create a barrier
to entry so that people wouldn't just
just come in spend 20 bucks to a bunch
of tapes and never return um there's
obviously like the locks on the doors
and things pretty standard stuff uh the
point of salees system itself uh that's
not the actual one but it's sort of
Representative of what we had to deal
with a very slow clunky system where you
scan your tapes in and it shows your
inventories Etc um those little uh metal
detector things or Rad Radar Detector
things I'm not even sure what they are
but the things that basically see when
the little magnet is inside the uh tape
so if someone's walking out but the
problem is of course with something like
that if somebody walks out with
inventory I'm not going out after them
I'm like oh wow the alarm just went off
that's nice next customer
please uh you have things like manager
oversight and I'll put that in quotes uh
when I was only making minimum wage 515
an hour at Hollywood Video it may not
surprise you that the assistant manager
wasn't exactly rolling it rolling in it
and so you're asking a lot of
responsibilities on people who are not
not really making that much money and as
you might expect you're not going to
have the best outcomes when people
aren't personally invested in it um uh
lastly is the lock box for returns so uh
we had a little box outside and when
you're returning things if you put it in
the Box by midnight of that night uh you
weren't uh late and we would open it up
and hopefully there wasn't water in it
and we would just take all the tapes out
and scan them in the store it was a big
pain uh but none of this as you can tell
is particularly foolproof you can beat
all these security measures it's not
very
hard so let's talk about what actually
happened and why Hollywood Video was
such a Civ for loss so when it comes to
the tapes and games we had a lot of
excuses the first one was I returned it
you know people would say that they
returned it and then somebody come came
up to me at the register and I would say
up I can't rent you this tape it shows
that you still have Star Wars episode
one out for rental and you need to
return it and uh I need my jar back they
would say they might say something oh I
returned it and honestly it's just the
honor honor System you basically just
have to give them the benefit out it's
not like I can prove it I'm not going to
take them to court or anything uh we had
broken inventory but we also had broken
inventory there were about four drawers
on the side of the register and each
drawer had a different kind of inventory
that was considered dead inventory a lot
of them were tapes now VHS tapes are
very temperamental
uh I actually spliced them a little bit
you know you would literally uh be able
if something wasn't working right you
would literally cut pieces of tape and
then sort of tape them together and
that's how you fixed VHS tapes I've done
this a few times uh but then people
would come in and say things are broken
now when you're in the middle of a shift
and someone says something's something's
broken you're just taking their word for
it you're putting in their drawer and
you're moving on to the next thing I
can't go through some Quality Control
process every time someone uh claims
it's broken with video games it's even
more difficult because it's not like I
had an N64 and a PlayStation and a
Dreamcast all next to each other just to
boot up games all day uh we had this big
drawer and one day my boss uh uh I don't
even remember his name said to me hey
Ben you're a big video game guy why
don't you go and see if all these games
work and if they don't work just get rid
of them or something so I took them home
and you know none of them worked I don't
know what happened just all these games
didn't work you know N64 games they fail
all the time they don't they definitely
don't work when you clean them a little
bit but you know they just didn't work I
don't know what happened
there there's also like common theft so
uh you know people would walk off with
things you know uh we would find ta
cases that were emptied we didn't have
too many sophisticated locks on them
people just sneak stuff out I'm pretty
sure other employees would be even more
blatant about the theft than I that I
was I mean when my boss told me to take
stuff home I wasn't I didn't feel too
bad about it but I think some of my
co-workers had even less qualms about
these things um with the cash uh we have
had wrong register counts sometimes uh
there was one situation that I had
personally where uh my shift manager
Anthony I'll never forget this cuz uh it
was a point of contention with us told
me it was 5:00 that's fine Ben go home
and I would say well I have to close out
my register Anthony he's like no that's
okay I'll take over your register now
this guy was my manager he told me to
leave the register open so then I come
to work the next day and they said Ben
we're writing you up your register was
40 bucks short I didn't take the money
the register wasn't closed out right so
either Anthony took it or it was
miscounted at some point but the point
is we didn't follow process and so we
had consistent losses that way the other
thing with the food was every shift
managers would tell you yeah just take a
ice cream from the freezer just take a
soda it's cool we would count these
things in inventory when we would run
inventory we had to scan them in we had
to account for them but managers would
straight up tell us just take it it's
cool you've worked a long shift grab a
Pepsi grab a ice cream sandwich grab
