# Media

url: https://www.youtube.com/watch?v=cFW0sYSo7ZM
title: DEF CON 32 - From getting JTAG on the iPhone 15 to hacking Apple's USB-C Controller - Stacksmashing
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=cFW0sYSo7ZM",
  "title": "DEF CON 32 - From getting JTAG on the iPhone 15 to hacking Apple's USB-C Controller - Stacksmashing",
  "description": "With the iPhone 15 & iPhone 15 Pro Apple switched their iPhone to USB-C - and introduced a new proprietary USB-C controller: The ACE3.\n\nBut the ACE3 does more than just handle USB power delivery: It's a full microcontroller running a full USB stack connected to some of the internal busses of the device, and we even managed to access JTAG on the iPhone 15 through it. It also provides access to UART, the internal SPMI bus, etc. Previous variants of the ACE, namely the ACE2 found in MacBooks, could easily be dumped and analyzed using SWD - and even be persistently backdoored through a software vulnerability we found.\n\nOn the ACE3 however, Apple upped their game: Firmware updates are personalized, debug interfaces seem to be disabled, and the external flash is validated and does not contain all the firmware. However using a combination of reverse-engineering, RF side-channel analysis and electro-magnetic fault-injection it was possible to gain code-execution on the ACE3 - allowing dumping of the ROM, and analysis of the functionality.\n\nThis talk will show how to use a combination of hardware, firmware, reverse-engineering, side-channel analysis and fault-injection to gain code-execution on a completely custom chip, enabling further security research on an under-explored but security relevant part of Apple devices.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2214,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.24s - 7.02s | This text was transcribed using whisper model: large-v2

 Hey everyone, welcome to my talk, Ace of the Sleeve, hacking into Apple's new USB-C controller.
7.02s - 8.02s |  First off, who am I?
8.02s - 10.48s |  My name is Thomas Roth, aka Stack Smashing.
10.48s - 14.64s |  I'm a security researcher for hardware and firmware, and I'm also a co-founder at this
14.64s - 17.44s |  online training platform called Hackstreet.io.
17.44s - 21.00s |  You can find me on Twitter, YouTube, and so on.
21.00s - 26.02s |  Now, as always, like any research, it's built on top of other people's work, right?
26.02s - 31.90s |  And so I want to thank, for example, Sigusa, who built a kernel module we will use, Oli
31.90s - 37.34s |  for the Thunderbolt patcher, the Azahi Linux team, without whose reverse engineering work
37.34s - 42.46s |  I couldn't do anything, Carlo Maragni, who just always was there when I talked and had
42.46s - 49.50s |  to rant about fault injection, Biasca, Fabian, and Caro, Mark Zingier for the central scrutinizer,
49.50s - 54.10s |  and also the TAD12 dev team, who did some awesome work.
54.18s - 56.14s |  Now, a bit on the backstory.
56.14s - 61.66s |  Apple used to have this proprietary connector called Lightning, and it could do fairly obvious
61.66s - 65.62s |  things such as charging, USB, video, and audio.
65.62s - 71.14s |  But it could also do some really cool stuff, for example, JTAG, UART, SDQ, and so on.
71.14s - 77.14s |  And you could buy cables for this on the black market, and there was also the Bonobo cable,
77.14s - 81.18s |  but we decided we want to build an open-source version of this, and we called it the Tamarind
81.18s - 82.18s |  Cable.
82.18s - 87.50s |  And the Tamarind Cable is essentially a $20 Lightning debugging interface that we introduced
87.50s - 90.86s |  two years ago at DEF CON, so it's good to be back.
90.86s - 96.46s |  However, Apple decided to throw all of my work away by switching from Lightning to,
96.46s - 107.24s |  you know, this thing here, that was supposed to be audio here, but she's talking that we
107.24s - 109.68s |  can do charging, data, audio, and video.
109.68s - 113.60s |  But I think they made a mistake during the keynote, because they forgot, you know, all
113.60s - 114.60s |  the cool stuff.
114.60s - 115.60s |  Like, who cares about charging?
115.60s - 118.40s |  We want JTAG on the iPhone.
118.40s - 123.88s |  And you know, if you look at the USB-C connector, it has a ton of pins, and so surely we can
123.88s - 129.88s |  somehow get some of these to speak JTAG, UART, or, you know, anything interesting, not just
129.88s - 131.24s |  charging.
131.24s - 136.00s |  And then I realized that the iPhone is not the first USB-C device that, you know, Apple
136.00s - 137.00s |  made.
137.00s - 140.56s |  And I never looked at any of these, but luckily for me, other people did.
140.56s - 146.72s |  And they figured out that Apple essentially uses the USB power delivery negotiation to
146.72s - 148.64s |  do some cool stuff.
148.64s - 153.24s |  And it turns out that this power delivery negotiation is happening in something called
153.24s - 155.32s |  the USB-C port controller.
155.32s - 162.28s |  It's essentially a tiny microcontroller in the MacBook, and that one handles all of this.
162.28s - 166.92s |  And essentially, the charger communicates with it through these two lines, the configuration
166.92s - 173.64s |  lines, and this is all handled by a microcontroller that sits close to the USB-C ports.
173.64s - 177.40s |  And you know, a microcontroller will have some kind of firmware, and some smart people
177.40s - 180.96s |  years ago figured out you can just dump that firmware.
180.96s - 186.48s |  So you solder a couple of wires into your very expensive MacBook, dump the firmware,
186.48s - 190.96s |  and then they wrote an awesome blog post because they reverse-engineered the firmware, and
190.96s - 196.44s |  they figured out that the Apple Type-C port controller, which we call Ace, actually contains
196.48s - 199.36s |  a lot of secret functionality.
199.36s - 205.04s |  And they found that Apple uses something called VDM, or Vendor Defined Messages, to let us
205.04s - 208.88s |  change the configuration of certain pins on the USB-C connector.
208.88s - 215.72s |  And so for example, we can change the SBU, the Sideband Use Pins, to be serial.
215.72s - 222.56s |  And so we can, you know, send the VDM action 306 to the Ace controller, and then we get
222.56s - 225.92s |  a serial console on the MacBook.
225.92s - 229.72s |  And it turns out that to this Ace, there's much more connected than just serial.
229.72s - 236.64s |  You can also do JTAG, Thunderbolt, even I2C, or on the iPhone there's SPMI and so on.
236.64s - 241.92s |  And so that's kind of cool, but how can we actually send these Vendor Defined Messages?
241.92s - 244.92s |  Because this is not just like regular USB.
244.92s - 250.56s |  Instead we actually have to use special tooling to be able to send these messages.
250.60s - 256.44s |  And again, some very smart people from the Asahi Linux team found out that the back left
256.44s - 261.40s |  port on the MacBook Pro is special, and can actually send those commands, and they reverse
261.40s - 263.16s |  engineered all of that stuff.
263.16s - 268.56s |  And so there's a nice tool that you can just use to send these commands from a Mac to another Mac.
268.56s - 272.92s |  Also, Marc Zenier built this thing called the Central Scrutinizer, which is essentially
272.92s - 277.80s |  a serial adapter that is able to send all of these things, and can give you, you know,
277.80s - 282.28s |  a UART shell on a MacBook, and so on and so forth.
282.28s - 283.28s |  Now I saw this.
283.28s - 284.28s |  It's Pico based.
284.28s - 289.88s |  I love the Pico, and so I ordered a couple of PCBs and started experimenting with this.
289.88s - 295.16s |  And essentially all it contains is a small USB-C controller and a couple of level shifters.
295.16s - 300.60s |  Now I wanted to try to get serial on the iPhone 15 that was freshly released, because everyone
300.60s - 306.68s |  was harassing me that my stuff doesn't work anymore, so I had to get with the times.
306.68s - 309.88s |  Now unfortunately, it didn't work on the iPhone 15 out of the box.
309.88s - 315.20s |  I had to actually solder on a small USB switch and provide power to the iPhone and so on.
315.20s - 320.24s |  Now this might just be my incompetence, because this is the first time I ever touched USB-C,
320.24s - 323.16s |  and so I just tried random stuff until it happened to work.
323.16s - 330.80s |  And so if you know USB-C better than me, feel free to tell me what I'm doing right or wrong.
330.80s - 335.64s |  But after doing all of this, I essentially had the Central Scrutinizer working on the
335.64s - 345.32s |  iPhone, and so I can hit some keys, and suddenly I get the serial console on the iPhone 15.
345.32s - 351.28s |  That's pretty cool, but also pretty useless, because what do we do with serial output?
351.28s - 355.72s |  We want to get JTAG or SPMI or something interesting, right?
355.72s - 360.56s |  And again, the Asahi Linux people did a ton of cool reverse engineering work on all of
360.56s - 365.96s |  that USB PD stuff, and they have a gigantic document where they document all the actions
365.96s - 370.44s |  and so on and so forth, and if you keep scrolling and scrolling and scrolling, you will find
370.44s - 375.96s |  a small note that says, by the way, there's this action called 0206, and there's a good
375.96s - 382.08s |  chance this is SWD, but nobody ever seems to have like publicly tried this.
382.08s - 388.04s |  So I took my Central Scrutinizer, hooked my oscilloscope debugger and so on up to this,
388.04s - 393.80s |  and tried to connect to it, and it didn't work.
393.80s - 399.72s |  But you know, turns out there are two cables, so I just reversed them, gave it another try,
399.72s - 403.64s |  and suddenly we get a success message.
403.64s - 409.86s |  We found the debug port with the ID 4BA02477.
409.86s - 414.36s |  We just got JTAG on the iPhone 15 by just sending 206.
414.36s - 418.60s |  Awesome.
418.60s - 424.28s |  Unfortunately, this is a production device, and so JTAG is locked.
424.28s - 428.08s |  So essentially, we can't debug it because it's a production device.
428.08s - 431.70s |  On the black market, you can probably find an iPhone that is not locked, but it will
431.70s - 436.24s |  run you like 100K or something, so I can't do that.
436.24s - 440.84s |  But we got JTAG, useless JTAG.
440.84s - 445.00s |  You know, but we can still explore some other buses, and so it turns out that on the iPhone
445.00s - 450.72s |  15, there's actually more than just UART and so on on this connector, but also SPMI
450.72s - 451.72s |  and other things.
451.72s - 457.64s |  And so in December last year, we released a PCB called the Tamron C adapter, which is
457.64s - 463.44s |  essentially a fork of the Central Scrutinizer with bidirectional level shifters, a USB power
463.44s - 466.96s |  switch that can actually charge the iPhone if you want to let it run for a long time
466.96s - 468.24s |  for research.
468.24s - 472.84s |  And we can use it to explore all the buses on the iPhone 15, including SPMI, which I
472.84s - 478.56s |  think we released the first public analyzer for, and it also runs a full JTAG probe.
478.56s - 480.36s |  And so you can experiment with this.
480.36s - 482.60s |  It's fully open source.
482.60s - 484.60s |  And if you use it, it looks like this.
484.60s - 487.88s |  Now, this is cool, but again, also kind of useless.
487.88s - 494.40s |  However, what's interesting is that all this stuff is implemented on the iPhone side in
494.40s - 497.02s |  this chip called the ACE3.
497.02s - 501.64s |  And the ACE3 essentially sits between the USB port and the system on a chip, and it
501.64s - 506.76s |  makes for a very interesting target, because on the iPhone 15, the ACE3 can actually run
506.76s - 511.20s |  a full USB port, like it can come up as a USB device.
511.20s - 515.96s |  If you go into recovery and plug your iPhone in, you're actually communicating with the
515.96s - 521.60s |  ACE3, and that makes it an interesting target, because imagine if you compromise this part
521.60s - 526.68s |  of the device, you could do attacks on the system on a chip without any way for anyone
526.68s - 531.16s |  to know, like there would be essentially zero traces.
531.16s - 537.36s |  So I was interested in this, but I wanted to first understand the predecessor, the ACE2,
537.36s - 540.16s |  because there's a lot of public work on the ACE2 already.
540.16s - 547.32s |  And the ACE2 is essentially a custom Texas Instruments USB-C controller.
547.32s - 549.00s |  It's an ARM chip.
549.00s - 553.52s |  It's connected to the SoC via I2C, and you can find it on all MacBooks, starting with
553.52s - 559.88s |  the T2 Macs up to the M3 Macs, and so very recent Macs even still use this.
559.88s - 569.00s |  It turns out that it's just essentially a re-labeled TPS65986 with a custom ROM, essentially.
569.00s - 575.60s |  Now, I opened up my MacBook, I recreated the work by the TAD12 dev team, I dumped this
575.60s - 580.56s |  on an M1 MacBook, and so I got an up-to-date firmware, started reverse engineering it,
580.56s - 585.28s |  and found the command handling, built tooling to talk to it, and so on and so forth.
585.28s - 589.80s |  And interestingly, the firmware even contains some privileged commands, such as memory read
589.80s - 591.68s |  write, modify, and so on.
591.68s - 595.96s |  It's like peek and poke, but unfortunately those are locked on production devices, but
595.96s - 599.60s |  if you manage to change a single bit, you can unlock them.
599.60s - 605.08s |  And so, yeah, that's kind of cool.
605.08s - 609.68s |  The way we communicate from the system on a chip, like from macOS with the ACE, is using
609.68s - 616.32s |  a bus called Apple HPM bus, which stands for Host Port Microcontroller, and we communicate
616.32s - 620.24s |  with it by sending these 4-byte commands, they're called 4CC.
620.24s - 625.16s |  It's essentially a 4-byte integer, but it happens to be ASCII, and so they're like commands
625.16s - 630.24s |  such as, you know, GAID, or, you know, reset, and so on and so forth.
630.24s - 633.64s |  And we built a small tool called ACE Tool to communicate with that, and so if you want
633.64s - 639.08s |  to, we have the full list of commands online, we have a tool online to try them out, so
639.08s - 640.20s |  it makes for fun.
640.20s - 644.50s |  But the reason I'm telling you this is that we can do one very important thing.
644.50s - 646.38s |  We can read the status of the chip.
646.38s - 650.62s |  We can determine whether it's in application mode, or whether it's in boot mode.
650.62s - 654.58s |  And we can also determine whether it's in DFU mode and so on, and so if the chip fails
654.58s - 656.18s |  to boot, we can measure it.
656.18s - 659.20s |  If the chip successfully boots, we can also measure this.
659.20s - 662.76s |  This will become important later, so yeah.
662.76s - 668.22s |  The ACE 2 also has an external flash connected, and this SPI flash does not actually contain
668.22s - 673.46s |  the full firmware, but it actually just contains patches for the ROM.
673.46s - 679.46s |  And so essentially, you can patch every single function in the ROM using this flash.
679.46s - 683.46s |  This makes reverse engineering terribly annoying, because when you start reversing the firmware,
683.46s - 685.38s |  you have like a function call.
685.38s - 691.34s |  That function call goes to another segue function, which does like stupid stuff with the registers.
691.34s - 698.30s |  Then it dereferences a pointer list, which will be loaded from the flash.
698.30s - 701.86s |  And then it actually jumps to the function, and so everything has like three layers of
701.90s - 706.90s |  indirection, which breaks all your tooling for cross-referencing, and so on and so forth.
706.90s - 711.26s |  And so we built some scripts to make this easier, but there are thousands of these functions,
711.26s - 715.86s |  and so it's terribly annoying to reverse without additional tooling.
715.86s - 719.46s |  But because it has an external flash, this chip is getting updates.
719.46s - 725.78s |  And so on macOS, there's a tool called USB-C Firmware Flasher, and with this, it gets regular
725.78s - 727.24s |  updates and so on.
727.32s - 734.24s |  These updates are unfortunately protected using RSA-3072, but that signature is only
734.24s - 738.96s |  checked during updates, so there's no secure boot on the chip whatsoever.
738.96s - 743.80s |  So if you find code execution and can modify the external flash contents, you get persistence
743.80s - 747.60s |  for free, like you don't have to do anything.
747.60s - 752.12s |  And so I found a vulnerability in the ACE2, as you do.
752.12s - 756.60s |  Well, it's not actually, you will see, it's complicated.
756.60s - 761.60s |  And I got told it would be fixed in fall, so in the submission report, I can see fall
761.60s - 762.60s |  2024.
762.60s - 770.48s |  However, after I said that at BlackHat, I got told by Apple, oh yeah, that's a mistake.
770.48s - 772.40s |  We are not going to fix it.
772.40s - 777.28s |  And so I learned two days ago that I can actually drop a vulnerability here.
777.28s - 786.76s |  So I'm doing, thank you, so I spent the last two hours writing slides, so this is going
786.76s - 790.00s |  to be a bit of PowerPoint karaoke.
790.00s - 796.12s |  But essentially, it turns out that not only does the ACE have SWD to the system on a chip,
796.12s - 800.36s |  but the system on a chip also has SWD to the ACE2.
800.36s - 804.94s |  And so the SoC can debug the ACE2.
804.94s - 809.08s |  And the way this works is that there are the two lines that you need for SWD, SWD.IO and
809.08s - 815.36s |  SWD.CLOCK are general purpose IOs on the SoC.
815.36s - 819.32s |  And GPIO on Apple SoC is basically just a memory range.
819.32s - 822.32s |  And if you write to it, you can fiddle with the IOs.
822.32s - 827.04s |  You can put them into read mode, output mode, high, low, and so on and so forth.
827.04s - 830.56s |  And thanks to the Asahi Linux team, we know how to talk to them.
830.56s - 836.24s |  And thanks to Segusa's IO kernel read-write module, we can actually do writes to those
836.24s - 841.56s |  pages using a kernel module, which requires disabling SIP and so on.
841.56s - 849.04s |  And so we can control the pins that talk to the debug port of the ACE through the kernel.
849.04s - 855.80s |  And so let's bitbang SWD through the macOS kernel, because, you know, I don't have enough
855.80s - 857.24s |  stuff to debug or something.
857.24s - 858.24s |  I don't know.
858.24s - 862.64s |  Anyway, and so basically, we have our user space application.
862.64s - 867.28s |  That user space application talks to the IO kernel read-write module that I loaded
867.28s - 872.64s |  into the macOS kernel, which talks to the memory-mapped IO peripherals, which toggles
872.64s - 877.52s |  the physical pins, which then talk to the ACE2.
877.52s - 882.72s |  And I implemented a debug probe over this that lets us dump and modify the ACE2 from
882.72s - 885.70s |  user space and looks like this.
885.70s - 892.00s |  So you can just essentially call .h2 dump, assuming you have this kernel module loaded.
892.00s - 894.88s |  It will dump the firmware of the ACE2.
894.88s - 899.08s |  Now the problem with this is I wanted to, you know, build some payloads, and I want
899.08s - 903.16s |  to debug those payloads, and I don't always want to have my MacBook open to debug the
903.16s - 904.44s |  payload.
904.44s - 907.68s |  And so I want to debug.
907.68s - 910.52s |  So I ported this entire thing into OpenOCD.
910.52s - 917.68s |  And so introducing Tamarin kernel, which is essentially an OpenOCD driver that bitbangs
917.68s - 922.00s |  SWD on Apple SoCs through the IO kernel read-write module.
922.00s - 927.32s |  And so you can actually debug more than just the ACE2.
927.32s - 933.32s |  There are other peripherals that have debug enabled, thank you.
933.32s - 937.64s |  And also I found a way to disable the signature verification, because it's, you know, patchable
937.64s - 938.64s |  from external.
938.64s - 945.64s |  I can just, if I get code execution, it turns out that, remember how all functions are patchable?
945.64s - 949.20s |  Also the signature verification functions are patchable, and so you can just disable
949.20s - 954.36s |  them from the external flash, and afterwards you can actually just load your own firmware
954.36s - 955.92s |  through user space.
955.92s - 960.52s |  And all modifications survive a full system restore, so even if you wipe your Mac, the
960.52s - 962.56s |  ACE2 will still be compromised.
962.56s - 964.92s |  And so we can backdraw the ACE2, yeah.
964.92s - 969.04s |  And I'm going to, like all these things I have to release, like today, as I learned
969.04s - 973.52s |  I can release this two days ago, so I don't have this packaged nicely, and there's still
973.52s - 979.64s |  a lot of swear words in the code, let's say, so I'll fix that and publish it on GitHub.
979.64s - 983.48s |  But we have the ACE2, which is on the way out.
983.48s - 985.68s |  It's an old chip, it doesn't do a whole lot.
985.68s - 990.96s |  The iPhone 15 Pro uses the successor, which is far cooler.
990.96s - 993.60s |  And so we have to check the ACE3.
993.60s - 1000.20s |  The ACE3 is actually a Texas Instruments SN25A12, and when I started this, there was zero public
1000.20s - 1002.52s |  information on this, literally zero.
1002.52s - 1006.72s |  In fact, I started tweeting about the chip, and afterwards I got emails from like the
1006.72s - 1011.20s |  gray market salespeople who sell like the stolen chips online, and they were like, hey,
1011.20s - 1015.46s |  can we pay you to write a product description for this chip, because we can't find anyone
1015.46s - 1017.68s |  else who ever talked about it.
1017.68s - 1024.96s |  And so the ACE3 is used in the iPhone 15 and on the MacBook Pro M3 with Pro and Max processors.
1024.96s - 1028.28s |  And the ACE3 is far more complex than the ACE2.
1028.28s - 1031.16s |  It runs a full USB stack called Port DFU.
1031.16s - 1033.66s |  It has access to some more internal buses.
1033.66s - 1039.00s |  It has very interesting potential, because it's so, because it can run full USB, if we
1039.00s - 1045.18s |  managed to, you know, find another checkmate-style boot ROM issue, we could in theory get persistence
1045.18s - 1049.94s |  for a jailbreak by just putting it in the ACE3 instead of having to gain persistence
1049.94s - 1051.86s |  in the SOC itself.
1051.86s - 1055.74s |  I haven't done any of that, it's just some of the motivation that drove me to hack this
1055.74s - 1058.06s |  chip.
1058.06s - 1063.22s |  So I started looking at how is this chip protected, like what's different, and it turns out that
1063.22s - 1064.70s |  everything has changed.
1064.70s - 1069.66s |  It doesn't use the USB-C firmware flasher anymore, it uses different upgrade mechanisms
1069.66s - 1072.10s |  between the iPhone 15 and the MacBook.
1072.10s - 1077.36s |  In fact, I believe on the iPhone 15, it actually uses SWD to update the chip, which is kind
1077.36s - 1078.54s |  of cool.
1078.54s - 1083.58s |  And the updates are fully personalized, so each chip will get their own firmware.
1083.58s - 1087.42s |  But you know, I still had this vulnerability that I think, you know, I can theoretically,
1087.42s - 1092.18s |  I now can debug the ACE3, so I wanted to try it on the ACE3, so I ordered a MacBook
1092.18s - 1097.38s |  M3, and the trick didn't work.
1097.38s - 1104.22s |  So easy select, easy choice, send it back, or, you know, I'm a hardware hacker, open
1104.22s - 1105.98s |  it up.
1105.98s - 1110.70s |  So I opened up the MacBook, and remember I had to do this quickly, because the Amazon
1110.70s - 1116.30s |  return window for this machine was just 30 days.
1116.30s - 1121.10s |  And the first thing you will notice is that there are again the same debug ports that
1121.10s - 1126.90s |  we already saw on the previous MacBooks, and on the previous MacBooks, we could dump the
1126.90s - 1128.22s |  chip this way.
1128.22s - 1132.62s |  And so just for labeling, this is the ACE3, it's much bigger than the ACE2, and there's
1132.62s - 1137.66s |  no Texas Instruments chip that looks similar to this one, and so we really have zero idea
1137.66s - 1139.26s |  what this chip does.
1139.26s - 1143.78s |  There's again an external SPI flash, and these nice debug connectors.
1143.78s - 1150.30s |  Now I started probing these, and in combination with the terminal, with the tamering kernel,
1150.30s - 1157.54s |  I could essentially see that yes, I'm talking SWD on the right lines, but it seems like
1157.54s - 1161.96s |  the debug port is disabled, so no luck.
1161.96s - 1166.14s |  So instead I decided to dump the external flash, so again, like I couldn't solder in
1166.14s - 1170.10s |  this, because again, Amazon return window, so I used these needle probes to just like
1170.10s - 1171.90s |  probe the flash lines.
1171.90s - 1176.42s |  And eventually I got a full firmware dump.
1176.42s - 1177.42s |  Reversing time.
1177.42s - 1179.26s |  Turns out, it's essentially the same.
1179.26s - 1184.42s |  Only patches get loaded from the external flash, and everything seems to be different
1184.42s - 1189.02s |  on the hardware side, so for example the CRC peripheral is at a different address as far
1189.02s - 1190.78s |  as I can tell.
1190.78s - 1192.10s |  It's just patches.
1192.10s - 1196.02s |  And there's some weird regions with high entropy, which is always a bad sign, because that means
1196.02s - 1199.34s |  that there's some cryptography very likely going on.
1199.34s - 1203.70s |  And yeah, that will spoil our day if they implemented secure boot.
1203.70s - 1207.90s |  However, some successful things was that I was able to reverse engineer the firmware
1207.90s - 1213.70s |  header, and so I found a couple of CRCs and so on, and my naive hope was, okay, I just
1213.70s - 1219.06s |  you know, patch the firmware, fix the CRCs, and surely this chip will boot, and so let's
1219.06s - 1222.82s |  flip a bit in a $3,000 MacBook.
1222.82s - 1228.78s |  Unfortunately, I couldn't get it to boot a modified firmware, but at least I didn't fully
1228.78s - 1229.78s |  brick it.
1229.78s - 1235.98s |  So in the end, what I tried, I tried my software vulnerability, I tried physical SWD access,
1235.98s - 1239.82s |  I tried modifying and switching the flash contents, even like between the different
1239.82s - 1244.98s |  ACE chips, but they all seem to have a unique signature, like even you can't take the left
1244.98s - 1248.82s |  ACE and put it on the right ACE and so on and so forth.
1248.82s - 1253.58s |  I tried fuzzing, and I actually found a timing side channel that lets me enumerate the commands
1253.58s - 1257.58s |  that the ACE3 supports, but that doesn't really give me anything.
1257.58s - 1264.98s |  So yeah, essentially we have a completely undocumented, not documented, apologies, chip,
1264.98s - 1268.98s |  we have no firmware, and only some simple commands.
1268.98s - 1274.58s |  Time to give up, or do we try fault injection?
1274.58s - 1279.30s |  So fault injection is an awesome technique, because essentially we can introduce faults
1279.30s - 1283.92s |  into a chip, which allows us to modify the behavior of the running software.
1283.92s - 1288.36s |  So for example, we might be able to flip bits in registers and memory, we might be
1288.36s - 1292.44s |  able to skip instructions and so on, and there are a lot of different techniques for this.
1292.44s - 1297.04s |  There's voltage glitching, laser, BBI, electromagnetic, and so on.
1297.04s - 1302.56s |  They all have one thing in common, which is that they very easily break chips.
1302.56s - 1307.90s |  The most common way to do glitching is using voltage fault injection, and there you essentially
1307.90s - 1313.08s |  drop the power to the chip for a very short amount of time, at just the right point in
1313.08s - 1314.36s |  time.
1314.36s - 1318.80s |  And the problem is, this pretty much requires soldering and removal of a ton of capacitors
1318.80s - 1322.80s |  and so on, and it's best performed if you know what's going on.
1322.80s - 1326.32s |  We don't even know the pinout, we don't know what is the core voltage, what is the main
1326.32s - 1331.74s |  voltage rail, we don't know what other chips are on there, and so on and so forth.
1331.74s - 1336.92s |  But there's an alternative called EMFI, electromagnetic fault injection.
1336.92s - 1342.24s |  The idea is we create a high voltage pulse into a coil, and this lets us inject current
1342.24s - 1345.56s |  directly into precise locations in the chip.
1345.56s - 1350.64s |  And this again can let us skip instructions, change register values, and so on.
1350.64s - 1353.84s |  And we don't really need target preparation for this.
1353.84s - 1361.12s |  It's just we point our chip shouter at the chip, we zap it, and the chip is hacked.
1361.12s - 1363.26s |  Wonderful, in theory.
1363.26s - 1369.36s |  The problem is, we need to know the very precise timing on when we need to glitch, because
1369.36s - 1373.96s |  otherwise we're just going to glitch something else.
1373.96s - 1377.28s |  How do we figure out the timing on something that we know nothing about?
1377.28s - 1380.00s |  We just know it doesn't boot, period.
1380.00s - 1387.44s |  Brute force, I thought about it, but the boot is so slow that it would take forever to try.
1387.44s - 1391.84s |  And the more we try to glitch at the wrong point in time, the more likely we are to break
1391.84s - 1392.84s |  the chip.
1392.84s - 1396.16s |  So we really want to get this right.
1396.16s - 1402.08s |  I had another idea, which is, what if we find a side channel?
1402.08s - 1408.24s |  What if we find a side channel to get this precise timing on when to inject our glitch?
1408.24s - 1411.76s |  Normally, now I decided to use an EM side channel.
1411.76s - 1415.60s |  So I used an EM probe to measure the chip.
1415.60s - 1419.08s |  And normally you would use a very high-end oscilloscope for this, but I wanted to use
1419.08s - 1422.76s |  a cheap, affordable hacker to make this more accessible.
1422.76s - 1428.36s |  And I just glued a random coil onto a PC-byte probe and just dropped it onto the chip.
1428.36s - 1430.80s |  So this is just held with gravity.
1430.80s - 1433.80s |  And this way we can capture the magic chip waves.
1433.80s - 1435.24s |  And we can actually see this.
1435.24s - 1440.48s |  As we restart the chip, we can actually see that there is activity on the spectrum at
1440.48s - 1442.68s |  around 48 megahertz.
1442.68s - 1444.68s |  Now this activity could be anything, right?
1444.68s - 1450.64s |  This could be the power rail, this could just be the spy flash line or so, but it's something.
1450.64s - 1452.80s |  And so the idea is simple.
1452.80s - 1455.72s |  We start recording the spectrum on the hackRF.
1455.72s - 1459.00s |  We reboot the ACE3 using the ACE tool I showed earlier.
1459.00s - 1465.96s |  We get the electromagnetic recording, and then we just do some very simple DSP.
1465.96s - 1472.00s |  Which just took the better half of a week to generate a ton of different measurements
1472.00s - 1474.60s |  and so on and so forth, filtering this and that.
1474.60s - 1478.48s |  But eventually I had a line that I thought, okay, this looks like it might tell us something
1478.48s - 1479.76s |  about the chip.
1479.76s - 1483.48s |  And this is completely gut feeling, like I didn't do any science here, I just tried
1483.48s - 1487.88s |  to play with filters, and eventually I got this line.
1487.88s - 1493.52s |  Now the problem with this recording is that you want to collect a lot of traces and average
1493.52s - 1495.02s |  them together.
1495.02s - 1499.84s |  The problem is they will all be at different offsets in time, because we don't have a precise
1499.84s - 1503.00s |  way on how to start the recording.
1503.00s - 1508.36s |  And so we could align these in software, however the hackRF actually has a nice feature, which
1508.36s - 1511.20s |  is it has hardware trigger inputs.
1511.20s - 1515.38s |  And so we can actually trigger the recording using a hardware signal.
1515.38s - 1519.64s |  This doesn't work in the latest hackRF firmware, so it was again like hours of trying different
1519.64s - 1523.68s |  firmwares until one would actually trigger correctly.
1523.68s - 1525.72s |  And now we just need a trigger.
1525.72s - 1531.12s |  Now remember that we have access to the flash lines, and the flash lines have a line called
1531.12s - 1532.60s |  chip select.
1532.60s - 1538.96s |  And the chip select line will go low just as our firmware is being loaded.
1538.96s - 1543.40s |  And so this is perfect to offset a glitch from if we want to bypass secure boot of what
1543.40s - 1546.24s |  just got loaded from flash.
1546.24s - 1554.64s |  So easy plan, we start recording on the hackRF, we reboot the ACE3, the hackRF gets triggered
1554.64s - 1558.80s |  by the chip select line, and we get a perfectly aligned recording.
1558.80s - 1564.68s |  And in theory it should look like this, if you take pictures for presentation, in reality
1564.68s - 1570.00s |  your desk will look like this, and it will just be a gigantic mess.
1570.00s - 1575.04s |  So in the end, we have perfectly aligned recordings, and we can actually average them together
1575.04s - 1580.40s |  to get a nice, meaningful signal where if anything else put in noise, we can just filter
1580.40s - 1582.80s |  it away essentially.
1582.80s - 1588.76s |  But you know, now we just have a fancy line, how do we actually use this to time our glitch?
1588.76s - 1594.32s |  Well, we can change the flash contents to be invalid, so that the boot fails.
1594.32s - 1600.04s |  We reboot the ACE3 and record the EM emissions, and then we compare the differences.
1600.04s - 1605.04s |  Sounds easy, but in reality this takes hours, because you have to set up these needle probes,
1605.04s - 1607.80s |  which takes like, you know, 20 minutes.
1607.80s - 1613.04s |  You try to flash the chip until it works, then you do the capture, and measure, and
1613.04s - 1614.24s |  so on.
1614.24s - 1617.76s |  And then you do this again, and again, and again, until you get everything right.
1617.76s - 1621.88s |  And in the end, you end up with a trace that might look like this, where you have the original
1621.88s - 1625.20s |  firmware, and the modified firmware.
1625.20s - 1629.04s |  And we can see that this trace looks super different, right, like there's a clear point
1629.04s - 1632.24s |  in time where they start to differ.
1632.24s - 1637.92s |  What's even better is we can test our hypothesis by modifying the CRCs.
1637.92s - 1644.68s |  So remember that we have these three CRCs, and so in theory, if we fix just some of them,
1644.68s - 1647.20s |  we should see a delay in our boot, in our EM trace.
1647.20s - 1653.00s |  Like, we should see that our trace changes at a later point in time.
1653.00s - 1660.08s |  So I tried this, so I have the original firmware, then I set one of three CRCs to be correct,
1660.08s - 1663.00s |  and you can see we have exactly the same signal as before.
1663.00s - 1669.52s |  Then I tried two of three CRCs to be correct, and no change, so I was worried that this
1669.52s - 1671.36s |  might not actually work.
1671.36s - 1676.60s |  But then when I set the third CRC to be correct, we can see that the boot actually goes much
1676.60s - 1682.08s |  further, and that the boot fails at a much later point in time.
1682.08s - 1685.60s |  And so why not just glitch here, right?
1685.60s - 1687.36s |  So simple enough.
1687.36s - 1688.76s |  We now have some timing.
1688.76s - 1694.24s |  Now we just need to position our chip shoulder, because normally for EMFI, it's very important
1694.24s - 1696.72s |  where you are glitching.
1696.72s - 1702.46s |  And so if you were doing this professionally, to give a talk at big security conferences,
1702.46s - 1705.84s |  you would use a big XY table to scan the chip.
1706.08s - 1710.12s |  Unfortunately, like literally the week before I did this, I had a small accident with my
1710.12s - 1716.36s |  CNC, and I got 230 volts onto the ground line, and completely bricked my computer, my screen,
1716.36s - 1720.04s |  and my CNC controller.
1720.04s - 1721.04s |  That was fun.
1721.04s - 1724.36s |  And so I couldn't do this, but I really wanted to try this attack.
1724.36s - 1729.24s |  So I just did the dumbest thing you probably could have done, which is I choose the biggest
1729.24s - 1734.56s |  tip I had, I just placed it on the chip.
1734.56s - 1740.36s |  So that way I was sure that I was at least hitting something in there.
1740.36s - 1744.36s |  And so I had this nice setup with the chip shoulder.
1744.36s - 1748.64s |  Then the triggering was done by a chip whisperer, Husky.
1748.64s - 1753.62s |  The trigger connection is just the chip's leg line, using a PC byte, and a connection
1753.62s - 1755.08s |  to ground.
1755.08s - 1758.08s |  What's not shown is the days of debugging this took.
1758.08s - 1761.28s |  And again, this is a photo op, reality looked like this.
1761.28s - 1765.20s |  And like as soon as you bump the table, everything would just drop off.
1765.20s - 1768.84s |  So yeah.
1768.84s - 1771.12s |  So we are ready to glitch essentially.
1771.12s - 1775.16s |  So my first attempt was, I would just change the version string.
1775.16s - 1780.32s |  So from Mac OS, I can read out the version of the firmware that is running on the ACE.
1780.32s - 1785.36s |  And so on my MacBook, this was 2.45.
1785.36s - 1790.60s |  And so I decided in the flash, I would just change that single byte.
1790.60s - 1794.40s |  And I fixed all the other CRCs around it.
1794.40s - 1797.04s |  And then I armed the Husky and the chip shouter.
1797.04s - 1800.12s |  I reboot the ACE3 via ACE tool.
1800.12s - 1802.12s |  I wait for the glitch.
1802.12s - 1807.36s |  And then remember earlier, I told you that we can check what the status of the chip is.
1807.36s - 1810.72s |  I just check whether it's successfully booted.
1810.72s - 1812.92s |  And this worked wonderfully, right?
1812.92s - 1816.00s |  So I just, I can just try again and again and again.
1816.00s - 1819.20s |  And in theory, we should eventually get successful.
1819.20s - 1826.20s |  And so I built this tiny Jupyter notebook to do all of this and started it.
1826.20s - 1829.16s |  And you can see we got like 1.6 attempts per second.
1829.16s - 1834.16s |  So each reboot takes like 1.6 seconds.
1834.16s - 1836.12s |  That's when the trouble started.
1836.12s - 1840.60s |  The problem is sometimes the ACE completely stops responding and I can't get it to boot
1840.60s - 1841.60s |  again.
1841.60s - 1842.60s |  I don't get any output.
1842.60s - 1845.16s |  So I need to reboot the machine.
1845.16s - 1851.04s |  The problem is if I reboot the machine while the charging controller doesn't have a firmware,
1851.04s - 1853.68s |  the MacBook will stop charging.
1853.68s - 1857.68s |  And essentially, I have eight hours of trying to glitch the chip.
1857.68s - 1861.64s |  And then the battery runs out, then I have to restore the flash, which takes hours again
1861.64s - 1866.52s |  with the probes, restore the firmware, charge it up, and then do the whole thing opposite
1866.52s - 1869.20s |  again.
1869.20s - 1872.84s |  So I did that for a couple of days.
1873.52s - 1875.00s |  It was like sunken cost fallacy.
1875.00s - 1879.68s |  I started, then I thought like, hey, maybe I should build a battery emulator and just
1879.68s - 1881.68s |  like feed it externally.
1881.68s - 1883.48s |  But I thought, ah, no, I'm so close.
1883.48s - 1886.84s |  I'm sure it will happen any minute now.
1886.84s - 1889.88s |  So I kept doing this, but eventually I got success.
1889.88s - 1896.48s |  I managed to get into the app mode on the ACE3.
1896.48s - 1906.96s |  And by checking the version number, I can actually see I was successful.
1906.96s - 1911.16s |  I changed it to version 42, and we glitched the ACE3.
1911.16s - 1917.28s |  But the problem is we only changed the external patches.
1917.28s - 1921.24s |  And we don't actually know what these patches patch because we don't know the actual ROM.
1921.24s - 1926.12s |  And so essentially, we have this flash, which is full of random functions, but we don't
1926.12s - 1927.56s |  ever know what they do.
1928.20s - 1930.48s |  We don't know, how can I trigger them?
1930.48s - 1932.32s |  Will they actually be executed?
1932.32s - 1936.44s |  And then even if you manage to execute them, we don't have any input or output.
1936.44s - 1939.24s |  We don't even have a driver to wiggle a pin or something.
1939.24s - 1945.32s |  So I was considering, oh, can I do maybe some looping that I can measure via EM or so?
1945.32s - 1947.60s |  But yeah, essentially, we can replace functions.
1947.60s - 1949.10s |  We don't know what they do.
1949.10s - 1954.92s |  And even if we execute them, even if we 100% know we get them to execute, we have no way
1954.92s - 1956.60s |  to get data out.
1957.24s - 1962.00s |  However, I started looking around a lot through the ACE3 flash, and you can see that there
1962.00s - 1969.96s |  are a lot of 4CC strings here again, like this, UFPF, DFUF, USBW, and so on and so forth.
1969.96s - 1975.56s |  And I thought probably there are some similarities between the ACE3 firmware and the ACE2 firmware.
1975.56s - 1980.48s |  And maybe I get lucky and they patched a function in both chips, the old one and the new one.
1980.48s - 1987.04s |  And so after hours of staring in Binary Ninja, I found a function that is actually almost
1987.04s - 1990.04s |  identical between the two.
1990.04s - 1992.04s |  And this is the USBW command handler.
1992.04s - 1998.00s |  And USBW command handler, I have no idea what that does, but it's a command that I can send
1998.00s - 2001.20s |  to the ACE that will get executed.
2001.20s - 2003.60s |  And remember, and so I can replace it.
2003.60s - 2007.52s |  And remember how earlier I saw the memread function?
2007.56s - 2012.48s |  I essentially took that implementation from the ACE2, modified it, simplified it slightly,
2012.48s - 2017.16s |  and then had a function that was by Apple built to give me memory.
2017.16s - 2020.52s |  And so I essentially Apple built my exploit payload.
2020.52s - 2023.08s |  So I'm very thankful for that.
2023.08s - 2028.20s |  And so in the end, I essentially had a very simple payload that is a trivial memory reader
2028.20s - 2032.32s |  that takes in an address and returns four bytes at that address.
2032.32s - 2037.76s |  So again, attempt two, we replaced the USBW command handler.
2037.76s - 2039.16s |  And we start glitching.
2039.16s - 2043.48s |  And we again, you know, wait for the battery to run out, start over, and so on and so forth.
2043.48s - 2046.80s |  The glitch was not very stable at this point in time.
2046.80s - 2052.00s |  And so, but eventually, I got a success.
2052.00s - 2058.88s |  And so I decided I will just send the USBW command with the address 0000.
2058.88s - 2063.76s |  And I got this back, 000620.
2063.76s - 2065.80s |  And you know, this is a little endian machine.
2065.80s - 2067.28s |  So you reverse it.
2067.28s - 2072.56s |  And if you do a lot of arm reversing, you will immediately spot why this indicates success.
2072.56s - 2074.32s |  This is the stack pointer reset value.
2074.32s - 2078.12s |  We just read address zero of the physical memory of the chip.
2078.12s - 2083.16s |  And so we can read and also write arbitrary memory on the ACE3.
2083.16s - 2092.13s |  So time to dump.
2092.13s - 2094.81s |  And again, like I, my payload was not the greatest.
2094.81s - 2097.77s |  And so I could dump four bytes at a time.
2097.77s - 2101.37s |  And so it took hours and the battery ran out.
2101.37s - 2110.13s |  And I had to reflash, restore, recharge, glitch again, and then dump it again.
2110.13s - 2113.17s |  But eventually, I had the full firmware.
2113.17s - 2117.17s |  A full dump of the ACE3, ROM and RAM, and so on and so forth.
2117.17s - 2118.41s |  So awesome.
2118.41s - 2122.37s |  We can actually start reverse engineering this chip.
2122.37s - 2127.41s |  And the main thing that I learned during this is dumping unknown silicon is actually possible.
2127.41s - 2130.05s |  Like, I knew almost nothing about this chip, right?
2130.05s - 2131.77s |  And it's not super difficult.
2131.77s - 2135.61s |  It just takes a lot of persistence and, you know, dealing with annoyances.
2135.61s - 2141.33s |  And we can actually get code execution without having firmware, even on a microcontroller.
2141.37s - 2143.29s |  I thought that was really cool.
2143.29s - 2147.25s |  And now we can actually start researching the ACE3.
2147.25s - 2152.37s |  Now, the equipment I used with like the chip shoulder, Husky and so on, this is all very
2152.37s - 2153.37s |  expensive, right?
2153.37s - 2156.65s |  Like the total is probably like 8k or something.
2156.65s - 2158.77s |  And you know, so let's make it cheaper.
2158.77s - 2164.81s |  So I imported the entire attack onto the Pico MP, which is like a super low cost electromagnetic
2164.81s - 2166.97s |  fault injection tool.
2166.97s - 2172.17s |  And I put a firmware on the chip shoulder that does all the triggering on the chip select
2172.17s - 2174.65s |  line and so on and so forth automatically.
2174.65s - 2180.61s |  And so you can now attack the ACE3 and dump it for $60, which I think is pretty fair.
2180.61s - 2186.18s |  And so, yeah.
2186.18s - 2189.34s |  With that said, that's all I have for you today.
2189.34s - 2192.50s |  We have a bit of time for Q&A, but thank you.
2192.50s - 2196.04s |  And also, if you're interested in actually trying some fault injection, we are running
2196.04s - 2198.42s |  a glitching lab over at the Embedded Systems Village.
2198.42s - 2203.50s |  And so come by and you can actually bypass some protections on chips by zapping them
2203.50s - 2206.06s |  or fiddling with the voltage rails and so on.
2206.06s - 2206.90s |  So yeah, thank you.


url: https://www.youtube.com/watch?v=cHsRxkfxvq8
title: DEF CON 32 - The Rise and Fall of Binary Exploitation - Stephen Sims
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=cHsRxkfxvq8",
  "title": "DEF CON 32 - The Rise and Fall of Binary Exploitation - Stephen Sims",
  "description": "For the past 20+ years binary exploitation has been seen as the ultimate challenge and prize, when exploiting large applications and operating systems. During this period, the question of \"How much longer will we be able to do this?\" has been asked countless times, and with good reason. Memory safety and corruption issues with low-level languages have been an enormous challenge for OS and application developers. There are certainly efforts to move to \"safer\" languages such as Rust, but those languages need to mature a bit longer before they're able to stand up to the capabilities of a language like C++.\n\nThanks to exploit mitigations and memory protections, a large number of these vulnerabilities are not exploitable. There are the mature mitigations, such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), and then newer ones such as Control-flow Enforcement Technology (CET) and Virtualization Based Security (VBS). A large number of these mitigations are not enabled by default on the Windows OS, due to the fact that many need to be tested to ensure they do not break production applications. In this presentation, we will take a technical dive into the state of binary exploitation and the effectiveness of the many available mitigations, by looking at the way they're enforced.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2860,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.76s | This text was transcribed using whisper model: large-v2

