# MediaChunks

chunk_id: 166_chunk_32
chunk_text:
second one between the GDT register base and the file jump segment 1701.10s - 1707.54s | selector. And the nice thing about this is we can actually reuse the same fake GDT for both 1707.54s - 1715.42s | core zero and core one. And the added bonus is we don't even need the spy bar anymore. The 1715.42s - 1719.90s | only thing that we really have to take care of is the SMM safe state once again for core one. 1719.90s - 1725.58s | For core zero we just do the same thing as before. But core one is going to be running in some 1725.58s - 1729.62s | unknown state. It could be running in ring three, ring zero, just in an unknown context. We 1729.62s - 1734.08s | have to bring it to the same controlled state as core zero. And we do so by using a kernel 1734.08s - 1739.32s | synchronization API. Which on Windows is the deferred procedure call. Or on Linux uh 1739.32s - 1745.80s | symmetric multiprocessing. And basically once that's done uh we have both cores in a known 1745.80s - 1751.60s | state. And we can use the same trick we did uh use for core zero. So all good things are 1751.60s - 1757.58s | three. So let's try again. The exploit this time is greatly simplified. And well the only 1757.58s - 1762.32s | thing we have to do is we create a fake GDT in the beginning of the address space. We choose 1762.32s - 1768.36s | the um base address within the descriptor accordingly. And that's it. And then when we 1768.36s - 1773.86s | trigger when we enable T-Close and run the uh SMM entry point code again. The all GDT this 1773.86s - 1779.06s | time around is going to point to the very end of the address space of the first four gigs. But 1779.06s - 1783.10s | then when the far jump happens it's going to wrap around. It's going to fetch the GDT 1783.10s - 1788.68s | descriptor entry from the beginning of the address space from our fake GDT. And then 1788.68s - 1792.94s | afterwards it's going to redirect execution for both core zero and core one to our own 1792.94s - 1798.38s | payload. And that finally worked. Well we managed to control both cores. Core zero and


chunk_id: 166_chunk_33
chunk_text:
we did uh use for core zero. So all good things are 1751.60s - 1757.58s | three. So let's try again. The exploit this time is greatly simplified. And well the only 1757.58s - 1762.32s | thing we have to do is we create a fake GDT in the beginning of the address space. We choose 1762.32s - 1768.36s | the um base address within the descriptor accordingly. And that's it. And then when we 1768.36s - 1773.86s | trigger when we enable T-Close and run the uh SMM entry point code again. The all GDT this 1773.86s - 1779.06s | time around is going to point to the very end of the address space of the first four gigs. But 1779.06s - 1783.10s | then when the far jump happens it's going to wrap around. It's going to fetch the GDT 1783.10s - 1788.68s | descriptor entry from the beginning of the address space from our fake GDT. And then 1788.68s - 1792.94s | afterwards it's going to redirect execution for both core zero and core one to our own 1792.94s - 1798.38s | payload. And that finally worked. Well we managed to control both cores. Core zero and core 1798.38s - 1805.18s | one uh our payload was executed with SMM privileges. And uh it would return gracefully from SMM 1805.18s - 1809.18s | to the operating system and nothing would crash. And that was great. There were only a couple 1809.18s - 1815.82s | of things that we wanted to improve uh in our exploit. And that was um to reload the GDT 1815.82s - 1822.20s | because the base actually is um a bit off. So we just reloaded the GDT so that the base 1822.20s - 1826.60s | address is equal zero again so that we don't have strange misalignment issues. We set up 1826.62s - 1831.90s | long modes uh so page tables, stack pointer etc. So we can execute like uh any SQL that we 1831.90s - 1837.46s | want. Uh and then we also install an SMI handler so that we only have to exploit the bug 1837.46s - 1843.58s | once and then basically we have kind of semi persistence and the whole system resets. Right? 1843.58s - 1849.34s | So for the demo just to show you I'm not selling just some snake oil. Uh we have a system 1849.36s


chunk_id: 166_chunk_34
chunk_text:
core 1798.38s - 1805.18s | one uh our payload was executed with SMM privileges. And uh it would return gracefully from SMM 1805.18s - 1809.18s | to the operating system and nothing would crash. And that was great. There were only a couple 1809.18s - 1815.82s | of things that we wanted to improve uh in our exploit. And that was um to reload the GDT 1815.82s - 1822.20s | because the base actually is um a bit off. So we just reloaded the GDT so that the base 1822.20s - 1826.60s | address is equal zero again so that we don't have strange misalignment issues. We set up 1826.62s - 1831.90s | long modes uh so page tables, stack pointer etc. So we can execute like uh any SQL that we 1831.90s - 1837.46s | want. Uh and then we also install an SMI handler so that we only have to exploit the bug 1837.46s - 1843.58s | once and then basically we have kind of semi persistence and the whole system resets. Right? 1843.58s - 1849.34s | So for the demo just to show you I'm not selling just some snake oil. Uh we have a system 1849.36s - 1854.36s | over here which is a Huawei Matebook V16 from two thousand uh twenty three. And you can 1858.10s - 1862.44s | see when the system boots it actually shows the Huawei logo. That logo is embedded in the 1862.44s - 1869.02s | firmware code. For that um so for our exploit we're actually going to modify that uh that logo. 1869.02s - 1875.82s | So um we're going to run our exploit with uh kernel privileges. So you'll see over here that 1875.84s - 1881.82s | we have to elevate privileges and it's going to be triggered via a malicious driver. And then 1881.82s - 1886.14s | our exploit is going to do uh three things. It's first it's going to use the synclose issue to 1886.14s - 1892.26s | elevate privileges to SMM. Then it's going to disable the spy flash protections. And then 1892.26s - 1897.86s | afterwards it's going to write to the spy flash the portion where the um boot splash logo is 1897.86s - 1902.74s | actually residing. This takes a little while about fifteen minutes so we just fast forward 1902.76s - 1909.36s | that portion. And you can see okay


chunk_id: 166_chunk_35
chunk_text:
- 1854.36s | over here which is a Huawei Matebook V16 from two thousand uh twenty three. And you can 1858.10s - 1862.44s | see when the system boots it actually shows the Huawei logo. That logo is embedded in the 1862.44s - 1869.02s | firmware code. For that um so for our exploit we're actually going to modify that uh that logo. 1869.02s - 1875.82s | So um we're going to run our exploit with uh kernel privileges. So you'll see over here that 1875.84s - 1881.82s | we have to elevate privileges and it's going to be triggered via a malicious driver. And then 1881.82s - 1886.14s | our exploit is going to do uh three things. It's first it's going to use the synclose issue to 1886.14s - 1892.26s | elevate privileges to SMM. Then it's going to disable the spy flash protections. And then 1892.26s - 1897.86s | afterwards it's going to write to the spy flash the portion where the um boot splash logo is 1897.86s - 1902.74s | actually residing. This takes a little while about fifteen minutes so we just fast forward 1902.76s - 1909.36s | that portion. And you can see okay it shows done patching. All good. And at this point we just 1909.36s - 1914.36s | reset the system and pray that it works. So let's see. Yeah this one takes a little while. And 1928.00s - 1941.80s | there we go. We're successful. So I mean this was just one example of what we can do with this 1941.80s - 1946.64s | kind of access into the system but let's take a more systematic approach to see whether this 1946.68s - 1950.96s | works on all systems or just on some. What does this actually depend on? So the next attack 1950.96s - 1957.56s | path um paths depend on how the platform is actually configured. Um so every vendor 1957.56s - 1962.00s | configures certain features that uh AMD provides to them. And specifically there are two of 1962.00s - 1967.30s | them which are key to this. One is room armor which can be used to restrict access to the 1967.30s - 1972.64s | portions of the spy flash. And the second one is platform secure boot which is AMD's 1972.68s - 1979.36s | equivalent of boot guard which will verify the initial stages of the firmware


chunk_id: 166_chunk_36
chunk_text:
it shows done patching. All good. And at this point we just 1909.36s - 1914.36s | reset the system and pray that it works. So let's see. Yeah this one takes a little while. And 1928.00s - 1941.80s | there we go. We're successful. So I mean this was just one example of what we can do with this 1941.80s - 1946.64s | kind of access into the system but let's take a more systematic approach to see whether this 1946.68s - 1950.96s | works on all systems or just on some. What does this actually depend on? So the next attack 1950.96s - 1957.56s | path um paths depend on how the platform is actually configured. Um so every vendor 1957.56s - 1962.00s | configures certain features that uh AMD provides to them. And specifically there are two of 1962.00s - 1967.30s | them which are key to this. One is room armor which can be used to restrict access to the 1967.30s - 1972.64s | portions of the spy flash. And the second one is platform secure boot which is AMD's 1972.68s - 1979.36s | equivalent of boot guard which will verify the initial stages of the firmware code. Um so if 1979.36s - 1984.26s | everything is enabled the very least thing that we can do is we can write to a portion of the 1984.26s - 1987.60s | spy flash where you have your variables live. So for instance in these variables you're going 1987.60s - 1993.50s | to have things like the secure boot uh keys which I used. So we can break secure boot. That's 1993.50s - 1998.40s | nice. Um but if nothing is enabled actually we have firmware implants. I'm going to explain in 1998.40s - 2002.10s | a moment uh what the difference actually is. So the first configuration whenever where 2002.10s - 2007.88s | everything is uh properly configured we see ok we escalate from the operating system to SMM 2007.88s - 2012.98s | and from there we can write to the let's say firmware uh data portion of the spy flash where 2012.98s - 2017.62s | the configurations are. So we can manipulate like secure boot keys so that afterwards we can 2017.62s - 2023.30s | actually load our own malicious boot loader before the OS loader runs. And the second 2023.30s - 2028.10s | configuration where the PSB


chunk_id: 166_chunk_37
chunk_text:
code. Um so if 1979.36s - 1984.26s | everything is enabled the very least thing that we can do is we can write to a portion of the 1984.26s - 1987.60s | spy flash where you have your variables live. So for instance in these variables you're going 1987.60s - 1993.50s | to have things like the secure boot uh keys which I used. So we can break secure boot. That's 1993.50s - 1998.40s | nice. Um but if nothing is enabled actually we have firmware implants. I'm going to explain in 1998.40s - 2002.10s | a moment uh what the difference actually is. So the first configuration whenever where 2002.10s - 2007.88s | everything is uh properly configured we see ok we escalate from the operating system to SMM 2007.88s - 2012.98s | and from there we can write to the let's say firmware uh data portion of the spy flash where 2012.98s - 2017.62s | the configurations are. So we can manipulate like secure boot keys so that afterwards we can 2017.62s - 2023.30s | actually load our own malicious boot loader before the OS loader runs. And the second 2023.30s - 2028.10s | configuration where the PSB is not enabled we have basically the same scenario. Um 2028.10s - 2033.10s | Roam armor will still restrict write access to um to the data portion and we can we can still 2036.38s - 2042.28s | just um uh inject our own boot kits. And the third configuration we can write to even 2042.28s - 2048.18s | firmware code but that's going to be still verified by platform secure boot. So ok and these 2048.18s - 2052.50s | three we have the same scenario we can just inject a boot kit which is still nice because it 2052.52s - 2056.60s | runs before the OS loader. Any protections provided by the operating system would still be 2056.60s - 2063.60s | um rendered null. But in the last scenario where none of these features are enabled what we 2063.60s - 2069.14s | can do is we can inject our uh malware into the spy flash into the firmware code portion of it. 2069.14s - 2075.64s | And when that happens uh is what we're going to get is we can um run our own malware at the 2075.64s - 2080.62s | very earliest stage of the boot process. And there's


chunk_id: 166_chunk_38
chunk_text:
is not enabled we have basically the same scenario. Um 2028.10s - 2033.10s | Roam armor will still restrict write access to um to the data portion and we can we can still 2036.38s - 2042.28s | just um uh inject our own boot kits. And the third configuration we can write to even 2042.28s - 2048.18s | firmware code but that's going to be still verified by platform secure boot. So ok and these 2048.18s - 2052.50s | three we have the same scenario we can just inject a boot kit which is still nice because it 2052.52s - 2056.60s | runs before the OS loader. Any protections provided by the operating system would still be 2056.60s - 2063.60s | um rendered null. But in the last scenario where none of these features are enabled what we 2063.60s - 2069.14s | can do is we can inject our uh malware into the spy flash into the firmware code portion of it. 2069.14s - 2075.64s | And when that happens uh is what we're going to get is we can um run our own malware at the 2075.64s - 2080.62s | very earliest stage of the boot process. And there's a key difference here between a 2080.64s - 2087.92s | firmware implant and uh a boot kit is that this attack actually is resistant to uh to OS 2087.92s - 2093.22s | reinstallations. So even if you wipe your drive it's still going to be around. Um and even if 2093.22s - 2096.92s | you try to push a firmware update from the operating system it's still going to be around 2096.92s - 2102.80s | because the uh the malware can just say well the update was successful. Um and the only way 2102.80s - 2108.94s | to really get rid of it at that point is to take apart your system, take a spy programmer to 2108.96s - 2113.96s | read out the spy flash, inspect it and if it's infected um just uh rewrite it. But typically 2117.90s - 2123.44s | it's not really in the repertoire of a typical IT guy right? So to illustrate how prevalent 2123.44s - 2127.84s | actually these misconfigurations are we did some research last year on that and we saw that 2127.84s - 2132.04s | the majority of the systems have none of the security features actually enabled. Which 2132.04s -


chunk_id: 166_chunk_39
chunk_text:
a key difference here between a 2080.64s - 2087.92s | firmware implant and uh a boot kit is that this attack actually is resistant to uh to OS 2087.92s - 2093.22s | reinstallations. So even if you wipe your drive it's still going to be around. Um and even if 2093.22s - 2096.92s | you try to push a firmware update from the operating system it's still going to be around 2096.92s - 2102.80s | because the uh the malware can just say well the update was successful. Um and the only way 2102.80s - 2108.94s | to really get rid of it at that point is to take apart your system, take a spy programmer to 2108.96s - 2113.96s | read out the spy flash, inspect it and if it's infected um just uh rewrite it. But typically 2117.90s - 2123.44s | it's not really in the repertoire of a typical IT guy right? So to illustrate how prevalent 2123.44s - 2127.84s | actually these misconfigurations are we did some research last year on that and we saw that 2127.84s - 2132.04s | the majority of the systems have none of the security features actually enabled. Which 2132.04s - 2136.36s | means all the systems which have none of the features enabled are vulnerable to firmware 2136.38s - 2141.98s | implants. Which is pretty bad. And to put a cherry on top we also found that once you're 2141.98s - 2146.62s | infected with that kind of uh firmware implant you can even disable platform secure boot 2146.62s - 2151.76s | forever by burning a specific fuse so that your system remains vulnerable to firmware uh 2151.76s - 2156.76s | implant reinfections forever. Sweet. So let's wrap up the presentation. Thanks Christoph. 2157.24s - 2165.21s | So yeah. In terms of affected systems right? Pretty much all of them. Uh yeah. Um our tests 2173.45s - 2180.45s | were on Ryzen mostly. Several laptops. Uh but turns out the Threat Reaper series is also 2180.45s - 2185.47s | affected. Epic series is also affected. Meaning servers. Um and yeah uh due to the longevity 2189.95s - 2194.95s | of this this this thing we can estimate the total number of affected chips are in around 2197.75s - 2202.75s | the hundreds of millions. Um there's an advisory from AMD published now um where more 2205.63s - 2211.89s | information


chunk_id: 166_chunk_40
chunk_text:
2136.36s | means all the systems which have none of the features enabled are vulnerable to firmware 2136.38s - 2141.98s | implants. Which is pretty bad. And to put a cherry on top we also found that once you're 2141.98s - 2146.62s | infected with that kind of uh firmware implant you can even disable platform secure boot 2146.62s - 2151.76s | forever by burning a specific fuse so that your system remains vulnerable to firmware uh 2151.76s - 2156.76s | implant reinfections forever. Sweet. So let's wrap up the presentation. Thanks Christoph. 2157.24s - 2165.21s | So yeah. In terms of affected systems right? Pretty much all of them. Uh yeah. Um our tests 2173.45s - 2180.45s | were on Ryzen mostly. Several laptops. Uh but turns out the Threat Reaper series is also 2180.45s - 2185.47s | affected. Epic series is also affected. Meaning servers. Um and yeah uh due to the longevity 2189.95s - 2194.95s | of this this this thing we can estimate the total number of affected chips are in around 2197.75s - 2202.75s | the hundreds of millions. Um there's an advisory from AMD published now um where more 2205.63s - 2211.89s | information on the system the affected systems and cover uh that there's a microcode update 2211.89s - 2216.89s | now. Information is there and so you can check. Mitigations. Yeah AMD as I just mentioned 2219.73s - 2225.55s | is just set. Provided um with microcode updates. However it might not cover all of the 2225.55s - 2230.55s | affected systems. Of course um in terms of what an OEM can do, they can just modify the 2233.31s - 2240.03s | SMM entry point code to detect if the T-Close bit is set. And if it is then just abort the 2240.03s - 2245.87s | execution and this this will just render the exploitation unfeasible. Uh this can even be 2245.87s - 2250.89s | done at the EDK 2 level for AMD system right? And we wrote we really haven't covered here 2253.71s - 2259.65s | core boot but core boot is affected in the same way. We just I mean um core boot does the 2259.65s - 2264.29s | very beginning of the entry point performs a low GDT. They have to go to protected mode as 2264.29s - 2270.83s | well so it's it's the same thing. Um and


chunk_id: 166_chunk_41
chunk_text:
on the system the affected systems and cover uh that there's a microcode update 2211.89s - 2216.89s | now. Information is there and so you can check. Mitigations. Yeah AMD as I just mentioned 2219.73s - 2225.55s | is just set. Provided um with microcode updates. However it might not cover all of the 2225.55s - 2230.55s | affected systems. Of course um in terms of what an OEM can do, they can just modify the 2233.31s - 2240.03s | SMM entry point code to detect if the T-Close bit is set. And if it is then just abort the 2240.03s - 2245.87s | execution and this this will just render the exploitation unfeasible. Uh this can even be 2245.87s - 2250.89s | done at the EDK 2 level for AMD system right? And we wrote we really haven't covered here 2253.71s - 2259.65s | core boot but core boot is affected in the same way. We just I mean um core boot does the 2259.65s - 2264.29s | very beginning of the entry point performs a low GDT. They have to go to protected mode as 2264.29s - 2270.83s | well so it's it's the same thing. Um and actually core boot they are checking for this uh for 2270.83s - 2274.81s | for other issues as well at the entry point so they could they could very well do this. 2275.51s - 2280.51s | Um and users well they can you know a hypervisor could trap the access on the T-Sec mask MSR 2283.25s - 2288.25s | so that's another uh way to stop this. Timeline wise well we reported this back in October 2291.39s - 2296.39s | to 2023. A CVE of 2023 uh 31315 was assigned in November and then we discussed mitigations 2299.23s - 2304.71s | and impact with AMD over the course of the next months. Um and yeah finally yesterday 2304.83s - 2310.97s | um the advisory was published and we are here at DEF CON today. This was the official AMD 2310.97s - 2315.99s | response. Essentially we work with them in a process of uh responsible disclosure and yeah 2319.89s - 2326.23s | they've been great to work with. Conclusions and takeaways. While the vulnerability has been 2326.23s - 2331.25s | around for nearly 2 decades um the complexity of the architecture clearly plays in favor of 2331.55s - 2336.55s |


chunk_id: 166_chunk_42
chunk_text:
actually core boot they are checking for this uh for 2270.83s - 2274.81s | for other issues as well at the entry point so they could they could very well do this. 2275.51s - 2280.51s | Um and users well they can you know a hypervisor could trap the access on the T-Sec mask MSR 2283.25s - 2288.25s | so that's another uh way to stop this. Timeline wise well we reported this back in October 2291.39s - 2296.39s | to 2023. A CVE of 2023 uh 31315 was assigned in November and then we discussed mitigations 2299.23s - 2304.71s | and impact with AMD over the course of the next months. Um and yeah finally yesterday 2304.83s - 2310.97s | um the advisory was published and we are here at DEF CON today. This was the official AMD 2310.97s - 2315.99s | response. Essentially we work with them in a process of uh responsible disclosure and yeah 2319.89s - 2326.23s | they've been great to work with. Conclusions and takeaways. While the vulnerability has been 2326.23s - 2331.25s | around for nearly 2 decades um the complexity of the architecture clearly plays in favor of 2331.55s - 2336.55s | attackers and we see this uh with the flexibility of of of the GDT. Um the 2 types of 2339.65s - 2344.65s | wraparounds the the the byte level uh um address um like granularity that there is with it no 2346.89s - 2351.89s | problem. Um and also with the how the MSRs can be accessed without any restriction. Uh that 2355.67s - 2361.17s | that's that's all good for attackers right? Um these things combined are what what 2361.39s - 2366.39s | made this exploit approach possible. It might be on other exploit methods too. Um but yeah 2369.77s - 2375.47s | all of this of of course requires an in depth understanding of the architecture and in the end 2375.47s - 2380.77s | we managed to exploit this without requiring physical presence. So that's very good. And yeah 2380.77s - 2387.46s | exploit code will be released soon so stay tuned for that. Questions? 2387.78s - 2399.37s | Is there a microphone? Okay. Oh there's some stuff. Uh uh hello. Um it wasn't entirely 2411.06s - 2416.06s | clear to me. Is the spy flash chip you're referring to on the uh CPU die or is it


chunk_id: 166_chunk_43
chunk_text:
attackers and we see this uh with the flexibility of of of the GDT. Um the 2 types of 2339.65s - 2344.65s | wraparounds the the the byte level uh um address um like granularity that there is with it no 2346.89s - 2351.89s | problem. Um and also with the how the MSRs can be accessed without any restriction. Uh that 2355.67s - 2361.17s | that's that's all good for attackers right? Um these things combined are what what 2361.39s - 2366.39s | made this exploit approach possible. It might be on other exploit methods too. Um but yeah 2369.77s - 2375.47s | all of this of of course requires an in depth understanding of the architecture and in the end 2375.47s - 2380.77s | we managed to exploit this without requiring physical presence. So that's very good. And yeah 2380.77s - 2387.46s | exploit code will be released soon so stay tuned for that. Questions? 2387.78s - 2399.37s | Is there a microphone? Okay. Oh there's some stuff. Uh uh hello. Um it wasn't entirely 2411.06s - 2416.06s | clear to me. Is the spy flash chip you're referring to on the uh CPU die or is it external? 2419.34s - 2424.34s | External. Okay. Yes. Yep. Hi how are you? We were talking with Enrique that this is 2425.06s - 2429.76s | interesting also to bypass an anti-cheat system right? Uh in the video game industry. Um 2429.76s - 2434.76s | PlayStation 5 runs on an MID chip. Uh is is is it also vulnerable or is it uh a different 2439.76s - 2446.28s | kind of chip and it doesn't affect it? Thank you. Um so I'm sorry if if I understood your 2446.28s - 2451.14s | question correctly was about bypassing uh anti-cheat systems uh using this method? 2451.18s - 2456.18s | No installing something to bypass uh the anti-cheat systems and uh uh once you achieve 2459.46s - 2464.46s | arbitrary code execution in SMM uh yeah pretty much uh like modern anti-cheat systems 2467.70s - 2472.90s | running uh either kernel or even maybe a hypervisor level could could could run and and 2472.90s - 2477.90s | this this runs even below that if that makes sense. Um but uh since uh MID has disclosed 2478.74s - 2483.74s | the processors that are vulnerable to this attack it is the it is not


chunk_id: 166_chunk_44
chunk_text:
external? 2419.34s - 2424.34s | External. Okay. Yes. Yep. Hi how are you? We were talking with Enrique that this is 2425.06s - 2429.76s | interesting also to bypass an anti-cheat system right? Uh in the video game industry. Um 2429.76s - 2434.76s | PlayStation 5 runs on an MID chip. Uh is is is it also vulnerable or is it uh a different 2439.76s - 2446.28s | kind of chip and it doesn't affect it? Thank you. Um so I'm sorry if if I understood your 2446.28s - 2451.14s | question correctly was about bypassing uh anti-cheat systems uh using this method? 2451.18s - 2456.18s | No installing something to bypass uh the anti-cheat systems and uh uh once you achieve 2459.46s - 2464.46s | arbitrary code execution in SMM uh yeah pretty much uh like modern anti-cheat systems 2467.70s - 2472.90s | running uh either kernel or even maybe a hypervisor level could could could run and and 2472.90s - 2477.90s | this this runs even below that if that makes sense. Um but uh since uh MID has disclosed 2478.74s - 2483.74s | the processors that are vulnerable to this attack it is the it is not disclosed in 2486.08s - 2491.08s | PlayStation 5 which has MID. So that's what I was asking if maybe it's also yeah. Ah okay. 2499.16s - 2504.24s | But yeah I'm sorry I I don't know uh I I don't understand your question correctly. 2504.24s - 2509.24s | The the PlayStation 5 hypervisor blocks the MSR. Oh. Uh if it's for that yes. The the yes. 2511.04s - 2516.04s | We we check that. And it is being trapped by the hypervisor layer on the place. Yes. Sorry. 2518.72s - 2524.88s | Hey thank you. Um quick question. Um why didn't disabling SMT prevent the system from 2524.88s - 2531.90s | becoming unstable? Uh yes so the SMT when we try to disable it um essentially what 2531.90s - 2537.14s | happened is the other logical core will just not run but it still be there and it will 2537.14s - 2541.40s | be the all the entry points and um will be already configured by the firmware if that 2541.40s - 2546.38s | makes sense. So when the SMI happens it was a level underneath I mean it won't you won't 2546.38s - 2553.12s | see the processor available


chunk_id: 166_chunk_45
chunk_text:
disclosed in 2486.08s - 2491.08s | PlayStation 5 which has MID. So that's what I was asking if maybe it's also yeah. Ah okay. 2499.16s - 2504.24s | But yeah I'm sorry I I don't know uh I I don't understand your question correctly. 2504.24s - 2509.24s | The the PlayStation 5 hypervisor blocks the MSR. Oh. Uh if it's for that yes. The the yes. 2511.04s - 2516.04s | We we check that. And it is being trapped by the hypervisor layer on the place. Yes. Sorry. 2518.72s - 2524.88s | Hey thank you. Um quick question. Um why didn't disabling SMT prevent the system from 2524.88s - 2531.90s | becoming unstable? Uh yes so the SMT when we try to disable it um essentially what 2531.90s - 2537.14s | happened is the other logical core will just not run but it still be there and it will 2537.14s - 2541.40s | be the all the entry points and um will be already configured by the firmware if that 2541.40s - 2546.38s | makes sense. So when the SMI happens it was a level underneath I mean it won't you won't 2546.38s - 2553.12s | see the processor available at the OS level but all all the layout and and and and at at 2553.12s - 2558.16s | yeah at the deeper level the the logical core is still there if that makes sense. Yes it 2558.16s - 2565.10s | does. So we have to deal with that regardless. Yes we try it. Thank you. Hello. Do you know 2565.12s - 2570.22s | what uh changes AMD microcode update made? Um I'm sorry could you could you speak up 2570.22s - 2576.40s | louder? I'm sorry. Do you know what changes AMD microcode update made to mitigate this issue? 2576.40s - 2581.40s | Oh interesting question. Uh yes. Um no I mean officially we don't. Uh. Um what uh we 2581.40s - 2586.40s | don't. That's a long and short of it. Uh yes. I think we're good. Okay well if no more 2606.58s - 2608.98s | questions thank you so much for joining us today.


chunk_id: 166_chunk_46
chunk_text:
at the OS level but all all the layout and and and and at at 2553.12s - 2558.16s | yeah at the deeper level the the logical core is still there if that makes sense. Yes it 2558.16s - 2565.10s | does. So we have to deal with that regardless. Yes we try it. Thank you. Hello. Do you know 2565.12s - 2570.22s | what uh changes AMD microcode update made? Um I'm sorry could you could you speak up 2570.22s - 2576.40s | louder? I'm sorry. Do you know what changes AMD microcode update made to mitigate this issue? 2576.40s - 2581.40s | Oh interesting question. Uh yes. Um no I mean officially we don't. Uh. Um what uh we 2581.40s - 2586.40s | don't. That's a long and short of it. Uh yes. I think we're good. Okay well if no more 2606.58s - 2608.98s | questions thank you so much for joining us today.


chunk_id: 167_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=pri4EJ0634c", "title": "DEF CON 32 - What History\u2019s Greatest Heist Can Teach Us About Defense In Depth - Pete Stegemeyer", "description": "What\u2019s the real life equivalent of hacking a Gibson? Probably stealing hundreds of millions of dollars in diamonds, gold, and cash from one of the world's most formidable vaults. In 2003, a team of thieves did just that. Armed with hairspray, double sided tape, and nerves of steel, these thieves defeated layer after layer of security to pull off the haul of a lifetime.\n\nHowever, as much as this is a story of skilled criminals, it is every bit as much a story of security failures and the parallels between protecting diamonds and data. In this presentation we\u2019ll dive deep into what went right, what went wrong, and how to properly apply defense in depth to make your security program look like a hundred million bucks.\n\nDavis, J. (2009, March 12). The untold story of the World\u2019s biggest Diamond Heist. Wired. link\nSelby, S. A., & Campbell, G. (2012). Flawless: Inside the largest diamond heist in history. Sterling.\nStegemeyer, P. (2021). Heist: An inside look at the world\u2019s 100 Greatest Heists, cons, and capers: From burglaries to bank jobs and everything in between. Whalen Book Works.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1787, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.05s - 5.05s | This text was transcribed using whisper model: large-v2 And with that, the stage is yours. Alright, awesome. Alright, perfect. Uh, can everybody 7.95s - 12.95s | hear me okay? Excellent. Okay. I got that. That was good. Uh, awesome. Uh, so my name is Pete 15.79s - 22.53s | Stegmaier. Uh, this is a treasure trove of failures. What history's greatest heist can teach 22.53s - 28.33s | us about defense in depth. Uh, who am I? Uh, I'm Pete Stegmaier. You're probably tired of 28.33s - 33.55s | hearing that by now. I'm kind of tired of saying it. Uh, I've been a senior security engineer 33.55s - 38.55s | for seven years. Uh, in addition to that, I am a heist expert and it feels really douchey to 40.99s - 47.13s | say that. Uh, it's true though. Uh, History Channel, Vice, uh, National Geographic have all 47.13s - 52.09s | called me up and asked for like consultations. I've done, uh, history's greatest heist with 52.09s - 58.27s | Pierce Brosnan, uh, as an expert. Uh, and


chunk_id: 167_chunk_1
chunk_text:
in between. Whalen Book Works.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1787, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.05s - 5.05s | This text was transcribed using whisper model: large-v2 And with that, the stage is yours. Alright, awesome. Alright, perfect. Uh, can everybody 7.95s - 12.95s | hear me okay? Excellent. Okay. I got that. That was good. Uh, awesome. Uh, so my name is Pete 15.79s - 22.53s | Stegmaier. Uh, this is a treasure trove of failures. What history's greatest heist can teach 22.53s - 28.33s | us about defense in depth. Uh, who am I? Uh, I'm Pete Stegmaier. You're probably tired of 28.33s - 33.55s | hearing that by now. I'm kind of tired of saying it. Uh, I've been a senior security engineer 33.55s - 38.55s | for seven years. Uh, in addition to that, I am a heist expert and it feels really douchey to 40.99s - 47.13s | say that. Uh, it's true though. Uh, History Channel, Vice, uh, National Geographic have all 47.13s - 52.09s | called me up and asked for like consultations. I've done, uh, history's greatest heist with 52.09s - 58.27s | Pierce Brosnan, uh, as an expert. Uh, and I had a podcast and a book, uh, also about a bunch 58.27s - 63.27s | of different heists. Um, so today I wanted to talk about my favorite heist and the parallels 65.87s - 72.45s | between a real world attack and, uh, something that we can do in the digital world and how we 72.45s - 80.23s | can either defend against that or exploit it depending on why you're here. Alright, so, uh, 80.27s - 84.87s | we're gonna be talking about the Antwerp Diamond Heist. Uh, this happened, uh, between 84.87s - 89.87s | February 15th and 16th in February of 2003. Uh, Antwerp, Belgium. Uh, this was pulled off 92.15s - 96.75s | by the school of Turin. Uh, we're just gonna do a little bit of like details about everything 96.75s - 102.29s | first and then we'll get into the process. And what ended up being stolen was between a 102.29s - 107.29s | hundred million and a billion dollars worth of, uh, diamonds, gold, jewels, stocks, 110.43s - 116.07s | uh, and the reason that there is a 900 million dollar range is because what was targeted 116.07s - 120.77s | was


chunk_id: 167_chunk_2
chunk_text:
I had a podcast and a book, uh, also about a bunch 58.27s - 63.27s | of different heists. Um, so today I wanted to talk about my favorite heist and the parallels 65.87s - 72.45s | between a real world attack and, uh, something that we can do in the digital world and how we 72.45s - 80.23s | can either defend against that or exploit it depending on why you're here. Alright, so, uh, 80.27s - 84.87s | we're gonna be talking about the Antwerp Diamond Heist. Uh, this happened, uh, between 84.87s - 89.87s | February 15th and 16th in February of 2003. Uh, Antwerp, Belgium. Uh, this was pulled off 92.15s - 96.75s | by the school of Turin. Uh, we're just gonna do a little bit of like details about everything 96.75s - 102.29s | first and then we'll get into the process. And what ended up being stolen was between a 102.29s - 107.29s | hundred million and a billion dollars worth of, uh, diamonds, gold, jewels, stocks, 110.43s - 116.07s | uh, and the reason that there is a 900 million dollar range is because what was targeted 116.07s - 120.77s | was actually safety deposit boxes and a lot of times people don't like to claim what they 120.77s - 126.21s | have in there. So there's no way of actually knowing. And the reason that this, uh, 126.21s - 131.29s | happened, believe it or not, like the team, the thieves were very talented, but it would 131.29s - 136.79s | not have been possible without just a cascade of failures on behalf of the security team as 136.79s - 141.23s | well. Uh, so we're gonna go ahead and start getting into that. Uh, first let's set the scene 141.23s - 147.23s | with the Diamond Center itself. This is actually, uh, this is kind of like a nested 147.23s - 153.07s | facility. Uh, so the Antwerp Diamond Center handles 80 percent of global diamond 153.07s - 158.91s | transactions. Uh, so it's a pretty, pretty major throw point, uh, for anybody to try to 158.91s - 163.95s | attack and because of that a lot of people thought that it was too big to attack. Uh, it is 163.95s - 169.99s | in the most secure part of Antwerp. They have a dedicated private police force as well


chunk_id: 167_chunk_3
chunk_text:
actually safety deposit boxes and a lot of times people don't like to claim what they 120.77s - 126.21s | have in there. So there's no way of actually knowing. And the reason that this, uh, 126.21s - 131.29s | happened, believe it or not, like the team, the thieves were very talented, but it would 131.29s - 136.79s | not have been possible without just a cascade of failures on behalf of the security team as 136.79s - 141.23s | well. Uh, so we're gonna go ahead and start getting into that. Uh, first let's set the scene 141.23s - 147.23s | with the Diamond Center itself. This is actually, uh, this is kind of like a nested 147.23s - 153.07s | facility. Uh, so the Antwerp Diamond Center handles 80 percent of global diamond 153.07s - 158.91s | transactions. Uh, so it's a pretty, pretty major throw point, uh, for anybody to try to 158.91s - 163.95s | attack and because of that a lot of people thought that it was too big to attack. Uh, it is 163.95s - 169.99s | in the most secure part of Antwerp. They have a dedicated private police force as well 169.99s - 175.13s | as a local police force located just outside the facility. Uh, and because this is like 175.13s - 181.53s | basically a neighborhood in Antwerp, um, in addition to having all that policing, they 181.53s - 186.27s | also had, uh, a way to control traffic. So like a traffic control point, uh, with those 186.27s - 190.45s | little car catchers, the little hydraulic spikes that come up, so they could literally 190.45s - 194.89s | control all of the cars coming in and out of this controlled area. And then there were 194.89s - 199.99s | multiple blocks of this Diamond Center, um, where different offices and different jewelers 199.99s - 203.89s | could rent office space and things like that. So there were actually three buildings, A, B, 203.89s - 210.81s | and C block. Uh, and let's get to the vault. Uh, I tried real hard to do like the Ocean's 210.81s - 217.45s | Eleven, George Clooney, real smooth, like, uh, I, I can't do it. And I, like, they said 217.45s - 220.35s | something about copyright. I'm kind of scared. I don't want this taken down. So we're just


chunk_id: 167_chunk_4
chunk_text:
169.99s - 175.13s | as a local police force located just outside the facility. Uh, and because this is like 175.13s - 181.53s | basically a neighborhood in Antwerp, um, in addition to having all that policing, they 181.53s - 186.27s | also had, uh, a way to control traffic. So like a traffic control point, uh, with those 186.27s - 190.45s | little car catchers, the little hydraulic spikes that come up, so they could literally 190.45s - 194.89s | control all of the cars coming in and out of this controlled area. And then there were 194.89s - 199.99s | multiple blocks of this Diamond Center, um, where different offices and different jewelers 199.99s - 203.89s | could rent office space and things like that. So there were actually three buildings, A, B, 203.89s - 210.81s | and C block. Uh, and let's get to the vault. Uh, I tried real hard to do like the Ocean's 210.81s - 217.45s | Eleven, George Clooney, real smooth, like, uh, I, I can't do it. And I, like, they said 217.45s - 220.35s | something about copyright. I'm kind of scared. I don't want this taken down. So we're just 220.35s - 225.35s | going to describe this vault and I am not George Clooney. Um, so the first, uh, this vault 227.73s - 234.19s | is a marvel of engineering. Um, it's my favorite vault. Uh, it's weird to have one, but this 234.19s - 240.23s | is it. Uh, and it's got some really, it's got ten different security features baked into it. 240.23s - 245.25s | Um, number one is a combination lock or a combination dial with a hundred million 245.25s - 250.25s | possible combinations. Uh, it is a foot thick of solid steel and there is a 12 inch long key 253.65s - 257.83s | that actually gets separated into two different parts. So there's like the stick part and then 257.83s - 263.83s | the actual teeth, uh, or the comb of the, uh, the key. Then there's a day gate. So if you 263.83s - 269.33s | open up that first gate, there's still, you know, another, uh, another door stopping you. 269.33s - 274.81s | There's a magnetic sensor that detects if the door is opened. So if that magnetic field 274.83s - 281.71s | breaks, it triggers an alarm. There


chunk_id: 167_chunk_5
chunk_text:
220.35s - 225.35s | going to describe this vault and I am not George Clooney. Um, so the first, uh, this vault 227.73s - 234.19s | is a marvel of engineering. Um, it's my favorite vault. Uh, it's weird to have one, but this 234.19s - 240.23s | is it. Uh, and it's got some really, it's got ten different security features baked into it. 240.23s - 245.25s | Um, number one is a combination lock or a combination dial with a hundred million 245.25s - 250.25s | possible combinations. Uh, it is a foot thick of solid steel and there is a 12 inch long key 253.65s - 257.83s | that actually gets separated into two different parts. So there's like the stick part and then 257.83s - 263.83s | the actual teeth, uh, or the comb of the, uh, the key. Then there's a day gate. So if you 263.83s - 269.33s | open up that first gate, there's still, you know, another, uh, another door stopping you. 269.33s - 274.81s | There's a magnetic sensor that detects if the door is opened. So if that magnetic field 274.83s - 281.71s | breaks, it triggers an alarm. There is a guard, uh, or a guard shack and there's cameras like 281.71s - 288.05s | watching the vault. There's an access card reader, seismic detector, so you can't, you can't 288.05s - 293.05s | tunnel in. There is a combination motion and thermal sensor, uh, that because they had a lot 295.79s - 302.59s | of false positives would only set off if it detected both extra temperature and motion. So 302.67s - 307.21s | if it just got a little warm, not going to set it off. If like a mouse is running around, not 307.21s - 311.79s | going to set it off. But if there's a person, they're warm enough and shaky enough to, to make 311.79s - 318.05s | that happen. And then finally there are the safe deposit boxes themselves. Um, these are 318.05s - 323.07s | pretty standard, although, uh, the owners of the box were given the opportunity to replace, uh, 325.93s - 331.93s | basically what was a plastic plate behind, uh, the keyhole with a steel plate. And so some 331.97s - 339.05s | people chose to update, uh, to that steel plate. Some people chose to, uh, you know,


chunk_id: 167_chunk_6
chunk_text:
is a guard, uh, or a guard shack and there's cameras like 281.71s - 288.05s | watching the vault. There's an access card reader, seismic detector, so you can't, you can't 288.05s - 293.05s | tunnel in. There is a combination motion and thermal sensor, uh, that because they had a lot 295.79s - 302.59s | of false positives would only set off if it detected both extra temperature and motion. So 302.67s - 307.21s | if it just got a little warm, not going to set it off. If like a mouse is running around, not 307.21s - 311.79s | going to set it off. But if there's a person, they're warm enough and shaky enough to, to make 311.79s - 318.05s | that happen. And then finally there are the safe deposit boxes themselves. Um, these are 318.05s - 323.07s | pretty standard, although, uh, the owners of the box were given the opportunity to replace, uh, 325.93s - 331.93s | basically what was a plastic plate behind, uh, the keyhole with a steel plate. And so some 331.97s - 339.05s | people chose to update, uh, to that steel plate. Some people chose to, uh, you know, not patch 339.05s - 345.66s | everything. And, uh, I'll let you guess which ones got hit later. That said, I mean, don't 345.66s - 350.66s | patch everything like right away. Like maybe, like we learned that this week too. So, uh, so 353.50s - 359.84s | this is, um, since we're all, uh, mostly tech people here, uh, this is basically just a very 359.84s - 365.28s | poorly colored, uh, in retrospect diagram of what we're looking at. And I just wanted to 365.28s - 369.72s | make this look like a network so you can kind of see the different layers of security and how 369.72s - 374.72s | it would relate to the, uh, to the cloud. So over here we've got the world itself. And then 376.52s - 380.10s | we've got our access point here, which is the car catches at the gateways into that 380.10s - 386.04s | neighborhood. Uh, in there we've got the actual diamond center building. And then within 386.04s - 390.74s | there is another series of access control points like, uh, an elevator that can take you 390.74s - 396.22s | down to the antechamber below the


chunk_id: 167_chunk_7
chunk_text:
not patch 339.05s - 345.66s | everything. And, uh, I'll let you guess which ones got hit later. That said, I mean, don't 345.66s - 350.66s | patch everything like right away. Like maybe, like we learned that this week too. So, uh, so 353.50s - 359.84s | this is, um, since we're all, uh, mostly tech people here, uh, this is basically just a very 359.84s - 365.28s | poorly colored, uh, in retrospect diagram of what we're looking at. And I just wanted to 365.28s - 369.72s | make this look like a network so you can kind of see the different layers of security and how 369.72s - 374.72s | it would relate to the, uh, to the cloud. So over here we've got the world itself. And then 376.52s - 380.10s | we've got our access point here, which is the car catches at the gateways into that 380.10s - 386.04s | neighborhood. Uh, in there we've got the actual diamond center building. And then within 386.04s - 390.74s | there is another series of access control points like, uh, an elevator that can take you 390.74s - 396.22s | down to the antechamber below the ground for the vault. Um, you know, badge readers, 396.22s - 402.12s | guards, things like that. And all of those security, uh, controls allow you access to the 402.12s - 407.12s | vault. So it is kind of like a system in that. And it would be a really bad system design if, 409.30s - 414.70s | you know, I don't know, somebody put a open port on this part, uh, that connected to the 414.72s - 417.96s | world and then it just kind of had a tunnel to the vault, like that would be really bad and 417.96s - 422.96s | nobody would do that, right? Alright, well that's my talk, so. Uh, alright. Uh, so this, this 426.08s - 430.14s | heist was actually pulled off by a group called the School of Terran. Uh, that is not an 430.14s - 435.34s | official name, that is a name that was given to them by the police. Uh, it is also not an 435.34s - 440.36s | accredited school. Uh, this is a, uh, this is a group of highly specialized thieves that work 440.42s - 447.12s | in a collective and they kind of refer


