# Media

url: https://www.youtube.com/watch?v=uKvkBchZkA0
title: DEF CON 32 - Autos, alcohol, blood, sweat, & creative reversing obfuscated Car Modding tool - Atlas
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=uKvkBchZkA0",
  "title": "DEF CON 32 - Autos, alcohol, blood, sweat, & creative reversing obfuscated Car Modding tool - Atlas",
  "description": "reversing can feel uber powerful... like you hold God's honest truth within your hands... most humans don't understand what you can see and comprehend.\n\nuntil someone tries to hide the truth from you... limit your knowledge... keep you from your glorious purpose!\n\nobfuscated code can be a real downer.\n\nthis talk focuses on the story of how i took on an interesting obfuscated target (an automotive modder's tool with ability to flash firmware and tweak engines), in fun and exciting ways.\n\nwe'll discuss several problems with obfuscated code, an approach i took (and tooling), playing in the guts of machine code, and customizations to binary analysis tools that came out of the journey...\n\nthere will be much hex, disassembly, green on black, total carnage.\n\nyou will walk away with powerful ideas and new tools to help you in your pursuit of truth. you will be entertained, enriched, educated, and hopefully inspired. instead of thinking that \"atlas is smart\" my goal is you feeling, and being, more powerful.\n\ncome with Vivisect installed to follow along!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2452,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.80s | This text was transcribed using whisper model: large-v2

 Good morning, oh good afternoon DEF CON. Uh today we have a talk on automobiles, alcohol,
5.80s - 12.88s |  blood, sweat, and creative revers- reversing of obfuscated car moding tool. And with our
12.88s - 17.88s |  speaker Atlas. Thank you sir. Thank you Fals. I'm sorry True. Hi everyone, welcome. How
23.46s - 30.06s |  many of you came because it had the word automotive in it? Alright, good. Uh obfuscation,
30.06s - 37.46s |  who came because it said obfuscation? Excellent. Well thank you all. I don't care why you
37.46s - 42.10s |  came, you're here. I'm very grateful for you. I hope that we have a lot of fun today. Uh as
42.10s - 47.30s |  per usual if you've come to a talk of mine I've crammed in way too much stuff and we're
47.30s - 54.81s |  gonna see just how well and how much we can fit in. And because of timing I'm going to
54.81s - 59.31s |  probably just come out here and look at the slides that you're seeing cause I, yeah
59.31s - 64.31s |  whatever. So who is this Atlas dork? Hi. This is my home. I was created here at DEF CON in
66.65s - 71.65s |  2013. Um and this is my family. I'm a hacker of things, I ride a motorcycle, I've got three
77.25s - 86.90s |  amazing daughters who have nothing to do with technology. If you dare there is a QR code
86.92s - 92.42s |  that has all sorts of ways to get a hold of me. I'll leave that up for about ten more
92.42s - 103.43s |  seconds. So I work in R&D and cyber physical systems for a company called Grim and Grim is
103.43s - 112.56s |  represented, stand up. My dear friends down here wore huge Grim t-shirts, ask how many of
112.56s - 119.62s |  them work for Grim. A lot of love here. Alright, so my job is to break into things and I'm
126.32s - 132.30s |  I set many goals, some of them attainable in the near term, many of them long term goals, some
132.30s - 137.80s |  of them like if I do these three projects that are year long then I'll achieve this thing. So
137.80s - 144.24s |  I think in these many different ways. But my ultimate goal typically is remote code execution
144.24s - 149.26s |  on a device thing in a running program. For cars and uh and particularly the small ECUs that
150.22s - 155.22s |  run your cars. My favorite way to gain code execution on an ECU like your brake controller,
159.22s - 165.86s |  your power steer, power steering controller is through the update process or diagnostics
165.86s - 170.86s |  process. Your tool plugs in, I'm sorry, runs on Windows, there's some software, have a
171.86s - 176.86s |  have a hardware tool plugs into the OBD2 port on your car and then talks over the the
181.00s - 186.00s |  vehicle CAN network to tell the car things what to do. Now, for that, for the really cool
190.94s - 196.34s |  stuff that we really like to do, there's an authentication mechanism so the tool says no, I'm
196.34s - 202.04s |  not just some Joe Schmo, I'm I'm supposed to be doing this. Give me all the goods, let me do
202.06s - 206.16s |  all the cool things. Now there are a couple different ways that this is done, well a number
206.16s - 210.50s |  of different ways but two primary standards of the way that this is done. But it generally
210.50s - 215.30s |  comes with some sort of back and forth, a seed key exchange or some sort of authentication
215.30s - 220.30s |  mechanisms like what you might like. Um and then, well I won't get into exactly how I gain
222.88s - 228.69s |  code execution at that point but there are many different cool things that you can do. Set
228.73s - 234.27s |  diagnostics level is the uh is the way that you tell an ECU to go into a certain mode.
234.27s - 239.55s |  Sometimes you can change parameters, sometimes you can update firmware. Um but then
239.55s - 245.35s |  there's a security access uh hex 27 or an authentication hex 29, these are the service
245.35s - 251.83s |  numbers that are that are used in the messages. And that sets up the back and forth
251.83s - 256.85s |  authentication process. So it could be simple key uh seed key exchange and we just walked
260.41s - 270.30s |  through that basically. Moving right along. Alright so the goal for me in this project that
273.78s - 278.78s |  I'm talking about is to gain access to the code that calculates the seed key exchange or the
281.28s - 285.92s |  authentication mechanism. Uh there are many different things that that can go into that but I
285.92s - 290.86s |  don't care. I want them all. Uh this this all started a couple years ago when one
290.86s - 297.54s |  manufacturer that we already had access to added a new authentication mechanism that we didn't
297.54s - 302.94s |  have access to and so it's like we gotta have this and then I made the I made the, I won't say
302.94s - 309.72s |  mistake, I made the decision to use this as a mentoring tool. Instead of going hog wild after it,
309.72s - 314.46s |  I leaned into other people who are very capable, very skilled, very passionate and I allowed
314.46s - 319.46s |  them to think on it, stew on it and work with it with me. Um but it did slow things down quite a
321.46s - 330.31s |  bit. So I don't know if you can see this. If you can't, I apologize. Basically this is showing
330.31s - 337.31s |  an obfuscated program. So when you install this tool, I'm I'm not gonna mention who, the tool
337.31s - 344.05s |  has one executable program on a Windows pro uh on a Wi- Windows system and as soon as you load
344.05s - 350.55s |  it up in your favorite disassembler, the entry code does some weird stuff. It pushes a value
350.55s - 356.29s |  onto the stack, it makes a call and then it has a return. Well that call is literally a return.
356.29s - 364.29s |  It's a no op call. So what happens when you push something on the stack and then you return?
364.29s - 369.57s |  Well that's a jump. It's very common to uh to it's a common thing to use to obfuscate what
369.59s - 375.49s |  you're trying to do. Malware does this, uh software does this. And it's the makings of a very
375.49s - 382.51s |  long day. Now there are a number of ways to deal with obfuscated programs. Uh more than I
382.51s - 386.85s |  listed here but these are the two that hit my brain. They they tickle my fancy. I like to
386.85s - 392.05s |  emulate through things and do analysis through emulation. You probably heard a talk or two from
392.05s - 396.65s |  me on that. And what I'm calling snatch and grab and that's actually what we're gonna talk about
396.67s - 403.05s |  here today. Uh from an emulator perspective you might spin up QMU. QMU allows you to do all
403.05s - 409.25s |  sorts of cool emulation things and it builds in a GDB debugger component where you can halt
409.25s - 415.03s |  something and do twiddle and and all sorts of fun stuff. Maybe kernel debugging if if if we
415.03s - 421.53s |  ever get to a point where uh where anti-debugging is really good enough to stop me from using
421.55s - 426.99s |  this type of uh uh this type of mechanism then kernel debugging will be another option.
426.99s - 431.63s |  Vivisection has a lot of cool stuff. A tool that I that I released and and actually spoke
431.63s - 438.41s |  about last week at Black Hat. But not this time. No emulation in the initial things anyway.
438.41s - 443.41s |  Emulation plays into pretty much everything that I do but not for this. So snatch and grab.
443.53s - 448.53s |  So snatch and grab. Basically you start up the program. You run it. You attach you you connect
452.27s - 458.01s |  it to the vehicle. You get all the functionality that you're really into. And you make sure
458.01s - 463.01s |  that it's all working. It's all obviously able to be executed. You attach with a debugger and
467.20s - 472.20s |  there are issues that that go around this but uh uh anti-debugging who's heard of it? Anybody
472.32s - 477.32s |  uh tried to get around anti-debugging techniques? Well we're not even gonna worry about it. We
481.50s - 486.30s |  attach it is very difficult to make it so you can't attach. If you can't if you actually can't
486.30s - 491.30s |  attach then kernel debugging becomes a thing. Then we grab all the data and we store it and
495.18s - 501.55s |  analyze it. I mean it sounds simple right? So for this I used a tool called Vivisect my
501.57s - 507.67s |  favorite uh reversing tool. Vivisect has a built in vulnerability debugger. So we use VDB
507.67s - 514.45s |  attached to the running program. Dump what the reason I wanted to use VDB is because VDB has a
514.45s - 519.45s |  V snapshot. V plays into everything. It's kinda like V for Vendetta but Visigoth. Um and then
523.77s - 531.78s |  magic happens. So here's a picture. If that's too much on my chart here's here's a closer
531.80s - 536.80s |  picture. Basically it's just an attach and we say as soon as the attach is done run snapshot
540.44s - 545.94s |  and it dumps all the memory maps out to a file including processor state and and so on so
545.94s - 554.20s |  forth. So that we can easily analyze the full system state at that point. And here's the actual
554.20s - 559.22s |  I had to zoom in yet again. So snapshot target dot vsnap. The next step was to import the data
565.18s - 570.18s |  from the snapshot into a Vivisect workspace. Vivisect workspaces is basically holds all the
573.38s - 578.26s |  things that you're analyzing when working with Vivisect doing reverse engineering. And you can
578.26s - 582.96s |  use this for many many things including symbolic analysis and emulation but we won't get there
582.96s - 587.96s |  right now. Uh it's basically it was a manual process when I started this. Uh it's continued to
588.96s - 593.96s |  take shape. This will be wrapped into uh this will be wrapped into Vivisection shortly. Like
597.98s - 604.77s |  within a week or two. I will be releasing next week. So basically we copy all of the memory
607.41s - 612.41s |  maps. Who? Show of hands. Who's done debugging before and understands what a memory map is?
613.41s - 618.41s |  If you do like infill proc maps in GDB or cat in a Linux system with a proc file system, cat
623.15s - 628.15s |  slash proc slash pid slash maps and it'll list. Here are the different memory maps that exist.