 So, thank you so much for coming. Uh, I know it's early on a Saturday at DEF CON. I talked to
4.76s - 8.24s |  some people last night, they're like, when are you talking? It's at 11 AM. I don't get up
8.24s - 13.24s |  till 3, sorry. So, I appreciate the effort. Or maybe you're still up. So, I wanna move pretty
15.78s - 19.88s |  quickly here. I've got a handheld mic, I might walk around a bit. I don't have a lapel mic
19.88s - 24.58s |  because flippers and stuff like that. So, we'll see what we do. But, uh, I've got a lot of
24.58s - 28.36s |  slides and I wanna make sure I get through everything. So, I've got a quick agenda that I
28.38s - 33.42s |  will start with. Let me quickly introduce myself for those of you who may not be familiar with
33.42s - 39.52s |  who I am or my work. So, my name is Stephen Sims. I've been a vulnerability researcher for
39.52s - 44.54s |  going on 20 years now. I've, was lucky enough early on, uh, to have computers in the house and
47.44s - 52.24s |  be able to have access to video gaming and all the fun things early on and editing hex edit,
52.24s - 56.34s |  you know, using a hex editor and hacking, all the things you guys have already done. So,
56.36s - 63.10s |  let's move on beyond that. I've sold a lot of exploits over the past couple decades. I
63.10s - 68.64s |  corrected myself there. I thought it was over 30 browser exploits but I didn't wanna fib so I
68.64s - 73.88s |  went back and counted and it ends up being 29 of them. Um, those are mostly used after free
73.88s - 79.48s |  and tight confusion vulnerabilities. I've always been someone who sells exploits. I don't
79.48s - 85.76s |  typically disclose them publicly or through other programs. I will talk a little bit about
85.78s - 89.24s |  that because obviously there are ethics associated with exploit sales so I'll give you my
89.24s - 95.12s |  position when we get there. I found a couple kernel vulnerabilities on Windows 1 RCE which
95.12s - 98.82s |  you can get a lot of money for nowadays. Had I known a little bit more when I sold it, it
98.82s - 102.46s |  would have been better. But lots of other vulnerabilities in different applications and
102.46s - 105.60s |  hardware out there over the years. I've been lucky enough to have a lot of great relationships
105.60s - 111.00s |  and such. I moved to San Francisco early on in the 2000s and lived on Treasure Island where
111.00s - 114.78s |  we used to joke and call it Hacker Island because there was so many hackers there. People
114.82s - 119.52s |  from Burning Man, people from all kinds of different backgrounds but it was just a free for
119.52s - 124.36s |  all and it was pretty incredible. Lots of people from CDC lived out there and others and you
124.36s - 129.24s |  know you learn pretty early on to uh how to properly use a handle and not get yourself doxxed
129.24s - 134.24s |  out there. I'm also uh like I said a musician at the Sands Institute on the offensive
134.24s - 138.94s |  operations curriculum lead and I have a couple courses there on advanced exploit development. I
138.94s - 142.48s |  am one of the co-authors of Grey Hat Hacking if you've heard of that book series. We're
142.48s - 147.82s |  talking right now about doing a 7th edition so hopefully that comes to fruition. And then I
147.82s - 152.16s |  also run a weekly stream you might have heard of called Off By One Security where I do my
152.16s - 156.10s |  own stream solo and I also have a lot of guests on and I've been lucky enough to have some
156.10s - 161.06s |  really amazing people on and uh that just makes it all great. And I appreciate so many of
161.06s - 164.24s |  you have come up and say thank you for the stream cause that means a lot to me and that's
164.24s - 167.44s |  what I do it for is to give back to the community. And if any of you are ever interested in
167.44s - 172.98s |  being a guest I'd love to uh hear from you. Alright so quick agenda we're gonna start off
172.98s - 178.58s |  doing a quick history of mitigations. We're not gonna cover all of them there's dozens and
178.58s - 182.68s |  dozens of them so we can't get through them all but we'll touch briefly on them kinda show you
182.68s - 187.82s |  where we were where we are today. Microsoft MSRC was generous enough to get me some really
187.82s - 192.40s |  cool cutting edge data that uh has not been published yet so you'll get to see some
192.40s - 196.90s |  vulnerability information from Microsoft's perspective in relation to RCEs and local
196.90s - 201.76s |  priv and other types of bugs. Then we'll quickly go through payouts. I did a stream last
201.76s - 206.50s |  Friday on nothing but payouts and all the different types of buyers out there and uh I
206.50s - 211.74s |  got a lot of hate and a lot of love from that one which I expected because again it's it
211.74s - 217.64s |  involves your morals and it's very ethical you know considerations to have. The we'll
217.64s - 221.72s |  quickly look at the role of machine learning and AI in general in vulnerability research
221.72s - 226.28s |  because that's obviously a hot topic as of late and will continue to be. And then we're
226.30s - 230.74s |  gonna switch over into being technical cause I don't wanna do a talk without being technical
230.74s - 235.54s |  and we'll get into looking at one specific mitigation that is implemented in the Windows
235.54s - 241.32s |  kernel. And my main point of wanting to show you that is so that if you yourself wanna
241.32s - 245.48s |  understand how a new mitigation works that comes out. If you wanna figure out how to
245.48s - 250.52s |  bypass it how to work around it or other things or how effective it is if you're a defender
250.52s - 255.10s |  you need to go and debug it. It's really the only way you can learn other than taking other
255.12s - 259.72s |  people's published information. So every time a new mitigation comes out I love to jump in to
259.72s - 263.92s |  debuggers and disassemblers and go and understand it as best I can. And then we'll do some
263.92s - 270.00s |  takeaways. That is the agenda. So the golden years I'm not one you know it's it's not my right
270.00s - 273.74s |  to say what the golden years of hacking is but I have been doing it long enough and I
273.74s - 278.84s |  remember you know reading it was before my time but I left one smash in the stack for fun and
278.84s - 283.92s |  profit and other papers released around that time. Open wall, work that Brad Spengler was
283.94s - 289.90s |  doing so many other brilliant researchers and when you when when I personally think about
289.90s - 294.78s |  what the golden years is it's before all these mitigations became really effective. You'll see
294.78s - 299.48s |  on a diagram that I put together coming up in a moment that there are certain years where
299.48s - 304.42s |  stuff got real serious and it's only gotten harder and harder since then. So I would say the
304.42s - 309.66s |  golden years of memory corruption bugs is long over but still possible and those bugs are
309.66s - 315.88s |  very valuable now and you'll see that in a moment. But you see here Windows up at the top
315.88s - 321.34s |  and we can go way back to when trust from escape and wag that was what became Emmet or at
321.34s - 325.42s |  least some of the controls and mitigations there became the enhanced mitigation experience
325.42s - 330.32s |  toolkit which of course now today is exploit guard. But Windows it wasn't until XP service
330.32s - 334.76s |  pack 2 where mitigations were a thing. I remember when that dropped and admins were
334.76s - 339.00s |  freaking out because it was over a gigabyte update and there were a lot of new mitigations
339.04s - 342.44s |  published. You can see them listed there. I'm not going to go through every one of them but
342.44s - 347.68s |  notable ones like data execution prevention that's huge and in stack canaries. Linux down
347.68s - 352.32s |  below I was doing some uh research and thankfully Brad Spangler pointed me to some a great
352.32s - 357.32s |  talk from uh maybe a decade or so ago that really went through every single mitigation when it
359.76s - 364.70s |  came out the bug classes and gave credit where credit is due to all the brilliant researchers
364.70s - 368.70s |  and that's a really hard thing to do. There's a lot of confusion when you go out there
368.70s - 373.44s |  trying to find out who the original source was that published a technique for
373.44s - 379.74s |  exploitation or some documentation and I try my best to give that credit. So the information
379.74s - 386.18s |  there under Linux all the way back to 1997 I mean people were thinking about security way
386.18s - 391.92s |  back in 1997 especially on the Linux side of the house which as expected is always first in
391.92s - 397.46s |  that realm. But open wall was a big one for that one. Uh Mac OS you can see was a bit late to
397.46s - 402.66s |  the game. ASLR like randomization didn't come out until like 2011. That's way behind
402.66s - 409.70s |  Vista even. So all the operating systems now though are at a pretty good state. Some notable
409.70s - 413.94s |  mitigations this is not complete by any means. I put this together there's always
413.94s - 418.68s |  possibilities there's mistakes. A lot of times mitigations come out like before the
418.68s - 423.28s |  official OS release of that mitigation. You might hear well low fragmentation heap that
423.28s - 428.04s |  was around during XP service pack 2 or 3 but it didn't fully get implemented to replace the
428.04s - 432.72s |  front end heap allocator until Windows Vista. And then they got rid of the look aside list
432.72s - 436.86s |  except for in the kernel. So like a lot of this stuff can be fuzzy. So if the arrow is going
436.86s - 440.80s |  back that means back ported. A lot of times mitigations come out some of them get back
440.80s - 444.76s |  ported some of them don't get back ported. But you can see some other notable ones like
444.76s - 449.56s |  Windows 10 obviously came out uh control flow guard was a significant one. Microsoft was
449.56s - 453.46s |  pretty proud of that one and made some pretty bold claims about it. But none of these
453.46s - 459.62s |  mitigations by themselves are a one stop shop. They are complementary to one another. If
459.62s - 465.16s |  there's one weak link in the chain if one single mitigation is not working properly or if one
465.16s - 471.34s |  library is not compiled to participate in a mitigation it breaks the whole thing. So it can
471.34s - 476.28s |  be difficult to get all of them there. I usually put up like a Venn diagram that shows
476.30s - 481.28s |  overlapping circles where you've got different categories of mitigations like those enforced
481.28s - 486.32s |  by the operating system, those enforced by the compiler, those enforced by a tool kit like
486.32s - 490.92s |  exploit guard or malware bytes or whatever you might be using. And if you get to the merged
490.92s - 495.32s |  areas in the circles you're taking advantage of multiple categories and that's where things
495.32s - 500.10s |  become much more effective. Because depending on the type of exploit you're using or you're
500.10s - 505.46s |  writing a mitigation might not even matter. For example font protection. Like they
505.48s - 509.56s |  introduced font protection because I think it was Dooku or Stuxnet. It was a font based
509.56s - 514.76s |  vulnerability. It was a sign extension bug and it affected the Windows kernel and was a
514.76s - 521.86s |  brilliant exploit. That font mitigation just says you can't use any fonts unless it's in the
521.86s - 527.04s |  system 32 fonts folder. So no third party fonts to come along. But obviously that only
527.04s - 532.64s |  targets a very specific thing. So some of these mitigations don't matter when you're exploiting
532.66s - 538.30s |  things. So this is not something we're going to walk through. It's a pretty ugly slide but
538.30s - 542.54s |  it's something you can take a picture of. All it's showing is that with all of those
542.54s - 548.24s |  mitigations and that was not comprehensive by any means. It's a cat and mouse game where
548.24s - 555.04s |  you've got a mitigation that comes out due to a bug class or an exploit technique. For
555.04s - 561.22s |  example look at arbitrary code guard or export address table filtering. EAF specifically
561.24s - 568.34s |  targets shellcode and how it accesses the exports table inside libraries like kernel 32. So
568.34s - 572.88s |  they target very specific things and it's that cat and mouse game because when a new exploit
572.88s - 577.88s |  technique comes out or a new bug class a mitigation goes in to try to kill it. And then a
577.88s - 582.72s |  work around comes out and then they update the mitigation. A perfect example is back in
582.72s - 588.02s |  2014 and I was just hanging out with Corlan Coder like a week ago in Amsterdam at Hackfest
588.02s - 592.90s |  that we had out there. And he and I have something very in common with each other. Actually
592.90s - 597.84s |  I'll show you in a diagram coming up very soon. It might be the next one. It is the next one.
597.84s - 603.50s |  So this is the last version that Microsoft published outwardly that I've seen anyway from
603.50s - 609.82s |  Matt Miller and other folks at MSRC. And you notice it only goes up to like 2013 or so or
609.82s - 615.22s |  2015, 16. I can't even see it. But what I want you to look at here is and unfortunately I
615.22s - 619.82s |  don't have a laser pointer on this thing. But look at the grey area to the right side and see
619.82s - 626.06s |  how it's a very wide gap. And then all of a sudden after that it shrinks down. The reason that
626.06s - 632.60s |  happened is because Microsoft in 2014 introduced a couple mitigations that really killed
632.60s - 639.48s |  specific types of bug classes in the browser like type confusion, use after free. I brought up
639.48s - 644.82s |  Corlan Coder because he and I both were writing quite a few exploits per year against a
644.82s - 650.62s |  browser and then all of a sudden in June, July 2014 they stopped working. The exploits
650.62s - 656.00s |  stopped working because they put in deferred free, isolated heaps and then MemGC came
656.00s - 660.70s |  shortly after. And I remember even seeing people like Skylines who was releasing lots of
660.70s - 666.60s |  vulnerabilities or selling exploits or disclosing them saying one time in a tweet, hey does
666.60s - 671.50s |  anybody have a MemGC bypass? I'm literally sitting on a bunch of edge vulnerabilities that I
671.52s - 677.40s |  can't exploit. So that's the job of the OS developers who work with mitigations is to
677.40s - 683.84s |  identify and understand a specific exploit technique or bug class and try to kill it.
683.84s - 689.68s |  Deferred free is or MemGC I should say is so effective because it does validation of
689.68s - 694.92s |  references. Microsoft used C++ smart pointers to do dynamic tracking of objects and
694.92s - 699.72s |  reference tracking and the way in which they chose to track references allowed for a certain
699.74s - 705.18s |  type of exploit to be quite possible. So by adding the MemGC control in deferred free,
705.18s - 709.32s |  there's validation going on to make sure that there are other, there are no other references
709.32s - 713.82s |  to the object that's about to get freed before giving it back to garbage collector for reuse
713.82s - 719.50s |  to get recycled. And that's why it shrinks down so much. So Microsoft is very kind as I
719.50s - 724.34s |  said before in getting me this diagram and the next one. This one is remote code
724.36s - 730.66s |  execution CVEs by patch year. So you have to imagine that the majority of CVEs that come out
730.66s - 735.04s |  are privately disclosed. Meaning that there is no public exploit code. And that's why
735.04s - 740.54s |  there's a lot of exploit framework vendors out there like Rapid 7 with Metasploit and
740.54s - 746.48s |  Core Impact and Immunity Canvas and Saint. There's all these different frameworks and what
746.48s - 753.48s |  they want to be able to say is we have the most exploits for privately disclosed CVEs.
753.50s - 758.06s |  Because if you're a red team or some other offensive group and you want to be able to break
758.06s - 765.06s |  in obviously the targets, most companies are terrible about patching. So if we can get
765.06s - 770.60s |  some really smart people to do things like patch diffing, identify the delta in the code
770.60s - 775.34s |  and weaponize these end day vulnerabilities, then we're going to have a much more valuable
775.34s - 780.02s |  framework because we're able to allow you to exploit things that no one else can. I would
780.02s - 785.80s |  say close to like 90 percent of CVEs are privately disclosed. No public exploit code. So
785.80s - 791.44s |  that is absolutely a profitable business to go and write or weaponize end day
791.44s - 795.54s |  vulnerabilities. Because again organizations are terrible about patching. But you can see
795.54s - 799.24s |  we're not going to walk through all the data. I'm going to tweet this afterward and the slides
799.24s - 803.52s |  obviously will come out. But this is great stuff to use internally with your teams and your
803.52s - 808.52s |  threat intel folks and SOC and everyone else to say hey these are some things we should be
808.52s - 813.06s |  considering. Uh how effective are the mitigations? What bug classes are the most popular right
813.06s - 819.26s |  now? And this specifically is for RCE and you can see the number in the middle. The uh next
819.26s - 825.80s |  one here is overall CVEs by patch here. So this is not just memory safety or if you go back to
825.80s - 830.88s |  that initial slide that I had up, that was all memory corruption for the most part. All of it.
830.88s - 836.84s |  And I remember some patch Tuesdays there'd be like 50 patch, 50 patches coming out for
836.84s - 841.54s |  Internet Explorer and Edge alone. It was a serious problem and they had to solve it with
841.54s - 846.28s |  these mitigations and did a quite an effective job. But this shows you no memory corruption.
846.28s - 849.92s |  If you look at the left, that's the big green one in the middle. And if you look to the left
849.92s - 855.28s |  it's getting less and less and sometimes it gets bigger and smaller. But that is happening
855.28s - 860.06s |  because obviously secured code initiatives, introducing rust into the kernel to protect
860.06s - 864.36s |  critical components, the mitigations being very effective. That is what changes the
864.38s - 869.26s |  trajectory here. And you can see things like deserialization and other types of bugs start to
869.26s - 873.26s |  pop up and get more popular. Again, cat and mouse game and we're always trying to find new
873.26s - 878.44s |  ways of getting in. So how mitigations have affected payouts. I'll quickly go through this
878.44s - 882.40s |  one because again I want to make sure I have enough time. But and if you want more
882.40s - 886.48s |  information on this, if you go to the Off By One security channel on YouTube, look at last
886.48s - 892.02s |  week's stream. I spent like 2 hours almost talking specifically about this process. But
892.04s - 895.62s |  quickly going through, there are different categories of buyers. You can always go to the
895.62s - 901.42s |  vendor themselves, like Microsoft, Google, Apple and they will pay you. Some companies have
901.42s - 906.12s |  bounties, some don't. But they typically don't pay as much as third party buyers out there
906.12s - 910.40s |  depending where they sit on the realm of ethical boundaries. But they'll pay you and it's
910.40s - 915.14s |  gotten better. Then you go a little bit further. Okay, we can go to ZDI, the Zero Day
915.14s - 919.80s |  Initiative or go out to CanSec West and participate in Pwn2Own or you know Bug Crowd,
919.82s - 924.36s |  HackerOne, iDefense which I don't think are buying exploits anymore. But those are third
924.36s - 928.80s |  parties who do work with the vendor and they get it patched. The exploit code never goes
928.80s - 934.56s |  public. When you sell an exploit, it's no longer your exploit. Typically they don't pay you.
934.56s - 938.88s |  The money gets put into an escrow and you have to wait to get paid because they want to make
938.88s - 942.64s |  sure you're not trying to double dip and sell it to multiple buyers out there until you
942.64s - 946.48s |  build up a good trust. So we go out further and I'm not going to name any names because they
946.50s - 951.10s |  get mad. But there are all kinds of different third party buyers on behalf of different
951.10s - 956.78s |  intelligence agencies and governments around the world. Believe me, I've sat with them many
956.78s - 961.08s |  times and they are looking for bugs from you. Now you typically don't go knock on the front
961.08s - 965.82s |  door of the NSA, I don't advise that. But there are third parties out there and they will pay
965.82s - 971.22s |  more than the below ones that we just talked about. How much? We'll talk about some money
971.30s - 977.44s |  here in a moment. You go further than that, there are these third party companies that are
977.44s - 982.24s |  exploit acquisition companies. They refer to themselves as crowd fences, a relatively new
982.24s - 985.72s |  one. You heard of Zerodium? I don't think they're buying anymore. They used to be Voopin.
985.72s - 991.92s |  And there's Volnpoint. I don't know anything about Volnpoint but there's some hefty amounts
991.92s - 997.46s |  of money that you can make there. Millions. I think up to 9 million US dollars for an iOS
997.50s - 1003.78s |  bug. I mean full chain, obviously. It's got to be all the things. And then you've got kind of
1003.78s - 1009.54s |  the most unethical place you can go, which are random people. This is where you've got to be
1009.54s - 1012.52s |  really careful because you don't know who you're selling to and you don't know who they're
1012.52s - 1017.72s |  selling it to. You don't know who the buyer is. But this could be over Tor, Telegram, people.
1017.72s - 1022.96s |  If you start getting known for selling exploits or having the skills to find zero days and
1022.96s - 1028.30s |  weaponize them, especially in today's climate with how hard it is, they will find you. But
1028.30s - 1031.90s |  you've got to be really careful when you're selling this stuff to protect you and your family
1031.90s - 1036.44s |  and other things. I really again recommend watching that stream if you're interested in that
1036.44s - 1042.48s |  space because I go into some good detail about that. So examples of how much you get paid for
1042.48s - 1048.28s |  some of this stuff. Now this example is one from me personally. I've always sold things. I
1048.28s - 1052.66s |  don't sell to unethical buyers though. Personally that's my choice. Yes you get paid less but
1052.66s - 1057.66s |  that's you know, your choice. So someone like iDefense or uh ZDI back in 2014 before those
1060.30s - 1065.16s |  mitigations I told you about dropped, you could expect to get 10 to 30 thousand US dollars for
1065.16s - 1071.38s |  like a USAPTA free exploit. And back then you typically didn't need a big chain. Maybe one
1071.38s - 1076.48s |  exploit or two, like an information disclosure bug to bypass ASLR if you needed it. But if
1076.48s - 1082.18s |  anyone remembers and I'm sure some of you do, JRE6, the Java Runtime Environment 6, MSV CR
1082.70s - 1089.38s |  71.dll. That made me a lot of money because they didn't add dynamic rebasing to that module and
1089.38s - 1093.64s |  it also had all the gadgets you need to get around data execution prevention. So it's a
1093.64s - 1100.52s |  beautiful thing. So if you found one remote code execution uh USAPTA free against a browser
1100.52s - 1105.86s |  that's all you needed. There was no sandboxing on Internet Explorer Edge back then. And so you
1105.86s - 1111.74s |  could expect to get paid that amount but now it's a lot harder. On the more unethical side of
1111.76s - 1118.54s |  it, you can expect to get paid 10 to 20 times more. So you can see an example there from
1118.54s - 1123.48s |  CrowdFence. They say offering up to 400,000. That's straight from the website. Another
1123.48s - 1130.54s |  example is IOS. Zero click. Apple created something called Blastor to try to triage text
1130.54s - 1135.52s |  messages coming in to make sure code execution isn't occurring. Like it's gonna be a lot
1135.52s - 1141.42s |  harder to jailbreak or root that phone because of Blastor. So you gotta have like 4 to 6
1141.44s - 1146.50s |  zero days chained together at least. And it's not one person out there doing this anymore.
1146.50s - 1152.32s |  Back in 2014 you and yourself could find enough to get around all the things and get code
1152.32s - 1157.28s |  execution. But nowadays especially like in the kernel with HVCI and other cutting edge
1157.28s - 1161.72s |  mitigations you could say. It's hard. The execute primitive is gone. You get read write
1161.72s - 1165.16s |  opportunities but even that can be challenging with code signing and all kinds of other
1165.16s - 1170.70s |  things. But that is why the price tag goes up so much. So you can see 2014 I remember
1170.74s - 1175.68s |  Zerodium was offering up to 2 million, 2.5 million for IOS and Android full chain zero
1175.68s - 1182.36s |  clicks. Now you can get up to 9 million with VulnPoint and CrowdFence I think I saw. And
1182.36s - 1186.86s |  then this example here if you've ever seen Operation Zero it literally says on the Twitter
1186.86s - 1192.50s |  page on their home page the only Russian backed exploit acquisition program. And it
1192.50s - 1197.50s |  literally says we are non-NATO friendly. But 20 million US dollars you could retire. That's
1197.64s - 1203.54s |  amazing. But look who you're selling. You are literally doing treason at that point. I'll
1203.54s - 1207.92s |  stop saying literally. And they will use that to attack your country. So I don't know if you
1207.92s - 1213.22s |  want to be in that position but it's an option for you. So we'll jump now into machine
1213.22s - 1219.66s |  learning for vulnerability research. This one is one that I have a lot of interest in
1219.66s - 1224.66s |  because it saves you time. You already know but automation and machine learning or
1227.64s - 1233.04s |  the umbrella of AI in general are things that aren't going away. And we don't want to
1233.04s - 1237.62s |  fight it. We want to leverage it and use it to complement our skills. If you fight it you
1237.62s - 1242.62s |  will lose. When ChatGPT was made public I think it was November, December 2022 shortly
1246.86s - 1252.46s |  after that spring I believe Project Zero started an initiative of course to go and see
1252.46s - 1258.36s |  how AI in general, machine learning, can help with vulnerability research. Specifically
1258.36s - 1265.04s |  for memory corruption bugs. If you remember a long time ago DARPA back in like 2016 they
1265.04s - 1270.04s |  had a a challenge. And they paid I think 2 or 3 million US dollars to the winning team. And
1272.32s - 1278.56s |  the challenge was we want you to write basically machine wars. Automated hacking,
1278.56s - 1282.42s |  automated detection and defense. Where the machines are fighting each other. Almost
1282.42s - 1286.70s |  like a capture the flag. And back then there was a lot of universities looking into very
1286.70s - 1291.44s |  basic exploitation techniques like stack overflows. That's a pretty easy thing to
1291.44s - 1295.90s |  weaponize. Okay the buffer is overrun and you overwrite a return point like that's very
1295.90s - 1302.14s |  basic. So it's not so hard to write something that will do that for you automatically. But
1302.14s - 1307.98s |  when you're getting into harder bug classes, I gave a couple examples like type confusion.
1308.00s - 1313.24s |  Those are difficult to find. Static analysis, dynamic analysis, manual code inspection, it
1313.24s - 1318.68s |  doesn't matter. Those are tough to find. Because as a developer you can't possibly get your
1318.68s - 1324.76s |  code into the context for every possible situation where it might be run. Different
1324.76s - 1328.72s |  libraries, different patch levels, different things people do to their computers. A
1328.72s - 1333.60s |  developer can't anticipate what that code might run into in the future. So these
1333.62s - 1339.22s |  vulnerabilities manifest thanks to things like C++. A lot of people ask well why aren't we
1339.22s - 1344.70s |  already on Rust? Why isn't the Windows kernel rewritten entirely in Rust? I can't answer
1344.70s - 1349.70s |  that 100% but I can give my opinion which is wow. Theirs is louder than mine, it's amazing.
1352.64s - 1357.64s |  Alright I'll, okay. Cutting me off. So Rust, remember when HD more and the Metasploit team
1358.02s - 1363.02s |  they were on Perl early on. Metasploit came out in 2003. And at one point they said we need to
1368.16s - 1372.60s |  get off Perl because the language wasn't growing at the same pace that they needed it to. And
1372.60s - 1378.44s |  so they were going to choose between Python and what's the other one? Ruby right? And they
1378.44s - 1383.48s |  chose Ruby. And I remember talking to HD more at Defcon a long time ago and I believe it was
1383.48s - 1388.16s |  the Ruby developers were willing to work with that project because it became the largest
1388.16s - 1393.66s |  open source Ruby project to improve the language to meet the needs of the developers. So the
1393.66s - 1398.40s |  language developers working with the developers of the framework. I imagine it's a similar
1398.40s - 1405.10s |  thing where C++ has been around for a long time. It's very mature, it's very powerful. So a
1405.10s - 1409.72s |  couple things you get from that. You've got developers with decades of experience who can't
1409.72s - 1414.20s |  just overnight over to Rust. And you've got limitations in the language that might not allow
1414.20s - 1420.60s |  it to do the things that C++ can do. And yes, Rust is mimicking like low level behavior with
1420.60s - 1426.20s |  the speed and the power of being able to directly manipulate processor registers and memory but
1426.20s - 1432.28s |  unsafe languages tend to be extremely powerful. So it's, those memory corruption bugs they're
1432.28s - 1435.78s |  just, they're difficult to squash. And it's not going to be overnight where we replace
1435.78s - 1439.16s |  everything. But it is slowly happening. I believe the first thing you saw in the Windows
1439.16s - 1444.60s |  kernel was when 32k.sys driver, some implementation of that got put over to Rust. So
1444.60s - 1448.06s |  anyway, from a high level, because I can't really go into what Google's doing at nap time, I
1448.06s - 1451.78s |  read the paper, that's what they called it was project nap time. And I had been working on a
1451.78s - 1455.88s |  similar thing but as a single person so they've got a team of people. I've also talked to
1455.88s - 1460.82s |  multiple other teams out there who are doing the same thing. And that is how do we create
1460.82s - 1466.58s |  agents, different agents that serve different roles. They do different things. Because just
1466.58s - 1472.18s |  like humans, if you try to give AI in general, and again that's an umbrella encompassing
1472.18s - 1478.86s |  term, for everything underneath it. If you ask a single agent or LLM to do everything for you
1478.86s - 1483.46s |  it's, it's not going to do a great job. But if you break it down, just like humans, don't ask
1483.46s - 1488.70s |  one developer to go rewrite Microsoft Office suite. That's too much. Break it down into
1488.70s - 1493.54s |  different groups, different agents and roles, it's going to be a lot more possible. And the
1493.56s - 1498.10s |  gist of that, they did make some really impressive progress and they're going to continue
1498.10s - 1503.18s |  working on it of course. But said, as it quotes on the slide, there's still a long way to go.
1503.18s - 1507.88s |  We're not going to be replaced anytime soon because there's so much nuance that it can't
1507.88s - 1513.88s |  have, like humans can have the way we think. It'll get better of course. But going into that
1513.88s - 1518.40s |  a little bit more, this is an example of something called crew AI, if you've heard of that.
1518.40s - 1523.40s |  There's multiple frameworks out there for such, open source. And it has this concept of the
1523.42s - 1527.46s |  agents and these roles that things serve. So you can see on the right, we're saying we want you
1527.46s - 1532.80s |  to be a threat intelligence analyst. This is what your job is. And you feed it information, it
1532.80s - 1538.90s |  uses RAG and other cool technology to ingest all kinds of threat intel data and other. And
1538.90s - 1544.78s |  then it does a thing. And to put that in like a, a chain, you've got over on the left, like an
1544.78s - 1550.68s |  agent that is the threat intel agent. And it's ingesting things like PDF documents and just
1550.70s - 1556.04s |  threat intel data. Everything it can get its hands on. And then the result of that, the output,
1556.04s - 1560.98s |  like the list of MITRE ATT&CK TTPs as an example, because everyone knows that one, gets fed
1560.98s - 1565.88s |  into two other agents. One's the red team side and one's the blue team side. One's doing
1565.88s - 1572.52s |  detection engineering and generating Sigma or some kind of other rules out there. And the red
1572.52s - 1576.86s |  team side is using it for continuous automated red teaming and patent testing. So they're
1576.88s - 1581.18s |  consuming and ingesting the same data, using it for different purposes. A lot of companies are
1581.18s - 1585.48s |  getting into this now. A lot of managed socks out there are doing exactly that. Here's your
1585.48s - 1590.90s |  Yara rules, here's your Sigma rules, whatever from it. This is a pretty ugly slide but it's one
1590.90s - 1595.06s |  that I put together because this is what I'm working on personally and I have been for some
1595.06s - 1601.44s |  time now. I, I am not anywhere close to where I want to be and if Google's not getting the, the
1601.46s - 1605.46s |  best results in the world, like meaning it can replace humans with VR or the other way around,
1605.46s - 1610.26s |  um, then I'm certainly not going to be able to do it alone. But I have made some good progress
1610.26s - 1616.54s |  which is I feed into an LLM all the different CVEs, all the project zero or other public
1616.54s - 1621.54s |  research out there, all GitHub, at pastebin, anything I can feed it around exploits and patch
1624.04s - 1630.28s |  diffing, binary diffing and all that, all that data. So one thing I do a lot is end day
1630.28s - 1635.36s |  vulnerability weaponization. I download on patch Tuesday unless I don't have time. You get
1635.36s - 1638.82s |  used to looking at this stuff. You look at all the CVEs, you look at the knowledge base
1638.82s - 1643.94s |  articles, you try to figure out which ones are most likely exploitable. And you're probably
1643.94s - 1647.24s |  still wrong and you learn a lot so you got to keep telling yourself because it's very
1647.24s - 1651.24s |  frustrating when you spend two weeks looking at a patch vulnerability that you realize you
1651.24s - 1656.38s |  cannot weaponize because of mitigations or some other factors. Because even if a
1656.38s - 1661.98s |  mitigation can 100 percent stop a vulnerability from being exploitable, they're still
1661.98s - 1666.90s |  going to patch it. Because what if somebody turns a mitigation off? Or it's just, you know,
1666.90s - 1671.90s |  it's good, it's good habit to, to clean that stuff up. So when you do a patch diff and you look
1674.26s - 1680.08s |  at the delta of the code, use something like diaphora or bin diff and you take a look at the
1680.08s - 1686.34s |  changes at the function or the code level, you can give that information to the LLM and
1686.34s - 1691.52s |  teach it how and why it's a certain type of vulnerability. And then the output from that can
1691.52s - 1696.62s |  go into the next agent which is really doing the patch diffing for new vulnerabilities that
1696.62s - 1701.36s |  got patched. So it's taking the patch, it's extracting it or grabbing it from Winbindex,
1701.36s - 1707.30s |  doing the diffing and it's looking at the delta and it's knowledge of all the prior diffs that
1707.30s - 1712.36s |  it has learned about and all the information about exploits that are public or private. It's
1712.40s - 1718.70s |  using that to make a good guess as to what most likely is the vulnerability type. And then we
1718.70s - 1723.64s |  have a corpus generation agent which is trying to generate trigger files that you can then
1723.64s - 1728.24s |  feed to whatever it is and hopefully trigger the vulnerability. And then of course you would
1728.24s - 1733.74s |  have to go in and see if you can actually weaponize it. So it's automating the process of
1733.74s - 1740.36s |  binary diffing and trying to find where the bug is and trying to help you generate malformed
1740.36s - 1744.62s |  documents or whatever you need to send to the target to try and get it to crash. I've got
1744.62s - 1749.84s |  this working pretty good. It's not great but it's pretty, it's saving me a ton of time. I
1749.84s - 1756.54s |  would say probably like 10 to 20 times it's saving me on that research effort which is pretty
1756.54s - 1761.18s |  damn good for me anyway. So understanding how mitigations work, we're going to jump into a
1761.18s - 1767.26s |  more technical part now. I, there's so many mitigations so I just chose one random one and
1767.28s - 1771.96s |  also on my channel I do a lot of exploit mitigation reversing. If you're interested in
1771.96s - 1776.56s |  that stuff there's videos on that. But a lot of these mitigations especially the more
1776.56s - 1782.40s |  classic ones that came out with emits and the initial exploit guard. What they do is they
1782.40s - 1787.30s |  will hook something. So for example there are things called critical functions on Windows.
1787.30s - 1791.72s |  Critical function of one type will be any function that can change permissions in memory. Like
1791.74s - 1797.24s |  virtual alloc, virtual protect, heap create, write process memory. Those are critical APIs.
1797.24s - 1802.18s |  So we want to monitor those. So if we understand things about different bug classes out there
1802.18s - 1807.56s |  and different ways in which people exploit vulnerabilities then we can hook the flow of
1807.56s - 1812.72s |  execution and before we allow the function to be called that will in fact change permissions in
1812.72s - 1818.14s |  memory, we inspect it. And they can do that, you could do that by overwriting an entry in the
1818.16s - 1823.26s |  imports table so when it calls that function where it's linked it'll actually call your code
1823.26s - 1827.40s |  first or more likely they're going to hot patch or put a patch in the very beginning of the
1827.40s - 1832.98s |  function entry point and it will first jump to another location, execute some code, typically
1832.98s - 1838.68s |  points into something called payload restrictions dot DLL and it evaluates the environment to
1838.68s - 1841.78s |  make sure things look good. I'll give you one simple example. If you've heard of stack
1841.80s - 1848.24s |  pivoting before, Microsoft had the blue hat challenge and that was 2012, it was a long time
1848.24s - 1854.24s |  ago. But they paid over a million dollars US to the first place winner and then they had three
1854.24s - 1859.28s |  places, first, second, third and uh what they were looking for is help from the community to
1859.28s - 1864.48s |  stop return oriented programming. And one of the main things that we would do in use after free
1864.48s - 1869.76s |  exploits on browsers is we would pivot the stack pointer out to the heap because the stack
1869.78s - 1874.02s |  pointer is a register that only is supposed to point to the current thread stack to the top of
1874.02s - 1878.52s |  it. Let's not get into speculative execution and such but you know what I mean. And we like the
1878.52s - 1882.92s |  stack pointer because of three powerful instructions, push, pop, ret. That's the only
1882.92s - 1889.06s |  register that those instructions exist for. So that power, we want that in other places in
1889.06s - 1894.00s |  memory so what we would do is use an exchange gadget and it would exchange or pivot the stack
1894.00s - 1898.04s |  pointer with another register like the accumulator register. That would make it so the
1898.06s - 1902.52s |  stack pointer points out on the heap somewhere where maybe our ROP chain is, our exploit code
1902.52s - 1909.00s |  is. So great, it works. So anti-ROP which came out of right before Blue Hat was when Windows 8
1909.00s - 1913.60s |  all it did was it looked at something called the thread information block at the stack
1913.60s - 1918.14s |  boundaries, the stack high and stack low limits to make sure that the stack pointer points where
1918.14s - 1924.24s |  it's supposed to before allowing a critical API to be called. Very simple thing and it was very
1924.28s - 1928.28s |  easy to get around but it showed you Microsoft was taking return oriented programming
1928.28s - 1935.02s |  seriously. And then after that a whole suite of mitigations came out like 6, 7, 8 simulate the
1935.02s - 1941.26s |  execution flow, just many others. So again a lot of these hook and then they inspect and you
1941.26s - 1946.00s |  move on. Not all of them though. Some of them are enforced in user LAN, some of them are
1946.00s - 1952.74s |  enforced in the kernel and other factors. So let's look at one more more closely. So create
1952.74s - 1958.58s |  process, a little C++ program I put together. Lifted code of course too. And all it does is
1958.58s - 1965.32s |  it calls create process. There was a mitigation that Microsoft came out with called do not
1965.32s - 1970.62s |  allow child processes. And that was called the calculator killer because obviously a lot of
1970.62s - 1975.50s |  times people would use shell code to pop a calculator to prove that it worked. Well this
1975.50s - 1979.30s |  mitigation would kill that and prevent it from happening. So a lot of times if you're
1979.30s - 1984.60s |  exploiting like Microsoft Word or a browser or anything else you you want to create a new
1984.60s - 1990.60s |  process. This mitigation would stop you from being able to do it. So when I first saw the
1990.60s - 1996.44s |  mitigation I just assumed that it hooked create process in user LAN somewhere around NTDLL or
1996.44s - 2000.62s |  something it grabbed it and then payload restrictions would just inspect it and it would
2000.62s - 2004.62s |  just prevent you from being able to do it. But this one ended up being a kernel enforced
2004.64s - 2016.74s |  protection. So first off this is the code you compile it and great simple. When you run it so I'm
2016.74s - 2026.90s |  make sure this seems to be uh acting weird here. Alright there we go. So when you run it you can
2026.90s - 2031.22s |  see on command line right there a calculator pops up. We are exciting right? But that's that's
2031.22s - 2035.24s |  what it's job was. It's what it was supposed to do is just pass in an argument and it executes
2035.24s - 2040.60s |  and creates a process with that argument. Simple. Then I go into exploit guard that's a little
2040.62s - 2046.42s |  snippet on the top right and I turn that specific mitigation on. You can see there's audit mode
2046.42s - 2051.10s |  and then there's enabled mode and I I just enabled it. And then when we try to run it you can see
2051.10s - 2056.50s |  the command prompt in the middle it said create process failed. Okay the mitigation is working.
2056.50s - 2061.88s |  Down at the bottom you can see that as a defender you want to watch these things as so here's one
2061.88s - 2066.78s |  thing I'll take a step back. A lot of administrators are afraid to turn on these mitigations the
2066.80s - 2071.30s |  ones that aren't turned on by default by Microsoft. And Microsoft's kind of in a catch 22
2071.30s - 2075.08s |  situation because if they turn all the mitigations on that are available they might break your
2075.08s - 2079.18s |  applications. Because some of your developers have to adhere to the way in which these
2079.18s - 2083.42s |  mitigations work. But if they don't turn them on then you're mad at them because they didn't
2083.42s - 2087.92s |  protect you like so they're kind of in a bad spot. So they wait till things are mature enough. A
2087.92s - 2092.80s |  perfect example would be shadow stacks. If you've heard of shadow stack it's a relatively newer
2092.82s - 2098.32s |  mitigation though not in theory. Early 2000's someone mentioned the idea of that. It creates a
2098.32s - 2103.34s |  copy of return pointers and it requires at least an Intel Tiger Lake CPU. So obviously not
2106.80s - 2110.30s |  everybody's running one of the newest processors and they're not just going to turn that on by
2110.30s - 2115.24s |  default. So they have to wait. So a lot of these you do have to go on and turn them on. I
2115.24s - 2120.18s |  remember Microsoft released a paper a long time ago and said the adoption rate for the enhanced
2120.20s - 2126.60s |  mitigation experience tool kit, Emmet, was under 5%. So under 5% of organizations were
2126.60s - 2132.24s |  actually using Emmet in any way shape or form. Because the admins maybe don't understand how
2132.24s - 2135.84s |  the mitigations work at a very technical level and they don't want to do the screen test.
2135.84s - 2140.24s |  There's also performance hits associated with these mitigations. One nice thing you can do
2140.24s - 2144.62s |  though is turn on that audit mode. It's almost like an intrusion detection versus intrusion
2144.62s - 2150.46s |  prevention. Where it tells you about a potential problem but it doesn't actually block it. So
2150.46s - 2154.74s |  you've got the power to do that and then you can look in the event logs. There's a specific
2154.74s - 2159.50s |  event log area for user LAN mitigations and kernel LAN mitigations. And that's what you're
2159.50s - 2164.48s |  seeing at the bottom there. When I ran that program to execute the calculator that new log
2164.48s - 2169.32s |  popped up that said a mitigation was blocking it. That's right there what told me it was
2169.32s - 2175.96s |  kernel enforced. So looking at the NTOS kernel here. When I set a break point on create
2175.96s - 2181.50s |  process and let it continue it went straight into the kernel. So it told me right there
2181.50s - 2186.84s |  validated that this is not a kernel uh sorry user LAN enforced mitigation. So I went into
2186.84s - 2192.58s |  hex or I used hex rays obviously and I used win debug and went in and set some break points on
2192.58s - 2197.58s |  those functions right there. Like PSP get no child process restricted pro- policy or SC token
2200.46s - 2205.90s |  is no child process restriction enforced. These are by symbol name because thankfully
2205.90s - 2210.90s |  Microsoft gives us the symbols the PDB files. We can go and look for things that look like they
2210.90s - 2215.10s |  might be associated with the mitigation that we're curious about. So I set the break points
2215.10s - 2221.08s |  on there and then we run it. It immediately gets hit. But look where it gets hit. It gets hit
2221.08s - 2227.32s |  when I'm in the command prompt trying to start that C++ wrapper program. The create process
2227.32s - 2233.86s |  program. Because that's the program we turned exploit guard mitigation on. In the settings as
2233.86s - 2240.66s |  you saw in the last slide. So it makes sense. So we hit a break point on the setting API. The
2240.66s - 2245.54s |  one that sets the mitigation. Over on the right there if you're not familiar with the Virgilious
2245.54s - 2250.70s |  project. It's everybody I know's go to if you're looking at kernel structures. It is a
2250.70s - 2255.78s |  brilliant resource and every single Windows version, kernel version, every build, every
2255.78s - 2260.32s |  creators update whatever is tracked there. Because a lot of times when you're doing things
2260.32s - 2265.76s |  like token stealing in the kernel you need to make sure that your offsets are correct. There
2265.76s - 2270.42s |  might be a structure like E process or K process, K thread, E thread and you need to make sure
2270.42s - 2275.20s |  that what you think like AP links at a certain offset is still there depending on the kernel
2275.22s - 2278.76s |  version. So you can look at these structures, look at the members and you can update your
2278.76s - 2285.10s |  shellcode accordingly. But either way I saw an instruction and you can see in the code in the
2285.10s - 2290.10s |  top middle in the white area it says move into racks GS segment register offset 188 hex. So
2292.70s - 2297.04s |  the GS register while under the context of the kernel points to a structure called the kernel
2297.04s - 2302.04s |  processor control region. A very large kernel structure. And nested inside of that is
2302.06s - 2306.16s |  something called KPRCB. The kernel processor region control block which is a mega
2306.16s - 2312.50s |  structure. Well it's telling us at offset 8 within that nested structure is what we're
2312.50s - 2318.70s |  dereferencing. It ends up being the K thread pointer. K thread and E thread and K process and
2318.70s - 2322.64s |  E process are kernel things. If you've ever heard of the process environment block in user
2322.64s - 2327.18s |  land, the peb. E process is like the equivalent in the kernel. If you've ever heard of the
2327.22s - 2331.90s |  TIB, the thread information block. K thread, E thread, the executive and kernel thread.
2331.90s - 2336.60s |  Those are the relative entries in the kernel. Not one to one but it's pretty close. So either
2336.60s - 2342.84s |  way we're dereferencing and grabbing the K thread pointer for the current thread. So let me
2342.84s - 2348.08s |  go in further and we're checking out our progress here. You can see that I run this fancy
2348.08s - 2352.58s |  window bug command and we're basically saying what is our current process? And it tells us
2352.58s - 2358.30s |  that the current process is the uh which one? Command dot EXE. That's not the process I
2358.30s - 2362.70s |  want to be in. So we let it continue. We hit the breakpoint again and then we look at the
2362.70s - 2367.20s |  current process and now we're in the create process C++ program where we want to be. So now
2367.20s - 2371.30s |  we know where we want to be. We're at where we want to be. It's important to mention that
2371.30s - 2375.54s |  because when you set these types of breakpoints they will get hit often unless you set
2375.54s - 2379.68s |  process specific breakpoints as a kernel debugging session. So you want to make sure you
2379.68s - 2384.92s |  understand what context you're under for each you know process. And then we hit our
2384.92s - 2391.06s |  breakpoint on the SE token set no child process restricted function. So this means that
2391.06s - 2396.54s |  we're under the context of the create process C++ program and that mitigation function has
2396.54s - 2403.34s |  just been called. And it says set no child process restricted. So you go into hex rays and
2403.34s - 2407.38s |  you decompile it and you say hey let's take a look at this function and that's what you're
2407.38s - 2411.72s |  seeing on the right there. I know it's kind of small again slides will be released. Put some
2411.72s - 2416.16s |  circles around some variables because we don't know what those variables are. Thankfully we
2416.16s - 2420.66s |  get symbols from Microsoft. Thankfully hex rays and IDA pro are brilliant. It's a brilliant
2420.66s - 2424.96s |  disassembler and we get the function prototype data. As long as you know what the structure
2424.96s - 2430.00s |  is you can say hey I know this is a token structure because MSDN told me on the left on the
2430.00s - 2436.08s |  top there. And then once you do that you see that it's able to then go in and add all the
2436.08s - 2441.78s |  symbols. Define everything that you want to see. On the right there I did a stream a while
2441.78s - 2447.82s |  ago on documenting undocumented structures and it was all about looking at different bitmasks
2447.82s - 2452.46s |  in the kernel and e-process and the token structure to understand what the mitigation bits
2452.46s - 2457.76s |  are and to show you kind of how to do that. This is a reference from Google that shows us that
2457.76s - 2462.60s |  these different bitmask numbers you'll see lots of booleans like ands and ors and those are
2462.62s - 2467.76s |  either turning on or clearing bits in the bitmask so that the mitigation flags are set to the
2467.76s - 2472.04s |  state that they're supposed to be in. So I went through here and I added a bunch of comments
2472.04s - 2475.74s |  because obviously it's helpful especially if you're not used to debugging uh or
2475.74s - 2480.28s |  disassembling and decompiling kernel structures. But that defines everything that's
2480.28s - 2484.18s |  happening. Basically we're getting a token or acquiring a lock on the token. We're
2484.18s - 2488.62s |  initializing a variable which ends up being the token, the current token. And then we're
2488.64s - 2494.44s |  going in and we're checking bits that are set in the bitmask. And these bitmasks bits are
2494.44s - 2500.18s |  things like is it in audit only mode? Should it be turned on and enforced? Is the low box
2500.18s - 2504.46s |  token thing associated with it? What what setting should I do? And through the boolean
2504.46s - 2509.46s |  operations it turns on the appropriate bit which then sets the mitigation on. That is pretty
2511.70s - 2515.74s |  much how that mitigation works and that's why it's being blocked. Because the next thing
2515.76s - 2520.60s |  that would have happened had we kept going the get function would have gotten called and it
2520.60s - 2525.40s |  would have checked that bit to see if that program has the authority to spawn a new
2525.40s - 2529.84s |  process. So that's kind of what we learned by going through that and that's how easy it can
2529.84s - 2534.44s |  be to understand mitigations to see if you can get around them. So from that you're like well
2534.44s - 2540.48s |  then can I get around this somehow? Obviously the first thing you want to do is Google go to
2540.48s - 2545.32s |  chat GPT or your favorite AI LLM whatever and say hey can you tell me about any bypass
2545.34s - 2549.54s |  techniques that may be publicly available? But if there are no publicly available ones,
2549.54s - 2553.68s |  hey you've got a great opportunity to do some cool research and make it public if you can find
2553.68s - 2558.98s |  something. Some examples down there towards the bottom. There was a technique I forget who
2558.98s - 2563.28s |  discovered it but I put the link there where you can you can impersonate the anonymous token to
2563.28s - 2567.16s |  get around the mitigation and spawn a new process. I don't think that still works but it was an
2567.16s - 2574.26s |  option. You can use WMI like if you're in the context of Microsoft Office and you can use some
2574.30s - 2578.88s |  cool PowerShell or WMI to get around the mitigation that way. There's a process migration
2578.88s - 2583.18s |  potentially. You can use reflexive DLL loading where you load from memory something into
2583.18s - 2588.82s |  memory. That also gets you around other mitigations like CIT. Ones that are preventing you
2588.82s - 2593.82s |  from loading an unsigned DLL from your Windows box and again setting it accordingly,
2596.12s - 2600.12s |  enforcing the protection and getting around it with things like reflexive DLL. So there's a
2600.12s - 2604.10s |  bunch of ways we can potentially get around it and that's why it's so important that you put
2604.10s - 2609.04s |  a bunch of these together. That you're not just relying on any one mitigation. I remember
2609.04s - 2614.32s |  Microsoft made a pretty bold claim somebody there said CFG control flow guard should be a
2614.32s - 2620.28s |  strong enough mitigation that it can prevent the majority of exploitation techniques where
2620.28s - 2624.90s |  Emmet may not be needed as much. That ends up not being entirely true because CFG is
2624.90s - 2629.76s |  another one you could potentially get around. People have demonstrated that even with V8
2629.76s - 2634.76s |  on Chrome. So this right here I just wanted to point it out. There are two fields and rest
2637.80s - 2642.14s |  in peace to Jeff Chappelle brilliant individual passed away recently sadly but he
2642.14s - 2647.14s |  maintained this site and I hope it stays up forever because every time Microsoft would make a
2647.14s - 2652.04s |  structural change or add a new mitigation like if you can see the ones towards the bottom on
2652.04s - 2657.02s |  the right and mitigation flags too. You see things like control flow enforcement technology
2657.02s - 2661.92s |  and shadow stacks. Those are relatively new mitigations and these are bit masks that are set
2661.92s - 2667.76s |  as a member of the e-process structure and those are the things that are being checked. That's
2667.76s - 2671.92s |  why a lot of times you might heard people getting around SMAP like supervisor mode execution
2671.92s - 2677.10s |  prevention by setting a bit or flipping a bit inside a control register while under a certain
2677.10s - 2682.48s |  context. Getting around patch guard by doing it fast and doing a race condition. So the more
2682.50s - 2687.10s |  you understand from an offensive perspective about these mitigations the more you'll be able to
2687.10s - 2691.98s |  get around them potentially or know when to call it a day. For me it's all about saving time. If I
2691.98s - 2696.74s |  know a mitigation is likely on and I'm doing a patch dip or find a zero day and I think it's not
2696.74s - 2701.28s |  going to be fruitful for me to continue down that path. You gotta pay your dues though. You will
2701.28s - 2706.06s |  have those harsh you know frustrating days. I still have them all the time. From a defensive
2706.06s - 2711.40s |  perspective it really helps you to understand how these mitigations work so that if you don't
2711.42s - 2715.72s |  want to turn all of them on you know which ones are going to be more beneficial. Which ones
2715.72s - 2721.40s |  have less overhead. Which ones actually do stop an exploit technique and which ones are pretty
2721.40s - 2728.04s |  useless. So some takeaways I think I went through some already but it's it's a lot of nuance and I
2728.04s - 2734.54s |  think that that gives us power where AI won't take over our jobs anytime soon because the
2734.54s - 2739.14s |  circumstances in which you will be doing your research requires something that machine
2739.16s - 2743.82s |  learning just can't do right now. And there's synergy there as well when working with other
2743.82s - 2748.70s |  researchers. The golden years of binary exploitation can be behind us but um it's not
2748.70s - 2752.44s |  going away anytime soon. People ask me they probably ask you all the time for how much
2752.44s - 2757.40s |  longer am I going to be able to do this? As long as it's possible. People are going to keep
2757.40s - 2761.68s |  doing it. It's a lot harder now but I use an analogy like Tony Hawk the skateboarder. What he
2761.68s - 2766.38s |  was doing in the 1990s there's like a 8 year old kid able to do that today. We're just all
2766.38s - 2771.20s |  this information is out there to get you up to speed from all the research done in the past
2771.20s - 2776.90s |  fast so that you can then go and bring about novel exploitation techniques and new zero days.
2776.90s - 2781.70s |  And the ethical considerations are something that you have to understand and think about. Um
2781.70s - 2787.44s |  there's new acts and new legislation out there. Like palm oil and such that we have to worry
2787.44s - 2792.54s |  about. But as you probably know the more you push researchers and say you can't do
2792.58s - 2796.62s |  something the more likely they're going to go unethical route and sell it on the dark net and
2796.62s - 2803.08s |  make money that way. So mitigations are uh a real thing. They're hard but they're not going
2803.08s - 2806.66s |  away and you just have to deal with it. And they're how you have to think about it as if
2806.66s - 2812.96s |  there's always a way around it. And the prize will continue to grow. What was $10,000 is
2812.96s - 2818.90s |  $500,000 now. So it is worth your time putting months into research. So references and
2818.90s - 2823.10s |  thanks. I there's always more people than I can remember to thank but lots of researchers
2823.10s - 2826.34s |  out there in the past. Uh Jeremy Tinder just a shout out to him for getting me those
2826.34s - 2830.38s |  Microsoft documents or those updated charts which is cool. Brad Spangler helped me out
2830.38s - 2833.88s |  with going over some things so I'm not going to go through everyone. Harun Mir is the
2833.88s - 2838.92s |  individual I said that did a talk from 2010 that went through every single mitigation that
2838.92s - 2843.52s |  ever came out. It's a beautiful document. Definitely check that one out. And a lot of
2843.52s - 2848.16s |  other folks as well. Thanks to Def Con for selecting a talk. That is it. I think I'm right
2848.16s - 2851.46s |  on time here. I'm happy to you know chat out in the hall because I know I got to make
2851.46s - 2854.96s |  way if you have any questions. But thank you so much for coming to my talk. I really appreciate
2854.96s - 2855.00s |  it.