chunk_id: 167_chunk_8
chunk_text:
ground for the vault. Um, you know, badge readers, 396.22s - 402.12s | guards, things like that. And all of those security, uh, controls allow you access to the 402.12s - 407.12s | vault. So it is kind of like a system in that. And it would be a really bad system design if, 409.30s - 414.70s | you know, I don't know, somebody put a open port on this part, uh, that connected to the 414.72s - 417.96s | world and then it just kind of had a tunnel to the vault, like that would be really bad and 417.96s - 422.96s | nobody would do that, right? Alright, well that's my talk, so. Uh, alright. Uh, so this, this 426.08s - 430.14s | heist was actually pulled off by a group called the School of Terran. Uh, that is not an 430.14s - 435.34s | official name, that is a name that was given to them by the police. Uh, it is also not an 435.34s - 440.36s | accredited school. Uh, this is a, uh, this is a group of highly specialized thieves that work 440.42s - 447.12s | in a collective and they kind of refer each other, uh, to jobs based on the skill sets 447.12s - 451.26s | required. So somebody might say, hey, I want to rob this Arby's. And you're going to say, 451.26s - 456.76s | great, we need a safe guy, we need somebody with zero taste buds, we can make this happen. I 456.76s - 462.38s | don't know why I said that, I love Arby's, please. Uh, anyways. Sorry, I'm going off on 462.38s - 468.28s | tangents here. Um, yeah, they referred each other based on the skills that they needed, but 468.30s - 473.54s | they were usually organized by, you know, specific masterminds. And in this case, that 473.54s - 478.54s | mastermind was named Leonardo, Leonardo Noturbitarlo. Um, the other thing that this, uh, 480.48s - 485.92s | group of thieves was great at was nicknames. Uh, so his was the mastermind, but there was 485.92s - 491.26s | also the monster, uh, who was like damn near seven feet tall. Uh, he specialized in like 491.26s - 496.26s | alarms. There was the genius who also specialized in alarms and electronics. The king of 497.02s - 504.02s | keys, which is just the


chunk_id: 167_chunk_9
chunk_text:
each other, uh, to jobs based on the skill sets 447.12s - 451.26s | required. So somebody might say, hey, I want to rob this Arby's. And you're going to say, 451.26s - 456.76s | great, we need a safe guy, we need somebody with zero taste buds, we can make this happen. I 456.76s - 462.38s | don't know why I said that, I love Arby's, please. Uh, anyways. Sorry, I'm going off on 462.38s - 468.28s | tangents here. Um, yeah, they referred each other based on the skills that they needed, but 468.30s - 473.54s | they were usually organized by, you know, specific masterminds. And in this case, that 473.54s - 478.54s | mastermind was named Leonardo, Leonardo Noturbitarlo. Um, the other thing that this, uh, 480.48s - 485.92s | group of thieves was great at was nicknames. Uh, so his was the mastermind, but there was 485.92s - 491.26s | also the monster, uh, who was like damn near seven feet tall. Uh, he specialized in like 491.26s - 496.26s | alarms. There was the genius who also specialized in alarms and electronics. The king of 497.02s - 504.02s | keys, which is just the coolest name I've ever heard of in my life. And then speedy, because 504.02s - 511.47s | sometimes you run out of budget. Alright, so, how do we plan this heist? Same way that we're 511.47s - 516.47s | going to try and attack a network, right? So, you got to start with recon. So, 18 months 518.61s - 524.75s | prior to the heist, uh, Noturbitarlo just walks up to the office space and rents an office. He 524.77s - 528.97s | says, oh, I've got a jewel company. I'd like to get a safety deposit box. And they said, 528.97s - 534.91s | great, you can stay here as long as you like. Uh, had they run a background check on him, 534.91s - 539.65s | they would have known that he was like, he didn't even like change his name. He'd been 539.65s - 544.65s | arrested many times. Many times. And they're like, yeah, we'll, we'll just give you an 547.55s - 553.69s | access card to the, to the safety deposit box, to the vault. You're good to go. And so he 553.73s - 559.01s | starts by establishing persistence. He goes there multiple times


chunk_id: 167_chunk_10
chunk_text:
coolest name I've ever heard of in my life. And then speedy, because 504.02s - 511.47s | sometimes you run out of budget. Alright, so, how do we plan this heist? Same way that we're 511.47s - 516.47s | going to try and attack a network, right? So, you got to start with recon. So, 18 months 518.61s - 524.75s | prior to the heist, uh, Noturbitarlo just walks up to the office space and rents an office. He 524.77s - 528.97s | says, oh, I've got a jewel company. I'd like to get a safety deposit box. And they said, 528.97s - 534.91s | great, you can stay here as long as you like. Uh, had they run a background check on him, 534.91s - 539.65s | they would have known that he was like, he didn't even like change his name. He'd been 539.65s - 544.65s | arrested many times. Many times. And they're like, yeah, we'll, we'll just give you an 547.55s - 553.69s | access card to the, to the safety deposit box, to the vault. You're good to go. And so he 553.73s - 559.01s | starts by establishing persistence. He goes there multiple times a week and he'll just hang 559.01s - 565.05s | out in his office. He'll go down to the safe. Uh, he wore like hidden cameras in his pockets 565.05s - 571.29s | and in his duffel bag so that he could start mapping this stuff out. And then, after he'd 571.29s - 574.95s | kind of gleaned all the information that he could on that first run, he decides to try to 574.95s - 579.53s | escalate his privileges a little bit and get, you know, a higher level of clearance by 579.53s - 584.87s | renting a larger office space. And so he says, hey, you know, I want to give you guys more 584.87s - 588.97s | money for some more floor space. Uh, can I see some floor plans just so I could pick out the 588.97s - 595.15s | appropriate office? And they said, sure thing. Here's the blueprints for the entire 595.15s - 603.84s | organization. Yeah. Uh, so, for those of you who keep track at home, that's least 603.84s - 610.66s | privilege. Uh, and while he was going over, uh, going over the, uh, the schematics, he saw 614.90s - 619.90s


chunk_id: 167_chunk_11
chunk_text:
a week and he'll just hang 559.01s - 565.05s | out in his office. He'll go down to the safe. Uh, he wore like hidden cameras in his pockets 565.05s - 571.29s | and in his duffel bag so that he could start mapping this stuff out. And then, after he'd 571.29s - 574.95s | kind of gleaned all the information that he could on that first run, he decides to try to 574.95s - 579.53s | escalate his privileges a little bit and get, you know, a higher level of clearance by 579.53s - 584.87s | renting a larger office space. And so he says, hey, you know, I want to give you guys more 584.87s - 588.97s | money for some more floor space. Uh, can I see some floor plans just so I could pick out the 588.97s - 595.15s | appropriate office? And they said, sure thing. Here's the blueprints for the entire 595.15s - 603.84s | organization. Yeah. Uh, so, for those of you who keep track at home, that's least 603.84s - 610.66s | privilege. Uh, and while he was going over, uh, going over the, uh, the schematics, he saw 614.90s - 619.90s | two fatal flaws. Number one was a door in the parking garage that just opened out to the 622.70s - 628.48s | street. That thing that we said couldn't possibly happen, it happened. And then from that 628.48s - 634.82s | garage, there was a stairwell that took you down into the antechamber past the elevator. 634.84s - 641.86s | So, you could just bypass, like, most of the access controls and be right in the vault room. I 641.86s - 647.16s | sure hope they fired that guy. Uh, but as they were, as they were, like, you know, using their 647.16s - 651.90s | cameras and figuring things out, uh, the school of Turin did something that I think is pretty, 651.90s - 657.54s | pretty incredible. Uh, they built a replica vault. Uh, some of these guys, the genius 657.54s - 662.04s | particularly, owned a security company. Uh, so he was able to get, like, the exact, like, 662.06s - 667.06s | motion detectors and, uh, basically they were able to build a complete replica of this vault, and 669.60s - 674.84s | they started practicing being able to open it in the dark. Uh,


chunk_id: 167_chunk_12
chunk_text:
| two fatal flaws. Number one was a door in the parking garage that just opened out to the 622.70s - 628.48s | street. That thing that we said couldn't possibly happen, it happened. And then from that 628.48s - 634.82s | garage, there was a stairwell that took you down into the antechamber past the elevator. 634.84s - 641.86s | So, you could just bypass, like, most of the access controls and be right in the vault room. I 641.86s - 647.16s | sure hope they fired that guy. Uh, but as they were, as they were, like, you know, using their 647.16s - 651.90s | cameras and figuring things out, uh, the school of Turin did something that I think is pretty, 651.90s - 657.54s | pretty incredible. Uh, they built a replica vault. Uh, some of these guys, the genius 657.54s - 662.04s | particularly, owned a security company. Uh, so he was able to get, like, the exact, like, 662.06s - 667.06s | motion detectors and, uh, basically they were able to build a complete replica of this vault, and 669.60s - 674.84s | they started practicing being able to open it in the dark. Uh, they got some safety deposit 674.84s - 682.50s | boxes, and they basically just built a network that they could start running scripts in. 682.50s - 689.39s | Alright, so now we gotta plan this thing. Hold on, I'm just gonna grab a drink. Whew, thirsty. 689.57s - 696.33s | Alright. So, if you're gonna rob a diamond, uh, center, best time to do it is Valentine's Day 699.87s - 707.23s | weekend. That's uh, and this time worked out for a lot of reasons. Number one, Valentine's Day 707.23s - 712.19s | weekend. Either they just sold a lot of diamonds, or they have a bunch of unsold diamonds 712.19s - 716.73s | sitting in that safe. So, there's extra cash, extra diamonds, because everybody's up in their 716.73s - 721.75s | inventory. The next thing that made this particular weekend a really good time, was Serena 724.01s - 730.55s | Williams was doing an exhibition tennis match across town, so all of the police were busy, 730.55s - 735.35s | like, controlling traffic for that, because she was a big draw. Uh, so they, they just did the 735.35s - 740.37s | Die Hard 4. Uh, and then


chunk_id: 167_chunk_13
chunk_text:
they got some safety deposit 674.84s - 682.50s | boxes, and they basically just built a network that they could start running scripts in. 682.50s - 689.39s | Alright, so now we gotta plan this thing. Hold on, I'm just gonna grab a drink. Whew, thirsty. 689.57s - 696.33s | Alright. So, if you're gonna rob a diamond, uh, center, best time to do it is Valentine's Day 699.87s - 707.23s | weekend. That's uh, and this time worked out for a lot of reasons. Number one, Valentine's Day 707.23s - 712.19s | weekend. Either they just sold a lot of diamonds, or they have a bunch of unsold diamonds 712.19s - 716.73s | sitting in that safe. So, there's extra cash, extra diamonds, because everybody's up in their 716.73s - 721.75s | inventory. The next thing that made this particular weekend a really good time, was Serena 724.01s - 730.55s | Williams was doing an exhibition tennis match across town, so all of the police were busy, 730.55s - 735.35s | like, controlling traffic for that, because she was a big draw. Uh, so they, they just did the 735.35s - 740.37s | Die Hard 4. Uh, and then also, it was a bank holiday, so there was a long weekend there, and the 741.05s - 747.35s | president of the, uh, diamond exchange was getting married that week, so all of the 747.35s - 752.35s | executives were at that. So, nobody's coming back to the office. Uh, and this, this timing, by 754.45s - 759.73s | the way, if you're familiar with the Bank of Bangladesh heist, uh, or, uh, hack, they kinda 759.73s - 764.17s | did the same thing. They were able to line up, I believe an Islamic holiday, uh, a national 764.17s - 769.57s | holiday in the states, and basically made sure that nobody was gonna be checking those logs 769.57s - 775.71s | for at least 3 days. So, picking a time like that is super great if you're, you know, a thief 775.71s - 780.95s | or trying to find the right time to attack, but if you're looking to defend your networks, 780.95s - 785.69s | don't just think about, like, hey guys, long weekend. You know, make sure that there are 785.69s - 792.19s | systems in place, you know, so this doesn't happen. They did have a


chunk_id: 167_chunk_14
chunk_text:
also, it was a bank holiday, so there was a long weekend there, and the 741.05s - 747.35s | president of the, uh, diamond exchange was getting married that week, so all of the 747.35s - 752.35s | executives were at that. So, nobody's coming back to the office. Uh, and this, this timing, by 754.45s - 759.73s | the way, if you're familiar with the Bank of Bangladesh heist, uh, or, uh, hack, they kinda 759.73s - 764.17s | did the same thing. They were able to line up, I believe an Islamic holiday, uh, a national 764.17s - 769.57s | holiday in the states, and basically made sure that nobody was gonna be checking those logs 769.57s - 775.71s | for at least 3 days. So, picking a time like that is super great if you're, you know, a thief 775.71s - 780.95s | or trying to find the right time to attack, but if you're looking to defend your networks, 780.95s - 785.69s | don't just think about, like, hey guys, long weekend. You know, make sure that there are 785.69s - 792.19s | systems in place, you know, so this doesn't happen. They did have a security guard that was 792.19s - 795.73s | supposed to be there, uh, he took the night off just because he was getting drunk with his 795.73s - 803.45s | brother. So, next, uh, we've got our final prep work before the heist. So, 5 days before, the 806.33s - 811.79s | genius just takes Notre Bartolo's access card, swipes in because there was no other form of 811.79s - 817.91s | authentication, if you had the key card, you were fine, and he actually goes into the vault 817.91s - 822.91s | in the evening and starts testing a, uh, a way to, uh, bypass that magnetic sensor. Uh, and 823.91s - 831.21s | that's, that's a pretty advanced system and he solves it with like $20 worth of stuff, uh, 831.21s - 835.41s | which I just love. That's, that's part of the reason this is my favorite. It's like, just, they 835.41s - 840.43s | did really cool stuff. Don't do it, but like, don't, don't not do it. Uh, so, and we're gonna, 842.99s - 848.67s | I'll show you that in a, in a little bit here. Uh, 3 days before the heist, uh, and


chunk_id: 167_chunk_15
chunk_text:
security guard that was 792.19s - 795.73s | supposed to be there, uh, he took the night off just because he was getting drunk with his 795.73s - 803.45s | brother. So, next, uh, we've got our final prep work before the heist. So, 5 days before, the 806.33s - 811.79s | genius just takes Notre Bartolo's access card, swipes in because there was no other form of 811.79s - 817.91s | authentication, if you had the key card, you were fine, and he actually goes into the vault 817.91s - 822.91s | in the evening and starts testing a, uh, a way to, uh, bypass that magnetic sensor. Uh, and 823.91s - 831.21s | that's, that's a pretty advanced system and he solves it with like $20 worth of stuff, uh, 831.21s - 835.41s | which I just love. That's, that's part of the reason this is my favorite. It's like, just, they 835.41s - 840.43s | did really cool stuff. Don't do it, but like, don't, don't not do it. Uh, so, and we're gonna, 842.99s - 848.67s | I'll show you that in a, in a little bit here. Uh, 3 days before the heist, uh, and by the way, 848.69s - 853.33s | they almost got caught 5 days out when he was trying to leave and then he just turned around 853.33s - 858.17s | and slept in the office because he saw security guards like checking IDs. And nobody thought 858.17s - 863.17s | that that was weird. Um, so, 3 days before the heist, uh, Notre Bartolo is going into the safe 865.97s - 870.91s | again to just, you know, conduct his business and make sure everything is still looking, you 870.91s - 877.35s | know, good for a heisting. And he places a hidden camera over the vault door. And this is 877.37s - 882.11s | gonna give them a view of the combination. So, when somebody goes to open it, they can 882.11s - 887.11s | hopefully, you know, see those numbers. The 100 million possible combinations. This is my 889.19s - 894.19s | favorite part. The day before the heist, uh, right before, uh, right before closing, Notre 896.33s - 901.33s | Bartolo takes out a bottle of hairspray and he sprays the heat and motion sensor with a light 901.75s - 906.75s | film of hairspray that basically


chunk_id: 167_chunk_16
chunk_text:
by the way, 848.69s - 853.33s | they almost got caught 5 days out when he was trying to leave and then he just turned around 853.33s - 858.17s | and slept in the office because he saw security guards like checking IDs. And nobody thought 858.17s - 863.17s | that that was weird. Um, so, 3 days before the heist, uh, Notre Bartolo is going into the safe 865.97s - 870.91s | again to just, you know, conduct his business and make sure everything is still looking, you 870.91s - 877.35s | know, good for a heisting. And he places a hidden camera over the vault door. And this is 877.37s - 882.11s | gonna give them a view of the combination. So, when somebody goes to open it, they can 882.11s - 887.11s | hopefully, you know, see those numbers. The 100 million possible combinations. This is my 889.19s - 894.19s | favorite part. The day before the heist, uh, right before, uh, right before closing, Notre 896.33s - 901.33s | Bartolo takes out a bottle of hairspray and he sprays the heat and motion sensor with a light 901.75s - 906.75s | film of hairspray that basically just disrupted it enough to not notice the increase in heat 909.23s - 914.23s | right away. And so, because of that, it could detect motion and they bought themselves a few 915.87s - 920.87s | extra minutes before the heat was hot enough to, to go ahead and do that. Uh, just honestly 923.77s - 928.41s | genius. And then they got themselves a nice sandwich plate. That's gonna come into play 928.43s - 936.06s | later. But always like, if you're gonna do a crime, like, eat up. Alright, so we're at the day 936.06s - 941.24s | of the heist now. They enter through the garage, just like that, uh, problem in the 941.24s - 946.38s | schematics showed them to do. Uh, they started taking like crown royal bags and covering all 946.38s - 952.18s | the cameras because they knew exactly where those were as well. Um, this device here, if you 952.18s - 957.36s | can see it on the, the right hand side of the slide, it's basically just an aluminum plate 957.38s - 962.88s | that he stuck two sided tape on. So it had a magnet, it had two sided tape,


chunk_id: 167_chunk_17
chunk_text:
just disrupted it enough to not notice the increase in heat 909.23s - 914.23s | right away. And so, because of that, it could detect motion and they bought themselves a few 915.87s - 920.87s | extra minutes before the heat was hot enough to, to go ahead and do that. Uh, just honestly 923.77s - 928.41s | genius. And then they got themselves a nice sandwich plate. That's gonna come into play 928.43s - 936.06s | later. But always like, if you're gonna do a crime, like, eat up. Alright, so we're at the day 936.06s - 941.24s | of the heist now. They enter through the garage, just like that, uh, problem in the 941.24s - 946.38s | schematics showed them to do. Uh, they started taking like crown royal bags and covering all 946.38s - 952.18s | the cameras because they knew exactly where those were as well. Um, this device here, if you 952.18s - 957.36s | can see it on the, the right hand side of the slide, it's basically just an aluminum plate 957.38s - 962.88s | that he stuck two sided tape on. So it had a magnet, it had two sided tape, and then 962.88s - 969.46s | basically he just unscrewed the bolts so that when he took the, the whole sensor off the door, 969.46s - 975.94s | it stayed together. And it never broke that magnetic seal because they were taped together. 975.94s - 980.94s | So, doesn't matter how smart your system is, something stupid can and will beat it. Um, so 981.16s - 986.16s | the next thing they do is they open the vault door and they turn the lights off because 989.56s - 994.56s | there are the, uh, light detectors in there. And then the genius basically, he takes like a 996.86s - 1003.30s | styrofoam cooler and puts it over the heat sensor. So this is gonna block motion and it's 1003.30s - 1008.48s | gonna insulate the temperature, so now that's out of the way. Uh, the seven foot tall guy 1008.52s - 1014.02s | disables the alarm on the top of the garage, uh, on the top of the safe. And then they go to 1014.02s - 1019.90s | actually get the keys themselves. Now bear in mind, I said before, this is a, uh, two foot 1019.90s - 1024.90s |


chunk_id: 167_chunk_18
chunk_text:
and then 962.88s - 969.46s | basically he just unscrewed the bolts so that when he took the, the whole sensor off the door, 969.46s - 975.94s | it stayed together. And it never broke that magnetic seal because they were taped together. 975.94s - 980.94s | So, doesn't matter how smart your system is, something stupid can and will beat it. Um, so 981.16s - 986.16s | the next thing they do is they open the vault door and they turn the lights off because 989.56s - 994.56s | there are the, uh, light detectors in there. And then the genius basically, he takes like a 996.86s - 1003.30s | styrofoam cooler and puts it over the heat sensor. So this is gonna block motion and it's 1003.30s - 1008.48s | gonna insulate the temperature, so now that's out of the way. Uh, the seven foot tall guy 1008.52s - 1014.02s | disables the alarm on the top of the garage, uh, on the top of the safe. And then they go to 1014.02s - 1019.90s | actually get the keys themselves. Now bear in mind, I said before, this is a, uh, two foot 1019.90s - 1024.90s | long, or a foot long key kept in two different spots. Except, it's not. They just put it in 1027.90s - 1035.89s | the coat closet next to the safe door and they didn't take it apart. Oh, if you like that, 1035.89s - 1040.89s | just, here we go. The combination lock, you know, the hundred million combinations, turns 1043.77s - 1048.57s | out, that's as much of a pain in the ass for a thief to figure out as it is for the security 1048.57s - 1056.16s | guy. So when he closed the vault that night, he just didn't spin the lock. Yeah. Sometimes 1061.27s - 1065.47s | your man on the inside doesn't even realize that he's on the inside. He doesn't know 1065.47s - 1072.52s | anything. And then they just open the, uh, the day gate with a crowbar. Cause sometimes the 1072.52s - 1077.52s | classics work. So, this is the hall. Of the hundred and sixty safe, uh, deposit boxes, a 1082.36s - 1087.36s | hundred and twenty three of them got looted. Uh, including Notre Bartolo's own. Um, I, I like 1091.00s - 1095.80s | to think that he was just


chunk_id: 167_chunk_19
chunk_text:
long, or a foot long key kept in two different spots. Except, it's not. They just put it in 1027.90s - 1035.89s | the coat closet next to the safe door and they didn't take it apart. Oh, if you like that, 1035.89s - 1040.89s | just, here we go. The combination lock, you know, the hundred million combinations, turns 1043.77s - 1048.57s | out, that's as much of a pain in the ass for a thief to figure out as it is for the security 1048.57s - 1056.16s | guy. So when he closed the vault that night, he just didn't spin the lock. Yeah. Sometimes 1061.27s - 1065.47s | your man on the inside doesn't even realize that he's on the inside. He doesn't know 1065.47s - 1072.52s | anything. And then they just open the, uh, the day gate with a crowbar. Cause sometimes the 1072.52s - 1077.52s | classics work. So, this is the hall. Of the hundred and sixty safe, uh, deposit boxes, a 1082.36s - 1087.36s | hundred and twenty three of them got looted. Uh, including Notre Bartolo's own. Um, I, I like 1091.00s - 1095.80s | to think that he was just doing it to like blend in, but in reality he was probably just too 1095.82s - 1101.50s | cheap to get the new plate. Because the, the only boxes that weren't opened with that tool, uh, 1101.50s - 1106.40s | that basically just snapped the back plate off to open the lock, was the ones where they spent 1106.40s - 1111.40s | the extra twenty dollars to upgrade to the steel plate. That's your stuff. Don't, don't be 1115.04s - 1120.04s | cheap when it comes to like keeping your diamonds safe. They stole so much stuff that they 1120.12s - 1125.12s | had to start like prioritizing and they left like tens of millions of dollars worth of diamonds 1127.16s - 1133.53s | and cash just on the floor because it was too heavy. Hashtag goals. Once they were done, and 1137.72s - 1143.36s | this, this heist by the way lasted three days. Um, yeah, because everybody was gone, they just 1143.36s - 1151.28s | kept coming back and stealing more stuff. And nobody figured like, hey, like, maybe I should 1151.28s - 1155.26s | like check the vault, make sure nobody stole the money. It's weird, but


chunk_id: 167_chunk_20
chunk_text:
doing it to like blend in, but in reality he was probably just too 1095.82s - 1101.50s | cheap to get the new plate. Because the, the only boxes that weren't opened with that tool, uh, 1101.50s - 1106.40s | that basically just snapped the back plate off to open the lock, was the ones where they spent 1106.40s - 1111.40s | the extra twenty dollars to upgrade to the steel plate. That's your stuff. Don't, don't be 1115.04s - 1120.04s | cheap when it comes to like keeping your diamonds safe. They stole so much stuff that they 1120.12s - 1125.12s | had to start like prioritizing and they left like tens of millions of dollars worth of diamonds 1127.16s - 1133.53s | and cash just on the floor because it was too heavy. Hashtag goals. Once they were done, and 1137.72s - 1143.36s | this, this heist by the way lasted three days. Um, yeah, because everybody was gone, they just 1143.36s - 1151.28s | kept coming back and stealing more stuff. And nobody figured like, hey, like, maybe I should 1151.28s - 1155.26s | like check the vault, make sure nobody stole the money. It's weird, but like, you know, it's 1155.26s - 1161.76s | a thing I should check. They didn't, they just didn't do it. Uh, and then also, um, the, the 1161.76s - 1165.94s | diamond center themselves, like after the heist was finally completed, they're like, oh, we 1165.94s - 1170.44s | gotta go grab those videotapes. So they went up to the second story guard shack where the tapes 1170.44s - 1176.44s | were and they just removed, they just took them out of the VCR. That's right, they were still 1176.44s - 1182.88s | using, uh, VHS tapes because they didn't want to spend the extra money on DVRs. So had they, 1182.88s - 1186.98s | you know, not done that, or had they updated it, we would have caught these people a lot 1186.98s - 1196.72s | sooner, but they decided, you know, who's going to break into the vault? Alright, so now we 1196.72s - 1201.72s | get to kind of the, uh, the fun part where everything falls apart. They get away initially 1202.66s - 1207.66s | about two hours into the drive, uh, back to Italy where all these guys were from, Speedy, the 1210.66s - 1215.66s


chunk_id: 167_chunk_21
chunk_text:
like, you know, it's 1155.26s - 1161.76s | a thing I should check. They didn't, they just didn't do it. Uh, and then also, um, the, the 1161.76s - 1165.94s | diamond center themselves, like after the heist was finally completed, they're like, oh, we 1165.94s - 1170.44s | gotta go grab those videotapes. So they went up to the second story guard shack where the tapes 1170.44s - 1176.44s | were and they just removed, they just took them out of the VCR. That's right, they were still 1176.44s - 1182.88s | using, uh, VHS tapes because they didn't want to spend the extra money on DVRs. So had they, 1182.88s - 1186.98s | you know, not done that, or had they updated it, we would have caught these people a lot 1186.98s - 1196.72s | sooner, but they decided, you know, who's going to break into the vault? Alright, so now we 1196.72s - 1201.72s | get to kind of the, uh, the fun part where everything falls apart. They get away initially 1202.66s - 1207.66s | about two hours into the drive, uh, back to Italy where all these guys were from, Speedy, the 1210.66s - 1215.66s | discount henchman starts freaking out. He's never flown this close to the sun before. And so 1217.86s - 1224.04s | he starts like just throwing trash out of the window of their getaway car. I'm going to say 1224.04s - 1229.04s | this right now, rule number one of performing a crime, only do one crime at a time. 1233.53s - 1241.09s | Like, like if you got a Monet in your backseat, do the speed limit. That's all I'm saying. Uh, 1245.33s - 1249.81s | Speedy though, he started freaking out and he just pulls over and he's like, we got to burn 1249.81s - 1254.41s | this evidence because they had like trash bags full of evidence. So I guess rule two would be 1254.41s - 1259.75s | don't drive with trash bags full of incriminating evidence. I shouldn't have to say that 1259.77s - 1266.47s | one. Uh, but yeah, they, they basically, he started panicking and he started trying to burn 1266.47s - 1271.17s | all of the evidence in a, in a burn barrel. And when he realized that wasn't going to happen, 1271.17s - 1277.91s | he just kind of dumped it on


chunk_id: 167_chunk_22
chunk_text:
| discount henchman starts freaking out. He's never flown this close to the sun before. And so 1217.86s - 1224.04s | he starts like just throwing trash out of the window of their getaway car. I'm going to say 1224.04s - 1229.04s | this right now, rule number one of performing a crime, only do one crime at a time. 1233.53s - 1241.09s | Like, like if you got a Monet in your backseat, do the speed limit. That's all I'm saying. Uh, 1245.33s - 1249.81s | Speedy though, he started freaking out and he just pulls over and he's like, we got to burn 1249.81s - 1254.41s | this evidence because they had like trash bags full of evidence. So I guess rule two would be 1254.41s - 1259.75s | don't drive with trash bags full of incriminating evidence. I shouldn't have to say that 1259.77s - 1266.47s | one. Uh, but yeah, they, they basically, he started panicking and he started trying to burn 1266.47s - 1271.17s | all of the evidence in a, in a burn barrel. And when he realized that wasn't going to happen, 1271.17s - 1277.91s | he just kind of dumped it on the side of the road. And then in a, a weird fun twist of fate, 1277.91s - 1283.89s | the exact spot that he picked, uh, to dump his trash was the spot where like an old 1283.89s - 1289.19s | curmudgeonly farmer had just kept calling the police because of the dang kids who were also 1289.19s - 1297.56s | dumping trash there. It was like, it was just like a good spot for trash. And so he, he's like, 1297.56s - 1301.46s | oh, these kids, like they did the trash again. And so the police are like, sure, Harold. And 1301.46s - 1304.84s | then they start going out there and they start seeing envelopes that say Antwerp Diamond 1304.84s - 1309.84s | Center. And like pieces of videotape from the, the cameras and diamonds. They threw away 1312.38s - 1317.38s | diamonds. They also found some half eaten sandwiches. And from the sandwiches, this is my 1320.20s - 1325.20s | favorite part, they were able to start like looking through security camera footage and they saw 1328.08s - 1334.38s | like the receipt was purchased like from a shop next to the diamond center. And then


chunk_id: 167_chunk_23
chunk_text:
the side of the road. And then in a, a weird fun twist of fate, 1277.91s - 1283.89s | the exact spot that he picked, uh, to dump his trash was the spot where like an old 1283.89s - 1289.19s | curmudgeonly farmer had just kept calling the police because of the dang kids who were also 1289.19s - 1297.56s | dumping trash there. It was like, it was just like a good spot for trash. And so he, he's like, 1297.56s - 1301.46s | oh, these kids, like they did the trash again. And so the police are like, sure, Harold. And 1301.46s - 1304.84s | then they start going out there and they start seeing envelopes that say Antwerp Diamond 1304.84s - 1309.84s | Center. And like pieces of videotape from the, the cameras and diamonds. They threw away 1312.38s - 1317.38s | diamonds. They also found some half eaten sandwiches. And from the sandwiches, this is my 1320.20s - 1325.20s | favorite part, they were able to start like looking through security camera footage and they saw 1328.08s - 1334.38s | like the receipt was purchased like from a shop next to the diamond center. And then they saw 1334.38s - 1338.02s | the, the camera footage of that and they're like, who's this weird seven foot tall guy 1338.02s - 1344.50s | buying a bunch of sandwiches? So another rule, delete your cookies. That's the one I'm 1345.44s - 1353.96s | going to do this for. Oh, thank you. Alright. So the other thing that happened after this is 1363.53s - 1370.53s | Notre Bartolo, this is too dark, that was just a gag. Notre Bartolo, he decides in what might be 1370.53s - 1374.97s | the dumbest move I've ever seen. He's like, you know what I'm going to do on Monday? I'm 1374.97s - 1380.45s | going to show up back to the office, be like, what happened? And you know, play it like, like 1380.45s - 1385.45s | an innocent man would do. Don't do that. If you escape the country, don't go back. Don't, 1388.19s - 1393.19s | like, but he did that and then the police were kind of there waiting for him already. And then 1393.19s - 1397.63s | they went to his apartment that he rented in town and they found a bunch of, uh, what's 1397.63s - 1402.33s


chunk_id: 167_chunk_24
chunk_text:
they saw 1334.38s - 1338.02s | the, the camera footage of that and they're like, who's this weird seven foot tall guy 1338.02s - 1344.50s | buying a bunch of sandwiches? So another rule, delete your cookies. That's the one I'm 1345.44s - 1353.96s | going to do this for. Oh, thank you. Alright. So the other thing that happened after this is 1363.53s - 1370.53s | Notre Bartolo, this is too dark, that was just a gag. Notre Bartolo, he decides in what might be 1370.53s - 1374.97s | the dumbest move I've ever seen. He's like, you know what I'm going to do on Monday? I'm 1374.97s - 1380.45s | going to show up back to the office, be like, what happened? And you know, play it like, like 1380.45s - 1385.45s | an innocent man would do. Don't do that. If you escape the country, don't go back. Don't, 1388.19s - 1393.19s | like, but he did that and then the police were kind of there waiting for him already. And then 1393.19s - 1397.63s | they went to his apartment that he rented in town and they found a bunch of, uh, what's 1397.63s - 1402.33s | called pointer emeralds stuck in his carpet. Those are like the little tiny emeralds that 1402.33s - 1406.91s | like, if you're, like if Cartier does like those jaguar heads that are like the little tiny 1406.93s - 1412.31s | stones, those are usually pointer emeralds. They're more or less worthless, but, you know, 1412.31s - 1418.25s | it's like finding, you know, a, a perfect mashing hash, like in a file dump or something like 1418.25s - 1425.14s | that. It's just something that could only be from that. So, all of them with the exception of 1427.38s - 1432.38s | the King of Keys, who to this day, nobody knows who he is, they all got arrested. Um, they 1433.34s - 1438.34s | on average served three years in prison and they never recovered any of the money or the 1441.22s - 1448.22s | diamonds. Which brings me to fun crime fact number four, or tip, I guess. If you're gonna 1448.22s - 1453.22s | perform a heist, do it in Europe. Uh, these, these guys, they ended up, uh, yeah, they're 1454.22s - 1463.89s | they're somewhere like retired with a bunch of money and a


chunk_id: 167_chunk_25
chunk_text:
| called pointer emeralds stuck in his carpet. Those are like the little tiny emeralds that 1402.33s - 1406.91s | like, if you're, like if Cartier does like those jaguar heads that are like the little tiny 1406.93s - 1412.31s | stones, those are usually pointer emeralds. They're more or less worthless, but, you know, 1412.31s - 1418.25s | it's like finding, you know, a, a perfect mashing hash, like in a file dump or something like 1418.25s - 1425.14s | that. It's just something that could only be from that. So, all of them with the exception of 1427.38s - 1432.38s | the King of Keys, who to this day, nobody knows who he is, they all got arrested. Um, they 1433.34s - 1438.34s | on average served three years in prison and they never recovered any of the money or the 1441.22s - 1448.22s | diamonds. Which brings me to fun crime fact number four, or tip, I guess. If you're gonna 1448.22s - 1453.22s | perform a heist, do it in Europe. Uh, these, these guys, they ended up, uh, yeah, they're 1454.22s - 1463.89s | they're somewhere like retired with a bunch of money and a bunch of diamonds, and it's just, 1471.13s - 1476.57s | I love that for them. Um, but there are lessons that, that we can take from this as well, 1476.57s - 1482.77s | especially on the security side. Number one, defense in depth, like that, that vault door 1482.79s - 1487.79s | had ten different security features alone. But it only works if you do it properly. Because 1490.53s - 1495.53s | the specter of security is not in fact security. Like you can think something is secure, but 1498.01s - 1503.01s | unless you're actually, you know, walking the walk, it doesn't really matter. Um, complacency 1503.83s - 1508.83s | is the enemy of complexity. So again, if something is tedious for you, don't make it easy 1513.57s - 1519.41s | for you at the expense of making it easy for somebody to pull off the heist of a lifetime. 1519.41s - 1524.15s | You're worth that 30 seconds. Like the number of people that just like won't bother putting 1524.15s - 1529.15s | like MFA on their phones like blows my mind. And finally, stupid and or lazy can be dangerous 1529.37s - 1534.37s | both ways. It


chunk_id: 167_chunk_26
chunk_text:
bunch of diamonds, and it's just, 1471.13s - 1476.57s | I love that for them. Um, but there are lessons that, that we can take from this as well, 1476.57s - 1482.77s | especially on the security side. Number one, defense in depth, like that, that vault door 1482.79s - 1487.79s | had ten different security features alone. But it only works if you do it properly. Because 1490.53s - 1495.53s | the specter of security is not in fact security. Like you can think something is secure, but 1498.01s - 1503.01s | unless you're actually, you know, walking the walk, it doesn't really matter. Um, complacency 1503.83s - 1508.83s | is the enemy of complexity. So again, if something is tedious for you, don't make it easy 1513.57s - 1519.41s | for you at the expense of making it easy for somebody to pull off the heist of a lifetime. 1519.41s - 1524.15s | You're worth that 30 seconds. Like the number of people that just like won't bother putting 1524.15s - 1529.15s | like MFA on their phones like blows my mind. And finally, stupid and or lazy can be dangerous 1529.37s - 1534.37s | both ways. It can be dangerous on the blue team, it can be dangerous on the red team. So make 1537.47s - 1542.17s | sure that you're, you know, taking care of yourself, that you're being thorough about things 1542.17s - 1547.95s | and that you're actually thinking about things in a layered approach. Like defensive depth 1547.95s - 1552.95s | like is all about compensating controls. If something happens, like these guys just jumped 1552.95s - 1557.63s | out of a plane with 60 parachutes and not one of them went off. Like that's, that's a problem. 1557.63s - 1563.61s | Don't, don't do that. That's gonna make you fall faster because of the weight. Um, but yeah, 1563.61s - 1585.22s | that's, that's pretty much the main takeaways from there. Uh, do we have any questions? I, I 1585.22s - 1590.22s | wish. I, I'm gonna be honest, I am 40 years old, I still get a brain freeze when I eat ice 1591.82s - 1596.82s | cream. I can't, I can't do that. What's up? I mean, I like them. Yes, you can do that. 1602.96s - 1619.29s | You can come to this microphone for questions so everybody can


chunk_id: 167_chunk_27
chunk_text:
can be dangerous on the blue team, it can be dangerous on the red team. So make 1537.47s - 1542.17s | sure that you're, you know, taking care of yourself, that you're being thorough about things 1542.17s - 1547.95s | and that you're actually thinking about things in a layered approach. Like defensive depth 1547.95s - 1552.95s | like is all about compensating controls. If something happens, like these guys just jumped 1552.95s - 1557.63s | out of a plane with 60 parachutes and not one of them went off. Like that's, that's a problem. 1557.63s - 1563.61s | Don't, don't do that. That's gonna make you fall faster because of the weight. Um, but yeah, 1563.61s - 1585.22s | that's, that's pretty much the main takeaways from there. Uh, do we have any questions? I, I 1585.22s - 1590.22s | wish. I, I'm gonna be honest, I am 40 years old, I still get a brain freeze when I eat ice 1591.82s - 1596.82s | cream. I can't, I can't do that. What's up? I mean, I like them. Yes, you can do that. 1602.96s - 1619.29s | You can come to this microphone for questions so everybody can hear the question. Is it 1619.29s - 1624.29s | possible that the German police are retired in the islands? I, I'm not gonna say it's 1626.79s - 1632.37s | impossible. Um, you never know like where people are gonna have inside, uh, inside people. 1632.37s - 1636.87s | I personally feel like somebody had to have gotten paid off at this just because of the sheer, 1636.87s - 1642.37s | like it's almost like mathematically impossible negligence. Um, but yeah, um, so that's 1642.37s - 1648.61s | definitely possible. What changes did they make as a result of this to make it not happen 1648.61s - 1656.72s | again? Uh, so number one, they stopped giving out blueprints. Uh, um, and some of the other 1656.72s - 1662.02s | things that happened is, um, they started really forcing through those updates. Like the 1662.02s - 1666.42s | security cameras, like they weren't waiting, they weren't making excuses to stop spending 1666.42s - 1671.16s | money or to, you know, not spend the money. They updated their systems there. They made 1671.16s - 1676.36s | sure that they were staying ahead of trends and they also worked on like actual enforcement


chunk_id: 167_chunk_28
chunk_text:
hear the question. Is it 1619.29s - 1624.29s | possible that the German police are retired in the islands? I, I'm not gonna say it's 1626.79s - 1632.37s | impossible. Um, you never know like where people are gonna have inside, uh, inside people. 1632.37s - 1636.87s | I personally feel like somebody had to have gotten paid off at this just because of the sheer, 1636.87s - 1642.37s | like it's almost like mathematically impossible negligence. Um, but yeah, um, so that's 1642.37s - 1648.61s | definitely possible. What changes did they make as a result of this to make it not happen 1648.61s - 1656.72s | again? Uh, so number one, they stopped giving out blueprints. Uh, um, and some of the other 1656.72s - 1662.02s | things that happened is, um, they started really forcing through those updates. Like the 1662.02s - 1666.42s | security cameras, like they weren't waiting, they weren't making excuses to stop spending 1666.42s - 1671.16s | money or to, you know, not spend the money. They updated their systems there. They made 1671.16s - 1676.36s | sure that they were staying ahead of trends and they also worked on like actual enforcement 1676.36s - 1684.59s | so that, um, you know, these things that they set up to work could actually do their job. Yes. 1684.59s - 1690.49s | Is there a movie about this? Uh, not about this one specifically actually. There should be. 1690.49s - 1700.58s | That's the real crime. Uh. So stay away you. Uh, so what is the answer to the, that type of 1702.56s - 1707.56s | complacency issue? Cause I think that's something we see a lot when it comes to, for example, 1711.56s - 1715.56s | you know, self-driving cars, the difference between asking people to remain alert all the 1715.56s - 1721.14s | time and asking people to just, oh, it's fine until it suddenly isn't is a big one, right? So 1721.14s - 1725.48s | how do you get people to, to take that key and split it in half and put it away properly every 1725.48s - 1730.48s | single time? I, I, I think the solution for that has to be some sort of accountability. Uh, 1732.62s - 1738.52s | and it doesn't, it doesn't fix anything, you know, necessarily in the long term, but if all 1738.52s - 1742.42s


chunk_id: 167_chunk_29
chunk_text:
1676.36s - 1684.59s | so that, um, you know, these things that they set up to work could actually do their job. Yes. 1684.59s - 1690.49s | Is there a movie about this? Uh, not about this one specifically actually. There should be. 1690.49s - 1700.58s | That's the real crime. Uh. So stay away you. Uh, so what is the answer to the, that type of 1702.56s - 1707.56s | complacency issue? Cause I think that's something we see a lot when it comes to, for example, 1711.56s - 1715.56s | you know, self-driving cars, the difference between asking people to remain alert all the 1715.56s - 1721.14s | time and asking people to just, oh, it's fine until it suddenly isn't is a big one, right? So 1721.14s - 1725.48s | how do you get people to, to take that key and split it in half and put it away properly every 1725.48s - 1730.48s | single time? I, I, I think the solution for that has to be some sort of accountability. Uh, 1732.62s - 1738.52s | and it doesn't, it doesn't fix anything, you know, necessarily in the long term, but if all 1738.52s - 1742.42s | of a sudden, you know, these leaders and things like that are, are, you know, their 1742.42s - 1746.70s | managers are checking to make sure that like the jobs are completed, uh, making sure that, you 1746.70s - 1752.24s | know, due diligence is performed and making sure that, you know, there is something, there's 1752.24s - 1756.58s | some sort of teeth that are gonna, you know, prevent that from happening. Like, uh, if say 1756.60s - 1763.34s | you push, uh, an untested update out to a billion computers, uh, you know, probably get fired at 1763.34s - 1768.34s | the very least, or some fines or something, you know? I mean, that's a hypothetical. Uh, 1774.18s - 1782.38s | that wouldn't happen. Uh, any other questions? Alright, well, uh, this is a dream come 1782.38s - 1783.62s | true, so thanks everybody.


chunk_id: 167_chunk_30
chunk_text:
| of a sudden, you know, these leaders and things like that are, are, you know, their 1742.42s - 1746.70s | managers are checking to make sure that like the jobs are completed, uh, making sure that, you 1746.70s - 1752.24s | know, due diligence is performed and making sure that, you know, there is something, there's 1752.24s - 1756.58s | some sort of teeth that are gonna, you know, prevent that from happening. Like, uh, if say 1756.60s - 1763.34s | you push, uh, an untested update out to a billion computers, uh, you know, probably get fired at 1763.34s - 1768.34s | the very least, or some fines or something, you know? I mean, that's a hypothetical. Uh, 1774.18s - 1782.38s | that wouldn't happen. Uh, any other questions? Alright, well, uh, this is a dream come 1782.38s - 1783.62s | true, so thanks everybody.