630.39s - 636.03s |  These four or five are from this program or this library and whatnot and so forth. That's what
636.03s - 641.43s |  I'm talking about. So we we just take that's all been snapshotted away. We grab the snapshot
641.43s - 646.43s |  memory maps. We copy them into a Vivisect workspace and then we do a little magic that says we
650.17s - 655.17s |  have all the data. The PE that's been loaded into memory has all of its own data. Symbol data,
657.51s - 662.51s |  names, things like that. And we tell the workspace to just steal that data. I'm giving you
662.51s - 667.51s |  eye charts. We're skipping over quite a few slides here because at the end of the day, this was
675.99s - 680.99s |  stolen from the built-in Vivisect parser. We just removed a few things that loaded the memory
683.69s - 688.59s |  maps back in again. And that's the thing that I'm going to be wrapping into Vivisection. Reach
688.61s - 693.05s |  out to me if you want it. You've got contact information for me on the slides. The slides
693.05s - 698.05s |  should be available online. Okay. So there are a number of different ways that obfuscation is
701.79s - 706.79s |  generally done. Any malware reverse engineers here? How about malware forward engineers? So
712.75s - 717.83s |  there are three primary ones that I run into when I've done malware reversing or
717.85s - 722.85s |  obfuscation. The first one is unpack or decrypt in place. So the program runs, loads up, the
726.19s - 731.19s |  loader creates these memory maps and the initial part of the code does a lot of really annoying
733.83s - 738.83s |  things but then it gets to a point where it decrypts itself into the existing memory maps. So
742.13s - 746.41s |  that's one thing to be looking for because we're always looking for what's important. What are
746.45s - 751.33s |  we interested in? The next one is to unpack or decrypt into new memory maps. So it just calls
751.33s - 756.33s |  basically give me a new memory map, I will shit my stuff into it and then we'll execute from
756.33s - 761.07s |  there. So anonymous memory maps may be very interesting as well. You have, you have named
761.07s - 767.97s |  memory maps, you have anonymous memory maps. And then process hollowing or some variation
767.97s - 773.49s |  thereof. So let's say you've got your malware or your, your obfuscated thing, starts another
773.49s - 778.51s |  process and then decrypts its stuff across into that other process much like a debugger would.
781.01s - 786.01s |  So these are all interesting things we're looking for. There are many variations on it. And
787.21s - 792.21s |  determine very quickly by comparing what I had dumped into the vivisect workspace to what the
794.29s - 799.29s |  original binary loaded in the vivisect workspace. And this was a decrypt in place binary. So
799.29s - 804.29s |  that gives me an understanding of at least where I do need to focus. Maybe, maybe not
807.67s - 813.41s |  cutting out where I don't. So let's go searching for things. Reversing, reverse engineering.
813.41s - 818.41s |  You load a thing up into, into Ghidra or Ida or Binja and you want to do things, how do you, how
821.25s - 826.25s |  do you do those things? I, I want to go find hex UDS things, hex 29, hex 27 as immediate
826.61s - 832.86s |  constants. Uh oh. You see, we don't know anything about what we just dumped into the
836.30s - 842.28s |  workspace. There's no code that's been identified. There are no strings that have been
842.28s - 847.28s |  identified. Like you can, you can manually go, manually go through the like the 30 meg of
848.72s - 853.72s |  memory maps and manually look for strings but yeah, I don't have that kind of time. So here
854.24s - 862.41s |  actually is, is a picture of vivisect where I'm looking at a string that I want to find. But
864.83s - 871.11s |  it's not identified as a string. In fact, nothing is except stuff that the loader told me was a
872.81s - 880.14s |  string by going through the magic that we did before. So here's a different view of it. Maybe
881.48s - 886.48s |  you, maybe you prefer this view. And of course my laser pointer cannot show up on the screen.
886.50s - 893.49s |  So on the right hand side, if you can see this slide and you have great eyes, uh, you can see
895.03s - 900.63s |  near the bottom, there starts to be some ASCII string looking things. Okay, really nifty.
900.63s - 905.51s |  Including security array. I'm very interested in security array. Anything that starts in
905.51s - 911.65s |  security is very um, uh, interesting to me. But unfortunately, viv doesn't know that that's a
911.65s - 918.63s |  string yet. When I first did this, I actually just saved the workspace out and the workspace
918.65s - 923.65s |  is unencrypted. And I just ran strings literally on the workspace to get an idea of what was
925.19s - 930.19s |  there. Because they were decrypted. They were de-obfuscated. And when I found an interesting
931.33s - 936.33s |  thing, and there are millions of strings. When I found an interesting thing, I went back into
937.53s - 942.53s |  vivisect and found, hi there. I held down the wrong button. Are we back? No, not yet. What? Of
942.65s - 979.49s |  course it is. I probably see it just as easily too. New pointer. I apologize. Not used to it yet.
1009.26s - 1022.67s |  Okay. It does go fast though. So once I found a string that was interesting, I'd go into the
1022.67s - 1026.51s |  vivisect CLI. There's a command line at the bottom and I just type search and I look for that
1026.51s - 1035.26s |  string. It shows up and I can start turning it into strings by pressing S. All right, about a
1035.26s - 1040.26s |  week ago I wrote a vivisection plugin component that allows me just to do that and make that
1040.94s - 1047.76s |  available to you guys as well. The vivisection scan for strings. It brings up a starting memory
1049.20s - 1054.04s |  map, an ending memory map, and if that's not granular enough, a starting address and an ending
1054.04s - 1058.84s |  address, do you want to apply the strings when you find them? Like shove them into the
1058.84s - 1063.84s |  workspace? And I said no. Because it turns out strings captures a whole bunch of binary
1064.50s - 1069.50s |  code that just kind of happens to be alphanumeric. So let's take a look at this. I'm
1072.14s - 1077.82s |  looking for ASCII strings. I can look for unicode and it allows you to set the minimum size
1077.82s - 1084.28s |  defaults to five characters. That's generally good for me. So when we're done, if you can see
1084.28s - 1092.17s |  this over here, because I told it not to apply the strings, it popped up a GUI, a widget that
1092.17s - 1096.59s |  just printed out. Here's the location. Here's the strings. I did not make it so that you
1096.59s - 1102.13s |  could click on the uh on the location yet. Uh that's coming next week. It's been very busy.
1102.13s - 1108.37s |  Um so I get an idea and I'm able to scroll through and go oh this chunk of code is actually or
1108.37s - 1117.76s |  this chunk of strings is really not strings. So I don't want all the strings so I zero in on a
1117.76s - 1123.36s |  memory address range where I'm confident that those strings are what I want and they are real
1123.40s - 1132.53s |  strings. So now I have strings. Look security access is right there. DPF soot PC uh automotive
1135.41s - 1141.45s |  stuff. If that makes you happy that makes you happy. Um but I see some interesting things that
1141.45s - 1149.09s |  aren't strings and I'm I'm curious about them. We'll come back to it. X86 32 or 64 bit doesn't
1149.09s - 1154.09s |  matter. It's a variable length instruction set and it's really important that we get it right so
1154.83s - 1159.83s |  that when we call something code it is code indeed. So if you get off by one byte you can tank
1164.61s - 1171.24s |  an entire understanding of a segment of code. So how do we accurately identify code? Well it
1174.72s - 1179.72s |  turns out there are 12 stack areas. Alright I gave you a hint. Actually I'm taking hands. How do
1179.72s - 1184.72s |  I identify known good code? Yell it out. Look do you know how many things are good op codes
1195.01s - 1206.44s |  that are not real? What's that? Ding ding ding give Travis a big hug. I'll get you later. Um
1209.28s - 1214.28s |  yes. So with the hint he didn't need it. Uh we have 12 stacks identified. One for each thread
1215.14s - 1220.14s |  that's running in the program in the system. Each one has its own stack. In the stack what's
1223.62s - 1228.62s |  stored there? Return pointers. And a whole bunch of other fucking pointers that are very
1230.72s - 1235.72s |  annoying and they're all large but it's a great teaching thing. How do I know if a pointer is a
1236.08s - 1241.08s |  return? Well first of all we go to the pointer. And on the top you see a 32 bit representation
1246.52s - 1251.52s |  of stuff around the stack. At this address 3F7FDD4 we see a an address 5143A6. It's blue
1255.86s - 1262.33s |  because that's a valid memory address. Then we back up. Two bytes. And see if it disassembles.
1262.45s - 1267.45s |  And now we're into what you're saying but it's we're into what you were saying a second ago but
1269.59s - 1274.79s |  there's more to it. So sorry if I if I should shut you down too quickly. So we back up two
1274.79s - 1279.79s |  bytes. Why? Because the smallest the smallest call in x86 is two bytes long. The longest call
1281.57s - 1286.57s |  is like eight bytes. So we back up two bytes. Does it disassemble into a call? Yes! Okay
1286.85s - 1291.85s |  cool. Now wait. Does that call stop? Because everyone's got its own size. Does it stop at the
1296.79s - 1302.03s |  pointer that we're trying to investigate? No. Shit. Go back. Okay. Three bytes. Four bytes.
1302.03s - 1307.03s |  Five. Six bytes. Whatever. We get a call. The instruction itself ends at the boundary where the
1309.27s - 1314.57s |  pointer is pointing. Because that's what the that's what a return call is is to go to the next
1314.61s - 1324.44s |  thing. And that is a pretty good likelihood that that's a return pointer. So I go to that
1324.44s - 1329.44s |  location and I say C to make code. And sure enough we have a call to this address which is also
1332.38s - 1337.38s |  valid. We have a jump after that. And then basically a a drop down to a ret. So this is looking
1341.32s - 1346.32s |  very much like very good code. But that is a fuck ton of work. And after less than a minute
1348.76s - 1353.76s |  of putting my mentee uh stew on it for for a day, I gave her a script and said so here's a
1356.00s - 1360.10s |  script that'll kind of do that manually for or automatically for you. And that script I was
1360.10s - 1364.38s |  going to include in the deck here I am not because I wrapped it into vivisection. You'll get
1364.38s - 1369.38s |  to see that when I cut the next release. But whoops. Here's the problem. When I did that, code
1370.38s - 1375.38s |  started getting identified. Cross references, strings, like magic was happening and then boom
1381.68s - 1391.04s |  out of memory. I ended up uh analyzing this overnight on a machine where I gave myself an 80
1391.04s - 1396.04s |  gig swap space just to see if it would work. Binja did the same thing. Barfed. And most of my
1397.00s - 1404.01s |  work ended up being on a 500 plus megabyte workspace. Which I don't know about you or how
1408.01s - 1414.03s |  how big your workspaces are but this takes 10 minutes to load. And if I'm doing it over a
1414.03s - 1419.67s |  network because vivisect has a vivisect server and client mode, it takes 45 minutes to load.
1419.67s - 1424.67s |  Okay. Need to work on this one. And we're in uncut territory here. That's fine I guess. So
1428.57s - 1434.57s |  it also makes function recon completely useless. I don't know. I just released function
1434.57s - 1439.15s |  recon in vivisection so you might not have had a chance to use it. But function recon basically
1439.15s - 1444.15s |  straps in a specialized partial emulator into a function. And it follows every code path exactly
1448.39s - 1454.89s |  once. And then every call it does that too and it keeps going and going and going until it runs
1454.91s - 1460.31s |  out of code to hit. And it captures things like what strings did I run into? What function
1460.31s - 1466.61s |  calls did I run to? What named functions did I call? Basically, reconnaissance on what a
1466.61s - 1473.29s |  given subset of a program is going to do. Function recon is worthless on this binary. Or on
1473.29s - 1481.66s |  this workspace. Because I analyzed all of NTDLL and user 32 and kernel 32 and all the things
1481.66s - 1486.42s |  that I really don't give a shit about. Because it turns out we know what that is. That's not
1487.16s - 1492.64s |  obfuscated. That would be a really dirty trick. But I mean, I did check. This is legitimate
1492.64s - 1500.66s |  NTDLL and whatnot. So sometime by next week I could probably get done with function recon. But I
1504.04s - 1510.04s |  think I'd like to make a change and not do that. Oh and I broke the viv server. Didn't not just
1510.24s - 1516.24s |  work, it literally broke it where it would not try to send the data over the network. So I ended
1521.58s - 1532.87s |  up fixing that. That was months ago. So I did wrap this into vivisection because the goal of
1532.87s - 1539.13s |  vivisection is to kill all tedium and brain drain. We need your brains to be able to chew on
1539.15s - 1545.15s |  the more important things, not just do these tedious horrible things. And we focus on
1546.77s - 1553.69s |  starting maps and ending maps for stack. So we look for the pointers here. And we can restrict
1553.69s - 1558.41s |  where the pointers can point to that we care about. So that we can skip NTDLL. We can skip
1558.41s - 1564.41s |  kernel 32 DLL. Then I have a pull request in for the vivisect proper to allow us to turn on
1569.45s - 1576.89s |  what's called one library. So that when you analyze a function and it hits outside that library,
1576.89s - 1583.27s |  it jumps or it calls into NTDLL for example. It just stops. Because the NTDLL is going to have a
1583.27s - 1593.43s |  name and that's kind of how we do reversing, right? So next, once we found strings, we have
1593.43s - 1599.35s |  this one problem. There's no cross references. So the idea is we go to a string and then we have
1599.37s - 1604.75s |  code that references the string. And so the code is instantly interesting to me. Nothing is
1604.75s - 1611.63s |  referring to these strings. We just told them that it was strings. Okay. Now what? Well, while
1611.63s - 1618.23s |  doing this in this particular tool, I noticed that around these groupings of strings that were
1618.23s - 1623.65s |  very interesting to me were a whole bunch of non-strings. And it didn't look like code either.