url: https://www.youtube.com/watch?v=T5K4ABfzkhI
title: DEF CON 32 - Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panel - Vangelis Stykas
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=T5K4ABfzkhI",
  "title": "DEF CON 32 - Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panel - Vangelis Stykas",
  "description": "Ransomware groups have become notably proficient at wreaking havoc across various sectors , but we can turn the tables. However, a less explored avenue in the fight against these digital adversaries lies in the proactive offense against their web panels. In this presentation, I will delve into the strategies and methodologies for infiltrating and commandeering the web panels used by ransomware groups to manage their malicious operations or the APIs used during their initial exfiltration of data.\n\nI will demonstrate how to leverage these vulnerabilities to gain unauthorized access to the ransomware groups' web panels. This access not only disrupts their operations but also opens a window to gather intelligence and potentially identify the operators behind those APTs. Let\u2019s explore the frontiers of cyber offense, targeting the very command and control (C2) centers ransomware groups rely on, turning the tables in our ongoing battle against cyber threats, it\u2019s our turn to wreak havoc.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2338,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

3.09s - 12.09s | This text was transcribed using whisper model: large-v2

 Hello Deftone. First of all, if anyone does not want to be photographed, I'm going to take two pictures.
12.09s - 28.42s |  That's for my mom. She never believes that anyone comes and hears me talking.
28.42s - 34.75s |  That says a lot about her trust issues, but yeah.
34.75s - 42.75s |  So, hello everyone and welcome to my talk, Behind Enemy Lines, Engaging and Disrupting ransomware web panels.
45.61s - 50.61s |  This talk is PG-17 due to two reasons.
50.61s - 60.61s |  First, there are going to be some notions about drugs and bad words from people in the talk.
60.61s - 68.61s |  And secondly, I love saying fuck and shit, and I'm not going to stop it.
71.34s - 74.34s |  Hello all. As you can see, I'm Vangelis Stikas.
74.34s - 80.34s |  I'm the CTO and co-founder of a penetration testing firm called Atropos.
80.34s - 90.34s |  We specialize in API penetration testing and green PV and electronic vehicle chargers penetration testing.
90.34s - 99.34s |  My research interest for the past decade is API security and for the past couple of years, malware and ransomware situation.
99.34s - 114.61s |  How everything started. So, I don't know who of you were here last DEF CON, but I did a pretty similar talk about malware C2s, which was really, really easy.
114.61s - 122.61s |  So, I wanted a bigger challenge and the main question in here is, could it be any harder?
125.72s - 132.72s |  Markus Hatzins, I think you all know who he is, said that cyber threat intelligence is such a white industry.
132.72s - 143.72s |  In contrast to the actual intelligence, which is a monopoly of the governments, there is the CTI.
143.72s - 153.72s |  There is just some random dude named Brad who got really baked one night and yellowed his way into a major APT's backend server.
153.72s - 159.72s |  Two issues in here. I'm going to start with the one that has legal implications.
159.72s - 168.18s |  Who the fuck named his son Brad? I'm not Brad, I'm Vangelis.
168.18s - 180.18s |  And secondly, I don't take drugs. I do like my occasional alcohol, but I also have three really strange people in the signal chat.
181.18s - 186.18s |  If you want to drop them a follow on Twitter, Twitter, no text, fuck Elon Musk.
186.18s - 195.18s |  First is Solfer, my really good friend and pretty much partner in all my research and the main person to blame.
196.18s - 210.18s |  My second person is Iskuri, who is a legendary DEF CON, multiple times DEF CON and Black Hat speaker and a person who hacks bootloaders for fun.
210.18s - 222.18s |  And third one is No Thanks. He's a super ninja hacker, multiple times DEF CON speaker too, and a really good artist.
222.18s - 229.18s |  So all three of them were trying to poke me around to start going after ransomware.
229.18s - 239.00s |  A couple of minutes ago, I asked how much more difficult it would be.
239.00s - 252.00s |  For the malwares, in the past couple of years, I have been able to pawn or gain access to pretty much 50% of all the bundles that I have seen.
252.00s - 257.00s |  So it's 18 out of 36. For the ransomware, it's quite difficult.
257.00s - 266.00s |  So I only was able to get access to three and a half out of 140 that I have tested.
266.00s - 276.34s |  Quick intro. That's the only intro. Ransomware is a type of malicious software that threatens to publish or block access until the blah, blah, blah.
276.34s - 280.34s |  If you don't know what the ransomware is, go somewhere else.
281.34s - 287.23s |  How ransomware hacks work, there's a step-by-step process.
287.23s - 297.23s |  One is they somehow get access and distribute their malware and infect an internal user.
297.23s - 301.23s |  The second step is getting access to command and control C2s.
301.23s - 305.23s |  Then they do the discovery and lateral movement.
305.23s - 309.23s |  The data extraction, so they're extracting all the data.
309.23s - 313.23s |  Data encryption, which means you have lost all your data.
313.23s - 319.23s |  Then there is extortion, so what we're going to see there are three or four ways of extortion.
319.23s - 325.23s |  And then there is resolution, however you resolve that issue.
329.61s - 336.61s |  That slide is going to seem like I'm pitching you on how good ransomware market is.
336.61s - 338.61s |  I'm not.
338.61s - 340.61s |  I fucking hate them.
340.61s - 342.61s |  They fucking hate me.
342.61s - 345.61s |  But I want to say some good stuff about them.
345.61s - 348.61s |  It's the fastest growing type of cybercrime.
348.61s - 354.61s |  Their payout broke the limit of 1 billion last year.
354.61s - 356.61s |  They hit 1.1 billion.
356.61s - 359.61s |  It's a highly professional industry.
359.61s - 363.61s |  It seems that the boundaries here are falling off.
363.61s - 370.61s |  So they're after hospitals, critical national infrastructure, and pretty much everything else.
370.61s - 375.61s |  And WannaCry opened the kind of forms that we cannot close.
375.61s - 379.61s |  Again, this slide too, I fucking hate them.
379.61s - 381.61s |  The gangs are highly hierarchical.
381.61s - 385.61s |  We expect that it's a criminal rig.
385.61s - 387.61s |  They have a clear structure.
387.61s - 390.61s |  The first part is obviously the tech part that we're going to see later on.
390.61s - 396.61s |  But they also have ransomware negotiators and customer support, as pretty much any company has.
396.61s - 402.61s |  Money launderers and payment processing, because as we saw, they're processing 1.1 billion per year.
402.61s - 410.86s |  And collaboration and partnerships, because why not partner with a ransomware, right?
410.86s - 412.86s |  The tech part.
412.86s - 416.86s |  They have several specific and special users.
416.86s - 418.86s |  One is the malware developers.
418.86s - 420.86s |  I'm not going to explain what it is.
420.86s - 425.86s |  Exploitation developers who are possibly developing either zero day or end day.
425.86s - 428.86s |  They have special people for data theft and leaks.
428.86s - 430.86s |  They have people for operational security.
430.86s - 434.86s |  And last but not least, and usually we don't know about that,
434.86s - 437.86s |  they have really good people on infrastructure and hosting.
437.86s - 442.86s |  And that makes sense, because imagine owning a unicorn company,
442.86s - 447.86s |  extracting half a terabyte of data and not being able to process it
447.86s - 451.86s |  because your infrastructure or hosting was bad enough.
451.86s - 456.52s |  Let's move to the ransomware models.
456.52s - 458.52s |  First of all, there were lone wolves.
458.52s - 461.52s |  At some point, right now, they're no longer it.
461.52s - 465.52s |  Those were single people who were doing everything.
465.52s - 469.52s |  Initial access brokers are a special way of ransomware groups.
469.52s - 474.52s |  There are people who specialize in just that, initial access,
474.52s - 477.52s |  getting it and then selling it to other ransomware groups.
477.52s - 481.52s |  Only one ransomware groups, which is from start to finish,
481.52s - 484.52s |  everything done by them.
484.52s - 490.52s |  And ransomware as a service, which you could consider it as software as a service
490.52s - 496.52s |  or as I like to say, ransomware meets capitalism.
496.52s - 501.12s |  How ransomware as a service are being paid?
501.12s - 505.12s |  Flat monthly fee, affiliate programs with a monthly percent of the profits,
505.12s - 507.12s |  one-time license.
507.12s - 512.12s |  This is not as a service, just saying, but they do advertise that.
512.12s - 517.12s |  Pure profit sharing, payments made to the RAS,
517.12s - 524.12s |  and then they give their affiliate, not me, a part of the profits.
524.12s - 529.12s |  And the most well-known were Lockbit, Blackcat, Clop, and some more.
529.12s - 536.12s |  This is my only try of being a graphic designer.
536.12s - 538.12s |  You see I'm not good.
538.12s - 541.12s |  So we are going after the C2 server.
541.12s - 543.12s |  As we can see, there's the user, there's the cloud,
543.12s - 549.12s |  and there is the hacker slash ransomware on the top with the red.
549.12s - 553.12s |  Can anyone guess why he's the hacker?
553.12s - 555.12s |  No one?
555.12s - 557.12s |  He's wearing a hoodie, guys.
557.12s - 559.12s |  If you wear a hoodie, you're a hacker.
559.12s - 560.12s |  You should know that.
560.12s - 564.40s |  You're DEF CON for fuck's sake.
564.40s - 565.40s |  The extortion, how they do.
565.40s - 569.40s |  They establish communications with victim with multiple ways,
569.40s - 574.40s |  talks, telegram, email, or some internal web panels.
574.40s - 575.40s |  Keep that in mind.
575.40s - 577.40s |  You're going to see one.
577.40s - 582.40s |  They lay their terms and then they extort victims in multiple ways.
582.40s - 585.40s |  There are four ways of extorting people.
585.40s - 587.40s |  The first is ransomware data.
587.40s - 589.40s |  So they have encrypted their data.
589.40s - 595.40s |  So they're wanting the money to decrypt data.
595.40s - 599.40s |  This was easily fell over
599.40s - 606.40s |  because now pretty much everyone has a proper backup system, I hope.
606.40s - 609.40s |  Then the second part where the second level of extortion
609.40s - 611.40s |  was releasing data to the public.
611.40s - 613.40s |  So extorting the people that we have your data,
613.40s - 615.40s |  we're going to release it on the public.
615.40s - 619.40s |  The third was DDoS with knowledge obtained from data.
619.40s - 625.40s |  And fourth was communicate with people that were the victim's customers
625.40s - 627.40s |  or even the LEA.
627.40s - 634.40s |  We have seen in 2024 a lot of groups going to the LEIA
634.40s - 638.40s |  and saying that this company was hacked and they did not report it.
640.74s - 643.74s |  So let's set some goals.
643.74s - 648.74s |  First, we want to identify all the C2s and data leak sites.
648.74s - 652.74s |  Try to find any vulnerabilities, and I mean any vulnerabilities.
652.74s - 654.74s |  Identify any people behind them.
654.74s - 658.74s |  Try to disrupt panels and threat actors.
658.74s - 661.74s |  And the three last ones are really, really important.
661.74s - 666.74s |  Do not disrupt with any active LEA investigation.
666.74s - 670.74s |  Don't be a malakas, and don't get vanned.
670.74s - 675.74s |  So those two, the last are my motto for the past couple of years.
675.74s - 676.74s |  I have them as stickers.
676.74s - 678.74s |  If you want them, come ask for them.
678.74s - 684.74s |  So the past couple of years, I have been joking around
684.74s - 687.74s |  that I will be vanned, which was mostly a joke
687.74s - 692.74s |  and a tongue in the cheek thing.
692.74s - 697.74s |  But right now, I'm trying to disrupt criminal rigs
697.74s - 705.74s |  that handle more or less tens of millions of dollars,
705.74s - 707.74s |  and they are criminal rigs.
707.74s - 716.74s |  So this is no longer a joke, but an actual probable risk for me.
716.74s - 724.74s |  So this last night, when someone tried to enter my room by wrong,
724.74s - 727.74s |  I literally thought that I was getting vanned.
727.74s - 730.74s |  This is not funny.
730.74s - 737.74s |  A more probable situation, though, is me waking up again with this message.
737.74s - 743.74s |  I don't know how many of you have woken up with this kind of message,
743.74s - 748.74s |  whether on your Google account or your iPhone.
748.74s - 750.74s |  But when you wake up and you see that government-backed attackers
750.74s - 757.12s |  may be trying to steal your password, you are freaked out.
757.12s - 761.12s |  So I'm going to say it here in DEF CON.
761.12s - 763.12s |  I also said it on Black Hat a couple of days ago.
763.12s - 768.12s |  If anyone wants to burn his one million zero day
768.12s - 772.12s |  to get access to my email or my phone,
772.12s - 775.12s |  I'm going to delete the photos from my kids
775.12s - 781.82s |  and give him my phone for just 100K plus VAT.
781.82s - 787.22s |  There's no reason to burn your zero day for me.
787.22s - 795.22s |  I want to state again that I had really low expectations into finding anything,
795.22s - 800.22s |  and I didn't find as much as I would want.
800.22s - 803.22s |  How did I identify pandemics?
803.22s - 809.22s |  Those really nice people that are doing CTI, I'm not a CTI expert.
809.22s - 814.22s |  I'm just a random guy who Googles and doing scrolls on Twitter.
814.22s - 820.22s |  So I use Ransomlook.io, Ransomwave, Ransomware.live,
820.22s - 823.22s |  the deep dark CTI on GitHub,
823.22s - 826.22s |  and lots and I mean lots of doing scrolling
826.22s - 831.82s |  and monitoring CTI companies for new posts.
832.82s - 837.82s |  Research had certain limitations that I knew from the beginning.
837.82s - 840.82s |  The C2s had a terribly small lifetime
840.82s - 847.82s |  because they were live only during the actual phase of being of the ponies.
847.82s - 850.82s |  And they're also really difficult to find
850.82s - 853.82s |  because all the CTIs companies will keep them for themselves,
853.82s - 858.82s |  obviously, and not going to post an active threat.
858.82s - 863.82s |  The data link sites are very, very well looked after,
863.82s - 866.82s |  and they're also behind Tor and Onion.
866.82s - 872.82s |  So it gives an extra obstacle that I would have to bypass
872.82s - 874.82s |  in order to get to them and test them.
874.82s - 880.49s |  My methodology is quite straightforward.
880.49s - 884.49s |  I'm going to ignore malware distribution and reversing.
884.49s - 888.49s |  First, because I'm a singleton and I don't understand reversing.
888.49s - 892.49s |  This is mostly because I'm, as I said, a singleton,
892.49s - 897.49s |  and two, because I hate assembly due to my college years
897.49s - 902.49s |  and a certain person who tried to teach me.
902.49s - 905.49s |  I would just run the malware in a sandbox,
905.49s - 907.49s |  extract all the URLs,
907.49s - 911.49s |  and use data link URLs found via CTI or other means.
911.49s - 919.86s |  And then I will introduce you to a newer Toyota Corolla.
919.86s - 922.86s |  The Toyota Corolla of security testing,
922.86s - 926.86s |  also known as web application penetration testing,
926.86s - 929.86s |  will get you from place A to place B.
929.86s - 932.86s |  It's not sexy. It's not nice.
932.86s - 934.86s |  But by getting you from A to B,
934.86s - 939.86s |  it will probably also give you some info about ransomware groups
939.86s - 941.86s |  and potentially a couple of RCs.
941.86s - 945.50s |  Methodology.
945.50s - 946.50s |  Boring stuff, but I have to say,
946.50s - 951.50s |  because those tools literally made the whole research.
951.50s - 953.50s |  Dirsearch for the win.
953.50s - 954.50s |  FFUF.
954.50s - 955.50s |  Burpsuit.
955.50s - 958.50s |  The trifecta of Tor, which is Tor Expert Bundle,
958.50s - 960.50s |  Tor Browser, and Tor Socks,
960.50s - 963.50s |  which greatly helps to run any other tool.
963.50s - 964.50s |  Coffee.
964.50s - 966.50s |  And I mean a lot of coffee.
966.50s - 968.50s |  Anyrun for running all the malwares.
968.50s - 970.50s |  Several droplets on DigitalOcean,
970.50s - 972.50s |  because, as I said, they had a lot of operation security,
972.50s - 975.50s |  so I was getting banned en masse.
975.50s - 977.50s |  So done ION Census,
977.50s - 983.50s |  so that you could potentially find websites outside of Tor.
983.50s - 985.50s |  And did I mention coffee?
985.50s - 987.50s |  I mean lots of coffee.
987.50s - 992.67s |  How I'm going to approach the whole thing.
992.67s - 994.67s |  Black box web application testing.
994.67s - 998.67s |  Use any acquired information for furthering my attacks.
998.67s - 1001.67s |  Interact with data leaks and chat websites.
1001.67s - 1003.67s |  Intentionally infect sandbox
1003.67s - 1005.67s |  so that I could get a ticket.
1005.67s - 1006.67s |  And by ticket I mean,
1006.67s - 1010.67s |  you're going to see later that all the chats wanted a ticket
1010.67s - 1014.67s |  so that they can identify what company you were in.
1014.67s - 1019.34s |  My first step was, as I did with malware,
1019.34s - 1022.34s |  just blatantly run Dirsearch and FFUF
1022.34s - 1025.34s |  with a custom word list through Tor Socks.
1025.34s - 1027.34s |  My results were disappointing.
1027.34s - 1031.34s |  There were only 15 URLs that gave something interesting,
1031.34s - 1034.34s |  which is not exactly interesting.
1034.34s - 1038.34s |  Then I moved to manually check all of them.
1038.34s - 1041.34s |  Five of them were WordPress.
1041.34s - 1044.34s |  A couple of them were leaking IP addresses,
1044.34s - 1046.34s |  and some of them were cheeky.
1046.34s - 1049.34s |  And when I say cheeky, I mean really cheeky.
1049.34s - 1053.34s |  So one of them told me to fuck off.
1053.34s - 1057.34s |  The other one told me to use the N word.
1057.34s - 1060.34s |  I'm not going to use it because I respect people.
1060.34s - 1064.34s |  And the cheeky was Abish who said,
1064.34s - 1067.34s |  just business, nothing personal.
1067.34s - 1070.34s |  Keep that.
1070.34s - 1072.34s |  So let's go.
1072.34s - 1076.34s |  Much like Alice in Wonderland,
1076.34s - 1081.34s |  let's take the little dumb bunny by hand
1081.34s - 1088.42s |  and let's move inside ransomware land, shall we?
1088.42s - 1089.42s |  First one is mallocs.
1089.42s - 1091.42s |  I don't know who is familiar with that.
1091.42s - 1094.42s |  They're also known as Target Company, Fargo,
1094.42s - 1097.42s |  and Tonsomething.
1097.42s - 1098.42s |  I cannot pronounce it.
1098.42s - 1101.42s |  First appearance was of June 2021.
1101.42s - 1104.42s |  They target mostly Windows machines
1104.42s - 1107.42s |  and specifically MSSQL servers,
1107.42s - 1109.42s |  the brute force SA accounts.
1109.42s - 1112.42s |  Last year, they started using also some NDAs,
1112.42s - 1117.42s |  and they are in the hundreds of victims.
1118.42s - 1122.42s |  This is their index page of their data leaks.
1122.42s - 1125.42s |  As you can see, they have a lot of victims.
1125.42s - 1130.42s |  And the slash malloc slash private sign-in,
1130.42s - 1135.42s |  they requested a private key so that I could chat with them.
1135.42s - 1139.42s |  So I had to, as I said, infect something.
1139.42s - 1141.42s |  I infected anyone.
1141.42s - 1143.42s |  I got a key.
1145.76s - 1146.76s |  Is it clear?
1146.76s - 1148.76s |  I said, hello.
1148.76s - 1149.76s |  Guy didn't respond.
1149.76s - 1153.76s |  So I said again, hello.
1153.76s - 1154.76s |  Nothing back.
1154.76s - 1156.76s |  Sorry.
1156.76s - 1160.76s |  I then decided to run Deer Search and FFUF.
1160.76s - 1164.76s |  There was an Apache server status page exposed,
1164.76s - 1168.76s |  which was leaking URLs, server IP addresses,
1168.76s - 1171.76s |  and it was also leaking tokens to check other people's messages.
1171.76s - 1173.76s |  But that was not fun enough.
1173.76s - 1178.84s |  So can you see the whole thing?
1178.84s - 1183.84s |  There is a button underneath my hello that says reply.
1183.84s - 1185.84s |  This is the post message.
1185.84s - 1187.84s |  It's practically a quote.
1187.84s - 1191.84s |  Can anyone guess what the issue is in here?
1191.84s - 1194.44s |  No?
1194.44s - 1196.75s |  Okay.
1196.75s - 1200.75s |  So there was an IDOR on reply ID parameter,
1200.75s - 1205.75s |  which means I could quote pretty much any message in the world.
1206.75s - 1207.75s |  In the server.
1207.75s - 1209.75s |  The parameter was an incremental integer,
1209.75s - 1212.75s |  so all I had to do was to take that post,
1212.75s - 1215.75s |  write the Python script really badly,
1215.75s - 1221.75s |  and do a for loop from one to, I don't know, 50 million,
1221.75s - 1223.75s |  and export all the messages.
1223.75s - 1234.16s |  That was also used for in-organization messages.
1234.16s - 1236.16s |  So first there is the boss.
1236.16s - 1239.16s |  Clearly a God complex.
1239.16s - 1241.16s |  I work according to my own schedule,
1241.16s - 1243.16s |  which does not change on anyone's request.
1243.16s - 1247.16s |  As soon as I see the payment, I will send the decryptor.
1247.16s - 1250.16s |  I have a well-maintained business, blah, blah.
1250.16s - 1255.16s |  It will not be disturbed by any moron that could not secure their machines.
1255.16s - 1258.16s |  Oh, the irony, right?
1258.16s - 1262.16s |  And last one, I was on special key for a couple of days,
1262.16s - 1266.16s |  so fuck off and do the work that I'm paying you to do.
1266.16s - 1268.16s |  I don't know exactly what special key is,
1268.16s - 1271.16s |  but I think it's a drag.
1271.16s - 1276.47s |  So employees, boss, the budget for this client is only 15K.
1276.47s - 1278.47s |  Do you agree?
1278.47s - 1280.47s |  They don't need much data.
1280.47s - 1282.47s |  And Jessica, probably to another employee,
1282.47s - 1284.47s |  boss is not on a good mood today.
1284.47s - 1285.47s |  Let's be careful.
1285.47s - 1287.47s |  Yeah, be careful.
1287.47s - 1290.78s |  Good for you, Jessica.
1290.78s - 1292.78s |  And last but really not least,
1292.78s - 1295.78s |  the boss was sending the decryptors to the guys.
1295.78s - 1297.78s |  Here's the decryptor for company A.
1297.78s - 1299.78s |  Here's the decryptor for company B.
1299.78s - 1303.78s |  I got those decryptors because I wanted them too.
1303.78s - 1308.19s |  This is the actual organization.
1308.19s - 1311.19s |  I said I wouldn't have another graphic,
1311.19s - 1313.19s |  but I needed to do another graphic.
1313.19s - 1315.19s |  You should forgive me for that.
1315.19s - 1319.19s |  So boss on the top, Panda, Jessica, Malox, and Ismail on the bottom.
1319.19s - 1322.19s |  And then after a day or so,
1322.19s - 1327.19s |  unfortunately, my chat was disabled and my ID was fixed.
1327.19s - 1329.19s |  Message was not delivered.
1329.19s - 1333.19s |  Unfortunately, I couldn't quote it anymore.
1333.19s - 1334.19s |  What did I get?
1334.19s - 1336.19s |  I got internal knowledge of the team.
1336.19s - 1338.19s |  I got pretty much all of their messages.
1338.19s - 1339.19s |  I got some decryptors,
1339.19s - 1343.19s |  which I communicated to the companies that were ransomed with,
1343.19s - 1345.19s |  and they used it.
1345.19s - 1350.19s |  Once the admin got up or sober, I don't know what,
1350.19s - 1351.19s |  it was fixed.
1351.19s - 1355.19s |  So all in all, result?
1355.19s - 1357.19s |  Mediocre, I guess.
1357.19s - 1359.19s |  Sorry about that, but I was too verbose.
1359.19s - 1361.19s |  I was too blatant.
1361.19s - 1366.19s |  I just did it all at once, but I wanted to do it.
1366.19s - 1370.19s |  That's my second group.
1370.19s - 1374.19s |  I think all of you know it, Black Hat and Alpha V.
1374.19s - 1376.19s |  They're also known as Noberus.
1376.19s - 1378.19s |  Their first appearance was in 2021.
1378.19s - 1381.19s |  They operated as a ransomware as a service.
1381.19s - 1384.19s |  They have a Rust-based malware and server-side C2,
1384.19s - 1387.19s |  and they use the triple extortion scheme.
1387.19s - 1391.86s |  The Rust loader that we're going to go after
1391.86s - 1394.86s |  was researched by Lapuseanu,
1394.86s - 1398.86s |  sorry if I butchered your name, Andrei,
1398.86s - 1400.86s |  by Bitdefender Labs.
1400.86s - 1402.86s |  It was targeting only Mac.
1402.86s - 1404.86s |  It was developed in Rust.
1404.86s - 1408.86s |  I think all of the Black Hat malware was developed in Rust,
1408.86s - 1413.86s |  and their C2 was used on all of Black Hat malware.
1413.86s - 1418.86s |  Andrei Lapuseanu, that's the actual research
1418.86s - 1420.86s |  that I saw while Doomscrolling,
1420.86s - 1426.86s |  and there were one, two, three, four CNC servers in there.
1426.86s - 1429.86s |  I checked all the C2 URLs.
1429.86s - 1433.86s |  One of them was online, but it was just returning 404.
1433.86s - 1436.86s |  So me being me, I have decided to put it
1436.86s - 1441.86s |  in the loop of continuous scanning that I have in my rig.
1441.86s - 1446.86s |  And two days later, it downloaded some documentation.
1446.86s - 1449.86s |  The first documentation was for clients,
1449.86s - 1454.86s |  so I could see all the malware-infected clients.
1454.86s - 1457.86s |  And the second one was tasks,
1457.86s - 1461.86s |  so I could see all the tasks that were ever run
1461.86s - 1464.86s |  on the server, on the machines.
1464.86s - 1467.86s |  Unfortunately, both of those endpoints
1467.86s - 1470.86s |  were offline at that point.
1470.86s - 1475.86s |  So what I had to do is read the documentation,
1475.86s - 1478.86s |  try to guess, not exactly guess,
1478.86s - 1480.86s |  try to understand the documentation,
1480.86s - 1483.86s |  create a Python script, automate the check,
1483.86s - 1487.86s |  and put that in the loop again, and wait.
1487.86s - 1492.86s |  And by wait, I mean really wait.
1492.86s - 1496.86s |  I think seven or eight days after,
1496.86s - 1499.86s |  I got a push notification on my phone.
1499.86s - 1501.86s |  Yay, you got something.
1501.86s - 1504.86s |  So I extracted 197 commands in two minutes
1504.86s - 1506.86s |  on a four-hour window.
1506.86s - 1508.86s |  What does that say to us?
1508.86s - 1512.86s |  It means that Black Cat was putting the C2 server
1512.86s - 1515.86s |  only when using it and exploiting it,
1515.86s - 1518.86s |  and when they're not using it to do any movement,
1518.86s - 1520.86s |  any lateral movement or anything else,
1520.86s - 1522.86s |  they were putting it off.
1522.86s - 1528.86s |  And you can see that in here, it uploads a file.
1528.86s - 1530.86s |  And this is the scary command.
1530.86s - 1535.86s |  When you see the XXX in here was a company's name,
1535.86s - 1538.86s |  so when you see zipping someone's AWS
1538.86s - 1543.86s |  and GCP environments on an env.zip
1543.86s - 1546.86s |  and then being uploaded to another server,
1547.86s - 1549.86s |  it means that someone is getting exploited
1549.86s - 1552.86s |  as we speak right now.
1552.86s - 1557.86s |  So I had to switch to incident response mode.
1557.86s - 1561.86s |  I hate incident response.
1561.86s - 1563.86s |  I identified four companies.
1563.86s - 1566.86s |  All of them were cryptocurrency-related.
1566.86s - 1569.86s |  Crypto is cryptography.
1569.86s - 1571.86s |  Fuck cryptocurrency.
1571.86s - 1573.86s |  Two of them were unicorns,
1573.86s - 1578.86s |  which means their valuation was over a billion.
1578.86s - 1580.86s |  All four of them were notified,
1580.86s - 1582.86s |  and they acknowledged the issue.
1582.86s - 1585.86s |  None of them were ransomed.
1585.86s - 1586.86s |  What did I do?
1586.86s - 1589.86s |  I got all the info and understood the lateral movement
1589.86s - 1591.86s |  that Black Cat was doing at that point.
1591.86s - 1593.86s |  I stopped the whole campaign.
1593.86s - 1595.86s |  Four companies were not ransomed,
1595.86s - 1609.38s |  and Black Cat got a really big financial hit.
1609.38s - 1612.38s |  And after a month, under increasing federal scrutiny,
1612.38s - 1616.38s |  Black Cat ransomware gang pulls XXX on its way out.
1616.38s - 1619.38s |  I'm not going to say that this was all me,
1619.38s - 1622.38s |  but I'm going to say that my exploitation
1622.38s - 1624.38s |  and stopping that campaign
1624.38s - 1628.38s |  probably helped them to do that XXX,
1628.38s - 1630.38s |  the decision to do that XXX.
1630.38s - 1637.30s |  So all in all, I would say not bad, right?
1637.30s - 1640.30s |  Third one, Everest.
1640.30s - 1643.30s |  Oh, my lovely Everest.
1643.30s - 1646.30s |  Active since late 2020.
1646.30s - 1648.30s |  They targeted high-profile targets
1648.30s - 1651.30s |  for the first three years.
1651.30s - 1656.30s |  In the last year, they moved to also lower-profile targets.
1656.30s - 1659.30s |  They pivoted to initial access broker.
1659.30s - 1662.30s |  They pivoted to just data leak.
1662.30s - 1665.30s |  Fuck, they pivot around like they're startups.
1665.30s - 1668.30s |  They grade it as highly sophisticated
1668.30s - 1670.30s |  by multiple researchers,
1670.30s - 1673.30s |  and they're also well-known for being paid
1673.30s - 1678.30s |  and not getting and then releasing the data,
1678.30s - 1681.30s |  so they're mentally unstable.
1681.30s - 1682.30s |  Right?
1682.30s - 1686.30s |  Why don't you go after a mentally unstable millionaire?
1686.30s - 1691.19s |  This is their data leak page.
1691.19s - 1694.19s |  Does it look like something you know?
1694.19s - 1696.19s |  No one?
1696.19s - 1704.22s |  It's fucking WordPress.
1704.22s - 1709.62s |  Version 5.5.3.
1709.62s - 1712.62s |  This version was done in 2020.
1712.62s - 1714.62s |  That's four years ago.
1714.62s - 1717.62s |  There on the left, there is the login page,
1717.62s - 1719.62s |  and on the right, there is also the readme.txt
1719.62s - 1723.62s |  in case you didn't know how to install WordPress.
1723.62s - 1729.97s |  Then I ran WPScan via Torsox
1729.97s - 1732.97s |  because why not, right?
1732.97s - 1736.97s |  It said it's really insecure, 42 vulnerabilities identified.
1736.97s - 1740.97s |  Unfortunately, none of them was really exploitable
1740.97s - 1742.97s |  by silly me.
1742.97s - 1746.97s |  The only thing that I could see in here
1746.97s - 1752.97s |  was that error on RSS functions.
1752.97s - 1753.97s |  As you can see in here,
1753.97s - 1757.97s |  we can see that the PHP error reporting was on.
1757.97s - 1759.97s |  It was a Windows machine,
1759.97s - 1763.97s |  and we were running Vertigo server hosting,
1763.97s - 1767.97s |  which is end of life for the past two years.
1767.97s - 1770.97s |  They also had OpenDIR,
1770.97s - 1772.97s |  so you could see pretty much everything.
1772.97s - 1776.97s |  They had a couple of zip files, but nothing interesting.
1776.97s - 1780.97s |  They also had PHPMyAdmin.
1780.97s - 1782.97s |  Why not, right?
1782.97s - 1787.97s |  And I did what every super hacker does in the world.
1787.97s - 1795.97s |  I googled Vertigo default MySQL password.
1795.97s - 1803.70s |  Yeah, I got that, but unfortunately, it didn't work.
1803.70s - 1809.70s |  And that was my talk up until 15th of July.
1809.70s - 1815.70s |  Then my nine-year-old son, okay, let me stop.
1815.70s - 1816.70s |  In Greece, I have two sons.
1816.70s - 1817.70s |  The one is nine-year-old.
1817.70s - 1821.70s |  The other just became 13,
1821.70s - 1824.70s |  so can we all say happy birthday to Antonis?
1824.70s - 1830.04s |  Because thanks for that.
1830.04s - 1831.04s |  Happy birthday, Antonis.
1831.04s - 1835.04s |  I should be there in Greece, but I'm here, so you know me.
1835.04s - 1840.04s |  So my nine-year-old was sitting at my computer
1840.04s - 1844.04s |  reading my 2000 open tabs.
1845.04s - 1847.04s |  At some point, he says,
1847.04s - 1852.04s |  that's a really strange name to call your server.
1852.04s - 1855.04s |  Why the fuck would you call it Vertigo?
1855.04s - 1858.04s |  I'm like, no, it's not Vertigo, it's Vertigo.
1858.04s - 1860.04s |  He says, no, I know how to read.
1860.04s - 1863.04s |  It has two R's, it's Vertigo.
1863.04s - 1869.67s |  I'm like, what, motherfucker?
1869.67s - 1871.67s |  He then said that he's not the thing, I'm the thing,
1871.67s - 1873.67s |  but it is what it is.
1873.67s - 1875.67s |  Do you all know what that means?
1875.67s - 1879.67s |  I have to reuse my favorite meme.
1879.67s - 1882.67s |  I use Vertigo, and what that means is,
1882.67s - 1889.25s |  I'm the fucking admin.
1889.25s - 1894.01s |  WordPress administration,
1894.01s - 1898.01s |  I did develop a WordPress plugin.
1898.01s - 1901.01s |  No, I didn't develop a WordPress plugin, sorry.
1901.01s - 1904.01s |  I took a PHP cell, Pony cell,
1904.01s - 1908.01s |  zipped it, named it cell.plugin,
1908.01s - 1915.62s |  uploaded there,
1915.62s - 1918.62s |  and I think I might have prematurely
1918.62s - 1921.62s |  used the I'm the admin meme,
1921.62s - 1923.62s |  because right now,
1923.62s - 1933.86s |  I'm the fucking admin in the whole situation.
1933.86s - 1938.86s |  Then, after doing things that
1938.86s - 1940.86s |  most of the red teamers in here,
1940.86s - 1942.86s |  I see a really good red teamer in here,
1942.86s - 1945.86s |  would decapitate me of doing,
1945.86s - 1949.86s |  but again, I'm a simpleton, sorry about that.
1949.86s - 1952.86s |  I somehow run Mimikatz,
1952.86s - 1955.86s |  got the whole, I don't know, token and shit,
1955.86s - 1960.13s |  and all that, which means,
1960.13s - 1962.13s |  they're Russians.
1962.13s - 1965.13s |  Who the fuck would expect them to be Russians?
1965.13s - 1969.13s |  It's a Windows 2012 server,
1969.13s - 1972.13s |  and they have done a lot of crimes,
1972.13s - 1978.08s |  but can anyone guess what's their biggest crime?
1978.08s - 1981.08s |  They haven't paid for WinRAR.
1981.08s - 1987.66s |  For fuck's sake, if you make,
1987.66s - 1989.66s |  I don't know, 20 million per year,
1989.66s - 1991.66s |  pay the fucking WinRAR.
1991.66s - 1996.20s |  So, database export,
1996.20s - 1998.20s |  username extract,
1998.20s - 2000.20s |  remote command execution on the server,
2000.20s - 2003.20s |  got hold of their own secret keys,
2003.20s - 2006.20s |  lots, and I mean lots of locks to analyze.
2006.20s - 2009.20s |  I was hoping that it would be down
2009.20s - 2011.20s |  by someone by now,
2011.20s - 2012.20s |  but it's still there,
2012.20s - 2015.20s |  so if anyone wants to play, go play.
2015.20s - 2025.01s |  Result?
2025.01s - 2028.01s |  Again, this was supposedly my talk
2028.01s - 2030.01s |  up until this Saturday,
2030.01s - 2032.01s |  but this Saturday,
2032.01s - 2035.80s |  Black Angels,
2035.80s - 2037.80s |  it emerged in May 2022,
2037.80s - 2039.80s |  high profile targets,
2039.80s - 2040.80s |  Babook based,
2040.80s - 2042.80s |  that means that they just
2042.80s - 2044.80s |  stole the whole league of Babook,
2044.80s - 2045.80s |  and they're using it,
2045.80s - 2048.80s |  they're focused on Linux and ESXi,
2048.80s - 2052.80s |  and they received a record 75 million ransom,
2052.80s - 2054.80s |  as we all saw last week.
2054.80s - 2056.80s |  And then,
2056.80s - 2058.80s |  Rakesh Krishnan,
2058.80s - 2060.80s |  I hope I said it correctly,
2060.80s - 2062.80s |  found their clear text,
2062.80s - 2065.80s |  their open web IP,
2065.80s - 2068.80s |  which means I had to take a look.
2068.80s - 2069.80s |  This was on Saturday morning,
2069.80s - 2072.80s |  and I was flying away Saturday evening,
2072.80s - 2074.80s |  so I had six hours.
2074.80s - 2079.85s |  You can go there right now.
2079.85s - 2080.85s |  I should make it a demo,
2080.85s - 2082.85s |  but I don't like demos.
2082.85s - 2084.85s |  They have a different HTTPS
2084.85s - 2086.85s |  and HTTP configuration.
2086.85s - 2089.85s |  The HTTPS is on the slash public
2089.85s - 2092.85s |  of their symphony.
2092.85s - 2095.85s |  The HTTP port 80
2095.85s - 2098.85s |  is on the root of symphony,
2098.85s - 2100.85s |  which means if you go to .env,
2100.85s - 2102.85s |  you are going to see .env,
2102.85s - 2104.85s |  and you are going to see AppSecret
2104.85s - 2108.85s |  and the MySQL password.
2108.85s - 2113.85s |  You do what you want with that information.
2113.85s - 2115.85s |  What did I found?
2115.85s - 2116.85s |  .env file exposure,
2116.85s - 2118.85s |  internal URLs exposure,
2118.85s - 2120.85s |  some error logs exposed.
2120.85s - 2123.85s |  I'm not going to say what those error logs were.
2123.85s - 2125.85s |  You can look at it.
2125.85s - 2127.85s |  One message mentioning
2127.85s - 2131.85s |  5.5 million payment exposed.
2131.85s - 2133.85s |  This was nowhere to be found,
2133.85s - 2135.85s |  so I guess they were paid
2135.85s - 2137.85s |  and killed the whole thing.
2137.85s - 2140.85s |  All in all, that was fast.
2140.85s - 2142.85s |  I could do some stuff with AppSecret,
2142.85s - 2144.85s |  but unfortunately I had to fly here,
2144.85s - 2150.12s |  so you should excuse me for that.
2150.12s - 2154.12s |  We are getting to the end.
2154.12s - 2159.12s |  My favorite part of ethical dilemmas.
2159.12s - 2161.12s |  Are we the baddies?
2161.12s - 2164.12s |  What the fuck we are doing with our lives?
2164.12s - 2168.72s |  I never wanted to become a vigilante.
2168.72s - 2170.72s |  I'm not seeing myself as a vigilante
2170.72s - 2173.72s |  or someone who wanted to do bad things.
2173.72s - 2176.72s |  I always wanted to be considered,
2176.72s - 2178.72s |  as we Greeks say,
2178.72s - 2180.72s |  the Socratic fly or the god fly.
2180.72s - 2182.72s |  I wanted to be the one that
2182.72s - 2185.72s |  reinvents the status quo
2185.72s - 2189.72s |  and tries to make the bad people,
2189.72s - 2190.72s |  the ransomware gangs,
2190.72s - 2194.72s |  give them a taste of their own medicine.
2194.72s - 2197.72s |  And I also want to say to CTI companies
2197.72s - 2201.72s |  that they would really need to be more
2201.72s - 2204.72s |  open into sharing information.
2204.72s - 2209.72s |  If I only had C2's information more quicker,
2209.72s - 2214.72s |  I would have a really bigger talk right now.
2214.72s - 2217.72s |  Except the two CTI companies
2217.72s - 2219.72s |  that have already used my research
2219.72s - 2221.72s |  without mentioning me.
2221.72s - 2228.08s |  Those can go fuck off, I don't care.
2228.08s - 2230.08s |  Conclusions.
2230.08s - 2234.08s |  Some of us fail and fail miserably.
2234.08s - 2237.08s |  Some of you really succeed
2237.08s - 2240.08s |  and succeed gloriously.
2240.08s - 2243.08s |  And I'm really happy with everyone that succeeds.
2243.08s - 2246.08s |  I know that for the past two years
2246.08s - 2248.08s |  I have been looking,
2248.08s - 2250.08s |  I really love VX Underground
2250.08s - 2254.08s |  and their five horsemen paradigm.
2254.08s - 2256.08s |  So for the past two years,
2256.08s - 2259.08s |  from London 2022 with Spower,
2259.08s - 2261.08s |  Defcon last year with Stealer and Botnet,
2261.08s - 2264.08s |  and this year's Defcon and Blackhat with Ransomware,
2264.08s - 2268.08s |  I have been fighting all those five horsemen.
2268.08s - 2273.08s |  And while I never had a clear win,
2273.08s - 2276.08s |  I could never say that this was not the case,
2276.08s - 2278.08s |  that I didn't look anyone,
2278.08s - 2281.08s |  all of them in the eye and smiled.
2281.08s - 2284.08s |  So, thank you.
2284.08s - 2286.08s |  And if anyone has any questions,
2286.08s - 2289.08s |  we have like five minutes to talk.
2289.08s - 2291.08s |  There's the microphone.
2291.08s - 2299.13s |  No one?
2299.13s - 2300.13s |  Nice.
2300.13s - 2302.13s |  Thank you, guys.
2302.13s - 2304.13s |  Oh, I have one.
2304.13s - 2306.13s |  Where is he?
2306.13s - 2307.13s |  Oh, nice.
2307.13s - 2311.46s |  Hi, thank you.
2311.46s - 2312.46s |  Great talk.
2312.46s - 2314.46s |  My question is,
2314.46s - 2317.46s |  which would you choose to fight?
2317.46s - 2321.46s |  Five duck-sized horses
2321.46s - 2323.46s |  or...
2323.46s - 2325.46s |  Oh, I got it wrong.
2325.46s - 2326.46s |  I got no question.
2326.46s - 2327.46s |  Thank you for the talk.
2327.46s - 2329.46s |  Thank you.
2329.46s - 2331.46s |  Anyone else?
2331.46s - 2333.46s |  Thank you, guys.


url: https://www.youtube.com/watch?v=RHhyrcgm7n4
title: DEF CON 32 - Abusing legacy railroad signaling systems - David Meléndez, Gabriela Gabs Garcia
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=RHhyrcgm7n4",
  "title": "DEF CON 32 - Abusing legacy railroad signaling systems - David Mele\u0301ndez, Gabriela Gabs Garcia",
  "description": "In this study, we delve into the darker aspects of railway technology, revealing how easily accessible domestic hardware tools can compromise the seemingly infallible robustness of signaling systems. We demonstrate how these accessible technologies can be utilized to devise strategies that potentially threaten train circulation in Spain. Our research presents a critical analysis of the vulnerabilities present in the railway signaling systems, highlighting the ease with which these systems can be tampered with, using tools that are readily available to the general public. Through a combination of theoretical insights and practical demonstrations, we offer a comprehensive overview of the risks associated with such vulnerabilities.\n\nOur findings aim to raise awareness among stakeholders in the railway industry, prompting a reevaluation of current security measures and encouraging the adoption of more stringent protections against such threats. This paper contributes to the ongoing discussion in the cybersecurity community, offering valuable insights into the potential risks facing modern transportation infrastructures and suggesting avenues for future research and development in railway system security.\n\nWe consider this work to be innovative on a type of system that has been present for over half a century in railway infrastructures. Therefore, the references provided are primarily about the operation of the systems and relevant news concerning them.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2571,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