chunk_id: 168_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=gg5zsWyZJ90", "title": "DEF CON 32 - Unlocking the Gates: Understanding Authentication Bypass Vulnerabilities - Vikas Khanna", "description": "Industrial VPN gateways play a crucial role in operational technology by enabling secure remote access to systems within industrial networks. However, their importance goes hand in hand with increased security risks, as their architecture makes them lucrative targets for threat actors. Over the years, we have seen such devices being used in various industrial environments, which underlines their widespread use in critical infrastructures.\n\nThis talk is about a security analysis of a widely used industrial remote access solution. We will dive deep into and expose various vulnerabilities. This includes rooting the device, bypassing hardware-based security mechanisms such as the use of a hardware security module, and reverse engineering software and firmware. Ultimately, we will show how various identified vulnerabilities allowed us to hijack remote access sessions, creating significant security risks.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1831, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 10.82s | This text was transcribed using whisper model: large-v2 It is my pleasure to introduce Vikas to the stage. Let's give him a round of applause. 10.82s - 19.82s | Hello. I hope you can hear me. Thanks for the warm welcome. So welcome to the talk and 19.82s - 25.58s | I hope you are having a good time so far. So my topic for today is authentication bypass 25.58s - 33.02s | and account takeovers. So this talk is for people who are in pentesting, who are doing 33.02s - 38.58s | red teaming activities and who are in bug bounty hunting. Other than that, if you are 38.58s - 45.76s | a student or new to this field, this is for you as well. So I hope you will enjoy it. 45.76s - 51.16s | All right. So the agenda for today's talk is I have divided it in three different phases. 51.16s - 56.64s | First is introduction. I will discuss about what authentication is, why it's so crucial 56.64s - 63.92s | and what are the different modules where you can look for such bugs. The phase two is techniques 63.92s - 72.04s | and vulnerabilities which I personally use to take over the accounts and bypass the authentications 72.04s - 77.08s | during my entire career. I mean, I have eight years of experience and I have used these 77.08s - 82.36s


chunk_id: 168_chunk_1
chunk_text:
for the warm welcome. So welcome to the talk and 19.82s - 25.58s | I hope you are having a good time so far. So my topic for today is authentication bypass 25.58s - 33.02s | and account takeovers. So this talk is for people who are in pentesting, who are doing 33.02s - 38.58s | red teaming activities and who are in bug bounty hunting. Other than that, if you are 38.58s - 45.76s | a student or new to this field, this is for you as well. So I hope you will enjoy it. 45.76s - 51.16s | All right. So the agenda for today's talk is I have divided it in three different phases. 51.16s - 56.64s | First is introduction. I will discuss about what authentication is, why it's so crucial 56.64s - 63.92s | and what are the different modules where you can look for such bugs. The phase two is techniques 63.92s - 72.04s | and vulnerabilities which I personally use to take over the accounts and bypass the authentications 72.04s - 77.08s | during my entire career. I mean, I have eight years of experience and I have used these 77.08s - 82.36s | techniques during the pentesting activities, red teaming activities and bug bounty hunting. 82.36s - 89.44s | The third phase is I identified account takeover or authentication bypass in Apple. I will 89.44s - 98.82s | disclose that. A little bit about myself. My name is Vikas Khanna. I am technical specialist 98.82s - 107.54s | at Privasec. My key focus is on AppSec, web applications, API security. Whenever I'm not 107.54s - 114.70s | working on my professional stuff, I am bit active on bug bounty hunting. I got acknowledgments 114.70s - 120.34s | from companies like Google, Microsoft, Apple and many more. Other than that, I have contributed 120.38s - 129.38s | to the community. I have contributed to OWASP, WSTG and OWASP www community. Other than that, 129.38s - 136.38s | I have a few CVs from Oracle and IBM for reporting them issues in their enterprise products. 138.26s - 143.98s | So what is authentication? Basically authentication is a process to verify a user or a system 143.98s - 150.02s | that they are what they are claiming to be by verifying their credentials in terms of 150.02s - 157.02s | their user names, password, digital


chunk_id: 168_chunk_2
chunk_text:
| techniques during the pentesting activities, red teaming activities and bug bounty hunting. 82.36s - 89.44s | The third phase is I identified account takeover or authentication bypass in Apple. I will 89.44s - 98.82s | disclose that. A little bit about myself. My name is Vikas Khanna. I am technical specialist 98.82s - 107.54s | at Privasec. My key focus is on AppSec, web applications, API security. Whenever I'm not 107.54s - 114.70s | working on my professional stuff, I am bit active on bug bounty hunting. I got acknowledgments 114.70s - 120.34s | from companies like Google, Microsoft, Apple and many more. Other than that, I have contributed 120.38s - 129.38s | to the community. I have contributed to OWASP, WSTG and OWASP www community. Other than that, 129.38s - 136.38s | I have a few CVs from Oracle and IBM for reporting them issues in their enterprise products. 138.26s - 143.98s | So what is authentication? Basically authentication is a process to verify a user or a system 143.98s - 150.02s | that they are what they are claiming to be by verifying their credentials in terms of 150.02s - 157.02s | their user names, password, digital signatures and many more things. Authentication is very 157.58s - 163.94s | crucial. For example, there are post login modules which are having sensitive information, 163.94s - 170.94s | your PIIs and information which not everybody should be able to see without, you know, logging 171.02s - 177.38s | into the application. So that is why authentication is very crucial. Okay, so whenever we are 177.38s - 184.38s | hunting for authentication bypass and account takeovers, these are the abusable vectors 186.76s - 192.82s | or functionalities where you can focus on. Basically I have identified issues in these 192.82s - 199.74s | features, these functionalities but this bug is not limited to these features only. I mean 199.74s - 208.69s | you can explore but this is based on my experience. Okay, real time abuse vectors like vulnerabilities 209.45s - 215.45s | and techniques which you can use basically to take over the accounts and bypass the authentications. 215.45s - 221.21s | Alright, first vulnerability is session puzzling. What is session puzzling? Session puzzling 221.21s - 228.21s | is like whenever you have extra permissions on your session ID. For example, you are in 230.37s - 237.37s | pre-login


chunk_id: 168_chunk_3
chunk_text:
signatures and many more things. Authentication is very 157.58s - 163.94s | crucial. For example, there are post login modules which are having sensitive information, 163.94s - 170.94s | your PIIs and information which not everybody should be able to see without, you know, logging 171.02s - 177.38s | into the application. So that is why authentication is very crucial. Okay, so whenever we are 177.38s - 184.38s | hunting for authentication bypass and account takeovers, these are the abusable vectors 186.76s - 192.82s | or functionalities where you can focus on. Basically I have identified issues in these 192.82s - 199.74s | features, these functionalities but this bug is not limited to these features only. I mean 199.74s - 208.69s | you can explore but this is based on my experience. Okay, real time abuse vectors like vulnerabilities 209.45s - 215.45s | and techniques which you can use basically to take over the accounts and bypass the authentications. 215.45s - 221.21s | Alright, first vulnerability is session puzzling. What is session puzzling? Session puzzling 221.21s - 228.21s | is like whenever you have extra permissions on your session ID. For example, you are in 230.37s - 237.37s | pre-login stage and for some modules or some activities you got a session ID and that session 237.69s - 244.01s | ID is misconfigured and having a permission, over permission which you can use to access 244.01s - 249.13s | the post-login modules as well. Basically it's in pre-login stage but you can access 249.13s - 257.68s | post-login modules as well. Alright, so the example for this is forgot password functionality. 257.68s - 263.00s | How forgot password functionality works? Like there is a forgot password module, you can 263.00s - 268.76s | enter your email ID, application will redirect you to another page where application will 268.76s - 275.76s | ask you for OTPs or maybe security questions and if you provide OTP, correct OTP or correct 276.32s - 281.72s | security questions answer, application will redirect you to another page where you can 281.72s - 286.64s | enter the new password and change the password. But for the second page where application 286.64s - 292.36s | is asking for security questions answer or OTP, application have created a session which 292.36s - 298.28s | is linked with your email ID which you provided on the first page. But


chunk_id: 168_chunk_4
chunk_text:
stage and for some modules or some activities you got a session ID and that session 237.69s - 244.01s | ID is misconfigured and having a permission, over permission which you can use to access 244.01s - 249.13s | the post-login modules as well. Basically it's in pre-login stage but you can access 249.13s - 257.68s | post-login modules as well. Alright, so the example for this is forgot password functionality. 257.68s - 263.00s | How forgot password functionality works? Like there is a forgot password module, you can 263.00s - 268.76s | enter your email ID, application will redirect you to another page where application will 268.76s - 275.76s | ask you for OTPs or maybe security questions and if you provide OTP, correct OTP or correct 276.32s - 281.72s | security questions answer, application will redirect you to another page where you can 281.72s - 286.64s | enter the new password and change the password. But for the second page where application 286.64s - 292.36s | is asking for security questions answer or OTP, application have created a session which 292.36s - 298.28s | is linked with your email ID which you provided on the first page. But that if the application 298.28s - 303.96s | is misconfigured and that session variable, session ID is having over permissions, you 303.96s - 310.36s | can without entering the security answer or OTP, you can access the post-login modules 310.36s - 316.20s | by just using that particular session ID because it is activated globally. So this issue I 316.20s - 324.61s | have identified in Apple and I will show in the later slides. Alright, other vulnerability 324.61s - 331.61s | is session fixation. As name suggests that in this vulnerability you can fix the session 332.69s - 339.45s | in pre-login stage. Basically the pre-login and post-login session variables value will 339.45s - 345.73s | remain same. It will be just the state of the session token which will become active 345.73s - 352.73s | or de-active. Alright, so there are two ways we can use this vulnerability. One is we can 355.13s - 362.13s | whenever your victim is in the remote location, so how you can leverage that? So if you are 363.61s - 370.61s | able to get the session ID in URL in pre-login stage, what you can do, you can copy that 371.49s


chunk_id: 168_chunk_5
chunk_text:
that if the application 298.28s - 303.96s | is misconfigured and that session variable, session ID is having over permissions, you 303.96s - 310.36s | can without entering the security answer or OTP, you can access the post-login modules 310.36s - 316.20s | by just using that particular session ID because it is activated globally. So this issue I 316.20s - 324.61s | have identified in Apple and I will show in the later slides. Alright, other vulnerability 324.61s - 331.61s | is session fixation. As name suggests that in this vulnerability you can fix the session 332.69s - 339.45s | in pre-login stage. Basically the pre-login and post-login session variables value will 339.45s - 345.73s | remain same. It will be just the state of the session token which will become active 345.73s - 352.73s | or de-active. Alright, so there are two ways we can use this vulnerability. One is we can 355.13s - 362.13s | whenever your victim is in the remote location, so how you can leverage that? So if you are 363.61s - 370.61s | able to get the session ID in URL in pre-login stage, what you can do, you can copy that 371.49s - 377.45s | and send it to your victims. Alright, whenever your victim will click on that link, since 377.45s - 383.77s | the link belongs to the legitimate application, victim will click on that and will enter the 383.81s - 390.81s | credentials. When victim will enter the credentials, the session ID will become in an active state. 390.81s - 394.65s | Since you are the one, you are the attacker, you have that session ID, you can use it on 394.65s - 399.85s | your machine and you can login into the victim's account directly. You don't have to enter 399.85s - 406.35s | the passwords. So that's how you can bypass the authentication and take over the accounts. 406.35s - 412.81s | This is when your victim is remote. The other thing is whenever let's say you are working 412.81s - 418.69s | on a shared machine. There is a machine which is shared by multiple users. So what you can 418.69s - 425.05s | do, you can go to that machine, you can copy the cookies. Since pre-login and post-login 425.05s - 429.65s | cookie will be same, you can just copy that and whenever your


chunk_id: 168_chunk_6
chunk_text:
- 377.45s | and send it to your victims. Alright, whenever your victim will click on that link, since 377.45s - 383.77s | the link belongs to the legitimate application, victim will click on that and will enter the 383.81s - 390.81s | credentials. When victim will enter the credentials, the session ID will become in an active state. 390.81s - 394.65s | Since you are the one, you are the attacker, you have that session ID, you can use it on 394.65s - 399.85s | your machine and you can login into the victim's account directly. You don't have to enter 399.85s - 406.35s | the passwords. So that's how you can bypass the authentication and take over the accounts. 406.35s - 412.81s | This is when your victim is remote. The other thing is whenever let's say you are working 412.81s - 418.69s | on a shared machine. There is a machine which is shared by multiple users. So what you can 418.69s - 425.05s | do, you can go to that machine, you can copy the cookies. Since pre-login and post-login 425.05s - 429.65s | cookie will be same, you can just copy that and whenever your victim will login to that 429.65s - 434.29s | particular application, you can use that cookie and you can bypass the authentication by using 434.29s - 443.24s | victim's account. Alright, the other is access control checks. IDRs, IDRs are best friends. 444.92s - 450.96s | We can use that to perform a number of activities and one of them is account takeovers and authentication 450.96s - 456.16s | bypasses. So how you can take over the accounts? For example, application performing some sort 456.16s - 461.48s | of sensitive activities like change password, update profiles by just checking the user's 461.48s - 468.32s | ID. Sometimes it's in even hidden parameters. You can use tools like client-side proxy tool 468.32s - 474.96s | like Bob suit and you can just modify the user ID and if the application is vulnerable, 474.96s - 481.08s | you will be able to take over the accounts of your victims. The other is privilege escalations. 481.08s - 486.88s | Let's say if you are performing grey box assessments as a pen tester. So you will be aware with 486.88s - 493.88s | admin level modules as well and non-privileged user or non-admin users


chunk_id: 168_chunk_7
chunk_text:
victim will login to that 429.65s - 434.29s | particular application, you can use that cookie and you can bypass the authentication by using 434.29s - 443.24s | victim's account. Alright, the other is access control checks. IDRs, IDRs are best friends. 444.92s - 450.96s | We can use that to perform a number of activities and one of them is account takeovers and authentication 450.96s - 456.16s | bypasses. So how you can take over the accounts? For example, application performing some sort 456.16s - 461.48s | of sensitive activities like change password, update profiles by just checking the user's 461.48s - 468.32s | ID. Sometimes it's in even hidden parameters. You can use tools like client-side proxy tool 468.32s - 474.96s | like Bob suit and you can just modify the user ID and if the application is vulnerable, 474.96s - 481.08s | you will be able to take over the accounts of your victims. The other is privilege escalations. 481.08s - 486.88s | Let's say if you are performing grey box assessments as a pen tester. So you will be aware with 486.88s - 493.88s | admin level modules as well and non-privileged user or non-admin users modules as well. So 494.48s - 499.44s | you can login into the least privileged user account and you can try to access the admin 499.44s - 504.76s | account and if the application is vulnerable to access controls and privilege escalations, 504.76s - 511.28s | you can access the admin level modules. Alright, depending on the application's functionality, 511.28s - 517.08s | let's say there could be a number of you know, sensitive modules where you can play with 517.08s - 522.64s | maybe let's say there is an admin module where you can see the number of users. You can deactivate 522.64s - 527.88s | their accounts. You can change their passwords. You can block them. You know, you can depending 527.88s - 532.04s | on the application's functionality, you can do a number of things. Other thing is forced 532.04s - 539.04s | browsing. Forced browsing is something when you are forcefully trying to access post-authentication 539.14s - 545.76s | modules by just hitting them without providing any credentials. If there is access control 545.76s - 551.48s | bug, you will be able to access the post-login modules as well. And let's say there are configuration 551.72s


chunk_id: 168_chunk_8
chunk_text:
modules as well. So 494.48s - 499.44s | you can login into the least privileged user account and you can try to access the admin 499.44s - 504.76s | account and if the application is vulnerable to access controls and privilege escalations, 504.76s - 511.28s | you can access the admin level modules. Alright, depending on the application's functionality, 511.28s - 517.08s | let's say there could be a number of you know, sensitive modules where you can play with 517.08s - 522.64s | maybe let's say there is an admin module where you can see the number of users. You can deactivate 522.64s - 527.88s | their accounts. You can change their passwords. You can block them. You know, you can depending 527.88s - 532.04s | on the application's functionality, you can do a number of things. Other thing is forced 532.04s - 539.04s | browsing. Forced browsing is something when you are forcefully trying to access post-authentication 539.14s - 545.76s | modules by just hitting them without providing any credentials. If there is access control 545.76s - 551.48s | bug, you will be able to access the post-login modules as well. And let's say there are configuration 551.72s - 557.16s | files which are not linked with the application but are still present in the server. So you 557.16s - 562.36s | can access those configuration files and you know, it will share, it will disclose a lot 562.36s - 569.16s | of sensitive information depending on what kind of configuration file is there. Alright, 569.16s - 576.16s | next is password reset link hijacking or poisoning by using host header injection. So let me 577.16s - 582.24s | explain what is host header injection and how it works first. Then we will dig into 582.24s - 587.88s | the how we can abuse it. So whenever you are hitting an application, application verify 587.88s - 594.88s | okay what's the value of host header, it's origin and accordingly application will fetch 595.56s - 602.92s | the responses from that particular application server and assign to you the resources. So 603.04s - 609.36s | whenever you are having redirection 301, 302, you can use host header vulnerability. You 609.36s - 613.88s | can change the host header's value and you can check the location header if your host 613.88s - 619.52s | header's value is getting reflected into


chunk_id: 168_chunk_9
chunk_text:
- 557.16s | files which are not linked with the application but are still present in the server. So you 557.16s - 562.36s | can access those configuration files and you know, it will share, it will disclose a lot 562.36s - 569.16s | of sensitive information depending on what kind of configuration file is there. Alright, 569.16s - 576.16s | next is password reset link hijacking or poisoning by using host header injection. So let me 577.16s - 582.24s | explain what is host header injection and how it works first. Then we will dig into 582.24s - 587.88s | the how we can abuse it. So whenever you are hitting an application, application verify 587.88s - 594.88s | okay what's the value of host header, it's origin and accordingly application will fetch 595.56s - 602.92s | the responses from that particular application server and assign to you the resources. So 603.04s - 609.36s | whenever you are having redirection 301, 302, you can use host header vulnerability. You 609.36s - 613.88s | can change the host header's value and you can check the location header if your host 613.88s - 619.52s | header's value is getting reflected into the location header in the response itself. How 619.52s - 624.48s | you can use it to take over the accounts. So for example, there is a forgot password 624.48s - 629.00s | functionality you can go there, you can enter your victim's email ID, you can capture the 629.04s - 635.40s | request by using bobsuit and you can change the host value to the domain which you can 635.40s - 642.40s | control. Alright, so here 0xnoob is for example my domain, I'm a attacker. Alright, so I can 644.08s - 649.12s | enter my victim's email ID, I can capture the request and I can change the host header 649.12s - 654.48s | value to 0xnoob. So what application will do? How forgot password functionality works? 654.48s - 659.20s | Application will send you a reset token link to your email ID, you can click on that and 659.20s - 663.92s | update the password. But here since you have updated the host header value, application 663.92s - 670.92s | server will send a password reset link to your email ID with the password reset token 671.40s - 678.40s | but the URL which will be embedded


chunk_id: 168_chunk_10
chunk_text:
the location header in the response itself. How 619.52s - 624.48s | you can use it to take over the accounts. So for example, there is a forgot password 624.48s - 629.00s | functionality you can go there, you can enter your victim's email ID, you can capture the 629.04s - 635.40s | request by using bobsuit and you can change the host value to the domain which you can 635.40s - 642.40s | control. Alright, so here 0xnoob is for example my domain, I'm a attacker. Alright, so I can 644.08s - 649.12s | enter my victim's email ID, I can capture the request and I can change the host header 649.12s - 654.48s | value to 0xnoob. So what application will do? How forgot password functionality works? 654.48s - 659.20s | Application will send you a reset token link to your email ID, you can click on that and 659.20s - 663.92s | update the password. But here since you have updated the host header value, application 663.92s - 670.92s | server will send a password reset link to your email ID with the password reset token 671.40s - 678.40s | but the URL which will be embedded will be 0xnoob or the domain which you will provide. 679.40s - 686.40s | Alright, so since it is coming from the legitimate application server, victim will click on the 686.84s - 691.80s | link, you can use it in red teaming activities, you can try it on pen testing, bug bounty 691.80s - 698.80s | hunting. Victim will click on that particular link and you can go to your server logs and 699.64s - 706.20s | you can capture the, you can grab the reset token. Since it's still in the active state 706.20s - 711.44s | because victim haven't used it on legitimate application yet. So you can go to the legitimate 711.44s - 717.60s | application and embed that particular token and that's how you can take over the accounts 717.60s - 722.48s | because a token is still in active state. You can enter the credentials and you can 722.48s - 730.92s | change the credentials of your victim. That's how you can take over the accounts. JS files, 730.92s - 736.84s | a lot of people usually don't get into the JS files, they don't bother about it. But 736.88s - 743.88s | JS files


chunk_id: 168_chunk_11
chunk_text:
will be 0xnoob or the domain which you will provide. 679.40s - 686.40s | Alright, so since it is coming from the legitimate application server, victim will click on the 686.84s - 691.80s | link, you can use it in red teaming activities, you can try it on pen testing, bug bounty 691.80s - 698.80s | hunting. Victim will click on that particular link and you can go to your server logs and 699.64s - 706.20s | you can capture the, you can grab the reset token. Since it's still in the active state 706.20s - 711.44s | because victim haven't used it on legitimate application yet. So you can go to the legitimate 711.44s - 717.60s | application and embed that particular token and that's how you can take over the accounts 717.60s - 722.48s | because a token is still in active state. You can enter the credentials and you can 722.48s - 730.92s | change the credentials of your victim. That's how you can take over the accounts. JS files, 730.92s - 736.84s | a lot of people usually don't get into the JS files, they don't bother about it. But 736.88s - 743.88s | JS files are something which are very crucial and sometimes it's having some sort of sensitive 743.88s - 749.44s | stuff, funny stuff, I mean depending on, you know, what sort of stuff is that. So you can 749.44s - 758.58s | find API keys, you can find credentials, you can even find the sensitive API end points. 758.78s - 775.26s | PHP type juggling, give me a moment. So type juggling is a feature of PHP. What does it 776.02s - 783.02s | means? So it's a functionality of PHP where you don't have to define the data types, PHP 784.62s - 791.62s | will do it for you. PHP will, whenever PHP will perform any operations or comparisons 791.98s - 797.18s | on the variables or parameters, PHP will convert the data type accordingly and perform the 797.18s - 804.18s | action. For example, the first parameter is number one, which is a string, 10 is in double 804.78s - 811.22s | quotes. The second parameter is number two, which is five, which is integer. And in third 811.22s - 816.62s | parameter we are performing operation, additional operation. Okay, so whenever we are performing 816.62s - 823.62s | addition,


chunk_id: 168_chunk_12
chunk_text:
are something which are very crucial and sometimes it's having some sort of sensitive 743.88s - 749.44s | stuff, funny stuff, I mean depending on, you know, what sort of stuff is that. So you can 749.44s - 758.58s | find API keys, you can find credentials, you can even find the sensitive API end points. 758.78s - 775.26s | PHP type juggling, give me a moment. So type juggling is a feature of PHP. What does it 776.02s - 783.02s | means? So it's a functionality of PHP where you don't have to define the data types, PHP 784.62s - 791.62s | will do it for you. PHP will, whenever PHP will perform any operations or comparisons 791.98s - 797.18s | on the variables or parameters, PHP will convert the data type accordingly and perform the 797.18s - 804.18s | action. For example, the first parameter is number one, which is a string, 10 is in double 804.78s - 811.22s | quotes. The second parameter is number two, which is five, which is integer. And in third 811.22s - 816.62s | parameter we are performing operation, additional operation. Okay, so whenever we are performing 816.62s - 823.62s | addition, PHP will convert string, which is 10, to an integer and will perform the addition 823.86s - 830.86s | operation. So the result will be 15, 10 plus 5 is 15. So the other thing is comparison. 834.94s - 841.94s | Whenever PHP will perform a comparison by using two times equals to, so what PHP will 842.62s - 848.26s | do, first parameter here is integer, second is string. So the second parameter's value 848.26s - 854.70s | is 10 ABC, which is a string. Whenever you will perform a comparison operation here, 854.70s - 861.70s | PHP will convert that string 10 ABC to 10, which will become integer. And then PHP will 862.70s - 868.94s | perform the action accordingly. So 10 is equal to 10, so the result will be equals. How we 868.94s - 875.94s | can leverage it to take over the accounts? Alright, so let's say there is a value of 877.30s - 884.30s | parameter, which is, which don't have the integer. So if you will convert that string 885.10s - 891.34s | with the integer, PHP will convert that string to zero and then it will compare with the 891.38s -


chunk_id: 168_chunk_13
chunk_text:
PHP will convert string, which is 10, to an integer and will perform the addition 823.86s - 830.86s | operation. So the result will be 15, 10 plus 5 is 15. So the other thing is comparison. 834.94s - 841.94s | Whenever PHP will perform a comparison by using two times equals to, so what PHP will 842.62s - 848.26s | do, first parameter here is integer, second is string. So the second parameter's value 848.26s - 854.70s | is 10 ABC, which is a string. Whenever you will perform a comparison operation here, 854.70s - 861.70s | PHP will convert that string 10 ABC to 10, which will become integer. And then PHP will 862.70s - 868.94s | perform the action accordingly. So 10 is equal to 10, so the result will be equals. How we 868.94s - 875.94s | can leverage it to take over the accounts? Alright, so let's say there is a value of 877.30s - 884.30s | parameter, which is, which don't have the integer. So if you will convert that string 885.10s - 891.34s | with the integer, PHP will convert that string to zero and then it will compare with the 891.38s - 898.38s | user's provided input. So for example, the admin's password is not having integer value, 899.58s - 906.58s | having a string only. So as an attacker, you can mention zero in the password. PHP will 906.58s - 911.94s | compare it with admin password. Admin password is a string. PHP will convert admin's password 911.94s - 918.62s | to zero and zero is equal to zero will become a true statement. That's how you can bypass 918.62s - 925.62s | the authentication. But there is a prerequisite. It should be JSON or serialized object. Then 928.34s - 937.72s | only you will be able to perform this attack. CSRF, let's say if in the application CSRF 937.72s - 943.16s | tokens are missing and there is no CSRF protection. And there is a module where you can update 943.16s - 949.08s | the mobile number, email ID, you can craft a HTML page and send it to your victim if 949.08s - 956.08s | that victim is logged in into their account, you can literally update their mobile numbers 956.12s - 961.20s | and email address. Once you will be able to do that, you can request for


chunk_id: 168_chunk_14
chunk_text:
898.38s | user's provided input. So for example, the admin's password is not having integer value, 899.58s - 906.58s | having a string only. So as an attacker, you can mention zero in the password. PHP will 906.58s - 911.94s | compare it with admin password. Admin password is a string. PHP will convert admin's password 911.94s - 918.62s | to zero and zero is equal to zero will become a true statement. That's how you can bypass 918.62s - 925.62s | the authentication. But there is a prerequisite. It should be JSON or serialized object. Then 928.34s - 937.72s | only you will be able to perform this attack. CSRF, let's say if in the application CSRF 937.72s - 943.16s | tokens are missing and there is no CSRF protection. And there is a module where you can update 943.16s - 949.08s | the mobile number, email ID, you can craft a HTML page and send it to your victim if 949.08s - 956.08s | that victim is logged in into their account, you can literally update their mobile numbers 956.12s - 961.20s | and email address. Once you will be able to do that, you can request for forward password, 961.20s - 966.16s | you know, by entering the email or password with email or mobile number, which you have 966.16s - 973.16s | mentioned during the HTML page creation, then you can take over the accounts because application 974.16s - 980.16s | will send the OTPs or password reset links to your phone number and email ID, which belongs 980.16s - 985.96s | to the user's, the victim's account. Let's say if there is a forward password functionality 985.96s - 991.12s | where application is not asking for old passwords and application is vulnerable to CSRF, you 991.12s - 995.52s | can just craft a request and send to, you know, your victim and you will be able to 995.52s - 1001.96s | change the password. From there you can take over the accounts. HTTP parameter pollution. 1001.96s - 1008.64s | It's a vulnerability where you can mention multiple parameters with the same name, but 1008.64s - 1014.04s | the values will be different and the application will perform the action on the basis of that. 1014.04s - 1021.04s | So let's say there is a forward password functionality, all right? And you can mention maybe you


chunk_id: 168_chunk_15
chunk_text:
forward password, 961.20s - 966.16s | you know, by entering the email or password with email or mobile number, which you have 966.16s - 973.16s | mentioned during the HTML page creation, then you can take over the accounts because application 974.16s - 980.16s | will send the OTPs or password reset links to your phone number and email ID, which belongs 980.16s - 985.96s | to the user's, the victim's account. Let's say if there is a forward password functionality 985.96s - 991.12s | where application is not asking for old passwords and application is vulnerable to CSRF, you 991.12s - 995.52s | can just craft a request and send to, you know, your victim and you will be able to 995.52s - 1001.96s | change the password. From there you can take over the accounts. HTTP parameter pollution. 1001.96s - 1008.64s | It's a vulnerability where you can mention multiple parameters with the same name, but 1008.64s - 1014.04s | the values will be different and the application will perform the action on the basis of that. 1014.04s - 1021.04s | So let's say there is a forward password functionality, all right? And you can mention maybe you can 1021.48s - 1028.48s | use that one parameter for twice, for two times, and mention the victim's email ID plus 1028.96s - 1034.60s | your own email ID. So if the application is vulnerable, application will send password 1034.60s - 1041.60s | reset token to both the email IDs, but it will be activated for one account only, depending 1041.80s - 1047.64s | on how application is, you know, doing that. Maybe it is validating the first parameter 1047.64s - 1051.96s | or second parameter. That you have to figure out. It depends on different applications. 1051.96s - 1057.84s | I mean, so accordingly, let's say if it is, let's say whenever you will receive that link, 1057.84s - 1062.72s | you can just go to application and you can just change the password of your victim and 1062.72s - 1067.60s | you can take over the account. You can try this on reset password, update password, wherever 1067.60s - 1076.23s | you are receiving OTPs, you can try that vulnerability. Authentication bypasses by using response 1076.35s - 1083.35s | manipulation. So a few applications are validating the previous response and then perform the 1084.35s - 1091.35s | next


chunk_id: 168_chunk_16
chunk_text:
can 1021.48s - 1028.48s | use that one parameter for twice, for two times, and mention the victim's email ID plus 1028.96s - 1034.60s | your own email ID. So if the application is vulnerable, application will send password 1034.60s - 1041.60s | reset token to both the email IDs, but it will be activated for one account only, depending 1041.80s - 1047.64s | on how application is, you know, doing that. Maybe it is validating the first parameter 1047.64s - 1051.96s | or second parameter. That you have to figure out. It depends on different applications. 1051.96s - 1057.84s | I mean, so accordingly, let's say if it is, let's say whenever you will receive that link, 1057.84s - 1062.72s | you can just go to application and you can just change the password of your victim and 1062.72s - 1067.60s | you can take over the account. You can try this on reset password, update password, wherever 1067.60s - 1076.23s | you are receiving OTPs, you can try that vulnerability. Authentication bypasses by using response 1076.35s - 1083.35s | manipulation. So a few applications are validating the previous response and then perform the 1084.35s - 1091.35s | next action, all right? So let's say the response is on the basis of true or false. If you have 1094.87s - 1101.87s | provided the right credentials, application is throwing you the true response, okay? And 1102.31s - 1107.35s | if you have provided the wrong credentials, application will throw the false response. 1107.35s - 1113.07s | So you can change that to true and you can perform the next action. You can bypass it. 1113.35s - 1119.35s | Similarly, you can manipulate the status codes. If application is throwing 400 or something 1119.35s - 1125.99s | for wrong credentials and throwing 200, okay, for right credentials, you can try to manipulate 1125.99s - 1135.90s | that. Two-factor authentication or OTP, you can break that. How? So whenever you are performing 1138.34s - 1145.10s | pen testing specially, you can use these things. You can check for the integrity validation 1145.10s - 1151.86s | of OTPs. For example, I can send OTP to my mobile number and send OTP to my victim's 1151.86s - 1158.86s | mobile number. So these two OTPs are in active state now because neither I used nor my victim 1161.18s - 1166.66s | used it


chunk_id: 168_chunk_17
chunk_text:
action, all right? So let's say the response is on the basis of true or false. If you have 1094.87s - 1101.87s | provided the right credentials, application is throwing you the true response, okay? And 1102.31s - 1107.35s | if you have provided the wrong credentials, application will throw the false response. 1107.35s - 1113.07s | So you can change that to true and you can perform the next action. You can bypass it. 1113.35s - 1119.35s | Similarly, you can manipulate the status codes. If application is throwing 400 or something 1119.35s - 1125.99s | for wrong credentials and throwing 200, okay, for right credentials, you can try to manipulate 1125.99s - 1135.90s | that. Two-factor authentication or OTP, you can break that. How? So whenever you are performing 1138.34s - 1145.10s | pen testing specially, you can use these things. You can check for the integrity validation 1145.10s - 1151.86s | of OTPs. For example, I can send OTP to my mobile number and send OTP to my victim's 1151.86s - 1158.86s | mobile number. So these two OTPs are in active state now because neither I used nor my victim 1161.18s - 1166.66s | used it for now. So what can I do? Since both the OTPs are in active state, I can check 1166.66s - 1173.58s | the integrity. I can try my OTP on my victim's account just to validate that application 1173.58s - 1181.04s | is checking the integrity of the OTP or not. And trust me, it's still working. Reusability 1181.04s - 1188.04s | of OTPs, you can try to reuse the OTPs. And the third one is I found it in one of the 1189.12s - 1196.12s | most popular banks. So they were disclosing the OTPs in the responses. So I mean, go for 1197.12s - 1204.12s | it, check for responses as well. Master OTPs, I found it in one of the net banking application. 1207.60s - 1213.68s | The master OTP was six times zeros. So you can log into any account by using six times 1213.68s - 1222.54s | zero. I mean, you can try for other stuff also. So go for it. All right, brute force. 1223.18s - 1230.18s | So whenever we are thinking about brute force, we are trying to brute force the passwords. 1230.30s - 1237.06s | We can try another way as


chunk_id: 168_chunk_18
chunk_text:
for now. So what can I do? Since both the OTPs are in active state, I can check 1166.66s - 1173.58s | the integrity. I can try my OTP on my victim's account just to validate that application 1173.58s - 1181.04s | is checking the integrity of the OTP or not. And trust me, it's still working. Reusability 1181.04s - 1188.04s | of OTPs, you can try to reuse the OTPs. And the third one is I found it in one of the 1189.12s - 1196.12s | most popular banks. So they were disclosing the OTPs in the responses. So I mean, go for 1197.12s - 1204.12s | it, check for responses as well. Master OTPs, I found it in one of the net banking application. 1207.60s - 1213.68s | The master OTP was six times zeros. So you can log into any account by using six times 1213.68s - 1222.54s | zero. I mean, you can try for other stuff also. So go for it. All right, brute force. 1223.18s - 1230.18s | So whenever we are thinking about brute force, we are trying to brute force the passwords. 1230.30s - 1237.06s | We can try another way as well by using password spraying attack. We can brute force the emails 1237.06s - 1242.46s | by using one password. We have one password and we can try that on multiple users. We 1242.46s - 1246.58s | can try to brute force in that way as well. So whenever you are performing red teaming 1246.58s - 1251.54s | activities or bug hunting or something, you just need one account to perform your actions. 1251.54s - 1258.18s | So this will be very handy. Try to check if there are rate limiting controls are enabled 1258.18s - 1265.18s | or not. Other than that, sometimes application is blocking your IP address whenever you are 1265.82s - 1271.98s | performing brute force attacks. So you can hop on different, you know, IP addresses. 1271.98s - 1277.26s | You can change your IP addresses depending on how application is blocking it. Maybe after 1277.26s - 1283.54s | 15 requests or 50 requests and just before, let's say application is blocking IP after 1283.54s - 1289.86s | every 50 requests, you know, within maybe some sort of time foundation. So you can change 1289.86s - 1297.63s | on, you can change your IP on


chunk_id: 168_chunk_19
chunk_text:
well by using password spraying attack. We can brute force the emails 1237.06s - 1242.46s | by using one password. We have one password and we can try that on multiple users. We 1242.46s - 1246.58s | can try to brute force in that way as well. So whenever you are performing red teaming 1246.58s - 1251.54s | activities or bug hunting or something, you just need one account to perform your actions. 1251.54s - 1258.18s | So this will be very handy. Try to check if there are rate limiting controls are enabled 1258.18s - 1265.18s | or not. Other than that, sometimes application is blocking your IP address whenever you are 1265.82s - 1271.98s | performing brute force attacks. So you can hop on different, you know, IP addresses. 1271.98s - 1277.26s | You can change your IP addresses depending on how application is blocking it. Maybe after 1277.26s - 1283.54s | 15 requests or 50 requests and just before, let's say application is blocking IP after 1283.54s - 1289.86s | every 50 requests, you know, within maybe some sort of time foundation. So you can change 1289.86s - 1297.63s | on, you can change your IP on 49th attempt. Accordingly, you can try that. You can send 1297.63s - 1304.63s | multiple credentials in request to validate that, I mean, it is working or not. There 1304.87s - 1311.87s | is a very, very good lab of web security academy. Please check that. Default credentials, if 1313.35s - 1320.35s | you are, okay, this is very, very handy in red teaming activities. So, I mean, almost 1320.55s - 1326.71s | every organisation is using enterprise products. Go for it. Check for the default credentials. 1326.71s - 1333.71s | I mean, it's still working. I usually find that. Wordpress, it is one of the most popular 1335.11s - 1342.11s | CMS. So there is a so-called feature in Wordpress where you can use author parameter just to 1343.91s - 1350.51s | verify that what's the username of one. I mean, let's say if you will enter the author's 1350.51s - 1355.03s | value one, it will show you the first user of that particular application. If you will 1355.03s - 1359.75s | change it to two, it will show you the second user of that particular application. It will 1359.75s - 1364.31s | show you the username. It


chunk_id: 168_chunk_20
chunk_text:
49th attempt. Accordingly, you can try that. You can send 1297.63s - 1304.63s | multiple credentials in request to validate that, I mean, it is working or not. There 1304.87s - 1311.87s | is a very, very good lab of web security academy. Please check that. Default credentials, if 1313.35s - 1320.35s | you are, okay, this is very, very handy in red teaming activities. So, I mean, almost 1320.55s - 1326.71s | every organisation is using enterprise products. Go for it. Check for the default credentials. 1326.71s - 1333.71s | I mean, it's still working. I usually find that. Wordpress, it is one of the most popular 1335.11s - 1342.11s | CMS. So there is a so-called feature in Wordpress where you can use author parameter just to 1343.91s - 1350.51s | verify that what's the username of one. I mean, let's say if you will enter the author's 1350.51s - 1355.03s | value one, it will show you the first user of that particular application. If you will 1355.03s - 1359.75s | change it to two, it will show you the second user of that particular application. It will 1359.75s - 1364.31s | show you the username. It will show you the posts which are done by that user. It will, 1364.31s - 1369.19s | it might show you the comments as well. So accordingly, you can, you know, enumerate 1369.19s - 1376.19s | user's information. And whenever you are performing WP scan, don't perform directly from the, 1376.83s - 1383.71s | you know, without using API keys. Please use API key. You can go to WP scan website. You 1383.71s - 1389.95s | can get API key. It's free of cost. And by using that particular API key, if you will 1390.27s - 1397.45s | perform the WP scan, the results will be definitely different. In secure logout management, whenever 1397.45s - 1403.77s | you are working on pen testing, check for these things, especially for banking applications. 1403.77s - 1408.77s | For example, reuse of session. Check if you can reuse that particular session. Login to 1408.77s - 1415.17s | the application, logout from the application. Check if you can still use the old sessions. 1415.17s - 1420.85s | Close the browser for the sensitive applications. Whenever you are closing the browser, it should, 1420.85s - 1425.81s | you know, dissolve the entire session at the


chunk_id: 168_chunk_21
chunk_text:
will show you the posts which are done by that user. It will, 1364.31s - 1369.19s | it might show you the comments as well. So accordingly, you can, you know, enumerate 1369.19s - 1376.19s | user's information. And whenever you are performing WP scan, don't perform directly from the, 1376.83s - 1383.71s | you know, without using API keys. Please use API key. You can go to WP scan website. You 1383.71s - 1389.95s | can get API key. It's free of cost. And by using that particular API key, if you will 1390.27s - 1397.45s | perform the WP scan, the results will be definitely different. In secure logout management, whenever 1397.45s - 1403.77s | you are working on pen testing, check for these things, especially for banking applications. 1403.77s - 1408.77s | For example, reuse of session. Check if you can reuse that particular session. Login to 1408.77s - 1415.17s | the application, logout from the application. Check if you can still use the old sessions. 1415.17s - 1420.85s | Close the browser for the sensitive applications. Whenever you are closing the browser, it should, 1420.85s - 1425.81s | you know, dissolve the entire session at the server side. Let's say if there is a net 1425.81s - 1430.41s | banking application and you are closing the browser, whenever you are again accessing 1430.41s - 1435.69s | the application by using new tab, it shouldn't work. I mean, application should ask you for 1435.69s - 1441.77s | the login. Session should bound to IP address for sensitive applications. For example, as 1441.77s - 1448.77s | an attacker, if I am able to get the session of my victim, okay, but if let's say that 1448.77s - 1457.43s | is bound to their IP address only, I won't be able to use that. Check for it. All right. 1458.31s - 1465.19s | So tips for red teamers and pen testers. Go to pastebin whenever you are performing red 1465.19s - 1472.19s | teaming activities. Go to pastebin. Pastebin have a lot of sensitive stuff. DHash, go for 1472.35s - 1477.83s | DHash. I mean, you can find the passwords of your victims. Open bug bounty. So this 1477.83s - 1483.71s | website is very handy. I use it multiple times and it helped me a lot. So you can find 1483.71s - 1490.71s | a lot of vulnerabilities


chunk_id: 168_chunk_22
chunk_text:
server side. Let's say if there is a net 1425.81s - 1430.41s | banking application and you are closing the browser, whenever you are again accessing 1430.41s - 1435.69s | the application by using new tab, it shouldn't work. I mean, application should ask you for 1435.69s - 1441.77s | the login. Session should bound to IP address for sensitive applications. For example, as 1441.77s - 1448.77s | an attacker, if I am able to get the session of my victim, okay, but if let's say that 1448.77s - 1457.43s | is bound to their IP address only, I won't be able to use that. Check for it. All right. 1458.31s - 1465.19s | So tips for red teamers and pen testers. Go to pastebin whenever you are performing red 1465.19s - 1472.19s | teaming activities. Go to pastebin. Pastebin have a lot of sensitive stuff. DHash, go for 1472.35s - 1477.83s | DHash. I mean, you can find the passwords of your victims. Open bug bounty. So this 1477.83s - 1483.71s | website is very handy. I use it multiple times and it helped me a lot. So you can find 1483.71s - 1490.71s | a lot of vulnerabilities which are identified by other attackers. All right. And they have 1491.91s - 1498.91s | disclosed those vulnerabilities publicly because the vendor is not entertaining them. All right. 1499.91s - 1510.24s | So you can use those vulnerabilities. My first bug, I found it in Apple. I found account 1511.52s - 1517.16s | takeover or authentication bypass basically. I will call it as authentication bypass. So 1517.16s - 1529.44s | that was my first bug in Apple. So this was session puzzling which I explained in the 1530.44s - 1537.44s | earlier stage. So I was able to get the session variable which was active for post-login modules 1539.20s - 1546.20s | as well in the pre-login stage. So here I am on login page. I'm trying. Okay. Application 1549.88s - 1556.24s | is redirecting me to the login page only. Okay. There is a story behind that. So the 1556.28s - 1563.28s | domain name is InstaVision.Apple.com. If I will go to that domain directly, it will redirect 1563.76s - 1570.40s | me to the SSO of Apple. Based on my understanding, it is a bit secure. I haven't tested that 1570.40s - 1577.40s | to be honest. But


chunk_id: 168_chunk_23
chunk_text:
which are identified by other attackers. All right. And they have 1491.91s - 1498.91s | disclosed those vulnerabilities publicly because the vendor is not entertaining them. All right. 1499.91s - 1510.24s | So you can use those vulnerabilities. My first bug, I found it in Apple. I found account 1511.52s - 1517.16s | takeover or authentication bypass basically. I will call it as authentication bypass. So 1517.16s - 1529.44s | that was my first bug in Apple. So this was session puzzling which I explained in the 1530.44s - 1537.44s | earlier stage. So I was able to get the session variable which was active for post-login modules 1539.20s - 1546.20s | as well in the pre-login stage. So here I am on login page. I'm trying. Okay. Application 1549.88s - 1556.24s | is redirecting me to the login page only. Okay. There is a story behind that. So the 1556.28s - 1563.28s | domain name is InstaVision.Apple.com. If I will go to that domain directly, it will redirect 1563.76s - 1570.40s | me to the SSO of Apple. Based on my understanding, it is a bit secure. I haven't tested that 1570.40s - 1577.40s | to be honest. But yeah, based on my understanding, it is secure. So then I did some sort of Google 1578.80s - 1584.00s | docking and I got to know that there is a subdirectory with a random string folder name 1584.04s - 1594.21s | and there is a login module there. So I tried to hunt here. I removed the login page. Application 1595.57s - 1604.42s | is redirecting me to login again. Here it is. So application is asking me for a username 1605.34s - 1620.12s | and email address. I provided a fake username and fake email ID. Okay. I got an error that 1620.92s - 1627.92s | please try again. But for this particular thing, when application was throwing me an 1632.76s - 1639.00s | error, application created a session which belongs to my email ID and they have activated 1639.00s - 1650.36s | it for the entire application and which was linked to the admin module. Now I tried to 1650.36s - 1666.06s | remove the login and try to access the subdirectory. Boom. Thank you. So here I was able to download 1668.54s - 1675.54s | the confidential details. I have blurred a few contents because of sensitive


chunk_id: 168_chunk_24
chunk_text:
yeah, based on my understanding, it is secure. So then I did some sort of Google 1578.80s - 1584.00s | docking and I got to know that there is a subdirectory with a random string folder name 1584.04s - 1594.21s | and there is a login module there. So I tried to hunt here. I removed the login page. Application 1595.57s - 1604.42s | is redirecting me to login again. Here it is. So application is asking me for a username 1605.34s - 1620.12s | and email address. I provided a fake username and fake email ID. Okay. I got an error that 1620.92s - 1627.92s | please try again. But for this particular thing, when application was throwing me an 1632.76s - 1639.00s | error, application created a session which belongs to my email ID and they have activated 1639.00s - 1650.36s | it for the entire application and which was linked to the admin module. Now I tried to 1650.36s - 1666.06s | remove the login and try to access the subdirectory. Boom. Thank you. So here I was able to download 1668.54s - 1675.54s | the confidential details. I have blurred a few contents because of sensitive information. 1676.30s - 1696.55s | So yeah, I was able to download as well. Okay. Let's discuss if you have any questions. Please. 1704.78s - 1711.78s | So WBSCAN, if you will use it without API key, it will definitely will give you results. 1713.18s - 1719.50s | But with API keys, I use it in some sort of CTS and even during my red teaming activities, 1719.50s - 1726.22s | it will give you extra privileges, extra features to use that. So by using that extra privileges, 1726.22s - 1734.94s | you can get more information. Sorry? No, no, no. You can go to WBSCAN website and you can 1735.38s - 1743.52s | create a custom key for yourself only. So that will be linked with your account. Yeah, 1743.52s - 1759.93s | please. Sorry? Yeah. It is there. Yeah. No. So we were not discussing about traditional 1759.93s - 1763.69s | brute forces. We were discussing about how you can, you know, if there is still there 1763.69s - 1768.53s | is brute force protection, how you can bypass it. So we were discussing about bypasses. 1768.53s - 1802.98s | Please. Obviously, I'm still exploring that particular things.