1623.83s - 1631.83s |  I started seeing a pattern in them. It was number, number, number, zero. Number, number, number,
1631.83s - 1643.83s |  zero. Number, number, number, zero. And in this area of code, the address space is held within
1643.99s - 1653.99s |  24 bits. It is, look at the, the address is 0075D289. In fact, the target binary starts at
1653.99s - 1664.37s |  400,000 hex and ends at like 80A000. That was really interesting to me. And as you can see,
1664.37s - 1673.55s |  these little byte groupings are valid pointers into this target binary address space. So I
1673.57s - 1678.45s |  started going through and just hitting, going to one and hitting P. Make it a pointer. And
1678.45s - 1683.41s |  suddenly that P goes through the analysis process for the pointer and it says, oh, suddenly I'm
1683.41s - 1689.75s |  pointing at a function. Because it starts with the name sub. Oh, that's, that's curious. So I
1689.75s - 1696.01s |  did that with a whole bunch of them. And they were all functions. So much so that I ended up
1696.01s - 1702.47s |  writing a vivisection, actually no, I think I wrapped this into vivisect itself. Writing code
1702.47s - 1705.67s |  that just allows you to make pointers and you just say, here's the start, here's the stop.
1705.67s - 1716.10s |  Just make them all pointers. Turns out there are vast arrays of pointers to a whole ton of
1716.10s - 1725.44s |  code. They end up being virtual function tables for C++. Is that familiar with anyone? C++
1725.44s - 1733.65s |  reversing. Kudos to you. It's not fun. So we end up with these tables of functions that are
1733.65s - 1741.45s |  used, so when you have the class object ball and you want to call the function bounce or get
1741.45s - 1748.53s |  color or change color, they're just held in this table here and the code knows that bounce is
1748.53s - 1756.92s |  offset four into this table. Make sense? And all of a sudden, while I'm digging through here
1756.92s - 1762.26s |  making all sorts of cross, all sorts of pointers, I started seeing cross references to my
1762.26s - 1773.90s |  strings. So now I know some code is referring to security array. I'm getting better. Getting
1773.90s - 1780.90s |  happier. And then I made this, so here's the vivisect code or functionality to create a
1780.90s - 1786.44s |  pointer array. Actually, if you just hold down shift and hit P, capital P is pointer array.
1786.44s - 1791.64s |  Pops up a dialogue. Here's a starting address. Here's a stop address. Or if you'd rather this
1791.64s - 1796.64s |  many, so you can put in a number into the count and it'll ignore the stop address. It'll just do
1796.64s - 1802.62s |  that many. And then if we run into a null pointer, do we care and do we keep going or do we call
1802.62s - 1813.44s |  that the end? So these are all useful to me, and so I put them in here. So the vtable entries, I
1813.44s - 1818.94s |  don't know if you can see that, but the first entry in most virtual tables is called a
1818.94s - 1828.88s |  destructor. C++ programmers? Again? Okay, a number of you. When you create a class, you write code
1828.88s - 1834.92s |  for a constructor and a destructor. When you instantiate the object, it runs the constructor,
1834.92s - 1842.02s |  which basically tells, it sets up the different data structures in place. Creates strings,
1842.02s - 1846.86s |  creates subobjects, other things like that. A destructor is tasked with making sure that
1846.86s - 1852.82s |  everything gets cleaned up appropriately. So if you have a C++ class that has a bunch of
1852.82s - 1859.46s |  strings in it, your destructor will roll through and say, all right, do this destructor thing for
1859.46s - 1866.04s |  the strings here, strings there, strings here and otherwise. Or other C++ objects that are
1866.04s - 1881.82s |  wrapped in. So the destructor is a highly valuable resource. How much time do I have? I'm
1881.82s - 1890.64s |  going faster than I thought. No blood dripping out of your ears? I'm doing good. All right. So
1890.64s - 1895.28s |  when we get involved in C++ analysis, no, don't worry, I'm not going to take you too far down
1895.28s - 1901.68s |  that road. I didn't warn you enough. And it is, actually, it's another talk. I need to give
1901.68s - 1908.76s |  another talk on this particular thing. C++ objects, what creates them? It's really important
1908.76s - 1913.80s |  because once you create a C++ object, you just kind of tote it around. You know, I make the
1913.80s - 1921.16s |  function call over here, here's a C++ object, and the C++ object, the goal for object-oriented
1921.16s - 1926.52s |  programming is that that virtual function table maintains all the logic about how to do
1926.52s - 1932.16s |  everything necessary with that object. So it's kind of self-contained. And then I just say, call
1932.16s - 1937.40s |  this function on here's my ball, you know, or whatever the object is. And then that function
1937.40s - 1944.20s |  says, I know that a ball can do a bounce. I don't have to know what that thing is, you know, what
1944.20s - 1949.88s |  goes into bouncing that ball. I know that I can call bounce on that ball and it'll be good. So
1952.16s - 1959.20s |  tracing V tables, very, very interesting. So about a dozen years ago, I spent some time writing
1959.20s - 1966.88s |  symbolic analysis for structures and building in structure reconstitution, basically. Using a set
1966.88s - 1974.76s |  of code and symbolic data about what the code is doing. And it's a simple or difficult way of
1974.76s - 1984.40s |  saying the symbolic data is this is this pointer plus 12. Instead of this pointer and then a bunch
1984.40s - 1990.72s |  of instructions that modify what that register is doing. The symbolic analysis just traces that and
1990.72s - 2003.48s |  makes it easy for me to say, oh, this is offset 12 into that structure, all golden. So the first
2003.48s - 2009.80s |  thing that I'm wanting to do when I do C++ structure analysis is to go through all the functions in
2009.80s - 2014.96s |  the V table, because the V table lists all functions that know how to do that thing with that
2014.96s - 2027.08s |  ball. Or that diagnostics utility. I then analyze how this pointer is being accessed. And I can
2027.08s - 2033.28s |  identify what things go where in memory. That becomes really important when I'm looking at other
2033.28s - 2046.97s |  code so that I know what offset 12 really means. Other things. As I said, the destructor is very,
2046.97s - 2053.41s |  very powerful. And I don't know if you can see that. This is the first function in one of the V
2053.41s - 2060.41s |  tables we looked at earlier. And it looks really simple. It calls free object. That's what I call
2060.41s - 2067.25s |  it. This is sub underscore some number. So free object. This object. And I like to name things by
2067.25s - 2074.89s |  the address of the virtual function table. And then down here, based on what's returned or
2075.25s - 2081.37s |  based on the arg one, we decide whether or not to decrement and free that object. Okay. Seems
2081.37s - 2089.37s |  simple enough. But free object is where all the really fun magic happens. So free object goes
2089.37s - 2097.05s |  through whatever this class or this object is and does the real dirty magic. You'll notice here
2097.05s - 2104.09s |  something that is often found in dealing with C++ code. At the top of this little box, there's a
2104.09s - 2113.77s |  move D word. So ESI is being used as this pointer right now. And the very first the very first
2113.77s - 2120.69s |  pointer in that object is a pointer to a virtual function table. And one thing that you'll notice
2120.69s - 2128.69s |  is that as C++ code is used in different ways. So, for example, we created the object the class
2128.77s - 2135.25s |  ball. And we have a subclass that inherits from it called basketball. And then another one that
2135.25s - 2139.37s |  is very different that inherits from ball called football. And if you don't know what the
2139.37s - 2145.05s |  difference is there, try to bounce them both. So they both have their own bounce functions. But
2145.05s - 2151.65s |  they're both a ball. So sometimes what we'll do is we'll say, yeah, no, I really want the ball
2151.65s - 2158.99s |  version of bounce. I don't actually want the basketball to have this control. So oftentimes
2159.03s - 2165.95s |  code will jam in the appropriate virtual function table for that when your when your code
2165.95s - 2172.95s |  asks for that. So as we're going through this free object, ignore the top. It's basically just
2173.23s - 2179.63s |  memory protection things. So we we jam in this virtual table. I just call it six because I
2179.63s - 2185.87s |  didn't know what to do with it at that point. We then move 16 into EDI. That'll be important
2185.87s - 2196.95s |  very, very shortly. We compare EDI to this this plus 608, this six plus this 608 offset. I'll
2196.95s - 2202.83s |  tell you in advance the spoilers. It's a string. It's a C++ string, which is not like your
2202.83s - 2212.56s |  ASCII string. We then move seven into a local variable and move on. And based on whether or
2212.56s - 2221.68s |  not this offset into that this string basically the size of the string is being compared
2221.68s - 2231.08s |  against 16. If the string is 16 bytes or more, C++ will create a new object of the right size or
2231.08s - 2238.04s |  something that's flexible and move the string into that. If the string is less than 16 bytes,
2238.04s - 2244.96s |  then there's enough room in the C++ structure for a string to just house the string. So this
2244.96s - 2251.68s |  is why I know this is a string. And that's a very common element for C++ reversing. So we
2251.68s - 2257.72s |  come down here. If it's greater if it's 16 bytes or greater, then I know that I have a
2257.72s - 2264.20s |  pointer to the thing that actually holds the ASCII string. So I free that. And then I move
2264.20s - 2272.40s |  down to the next thing. And I compare 15 or I move 15 into EBP. And I shove that all over to
2272.40s - 2278.60s |  make sure that this string that we are in the process of deconstructing doesn't ever do that
2278.60s - 2285.00s |  again. So it's as soon as we free that memory, we say it's okay, it's 15. That's not true.
2285.00s - 2290.24s |  Actually, it's going to be zero. We're going to delete it. But as it moves down, compare EDI
2290.24s - 2298.16s |  against another offset. So some other string. We go down because EDI is still 16. So we
2298.16s - 2310.62s |  actually see in this particular object multiple points of clearly this is a string. In fact, we
2310.62s - 2316.62s |  then run into another embedded object that's special. And we call some code to clean it up. I
2316.62s - 2321.74s |  won't go into right now. But then we do another thing. Hey, compare this thing against EDI. EDI
2321.74s - 2331.42s |  is still 16. And if it's less than or if it's greater than 16, call decrement and free. And so
2331.42s - 2345.41s |  on and so forth. So just to recap C++ reconstitution approach. Look for a whole bunch of
2345.41s - 2353.88s |  function pointers. All grouped together. Look for cross references to the start of the branch.
2353.88s - 2360.24s |  Is that the beginning of a bunch of pointers? Is that the beginning of a virtual function table?