1.58s - 4.58s | This text was transcribed using whisper model: large-v2

 Okay. Hello, everyone.
4.58s - 9.06s |  Yeah, NRG.
9.06s - 13.06s |  Thanks, everyone, for coming, especially to being the last day,
13.06s - 17.06s |  and most of the people that we knew are going home,
17.06s - 21.06s |  so we are very glad for us to have you here.
21.06s - 26.06s |  Thanks, the La Villa Hacker people that are here, I'm sure,
26.06s - 29.06s |  because I cried for that. Yeah.
30.06s - 40.06s |  And, well, we are prepared now to talk to you about railroad hacking.
40.06s - 42.06s |  We call this...
42.06s - 45.06s |  It's working? Not working? Okay.
45.06s - 48.06s |  We are Gabriela Garcia and David Melendez.
48.06s - 50.06s |  I am a security software developer
50.06s - 53.06s |  that got into hacking and hardware hacking
53.06s - 55.06s |  because of the hardware hacker people
55.06s - 59.06s |  that they like to introduce you to their weird world.
59.06s - 63.06s |  And David Melendez, I am the embedded software engineer
63.06s - 70.06s |  that is here to talk to you with me about railroad hacking.
70.06s - 74.06s |  We call this a dark territory because in railway sector,
74.06s - 77.06s |  a dark territory is a section of the railway
77.06s - 81.06s |  that lacks remotely control of signals
81.06s - 85.06s |  and you have no automatic blocking systems.
85.06s - 88.06s |  So in this area, the communication and coordination
88.06s - 92.06s |  is really exclusive on the railway operator,
92.06s - 98.06s |  and the term has gained popularity in railway hackers
98.06s - 104.06s |  to describe sectors that lack supervision in any other kind of way.
104.06s - 108.06s |  So we are introducing you Fun with Trains.
108.06s - 115.70s |  As you can see, graphic design is our passion.
115.70s - 121.06s |  So let me introduce you to some concepts.
121.06s - 123.06s |  For example, the railway block.
123.06s - 128.06s |  Railway block is a section that is normally no more than one train
128.06s - 133.06s |  can be present to evade collision between two trains.
133.06s - 138.06s |  This block session can be between stations
138.06s - 140.06s |  and can be between signals
140.06s - 146.06s |  for the railroad control people to be able to control
146.06s - 152.06s |  the passes of the trains between these blocks.
152.06s - 156.06s |  To know where and how they have been passing the trains,
156.06s - 163.06s |  we have axle counters that are systems that count the axis of every train
163.06s - 168.06s |  and every train needs to be the same amount of axles
168.06s - 171.06s |  in the first one and in the last one.
171.06s - 175.06s |  It's nice because you don't lose people or half of your train,
175.06s - 177.06s |  so it's very cool.
177.06s - 181.06s |  And we can have train blockings in different ways.
181.06s - 183.06s |  For example, we can give a token.
183.06s - 187.06s |  It's vintage, but it's still happening in some parts of the world.
187.06s - 193.06s |  You can give the railway operator a token and he takes it.
193.06s - 195.06s |  It's vintage, okay?
195.06s - 200.06s |  It takes it and then you know that this train has passed through your station.
200.06s - 205.06s |  The next technological advancement has been to call people
205.06s - 208.06s |  instead of giving them a token because it's weird.
208.06s - 213.06s |  So the telephone block is just to tell the next block
213.06s - 216.06s |  that the train is passing through your block.
216.06s - 219.06s |  It's less vintage, but vintage too.
219.06s - 223.06s |  And then we pass it to the train blocking, the electronic train blocking.
223.06s - 229.06s |  What we have is slices of railway that are controlled by signals
229.06s - 232.06s |  or controlled by a central operation center
232.06s - 240.06s |  that blocks the slice of railway when the train is passing out,
240.06s - 244.06s |  taking into account the data received through the axis counter.
244.06s - 248.06s |  We have it in one track.
248.06s - 252.06s |  We have two tracks and we have reversible two tracks.
252.06s - 260.06s |  So we can have control in every direction you have your train passing.
260.06s - 268.06s |  The control is just set by the side where these beacons in the railway are set.
268.06s - 272.06s |  So if you are in one direction,
272.06s - 279.06s |  the beacon that is controlling you is in the right side of the railway.
279.06s - 282.06s |  And if you are in the opposite direction,
282.06s - 285.06s |  in your direction there will be another beacon
285.06s - 289.06s |  controlling that you are passing through this segment.
289.06s - 291.06s |  And this is the central light traffic control.
291.06s - 294.06s |  This is specially in Madrid called Chamartín.
294.06s - 299.06s |  And there are lots of people working here
299.06s - 303.06s |  controlling that the trains don't collide, especially.
303.06s - 308.34s |  We have based this investigation in one of the systems
308.34s - 312.34s |  that is present in Spain that is called ASFA.
312.34s - 315.34s |  In Spanish it's Anuncio de Señales y Frenado Automático.
315.34s - 319.34s |  In English, Announcement of Signal and Automatic Braking.
319.34s - 323.34s |  What it does is support the train circulation
323.34s - 327.34s |  based on a core capacitor circuit connected to a signal.
327.34s - 331.34s |  And depending the signal, the aspect they need to transmit,
331.34s - 337.34s |  transmit one frequency or another in the onboard equipment.
338.34s - 340.34s |  So this is the whole process.
340.34s - 344.34s |  You have a railway signal that connects to a unit
344.34s - 347.34s |  that gives a signal to a beacon.
347.34s - 352.34s |  The beacon is received by the perturbation.
352.34s - 354.34s |  Is the name?
354.34s - 357.34s |  The perturbation is received by the antenna.
357.34s - 362.34s |  And this antenna gives a signal to a console that is inside the train
362.34s - 367.34s |  and gives different aspects related to different signs.
367.34s - 372.34s |  The first of all is that you can have fixed aspects
372.34s - 376.34s |  that are signals or beacons that only transmit one signal
376.34s - 382.34s |  and variable aspects that have beacons that have different signals.
382.34s - 384.34s |  And it depends on the frequency.
384.34s - 388.34s |  The frequency they leave the antenna is the aspect
388.34s - 392.34s |  that the railway operator is receiving inside.
392.34s - 397.34s |  So the first problem is that, as you can see,
397.34s - 402.34s |  a couple of different signals give different aspects.
402.34s - 407.34s |  Or the same range of frequencies give different signals
407.34s - 410.34s |  to the railway operator.
411.34s - 420.34s |  So, for example, the L1 and the L3 are in the same range of frequencies.
420.34s - 428.34s |  So we can have little problems when we are not controlling it as much as we need.
428.34s - 432.34s |  And this is the panel that the operator receives here.
432.34s - 436.34s |  It's completely in Spanish because this picture is taken
436.34s - 443.34s |  on open source documentation that the railway company in Spain
443.34s - 447.34s |  have completely publicly available on the Internet.
447.34s - 452.34s |  So this is a screenshot of their documentation.
452.34s - 455.34s |  And this is what the train driver sees.
455.34s - 462.34s |  As you can see, this little blue dashboard has some buttons
462.34s - 466.34s |  that represent the acknowledgement of the train driver
466.34s - 471.34s |  that they have received this signal or the advice of this signal.
471.34s - 475.34s |  So they push, I have acknowledged this signal,
475.34s - 479.34s |  and I have to keep moving forward.
479.34s - 482.34s |  And we get into what we call the dark territory
482.34s - 488.34s |  because there have been several serious accidents in Spain
488.34s - 492.34s |  related to the control of the signals.
492.34s - 495.34s |  The first one is the Huarte Araquil.
495.34s - 498.34s |  It was like 30 years ago.
498.34s - 504.34s |  And it was related to not having any kind of beacons or signals
504.34s - 508.34s |  or systems of control on the railway.
508.34s - 516.34s |  And the train driver saw a signal but misconfused the signal
516.34s - 524.34s |  and misinterpreted what he saw, and lots of people died.
524.34s - 531.34s |  And then, like 10 years ago, when was the Galician accident?
531.34s - 534.34s |  It was 10 years ago, right?
534.34s - 542.34s |  They had a huge accident in Spain, too, where kind of lots of people died
542.34s - 546.34s |  because there was a misconfiguration between other factors.
546.34s - 549.34s |  There was a misconfiguration in the ASFA system,
549.34s - 560.62s |  so it could be not completely avoidable but less difficult to fix.
560.62s - 562.62s |  So we have these beacons.
562.62s - 565.62s |  These are the beacons that we have in the ASFA systems,
565.62s - 570.62s |  and these beacons sit on the railway,
570.62s - 573.62s |  and you can receive it by the capture.
573.62s - 580.37s |  So I have to work here.
580.37s - 586.87s |  So we have the beacon in the black box.
586.87s - 588.87s |  The wood doesn't count.
588.87s - 590.87s |  It's only the black box.
590.87s - 597.87s |  And inside this black box is a coil and a capacitor.
597.87s - 602.87s |  So we have a coil-capacitor circuit in closed loop.
602.87s - 610.87s |  No batteries, no voltage here, no batteries, no IC power.
610.87s - 616.87s |  So it's a passive device that is powered by the train
616.87s - 620.87s |  when the train passes along the track.
620.87s - 632.87s |  So we have here a very simple circuit with a coil and capacitors in parallel.
632.87s - 643.87s |  So I'm going to explain why this setup makes sense.
643.87s - 648.87s |  The technology behind the ASFA system is based on induction.
648.87s - 654.87s |  As you can find in your kitchen or in your phone charger,
654.87s - 660.87s |  wireless, of course, and even in RFID tags and so on.
660.87s - 666.87s |  But it's a very primitive kind of RFID tag.
666.87s - 670.87s |  Very primitive because there is no data transmit,
670.87s - 674.87s |  but it's only an aspect transmit.
674.87s - 679.43s |  Where do I want to see that?
679.43s - 683.43s |  It's in Spanish because it's open source.
683.43s - 690.43s |  All of this is publicly available if you Google that.
690.43s - 696.43s |  So a guy put this on the Internet.
696.43s - 701.43s |  Oh, I have to repair an ASFA tester.
701.43s - 708.43s |  An ASFA tester is a device that will be on the train path.
708.43s - 717.43s |  So you put this device above the beacon
717.43s - 722.43s |  and this device reads what kind of beacon it is.
722.43s - 725.43s |  So we have two coils here.
725.43s - 728.43s |  The two circles are two coils.
729.43s - 735.43s |  One coil is for transmit to give power to the beacon
735.43s - 738.43s |  and the other one is to receive power.
738.43s - 749.99s |  So what about if you use a circuit with a coil and capacitor
749.99s - 756.07s |  to emulate a beacon?
756.07s - 761.07s |  We could replicate a beacon and we could make a fake beacon.
761.07s - 767.07s |  So we require wire and a capacitor.
767.07s - 768.07s |  That's all.
768.07s - 769.07s |  It's enough.
769.07s - 772.07s |  It's enough for that.
772.07s - 779.07s |  So I think this is the most important slide here in this talk
779.07s - 786.07s |  because it represents very well how the setup is configured.
786.07s - 790.07s |  So we have the beacon itself in the DAC
790.07s - 794.07s |  and the beacon is, as you can see in the diagram,
794.07s - 798.07s |  we have a coil and a capacitor.
798.07s - 800.07s |  We represented a variable capacitor
800.07s - 805.07s |  because you can change the capacitance of the circuit
805.07s - 807.07s |  to change the aspect.
807.07s - 811.07s |  For example, if I want to transmit a red light,
811.07s - 815.07s |  we change the capacitance.
815.07s - 819.07s |  This beacon is by default in red signal.
819.07s - 826.07s |  It's the safest symbol that is red light, obviously.
826.07s - 835.07s |  So if we put a smart current temporarily to that symbol,
835.07s - 838.07s |  we can change the aspect.
838.07s - 845.07s |  So we only need power only to change from red to another symbol.
845.07s - 849.07s |  For example, green or yellow.
849.07s - 856.07s |  And the other setup here is in the train part.
856.07s - 864.07s |  So we have a capture that has two items.
864.07s - 871.07s |  We have a 111 kilohertz generator, IEC power.
871.07s - 875.07s |  So we can generate a frequency of that kind
875.07s - 880.07s |  with also a coil and a capacitor.
880.07s - 889.07s |  At the same time, the train has put together another device
889.07s - 898.07s |  that receives that power by inductance coupling.
898.07s - 901.07s |  Oh, I've seen 111 kilohertz.
901.07s - 905.07s |  That's okay. It's working.
905.07s - 914.42s |  But when the train passes...
914.42s - 918.42s |  When the train passes through...
918.42s - 923.42s |  When the train passes through the beacon,
923.42s - 928.42s |  an inductive coupling is produced between
928.42s - 932.42s |  the first coil that transmits 111 kilohertz,
932.42s - 935.42s |  the second coil that receives that signal,
935.42s - 938.42s |  and the third coil that is on the tracks
938.42s - 944.42s |  that modifies the inductance coupling to another frequency,
945.42s - 949.42s |  to the frequency that this configures that beacon.
949.42s - 955.42s |  It's easy to understand. Yes? Okay?
955.42s - 959.95s |  It's okay.
959.95s - 964.95s |  So, that's our desk.
964.95s - 969.95s |  We have the transmitter part.
969.95s - 972.95s |  Firstly, to make the fake beacon,
972.95s - 977.95s |  we need the framework like Java, Javascript, and so on.
977.95s - 982.95s |  So, this is our code editor.
982.95s - 987.95s |  So we need a framework to test the beacon
987.95s - 992.95s |  at that point that was not existing.
992.95s - 995.95s |  So, firstly we need a transmitter.
995.95s - 998.95s |  So, we set up a coil and a capacitor
998.95s - 1006.95s |  that is suitable to transmit power at 111 kilohertz.
1006.95s - 1008.95s |  Okay?
1008.95s - 1012.95s |  We use an AliExpress device called NanoVNeA
1012.95s - 1018.95s |  that is a vector network analyzer that you can buy.
1018.95s - 1021.95s |  It's cheap.
1022.95s - 1026.95s |  You can see the impedance, the inductance, the resonance, and so on.
1026.95s - 1032.52s |  So, this is the receiver part.
1032.52s - 1035.52s |  It's more or less the same setup,
1035.52s - 1042.52s |  but instead of transmitting power, it receives power.
1042.52s - 1053.52s |  So, it's fine tuned to capture frequencies from 50 kilohertz to 111.
1053.52s - 1061.52s |  So, it's very wide range to capture all the aspects of any beacon.
1061.52s - 1070.52s |  So, we have a signal generator, also from AliExpress.
1070.52s - 1076.52s |  And we receive that signal on the receiver part.
1076.52s - 1080.52s |  So, we already have the tester.
1080.52s - 1087.08s |  So, we need to make the beacon itself.
1087.08s - 1094.08s |  So, what if two people here or not here could replicate this beacon
1094.08s - 1098.08s |  and show it to you right now?
1098.08s - 1099.08s |  Shall we?
1099.08s - 1101.08s |  I'll pay you for that.
1101.08s - 1104.94s |  It's my turn.
1104.94s - 1106.94s |  The tester.
1110.94s - 1116.94s |  Well, the most important part of this tester we did is a can of morteruero de cuenca,
1116.94s - 1118.94s |  which is...
1118.94s - 1122.94s |  They are laughing because morteruero de cuenca means meat in a can.
1122.94s - 1123.94s |  Okay?
1123.94s - 1129.94s |  So, it's what helped us to have this coil or setup.
1129.94s - 1131.94s |  And it works perfectly.
1131.94s - 1136.94s |  So, meat in a can may be a key factor in this tester.
1136.94s - 1137.94s |  Okay?
1137.94s - 1141.94s |  And the second part is the beacon.
1141.94s - 1142.94s |  Okay.
1142.94s - 1149.94s |  So, we could replicate the beacon by following the calculus that you can do with data
1149.94s - 1158.94s |  that is completely, I repeat, completely available on the Internet in open source information.
1158.94s - 1164.94s |  So, this one is the L5 as you saw.
1164.94s - 1165.94s |  One second.
1165.94s - 1170.94s |  Here, this one is the L5, the yellow sign.
1170.94s - 1178.94s |  And for legal reasons, we cannot show you here on this stage the proof that this works.
1178.94s - 1184.94s |  But outside of the stage, anyone that comes and asks will have the answer.
1184.94s - 1185.94s |  Okay?
1189.21s - 1194.21s |  We don't want to go to jail, but we like to brag about our things.
1194.21s - 1195.21s |  Yeah, okay.
1206.07s - 1208.07s |  Hacking.
1208.07s - 1222.91s |  So, as a computer engineer, I have to make the work of the electronic engineer here.
1222.91s - 1229.91s |  So, if any electronic engineer here can come to explain that, and we rest here.
1229.91s - 1237.91s |  So, if there is any electronic engineer in the house, is there any electronic engineer here?
1237.91s - 1239.91s |  Just raise your hand.
1239.91s - 1246.23s |  Okay, we are sorry in advance.
1246.23s - 1265.23s |  So, when you put current in an inductor and capacitive circuit, it's like magic, you know.
1265.23s - 1266.23s |  It's magic.
1266.23s - 1269.23s |  Indeed, it's black magic here.
1269.23s - 1273.23s |  Because when you put a set of frequencies,
1273.23s - 1283.23s |  So, the circuit behaves differently according to the frequency that you put in the circuit.
1283.23s - 1289.23s |  We, the computing engineers here, we couldn't understand this.
1290.23s - 1303.23s |  The circuit behaves as a capacitive, as a virtual capacitor, as a virtual resistance, or as a virtual inductor.
1303.23s - 1306.23s |  It's okay, eh? That's cool.
1306.23s - 1314.23s |  You don't get rid of virtual devices even if you are an electronic engineer.
1315.23s - 1326.23s |  The point here is to design a circuit that resonates at a very specific and very narrow set of frequencies.
1326.23s - 1336.23s |  Indeed, you need to resonate at a very narrow interval of frequencies.
1336.23s - 1345.23s |  So, as you see, as Gabs explained to you, we need a circuit that resonates at a certain set of frequencies
1345.23s - 1350.23s |  to make the train think that this is a symbol.
1350.23s - 1358.23s |  It's a real symbol, a red light, a green light, a yellow, even a yellow and green light.
1358.23s - 1360.23s |  That exists.
1360.23s - 1364.23s |  It's trainiac stuff, don't worry.
1365.23s - 1370.23s |  So, we need that, but how do you do that?
1370.23s - 1372.23s |  We are computing engineers.
1372.23s - 1385.24s |  So, we need to wire, by public photos and seeing the device in real world,
1385.24s - 1389.24s |  we can get the dimensions of the beacon.
1389.24s - 1394.24s |  We can guess that because there is a public documentation,
1394.24s - 1401.24s |  but they don't give you the exact details to make the beacon, obviously.
1401.24s - 1405.24s |  So, you have to guess that at some point.
1405.24s - 1411.24s |  So, guessing the dimensions of the beacon and the shape, indeed,
1412.24s - 1421.24s |  we started to wire one turn, two turns, three turns, all day long.
1421.24s - 1428.24s |  So, we asked ourselves, what am I doing with my life?
1428.24s - 1432.24s |  I could be in the swimming pool.
1432.24s - 1437.24s |  So, we end with a lot of turns and what happens now?
1437.24s - 1442.24s |  So, we tested with the nano VNA and nothing works.
1442.24s - 1449.24s |  The resonance of the circuit is very far from the target resonance.
1449.24s - 1456.24s |  So, we cut the wire and we put on the nano VNA.
1456.24s - 1462.24s |  So, we start to wire another round of turns.
1462.24s - 1470.24s |  And we saw real time how this graph moves in real time,
1470.24s - 1477.24s |  getting closer and closer and closer to the target frequency or the desired symbol.
1477.24s - 1483.24s |  So, turning and turning and messing it up and what the fuck.
1483.24s - 1487.24s |  So, we achieved one symbol.
1487.24s - 1498.62s |  So, indeed, this is not a real coil capacitor setup, but it's a double inductor setup.
1498.62s - 1506.62s |  There are two inductors put together and taking advantage of the parasitic capacitance.
1506.62s - 1514.62s |  We have a virtual NC circuit that makes the same work at the real device.
1514.62s - 1518.62s |  We know that the real device is one coil and one capacitor.
1518.62s - 1528.62s |  But this stuff is two coils put together and taking advantage of the parasitic capacitance.
1528.62s - 1533.62s |  So, this is the center frequency.
1533.62s - 1538.62s |  And less frequency, the circuit behaves as a capacitor.
1538.62s - 1543.62s |  The more frequency, the circuit behaves as an inductor.
1543.62s - 1549.62s |  So, at the very exact point, the circuit is a resistance.
1549.62s - 1562.15s |  So, this is the graph that you have to see to make sure you are doing right.
1562.15s - 1569.15s |  In order to achieve the correct resonance frequency.
1569.15s - 1580.15s |  The yellow line is the resonance that has to be just in the middle of the graph.
1580.15s - 1585.15s |  The green line is the impedance.
1585.15s - 1590.15s |  So, it has to be as low as possible at the resonant point.
1590.15s - 1593.15s |  And the other one is the standing wave radio.
1593.15s - 1603.68s |  That is how well is the energy transferred from the system to outside and backwards.
1603.68s - 1606.68s |  So, that is the device.
1606.68s - 1611.68s |  As you can see, it's very complex, very expensive.
1611.68s - 1612.68s |  And beautiful.
1612.68s - 1613.68s |  And beautiful.
1613.68s - 1617.68s |  Because it has, I think, this Amazon cardboard.
1617.68s - 1619.68s |  Thank you, Amazon.
1619.68s - 1621.68s |  Thank you, Amazon.
1621.68s - 1629.68s |  And you have to use isolated copper wire.
1629.68s - 1638.68s |  So, once we have this item, we have to put glue on the device.
1638.68s - 1639.68s |  That is very important.
1639.68s - 1646.68s |  Because you make with the fingers any movement and the frequency changes.
1646.68s - 1648.68s |  It's crazy.
1648.68s - 1649.68s |  It's crazy.
1649.68s - 1654.68s |  So, you take the device and no more works.
1654.68s - 1664.68s |  So, you have to glue the wire to make sure that the center frequency remains at the target frequency.
1664.68s - 1668.68s |  In the tester, the most important was the glue.
1668.68s - 1676.68s |  The most important thing in the tester is the can of meat.
1676.68s - 1677.68s |  Here is the glue.
1677.68s - 1681.68s |  The key component.
1681.68s - 1684.96s |  Yeah, I'm sorry.
1684.96s - 1688.96s |  I'm seeing the electronic engineering looking at us.
1688.96s - 1691.96s |  Sorry, really.
1691.96s - 1694.96s |  I have stickers for you to compensate this.
1694.96s - 1702.04s |  So, how do you know that this works?
1702.04s - 1708.04s |  Well, firstly, you have to know what to see.
1709.04s - 1713.04s |  It's a key factor.
1713.04s - 1716.04s |  You have to know that I have to see things.
1716.04s - 1726.04s |  So, in the picture on the left, we have the default frequency being received by the receiver device.
1726.04s - 1730.04s |  So, we transmit 111 kHz.
1730.04s - 1732.04s |  Okay, I'm working.
1732.04s - 1735.04s |  I'm receiving the same frequency as the train transmits.
1736.04s - 1741.04s |  That's a permanent testing that the system works.
1741.04s - 1755.04s |  So, the left one, the right one, is when you pass through a beacon.
1755.04s - 1762.04s |  So, you see another spike on the spectrum analyzer.
1762.04s - 1769.04s |  You have another spike that represents the resonant frequency of the device, of the beacon.
1769.04s - 1773.77s |  So, that works.
1773.77s - 1785.13s |  Thank you for this sincere applause.
1785.13s - 1789.13s |  So, where should I place my fake beacon?
1789.13s - 1797.13s |  Well, the official documentation already tells you where to put your device, your fake device.
1797.13s - 1799.13s |  So, that's the dimension.
1799.13s - 1811.13s |  You have to keep a distance from the rails and a certain height from the sleepers.
1811.13s - 1828.40s |  So, the most important thing is that it matches the position perfectly to make all the setup take place, the induction coupling.
1828.40s - 1838.40s |  This is not a radio frequency stuff, but it's more an inductive coupling.
1838.40s - 1848.40s |  We firstly thought that it was a radio frequency problem, but it's more like an inductive coupling, as Gabriela says to you.
1848.40s - 1857.86s |  So, what about other systems all over Europe and worldwide?
1857.86s - 1861.86s |  Well, in the UK, you have the AWS system.
1861.86s - 1863.86s |  Not powered by Amazon.
1863.86s - 1866.86s |  Not powered by Amazon.
1866.86s - 1877.86s |  Indeed, the Spanish system is the most sophisticated legacy system, because they have more symbols to transmit.
1877.86s - 1880.86s |  The UK system only has two symbols.
1880.86s - 1883.86s |  Go and stop. That's all.
1883.86s - 1887.86s |  So, you see a star in the cabin.
1887.86s - 1889.86s |  It's called the sunflower.
1889.86s - 1891.86s |  Sunflower.
1891.86s - 1896.43s |  It's okay. Not okay. That's all.
1896.43s - 1899.43s |  And this is the Indus Sea.
1899.43s - 1903.43s |  In German, it's very...
1909.43s - 1913.43s |  It has a name in German that we don't know how to spell.
1913.43s - 1919.43s |  So, let's call it Indus Sea and let's have some fun.
1919.43s - 1924.43s |  We don't want to offend German people.
1924.43s - 1931.43s |  So, there is also that kind of systems that is based on the same principle.
1931.43s - 1936.43s |  But they are not one-to-one compatible.
1936.43s - 1943.43s |  So, you will have to make your own device adjusted to that kind of setups.
1943.43s - 1952.35s |  And that is the North American system that also is based on the same principle.
1952.35s - 1960.35s |  But they are not entirely widespread on all the tracks.
1960.35s - 1963.35s |  It's an intermittent system.
1963.35s - 1970.46s |  But it's based, again, on the same principle, by induction.
1970.46s - 1976.09s |  What about new things?
1977.09s - 1979.09s |  No.
1979.09s - 1988.09s |  Well, we talk about a legacy system that was invented in the middle of the 20th century.
1988.09s - 1990.09s |  So, what about new systems?
1990.09s - 1996.09s |  We're talking about new because it was invented in the 90s.
1996.09s - 1998.09s |  Okay? Cool.
1998.09s - 2008.72s |  Well, we have the ATCS, the European Trade Control System, that is based, again, on beacons.
2008.72s - 2011.72s |  But they transmit digital data.
2011.72s - 2016.72s |  So, we will talk about this next year, maybe.
2017.72s - 2030.72s |  So, the main thing here is that all the European regions have very different systems.
2030.72s - 2037.06s |  And they thought, what about a new protocol?
2037.06s - 2046.06s |  So, we have a new protocol that covers all Europe, but it is not implemented already widespread.
2046.06s - 2051.06s |  Only in high-speed trains and very crowded lines.
2051.06s - 2054.06s |  Because it takes money, you know.
2054.06s - 2060.66s |  So, it combines beacons called Euroballis.
2060.66s - 2063.66s |  I like more beacons.
2063.66s - 2073.66s |  And they combine that system with some kind of mobile communications, changing the protocol.
2073.66s - 2076.66s |  It's called JCM-Air.
2076.66s - 2084.75s |  Air means railroad.
2084.75s - 2085.75s |  Okay.
2085.75s - 2094.75s |  So, as you have seen in the whole presentation, what we have discovered is that by inductive coupling,
2094.75s - 2101.75s |  we can reach the most of the signaling system in Spain.
2101.75s - 2111.75s |  Because they don't use this system, ATCS, in most of the railway segments.
2111.75s - 2121.75s |  So, what we have is now security problems that was, in their time, a really robust protocol.
2121.75s - 2128.75s |  Because these kinds of protocols are not being properly revised.
2128.75s - 2136.75s |  So, one of the main things that we receive when we talk about this investigation is why we are talking about this.
2136.75s - 2146.75s |  And the reason is that we want companies to revise these kinds of systems.
2146.75s - 2154.75s |  For example, we can adopt this new ATCS system.
2154.75s - 2162.75s |  This system started being quite less robust, but now it's like in level 3, developing level 3.
2162.75s - 2168.75s |  And having very good results in terms of security.
2168.75s - 2170.75s |  But it costs money.
2170.75s - 2180.75s |  And money is a key factor in the decision making of the petitions and authorities related to this.
2180.75s - 2191.75s |  So, one of the other measures that we can offer, and we are completely willing to work with authorities in that,
2191.75s - 2197.75s |  is the usage, for example, of trained drones that are being developed.
2197.75s - 2200.75s |  This one is AI generated, okay?
2200.75s - 2203.75s |  Because I didn't find the picture.
2203.75s - 2210.75s |  Italy has now quite bigger, but yet tiny, trained drones.
2210.75s - 2221.75s |  And these trained drones can be deployed through the whole railway segments to investigate or inspect the beacons.
2221.75s - 2231.75s |  Just to know if there is anything, any weird objects, for example, in the railway, or anyone has covered these beacons.
2231.75s - 2248.75s |  Because these kind of beacons, ASFA beacons, can be just shot down by putting above them a plaque, a slice of lead.
2248.75s - 2260.75s |  So, we are trying to make quite a concern and talk with our authorities to make them inspect them.
2260.75s - 2271.75s |  Another object they can use are normal drones, just surveillance and looking at these railway segments just to, again,
2271.75s - 2278.75s |  know if there is any strange objects in the railway segments.
2278.75s - 2287.75s |  And, of course, we can use testers and pass testers more frequently just to know everything is okay with the beacons.
2287.75s - 2299.75s |  Actually, we don't have to create this chaos or fear, just want to have more intensity in the inspection rounds
2299.75s - 2307.75s |  or to change these devices into more newer devices around the world.
2307.75s - 2314.75s |  Because this investigation is based on the most robust legacy system, that is the ASFA.
2315.75s - 2319.75s |  But here Amtrak is using it, UK is using it.
2319.75s - 2322.75s |  Not the same, but less robust systems.
2322.75s - 2325.75s |  And, of course, Germany, Austria, Hungary.
2325.75s - 2334.75s |  So, we can work to change this or at least to revise this to keep everyone safe around the world.
2334.75s - 2340.75s |  So, thanks everyone that helped us to get here.
2340.75s - 2353.37s |  And, of course, we are here for the questions.
2353.37s - 2356.38s |  Yes?
2362.70s - 2364.70s |  Right, thanks for the talk.
2364.70s - 2367.70s |  Very educational, funny and scary, honestly.
2367.70s - 2376.70s |  When you have a signal that can display multiple aspects, how does that relate to the meat cans that are set on the track?
2376.70s - 2381.70s |  Does it change its own resonance to reflect the current aspect on the signal?
2381.70s - 2382.70s |  Yeah, actually they do.
2382.70s - 2392.70s |  Because what differentiates one signal through the other is the state they leave the capacitor circuit in the train.
2392.70s - 2400.70s |  So, the difference between these frequencies is the aspect the operator receives inside the train.
2401.70s - 2403.94s |  Okay.
2403.94s - 2404.94s |  Okay.
2404.94s - 2412.94s |  What are the related risks or threats related with this finding that you get?
2412.94s - 2422.94s |  Mostly, beyond that, to prevent accidentality in the trains, what are the risks?
2422.94s - 2424.94s |  The risks?
2425.94s - 2432.94s |  Well, actually we started this investigation because in Spain we are in terrorist alert 4 from 5.
2432.94s - 2442.94s |  So, it's quite important because most of the biggest accidents that have happened in Spain have happened with trains.
2442.94s - 2451.94s |  Actually, we have a real difficult incident that happened on the 11th of March,
2451.94s - 2461.94s |  that marked before and after on the way that people seized the railway and the metro in Spain.
2461.94s - 2469.94s |  So, any people with the right amount of motivation and knowledge could exploit this.
2469.94s - 2475.94s |  So, we want to make a wake-up call before something like this happens
2475.94s - 2484.94s |  and make people invest more time and money to keep the safety around Spain and of course around the world,
2484.94s - 2487.94s |  because this again happens mostly everywhere.
2487.94s - 2491.19s |  So, thanks. This is really fascinating.
2491.19s - 2499.19s |  I'm curious to know if there are any other systems that the drivers rely on to make their decisions
2499.19s - 2505.19s |  about what speed to control the trains. Is it primarily these beacons that they're using for that?
2505.19s - 2510.19s |  Or is there any other input they're also using to make the judgment?
2510.19s - 2513.19s |  Sorry, I didn't hear you.
2513.19s - 2523.41s |  Is there another system?
2524.41s - 2533.41s |  The train driver has the real signals and the system is an acknowledged system
2533.41s - 2538.41s |  to make sure that the train driver has seen the right signal.
2538.41s - 2543.41s |  So, by default there is no other resource.
2543.41s - 2552.41s |  And the point here is that you could make a red signal device in the middle of the track with no lights.
2552.41s - 2554.41s |  For example.
2554.41s - 2556.41s |  Thank you.
2556.41s - 2562.22s |  More questions?
2562.22s - 2566.87s |  Thank you.
2566.87s - 2570.15s |  Thank you very much.


url: https://www.youtube.com/watch?v=IJT6_OcY_dc
title: DEF CON 32 - A Shadow Librarian: Fighting back against encroaching capitalism - Daniel Messe
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=IJT6_OcY_dc",
  "title": "DEF CON 32 - A Shadow Librarian: Fighting back against encroaching capitalism - Daniel Messe",
  "description": "The public library is under attack. Calls for book banning are at an all time high. Some states have passed laws that hold librarians legally accountable for offering \"unacceptable\" materials to minors. But before this fire started, another one was already burning. In an era of digital content, from eBooks to streaming movies, public libraries have been forced to accept draconian terms of service at the expense of their patrons and to the benefit of corporations. Grossly inflated eBook prices and licensing, unobtainable materials that went out of print due to artificial scarcity, exorbitant fees for access to academic research; these are just a few of the myriad of ways that libraries have been forced to bow before capitalism, all because of a desire to serve the public. But we can fight back...\n\nAnd no one says we need to fight fairly.\n\nI\u2019d like to tell you some real life stories of a public librarian with a quasi-legal, dark grey skillset. And I\u2019d love to share some ideas about what you can do to help others. If I can do this, you can. And anyone can be a shadow librarian.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2582,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.88s - 7.20s | This text was transcribed using whisper model: large-v2