chunk_id: 168_chunk_25
chunk_text:
information. 1676.30s - 1696.55s | So yeah, I was able to download as well. Okay. Let's discuss if you have any questions. Please. 1704.78s - 1711.78s | So WBSCAN, if you will use it without API key, it will definitely will give you results. 1713.18s - 1719.50s | But with API keys, I use it in some sort of CTS and even during my red teaming activities, 1719.50s - 1726.22s | it will give you extra privileges, extra features to use that. So by using that extra privileges, 1726.22s - 1734.94s | you can get more information. Sorry? No, no, no. You can go to WBSCAN website and you can 1735.38s - 1743.52s | create a custom key for yourself only. So that will be linked with your account. Yeah, 1743.52s - 1759.93s | please. Sorry? Yeah. It is there. Yeah. No. So we were not discussing about traditional 1759.93s - 1763.69s | brute forces. We were discussing about how you can, you know, if there is still there 1763.69s - 1768.53s | is brute force protection, how you can bypass it. So we were discussing about bypasses. 1768.53s - 1802.98s | Please. Obviously, I'm still exploring that particular things. So yeah. But yeah, valid 1802.98s - 1811.62s | question. I mean, I look into it. I'll definitely look into it. Thank you so much. Excuse me. 1811.98s - 1818.98s | Last thing. I'm still working on authentication bypasses stuff. And if someone from you guys 1818.98s - 1823.54s | is working on authentication bypasses, feel free to reach out to me. I will be more than 1823.54s - 1827.22s | happy to collaborate and, you know, work more on it. Thank you so much.


chunk_id: 168_chunk_26
chunk_text:
So yeah. But yeah, valid 1802.98s - 1811.62s | question. I mean, I look into it. I'll definitely look into it. Thank you so much. Excuse me. 1811.98s - 1818.98s | Last thing. I'm still working on authentication bypasses stuff. And if someone from you guys 1818.98s - 1823.54s | is working on authentication bypasses, feel free to reach out to me. I will be more than 1823.54s - 1827.22s | happy to collaborate and, you know, work more on it. Thank you so much.


chunk_id: 169_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=fc6c2hP86Wk", "title": "DEF CON 32 - Unlocking the Gates Hacking a secure Industrial Remote Access Solution - Moritz Abrell", "description": "Industrial VPN gateways play a crucial role in operational technology by enabling secure remote access to systems within industrial networks. However, their importance goes hand in hand with increased security risks, as their architecture makes them lucrative targets for threat actors. Over the years, we have seen such devices being used in various industrial environments, which underlines their widespread use in critical infrastructures.\n\nThis talk is about a security analysis of a widely used industrial remote access solution. We will dive deep into and expose various vulnerabilities. This includes rooting the device, bypassing hardware-based security mechanisms such as the use of a hardware security module, and reverse engineering software and firmware. Ultimately, we will show how various identified vulnerabilities allowed us to hijack remote access sessions, creating significant security risks.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1105, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 4.85s - 9.85s | This text was transcribed using whisper model: large-v2 So, hi DEF CON, thanks for having me here today. Also, many thanks for those who made it to a 12.29s - 18.59s | Sunday 10 AM DEF CON talk, I really appreciate it. My name is Moritz Abra and I am super 18.59s - 23.99s | excited to present my research, Unlocking the Gates, Hacking a Secure Industrial Remote 23.99s - 29.01s | Access Gateway. In this session we will delve deep into an industrial remote access gateway, 29.63s - 34.63s | uncover vulnerabilities and exploit them to affect critical infrastructure worldwide. But 39.31s - 44.71s | first of all, a few words about myself. My name is Moritz Abra, I'm working as a senior IT 44.71s - 50.35s | security consultant and penetration tester at the German company SUS. So, I love breaking 50.35s - 57.13s | stuff and I also regularly conduct security research and the results has been presented at 57.15s - 64.02s | various security conferences such as Black Hat or DEF CON. So, how does an industrial 64.02s - 70.36s | remote access solution work? Well, they all operate similarly. For instance, a device 70.36s - 76.80s | inside the industrial network establishes a VPN connection to a VPN server. And this server 76.80s - 83.04s | is usually operated by the vendor itself. Now, if a service technician wants


chunk_id: 169_chunk_1
chunk_text:
AM DEF CON talk, I really appreciate it. My name is Moritz Abra and I am super 18.59s - 23.99s | excited to present my research, Unlocking the Gates, Hacking a Secure Industrial Remote 23.99s - 29.01s | Access Gateway. In this session we will delve deep into an industrial remote access gateway, 29.63s - 34.63s | uncover vulnerabilities and exploit them to affect critical infrastructure worldwide. But 39.31s - 44.71s | first of all, a few words about myself. My name is Moritz Abra, I'm working as a senior IT 44.71s - 50.35s | security consultant and penetration tester at the German company SUS. So, I love breaking 50.35s - 57.13s | stuff and I also regularly conduct security research and the results has been presented at 57.15s - 64.02s | various security conferences such as Black Hat or DEF CON. So, how does an industrial 64.02s - 70.36s | remote access solution work? Well, they all operate similarly. For instance, a device 70.36s - 76.80s | inside the industrial network establishes a VPN connection to a VPN server. And this server 76.80s - 83.04s | is usually operated by the vendor itself. Now, if a service technician wants to connect to 83.06s - 88.06s | this uh industrial network, he uses vendor provided software to initiate a VPN connection. 90.62s - 96.70s | Finally, the VPN server routes between those connections and thus the technician is able to 96.70s - 103.21s | reach the targeted infrastructure through the industrial router. So, to analyze such a 103.21s - 110.19s | solution, we need to acquire an industrial remote access gateway. And I chose the EVON 110.23s - 115.23s | COSI Plus by HMS for several reasons. Firstly, it is widely used and the vendor claims that 119.01s - 124.01s | over a half of a million of devices are connected, meaning finding vulnerabilities could have a 126.51s - 131.51s | significant impact. Furthermore, a similar device has already been considered in the past 131.71s - 136.71s | where some problems were identified resulting in a complete refactoring. So, the vendor 140.79s - 147.19s | claims that the COSI Plus is developed with a focus on security and this involves, for 147.19s - 153.47s | example, a hardware security module with a route of trust, individual certificates and secure 153.47s - 158.47s | boot. And the solution was also tested


chunk_id: 169_chunk_2
chunk_text:
to connect to 83.06s - 88.06s | this uh industrial network, he uses vendor provided software to initiate a VPN connection. 90.62s - 96.70s | Finally, the VPN server routes between those connections and thus the technician is able to 96.70s - 103.21s | reach the targeted infrastructure through the industrial router. So, to analyze such a 103.21s - 110.19s | solution, we need to acquire an industrial remote access gateway. And I chose the EVON 110.23s - 115.23s | COSI Plus by HMS for several reasons. Firstly, it is widely used and the vendor claims that 119.01s - 124.01s | over a half of a million of devices are connected, meaning finding vulnerabilities could have a 126.51s - 131.51s | significant impact. Furthermore, a similar device has already been considered in the past 131.71s - 136.71s | where some problems were identified resulting in a complete refactoring. So, the vendor 140.79s - 147.19s | claims that the COSI Plus is developed with a focus on security and this involves, for 147.19s - 153.47s | example, a hardware security module with a route of trust, individual certificates and secure 153.47s - 158.47s | boot. And the solution was also tested and analyzed by an independent company and this 158.91s - 163.91s | company issued a certificate available on the vendor's website stating that the hardware 167.41s - 174.49s | backend and associated software were tested. So, let's take a closer look at this secure 174.49s - 179.49s | gateway. Here we can see the hardware and here the disassembled view. And aside from the 180.49s - 185.49s | mentioned hardware security module, nothing really special is going on on the PCB. But due 191.17s - 197.27s | to the advanced hardware security claims, I initially skipped the hardware analysis to avoid 197.27s - 203.25s | damaging something. And since firmware update files are encrypted, we need a different 203.25s - 208.25s | approach. So, the goal was to find vulnerabilities in the software or firmware using a pure 210.79s - 217.04s | black box approach. Surprisingly, this was quite easy. The device allows uploading custom 219.98s - 224.98s | open VPN configuration files and open VPN on the other hand allows custom com- executing 227.52s - 234.30s | custom commands using the up parameter. So, I attempted to upload a custom VPN configuration 234.30s - 239.30s | with a command.


chunk_id: 169_chunk_3
chunk_text:
and analyzed by an independent company and this 158.91s - 163.91s | company issued a certificate available on the vendor's website stating that the hardware 167.41s - 174.49s | backend and associated software were tested. So, let's take a closer look at this secure 174.49s - 179.49s | gateway. Here we can see the hardware and here the disassembled view. And aside from the 180.49s - 185.49s | mentioned hardware security module, nothing really special is going on on the PCB. But due 191.17s - 197.27s | to the advanced hardware security claims, I initially skipped the hardware analysis to avoid 197.27s - 203.25s | damaging something. And since firmware update files are encrypted, we need a different 203.25s - 208.25s | approach. So, the goal was to find vulnerabilities in the software or firmware using a pure 210.79s - 217.04s | black box approach. Surprisingly, this was quite easy. The device allows uploading custom 219.98s - 224.98s | open VPN configuration files and open VPN on the other hand allows custom com- executing 227.52s - 234.30s | custom commands using the up parameter. So, I attempted to upload a custom VPN configuration 234.30s - 239.30s | with a command. But, unfortunately, the parameter was blacklisted. However, bypassing the 243.14s - 248.14s | filter was also relatively easy. I added two dashes to the up parameter and this bypassed the 251.48s - 258.12s | blacklist without breaking the parameter itself. And finally, the command executed with root 258.12s - 264.40s | privileges. I then uploaded a new VPN configuration file including a reverse shell. And 266.54s - 271.54s | finally, received this root shell. Nevertheless, this was only possible with administrative 273.92s - 278.92s | access to the device. But, there is a way around this. I found a persistent cross-site 281.38s - 288.00s | scripting vulnerability originating from FTP login attempts. This means, when an 288.00s - 293.00s | administrative user visits the login page, the injected JavaScript executes. And the 295.64s - 301.68s | attacker, to make things more convenient, there is an insecure cookie containing the base 64 301.68s - 308.58s | encoded administrative password in plain text. At this point, I would also like to credit 308.58s - 313.58s | Khan Ganeshin who reported probably this issue for a similar device to the vendor, uh, already 315.72s - 320.72s | in 2015. Anyway, combining these vulnerabilities


chunk_id: 169_chunk_4
chunk_text:
But, unfortunately, the parameter was blacklisted. However, bypassing the 243.14s - 248.14s | filter was also relatively easy. I added two dashes to the up parameter and this bypassed the 251.48s - 258.12s | blacklist without breaking the parameter itself. And finally, the command executed with root 258.12s - 264.40s | privileges. I then uploaded a new VPN configuration file including a reverse shell. And 266.54s - 271.54s | finally, received this root shell. Nevertheless, this was only possible with administrative 273.92s - 278.92s | access to the device. But, there is a way around this. I found a persistent cross-site 281.38s - 288.00s | scripting vulnerability originating from FTP login attempts. This means, when an 288.00s - 293.00s | administrative user visits the login page, the injected JavaScript executes. And the 295.64s - 301.68s | attacker, to make things more convenient, there is an insecure cookie containing the base 64 301.68s - 308.58s | encoded administrative password in plain text. At this point, I would also like to credit 308.58s - 313.58s | Khan Ganeshin who reported probably this issue for a similar device to the vendor, uh, already 315.72s - 320.72s | in 2015. Anyway, combining these vulnerabilities creates the following exploit chain. An 320.94s - 325.94s | attacker injects JavaScript code through an FTP login attempt. An administrator visits the 330.12s - 335.12s | login page. The administrator's browser loads JavaScript from the attacker server. The 337.92s - 343.06s | malicious JavaScript accesses and sends the plain text administrative password to the 343.06s - 348.06s | attacker. The attacker then uploads a malicious open VPN configuration and the command 348.38s - 353.38s | executes with root privileges. Alright, so, let's see this in action. On the left side, we 361.07s - 367.60s | can see the victim browser and on the right side, the attacker executing the exploit. Now, 373.40s - 378.40s | the victim visits the login page and the malicious JavaScript is executed. The attacker 379.02s - 386.61s | then uploads the open VPN configuration and after a moment, finally receives a reverse shell. 396.16s - 401.16s | Now, with root access to the device, I was able to analyze the firmware internals. And one 404.86s - 409.88s | of my first interests was how encrypted passwords in configuration files are encrypted. For 409.92s - 414.92s | example, are attackers able to decrypt sensitive data


chunk_id: 169_chunk_5
chunk_text:
creates the following exploit chain. An 320.94s - 325.94s | attacker injects JavaScript code through an FTP login attempt. An administrator visits the 330.12s - 335.12s | login page. The administrator's browser loads JavaScript from the attacker server. The 337.92s - 343.06s | malicious JavaScript accesses and sends the plain text administrative password to the 343.06s - 348.06s | attacker. The attacker then uploads a malicious open VPN configuration and the command 348.38s - 353.38s | executes with root privileges. Alright, so, let's see this in action. On the left side, we 361.07s - 367.60s | can see the victim browser and on the right side, the attacker executing the exploit. Now, 373.40s - 378.40s | the victim visits the login page and the malicious JavaScript is executed. The attacker 379.02s - 386.61s | then uploads the open VPN configuration and after a moment, finally receives a reverse shell. 396.16s - 401.16s | Now, with root access to the device, I was able to analyze the firmware internals. And one 404.86s - 409.88s | of my first interests was how encrypted passwords in configuration files are encrypted. For 409.92s - 414.92s | example, are attackers able to decrypt sensitive data such as passwords or VPN certificates 418.90s - 425.70s | found in configuration files? So, I grabbed the used prefix and found the responsible code in 425.70s - 430.70s | an ARM binary. And due to the use of well-known open SSL functions, the encryption could be 433.32s - 438.38s | quickly reverse engineered and the hard-coded key and IV could be found in the read-only 438.38s - 443.38s | data section. So, by re-implementing the encryption algorithm with the found key and IV, we 445.72s - 450.72s | are now able to decrypt encrypted passwords. Great, but now I was looking for the firmware 454.00s - 459.00s | update encryption. Remember, firmware update files are encrypted. So, during this, I found 461.40s - 467.44s | references to the use of the hardware security module. So, I decided to have a closer look to 467.44s - 472.44s | this HSM, which is from the EdgeLog family by NXP. And in regard to the application node, I 476.48s - 481.48s | analyzed the I2C communication passively. And in regard to the APDO specification, we 484.96s - 489.96s | observed the APDO command structure indicating it isn't encrypted, but the payload is.


chunk_id: 169_chunk_6
chunk_text:
such as passwords or VPN certificates 418.90s - 425.70s | found in configuration files? So, I grabbed the used prefix and found the responsible code in 425.70s - 430.70s | an ARM binary. And due to the use of well-known open SSL functions, the encryption could be 433.32s - 438.38s | quickly reverse engineered and the hard-coded key and IV could be found in the read-only 438.38s - 443.38s | data section. So, by re-implementing the encryption algorithm with the found key and IV, we 445.72s - 450.72s | are now able to decrypt encrypted passwords. Great, but now I was looking for the firmware 454.00s - 459.00s | update encryption. Remember, firmware update files are encrypted. So, during this, I found 461.40s - 467.44s | references to the use of the hardware security module. So, I decided to have a closer look to 467.44s - 472.44s | this HSM, which is from the EdgeLog family by NXP. And in regard to the application node, I 476.48s - 481.48s | analyzed the I2C communication passively. And in regard to the APDO specification, we 484.96s - 489.96s | observed the APDO command structure indicating it isn't encrypted, but the payload is. Thus, 490.46s - 495.46s | we cannot eavesdrop on the physical connection between the HSM and the SOC. So, I went back to 501.55s - 507.39s | the device and further analyzed the encryption and finally was able to reconstruct it, which 507.39s - 512.39s | can be summarized as follows. Four bytes are read from an unencrypted flash memory, which 514.23s - 519.23s | represents the length of data to be read in the next step. Then this data is decrypted using the 521.43s - 528.21s | IMX6 cryptographic acceleration and assurance module. Afterwards, session keys are derived 528.21s - 533.21s | from this data and used to encrypt the communication using AES and CBC mode. And since I had a 536.69s - 542.77s | single device only, I do not know if the data stored on the unencrypted flash is unique or 542.77s - 550.61s | device specific. Next, I attempted to access keys directly from the rooted device using the 550.63s - 557.76s | block and trust middleware from NXP. So, I developed a small proof of concept tool to access 557.76s - 562.76s | data on the HSM. However, the policies are configured correctly and I


chunk_id: 169_chunk_7
chunk_text:
Thus, 490.46s - 495.46s | we cannot eavesdrop on the physical connection between the HSM and the SOC. So, I went back to 501.55s - 507.39s | the device and further analyzed the encryption and finally was able to reconstruct it, which 507.39s - 512.39s | can be summarized as follows. Four bytes are read from an unencrypted flash memory, which 514.23s - 519.23s | represents the length of data to be read in the next step. Then this data is decrypted using the 521.43s - 528.21s | IMX6 cryptographic acceleration and assurance module. Afterwards, session keys are derived 528.21s - 533.21s | from this data and used to encrypt the communication using AES and CBC mode. And since I had a 536.69s - 542.77s | single device only, I do not know if the data stored on the unencrypted flash is unique or 542.77s - 550.61s | device specific. Next, I attempted to access keys directly from the rooted device using the 550.63s - 557.76s | block and trust middleware from NXP. So, I developed a small proof of concept tool to access 557.76s - 562.76s | data on the HSM. However, the policies are configured correctly and I was not able to access 564.86s - 571.30s | keys. Ok, so we cannot eavesdrop on the physical communication and we also cannot access data 573.64s - 578.64s | stored on the HSM. But, how does the firmware encryption work? So, I further reverse 579.56s - 584.56s | engineered the update process, which can be summarized as follows. A key type is read from 588.40s - 593.40s | the update file. Next, an encrypted key and IV is read. The encrypted key is decrypted by the 597.84s - 602.84s | HSM and stored in a file. An encrypted bash script is extracted from the update file and 603.58s - 608.58s | decrypts, uh, and decrypted using the plain text key. And finally, the parser script extracts 613.80s - 621.72s | the different firmware parts and decrypts it using the plain text key. So, in summary, each 621.72s - 627.76s | firmware version has its own encryption key, but with access to a rooted device, we can 627.76s - 634.64s | decrypt the key and therefore leak firmware specific encryption keys. So, as a proof of 634.64s - 640.68s | concept, I decrypted such a key using the rooted device and


chunk_id: 169_chunk_8
chunk_text:
was not able to access 564.86s - 571.30s | keys. Ok, so we cannot eavesdrop on the physical communication and we also cannot access data 573.64s - 578.64s | stored on the HSM. But, how does the firmware encryption work? So, I further reverse 579.56s - 584.56s | engineered the update process, which can be summarized as follows. A key type is read from 588.40s - 593.40s | the update file. Next, an encrypted key and IV is read. The encrypted key is decrypted by the 597.84s - 602.84s | HSM and stored in a file. An encrypted bash script is extracted from the update file and 603.58s - 608.58s | decrypts, uh, and decrypted using the plain text key. And finally, the parser script extracts 613.80s - 621.72s | the different firmware parts and decrypts it using the plain text key. So, in summary, each 621.72s - 627.76s | firmware version has its own encryption key, but with access to a rooted device, we can 627.76s - 634.64s | decrypt the key and therefore leak firmware specific encryption keys. So, as a proof of 634.64s - 640.68s | concept, I decrypted such a key using the rooted device and used it to decrypt the firmware 640.68s - 648.73s | update, for example, the root file system. Alright, so we can decrypt configuration files 648.73s - 655.37s | using static keys and we can also decrypt firmware updates using our rooted device and its 655.37s - 661.23s | hardware security module. So, now let's move on to the last topic, the backend 661.27s - 666.27s | communication. As expected, communication with the vendor's API is encrypted and mutual 668.71s - 673.71s | authentication is enforced. So, if we want to analyze the communication using a TLS proxy, 676.25s - 682.39s | our certificate needs to be trusted by the Evon Cozy Plus. And we also need the client 682.39s - 688.89s | certificate trusted by the backend. So, placing our own certificate in the hard-coded trust 688.89s - 693.89s | store is simple, but extracting the client certificate turned out to be difficult. In fact, 697.13s - 703.63s | we also found the hard-coded pass to the client certificate and key, but while the public 703.63s - 710.07s | key looks good, something seems to be wrong with the private key and it looks like it is 710.07s - 717.73s


chunk_id: 169_chunk_9
chunk_text:
used it to decrypt the firmware 640.68s - 648.73s | update, for example, the root file system. Alright, so we can decrypt configuration files 648.73s - 655.37s | using static keys and we can also decrypt firmware updates using our rooted device and its 655.37s - 661.23s | hardware security module. So, now let's move on to the last topic, the backend 661.27s - 666.27s | communication. As expected, communication with the vendor's API is encrypted and mutual 668.71s - 673.71s | authentication is enforced. So, if we want to analyze the communication using a TLS proxy, 676.25s - 682.39s | our certificate needs to be trusted by the Evon Cozy Plus. And we also need the client 682.39s - 688.89s | certificate trusted by the backend. So, placing our own certificate in the hard-coded trust 688.89s - 693.89s | store is simple, but extracting the client certificate turned out to be difficult. In fact, 697.13s - 703.63s | we also found the hard-coded pass to the client certificate and key, but while the public 703.63s - 710.07s | key looks good, something seems to be wrong with the private key and it looks like it is 710.07s - 717.73s | filled up with null bytes. So, it turned out that this is not the private key itself, instead 717.73s - 724.07s | it is a, it is a so-called reference key and the actual key is securely stored at the 724.07s - 729.07s | HSM. So, extracting the key is not possible. But, I found a workaround. We can use this 734.17s - 741.05s | open SSL configuration which references a specific open SSL engine to implement the HSM 741.05s - 746.05s | for encryption. And now, by using this configuration, we can use open SSL encryption 747.73s - 756.05s | aware tools like curl on the device itself to communicate with the backend. This also 756.05s - 760.95s | means without the device's private key, we cannot route the communication through a TLS 760.95s - 767.39s | proxy. And therefore, I used the following alternative approach to analyze the backend 767.39s - 772.39s | communication. First, we intercept a request initiated by the device. Then we use curl on 773.39s - 778.39s | the device to send this exact request and retrieve the response received on the device. 783.43s - 789.13s | Afterwards, we can implement this response


chunk_id: 169_chunk_10
chunk_text:
| filled up with null bytes. So, it turned out that this is not the private key itself, instead 717.73s - 724.07s | it is a, it is a so-called reference key and the actual key is securely stored at the 724.07s - 729.07s | HSM. So, extracting the key is not possible. But, I found a workaround. We can use this 734.17s - 741.05s | open SSL configuration which references a specific open SSL engine to implement the HSM 741.05s - 746.05s | for encryption. And now, by using this configuration, we can use open SSL encryption 747.73s - 756.05s | aware tools like curl on the device itself to communicate with the backend. This also 756.05s - 760.95s | means without the device's private key, we cannot route the communication through a TLS 760.95s - 767.39s | proxy. And therefore, I used the following alternative approach to analyze the backend 767.39s - 772.39s | communication. First, we intercept a request initiated by the device. Then we use curl on 773.39s - 778.39s | the device to send this exact request and retrieve the response received on the device. 783.43s - 789.13s | Afterwards, we can implement this response in our own web server and proceed with the next 789.13s - 795.67s | request or stage. And by doing so, I observed the following endpoints. And especially this 796.49s - 801.49s | one was quite interesting. In detail, the device generates a certificate signing request 805.77s - 811.91s | during account assignment and sends it to the backend. The vendor server then signs this 811.91s - 818.91s | request and the signed certificate can then be requested by the device. Afterwards, the 818.91s - 825.55s | device has a certificate signed by the vendor which contains the device's serial number. And 825.57s - 831.17s | this certificate is then used for authentication against the VPN server and the serial number 831.17s - 836.17s | in the certificate is used by the VPN server to assign it to a specific account or a client. 838.91s - 845.35s | Therefore, I ask myself, can I get signed certificates for other devices by generating a 845.35s - 850.35s | certificate signing request with a foreign serial number? And to verify this, I reported my 850.49s - 855.49s | thoughts and assumptions to the vendor and they gave me a serial number of


chunk_id: 169_chunk_11
chunk_text:
in our own web server and proceed with the next 789.13s - 795.67s | request or stage. And by doing so, I observed the following endpoints. And especially this 796.49s - 801.49s | one was quite interesting. In detail, the device generates a certificate signing request 805.77s - 811.91s | during account assignment and sends it to the backend. The vendor server then signs this 811.91s - 818.91s | request and the signed certificate can then be requested by the device. Afterwards, the 818.91s - 825.55s | device has a certificate signed by the vendor which contains the device's serial number. And 825.57s - 831.17s | this certificate is then used for authentication against the VPN server and the serial number 831.17s - 836.17s | in the certificate is used by the VPN server to assign it to a specific account or a client. 838.91s - 845.35s | Therefore, I ask myself, can I get signed certificates for other devices by generating a 845.35s - 850.35s | certificate signing request with a foreign serial number? And to verify this, I reported my 850.49s - 855.49s | thoughts and assumptions to the vendor and they gave me a serial number of a device located at 859.13s - 864.13s | the vendor's lab. So, I generated a certificate signing request including this serial number 866.81s - 871.81s | and sent it to the API using my routed device. And indeed, the request was successful and I 874.75s - 881.52s | received a certificate for the foreign serial number. Afterwards, I successfully used the 881.56s - 887.16s | certificate to initiate a VPN session in the context of the device located at the vendor's 887.16s - 892.16s | lab. This in turn had the following impacts. First of all, the VPN session of the original 895.50s - 900.50s | device was overwritten and therefore no longer accessible. Next, if a user tries to connect to 902.94s - 907.94s | this serial number or device, he gets forwarded to the attacker without noticing. And due to 908.94s - 915.58s | the missing network restrictions inside the VPN tunnel, the attacker is able to access all 915.58s - 920.58s | services of the connected clients. So, let me illustrate this. An attacker can use a routed 923.72s - 930.42s | EvonCozyPlus to get the correctly signed certificate for a foreign device. Then he is able


chunk_id: 169_chunk_12
chunk_text:
a device located at 859.13s - 864.13s | the vendor's lab. So, I generated a certificate signing request including this serial number 866.81s - 871.81s | and sent it to the API using my routed device. And indeed, the request was successful and I 874.75s - 881.52s | received a certificate for the foreign serial number. Afterwards, I successfully used the 881.56s - 887.16s | certificate to initiate a VPN session in the context of the device located at the vendor's 887.16s - 892.16s | lab. This in turn had the following impacts. First of all, the VPN session of the original 895.50s - 900.50s | device was overwritten and therefore no longer accessible. Next, if a user tries to connect to 902.94s - 907.94s | this serial number or device, he gets forwarded to the attacker without noticing. And due to 908.94s - 915.58s | the missing network restrictions inside the VPN tunnel, the attacker is able to access all 915.58s - 920.58s | services of the connected clients. So, let me illustrate this. An attacker can use a routed 923.72s - 930.42s | EvonCozyPlus to get the correctly signed certificate for a foreign device. Then he is able 930.42s - 935.90s | to use the certificate for VPN authentication, which results in a loss of connection of the 935.90s - 940.90s | original device. Now, if a user of this solution tries to connect to this device, he will be 943.36s - 949.88s | forwarded to the attacker and therefore the attacker is able to attack the victim's client, 949.88s - 956.64s | for example, accessing the client's remote desktop service. And last but not least, the 956.64s - 963.12s | attacker can imitate the original infrastructure to eavesdrop on sensitive data, for example, 963.14s - 968.14s | authentication data, or if the victim uploads a secret program to a PLC. And given that the 971.82s - 978.20s | serial numbers are more or less enumeratable, this attack is scalable and we are able to 978.20s - 985.18s | disconnect more than 500,000 devices. This means that energy plants, industrial facilities, 987.38s - 993.72s | critical infrastructures, or oil platforms all around the world are no longer accessible and the 993.74s - 1000.31s | users trying to connect to them could be attacked. So, let me conclude. We were able to route 1003.81s - 1010.25s | the device


chunk_id: 169_chunk_13
chunk_text:
930.42s - 935.90s | to use the certificate for VPN authentication, which results in a loss of connection of the 935.90s - 940.90s | original device. Now, if a user of this solution tries to connect to this device, he will be 943.36s - 949.88s | forwarded to the attacker and therefore the attacker is able to attack the victim's client, 949.88s - 956.64s | for example, accessing the client's remote desktop service. And last but not least, the 956.64s - 963.12s | attacker can imitate the original infrastructure to eavesdrop on sensitive data, for example, 963.14s - 968.14s | authentication data, or if the victim uploads a secret program to a PLC. And given that the 971.82s - 978.20s | serial numbers are more or less enumeratable, this attack is scalable and we are able to 978.20s - 985.18s | disconnect more than 500,000 devices. This means that energy plants, industrial facilities, 987.38s - 993.72s | critical infrastructures, or oil platforms all around the world are no longer accessible and the 993.74s - 1000.31s | users trying to connect to them could be attacked. So, let me conclude. We were able to route 1003.81s - 1010.25s | the device and decrypt encrypted passwords. Afterwards, we used the routed device to get 1010.25s - 1014.89s | firmware specific encryption keys and getting correctly signed certificates for other 1014.89s - 1019.89s | devices used for VPN authentication. With these certificates, we were finally able to impact the 1020.03s - 1025.03s | whole remote access solution accessing devices of connected users and eavesdrop on sensitive 1027.87s - 1035.19s | data. Of course, we reported the vulnerabilities to the manufacturer who immediately patched 1035.19s - 1042.19s | the backend so getting certificates for other devices was no longer possible and a fixed 1042.19s - 1047.21s | firmware version was also recently released. But what can we learn from this? First of all, it 1047.21s - 1052.21s | is important to consider the risks and increase the tech surface of remote access solutions, 1056.29s - 1063.17s | especially with infrastructure operated in the cloud or by third parties. And as 1063.17s - 1069.01s | demonstrated in this talk, exploiting vulnerabilities in such solutions could impact many 1069.01s - 1074.01s | facilities and maybe your infrastructure too. And for the security researchers among us, 1074.75s - 1079.75s | some of the vulnerabilities shown were found


chunk_id: 169_chunk_14
chunk_text:
and decrypt encrypted passwords. Afterwards, we used the routed device to get 1010.25s - 1014.89s | firmware specific encryption keys and getting correctly signed certificates for other 1014.89s - 1019.89s | devices used for VPN authentication. With these certificates, we were finally able to impact the 1020.03s - 1025.03s | whole remote access solution accessing devices of connected users and eavesdrop on sensitive 1027.87s - 1035.19s | data. Of course, we reported the vulnerabilities to the manufacturer who immediately patched 1035.19s - 1042.19s | the backend so getting certificates for other devices was no longer possible and a fixed 1042.19s - 1047.21s | firmware version was also recently released. But what can we learn from this? First of all, it 1047.21s - 1052.21s | is important to consider the risks and increase the tech surface of remote access solutions, 1056.29s - 1063.17s | especially with infrastructure operated in the cloud or by third parties. And as 1063.17s - 1069.01s | demonstrated in this talk, exploiting vulnerabilities in such solutions could impact many 1069.01s - 1074.01s | facilities and maybe your infrastructure too. And for the security researchers among us, 1074.75s - 1079.75s | some of the vulnerabilities shown were found by gaining root access, meaning similar 1082.71s - 1089.29s | vulnerabilities may exist in other solutions and waiting for you to be found. Sometimes, you 1089.29s - 1095.23s | just have to find the right initial foothold. And with that said, thanks for joining this 1095.23s - 1100.23s | talk. Connect with me on X and feel free to check out the blog post. Thanks.


chunk_id: 169_chunk_15
chunk_text:
by gaining root access, meaning similar 1082.71s - 1089.29s | vulnerabilities may exist in other solutions and waiting for you to be found. Sometimes, you 1089.29s - 1095.23s | just have to find the right initial foothold. And with that said, thanks for joining this 1095.23s - 1100.23s | talk. Connect with me on X and feel free to check out the blog post. Thanks.


chunk_id: 170_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=jALLbBisg_8", "title": "DEF CON 32 - Troll Trapping Through TAS Tools Exposing Speedrunning Cheaters - Allan Cecil", "description": "Trolls cheating in video games by passing Tool-Assisted Speedruns off as human effort break leaderboards and stifle speedrunners. Why do they do it when they could make a cool game hack or TAS to show off their work, and how do you trap these trolls? The answer is to use their own tools against them, often with popcorn bucket worthy results like taking down Guinness World Records. From a TASVideos member taking on 1980's Dragster cheat Todd Rogers, a passing mention of Billy Mitchell, and the TASBot team investigating Super Mario Maker shenanigans, this talk covers several notable cheating incidents and concludes with a systematic takedown of a troll that chilled the Diablo speedrunning community for more than a decade.\n\nThis talk includes several investigations I have been a part of in some capacity and will ultimately include additional references in the coming months; I've broken the references out by game, presented in Markdown format like the rest of this document:", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2629, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 2.86s - 15.10s | This text was transcribed using whisper model: large-v2 Hello, DEF CON! I am DuangoAC, Keeper of TASBOT, this cute guy right over here, I am so thankful 15.10s - 18.42s | to not be able to see you because the lights are really bright, but I'm assuming you're 18.42s - 23.26s | in the audience. Uh, thank you very much for showing up. First of all, this is a dynamic 23.26s - 28.70s | talk that is changing by the minute. Uh, things have been developing rapidly over the course 28.70s - 33.18s | of the last week, which I didn't anticipate. So, uh, we're gonna have a lot of fun walking 33.18s - 38.74s | through this. Uh, first of all, on my screen, I have a paper that I, we just released in 38.74s - 47.10s | the last seven minutes. Uh, it is at diablo.tas.bot, and you are welcome to follow along from your 47.10s - 51.66s | own personal device if you so choose to do so. Uh, what we have done is put together 51.66s - 57.82s | a document that we'll be talking about later on in the talk. Uh, there is a lot to cover 57.82s - 62.46s


chunk_id: 170_chunk_1
chunk_text:
whisper model: large-v2 Hello, DEF CON! I am DuangoAC, Keeper of TASBOT, this cute guy right over here, I am so thankful 15.10s - 18.42s | to not be able to see you because the lights are really bright, but I'm assuming you're 18.42s - 23.26s | in the audience. Uh, thank you very much for showing up. First of all, this is a dynamic 23.26s - 28.70s | talk that is changing by the minute. Uh, things have been developing rapidly over the course 28.70s - 33.18s | of the last week, which I didn't anticipate. So, uh, we're gonna have a lot of fun walking 33.18s - 38.74s | through this. Uh, first of all, on my screen, I have a paper that I, we just released in 38.74s - 47.10s | the last seven minutes. Uh, it is at diablo.tas.bot, and you are welcome to follow along from your 47.10s - 51.66s | own personal device if you so choose to do so. Uh, what we have done is put together 51.66s - 57.82s | a document that we'll be talking about later on in the talk. Uh, there is a lot to cover 57.82s - 62.46s | of, of some background of what I'll be doing here. Uh, first of all, if you don't know 62.46s - 69.02s | me, I am known for a variety of weird things. I am a senior ambassador on-site staff for 69.02s - 75.90s | TASvideos.org. I am also the founder of the TASbot organization that does tool-assisted 75.90s - 81.66s | speedrun content on real hardware at places like Games Done Quick events. Uh, there's 81.66s - 86.22s | some interesting stuff that I've managed to get into over the course of the last few years, 86.22s - 92.02s | and I'm gonna quickly go over some highlights from some past things that have happened. 92.02s - 96.82s | Some of them are rather bizarre. Uh, there are things that I didn't expect would happen 96.82s - 104.22s | that did. Um, for instance, in 2017, there was someone named Todd Rogers who cheated 104.22s - 111.10s | at a video game. He cheated all the way back in the 80s, but we found out about it in 2017. 111.10s - 118.62s | And getting involved in that little bit of, of intrigue started a process of, uh, aligning


chunk_id: 170_chunk_2
chunk_text:
| of, of some background of what I'll be doing here. Uh, first of all, if you don't know 62.46s - 69.02s | me, I am known for a variety of weird things. I am a senior ambassador on-site staff for 69.02s - 75.90s | TASvideos.org. I am also the founder of the TASbot organization that does tool-assisted 75.90s - 81.66s | speedrun content on real hardware at places like Games Done Quick events. Uh, there's 81.66s - 86.22s | some interesting stuff that I've managed to get into over the course of the last few years, 86.22s - 92.02s | and I'm gonna quickly go over some highlights from some past things that have happened. 92.02s - 96.82s | Some of them are rather bizarre. Uh, there are things that I didn't expect would happen 96.82s - 104.22s | that did. Um, for instance, in 2017, there was someone named Todd Rogers who cheated 104.22s - 111.10s | at a video game. He cheated all the way back in the 80s, but we found out about it in 2017. 111.10s - 118.62s | And getting involved in that little bit of, of intrigue started a process of, uh, aligning 118.62s - 124.82s | me in weird ways of trying to help take down cheaters in speedruns, which is not something 124.82s - 128.86s | I expected to do. I'm used to making them and playing them on a real console for charity. 128.86s - 134.10s | Uh, so, so this talk is actually very different than most of the other talks I've given because 134.10s - 139.98s | it's really a lot more about finding something interesting, going, hmm, that's not right. 139.98s - 144.30s | And then somehow getting attached to these investigations and getting sidelined off in 144.30s - 151.30s | some weird project. So, I want to talk to you about what happened in 2017. In the 1980s, 151.30s - 157.82s | a game for the Atari 2600 came out named Dragster. And a runner at the time, someone who was 157.82s - 163.20s | playing video games competitively named Todd Rogers, set a record of being able to complete 163.20s - 170.22s | the game, allegedly, in 5.51 seconds. In other words, the fastest amount of in-game time 170.54s - 176.90s | to, to beat the game effectively. Now, this ended up ultimately becoming a


chunk_id: 170_chunk_3
chunk_text:
118.62s - 124.82s | me in weird ways of trying to help take down cheaters in speedruns, which is not something 124.82s - 128.86s | I expected to do. I'm used to making them and playing them on a real console for charity. 128.86s - 134.10s | Uh, so, so this talk is actually very different than most of the other talks I've given because 134.10s - 139.98s | it's really a lot more about finding something interesting, going, hmm, that's not right. 139.98s - 144.30s | And then somehow getting attached to these investigations and getting sidelined off in 144.30s - 151.30s | some weird project. So, I want to talk to you about what happened in 2017. In the 1980s, 151.30s - 157.82s | a game for the Atari 2600 came out named Dragster. And a runner at the time, someone who was 157.82s - 163.20s | playing video games competitively named Todd Rogers, set a record of being able to complete 163.20s - 170.22s | the game, allegedly, in 5.51 seconds. In other words, the fastest amount of in-game time 170.54s - 176.90s | to, to beat the game effectively. Now, this ended up ultimately becoming a Guinness Book 176.90s - 182.18s | of World Records because this record that was on Twin Galaxies went unbeaten for over 182.18s - 189.18s | three decades. And there was an effort in about 2016-2017 by tool-assisted speedrun 190.54s - 195.70s | author and TASOvideos member OmniGamer to make a tool-assisted speedrun of the game. 196.06s - 200.82s | It's a little bit of context. You might have played a game like Metroid or Super Metroid 200.82s - 205.02s | in the past where you get to the end of the game and it will show you how long it took 205.02s - 209.74s | you to complete the game. It shows a timer and sometimes even different graphics depending 209.74s - 213.50s | on how quickly you've managed to finish the game. So, speedrunning started to become a 213.50s - 220.06s | thing based on games that encouraged you to try to beat them quickly. And a normal speedrun 220.06s - 224.94s | with human effort involves the process of grinding through trying to play a game as 224.94s - 231.40s | quickly as possible. And from that came an off, kind of a rather interesting branch of 234.96s


chunk_id: 170_chunk_4
chunk_text:
Guinness Book 176.90s - 182.18s | of World Records because this record that was on Twin Galaxies went unbeaten for over 182.18s - 189.18s | three decades. And there was an effort in about 2016-2017 by tool-assisted speedrun 190.54s - 195.70s | author and TASOvideos member OmniGamer to make a tool-assisted speedrun of the game. 196.06s - 200.82s | It's a little bit of context. You might have played a game like Metroid or Super Metroid 200.82s - 205.02s | in the past where you get to the end of the game and it will show you how long it took 205.02s - 209.74s | you to complete the game. It shows a timer and sometimes even different graphics depending 209.74s - 213.50s | on how quickly you've managed to finish the game. So, speedrunning started to become a 213.50s - 220.06s | thing based on games that encouraged you to try to beat them quickly. And a normal speedrun 220.06s - 224.94s | with human effort involves the process of grinding through trying to play a game as 224.94s - 231.40s | quickly as possible. And from that came an off, kind of a rather interesting branch of 234.96s - 239.96s | doing this, but without any human limitations of skill, reflexes, memory, luck, things like 239.96s - 244.74s | that. And that's called a tool-assisted speedrun. One of the most famous examples of those is 244.74s - 250.14s | from 2003, someone named Morimoto released what was called a Super Mario Brothers time 250.14s - 255.78s | attack, Super Mario Brothers 3 time attack run. Uh, it was not labeled. Uh, it was ridiculous 255.78s - 261.02s | because it had Mario jumping all over the place, randomly getting 99 lives, never dying, 261.02s - 265.56s | getting really close to enemies. And there was no labeling to say that it was a tool-assisted 265.56s - 270.90s | speedrun. And it caused a lot of, you know, pre-YouTube days controversy. Just a WMV file 270.90s - 275.40s | floating around the internet didn't have enough context to explain it. It was a tool-assisted 275.40s - 279.98s | speedrun and ultimately something that someone named Bizkwit developed NES videos, which 279.98s - 285.42s | became TAS videos, to host tool-assisted speedruns like that. In other words, you can play a 285.42s - 290.62s | game as a human or