2360.24s - 2369.16s |  Very likely. Kind of investigation is the right key there. Analyze those functions for how they
2369.16s - 2374.80s |  deal with the this pointer that's handed in. And every call and convention on every architecture
2374.80s - 2380.72s |  has its own this pointer argument. Typically, it's the first one. On 32-bit, you see a lot of
2380.72s - 2386.64s |  this call that's ECX. That's why you're seeing that here. So analyze the first function in the
2386.64s - 2394.95s |  virtual function table. If it's a destructor, it will tell you almost everything else that you
2394.95s - 2403.86s |  really need to know. And then make good use of it. I hope you didn't come here expecting Oday.
2403.86s - 2410.18s |  That wasn't my bent. I'm a mentor. Hopefully I've taught you how to fish. Go fish for
2410.18s - 2418.58s |  yourself. So the real conclusion. Think outside the box. Make your tools do new things. If your
2418.58s - 2424.90s |  tools are incapable of doing new things, make your own tools. Understand why things work the way
2424.90s - 2433.54s |  they do. Because that leads you to be more powerful. Then go hunting. Figure out what you
2433.54s - 2441.94s |  think the code or the behavior should look like. And use your brain to create new tooling. Use
2441.94s - 2448.58s |  the existing tooling in creative new ways. Because you're the real power. Go forth and do
2448.58s - 2449.14s |  great things.


url: https://www.youtube.com/watch?v=tA7bpp8qXxI
title: DEF CON 32 - How To Keep IoT From Becoming An IoTrash - Roberts, Wysopal, Doctorow, Wheeler, Giese
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=tA7bpp8qXxI",
  "title": "DEF CON 32 - How To Keep IoT From Becoming An IoTrash - Roberts, Wysopal, Doctorow, Wheeler, Giese",
  "description": "In a world where technology and software are intertwined with our daily lives more than ever, a silent threat grows in the shadows.\n\nEnd-of-life devices\u2014abandoned by manufacturers - power our homes, hospitals, businesses and critical infrastructure. From the depths of the cyber underground, malicious software from cybercriminal and nation-state actors is seizing these forgotten devices and conscripting them into botnets and other malicious infrastructure.\n\nFor example, Black Lotus Labs revealed a chilling trend: 40,000 small office home office (SOHO) routers compromised and enrolled in the sinister 'Faceless' botnet - now powered by devices you own and thought were safe.\n\nAnd it's not just routers. Critical medical devices, essential security hardware\u2014smart home appliances. No gadget is safe. And, with the Internet of Things set to double in the next decade, billions of vulnerable devices marketed and sold to connect us risk robbing, dividing and defeating us in the years to come: a process one expert has termed \u201censhittification.\u201d\n\nAfter years of warnings from the cybersecurity community, alarms are finally sounding in the halls of power. But more is needed: a clarion call to reset, to redefine ownership and security in an age of smart, connected devices before it's too late.\n\nIn this panel you\u2019ll be enlisted to join the fight. You\u2019ll hear from experts working at the forefront of a fight to challenge the status quo and seek solutions to safeguard our digital futures.Are you ready to stand up for your right to a secure, connected world? The battle for control, for transparency- for a sustainable and resilient digital future begins now!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2803,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.78s - 2.78s | This text was transcribed using whisper model: large-v2

 Wow, whoo
6.88s - 8.28s |  Blast off
8.28s - 9.68s |  All right
9.68s - 14.96s |  Thank you everyone for joining us here for our talk this afternoon
15.52s - 21.06s |  Bricked and abandoned how to keep the IOT or the Internet of Things from becoming an Internet of trash
21.64s - 25.24s |  My name is Paul Roberts, and I'm going to be moderating our discussion today
25.24s - 29.40s |  I am the publisher and editor-in-chief at the security ledger
29.80s - 33.20s |  I'm the head of editorial content at reversing labs
33.20s - 38.12s |  And I'm also the founder of a new nonprofit called surf the secure resilient future foundation
38.12s - 40.12s |  We're going to talk a little bit more about that later
40.24s - 45.28s |  But our conversation today is going to focus on the problem of abandon where an end-of-life
45.64s - 50.72s |  Devices the idea behind this panel really came out of work that I and others on this panel have done
51.24s - 54.80s |  on the issue of the right to repair our stuff and
55.32s - 58.80s |  Tara and Corey have both been involved in that movement and
59.52s - 64.80s |  There that's a project that has shown had some real successes in the last few years
65.68s - 67.68s |  Five states have enacted
68.28s - 69.48s |  comprehensive
69.48s - 71.48s |  electronics right to repair laws
71.52s - 73.52s |  and yep in
75.24s - 76.88s |  Including
76.88s - 78.68s |  home appliances
78.68s - 82.44s |  iPads iPhones and most recently in Colorado
83.04s - 88.88s |  I'm sorry about that. I don't know what happened
89.60s - 97.88s |  Most recently in Colorado agricultural devices farm equipment as well as b2b devices so Cisco routers and stuff that you sell to companies
98.88s - 104.68s |  Lobbyists had done a good job getting carve-outs for that, but Colorado just passed a law that includes that so that's great
106.48s - 110.64s |  Colorado Oregon band practices like part serialization and part pairing
111.04s - 118.08s |  And that's wonderful, but even with the right to repair and this is kind of where this panel comes from we still have
118.84s - 120.84s |  issues and
122.08s - 126.76s |  Consumers businesses and communities are still finding themselves at the mercy of
127.48s - 131.96s |  manufacturers and that's because our current mix or mess depending on how you look at it of
132.28s - 138.36s |  IP and copyright laws and policies as well as decades of kind of a hands-off approach to
139.16s - 146.92s |  market consolidation by our government give companies these days a pretty wide latitude when they sell a smart product to the
147.28s - 152.44s |  public and I'll just kind of use the example that I and many others have used which is you might go out to
152.76s - 159.64s |  Best Buy and buy a smart refrigerator with a touchscreen panel that hardware might have a useful life of a couple decades
160.20s - 161.64s |  or more
161.64s - 166.68s |  The software, you know, maybe they're gonna support it for three years five years something like that
166.76s - 174.52s |  But that's the extent of their commitment to that product. So what's going on over there?
176.32s - 177.64s |  So
177.64s - 183.12s |  that's kind of the the gist or the heart of what we're gonna be talking about today and
183.80s - 189.64s |  To get us started. I think it's a good idea to introduce our panelists. We got an amazing panel and
190.40s - 192.40s |  let them I'm gonna
192.56s - 198.92s |  Introduce them and then just let them say hi to you and then we'll get going so immediately to my left is mr
198.92s - 205.40s |  Chris Weiss Opal Chris is the CTO of Veracode a provider of application security and testing technology
205.40s - 210.56s |  He began his career as a vulnerability researcher and renowned hacker with the loft in
211.32s - 216.96s |  1998 Chris and six of his loft colleagues including much who was talking in this room earlier today
217.52s - 222.12s |  Testified before the US Senate on matters of US government cyber security and
222.68s - 224.24s |  Chris welcome
224.24s - 226.24s |  Thanks, Paul. Great to be here
226.48s - 232.25s |  All right next to Chris. We have the amazing Tara Wheeler
232.77s - 240.09s |  Tara is the founder and CEO of Red Queen Dynamics and a senior fellow in global global cyber policy at the Council of Foreign Relations
240.33s - 247.85s |  And a well-known speaker and writer on topics that include cyber warfare security best practices future trends and more
247.93s - 249.49s |  Tara
249.49s - 251.49s |  Thank you so much. It's a pleasure to be here
254.08s - 256.52s |  Next to Tara. We have Cory Doctorow
256.52s - 261.24s |  I think all of us know Cory's a science fiction writer author activist and journalist and
261.44s - 266.28s |  The author of many books most recently the bezel and the lost cause in 2020
266.28s - 272.52s |  He was inducted into the Canadian Science Fiction and Fantasy Hall of Fame. I probably missed a more recent book, but
276.96s - 279.88s |  He you blow me away, yeah
283.76s - 290.76s |  I'm blown away by how many how much you've written and next to Cory Dennis keys who is a researcher with a focus on
292.36s - 295.44s |  The cyber security and privacy of Internet of Things devices
295.44s - 302.72s |  he is best known for his research on these security of vacuum robots and method and
303.32s - 308.72s |  Methods which we're going to talk about for liberating these devices and user data for manufacturer control Dennis
313.87s - 315.35s |  Okay
315.35s - 321.41s |  Hold on. How do I control this large? Okay. There we go
322.41s - 323.53s |  so
323.53s - 329.37s |  You know the backstory for this panel, right is we have an epidemic of end-of-life devices
329.37s - 334.89s |  And it's an epidemic that is going to grow in proportion to the growth of the Internet of Things
335.85s - 339.77s |  29 billion IOT devices are projected by 2030
340.33s - 342.81s |  They're probably more than 20 billion now
343.33s - 346.49s |  And as I said with the kind of smart refrigerator
346.49s - 354.05s |  There's a divergence between the useful life of hardware measured in decades and software support may be measured in years maybe months
354.53s - 358.41s |  And there are currently aren't any laws in the u.s
358.65s - 366.33s |  Anyway that mandate periods of support so end-of-life decisions for devices are really driven by bottom-line concerns for the manufacturers
366.49s - 371.13s |  You know the age of the product product, you know the profitability of the product the cost of maintenance
371.65s - 375.77s |  Not informed by things that should matter like the useful life of the hardware
376.29s - 380.53s |  the cost of replacement for the consumer who purchased the device or
381.17s - 387.65s |  Even more importantly the cost to our planet of e-waste that ends up in landfills and poisons our environment
388.01s - 395.65s |  As well as you know kind of the security risks of unsupported and end-of-life devices which are becoming a more prevalent issue
395.69s - 397.49s |  More prevalent issue
397.49s - 403.93s |  so but behind all of this is this kind of bigger phenomena of what Corey has really
404.33s - 406.33s |  wonderfully termed in shitification
407.89s - 409.33s |  Which is a
409.33s - 415.05s |  Phenomenon that is a growing phenomenon and I thought I'd just turn the mic over to Corey just Corey if you could just talk
415.05s - 417.85s |  To the audience what is in shitification and you know?