 uh, welcome. Thank you all for coming to the track. Uh, the next speaker up is Daniel Messer.
7.20s - 12.00s |  And the talk is A Shadow Librarian in Broad Daylight. Uh, please give Daniel a warm welcome.
12.00s - 23.42s |  How y'all doing? Okay, so good afternoon. Thank you for coming. There's a whole lot of you
23.42s - 29.76s |  here to see a librarian talk at DEF CON. So, um, it's nice to have you. So, uh, to start off
29.76s - 35.62s |  with, quick disclaimer, you know, big disclaimer. Uh, hi, I'm not a hacker. I am not a
35.62s - 40.54s |  cybersecurity expert. I will not be talking about how I cracked some passwords that I found
40.54s - 46.00s |  on the dark web and used that to infiltrate some system. I won't be talking about that
46.00s - 53.14s |  cause that's nothing I have ever done. Um, but I think that you and I and all of you and
53.14s - 58.14s |  maybe I, uh, we share kind of a kindred relationship. Um, because though I am not a, I'm
60.94s - 65.94s |  not a hacker, I think we can both, uh, we can come together on a relationship based in fear.
68.48s - 73.48s |  Because people fear hackers. You know this. Some of you revel in this. And people are
76.12s - 81.12s |  starting to fear others like me too. In red states, from city councils to state capitals, uh,
84.10s - 90.94s |  I am a threat. And so are people like me. More legislation has been passed in the last few
90.94s - 95.94s |  months to, uh, curtail my activities than have been passed to curtail yours. Because I am
98.48s - 111.13s |  fucking dangerous. I am a public librarian. In the third century before the common era, there
113.27s - 118.57s |  was a great library in the city of Alexandria, Egypt. Many tales have been told about this
118.59s - 125.23s |  library and some of them are even true. One thing that isn't talked about as often as I think
125.23s - 131.31s |  it should be, is the Alexandrian acquisitions department. Yeah, I know, I know, thrilling
131.31s - 136.85s |  stuff messin' me, but hang on, we're gonna go someplace beyond an ancient library, okay?
136.85s - 143.59s |  See, there was a decree by Ptolemy II Philadelphus that among other things, ordered agents of
143.61s - 148.61s |  the library to, to search the ships and take any books that they found, borrow them. Now we're
152.59s - 156.63s |  talking about the city of Alexandria. This was one of the biggest centers of trade in human
156.63s - 162.69s |  history. We're talking about a lot of ships. These agents would snag any books and then bring
162.69s - 169.11s |  them back to the library where they would be copied and added to the collection. And it was
169.13s - 174.19s |  often the case that the ships would sail away with the copies while the library kept the
174.19s - 179.21s |  originals. Um, this was the first large scale version of a modern adage in that information
181.81s - 186.81s |  should be free and it should belong to me. In the year of our goddess, 2024, can you imagine a
190.49s - 195.49s |  library doing anything like that today? That library would have more lawyers at their front
195.91s - 200.91s |  door than they have children attending the herpetologist event at a summer reading program.
204.79s - 210.43s |  So, okay, yeah, maybe, uh, maybe some introductions before I really get into this. Hi, I'm Dan.
210.43s - 215.99s |  Uh, I've been working libraries for almost 30 years now. Uh, from the front desk to systems
215.99s - 222.27s |  administration and a few stops in between, you know. As a systems librarian, I specialize in
222.29s - 228.39s |  integrated library systems, which is the day to day operating system of a modern library,
228.39s - 233.39s |  checking the things out, checking the things in, managing the catalog, all that stuff. Um, so,
235.87s - 241.57s |  what I'm called is a systems librarian by most people. If you, um, I'm also into things like,
241.57s - 247.31s |  uh, SQL hacking. I say that I'm a SQL hacker because, uh, the way I typically get SQL to work
247.33s - 252.83s |  is that I write a query, I swear because it doesn't work, then I rewrite the query and I'm
252.83s - 258.13s |  closer but they're still swearing and finally the query works. So, I, yeah, that's how I hack
258.13s - 264.43s |  SQL. I'm also into data analysis and storytelling. Libraries love data, the sort of running
264.43s - 270.71s |  joke is that librarians are into stats and cats. Um, so, yeah, I'm into, I'm one of the data
270.71s - 275.65s |  guys where I work. No surprise I'm into library technology, self-checkout machines,
275.65s - 281.29s |  self-check-in machines, everything from the barcode on the front desk to the RFID tags
281.29s - 286.17s |  within the items. And this probably doesn't matter to anyone, I'm a circulation
286.17s - 291.17s |  methodologist. In other words, I can help libraries better circulate their materials. But,
294.71s - 298.87s |  one, one thing, um, one thing that you might also know me for is if you listen to library
298.87s - 303.71s |  related podcasts, I am known as your little free cyberpunk librarian. And with a name like
303.71s - 308.15s |  that, it shouldn't be, uh, it shouldn't be a real big surprise that I am into shadow
308.15s - 314.35s |  libraries. Um, I have been researching shadow libraries for about 10 years. I can't be, uh, I
314.35s - 318.85s |  can't be, uh, specific on that because I don't remember exactly when I started approaching it
318.85s - 323.89s |  as a topic of research rather than as a topic of usage. Um, so, yeah, I've done this for
323.89s - 329.73s |  about 10 years. I've worked in shadow libraries as a, uh, cataloger. In other words, if I am
329.75s - 335.07s |  presented with an e-book of questionable sources, um, and that e-book is lacking metadata, I
335.07s - 340.97s |  can help provide that metadata. I've also worked in interlibrary loan, which, uh, in this
340.97s - 345.97s |  case usually involves someone on the internet needs a PDF. And I can provide that PDF. But I've
348.17s - 352.85s |  also done work in acquisitions, aka book scanning, digitization, things like that. And I've
352.85s - 357.85s |  also done some system, uh, systems administration and development. So, okay, here's the deal.
360.33s - 367.33s |  As a public librarian and a shadow librarian, I work in two sides of the library world. The
367.33s - 372.33s |  public library, which I'm sure many of you are familiar with, and shadow libraries, which
374.81s - 381.51s |  I'm sure many of you are familiar with. Um, so, that might come as a surprise to you because
381.51s - 386.35s |  why would, why would a legit librarian go to the dark side? You know, why, why would I do
386.37s - 392.41s |  that? Well, you can encompass a lot of that under a heading of you do what you gotta do. I'm
392.41s - 397.41s |  here to serve the public in matters of information and media. And to a librarian, everything
400.85s - 405.85s |  is media. This podium, this podium I'm speaking from, librarians can totally catalog and
408.59s - 413.59s |  circulate this thing. Uh, we, we actually have a word for it. It's called realia. This is a
413.67s - 420.47s |  realistic thing, it's not a book, it's not a, you know, a piece of like a Blu-ray or anything
420.47s - 426.61s |  like that. This is realia. We can circulate this stuff. See, if you haven't been to your local
426.61s - 432.11s |  public library recently, I strongly encourage you to go. The reasons for that are stuff that
432.11s - 435.53s |  you probably already know, but I'll drop the two biggest ones just in case you need a
435.53s - 442.07s |  reminder. Number one, we lend you stuff for free. And, uh, with that, that could include
442.07s - 447.09s |  stuff that, uh, you didn't, you may not associate with public libraries, which is the
447.09s - 452.09s |  number two reason you should go to the library and see what they have. If you think we're just a
452.09s - 457.09s |  stronghold of books and Blu-rays, you might give it another look just in case. So, um, for
459.43s - 463.27s |  instance, I work with libraries all across the country and some of them have tool
463.27s - 468.53s |  collections, and I'm not talking about the band. Um, if you're, uh, if you're putting
468.53s - 474.71s |  something together and maybe you need a hammer or a cordless drill or something like that, but
474.71s - 478.61s |  you're not a handy person, you're not Norm Abram, so you don't want to just buy this, you're
478.61s - 483.79s |  just assembling something that you bought at Ikea, check, check with your local library. They,
483.79s - 487.99s |  uh, they might have a tool collection for you. Um, do you want to learn how to play the
487.99s - 494.13s |  guitar? Some libraries have musical instrument collections. So, this is great because you
494.13s - 499.13s |  can go lend, you can borrow that guitar and you don't have to buy one because later on if you
501.57s - 505.35s |  find out, well, playing the guitar isn't for me or I'm just not good at that. Well, if you
505.35s - 509.81s |  bought a guitar, now you have a symbol of your failure laying around your house. With the, with
509.81s - 514.83s |  the borrowed guitar, you just take it back to the library. So, I work with a library that has a
518.45s - 523.53s |  massive collection of cake pans. Literally, lots of cake pans. And you might think, cake
523.53s - 528.87s |  pans, well, how often do you need to make a Hello Kitty birthday cake? Maybe once a year? So,
528.87s - 534.97s |  why should you buy a Hello Kitty cake shaped cake pan for the other 364 days? Just go borrow
534.97s - 539.97s |  the thing. So, podiums, right? I'm just saying, sometimes people need to talk in front of a
542.15s - 549.15s |  crowd and, uh, you know what they might not have? Podium. It's not something you got laying
549.17s - 554.81s |  around your house most of the time. A library could buy, catalog and circulate one of these
554.81s - 559.35s |  things. I would not be surprised if that's something that's already happening in a library
559.35s - 565.79s |  somewhere. So, as I said, I am here to serve the public about information and media and
565.79s - 570.83s |  sometimes that stuff doesn't come easy. At one point in your lives, you may have gone to a
570.83s - 575.83s |  library for a story time. Um, so, you have your very own librarian right here, so let's, let's
579.23s - 584.21s |  have a story time. Sit back and relax. I'm going to tell you a couple of stories because it's
584.21s - 589.41s |  the war stories track, right? Um, I was going to bring puppets, but when I explained to the
589.41s - 593.71s |  DEF CON organizers what I wanted to do with them, they shot that idea down for ethical
593.71s - 600.33s |  reasons, so. Once upon a time, there was a law. It's a pretty good law, as laws go. And its name
600.39s - 605.39s |  was Title 17 United States Code Subsection 109A. Thank you. Big fans! Anyway. Uh, this little
614.83s - 619.83s |  bit of legislation does us the small service of providing only the entire foundation of how
622.91s - 627.91s |  libraries operate in the United States. But please, Title 17 United States Code Subsection 109A
630.95s - 636.55s |  that's a very long name, very complicated. So, it's got a nickname. It's called the First Sale
636.55s - 641.55s |  Doctrine. Simply stated, this law allows libraries to buy physical items and lend them. We can
644.59s - 649.59s |  lend books, blu-rays, and banjos. Uh, because when we buy them, we own them. And because we
652.17s - 657.17s |  own them, we can decide to lend them to others. So, more than one person has said that if a
657.35s - 662.35s |  library didn't exist today, it would probably be illegal to create one. And that's because
665.25s - 671.79s |  media publishers would never let a law like this pass if this was something that came forward
671.79s - 676.79s |  today. So, this law is great though when it comes to physical items. What about the digital
679.49s - 684.41s |  stuff? So, hey, you might not have known this either if you haven't been to the library for a
684.41s - 689.25s |  little while. Uh, did you know you can check out stuff at the library and never leave your
689.25s - 694.25s |  home? You can get things from e-books and digital comics. You can stream music and movies. Uh,
696.13s - 701.37s |  you can download magazines and read the news. You don't even have to put on pants. Just get
701.37s - 706.37s |  your tablet, get your phone, log into your library account and get stuff for free. Legally,
707.17s - 712.17s |  for a change. And that, dear hearts, that's the problem. Digital items are not sold. They're
719.75s - 726.69s |  licensed. And licensing does not equal ownership. And libraries all across the country are
726.69s - 731.69s |  seeing a steep rise in their public's desire for digital items. Okay, well, so what? Well, how
732.69s - 737.69s |  much do you pay for an e-book on Amazon? Maybe about 15 bucks or so, give or take, you know, if
740.99s - 747.33s |  it's new or it's big or whatever. Say about 15 bucks. And keep in mind, you are licensing it
747.33s - 754.57s |  too. You don't own that. Um, but you are just a single licensee reading the book on your
754.57s - 761.41s |  devices. Fine. Libraries, on the other hand, we want to lend e-books to multiple people so
761.43s - 768.11s |  they can read it on multiple devices. And publishers, they don't like that. They
768.11s - 774.81s |  absolutely see that as lost sales. Do you know how much a library will pay for the same e-book
774.81s - 779.81s |  that you bought on Amazon for 15 bucks? 60. They will pay about 4 times the cost so that you
784.79s - 790.89s |  can have access to an e-book. And that's for a single user license. Well, what the hell is a
790.91s - 795.85s |  single user license? A single user license basically says that one person can check out that
795.85s - 800.85s |  e-book at a time. Just like a physical book. It's an e-book. It's not like we have a problem
804.29s - 809.29s |  making copies of it, but the licensing is that one person can have that book at a time. So, more
811.97s - 818.57s |  than that, publishers will also literally withhold sales to, to libraries. Um, because they
818.59s - 823.25s |  want to hit that buyer's market first. The new, you know, James Patterson pulls a lever and
823.25s - 828.27s |  publishes a novel and the, the publisher might not offer that as a e-book to libraries because
831.83s - 837.73s |  they want to hit that buyer's market first. Those free-loading librarians can just wait to
837.73s - 843.87s |  pay 4 times the amount for that e-book because, you know, the publishing industry got to get
843.87s - 850.45s |  paid, son. Oh, and by the way, that license is good for anywhere from a few months to maybe a
850.45s - 855.45s |  couple years. And then the library has to license the book again. Why? Did it wear out?
861.23s - 866.23s |  Actually, that's the story. The publishers, uh, and the sellers will tell you that a physical book
866.67s - 871.67s |  will wear out over time, so you're going to need to replace it. So, that's all we're doing, we're
874.11s - 879.61s |  just emulating what's happening in the physical book. That's okay, right? Beloved, there are
879.61s - 884.61s |  books in libraries that are over 200 years old. Travel to Europe, there are books in libraries
887.99s - 893.55s |  that are centuries old. Um, yeah, you might not be able to check them out and take them home,
893.55s - 898.55s |  granted, but I bet they're still somehow available for use. There's not an e-book around right
901.19s - 907.95s |  now that is even half as old as some of the oldest books in a, in a library. In other words, this
907.95s - 913.03s |  is just good old fashioned bog standard capitalism at work. You, you've heard of forced
913.03s - 918.03s |  scarcity, I'm sure. This is enforced scarcity. We live in a time where nothing, nothing ever
918.55s - 923.55s |  needs to go out of print. And even things that have gone out of print, they could be digitized,
927.37s - 934.19s |  resurrected and brought forward. And, you know, Google did that. And they got away with it
934.19s - 938.37s |  because they're Google. And then the Internet Archive did that, got sued and had to remove
938.37s - 943.37s |  500,000 books from their collection. Um, because of course, of course, that represents a loss of
948.17s - 954.31s |  sales. As a counterpoint, according to Publishers Weekly and the Association of American
954.31s - 959.31s |  Publishers, the United States publishing industry made over 12.5 billion dollars last year. We
961.85s - 966.85s |  should all have some of those lost sales. How do they survive? And with the growing demand for
969.33s - 974.59s |  e-books, library budgets are feeling that pinch more than ever because e-book licenses are
974.59s - 980.83s |  more or less twice the price of a physical book. A new dead tree book might cost 20, 25
980.83s - 987.37s |  bucks. A library could buy two books for 50 bucks, or they can buy one single e-book license
987.37s - 992.37s |  for 10 dollars more. I mean, fiscally, those physical items make more sense, but that's not
995.41s - 1001.89s |  what people are after. And beyond that though, what do you do when you're faced with a
1001.89s - 1008.59s |  patron who needs an item, but that item is almost unobtainable? Because Amikoi, my God, we
1008.59s - 1012.79s |  haven't even talked about things like the price of journals, like academic journals. Any
1012.79s - 1018.37s |  students here today, anyone working on a bachelor's, a master's, maybe even a doctorate. I
1018.37s - 1024.65s |  got, I got a few hands, awesome. Okay, so do you know how much money your college library
1024.65s - 1030.81s |  spends per year for access to academic articles and publications? I want you to think of a
1030.83s - 1035.43s |  number. A price that sounds reasonable, let's not get cos, cos, you know, cosmically
1035.43s - 1040.87s |  stratospheric here, but a price that sounds reasonable. What do you think your university is
1040.87s - 1045.89s |  paying for access to those academic journals? Got that number? No, you're wrong, it's higher.
1045.89s - 1050.89s |  The, the cost of academic journals and access to those publications is insane and it's
1053.65s - 1059.09s |  obscene, and never mind that many of the articles that these students are after were written
1059.11s - 1065.71s |  by researchers and scientists working with public funds. So, if you're a student browsing a
1065.71s - 1072.41s |  database of publications at your uni's library and you find what you need, I, holy crap, here
1072.41s - 1077.05s |  it is, this, this is what I'm looking for. I know this author. They're working in my arena.
1077.05s - 1083.09s |  This will go a long way to helping me finish my master's thesis or my doctoral dissertation.
1083.13s - 1088.13s |  Fantastic. And they don't have it. This is the heartbreak of the abstract, where all they
1092.77s - 1097.91s |  have is the abstract. Your library, for some reason, just does not have access to that
1097.91s - 1105.12s |  article. So, imagine yourself now as a librarian. You've got that patron looking for a book
1107.26s - 1112.74s |  that's had one print run and hasn't been published again since the 1970s. You've got a patron
1112.74s - 1118.52s |  who needs an indie film that was made in 1990 and can't be found anywhere. Or you've got
1118.52s - 1124.86s |  this student who needs the article, but you don't have it. When I was in high school, never
1124.86s - 1129.86s |  mind how many years ago, a friend of mine taught me something that literally stuck with me
1129.86s - 1134.40s |  ever since. I could put this on a business card and it would make some sense for me. And that
1134.40s - 1139.40s |  thing is, is when what you need don't meet your eyes, you must learn to improvise. So, time
1139.60s - 1144.60s |  to improvise. Due to patron confidentiality, I will not divulge the title of this book,
1147.64s - 1153.18s |  except to say it was a work of fiction written in the 1970s by some author I had never heard
1153.18s - 1159.72s |  of. The patron read this book back in their younger days. And like a fever dream, it popped
1159.72s - 1164.60s |  into their head again and they just, they needed to read it again. And hey, I get it. I don't
1164.60s - 1168.96s |  know about you, but as a librarian, there's certain books that I always go back to. I cannot
1168.96s - 1176.90s |  tell you how many times I've read Neuromancer and the Hitchhiker's Guide to the Galaxy. It's
1176.90s - 1181.90s |  like comfort food. Now, libraries have various networks that they can go through to do
1184.28s - 1189.28s |  something magical. And that magical thing is interlibrary loan. And if you're not familiar
1191.82s - 1198.42s |  with it, no shame. Today, you are one of today's lucky 10,000. So, let me tell you about
1198.46s - 1204.62s |  interlibrary loan. See, if you go to a library and they don't have the thing you need, you can
1204.62s - 1209.76s |  talk to someone there and they can try to get it from another library. Maybe even at a
1209.76s - 1214.34s |  completely different state, sometimes in a completely different country. You may have to
1214.34s - 1221.40s |  pay for shipping, but they can help you get that weird and wonderful thing that cannot be
1221.40s - 1226.22s |  found anywhere else. And that's exactly what I did. I, you know, worked with this patron, I
1226.22s - 1230.98s |  looked it up in the computer, we placed a request through an interlibrary loan network and
1230.98s - 1236.00s |  we waited for the item to arrive. Which it did. Just the next week. In pieces. It's a paperback
1242.00s - 1248.80s |  from the 1970s. Do you know what they used to make binding glue out of in the 1970s?
1248.80s - 1256.19s |  Lysergic acid diethylamide and the dreams of small children. I called this patron and I
1256.19s - 1262.85s |  said, hey, um, I got your thing, but there's this problem. And they were heartbroken. That's
1262.85s - 1267.13s |  one of my favorite patrons. They were afraid to check it out because they didn't want to
1267.13s - 1270.73s |  further damage that. I don't know how they would have done that other than sticking it in a
1270.73s - 1277.27s |  blender with some protein powder. Um, but dammit, I hated to disappoint this person. And the
1277.27s - 1281.57s |  lending library that responded was the only lending library that responded. It was either this
1281.59s - 1286.59s |  copy or nothing. Time for the lie. This patron, I'll call him Joe. I'm talking to him on the
1289.27s - 1294.27s |  phone. I said, hey Joe, do you have an e-reader? You do. That's awesome. Hey, what kind of e-reader
1294.27s - 1299.77s |  you got? Uh huh. That new Kindle? Yeah, right. How do you like it? Nice. Okay, so here's what
1299.77s - 1304.65s |  we're gonna do. I'm gonna, I'm gonna check in a different ILL system real quick. This one deals
1304.65s - 1309.05s |  in digital copies. And no, no Joe, I know you already look, but I'm a librarian. Let me do my
1309.07s - 1315.31s |  job. And oh my God, Joe, check it out. I found it. It's right here. No, this one library, they've
1315.31s - 1320.51s |  got it. Um, I need to contact them to see uh, see what I need to do to borrow it. But I'll give
1320.51s - 1325.39s |  you a call back in a couple days. Okay, talk to you later Joe. Bye. Beloved, did you know you
1325.39s - 1332.15s |  can scan a paperback in about 30 minutes? Uh, I took the book home and this was before I got a
1332.37s - 1337.37s |  proper book scanner. I have tools now. But I just had at the time, you know, regular run of the
1341.61s - 1347.31s |  mill, pretty decent flatbed scanner. And it was great cause you could easily fit the pages on
1347.31s - 1351.89s |  the glass uh, you know, the glass part of the scanner and push what was left of the binding up
1351.89s - 1356.75s |  against the uh, you know, up against the thing. Got some good pages. And you know, I threw in a
1356.75s - 1361.83s |  podcast and about half an hour later I had a bunch of images of pages which I could feed to
1361.87s - 1368.41s |  ScanTailor. A bit of software that I think the Internet Archive still uses for um, ingesting,
1368.41s - 1373.41s |  OCRing and converting images of pages into actual e-books. Um, it's not pretty but it works.
1376.65s - 1381.49s |  Uh, well and then after I'm done, well this patron has a Kindle so obviously I needed to use
1381.49s - 1386.57s |  Calibre to convert it to Mobi format. And 2 days later I gave him a copy of a favorite book
1386.57s - 1391.57s |  that he had not read in 30 years. Okay. Thank you. Thank you. You're far too kind. Alright,
1396.45s - 1401.23s |  this is one of my favorite stories of all time. I'll be telling this until I die. Uh, and
1401.23s - 1406.23s |  this worked because of people like what I'm looking at at here at DEF CON. In the 1990s a
1408.69s - 1415.07s |  bunch of punks made a movie. And I mean that literally. I want to tell you a story about
1415.07s - 1421.11s |  Terminal City Ricochet. This is the one, this is one of the most independent of indie films.
1421.11s - 1428.15s |  It's a punk rock counterculture cyberpunk cult masterpiece starring, well, featuring Jella
1428.15s - 1433.15s |  Biafra of the Dead Kennedys and Joe Keithley of DOA. So uh, there was this uh, there was this
1437.49s - 1442.49s |  person, I mean well let me back up. So why is this, why is this thing hard to find? Um,
1445.07s - 1450.07s |  so this, this uh, this movie was made in sunny British Columbia, which is not Hollywood. Um, it
1453.27s - 1458.27s |  has a soundtrack with some raging Canadian punk bands. And as I said in 2023, late 2023, it was
1460.61s - 1466.59s |  almost entirely unobtainable. I mean they probably printed, you know, just a few DVDs and VHS
1466.59s - 1472.19s |  cassettes and probably sold them through their friends and independent shops and stuff like
1472.21s - 1477.45s |  that. So they're just strewn to the four winds. You could not even find it on eBay. And you
1477.45s - 1482.53s |  can't pirate it because if you want to pirate something, you need to kind of have a copy of it.
1482.53s - 1489.27s |  So, one day on Mastodon, someone started asking around about this movie and they wanted to get a
1489.27s - 1495.41s |  copy of it. And that was proven to be difficult if not impossible. So, by the way, I don't know
1495.41s - 1499.65s |  if he's here, but big shout out to the Gibson for hosting, running and putting up with all the
1499.67s - 1505.91s |  insanity that is the hackers dot town Mastodon server. Um, you know, awesome, awesome work
1505.91s - 1511.85s |  there. And that's what facilitated this whole thing. This user had checked out some libraries
1511.85s - 1516.59s |  and they couldn't find it. And someone just popped up, I didn't even know who this person was,
1516.59s - 1522.29s |  popped up and said, hey, if you ask Cyberpunk Librarian, he might know a way to get it. So,
1522.29s - 1528.87s |  they checked a bunch of libraries. They had not, however, checked WorldCat. Now if you don't
1528.89s - 1535.13s |  know, WorldCat is a massive catalog of library materials and libraries all over the globe. And
1535.13s - 1540.41s |  it's run by a company called OCLC. Now, I'm not going to get into the problems inherent with
1540.41s - 1545.37s |  OCLC and modern libraries because we don't have the time and they only allowed me a shot and
1545.37s - 1552.69s |  not the entire bottle. I, but I will tell you that if you want to see if you can find something in
1552.71s - 1557.71s |  a library somewhere, your first stop is WorldCat dot org. So start there. And using WorldCat, I
1560.51s - 1565.51s |  found a copy. One single copy. And do you know where it was? No surprises. Greater Victoria
1568.53s - 1573.53s |  Public Library in beautiful British Columbia. So, uh, yeah. We're able to uh, you know, on
1574.21s - 1579.21s |  Mastodon, we're able to work with each other. And uh, you know, a little back and forth, we
1585.35s - 1591.09s |  found a Victorian local who literally lived down the street from this library. Now, this is a
1591.09s - 1598.09s |  rare piece of media, but you could check it out. And they did. And they ripped us a beautiful
1598.13s - 1603.13s |  digital copy, including the soundtrack. Um, so, you know, and they provide it for this
1607.23s - 1613.81s |  person who is doing everything they could to obtain it legally. So, there was this guy, I'm
1613.81s - 1617.31s |  sure you've not heard of him because there's librarians that might never heard of him. His
1617.31s - 1622.81s |  name was Ranganathan. I'm probably pronouncing that wrong. He wrote down the five laws of
1622.81s - 1628.55s |  library science. These are still pretty good today. And as you can see, the third law is every
1628.55s - 1633.55s |  book its reader. Or in this case, every DVD its viewer. So, within a few days, a long lost
1637.15s - 1641.49s |  movie had been re-obtained. And nowadays, strangely enough, you can view it on the
1641.49s - 1646.49s |  internet archive. Funny how that happened. Okay, circling back, let's go back to that student
1646.91s - 1654.21s |  who needed the article that their library didn't have access to. Now, there's something that you
1654.21s - 1660.99s |  need to understand about libraries and librarians in that it's kind of an insular world. We
1660.99s - 1665.99s |  know lots of other librarians. And you know what librarians love to do? They love to talk to
1668.67s - 1673.67s |  other librarians. Um, so, okay, fine. But what does that mean for the student? Well, we've got a
1674.05s - 1679.05s |  stat request for this article. They need this, the paper's due next week and oh my God. Okay, well
1681.69s - 1687.99s |  even back in the day, before, you know, all the cool internet stuff and things, a good
1687.99s - 1693.43s |  interline- a good interlibrary loan librarian, which is hard to say, could turn this request
1693.43s - 1700.07s |  around in hours if not minutes. Cause yes, there is a formal process that you have to go
1700.07s - 1705.21s |  through to request an interlibrary loan, which you can totally do after you've made a phone
1705.21s - 1710.81s |  call to your friend at the other library way over there and said, hey, I got a student that
1710.81s - 1714.95s |  needs this thing, can you give a copy of it and send it? Yeah, I'll check my email later, I'll
1714.95s - 1720.79s |  send you over the request later this afternoon. Thanks, bye! Now, while I'm not an interlibrary
1720.79s - 1725.97s |  loan coordinator anymore, um, I have worked as an interlibrary loan coordinator over the
1725.97s - 1731.51s |  course of my career. I've been in, I've actually done it for three separate times. I've been
1731.51s - 1736.51s |  on both sides of that conversation. So, these days, like I said, I work in interlibrary loan as
1739.09s - 1745.15s |  a shadow librarian. What that means is literally I'll, I'll watch Reddit, I'll watch Discord or,
1745.15s - 1750.83s |  you know, chat room, whatever, and someone needs a PDF. They don't have access to that PDF. And
1750.83s - 1755.83s |  maybe I do, and suddenly they have access to that PDF. It's very simple. Um, but, to, uh, kind
1760.03s - 1766.11s |  of, kind of move beyond even that, if you listen to podcasts or, uh, watch YouTube videos, which I
1766.11s - 1772.25s |  bet some of you do, um, you will hear someone occasionally say something along the lines of, I'm
1772.25s - 1777.25s |  a lawyer, but I'm not your lawyer. Or I'm a therapist, but I'm not your therapist. Librarians
1777.91s - 1782.91s |  are different. In a capitalistic society, the public library remains one of the few places where
1785.61s - 1790.61s |  you can go and be there, and exist in a location, and no one expects you to pay for it. I am, I
1794.25s - 1799.97s |  take pride in being part of a rare organization that can literally say, hi, I'm from the
1799.97s - 1808.86s |  government and I'm here to help and people don't laugh at me. I said people don't laugh at me.
1808.88s - 1814.64s |  But, uh, the funny thing about librarians, we'll teach you how to do our job. We'll show you how to
1814.64s - 1821.18s |  do what we do. And in essence, we kind of cut ourselves out of the, uh, out of the process. And
1821.18s - 1826.82s |  it's not that we don't want to lose you as a patron, uh, but, because we believe in education,
1826.82s - 1832.40s |  okay? Um, and even then, we'll, we'll always be there to back you up. We don't expect you to be
1832.40s - 1837.90s |  experts. Um, so if you're having trouble using the library, you can't find something, well, hey,
1837.90s - 1842.84s |  we are still there. And it doesn't matter if you're standing in a brick and mortar library, it
1842.84s - 1847.74s |  doesn't matter if you're chatting to a librarian online or trying to find something on Mastodon,
1847.74s - 1852.76s |  Discord, Reddit, whatever. So, let present me help future you. Like Liam Neeson, I have a
1858.36s - 1864.00s |  particular set of skills. Because I can offer guidance and assistance from a public
1864.00s - 1870.80s |  librarian's point of view and from a shadow librarian's standpoint as well. So, just a few
1870.80s - 1877.28s |  things to consider. If you ever need to go researching something and you need in-depth
1877.28s - 1883.38s |  information beyond what a search engine can provide. First, don't discount your public
1883.38s - 1888.32s |  library. And I'm not saying that because I want you to support your library. Folks, your tax is
1888.34s - 1894.02s |  paid for the library. You're supporting the library. You may as well go use it. It's one of the
1894.02s - 1898.82s |  few places where you can go use the things you paid for. You paid for the cop cars, go drive
1898.82s - 1909.48s |  one, see how it works. But there is one thing that shadow libraries suck at. They're just not
1909.48s - 1914.48s |  good at it at all and I love shadow libraries. Um, and that thing is browsing. Serendipity is a
1914.80s - 1919.80s |  hell of a discovery tool. Uh, for example, I write ghost stories. I have a podcast called AM800
1924.40s - 1930.92s |  WRTH and it's like a night gallery thing in that this fictional AM radio station provides a
1930.92s - 1936.72s |  delivery mechanism for the ghost story. Um, so, yeah, just the same way that the gallery did for
1936.72s - 1942.32s |  the spooky TV story. So, I popped into the, uh, Warren County Public Library in Bowling Green,
1942.36s - 1947.54s |  Kentucky. Because I wanted to find some ghost stories that I could, you know, have as maybe
1947.54s - 1952.84s |  some ticklers. Something, you know, I'm not plagiarizing, I just need ideas, dammit. And my
1952.84s - 1956.68s |  father's side of the family is from Appalachia, which now that you've heard me talk for a
1956.68s - 1962.88s |  little while, might not surprise you. And that is a culture with a wonderful richness of ghost
1962.88s - 1969.28s |  stories. And I figured, hey, I could find something along those lines. And I sure did. That
1969.28s - 1976.32s |  was easy. I mean, 133. That's the Dewey Decimal number for specific topics in the paranormal,
1976.32s - 1981.86s |  parapsychological and occultism. Uh, I didn't even use the library's catalog because I'm a
1981.86s - 1988.54s |  professional, dammit. So, I go straight to the shelf and I'm standing there with a couple of,
1988.54s - 1993.10s |  you know, a couple of shelves of, you know, ghost stories. And that's when I noticed
1993.10s - 2002.08s |  something. Wow, this one guy. Uh, William Linwood Montel. Okay. Um, he's got a hell of a
2002.08s - 2008.28s |  lot of books here. Um, right here in this section. Uh, and most all of them are about
2008.28s - 2013.86s |  paranormal stories and incidents in the state of Kentucky. What's that about? Well, you know
2013.86s - 2018.50s |  what else is in Bowling Green, Kentucky? Western Kentucky University. And if you know
2018.50s - 2023.24s |  anything about the paranormal, you might know that John Carpenter went to Western Kentucky
2023.24s - 2029.64s |  University. His father was a professor at Western Kentucky University and so was Dr. William
2029.64s - 2036.62s |  Linwood Montel. Um, this was a man that was involved in editing, writing, publishing about
2036.62s - 2043.62s |  28 books. He was a folklorist. He studied what he called the history of the common people. Um,
2043.62s - 2048.30s |  I had never heard of this guy until I'm standing in a library looking at a couple shelves of
2048.30s - 2055.30s |  books and then suddenly, I'm a big fan. Browsing a well-ordered collection of information and
2055.30s - 2061.38s |  media might not help you find exactly what you want, but you could find what you need. Um,
2061.38s - 2066.12s |  libraries are great for that and yeah, so are bookstores, but in a library you can borrow the
2066.12s - 2071.86s |  thing and pay nothing. Gather your sources. Yeah, yeah, sometimes the shortest distance
2071.86s - 2075.60s |  between two points is a search on Anna's Archive and suddenly you have an e-book that you
2075.62s - 2080.86s |  didn't have before. But you remember WorldCat? You can uh, you can set up an account on
2080.86s - 2085.54s |  WorldCat, totally free, and you can give it your zip code. And now if you want to see if you can
2085.54s - 2091.24s |  find that weird and wonderful thing that you need to read right now, you can check WorldCat and
2091.24s - 2095.38s |  it will tell you if it's any libraries that are close to you, sometimes within driving
2095.38s - 2100.38s |  distance. Um, so, not only do you want to, you know, worry about that, but you can also uh,
2100.60s - 2105.60s |  check out your library's uh, collection of databases. Um, yeah, libraries have got great
2109.34s - 2113.78s |  collections, but depending on your library, they're gonna have things like magazine and
2113.78s - 2119.62s |  newspaper databases. They're gonna have business databases, medical databases, legal
2119.62s - 2125.26s |  databases. You need forms? They probably got your forms. Hell, lots of libraries have an
2125.26s - 2130.36s |  online language learning system where you can learn a foreign language and you won't have to
2130.38s - 2137.22s |  put up with a guilt trip from a little green owl. So, you may not need any of this stuff today,
2137.22s - 2142.22s |  you might not need it tomorrow, but next week, next month, who knows? Check out other
2144.40s - 2150.36s |  libraries, online or in person. This is not meant to be an exclusive relationship. We are not
2150.36s - 2155.10s |  monogamous here, at least not when it comes to the libraries. What you do on your own time is
2155.12s - 2160.12s |  up to you. Um, but is there something your library is lacking? Okay. Check another. Back in
2164.66s - 2170.70s |  the COVID days, a library set up a thing where you could uh, sign up online for a digital
2170.70s - 2175.64s |  library card that allowed you access to the e-book, you know, e-content collections and the
2175.64s - 2180.64s |  databases and stuff. There was no charge for it. And in most cases, there still isn't. And that
2181.56s - 2186.56s |  card might only be good for maybe 6 months or so, but hey, 6 months might be all you need. If
2189.30s - 2194.80s |  you wanna get something that's, you know, more permanent, almost any library will offer you a
2194.80s - 2201.64s |  library card with full borrowing privileges for some kind of fee. Back in the shadows for a
2201.64s - 2206.98s |  moment, remember that there is a thriving e-book community in other places besides Zed
2207.02s - 2213.30s |  Library and Anna's Archive and stuff. Check out IRC. Remember IRC? Good times those were.
2213.30s - 2218.30s |  There's a couple channels there on Undernet called e-books and books. That's a books with a
2218.30s - 2223.24s |  Zed on the end of it. Um, you know, check that out. Easy to use, especially if you know how to
2223.24s - 2230.18s |  use IRC. But, outside of all of that, today I would like to offer you a fantastic
2230.22s - 2235.22s |  opportunity. I have a timeshare, no. Um, I would like to offer you a fantastic opportunity to
2239.26s - 2245.80s |  be someone else's librarian. Listen, all of you, you're, you're here at DEF CON, right? I
2245.80s - 2250.80s |  think so. I haven't hallucinated this bad in ages. Um, that means, whoops, I think I just got
2252.84s - 2257.84s |  out of that. There we go. That means that you too have a particular set of skills. You have
2260.18s - 2265.18s |  you know things and you know how to find things and you know how to do things with what you
2267.32s - 2273.86s |  have learned. You know about torrents, you know about Anna's Archive, you know how to break
2273.86s - 2279.80s |  DRM. I could have totally put in a talk topic where I stood up here, talked about how DRM
2279.80s - 2284.14s |  works on digital library materials, how you could strip that shit off and then make those
2284.14s - 2288.64s |  files available for someone else to get a hold of, you know, that may not have access to it. I
2288.64s - 2295.38s |  didn't do that because I think it'd be boring because I bet, I bet many of you already know how
2295.38s - 2300.38s |  to do that shit already. And if you don't, you can learn it in an afternoon, believe me. But
2302.52s - 2307.32s |  across the United States right now, right wing legislators and fascists, sorry, but I repeat
2307.32s - 2314.06s |  myself there, are effectively banning books and materials in libraries and schools. Is it
2314.06s - 2319.06s |  related to sex? Ban it. Anything to do with the GOBTQ community? That's gotta go. Uh, does it
2322.26s - 2327.26s |  involve a non-Christian deity? That, can't have that. Um, but it goes beyond that. Some states,
2331.74s - 2336.38s |  namely, let's see if I can do this, Arkansas, Idaho, Indiana, Missouri, Montana, North
2336.38s - 2341.38s |  Carolina, Oklahoma and Tennessee have tried to pass laws that make multiple aspects of public
2341.84s - 2346.84s |  librarianship a criminal offense. And in some states, they succeeded. In uh, in Oklahoma,
2352.08s - 2358.28s |  school and public librarians are looking at up to $20,000 in fines or 10 years in prison for
2358.28s - 2363.30s |  exposing children to obscene materials, whatever the hell that is. In uh, in uh, Montana, school
2364.02s - 2369.02s |  library and museum uh, employees face prosecution for dealing in obscene materials. Have you
2376.60s - 2382.64s |  got a renaissance exhibit coming through town? Does it have pictures of naked people? You
2382.64s - 2387.64s |  might go to jail if a kid comes to the museum. Sounds great, doesn't it? So, what can you do
2388.26s - 2393.26s |  to help? It's very easy. Share your skills, share the media. Now, you can take that however you
2402.66s - 2408.04s |  like. You might be thinking, oh, I, I see what he's saying. He's encouraging me to liberate
2408.04s - 2412.64s |  DRM encumbered materials and make sure that others can access those materials uh,
2412.64s - 2416.96s |  regardless of the capitalist bullshit, unconstitutional laws and oppressive
2416.96s - 2423.21s |  governments. And you'd be right. You, or you might think, hey, he's suggesting, I know what he's
2430.45s - 2435.65s |  saying, he's suggesting that I should scan and copy and digitize materials that aren't even
2435.65s - 2440.67s |  available online and then put them online. And you'd be correct. Um, or you might be
2445.43s - 2450.43s |  thinking, hey, I uh, I know a kid and they really need to read genderqueer. Cause they're
2456.81s - 2462.29s |  going through some shit right now, man. And uh, maybe I should get them a copy of their own
2462.29s - 2467.29s |  because their state banned that book in public and school libraries. That's good too. I'm
2468.29s - 2473.29s |  gonna close this out with a uh, with a dirty little secret about me. That's not really a dirty
2477.53s - 2489.25s |  little secret if uh, if you know anything about me. I never finished my library degree. I
2489.25s - 2494.29s |  started working in libraries uh, 30 years ago. I've never been able to finish my library
2494.29s - 2498.47s |  degree cause I'm too busy doing library work. I've shelved books, worked the front desk,
2498.47s - 2501.83s |  reference desk, children's desk, built curriculum, taught classes, installed tech, fixed
2502.29s - 2506.45s |  problems, started problems, migrated systems, abandoned systems, created workflows, created
2506.45s - 2513.33s |  databases, wrote SQL, wrote PHP, wrote documentation and wrote an entire goddamn book on how to
2513.33s - 2518.33s |  use a very specific database in a very specific library system. I did all that shit without a
2520.91s - 2529.50s |  degree. I started working in libraries 30 years ago. You can start today. You can be someone
2529.82s - 2534.82s |  else's librarian. Even if they're, even if they're your only patron. All you need to do is
2538.36s - 2543.36s |  help and share. Anything you don't know, you're allowed to look it up. Thank you for
2545.84s - 2551.48s |  listening. Thank you to Derek Brown for browbeating me into being here. Rise above my
2551.48s - 2565.34s |  friends, enjoy the rest of DEF CON. They got a thing coming up I'm sure in a few minutes. I'm
2565.36s - 2569.36s |  going to head out into the hallway if you want to ask me questions. Well, hi, I'm a
2569.36s - 2574.94s |  librarian. Um and uh yeah, I'll meet you all out there. Thank you all for coming. There's a
2574.94s - 2578.94s |  hell of a lot more of you than I thought there would be and thank you for having me.


url: https://www.youtube.com/watch?v=QgeEHdAmJDg
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Secret Life of  Rogue Device: Lost IT Assets on the Public Marketplace - Matthew Bryant

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=QgeEHdAmJDg",
  "title": "DEF CON 32 - Secret Life of  Rogue Device: Lost IT Assets on the Public Marketplace - Matthew Bryant",
  "description": "An ex-employee's work laptop, a secret hardware prototype, the company backup server, and classified government computers. What do these things have in common? They should never end up on the public market. Ask any IT department and they'll tell you that \"it happens\", but how serious is the problem and what's really at stake? This talk explores the interesting journey of a research project to learn the surprising answers to these questions.\n\nAlong the way we'll scrape over 150 million images from online listings in Western and Eastern second hand markets, hack together an OCR cluster out of old iPhones, reverse engineer well-obfuscated Chinese apps, and converse with secretive underground groups of collectors.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1815,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.04s | This text was transcribed using whisper model: large-v2

 Good deal. Thank you all for coming. This is a secret life of a rogue device
5.24s - 9.36s |  My wife told me not to tell anybody who helped me with these slides and make them look beautiful
9.36s - 15.12s |  So I'm just gonna say a beautiful anonymous woman helped me make these look nice and the earlier format was much uglier
15.12s - 16.36s |  I assure you
16.36s - 22.04s |  So a quick background. I'm Matthew. My friends call me mandatory
22.04s - 29.50s |  I've worked on a variety of security projects things like XSS center cursed Chrome and I write security research at the hacker blog calm
29.94s - 32.58s |  In my professional life, I also lead the red team at snap
33.18s - 37.69s |  So this talks sort of about quote-unquote rogue hardware
38.43s - 43.03s |  Ending up on the secondhand online electronics markets. So what do I mean by rogue?
43.03s - 45.39s |  I mean things that shouldn't end up there
45.39s - 49.43s |  So this is kind of a few key categories, right things like employee laptops
49.43s - 54.17s |  Which you're probably familiar with right that shouldn't be resold maybe has sensitive data on it stuff like that
54.95s - 56.63s |  It means things like prototypes
56.63s - 59.15s |  So early development version of your favorite products
59.15s - 63.87s |  maybe like the iPhones that you enjoy right earlier stages when they were first being built right and
64.07s - 70.11s |  Then sort of like more specialized things like factory line equipments and you know backup hard drives stuff like that
70.11s - 72.11s |  So that's sort of what we'll be covering
72.35s - 77.64s |  The main questions we're gonna be answering here is some of them are pretty obvious, right?
77.64s - 80.76s |  It's like how often does this actually happen right? Is this a problem, right?
80.76s - 85.32s |  And then for the stuff that does end up here, you know on these secondary markets. What's the impact?
85.32s - 90.00s |  Is there anything security related that we have to worry about and then, you know, ultimately what is it?
90.00s - 92.00s |  That actually ends up getting resold like this
93.32s - 99.12s |  Along the way we'll sort of figure out like, you know, what are the challenges of doing research in this space once we figure those
99.12s - 103.48s |  Out well to scale it up to sort of do all of the listings across Western and Eastern markets
103.48s - 108.96s |  And then we'll finish up with everybody's favorite part, which is like war stories and loot and all that cool stuff
111.60s - 114.84s |  Great. So what are the challenges to finding rogue hardware?
115.84s - 120.28s |  First one is probably pretty obvious. You probably already guessed it. We've got to get it from somewhere
120.28s - 122.84s |  So what are the places that stuff gets resold on right?
122.84s - 127.64s |  So if you're you know from the US you probably familiar with eBay right for the Western side of things
127.76s - 132.60s |  There's also other things like Craigslist and Facebook Marketplace, but those are generally a little bit more local, right?
132.60s - 136.44s |  You they might expect you to show up and you know, that's kind of hard to scale out
136.44s - 139.72s |  So we want stuff where you can sort of ship it. So we'll kind of focus on eBay on this side
140.72s - 146.24s |  On the eastern side, you know sort of where all the electronics are assembled actually put together right within some manufactured
146.60s - 151.72s |  There's another market which you may not be as familiar with. I apologize to the native Chinese speakers here
151.72s - 152.64s |  I'm gonna butcher this word
152.64s - 154.64s |  But Shen you is the app that they have there
154.76s - 160.48s |  Which is much larger than I thought it was going to be but this is basically the second-hand market in China
160.48s - 162.40s |  So if you want to resell something there
162.40s - 168.53s |  So we know the where but the second challenge is like sellers don't usually make listings like this
168.53s - 173.17s |  They're not like hey, this is a secret, you know prototype for this crazy product thing, right?
173.45s - 177.37s |  Usually the sellers don't even know what it is that they're selling right in many of these cases
177.57s - 182.21s |  And they're not just gonna put that in a listing where we could easily find it. So how do we deal with that?
183.25s - 187.61s |  I'll give you a little spoiler a lot of the information that we actually want is more in the images, right?
187.61s - 188.77s |  So it's not in any text
188.77s - 194.13s |  What's actually in the text embedded in the images themselves if you have again a company laptop probably sticker on the bottom
194.13s - 197.05s |  It says property of whatever or asset tag, you know, whatever
197.81s - 202.01s |  So we have to dig a little bit deeper to find the answer to this stuff right to figure out the real truth of where
202.01s - 202.85s |  These are
202.85s - 209.34s |  So assuming that we get all the stuff from where we've talked about and then we sort of analyze those images and do all this
209.34s - 212.62s |  Stuff right? We still have to know kind of like what we're looking for, right?
212.66s - 218.06s |  So in the case of prototypes, like I mentioned there's like secret code words secret labeling conventions they use
218.62s - 223.14s |  For I mentioned before for employee laptops, there's special barcode formats and whatever else, right?
223.14s - 226.46s |  So we have to sort of figure out what these are in order to identify when these things show up
226.98s - 232.84s |  And let's talk about sort of building a pipeline for detecting this rogue hardware at scale
234.40s - 238.24s |  Probably unsurprisingly the first challenge is we've got to scrape the hell out of a bunch of sites, right?
238.24s - 242.36s |  So I mentioned before we'll focus on two main sites here eBay and sinew
242.80s - 246.24s |  Let's start off with eBay because it's dramatically easier to scrape. You'll see why
247.12s - 249.00s |  So on the eBay side, this is pretty simple
249.00s - 253.92s |  You just do searches for the kind of products you're looking for right something like laptop or phone or whatever it is
254.28s - 258.36s |  You scrape the resulting listings and you extract the images out of them so we can do analysis on them
259.44s - 263.60s |  But we have a hurdle and this is pretty much the case for any major site, right?
263.60s - 267.16s |  They'll have some form of rate limiting right to prevent either bots or whatever it is
267.60s - 271.96s |  In the case of eBay if you do too many requests, they give you this fake 404 page saying hey
272.56s - 276.36s |  You know, you're doing that too much and to try to fool you into thinking this page doesn't exist
277.72s - 281.08s |  Luckily in the modern Internet is not quite as simple as it used to be, right?
281.08s - 286.76s |  We have like CDN services in the middle of a lot of things to sort of speed up page loads and optimize content being served
286.76s - 290.56s |  At the edge right and we can use this to our advantage to circumvent this rate limiting
290.76s - 295.16s |  So in the case of eBay, you know, they essentially have an allow list from all of cloudflare
295.16s - 298.60s |  Which is a popular CDNs like IP ranges that said hey if it's coming from here
299.00s - 301.84s |  Don't bother with the rate limiting just allow unlimited requests, right?
302.32s - 305.72s |  So cloudflare allows you to make workers which come from like their space, right?
305.72s - 310.52s |  So I just simply upload a cloudflare worker which proxy to eBay and so by using this as a proxy
310.52s - 316.56s |  I can get around all the rate limiting and do unlimited requests. So super easy. We've got that problem solved
317.76s - 319.52s |  moving right along
319.52s - 325.16s |  All right. So in the China side right Shen you it's not quite as easy
325.16s - 327.92s |  In fact, you go to their website and you don't see like anything at all
327.92s - 331.00s |  It just says like hey download our app to continue. They're like, all right
331.44s - 336.20s |  So you go to their your local app store you download their web their their little app
336.20s - 338.20s |  You start browsing for listings on this, right?
338.40s - 341.92s |  Of course if we want to do this at scale and do any scrapings is not going to cut it
341.92s - 345.92s |  So we got to crack open the app. We remove cert pinning and under the hood
345.92s - 350.84s |  We find that it has a total custom signing API for all of their requests
351.04s - 354.04s |  So they basically generate some cryptographic material. They sign all the requests
354.04s - 356.52s |  They have to be byte perfect and be signed properly
356.52s - 359.76s |  Otherwise the servers will just reject your requests on top of this
359.76s - 364.78s |  Even if you do those requests you get responses where the fields are actually encrypted in their proprietary format
365.00s - 367.40s |  So you have to be able to figure out how to get rid of that as well
367.88s - 370.28s |  And of course they implement their own capture system
370.28s - 375.04s |  So if you're doing a lot of these requests, right, you're not logged in they're gonna spawn this and you have to solve this
375.04s - 376.24s |  and
376.24s - 380.24s |  You're like it's too easy. There's still more all of that stuff
380.52s - 387.00s |  It's not done like in the Java where it might be easier to reverse right? It's done deep inside the obfuscated JNA binary, right?
387.00s - 389.36s |  So you're gonna have to pull out some assembly and start cooking, right?
390.04s - 394.20s |  Really great job actually like by the team. They did a good job of doing the any bot stuff here
395.12s - 400.12s |  But for us, this is just like a skill issue. So we're gonna have to get around all this shit, right?
401.04s - 405.24s |  If any of you have ever done Android reverse engineering before you have personally been on this scale
405.36s - 409.00s |  You start off and you're like reading a blog post. You're like dude Frieda is sick
409.00s - 412.92s |  I can just hook all these functions and like I don't have to do a reverse engineering look like
413.12s - 418.88s |  Easy and then eventually you start like becoming like I'm the real deal. I learned assembly. I can reverse engineer stuff
418.88s - 424.12s |  I can actually just figure out their custom thing and like re-implemented my own language and it's super leaf
424.12s - 427.28s |  And then they do an update and it breaks all your shit and you're like, wait a minute
427.92s - 430.44s |  Every update I'm gonna have to do like three hours of reversing
430.44s - 434.76s |  No fucking thank you. And so you go back to Frieda, right? So in this case, we just skip to the end
435.76s - 438.40s |  so I wrote a custom thing to basically
438.92s - 445.48s |  basically open the app click through all the prompts do initial requests and do the fun like thumb capsule sliding thing automatically and
445.76s - 449.00s |  Then once it's into the state where I can start actually doing these requests
449.00s - 453.96s |  It does a Frieda server and doesn't injection so we can basically hand it an HTTP request that
454.12s - 458.68s |  We want to sign for us and it will return us to sign the request that we can then send to their API server
461.43s - 462.99s |  So this is essentially what it looks like
462.99s - 466.95s |  You got like a rooted phone with a server and essentially it does the signing proxying for us, right?
466.95s - 470.19s |  and then we send that off over residential proxy to make the request and
470.83s - 475.55s |  Result looks something like this again cable management was not me. It was much uglier when I did it
476.23s - 480.00s |  So this gives us a good way to sort of find new sellers, right?
480.00s - 484.64s |  We do searches we get their seller IDs and now we've got a good base to actually scrape the items that we want here
485.56s - 488.96s |  So when I said that there's like no websites that was kind of a lie
489.08s - 493.28s |  They do have a special like preview thing for ostensibly growth reasons, right?
493.28s - 497.24s |  So you can like share a link in the app with somebody else and they don't have to have the app to see it
497.24s - 499.64s |  And it's like a little it'll show you the listing information
499.64s - 501.76s |  But then when you try to buy it, right, it's like down on our app
502.00s - 506.92s |  So that sounds like a great way to get around this but there's kind of a caveat, right?
506.96s - 510.20s |  The rate limiting here is severe. I don't mean like you're like wow
510.20s - 513.88s |  This is like three previews you view it and it's like no, no, no, no more
513.88s - 519.26s |  No more previews you got to log in and so this means that we're gonna need like a lot of IP addresses
520.04s - 523.36s |  So even for like the crappy budget networks, this is gonna be a lot of IP addresses
523.64s - 530.52s |  So I had to do a little bit of digging pun intended and I was like, oh it's available over IPv6
530.96s - 534.76s |  Last time I checked I think there's a lot more IPv6 IPs out there than IPv4
535.08s - 537.08s |  So I think there might be a solution here
537.08s - 538.76s |  Okay
538.76s - 544.00s |  So I went straight to the source for you know for me this is like the North American number registry
544.00s - 545.12s |  Which is Aaron, right?
545.12s - 551.84s |  you can apparently get a fat 36 range IPv6 right allocation and it only costs like 250 bucks a year and
552.04s - 555.76s |  So with this you actually the number of IPs is a bigger number that I can even pronounce
555.80s - 558.88s |  But you essentially have a limited IP space that you can now utilize.
559.92s - 564.12s |  I combined this with a piece of software that my friend wrote which essentially takes like if you have a box where you write
564.12s - 569.60s |  All the IP addresses to you this turns it into like a Sox by a Sox proxy server where every request you make to it
569.60s - 572.28s |  It will randomize it through the outbound range that you have set up, right?
572.36s - 577.76s |  So now we can just start blasting from a limit this huge range right with unlimited IPs and rate limiting is
578.00s - 581.84s |  We'll call it more or less solved, right? We may never come from the same IP twice
583.98s - 585.14s |  Great
585.14s - 587.90s |  Scraping is solved. Let's talk about that second challenge, right?
588.14s - 593.94s |  Again, that challenge is that the secrets that we want are probably not outright in the listing description, right? They're hidden, right?
593.94s - 596.06s |  Maybe the seller doesn't even know what it is that they're selling
596.78s - 602.06s |  So, how do we address this right? The key way that we do this is via OCR, right? So
602.74s - 604.62s |  There's some problems with this in practice
604.62s - 606.50s |  You probably heard of open source solutions
606.50s - 611.50s |  but they have things like this where Apple does their very chic gray on silver design and
611.70s - 615.30s |  Even some humans have issues reading this text right and computers are no different
615.46s - 621.14s |  When I plug this into the open source Tesseract model, right? It basically said there's no text on this
621.14s - 622.70s |  I have no idea what you're talking about
622.70s - 628.18s |  So that was like not gonna fly. I looked at some like proprietary APIs, right?
628.18s - 630.58s |  There's Google Vision Google Vision actually did a great job
630.58s - 634.54s |  I was like, wow, look at all the text that I could you know, want me to get out of this, right?
635.06s - 637.06s |  but then I sort of looked at the pricing and
637.98s - 643.66s |  I was like, oh one penny for seven images. That's pretty good. But then I was like wait so for a million images
643.66s - 647.38s |  That's 1500 bucks and we're doing hundreds of millions of images. So
648.10s - 650.10s |  Yeah, that's not really tenable
650.98s - 653.90s |  But I had sort of a eureka moment when I was actually using my iPhone
653.90s - 658.02s |  I had one of those old-school captures, you know before the current more annoying like grid ones
658.50s - 660.50s |  where essentially I held my thumb down and I
660.78s - 666.50s |  Realized that I could actually select the warped texts and I could copy it and I was like wait
666.50s - 671.54s |  I was as an OCR model. This is sick, and I could paste it and it got it exactly, right?
671.54s - 675.14s |  so I was like there there might be something here and
676.66s - 679.98s |  Not only is it available you can actually like if you just write an app you can integrate
679.98s - 684.78s |  with this API and automate it so I wrote some of the ugliest Swift code any of you have probably ever seen and
685.18s - 692.54s |  made a little HTTP server where I could send it an image and it would do OCR in English and Chinese and do barcode detection and
693.06s - 699.34s |  This basically solved it, but you're probably like, okay, you can use an iPhone, but that's got to be expensive, right?
699.34s - 701.18s |  Like iPhones are super expensive
701.18s - 707.82s |  but in fact the GPU acceleration chip actually goes back as far as the iPhone second generation SE and
708.58s - 714.62s |  And if you get those on like, you know cricket wireless or some unpopular carrier, right they're sold for as little as 40 bucks
715.02s - 719.74s |  So you can get these for super cheap and you can build yourself a high-capacity OCR array
720.70s - 722.70s |  So I wired a bunch of these together
722.90s - 727.30s |  And I had a high-capacity array that could do around 50 HD images
727.54s - 731.90s |  second in English and Chinese even with a lot of text and barcode detection as well and
732.38s - 739.22s |  To make it even better it basically uses no power because the mobile like compute was actually super efficient. So it worked out really well
740.86s - 744.78s |  Great so we scraped all this shit. We got all these images we can do OCR on all these images
744.78s - 747.94s |  We index all of it, but now we need to know what we're looking for, right?
748.14s - 750.06s |  So I started off by just looking like
750.06s - 756.02s |  general examples of like prototypes and company laptops and sort of built a very early set of keywords to alert on and
756.10s - 760.82s |  When I found matches to those alerts for products that were listed anything else on the laptops that they had
760.82s - 766.02s |  I then added those marks to my list of things to alert for right so maybe I had some text that was like property
766.02s - 770.34s |  Of then I get a barcode and I'd see what their barcode format was and then I would add that to my rules
770.34s - 773.10s |  And it's iterative, right? So every time I get more results
773.10s - 774.82s |  I'm improving my rule sets and pretty soon
774.82s - 779.30s |  I've got a huge alert list of keywords that when something comes up I can immediately get a notified of it. I
780.26s - 784.02s |  Made this a little easier by building like a nice little data lake UI so I can just type in
784.10s - 789.38s |  Fancy type any keyword and it will immediately start showing me matching listings so I can very quickly cook these things up
791.71s - 795.19s |  Talked about a lot of pieces overall, but this is kind of a 10,000 foot view
795.35s - 802.35s |  you've got the most convoluted set of like free to server bullshit combined with like exit proxying combined with like elastic search and
802.43s - 807.07s |  iPhone OCRs, but TLDR took a lot to do this with the level of data that we're doing
808.83s - 810.75s |  Overall we're talking about
810.75s - 817.41s |  Much more now, but probably like 50 million listings scraped, right? We're talking over 250 million images OCR in total, right?
817.63s - 819.87s |  None of the iPhones are exploded yet. Very great work
822.04s - 825.04s |  Said there was only three challenges. There's actually kind of 3.5
825.20s - 830.72s |  So imagine you're selling something on eBay and some random person like some remote province of China says
830.72s - 833.84s |  Hey, could you just like ship this to me and you'd be like, dude
833.84s - 835.24s |  I don't know how to do paperwork for Canada
835.24s - 837.68s |  Let alone like you know this place in China, right?
837.68s - 841.40s |  And it's so different if you ask somebody and do domestic Chinese markets to say hey
841.40s - 844.12s |  Could you ship this to me in like, you know, Alabama or whatever it is, right?
844.36s - 850.12s |  So we kind of have to figure out like how can we work in these markets and buy from local sellers when we ourselves like
850.16s - 853.80s |  Don't maybe don't speak the language to understand the culture and when I get it like exported to us
854.84s - 856.84s |  So where can this secret knowledge be found?
858.00s - 863.50s |  Luckily, there's a community who's very familiar with a domestic Chinese market built around like really high-end fake
864.24s - 868.64s |  Fashion replicas. So yeah, your Gucci handbag that's like indistinguishable or whatever from the real one
869.08s - 874.80s |  There's a community that kind of focuses on basically getting these from inside of the domestic Chinese market and they use these agents
874.80s - 877.08s |  Which will actually do the work of communicating with the seller
877.08s - 881.00s |  They'll buy it and they'll actually like rewrap it for you and do all the export forms to get it to you
881.32s - 886.36s |  So we basically use the exact same stuff that they use to get these designer clothes and we kind of have this solved
886.88s - 891.05s |  So this is what you've all been waiting for. I'm sure let's go to the loot
891.05s - 896.89s |  So now what we found here before we again, we'll start off with employee devices here before we sort of get into these
897.09s - 899.35s |  We'll dispel some very quick like well
899.61s - 904.89s |  Actually things that I'm sure you're gonna want to say and one of the common rebuttals I hear is like sure you can find this
904.89s - 910.05s |  Hardware leaking out, but it's it's probably all locked and requires a passcode to access them or whatever
910.05s - 912.25s |  So there's no way that you can like actually do this, right?
912.93s - 918.71s |  My rebuttal in this case is merely a slide. Obviously, there's a lot more examples, but there's only so much space
920.69s - 928.03s |  Plenty of notable examples here, right and you're like, okay, okay. Okay. They're unlocked
928.03s - 931.63s |  I get it. I get it, but that doesn't mean that there's actually anything sensitive on the devices, right?
931.87s - 934.09s |  And again, I only have a slide as a rebuttal
934.75s - 937.03s |  again, many more examples, right and
939.28s - 943.36s |  If you're like my company is not affected if you work for a fortune 500 company
943.52s - 947.26s |  Guarantee you I've seen your equipment end up on eBay or some other market, right?
947.64s - 952.18s |  Super wide breadth of you do any volume of employee equipment or whatever. It's gonna be here
953.62s - 957.80s |  So let's talk about the war stories. I want to actually do a quick little preface here
957.80s - 960.68s |  All of my examples are for a pretty popular company called Apple
961.24s - 965.56s |  This is not because Apple like fucked up especially actually it's pretty much the opposite
965.56s - 971.20s |  They were like a mature hardware company and my point of the research targeting like their stuff was more because like if it affects them
971.72s - 974.76s |  We can be pretty sure that any other company is affected as well, right?
974.76s - 980.12s |  They have they have resources right to make this right. So I will start with the story of the time capsule
980.96s - 987.00s |  So I built up a good little database of alerts and keywords for those things and eventually I got alerted to a time capsule
987.00s - 988.68s |  That was listed in the United Kingdom
988.68s - 993.44s |  and the reason why I got an alert is I had this cool sticker on the background which said property of Apple Computers Inc
993.60s - 997.76s |  Expensed equipment and I was like, hmm. This might be interesting and
998.52s - 1003.04s |  I looked at the description and it said this said hey, it was part of an office clearance good sign
1003.44s - 1007.44s |  It's been powered up and lights up as expected, but it has not been tested beyond this point
1007.76s - 1012.64s |  This is the perfect description for if you think something's gonna be good because it means the device works
1012.84s - 1016.96s |  We couldn't wipe it ourselves because we couldn't really get it like turned on like all set up, right?
1016.96s - 1020.92s |  But we can be pretty sure that like it's at least in the original state that maybe they got it in, right?
1022.00s - 1026.64s |  So I also did some googling and there was actually an office clearance for Apple that like they moved offices
1026.64s - 1028.64s |  So it seemed like it lined up
1028.80s - 1030.80s |  So I placed a bid. I
1031.04s - 1035.76s |  Didn't realize how big the shipping was it was actually like almost like it's like more than the actual device itself
1035.76s - 1041.32s |  so I kind of learned that lesson the hard way, but we'll take a risk got into United States after
1041.84s - 1044.84s |  Sweating with a heat gun and getting the back off and pulling the hard drive out
1044.84s - 1048.12s |  I was able to connect it up to my laptop to start doing like
1048.84s - 1050.84s |  to look at the drive rights and
1051.64s - 1055.72s |  Initially, I looked at it. I was like, oh, you know shoot. Oh, there's no files. Looks like they deleted them
1056.48s - 1058.12s |  I was like unless
1058.12s - 1062.32s |  Unless they deleted it and they didn't actually do a secure wipe of it. So maybe they're still hanging around
1062.32s - 1065.72s |  Let's just just in case let's do a forensic scan this thing, right?
1066.12s - 1069.32s |  So I let this thing run that cooked for around 28 hours
1069.88s - 1071.88s |  For two terabytes, which is quite a while and
1072.40s - 1080.32s |  Turns out it's not entirely true. There was data on the device things like internal credentials things like internal support tickets
1080.84s - 1084.96s |  sales reports and figures internal documentation apps repair guides
1085.84s - 1088.04s |  internal emails bank account information
1088.80s - 1095.60s |  Passport and ID scans and I swear this last one is true dank internal memes from these Apple stores in Europe
1096.60s - 1103.48s |  There was literally an entire video done in like the Backstreet Boys style of how to count the inventory in your Apple store
1103.48s - 1107.52s |  I kid you not it hurt me so much to like hand this back over. So
1110.09s - 1114.73s |  Anyways, I got this and I was like, all right, this is scary. I'm gonna tell Apple about this, right?
1114.73s - 1118.73s |  I used the only only channel they had for reporting which was like their regular
1119.13s - 1125.09s |  Like sort of bug bounty reporting cue thing and said hey, I've got this time capsule looks like it's from like the 2010s
1125.09s - 1128.21s |  It's got like a bunch of euro of stored data and you probably want this
1129.93s - 1135.49s |  You know, I got this I originally submit this actually to them and I got I think some regular like product security person
1135.49s - 1139.93s |  Who's like I do bugs like I don't know what the what this is or what I'm supposed to do with it
1139.93s - 1144.93s |  And he's just like I sent an email to our internal to keep like people but there's nothing I can do with this
1144.93s - 1147.65s |  So I originally was like, oh, this is easiest disclosure ever
1147.65s - 1152.01s |  It's like already over but then I got email later from their G stock in London
1152.01s - 1157.05s |  Which is like hey, we actually do we would very much like that drive and you're in the Bay Area, right?
1157.05s - 1159.17s |  Could you just like drive ten minutes and drop that off for us?
1159.17s - 1166.84s |  And I was like sure, you know lunch break head over there drop it off to them and I was like good deal
1166.84s - 1171.68s |  You know, I sent an email saying we're all good. The disclosure is all finished. I was like cool done deal
1173.32s - 1176.36s |  Later on I received an update like later that night where they were like, hey
1176.96s - 1182.16s |  Any other POC's off that drive that you can send us just to assess the impact of the report and I was kind of like
1182.64s - 1186.16s |  But I already gave you the drive so like how would I how would I do that?
1186.16s - 1188.56s |  Cuz like obviously I don't have the data. I gave it back to you, right?
1188.56s - 1191.88s |  So I was kind of like I think it was just a medication between the team
1191.88s - 1194.52s |  But I was kind of like a little bit like what's the deal here?
1198.94s - 1202.82s |  Cool. So let's talk about prototypes right another one of those like main columns. I mentioned
1203.66s - 1207.34s |  They usually look something like this right lots of scary hardware labels in the back
1207.90s - 1209.90s |  Usually a phone number to report it being missing
1210.62s - 1217.06s |  And Apple actually has some pretty interesting prototypes, they're a little bit more valuable than your regular prototype that you might find
1218.10s - 1220.66s |  Here's a bunch of stuff that I was able to get over doing this research
1221.10s - 1223.66s |  This is actually a small part of a lot of the prototypes. Those are the defiance
1225.38s - 1231.10s |  So the reason why Apple prototypes are a little bit more interesting is because they have something called dev fusing and a lot of
1231.10s - 1237.54s |  Their prototype versions of the iPhone right and you're like, what the hell is depth using essentially in a production iPhone that you buy from
1237.90s - 1244.46s |  Right, they actually burn these fuses which prevent you from being able to do debugging of the application processor and the secure enclave processor
1244.46s - 1249.58s |  Right, and so when you do exploit development, you've kind of heard these like million-dollar or whatever iPhone exploits
1249.74s - 1254.38s |  Having one of these phones is key because it allows you to really easily debug your exploit to make you know
1254.38s - 1255.66s |  Get it pull it off essentially
1255.66s - 1260.02s |  So there's like a big gray market spawned off of this Apple actually has researcher devices that they'll give you
1260.22s - 1263.18s |  If you follow a bunch of legal procedures to get yourself
1263.66s - 1267.30s |  But you know, there's still people that don't want to deal with that. So there's still this big gray market, right?
1267.54s - 1271.74s |  But there's these TLDR. There's these super rare iPhones which are useful for security research, right?
1272.54s - 1273.86s |  This is sort of what that looks like
1273.86s - 1275.10s |  They have different fusing states
1275.10s - 1279.52s |  If you have the debugging cable, you can basically plug the iPhone in and say yes, this is a deaf used iPhone
1279.98s - 1284.86s |  So again on around November 23rd 2023
1284.86s - 1289.02s |  I had my pipeline alerted to a bunch of listings being created at once in China
1289.02s - 1293.22s |  And they were all iPhone 14s and initially, you know when I get a bunch of alerts at once
1293.22s - 1296.26s |  I'm like, oh somebody's reposted their listing like eight times or whatever
1296.30s - 1298.46s |  But then I started to look at the photos and I was like
1298.98s - 1303.54s |  Wait a minute. These are all distinct iPhones. This is not like one iPhone that's been repeatedly posted
1304.14s - 1306.58s |  So it turned out this is actually a huge cache of these
1307.14s - 1313.66s |  Prototype iPhone 14s, which at the time was the latest model of iPhone, right? So this is like a video of the seller
1314.94s - 1318.58s |  Furthermore when I actually bought one of these iPhones and imported it here
1318.58s - 1322.90s |  I realized that the seller when he was sort of taking pictures to validate the camera worked
1323.02s - 1325.74s |  He didn't turn off the GPS tagging feature in the photos
1325.90s - 1329.74s |  so I actually had the exact location in China where the seller actually was and
1330.50s - 1333.64s |  Worse than that. He also took selfies to validate the camera
1334.50s - 1338.62s |  So in terms of like finding the source of these leaks, this is a pretty compelling way to do that, right?
1340.06s - 1341.66s |  But I don't want to give you the wrong impression
1341.66s - 1346.18s |  It's not just that these prototype iPhones will only come from like, you know, wherever in China that they're made
1346.18s - 1348.26s |  He actually ironically so I live in the Bay Area
1348.26s - 1353.02s |  It's either in these remote provinces of China or it's a 10-minute drive from my house with very little in between
1353.54s - 1357.30s |  So in this case like this was one that was leaked in San Francisco, right?
1357.30s - 1361.42s |  It's a DVT model iPhone 14 and it did indeed have depth fusing, right?
1361.50s - 1365.18s |  The most hilarious part about this actually is that the sellers oftentimes when they have these
1365.22s - 1371.38s |  They try to do like a regular restore of the device only to realize like this is a weird iPhone. I can't restore this
1371.38s - 1374.38s |  I have no idea what's going on here. They're just like I got I'll sell it for parts
1374.38s - 1380.74s |  Whatever and so the listings are sold usually for parts when it's actually like a very, you know expensive prototype iPhone, right?
1382.50s - 1388.18s |  Cool so it kind of covered a couple examples here. We talked about time capsule. We talked about these rare prototype devices, right?
1388.18s - 1390.98s |  Let's go to the thing the place where these things are made, right?
1390.98s - 1394.92s |  So in this case the assembly line is for Foxconn for Apple for the most part, right?
1396.18s - 1398.18s |  So I looked at a lot of these Chinese listings
1398.42s - 1400.02s |  Things that had like, you know
1400.02s - 1402.90s |  A bunch of labels that appeared to be related to Foxconn, right?
1402.90s - 1406.90s |  And I started to realize that there was a pattern that was starting to emerge when I looked at these things, right?
1406.98s - 1410.06s |  So if it's used inside of Foxconn, I started to realize that hey
1410.06s - 1411.70s |  It usually has this like, you know
1411.70s - 1416.14s |  Three-letter four-letter a six-digit combo thing that they used to label like internal equipment
1416.14s - 1420.54s |  And so I created a quick rule that anytime something like this shows up in China
1420.58s - 1422.70s |  Why don't you let me know and I'll take a look at it, right?
1422.90s - 1425.46s |  I'm sure all of you can sort of see where this might be going
1426.18s - 1428.86s |  Sometime later. I got an alert for a listing like this
1429.42s - 1431.74s |  For only 181. This is like
1432.54s - 1434.54s |  $28 I think in USD and
1434.98s - 1436.54s |  When I took a closer look at it
1436.54s - 1438.46s |  It had all the markings that I wanted
1438.46s - 1442.86s |  And I looked at the bottom of it and there was an interesting of hole drilled in the bottom
1442.86s - 1444.30s |  I was like, oh, okay
1444.30s - 1448.86s |  So like they basically took a drill press to this thing to like securely destroy it and you know
1448.86s - 1450.86s |  What can get rid of the hard drive?
1450.94s - 1453.62s |  But then I thought about it a little bit more and I was like, wait a minute
1453.62s - 1457.86s |  Let me look up a schematic of what this looks like inside. I was like, okay, so if like the hard drive is here
1457.86s - 1459.18s |  and
1459.18s - 1461.50s |  that means the magnetic platter is here and
1462.70s - 1464.70s |  They drilled the hole like here
1465.50s - 1477.16s |  There might be a chance and this is one of those things where I'm like, there's no way but it would be too cool
1477.16s - 1480.44s |  If it works, so I bought it right into the United States again
1480.96s - 1482.28s |  Didn't you know?
1482.28s - 1483.68s |  Disassembled it pulled the hard drive out
1483.68s - 1489.24s |  I looked inside and I saw that beautiful orange PCB color and I was like, I think they might have missed it
1489.24s - 1491.36s |  But let's let's send it to the experts
1492.08s - 1497.76s |  So I shopped around a little bit found a cheap lab down in LA to that said hey they gave me the honest answer
1497.76s - 1500.76s |  Which is exactly what I was looking for where they were basically like, all right
1500.76s - 1502.76s |  Listen, you drilled a hole in the damn thing
1502.76s - 1507.72s |  Like if you did that and you didn't turn it on and there's not a bunch of dust and all these other things then yeah
1507.72s - 1511.20s |  I think we can recover it, but don't get your hopes up like be aware, right?
1511.72s - 1516.24s |  So I said down to them they basically after some time came back to me and they said hey, you know
1516.24s - 1517.12s |  We pop this thing open
1517.12s - 1520.48s |  It looks like it just hit the PCB and in order to recover it
1520.48s - 1524.56s |  We basically get to buy a working drive go into a clean room and swap the magnetic platter from one to the other
1525.52s - 1531.64s |  Obviously after getting this email I was like so just to be clear you're saying they did miss the magnetic platter and they were like
1531.64s - 1533.64s |  Yep, it pretty much missed everything
1533.80s - 1537.12s |  So it looks like there might be a chance here. There's not a lot of dust even on the platter
1537.12s - 1539.12s |  So I think we might be good
1539.96s - 1543.36s |  Sometime later. I got the email that I was looking for where they said hey
1543.36s - 1549.28s |  I got 99.99 whatever percent of the data and I was like, oh, yeah, it's all coming together
1551.16s - 1556.00s |  But I was still like if you do a lot of this research you always try to like hold off on being too excited because
1556.00s - 1558.68s |  Your dreams have been crushed too many times by it not working out
1558.68s - 1562.68s |  So I was like, you know, maybe maybe somebody actually bought it reused it and then they drilled the hole in it
1562.68s - 1565.96s |  So like, you know, maybe it's not actually the real thing, but it was
1566.96s - 1569.68s |  These are the wallpapers from it being used in the factory line
1569.68s - 1574.28s |  It was used to do Q&A ostensibly for actually a couple things that look like but for iPad QA it looked like
1575.04s - 1581.60s |  Came along with a bunch of really tasty internal Apple software for sort of interfacing with their prototype devices and doing QA on the line
1581.92s - 1586.60s |  all of that good stuff right came with internal credentials for the Foxconn factory and
1587.04s - 1591.60s |  a bunch of other cool stuff a lot of cool Apple tooling to with a bunch of like you could tell engineers came up with
1591.60s - 1594.32s |  The name of these tools right like footing whatever so
1596.04s - 1599.36s |  Another funny story about this one is when I gave this one to Apple like the first time
1599.36s - 1603.24s |  There's a lot of miss a lot of communication when it came to the time capsule like back and forth to coordinate it
1603.24s - 1607.76s |  The second time I was like, hey, I've got this random drive from the Foxconn line. I got did this forensics
1607.76s - 1609.20s |  I got all this data. I want to give it back to you
1609.20s - 1613.80s |  They were just like here's a prepaid FedEx envelope. You just drop that shit in the mail get it right to us
1613.80s - 1615.80s |  I was like sweet
1618.57s - 1622.33s |  Great, so we've got some cool PLCs. We kind of show off the problem, right?
1622.37s - 1626.37s |  Let's go into like maybe what are the high level like takeaways of this whole stuff, right?
1628.96s - 1632.88s |  So one thing that's kind of interesting is like this is not like, you know
1632.92s - 1637.12s |  You think like the conventional hacking stories and sort of like, you know cracking code or whatever
1637.12s - 1643.28s |  But this research raises kind of interesting question, which is like have I done anything sort of unethical or wrong here, right?
1643.28s - 1647.08s |  If you talk about the source of a lot of these other prototypes, we're talking about pretty illicit stuff, right?
1647.08s - 1651.64s |  They're paying somebody I assume to take it off the factory line or whatever it is, but we're not we're not doing that
1651.64s - 1653.64s |  We're just literally looking for public listings
1653.76s - 1658.76s |  We come to the table with a little bit more information about what is in those like listings and what it actually means, right?
1658.76s - 1661.16s |  And ostensibly they would have been sold anyways
1661.20s - 1666.08s |  But we just instead buy it in the first place, right? So have we like really done anything wrong, you know
1666.08s - 1668.12s |  I mean, so it's just a very interesting question there
1669.52s - 1672.96s |  I think another potentially interesting takeaway here is you know
1672.96s - 1679.36s |  You're probably more familiar when we have like very standardized full disk encryption and mobile device management for like the standard set of things
1679.52s - 1682.80s |  So you get your work laptop things are pretty well understood there
1682.80s - 1686.56s |  You have your like work phone and DM solutions that these solutions are pretty straightforward
1686.56s - 1691.08s |  But then when you get to the more custom hardware side, you don't necessarily have that level of maturity
1691.08s - 1692.44s |  It's like the time capsule, right?
1692.44s - 1696.76s |  It's like is there a clear suite that can that can actually do ensure that these things work the way that you expect?
1696.76s - 1702.32s |  And so I would assume that this probably extends to any other type of custom hardware where you don't have this very standardized
1702.40s - 1704.40s |  format of software to protect this
1705.68s - 1710.04s |  This one is probably obvious for anybody's done anything related to hardware or who lives through COVID
1710.76s - 1716.88s |  Supply chains are incredibly difficult, right? You've got multiple sides of the globe on different time zones doing iterations on hardware
1716.88s - 1719.80s |  It's not like software where you're halfway through and you're like, ah
1719.80s - 1721.44s |  Let's just can all this and rewrite it
1721.44s - 1724.32s |  You're kind of your parameters are slowly narrowing and you've got to like
1724.68s - 1729.32s |  Throughout all this time make sure none of them leak out and everything's securely destroyed and all this stuff, right?
1729.32s - 1731.04s |  You got to keep everybody super tight-lipped
1731.04s - 1735.72s |  So it's very challenging to do this right across many countries and to deliver this final product
1737.32s - 1742.44s |  Another interesting point as you noted with one of these examples is leaks very much point to sources
1742.84s - 1746.52s |  So you mentioned like we found listings where these things sort of bubbled up, right?
1746.52s - 1750.52s |  And we can then take those to go to the sellers to figure out like what's the real story here?
1750.52s - 1755.36s |  Where did this shit actually come from and we can start to understand a full picture of like where is my stuff breaking apart?
1755.36s - 1756.88s |  How is this stuff leaking out, right?
1756.88s - 1761.60s |  So it becomes a very good opportunity to sort of identify these sources and ultimately close them if you're the company
1761.60s - 1769.08s |  I think another really interesting piece of this too is I would say that like e-waste is a particularly interesting point, right?
1769.08s - 1773.28s |  So if you have your stuff going to e-waste a lot of people sort of assume like oh, it's gonna be destroyed
1773.44s - 1778.56s |  But then you get people who are at the e-waste side who are like, why are they throwing away 50 good iPhones?
1778.56s - 1781.92s |  Like this could be resold right now. Like it's very strange, right?
1781.92s - 1785.92s |  And so a lot of these I think leaked out from sort of e-waste recycling centers, right?
1785.92s - 1787.52s |  And this is what causes these problems
1787.52s - 1791.20s |  So you got to make sure that like your stuff is actually being destroyed and not being you know
1791.20s - 1798.44s |  Essentially diverted and potentially resold. I just want to give a quick quick special. Thanks to Apple demo
1798.44s - 1804.12s |  He does a bunch of iPhone prototype stuff check out his YouTube for helping me serve the initial research and understanding of this space
1804.56s - 1807.04s |  And I'd like to thank all of you for coming to this