chunk_id: 170_chunk_5
chunk_text:
- 239.96s | doing this, but without any human limitations of skill, reflexes, memory, luck, things like 239.96s - 244.74s | that. And that's called a tool-assisted speedrun. One of the most famous examples of those is 244.74s - 250.14s | from 2003, someone named Morimoto released what was called a Super Mario Brothers time 250.14s - 255.78s | attack, Super Mario Brothers 3 time attack run. Uh, it was not labeled. Uh, it was ridiculous 255.78s - 261.02s | because it had Mario jumping all over the place, randomly getting 99 lives, never dying, 261.02s - 265.56s | getting really close to enemies. And there was no labeling to say that it was a tool-assisted 265.56s - 270.90s | speedrun. And it caused a lot of, you know, pre-YouTube days controversy. Just a WMV file 270.90s - 275.40s | floating around the internet didn't have enough context to explain it. It was a tool-assisted 275.40s - 279.98s | speedrun and ultimately something that someone named Bizkwit developed NES videos, which 279.98s - 285.42s | became TAS videos, to host tool-assisted speedruns like that. In other words, you can play a 285.42s - 290.62s | game as a human or you can use tools to play the game inside of an emulator. Tools like 290.62s - 296.44s | save states, being able to stop at any point and back up and try a section again. Tools 296.44s - 302.44s | like frame advance or slow motion, being able to go forward one video frame at a time. Uh, 302.44s - 308.24s | being able to, uh, record a movie while you're going and record all of the button presses. 308.24s - 313.44s | So that's, that's kind of the difference between a speedrun and a tool-assisted speedrun. And 313.44s - 319.08s | you see, when OmniGamer, back to our Dragster story, attempted to make a tool-assisted speedrun 319.08s - 325.28s | of Dragster, he ran into a minor problem. Even with superhuman precision, he was unable to 325.28s - 331.86s | match Todd Rogers' time. Which raised some questions. So, how exactly did Todd Rogers 331.86s - 338.30s | manage to beat Dragster in 5.57 seconds? Uh, in the process of this investigation, OmniGamer 338.30s - 342.94s | looked at the source code, the ROM, from the cartridge. So we took the actual physical 342.94s - 348.74s | cartridge, put


chunk_id: 170_chunk_6
chunk_text:
you can use tools to play the game inside of an emulator. Tools like 290.62s - 296.44s | save states, being able to stop at any point and back up and try a section again. Tools 296.44s - 302.44s | like frame advance or slow motion, being able to go forward one video frame at a time. Uh, 302.44s - 308.24s | being able to, uh, record a movie while you're going and record all of the button presses. 308.24s - 313.44s | So that's, that's kind of the difference between a speedrun and a tool-assisted speedrun. And 313.44s - 319.08s | you see, when OmniGamer, back to our Dragster story, attempted to make a tool-assisted speedrun 319.08s - 325.28s | of Dragster, he ran into a minor problem. Even with superhuman precision, he was unable to 325.28s - 331.86s | match Todd Rogers' time. Which raised some questions. So, how exactly did Todd Rogers 331.86s - 338.30s | manage to beat Dragster in 5.57 seconds? Uh, in the process of this investigation, OmniGamer 338.30s - 342.94s | looked at the source code, the ROM, from the cartridge. So we took the actual physical 342.94s - 348.74s | cartridge, put it in a reader, pulled the contents of the ROM off, examined the way the code 348.74s - 353.88s | worked, and determined that the fastest time that all versions of Dragster that we've ever 353.88s - 358.34s | found, prototypes through released versions, all versions had the same algorithm that would 358.34s - 364.36s | not allow for a time, a time of 5.51. In fact, the fastest speedrun time that was achievable 364.36s - 369.46s | through the code was 5.57. And in that time frame, I had already started doing something 369.46s - 376.86s | interesting with TaskBot. By 2013, I had formed a community of people taking tool-assisted 376.86s - 380.96s | speedruns and playing them back on real hardware with our cute little mascot here. He looked a 380.96s - 385.74s | little different at the time. He was based on a robot at the time. But at that time, I had 385.74s - 391.78s | worked with a bunch of folks like True and Micro 500 and a bunch of other tools designers 391.80s - 397.24s | that created what's called a replay device that pretends to be an Atari 2600 controller. And we


chunk_id: 170_chunk_7
chunk_text:
it in a reader, pulled the contents of the ROM off, examined the way the code 348.74s - 353.88s | worked, and determined that the fastest time that all versions of Dragster that we've ever 353.88s - 358.34s | found, prototypes through released versions, all versions had the same algorithm that would 358.34s - 364.36s | not allow for a time, a time of 5.51. In fact, the fastest speedrun time that was achievable 364.36s - 369.46s | through the code was 5.57. And in that time frame, I had already started doing something 369.46s - 376.86s | interesting with TaskBot. By 2013, I had formed a community of people taking tool-assisted 376.86s - 380.96s | speedruns and playing them back on real hardware with our cute little mascot here. He looked a 380.96s - 385.74s | little different at the time. He was based on a robot at the time. But at that time, I had 385.74s - 391.78s | worked with a bunch of folks like True and Micro 500 and a bunch of other tools designers 391.80s - 397.24s | that created what's called a replay device that pretends to be an Atari 2600 controller. And we 397.24s - 402.24s | used TaskBot to play Dragster and beat the game on a real console with superhuman input. And 404.82s - 411.22s | the fastest time we could achieve was 5.57. In other words, we used a real console, a real 411.22s - 417.90s | cartridge, and superhuman input, and couldn't reproduce the time that Todd Rogers claimed. As 417.92s - 423.10s | a result of that investigation, Todd Rogers' records were stripped from Twin Galaxies and also 423.10s - 429.54s | from Guinness Book of World Records. It was a huge effort on OmniGamer's part to do all of the 429.54s - 433.74s | research and to assemble all of that information. And I was really thankful to be able to play a 433.74s - 439.84s | small part in being able to do the tool-assisted speedrun on real hardware. I didn't expect to 439.84s - 444.18s | ever return to that world. That was back in 2017. And somehow this year, I've now had two 444.20s - 450.54s | separate instances of getting embroiled in, hey, wait a minute, we're trying to do something, and 450.54s - 455.54s | we think that something is cheated. The


chunk_id: 170_chunk_8
chunk_text:
397.24s - 402.24s | used TaskBot to play Dragster and beat the game on a real console with superhuman input. And 404.82s - 411.22s | the fastest time we could achieve was 5.57. In other words, we used a real console, a real 411.22s - 417.90s | cartridge, and superhuman input, and couldn't reproduce the time that Todd Rogers claimed. As 417.92s - 423.10s | a result of that investigation, Todd Rogers' records were stripped from Twin Galaxies and also 423.10s - 429.54s | from Guinness Book of World Records. It was a huge effort on OmniGamer's part to do all of the 429.54s - 433.74s | research and to assemble all of that information. And I was really thankful to be able to play a 433.74s - 439.84s | small part in being able to do the tool-assisted speedrun on real hardware. I didn't expect to 439.84s - 444.18s | ever return to that world. That was back in 2017. And somehow this year, I've now had two 444.20s - 450.54s | separate instances of getting embroiled in, hey, wait a minute, we're trying to do something, and 450.54s - 455.54s | we think that something is cheated. The other time was in January, February, well, I guess March 455.54s - 461.42s | timeframe of this year. The Super Mario Maker community was trying to complete every single 461.42s - 467.62s | Super Mario Maker level before Nintendo shut the servers down. They had cleared all of the levels 467.62s - 475.42s | that they knew about, except one named Trimming the Herbs by a level author named Ahoyo. And there 475.42s - 481.78s | was a massive group of people trying to grind out beating this one 10-second long speedrun-oriented 482.14s - 486.02s | Super Mario Maker level. And they couldn't do it. It was really challenging. And the question 486.02s - 493.46s | became, how did they do it? Ultimately, Ahoyo came forward and said, hey, I admit it, I used tools to 493.46s - 498.66s | do this. And through that investigation, there's a series of Ars Technica articles. I worked with a 498.66s - 504.82s | team of folks in my Taskbot community and a bunch of amazing subject matter experts to recreate that 504.82s - 510.66s | tool-assisted speedrun based on what Ahoyo had said. We were able to get it to work. And


chunk_id: 170_chunk_9
chunk_text:
other time was in January, February, well, I guess March 455.54s - 461.42s | timeframe of this year. The Super Mario Maker community was trying to complete every single 461.42s - 467.62s | Super Mario Maker level before Nintendo shut the servers down. They had cleared all of the levels 467.62s - 475.42s | that they knew about, except one named Trimming the Herbs by a level author named Ahoyo. And there 475.42s - 481.78s | was a massive group of people trying to grind out beating this one 10-second long speedrun-oriented 482.14s - 486.02s | Super Mario Maker level. And they couldn't do it. It was really challenging. And the question 486.02s - 493.46s | became, how did they do it? Ultimately, Ahoyo came forward and said, hey, I admit it, I used tools to 493.46s - 498.66s | do this. And through that investigation, there's a series of Ars Technica articles. I worked with a 498.66s - 504.82s | team of folks in my Taskbot community and a bunch of amazing subject matter experts to recreate that 504.82s - 510.66s | tool-assisted speedrun based on what Ahoyo had said. We were able to get it to work. And amazingly, not 510.66s - 515.66s | only were we able to get a tool-assisted speedrun to work that was first cleared by someone who just 515.66s - 522.62s | joined the Taskbot community, but amazingly, a human somehow after many, many attempts, a human 522.62s - 526.74s | actually managed to clear this level that we thought was completely impossible. But yet again, I got 526.74s - 533.62s | caught up in a situation where a run was seemingly legit, a video game record seemed to be legit, but 533.62s - 541.42s | was not. So imagine my surprise when earlier this year, I worked with a speedrunner named FunkmasterMP 541.54s - 545.46s | who runs the video game Diablo. And he came up to me and said, I would like to make a tool-assisted 545.46s - 551.82s | speedrun of Diablo. Let's figure out how to do this. The tools were just starting to become developed to 551.82s - 557.90s | do this. It was just starting to, to come together. And I said, yeah, sure. Let's, let's do that. 557.94s - 566.54s | Let's uh, let's try, let's try to make a task of this. We used the


chunk_id: 170_chunk_10
chunk_text:
amazingly, not 510.66s - 515.66s | only were we able to get a tool-assisted speedrun to work that was first cleared by someone who just 515.66s - 522.62s | joined the Taskbot community, but amazingly, a human somehow after many, many attempts, a human 522.62s - 526.74s | actually managed to clear this level that we thought was completely impossible. But yet again, I got 526.74s - 533.62s | caught up in a situation where a run was seemingly legit, a video game record seemed to be legit, but 533.62s - 541.42s | was not. So imagine my surprise when earlier this year, I worked with a speedrunner named FunkmasterMP 541.54s - 545.46s | who runs the video game Diablo. And he came up to me and said, I would like to make a tool-assisted 545.46s - 551.82s | speedrun of Diablo. Let's figure out how to do this. The tools were just starting to become developed to 551.82s - 557.90s | do this. It was just starting to, to come together. And I said, yeah, sure. Let's, let's do that. 557.94s - 566.54s | Let's uh, let's try, let's try to make a task of this. We used the fastest speedrun we could find, which 566.54s - 572.66s | was on Speed Demos Archive, a website that records the fastest speedruns of games. And the run had 572.66s - 580.34s | been released, or had been created in 2009 by a runner named Grubo. It was a segmented run, meaning 580.34s - 587.54s | that the runner was allowed to do individual levels, and grind out one level, and then do the next 587.54s - 592.94s | level and stitch them together. But it did represent a very fast time that we wanted to use as the 592.94s - 598.34s | basis for a tool-assisted speedrun. With the assumption that if a human could do it, that we 598.34s - 604.06s | could do it. The only problem was we couldn't reproduce several of the things that we saw in 604.06s - 610.06s | Grubo's run, even with superhuman precision. And it started a long conversation with the team of 610.06s - 615.42s | developers behind the Devolution and DevolutionX projects that decompiled the game Diablo. 616.06s - 621.70s | Ultimately, it raised enough questions that we developed a team to start to analyze this video. 622.06s - 630.06s


chunk_id: 170_chunk_11
chunk_text:
fastest speedrun we could find, which 566.54s - 572.66s | was on Speed Demos Archive, a website that records the fastest speedruns of games. And the run had 572.66s - 580.34s | been released, or had been created in 2009 by a runner named Grubo. It was a segmented run, meaning 580.34s - 587.54s | that the runner was allowed to do individual levels, and grind out one level, and then do the next 587.54s - 592.94s | level and stitch them together. But it did represent a very fast time that we wanted to use as the 592.94s - 598.34s | basis for a tool-assisted speedrun. With the assumption that if a human could do it, that we 598.34s - 604.06s | could do it. The only problem was we couldn't reproduce several of the things that we saw in 604.06s - 610.06s | Grubo's run, even with superhuman precision. And it started a long conversation with the team of 610.06s - 615.42s | developers behind the Devolution and DevolutionX projects that decompiled the game Diablo. 616.06s - 621.70s | Ultimately, it raised enough questions that we developed a team to start to analyze this video. 622.06s - 630.06s | And the bulk of my talk today is going to be about what we found. Now, I want to play that video. And 630.06s - 638.06s | what I want you to do is I want you to, as you watch this, see if you can spot where things might be a 638.06s - 642.26s | little bit funny. Now, the downside, of course, is you're going to see this in real time, but that's 642.30s - 648.62s | okay. So this is the run should be on screen, and hopefully the volume is not blastingly loud. I'm 648.62s - 653.06s | going to play this, you can see that it says speed demos archive verified no cheating. And I'm going 653.06s - 663.31s | to play this run now. So there's our title screen, you can see this was a game made by Diablo. It was 663.31s - 669.23s | originally released back in 1996. Here is our screen to start the game and our character screen. 670.23s - 673.23s | Yeah, that's that's a little loud, but should be okay. Yeah, let's turn that volume down just a 673.23s - 685.23s | hair there. So this run


chunk_id: 170_chunk_12
chunk_text:
| And the bulk of my talk today is going to be about what we found. Now, I want to play that video. And 630.06s - 638.06s | what I want you to do is I want you to, as you watch this, see if you can spot where things might be a 638.06s - 642.26s | little bit funny. Now, the downside, of course, is you're going to see this in real time, but that's 642.30s - 648.62s | okay. So this is the run should be on screen, and hopefully the volume is not blastingly loud. I'm 648.62s - 653.06s | going to play this, you can see that it says speed demos archive verified no cheating. And I'm going 653.06s - 663.31s | to play this run now. So there's our title screen, you can see this was a game made by Diablo. It was 663.31s - 669.23s | originally released back in 1996. Here is our screen to start the game and our character screen. 670.23s - 673.23s | Yeah, that's that's a little loud, but should be okay. Yeah, let's turn that volume down just a 673.23s - 685.23s | hair there. So this run was done by Grubo on a on on a believe the time he was running a Windows. I 685.23s - 689.23s | don't I don't want to speculate what operating system is on. We never actually isolated that one. 689.23s - 695.23s | But this was done back in 2009 with the releases of Diablo that were available at that time. Diablo 695.23s - 699.23s | Diablo is by the way, a show of hands now that I can kind of sort of see you who here has played 699.23s - 705.23s | Diablo before. Wow, almost half the audience sanctity of this book. That wasn't me talking. 705.23s - 710.23s | Don't worry. There's going to be some random stuff. So for observe here that he walks from the 710.23s - 719.23s | upstairs to the downstairs, grabs an item here walks back down the stairs. grabs another actually 719.23s - 723.23s | I guess that's where he's grabbing the item. A couple of quick notes. This particular category 723.23s - 730.23s | allows removing those load screens from the calculated time. So again, we're going he's going 730.23s - 734.23s | directly from the upstairs to the downstairs


chunk_id: 170_chunk_13
chunk_text:
was done by Grubo on a on on a believe the time he was running a Windows. I 685.23s - 689.23s | don't I don't want to speculate what operating system is on. We never actually isolated that one. 689.23s - 695.23s | But this was done back in 2009 with the releases of Diablo that were available at that time. Diablo 695.23s - 699.23s | Diablo is by the way, a show of hands now that I can kind of sort of see you who here has played 699.23s - 705.23s | Diablo before. Wow, almost half the audience sanctity of this book. That wasn't me talking. 705.23s - 710.23s | Don't worry. There's going to be some random stuff. So for observe here that he walks from the 710.23s - 719.23s | upstairs to the downstairs, grabs an item here walks back down the stairs. grabs another actually 719.23s - 723.23s | I guess that's where he's grabbing the item. A couple of quick notes. This particular category 723.23s - 730.23s | allows removing those load screens from the calculated time. So again, we're going he's going 730.23s - 734.23s | directly from the upstairs to the downstairs very rapidly. This is incredible luck that you would 734.23s - 741.23s | never find anyone who's played Diablo before knows that you just don't get that that doesn't happen. 741.23s - 750.23s | Okay, so here he's killing an enemy and grabbed a staff allows him to basically warp which you saw 750.23s - 756.23s | there. He's he's phasing and hopping around the level really fast. He grabbed that item from the 756.23s - 761.23s | very first enemy in the game that happened to be dungeon level nine. That'll be important later. 761.23s - 768.23s | And again, he's just phasing and portaling trans moving all over the place as fast as possible. 768.23s - 779.23s | Right here. You can see he walks back to town to go buy some more items. He did. He did a couple 779.23s - 785.23s | of things that were way too fast there. Right here he is duping a stave. He's got he's picked up an 785.23s - 794.94s | additional staff. He's gonna head over to the shop and make a couple of purchases. This part is a 794.94s - 800.94s | little bit easier to to catch


chunk_id: 170_chunk_14
chunk_text:
very rapidly. This is incredible luck that you would 734.23s - 741.23s | never find anyone who's played Diablo before knows that you just don't get that that doesn't happen. 741.23s - 750.23s | Okay, so here he's killing an enemy and grabbed a staff allows him to basically warp which you saw 750.23s - 756.23s | there. He's he's phasing and hopping around the level really fast. He grabbed that item from the 756.23s - 761.23s | very first enemy in the game that happened to be dungeon level nine. That'll be important later. 761.23s - 768.23s | And again, he's just phasing and portaling trans moving all over the place as fast as possible. 768.23s - 779.23s | Right here. You can see he walks back to town to go buy some more items. He did. He did a couple 779.23s - 785.23s | of things that were way too fast there. Right here he is duping a stave. He's got he's picked up an 785.23s - 794.94s | additional staff. He's gonna head over to the shop and make a couple of purchases. This part is a 794.94s - 800.94s | little bit easier to to catch in real time. Some of these things are really hard to notice unless 800.94s - 810.94s | you're you're watching in slow motion. For instance right there. Can we turn that volume down just a 810.94s - 817.94s | little more? It's still pretty loud. All right, so the shop there, there was some inventory on screen. 817.94s - 832.62s | I'll be coming back to that in a second. There's a ring there. Okay, now we're back into the action. 832.62s - 838.62s | Again, a nice fast portal. There was something interesting on that screen I'll point out later. 838.62s - 846.62s | Okay, another set of phases. Okay, this is a battle. For anyone who's played Diablo, there's some 846.62s - 852.62s | improbably lucky things happening here. Legitimate though. 856.62s - 860.62s | All right, finished that fight. And now the final section. 879.13s - 886.13s | And that's it. That was the entire run. So, now you've been a little spoiled because I accidentally 886.13s - 892.13s | left this on my screen, but that's okay. Based on what you saw, did you guys happen to notice 892.13s - 897.13s | anything that seemed a


chunk_id: 170_chunk_15
chunk_text:
in real time. Some of these things are really hard to notice unless 800.94s - 810.94s | you're you're watching in slow motion. For instance right there. Can we turn that volume down just a 810.94s - 817.94s | little more? It's still pretty loud. All right, so the shop there, there was some inventory on screen. 817.94s - 832.62s | I'll be coming back to that in a second. There's a ring there. Okay, now we're back into the action. 832.62s - 838.62s | Again, a nice fast portal. There was something interesting on that screen I'll point out later. 838.62s - 846.62s | Okay, another set of phases. Okay, this is a battle. For anyone who's played Diablo, there's some 846.62s - 852.62s | improbably lucky things happening here. Legitimate though. 856.62s - 860.62s | All right, finished that fight. And now the final section. 879.13s - 886.13s | And that's it. That was the entire run. So, now you've been a little spoiled because I accidentally 886.13s - 892.13s | left this on my screen, but that's okay. Based on what you saw, did you guys happen to notice 892.13s - 897.13s | anything that seemed a little bit off in any of those? Especially anyone who's played Diablo before. 897.13s - 903.13s | So, if you kind of had some suspicions that something wasn't right, what approach would you take 903.13s - 908.13s | to prove it? What techniques might you use? Now, I'm going to have these slides on screen, 908.13s - 913.13s | but you can also head over to diablo.tasks.bot to see a version that's a little bit less squished. 913.13s - 917.13s | So, I'm just going to run through a little bit. We have a whole bunch of background that I've kind of 917.13s - 923.13s | already talked about here. What I'm going to do is just start at the very first thing here, 923.13s - 932.13s | which is this title screen. So, if you look here, right here, the copyright date says 1996 through 2001. 932.13s - 940.13s | What the team did is made a full table of every single release of Diablo and every single bit of metadata 940.65s - 948.65s | about it. And we can see that if the copyright date shown on the screen is 2001, then it must be version 948.65s -


chunk_id: 170_chunk_16
chunk_text:
little bit off in any of those? Especially anyone who's played Diablo before. 897.13s - 903.13s | So, if you kind of had some suspicions that something wasn't right, what approach would you take 903.13s - 908.13s | to prove it? What techniques might you use? Now, I'm going to have these slides on screen, 908.13s - 913.13s | but you can also head over to diablo.tasks.bot to see a version that's a little bit less squished. 913.13s - 917.13s | So, I'm just going to run through a little bit. We have a whole bunch of background that I've kind of 917.13s - 923.13s | already talked about here. What I'm going to do is just start at the very first thing here, 923.13s - 932.13s | which is this title screen. So, if you look here, right here, the copyright date says 1996 through 2001. 932.13s - 940.13s | What the team did is made a full table of every single release of Diablo and every single bit of metadata 940.65s - 948.65s | about it. And we can see that if the copyright date shown on the screen is 2001, then it must be version 948.65s - 954.65s | 1.09 of the game. Okay. Alright. So, now we know what version of the game he's running, except there's 954.65s - 965.57s | one minor problem. Um, it says Diablo version 1.00 on the next screen. Hmm. Okay, so which is it? 965.57s - 973.57s | Is it Diablo 1.09 or is it Diablo 1.00? Alright. So, this was something we saw early on that gave us 973.57s - 979.57s | some suspicion about how exactly was this run made anyway? So, then we get to this character screen. 979.57s - 985.57s | Now, this is not all that interesting. It's just a screenshot, but when we played the video, I was kind 985.57s - 989.57s | of talking over it a little bit, but I was quiet long enough for you to perhaps notice that there was no 989.57s - 993.57s | music playing during this character select screen. So, if you go back and watch his submission, you'll 993.57s - 1001.57s | note that there is no music at that point. That was only something that happened in Diablo 1.05 and later. 1001.57s - 1009.57s | So, that means we started with 1.09, went back to


chunk_id: 170_chunk_17
chunk_text:
954.65s | 1.09 of the game. Okay. Alright. So, now we know what version of the game he's running, except there's 954.65s - 965.57s | one minor problem. Um, it says Diablo version 1.00 on the next screen. Hmm. Okay, so which is it? 965.57s - 973.57s | Is it Diablo 1.09 or is it Diablo 1.00? Alright. So, this was something we saw early on that gave us 973.57s - 979.57s | some suspicion about how exactly was this run made anyway? So, then we get to this character screen. 979.57s - 985.57s | Now, this is not all that interesting. It's just a screenshot, but when we played the video, I was kind 985.57s - 989.57s | of talking over it a little bit, but I was quiet long enough for you to perhaps notice that there was no 989.57s - 993.57s | music playing during this character select screen. So, if you go back and watch his submission, you'll 993.57s - 1001.57s | note that there is no music at that point. That was only something that happened in Diablo 1.05 and later. 1001.57s - 1009.57s | So, that means we started with 1.09, went back to 1.0, and then somehow ended up with 1.05 or later, 1009.57s - 1021.57s | which is kind of an interesting conundrum. Like, how is it that this happened? Okay. Well, let's get 1021.57s - 1027.57s | into it a little bit more. Remember how you saw the stairs constantly going? You'd have an upstairs and a downstairs. 1027.57s - 1033.57s | They'd be right next to each other. Once or twice is one thing, but he got it on nearly every level. 1033.57s - 1037.57s | We're like, okay, well, we want to make a tool-assisted speedrun. We want that. Well, we didn't know 1037.57s - 1045.57s | exactly what Grubo had done, which game seed he had started with, so we made an entire open-source 1045.57s - 1053.57s | code set to entirely disassemble every little last bit of the Diablo map generation and use those tools 1053.57s - 1059.57s | to identify what exact game he used. And there's some information in here that I'll leave for an exercise 1059.57s - 1067.57s | to the reader for later. But the key thing that comes out of this is we managed to find the game seed 1067.57s - 1073.57s


chunk_id: 170_chunk_18
chunk_text:
1.0, and then somehow ended up with 1.05 or later, 1009.57s - 1021.57s | which is kind of an interesting conundrum. Like, how is it that this happened? Okay. Well, let's get 1021.57s - 1027.57s | into it a little bit more. Remember how you saw the stairs constantly going? You'd have an upstairs and a downstairs. 1027.57s - 1033.57s | They'd be right next to each other. Once or twice is one thing, but he got it on nearly every level. 1033.57s - 1037.57s | We're like, okay, well, we want to make a tool-assisted speedrun. We want that. Well, we didn't know 1037.57s - 1045.57s | exactly what Grubo had done, which game seed he had started with, so we made an entire open-source 1045.57s - 1053.57s | code set to entirely disassemble every little last bit of the Diablo map generation and use those tools 1053.57s - 1059.57s | to identify what exact game he used. And there's some information in here that I'll leave for an exercise 1059.57s - 1067.57s | to the reader for later. But the key thing that comes out of this is we managed to find the game seed 1067.57s - 1073.57s | that he used for the first level. Now, quick note. Diablo is a game where every single dungeon level, 1073.57s - 1079.57s | Dungeon Levels 1 through 16, are all generated at the moment that you start the character. In other words, 1079.57s - 1085.57s | you have a game seed and all of your dungeon seeds are generated from that. There was only one minor problem. 1085.57s - 1093.57s | The next level, Dungeon Level 2, didn't match. The first level matched, but not the second or any of them 1093.57s - 1099.57s | after that. So we had a puzzle that we had to solve. We basically repeated the same search that we were doing 1099.57s - 1107.57s | 16 times for each of the dungeon levels and found that Grubo hadn't played one game of Diablo. 1107.57s - 1115.57s | He'd taken save files from 15 different games and stitched them together. And because our tools are very accurate, 1115.57s - 1121.57s | we were able to identify the exact game time of each one of these. And you know all of these are in 2008 1121.57s - 1127.57s | all the way till this one,


chunk_id: 170_chunk_19
chunk_text:
| that he used for the first level. Now, quick note. Diablo is a game where every single dungeon level, 1073.57s - 1079.57s | Dungeon Levels 1 through 16, are all generated at the moment that you start the character. In other words, 1079.57s - 1085.57s | you have a game seed and all of your dungeon seeds are generated from that. There was only one minor problem. 1085.57s - 1093.57s | The next level, Dungeon Level 2, didn't match. The first level matched, but not the second or any of them 1093.57s - 1099.57s | after that. So we had a puzzle that we had to solve. We basically repeated the same search that we were doing 1099.57s - 1107.57s | 16 times for each of the dungeon levels and found that Grubo hadn't played one game of Diablo. 1107.57s - 1115.57s | He'd taken save files from 15 different games and stitched them together. And because our tools are very accurate, 1115.57s - 1121.57s | we were able to identify the exact game time of each one of these. And you know all of these are in 2008 1121.57s - 1127.57s | all the way till this one, which is in 2009. Grubo submitted his run in 2009, in January 2009. 1127.57s - 1137.14s | So these are very likely the exact levels that Grubo found. Just to put some context around that, 1137.14s - 1145.14s | we have high confidence that we exactly matched what's shown on the screen to the levels and we have an appendix 1145.14s - 1153.14s | in this document that describes how we identified those levels in detail. But we missed two levels. 1153.14s - 1160.14s | Dungeon Levels 3 and 4 were entirely missing and Dungeon Level 9, the one where you saw him pick up a staff 1160.14s - 1169.14s | from the first enemy, was there, but the items were wrong. So this definitely caused us to ask a few more questions. 1169.14s - 1176.14s | Like, okay, what's going on here? How did this happen? There were some other things that were very interesting. 1176.14s - 1182.14s | One of them was an inconsistent inventory issue. So if you're playing legitimately, you're generally going to 1182.14s - 1193.14s | not have any discrepancies in your run. We found a couple. For instance, in Dungeon Level 4, we pick


chunk_id: 170_chunk_20
chunk_text:
which is in 2009. Grubo submitted his run in 2009, in January 2009. 1127.57s - 1137.14s | So these are very likely the exact levels that Grubo found. Just to put some context around that, 1137.14s - 1145.14s | we have high confidence that we exactly matched what's shown on the screen to the levels and we have an appendix 1145.14s - 1153.14s | in this document that describes how we identified those levels in detail. But we missed two levels. 1153.14s - 1160.14s | Dungeon Levels 3 and 4 were entirely missing and Dungeon Level 9, the one where you saw him pick up a staff 1160.14s - 1169.14s | from the first enemy, was there, but the items were wrong. So this definitely caused us to ask a few more questions. 1169.14s - 1176.14s | Like, okay, what's going on here? How did this happen? There were some other things that were very interesting. 1176.14s - 1182.14s | One of them was an inconsistent inventory issue. So if you're playing legitimately, you're generally going to 1182.14s - 1193.14s | not have any discrepancies in your run. We found a couple. For instance, in Dungeon Level 4, we pick up a ring 1193.14s - 1202.14s | from that sarcophagus. Then when we're... I'm sorry, not we, Grubo. Grubo then went to Dungeon Level 9 1202.14s - 1207.14s | and opened his inventory, which you can note here that there's no ring in his inventory. 1207.14s - 1212.14s | But later on in town, he opens his inventory again and there's the ring again. So wait a minute. 1212.14s - 1216.14s | We had a ring, we lost a ring, we got the ring again. How did this happen? 1216.14s - 1222.14s | Okay, that seems to be proof that there is an irregularity in the speedrun. 1222.14s - 1228.14s | Another thing we noticed, and I'm not going to get into too many details on this, but there are some impossible 1228.14s - 1234.14s | quest combinations. There's groups of quests. For instance, Poisoned Water Supply and the Curse of King Leoric 1234.14s - 1239.14s | is the first group. You're going to have one of these and not the other. The other group down here, say 1239.14s - 1245.14s | The Butcher, Garibald the Weak, and Ogden's Sign, you're going to have two out of three of those.


chunk_id: 170_chunk_21
chunk_text:
up a ring 1193.14s - 1202.14s | from that sarcophagus. Then when we're... I'm sorry, not we, Grubo. Grubo then went to Dungeon Level 9 1202.14s - 1207.14s | and opened his inventory, which you can note here that there's no ring in his inventory. 1207.14s - 1212.14s | But later on in town, he opens his inventory again and there's the ring again. So wait a minute. 1212.14s - 1216.14s | We had a ring, we lost a ring, we got the ring again. How did this happen? 1216.14s - 1222.14s | Okay, that seems to be proof that there is an irregularity in the speedrun. 1222.14s - 1228.14s | Another thing we noticed, and I'm not going to get into too many details on this, but there are some impossible 1228.14s - 1234.14s | quest combinations. There's groups of quests. For instance, Poisoned Water Supply and the Curse of King Leoric 1234.14s - 1239.14s | is the first group. You're going to have one of these and not the other. The other group down here, say 1239.14s - 1245.14s | The Butcher, Garibald the Weak, and Ogden's Sign, you're going to have two out of three of those. 1245.14s - 1252.14s | But not all three at once. And what we found is extensive evidence of those not necessarily always aligning. 1252.14s - 1266.14s | Like right here we have the Poisoned Water Supply in evidence, but then later on we see that the Butcher's Red Room 1266.14s - 1280.67s | was present. Well, let's see. Getting my own notes mixed up. Basically, we expected that the quest Ogden's Sign 1283.37s - 1291.37s | would not be active. If it were, these stairs here would be behind walls. But most of the levels that we found 1291.37s - 1297.37s | in those seeds had those walls in place. Basically meaning that the speedrun wouldn't have been 1297.37s - 1302.37s | completable. So, wait a minute, what's going on here? We found a couple of other inconsistencies there. 1302.37s - 1313.37s | A quest was available on dungeon level 13 that was used. I'm sorry, let me rephrase this. A quest was available 1313.37s - 1320.37s | in four of the games. So we found it in four of them. And if that had really been the case, Gruber wouldn't have 1320.37s - 1328.37s | been able to continue


chunk_id: 170_chunk_22
chunk_text:
1245.14s - 1252.14s | But not all three at once. And what we found is extensive evidence of those not necessarily always aligning. 1252.14s - 1266.14s | Like right here we have the Poisoned Water Supply in evidence, but then later on we see that the Butcher's Red Room 1266.14s - 1280.67s | was present. Well, let's see. Getting my own notes mixed up. Basically, we expected that the quest Ogden's Sign 1283.37s - 1291.37s | would not be active. If it were, these stairs here would be behind walls. But most of the levels that we found 1291.37s - 1297.37s | in those seeds had those walls in place. Basically meaning that the speedrun wouldn't have been 1297.37s - 1302.37s | completable. So, wait a minute, what's going on here? We found a couple of other inconsistencies there. 1302.37s - 1313.37s | A quest was available on dungeon level 13 that was used. I'm sorry, let me rephrase this. A quest was available 1313.37s - 1320.37s | in four of the games. So we found it in four of them. And if that had really been the case, Gruber wouldn't have 1320.37s - 1328.37s | been able to continue forward if that had actually been active. So basically we ran into all these weird 1329.37s - 1336.37s | inconsistencies. Effectively there were just the wrong numbers of wrong combinations of quests that the game 1336.37s - 1342.37s | logic would never allow. We have some additional information on that in here for later. Now this is the one 1342.37s - 1348.37s | that was probably the most curious to us. We described this as inaccessible dungeon level. So when we got to 1348.37s - 1357.37s | dungeon level nine, we found the right room layout, but the problem is that even with conducting a search 1357.37s - 1367.37s | across all ranges, we couldn't quite identify any levels that exactly matched what was there. Basically some 1367.37s - 1376.37s | context. The game Diablo uses the current epochs and the 32-bit signed integer of number of seconds since 1970 1376.37s - 1383.37s | to determine what the game seed is. And in Windows, you can't really go beyond certain years. In other words, 1383.37s - 1388.37s | if you go beyond the year 2038, Diablo will just keep repeating the same level over and over again. There's no 1388.37s


chunk_id: 170_chunk_23
chunk_text:
forward if that had actually been active. So basically we ran into all these weird 1329.37s - 1336.37s | inconsistencies. Effectively there were just the wrong numbers of wrong combinations of quests that the game 1336.37s - 1342.37s | logic would never allow. We have some additional information on that in here for later. Now this is the one 1342.37s - 1348.37s | that was probably the most curious to us. We described this as inaccessible dungeon level. So when we got to 1348.37s - 1357.37s | dungeon level nine, we found the right room layout, but the problem is that even with conducting a search 1357.37s - 1367.37s | across all ranges, we couldn't quite identify any levels that exactly matched what was there. Basically some 1367.37s - 1376.37s | context. The game Diablo uses the current epochs and the 32-bit signed integer of number of seconds since 1970 1376.37s - 1383.37s | to determine what the game seed is. And in Windows, you can't really go beyond certain years. In other words, 1383.37s - 1388.37s | if you go beyond the year 2038, Diablo will just keep repeating the same level over and over again. There's no 1388.37s - 1396.37s | natural way to get to levels after that. But the only levels we found that exactly matched what we saw in Gruber's 1396.37s - 1405.37s | dungeon level nine were in the years 2056 and the years 2074, which again, something just seemed really wrong 1405.37s - 1410.37s | about that. He played this game in 2008, 2009. So there was just something really weird. And more than that, 1410.37s - 1417.37s | the fact that the first enemy dropped an item in a way that just would not be possible, despite searching the 1417.37s - 1427.37s | entire 32-bit signed space, every possible level, not one instance of finding that combination anywhere, just 1427.37s - 1433.37s | seemed very, very strange to the team. There was also some aspects that were a little bit tricky to figure out. 1433.37s - 1438.37s | For instance, there's some missing gameplay, and we went so specific as to go down to a single frame. For instance, 1438.37s - 1446.37s | there's an animation of him walking and turning. We have a first frame in Gruber's video where, well, we did a 1446.37s - 1456.37s | demo video here. So


chunk_id: 170_chunk_24
chunk_text:
- 1396.37s | natural way to get to levels after that. But the only levels we found that exactly matched what we saw in Gruber's 1396.37s - 1405.37s | dungeon level nine were in the years 2056 and the years 2074, which again, something just seemed really wrong 1405.37s - 1410.37s | about that. He played this game in 2008, 2009. So there was just something really weird. And more than that, 1410.37s - 1417.37s | the fact that the first enemy dropped an item in a way that just would not be possible, despite searching the 1417.37s - 1427.37s | entire 32-bit signed space, every possible level, not one instance of finding that combination anywhere, just 1427.37s - 1433.37s | seemed very, very strange to the team. There was also some aspects that were a little bit tricky to figure out. 1433.37s - 1438.37s | For instance, there's some missing gameplay, and we went so specific as to go down to a single frame. For instance, 1438.37s - 1446.37s | there's an animation of him walking and turning. We have a first frame in Gruber's video where, well, we did a 1446.37s - 1456.37s | demo video here. So this is a demo video. We're facing down, then we're facing away, and then we are facing away, 1456.37s - 1461.37s | and the right leg is in front of the left. You won't be able to see this on screen. It's way too tiny. But in Gruber's 1461.37s - 1467.37s | initial video, it's walking forward and then immediately goes backward with a frame missing. So there's just, for 1467.37s - 1475.37s | whatever reason, a single frame of video that we can, without a shadow of a doubt, say is just not there. Now, that 1475.37s - 1482.37s | means that the encoder might have had a problem. It doesn't necessarily mean that he cheated there. It's just odd. 1482.37s - 1488.37s | It did make it harder to identify where things might have been spliced incorrectly. However, there were sections 1488.37s - 1495.37s | that were missing gameplay entirely. For instance, when we entered dungeon level 15, this red portal is already 1495.37s - 1503.37s | open at the moment it appears, which means that that section of that portal initially opening is entirely 1503.37s - 1509.37s | missing. In other words, that portion of gameplay was


chunk_id: 170_chunk_25
chunk_text:
this is a demo video. We're facing down, then we're facing away, and then we are facing away, 1456.37s - 1461.37s | and the right leg is in front of the left. You won't be able to see this on screen. It's way too tiny. But in Gruber's 1461.37s - 1467.37s | initial video, it's walking forward and then immediately goes backward with a frame missing. So there's just, for 1467.37s - 1475.37s | whatever reason, a single frame of video that we can, without a shadow of a doubt, say is just not there. Now, that 1475.37s - 1482.37s | means that the encoder might have had a problem. It doesn't necessarily mean that he cheated there. It's just odd. 1482.37s - 1488.37s | It did make it harder to identify where things might have been spliced incorrectly. However, there were sections 1488.37s - 1495.37s | that were missing gameplay entirely. For instance, when we entered dungeon level 15, this red portal is already 1495.37s - 1503.37s | open at the moment it appears, which means that that section of that portal initially opening is entirely 1503.37s - 1509.37s | missing. In other words, that portion of gameplay was cut off, which indicates a potential video splice problem. 1509.37s - 1517.37s | And there's a couple of other instances of that as well. I talked about this earlier, the inconsistent item drop 1517.37s - 1526.37s | here, where we just cannot manage to find any way that that could have possibly happened. So that's kind of a rehash. 1526.37s - 1535.37s | But then there's another thing. There's what we describe as improbable item duplication. We see that as Gruber is 1535.37s - 1543.37s | walking, there are staffs that are like a nauseous puzzler. It's being duplicated in movement. The only problem is, 1543.37s - 1548.37s | and you can see that there are two of them here in inventory in the screenshot. The only problem with that is we saw on the 1548.37s - 1556.37s | version screen that it was using version 1.0. But in version 1.0, that duping glitch is very, very difficult to do 1556.37s - 1564.37s | because of a very tight timing loop. This likely wouldn't have been possible for a human to do until Diablo version 1.02 1564.37s - 1571.37s | or later. So we again had that weird, what's going


chunk_id: 170_chunk_26
chunk_text:
cut off, which indicates a potential video splice problem. 1509.37s - 1517.37s | And there's a couple of other instances of that as well. I talked about this earlier, the inconsistent item drop 1517.37s - 1526.37s | here, where we just cannot manage to find any way that that could have possibly happened. So that's kind of a rehash. 1526.37s - 1535.37s | But then there's another thing. There's what we describe as improbable item duplication. We see that as Gruber is 1535.37s - 1543.37s | walking, there are staffs that are like a nauseous puzzler. It's being duplicated in movement. The only problem is, 1543.37s - 1548.37s | and you can see that there are two of them here in inventory in the screenshot. The only problem with that is we saw on the 1548.37s - 1556.37s | version screen that it was using version 1.0. But in version 1.0, that duping glitch is very, very difficult to do 1556.37s - 1564.37s | because of a very tight timing loop. This likely wouldn't have been possible for a human to do until Diablo version 1.02 1564.37s - 1571.37s | or later. So we again had that weird, what's going on with these version mismatches? Then we ended up with this next 1571.37s - 1580.37s | one, which was what we described as inconsistent music playback. We went so far as to bust out everyone's favorite tool, a 1580.37s - 1587.37s | spectrograph. So this is a spectrogram view. And what we did is we looked at the section of video where we had some 1587.37s - 1593.37s | questions about how they did something. We can see footsteps, footsteps, footsteps, footsteps, and then there's this really 1593.37s - 1601.37s | sharp line right here. And this sharp line is where a video splice clearly happened. You can hear the music abruptly 1601.37s - 1609.37s | changing, and then the shop character starts speaking right here at this edge. Um, that basically gave us a pretty clear 1609.37s - 1619.37s | indication, based on that, on that audible signal, that there was something funny going on with, with, with this, uh, with this 1619.37s - 1627.37s | section. There was, there's something weird here. Then we ended up with this shop inventory, which was pretty puzzling. Uh, so 1627.37s - 1638.37s | there's this level, there's these items in inventory.