whatever and they just told us to do
that but there's a very deleterious
effect to this because when you're
telling employees yeah take this take
this take this don't worry about this
whatever why should we care about
security at all management doesn't care
why should we
care there's some other reasons we had
loss um some of it is just constraints
uh as I mentioned before employee safety
was very important Hollywood Video to
their credit um told us the right things
never confront somebody always protect
yourself don't worry about the tapes or
the money or whatever if someone's
committing a crime just let them do it
talk to the cops later if you have to we
had really weak inventory controls there
was limited time management we didn't
get paid enough all this stuff the
biggest problem is we must have had
10,000 tapes in the store and for us to
run inventory we would close the store
and from like 12 to 5 we were expected
to count every tape in the store by
hand that did not work
so no wonder things were missing all the
time no wonder our inventories were off
we didn't invest any time to actually
track this the right way obviously there
was the problem of checking tapes we
would have people complain about tapes
all the time but I was not going to
screen that stuff we just couldn't do it
and I wasn't going to argue with the
customers and the store is super huge
you just can't see it all um I mentioned
the bad management stuff the managers
didn't care don't steal but when I tell
you to steal it's okay and I'll just
close out your register later it's fine
log into this thing whatever it's cool
we don't have to follow
policy so what should you do with this
information my lesson to all of you and
what I hope you take away from this is
you should really build a threat model
for whatever you're trying to protect uh
anybody in the room responsible for sort
of managing the protection of assets
maybe if you're a company or something
like that
anybody I mean you should really have a
threat model in place you should know
all the things uh that I have now I put
Bruce Wayne's threat model here cuz I
found this image from ours Technica cuz
I thought it was so cool this is not a
perfect threat model I disagree with it
I disagree heavily but the point is
Bruce Wayne knew what his risks were he
knew what people he needed to protect
what kind of security controls he needed
to protect the Batcave and who his
threats were um you should do the same
thing understand who your ass what your
assets are what do you really care to
protect and classify them and these
assets might not be traditional things
some of them may be the reputation of
the people you work with some of them
may be you know we deal with situations
that have to deal with intellectual
property or national security interest
just Secrets things we don't want
getting out there um you have to look at
your adversaries too you know our
adversaries at Hollywood Video were
regular people for the most part people
who wanted to get a free tape people who
wanted to get some food or whatever like
like that not exactly uh you know the
most threatening people but a lot of uh
companies out there there a lot of
people who have web applications devices
whatever corporate networks Etc they
have adversaries like foreign
governments nation state actors
sophisticated hacking groups and you
need to know who's targeting you and
what kind of you know Bullseye you have
on you if you're a an organization
involved in things like National
Security a data breach is catastrophic
not just to your business but perhaps to
the country and so you have to take your
security posture and step it up
considerably the other and last part is
to sort of identify and assess your
tools and their effectiveness the only
way to know if a application or a
product or anything is truly secure is
to go through regular manual testing
where people are looking at it not
automated scanners and stuff like that
um if you're not going through regular
assessment you really don't know if the
tools you're using are effective enough
you're guessing just because somebody
puts secure on the box or makes big
claims unless you can vet those claims
unless you can see documentation unless
you put those things together yourself
and do the manual work you really don't
know how secure a product is you're just
guessing and the truth is that any
product can be broken with enough time
resources and
expertise that's all I have for the
prepared content so feel free to I I
would love to answer questions about
anything that I talked about today uh
and more especially the Hollywood Video
stuff and while I take questions I will
show you this little slide uh this is
the contact us stuff if you want to get
in touch with me you want to talk about
any of the stuff we talked about today
you can email me make sure you check out
iot Village in the start booth and we're
giving away free copies of my colleague
Ted Harrington's book uh hackable you I
unfortunately with this thing the QR
code is kind of cut off so I don't know
what I'm going to do about that I have
it on my laptop so you could just scan
it on my laptop after the event I will
make sure you get a copy of the of the
book um we we'll ship it to you and with
that all out of the way what questions
do people have I would love to answer
questions anybody
anybody
yes what's the most stolen
video
so it's probably a function of
popularity and um volume so I would say
I mean again this is dating it so like
year 2000 episode 1 people we had we