url: https://www.youtube.com/watch?v=QCoRhK7u9qw
title: Title: DEF CON 32 - DEF CON Unplugged: Cocktails & Cyber with Jeff & Jen - Jen Easterly, Jeff Moss
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=QCoRhK7u9qw",
  "title": "Title: DEF CON 32 - DEF CON Unplugged: Cocktails & Cyber with Jeff & Jen - Jen Easterly, Jeff Moss",
  "description": "REAL WORLD DEFCON: Where hackers stop being polite and start getting real. The Dark Tangent and Jen Easterly sit down for an Ask Me Anything.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2893,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.62s - 8.55s | This text was transcribed using whisper model: large-v2

 I'm transitioning from my central nervous system stimulant.
8.55s - 15.75s |  Jen's going to flex her skills in mixology and create some central nervous system depressants
15.75s - 19.47s |  that we're then going to consume and have a great conversation.
19.47s - 25.51s |  And then we are definitely going to open it up to ask Jen anything or ask me anything.
25.51s - 28.95s |  We'll go to an AMA style format after we talk for a little bit.
28.95s - 34.43s |  So we've got a microphone here.
34.43s - 37.79s |  Please ask a question.
37.79s - 40.09s |  This is not a statement in the form of a question.
40.09s - 41.79s |  It's a question.
41.79s - 44.43s |  And then we'll discuss the question.
44.43s - 47.89s |  So just please use this microphone if you can.
47.89s - 50.39s |  It's harder to see if there's another one.
50.39s - 51.51s |  Great.
51.51s - 52.55s |  So that's what we're going to do.
52.55s - 53.55s |  That's the plan.
53.55s - 55.55s |  Thanks for coming.
55.55s - 61.95s |  Jen's a multiple time DEF CON veteran.
61.95s - 62.95s |  And it's fascinating.
62.95s - 71.07s |  I always love, so disclaimer, I'm, Jen's my director.
71.07s - 74.11s |  I'm on the advisory council she set up at CISA.
74.11s - 78.27s |  So normally when I interact with Jen, it's much more formal.
78.27s - 82.95s |  We're delivering reports, technical advisory recommendations to her.
82.95s - 88.95s |  Her staff, CISA, determines whether to accept our recommendations, reject them, modify them.
88.95s - 96.67s |  And so outside of that dynamic, it's fantastic for her to make a drink for me.
96.67s - 97.67s |  So thank you.
97.67s - 98.67s |  Do you want me to?
98.67s - 101.24s |  Yeah.
101.24s - 104.64s |  Why don't you tell us what you're doing?
104.64s - 107.34s |  Oh.
107.34s - 108.34s |  Yeah.
108.34s - 109.34s |  What's going on here?
109.34s - 110.34s |  So, hey, everybody.
110.34s - 111.34s |  My name's Jen.
112.06s - 117.66s |  So this is the, it should have been the fourth time, but that 2021 was a COVID year.
117.66s - 121.74s |  This is my third time at DEF CON.
121.74s - 125.22s |  And this is my favorite con of the year.
125.22s - 126.22s |  My favorite thing to do.
126.22s - 129.82s |  I look forward to it every single year.
129.82s - 135.94s |  And last year, I was not, it was my second time, but I was with two newbies.
135.94s - 138.06s |  And so they had to do shots.
138.06s - 139.62s |  So I, you know, in solidarity.
139.62s - 142.82s |  But I said, this year, like, Jeff, what do you want to do?
142.82s - 143.82s |  And he's like, well, I don't know.
143.82s - 144.82s |  What do you want to do?
144.82s - 150.74s |  And I said, well, let's just, let's just have some cocktails and cyber talk and hear from
150.74s - 151.74s |  my friends.
151.74s - 152.74s |  Yeah.
152.74s - 153.74s |  See where it goes.
153.74s - 154.74s |  Yeah.
154.74s - 163.42s |  So before I took this job, I chatted with Jeff and I said, hey, Jeff, what's your best
163.42s - 168.06s |  advice to be successful as the director of CISA?
168.14s - 169.94s |  And it was great advice.
169.94s - 180.10s |  It wasn't like shockingly, you know, surprising advice, but it has really stayed with me since
180.10s - 181.10s |  I took this job.
181.10s - 187.10s |  And it was like, be a part of the community, you know, really like be a part of the community
187.10s - 188.90s |  because it's an amazing community.
188.90s - 192.66s |  And you know, CISA is not an intel agency.
192.66s - 194.30s |  We're not a law enforcement agency.
194.30s - 196.26s |  We're not a regulator.
196.26s - 202.06s |  Everything we do is by, with and through partners and our success is predicated on our ability
202.06s - 207.82s |  to catalyze trusted partnerships, whether it's with industry, with the research community,
207.82s - 211.42s |  with the hacker community, across the federal government, with the state and local community,
211.42s - 213.06s |  with election officials.
213.06s - 219.58s |  It's all about how do you build trusted partnerships and people don't trust institutions.
219.58s - 221.34s |  They trust people.
221.34s - 228.46s |  And so I like to get out and spend time with all of our partners so that they understand
228.46s - 234.14s |  who I am, who my team is, what we do, the value that we bring, and how we can help support
234.14s - 238.26s |  others and serve others and ultimately help the American people.
238.26s - 239.26s |  So I'm excited.
239.26s - 245.66s |  We're going to chat a little bit, but we really did just want to open this up as an ask us
245.66s - 248.42s |  anything, AUA, I guess.
248.42s - 254.54s |  You can ask all the hard questions to Jeff and I'll take all the easy ones, but I do
254.54s - 260.78s |  want to thank my friend Jeff, who has been a fabulous partner throughout my three plus
260.78s - 266.54s |  years in this job and for your service as well as the head of our technical advisory
266.54s - 271.22s |  council and really important work throughout the last three years.
271.22s - 273.06s |  So super grateful for that.
273.50s - 281.06s |  You're one of the first people that actually listened to my advice and really actually
281.06s - 286.10s |  visibly did some of the hard work to actually engage.
286.10s - 290.06s |  Building community is not easy and it sometimes fails.
290.06s - 295.74s |  And so I appreciate you calling that out because CISA's got some interesting things.
295.74s - 298.82s |  You can convene people.
298.82s - 301.06s |  You can try to regulate people.
301.06s - 302.06s |  You can-
302.06s - 303.06s |  Nope.
303.06s - 309.30s |  Well, in some critical infrastructure areas, you could, you know, not chemical.
309.30s - 313.14s |  Well, no, we lost those authorities, unfortunately.
313.14s - 314.98s |  They lost the authorities.
314.98s - 315.98s |  Yeah.
315.98s - 320.70s |  We're going to have to drink to that.
320.70s - 327.78s |  And so there's essentially the areas where you can be a convener or you can be a coordinator,
327.78s - 328.78s |  right?
328.78s - 330.82s |  A lot of sector coordination.
330.82s - 335.58s |  And so knowing what hat you're wearing and when and which is appropriate.
335.58s - 339.66s |  And I really love that you used that phrase, people trust individuals, not institutions.
339.66s - 345.58s |  That was one of the first lessons I learned at ICANN when I was back there was that nobody
345.58s - 348.42s |  is going to- everything's built on individual trust.
348.42s - 351.74s |  They're not going to reveal the secret to the random organization.
351.74s - 355.30s |  They're going to reveal it to their friend that they trust in the organization, which
355.30s - 358.94s |  then means you have to have people that are willing to put in the time to travel and not
358.94s - 360.72s |  turn over every year.
360.72s - 365.40s |  And so one of my pieces of advice was, Jen, is like, find some non-political appointees.
365.40s - 369.60s |  People will be there for a long time, some full-time employees, and they will be your
369.60s - 374.28s |  like avatars out in the community that people can build trust with and make sure you're
374.28s - 378.76s |  committing enough budget that they can show up in enough places over time that those relationships
378.76s - 381.44s |  build and you have a way of mentoring the next.
381.44s - 383.68s |  And she did it, which is awesome.
383.68s - 386.00s |  Okay, we're not doing an orange.
386.00s - 387.00s |  What the orange one?
387.00s - 388.00s |  Not the orange one.
388.00s - 389.00s |  Oh, okay.
389.00s - 390.00s |  Let's start out.
390.28s - 392.28s |  Okay, so tell us what you've done here.
392.28s - 394.28s |  Okay, we had a little bitters.
394.28s - 397.40s |  We had a little sugar cube that's partially melted.
397.40s - 400.12s |  We have a little maker's mark.
400.12s - 403.96s |  Didn't have a lot of success with the orange, but I do have some maraschino cherries.
403.96s - 405.84s |  Yeah, yeah.
405.84s - 406.84s |  It's my favorite.
406.84s - 409.36s |  So I don't see the cherry in here.
409.36s - 410.36s |  I didn't- okay.
410.36s - 411.36s |  All right.
411.36s - 412.36s |  All right.
412.36s - 413.36s |  I want the full meal deal.
413.36s - 414.36s |  All right, all right.
414.36s - 415.36s |  If it's on the table.
415.36s - 416.36s |  Okay.
416.36s - 417.36s |  All right.
417.36s - 418.36s |  All right.
418.36s - 419.36s |  As long as you're having one, right?
419.72s - 420.72s |  Yeah.
420.72s - 421.72s |  Good.
421.72s - 423.72s |  We have to have a parity, you know, a public-private partnership here.
423.72s - 424.72s |  Yeah, exactly.
424.72s - 425.72s |  Exactly.
425.72s - 426.72s |  All right.
426.72s - 427.72s |  There you go, brother.
427.72s - 428.72s |  Excellent.
428.72s - 431.19s |  Thank you.
431.19s - 434.19s |  I don't want to know how many government regulations we're violating.
434.19s - 435.19s |  None.
435.19s - 436.19s |  Right now.
436.19s - 437.19s |  I've had all of this approved.
437.19s - 441.19s |  You've had it all approved by the OGE lawyer.
441.19s - 442.19s |  Yes.
442.19s - 443.19s |  Okay.
443.19s - 452.08s |  So while you're mixing, maybe you can be thinking about like over the last three years now that
452.64s - 457.64s |  you've been building this community, maybe tell us what you think of when you see a community
457.64s - 463.64s |  like DEF CON and we want to get engaged, people want to help, they don't know how to help,
463.64s - 467.76s |  they're not very many good on-ramps to helping, and they don't even know if they have the
467.76s - 469.68s |  right skills that are needed.
469.68s - 472.68s |  And then on the other hand, you've got government doing the same thing.
472.68s - 477.04s |  They see this pool of talented people, but they don't necessarily know how to approach
477.04s - 478.04s |  them.
478.04s - 479.76s |  They don't know what to ask of them.
480.48s - 487.16s |  How have you puzzled through that, or is it like an ongoing mix and match, or I'll use
487.16s - 492.28s |  your term, Rubik's cube solve, trying to get everything on the right color on the right
492.28s - 493.28s |  side?
493.28s - 494.28s |  Yeah.
494.28s - 501.88s |  So we have tried really, really hard to be an agency that is not a lumbering government
501.88s - 502.88s |  bureaucracy.
502.88s - 503.88s |  Right?
503.88s - 511.20s |  And yeah, I mean, again, like I was in the government for 27 years.
511.20s - 513.08s |  I was in the army for most of that time.
513.08s - 518.24s |  I was the National Security Agency, I was in the White House a couple times doing policy.
518.24s - 521.44s |  And then I left to go to the private sector.
521.44s - 524.80s |  I was at Morgan Stanley for four and a half years.
524.80s - 529.84s |  And it was like a very liberating feel, frankly, to leave the federal government and go to
529.84s - 531.88s |  the private sector.
531.88s - 539.96s |  And when I looked back from the private sector to the federal government, I'm like, oh, oh,
539.96s - 540.96s |  that's really hard to understand.
540.96s - 542.20s |  Like a reverse culture shock?
542.20s - 543.20s |  Yeah, it was.
543.20s - 544.28s |  It really was.
544.28s - 550.88s |  And when I came back, I was very determined to ensure that this agency, which was then
550.88s - 559.36s |  the newest agency in the federal government, that we were going to add value, not friction.
559.36s - 564.96s |  That we were going to be accessible, that we were going to be transparent, that we were
564.96s - 567.40s |  going to be responsive.
567.40s - 572.76s |  And it sounds like obvious, but it's not that, you know, it's not an easy thing.
572.76s - 577.20s |  And so we really just wanted to build a very different culture from your typical government
577.20s - 578.52s |  agency.
578.52s - 582.20s |  And a lot of that is being accessible to the community.
582.20s - 586.92s |  So that's sort of the first thing, because, you know, if you only show up once a year,
586.92s - 591.28s |  if you only, you know, I mean, people know you're not authentic about it.
591.28s - 594.28s |  And so you have to be part of the community.
594.28s - 596.56s |  And when you're part of the community, you're going to take some lumps.
596.56s - 597.56s |  Yeah.
597.56s - 599.84s |  Well, dude, I've taken a lot of lumps in my life.
599.84s - 603.28s |  So that's not it's not a problem for me.
603.28s - 606.00s |  But you know, I do treat feedback as a gift.
606.00s - 607.00s |  I really do.
607.00s - 611.80s |  Like, I don't really I don't really appreciate people who are assholes.
611.80s - 612.80s |  I get it.
612.80s - 618.60s |  You know, but if but I really appreciate Frank, you know, positive, critical feedback.
618.60s - 622.92s |  That's like given a constructive, constructive feedback given in good faith.
622.92s - 623.92s |  Yeah.
623.92s - 624.92s |  Good faith.
624.92s - 625.92s |  Feedback is always.
625.92s - 626.92s |  Yeah.
626.92s - 628.48s |  I mean, you know, if you want to be a dick, that's fine.
628.48s - 630.36s |  But like, I don't really have time for you.
630.36s - 631.36s |  Right.
631.36s - 632.36s |  Right.
632.36s - 637.60s |  And so if as long as it's coming from a good place, half the questions, they just don't
637.60s - 639.56s |  know it's already been answered.
639.56s - 642.04s |  So it's just a lot of trying to orient people.
642.48s - 643.48s |  Totally.
643.48s - 644.76s |  So then.
644.76s - 648.76s |  So maybe in the last since you first started showing up at DEF CON, have there been good
648.76s - 653.80s |  examples or any exchanges of things that worked out the way you thought or didn't work out
653.80s - 655.72s |  like that's enough time to.
655.72s - 656.72s |  Yeah.
656.72s - 659.32s |  I mean, I will tell you, it's funny.
659.32s - 664.56s |  The first experience I had with DEF CON, I wasn't actually here.
664.56s - 669.12s |  It was it was when I was working at the National Security Agency in 2013.
669.12s - 670.12s |  Oh, do tell.
670.12s - 671.12s |  Remember?
671.88s - 677.52s |  And it was I was working counterterrorism and it was the year of Snowden.
677.52s - 682.48s |  And my boss at the time, Keith Alexander, wanted to come to Vegas.
682.48s - 686.64s |  I think you probably chatted with him about that.
686.64s - 691.92s |  And I didn't come with them then, but I was one of the staffers who sort of helped help
691.92s - 694.40s |  prepare remarks for that.
694.40s - 699.60s |  And I think the you know, I think the vibe is very, very different from those days.
699.60s - 700.60s |  Right.
701.08s - 702.76s |  I hate I hate the term Fed.
702.76s - 704.12s |  I just have to say that.
704.12s - 707.28s |  But it's like the federal is.
707.28s - 710.16s |  But I I think it's come a long way.
710.16s - 713.56s |  And I mean, people have been so gracious, so kind.
713.56s - 714.80s |  So it's been fantastic.
714.80s - 720.84s |  That's why I love this community, because everybody here, I think, shares the desire
720.84s - 727.04s |  to actually do good, to fix things, to help.
727.04s - 730.72s |  And that's what we need, because frankly, our job is to protect and defend the critical
730.72s - 734.56s |  infrastructure that Americans rely on every hour of every day.
734.56s - 739.96s |  And the vast majority of that infrastructure is owned and operated by other people.
739.96s - 747.32s |  And so if we do not catalyze a community approach to driving down risk to our technology ecosystem,
747.32s - 748.80s |  we won't be successful.
748.80s - 749.80s |  Right.
749.80s - 750.80s |  Yeah.
750.80s - 755.72s |  Do you think that's maybe an advantage in the in the U.S. model?
755.72s - 760.68s |  I mean, not every country has so much critical infrastructure owned and operated by a private
760.68s - 762.60s |  entity.
762.60s - 768.76s |  And so maybe it's a secret benefit I hadn't even really considered.
768.76s - 773.36s |  Because as long as you can orient the owner operators to do the right thing, they're not
773.36s - 777.16s |  just waiting in a passive mode for top down command and control, telling them to patch
777.16s - 778.68s |  this or do that.
778.68s - 779.68s |  Right.
779.68s - 782.12s |  There's enough independent autonomy or maybe diversity.
782.12s - 785.64s |  Well, there's definitely diversity.
786.56s - 788.32s |  I mean, you could say diversity equals resilience.
788.32s - 793.56s |  But I gave a talk yesterday at Black Hat, and, you know, since I've been in this job
793.56s - 797.68s |  now three plus years, we're trying to figure out, you know, when I came in, ransomware
797.68s - 798.92s |  is a problem.
798.92s - 802.72s |  Three plus years later, ransomware is still a big problem.
802.72s - 808.80s |  You know, I think the really important progress that we have made with the community, I think
808.80s - 814.88s |  we have been able to catalyze real collaboration between the federal government, state and
814.88s - 821.80s |  local industry, hacker community, academia, I mean, all kinds of partners.
821.80s - 824.60s |  We've been able to build good collaboration.
824.60s - 833.64s |  Second, I think CEOs and boards and business leaders are increasingly seeing cyber risk
833.64s - 834.92s |  as a core business risk.
834.92s - 836.32s |  I think that's really good.
836.32s - 841.56s |  I think there is greater awareness of the importance of basic cyber hygiene.
841.56s - 843.96s |  You know, we have the Secure Our World campaign.
844.04s - 845.24s |  Those are the four things to do.
845.24s - 848.28s |  And so, you know, we've been working on that.
848.28s - 854.80s |  I love efforts like Craig Newmark's Cyber Civil Defense, really bringing together the
854.80s - 859.84s |  community and we help with some of the cyber clinics, and that's really great.
859.84s - 866.80s |  But I think at the end of the day, unless we stop talking about the villains, right,
866.80s - 871.56s |  and the victims and start demanding more of the vendors, I don't think we're going to
871.56s - 877.64s |  get into a place where we're going to be able to drive down risk as much as we really
877.64s - 878.64s |  want to.
878.64s - 881.80s |  I mean, at the end of the day, we have, you know, Jeff and I were talking earlier, like
881.80s - 887.36s |  we should stop calling things vulnerabilities because it really diffuses responsibility.
887.36s - 895.96s |  We should start calling them product defects because that names it much more clearly, right?
895.96s - 897.44s |  And that's what they are.
897.44s - 902.12s |  And at the end of the day, it also highlights how important it is for tech manufacturers
902.12s - 910.24s |  to design and develop and test and deploy software specifically focused on driving down
910.24s - 913.84s |  dramatically the number of exploitable defects.
913.84s - 917.72s |  And when you use the common language that's used in other industries, everybody else kind
917.72s - 918.72s |  of gets it.
918.72s - 919.72s |  Oh, a defect.
919.72s - 920.72s |  Oh, we track defects.
920.72s - 921.72s |  We study defects.
921.72s - 922.72s |  We do these things.
923.00s - 927.92s |  It goes away from being mysterious so we can't protect ourselves.
927.92s - 928.92s |  It's a vulnerability.
928.92s - 929.92s |  Yeah.
929.92s - 931.32s |  I mean, a hundred percent.
931.32s - 936.24s |  We should be learning from what other industries possess that like inexplicably.
936.24s - 937.24s |  Oh, wait.
937.24s - 939.64s |  Did you sip out of your glass without clinking?
939.64s - 940.64s |  I did.
940.64s - 941.64s |  I was testing it.
941.64s - 942.64s |  Oh, okay.
942.64s - 943.64s |  I was testing it.
943.64s - 944.64s |  Okay.
944.64s - 945.64s |  That was an alpha test.
945.64s - 946.64s |  It's drinkable.
946.64s - 947.64s |  We're going to go to deployment.
947.64s - 948.64s |  Okay.
948.64s - 949.64s |  We're deploying.
949.64s - 950.64s |  Push to production.
950.64s - 955.26s |  Okay.
955.26s - 956.26s |  Here we go.
957.18s - 958.18s |  Sweet.
958.18s - 959.18s |  Yeah.
959.18s - 960.18s |  I'm sorry.
960.18s - 963.18s |  I interrupted your flow there.
963.18s - 965.18s |  I totally forgot what I was saying.
965.18s - 966.18s |  So.
966.18s - 967.18s |  Oh, you know what I was saying?
967.18s - 971.86s |  I think we can learn a lot from what other industries possess that the world of software
971.86s - 972.86s |  doesn't.
972.86s - 973.86s |  Right?
973.86s - 978.06s |  I mean, the vast majority of other industries, they do track defects and incidents that cause
978.06s - 982.14s |  harm so that you can specifically focus on reducing risk.
982.14s - 984.78s |  The risk to driving on the highway, the risk to getting on an airplane.
985.30s - 990.38s |  I mean, other industries are frankly obsessed with continuous improvement.
990.38s - 995.10s |  The thing that I find so mind boggling about this, as an outsider, not an engineer, is
995.10s - 1001.62s |  that think about all the safety engineering done around airplanes, space, water, any kind
1001.62s - 1004.14s |  of large civil engineering infrastructure.
1004.14s - 1006.14s |  They're held to these ridiculous standards.
1006.14s - 1008.34s |  Everybody is certified, whatever.
1008.34s - 1012.62s |  And then you take that and you're like, okay, that's what we do when it's like engineering
1012.66s - 1014.86s |  versus nature.
1014.86s - 1015.86s |  We have all these.
1015.86s - 1019.98s |  Now it's engineering versus nature plus adversaries.
1019.98s - 1025.10s |  So what we'll do is we're going to do less than we would have done if it was engineering
1025.10s - 1026.18s |  versus nature.
1026.18s - 1027.46s |  It doesn't make any sense.
1027.46s - 1028.46s |  No.
1028.46s - 1029.46s |  I'm with you, brother.
1029.46s - 1030.46s |  Is anyone here from MITRE?
1030.46s - 1031.46s |  We've got MITRE people.
1031.46s - 1034.10s |  I was talking about this yesterday.
1034.10s - 1041.30s |  So MITRE in 2007 published this white paper called Unforgivable Vulnerabilities.
1041.30s - 1046.70s |  And it laid out criteria for classes of defect that would be considered unforgivable for
1046.70s - 1049.54s |  being both easily found and easily exploited.
1049.54s - 1055.26s |  So products that didn't keep security, have security in mind at all.
1055.26s - 1059.76s |  And folks in here can probably guess what was on the list, but it was memory safety
1059.76s - 1065.66s |  violations and coding weaknesses leading to cross-site scripting, SQL injection, and directory
1065.66s - 1067.26s |  traversal.
1067.26s - 1075.14s |  So then 2023, 16 years later, MITRE publishes another paper called Stubborn Weaknesses.
1075.14s - 1077.38s |  And what do you think was at the top of the list?
1077.38s - 1078.38s |  Yeah.
1078.38s - 1084.02s |  Memory safety violations and coding weaknesses leading to cross-site scripting, SQL injection,
1084.02s - 1085.02s |  and directory traversal.
1085.02s - 1087.50s |  They just named it version two of their original document.
1087.50s - 1088.50s |  Yeah.
1088.50s - 1092.82s |  I mean, they weren't as egregious as the ones in 2007, but many of them were.
1092.82s - 1095.70s |  And so again, like this has to be a community thing.
1095.70s - 1100.62s |  We all have to play a role, both from the supply side, but as well as the demand side.
1100.62s - 1105.98s |  I mean, all of us need to be demanding safer and more secure products and realizing that
1105.98s - 1107.22s |  we have purchasing power.
1107.22s - 1108.22s |  Right.
1108.22s - 1109.22s |  So, right.
1109.22s - 1111.34s |  So I think there's...
1111.34s - 1112.34s |  If you just...
1112.34s - 1113.34s |  You're not going to drink your drink.
1113.34s - 1114.34s |  You don't like your drink.
1114.34s - 1115.34s |  I'm drinking the drink.
1115.34s - 1116.34s |  I'm drinking the drink.
1116.34s - 1117.34s |  No, I'm not forcing you.
1117.34s - 1118.34s |  Look how much I've got.
1118.34s - 1119.34s |  Let's compare our drinks.
1119.34s - 1122.95s |  I drank enough.
1122.95s - 1129.63s |  So I think part of it is you have to recognize who's most responsible in any given situation.
1129.63s - 1134.23s |  If it's a coding error, the people closest to the project probably bear the greatest
1134.23s - 1135.87s |  responsibility in fixing it.
1135.87s - 1136.87s |  Right.
1136.87s - 1140.55s |  They're near the lever, the steering wheel, whatever, where they can make the change.
1140.55s - 1144.83s |  Every step away from that, there's fewer and fewer things you can do.
1144.83s - 1147.99s |  Like, oh no, now I've got to wrap a firewall around it.
1147.99s - 1150.83s |  Now I have to wrap a monitoring system around it.
1150.91s - 1154.27s |  But the closer you get to fixing the core problem, you maybe don't have to deploy all
1154.27s - 1157.51s |  those other mitigations.
1157.51s - 1161.27s |  So my whole thing is the manufacturer or the person closest to the problem has the most
1161.27s - 1168.59s |  responsibility, comma, we should ask for better products, comma, the government should regulate
1168.59s - 1174.87s |  better labeling, better disclosures, better help inform the public debate, comma, we should
1174.87s - 1178.07s |  demand better of our partner nations.
1178.07s - 1183.35s |  There's a thing at each step, and no one trumps the other, but, you know.
1183.35s - 1185.47s |  Yeah, I mean, it's a community thing.
1185.47s - 1191.15s |  One of the things that we are having discussions around, or it's a software liability regime.
1191.15s - 1196.31s |  And so one that has an articulable standard of care, but also safe harbor provisions for
1196.31s - 1201.35s |  vendors that do innovate responsibly using secure development processes.
1201.35s - 1206.79s |  So the liability stuff, right, we've been complaining about that forever.
1206.79s - 1210.59s |  But there's so many, right, there's so many ways you could do liability.
1210.59s - 1214.75s |  You could say, you're an open source software project, your source is free.
1214.75s - 1218.39s |  No liability for you, because you can self protect.
1218.39s - 1223.03s |  Oh, you're a closed commercial product, and you've end of lifed your product.
1223.03s - 1225.79s |  And it's, you don't ever plan to do anything with it.
1225.79s - 1226.79s |  You still have liability.
1226.79s - 1230.83s |  But if you open source it, no liability, you know, there's so many nuances and ways to
1230.83s - 1231.83s |  approach it.
1231.83s - 1236.47s |  And I feel like the liability discussion is always like, all or nothing.
1237.15s - 1239.79s |  I'm saying that's like one of the levers to pull, right?
1239.79s - 1245.99s |  I mean, if you, if you just think about, if two thirds of software vulnerabilities are
1245.99s - 1248.47s |  memory safety, right?
1248.47s - 1254.83s |  Memory safety, then there is a lot that can be done across the ecosystem, quite frankly.
1254.83s - 1259.91s |  But you know, the yes, the technology vendor plays a significant role, but also, you know,
1259.91s - 1261.31s |  higher education.
1261.31s - 1264.03s |  That's why we're having discussions with that, right?
1264.03s - 1265.03s |  Right.
1265.07s - 1268.59s |  Yeah, I think there's, and it's interesting, because when I put on my government thinking
1268.59s - 1273.75s |  hat, you look at a problem, and you're like, okay, is this a problem that's uniquely a
1273.75s - 1278.67s |  governmental question, a tragedy, the commons issue, there's no market force, the incentive
1278.67s - 1281.79s |  models don't work to fix it.
1281.79s - 1286.75s |  So in that case, traditionally, that's why we form governments to help us in these areas
1286.75s - 1289.71s |  where normal forces don't work.
1289.71s - 1292.71s |  And then in other areas, you're like, oh, yeah, it totally responds to market forces,
1292.71s - 1294.91s |  it responds to pricing or whatever.
1294.91s - 1298.63s |  Yeah, market forces aren't working in this market force aren't working.
1298.63s - 1305.87s |  And so it's funny, because like, when I started in professionally in this field in like 98,
1305.87s - 1309.79s |  we were like, okay, we're gonna run software vulnerability scanning tools, and we're going
1309.79s - 1314.03s |  to release scores against products.
1314.03s - 1319.07s |  This will be like an 8.2 on the 1999 score system or whatever.
1319.07s - 1321.95s |  And consumers will make informed decisions.
1321.95s - 1325.39s |  You will all make informed decisions because you'll want to buy the thing with a higher
1325.39s - 1326.39s |  score.
1326.39s - 1332.47s |  Oh, well, the software shrink wrap license prevents that.
1332.47s - 1336.27s |  Like, oh, why would you prevent people testing your software?
1336.27s - 1339.27s |  That was my first inkling like something is very wrong here.
1339.27s - 1343.71s |  But have you looked at the standard contract language for software?
1343.71s - 1346.75s |  You bear the entire risk of this product.
1346.75s - 1348.35s |  And it's like part of the issue.
1348.35s - 1354.43s |  It's religion and software where there's no liability.
1354.43s - 1357.15s |  Every other industry in the world has liability.
1357.15s - 1358.15s |  Death and taxes.
1358.15s - 1359.15s |  Yeah, it's crazy.
1359.15s - 1363.47s |  Okay, so okay, so we're not going to get it with this.
1363.47s - 1365.23s |  The insurance industry.
1365.23s - 1370.27s |  So now we're into the early 2000s, the insurance industry will come along, and they will mandate
1370.27s - 1375.91s |  rates and better inform and then companies want to save money.
1375.91s - 1378.07s |  Then that didn't happen.
1378.07s - 1379.99s |  And now here we are.
1379.99s - 1380.99s |  Governments looking at their tool belt.
1380.99s - 1381.99s |  They're like, what do we got?
1381.99s - 1382.99s |  What do we got?
1382.99s - 1383.99s |  Okay.
1383.99s - 1384.99s |  Industry didn't work.
1384.99s - 1386.55s |  Self-regulation didn't work.
1386.55s - 1387.55s |  Insurance didn't work.
1387.55s - 1388.55s |  Oh, no.
1388.55s - 1390.39s |  I only have regulation left.
1390.39s - 1392.59s |  Like we're running out of tools.
1392.59s - 1397.51s |  And it's frustrating, but I know exactly how we got here.
1397.51s - 1401.75s |  You know, this is not a surprise that we're now at the point of talking about liability.
1401.75s - 1403.43s |  We saw this coming for decades.
1403.43s - 1408.95s |  I love to quote Dan Kaminsky on this, who said like, you know, security was never a
1408.95s - 1412.83s |  consideration when the internet was invented.
1412.83s - 1416.07s |  The internet was invented to move pictures of cats.
1416.07s - 1418.19s |  It's very good at that.
1418.19s - 1422.31s |  But I do think, so at the end of the day, we are a voluntary agency, but, you know,
1422.31s - 1428.09s |  we started out at RSA, we have this secure by design pledge, where companies are signing
1428.09s - 1433.97s |  up to it, committing to make material progress in seven key areas, you know, increasing
1433.97s - 1439.89s |  use of MFA, decreasing use of default password, eliminating whole classes of vulnerabilities.
1439.89s - 1446.09s |  And we had 68 vendors that signed at RSA, three months later, we're nearly at 200.
1446.09s - 1450.45s |  And I think there's virtue in being able to track progress and transparently report on
1450.45s - 1451.45s |  it.
1451.45s - 1455.05s |  Like that's a way, it's not like we're going to give people scores and stuff, and we're
1455.05s - 1456.85s |  going to have a third party do it.
1456.89s - 1458.89s |  So I really think transparency...
1458.89s - 1463.57s |  I like that you have the cycle, because otherwise they just stamp it and then they never...
1463.57s - 1467.89s |  No, I mean, as you say, transparency creates trust.
1467.89s - 1472.25s |  And part of that then will help consumers say, well, did you sign the pledge?
1472.25s - 1475.33s |  How did you do on implementing the pledge?
1475.33s - 1482.33s |  And you know, that will help to build, I think, greater security and resilience into the ecosystem.
1482.33s - 1485.93s |  I think product makers love to differentiate themselves.
1486.01s - 1489.93s |  And so if you give them some ways to differentiate, maybe their marketing team takes it and runs
1489.93s - 1490.93s |  with it.
1490.93s - 1491.93s |  Yeah.
1491.93s - 1496.17s |  And then they maybe respond to you giving them more tools that they can use to differentiate
1496.17s - 1497.17s |  themselves.
1497.17s - 1498.17s |  No, I totally agree.
1498.17s - 1499.65s |  Should we see if anyone has questions for us?
1499.65s - 1500.65s |  Yeah.
1500.65s - 1501.65s |  We're coming down to 20 minutes left.
1501.65s - 1503.17s |  Let's see how this goes.
1503.17s - 1504.17s |  And if you...
1504.17s - 1505.81s |  20 minutes of questions.
1505.81s - 1508.01s |  As you terrify us, we'll just drink.
1508.01s - 1509.01s |  AJA.
1509.01s - 1510.01s |  Ask Jeff.
1510.01s - 1511.01s |  AJJA.
1511.01s - 1512.01s |  Ask Jeff.
1512.01s - 1513.01s |  Okay, go ahead.
1513.01s - 1517.01s |  Do you want to tell us where you're from or anything to give us a little bit of perspective?
1517.01s - 1519.45s |  Oh, wait.
1519.45s - 1520.45s |  Wait.
1520.45s - 1524.73s |  Let's turn on the microphone in the Q&A session area.
1524.73s - 1525.73s |  Try speaking at it again.
1525.73s - 1528.61s |  We'll see if they've turned it up.
1528.61s - 1529.61s |  Number four.
1529.61s - 1530.61s |  Okay.
1530.61s - 1531.61s |  There it is.
1531.61s - 1532.61s |  Yeah.
1532.61s - 1533.61s |  You got to be close to the microphone, though.
1533.61s - 1534.61s |  Oh, yeah.
1534.61s - 1535.61s |  Wait, wait.
1535.61s - 1544.34s |  You got to be closer than that.
1544.34s - 1545.34s |  Okay.
1545.34s - 1546.34s |  Yeah.
1546.50s - 1549.78s |  Well, they say you basically have to eat the microphone for it to work.
1549.78s - 1564.38s |  So yes.
1564.38s - 1574.96s |  My job is done here.
1574.96s - 1639.10s |  Thanks dude.
1639.10s - 1640.10s |  Yeah.
1640.10s - 1641.10s |  No, it's a great question.
1641.10s - 1644.66s |  Thank you for the kind words.
1644.66s - 1649.58s |  Before I answer that, can I give you one of my pet peeves?
1649.58s - 1656.02s |  The names that we call these threat actors drive me frickin' bananas.
1656.02s - 1668.78s |  I mean, you know, Midnight Blizzard, Fancy Bear, Wizard Spider, Nemesis Kitten, The Lazarus
1668.78s - 1671.86s |  Group, Volt Typhoon.
1671.86s - 1673.98s |  That's redonkulous, man.
1673.98s - 1675.62s |  I'm on this campaign.
1675.62s - 1682.81s |  So I want to rename all these things, scrawny nuisance, right?
1682.81s - 1683.81s |  I got more.
1683.81s - 1684.81s |  I got more.
1684.81s - 1692.07s |  Stable Ferret, Weak Weasel, and my favorite, Doofus Dingo.
1692.07s - 1696.55s |  That's what I'm talking about, right?
1696.55s - 1702.55s |  So it's a great question and you know, frankly, this is something that we are super focused
1702.55s - 1706.73s |  on at CISA and it's a threat that's different in kind.
1706.73s - 1713.99s |  For most of my career, we really focused on China as a threat of espionage, data theft,
1713.99s - 1719.99s |  theft, and over the past couple years, we have seen Chinese cyberspace force actors
1719.99s - 1726.11s |  embedding deep within our critical infrastructure, not for espionage, but rather to launch disruptive
1726.11s - 1731.59s |  or destructive attacks in the event of a conflict in Taiwan.
1731.59s - 1738.27s |  So it's a world where a war in Asia will have very real impacts on the lives of Americans.
1738.27s - 1744.87s |  You would see pipelines exploding, pollution of water systems, severing of telecommunications,
1744.87s - 1751.87s |  derailing of transportation nodes, all specifically to incite societal panic and chaos and deter
1751.87s - 1755.83s |  our ability to marshal military might and citizen will.
1755.83s - 1757.39s |  And so it is a very real threat.
1757.39s - 1762.51s |  It's not a theoretical one, because our hunt teams have actually worked with the private
1762.51s - 1770.83s |  sector to identify and eradicate these actors from multiple sectors, water, power, comms,
1770.83s - 1771.83s |  transportation.
1771.83s - 1778.19s |  So really a real threat, and it's why we are making the case to how important resilience
1778.19s - 1780.31s |  is for every single business.
1780.31s - 1783.95s |  But to your point, they are using living off the land techniques.
1783.95s - 1785.95s |  So it's not like malware, right?
1785.95s - 1789.99s |  They're actually using the native processes of the system.
1789.99s - 1794.91s |  And within the compromised infrastructure, they are hard to find.
1794.91s - 1796.63s |  We have fantastic talents.
1796.63s - 1798.75s |  It's a kudos to our threat hunt team.
1798.75s - 1802.07s |  They've actually been able to find and identify them.
1802.07s - 1804.47s |  But once they're in the infrastructure, they're hard to find.
1804.47s - 1809.83s |  But the thing, the secure by design angle is the way that they're getting into the infrastructure
1809.83s - 1813.91s |  is they're using edge devices as a launch point.
1813.91s - 1818.55s |  And those edge devices are actually very easy to compromise.
1818.55s - 1823.95s |  And one of the vendors who we've been working with actually credit to them, because they
1823.95s - 1828.27s |  were the first ones to sign the pledge, is Avanti.
1828.27s - 1832.55s |  But that's an edge device, one of many, that the Chinese are taking advantage of to hop
1832.55s - 1835.03s |  into our critical infrastructure.
1835.03s - 1840.23s |  And so what we did, we actually put out an emergency directive and told all of the federal
1840.23s - 1846.15s |  civilian agencies, you need to pull out this piece of technology, because we cannot guarantee
1846.47s - 1849.63s |  that it does not implicate risk.
1849.63s - 1853.39s |  And frankly, we work with that company.
1853.39s - 1857.83s |  And we realize that it has an issue on reputation and business, but they were really good to
1857.83s - 1858.83s |  work with.
1858.83s - 1859.83s |  They signed the pledge.
1859.83s - 1860.83s |  They're making progress.
1860.83s - 1861.83s |  We're going to track it.
1861.83s - 1864.43s |  But that, at the end of the day, that's the complexity.
1864.43s - 1869.31s |  Yes, there are ways to find these actors if you know what to look for.
1869.31s - 1872.83s |  But also the way that they're getting in, we've made it easy on them, because we're
1872.83s - 1877.71s |  not demanding enough from our technology vendors, and that's what our push for Secure
1877.71s - 1878.71s |  by Design is.
1878.71s - 1883.39s |  Okay, let's go to the next question.
1883.39s - 1926.66s |  You got to get really close in there.
1926.66s - 1927.66s |  Yeah.
1927.66s - 1930.38s |  So your last question, absolutely.
1930.38s - 1935.98s |  We are working across the federal government to ensure that we are eating our own dog food
1935.98s - 1940.94s |  when it comes to Secure by Design, or drinking our own bourbon, as it were, when it comes
1940.94s - 1941.94s |  to Secure by Design.
1942.10s - 1945.50s |  And we work closely with GSA on FedRAMP.
1945.50s - 1949.38s |  But we are absolutely using all of the tools of procurement.
1949.38s - 1955.82s |  Just last week, we put out a Secure by Demand focused software acquisition guide for government
1955.82s - 1957.22s |  enterprise customers.
1957.22s - 1962.74s |  And then we put out something earlier this week, Secure by Demand for software customers.
1962.74s - 1969.18s |  So questions that you can ask of vendors to see how they are prioritizing security.
1969.18s - 1972.38s |  So yes is the answer to your second question.
1972.38s - 1977.26s |  Look, for the first one, I'm the head goalie for cyber.
1977.26s - 1978.86s |  We're the cyber defenders.
1978.86s - 1985.30s |  But we do work very closely with folks like Ambassador Nate Fick, who is the cyber ambassador.
1985.30s - 1990.62s |  We work very closely with NSA, with CyberCom, and with the Federal Bureau of Investigation.
1990.62s - 1997.34s |  And I have to say, I think that we have, as a government, become more cohesive, more coherent,
1997.34s - 2003.50s |  when we are using levers that have not necessarily been used as aggressively before to hold other
2003.50s - 2010.14s |  governments accountable, whether it's through justice or whether it's in diplomatic ways.
2010.14s - 2013.22s |  I get you that there is more to be done.
2013.22s - 2016.06s |  There is always more to be done in this world.
2016.06s - 2023.74s |  But I do think that across the federal government, we have attempted to more forcefully attribute
2023.74s - 2032.26s |  activity and hold partners accountable for being involved in malicious cyber activity.
2032.26s - 2037.26s |  So I've got a question on that.
2037.26s - 2040.90s |  I always like to say internet problems are global problems.
2040.90s - 2049.56s |  And so even when you have different opinions with China on a political issue, there's still
2049.56s - 2051.68s |  a giant manufacturer.
2051.68s - 2056.08s |  If there's a problem in a product or a defective something or other, you still have to talk
2056.08s - 2060.68s |  with China because chances are they're manufacturing the thing, right?
2060.68s - 2067.52s |  So you still need to maintain positive relationships, working relationships with the manufacturers
2067.52s - 2068.84s |  around the entire world.
2068.84s - 2072.84s |  And sometimes those manufacturers are in countries who are having a political disagreement.
2072.84s - 2077.72s |  But you still have to have positive relationships because they're producing the thing, right?
2077.72s - 2079.08s |  So you have to have a sort of a nuance.
2079.60s - 2085.52s |  And I think maybe CISA is in a unique position in that, like you mentioned earlier, you're
2085.52s - 2090.12s |  not intelligence community, you're not military, right?
2090.12s - 2091.40s |  You're civilian.
2091.40s - 2097.68s |  So you can speak from a different perspective that's more civilian than military.
2097.68s - 2098.68s |  Yeah.
2098.68s - 2104.28s |  And, you know, that opportunity has not come up.
2104.28s - 2107.72s |  I think we talked about this as one of the early meetings, like having the head of CISA
2107.88s - 2114.80s |  and the head of China's CERT together, frankly, given some of the things that we have seen
2114.80s - 2121.44s |  them doing in our critical infrastructure, which I don't think that they've owned up
2121.44s - 2122.44s |  to.
2122.44s - 2125.16s |  In fact, they've completely denied it.
2125.16s - 2131.40s |  I think that's really problematic because at the end of the day, these targets are civilian
2131.40s - 2134.16s |  critical infrastructure.
2134.16s - 2139.00s |  And I would be happy to have discussions that were in good faith, where we thought
2139.00s - 2143.56s |  we could make real progress, but I'm not sure we're at that stage right now.
2143.56s - 2176.76s |  OK, let's go to the next gentleman.
2176.76s - 2177.76s |  Take what off the table?
2177.76s - 2189.63s |  Why are we taking it off the table?
2189.63s - 2193.55s |  So if you magically have secured by design and it achieves all of its goals and it's
2193.55s - 2195.95s |  done, what's next in line?
2195.95s - 2200.63s |  But are you...
2200.63s - 2201.63s |  Oh, what's the next...
2201.63s - 2204.98s |  I don't know if I heard that.
2204.98s - 2205.98s |  What is it?
2206.06s - 2209.62s |  So it's basically, if you have secure by design success and Rust and everybody in the world
2209.62s - 2211.90s |  is using Rust, what's next?
2211.90s - 2212.90s |  Yeah.
2212.90s - 2217.74s |  So, you know, I sort of said tongue in cheek yesterday, we want to get to a world where
2217.74s - 2222.74s |  the community works to make products so secure that cybersecurity goes away.
2222.74s - 2227.42s |  I mean, the reason we have the cybersecurity industry is because technology vendors have
2227.42s - 2235.14s |  been able to create flawed, defective, insecure products, or defective for decades, right?
2235.30s - 2240.94s |  Because it's been all about incentives have been speed to market and features, not security.
2240.94s - 2249.02s |  So if we actually achieve secure by design, I mean, I will be like doing the Snoopy dance
2249.02s - 2250.30s |  everywhere, right?
2250.30s - 2256.34s |  Because that will be a world where ransomware is a shocking anomaly and where damaging software
2256.34s - 2259.70s |  vulnerabilities are as infrequent as plane crashes.
2259.70s - 2265.82s |  Now, does that mean that vulnerabilities or defects will go away completely?
2265.82s - 2267.38s |  No, of course not.
2267.38s - 2272.54s |  I fundamentally believe you can dramatically drive down the number of exploitable defects,
2272.54s - 2279.46s |  but there will still be room for the research community, the hacking community.
2279.46s - 2285.46s |  I mean, this community is actually responsible for making us all better, right?
2285.46s - 2289.62s |  We run the coordinated vulnerability disclosure program for the US government.
2289.62s - 2297.54s |  So we work with researchers all the time and we have an enormous respect and admiration
2297.54s - 2302.14s |  for folks and we intermediate between hackers and product owners.
2302.14s - 2307.78s |  And I don't think that will go away completely, but we do want to live in a world where the
2307.78s - 2311.70s |  number of defects in our products is dramatically lowered.
2311.70s - 2316.18s |  I mean, that will be a better world for all of us where we don't have to worry about our
2316.18s - 2320.94s |  parents constantly having to deal with malware and all of this.
2320.94s - 2324.22s |  So there will always be a role for hackers.
2324.22s - 2325.22s |  Yeah.
2325.22s - 2332.10s |  And even if every bit of code in the universe is memory safe, temporally, spatially memory
2332.10s - 2336.66s |  safe, there's always going to be business logic flaws.
2336.66s - 2340.74s |  There's so many other categories, but that's what you want to do, right?
2340.74s - 2341.74s |  You want to push them up the stack.
2341.74s - 2343.34s |  You want the difficulty to become harder.
2343.34s - 2344.98s |  You don't want a mass exploit.
2344.98s - 2349.30s |  We want you to have to spend all the time in the world understanding one business system
2349.30s - 2354.42s |  to exploit some business logic flaw in one thing instead of a single one-off that can
2354.42s - 2356.38s |  devastate an entire landscape.
2356.38s - 2360.34s |  Create massive friction for attackers, for squandering.
2360.34s - 2362.02s |  And you want to make it be more noisy.
2362.02s - 2365.26s |  So when they do do something, it's more visible.
2365.26s - 2388.76s |  And so, okay.
2388.76s - 2397.27s |  Thanks dude.
2397.27s - 2398.87s |  Well thank you.
2398.87s - 2417.58s |  Under twin powers, activate.
2417.58s - 2419.42s |  That AI will unleash, you mean?
2419.42s - 2432.01s |  Threat of AI.
2432.01s - 2433.01s |  Threat of AI.
2433.01s - 2434.01s |  Yeah, I'll tell you.
2434.01s - 2440.69s |  So the interesting thing is, it's really, we might have to drink to the end of CAPTCHA,
2440.69s - 2441.69s |  right?
2441.69s - 2443.65s |  I mean, if AI is that good, right?
2443.65s - 2449.09s |  I mean, so for example, we run this, you caught on to the fact we're really big into community.
2449.09s - 2454.89s |  And so DEF CON, a couple of years ago, we started the mastodon server, DEF CON.social.
2454.93s - 2460.25s |  And before Elon bought Twitter, we were kind of hedging our bets.
2460.25s - 2464.29s |  So we started to build our mastodon server, just in case things go south.
2464.29s - 2467.93s |  Things went south, mastodon.
2467.93s - 2469.97s |  And so people are signing up to the service.
2469.97s - 2472.93s |  And now you put in a CAPTCHA.
2472.93s - 2474.37s |  And so we use H-CAPTCHA.
2474.37s - 2478.77s |  It's the more friendly CAPTCHA, more privacy respecting CAPTCHA.
2478.77s - 2484.25s |  Well then you start paying attention, like, does this CAPTCHA actually prevent spam signups?
2484.25s - 2487.93s |  And it's supposedly a very performant CAPTCHA.
2487.93s - 2497.73s |  And you start reading academic studies, H-CAPTCHA can be bypassed 98% of the time.
2497.73s - 2501.77s |  But the competitors are 99% of the time.
2501.77s - 2503.57s |  Do you know who created CAPTCHA?
2503.57s - 2506.77s |  We're 50% more effective.
2506.77s - 2509.69s |  Do you know where CAPTCHA was created?
2509.69s - 2510.69s |  Do you know who created it?
2510.69s - 2511.69s |  Who?
2511.69s - 2512.69s |  It was at Carnegie Mellon.
2512.69s - 2513.69s |  Carnegie Mellon, yeah.
2514.13s - 2517.53s |  And that's why we did our, well not why, but one of the cool reasons we did our secure
2517.53s - 2518.53s |  by design launch.
2518.53s - 2520.77s |  It was at Carnegie Mellon.
2520.77s - 2525.49s |  So then you're like, okay, well, that's the defeat rate.
2525.49s - 2527.37s |  What's the human rate?
2527.37s - 2533.49s |  Humans can bypass CAPTCHA 78% of the time.
2533.49s - 2539.05s |  So it's like, well, if you don't make a mistake, you're probably a robot.
2539.05s - 2540.49s |  So you have to make some mistakes.
2540.49s - 2542.73s |  And so that's done.
2542.77s - 2546.21s |  I don't see CAPTCHAs, right?
2546.21s - 2551.62s |  And it's sad because, oh no, we're defenseless.
2551.62s - 2555.34s |  But we better own up to it really quick because pretending that we're not defenseless, that's
2555.34s - 2556.34s |  not going to work.
2556.34s - 2557.34s |  Right?
2557.34s - 2560.26s |  And so it feels like AI is going to fundamentally change some of this stuff.
2560.26s - 2566.66s |  Like one of the questions is, okay, well, almost perfect voice duplication for these
2566.66s - 2569.42s |  CEO takeover voice attacks.
2569.42s - 2570.42s |  Yeah.
2570.42s - 2571.42s |  Okay.
2571.42s - 2572.90s |  Well, that's reality.
2572.90s - 2574.90s |  We can't pretend we're going back.
2574.90s - 2577.34s |  So no more voice authentication.
2577.34s - 2578.34s |  Okay.
2578.34s - 2581.42s |  But we better own up to that really quick.
2581.42s - 2582.42s |  Right?
2582.42s - 2583.42s |  Well, yeah.
2583.42s - 2584.42s |  I mean, I'd say a couple of things.
2584.42s - 2587.74s |  Like I am a tech optimist.
2587.74s - 2590.14s |  I'm an optimist in general, and I'm a tech optimist.
2590.14s - 2592.90s |  I wouldn't be in this business if I weren't.
2592.90s - 2598.74s |  We just named a chief AI officer, Lisa Einstein, who kicked some serious ass.
2598.74s - 2599.74s |  I'm really proud of her.
2599.74s - 2600.74s |  Lisa Einstein, please stand up.
2600.74s - 2601.74s |  Chief AI officer.
2601.74s - 2602.74s |  Lisa.
2602.74s - 2603.74s |  Rock on.
2603.74s - 2604.74s |  Yay.
2604.74s - 2612.74s |  Because we want to ensure that we are leveraging these capabilities for cyber defense, but
2612.74s - 2618.30s |  we also want to make sure that we are reducing risk from these capabilities to critical infrastructure.
2618.30s - 2621.82s |  So we put out a roadmap with a lot of the work that we're doing.
2621.82s - 2629.54s |  We put out a guide specific on secure by design for AI with international partners, federal
2629.54s - 2630.54s |  partners.
2631.22s - 2635.94s |  As we've been talking about software, like AI, the same rules apply to AI.
2635.94s - 2642.82s |  You have to consider security first, because these are very powerful, fast-moving capabilities,
2642.82s - 2644.70s |  but we don't want to be scared of them.
2644.70s - 2647.18s |  We want to be able to optimize the use of them.
2647.18s - 2652.18s |  And so we're excited about the power of it.
2652.18s - 2657.02s |  There's a lot of hype here, so we don't want to get sucked into the hype, but we were at
2657.02s - 2658.02s |  the AICC.
2659.02s - 2661.94s |  I think you guys just heard from those folks yesterday.
2661.94s - 2665.58s |  And so if there are things that can be done with some of these capabilities to find and
2665.58s - 2672.58s |  fix vulnerabilities, the thing that I am very excited about is the ability to use AI to
2672.58s - 2677.54s |  refactor code from memory unsafe to memory safe.
2677.54s - 2683.38s |  Think about how that could have a transformative impact on some of the defects that we have
2683.38s - 2685.10s |  to deal with on a daily basis.
2685.78s - 2690.46s |  I think we should get excited about it, but I don't think we should get Skynet scared
2690.46s - 2691.46s |  about it.
2691.46s - 2697.42s |  The only thing I'd say is, I spent a lot of my life doing counterterrorism.
2697.42s - 2705.18s |  I was in Iraq twice, Afghanistan, and we used to talk about Al-Qaeda's chief bomb maker
2705.18s - 2711.98s |  a lot, and now you think about Al-Qaeda's chief AI officer.
2711.98s - 2713.66s |  That ain't good.
2713.66s - 2717.90s |  The pictures of the data centers in the tunnels.
2717.90s - 2719.30s |  That's just ungood.
2719.30s - 2725.90s |  And so we want to make sure that these capabilities are protected from being used by terrorists
2725.90s - 2729.74s |  and criminals and rogue nations to do real harm.
2729.74s - 2734.14s |  Okay, we only have time for one question.
2734.14s - 2735.26s |  I'm sorry.
2735.26s - 2736.62s |  So you've got it.
2736.62s - 2738.94s |  Hopefully it's...
2738.94s - 2739.94s |  Go for it.
2739.94s - 2743.46s |  Better be the greatest question ever.
2743.46s - 2744.46s |  No pressure.
2744.46s - 2745.46s |  No pressure.
2745.46s - 2746.46s |  No pressure.
2746.46s - 2749.38s |  No pressure.
2749.38s - 2750.38s |  Closer to the microphone.
2750.38s - 2751.38s |  Closer.
2751.38s - 2752.38s |  Closer to the microphone.
2752.38s - 2765.70s |  Right.
2765.70s - 2770.97s |  Okay, so the question is around cyber liability.
2770.97s - 2775.97s |  Do you think it's going to be hard to do because of all the laws around liability?
2775.97s - 2778.97s |  Yes, I do.
2778.97s - 2789.16s |  Because it's what?
2789.16s - 2790.16s |  Oh.
2790.16s - 2791.16s |  Oh, yeah.
2791.16s - 2792.16s |  No.
2792.16s - 2801.04s |  It's an interesting issue when you think about it because a lot of the incidents that happen,
2801.04s - 2805.08s |  we very much focus on the proximate cause, not the root cause.
2805.08s - 2806.80s |  So you're exactly right.
2806.80s - 2811.24s |  I mean, that's the issues around human error, like we had a ransomware attack because somebody
2811.24s - 2815.80s |  downloaded a malicious file or got phished into giving up their password, right?
2815.80s - 2820.72s |  So we always focus on the proximate cause, not the root cause.
2820.72s - 2826.04s |  And yeah, to get anything done like this is hard, and I always worry that it's going
2826.04s - 2831.72s |  to be a major devastating attack that actually gets some sort of legislation.
2831.72s - 2839.20s |  I mean, I think I would just give you my perspective from working closely with members of Congress.
2839.20s - 2840.20s |  They get this.
2840.20s - 2841.20s |  They understand.
2841.20s - 2846.04s |  I do think the report that we released, the Cyber Safety Review Board report, caught a
2846.04s - 2851.68s |  lot of attention in terms of how important a culture of security is, how important it
2851.68s - 2858.88s |  is for a vendor to take accountability and responsibility for producing secure software.
2858.88s - 2863.56s |  So I don't think it's impossible, but it will take a lot of work to do.
2863.56s - 2868.16s |  I do think that is something, you know, this is, as Jeff was saying, there's all kinds
2868.16s - 2871.56s |  of levers that can lead us to a more secure ecosystem.
2871.56s - 2879.21s |  I do think that is a very important one because it leads to a product differentiator.
2879.21s - 2880.21s |  Thank you for the question.
2880.21s - 2881.53s |  All right, everyone.
2881.53s - 2882.53s |  Let's give it up.
2882.53s - 2883.53s |  Thank you for being here.
2883.53s - 2884.53s |  Thanks, everybody.
2884.53s - 2885.53s |  Love you.
2885.53s - 2886.53s |  Bye.
2886.53s - 2887.53s |  Bye.
2887.53s - 2888.53s |  Bye.
2888.53s - 2889.53s |  Bye.
2889.53s - 2890.03s |  Bye.