chunk_id: 170_chunk_27
chunk_text:
on with these version mismatches? Then we ended up with this next 1571.37s - 1580.37s | one, which was what we described as inconsistent music playback. We went so far as to bust out everyone's favorite tool, a 1580.37s - 1587.37s | spectrograph. So this is a spectrogram view. And what we did is we looked at the section of video where we had some 1587.37s - 1593.37s | questions about how they did something. We can see footsteps, footsteps, footsteps, footsteps, and then there's this really 1593.37s - 1601.37s | sharp line right here. And this sharp line is where a video splice clearly happened. You can hear the music abruptly 1601.37s - 1609.37s | changing, and then the shop character starts speaking right here at this edge. Um, that basically gave us a pretty clear 1609.37s - 1619.37s | indication, based on that, on that audible signal, that there was something funny going on with, with, with this, uh, with this 1619.37s - 1627.37s | section. There was, there's something weird here. Then we ended up with this shop inventory, which was pretty puzzling. Uh, so 1627.37s - 1638.37s | there's this level, there's these items in inventory. And then on the next, uh, page, there's these items. And I'll go back 1638.37s - 1645.37s | here. Okay. Let me see if I can get both of them on the screen. Basically, the issue is, they have one set of items, and then 1645.37s - 1654.37s | suddenly they get a totally different set of items. The challenge with this is, you'd either have to, in version 1.00 to 1.02, 1654.37s - 1662.37s | you'd have to walk all the way to the dungeon and walk back. Or, if using version 1.03 or later, you would have to, at this 1662.37s - 1671.37s | point, save and then reload to force the shop to, to ro- to, uh, to change. Um, that theoretically should have been 1671.37s - 1678.37s | included in here one way or another, or at least a note about it in the description, but that wasn't included here. So, we saw this 1678.37s - 1686.37s | and went, hmm, there's, there's something missing in this location. Uh, then there's this fun one. Um, if you look really 1686.37s - 1694.37s | carefully, we have a little red section right here. It's probably not visible


chunk_id: 170_chunk_28
chunk_text:
And then on the next, uh, page, there's these items. And I'll go back 1638.37s - 1645.37s | here. Okay. Let me see if I can get both of them on the screen. Basically, the issue is, they have one set of items, and then 1645.37s - 1654.37s | suddenly they get a totally different set of items. The challenge with this is, you'd either have to, in version 1.00 to 1.02, 1654.37s - 1662.37s | you'd have to walk all the way to the dungeon and walk back. Or, if using version 1.03 or later, you would have to, at this 1662.37s - 1671.37s | point, save and then reload to force the shop to, to ro- to, uh, to change. Um, that theoretically should have been 1671.37s - 1678.37s | included in here one way or another, or at least a note about it in the description, but that wasn't included here. So, we saw this 1678.37s - 1686.37s | and went, hmm, there's, there's something missing in this location. Uh, then there's this fun one. Um, if you look really 1686.37s - 1694.37s | carefully, we have a little red section right here. It's probably not visible on the display. Uh, but this says, this says 1694.37s - 1706.37s | hit points negative 22. In, um, in this game, it is possible, through certain glitches, to overflow the health, and it not only 1706.37s - 1714.37s | gives you negative health, it even goes so far as to draw the health in the orb backward. It's drawing it from the bottom- from the 1714.37s - 1725.37s | top instead of the bottom. Uh, the only challenge here, though, is that the glitch was fixed in version 1.07. Meaning, going back to 1725.37s - 1734.37s | our initial screen that said 1.09, he couldn't have used 1.09. So, we come into this, okay, well, what version did he use anyway? 1734.37s - 1741.37s | There's no one version where all of these factors can all be in play at the same time. So, out of that, we, we came up with our own 1741.37s - 1750.37s | conclusions. Now, I'm gonna pause here. Based on this evidence, and, and show of hands, based on the evidence that I've shown you so far, 1750.37s - 1759.37s | does it seem like this run is completely legitimate? Or, raise your


chunk_id: 170_chunk_29
chunk_text:
on the display. Uh, but this says, this says 1694.37s - 1706.37s | hit points negative 22. In, um, in this game, it is possible, through certain glitches, to overflow the health, and it not only 1706.37s - 1714.37s | gives you negative health, it even goes so far as to draw the health in the orb backward. It's drawing it from the bottom- from the 1714.37s - 1725.37s | top instead of the bottom. Uh, the only challenge here, though, is that the glitch was fixed in version 1.07. Meaning, going back to 1725.37s - 1734.37s | our initial screen that said 1.09, he couldn't have used 1.09. So, we come into this, okay, well, what version did he use anyway? 1734.37s - 1741.37s | There's no one version where all of these factors can all be in play at the same time. So, out of that, we, we came up with our own 1741.37s - 1750.37s | conclusions. Now, I'm gonna pause here. Based on this evidence, and, and show of hands, based on the evidence that I've shown you so far, 1750.37s - 1759.37s | does it seem like this run is completely legitimate? Or, raise your hand if you think this is perhaps not legitimate. Okay, not legitimate? 1759.37s - 1764.37s | Most, okay, most folks are like, okay, most folks in the audience are like, eh, this is probably not legitimate. Well, that was our 1764.37s - 1772.37s | conclusion as well. Like, there's just so many factors here, especially given that these dungeon layouts aren't correct. And we, we spent so much 1772.37s - 1780.37s | time, so many members of the team spent so much time disassembling the code and diving in to understand what had happened here. Uh, but we just 1780.37s - 1788.37s | couldn't come up with, with any, any way to, to handle this. Like, we, we, we knew that there was something funny. So, our conclusion were, 1789.37s - 1796.37s | when we finished this analysis, our conclusion was that this run should be removed from record sites. Not just SDA, Speed Demos Archive, where the 1796.37s - 1804.37s | record is held now, but also Guinness Book of World Records, because there are two separate records on that site. We had attempted to contact 1804.37s - 1813.37s | Rubo in February through LinkedIn, didn't receive a reply,


chunk_id: 170_chunk_30
chunk_text:
hand if you think this is perhaps not legitimate. Okay, not legitimate? 1759.37s - 1764.37s | Most, okay, most folks are like, okay, most folks in the audience are like, eh, this is probably not legitimate. Well, that was our 1764.37s - 1772.37s | conclusion as well. Like, there's just so many factors here, especially given that these dungeon layouts aren't correct. And we, we spent so much 1772.37s - 1780.37s | time, so many members of the team spent so much time disassembling the code and diving in to understand what had happened here. Uh, but we just 1780.37s - 1788.37s | couldn't come up with, with any, any way to, to handle this. Like, we, we, we knew that there was something funny. So, our conclusion were, 1789.37s - 1796.37s | when we finished this analysis, our conclusion was that this run should be removed from record sites. Not just SDA, Speed Demos Archive, where the 1796.37s - 1804.37s | record is held now, but also Guinness Book of World Records, because there are two separate records on that site. We had attempted to contact 1804.37s - 1813.37s | Rubo in February through LinkedIn, didn't receive a reply, didn't have any other contact information. So, the analysis you just saw was based on no 1813.37s - 1821.37s | information from the runner. Remember how I said I was kind of scrambling a bit? Well, that's because in the last week, we got in touch with Rubo 1821.37s - 1829.37s | thanks to a journalist who was interested in this story and reached out to Rubo directly using the premium LinkedIn, actually. This is not an ad. Um, but 1829.37s - 1841.37s | managed to get in touch with Rubo. And suddenly, all of our carefully constructed theories got really interesting. So, our talk is going to take a bit of a 1841.37s - 1852.37s | turn. And also, you can kind of gather that I'm kind of presenting this in a very different way than I intended to. Rubo responded just this month, 1852.37s - 1862.37s | just in the last week, that because it was a segmented run, everything that we saw was completely explainable and totally allowed. 1863.37s - 1875.87s | Specifically, that the version number seen on the initial title screen versus the credit screen of the splash screen, and the discrepancies with 1875.87s -


chunk_id: 170_chunk_31
chunk_text:
didn't have any other contact information. So, the analysis you just saw was based on no 1813.37s - 1821.37s | information from the runner. Remember how I said I was kind of scrambling a bit? Well, that's because in the last week, we got in touch with Rubo 1821.37s - 1829.37s | thanks to a journalist who was interested in this story and reached out to Rubo directly using the premium LinkedIn, actually. This is not an ad. Um, but 1829.37s - 1841.37s | managed to get in touch with Rubo. And suddenly, all of our carefully constructed theories got really interesting. So, our talk is going to take a bit of a 1841.37s - 1852.37s | turn. And also, you can kind of gather that I'm kind of presenting this in a very different way than I intended to. Rubo responded just this month, 1852.37s - 1862.37s | just in the last week, that because it was a segmented run, everything that we saw was completely explainable and totally allowed. 1863.37s - 1875.87s | Specifically, that the version number seen on the initial title screen versus the credit screen of the splash screen, and the discrepancies with 1875.87s - 1884.87s | versions, that was just because he'd used old encodes and just stitched all that together for flavor. It didn't matter to the timing of the run and wasn't a 1884.87s - 1895.87s | problem. Okay. He further said that there was an exception in place that allowed him to start runs from multiple different saves, and then use tools 1895.87s - 1904.87s | to modify the memory, and ultimately, what gets saved in the save file, in order to basically catch up levels to match what previous levels had 1904.87s - 1913.87s | done. Now, obviously, we show that that wasn't always right. There's multiple cases where, for instance, that ring that appears and then disappears 1913.87s - 1922.87s | and then reappears again. That's a, that's a little bit funny. He obviously, if he did use those tools in the way he said, there were some mistakes 1922.87s - 1931.87s | made. Okay, not, not the end of the world. His exact quote, just so that it's here on the record, my run is a segmented spliced run, it always has been, and it was 1931.87s - 1938.87s | never passed off as anything else, nor was


chunk_id: 170_chunk_32
chunk_text:
1884.87s | versions, that was just because he'd used old encodes and just stitched all that together for flavor. It didn't matter to the timing of the run and wasn't a 1884.87s - 1895.87s | problem. Okay. He further said that there was an exception in place that allowed him to start runs from multiple different saves, and then use tools 1895.87s - 1904.87s | to modify the memory, and ultimately, what gets saved in the save file, in order to basically catch up levels to match what previous levels had 1904.87s - 1913.87s | done. Now, obviously, we show that that wasn't always right. There's multiple cases where, for instance, that ring that appears and then disappears 1913.87s - 1922.87s | and then reappears again. That's a, that's a little bit funny. He obviously, if he did use those tools in the way he said, there were some mistakes 1922.87s - 1931.87s | made. Okay, not, not the end of the world. His exact quote, just so that it's here on the record, my run is a segmented spliced run, it always has been, and it was 1931.87s - 1938.87s | never passed off as anything else, nor was it part of any competition or leaderboards. The speed demos archive page states that outright. Now, I would 1938.87s - 1946.87s | slightly disagree with Grubo on this point. I would say that speeds demos archives is a leaderboard. It is a records holding site. And furthermore, 1946.87s - 1954.87s | it's not entirely clear how the Guinness Book of World Records ended up there. But I would say Guinness Book of World Records is a records leaderboard 1954.87s - 1965.87s | site in every sense of the word. So that little bit of nitpick aside, Grubo's statement was basically, well, this was segmented, it was, it was possible to 1965.87s - 1972.87s | split wherever I wanted to. Sure, you showed that there was a video split right before the shot, but that's completely allowed. I can do that. And SDA timing 1972.87s - 1988.27s | says that I can remove the loading screens and just take a half second penalty. So, alright, where does this leave us? What do we do? We put a lot of effort 1988.75s - 1999.75s | into taking apart all of these elements, only to discover that the runner didn't do this with


chunk_id: 170_chunk_33
chunk_text:
it part of any competition or leaderboards. The speed demos archive page states that outright. Now, I would 1938.87s - 1946.87s | slightly disagree with Grubo on this point. I would say that speeds demos archives is a leaderboard. It is a records holding site. And furthermore, 1946.87s - 1954.87s | it's not entirely clear how the Guinness Book of World Records ended up there. But I would say Guinness Book of World Records is a records leaderboard 1954.87s - 1965.87s | site in every sense of the word. So that little bit of nitpick aside, Grubo's statement was basically, well, this was segmented, it was, it was possible to 1965.87s - 1972.87s | split wherever I wanted to. Sure, you showed that there was a video split right before the shot, but that's completely allowed. I can do that. And SDA timing 1972.87s - 1988.27s | says that I can remove the loading screens and just take a half second penalty. So, alright, where does this leave us? What do we do? We put a lot of effort 1988.75s - 1999.75s | into taking apart all of these elements, only to discover that the runner didn't do this with malice, at least according to his statement. And in all 1999.75s - 2009.75s | honesty, as, as a presenter, I have to agree with that. I don't think that Grubo maliciously tried to hurt anyone. But I need to pause there for a second, 2010.75s - 2020.75s | because in 2009, when Grubo released this run, that was only three minutes and 12 seconds long using SDA timing that removed those load screens. It 2020.75s - 2033.27s | completely stopped speedrunning in that category. No one else could get times anywhere near what Grubo had. Why? Because none of us read what Grubo submitted in 2033.27s - 2042.35s | his notes and interpreted it as, oh, yeah, I just took multiple different games and hacked together to save files using external tools that wrote to 2042.35s - 2052.99s | memory. No one made that assumption. The exception that Grubo claims to have had is nowhere to be found. Now that doesn't mean it didn't exist at the 2052.99s - 2061.95s | time. SDA staff has rotated since then. But nevertheless, there is is doubt maybe Grubo did have an exception. We don't have any of the save 2061.95s - 2072.27s


chunk_id: 170_chunk_34
chunk_text:
malice, at least according to his statement. And in all 1999.75s - 2009.75s | honesty, as, as a presenter, I have to agree with that. I don't think that Grubo maliciously tried to hurt anyone. But I need to pause there for a second, 2010.75s - 2020.75s | because in 2009, when Grubo released this run, that was only three minutes and 12 seconds long using SDA timing that removed those load screens. It 2020.75s - 2033.27s | completely stopped speedrunning in that category. No one else could get times anywhere near what Grubo had. Why? Because none of us read what Grubo submitted in 2033.27s - 2042.35s | his notes and interpreted it as, oh, yeah, I just took multiple different games and hacked together to save files using external tools that wrote to 2042.35s - 2052.99s | memory. No one made that assumption. The exception that Grubo claims to have had is nowhere to be found. Now that doesn't mean it didn't exist at the 2052.99s - 2061.95s | time. SDA staff has rotated since then. But nevertheless, there is is doubt maybe Grubo did have an exception. We don't have any of the save 2061.95s - 2072.27s | files. The SDA folks didn't keep them. Grubo didn't keep them. Well, all right, here we are. We're in a situation where we can't prove 2072.27s - 2085.23s | anything necessarily outside of one aspect. It's still a little bit interesting that despite all of the disassembly we did, we never found any 2085.23s - 2094.67s | possible route for Grubo to produce dungeon level nine with that drop of the item right away. It's simply it can't happen. There's no possible way 2094.67s - 2106.31s | that we were able to analyze in any version of Diablo that could produce that. So where does that leave us? Well, speedrunning on that category 2106.31s - 2115.21s | effectively stopped in 2009. No one could beat it. But in the last couple of weeks, as we've had folks streaming on Twitch, and talking about 2115.23s - 2128.39s | about, hey, well, maybe maybe now we can use new new methods to complete this faster. We've now come to a place where we can get very close to 2128.39s - 2139.39s | Grubo's time, we won't necessarily be able to beat it with human skill just yet. But we in the


chunk_id: 170_chunk_35
chunk_text:
| files. The SDA folks didn't keep them. Grubo didn't keep them. Well, all right, here we are. We're in a situation where we can't prove 2072.27s - 2085.23s | anything necessarily outside of one aspect. It's still a little bit interesting that despite all of the disassembly we did, we never found any 2085.23s - 2094.67s | possible route for Grubo to produce dungeon level nine with that drop of the item right away. It's simply it can't happen. There's no possible way 2094.67s - 2106.31s | that we were able to analyze in any version of Diablo that could produce that. So where does that leave us? Well, speedrunning on that category 2106.31s - 2115.21s | effectively stopped in 2009. No one could beat it. But in the last couple of weeks, as we've had folks streaming on Twitch, and talking about 2115.23s - 2128.39s | about, hey, well, maybe maybe now we can use new new methods to complete this faster. We've now come to a place where we can get very close to 2128.39s - 2139.39s | Grubo's time, we won't necessarily be able to beat it with human skill just yet. But we in the last week, scrounged and scraped and a whole bunch of 2139.39s - 2147.71s | folks on the team work together, Stephan and a Jenbo and FunkmasterMP and Nightcat and a bunch of other folks. There's a huge credits list, by the 2147.71s - 2160.23s | way, all got together and made a tool assisted speedrun to demonstrate what could be done on a real, legitimate playthrough, where we have one 2160.23s - 2168.07s | game seed and all of the dungeon levels that we encounter are legitimate dungeon seeds, and there's no issues whatsoever with with 2168.07s - 2178.43s | splicing. And I would like to just quickly show you that video. I'm going to be talking over it. So we'll keep the volume a little bit quieter. But 2178.95s - 2197.57s | you know, it'd really help if I had the video up. Okay, let me just load that right quick. Go. Well, I'm looking that up. Oh, yeah, of course, it's 2197.57s - 2210.98s | not in my history. Why would it be? Okay. You know, it's always fun when you're doing a talk, and things are changing right beforehand. There it is. 2210.98s - 2221.10s | There's


chunk_id: 170_chunk_36
chunk_text:
last week, scrounged and scraped and a whole bunch of 2139.39s - 2147.71s | folks on the team work together, Stephan and a Jenbo and FunkmasterMP and Nightcat and a bunch of other folks. There's a huge credits list, by the 2147.71s - 2160.23s | way, all got together and made a tool assisted speedrun to demonstrate what could be done on a real, legitimate playthrough, where we have one 2160.23s - 2168.07s | game seed and all of the dungeon levels that we encounter are legitimate dungeon seeds, and there's no issues whatsoever with with 2168.07s - 2178.43s | splicing. And I would like to just quickly show you that video. I'm going to be talking over it. So we'll keep the volume a little bit quieter. But 2178.95s - 2197.57s | you know, it'd really help if I had the video up. Okay, let me just load that right quick. Go. Well, I'm looking that up. Oh, yeah, of course, it's 2197.57s - 2210.98s | not in my history. Why would it be? Okay. You know, it's always fun when you're doing a talk, and things are changing right beforehand. There it is. 2210.98s - 2221.10s | There's the test. All right, there we go. So I want you guys to watch this really quick. I'll be talking over it as we go. Right. Just make sure the 2221.10s - 2236.54s | right task came up. Nope, it ain't there. All right, let's hope they don't splash my whole desktop. All right. Yep, I definitely tried to 2236.54s - 2244.90s | splash something I didn't mean to but that's all right. There we go. Here we go. Let me make that in big and and I will also restart it for the sake 2244.90s - 2255.26s | of of there we go. Okay, so this is a tool assisted speedrun, which isn't necessarily quite as fair. You might consider this a super segmented 2255.26s - 2263.62s | run. Um, Grubo did did his run in 27 segments, this tool assisted speedrun is doing it in a lot more than that. But right here, we're duplicating 2263.62s - 2270.58s | gold by dropping it on the ground and immediately picking it back up in a way that allows us to double our gold pile every time that you can see we 2270.58s - 2278.98s | played this entirely on


chunk_id: 170_chunk_37
chunk_text:
the test. All right, there we go. So I want you guys to watch this really quick. I'll be talking over it as we go. Right. Just make sure the 2221.10s - 2236.54s | right task came up. Nope, it ain't there. All right, let's hope they don't splash my whole desktop. All right. Yep, I definitely tried to 2236.54s - 2244.90s | splash something I didn't mean to but that's all right. There we go. Here we go. Let me make that in big and and I will also restart it for the sake 2244.90s - 2255.26s | of of there we go. Okay, so this is a tool assisted speedrun, which isn't necessarily quite as fair. You might consider this a super segmented 2255.26s - 2263.62s | run. Um, Grubo did did his run in 27 segments, this tool assisted speedrun is doing it in a lot more than that. But right here, we're duplicating 2263.62s - 2270.58s | gold by dropping it on the ground and immediately picking it back up in a way that allows us to double our gold pile every time that you can see we 2270.58s - 2278.98s | played this entirely on Diablo version 1.04. Here in the second is going to be the flashiest thing that happens in this run. We're going to go to the 2278.98s - 2293.34s | shop and we're going to buy a few items. Okay, there it is. Yeah, that's that's not fair. Now, as as this is playing, what's interesting about 2293.34s - 2303.30s | this is that we could not possibly create a number of dungeon levels that were that had stairs as close as Grubo did. But what we were able to get 2303.30s - 2312.14s | were a fair number of them that were reasonably short. And the first level though here is Diablo dungeon level one here, there's a bunch of walls 2312.14s - 2319.42s | in the way between us and the stairs that go down. So we use a new new glitch recently discovered that allows us to repeatedly phase without 2319.42s - 2328.78s | consuming any resources and just you know, go right through the walls. So while the level itself is physically longer distance between the stairs that 2328.78s - 2335.62s | go up and the stairs that go down, we were still able to clear that


chunk_id: 170_chunk_38
chunk_text:
Diablo version 1.04. Here in the second is going to be the flashiest thing that happens in this run. We're going to go to the 2278.98s - 2293.34s | shop and we're going to buy a few items. Okay, there it is. Yeah, that's that's not fair. Now, as as this is playing, what's interesting about 2293.34s - 2303.30s | this is that we could not possibly create a number of dungeon levels that were that had stairs as close as Grubo did. But what we were able to get 2303.30s - 2312.14s | were a fair number of them that were reasonably short. And the first level though here is Diablo dungeon level one here, there's a bunch of walls 2312.14s - 2319.42s | in the way between us and the stairs that go down. So we use a new new glitch recently discovered that allows us to repeatedly phase without 2319.42s - 2328.78s | consuming any resources and just you know, go right through the walls. So while the level itself is physically longer distance between the stairs that 2328.78s - 2335.62s | go up and the stairs that go down, we were still able to clear that section relatively quickly. And as you'll see, several of these are still 2335.70s - 2349.42s | remarkably fast. Like there's the stairs literally right there. So while this is playing, a couple of things I want to say was Grubo a cheater? Was 2349.42s - 2357.74s | was he actually intending to troll like Todd Rogers did? Because we can pretty much say that Todd Rogers was a troll. I think that's pretty fair to 2357.74s - 2366.18s | say every single one of his records was eliminated from Twin Galaxies and Guinness Book of World Records. I think his case is very clearly a 2366.18s - 2377.78s | troll. The Super Mario Maker situation with Ahoyo. Was he a troll? Not? Well, sort of he deliberately said he did this to troll people. But is he 2377.78s - 2385.42s | really a troll? Well, not really. He came forward and he admitted, okay, well, here's the tools and he gave us the tools that he used. And he came 2385.42s - 2395.18s | clean. Yes, it caused a lot of consternation. And it was a little bit of a bittersweet ending to the original Super Mario Maker for the


chunk_id: 170_chunk_39
chunk_text:
section relatively quickly. And as you'll see, several of these are still 2335.70s - 2349.42s | remarkably fast. Like there's the stairs literally right there. So while this is playing, a couple of things I want to say was Grubo a cheater? Was 2349.42s - 2357.74s | was he actually intending to troll like Todd Rogers did? Because we can pretty much say that Todd Rogers was a troll. I think that's pretty fair to 2357.74s - 2366.18s | say every single one of his records was eliminated from Twin Galaxies and Guinness Book of World Records. I think his case is very clearly a 2366.18s - 2377.78s | troll. The Super Mario Maker situation with Ahoyo. Was he a troll? Not? Well, sort of he deliberately said he did this to troll people. But is he 2377.78s - 2385.42s | really a troll? Well, not really. He came forward and he admitted, okay, well, here's the tools and he gave us the tools that he used. And he came 2385.42s - 2395.18s | clean. Yes, it caused a lot of consternation. And it was a little bit of a bittersweet ending to the original Super Mario Maker for the Wii U. But was he 2395.18s - 2405.90s | really a troll? Was he really a cheater? And Grubo? Is Grubo really a cheater? And you know what, I thought so. Like when I went through this 2405.90s - 2414.02s | analysis and all of these tools that we put together, yeah, I thought so. And then I talked to him. And then we kind of looked at things through a 2414.02s - 2422.82s | different lens of, hey, it was 2009. And things were a little bit looser at Speed Demos Archive back then and records are not really intact. And was he 2422.82s - 2433.34s | really a cheater? You know? No, I don't think so. Personally, there are other members on the team with more strong opinions about that. But at the end 2433.34s - 2443.02s | of the day, I'm only calling for Grubo's run to be retracted because it doesn't meet current standards. And it shouldn't have met the standards 2443.02s - 2453.74s | even in 2009 because of the impossibility of what was there. In a tool-assisted speedrun and a real speedrun, you can't just go in and modify how the 2453.74s - 2463.82s


chunk_id: 170_chunk_40
chunk_text:
Wii U. But was he 2395.18s - 2405.90s | really a troll? Was he really a cheater? And Grubo? Is Grubo really a cheater? And you know what, I thought so. Like when I went through this 2405.90s - 2414.02s | analysis and all of these tools that we put together, yeah, I thought so. And then I talked to him. And then we kind of looked at things through a 2414.02s - 2422.82s | different lens of, hey, it was 2009. And things were a little bit looser at Speed Demos Archive back then and records are not really intact. And was he 2422.82s - 2433.34s | really a cheater? You know? No, I don't think so. Personally, there are other members on the team with more strong opinions about that. But at the end 2433.34s - 2443.02s | of the day, I'm only calling for Grubo's run to be retracted because it doesn't meet current standards. And it shouldn't have met the standards 2443.02s - 2453.74s | even in 2009 because of the impossibility of what was there. In a tool-assisted speedrun and a real speedrun, you can't just go in and modify how the 2453.74s - 2463.82s | game works. If you want to do that, watch some of my GDQ stuff that the Taskbot team has done. Maybe Triforce Percent is a great one if you have not 2463.82s - 2470.42s | seen it before. Look up Legend of Zelda Ocarina of Time Beta Showcase or Legend of Zelda Ocarina of Time Triforce Percent. It's the same run. 2470.70s - 2477.86s | Highly recommend watching that. You can see what happens when you play by the game's rules on an original cartridge and well, in that case, cartridge and on an 2477.86s - 2486.66s | original console. And you just use arbitrary code execution to then get the game to change how it works itself. That's totally legitimate. But modifying it 2486.66s - 2495.42s | externally and doing a ROM hack, that's not the same game anymore. And that's basically what happened here. The modifications that were made, even 2495.42s - 2505.82s | though they weren't intended to be malicious, had the impact that, you know, it changed things and it made it so that people didn't have a fair shot at 2505.82s - 2519.22s | reproducing it. Now we can make a run that does


chunk_id: 170_chunk_41
chunk_text:
| game works. If you want to do that, watch some of my GDQ stuff that the Taskbot team has done. Maybe Triforce Percent is a great one if you have not 2463.82s - 2470.42s | seen it before. Look up Legend of Zelda Ocarina of Time Beta Showcase or Legend of Zelda Ocarina of Time Triforce Percent. It's the same run. 2470.70s - 2477.86s | Highly recommend watching that. You can see what happens when you play by the game's rules on an original cartridge and well, in that case, cartridge and on an 2477.86s - 2486.66s | original console. And you just use arbitrary code execution to then get the game to change how it works itself. That's totally legitimate. But modifying it 2486.66s - 2495.42s | externally and doing a ROM hack, that's not the same game anymore. And that's basically what happened here. The modifications that were made, even 2495.42s - 2505.82s | though they weren't intended to be malicious, had the impact that, you know, it changed things and it made it so that people didn't have a fair shot at 2505.82s - 2519.22s | reproducing it. Now we can make a run that does all this crazy phasing. Oh, by the way, that is an alt tab to stop some dialogue from happening. If we'd 2519.22s - 2526.94s | used a different resolution, it wouldn't have stayed there. A couple other quick notes here. This is not fully optimized as a tool assisted speed run. This was 2526.94s - 2539.22s | made rather rapidly in the last few days. It could be improved even further from where it's at. We're almost there, almost there to the end. This task is a 2539.22s - 2550.43s | demonstration of what the game playthrough could be legitimate. We already have as of today, and I'll be updating the document after this talk, the 2550.43s - 2561.55s | Diablo.tas.bot website. I'll be updating it with links. Just in the last hour and a half, someone managed to get a time less than five minutes with a 2561.55s - 2570.95s | single segment attempt. Not even segmented, just a single segment attempt. We feel that even a human can manage to beat Rubo's time with legitimate 2570.95s - 2588.32s | stances. And here's the final boss. And, uh, that's it. That's it. That's, that's the whole run. This task


chunk_id: 170_chunk_42
chunk_text:
all this crazy phasing. Oh, by the way, that is an alt tab to stop some dialogue from happening. If we'd 2519.22s - 2526.94s | used a different resolution, it wouldn't have stayed there. A couple other quick notes here. This is not fully optimized as a tool assisted speed run. This was 2526.94s - 2539.22s | made rather rapidly in the last few days. It could be improved even further from where it's at. We're almost there, almost there to the end. This task is a 2539.22s - 2550.43s | demonstration of what the game playthrough could be legitimate. We already have as of today, and I'll be updating the document after this talk, the 2550.43s - 2561.55s | Diablo.tas.bot website. I'll be updating it with links. Just in the last hour and a half, someone managed to get a time less than five minutes with a 2561.55s - 2570.95s | single segment attempt. Not even segmented, just a single segment attempt. We feel that even a human can manage to beat Rubo's time with legitimate 2570.95s - 2588.32s | stances. And here's the final boss. And, uh, that's it. That's it. That's, that's the whole run. This task is one second faster than Rubo without 2588.32s - 2599.20s | cheating. It's a completely legitimate playthrough. Okay. I have talked about a lot of crazy things. We are coming to the end of our time. There is so much more I 2599.20s - 2605.08s | would love to tell you if I had more time, but I don't. If you would like to know more about tool-assisted speedruns in general, come to 2605.08s - 2614.56s | TASvideos.org. If you would like to know more about playing tool-assisted speedruns on real consoles, go to TAS.bot. And if you happen to be 2614.56s - 2622.60s | interested in having me research projects like this, let me know. I could use the work. Um, thank you. Sorry. Thank you. Thank you so much, 2622.60s - 2626.48s | DEFCON, for having me again, and I look forward to the next opportunity. Thanks all.


chunk_id: 170_chunk_43
chunk_text:
is one second faster than Rubo without 2588.32s - 2599.20s | cheating. It's a completely legitimate playthrough. Okay. I have talked about a lot of crazy things. We are coming to the end of our time. There is so much more I 2599.20s - 2605.08s | would love to tell you if I had more time, but I don't. If you would like to know more about tool-assisted speedruns in general, come to 2605.08s - 2614.56s | TASvideos.org. If you would like to know more about playing tool-assisted speedruns on real consoles, go to TAS.bot. And if you happen to be 2614.56s - 2622.60s | interested in having me research projects like this, let me know. I could use the work. Um, thank you. Sorry. Thank you. Thank you so much, 2622.60s - 2626.48s | DEFCON, for having me again, and I look forward to the next opportunity. Thanks all.


chunk_id: 171_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=hwuIb-Vv2Ew", "title": "DEF CON 32 - The XZ Backdoor Story: The Undercover Op That Set the Internet on Fire - Thomas Roccia", "description": "On Fri, 29 Mar 2024, at exactly 08:51:26, OSS security received a message from Andres Freund, a software engineer at Microsoft, stating he had discovered a backdoor in upstream xz/liblzma that could compromise SSH servers. The open-source project XZ, specifically the liblzma library, has been compromised by a mysterious maintainer named Jia Tan, putting the entire internet at risk. Fortunately, this discovery helped us avoid the worst.\n\nBut what happened? How long has this rogue maintainer been part of the project? Who is Jia Tan? Was he involved in other projects? How does the backdoor work? And what should we learn from this?\n\nThese are questions we will attempt to answer. First, we will discuss the discovery, which is so riddled with coincidences and chance that it's hard not to think about all the ones we've missed. Then, we'll examine the process itself, from gaining trust within the project to deploying the backdoor, dissecting the operating methods and the main protagonists. We will also dive into the technical details, explaining how the backdoor is deployed and how it can be exploited.\n\nThe XZ backdoor is not just an incredible undercover operation but also a gigantic puzzle to solve. Beyond the technical background, there is a story to tell here, to capitalize on what went wrong and what we could improve.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2501, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 2.45s - 7.45s | This text was transcribed using whisper model: large-v2 Well, thank you for waiting. It was quite intense from the, the stage. Alright. So, thank you 11.35s - 17.69s | very much for attending this talk. Uh, I hope you will find it uh, enjoyable. It's uh, it's a 17.69s - 22.69s | cool story to tell and there is a lot to cover so, buckle up. So over the past uh, few years, 29.92s - 34.92s | the security industry have, you know, investigated a lot of different security incidents. 37.66s - 43.60s | But only a few of them were truly sophisticated. Meaning, something that was really 43.60s - 52.17s | different than what we used to be. We can talk about, for example, the SolarWinds case, the 52.17s - 57.17s | Lopetia attack or even the 3CX uh, supply chain attack


chunk_id: 171_chunk_1
chunk_text:
it can be exploited.\n\nThe XZ backdoor is not just an incredible undercover operation but also a gigantic puzzle to solve. Beyond the technical background, there is a story to tell here, to capitalize on what went wrong and what we could improve.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2501, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 2.45s - 7.45s | This text was transcribed using whisper model: large-v2 Well, thank you for waiting. It was quite intense from the, the stage. Alright. So, thank you 11.35s - 17.69s | very much for attending this talk. Uh, I hope you will find it uh, enjoyable. It's uh, it's a 17.69s - 22.69s | cool story to tell and there is a lot to cover so, buckle up. So over the past uh, few years, 29.92s - 34.92s | the security industry have, you know, investigated a lot of different security incidents. 37.66s - 43.60s | But only a few of them were truly sophisticated. Meaning, something that was really 43.60s - 52.17s | different than what we used to be. We can talk about, for example, the SolarWinds case, the 52.17s - 57.17s | Lopetia attack or even the 3CX uh, supply chain attack last year. But today I want to talk 59.61s - 64.61s | about um, another attack which surpasses even the most sophisticated we've seen before. This 64.89s - 69.89s | is uh, an undercover operation that lasted almost three years, which is very impressive in 74.77s - 81.05s | terms of technical details, but also the social engineering aspect is very impressive as 81.05s - 86.05s | well. So I'm going to talk about the XE backdoor story, the undercover operation that set 87.99s - 93.09s | the internet on fire. And I'm pretty sure that by the end of this presentation, your 93.11s - 98.11s | definition of what is a sophisticated uh, sophisticated attacker is, will be changed. So I'm 101.05s - 106.71s | Thomas Rocha, I'm a senior threat researcher at Microsoft. I've been working on the XE 106.71s - 113.15s | campaign when it came out by uh, uh, Andres Freund, which is uh, a colleague of mine and we, 113.15s - 118.19s | we, we discovered the, the backdoor itself. I'm French, as you probably may have heard, and 118.19s - 122.23s | I'm living in Australia so I'm, I'm good with the jet lag


chunk_id: 171_chunk_2
chunk_text:
last year. But today I want to talk 59.61s - 64.61s | about um, another attack which surpasses even the most sophisticated we've seen before. This 64.89s - 69.89s | is uh, an undercover operation that lasted almost three years, which is very impressive in 74.77s - 81.05s | terms of technical details, but also the social engineering aspect is very impressive as 81.05s - 86.05s | well. So I'm going to talk about the XE backdoor story, the undercover operation that set 87.99s - 93.09s | the internet on fire. And I'm pretty sure that by the end of this presentation, your 93.11s - 98.11s | definition of what is a sophisticated uh, sophisticated attacker is, will be changed. So I'm 101.05s - 106.71s | Thomas Rocha, I'm a senior threat researcher at Microsoft. I've been working on the XE 106.71s - 113.15s | campaign when it came out by uh, uh, Andres Freund, which is uh, a colleague of mine and we, 113.15s - 118.19s | we, we discovered the, the backdoor itself. I'm French, as you probably may have heard, and 118.19s - 122.23s | I'm living in Australia so I'm, I'm good with the jet lag now because it's been a week in 122.23s - 127.25s | uh, in Vegas already. Uh, if you want to learn more about my work, you can visit my website 127.25s - 133.96s | securitybreak.io or you can, you can also follow me on Twitter. What I will cover in this 133.96s - 139.56s | presentation, first, how the backdoor was found. Then I will talk about the long term 139.56s - 145.50s | operation and the timeline itself. I will then deep dive into the technical details and we 145.50s - 150.68s | will discuss about some assumptions. And finally, I want to conclude this presentation of 150.72s - 159.14s | what it means for us, for the security industry. Okay, this story began on Friday 29th of 159.14s - 164.14s | March at exactly 851 minutes and it was uh, a message sent by Andres Freund to the OSS 170.22s - 175.22s | security DL list. With the, the subject, backdoor in upstream exit libel ZMA leading to 176.22s - 181.22s | SSH server compromise. So that's pretty much around that time when I saw the, the email and 186.36s - 191.56s | read the investigation that I


chunk_id: 171_chunk_3
chunk_text:
now because it's been a week in 122.23s - 127.25s | uh, in Vegas already. Uh, if you want to learn more about my work, you can visit my website 127.25s - 133.96s | securitybreak.io or you can, you can also follow me on Twitter. What I will cover in this 133.96s - 139.56s | presentation, first, how the backdoor was found. Then I will talk about the long term 139.56s - 145.50s | operation and the timeline itself. I will then deep dive into the technical details and we 145.50s - 150.68s | will discuss about some assumptions. And finally, I want to conclude this presentation of 150.72s - 159.14s | what it means for us, for the security industry. Okay, this story began on Friday 29th of 159.14s - 164.14s | March at exactly 851 minutes and it was uh, a message sent by Andres Freund to the OSS 170.22s - 175.22s | security DL list. With the, the subject, backdoor in upstream exit libel ZMA leading to 176.22s - 181.22s | SSH server compromise. So that's pretty much around that time when I saw the, the email and 186.36s - 191.56s | read the investigation that I started to investigate more about the backdoor itself and how it 191.56s - 196.58s | was working. But before, I want to talk a little bit about Andres and how he found the, the 198.58s - 203.54s | backdoor. Because on the internet, there was a kind of a legend where everyone was saying 203.54s - 208.54s | that the backdoor was discovered because of a 500 millisecond and uh, for, from Andres that 211.14s - 218.14s | triggered the investigation. The reality is a bit different. Actually, what triggered the 218.14s - 224.46s | investigation from Andres was that he found that the SSH login in some of the tasted, the 224.46s - 231.06s | testing he was doing was actually failing. So he decided to investigate a little bit more to 231.08s - 237.36s | try to understand why the SSH was uh, the SSH logins were actually failing. And he 237.36s - 242.36s | discovered that there was a substantial CPU usage during the SSH and he found out the 500 245.20s - 254.57s | millisecond delay which he identified, identified later in the new package uh, exit. And he 254.57s - 260.77s | said that, he


chunk_id: 171_chunk_4
chunk_text:
started to investigate more about the backdoor itself and how it 191.56s - 196.58s | was working. But before, I want to talk a little bit about Andres and how he found the, the 198.58s - 203.54s | backdoor. Because on the internet, there was a kind of a legend where everyone was saying 203.54s - 208.54s | that the backdoor was discovered because of a 500 millisecond and uh, for, from Andres that 211.14s - 218.14s | triggered the investigation. The reality is a bit different. Actually, what triggered the 218.14s - 224.46s | investigation from Andres was that he found that the SSH login in some of the tasted, the 224.46s - 231.06s | testing he was doing was actually failing. So he decided to investigate a little bit more to 231.08s - 237.36s | try to understand why the SSH was uh, the SSH logins were actually failing. And he 237.36s - 242.36s | discovered that there was a substantial CPU usage during the SSH and he found out the 500 245.20s - 254.57s | millisecond delay which he identified, identified later in the new package uh, exit. And he 254.57s - 260.77s | said that, he said itself, it was a bunch of coincidences. So if we, if we have a look to how 260.79s - 267.53s | he discovered the backdoor. First, he saw that there was some issue with the SSH uh, login. 267.53s - 274.13s | Then he decided to investigate and then he found uh, a little bit of uh, amount of CPU uh, 274.13s - 280.35s | using by the SSH deep process. So he decided to investigate a little more and he, and he 280.35s - 285.35s | found out that this amount of CPU usage was used by the Libel ZMA. But then that's now which 286.13s - 291.13s | is becoming a little bit crazy because he actually used some specific setup which led him to 297.01s - 303.61s | find the backdoor. First, he decided to choose a Debian unstable which at the time of the 303.61s - 308.65s | release of the, the backdoor uh, only this kind of Linux version was affected by the 308.65s - 314.79s | backdoor. Then he chose to use a specific flag. And without this flag, this flag, he 314.79s - 319.79s | wouldn't have found uh, the, the backdoor


chunk_id: 171_chunk_5
chunk_text:
said itself, it was a bunch of coincidences. So if we, if we have a look to how 260.79s - 267.53s | he discovered the backdoor. First, he saw that there was some issue with the SSH uh, login. 267.53s - 274.13s | Then he decided to investigate and then he found uh, a little bit of uh, amount of CPU uh, 274.13s - 280.35s | using by the SSH deep process. So he decided to investigate a little more and he, and he 280.35s - 285.35s | found out that this amount of CPU usage was used by the Libel ZMA. But then that's now which 286.13s - 291.13s | is becoming a little bit crazy because he actually used some specific setup which led him to 297.01s - 303.61s | find the backdoor. First, he decided to choose a Debian unstable which at the time of the 303.61s - 308.65s | release of the, the backdoor uh, only this kind of Linux version was affected by the 308.65s - 314.79s | backdoor. Then he chose to use a specific flag. And without this flag, this flag, he 314.79s - 319.79s | wouldn't have found uh, the, the backdoor because he was actually tracing the process using 319.79s - 326.21s | Valgrind and Valgrind complaining, complained about uh, the, the processes because of the 326.21s - 332.47s | flag he was setting up before. So that's super crazy because thanks to that, he was able to 332.47s - 337.49s | investigate and to find out the high CPU usage was in the SSH deep processes below get CPU 337.85s - 344.99s | ID. Keep that information in mind because it will be interesting and important for the next 344.99s - 357.28s | part of the presentation. But you may wondering what the fuck is uh, exe, exe-utils 357.28s - 362.28s | package. So the exe, the exe-utils package is a free software, an open source software which 364.66s - 371.42s | is dedicated for lossless data compression through SDMA algorithm and exe. It, it is 371.44s - 377.12s | maintained by Lasikolin which is the main maintainer of the backdoor of the, sorry, of the, of 377.12s - 384.00s | the package since more than a, than a decade. The backdoor has been found in Libel ZMA in the 384.00s - 389.00s | version of exe-560 and 561. And


chunk_id: 171_chunk_6
chunk_text:
because he was actually tracing the process using 319.79s - 326.21s | Valgrind and Valgrind complaining, complained about uh, the, the processes because of the 326.21s - 332.47s | flag he was setting up before. So that's super crazy because thanks to that, he was able to 332.47s - 337.49s | investigate and to find out the high CPU usage was in the SSH deep processes below get CPU 337.85s - 344.99s | ID. Keep that information in mind because it will be interesting and important for the next 344.99s - 357.28s | part of the presentation. But you may wondering what the fuck is uh, exe, exe-utils 357.28s - 362.28s | package. So the exe, the exe-utils package is a free software, an open source software which 364.66s - 371.42s | is dedicated for lossless data compression through SDMA algorithm and exe. It, it is 371.44s - 377.12s | maintained by Lasikolin which is the main maintainer of the backdoor of the, sorry, of the, of 377.12s - 384.00s | the package since more than a, than a decade. The backdoor has been found in Libel ZMA in the 384.00s - 389.00s | version of exe-560 and 561. And it was introduced by a mysterious user called Jiatan in 392.64s - 397.64s | February 2024. The, the package and the backdoor affected mostly uh, development version so 398.50s - 403.50s | it was not widely deployed when Andres found the backdoor itself. And Red Hat assigned the 406.04s - 411.04s | vulnerability CVE 2024-30-94. There is something interesting here because you may 413.98s - 418.98s | wondering as well why the exe-utils package has in, uh, has in any relation with uh, SSH. 419.98s - 424.98s | Well I'm glad you ask. Actually the exe-utils uh, backdoor uh, package is widely used in 431.68s - 437.38s | many Linux uh, distribution and it's a trusted open source component for pro- for 437.38s - 442.40s | compression uh, and any kind of uh, optimization. The exe-utils has been used in the open 442.76s - 447.76s | source industry for years and which is interesting is that open SSH is using the exe 451.60s - 456.60s | compression to reduce the size of transfer data when you are doing a connection. So quite 459.40s - 466.46s | interesting target for an attacker. Okay I want now to talk about the timeline.