455.65s - 457.65s |  60,000 people in 2023
457.65s - 459.65s |  Another 100,000 this year
459.65s - 461.65s |  Interesting concept this year
461.65s - 463.65s |  It used to be that when the boss told you to make something garbage
463.65s - 465.65s |  You could tell your boss to go fuck himself
465.65s - 467.65s |  Cause some of them would give you a job
467.65s - 469.65s |  And your boss could find someone else to do your job
469.65s - 477.65s |  Well these days all of the sources of discipline that used to stop your boss from going to a shitification laboratory
477.65s - 479.65s |  Making them have to go all the way to 100
479.65s - 481.65s |  All of those courses he melts it away
481.65s - 483.65s |  And so we have these platforms
483.65s - 485.65s |  That are getting more and more politically worse
485.65s - 487.65s |  I'm not shouting at this for a hundred hours
487.65s - 489.65s |  But I need you to keep this word with your people
489.65s - 491.65s |  Yeah
491.65s - 493.65s |  That's right there's
493.65s - 495.65s |  Put it on your calendar
495.65s - 497.65s |  There's a much longer discussion of shitification
497.65s - 499.65s |  But Corey thank you
499.65s - 501.65s |  I think the other piece of this
501.65s - 503.65s |  So is that
503.65s - 505.65s |  These are not problems that are
505.65s - 507.65s |  Specific I mean these are not
507.65s - 509.65s |  This is not just a consumer rights issue
509.65s - 511.65s |  Or a you know
511.65s - 513.65s |  Access issue it's also increasingly
513.65s - 515.65s |  As I said a cyber security issue
515.65s - 517.65s |  We're at Defcon here
517.65s - 519.65s |  It's a cyber security conference
519.65s - 521.65s |  And so these issues are you know
521.65s - 523.65s |  Forefront in our mind
523.65s - 525.65s |  Chris could you just talk about
525.65s - 527.65s |  Kind of how the
527.65s - 529.65s |  You know these issues with end of life
529.65s - 531.65s |  And abandoned devices
531.65s - 533.65s |  Impact cyber security not just for
533.65s - 535.65s |  Consumers but for businesses as well
535.65s - 537.65s |  Right so
537.65s - 539.65s |  We all know that a lot of software is built
539.65s - 541.65s |  Insecure by design right
541.65s - 543.65s |  That's why we all find vulnerabilities
543.65s - 545.65s |  In the stuff that's out in the field
545.65s - 547.65s |  And there's lots of reasons for that
547.65s - 549.65s |  It's basically a business decision
549.65s - 551.65s |  That the manufacturers make
551.65s - 553.65s |  Not to invest in security
553.65s - 555.65s |  And there's no incentives for them
555.65s - 557.65s |  To do that especially if it's like
557.65s - 559.65s |  An off brand device or an inexpensive device
559.65s - 561.65s |  You're going to get less security
561.65s - 563.65s |  But if it has an IP address
563.65s - 565.65s |  And it's on the internet
565.65s - 567.65s |  That's what attackers
567.65s - 569.65s |  Like to use it for
569.65s - 571.65s |  To maybe create a DDoS
571.65s - 573.65s |  Botnet like we saw with Mirai
573.65s - 575.65s |  Or more recently
575.65s - 577.65s |  We've seen with the Volt Typhoon
577.65s - 579.65s |  And the KV Botnet
579.65s - 581.65s |  Where it was Soho routers
581.65s - 583.65s |  That were end of life
583.65s - 585.65s |  That were leveraged
585.65s - 587.65s |  To hide
587.65s - 589.65s |  Attacks it's actually
589.65s - 591.65s |  A great way for attackers
591.65s - 593.65s |  To hide where they're coming from
593.65s - 595.65s |  Because they can appear to come from
595.65s - 597.65s |  A network that's close
597.65s - 599.65s |  To the target because
599.65s - 601.65s |  These devices are everywhere
601.65s - 603.65s |  And in Volt Typhoon it actually
603.65s - 605.65s |  Was in Guam
605.65s - 607.65s |  Chinese hackers hacked
607.65s - 609.65s |  These Soho routers
609.65s - 611.65s |  And they were able to
611.65s - 613.65s |  Appear like they were just coming from Guam
613.65s - 615.65s |  Right so when they were attacking
615.65s - 617.65s |  ICS infrastructure
617.65s - 619.65s |  So that's just sort of
619.65s - 621.65s |  A present threat that we get
621.65s - 623.65s |  It's an environmental threat
623.65s - 625.65s |  That harms the ecosystem
625.65s - 627.65s |  That we all rely on
627.65s - 629.65s |  If you're a defender
629.65s - 631.65s |  It's harder to defend if it looks like
631.65s - 633.65s |  It's coming from one of your employees
633.65s - 635.65s |  Working from home right
635.65s - 637.65s |  Because it's coming from a home router
637.65s - 639.65s |  From a local isp
639.65s - 641.65s |  So this effect where
641.65s - 643.65s |  No incentives for these manufacturers
643.65s - 645.65s |  To actually build security in
645.65s - 647.65s |  And invest in doing that
647.65s - 649.65s |  Leads to us all having
649.65s - 651.65s |  Worse security
651.65s - 653.65s |  The other reasons that they
653.65s - 655.65s |  Have a problem doing this is because
655.65s - 657.65s |  Building secure software is hard
657.65s - 659.65s |  Right it actually takes expertise
659.65s - 661.65s |  It takes investing time
661.65s - 663.65s |  And tooling and actually the tooling
663.65s - 665.65s |  Isn't as good in the firmware space
665.65s - 667.65s |  As it is in some of the general purpose
667.65s - 669.65s |  Windows and Linux software
669.65s - 671.65s |  Spaces when you're dealing with these
671.65s - 673.65s |  Embedded devices the tooling's not as good
673.65s - 675.65s |  You have to rely on manual
675.65s - 677.65s |  Penetration testings and manual
677.65s - 679.65s |  Code review more
679.65s - 681.65s |  So these drive up the cost
681.65s - 683.65s |  So there's less incentives to
683.65s - 685.65s |  Spend the money
685.65s - 687.65s |  The other thing i want to mention though is
687.65s - 689.65s |  The cost of updating
689.65s - 691.65s |  There's a cost to updating software
691.65s - 693.65s |  And we know
693.65s - 695.65s |  If you find vulnerabilities
695.65s - 697.65s |  After you ship the product you're going to have to
697.65s - 699.65s |  Update the software and updating
699.65s - 701.65s |  Iot devices is actually harder
701.65s - 703.65s |  Than updating general purpose software like chrome
703.65s - 705.65s |  And windows
705.65s - 707.65s |  And mac and things like that
707.65s - 709.65s |  Because when you have a failure mode you don't
709.65s - 711.65s |  Have a great interface for someone to deal with it
711.65s - 713.65s |  Right so you have to invest a lot
713.65s - 715.65s |  More for these robust
715.65s - 717.65s |  Update process that is less prone
717.65s - 719.65s |  To failure
719.65s - 721.65s |  And you're doing this on devices that are
721.65s - 723.65s |  Inexpensive
723.65s - 725.65s |  So we just have a complete mismatch
725.65s - 727.65s |  Of incentives when it comes to
727.65s - 729.65s |  Especially inexpensive devices
729.65s - 731.65s |  And some of these soho routers are like 100 bucks
731.65s - 733.65s |  Right so there's not a lot of
733.65s - 735.65s |  Incentives to invest in security
735.65s - 737.65s |  So i mean i think one of the
737.65s - 739.65s |  Things that is
739.65s - 741.65s |  You know kind of picking up on what chris what you
741.65s - 743.65s |  Were saying is you know
743.65s - 745.65s |  Obviously this hugely
745.65s - 747.65s |  Growing internet of things it's
747.65s - 749.65s |  Working its way into our homes into our
749.65s - 751.65s |  Businesses into sensitive environments
751.65s - 753.65s |  Obviously but it's really
753.65s - 755.65s |  Sort of from a security
755.65s - 757.65s |  And you know
757.65s - 759.65s |  Quality standpoint a black box
759.65s - 761.65s |  Which is why i wanted dennis keys on
761.65s - 763.65s |  This panel because more than
763.65s - 765.65s |  Most other people in this planet
765.65s - 767.65s |  Dennis has familiarized don't
767.65s - 769.65s |  Yes that's true dennis don't don't be
769.65s - 771.65s |  Humble has peered deeply
771.65s - 773.65s |  Into the workings of smart
773.65s - 775.65s |  Connected devices
775.65s - 777.65s |  Vacuum robots and smart
777.65s - 779.65s |  Doorbells and you name it
779.65s - 781.65s |  So dennis if you could just kind
781.65s - 783.65s |  Of tell us a little bit just give us
783.65s - 785.65s |  A sense of under the hood
785.65s - 787.65s |  Of these connected devices
787.65s - 789.65s |  Whether they're end of life or not end of life
789.65s - 791.65s |  What are the types of things that you're finding
791.65s - 793.65s |  And what are the types of you know problems
793.65s - 795.65s |  That exist out there
824.91s - 826.91s |  One thing that i noticed
826.91s - 828.91s |  Was that all the
828.91s - 830.91s |  Recycling
850.91s - 852.91s |  One thing