url: https://www.youtube.com/watch?v=7k3zOylPKbM
title: DEF CON 32 - AWS CloudQuarry: Digging for secrets in public AMIs - Eduard Agavriloae, Matei Josephs
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=7k3zOylPKbM",
  "title": "DEF CON 32 - AWS CloudQuarry: Digging for secrets in public AMIs - Eduard Agavriloae, Matei Josephs",
  "description": "Join us as we unravel another story of public resources from AWS, digging in 3.1 million AMIs for secrets. Beyond the findings, we'll delve into the ominous connection between exfiltrated AWS access credentials from these AMIs and the heightened risk of AWS account takeover. This talk will highlight key methodologies, tools, and lessons learned, emphasizing the critical need for robust security measures in the cloud to prevent both data exposure and potential account compromise.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2372,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.43s - 8.05s | This text was transcribed using whisper model: large-v2

 Hello DEF CON. So I'm very happy to be here. This has been a dream of mine for uh many
8.05s - 16.05s |  many years and uh thanks for being part of it. This research is about a cool story about
16.05s - 23.79s |  um secrets in public cloud resources and um you know uh who thinks we will never run out
23.79s - 32.73s |  of customers public public sharing secrets in public cloud resources. Yeah I think I think we
32.73s - 39.53s |  will never run out of that. And uh my name is Edward Agaduluia. I was a senior penetration
39.53s - 45.25s |  tester at KPMG Romania while I've done uh this research. Uh huge shout out to them for
45.25s - 50.81s |  supporting the the the research and uh trusting this idea. Uh I was also a contractor at
50.81s - 56.31s |  Syncubes uh I I mean I still am and I'm doing offensive cloud uh projects there. I also
56.31s - 66.09s |  work one month at CrowdStrike but I resigned on Friday so so I'm open for new opportunities
66.09s - 71.09s |  and um yeah I'm trying to do some uh cloud security research. Now I started um a cloud
75.09s - 80.09s |  configuration review uh for a customer of uh Syncubes and um I got the initial access um and
81.09s - 86.09s |  I started using uh Scout Suite as I uh uh always uh as I always do. And um I checked the
92.73s - 99.33s |  report. I saw the S3 findings, the CloudTrail findings, the YAM findings and when I looked at
99.33s - 104.35s |  the EC2 dashboard I saw for the first time the critical finding AMI is set to public and who
104.71s - 109.71s |  knows what an AMI is? Ok cool and um who used at least once an EC2 instance? Ok so if you
116.25s - 122.03s |  used an EC2 instance you kind of know what an AMI is because every time you start a an EC2
122.03s - 128.73s |  instance you are using an AMI. It's like a snapshot of a virtual machine and you can
128.75s - 133.75s |  pre-configure an an AMI to contain your applications, secrets, um so to have a baseline
137.33s - 142.47s |  right? And then you can start new EC2 instances starting from this AMI. And you have AWS
142.47s - 148.07s |  Marketplace AMI that are official and from trusted vendors which are the recommended ones
148.07s - 154.45s |  you can use. And you can also have community AMIs that are published by anyone. And you
154.47s - 159.91s |  have to be careful with uh with them because if you don't trust the publisher you might have
159.91s - 164.91s |  some backdoors malware and so on. But in any case the thing is that an AMI can be public or
168.09s - 173.05s |  private and by default they are private and it's actually hard to make one public. And I
173.05s - 178.69s |  think you can see where I'm going with this. The issue is that they can be public and this
178.71s - 183.71s |  customer had 5 public AMIs um exposed for multiple years and when I asked them hey can I
187.01s - 192.65s |  take a look uh inside the AMIs to to see what's inside of them? And um they were like no and so
192.65s - 198.93s |  I I regretted I even asked. But I got this question what was inside the AMIs? And this
198.93s - 205.33s |  actually gave me the research idea if there are other companies with secrets in public
205.51s - 210.51s |  AMIs out there. So um first we wanted to do this research so bad that we haven't checked any
215.81s - 221.89s |  previous work but when we are when we were in the middle of it we discovered the work done
221.89s - 227.99s |  by Dolev Farhi who scanned based on keywords AMIs in a single AWS region which was was
227.99s - 234.13s |  fine but it was not enough uh from our perspective. And also the work done by Ben Morris
234.17s - 240.17s |  who searched secrets in public ABS snapshots but we will see shortly that that there is very
240.17s - 245.17s |  little overlap between his work. And funny story um last days um I was talking about uh the
247.61s - 252.75s |  research with someone and he was like hey you know who did something similar? Um he searched
252.75s - 257.39s |  public ABS snapshots uh he's Ben and he pointed at someone and it was Ben Morris and he was
257.43s - 263.94s |  like yeah and sorry. So yeah we um I've met mo- Ben Morris um I've been saying his name a
267.14s - 272.14s |  lot um uh rehearsing the presentation it was uh it was a pleasure to to meet him in person
274.62s - 280.96s |  he's a lovely guy. Now uh we set some goals for the research to dig for secrets in every
280.96s - 286.66s |  public AMI across all AWS regions to have some fun and do some responsible disclosure. We
286.66s - 292.26s |  also had a hidden goal to get some bounties and uh my colleague Matei will tell you more
292.26s - 299.18s |  about it. Starting the research we had to collect every public AMI across all A- all AWS
299.18s - 305.92s |  regions and to do that you have to um you have to use the CLI because AWS automatically
305.92s - 311.68s |  deprecates images after two years uh after they were published. And if they are
311.68s - 317.02s |  deprecated you can find them in the in the web portal. Also customers can deprecate their
317.04s - 322.12s |  images whenever they want. So we have to uh you have to use the CLI and specify the flag
322.12s - 328.16s |  include deprecated to make sure you get all the AMIs. And we did that and we got 3.1
328.16s - 333.16s |  million AMIs and um we were sure that this was too much for us to scan all of them and we
335.26s - 340.26s |  started asking if we can remove AMIs based on the chances of having secrets. So we removed
341.02s - 346.02s |  AMIs for from marketplace that left us with 1.5 million. We removed AMIs owned by AWS that
349.62s - 355.96s |  were not in the marketplace that left us with 1 million and we went further and uh we
355.96s - 362.00s |  removed the owners that had more than 50 public AMIs because honestly if you are a company
362.00s - 367.64s |  and you have more than 50 public AMIs security wise you are in a point of no return or you
367.66s - 373.90s |  are or you are uh an official publisher an unofficial publisher right? And that left us
373.90s - 378.90s |  with 27,000 AMIs. Now we did some sanity filtering because some AMIs had 17 volumes or
382.84s - 389.12s |  volumes uh as big as 20 terabytes. Obviously I'm very curious what's inside of them but for
389.12s - 396.12s |  our budget we had to remove them uh and that left us with 26,000 AMIs. Now the distribution
396.14s - 401.14s |  uh from our list looks like this. Obviously the most AMIs were in U.S. East 1 and um region
403.62s - 409.72s |  with the smallest number of AMIs was IL Central 1, Israel Central 1 with only 30 public
409.72s - 414.72s |  AMIs after uh after our filtering. And when I'm saying that we collected the AMIs this is
418.46s - 423.46s |  what I mean by it. So we got the JSON definition for each AMI and uh you have a lot of
423.58s - 430.28s |  information like the ones highlighted, the image ID, the information about the snapshot,
430.28s - 436.12s |  but you also have other important information like description, title and the owner of the
436.12s - 441.12s |  AMI and we'll see how we can use that uh shortly. Now that we had our list we need a way to
444.10s - 449.80s |  access the contents of the AMI and this should be time and cost effective, automated and as
449.84s - 456.32s |  reliable as possible. And we looked for various methods, some of them might work in certain
456.32s - 461.32s |  situations but only the fourth option was the right one for us. So first we tried to copy the
463.62s - 468.62s |  snapshot uh of the AMI in our own AWS account and download it but even if the AMI is
471.40s - 477.00s |  public the ABS snapshot is not by default and that's why it's very little overlap between our
477.00s - 483.22s |  work and the work done by Ben Morris. Next we tried to start an EC2 instance based on the
483.22s - 488.22s |  target AMI, create a an ABS snapshot of its volume and download it. But we we we quickly we
490.52s - 495.52s |  quickly realized that this will take a lot of time for an ABS snapshot of uh 100 gigabytes.
498.40s - 504.04s |  It took around 20, 30 minutes to download and we were sure that AWS will block our IP since
504.08s - 511.18s |  we are downloading uh terabytes of data, right? So definitely not an option but we realized we
511.18s - 517.46s |  had to operate as much as possible within the native AWS features to to achieve the faster
517.46s - 522.46s |  uh the faster method. And we we tried to start a new EC2 instance based on the target AMI and
525.34s - 531.98s |  connect directly to the instance but for some reason the instances were not in a state that
531.98s - 537.36s |  allowed us to connect to them. Either through SSH or through SSM features it just didn't
537.36s - 542.36s |  work. But we did a work around a work around and um we got to this method. So we have a secret
545.66s - 551.64s |  searcher instance. We call it like this because it's a sec- it's an instance that we already
551.64s - 557.24s |  have in our own AWS account and it's working we can connect to it. And next we start an EC2
557.24s - 562.28s |  instance based on the target AMI, detach its volume and reattach it to our secret searcher
562.28s - 568.32s |  instance where we can connect and analyze the data. It's like having a working laptop and
568.32s - 573.56s |  someone brought a laptop that doesn't work but you can get out the hard disk and connect it to
573.56s - 577.66s |  your laptop and basically that's how you can access the data. And everything is happening
577.66s - 584.54s |  within the AWS environment so it was both fast and with it was both as reliable as possible.
584.54s - 592.28s |  Now I'll show you a demo on how you can manually access the contents of one AMI. Let me
592.28s - 599.31s |  see if I can start this. So we can search based on the uh description. You can use this to
599.31s - 604.05s |  target certain technologies or companies. You have to mention the right region because
604.05s - 610.01s |  otherwise you will not find the the the AMI and you also have to specify the flag include
610.01s - 617.03s |  deprecated to make sure you get all the images right? If you know the AWS account ID you can
617.03s - 622.03s |  try to find all the images owned by that account so that's that might be useful for uh for
622.03s - 627.03s |  bug pound-hunter right? But let's stick with uh our uh description based search. So let's try
629.61s - 636.40s |  to copy the ABS snapshot as um as a first step. So you you will see that if you try to copy
639.54s - 644.00s |  the snapshot in our own AWS account we will get the error message source snapshot is not
644.00s - 650.66s |  found. That's because the ABS snapshot is not public only the AMI is. Now we will do the
650.66s - 655.20s |  method uh with the secret search searcher instance so we have our instance that it's
655.20s - 660.18s |  running and now we will start a new instance based on the target AMI and we will place it in
660.18s - 665.58s |  the same availability zone as our secret searcher instance. We you need the same availability
665.58s - 672.26s |  zone to make sure you have you you can move the volume between the instances. Now the
672.28s - 678.38s |  instance is running we will stop it and we will detach the volume and we will reattach it to
678.38s - 685.40s |  the secret searcher instance. After you detach the volume you can delete the initial ins- the
685.40s - 690.40s |  the EC2 instance that is based on the AMI if you want to reduce some cost but in any case uh you
694.40s - 699.54s |  can just attach the volume and then you can connect to it. We use the web portal uh because
699.56s - 704.76s |  it was easier for the demo but you can also connect through SSH. A common error that we
704.76s - 710.26s |  encountered was an ID collision between the new volume and the root volume that was
710.26s - 716.68s |  attached to to the instance. And we had to use all kind of weird tools I've never heard
716.68s - 723.68s |  about uh in order to fix this issue but once that is done you will be able to mount the
723.82s - 729.56s |  volume and connect um to mount the volume and access the files. And now that it's mounted
729.56s - 734.70s |  let's look for some AWS credentials right? We found some and now let's check if they are
734.70s - 741.24s |  valid. Because for some older instances the secrets might not be valid anymore so every
741.24s - 750.34s |  time you have to check them. So surprise yes they are working and that's exactly how we
750.34s - 756.44s |  felt when we found our first AWS access keys and in the same day we found 10 other valid
756.44s - 762.72s |  access keys so we realized that this was a big issue indeed. This is the high level
762.72s - 767.98s |  architecture we put in place. We had a master EC2 instance where we round uh we we ran our
767.98s - 774.66s |  big script and in each region we started the secret searcher instance um and then we
774.66s - 781.50s |  started batches of twenty uh twenty instances based on AMIs to um to make sure we um we
781.50s - 786.64s |  reduce the time. And for each instance we detach the volume, we reattach it to the secret
786.64s - 793.24s |  searcher instance where we will search for secrets and sensitive files. And after run
793.24s - 798.24s |  run after writing 1.2K lines of code, 14 days of scanning time and a bill of 450 dollars, we
801.18s - 806.18s |  collected 500 gigabytes of carefully selected files and data um that we had now to to
806.54s - 811.94s |  analyze and I invite my colleague Matej Josic to tell you more about it.
811.94s - 820.08s |  Thank you. Cool. Good morning everybody and thank you so much for being here. It's actually an
822.16s - 827.16s |  absolute pleasure to be on stage at DEF CON 32. This is the secret searcher section where I'm
830.60s - 837.04s |  going to talk about how we search for secrets, what sorts of secrets we found, and what we
837.06s - 844.74s |  were able to do with them. I am Matej Anthony-Josephs. I've been with KPMG for about an
844.74s - 849.34s |  year and a half and I'd like to take this opportunity to thank them for the time and the
849.34s - 855.66s |  budget for this project right here. Other than that, I'm a senior security researcher with
855.66s - 860.32s |  experience in pen testing, threat hunting, vulnerability management, and a bit of people
860.32s - 865.32s |  management as well. Now, completely unrelated to this research, I've also set up a company
866.00s - 870.60s |  alongside my wife, Alexa. Our company's called Hivehack, because we're absolutely
870.60s - 876.28s |  fascinated by the collaborative trace of bees, whereby up to 60,000 bees work together in a
876.28s - 881.28s |  colony for the greater good of the community. Similarly, we think that uh collaboration is
886.08s - 891.86s |  probably the most important part of cyber security. And while I don't know the exact
891.86s - 898.88s |  numbers, just looking around Dafcon, I can see why. There's quite a hive of hackers around
898.88s - 905.68s |  here. That's enough about me, back to Cloud Query. For our initial strategy, we decided to
905.68s - 911.76s |  be as lazy as possible. And trust me, being lazy is a good thing here. We wanted to avoid
911.76s - 916.66s |  reinventing the wheel, and wanted to use known tools as much as possible, such as
916.66s - 921.66s |  TruffleHog. But we quickly realized that this was not going to work. In fact, the tools which
924.10s - 930.00s |  we tried to use were quite slow, and produced loads of false positives. And while we could
930.00s - 934.78s |  have worked through the false positives, the fact that the tools were slow was the main
934.78s - 940.08s |  issue, because slow scanning times meant that our EC2 instances ran longer, which in turn
940.08s - 945.76s |  meant that uh our AWS bill would have been way higher, leaving us broke and lazy, rather
945.76s - 952.68s |  than just lazy. So, with this in mind, we had to pivot, and we went back to the Zen of Python.
954.78s - 961.02s |  More specifically, the following section of it. Simple is better than complex, complex is
961.02s - 967.86s |  better than complicated, and special cases aren't special enough to break the rules. So, with
967.86s - 974.40s |  this in mind, we reduced our scope even further, and became even lazier. We ended up only
974.40s - 980.50s |  looking for specific types of files or directories, such as uh, well, environment secrets,
980.50s - 985.50s |  secrets leaked within git repositories, AWS credentials, private keys, and a few others. Now
987.98s - 993.84s |  we faced an other issue, and that is, finding the right tool for this. We had to find the
993.84s - 999.78s |  tool, which allowed us to search for files and directories on the file system, based on
999.80s - 1006.10s |  their names. The tool had to be quick and simple. So, you can probably see where I'm going
1006.10s - 1011.12s |  with this. We ended up using the native Unix utility, find, of course. So, uh, we, we
1014.08s - 1019.12s |  skipped the Windows directory, program files directories, because they're full of junk and
1019.12s - 1025.26s |  slowed down our scans. We skipped everything about, above 25 megabytes, because, well, this
1025.28s - 1030.68s |  is only a proof of concept. We didn't need to find everything, really. And searched for all of
1030.68s - 1037.46s |  these various files and directories. So, besides our, well, proprietary and very complex use
1037.46s - 1043.32s |  of find, and I'm only joking as well, it's not that complex, we had to set up a few other
1043.32s - 1049.86s |  things. And one of them was an automation for verifying AWS credentials. And you'll see in a
1049.88s - 1056.28s |  minute exactly why we needed that. Secondly, we used Git leaks for checking Git repositories
1056.28s - 1061.28s |  for secrets. Also, we had to set up a few other automations for verifying API keys and other
1064.86s - 1070.82s |  types of credentials. And for this we used key hacks, which is a fantastic repository of
1070.82s - 1076.66s |  methods for validating keys and credentials. However, even if we had all of these
1076.66s - 1081.88s |  automations set up, we, we're still left with, well, a shit load of manual work, to be
1081.88s - 1086.88s |  fair. Um, so, following our data collection phase, we were left with 2 million generic API
1089.64s - 1095.48s |  keys, and of course many of them are false positives. Over 100,000 potential AWS
1095.48s - 1102.46s |  credentials. Several private keys, you can see some slack tokens, uh, uh, Stripe, Telegram,
1102.46s - 1107.40s |  and so on and so forth. So you can probably see why we needed all of these automations for
1107.40s - 1112.40s |  validating the keys and credentials. So, out of the, about 100,000 AWS credentials, only
1116.04s - 1121.04s |  about 120 of them were valid, out of which 20 were root. Now, I know that this does not seem
1124.18s - 1129.18s |  like a lot. I mean, what is, 120 out of 100,000 is nothing, right? But, think about it this
1132.46s - 1137.46s |  way. These, these keys allowed us to access the AWS accounts of over 100 companies. So, this
1143.00s - 1149.44s |  gave us initial access there, and for 20 of them we had absolute complete control. So, let
1149.44s - 1155.94s |  that sink in for a bit. Now, we faced another issue, and that is identifying the owners. And
1158.38s - 1163.78s |  for this, we used the get contact information call, which gave us, well, the
1163.78s - 1169.48s |  company name, in some cases the name of the contact, uh, phone number, email address, and
1169.48s - 1174.48s |  so on and so forth. So, with this in mind, we found something surprising. And that is, that
1178.02s - 1183.56s |  it's not only small boutique-like companies affected by this. In fact, many of the companies
1183.56s - 1188.56s |  are on the Fortune 500 list. Some of the most valuable ones were worth 200, respectively 50
1188.92s - 1193.92s |  billion dollars. We found three large telecom companies, which you've definitely heard about in
1196.86s - 1201.30s |  the past. Ten relevant security and tech companies, and several others in consulting,
1201.30s - 1208.04s |  education, health, manufacturing. Now, unfortunately, we cannot disclose much more about the
1208.04s - 1213.88s |  companies at the moment, but maybe in the coming weeks or months we will be able to do so. Now,
1213.90s - 1218.90s |  you may ask, well, anybody can write whatever they like in the contact information in the AWS
1221.24s - 1226.58s |  account, right? And you're absolutely right. And then our efforts for identifying the
1226.58s - 1233.22s |  owners could have been completely in vain. However, here is where our OSINT came in. We did
1233.22s - 1237.12s |  quite a bit of OSINT, went on social media, including LinkedIn, and found several of these
1237.12s - 1242.76s |  owners. Funnily enough, many of them had several AWS certifications on their accounts,
1242.78s - 1248.14s |  suggesting that they are security aware and know how to properly configure their AWS
1248.14s - 1255.37s |  accounts. Now, one of these companies, which was and still is actually on the Fortune 500
1255.37s - 1260.37s |  list, had a program on bug crowd. So we reported it. And this way we got our first P1, our
1262.77s - 1267.71s |  first confirmed critical vulnerability on a bug bounty platform. That was absolutely
1267.71s - 1275.24s |  fantastic for us. Oh, thank you. Thank you. Now, let's see, how much do you guys think
1276.68s - 1281.82s |  we made out of it? So, who thinks we made between $10,000 and $100,000? So, let's say
1281.82s - 1286.82s |  5 digits. Yeah, only a few hands up. Maybe 4 digits, so 1,000 and 10,000? Right, a few
1289.46s - 1294.50s |  more. Well, let's say AWS or cloud in general is niche, maybe they don't really care about
1294.50s - 1299.50s |  these accounts. Maybe 3 digits? Okay, yeah, that's pretty low. Um, yeah, we made $0 out
1299.50s - 1304.50s |  of it, nothing. Uh, yeah, thank you, absolutely. Um, well, to be fair, there's a bit of a
1312.12s - 1318.62s |  catch. It wasn't a bug bounty program, it's, it was a vulnerability discloser program. And
1318.62s - 1323.86s |  we weren't too disappointed to be fair. Because we didn't really aim to make money out of
1323.86s - 1328.86s |  this research. We just wanted to make the internet a safer place. Although this sounds a
1328.86s - 1335.20s |  bit cliche. But still, we quickly forgot about this because we found something else which I
1335.20s - 1341.30s |  think was more interesting than this. I like to call this story, how we earned and lost $3
1341.30s - 1346.68s |  million in a week. And, well, we're in Vegas right now, we all know a thing or two about
1346.68s - 1353.38s |  losing and earning money quickly, right? Um, maybe not quite $3 million. For a bit of
1353.38s - 1359.82s |  context, we found this company which had a public AMI, there was a git repository within that
1359.82s - 1366.82s |  AMI, and within the git repository we found, um, a Stripe API key. And for those of you who
1366.82s - 1373.20s |  don't know, Stripe is a payment service not unlike PayPal. So our first thought was, okay,
1373.20s - 1378.20s |  let's run a balance call to the API and that's what we got. Uh, 7 digits in the USD currency. So
1378.56s - 1383.56s |  what looked like $3.1 million. Fantastic. So our first thought, of course, was, well, how
1387.44s - 1392.74s |  would a threat actor go about transferring these funds into their own account for research
1392.74s - 1399.32s |  purposes only, trust me. Only research. So we went to the documentation and we quickly
1399.32s - 1406.57s |  realized that the amount is in cents. So what we thought was $3.1 million was actually
1406.59s - 1413.23s |  $31,000. Of course, we were very disappointed. Um, we had to get over the disappointment
1413.23s - 1418.51s |  that our net worth reduced from $3.1 million to $31,000 by simply reading the
1418.51s - 1425.01s |  documentation. So if there's any conclusion here, don't read the documentation. Um, just
1425.01s - 1430.91s |  joking of course. Uh, so we wrote an email to their security contact, let them know what's up
1430.93s - 1438.11s |  and waited and waited and waited. And all we got was radio silence for a few weeks. It was
1438.11s - 1442.37s |  pretty annoying to be fair. We thought, well, did we do something wrong? Didn't we prove
1442.37s - 1447.39s |  impact? So we thought of proving impact and that's what we did. We, or I, uh, registered to
1451.15s - 1458.40s |  their, uh, cheapest plan which was $9.99 per month. Confirmed the transaction from the
1458.46s - 1463.46s |  API. And did a refund call which was successful. Fantastic. And a second level of validation
1466.96s - 1472.40s |  was that, uh, the transaction was reverted. So my money was back in my account and I could
1472.40s - 1477.84s |  still use their services which I didn't do because I didn't need their services. But now this
1477.84s - 1482.58s |  was a bingo moment for us cause we knew that we can talk about money. So we contacted the
1482.58s - 1488.08s |  CEO but for this we had to go on LinkedIn, found the CEO, do a bit of OSINT, get their email
1488.10s - 1493.64s |  address, and write to them. And guess what? Within a couple of hours we got a response where
1493.64s - 1498.64s |  he also CC'd the CTO and asked us for more info. And we provided more info. We gave them a
1501.78s - 1507.72s |  comprehensive report including the finding, the impact of the finding, uh, and steps for
1507.72s - 1512.72s |  remediating this. And what we got in response was a pretty dry message from the CTO saying,
1513.08s - 1518.08s |  thanks for sharing the relevant information, we have made the AMI private. For now. Like what?
1520.32s - 1525.32s |  For now? Okay. And we'll be replacing the keys. Thanks so much for responsible disclosure.
1529.02s - 1534.96s |  We took that as a thanks bye. And yeah, honestly we were a bit disappointed but we had a lot
1534.96s - 1539.04s |  of research to do. We had to go back to our research and just, uh, dig through the 500
1539.06s - 1545.70s |  gigabytes of data which we already got. However, one month later I was forced to remember the
1545.70s - 1550.70s |  issue. I checked my bank account and there's a 999 transaction. So I was so excited about
1553.24s - 1558.24s |  being able to do the refund that I completely forgot to cancel my subscription. Oh. Well,
1561.02s - 1567.26s |  remember that we are fairly broke so we, I didn't want to let 999 go by just like that. So I
1567.28s - 1572.28s |  went back into the API, did the same call again and guess what? Money was back in my account.
1574.36s - 1580.86s |  Yes, thank you. Yup. Well, we were disappointed initially by the dry response. But you cannot
1584.10s - 1589.10s |  even imagine our disappointment that the issue was still not fixed one month later. Now,
1591.94s - 1597.20s |  there's way more impact than just this. Think about it this way. We had to spawn several EC2
1597.22s - 1602.88s |  instances in our account. We got a bill of 500 dollars which, well, I'd have preferred to
1602.88s - 1607.86s |  avoid. So, yeah, if we weren't ethical we could have went and used the, um, victims, so to
1610.40s - 1615.40s |  speak, AWS accounts, uh, to do this research for free. Now, a second potential area of impact,
1618.14s - 1623.14s |  uh, which I think has a bit more potential, um, well, AWS based ransomware. Um, and this way I
1623.32s - 1628.32s |  could have come to DefCon for free. Um, so, typically when we think about ransomware, we
1631.32s - 1637.16s |  think about these teams of developers working 24-7, uh, working on evasion and stuff like
1637.16s - 1643.04s |  that. Uh, perhaps when, when we talk about ransomware as a service, uh, they're using, uh,
1643.04s - 1648.04s |  24-7, uh, customer support teams and call centers. Well, in here, with access to the
1648.38s - 1653.38s |  profiles, to the accounts, we could have used this, well, one liner or four liner, depends
1657.46s - 1662.46s |  how you write it, to list every S3 bucket within the accounts, copy all of the data to our
1666.46s - 1671.46s |  local systems and then remove all the data. Now, instead of the data which they expect to
1671.76s - 1678.26s |  have on their accounts, they could find something along these lines, a ransom note. All your
1678.26s - 1682.50s |  files have been stolen, you must buy us a Romania, Las Vegas ticket to get your files. And
1682.50s - 1687.08s |  honestly, that would have been pretty reasonable, it's only what, 500, a thousand dollars, so
1687.08s - 1692.08s |  yeah, pretty decent ransom. And I need this disclaimer here, this is just a joke. We didn't
1694.48s - 1700.48s |  do this and we wouldn't do this, but it's pretty cool that we could have done this, right?
1700.48s - 1705.48s |  Now, Eduard, wanna take over? So, the research was done, uh, we collected the data, we found
1708.12s - 1715.12s |  secrets, we validated them, but we wanted to bring down the impact of the effective companies
1715.12s - 1721.10s |  before we, we published the research. So, we looked for, uh, contacted, contact details and
1721.10s - 1727.10s |  we couldn't find many, we had to search for websites to go find their contact information,
1727.10s - 1734.10s |  give some generic email just to make sure we don't give out too much information to, to
1734.10s - 1739.30s |  someone that doesn't need to know it. So, we sent almost 70 responsible disclosure emails
1739.30s - 1744.48s |  and we received less than 10 responses. We had to do some weird things like contacting the
1744.48s - 1749.08s |  national search for one company, scheduled a sales call just to tell them about the
1749.08s - 1754.08s |  vulnerability and 90 days later after we did all this, only 10 AWS keys were invalidated. So,
1758.10s - 1764.70s |  that sucked and it's like companies are using AWS and they are ignoring responsible
1764.70s - 1768.64s |  disclosure, they don't have contact details, they never wrote an access keys and they are
1768.64s - 1774.14s |  like, man, this cloud thing is so unsafe. It's not like that, right? And in a desperate
1774.14s - 1781.04s |  attempt to invalidate more keys, we notified AWS security team and we were, we were like, I
1781.06s - 1787.06s |  know this is weird but we got 120 access keys that are valid. Here are, here is the proof,
1787.06s - 1793.40s |  um, can you invalidate them? We have a research we want to publish it. And the AWS security
1793.40s - 1800.34s |  team, the most amazing team we, we worked with, um, they made me rethink about the whole
1800.34s - 1805.34s |  responsible disclosure process and after a few days after contacting them, more than 60
1805.34s - 1810.48s |  AWS keys were invalidated. We had a meeting about the research, we provided some, some
1810.52s - 1816.10s |  ideas, we discussed fixes and it was overall an amazing experience and I want to give a
1816.10s - 1821.90s |  huge high, uh, a huge shout out to Christian Severt from, uh, from AWS security team and
1821.90s - 1826.90s |  uh, AWS security outreach team. So, please give them a round of applause. Thank you.
1830.04s - 1834.04s |  Now, to discuss a bit about detecting and defending against this and let's start with
1834.04s - 1842.04s |  defending. So, if your AWS account has this, um, yellow warning signs, you, you, you might
1842.04s - 1847.76s |  want to look into it. So, the settings block public access for AMIs and ABS snapshots
1847.76s - 1852.56s |  should be enabled. They should look like this, they should, should have this green check
1852.56s - 1859.24s |  mark. You can also use the CLI to validate if you have public AMIs. Make sure to check
1859.24s - 1865.08s |  every region and uh, make sure to check for deprecated images. You have to be careful
1865.08s - 1870.58s |  about this because one technique attackers are using to exfiltrate data is by making AMIs
1870.58s - 1876.66s |  public and accessing them from their account and if that happens to you, you should look
1876.66s - 1882.16s |  in CloudTrail for this event, shared snapshot volume created. This is the only event you
1882.16s - 1887.26s |  get in CloudTrail if someone accesses your public AMI and it doesn't have a lot of
1887.26s - 1894.10s |  information. As you can see the IP address is hidden which I get it. It's protecting the,
1894.10s - 1900.00s |  the, the customer that is accessing the API, the, the AMI, that is cool. But the only
1900.00s - 1904.94s |  identifiable information you have is the account ID which you can't do much uh, with it,
1904.94s - 1909.78s |  right? So, better be careful, better protect your account and enable uh, enable the
1909.78s - 1916.22s |  settings if you don't plan to publish AMIs or uh, or uh, ABS snapshots. Now, we have a lot
1916.22s - 1921.22s |  of data and we did other research with uh, with it. And one idea we had was, so we had
1923.72s - 1930.06s |  20K JSON web tokens and we looked if there are any tokens that were not expired, maybe
1930.06s - 1934.70s |  they had some secrets in them, any other misconfigurations but nothing came out of it.
1934.70s - 1941.08s |  However, it was a, it was a good try. Next, we looked through our 4K unique SSH private
1941.08s - 1945.94s |  keys, we generated public keys and a figure print and we searched on showdown but nothing
1945.94s - 1951.98s |  uh, nothing came out of it. Uh, one idea was to perform the same scan from within the AWS
1951.98s - 1956.96s |  network. Maybe that's how uh, we might find some, some servers but that was just too much
1956.96s - 1961.96s |  work and uh, it wasn't worth it. Another cool idea we had but we haven't started this yet. So,
1964.30s - 1969.84s |  we collected a lot of private, a lot of repositories and some of them are surely private.
1969.84s - 1974.80s |  We wanted to identify the private repositories to identify the deployed web application in
1974.80s - 1981.20s |  the wild and then perform source code review um, in order to find some vulnerabilities, get
1981.20s - 1987.88s |  some CVs, get some bounties but that is a lot of work and we, we are keeping it for um, for
1987.88s - 1994.76s |  later. And that is not all. Matei if you will. Yep, so while we're on the topic of further
1994.78s - 2001.88s |  research, well we still have about 500 gigabytes of potential secrets and we tried our best to
2001.88s - 2008.46s |  dig, dig through that data but there's definitely way more to find. Moreover, our colleague
2008.46s - 2015.06s |  from KPMG Romania, Stefan Tica, worked on some similar research uh, on Azure and we are
2015.06s - 2020.64s |  looking forward to his research being published as well in the near future. Also, we will
2020.66s - 2025.66s |  soon make a word list public with all the files which we found in all these public AMIs which
2028.06s - 2034.06s |  we scanned. Now, going back to the research objectives formulated by Edward at the
2034.06s - 2039.06s |  beginning of this talk. We aim to dig for secrets in every public AMI across all AWS regions. And
2041.38s - 2048.38s |  while we didn't dig into all public AMIs, we dug into all public AMIs which we found
2048.38s - 2055.36s |  interesting. So I'd say that this was achieved. Also, we aim to have fun and yeah, we did. We
2055.36s - 2060.50s |  found a lot more stuff than we expected. It was a roller coaster and thanks Edward for this.
2060.50s - 2067.38s |  Lastly, responsible disclosure. Well, I was a bit disappointed by the responsible
2067.38s - 2074.38s |  disclosure process in general. Well, many of the owners uh, didn't, didn't respond to us.
2074.38s - 2079.38s |  Others, well, didn't have any sort of information for us to contact them. Um, however, the
2081.62s - 2087.52s |  experience of responsibly disclosing this to the AWS team definitely made up for all of the
2087.52s - 2093.90s |  less pleasant experiences so this was definitely achieved as well. Now, that we are
2093.90s - 2100.64s |  approaching the end of this talk, here are our conclusions. Firstly, the impact of this
2100.66s - 2105.66s |  research is not yet fully uncovered. There's still way more to find out there. We have found
2109.44s - 2115.08s |  several secrets already in the data which we collected. There's definitely more in the data
2115.08s - 2118.78s |  which we already collected but there's definitely way more out there which we did not
2118.78s - 2125.02s |  collect yet. Potentially, a nice area of research would be continuously monitoring new AMIs
2125.04s - 2131.38s |  becoming public. Secondly, security by obscurity is definitely insufficient. So many
2131.38s - 2135.98s |  developers definitely thought that their Git repositories were safe because they're private,
2135.98s - 2142.26s |  right? But how is anything private if it's placed in a public resource? Also, you may be
2142.26s - 2148.86s |  thinking, hey, I won't be a target of this, right? Nobody cares about my AMIs. Well, think
2148.86s - 2154.70s |  about it this way. Edward and I, two cyber security guys from Romania, were able to do this.
2154.72s - 2160.86s |  Think about what the threat actors could do. So definitely, don't make your AMIs public if you
2160.86s - 2165.86s |  don't have to. Now, AMIs are only the tip of the iceberg here. There are still a lot of other
2169.40s - 2175.74s |  interesting things to find across several other public cloud providers. Who knows, maybe
2175.74s - 2181.94s |  next year we'll be back here talking about how we dug for secrets in a different cloud
2181.96s - 2187.72s |  resource. And still, we encourage you to do your own research as well. And please, let us
2187.72s - 2194.74s |  know if you have any sort of ideas. We're happy to help. Actually, going back to my initial
2194.74s - 2200.90s |  point within the secret searcher section. Collaboration is definitely the most important
2200.90s - 2206.58s |  aspect of cyber security. So please, connect with us. Let us know if you need any help with
2206.58s - 2212.38s |  any sort of research in the future. And we'll definitely be happy to help. This being said,
2212.38s - 2228.51s |  thank you very much everybody. We appreciate you being here. Any questions? Yep. Sure, go
2228.51s - 2246.72s |  ahead. Is the mic on? Not yet. Can we get the question mic on please? Oh, perhaps just speak
2246.72s - 2258.31s |  really loudly. Well go ahead Edward. Uh, we don't know. So, we, we didn't perform any calls
2259.31s - 2264.31s |  beside the contact information. Um, so we tried to get uh, security operation and uh, another
2267.49s - 2272.39s |  type of contact details but we, we didn't check the permissions. I'm sure for some of them, we
2272.39s - 2277.19s |  surely could have. But yeah, that, that was too much because surely there were some
2277.19s - 2282.95s |  automation based on the uh, access keys and uh, we might have broke, uh, broken something.
2282.97s - 2288.51s |  So, yeah. Also, please note that just having the uh, S3 ransomware sort of code in my
2288.51s - 2302.57s |  terminal got my adrenaline rushing. So we, we didn't try to do anything like that. Yes. I
2302.57s - 2318.60s |  didn't have to, I wanted to. Sorry? Yeah, actually, so yeah, I'm looking for new
2318.60s - 2323.54s |  opportunities. If you have something in mind in the offensive security, cloud research or
2323.54s - 2328.28s |  cloud security, just give me a message. I'll, I'll start applying next week. So, thanks.
2333.32s - 2345.36s |  Cool. Any other questions? Yes, please. Uh, no, and to be fair, we didn't even expect that. I
2345.36s - 2351.94s |  mean, we had KPMG for that. So, thanks KPMG. And uh, we are waiting some t-shirts from the
2351.94s - 2361.02s |  companies we disclosed this. Thank you. Mic's working, so if anybody has any questions,
2361.02s - 2366.40s |  you can speak in the mic. Cool. Doesn't look like any other questions. We'll just be around
2366.40s - 2370.00s |  here, so please let us know guys. Nice talking to you. Thank you.