chunk_id: 171_chunk_7
chunk_text:
it was introduced by a mysterious user called Jiatan in 392.64s - 397.64s | February 2024. The, the package and the backdoor affected mostly uh, development version so 398.50s - 403.50s | it was not widely deployed when Andres found the backdoor itself. And Red Hat assigned the 406.04s - 411.04s | vulnerability CVE 2024-30-94. There is something interesting here because you may 413.98s - 418.98s | wondering as well why the exe-utils package has in, uh, has in any relation with uh, SSH. 419.98s - 424.98s | Well I'm glad you ask. Actually the exe-utils uh, backdoor uh, package is widely used in 431.68s - 437.38s | many Linux uh, distribution and it's a trusted open source component for pro- for 437.38s - 442.40s | compression uh, and any kind of uh, optimization. The exe-utils has been used in the open 442.76s - 447.76s | source industry for years and which is interesting is that open SSH is using the exe 451.60s - 456.60s | compression to reduce the size of transfer data when you are doing a connection. So quite 459.40s - 466.46s | interesting target for an attacker. Okay I want now to talk about the timeline. And it's a 466.46s - 471.46s | bit uh, heavy so what I did I actually split the timeline into five different phases. The 472.08s - 477.08s | first phase, the first phase which I called initial involvement of Gi-Tan from October 29, 481.96s - 486.96s | 2021 to June 29, 2022. So during this phase the user Gi-Tan started to get, started to 489.86s - 495.54s | gain trust into the exe uh, project and started to do some commit and to work a little bit 495.54s - 500.54s | more. Which is interesting is um, during that phase as well, there was, there was a 502.18s - 508.92s | additional persona that was part of a kind of a pressure campaign against Lassie Collin, the 508.92s - 513.92s | main maintainer of the exe package. To move the member, the um, the maintainership to another 517.20s - 522.20s | user. So some additional personnel, persona such as Giga Kumar and Dennis Hance have been 524.54s - 531.04s | part of this pressure campaign to put the pressure on Lassie Collin. And in June 29 of 531.06s - 536.06s | 2022, Lassie Collin started to mention Gi-Tan as a


chunk_id: 171_chunk_8
chunk_text:
And it's a 466.46s - 471.46s | bit uh, heavy so what I did I actually split the timeline into five different phases. The 472.08s - 477.08s | first phase, the first phase which I called initial involvement of Gi-Tan from October 29, 481.96s - 486.96s | 2021 to June 29, 2022. So during this phase the user Gi-Tan started to get, started to 489.86s - 495.54s | gain trust into the exe uh, project and started to do some commit and to work a little bit 495.54s - 500.54s | more. Which is interesting is um, during that phase as well, there was, there was a 502.18s - 508.92s | additional persona that was part of a kind of a pressure campaign against Lassie Collin, the 508.92s - 513.92s | main maintainer of the exe package. To move the member, the um, the maintainership to another 517.20s - 522.20s | user. So some additional personnel, persona such as Giga Kumar and Dennis Hance have been 524.54s - 531.04s | part of this pressure campaign to put the pressure on Lassie Collin. And in June 29 of 531.06s - 536.06s | 2022, Lassie Collin started to mention Gi-Tan as a co-maintainer already. Then in phase 2, 539.00s - 544.00s | which I call transition of mentorship from September 27 of 2022 to March 18 uh, 2023. 547.98s - 552.98s | During this time Gi-Tan continued to contribute to the project to gain trust with uh, with 554.98s - 559.98s | the, the main maintainer and to the project itself. On October 2022, Lassie Collin 561.72s - 567.86s | was added to the Tukeni organization on GitHub, which is the organization uh, that released 567.86s - 572.86s | the exe package. And an additional event as well during this time. Then during phase 3, which 575.14s - 580.14s | I call preparation for the attack from March 2023 to January 19, 2024. During this time, a 583.64s - 588.64s | bunch of information happened as well. First Gi-Tan uh, updates the Google OSS first to send 589.28s - 594.28s | bugs to his own email. Then another persona, Hans Jensen, sends patches for GNU indirect uh, 598.92s - 603.92s | function features, which is quite important as well. And uh, and Gi-Tan also disables uh, 606.96s - 612.30s | iPhone support during the OSS first build, which is quite important because


chunk_id: 171_chunk_9
chunk_text:
co-maintainer already. Then in phase 2, 539.00s - 544.00s | which I call transition of mentorship from September 27 of 2022 to March 18 uh, 2023. 547.98s - 552.98s | During this time Gi-Tan continued to contribute to the project to gain trust with uh, with 554.98s - 559.98s | the, the main maintainer and to the project itself. On October 2022, Lassie Collin 561.72s - 567.86s | was added to the Tukeni organization on GitHub, which is the organization uh, that released 567.86s - 572.86s | the exe package. And an additional event as well during this time. Then during phase 3, which 575.14s - 580.14s | I call preparation for the attack from March 2023 to January 19, 2024. During this time, a 583.64s - 588.64s | bunch of information happened as well. First Gi-Tan uh, updates the Google OSS first to send 589.28s - 594.28s | bugs to his own email. Then another persona, Hans Jensen, sends patches for GNU indirect uh, 598.92s - 603.92s | function features, which is quite important as well. And uh, and Gi-Tan also disables uh, 606.96s - 612.30s | iPhone support during the OSS first build, which is quite important because it's a kind of uh, 612.30s - 617.30s | evading some, some security protections. And then during phase 4, which I call backdoor 618.68s - 623.68s | insertion and distribution from February 23 uh, to March 28 of 2024, this is where Gi-Tan 627.48s - 633.66s | started to release the backdoor. So in February 24, Gi-Tan merged hidden backdoor binary 633.66s - 638.66s | code in kind of test files, which are actually fake text test files. And then he released the 641.66s - 646.64s | version 5.6.0 with an additional file that was not present in the GitHub repository itself. 649.20s - 654.20s | And in March 9, uh, Gi-Tan committed uh, an update of the backdoor because there was a bug and 657.48s - 663.18s | then he released the version 5.6.1, which was backdoored as well. And then on the last phase, 663.18s - 668.18s | phase uh, phase number 5, which I call discovery and response from March 28 to March 30, this 670.82s - 676.56s | is where Andres found the backdoor, started to alert and to send the email with his own 676.58s - 684.12s | investigation. And this is where internet was


chunk_id: 171_chunk_10
chunk_text:
it's a kind of uh, 612.30s - 617.30s | evading some, some security protections. And then during phase 4, which I call backdoor 618.68s - 623.68s | insertion and distribution from February 23 uh, to March 28 of 2024, this is where Gi-Tan 627.48s - 633.66s | started to release the backdoor. So in February 24, Gi-Tan merged hidden backdoor binary 633.66s - 638.66s | code in kind of test files, which are actually fake text test files. And then he released the 641.66s - 646.64s | version 5.6.0 with an additional file that was not present in the GitHub repository itself. 649.20s - 654.20s | And in March 9, uh, Gi-Tan committed uh, an update of the backdoor because there was a bug and 657.48s - 663.18s | then he released the version 5.6.1, which was backdoored as well. And then on the last phase, 663.18s - 668.18s | phase uh, phase number 5, which I call discovery and response from March 28 to March 30, this 670.82s - 676.56s | is where Andres found the backdoor, started to alert and to send the email with his own 676.58s - 684.12s | investigation. And this is where internet was on fire as well. But there is something which is 684.12s - 688.12s | interesting, I talk about the pressure campaign. So let me give you a little bit more detail 688.12s - 695.14s | about that. Cause this is quite interesting from the social engineering aspect. So first I 695.14s - 700.24s | mentioned that some additional personas were part of this pressure campaign to move the 700.24s - 705.24s | mentorship of the, of the backdoor to someone else. So in March, uh, in April 2022, 708.68s - 713.68s | Jigar Kumar sent a message. Patches spend years. In May 2022, Dennis Hance, the, the other 716.22s - 721.62s | persona, sent another message as well and said, I asked a question here a week ago and I have 721.62s - 727.34s | not heard back. It has not updated in over a year. Is there a plan for this thing in the future? 727.34s - 732.54s | Lassie Colleen, which at the time was getting all these messages from these personas and 732.62s - 737.62s | so on. Jihatan has helped me with exe-utils and he might have a bigger role in the future. It's 741.34s -


chunk_id: 171_chunk_11
chunk_text:
on fire as well. But there is something which is 684.12s - 688.12s | interesting, I talk about the pressure campaign. So let me give you a little bit more detail 688.12s - 695.14s | about that. Cause this is quite interesting from the social engineering aspect. So first I 695.14s - 700.24s | mentioned that some additional personas were part of this pressure campaign to move the 700.24s - 705.24s | mentorship of the, of the backdoor to someone else. So in March, uh, in April 2022, 708.68s - 713.68s | Jigar Kumar sent a message. Patches spend years. In May 2022, Dennis Hance, the, the other 716.22s - 721.62s | persona, sent another message as well and said, I asked a question here a week ago and I have 721.62s - 727.34s | not heard back. It has not updated in over a year. Is there a plan for this thing in the future? 727.34s - 732.54s | Lassie Colleen, which at the time was getting all these messages from these personas and 732.62s - 737.62s | so on. Jihatan has helped me with exe-utils and he might have a bigger role in the future. It's 741.34s - 748.22s | clear that my resources are too limited. In May 2022, Jigar Kumar answered. Over a month and 750.42s - 756.26s | no closer to being merged. Not a surprise. Jigar Kumar sent another message. Progress will not 756.26s - 761.50s | happen until there is a new maintainer. The current maintainer lost interest or doesn't care 761.52s - 766.52s | to maintain anymore. Quite aggressive. Then on June 2022, Lassie Colleen answered. My 769.16s - 774.16s | ability to care has been fairly limited, mostly due to long term mental health, but also due to 774.16s - 779.16s | some other things. Jihatan may have a bigger role in the future. And he mentioned also, and I 781.54s - 786.88s | think this is quite important in this case, he mentioned, it's also good to keep in mind that 786.90s - 793.15s | this is a non-paid OB project. In June 2022, Jigar Kumar sent another message. Right now you 795.35s - 802.35s | shock your repo. Why wait until 540 to change maintainer? Why delay what your repo needs? 802.35s - 807.73s | Dennis Ant sends a message. Why not pass on mentorship for exe for C


chunk_id: 171_chunk_12
chunk_text:
748.22s | clear that my resources are too limited. In May 2022, Jigar Kumar answered. Over a month and 750.42s - 756.26s | no closer to being merged. Not a surprise. Jigar Kumar sent another message. Progress will not 756.26s - 761.50s | happen until there is a new maintainer. The current maintainer lost interest or doesn't care 761.52s - 766.52s | to maintain anymore. Quite aggressive. Then on June 2022, Lassie Colleen answered. My 769.16s - 774.16s | ability to care has been fairly limited, mostly due to long term mental health, but also due to 774.16s - 779.16s | some other things. Jihatan may have a bigger role in the future. And he mentioned also, and I 781.54s - 786.88s | think this is quite important in this case, he mentioned, it's also good to keep in mind that 786.90s - 793.15s | this is a non-paid OB project. In June 2022, Jigar Kumar sent another message. Right now you 795.35s - 802.35s | shock your repo. Why wait until 540 to change maintainer? Why delay what your repo needs? 802.35s - 807.73s | Dennis Ant sends a message. Why not pass on mentorship for exe for C so you can give exe for 807.73s - 814.63s | Java more attention? And then Jigar Kumar sent another message. Jia, this is the first time he 814.63s - 820.21s | actually talked to Jia. Jia, I see you have recent commits. Why can't you commit this 820.21s - 825.21s | yourself? And then Lassie Colleen replied on June 2022, on the day 29. Jihatan may have a 828.61s - 833.61s | bigger role. He is practically a co-maintainer already. Some change in mentorship is already 836.29s - 841.29s | in progress. Mission accomplished. Jihatan is no part of the project and he has more rights 844.69s - 849.73s | to contribute. Alright, so now I want to talk about the technical details and how the back 849.73s - 855.81s | door was deploying and how the back door works as well. So remember, I mentioned that the 855.81s - 862.15s | user Jihatan deployed two different test files. The first one was bad3corrupt underscore 862.15s - 867.15s | lzma2 dot exe and the second one was goodlarge underscore compressed dot lzma. And 867.85s - 872.85s | additionally, when he released the latest version, version 5.6.0 of the exe package,


chunk_id: 171_chunk_13
chunk_text:
so you can give exe for 807.73s - 814.63s | Java more attention? And then Jigar Kumar sent another message. Jia, this is the first time he 814.63s - 820.21s | actually talked to Jia. Jia, I see you have recent commits. Why can't you commit this 820.21s - 825.21s | yourself? And then Lassie Colleen replied on June 2022, on the day 29. Jihatan may have a 828.61s - 833.61s | bigger role. He is practically a co-maintainer already. Some change in mentorship is already 836.29s - 841.29s | in progress. Mission accomplished. Jihatan is no part of the project and he has more rights 844.69s - 849.73s | to contribute. Alright, so now I want to talk about the technical details and how the back 849.73s - 855.81s | door was deploying and how the back door works as well. So remember, I mentioned that the 855.81s - 862.15s | user Jihatan deployed two different test files. The first one was bad3corrupt underscore 862.15s - 867.15s | lzma2 dot exe and the second one was goodlarge underscore compressed dot lzma. And 867.85s - 872.85s | additionally, when he released the latest version, version 5.6.0 of the exe package, he 878.93s - 884.79s | shipped the version with an additional file called build2host dot m4. If you are not 884.79s - 890.53s | familiar with m4 files, it's a kind of macro file used for configuration during the 890.53s - 898.85s | compilation process. And this file was present in the release but not in the repository. So 898.87s - 905.79s | let me talk a little bit more about the build2host dot m4 file. And I will focus here on the 905.79s - 910.79s | version 5.6.0. So what you see on the screen is just the malicious part of this file just to 913.83s - 918.63s | focus on what it is exactly doing but imagine that this file is super big with a lot of 918.63s - 923.63s | different configuration and a lot of legitimate actions. So the ones that you saw, you see on 923.89s - 928.89s | the screens are only the malicious part. So first, you can see there is a variable called 931.93s - 936.93s | glam config make with a grep which actually look for one of the malicious test file that have 940.41s - 945.41s | been released and


chunk_id: 171_chunk_14
chunk_text:
he 878.93s - 884.79s | shipped the version with an additional file called build2host dot m4. If you are not 884.79s - 890.53s | familiar with m4 files, it's a kind of macro file used for configuration during the 890.53s - 898.85s | compilation process. And this file was present in the release but not in the repository. So 898.87s - 905.79s | let me talk a little bit more about the build2host dot m4 file. And I will focus here on the 905.79s - 910.79s | version 5.6.0. So what you see on the screen is just the malicious part of this file just to 913.83s - 918.63s | focus on what it is exactly doing but imagine that this file is super big with a lot of 918.63s - 923.63s | different configuration and a lot of legitimate actions. So the ones that you saw, you see on 923.89s - 928.89s | the screens are only the malicious part. So first, you can see there is a variable called 931.93s - 936.93s | glam config make with a grep which actually look for one of the malicious test file that have 940.41s - 945.41s | been released and specifically the bad3corrupt underscore lzma2 dot exe. Then we have in 946.33s - 951.33s | number two, two additional variable. The first one which is the TR tool translate which is 956.61s - 961.61s | basically doing a kind of a substitution algorithm for part of the backdoor of the file 964.31s - 969.31s | itself, the bad3. And the second one is actually showing the test file and making a set to 969.59s - 974.59s | retrieve the extension of this file exe which will later be used as a common line. And as you 981.53s - 986.53s | can see, the translation of this piece of screen is the cat at the end of the presentation. 988.53s - 993.53s | So basically transforming the file itself and decompressing using exe, the file which have 993.97s - 998.97s | been the obfuscated, the obfuscated kind of using TR. So here you have a look of what was 1008.46s - 1013.46s | the original bad3corrupt lzma2 file before the decryption, the, the, the, the substitution 1015.56s - 1020.56s | and the, the decompression using exe and you have the malicious script on your right. So if 1020.92s - 1026.92s |


chunk_id: 171_chunk_15
chunk_text:
specifically the bad3corrupt underscore lzma2 dot exe. Then we have in 946.33s - 951.33s | number two, two additional variable. The first one which is the TR tool translate which is 956.61s - 961.61s | basically doing a kind of a substitution algorithm for part of the backdoor of the file 964.31s - 969.31s | itself, the bad3. And the second one is actually showing the test file and making a set to 969.59s - 974.59s | retrieve the extension of this file exe which will later be used as a common line. And as you 981.53s - 986.53s | can see, the translation of this piece of screen is the cat at the end of the presentation. 988.53s - 993.53s | So basically transforming the file itself and decompressing using exe, the file which have 993.97s - 998.97s | been the obfuscated, the obfuscated kind of using TR. So here you have a look of what was 1008.46s - 1013.46s | the original bad3corrupt lzma2 file before the decryption, the, the, the, the substitution 1015.56s - 1020.56s | and the, the decompression using exe and you have the malicious script on your right. So if 1020.92s - 1026.92s | you have a look to this malicious script, there is some interesting information here. So 1026.92s - 1031.94s | first I highlighted a comment which is actually an hexadecimal string. So today we still 1035.40s - 1041.38s | don't know what is exactly this strings but I believe because in version five six one, this 1041.38s - 1046.88s | hexadecimal string was not the same. So I believe this strings was potentially related to a 1046.90s - 1053.28s | kind of a versioning number. Then we have a bunch of uh head command which are used to 1053.28s - 1058.68s | manipulate input data stream. And at the end we have the stash3 and backdoor extraction 1058.68s - 1063.68s | because in the bad3corrupt um uh in the, in the bad3corrupt lzma and the second file, the 1065.76s - 1071.66s | good large compressed lzma, there is the next part of the, of the, the release of the 1071.66s - 1076.86s | backdoor and also the decompression of an object. I will come to it later. I just 1076.86s - 1082.68s | give me, let, let me give you a look, a deeper look of what the file, what the


chunk_id: 171_chunk_16
chunk_text:
you have a look to this malicious script, there is some interesting information here. So 1026.92s - 1031.94s | first I highlighted a comment which is actually an hexadecimal string. So today we still 1035.40s - 1041.38s | don't know what is exactly this strings but I believe because in version five six one, this 1041.38s - 1046.88s | hexadecimal string was not the same. So I believe this strings was potentially related to a 1046.90s - 1053.28s | kind of a versioning number. Then we have a bunch of uh head command which are used to 1053.28s - 1058.68s | manipulate input data stream. And at the end we have the stash3 and backdoor extraction 1058.68s - 1063.68s | because in the bad3corrupt um uh in the, in the bad3corrupt lzma and the second file, the 1065.76s - 1071.66s | good large compressed lzma, there is the next part of the, of the, the release of the 1071.66s - 1076.86s | backdoor and also the decompression of an object. I will come to it later. I just 1076.86s - 1082.68s | give me, let, let me give you a look, a deeper look of what the file, what the script is 1082.68s - 1089.06s | doing to release the next part. So first is decompress the second malicious file, remember 1089.06s - 1095.74s | the second test file, good large underscore compressed dot lzma that cons, contains the 1095.74s - 1100.74s | stash3 and the binary backdoor. It remove a ju, a bunch of junk data and unius byte 1101.12s - 1108.06s | because the file is a bit obfuscated. There is again a custom substitution cipher using 1108.06s - 1113.06s | tr and then all the, the deciphering data uh decompressed again using exe. Which lead to 1116.64s - 1121.64s | the stash3 which is another script which is doing a bunch of checking during the compilation 1122.64s - 1127.64s | process. So let me walk through some of the checking this stash3 is doing. First, it's 1131.02s - 1135.72s | checked for the iPhone support, remember previous commit we discussed about it, keep that in 1135.72s - 1140.72s | mind for the, for the next part. Then you verify crc source file, crc64 underscore fastc 1143.00s - 1149.24s | and crc32 underscore fastc for require iPhone code because the backdoor require this 1149.24s - 1155.68s | feature.


chunk_id: 171_chunk_17
chunk_text:
script is 1082.68s - 1089.06s | doing to release the next part. So first is decompress the second malicious file, remember 1089.06s - 1095.74s | the second test file, good large underscore compressed dot lzma that cons, contains the 1095.74s - 1100.74s | stash3 and the binary backdoor. It remove a ju, a bunch of junk data and unius byte 1101.12s - 1108.06s | because the file is a bit obfuscated. There is again a custom substitution cipher using 1108.06s - 1113.06s | tr and then all the, the deciphering data uh decompressed again using exe. Which lead to 1116.64s - 1121.64s | the stash3 which is another script which is doing a bunch of checking during the compilation 1122.64s - 1127.64s | process. So let me walk through some of the checking this stash3 is doing. First, it's 1131.02s - 1135.72s | checked for the iPhone support, remember previous commit we discussed about it, keep that in 1135.72s - 1140.72s | mind for the, for the next part. Then you verify crc source file, crc64 underscore fastc 1143.00s - 1149.24s | and crc32 underscore fastc for require iPhone code because the backdoor require this 1149.24s - 1155.68s | feature. There is a bunch of multiple checks, it verify the version of the Linux system, uh 1155.68s - 1160.28s | validate the gcc comp, compiler, check for the previous two test file because if the two 1160.28s - 1165.06s | test file are not present there is no need to continue to deploy the backdoor, so it's a kind 1165.06s - 1170.06s | of protection. It ensures position independent code and also it extract the backdoor from 1170.86s - 1175.86s | the, the test file goodlarge compressed dot lzma and this backdoor ex uh extracted from this 1182.01s - 1187.01s | file will be embedded into the, the object file liblzma la dash crc64 dash fast dot o. Then 1192.79s - 1197.79s | there is a modification of a function isarch extension supported in crc xx86clmul dot h 1198.75s - 1203.75s | and it replaces getcpuid with two underscore with getcpuid with one underscore. Remember 1212.52s - 1217.52s | getcpuid was where address trust the execution of the backdoor and the amount of CPU usage. 1228.54s - 1231.78s | So I want to talk little bit about the backdoor extraction itself because it's quite 1231.80s - 1236.80s | interesting how


chunk_id: 171_chunk_18
chunk_text:
There is a bunch of multiple checks, it verify the version of the Linux system, uh 1155.68s - 1160.28s | validate the gcc comp, compiler, check for the previous two test file because if the two 1160.28s - 1165.06s | test file are not present there is no need to continue to deploy the backdoor, so it's a kind 1165.06s - 1170.06s | of protection. It ensures position independent code and also it extract the backdoor from 1170.86s - 1175.86s | the, the test file goodlarge compressed dot lzma and this backdoor ex uh extracted from this 1182.01s - 1187.01s | file will be embedded into the, the object file liblzma la dash crc64 dash fast dot o. Then 1192.79s - 1197.79s | there is a modification of a function isarch extension supported in crc xx86clmul dot h 1198.75s - 1203.75s | and it replaces getcpuid with two underscore with getcpuid with one underscore. Remember 1212.52s - 1217.52s | getcpuid was where address trust the execution of the backdoor and the amount of CPU usage. 1228.54s - 1231.78s | So I want to talk little bit about the backdoor extraction itself because it's quite 1231.80s - 1236.80s | interesting how the attacker did it as well. So in the code there is a, a piece which is using 1239.14s - 1244.14s | the AWK function um tools from Linux and this is actually doing like a kind of a RC4 like 1247.72s - 1252.72s | algorithm to decrypt the payload itself that will be later store into the liblzma la crc64. 1253.44s - 1258.44s | So quite interesting to see that as well. So to recapitulate a little bit the compilation 1266.41s - 1272.05s | process because I know it could be quite uh quite complex. So first we have the execution of 1272.05s - 1278.29s | the macro file the build to host dot m4 which is executed and subsequent scripts are also 1278.29s - 1283.29s | executed. It run all the checks and it create the make file if previous conditions are met 1285.59s - 1289.83s | because there was a bunch of information. If all the conditions are not met then the 1289.83s - 1295.57s | backdoor is not released. Then during the make process there is a backup of the original 1295.57s - 1300.57s | file which has been backdoor and liblzma la crc64 fast dot


chunk_id: 171_chunk_19
chunk_text:
the attacker did it as well. So in the code there is a, a piece which is using 1239.14s - 1244.14s | the AWK function um tools from Linux and this is actually doing like a kind of a RC4 like 1247.72s - 1252.72s | algorithm to decrypt the payload itself that will be later store into the liblzma la crc64. 1253.44s - 1258.44s | So quite interesting to see that as well. So to recapitulate a little bit the compilation 1266.41s - 1272.05s | process because I know it could be quite uh quite complex. So first we have the execution of 1272.05s - 1278.29s | the macro file the build to host dot m4 which is executed and subsequent scripts are also 1278.29s - 1283.29s | executed. It run all the checks and it create the make file if previous conditions are met 1285.59s - 1289.83s | because there was a bunch of information. If all the conditions are not met then the 1289.83s - 1295.57s | backdoor is not released. Then during the make process there is a backup of the original 1295.57s - 1300.57s | file which has been backdoor and liblzma la crc64 fast dot o. There is a backup because 1303.15s - 1309.09s | if something, something goes wrong the backdoor itself I mean the the code itself can push 1309.09s - 1314.09s | back the original file and so there is no track into the final release of the exe utility. 1315.09s - 1321.59s | Package. There is also some specific compilation flag. I think I think resolvers run at 1321.59s - 1326.59s | startup. Modification of the file crc64 fast dot c and crc32 fast dot c and then finally 1330.51s - 1337.15s | compilation linking stage manipulation and clean up because the attacker did well they also 1337.15s - 1342.41s | have a bunch of clean cleaning up to avoid any forensic investigation or further further 1342.41s - 1347.43s | investigation. And then at this point we are here malicious liblzma is incorporated into the 1350.63s - 1358.15s | compiled liblzma. So now I want to talk a little bit more about the backdoor itself and some of 1358.15s - 1364.13s | the functionalities. So first it's using the iFunc feature which allows for dynamic 1364.13s - 1369.23s | resolution of function implementation during the run time meaning it can load


chunk_id: 171_chunk_20
chunk_text:
o. There is a backup because 1303.15s - 1309.09s | if something, something goes wrong the backdoor itself I mean the the code itself can push 1309.09s - 1314.09s | back the original file and so there is no track into the final release of the exe utility. 1315.09s - 1321.59s | Package. There is also some specific compilation flag. I think I think resolvers run at 1321.59s - 1326.59s | startup. Modification of the file crc64 fast dot c and crc32 fast dot c and then finally 1330.51s - 1337.15s | compilation linking stage manipulation and clean up because the attacker did well they also 1337.15s - 1342.41s | have a bunch of clean cleaning up to avoid any forensic investigation or further further 1342.41s - 1347.43s | investigation. And then at this point we are here malicious liblzma is incorporated into the 1350.63s - 1358.15s | compiled liblzma. So now I want to talk a little bit more about the backdoor itself and some of 1358.15s - 1364.13s | the functionalities. So first it's using the iFunc feature which allows for dynamic 1364.13s - 1369.23s | resolution of function implementation during the run time meaning it can load some specific 1369.23s - 1374.51s | features at the run time. And actually the backdoor hijacks the iFunc resolver to load the 1374.51s - 1380.85s | modification of the global offset table which which is a kind of a table with address to some 1380.85s - 1387.05s | specific functions. And here on the screen what you can see is actually the malicious get CPU 1387.05s - 1395.72s | ID that will trigger the backdoor and continue the execution to the global offset table hijack. 1395.72s - 1402.26s | Another interesting feature about the backdoor is the usage of dlaudit to set up the hook and to 1402.26s - 1407.64s | bypass railroad and to intercept also redirect function so function call. If you are not 1407.64s - 1412.64s | familiar with railroad it's a kind of a memory protection space to avoid uh to avoid to have 1412.64s - 1417.98s | some some space that could be vulnerable for some vulnerability exploitation. So what it is 1417.98s - 1422.98s | doing here, so first it's checking that the loaded target process is SSHD because remember it 1423.26s - 1428.26s | is our target here. And verify that the shell


chunk_id: 171_chunk_21
chunk_text:
some specific 1369.23s - 1374.51s | features at the run time. And actually the backdoor hijacks the iFunc resolver to load the 1374.51s - 1380.85s | modification of the global offset table which which is a kind of a table with address to some 1380.85s - 1387.05s | specific functions. And here on the screen what you can see is actually the malicious get CPU 1387.05s - 1395.72s | ID that will trigger the backdoor and continue the execution to the global offset table hijack. 1395.72s - 1402.26s | Another interesting feature about the backdoor is the usage of dlaudit to set up the hook and to 1402.26s - 1407.64s | bypass railroad and to intercept also redirect function so function call. If you are not 1407.64s - 1412.64s | familiar with railroad it's a kind of a memory protection space to avoid uh to avoid to have 1412.64s - 1417.98s | some some space that could be vulnerable for some vulnerability exploitation. So what it is 1417.98s - 1422.98s | doing here, so first it's checking that the loaded target process is SSHD because remember it 1423.26s - 1428.26s | is our target here. And verify that the shell library and specifically libel ZMA because 1432.12s - 1438.66s | this is the vulna the the this is where the backdoor is loaded is already present. Then it set up 1438.66s - 1443.66s | the dlaudit structure to start the audit mechanism. And during the dynamic linking so think 1445.80s - 1450.80s | about all these steps uh doing doing the the loading. It resolve and bind symbols and then 1453.98s - 1460.72s | the dlaudit bind function is called by the linker whenever a symbol needs binding. And if all 1460.72s - 1465.72s | the conditions are met then it set the backdoor to the install hook function to install the the 1467.96s - 1476.32s | hooking function that the payload will need later. There is also the global offset table uh 1476.32s - 1481.32s | redirect which I mentioned is a kind of a table with uh function address. And in that case at 1482.28s - 1487.28s | the runtime the backdoor will manipulate these pointers into the global offset table to 1490.62s - 1499.49s | redirect calls to the main malware function. And if you have a look to the investigation, if 1499.49s - 1506.63s | you


chunk_id: 171_chunk_22
chunk_text:
library and specifically libel ZMA because 1432.12s - 1438.66s | this is the vulna the the this is where the backdoor is loaded is already present. Then it set up 1438.66s - 1443.66s | the dlaudit structure to start the audit mechanism. And during the dynamic linking so think 1445.80s - 1450.80s | about all these steps uh doing doing the the loading. It resolve and bind symbols and then 1453.98s - 1460.72s | the dlaudit bind function is called by the linker whenever a symbol needs binding. And if all 1460.72s - 1465.72s | the conditions are met then it set the backdoor to the install hook function to install the the 1467.96s - 1476.32s | hooking function that the payload will need later. There is also the global offset table uh 1476.32s - 1481.32s | redirect which I mentioned is a kind of a table with uh function address. And in that case at 1482.28s - 1487.28s | the runtime the backdoor will manipulate these pointers into the global offset table to 1490.62s - 1499.49s | redirect calls to the main malware function. And if you have a look to the investigation, if 1499.49s - 1506.63s | you have a look to the to the running at this time, everything will look like it's been 1506.63s - 1515.25s | called through the CPU ID functions. On top of that there is additional evasion 1515.27s - 1522.27s | mechanisms and kind of obfuscation. First there is a strings obfuscation. In that case what 1522.27s - 1529.35s | the backdoor is doing is looking for a tree structure. A tree structure is basically uh a 1529.35s - 1534.99s | corresponding reference between a strings and a number. And what the backdoor is doing is 1534.99s - 1540.23s | looking for a specific number to retrieve the strings it needs for the execution of the 1540.25s - 1547.70s | payload. So if you it's kind of uh if you are familiar it's kind of API API hashing where you 1547.70s - 1552.70s | are retrieving the function call uh based on a specific hash. And in that case the sample the 1555.74s - 1560.74s | payload is is looking for some specific string and for example 0x1d0 is for RSA public 1563.62s - 1568.62s | decrypt which is one of the hooked function. Or for example for 0x300 for the ELF


chunk_id: 171_chunk_23
chunk_text:
have a look to the to the running at this time, everything will look like it's been 1506.63s - 1515.25s | called through the CPU ID functions. On top of that there is additional evasion 1515.27s - 1522.27s | mechanisms and kind of obfuscation. First there is a strings obfuscation. In that case what 1522.27s - 1529.35s | the backdoor is doing is looking for a tree structure. A tree structure is basically uh a 1529.35s - 1534.99s | corresponding reference between a strings and a number. And what the backdoor is doing is 1534.99s - 1540.23s | looking for a specific number to retrieve the strings it needs for the execution of the 1540.25s - 1547.70s | payload. So if you it's kind of uh if you are familiar it's kind of API API hashing where you 1547.70s - 1552.70s | are retrieving the function call uh based on a specific hash. And in that case the sample the 1555.74s - 1560.74s | payload is is looking for some specific string and for example 0x1d0 is for RSA public 1563.62s - 1568.62s | decrypt which is one of the hooked function. Or for example for 0x300 for the ELF header 1568.74s - 1573.74s | which is used for the deployment mechanism as well. And you have some of the strings that was 1577.58s - 1585.62s | extracted by the backdoor and needed for the rest of the execution. So as I said there is 1585.62s - 1590.62s | function hook that have been added by the by the by the payload itself. So first what it is, 1593.62s - 1598.50s | what it what it is doing, it's actually retrieving obfuscated string from the tree 1598.54s - 1605.12s | structure. And one of the string which is important here are the RSA public decrypt function 1605.12s - 1610.62s | which is a hook and the RSA gate zero key function which is also a hook. These two 1610.62s - 1615.62s | function are used in the latest SSH server version and are called when an RSA certificate is 1617.86s - 1623.10s | configured is using for the authentication. Remember that because this is important. And the 1623.10s - 1629.54s | last function which have been hook is the EVP PK set one RSA which it's a little bit well 1629.54s - 1634.64s | because it's not used in the


chunk_id: 171_chunk_24
chunk_text:
header 1568.74s - 1573.74s | which is used for the deployment mechanism as well. And you have some of the strings that was 1577.58s - 1585.62s | extracted by the backdoor and needed for the rest of the execution. So as I said there is 1585.62s - 1590.62s | function hook that have been added by the by the by the payload itself. So first what it is, 1593.62s - 1598.50s | what it what it is doing, it's actually retrieving obfuscated string from the tree 1598.54s - 1605.12s | structure. And one of the string which is important here are the RSA public decrypt function 1605.12s - 1610.62s | which is a hook and the RSA gate zero key function which is also a hook. These two 1610.62s - 1615.62s | function are used in the latest SSH server version and are called when an RSA certificate is 1617.86s - 1623.10s | configured is using for the authentication. Remember that because this is important. And the 1623.10s - 1629.54s | last function which have been hook is the EVP PK set one RSA which it's a little bit well 1629.54s - 1634.64s | because it's not used in the latest SSH version but probably that it has been set up for 1634.64s - 1642.90s | compatibility or probably for a specific environment. There is a bunch of other checks and 1642.90s - 1649.12s | evasion used by the sample uh by the payload. Here there is an overview so first as we saw 1649.12s - 1654.46s | it is checks that the current process is well SSHG because there is no need to deploy the 1654.46s - 1659.46s | backdoor if we if we are not running uh if SSHG is not running. It check for a potential kill 1661.40s - 1667.50s | switch. So this one is not very clear. This is a string that was present into the malware 1667.50s - 1672.10s | itself, the payload. But it's not very clear what's the goal, what was the goal of this 1672.10s - 1676.08s | string. Some researcher are thinking that it could be like a kind of a kill switch if the 1676.08s - 1681.08s | backdoor see the this uh strings into the the environment the the memory then it will not run. 1681.68s - 1686.68s | Potentially a kill switch. It also abuses the legit


chunk_id: 171_chunk_25
chunk_text:
latest SSH version but probably that it has been set up for 1634.64s - 1642.90s | compatibility or probably for a specific environment. There is a bunch of other checks and 1642.90s - 1649.12s | evasion used by the sample uh by the payload. Here there is an overview so first as we saw 1649.12s - 1654.46s | it is checks that the current process is well SSHG because there is no need to deploy the 1654.46s - 1659.46s | backdoor if we if we are not running uh if SSHG is not running. It check for a potential kill 1661.40s - 1667.50s | switch. So this one is not very clear. This is a string that was present into the malware 1667.50s - 1672.10s | itself, the payload. But it's not very clear what's the goal, what was the goal of this 1672.10s - 1676.08s | string. Some researcher are thinking that it could be like a kind of a kill switch if the 1676.08s - 1681.08s | backdoor see the this uh strings into the the environment the the memory then it will not run. 1681.68s - 1686.68s | Potentially a kill switch. It also abuses the legit LZMA alloc function for memory 1689.18s - 1695.62s | allocation which is required by the payload at some point. And there is also it is the 1695.62s - 1700.62s | backdoor is also hooking the logging function. Meaning for every authentication through the 1703.96s - 1711.38s | backdoor nothing will be logged into the into the log of the machine. So that means it's also 1711.40s - 1716.14s | more difficult for forensic investigation and incident response. And there is a bunch of 1716.14s - 1722.14s | other advanced functionality such as encryption, anti-replay, it also embeds its own tiny 1722.14s - 1729.09s | embedded disassembler which is required at some point as well. But how the how does the 1729.09s - 1734.87s | backdoor works really? So remember I said there is uh three main function that have been 1734.87s - 1740.67s | hooked and which is interesting as well is that the backdoor embeds three main function to be 1740.69s - 1746.67s | triggered. To trigger this function there is kind of a magic number actually three magic 1746.67s - 1751.37s | number and there is an operation which is used by the backdoor itself which is magic


chunk_id: 171_chunk_26
chunk_text:
LZMA alloc function for memory 1689.18s - 1695.62s | allocation which is required by the payload at some point. And there is also it is the 1695.62s - 1700.62s | backdoor is also hooking the logging function. Meaning for every authentication through the 1703.96s - 1711.38s | backdoor nothing will be logged into the into the log of the machine. So that means it's also 1711.40s - 1716.14s | more difficult for forensic investigation and incident response. And there is a bunch of 1716.14s - 1722.14s | other advanced functionality such as encryption, anti-replay, it also embeds its own tiny 1722.14s - 1729.09s | embedded disassembler which is required at some point as well. But how the how does the 1729.09s - 1734.87s | backdoor works really? So remember I said there is uh three main function that have been 1734.87s - 1740.67s | hooked and which is interesting as well is that the backdoor embeds three main function to be 1740.69s - 1746.67s | triggered. To trigger this function there is kind of a magic number actually three magic 1746.67s - 1751.37s | number and there is an operation which is used by the backdoor itself which is magic one 1751.37s - 1757.67s | multiply by magic two plus magic draw which which will give us the command number that will 1757.67s - 1763.51s | be triggered by the payload itself and the backdoor. So the first one command zero and 1763.51s - 1768.51s | command one is actually an SSH authentication bypass using root login. Second one is a 1771.35s - 1776.35s | remote code execution via systemd, cmd2 and the third one is uh cleaning uh close the 1778.73s - 1783.97s | pre-authent authentication that have been previously opened. And if you pay attention to the 1783.97s - 1788.97s | to the diagram below to trigger this specific uh command the attacker have to embed the 1792.45s - 1797.45s | payload into an RSA certificate that will be read by the by the backdoor server during the 1800.91s - 1806.29s | authentication and then there is bunch of decryption. Of course to exploit this specific 1806.29s - 1811.29s | backdoor there is a not coded certificate used so that means only the attacker itself can log 1816.03s - 1824.47s | in to the compromise server because he already have the private key. So to give you a


chunk_id: 171_chunk_27
chunk_text:
one 1751.37s - 1757.67s | multiply by magic two plus magic draw which which will give us the command number that will 1757.67s - 1763.51s | be triggered by the payload itself and the backdoor. So the first one command zero and 1763.51s - 1768.51s | command one is actually an SSH authentication bypass using root login. Second one is a 1771.35s - 1776.35s | remote code execution via systemd, cmd2 and the third one is uh cleaning uh close the 1778.73s - 1783.97s | pre-authent authentication that have been previously opened. And if you pay attention to the 1783.97s - 1788.97s | to the diagram below to trigger this specific uh command the attacker have to embed the 1792.45s - 1797.45s | payload into an RSA certificate that will be read by the by the backdoor server during the 1800.91s - 1806.29s | authentication and then there is bunch of decryption. Of course to exploit this specific 1806.29s - 1811.29s | backdoor there is a not coded certificate used so that means only the attacker itself can log 1816.03s - 1824.47s | in to the compromise server because he already have the private key. So to give you a little 1824.47s - 1829.47s | more details of how was the certificate payload. So you have here a kind of an overview of 1833.25s - 1840.25s | what is inside the certificate itself. So first this certificate is used to the connection to 1840.25s - 1845.25s | the SSH uh to the SSH uh process to the backdoor server. Then there is an exchange of the 1847.83s - 1854.83s | public key and this public key there is also a sharp 256 which is calculated as well. So let 1854.83s - 1860.13s | me give you an overview of the certificate itself. First if you have a look it's a normal RSA 1860.17s - 1867.07s | certificate but there is some interesting information. In the IV, I call that the IV because 1867.07s - 1873.75s | it's used later. The this IV is actually the magic numbers. Remember the magic numbers are 1873.75s - 1880.39s | used to calculate the common number that will be interpreted by the the server and the the 1880.39s - 1887.53s | backdoor itself. And then in the modulus N uh payload in the in the modulus N part of the RSA 1887.57s - 1892.57s


chunk_id: 171_chunk_28
chunk_text:
little 1824.47s - 1829.47s | more details of how was the certificate payload. So you have here a kind of an overview of 1833.25s - 1840.25s | what is inside the certificate itself. So first this certificate is used to the connection to 1840.25s - 1845.25s | the SSH uh to the SSH uh process to the backdoor server. Then there is an exchange of the 1847.83s - 1854.83s | public key and this public key there is also a sharp 256 which is calculated as well. So let 1854.83s - 1860.13s | me give you an overview of the certificate itself. First if you have a look it's a normal RSA 1860.17s - 1867.07s | certificate but there is some interesting information. In the IV, I call that the IV because 1867.07s - 1873.75s | it's used later. The this IV is actually the magic numbers. Remember the magic numbers are 1873.75s - 1880.39s | used to calculate the common number that will be interpreted by the the server and the the 1880.39s - 1887.53s | backdoor itself. And then in the modulus N uh payload in the in the modulus N part of the RSA 1887.57s - 1892.57s | certificate there is the payload which is encrypted in Shasha 2020 uh Shasha 20 sorry. And 1895.91s - 1900.91s | this payload is decrypted using the outcoded ED448 public key that have been exchanged 1904.99s - 1909.99s | during the initiation of the connection. But only with the first 32 byte. And it's also 1909.99s - 1914.99s | using the IV which are the magic numbers used outcoded into the the malicious RSA key. And 1917.89s - 1924.27s | to decrypt the payload. Then in the decryption of the payload we have two main parts. The 1924.27s - 1930.51s | first which is the signatures which have been verified by the payload to be sure this is 1930.51s - 1936.65s | well this is well the attacker that has been trying to connect. And we have the payload itself 1936.65s - 1943.65s | which have been executed. And the signature is generated with the CMD value which have 1943.67s - 1950.55s | been calculated. A five byte flag which we don't know at this time what is it exactly. The 1950.55s - 1955.55s | payload itself and the Shasha 256 that have been calculated from the ED448 signature. So


chunk_id: 171_chunk_29
chunk_text:
| certificate there is the payload which is encrypted in Shasha 2020 uh Shasha 20 sorry. And 1895.91s - 1900.91s | this payload is decrypted using the outcoded ED448 public key that have been exchanged 1904.99s - 1909.99s | during the initiation of the connection. But only with the first 32 byte. And it's also 1909.99s - 1914.99s | using the IV which are the magic numbers used outcoded into the the malicious RSA key. And 1917.89s - 1924.27s | to decrypt the payload. Then in the decryption of the payload we have two main parts. The 1924.27s - 1930.51s | first which is the signatures which have been verified by the payload to be sure this is 1930.51s - 1936.65s | well this is well the attacker that has been trying to connect. And we have the payload itself 1936.65s - 1943.65s | which have been executed. And the signature is generated with the CMD value which have 1943.67s - 1950.55s | been calculated. A five byte flag which we don't know at this time what is it exactly. The 1950.55s - 1955.55s | payload itself and the Shasha 256 that have been calculated from the ED448 signature. So a 1958.19s - 1964.33s | bunch of mechanisms to avoid also uh the replay of the certificate and to investigate a 1964.33s - 1971.15s | little bit more. And at this point JITAN is in. So there is a small um let me show you. I did a 1971.15s - 1979.90s | small uh demonstration using I did a small demonstration using uh a payload using uh 1991.69s - 1996.69s | someone someone reused um uh recoded actually the the backdoor. So I reused this code. So on 1999.83s - 2004.77s | on the right you have the target which is the attacker. So what I did here I recompiled the 2004.77s - 2010.41s | backdoor itself with my own certificate so I can reuse the code and authenticate like if I 2010.87s - 2017.11s | was the attacker. So you have the target on your right. On the on the bottom you have the logs 2017.11s - 2022.11s | because some researcher found that if you activate the verbose mechanism in the in the logs 2024.69s - 2030.69s | and the configuration of SSH there is a logging feature uh that appear and then there is some 2030.69s -