must have had a 100 tapes maybe more and
they were also the most missing because
people wanted it it was popular at the
time
now I'm not going to comment on the
quality of this film it was was to not
cause any controversy um but we missed a
lot of it um but there were you know
other things would be missing too I mean
it didn't necessarily line up with that
and it was probably because uh Star Wars
was so plentiful it was so visible I
think we even had a thing at the time
where we would guarantee that uh there
would be a copy in the store I think
they ordered so many that it was like if
you come in we'll have it for rent
doesn't matter when or where I think
they ordered it that way but then a lot
of them went missing anyway so what can
I what can I
say what other questions do people have
anything anybody
buer
yes
yeah I mean uh I guess that's part of
the calcul you know I'm not in the
corporate side so like I wasn't doing
the accounting on it but let's say you
would rent a tape for five bucks for
three days or something like that that
was about what it cost um I know there
were things like different tiers of
pricing like older things were a little
cheaper and stuff like that um you
really do need to rent a tape like 20
times to make money on it now again for
a Star Wars that's not so that wasn't so
difficult it was a little bit more
difficult for like Indie movies uh more
obscure stuff uh a lot of things that
were straight to video although the
things that were straight to video often
were cheaper for us to get um I used to
get screeners too that was a funny thing
when you get screener videos and they
would be black and white and say don't
steal this video but um but yeah uh it I
don't think ultimately you could see
that the business model kind of failed
as streaming got popular and the content
delivery model changed but it was still
tough to make money I think even back
then yeah
yes how often do N64 games break you
have to really beat up those N64 games
to break all right I'll go on another
tangent real quick so I collect video
games it's a big thing I do I have 4,000
unique games in my video game collection
I'm a big retro game collector and I can
almost guarant guarantee you that any
NES Super NES game boy N64 Sega Genesis
game if you didn't like dunk it in water
and leave it there for a while you can
pretty much revive anything I mean these
things are tanks and um usually when the
NES when the thing blinks and you blow
on the cartridge it's because of the
contacts in the system the carts are
basically bulletproof you're going to
have to replace the save batteries but
like those things last pretty much
forever discs are a different story
discs can rot they can get scratched Etc
but those cartridges if you clean the
pins uh they'll
last yeah any other
questions anybody anybody in
all
yes I'm sorry I can't hear
you
I think it's very tough to say so
looking back at it what could we have
done better I think the biggest thing is
not is having better expectations about
management and resource control it was
stupid to have us scan tapes that way
and and count inventory that way it was
never going to work I don't know why
they thought it was going to work with
one or two people doing this for a few
hours especially because they wanted to
open so like we would close the store
but they're like we have to open by five
cuz that's when everybody gets out of
work and they're going to rent tapes
it's like well then I'm not going to get
all the inventory done that stuff didn't
work also like the management had to
take the stuff seriously they they
should have probably I mean I don't
think it's a big deal ultimately that
they let us take things but it was a
very deleterious thing it didn't really
uh it didn't really create a security
culture you can't do much about people
swiping tapes or people trying to commit
robberies and stuff like that uh
nobody's willing to uh take the risk of
stopping that stuff and I don't think
they should um but our management could
have been better and if our management
would have been better it would have
been a little bit more improved
ultimately the the shrinkage the loss
wasn't why Hollywood Video failed it
failed because of Netflix like
everything else but um but it certainly
didn't help and it didn't make the store
profitable as much as it could have been
so any anybody else
yes yeah so that's kind of what like a
GameStop does now right like if you're
buying a video game
they I have an A to grind with this when
you buy a new video game from GameStop
they open it up and put the game behind
the counter and then you bring the case
and then they put the opened up game in
the case which is really bad would it
have helped it probably would have
created other problems because then we
would have had a situation where every
time somebody picks out two tapes I have
to go and fetch them in some gigantic
thing instead of them just bring it up
and I scan it I take their money and
check out so I feel like we'd be trading
one problem for another um but that's a
good question I never thought of
that anyone
else anybody anybody anybody all right
cool well uh I really oh actually I have
a question for all of you can I do one
of those things right take a selfie of
all of you and you like raise your hand
and stuff I'd really appreciate it it
would make me very happy all right one
sec thanks very much if anybody wants a
copy of the book uh just come up here I
have cards too if you want to talk and
you can scan the QR code on my
laptop