url: https://www.youtube.com/watch?v=-pxmly8xeas
title: DEF CON 32 - Breaking the Beam:Exploiting VSAT Modems from Earth - Lenders, Willbold, Bisping
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=-pxmly8xeas",
  "title": "DEF CON 32 - Breaking the Beam:Exploiting VSAT  Modems from Earth -  Lenders, Willbold, Bisping",
  "description": "VSAT satellite communication systems are widely used to provide two-way data and voice communications to remote areas, including maritime environments, crisis regions, and other locations where terrestrial communication infrastructure is limited or unavailable. In this presentation, we report on our security findings from our reverse-engineering efforts to exploit VSAT satellite modems from the Earth. We will focus on the Newtec MDM2200 from iDirect as an example. First, we explain how we reverse-engineered the software stack running on the modem device to find 0-day vulnerabilities. Then, we show how we reverse-engineered the network stack to devise attacks that can be launched by injecting wireless signals through the antenna dish of a VSAT terminal. Finally, we demonstrate our software-defined radio end-to-end attacks to inject bogus firmware updates and to gain a remote root shell access on the modem. To the best of knowledge, this represents the first successful demonstration of signal injection attacks on VSAT modems using software-defined radios from the Earth, while previous attacks on VSAT systems such as the ViaSat hack in 2022 were based on exploiting the operator\u2019s network through Internet VPN connections. Our work therefore enlarges significantly the attack surface of VSAT systems.\n\nOur presentation at DEF CON is part of a project that has three parts.\n\nIn the first part, we focus on the inherent security issues in current VSAT system practices. This work will be appear in May at ACM WiSec 2024.\n\nVSAsTer: Uncovering Inherent Security Issues in Current VSAT System Practices, Johannes Willbold, Moritz Schloegel, Robin Bisping, Martin Strohmeier, Thorsten Holz, Vincent Lenders, 17th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), Seoul, Korea, May 2024.\n\nThe second part deals with the systematic evaluation of wireless signal injection attacks using a software-defined radio. This work will appear in August at Usenix Security 2024:\n\nWireless Signal Injection Attacks on VSAT Satellite Modems, Robin Bisping, Johannes Willbold, Martin Strohmeier, and Vincent Lenders, 33rd USENIX Security Symposium (USENIX Security), Philadelphia PA, USA, August 2024.\n\nThe third part of the project deals with reverse-engineering of the software and network stack of satellite modems and the development of exploits that can be injected over the air through the antenna dish of a VSAT terminal from the ground. This part shall be presented at DEF CON this year.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2379,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

1.49s - 8.67s | This text was transcribed using whisper model: large-v2

 So hello everyone and welcome to our presentation on breaking the beam a new type of attack
9.65s - 14.09s |  That aims at exploiting vSAT satellite communication from the earth
14.77s - 18.69s |  But first let me introduce ourself. I'm Vincent. I'm
20.09s - 22.77s |  Cybersecurity researcher for more than 20 years
23.13s - 28.29s |  I've been focusing mostly on the security of wireless networks in my research and
28.29s - 33.13s |  And currently I'm acting as a director of the cyber defense campus in Switzerland
33.53s - 36.77s |  We have also with us today Johannes is a PhD student
37.41s - 38.89s |  from the
38.89s - 45.69s |  University of Bochum in Germany and is researching the software security of space and satellite systems
46.17s - 50.77s |  and also with us today is a Robin is a graduate students from ETH Zurich and
51.37s - 56.37s |  It has been also working at the cyber defense campus in the context of his master thesis
56.85s - 58.25s |  So
58.25s - 60.53s |  Let me start with what vSAT
61.29s - 68.09s |  Communication is vSAT stands for very small aperture terminal. This is a special type of
69.49s - 71.49s |  satellite communication
71.73s - 72.93s |  that
72.93s - 74.93s |  communicates over
75.25s - 83.41s |  Geostationary satellites you you can see here on the picture on the left a maritime vSAT communication system
86.23s - 87.87s |  A
87.87s - 90.35s |  Maritime vSAT. Can you please switch off the
91.55s - 98.83s |  The music. Thanks. We have a maritime vSAT communication system that is equipped on the ship or on the right
98.83s - 100.67s |  We have a terrestrial
100.67s - 101.83s |  vSAT
101.83s - 104.75s |  system that is typically used for
105.79s - 107.27s |  terrestrial
107.27s - 108.31s |  applications
108.31s - 112.03s |  This vSAT communication systems. They typically provide data
113.03s - 115.87s |  Video or voice communication services
116.71s - 117.95s |  and
117.95s - 120.23s |  They are not so small as the name stands
120.75s - 125.27s |  This antenna dishes can be typically the size of a one meter or two meters
127.96s - 129.84s |  Okay
129.84s - 134.40s |  if we look at a system a vSAT communication system
134.48s - 142.18s |  It basically consists of three components. We have a central hub. The central hub is typically connected to the Internet
142.18s - 143.30s |  and
143.30s - 145.70s |  We have a satellite geostationary
146.26s - 150.86s |  Geostationary satellite that's a satellite that is in the orbit such that it
151.62s - 153.62s |  Rotates at the same speed
154.14s - 161.66s |  Around the earth out there as the earth is rotating around its own axis. So the satellite stays always at the same
162.78s - 166.90s |  Location compared to the earth and then we have a vSAT
167.34s - 174.46s |  Endpoint that's a dish with a modem where users can connect their mobile device or smartphone laptops, whatever
175.38s - 181.14s |  If we look at the communication, it's a bidirectional communication. So we have a forward channel
181.54s - 185.62s |  From the central hub that goes over the satellite to the vSAT endpoint
186.42s - 188.06s |  and we have a
188.06s - 191.90s |  Return channel that goes from the vSAT endpoint back over the satellite
192.50s - 197.42s |  To the central up the satellite is really a very dumb. It's typically a bent pipe
197.42s - 203.06s |  So it just takes the signals from the uplink that it receives and forwards them to the downlink
203.22s - 207.66s |  That's the only thing that the satellite is typically doing is in terms of signal
208.22s - 210.10s |  forwarding
210.10s - 212.46s |  now if we look at the security of
213.14s - 215.14s |  vSAT communication systems
215.26s - 222.90s |  We can consider three thread models and the first thread model is basically an attacker that tries to attack the
222.90s - 224.90s |  system from the internet
225.14s - 227.14s |  so it will attack and try to
228.22s - 230.22s |  infiltrate from the central hub and
230.74s - 236.62s |  Basically, this is also what happened and what everybody was talking for the last two years. That is what happened in February
237.50s - 239.50s |  2022
239.50s - 245.82s |  In where at the same time on the same day as the Russian invaded the Ukraine there was an attack
246.54s - 253.74s |  basically through this ground system ground system network to deploy bogus malicious
254.46s - 256.22s |  firmwares to
256.22s - 257.86s |  thousands of
257.86s - 260.50s |  vSAT endpoints and this this attack
261.90s - 263.02s |  basically
263.02s - 265.02s |  Was was was basically?
265.58s - 267.58s |  rendering thousands of
267.62s - 271.70s |  Modems unavailable and had to be replaced or updated
272.82s - 279.54s |  Now this attack has been presented last year and the year before at Defcon so many people have analyzed what happened there
280.46s - 287.74s |  So there is a second threat model which basically looks at attacks against the satellite itself
288.62s - 289.86s |  so
289.86s - 294.50s |  Basically the idea would be to attack the satellite directly over their air interface
295.18s - 302.38s |  So we have been doing some research the previous years on these types of attacks for example at IEEE S&P in 2020
302.46s - 304.70s |  We showed how it is possible to intercept
305.90s - 307.42s |  vSAT
307.42s - 309.10s |  communication
309.10s - 314.54s |  Passively with an eavesdropper. We have been also doing some some research presenting this year at aerospace
316.26s - 319.54s |  Conference about reconnaissance how to basically
320.42s - 323.66s |  Discover capabilities of satellites or last year
323.66s - 329.02s |  I had an IEEE S&P Johannes was also presenting a paper that shows
329.38s - 334.14s |  how you could find the vulnerabilities in satellites and try to exploit those and
335.50s - 343.10s |  Then the the focus of today is to look at the threat model of an attacker the third threat model which basically
343.58s - 348.54s |  Attacks directly the vSAT endpoint, and this is the new thing that we are considering in this work
349.14s - 351.14s |  basically, we we
351.74s - 355.82s |  We try to understand our feasibilities to directly
356.46s - 360.62s |  Attack the endpoint without going through a central hub or the satellite
361.82s - 366.86s |  So our research contribution in this work. We have been reverse engineering
368.18s - 372.50s |  Vsat modem it's from I direct. It's the new tech MDM
373.74s - 376.70s |  2200 that's the model we have been analyzing and
377.34s - 383.14s |  We have been reverse engineering the entire software stack as well as the communication protocol stack
383.62s - 385.78s |  Up down to the physical layer
386.54s - 393.86s |  So we found several vulnerabilities in the software and the communication stack of the modem which allows us to implement
394.58s - 402.00s |  three over-the-air wireless attacks that use software-defined radios and this attacks allow us to
402.60s - 408.68s |  Remotely reset the modem to update a malicious firmware to the modem and also to obtain a
409.20s - 411.20s |  remote admin shell and
412.28s - 415.64s |  Finally we demonstrate the feasibility of these
416.12s - 420.96s |  Attacks to launch this and attacks by breaking the beam and what do we mean by breaking the beam?
421.56s - 425.24s |  Basically the idea is that we inject signals
426.00s - 431.80s |  from not directly from from the satellite, but from from a side beam from a
432.00s - 435.72s |  Attacker that is on earth that is close to the satellite
436.36s - 440.08s |  typically what people have at a conventional wisdom what people have assumed is that
440.72s - 444.88s |  satellites communicate we said satellite communication as quite robust against
445.16s - 450.08s |  signal injection attacks from the side because you have typically a high directional beam
450.64s - 457.58s |  towards the
457.58s - 461.60s |  Sorry for that
461.60s - 463.60s |  Okay, am I connected? Yeah
463.88s - 465.88s |  Okay, so the idea
466.88s - 473.88s |  Yeah, the idea what people assume this has basically since the the dish has a very high directionality
474.80s - 476.80s |  Basically, it would be difficult to inject
477.24s - 478.40s |  signals
478.40s - 483.36s |  From the side and what we show basically in our research is actually it's possible
483.68s - 487.52s |  From the from a side beam to inject these signals these attacks
488.04s - 490.04s |  from from the earth
490.28s - 495.00s |  So with that I want to give the word to Johannes will present his
495.56s - 500.56s |  Research or his work on reverse engineering the the modem. We've been looking at
501.08s - 504.94s |  All right. Thank you. So
505.42s - 511.22s |  So far, we've basically heard what kind of setup we need to actually attack these modems and as already introduced
511.22s - 517.18s |  We are attacking the new tech modem MDM 2200 and we also looked at a different modem call from Viasat
517.38s - 519.50s |  Exactly the one attack in Ukraine not in this talk
519.50s - 521.62s |  But in the research paper, this is all based on
522.22s - 529.54s |  But we picked this this I direct modem or also new I direct and it's kind of interchangeably since I direct the quiet new tech
529.54s - 533.38s |  some while ago and so I direct owns all of these products at this point and
533.98s - 541.42s |  There's pretty good case study since they themselves today are on the according to their website rank themselves first maritime communications in
542.10s - 545.38s |  Aerospace communications or rather in the basically commercial planes
545.90s - 549.78s |  Having visa systems and also in media and network broadcasting
549.78s - 555.42s |  And so while it's it's pretty clear that this specific system that we are looking at here is not deployed on all of these
555.42s - 557.42s |  This I want to be very clear these vulnerability
558.26s - 564.54s |  These vulnerabilities are not quite you can't go out and basically pawn every airplane with it. This definitely won't work
564.54s - 566.54s |  It's a different system from the same company
567.90s - 569.62s |  so
569.86s - 575.78s |  Far basically, we have this visa at endpoints and it's separated into the antenna, which you basically place outdoor
575.78s - 578.34s |  And that's why it's also called outdoor unit
578.54s - 584.20s |  Then we have this modem this the small little box that you play somewhere inside and that's why it's called indoor unit
584.86s - 590.98s |  And all of this is basically connecting your local area network where you have your PC Wi-Fi, etc
591.58s - 596.10s |  So the really interesting part is really this modem in the middle because this one is basically
596.34s - 602.46s |  Receiving the traffic from the satellite antenna and it's doing signal processing and it is all kinds of doing is doing all kinds of
602.74s - 604.74s |  control plane management, etc
605.18s - 608.10s |  And there are basically two kinds of traffic flowing through there
608.10s - 614.54s |  Usually these attacks and these talks at these conferences focus on internet traffic going from the antenna to this local area network
614.66s - 618.74s |  But we are only and exclusively focusing on the control plane traffic
618.74s - 624.14s |  And so this is oftentimes separated either with a VPN or so. It's in this in this specific case
624.14s - 629.38s |  It's the same physical channel and but we are only considering the control plane basically operating these modems
629.38s - 634.50s |  It has nothing to do with the actual LAN network and to keep everything that I'm going to talk about
634.82s - 638.70s |  Like all nice and mapped up. I did a little chart. So basically on the left side
638.70s - 643.30s |  We have the antenna and the right side our local area network and in the big in the middle a big
643.58s - 646.84s |  Question mark that we are slowly trying to to resolve
647.70s - 653.46s |  So first order of business as usual because it's pretty fun to open anything up. I guess most here agree
654.14s - 661.62s |  It's you get a nice little circuit board. Very unsurprising and if you actually look up these individual components you see for example demodulator
661.62s - 666.78s |  Which is well unsurprisingly doing demodulation. You see some digital analog converter
666.86s - 672.10s |  You see an FPGA which is doing a lot of signal processing since this is way too much to be handled by these
672.26s - 679.02s |  Lower and arm processors and then finally the microcontroller that we are going to focus on a some arm v5 to e microcontroller
679.98s - 683.30s |  So not much progress yet. We basically just knew that there is some
683.82s - 685.82s |  RF decoding signal processing
686.46s - 691.14s |  Stuff going on that that I'm personally not going to focus on since I'm doing more on the software side
691.14s - 695.82s |  And so what do we need for this? We actually need to dump the software off of this modem
696.42s - 698.34s |  and there
698.34s - 702.42s |  Plenty number of ways to do this. You could use like a bus pirate sold off the flash chips
703.06s - 707.26s |  It all seems pretty involved and I'm terrible with any kind of hardware
707.26s - 711.86s |  so I definitely keep my hands off of that and so instead these modems oftentimes have a
712.86s - 719.58s |  Questionable web UI when it comes to security and so when we basically look for blindly basically looks for some code injection
719.58s - 722.22s |  We found something obviously the code we only had afterwards
722.46s - 729.30s |  but basically this entire website is written as like bash scripts and the server is basically just a bunch of bash scripts and
729.78s - 732.38s |  If you basically insert the right string at the right time
732.38s - 736.86s |  Then you just get a proper command injection and can just open a remote shell. It's really that simple
737.86s - 742.70s |  And if you do this, then you have a nice mode and then if a nice console access to the actual modem
742.70s - 747.58s |  Which is even more useful than using a bus pirate since now we can actually run commands on the modem
747.86s - 751.22s |  All right. Let's actually do this. Let's figure out how all of this is working
751.82s - 756.62s |  So in this specific case, we when we see the network interface, we see some pretty regular stuff
756.62s - 758.22s |  ETH 0 pretty clear what that is
758.22s - 764.66s |  We see some to end network device, which are usually for VPNs and one device that is not very common called modem
765.26s - 767.18s |  So where is this coming from?
767.18s - 771.98s |  So usually some these network devices come from a specific kernel and in this case
771.98s - 775.54s |  There are in fact a few kernel objects that are shipped with this operating system
775.54s - 781.46s |  So we have something for DVB, which is basically the protocol or the underlying protocol of all of the satellite communication
781.46s - 786.02s |  So there's a pretty good hint something with new tech hardware abstraction layer also pretty good hint
786.06s - 788.86s |  so we search a little bit around in these kernel objects and
789.66s - 794.10s |  Yeah, we found exactly the code we were looking for. It's allocating some net device called modem
794.94s - 801.78s |  Perfect. We can also look in jitra into what kind of functions it exposing definitely some sending function not quite a receive function
801.78s - 803.78s |  But it's definitely working in some way
804.38s - 808.98s |  but interestingly when we kind of grab through the list of functions and search for common terms on
809.98s - 813.34s |  Cryptography like encrypting decrypting key exchange, etc
813.34s - 819.22s |  We didn't find anything and which is which doesn't mean that there is no encryption, but it's at least some kind of a hint
820.14s - 823.90s |  So to update our system app we have these drivers exposing this modem
823.90s - 827.58s |  Which doesn't seem to have any crypto and also when we went through a cold pass a little bit
827.58s - 833.10s |  We couldn't find anything. So we at this point. We're just assuming it as no basically data link layer protection here
833.70s - 837.30s |  And then the next question is basically what kind of applications are listening there?
837.30s - 843.02s |  So this modem interface is basically exposing network traffic and easy to consume on a Linux device
843.02s - 848.30s |  And you can just do accept listen receive blah blah the usual kind of setup and then there is for example
848.70s - 853.24s |  Application called TC net clients, which is some third-party software called from tele tech
853.54s - 859.02s |  So they basically ensure that the internet traffic is actually running but for the control plane that I'm talking about
859.02s - 862.54s |  We are caring really only about this modem controller and SW download
862.54s - 867.46s |  So two software packets or two to software applications running on the modem in the first one
867.46s - 872.06s |  We are going to focus on this modem controller and it kind of does exactly what the name says it controls
872.66s - 874.66s |  configuration on the modem
874.70s - 876.70s |  and when you basically look into the
877.26s - 878.66s |  initialization routine
878.66s - 882.14s |  We've kind of found what we are looking for that. There is at least some crypto
882.14s - 886.34s |  So that that seems pretty good at a first glance. So we have some modem crypt in it
886.34s - 892.82s |  We can see that it's reading some modem database and we can also see that it's using some private key pushing it somewhere
892.86s - 897.46s |  Okay, so there seems to be something going on with crypto, but I won't bore you with code all all the time
897.58s - 899.18s |  So
899.18s - 901.78s |  Basically, it's receiving a terminal private key
901.78s - 907.30s |  The terminal private key is exchanged when you first turn on this modem after you receive it from your satellite service provider
907.30s - 913.24s |  So it's exchanging this thing and then storing it kind of permanently on your device and then whenever you boot it up
913.58s - 919.14s |  It's loading this key and it's using this key as a key encryption key. What does a key encryption key do?
919.14s - 923.06s |  It encrypts keys and basically when you start up the modem
923.06s - 927.14s |  You receive two messages one session key message and one network configuration message
927.22s - 934.42s |  both of them control that key that is actually used to encrypt this specific traffic and a terminal private keys encoding both of these and
934.86s - 939.74s |  It works in a way that basically we have to hop and hop is sending a packet to the actual modem controller
940.14s - 944.04s |  In some hub terminal envelope, which is some Google proto buff protocol
944.58s - 950.14s |  And when we're looking at the code first line basically passes this proto buff into some predefined data structure
950.50s - 954.78s |  And then it's doing some interesting stuff. So first it's basically looking for some encryption flag
954.78s - 958.90s |  If it's not set it's basically discarding the packets if it's set it's going on
959.22s - 963.54s |  It's checking is the counter of the packet defined in this network packet zero
963.98s - 969.70s |  Then it's pretty interesting we define or we just assign the buffer to the message string if it's not zero
969.90s - 976.10s |  Then we actually decrypt it. So at least from this function if we set it to zero, we can just skip the
976.62s - 978.86s |  Decryption which is useful since we don't know the key
979.86s - 984.70s |  But there's definitely something more to it since if you just have counter zero
984.70s - 989.14s |  It might just be some key exchange protocol in the very beginning. So there might be some
990.02s - 993.58s |  Receive counter matching going on and that is exactly what we found
993.94s - 1001.30s |  so basically there's encryption manager and it has a receive counter match functionality and it takes the encryption manager and a packet counter and
1001.42s - 1007.92s |  Compares is it the actual expected counter? So if the previous one is 68 it expects the next one to be 69
1008.64s - 1012.04s |  That that sounds pretty nice. It sounds exactly like what we are looking for
1012.04s - 1018.68s |  and if we have to if the match is false, it's doing a second check which checks if the counter is unequal to zero and
1019.28s - 1026.12s |  Only then it's discarding the message, but interesting part is if the counter is zero, then it's not discarding the message
1026.12s - 1032.56s |  So basically this kind of exactly the thing that it's trying to prevent. It's not preventing. I guess there's some coding error
1032.56s - 1037.84s |  They probably meant to use some other counter probably the reference counter from the modem and not the one from the packets
1038.24s - 1043.64s |  But yeah, this basically allows us to kind of bypass the entire encryption of this modem controller
1043.64s - 1046.14s |  Which is maybe not quite as it was intended or maybe it was
1047.72s - 1054.44s |  All right, second part is this SW download application software updates are always fun from a security perspective, so let's take a look at that
1055.52s - 1059.64s |  So we have to hop and the hop is basically sending out update signal packets
1059.84s - 1065.84s |  Around once a second or ten times a second depending on the configuration and these update signal packets basically tell you hey
1065.84s - 1070.20s |  There's currently this software version available for this hardware revision on this port
1070.20s - 1075.44s |  So if you want to get it, just listen to me and an SW download decides this sounds interesting
1075.44s - 1082.00s |  I want to receive these packets and it's just subscribing to the correct multicast on a correct port and gets the current software version
1083.20s - 1084.64s |  Interestingly, there's no crypto on that
1084.64s - 1089.96s |  That's just UDP packets and anybody can just go to any modem and essentially just broadcast their own software update
1090.72s - 1094.00s |  But in just in case you're too lazy to kind of build your own
1094.36s - 1098.64s |  Linux operating system interface with the FPGA and everything it gets easier and
1099.36s - 1101.36s |  worse from a security perspective
1101.72s - 1106.26s |  So this also it's a vulnerability if missing encryption authentication is not enough
1106.80s - 1109.44s |  Basically, this is one of these update signaling packets
1109.68s - 1115.84s |  It's basically saying case some you image ID then it says octet for whatever reason and then it says, okay
1115.84s - 1119.00s |  There's a bulk size as a version that is associated with this specific update
1119.12s - 1125.28s |  There's a minimal version that you need etc. And this octet part is pretty interesting since this is the function that is passing this
1125.28s - 1131.32s |  I'm not making this up. And so basically has a static buffer of 80 bytes and then it's using a scan F with
1132.16s - 1137.04s |  Unlimited length string to pass this octet just this octet part
1138.04s - 1145.24s |  Well pretty pretty easy from that parts to to gain some kind of control over the PC, but it shouldn't be that simple, right?
1145.24s - 1148.24s |  There's still a SLR secondary. So it's something like that
1149.36s - 1152.08s |  Turns out they're using an ancient Linux version
1152.88s - 1157.84s |  Version two point six point thirty five of the kernel and now some of you might be thinking but hey
1157.84s - 1163.56s |  Why is this guy talking about some ancient technology that nobody or that that they found on some scrapyard?
1163.56s - 1170.82s |  No, this was freshly installed for us in 2022. So this is not something super old. This is something they newly shipped to customers
1171.46s - 1176.06s |  And also their office, you know secondary is because if you have Linux two point six point thirty five
1176.06s - 1178.06s |  You probably don't bother about this part anyway
1179.22s - 1184.88s |  So to conclude first, there's no data link protection in the in this modem kernel device
1185.14s - 1190.98s |  There is an encryption bypass on a modem controller, which is the only part in the control plane actually implementing crypto
1191.50s - 1194.86s |  We can just broadcast updates as we want to this modem
1194.86s - 1199.16s |  And if this is not enough, we can also have a fully unmitigated remote code execution
1200.04s - 1203.68s |  And we kind of tested all of this on a little bit wacky way basically
1203.68s - 1208.44s |  We are using the Ethernet port and reconfigure the fireball to send the packets to the to this modem network device
1209.08s - 1213.88s |  for for easier testing, but obviously way more interesting approach is to actually do it wirelessly and
1214.56s - 1219.40s |  What does a PhD student do when he doesn't want to figure out all of the wireless parts?
1219.48s - 1223.44s |  Find a perfect student to actually figure it out. And this is a Robins turn now
1226.48s - 1230.28s |  Yeah, so let's address this remaining question mark
1232.00s - 1237.56s |  For this we started again by opening up this box looking at what components are built in and
1238.24s - 1244.36s |  researching via their tech sheets and all resources we found how the hardware works and
1244.92s - 1246.92s |  From this we could already
1247.28s - 1254.96s |  Deduct that there are two separate signal processing pipelines one for the transmission and one for reception
1255.48s - 1261.23s |  in addition we had a handy tool in the web interface a
1261.75s - 1269.51s |  Diagnostic screen which provided us with the internal states of the modem including some states from the FPGA and
1270.83s - 1277.03s |  This confirmed our protocol assumptions and it proved to be very helpful when implementing our attacker
1277.55s - 1282.55s |  since we could see what packets have been parsed correctly and what isn't working yet and
1284.43s - 1288.03s |  Finally we had the binaries thanks to Joanna's work
1288.95s - 1293.27s |  Which also proved very helpful since some of the parsing logic
1293.79s - 1300.67s |  Was implemented in the kernel modules. So not on dedicated ICS and by studying that we
1301.23s - 1304.59s |  Could know what the modem expected us to transmit
1306.67s - 1308.19s |  with these
1308.19s - 1314.75s |  Three information sources. It became pretty clear that the protocol used here is DVB RCS
1315.31s - 1317.31s |  the DVB
1317.87s - 1321.19s |  Protocol suite comes from the TV broadcasting domain
1321.35s - 1326.91s |  But what's more important here is the RCS which stands for return channel over satellite
1327.59s - 1333.43s |  because we don't want to have these one-way transmissions, but we need a return channel for the
1334.15s - 1335.31s |  interactive
1335.31s - 1337.23s |  internet protocol
1337.23s - 1339.23s |  behavior
1339.27s - 1342.67s |  What's best about this protocol is also that it's open and
1343.31s - 1348.39s |  That's why there are lots of resources and specifications which are freely available
1350.55s - 1352.19s |  Also, it's
1352.19s - 1357.91s |  kind of a meta protocol because it leverages multiple sub protocols and
1358.15s - 1360.95s |  Defines how these sub protocols interact with each other
1362.39s - 1370.23s |  In this regard it's also important to mention s3p or set three play because new tech never talks about DVB RCS
1370.23s - 1375.79s |  but s3 play which is their proprietary implementation of DVB RCS and
1376.83s - 1382.07s |  Since it's their own implementation and proprietary there are some uniquenesses to it
1382.15s - 1389.91s |  so in some instances we found that they deviated a little bit from the specification or they used some custom features to
1390.71s - 1394.91s |  transmit some other compulsory data, which is required and
1395.15s - 1403.64s |  And now let's quickly go through these layers at the lowest layer with DVB s2
1404.36s - 1407.72s |  Which is the protocol which handles all the wireless stuff?
1408.04s - 1411.04s |  So if you're a bit familiar with these wireless protocols
1411.04s - 1417.16s |  It has all these basic features such as pretending a preamble to synchronize
1417.60s - 1425.16s |  Transmitter and receiver it defines what modulation schemes are supported and it also defines the error correction codes
1427.41s - 1430.93s |  One layer higher up we have MPEG transport streams
1430.93s - 1436.65s |  And their task is to bundle multiple data streams into one
1437.17s - 1439.17s |  bigger stream and
1440.37s - 1444.61s |  In this project we've only implemented the forward channel
1444.61s - 1445.69s |  so I'm
1445.69s - 1448.57s |  focusing on this forward channel from central hub to
1449.17s - 1455.01s |  Endpoints and since we have this star topology where one central hub transmits to multiple
1455.61s - 1462.25s |  Endpoints it's implemented as a broadcast channel that contains all these individual data streams, and that's why this
1462.77s - 1464.77s |  MPEG transport streams are so useful
1465.29s - 1472.01s |  They are constructed in a hierarchical way at the lowest layer or lowest level there are elementary streams
1472.01s - 1475.53s |  Which could be audio streams or video streams or in our?
1476.29s - 1482.09s |  context data streams these elementary streams are then bundled together to programs and
1482.77s - 1488.61s |  A transport stream can finally be made up of multiples of these programs
1489.65s - 1494.81s |  There's also some space for metadata or some configuration data
1494.97s - 1500.77s |  Which is used to transmit the structure of these streams, but also to initialize the modem
1503.48s - 1510.80s |  Because when the modem starts up it starts in a in an empty state and awaits instruction from the central hub
1511.64s - 1516.76s |  It has some pre-configured values such as a frequency and a symbol rate
1517.40s - 1520.24s |  For where to expect these initial values
1520.24s - 1526.84s |  And this is called the initial carrier and with this information transmitted on this carrier it learns
1527.12s - 1529.04s |  Where to tune next?
1529.04s - 1536.44s |  To learn the configuration values for the final carrier where the data streams are finally transmitted
1537.36s - 1544.72s |  In our attacker implementation we simplified things quite a bit, so we didn't transmit on three separate frequencies
1544.88s - 1548.64s |  but we use this flexibility of this transport streams to
1549.36s - 1555.40s |  Include all this information from the beginning and instruct the modem to retune over and over again
1555.76s - 1561.72s |  But each time the multiplex a different stream from within this same transport stream
1562.52s - 1563.76s |  and
1563.76s - 1570.32s |  This is like basically the high-level overview of this protocol. There's only one thing left which is
1570.84s - 1576.56s |  Called multi protocol encapsulation which is a thin wrapper around the IP packets
1576.72s - 1579.84s |  Such that they can be included in these MPEG transport streams
1580.40s - 1583.88s |  But from there on up it's really basic internet protocols IP
1584.60s - 1586.28s |  UDP and TCP
1586.28s - 1595.43s |  So with this knowledge and the understanding of these protocols we attempted our attacker implementation
1596.35s - 1600.27s |  We chose a software-defined radio based stack we
1601.03s - 1603.03s |  opted for a USRP
1603.63s - 1607.51s |  SDR, but really any other SDR could be chosen as well and
1608.55s - 1612.83s |  Since SDRs are somewhat restricted in their output frequencies
1612.91s - 1620.59s |  We also bought some off-the-shelf components for up converting these frequencies into the satellite frequency bands
1620.99s - 1625.27s |  For this modem, that's the KU and KA bands at roughly
1625.79s - 1631.59s |  10 to 10.7 gigahertz or I believe even up to 15 gigahertz and
1632.79s - 1634.99s |  this totaled in a cost of about
1635.63s - 1637.43s |  $2,000 but
1637.43s - 1645.19s |  I'm pretty sure that it could be significantly reduced if you used more do-it-yourself approach and didn't buy off-the-shelf components
1645.75s - 1650.89s |  For the software implementation we chose GNU radio
1651.69s - 1656.37s |  Popular framework for SDR applications and as already mentioned
1656.37s - 1662.13s |  we only implemented the forward channel since this what proved to be sufficient for our attacks and
1662.85s - 1666.61s |  Can radio was also chosen since we could leverage some of the
1667.49s - 1674.45s |  built-in components for DVB s2, but everything on top of it. We implemented ourselves in a custom module and
1677.81s - 1679.81s |  Through this approach we
1679.97s - 1687.97s |  Started at a state where the modern modem wasn't connected, but we iteratively improved our attacker to be able to finally
1688.65s - 1695.97s |  transmit some initialization such that the modem picked up the signal and finally we were able to transmit
1696.61s - 1704.37s |  Some messages here. You see a TCB dump on the modem itself and it successfully receives some hello world packages
1704.37s - 1705.81s |  We are transmitting
1705.81s - 1716.24s |  So if we briefly look again at this map
1716.64s - 1723.04s |  We are now capable of injecting arbitrary IP packets into the modems protocol
1723.80s - 1725.80s |  into the modems network stack
1728.16s - 1730.16s |  Now, let's look at some attacks
1730.56s - 1735.52s |  the first most basic one we are talking about is a jamming attack, but it is
1736.28s - 1740.84s |  Interesting in in this case because it acts as a building block for more advanced attacks
1741.80s - 1745.32s |  Because when we jam a modem it no longer
1745.84s - 1749.60s |  receives the required synchrony synchronization packets and
1750.20s - 1753.20s |  Configuration packets and as a result it
1753.84s - 1758.64s |  resets itself to the initial state and awaits new connection instructions and
1760.04s - 1765.40s |  this can be used by an attacker to break the connection of a running modem and
1765.84s - 1773.76s |  Then provide new initialization instructions to steer it away from the legitimate central hub to a malicious one and
1775.84s - 1780.16s |  Once initialized we can mount a malicious firmware update
1780.92s - 1782.64s |  attack as
1782.64s - 1788.36s |  Joannes has explained before this works by first transmitting a signalization packet
1789.00s - 1791.12s |  to one of these internal binaries
1791.84s - 1793.44s |  SW download
1793.44s - 1801.64s |  To signal that an update is available. What version is available and on what port on what UDP port to receive it and
1802.24s - 1809.08s |  if this version is higher than the currently installed version the modem will start listening on that port and
1809.80s - 1811.80s |  receive these messages and
1811.96s - 1818.24s |  Once again to I want to emphasize that these messages are neither authenticated nor encrypted
1818.28s - 1820.40s |  So it's easy to exploit this
1821.20s - 1823.96s |  And that's what we did. We transmitted a
1824.60s - 1830.64s |  Malicious update and as you can see in the logs it correctly receives these packets
1831.12s - 1833.56s |  It and it tries to install them
1834.20s - 1840.44s |  But we set in this case an invalid checksum to prevent the modem from breaking
1840.64s - 1845.80s |  since we had we needed to use it afterwards as well, but this proves that
1846.80s - 1852.60s |  A malicious firmware can be installed to basically do arbitrary damage
1853.32s - 1855.04s |  also to just
1855.04s - 1857.04s |  Execute the denial-of-service attack
1857.48s - 1866.55s |  The second attack I want to talk about is a remote code execution attack where we leverage the buffer overflow
1866.99s - 1872.39s |  Vulnerability Joannes has explained and we implemented this one with two payloads
1872.67s - 1880.91s |  One where we simply turn on an LED on the modem to have a visual indication and the second one where we opened a
1880.91s - 1882.95s |  reverse shell towards a host in the LAN
1883.95s - 1885.35s |  but
1885.35s - 1887.35s |  Thank you
1887.43s - 1894.31s |  but if the modem would be connected via return channel to the central hub
1894.91s - 1898.31s |  Such a reverse shell could also be opened to any connected host
1898.47s - 1902.99s |  We chose a host in the LAN because we haven't initialized the return channel
1904.47s - 1910.23s |  Now next I want to quickly show a demo of this attack it's this remote code execution and we
1911.55s - 1914.19s |  Implemented here the LED turn on
1915.03s - 1918.43s |  So that the transmission LED on the modem lights lightens up
1918.43s - 1924.23s |  It wouldn't turn on in this case because as mentioned again, the return channel isn't initialized
1925.51s - 1927.51s |  So here you see our attacker
1927.83s - 1929.83s |  the canoe radio implementation
1930.59s - 1936.95s |  Which starts transmitting and the up converter set up and on the other side of the room?
1936.99s - 1941.15s |  there's the transmitter with the web interface open and
1943.07s - 1945.43s |  It should pick up the signal any moment
1946.71s - 1949.39s |  initialize itself and
1950.95s - 1957.07s |  Once receiving the data the transmission LED the second from the right lightens up
1957.51s - 1969.59s |  So this works
1969.59s - 1975.79s |  Finally, we wanted to explore the conditions under which such an attack can be
1976.47s - 1979.03s |  successfully mounted and for this we
1980.03s - 1986.43s |  transmitted from different angles both in the horizontal plane and in the vertical plane to find out if
1986.79s - 1988.47s |  Such an attack is successful
1988.47s - 1995.23s |  Not only from in front of the modem because because the antenna is a directional antenna and must be directly
1995.83s - 1997.47s |  Targeted at the satellite
1997.47s - 2002.67s |  So it would be much more powerful if we can launch such an attack also from other angles
2002.67s - 2008.47s |  And we found that there is a range of angles from where such an attack can be
2008.99s - 2014.15s |  Successfully mounted not only from directly in front of it here shown in green
2015.27s - 2020.43s |  also, keep in mind that this data has been gathered in an anechoic chamber where
2021.27s - 2027.95s |  Reflections are minimized. So if this is performed in the real world where there are roofs and walls
2028.07s - 2032.75s |  You have much more reflections. And so the success ratio is only going up
2033.23s - 2043.15s |  We have also written a paper about this where we go a bit more into the details also about these conditions
2043.75s - 2046.47s |  If you're interested in that, please check it out
2046.47s - 2051.23s |  it's available online or we're also next week at USENIX in Philly and
2053.72s - 2055.72s |  Then then there's one last thing
2056.08s - 2060.04s |  So far we have talked about targeting one specific modem
2060.40s - 2067.04s |  but during our research we found out that the modem also supports broadcast transmissions and
2067.84s - 2075.64s |  this allows us to target any modem of this type without any prior information about its MAC address or
2075.64s - 2077.64s |  any other identifier and
2078.28s - 2082.88s |  This as a result allows us to target any modem that is in reach
2083.36s - 2084.84s |  and if you
2084.84s - 2090.76s |  Imagine an attacker that is not only capable of injecting signals directly by transmitting it to the modem
2090.76s - 2093.92s |  But also in the uplink by first transmitting to the satellite
2094.60s - 2100.92s |  It would be capable of not targeting only one modem, but all modems within an entire
2101.56s - 2103.76s |  Satellite beam which is an entire region
2104.48s - 2113.17s |  All right. So so what is the real-world impact of all of this?
2113.81s - 2115.65s |  Basically the setup that we bought
2115.65s - 2122.49s |  Is around $2,000 of where the up converter to converting from whatever 6 gigahertz SDR can do to KU band
2123.13s - 2124.81s |  Is the biggest part?
2124.81s - 2128.45s |  So if you have if you happen to have one of those around that's probably a lot cheaper for you
2128.45s - 2133.53s |  And usually you would also have an SDR. So then it's probably pretty easy to pull off
2134.33s - 2139.65s |  So these attacks should generally work on all the modems that use SAT 3 play not just MDM 2200
2139.69s - 2144.45s |  But they also plenty long list of other of these protocols not just SAT 3 play
2147.29s - 2152.33s |  Ultimately we assume that the market share of these modems is 10 to 20 percent out of a few million deployed
2152.33s - 2156.33s |  I know this is not a precise number, but it's pretty hard finding these kinds of numbers here
2157.77s - 2162.01s |  One important part that we skipped so far is the responsible disclosure process
2162.41s - 2167.09s |  So obviously new tech doesn't exist anymore and I direct took over their product
2167.09s - 2173.13s |  So we messaged I direct and we first sent the first emails to kind of all public email addresses two years ago
2173.13s - 2177.13s |  And then a few weeks afterwards again in November 2023
2177.13s - 2183.45s |  We send out another wave of emails including to high-ranking officials at the company that we found for example through LinkedIn, etc
2183.93s - 2190.53s |  And ultimately we disclosed and escalated vulnerabilities to the special Swiss National Cyber Security Center and CSC
2191.21s - 2195.21s |  After that and I direct asked for a reproducer script for these vulnerabilities
2195.73s - 2199.85s |  And we are now in a process of allocating CVS for these vulnerabilities
2200.61s - 2203.89s |  So what a kind of some kind of mitigations, obviously
2203.89s - 2209.25s |  that's a pretty broad question here since the the main problem is that we are lacking security from the
2209.57s - 2214.71s |  Foundation and a lot of parts and so obviously something like physical layer or data link layer security
2214.93s - 2219.33s |  For example for Mac layer encryption as we have seen on other modems would be an option
2219.61s - 2224.97s |  Source authentication through for example, the protocols actually validating that not some random network
2224.97s - 2232.29s |  Defcon guy is actually just sending the software update or on the network layer maybe IPSec or some other VPN solutions also
2232.77s - 2240.41s |  Maybe not using Linux kernel version 2.6 point 35 on something that has shipped these days is maybe also an option
2241.01s - 2241.65s |  But yeah
2241.65s - 2247.85s |  It's it's a pretty big pretty broad topic and obviously did it warrant the solution to the specific for example remote code execution should also be
2247.85s - 2249.73s |  pretty clear and
2249.73s - 2256.17s |  With that essentially we showed the reverse engineering of one of of one probably broadly used visa system
2256.17s - 2258.81s |  We identified numerous attack vectors and vulnerabilities
2258.81s - 2265.21s |  We also built a full end-to-end wireless attack where we really can just take an SDR and pawn a working modem
2265.73s - 2272.41s |  We successfully performed signal injection attack that way and we have a certain as we can be without actually testing it
2272.41s - 2277.65s |  Which is obviously not quite feasible and that is would work on a satellite ultimately breaking the beam
2278.25s - 2289.04s |  And we do have some time left
2289.04s - 2293.52s |  So if you have any questions, feel free to come to one of the microphones in the front
2294.04s - 2295.44s |  otherwise
2295.44s - 2309.68s |  Talk to us in a few minutes or so in the back. So I actually do have several questions
2310.36s - 2313.72s |  one of the big things with satellite modems is that they have
2314.68s - 2321.32s |  Legendary latency. I think that would be the kindest way to put it a lot of the problems with security
2322.04s - 2328.60s |  Applications in satellite environments is because you have very specific timeouts, right?
2328.64s - 2330.64s |  but a lot of these things are going like to
2331.28s - 2334.76s |  20,000 miles round trip in order to even finish a TCP connection
2334.76s - 2341.04s |  And so why IPSec which is pretty vulnerable to those latencies would that be a suggested in your opinion?
2341.56s - 2343.56s |  That's an excellent question
2345.28s - 2346.88s |  Maybe just don't use IPSec
2346.88s - 2353.60s |  I don't think that that is maybe the quite best option and other vendors use VPN solutions quite honestly
2353.60s - 2356.40s |  I don't know if they're based on IPSec. So maybe IPSec is not the best option
2356.40s - 2361.88s |  It's some some protocol like IPSec that implements ultimately some VPN is some some solution generally
2361.88s - 2365.12s |  I think it might be TLS that they might use. That's fair
2366.04s - 2372.47s |  All right. Thank you. And if you have any more questions, let us know
2373.63s - 2375.63s |  offstage