852.91s - 854.91s |  In
854.91s - 856.91s |  Circles
866.91s - 868.91s |  But
868.91s - 870.91s |  It's
870.91s - 872.91s |  Important
872.91s - 874.91s |  So like
874.91s - 876.91s |  This
876.91s - 878.91s |  Is
878.91s - 880.91s |  Not the same
880.91s - 882.91s |  As
882.91s - 884.91s |  The
884.91s - 886.91s |  One
886.91s - 888.91s |  That
888.91s - 890.91s |  Is
890.91s - 892.91s |  The
892.91s - 894.91s |  One
894.91s - 896.91s |  That
896.91s - 898.91s |  Is
898.91s - 900.91s |  The
900.91s - 902.91s |  One
902.91s - 904.91s |  That
904.91s - 906.91s |  Is
906.91s - 908.91s |  The
908.91s - 910.91s |  One
910.91s - 912.91s |  That
912.91s - 914.91s |  Is
914.91s - 916.91s |  The
916.91s - 918.91s |  One
918.91s - 920.91s |  That
920.91s - 922.91s |  Is
922.91s - 924.91s |  The
924.91s - 926.91s |  One
926.91s - 928.91s |  That
928.91s - 930.91s |  Is
930.91s - 932.91s |  The
932.91s - 934.91s |  One
934.91s - 936.91s |  That
936.91s - 938.91s |  Is
938.91s - 940.91s |  The
940.91s - 942.91s |  One
942.91s - 944.91s |  That
944.91s - 946.91s |  Is
946.91s - 948.91s |  The
948.91s - 950.91s |  One
950.91s - 952.91s |  That
952.91s - 954.91s |  Is
954.91s - 956.91s |  The
956.91s - 958.91s |  One
958.91s - 960.91s |  That
960.91s - 962.91s |  Is
962.91s - 964.91s |  The
964.91s - 966.91s |  One
966.91s - 968.91s |  That
968.91s - 970.91s |  Is
970.91s - 972.91s |  The
972.91s - 974.91s |  One
974.91s - 976.91s |  That
976.91s - 978.91s |  Is
978.91s - 980.91s |  The
980.91s - 982.91s |  One
982.91s - 984.91s |  That
984.91s - 986.91s |  Is
986.91s - 988.91s |  The
988.91s - 990.91s |  One
990.91s - 992.91s |  That
992.91s - 994.91s |  Is
994.91s - 996.91s |  The
996.91s - 998.91s |  One
998.91s - 1000.91s |  That
1000.91s - 1002.91s |  Is
1002.91s - 1004.91s |  The
1004.91s - 1006.91s |  One
1006.91s - 1008.91s |  That
1008.91s - 1010.91s |  Is
1010.91s - 1012.91s |  The
1012.91s - 1014.91s |  One
1014.91s - 1016.91s |  That
1016.91s - 1018.91s |  Is
1018.91s - 1020.91s |  The
1020.91s - 1022.91s |  One
1022.91s - 1024.91s |  That
1024.91s - 1026.91s |  Is
1026.91s - 1028.91s |  The
1028.91s - 1030.91s |  One
1030.91s - 1032.91s |  That
1032.91s - 1034.91s |  Is
1034.91s - 1036.91s |  The
1036.91s - 1038.91s |  One
1038.91s - 1040.91s |  That
1040.91s - 1042.91s |  Is
1042.91s - 1044.91s |  The
1044.91s - 1046.91s |  One
1046.91s - 1048.91s |  That
1048.91s - 1050.91s |  Is
1050.91s - 1052.91s |  The
1052.91s - 1054.91s |  One
1054.91s - 1056.91s |  That
1056.91s - 1058.91s |  Is
1058.91s - 1060.91s |  The
1060.91s - 1062.91s |  One
1062.91s - 1064.91s |  That
1064.91s - 1066.91s |  Is
1066.91s - 1068.91s |  The
1068.91s - 1070.91s |  One
1070.91s - 1072.91s |  That
1072.91s - 1074.91s |  Is
1074.91s - 1076.91s |  The
1076.91s - 1078.91s |  One
1078.91s - 1080.91s |  That
1080.91s - 1082.91s |  Is
1082.91s - 1084.91s |  The
1084.91s - 1086.91s |  One
1086.91s - 1088.91s |  That
1088.91s - 1090.91s |  Is
1090.91s - 1092.91s |  The
1092.91s - 1094.91s |  One
1094.91s - 1096.91s |  That
1096.91s - 1098.91s |  Is
1098.91s - 1100.91s |  The
1100.91s - 1102.91s |  One
1102.91s - 1104.91s |  That
1104.91s - 1106.91s |  Is
1106.91s - 1108.91s |  The
1108.91s - 1110.91s |  One
1110.91s - 1112.91s |  That
1112.91s - 1114.91s |  Is
1114.91s - 1116.91s |  The
1116.91s - 1118.91s |  One
1118.91s - 1120.91s |  That
1120.91s - 1122.91s |  Is
1122.91s - 1124.91s |  The
1124.91s - 1126.91s |  One
1126.91s - 1128.91s |  That
1128.91s - 1130.91s |  Is
1130.91s - 1132.91s |  The
1132.91s - 1134.91s |  One
1134.91s - 1136.91s |  That
1136.91s - 1138.91s |  Is
1138.91s - 1140.91s |  The
1140.91s - 1142.91s |  One
1142.91s - 1144.91s |  That
1144.91s - 1146.91s |  Is
1146.91s - 1148.91s |  The
1148.91s - 1150.91s |  One
1150.91s - 1152.91s |  That
1152.91s - 1154.91s |  Is
1154.91s - 1156.91s |  The
1156.91s - 1158.91s |  One
1158.91s - 1160.91s |  That
1160.91s - 1164.35s |  Is
1164.35s - 1166.35s |  The
1166.35s - 1168.35s |  One
1168.35s - 1170.35s |  That
1170.35s - 1172.35s |  Is
1172.35s - 1174.35s |  The
1174.35s - 1176.35s |  One
1176.35s - 1178.35s |  That
1178.35s - 1180.35s |  Is
1180.35s - 1182.35s |  The
1182.35s - 1184.35s |  One
1184.35s - 1186.35s |  That
1186.35s - 1188.35s |  Is
1188.35s - 1190.35s |  The
1190.35s - 1192.35s |  One
1192.35s - 1194.35s |  That
1194.35s - 1196.35s |  Is
1196.35s - 1198.35s |  The
1198.35s - 1200.35s |  One
1200.35s - 1202.35s |  That
1202.35s - 1204.35s |  Is
1204.35s - 1206.35s |  The
1206.35s - 1208.35s |  One
1208.35s - 1210.35s |  That
1210.35s - 1212.35s |  Is
1212.35s - 1214.35s |  The
1214.35s - 1216.35s |  One
1216.35s - 1218.35s |  That
1218.35s - 1220.35s |  Is
1220.35s - 1222.35s |  The
1222.35s - 1224.35s |  One
1224.35s - 1226.35s |  That
1226.35s - 1228.35s |  Is
1228.35s - 1230.35s |  The
1230.35s - 1232.35s |  One
1232.35s - 1234.35s |  That
1234.35s - 1236.35s |  Is
1236.35s - 1238.35s |  The
1238.35s - 1240.35s |  One
1240.35s - 1242.35s |  That
1242.35s - 1244.35s |  Is
1244.35s - 1246.35s |  The
1246.35s - 1248.35s |  One
1248.35s - 1250.35s |  That
1250.35s - 1252.35s |  Is
1252.35s - 1254.35s |  The
1254.35s - 1256.35s |  One
1256.35s - 1258.35s |  That
1258.35s - 1260.35s |  Is
1260.35s - 1262.35s |  The
1262.35s - 1264.35s |  One
1264.35s - 1266.35s |  That
1266.35s - 1268.35s |  Is
1268.35s - 1270.35s |  The
1270.35s - 1272.35s |  One
1272.35s - 1274.35s |  That
1274.35s - 1276.35s |  Is
1276.35s - 1278.35s |  The
1278.35s - 1280.35s |  One
1280.35s - 1282.35s |  That
1282.35s - 1284.35s |  Is
1284.35s - 1286.35s |  The
1286.35s - 1288.35s |  One
1288.35s - 1290.35s |  That
1290.35s - 1292.35s |  Is
1292.35s - 1294.35s |  The
1294.35s - 1296.35s |  One
1296.35s - 1298.35s |  That
1298.35s - 1300.35s |  Is
1300.35s - 1302.35s |  The
1302.35s - 1304.35s |  One
1304.35s - 1306.35s |  That
1306.35s - 1308.35s |  Is
1308.35s - 1310.35s |  The
1310.35s - 1312.35s |  One
1312.35s - 1314.35s |  That
1314.35s - 1316.35s |  Is
1316.35s - 1318.35s |  The
1318.35s - 1320.35s |  One
1320.35s - 1322.35s |  That
1322.35s - 1324.35s |  Is
1324.35s - 1326.35s |  The
1326.35s - 1328.35s |  One
1328.35s - 1330.35s |  That
1330.35s - 1332.35s |  Is
1332.35s - 1334.35s |  The
1334.35s - 1336.35s |  One
1336.35s - 1338.35s |  That
1338.35s - 1340.35s |  Is
1340.35s - 1342.35s |  The
1342.35s - 1344.35s |  One
1344.35s - 1346.35s |  That
1346.35s - 1348.35s |  Is
1348.35s - 1350.35s |  The
1350.35s - 1352.35s |  One
1352.35s - 1354.35s |  That
1354.35s - 1356.35s |  Is
1356.35s - 1358.35s |  The
1358.35s - 1360.35s |  One
1360.35s - 1362.35s |  That
1362.35s - 1364.35s |  Is
1364.35s - 1366.35s |  The
1366.35s - 1368.35s |  One
1368.35s - 1370.35s |  That
1370.35s - 1372.35s |  Is
1372.35s - 1374.35s |  The
1374.35s - 1376.35s |  One
1376.35s - 1378.35s |  That
1378.35s - 1380.35s |  Is
1380.35s - 1382.35s |  The
1382.35s - 1384.35s |  One
1384.35s - 1386.35s |  That
1386.35s - 1388.35s |  Is
1388.35s - 1390.35s |  The
1390.35s - 1392.35s |  One
1392.35s - 1394.35s |  That
1394.35s - 1396.35s |  Is
1396.35s - 1398.35s |  The
1398.35s - 1400.35s |  One
1400.35s - 1402.35s |  That
1402.35s - 1404.35s |  Is
1404.35s - 1406.35s |  The
1406.35s - 1408.35s |  One
1408.35s - 1410.35s |  That
1410.35s - 1412.35s |  Is
1412.35s - 1414.35s |  The
1414.35s - 1416.35s |  One
1416.35s - 1418.35s |  That
1418.35s - 1420.35s |  Is
1420.35s - 1422.35s |  The
1422.35s - 1424.35s |  One
1424.35s - 1426.35s |  That
1426.35s - 1428.35s |  Is
1428.35s - 1430.35s |  The
1430.35s - 1432.35s |  One
1432.35s - 1434.35s |  That
1434.35s - 1436.35s |  Is
1436.35s - 1438.35s |  The
1438.35s - 1440.35s |  One
1440.35s - 1442.35s |  That
1442.35s - 1444.35s |  Is
1444.35s - 1446.35s |  The
1446.35s - 1448.35s |  One
1448.35s - 1450.35s |  That
1450.35s - 1452.35s |  Is
1452.35s - 1454.35s |  The
1454.35s - 1456.35s |  One
1456.35s - 1458.35s |  That
1458.35s - 1460.35s |  Is
1460.35s - 1462.35s |  The
1462.35s - 1464.35s |  One
1464.35s - 1466.35s |  That
1466.35s - 1468.35s |  Is
1468.35s - 1470.35s |  The
1470.35s - 1472.35s |  One
1472.35s - 1474.35s |  That
1474.35s - 1476.35s |  Is
1476.35s - 1478.35s |  The
1478.35s - 1480.35s |  One
1480.35s - 1482.35s |  That
1482.35s - 1484.35s |  Is
1484.35s - 1486.35s |  The
1486.35s - 1488.35s |  One
1488.35s - 1490.35s |  That
1490.35s - 1492.35s |  Is
1492.35s - 1494.35s |  The
1494.35s - 1496.35s |  One
1496.35s - 1498.35s |  That
1498.35s - 1500.35s |  Is
1500.35s - 1502.35s |  The
1502.35s - 1504.35s |  One
1504.35s - 1506.35s |  That
1506.35s - 1508.35s |  Is
1508.35s - 1510.35s |  The
1510.35s - 1512.35s |  One
1512.35s - 1514.35s |  That
1514.35s - 1516.35s |  Is
1516.35s - 1518.35s |  The
1518.35s - 1520.35s |  One
1520.35s - 1522.35s |  That
