 uh, this is uh, go know yourself or how Dr. Strange Love is one of the greatest movies ever. So, um, I'm called Jurgy. Sorry. Uh, I'm a degenerate. Uh, greets to the, to the DGNs. Uh, no mercy, but little pocket dans and Ilias. Right? Um, I hack things for IOActive. I also want to say greets to the old school uh, telefreakers, uh, since back in 92, since I've been living between pay phone to pay phone, they've helped me out. So, uh, so uh, why this talk? Um, so I was hanging out with uh, my buddy Far and we were talking about like uh, stupid, you know, famous hacker tales. So you go to cons and people tell you these stories and half the time you're like whatever, it's bullshit. Other times it's totally lulls. Uh, a lot of times it's victims of uh, weird computer bugs. And um, sometimes it's totally real situations and there's victims of these, these bugs from unexpected data but it's totally valid data. And we kind of had questions about can you, can you use totally valid data in these scenarios and get unexpected results and maybe profitable uh, lullsy results? Who knows? So some observations. Um, everyone's seen this before. Um, yeah, it's a license plate cameras. Uh, it's uh, you know, somebody attempting to do a sequel injection with a license plate. Nah. Uh, it's clearly a joke. Like the, it wouldn't work. I'm sorry to tell you. It would not work. Um, but it does bring up some good points because are these people actually thinking about, you know, that data as being like an attack surface? Um, who knows? But, but yeah, a little skeptic about it. And um, yeah, this is a super uh, sketch company. I just threw this in here to kind of call them out. Uh, it's basically big data analytics in there. Uh, they're a surveillance network on like all U.S. citizens. They do like sketchy heat maps and stuff and monitor all license plate data and everything. So um, yeah, you can look up their manual and see some, some weird stuff if you're interested. But here's an example like, uh, they, they leak their man, or somebody leaks their manual and you can see like how cops will go ahead and search data up about people and it will query like various ALPR databases, uh, the DMV, all sorts of stuff. So, uh, getting onto FOIA. It's the Freedom of Information Act. Basically lets you request data from, uh, federal agencies and uh, far as uh, FOIA dude. So, uh, he went ahead and um, you know, explained some of it to me. He kind of gave a few little tips like just so you know if you're, if you are gonna FOIA some stuff, um, they, they're not going to go ahead and get something that they don't have. You can't just say like go, go fetch. Like if they have it, they'll give it to you but they're not going to go get something that you want, that you want that they don't have, right? And also ask for electronic delivery because uh, it can, it can cost some money depending on what you're requesting but you can read more about it at your heart's content. But basically, uh, he went ahead and did a FOIA request to the Seattle Police Department ALPR database. And uh, in this database, I think it was like 80 gigs or 100 gigs or something, uh, had all sorts of shit. Um, all the images, um, all the location data for the car that was scanned, for the car that did the scanning, uh, the OCR data for when to analyze the image and other, other way to anomalies and stuff that we'll, we'll get back to you later. Um, and they stripped some, some sensitive stuff, you know, like about like hot cars and whatnot but they, they forgot a few things, you know, like it's not really important things like credentials and stuff, it's no big deal. But um, uh, but here's an example on a, on a cop car, you know, as, as the cameras and they'll be scanning plates. So another observation is uh, Mr. Noel. So this is some dude and that's his surname, believe it or not. And um, he, there's an article up there, you know, just Google and he had issues like purchasing plane tickets. And you know, people were kind of skeptic like, you know, this guy's full of it. Um, it makes you wonder like, is this a one-off issue? Like, did this happen back in 92 with OG Telefreak or did this happen, you know, in 2019? Um, it, you know, it was a huge difference. Like it, would it happen today? And um, and why did it cause a bug? The, the value Noel is different than the string Noel. So what the fuck? Right? And um, it's kind of crazy. So um, yes, there are a little bit of cringe. Well, I had to throw it in there. So uh, so I, I think the Noel story is real. Personally, um, because I see data validation issues every single day and computers are hard. So I think edge cases like this still exist. And um, made us kind of wonder, you know, are there any other types of uh, areas where we could provide data like this and maybe