chunk_id: 171_chunk_30
chunk_text:
a 1958.19s - 1964.33s | bunch of mechanisms to avoid also uh the replay of the certificate and to investigate a 1964.33s - 1971.15s | little bit more. And at this point JITAN is in. So there is a small um let me show you. I did a 1971.15s - 1979.90s | small uh demonstration using I did a small demonstration using uh a payload using uh 1991.69s - 1996.69s | someone someone reused um uh recoded actually the the backdoor. So I reused this code. So on 1999.83s - 2004.77s | on the right you have the target which is the attacker. So what I did here I recompiled the 2004.77s - 2010.41s | backdoor itself with my own certificate so I can reuse the code and authenticate like if I 2010.87s - 2017.11s | was the attacker. So you have the target on your right. On the on the bottom you have the logs 2017.11s - 2022.11s | because some researcher found that if you activate the verbose mechanism in the in the logs 2024.69s - 2030.69s | and the configuration of SSH there is a logging feature uh that appear and then there is some 2030.69s - 2035.69s | track some trace into the into the logs. So what I'm using here I'm actually running the 2036.05s - 2041.05s | backdoor against my server which have been compromised and here you can see there is what I 2044.09s - 2049.33s | did here is extracting some of the components that have been used to generate the RSA 2049.33s - 2054.93s | certificate used to authenticate to the compromised server. And as you can see here you can 2054.93s - 2061.07s | see the OSCE, the SHA256, the different magic number, the magic command in that case it's 2061.09s - 2067.27s | number two so I'm using the RCE remote code execution and then we have the certificate that 2067.27s - 2073.27s | have been sent to the compromised server. And if you look to the target here I've been 2073.27s - 2078.27s | written a file called it's me and that have been executed by uh the certificate itself. And 2080.31s - 2085.81s | this payload was actually part of the RSA uh key that are sent to the mal- to the 2085.83s - 2090.83s | compromised server. The second one is a um is a remote


chunk_id: 171_chunk_31
chunk_text:
2035.69s | track some trace into the into the logs. So what I'm using here I'm actually running the 2036.05s - 2041.05s | backdoor against my server which have been compromised and here you can see there is what I 2044.09s - 2049.33s | did here is extracting some of the components that have been used to generate the RSA 2049.33s - 2054.93s | certificate used to authenticate to the compromised server. And as you can see here you can 2054.93s - 2061.07s | see the OSCE, the SHA256, the different magic number, the magic command in that case it's 2061.09s - 2067.27s | number two so I'm using the RCE remote code execution and then we have the certificate that 2067.27s - 2073.27s | have been sent to the compromised server. And if you look to the target here I've been 2073.27s - 2078.27s | written a file called it's me and that have been executed by uh the certificate itself. And 2080.31s - 2085.81s | this payload was actually part of the RSA uh key that are sent to the mal- to the 2085.83s - 2090.83s | compromised server. The second one is a um is a remote code execution as well just to uh have a 2093.87s - 2099.01s | river shell and to be able to uh authenticate and to do some action onto the mali- onto the 2099.01s - 2146.02s | compromised server. Okay. Sorry about that. Okay so you may wondering who is behind uh this 2148.66s - 2154.90s | attack. So as I as I discussed at the beginning there was multiple personas involved into 2154.92s - 2159.92s | the uh into the deployment of the backdoor for the pressure campaign against LaCie calling. So 2162.42s - 2167.42s | remember I talk about Jigar Kumar, Dennis Ants and Ants Jensen and G. Atan as well. So what I 2169.50s - 2175.74s | did here I wanted to know if because we already had this their their email address also their 2175.74s - 2182.38s | username and I wanted to understand if there is some connection or if the specific email 2182.42s - 2187.42s | addresses were known before or not. So what I actually did I look for some uh connection using 2191.60s - 2197.64s | this email address especially for the G. Atan user and I found out that there was only


chunk_id: 171_chunk_32
chunk_text:
code execution as well just to uh have a 2093.87s - 2099.01s | river shell and to be able to uh authenticate and to do some action onto the mali- onto the 2099.01s - 2146.02s | compromised server. Okay. Sorry about that. Okay so you may wondering who is behind uh this 2148.66s - 2154.90s | attack. So as I as I discussed at the beginning there was multiple personas involved into 2154.92s - 2159.92s | the uh into the deployment of the backdoor for the pressure campaign against LaCie calling. So 2162.42s - 2167.42s | remember I talk about Jigar Kumar, Dennis Ants and Ants Jensen and G. Atan as well. So what I 2169.50s - 2175.74s | did here I wanted to know if because we already had this their their email address also their 2175.74s - 2182.38s | username and I wanted to understand if there is some connection or if the specific email 2182.42s - 2187.42s | addresses were known before or not. So what I actually did I look for some uh connection using 2191.60s - 2197.64s | this email address especially for the G. Atan user and I found out that there was only a few 2197.64s - 2204.14s | server only a few website that was using this email address. What I found out as well is that 2204.14s - 2211.02s | for Jigar Kumar with the proton mail address I was able to recover the date of creation of 2211.02s - 2217.66s | this email address which was on twenty twenty-two April, April twenty-seven and which is 2217.66s - 2224.14s | interesting because this email address have been created just a day before Jigar Kumar sent 2224.14s - 2229.14s | the first email to the to the XE uh utils uh DL list and and project. So Jigar Kumar, Ants 2232.88s - 2237.82s | Jensen and Dennis Ants was part of the first pressure campaign and the second one, 2237.82s - 2243.30s | Misoator and Krigorin was part of the second pressure campaign which occurred between the 2243.30s - 2249.04s | release of the version five six oh and the release of the version five five six one. And which 2249.04s - 2254.04s | is interesting is that if you have a look to the structure of this email addresses they all have 2256.68s - 2262.48s | the same structures. They have


chunk_id: 171_chunk_33
chunk_text:
a few 2197.64s - 2204.14s | server only a few website that was using this email address. What I found out as well is that 2204.14s - 2211.02s | for Jigar Kumar with the proton mail address I was able to recover the date of creation of 2211.02s - 2217.66s | this email address which was on twenty twenty-two April, April twenty-seven and which is 2217.66s - 2224.14s | interesting because this email address have been created just a day before Jigar Kumar sent 2224.14s - 2229.14s | the first email to the to the XE uh utils uh DL list and and project. So Jigar Kumar, Ants 2232.88s - 2237.82s | Jensen and Dennis Ants was part of the first pressure campaign and the second one, 2237.82s - 2243.30s | Misoator and Krigorin was part of the second pressure campaign which occurred between the 2243.30s - 2249.04s | release of the version five six oh and the release of the version five five six one. And which 2249.04s - 2254.04s | is interesting is that if you have a look to the structure of this email addresses they all have 2256.68s - 2262.48s | the same structures. They have a username, they have a number and they all use used a free 2262.48s - 2267.48s | email service. And also what I wanted to discover is does this email address are using I've been 2270.32s - 2276.86s | for example known in public data leak database. And I checked for all of them and all of them 2276.86s - 2283.10s | were not present in any of the public leak leak database. And Brian Krebs at the time of uh the 2283.10s - 2288.10s | investigation and when everyone was crazy about it uh said it's super rare to have one email 2288.76s - 2293.76s | address which is not present in data leak databases. But it's even more rare to have multiple 2298.54s - 2303.68s | email address which are not present in any of the data leaks. Which could give us some 2303.68s - 2308.68s | information about you know a really well crafted uh operation. So what can we do about it? 2313.05s - 2318.19s | Well it's not an easy question and I don't think I have the the answer today. But here is some 2318.21s - 2324.09s | elements maybe to you know just


chunk_id: 171_chunk_34
chunk_text:
a username, they have a number and they all use used a free 2262.48s - 2267.48s | email service. And also what I wanted to discover is does this email address are using I've been 2270.32s - 2276.86s | for example known in public data leak database. And I checked for all of them and all of them 2276.86s - 2283.10s | were not present in any of the public leak leak database. And Brian Krebs at the time of uh the 2283.10s - 2288.10s | investigation and when everyone was crazy about it uh said it's super rare to have one email 2288.76s - 2293.76s | address which is not present in data leak databases. But it's even more rare to have multiple 2298.54s - 2303.68s | email address which are not present in any of the data leaks. Which could give us some 2303.68s - 2308.68s | information about you know a really well crafted uh operation. So what can we do about it? 2313.05s - 2318.19s | Well it's not an easy question and I don't think I have the the answer today. But here is some 2318.21s - 2324.09s | elements maybe to you know just to think about it. Maybe something that could be done 2324.09s - 2328.53s | specially on project like this one that have been widely used everywhere will be to have like a 2328.53s - 2334.37s | strict contributor verification. Also to ensure that the builds are reproducible meaning to 2334.37s - 2340.47s | have like the equivalent of the GitHub repository and the release of the tarball. Then 2340.47s - 2345.25s | hooded hooks and railroad protection but as we saw in that case the backdoor were actually 2345.27s - 2351.91s | using uh bypassing for of the railroad. And also improving dependency management could be a 2351.91s - 2359.76s | good way to improve issue like this one. There is also something which is important to keep in 2359.76s - 2365.40s | mind which is what does it mean for the security community and beyond. So first I think it's 2365.40s - 2371.68s | important to keep in mind that the entire industry relies on open source tools and as we saw 2371.70s - 2376.70s | for the XE util package some people are relying of a base project such as the XE uh util package. 2381.44s - 2387.28s


chunk_id: 171_chunk_35
chunk_text:
to think about it. Maybe something that could be done 2324.09s - 2328.53s | specially on project like this one that have been widely used everywhere will be to have like a 2328.53s - 2334.37s | strict contributor verification. Also to ensure that the builds are reproducible meaning to 2334.37s - 2340.47s | have like the equivalent of the GitHub repository and the release of the tarball. Then 2340.47s - 2345.25s | hooded hooks and railroad protection but as we saw in that case the backdoor were actually 2345.27s - 2351.91s | using uh bypassing for of the railroad. And also improving dependency management could be a 2351.91s - 2359.76s | good way to improve issue like this one. There is also something which is important to keep in 2359.76s - 2365.40s | mind which is what does it mean for the security community and beyond. So first I think it's 2365.40s - 2371.68s | important to keep in mind that the entire industry relies on open source tools and as we saw 2371.70s - 2376.70s | for the XE util package some people are relying of a base project such as the XE uh util package. 2381.44s - 2387.28s | I think also the discovery of the backdoor itself was a mix of luck, coincidence and 2387.28s - 2393.02s | expertise because without the investigation of Andres then we won't be able to we probably 2393.02s - 2397.86s | wouldn't wouldn't have been able to find the backdoor itself. So I think it's kind of 2397.90s - 2404.28s | important to think about it. I believe also if you are if you have a look to the 2404.28s - 2410.68s | sophistication, the mechanisms and the deep understanding of Linux operating systems I 2410.68s - 2416.72s | believe it's also redefine what we call sophisticated attacker. And of course as I said 2416.72s - 2421.56s | there is no easy solution probably the knowledge of what I'm trying to do today meaning 2421.56s - 2427.84s | explaining you how the backdoor is working and what the attacker did is also maybe part of 2427.84s - 2433.02s | the solution because knowledge potentially is the key so you are you are well prepared for 2433.02s - 2440.14s | the next one. Of course in 45 minutes it's super difficult to give you the whole details. 2440.14s - 2445.98s | There


chunk_id: 171_chunk_36
chunk_text:
| I think also the discovery of the backdoor itself was a mix of luck, coincidence and 2387.28s - 2393.02s | expertise because without the investigation of Andres then we won't be able to we probably 2393.02s - 2397.86s | wouldn't wouldn't have been able to find the backdoor itself. So I think it's kind of 2397.90s - 2404.28s | important to think about it. I believe also if you are if you have a look to the 2404.28s - 2410.68s | sophistication, the mechanisms and the deep understanding of Linux operating systems I 2410.68s - 2416.72s | believe it's also redefine what we call sophisticated attacker. And of course as I said 2416.72s - 2421.56s | there is no easy solution probably the knowledge of what I'm trying to do today meaning 2421.56s - 2427.84s | explaining you how the backdoor is working and what the attacker did is also maybe part of 2427.84s - 2433.02s | the solution because knowledge potentially is the key so you are you are well prepared for 2433.02s - 2440.14s | the next one. Of course in 45 minutes it's super difficult to give you the whole details. 2440.14s - 2445.98s | There is a bunch of technical uh details uh into the the backdoor itself. There is a lot of 2445.98s - 2451.18s | information to cover. So I want to acknowledge uh all the researcher that have been working 2451.18s - 2454.96s | on it because they did a fantastic job and I really recommend you to have a look to the 2454.96s - 2461.60s | different blogs at the end if you want to learn more about it. And because because of uh I 2461.60s - 2466.64s | mean thanks to all the writer we know a little bit more today how the backdoor works but 2466.64s - 2471.52s | there is potentially more to discover and potentially stuff that we will never discover. And 2471.52s - 2477.52s | before to conclude on the presentation I just want you to to ask you a question to think 2477.52s - 2484.00s | about for potentially the the rest of the day, the rest of the week or potentially the the rest 2484.00s - 2492.74s | of your career. How many other JATAN do you think are paid are are paid to insert 2492.74s - 2496.38s | backdoors in open source project?


chunk_id: 171_chunk_37
chunk_text:
is a bunch of technical uh details uh into the the backdoor itself. There is a lot of 2445.98s - 2451.18s | information to cover. So I want to acknowledge uh all the researcher that have been working 2451.18s - 2454.96s | on it because they did a fantastic job and I really recommend you to have a look to the 2454.96s - 2461.60s | different blogs at the end if you want to learn more about it. And because because of uh I 2461.60s - 2466.64s | mean thanks to all the writer we know a little bit more today how the backdoor works but 2466.64s - 2471.52s | there is potentially more to discover and potentially stuff that we will never discover. And 2471.52s - 2477.52s | before to conclude on the presentation I just want you to to ask you a question to think 2477.52s - 2484.00s | about for potentially the the rest of the day, the rest of the week or potentially the the rest 2484.00s - 2492.74s | of your career. How many other JATAN do you think are paid are are paid to insert 2492.74s - 2496.38s | backdoors in open source project? And thank you very much for listening me today.


chunk_id: 172_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=jEexnbk9kaI", "title": "DEF CON 32 - The Pwnie Awards", "description": "The Pwnies are an annual awards ceremony celebrating and making fun of the achievements and failures of security researchers and the wider security community. Every year, members of the infosec community nominate the best research and exploits they\u2019ve seen. The Pwnie Award nominations are judged by a panel of respected security researchers and former pwnie award recipients \u2013 the closest to a jury of peers a hacker is likely to ever get. At this event DEF CON attendees will get a first person look at some of the most groundbreaking research and hacks in the cyber security community of the past year, and the winners get some well deserved recognition from the broader community for the great work they\u2019ve done.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2981, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 1.71s - 12.51s | This text was transcribed using whisper model: large-v2 Hello. Welcome to the 2024 Pony Awards. I'm so happy to see all of you. And I'm so happy 12.51s - 21.83s | none of you had to spend $5,000 to get in this time. So, oh yeah, sorry we have an intro 21.83s - 41.38s | reel I forgot. Good morning everyone. Welcome to the 2024 Pony Awards ceremony. Today we 41.38s - 48.30s | celebrate this year's outstanding achievements in security. And some, well, not so outstanding 48.30s - 54.74s | ones, all for the first time ever at DEF CON. We hope you enjoy the show. Without further 54.74s - 70.74s | ado, please welcome your host, Ian Roos. You can tell we didn't do a dry run. It'll be 70.74s - 76.58s | good though. Uh, yeah. So, thank you so much for coming. I'm so happy to see you all here. 76.58s - 80.74s | Uh, we do like maybe a rough show of hands. How many of you are already familiar with 80.74s - 84.66s | the Pony Awards? Alright, I should do that backwards. How many of you have never seen 84.66s - 91.82s | the Pony Awards? It's like the same people. Um, okay. So, the Pony Awards are a annual 91.82s - 98.34s | award show for security research where we try to celebrate both the successes and failures 98.34s - 107.22s | of the security community. Uh, the, the general kind of gist of it


chunk_id: 172_chunk_1
chunk_text:
41.38s | reel I forgot. Good morning everyone. Welcome to the 2024 Pony Awards ceremony. Today we 41.38s - 48.30s | celebrate this year's outstanding achievements in security. And some, well, not so outstanding 48.30s - 54.74s | ones, all for the first time ever at DEF CON. We hope you enjoy the show. Without further 54.74s - 70.74s | ado, please welcome your host, Ian Roos. You can tell we didn't do a dry run. It'll be 70.74s - 76.58s | good though. Uh, yeah. So, thank you so much for coming. I'm so happy to see you all here. 76.58s - 80.74s | Uh, we do like maybe a rough show of hands. How many of you are already familiar with 80.74s - 84.66s | the Pony Awards? Alright, I should do that backwards. How many of you have never seen 84.66s - 91.82s | the Pony Awards? It's like the same people. Um, okay. So, the Pony Awards are a annual 91.82s - 98.34s | award show for security research where we try to celebrate both the successes and failures 98.34s - 107.22s | of the security community. Uh, the, the general kind of gist of it is, you know, we have some 107.22s - 112.38s | very good awards. We have some maybe not so good awards, but people tend to kind of 112.38s - 120.62s | appreciate it, roll with it, have fun. Um, the, as a heads up, uh, as we give out the 120.62s - 127.06s | awards today, um, there will very hopefully be people in the crowd who are available to 127.06s - 134.10s | accept the award. If that happens, please come up on stage. We'll give you a horse and 134.10s - 139.22s | then you can take a couple of minutes in order to, uh, talk about, uh, the research that 139.22s - 144.54s | you did. Now, something we've run into in the past is not everybody can make it out 144.54s - 150.14s | despite our best efforts. Uh, we are a purely volunteer effort and, uh, do not make any 150.14s - 155.78s | money so we're not flying people out for this yet, but we'd love to get there one day. Um, 155.78s - 162.22s | in the event that, uh, the winner is not available, I would love for someone who is maybe


chunk_id: 172_chunk_2
chunk_text:
is, you know, we have some 107.22s - 112.38s | very good awards. We have some maybe not so good awards, but people tend to kind of 112.38s - 120.62s | appreciate it, roll with it, have fun. Um, the, as a heads up, uh, as we give out the 120.62s - 127.06s | awards today, um, there will very hopefully be people in the crowd who are available to 127.06s - 134.10s | accept the award. If that happens, please come up on stage. We'll give you a horse and 134.10s - 139.22s | then you can take a couple of minutes in order to, uh, talk about, uh, the research that 139.22s - 144.54s | you did. Now, something we've run into in the past is not everybody can make it out 144.54s - 150.14s | despite our best efforts. Uh, we are a purely volunteer effort and, uh, do not make any 150.14s - 155.78s | money so we're not flying people out for this yet, but we'd love to get there one day. Um, 155.78s - 162.22s | in the event that, uh, the winner is not available, I would love for someone who is maybe 162.22s - 166.78s | familiar with the body of research or the work that they did to come up on stage and 166.78s - 172.22s | give, you know, a couple minutes, kind of explain what it is, why it's important. Uh, if 172.22s - 177.46s | you feel like maybe you deserve the pony instead, I'm not gonna tell you what to do, but, 177.46s - 184.74s | um, you can fight over it. Uh, and then, um, yeah, that's sort of the plan. Does that sound 184.82s - 198.92s | good? All right, right on. So, for our first award, I would, uh, like to invite, uh, the 198.92s - 210.68s | ransomware actor, Elf, on stage. 210.68s - 219.48s | Hello. I am Elf, also known as Black Hat Ransomware Group. I'm your typical, uh, 219.48s - 229.34s | ransomware as a service animal. Hey. I know there's been lots of speculation as to how 229.34s - 234.38s | they've let me stateside, but do you think you would get far if you had a six-foot-tall 234.38s - 241.46s | Russian handler? Speaking of the cat getting out of the bag, I ran into the president of


chunk_id: 172_chunk_3
chunk_text:
162.22s - 166.78s | familiar with the body of research or the work that they did to come up on stage and 166.78s - 172.22s | give, you know, a couple minutes, kind of explain what it is, why it's important. Uh, if 172.22s - 177.46s | you feel like maybe you deserve the pony instead, I'm not gonna tell you what to do, but, 177.46s - 184.74s | um, you can fight over it. Uh, and then, um, yeah, that's sort of the plan. Does that sound 184.82s - 198.92s | good? All right, right on. So, for our first award, I would, uh, like to invite, uh, the 198.92s - 210.68s | ransomware actor, Elf, on stage. 210.68s - 219.48s | Hello. I am Elf, also known as Black Hat Ransomware Group. I'm your typical, uh, 219.48s - 229.34s | ransomware as a service animal. Hey. I know there's been lots of speculation as to how 229.34s - 234.38s | they've let me stateside, but do you think you would get far if you had a six-foot-tall 234.38s - 241.46s | Russian handler? Speaking of the cat getting out of the bag, I ran into the president of 241.46s - 247.74s | CrowdStrike backstage. Hey, listen, Mike is a great guy. Huge fan of his work, really. 247.74s - 251.78s | They're true artists over there at CrowdStrike. Truly humbling to see a big tech company 251.78s - 257.50s | putting art and memes first. Let's just say, if I got my paws on 8 million devices and 257.54s - 262.62s | execution in kernel, I would make enough ransomware money to maybe afford a CrowdStrike 262.62s - 269.30s | subscription. I'm here to present the award for best cryptographic bug. Folks, as a 269.30s - 273.94s | ransomware operator, encryption is near and dear to my heart, and we got some great 273.94s - 279.02s | research here. Neural network-aided cryptanalysis, Apple processor, side channel 279.02s - 285.14s | attacks, and, hey, UPnP. For those who have ever looked at UPnP's security stack, we 285.14s - 293.78s | have an old saying. I pee, you pee, we all pee on UPnP. Well, folks, I got to snort some 293.78s - 300.22s | catnip and I got to snort some catnip with some cyber insurance dollars, so let's hear it 300.22s - 306.18s | for these nominees. What?


chunk_id: 172_chunk_4
chunk_text:
241.46s - 247.74s | CrowdStrike backstage. Hey, listen, Mike is a great guy. Huge fan of his work, really. 247.74s - 251.78s | They're true artists over there at CrowdStrike. Truly humbling to see a big tech company 251.78s - 257.50s | putting art and memes first. Let's just say, if I got my paws on 8 million devices and 257.54s - 262.62s | execution in kernel, I would make enough ransomware money to maybe afford a CrowdStrike 262.62s - 269.30s | subscription. I'm here to present the award for best cryptographic bug. Folks, as a 269.30s - 273.94s | ransomware operator, encryption is near and dear to my heart, and we got some great 273.94s - 279.02s | research here. Neural network-aided cryptanalysis, Apple processor, side channel 279.02s - 285.14s | attacks, and, hey, UPnP. For those who have ever looked at UPnP's security stack, we 285.14s - 293.78s | have an old saying. I pee, you pee, we all pee on UPnP. Well, folks, I got to snort some 293.78s - 300.22s | catnip and I got to snort some catnip with some cyber insurance dollars, so let's hear it 300.22s - 306.18s | for these nominees. What? 308.42s - 315.22s | First up, presenting the nominees for best crypto bug. Breach extraction attacks by 315.22s - 320.62s | Corneropolis, leveraging leakage from cryptographic protocols and compromised credential 320.62s - 325.98s | checking services, specifically Cloudflare's implementation to reconstruct encrypted 325.98s - 333.46s | passwords on servers using cryptographic insights and neural networks. GoFetch, breaking 333.46s - 339.70s | constant-time cryptographic implementations using data-memory dependent prefetchers by 339.70s - 345.70s | Boruchan, a micro-architectural side channel attack that exploits data-memory dependent 345.70s - 351.26s | prefetchers on Apple processors to extract secret keys from constant-time cryptographic 351.26s - 359.62s | implementations. Blast Radius, RADIUS UDP, considered harmful by Nadia. This significant 359.62s - 365.38s | attack targets a major protocol using a powerful, underused vector that exploits the legacy 365.38s - 381.46s | use of MD5, which lacks chosen prefix collision resistance. And the pony goes to, it's hard 381.46s - 392.46s | with pause, Boruchan for GoFetch, breaking constant-time cryptographic implementations using 392.46s - 408.25s | data-memory dependent prefetchers. Congratulations. Boruchan, are you here? All right. 417.25s - 425.65s | It's on now. Okay. So first dry run. You ready? Is anyone here familiar with this work?


chunk_id: 172_chunk_5
chunk_text:
308.42s - 315.22s | First up, presenting the nominees for best crypto bug. Breach extraction attacks by 315.22s - 320.62s | Corneropolis, leveraging leakage from cryptographic protocols and compromised credential 320.62s - 325.98s | checking services, specifically Cloudflare's implementation to reconstruct encrypted 325.98s - 333.46s | passwords on servers using cryptographic insights and neural networks. GoFetch, breaking 333.46s - 339.70s | constant-time cryptographic implementations using data-memory dependent prefetchers by 339.70s - 345.70s | Boruchan, a micro-architectural side channel attack that exploits data-memory dependent 345.70s - 351.26s | prefetchers on Apple processors to extract secret keys from constant-time cryptographic 351.26s - 359.62s | implementations. Blast Radius, RADIUS UDP, considered harmful by Nadia. This significant 359.62s - 365.38s | attack targets a major protocol using a powerful, underused vector that exploits the legacy 365.38s - 381.46s | use of MD5, which lacks chosen prefix collision resistance. And the pony goes to, it's hard 381.46s - 392.46s | with pause, Boruchan for GoFetch, breaking constant-time cryptographic implementations using 392.46s - 408.25s | data-memory dependent prefetchers. Congratulations. Boruchan, are you here? All right. 417.25s - 425.65s | It's on now. Okay. So first dry run. You ready? Is anyone here familiar with this work? Come on. 425.65s - 431.41s | No crypto. No crypto people in the crowd. I understand. It's really difficult. It's all weird 431.41s - 438.53s | math and shit. You sure? All right. Well, I encourage you. Hi. Maybe they need to study math 438.53s - 445.65s | at Deep State University. I would encourage all of you to look up this research. We'll be 445.65s - 451.57s | publishing links to the papers that they're writing, blog posts, all of that, online, probably 451.57s - 457.09s | in a couple days when I've actually slept. And, yeah. With that, I think we'll move on to the 457.09s - 471.99s | next presenter. All righty. For the presenter for best desktop bug, I'd like to invite Mark 472.15s - 487.64s | Trumpor on stage. Good evening. Well, it's evening somewhere. And it's Vegas, so there's no clocks. 489.16s - 492.92s | So, yeah. Evening. Maybe next year we can do this later in the day. 494.84s - 499.24s | Your dinner jacket is excellent. Thank you. Thank you. I can't believe you can see it. 501.96s - 507.08s | I'm Mark Trumpor. I'm the executive director of SummerCon, America's oldest


chunk_id: 172_chunk_6
chunk_text:
Come on. 425.65s - 431.41s | No crypto. No crypto people in the crowd. I understand. It's really difficult. It's all weird 431.41s - 438.53s | math and shit. You sure? All right. Well, I encourage you. Hi. Maybe they need to study math 438.53s - 445.65s | at Deep State University. I would encourage all of you to look up this research. We'll be 445.65s - 451.57s | publishing links to the papers that they're writing, blog posts, all of that, online, probably 451.57s - 457.09s | in a couple days when I've actually slept. And, yeah. With that, I think we'll move on to the 457.09s - 471.99s | next presenter. All righty. For the presenter for best desktop bug, I'd like to invite Mark 472.15s - 487.64s | Trumpor on stage. Good evening. Well, it's evening somewhere. And it's Vegas, so there's no clocks. 489.16s - 492.92s | So, yeah. Evening. Maybe next year we can do this later in the day. 494.84s - 499.24s | Your dinner jacket is excellent. Thank you. Thank you. I can't believe you can see it. 501.96s - 507.08s | I'm Mark Trumpor. I'm the executive director of SummerCon, America's oldest hacker conference, 507.08s - 517.54s | which has been running continuously since 1987. It is our honor to host the Pony Award 517.54s - 526.04s | nominations, and it is my pleasure to introduce the contenders for best desktop bug. In a world 526.04s - 531.96s | where general purpose computing happens everywhere, from the cloud to the door of your refrigerator, 531.96s - 539.88s | desktop bug might sound a bit anachronistic. But as recent events have shown, from airline 539.88s - 547.16s | check-in kiosks to the blue sphere of death, okay, maybe the sphere pictures were a hoax, 547.16s - 554.60s | but they were still funny. Um, desktop systems are everywhere, proving that this category is as 554.60s - 563.32s | relevant as ever. Let's take a look at this year's nominees. Here are the nominees for best desktop 563.32s - 571.05s | bug. Ben Barnea's three episode research on Windows Paths by Nachos Kernel. Highlighting 571.05s - 576.89s | the complexity of parsing Windows Paths, leading to severe consequences like zero-click vulnerabilities 576.89s - 584.49s | in Outlook or Windows Explorer. A Chrome zero day caused by improperly triggered audio rendering 584.49s - 592.09s |


chunk_id: 172_chunk_7
chunk_text:
hacker conference, 507.08s - 517.54s | which has been running continuously since 1987. It is our honor to host the Pony Award 517.54s - 526.04s | nominations, and it is my pleasure to introduce the contenders for best desktop bug. In a world 526.04s - 531.96s | where general purpose computing happens everywhere, from the cloud to the door of your refrigerator, 531.96s - 539.88s | desktop bug might sound a bit anachronistic. But as recent events have shown, from airline 539.88s - 547.16s | check-in kiosks to the blue sphere of death, okay, maybe the sphere pictures were a hoax, 547.16s - 554.60s | but they were still funny. Um, desktop systems are everywhere, proving that this category is as 554.60s - 563.32s | relevant as ever. Let's take a look at this year's nominees. Here are the nominees for best desktop 563.32s - 571.05s | bug. Ben Barnea's three episode research on Windows Paths by Nachos Kernel. Highlighting 571.05s - 576.89s | the complexity of parsing Windows Paths, leading to severe consequences like zero-click vulnerabilities 576.89s - 584.49s | in Outlook or Windows Explorer. A Chrome zero day caused by improperly triggered audio rendering 584.49s - 592.09s | by 708v1. A long-standing bug in Chrome allows forced real-time audio rendering without user 592.09s - 600.09s | interaction, exploited in last year's Tianfu Cup. Byte code breakdown. Unraveling Factorio's Lua 600.09s - 605.77s | security flaws by Daniels B. Exploiting a vulnerability in the Lua implementation of 605.77s - 613.29s | Factorio. Enabling a malicious server to execute arbitrary code on clients, affecting every player. 613.29s - 628.87s | And the pony for best desktop bug goes to 708v1 for a Chrome O day caused by improperly triggered 629.11s - 638.23s | audio rendering. Congratulations. All right. I'm going to start just pulling people up at some 638.23s - 647.19s | point. Is anyone familiar with this body of work? Okay. I have used Chrome. Here's what we're going 647.19s - 654.79s | to do. Has anyone done any interesting desktop exploitation Chrome bug research recently? 654.87s - 660.07s | Anyone maybe pitch your work very briefly? I know you're out there. It's fine. You can come 660.07s - 667.27s | up. I'll call someone out. Just pick somebody at random. Make them describe some. They're all 667.27s - 673.67s | very nervous. I know. We were actually thinking


chunk_id: 172_chunk_8
chunk_text:
by 708v1. A long-standing bug in Chrome allows forced real-time audio rendering without user 592.09s - 600.09s | interaction, exploited in last year's Tianfu Cup. Byte code breakdown. Unraveling Factorio's Lua 600.09s - 605.77s | security flaws by Daniels B. Exploiting a vulnerability in the Lua implementation of 605.77s - 613.29s | Factorio. Enabling a malicious server to execute arbitrary code on clients, affecting every player. 613.29s - 628.87s | And the pony for best desktop bug goes to 708v1 for a Chrome O day caused by improperly triggered 629.11s - 638.23s | audio rendering. Congratulations. All right. I'm going to start just pulling people up at some 638.23s - 647.19s | point. Is anyone familiar with this body of work? Okay. I have used Chrome. Here's what we're going 647.19s - 654.79s | to do. Has anyone done any interesting desktop exploitation Chrome bug research recently? 654.87s - 660.07s | Anyone maybe pitch your work very briefly? I know you're out there. It's fine. You can come 660.07s - 667.27s | up. I'll call someone out. Just pick somebody at random. Make them describe some. They're all 667.27s - 673.67s | very nervous. I know. We were actually thinking about dropping this category at a certain point 673.67s - 680.79s | because no one uses desktops anymore. It's all in the cloud. It's all desktops. It's smart. It's 680.79s - 690.07s | very clearly laptops. All right. Well, with that, let's move on to our next category. I know some 690.07s - 700.38s | of you are here, by the way. Okay. For our next category, we have the best mobile bug research of 700.38s - 718.92s | the year presented by Kai. So, hello. I am very excited to be here primarily because I have 718.92s - 724.04s | another reason to wear this really expensive jacket that I have only had one opportunity to 724.04s - 729.64s | wear before. Uh, I thought the tombstone logs in the back of it would be a little too niche, so 729.64s - 734.88s | bear with me on this. Uh, the state of mobile security has been, I think, steadily improving, 734.88s - 739.08s | and that's kind of commensurate by some of the best researchers fucking off to go audit Ethereum 739.08s - 746.60s | smart contracts or something. Um, but I am really happy to be here


chunk_id: 172_chunk_9
chunk_text:
about dropping this category at a certain point 673.67s - 680.79s | because no one uses desktops anymore. It's all in the cloud. It's all desktops. It's smart. It's 680.79s - 690.07s | very clearly laptops. All right. Well, with that, let's move on to our next category. I know some 690.07s - 700.38s | of you are here, by the way. Okay. For our next category, we have the best mobile bug research of 700.38s - 718.92s | the year presented by Kai. So, hello. I am very excited to be here primarily because I have 718.92s - 724.04s | another reason to wear this really expensive jacket that I have only had one opportunity to 724.04s - 729.64s | wear before. Uh, I thought the tombstone logs in the back of it would be a little too niche, so 729.64s - 734.88s | bear with me on this. Uh, the state of mobile security has been, I think, steadily improving, 734.88s - 739.08s | and that's kind of commensurate by some of the best researchers fucking off to go audit Ethereum 739.08s - 746.60s | smart contracts or something. Um, but I am really happy to be here and I want to give you guys a 746.60s - 752.44s | little bit of advice. Uh, for any aspiring mobile security researchers out there, pay attention in 752.44s - 758.16s | your complexity theory class. Building Turing machines is no longer just an academic exercise. 758.16s - 764.92s | I also want to say, pay attention- I also want to say, pay attention in your undocumented 764.92s - 771.50s | hardware feature class. You'll never know when you'll need a PPL bypass. Uh, and with that, uh, 771.50s - 776.90s | my only real move in these situations is, I have students and generally I have power over them and 776.90s - 781.78s | threaten to fail them if they don't laugh, so I will fail you if you don't laugh. And the nominees 781.78s - 786.78s | are- right a button? Here are the nominees for best mobile bug. Operation Triangulation by, who 792.46s - 798.72s | knows, one of the most sophisticated attacks targeting iPhones, notable for being the first to 798.72s - 806.92s | exploit a hardware feature in iPhones. Gaining kernel code execution on an MTE-enabled Pixel 8 by 806.92s - 813.50s | Manwei Mo,


chunk_id: 172_chunk_10
chunk_text:
and I want to give you guys a 746.60s - 752.44s | little bit of advice. Uh, for any aspiring mobile security researchers out there, pay attention in 752.44s - 758.16s | your complexity theory class. Building Turing machines is no longer just an academic exercise. 758.16s - 764.92s | I also want to say, pay attention- I also want to say, pay attention in your undocumented 764.92s - 771.50s | hardware feature class. You'll never know when you'll need a PPL bypass. Uh, and with that, uh, 771.50s - 776.90s | my only real move in these situations is, I have students and generally I have power over them and 776.90s - 781.78s | threaten to fail them if they don't laugh, so I will fail you if you don't laugh. And the nominees 781.78s - 786.78s | are- right a button? Here are the nominees for best mobile bug. Operation Triangulation by, who 792.46s - 798.72s | knows, one of the most sophisticated attacks targeting iPhones, notable for being the first to 798.72s - 806.92s | exploit a hardware feature in iPhones. Gaining kernel code execution on an MTE-enabled Pixel 8 by 806.92s - 813.50s | Manwei Mo, exploiting a vulnerability in the ARM Mealy GPU to achieve arbitrary kernel code 813.50s - 821.00s | execution and gain root access on an Android phone, even with MTE mitigation enabled. That 821.06s - 829.06s | Samsung Galaxy A bug chain by MaxRB. Triggered via USB, allowing code execution in the boot 829.06s - 835.20s | loader, control over Android, and leakage of secrets stored in trust zone, affecting many 835.20s - 847.80s | devices in the Galaxy A family. And the winner is- Operation Triangulation. Operation 851.42s - 858.06s | Triangulation, are you out there? I- Anyone want to take credit for this? I would be so happy. Oh 858.08s - 864.12s | my gosh, they're here. Operation Triangulation is in the room. Please. Yeah? Please come up on 864.12s - 869.50s | stage. Hi. Would you like to say a few words? I'm just- I'm just here to- I'm not going to take 869.50s - 874.26s | credit. Um, I think it's pretty cool, this category, because it's mobile, and mobile still has 874.26s - 878.50s | lots of hardware crap put together in it, and this is kind of a great example of it, because 878.50s -


chunk_id: 172_chunk_11
chunk_text:
exploiting a vulnerability in the ARM Mealy GPU to achieve arbitrary kernel code 813.50s - 821.00s | execution and gain root access on an Android phone, even with MTE mitigation enabled. That 821.06s - 829.06s | Samsung Galaxy A bug chain by MaxRB. Triggered via USB, allowing code execution in the boot 829.06s - 835.20s | loader, control over Android, and leakage of secrets stored in trust zone, affecting many 835.20s - 847.80s | devices in the Galaxy A family. And the winner is- Operation Triangulation. Operation 851.42s - 858.06s | Triangulation, are you out there? I- Anyone want to take credit for this? I would be so happy. Oh 858.08s - 864.12s | my gosh, they're here. Operation Triangulation is in the room. Please. Yeah? Please come up on 864.12s - 869.50s | stage. Hi. Would you like to say a few words? I'm just- I'm just here to- I'm not going to take 869.50s - 874.26s | credit. Um, I think it's pretty cool, this category, because it's mobile, and mobile still has 874.26s - 878.50s | lots of hardware crap put together in it, and this is kind of a great example of it, because 878.50s - 884.68s | you've got a core that someone makes and has debug features, and they forget to turn them off. 884.68s - 888.10s | It's awesome. It happens all the time. If you're not into hardware, check it out, because 888.10s - 894.24s | there's a lot of wide open doors all over everything in hardware. And if we agree that this 894.24s - 898.52s | pony has zero value, there is a possibility I could at least get it back to the folks who 898.52s - 902.98s | discovered and reported it. Because, you know, no sanction violations if I bring something of 902.98s - 906.82s | zero value. I mean, there's no money attached to this, so I don't know. Winona, is this 906.82s - 912.82s | illegal? Sorry. This is a pony? It is a pony. It's a gummy bear. You can eat it. Is it clean? I 921.72s - 927.36s | wouldn't ask. Okay. Well, yeah. Hack on hardware. Hardware is awesome. I'll do my best to see 927.36s - 934.26s | if I can get this to someone who knows. Either side. I don't give a shit. Either end of it. Up 934.28s - 938.52s


chunk_id: 172_chunk_12
chunk_text:
884.68s | you've got a core that someone makes and has debug features, and they forget to turn them off. 884.68s - 888.10s | It's awesome. It happens all the time. If you're not into hardware, check it out, because 888.10s - 894.24s | there's a lot of wide open doors all over everything in hardware. And if we agree that this 894.24s - 898.52s | pony has zero value, there is a possibility I could at least get it back to the folks who 898.52s - 902.98s | discovered and reported it. Because, you know, no sanction violations if I bring something of 902.98s - 906.82s | zero value. I mean, there's no money attached to this, so I don't know. Winona, is this 906.82s - 912.82s | illegal? Sorry. This is a pony? It is a pony. It's a gummy bear. You can eat it. Is it clean? I 921.72s - 927.36s | wouldn't ask. Okay. Well, yeah. Hack on hardware. Hardware is awesome. I'll do my best to see 927.36s - 934.26s | if I can get this to someone who knows. Either side. I don't give a shit. Either end of it. Up 934.28s - 938.52s | to you, man. Well, no, not triangulation folks. The Kaspersky votes who found it. But, you 938.52s - 941.16s | know, they didn't really want the first ones to find it. They were just the ones who saw someone 941.16s - 945.12s | else who found it. I think they're in another category coming up, too. Oh, they are? I'm pretty 945.12s - 954.93s | happy. I'll stay close to the front. You should give it to them. Thank you. All right. Now 966.02s - 978.46s | introducing our presenter for the best song category, Claudia. Thank you, everyone. I get very 978.48s - 984.58s | excited about this. And also, isn't Ian doing a great job? He is crushing it. It's not easy when 984.58s - 988.86s | you don't really know who's going to be in the audience and, uh, you know, there's a lot of 988.86s - 994.86s | mystery on both sides here. So you might be asking yourself, best song in the ponies award? Why? 999.20s - 1006.40s | The answer is vibes. I think all of us can agree that working in security, you need to generate 1006.44s - 1013.36s | the right


chunk_id: 172_chunk_13
chunk_text:
| to you, man. Well, no, not triangulation folks. The Kaspersky votes who found it. But, you 938.52s - 941.16s | know, they didn't really want the first ones to find it. They were just the ones who saw someone 941.16s - 945.12s | else who found it. I think they're in another category coming up, too. Oh, they are? I'm pretty 945.12s - 954.93s | happy. I'll stay close to the front. You should give it to them. Thank you. All right. Now 966.02s - 978.46s | introducing our presenter for the best song category, Claudia. Thank you, everyone. I get very 978.48s - 984.58s | excited about this. And also, isn't Ian doing a great job? He is crushing it. It's not easy when 984.58s - 988.86s | you don't really know who's going to be in the audience and, uh, you know, there's a lot of 988.86s - 994.86s | mystery on both sides here. So you might be asking yourself, best song in the ponies award? Why? 999.20s - 1006.40s | The answer is vibes. I think all of us can agree that working in security, you need to generate 1006.44s - 1013.36s | the right vibes to get to the right goal. You know, when we're running CTFs, you need to have 1013.36s - 1020.36s | some epic gamer music. Shout out to EDM for powering us through many a late night coding 1021.00s - 1034.28s | sesh. So today it is my honor to talk about who might in the last year have generated those rare 1034.64s - 1040.64s | vibes that we needed in moments of difficulty. So without further ado, the nominees for best song 1045.44s - 1051.44s | are the nominees for best song 2024 touch some grass by UWU underground. Kids out here believing 1054.92s - 1060.92s | what they're told. The X on the ground, code snail loads by Lava Dose. It's falling back. It's 1064.52s - 1070.52s | right through them. That works too. And the pony for best song goes to UWU for touch some grass. 1093.08s - 1100.08s | Let's go. A good reminder for us all. Do we have someone? Yes. I think we have someone to 1100.08s - 1107.33s | accept the award. I mean, who wouldn't want to take credit for this, you know? Nice. Awesome. 1109.33s - 1114.83s | Hi, my name