1522.35s - 1524.35s |  Is
1524.35s - 1526.35s |  The
1526.35s - 1528.35s |  One
1528.35s - 1530.35s |  That
1530.35s - 1532.35s |  Is
1532.35s - 1534.35s |  The
1534.35s - 1536.35s |  One
1536.35s - 1538.35s |  That
1538.35s - 1540.35s |  Is
1540.35s - 1542.35s |  The
1542.35s - 1544.35s |  One
1544.35s - 1546.35s |  That
1546.35s - 1548.35s |  Is
1548.35s - 1550.35s |  The
1550.35s - 1552.35s |  One
1552.35s - 1554.35s |  That
1554.35s - 1556.35s |  Is
1556.35s - 1558.35s |  The
1558.35s - 1560.35s |  One
1560.35s - 1562.35s |  That
1562.35s - 1564.35s |  Is
1564.35s - 1566.35s |  The
1566.35s - 1568.35s |  One
1568.35s - 1570.35s |  That
1570.35s - 1572.35s |  Is
1572.35s - 1574.35s |  The
1574.35s - 1576.35s |  One
1576.35s - 1578.35s |  That
1578.35s - 1580.35s |  Is
1580.35s - 1582.35s |  The
1582.35s - 1584.35s |  One
1584.35s - 1586.35s |  That
1586.35s - 1588.35s |  Is
1588.35s - 1590.35s |  The
1590.35s - 1592.35s |  One
1592.35s - 1594.35s |  That
1594.35s - 1596.35s |  Is
1596.35s - 1598.35s |  The
1598.35s - 1600.35s |  One
1600.35s - 1602.35s |  That
1602.35s - 1604.35s |  Is
1604.35s - 1606.35s |  The
1606.35s - 1608.35s |  One
1608.35s - 1610.35s |  That
1610.35s - 1612.35s |  Is
1612.35s - 1614.35s |  The
1614.35s - 1616.35s |  One
1616.35s - 1618.35s |  That
1618.35s - 1620.35s |  Is
1620.35s - 1622.35s |  The
1622.35s - 1624.35s |  One
1624.35s - 1626.35s |  That
1626.35s - 1628.35s |  Is
1628.35s - 1630.35s |  The
1630.35s - 1632.35s |  One
1632.35s - 1634.35s |  That
1634.35s - 1636.35s |  Is
1636.35s - 1638.35s |  The
1638.35s - 1640.35s |  One
1640.35s - 1642.35s |  That
1642.35s - 1644.35s |  Is
1644.35s - 1646.35s |  The
1646.35s - 1648.35s |  One
1648.35s - 1650.35s |  That
1650.35s - 1652.35s |  Is
1652.35s - 1654.35s |  The
1654.35s - 1656.35s |  One
1656.35s - 1658.35s |  That
1658.35s - 1660.35s |  Is
1660.35s - 1662.35s |  The
1662.35s - 1664.35s |  One
1664.35s - 1666.35s |  That
1666.35s - 1668.35s |  Is
1668.35s - 1670.35s |  The
1670.35s - 1672.35s |  One
1672.35s - 1674.35s |  That
1674.35s - 1676.35s |  Is
1676.35s - 1678.35s |  The
1678.35s - 1680.35s |  One
1680.35s - 1682.35s |  That
1682.35s - 1684.35s |  Is
1684.35s - 1686.35s |  The
1686.35s - 1688.35s |  One
1688.35s - 1690.35s |  That
1690.35s - 1692.35s |  Is
1692.35s - 1694.35s |  The
1694.35s - 1698.66s |  One
1698.66s - 1706.77s |  That
1706.77s - 1708.77s |  Is
1708.77s - 1710.77s |  The
1710.77s - 1712.77s |  One
1712.77s - 1714.77s |  That
1714.77s - 1716.77s |  Is
1716.77s - 1718.77s |  The
1718.77s - 1720.77s |  One
1720.77s - 1722.77s |  That
1722.77s - 1724.77s |  Is
1724.77s - 1726.77s |  The
1726.77s - 1728.77s |  One
1728.77s - 1730.77s |  That
1730.77s - 1732.77s |  Is
1732.77s - 1734.77s |  The
1734.77s - 1736.77s |  One
1736.77s - 1738.77s |  That
1738.77s - 1740.77s |  Is
1740.77s - 1742.77s |  The
1742.77s - 1744.77s |  One
1744.77s - 1746.77s |  That
1746.77s - 1748.77s |  Is
1748.77s - 1750.77s |  The
1750.77s - 1752.77s |  One
1752.77s - 1754.77s |  That
1754.77s - 1756.77s |  Is
1756.77s - 1758.77s |  The
1758.77s - 1760.77s |  One
1760.77s - 1762.77s |  That
1762.77s - 1764.77s |  Is
1764.77s - 1766.77s |  The
1766.77s - 1768.77s |  One
1768.77s - 1770.77s |  That
1770.77s - 1772.77s |  Is
1772.77s - 1774.77s |  The
1774.77s - 1776.77s |  One
1776.77s - 1778.77s |  That
1778.77s - 1780.77s |  Is
1780.77s - 1782.77s |  The
1782.77s - 1784.77s |  One
1784.77s - 1786.77s |  That
1786.77s - 1788.77s |  Is
1788.77s - 1790.77s |  The
1790.77s - 1792.77s |  One
1792.77s - 1794.77s |  That
1794.77s - 1796.77s |  Is
1796.77s - 1798.77s |  The
1798.77s - 1800.77s |  One
1800.77s - 1802.77s |  That
1802.77s - 1804.77s |  Is
1804.77s - 1806.77s |  The
1806.77s - 1808.77s |  One
1808.77s - 1810.77s |  That
1810.77s - 1812.77s |  Is
1812.77s - 1814.77s |  The
1814.77s - 1816.77s |  One
1816.77s - 1818.77s |  That
1818.77s - 1820.77s |  Is
1820.77s - 1822.77s |  The
1822.77s - 1824.77s |  One
1824.77s - 1826.77s |  That
1826.77s - 1828.77s |  Is
1828.77s - 1830.77s |  The
1830.77s - 1832.77s |  One
1832.77s - 1834.77s |  That
1834.77s - 1836.77s |  Is
1836.77s - 1838.77s |  The
1838.77s - 1840.77s |  One
1840.77s - 1842.77s |  That
1842.77s - 1844.77s |  Is
1844.77s - 1846.77s |  The
1846.77s - 1848.77s |  One
1848.77s - 1850.77s |  That
1850.77s - 1852.77s |  Is
1852.77s - 1854.77s |  The
1854.77s - 1856.77s |  One
1856.77s - 1858.77s |  That
1858.77s - 1860.77s |  Is
1860.77s - 1862.77s |  The
1862.77s - 1864.77s |  One
1864.77s - 1866.77s |  That
1866.77s - 1868.77s |  Is
1868.77s - 1870.77s |  The
1870.77s - 1872.77s |  One
1872.77s - 1874.77s |  That
1874.77s - 1876.77s |  Is
1876.77s - 1878.77s |  The
1878.77s - 1880.77s |  One
1880.77s - 1882.77s |  That
1882.77s - 1884.77s |  Is
1884.77s - 1886.77s |  The
1886.77s - 1888.77s |  One
1888.77s - 1890.77s |  That
1890.77s - 1892.77s |  Is
1892.77s - 1894.77s |  The
1894.77s - 1896.77s |  One
1896.77s - 1898.77s |  That
1898.77s - 1900.77s |  Is
1900.77s - 1902.77s |  The
1902.77s - 1904.77s |  One
1904.77s - 1906.77s |  That
1906.77s - 1908.77s |  Is
1908.77s - 1910.77s |  The
1910.77s - 1912.77s |  One
1912.77s - 1914.77s |  That
1914.77s - 1916.77s |  Is
1916.77s - 1918.77s |  The
1918.77s - 1920.77s |  One
1920.77s - 1922.77s |  That
1922.77s - 1924.77s |  Is
1924.77s - 1928.40s |  The
1928.40s - 1930.40s |  One
1930.40s - 1932.40s |  That
1932.40s - 1934.40s |  Is
1934.40s - 1936.40s |  The
1936.40s - 1938.40s |  One
1938.40s - 1940.40s |  That
1940.40s - 1942.40s |  Is
1942.40s - 1944.40s |  The
1944.40s - 1946.40s |  One
1946.40s - 1948.40s |  That
1948.40s - 1950.40s |  Is
1950.40s - 1952.40s |  The
1952.40s - 1954.40s |  One
1954.40s - 1956.40s |  That
1956.40s - 1958.40s |  Is
1958.40s - 1960.40s |  The
1960.40s - 1962.40s |  One
1962.40s - 1964.40s |  That
1964.40s - 1966.40s |  Is
1966.40s - 1968.40s |  The
1968.40s - 1970.40s |  One
1970.40s - 1972.40s |  That
1972.40s - 1974.40s |  Is
1974.40s - 1976.40s |  The
1976.40s - 1978.40s |  One
1978.40s - 1980.40s |  That
1980.40s - 1982.40s |  Is
1982.40s - 1984.40s |  The
1984.40s - 1986.40s |  One
1986.40s - 1988.40s |  That
1988.40s - 1990.40s |  Is
1990.40s - 1992.40s |  The
1992.40s - 1994.40s |  One
1994.40s - 1996.40s |  That
1996.40s - 1998.40s |  Is
1998.40s - 2000.40s |  The
2000.40s - 2002.40s |  One
2002.40s - 2004.40s |  That
2004.40s - 2006.40s |  Is
2006.40s - 2008.40s |  The
2008.40s - 2010.40s |  One
2010.40s - 2012.40s |  That
2012.40s - 2014.40s |  Is
2014.40s - 2016.40s |  The
2016.40s - 2018.40s |  One
2018.40s - 2020.40s |  That
2020.40s - 2022.40s |  Is
2022.40s - 2024.40s |  The
2024.40s - 2026.40s |  One
2026.40s - 2028.40s |  That
2028.40s - 2030.40s |  Is
2030.40s - 2032.40s |  The
2032.40s - 2034.40s |  One
2034.40s - 2036.40s |  That
2036.40s - 2038.40s |  Is
2038.40s - 2040.40s |  The
2040.40s - 2042.40s |  One
2042.40s - 2044.40s |  That
2044.40s - 2046.40s |  Is
2046.40s - 2048.40s |  The
2048.40s - 2050.40s |  One
2050.40s - 2052.40s |  That
2052.40s - 2054.40s |  Is
2054.40s - 2056.40s |  The
2056.40s - 2058.40s |  One
2058.40s - 2060.40s |  That
2060.40s - 2062.40s |  Is
2062.40s - 2064.40s |  The
2064.40s - 2066.40s |  One
2066.40s - 2068.40s |  That
2068.40s - 2070.40s |  Is
2070.40s - 2072.40s |  The
2072.40s - 2074.40s |  One
2074.40s - 2076.40s |  That
2076.40s - 2078.40s |  Is
2078.40s - 2080.40s |  The
2080.40s - 2082.40s |  One
2082.40s - 2084.40s |  That
2084.40s - 2086.40s |  Is
2086.40s - 2088.40s |  The
2088.40s - 2090.40s |  One
2090.40s - 2092.40s |  That
2092.40s - 2094.40s |  Is
2094.40s - 2096.40s |  The
2096.40s - 2098.40s |  One
2098.40s - 2100.40s |  That
2100.40s - 2102.40s |  Is
2102.40s - 2104.40s |  The
2104.40s - 2106.40s |  One
2106.40s - 2108.40s |  That
2108.40s - 2110.40s |  Is
2110.40s - 2112.40s |  The
2112.40s - 2114.40s |  One
2114.40s - 2116.40s |  That
2116.40s - 2118.40s |  Is
2118.40s - 2120.40s |  The
2120.40s - 2122.40s |  One
2122.40s - 2124.40s |  That
2124.40s - 2126.40s |  Is
2126.40s - 2128.40s |  The
2128.40s - 2130.40s |  One
2130.40s - 2132.40s |  That
2132.40s - 2134.40s |  Is
2134.40s - 2136.40s |  The
2136.40s - 2138.40s |  One
2138.40s - 2140.40s |  That
2140.40s - 2142.40s |  Is
2142.40s - 2144.40s |  The
2144.40s - 2146.40s |  One
2146.40s - 2148.40s |  That
2148.40s - 2150.40s |  Is
2150.40s - 2152.40s |  The
2152.40s - 2154.40s |  One
2154.40s - 2156.40s |  That
2156.40s - 2158.40s |  Is
2158.40s - 2160.40s |  The
2160.40s - 2162.40s |  One
2162.40s - 2164.40s |  That
2164.40s - 2166.40s |  Is
2166.40s - 2168.40s |  The
2168.40s - 2170.40s |  One
2170.40s - 2172.40s |  That
2172.40s - 2174.40s |  Is
2174.40s - 2176.40s |  The
2176.40s - 2178.40s |  One
2178.40s - 2180.40s |  That
2180.40s - 2182.40s |  Is