cause issues or interesting outcomes. Um, even though it's totally valid. And uh, just a, a small note. This is all fake that I'm telling you. Like this, the way the story is going. In reality, I just wanted to register a cool plate and I'm gonna pretend like I did it in this order. Just FYI. Um, but in the United States we can make vanity license plates. And there's some rules. They can't be vulgar, uh, sexual, stuff like that. And you can't misrepresent law enforcement. So you can't be like FBI or something. Um, and there's some examples of some cringey plates. And um, yeah, Texas pride. So, so let's register a plate, right? Um, now I've got a DMV website. Check if uh, Noel was there. So in reality I was like looking for cool stuff like, you know, um, I don't know, SIG fault, right? Like Noel Pointer and, and then I was like, oh fuck Noel. I should look that. And um, it was available. And I, I expected the DMV site to just like not allow it in crash or error or something. Cause it's a government website. Um, but uh, but no, like no bugs happen. I said you're registered like wait, wait and we're gonna mail a plate to you and cool. Let's, let's wait. And there it is. So it's pretty cute. It's pretty cool plate, right? And um, so uh, profit. Um, is it possible to be invisible citations maybe? Will a cop go ahead and uh, try to, try to scan me? And it will say like enter real data. Enter, you know? Like you must enter something other than Noel. Like I don't, I don't know. Like um, if they wrote a ticket, would it break something? I have no idea. But like time will tell. We'll see if I get a ticket or not. But, so unforeseen consequences. Uh, a beer to the first person who calls out the uh, the little Easter egg there, the reference. Who said that? Come get the beer. Come get the beer. I don't have a beer. I'll get it later. Um, yeah half-life's the shit. Good man. Uh, so I didn't get a ticket for like a year because I'm a good boy. And um, my registration renewal came up. So you go to the CA DMV website, says enter the last five-year event, enter your license plate. Like easy enough. And oops, it broke. So, I was able to register the play and get it, but I can't re-register. And uh, of course I'm just like, shit, shit. I have to go to the DMV. Like no one wants to go to the DMV. Uh, like people who say like the DMV is not a big deal. They're, they're cuckoo. Like when you live in LA, the DMV, that's your whole day. So, um, well luckily I was able to use a reference number. I didn't have to go and I registered it, but, but cool. So, uh, later on I ended up getting a ticket. So I go ahead and, I grab it off my windshield and it says noll on it. Shit. You know? Uh, has a citation number. It has some info for me to go ahead and pay the ticket. And I, I went ahead and paid it like a sucker, you know? And um, and clearly my predictions are wrong. Like there were no issues. I, I did get a ticket. Uh, but at least I have the cool plate. Right? So about a week later I, I open up the mailbox and have a grip of envelopes. And uh, open them up and there's a lot of citations. Yeah, and they're, they're all addressed to me, but um, well like I didn't know I had a, a Honda, Toyota, Porsche, Mercedes, you know, if anything. I'm, I'm living big. Right? So, um, so my prediction was really wrong. Bees, right? Bees, when we went in there it's like, oh, I'm, I'm, I'm not going to be able to get a ticket. I'm the shit. Like I'm invisible. But, but instead I got all the tickets. So, yeah. Yay. So this company that I had to go and pay and, and you look up the ticket number, citation processing center. So it's a private company that happened to be based out of Newport Beach, California, which is total coincidence. I got my ticket in Newport Beach and, and I was like, why am I giving money to like a PO box? And I was super weirded out. Turns out they're stationed there and I drive past them all the time and didn't realize. Um, you know, sketchy basically collection agency for the government. And um, you can go on their site and you can do a query for a plate and a state. So I go ahead and query for my plate and state of California. Yeah, fun. Yeah. So, so I call them up and you know, at this point it's still fun, right? Like ah, it's a bug. My wife's pissed. So, like, you know, she, she thinks like I'm actually going to pay the money. She, you know, she's like, ah, and so I call this guy and, and of course total dick. I'm like, hey, I need to, I got a, I got a great story for you. Give me your citation number. No, no, man. Like this is more involved. Give me your citation number. Okay. Um, which one? Yeah. Uh, so I go ahead and um, I gave him everything and um, he basically says, how do I know these aren't all you? And, and he wants me to like show him all my registration history and mail everything back. I'm like, ah, I'm not mailing shit back to you. I'm keeping all this, this is evidence of your mess up. And um, it just didn't go well. So you know, my response was basically fuck off. Like we're done here. Is that ten? Uh, perfect. Yeah. And um, so, I after our discussion and I'm telling my wife about it, I go ahead and I'm, I'm trying to explain to her, look, it's like this is ridiculous. Like, uh, you know, like Cypress College, I don't go to Cypress College. Like there's a, there's a plate or there's a car that got a ticket at 1130 a.m. There's a different car that got a ticket at 1 p.m. Like it's clearly not me. The guy thinks that I can change my registration fast enough, but clearly it wasn't me. I'm not worried about it. But after the call, I, I go to shower. Look, here's the, here's the one that I have physically that was mailed to me. You know, I don't know if you can read it, but it says it's a Honda plate and all. And I go, look, look, I'll, I'll bring it up. Now it says it's an infinity and it has my VIN number. Ooh. So they changed the data to basically make me look guilty for these tickets. Um, because I did tell the guy I don't drive a Honda, I drive an infinity. So, so now, uh, their whole database basically points at me, not all of them, but a lot of them. So, uh, are there any lawyers here? Because I'm, I don't know if I have legal footing, um, but basically, um, this is bullshit. Um, I don't know, like I don't, I don't know the, the impact, right? Um, does this sync with the police department? Does this sync with the DMV? Um, are their bench warrants for my arrest? Am I, is my license going to get suspended? I have no idea, right? So, um, it, it also opens up a ton of questions too, like potential for misconduct. Why, why doesn't a, a random employee have right access to this? You know, a cop writes a ticket, sends it to them. What happens if it's a disgruntled X and they just decide to load up their X with tickets? And you're just guilty. Like, there's nothing. Um, can you social them? Can you get them? Ah, that's an off by one. You know? It was actually a zero, not a one. Like, who knows? Like, it's, it's ridiculous though, right? So, uh, there's poor solutions. So, I, I went to the LAPD and I said, hey man, this is the situation. The guy's just like looking at me. I'm like, I don't fucking know. I said change your plate. I said, I said no. I didn't do anything wrong. So, I called the DMV. They said, ah, we don't deal with citations. We only suspend you if somebody asks us to. But you should change your plate. I said no. I didn't do anything wrong. So, I called the Citation Processing Center again. And they just said, you better prove without a doubt that these hundreds of citations are not yours. Also, you should change your plate. So, I hung up, right? So, I, so I sent this tweet out. I don't know if you can read it, but I basically, so I think CADMV, you idiots, like nobody, nobody has a good solution. And, you know, it's back when there were gun emojis, you know. So, I sent like a different message. But, uh, Apple changed this. Now I'm like squirting myself with a squirt gun. It's a little silly if you go look at it now. But, but they actually responded to me, which is crazy. Um, I don't know if it's a PR company or something, but, um, they contacted this company and they actually voided out a bunch of old tickets. And they were, uh, they ended up sending me an email. And she's like, hey, I'm getting this taken care of. Um, I just need you to tell me which ones are actually yours. So, yeah. And, um, so they didn't actually fix the issue though. They just voided out. So it's zero dollars, but, but then it just started climbing back up, of course. Alright. So, uh, what are some of future possibilities? Um, so clearly there's a total lack of like data entry. Um, standards, like it's just retarded. So I started going like, like no cop is riding up to a car and going, oh, there's no plate. I'm gonna put null. Like, so I thought, what, what is a totally like valid plate that, that would do this? Oh, what about missing? That's, that's a val license plate. You could register that. So I searched, searched in their database for the word missing. Tickets. What do I, none. Tickets. No tags. Tickets. No plate. Tickets. So, thank you. So, uh, yeah, you can, um, you can be just like me. There's an article down there. Um, it's about this guy, uh, he got no plate back in like the 70s and he's been like fighting the good fight for like forever. And he goes to court and he's just like, oh, it wasn't me. Yeah, but there's an article about it. Uh, so going back to the, the, to the ALPR data. So, um, as you can see, um, the, the cop cars when they're driving around Seattle, they kind of read like everything. Sides of buildings, random construction signs. So there's another one. What happens if you register the plate? Nissan. Jeep. I don't know. Um, and there's some other anomalies. So you can see there's a ton of variations of the word police. So it's clearly, you know, reading the sides of cop cars. So if somebody in the Seattle area wants to try this, um, you, you know, you can't impersonate a police officer, but maybe you can talk to, you know, a lady at the DMV and explain how you're a huge fan of the, the band police and get P.O.L. 1C3 or something. And uh, drive over the 520 bit bridge and tell me if you get a toll. That's the only thing I'm interested in. Like, I'm curious like, like, like, is this like, uh, like a whitelist? Like they get so many of them, they're just like, ah, fuck it. Just, just, you know, remove it. Um, anyways, a quick summary. Um, basically I still get tickets in the mail and stuff. I still have my dope plate and uh, my total is currently at $6,000. Um, oh yeah, yeah. So breaking news, breaking news. So last night my wife's text me a picture. Because before I'm telling all these people this like, like, I'm gonna sue the shit out of them or I'm, I'm gonna get a boat. And um, and they're like, they're like, idiot. Like, like nothing. This is like some, some flaw. Like it'll get fixed. It's not real. Like the, the money's not real. Like this isn't an issue yet. And my wife sent me a picture last night and I got a thing in the mail from the DMV and it's time to re-register my, my vehicle again. And uh, they want me to pay some tickets before I re-register. So I'm in, I'm in a sticky situation now because I'm not paying those tickets. And uh, but my registration expires like in three weeks or something. So I don't know what's gonna happen. But if you want to hit me up, I'm on Twitter and IRC because I'm old. Um, but um, yeah I guess we're done. Uh, so I don't know if there's questions. To be honest, I, I doubt there's gonna be an interesting question. Not to be a dick. Um, but, but I'm sure there's similar stories that I'd love to hear. So if we have time and anybody has similar stories, please come tell them. That would be great. I don't know how this works. I mean, does someone bring you a microphone or? Uh, no Crowdmax. I, I, I didn't hear you. You want to come talk in the mic? Are you a lawyer? Are you a fed? Okay. Yeah, get on stage. Who else is coming up on stage? Come on. No, seriously. It's the last talk. Who gives a shit? That's a what? Okay. So there's a term you should pay attention to called spoliation. Yeah. And not a lawyer. But what it means is that if someone knowingly alters data for appending lawsuit, the lawyer who's protecting or a part of that team who allowed it can lose their license at the bar at a minimum and you automatically win your lawsuit period. Does this mean I get a boat? Well, so when you collect evidence that their databases have been altered to alter the data from its original state to your VIN, they spoliated data for appending lawsuit. Which means the reason they were so happy to update you is to save themselves from legal hell. Okay, so I would definitely take pictures of their records before or after the time that they charge you with these tickets. And you should definitely get yourself a lawyer. Not because you need it, but because they do. We're up here. Can repeat if you want to. But he asked if boats have license plates. I'm pretty sure they do. We'll call up the Aquaholic and we'll make it null. Null is available in the state of Illinois. If anybody's curious, everyone should get a null plate. It's fun. It's fun. See, I had no concerns. I thought their shit was solid. I didn't think anything was going to happen. So I just, I just wanted a cool plate. This guy gets charged for other people's tags. What? What's your plate? Instead of Virginia, an easy pass? It's just a random plate and you get charged. What do you do? You don't pay it. Don't tell me you pay it. You had to pay some. Dude, let's team up. Yes. So, so yeah, the moment the moment I got my first ticket and I actually paid it, I think what happened is then it was like, holy shit, we associated it finally and now have an address and stuff. And yeah, because some of those tickets are from like 2013. I didn't have the plate back then, 2014. Like they're really old and stuff. And it's somewhere modern, you know. But yeah, I didn't get them until after. Yeah. Yeah, all from Newport Beach, California. Yeah. Is that everyone? The company? We don't want to talk about them. I'm a paranoid, I'm a paranoid schizo. We don't want to talk about them. Are we done? What? If it's big enough, can we host DEF CON on it? We can call it a null con. Drugie con. If you get a big enough bow, let's do it. Pirate con. Let's go. Are we good?