2182.40s - 2184.40s |  The
2184.40s - 2186.40s |  One
2186.40s - 2188.40s |  That
2188.40s - 2190.40s |  Is
2190.40s - 2192.40s |  The
2192.40s - 2194.40s |  One
2194.40s - 2196.40s |  That
2196.40s - 2198.40s |  Is
2198.40s - 2200.40s |  The
2200.40s - 2202.40s |  One
2202.40s - 2204.40s |  That
2204.40s - 2206.40s |  Is
2206.40s - 2208.40s |  The
2208.40s - 2210.40s |  One
2210.40s - 2212.40s |  That
2212.40s - 2214.40s |  Is
2214.40s - 2216.40s |  The
2216.40s - 2218.40s |  One
2218.40s - 2220.40s |  That
2220.40s - 2222.40s |  Is
2222.40s - 2224.40s |  The
2224.40s - 2226.40s |  One
2226.40s - 2228.40s |  That
2228.40s - 2230.40s |  Is
2230.40s - 2232.40s |  The
2232.40s - 2234.40s |  One
2234.40s - 2236.40s |  That
2236.40s - 2238.40s |  Is
2238.40s - 2240.40s |  The
2240.40s - 2242.40s |  One
2242.40s - 2244.40s |  That
2244.40s - 2246.40s |  Is
2246.40s - 2248.40s |  The
2248.40s - 2250.40s |  One
2250.40s - 2252.40s |  That
2252.40s - 2254.40s |  Is
2254.40s - 2256.40s |  The
2256.40s - 2258.40s |  One
2258.40s - 2260.40s |  That
2260.40s - 2262.40s |  Is
2262.40s - 2264.40s |  The
2264.40s - 2266.40s |  One
2266.40s - 2268.40s |  That
2268.40s - 2270.40s |  Is
2270.40s - 2272.40s |  The
2272.40s - 2274.40s |  One
2274.40s - 2276.40s |  That
2276.40s - 2278.40s |  Is
2278.40s - 2280.40s |  The
2280.40s - 2282.40s |  One
2282.40s - 2284.40s |  That
2284.40s - 2286.40s |  Is
2286.40s - 2288.40s |  The
2288.40s - 2290.40s |  One
2290.40s - 2292.40s |  That
2292.40s - 2294.40s |  Is
2294.40s - 2296.40s |  The
2296.40s - 2298.40s |  One
2298.40s - 2300.40s |  That
2300.40s - 2302.40s |  Is
2302.40s - 2304.40s |  The
2304.40s - 2306.40s |  One
2306.40s - 2308.40s |  That
2308.40s - 2310.40s |  Is
2310.40s - 2312.40s |  The
2312.40s - 2314.40s |  One
2314.40s - 2316.40s |  That
2316.40s - 2318.40s |  Is
2318.40s - 2320.40s |  The
2320.40s - 2322.40s |  One
2322.40s - 2324.40s |  That
2324.40s - 2326.40s |  Is
2326.40s - 2328.40s |  The
2328.40s - 2330.40s |  One
2330.40s - 2332.40s |  That
2332.40s - 2334.40s |  Is
2334.40s - 2336.40s |  The
2336.40s - 2338.40s |  One
2338.40s - 2340.40s |  That
2340.40s - 2342.40s |  Is
2342.40s - 2344.40s |  The
2344.40s - 2346.40s |  One
2346.40s - 2348.40s |  That
2348.40s - 2350.40s |  Is
2350.40s - 2352.40s |  The
2352.40s - 2354.40s |  One
2354.40s - 2356.40s |  That
2356.40s - 2358.40s |  Is
2358.40s - 2360.40s |  The
2360.40s - 2362.40s |  One
2362.40s - 2364.40s |  That
2364.40s - 2366.40s |  Is
2366.40s - 2368.40s |  The
2368.40s - 2370.40s |  One
2370.40s - 2372.40s |  That
2372.40s - 2374.40s |  Is
2374.40s - 2376.40s |  The
2376.40s - 2378.40s |  One
2378.40s - 2380.40s |  That
2380.40s - 2382.40s |  Is
2382.40s - 2384.40s |  The
2384.40s - 2386.40s |  One
2386.40s - 2388.40s |  That
2388.40s - 2390.40s |  Is
2390.40s - 2392.40s |  The
2392.40s - 2394.40s |  One
2394.40s - 2396.40s |  That
2396.40s - 2398.40s |  Is
2398.40s - 2400.40s |  The
2400.40s - 2402.40s |  One
2402.40s - 2404.40s |  That
2404.40s - 2406.40s |  Is
2406.40s - 2408.40s |  The
2408.40s - 2410.40s |  One
2410.40s - 2413.90s |  That
2413.90s - 2415.90s |  Is
2415.90s - 2417.90s |  The
2417.90s - 2419.90s |  One
2419.90s - 2421.90s |  That
2421.90s - 2423.90s |  Is
2423.90s - 2425.90s |  The
2425.90s - 2427.90s |  One
2427.90s - 2429.90s |  That
2429.90s - 2431.90s |  Is
2431.90s - 2433.90s |  The
2433.90s - 2435.90s |  One
2435.90s - 2437.90s |  That
2437.90s - 2439.90s |  Is
2439.90s - 2441.90s |  The
2441.90s - 2443.90s |  One
2443.90s - 2445.90s |  That
2445.90s - 2447.90s |  Is
2447.90s - 2449.90s |  The
2449.90s - 2451.90s |  One
2451.90s - 2453.90s |  That
2453.90s - 2455.90s |  Is
2455.90s - 2457.90s |  The
2457.90s - 2459.90s |  One
2459.90s - 2461.90s |  That
2461.90s - 2463.90s |  Is
2463.90s - 2465.90s |  The
2465.90s - 2467.90s |  One
2467.90s - 2469.90s |  That
2469.90s - 2473.44s |  Is
2473.44s - 2475.44s |  The
2475.44s - 2477.44s |  One
2477.44s - 2479.44s |  That
2479.44s - 2481.44s |  Is
2481.44s - 2483.44s |  The
2483.44s - 2485.44s |  One
2485.44s - 2487.44s |  That
2487.44s - 2489.44s |  Is
2489.44s - 2491.44s |  The
2491.44s - 2493.44s |  One
2493.44s - 2495.44s |  That
2495.44s - 2499.87s |  Is
2499.87s - 2501.87s |  The
2501.87s - 2503.87s |  One
2503.87s - 2505.87s |  That
2505.87s - 2507.87s |  Is
2507.87s - 2509.87s |  The
2509.87s - 2511.87s |  One
2511.87s - 2513.87s |  That
2513.87s - 2515.87s |  Is
2515.87s - 2517.87s |  The
2517.87s - 2519.87s |  One
2519.87s - 2521.87s |  That
2521.87s - 2523.87s |  Is
2523.87s - 2525.87s |  The
2525.87s - 2527.87s |  One
2527.87s - 2529.87s |  That
2529.87s - 2531.87s |  Is
2531.87s - 2533.87s |  The
2533.87s - 2535.87s |  One
2535.87s - 2537.87s |  That
2537.87s - 2539.87s |  Is
2539.87s - 2541.87s |  The
2541.87s - 2543.87s |  One
2543.87s - 2545.87s |  That
2545.87s - 2547.87s |  Is
2547.87s - 2549.87s |  The
2549.87s - 2551.87s |  One
2551.87s - 2553.87s |  That
2553.87s - 2555.87s |  Is
2555.87s - 2557.87s |  The
2557.87s - 2559.87s |  One
2559.87s - 2561.87s |  That
2561.87s - 2563.87s |  Is
2563.87s - 2565.87s |  The
2565.87s - 2567.87s |  One
2567.87s - 2569.87s |  That
2569.87s - 2571.87s |  Is
2571.87s - 2573.87s |  The
2573.87s - 2575.87s |  One
2575.87s - 2577.87s |  That
2577.87s - 2579.87s |  Is
2579.87s - 2581.87s |  The
2581.87s - 2583.87s |  One
2583.87s - 2585.87s |  That
2585.87s - 2587.87s |  Is
2587.87s - 2589.87s |  The
2589.87s - 2591.87s |  One
2591.87s - 2593.87s |  That
2593.87s - 2595.87s |  Is
2595.87s - 2597.87s |  The
2597.87s - 2599.87s |  One
2599.87s - 2601.87s |  That
2601.87s - 2603.87s |  Is
2603.87s - 2605.87s |  The
2605.87s - 2607.87s |  One
2607.87s - 2609.87s |  That
2609.87s - 2611.87s |  Is
2611.87s - 2613.87s |  The
2613.87s - 2615.87s |  One
2615.87s - 2617.87s |  That
2617.87s - 2619.87s |  Is
2619.87s - 2621.87s |  The
2621.87s - 2623.87s |  One
2623.87s - 2625.87s |  That
2625.87s - 2627.87s |  Is
2627.87s - 2629.87s |  The
2629.87s - 2631.87s |  One
2631.87s - 2633.87s |  That
2633.87s - 2635.87s |  Is
2635.87s - 2637.87s |  The
2637.87s - 2639.87s |  One
2639.87s - 2641.87s |  That
2641.87s - 2643.87s |  Is
2643.87s - 2645.87s |  The
2645.87s - 2647.87s |  One
2647.87s - 2649.87s |  That
2649.87s - 2651.87s |  Is
2651.87s - 2653.87s |  The
2653.87s - 2655.87s |  One
2655.87s - 2657.87s |  That
2657.87s - 2659.87s |  Is
2659.87s - 2661.87s |  The
2661.87s - 2663.87s |  One
2663.87s - 2665.87s |  That
2665.87s - 2667.87s |  Is
2667.87s - 2669.87s |  The
2669.87s - 2671.87s |  One
2671.87s - 2673.87s |  That
2673.87s - 2675.87s |  Is
2675.87s - 2677.87s |  The
2677.87s - 2679.87s |  One
2679.87s - 2681.87s |  That
2681.87s - 2683.87s |  Is
2683.87s - 2685.87s |  The
2685.87s - 2687.87s |  One
2687.87s - 2689.87s |  That
2689.87s - 2691.87s |  Is
2691.87s - 2693.87s |  The
2693.87s - 2695.87s |  One
2695.87s - 2697.87s |  That
2697.87s - 2699.87s |  Is
2699.87s - 2701.87s |  The
2701.87s - 2703.87s |  One
2703.87s - 2705.87s |  That
2705.87s - 2707.87s |  Is
2707.87s - 2709.87s |  The
2709.87s - 2711.87s |  One
2711.87s - 2713.87s |  That
2713.87s - 2715.87s |  Is
2715.87s - 2717.87s |  The
2717.87s - 2719.87s |  One
2719.87s - 2721.87s |  That
2721.87s - 2723.87s |  Is
2723.87s - 2725.87s |  The
2725.87s - 2727.87s |  One
2727.87s - 2729.87s |  That
2729.87s - 2731.87s |  Is
2731.87s - 2733.87s |  The
2733.87s - 2735.87s |  One
2735.87s - 2737.87s |  That
2737.87s - 2739.87s |  Is
2739.87s - 2741.87s |  The
2741.87s - 2743.87s |  One
2743.87s - 2745.87s |  That
2745.87s - 2747.87s |  Is
2747.87s - 2749.87s |  The
2749.87s - 2751.87s |  One
2751.87s - 2753.87s |  That
2753.87s - 2755.87s |  Is
2755.87s - 2757.87s |  The
2757.87s - 2759.87s |  One
2759.87s - 2761.87s |  That
2761.87s - 2763.87s |  Is
2763.87s - 2765.87s |  The
2765.87s - 2767.87s |  One
2767.87s - 2769.87s |  That
2769.87s - 2771.87s |  Is
2771.87s - 2773.87s |  The
2773.87s - 2775.87s |  One
2775.87s - 2777.87s |  That
2777.87s - 2779.87s |  Is
2779.87s - 2781.87s |  The
2781.87s - 2783.87s |  One
2783.87s - 2785.87s |  That
2785.87s - 2787.87s |  Is
2787.87s - 2789.87s |  The
2789.87s - 2791.87s |  One
2791.87s - 2793.87s |  That
2793.87s - 2795.87s |  Is
2795.87s - 2797.87s |  The
2797.87s - 2799.87s |  One
2799.87s - 2801.87s |  That


url: https://www.youtube.com/watch?v=m9QVfYVJ7R8
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Breaching AWS Through Shadow Resources - Yakir Kadkoda, Michael Katchinskiy, Ofek Itach

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=m9QVfYVJ7R8",
  "title": "DEF CON 32 - Breaching AWS Through Shadow Resources - Yakir Kadkoda, Michael Katchinskiy, Ofek Itach",
  "description": "The cloud seems complex, but it's what happens behind the scenes that really complicates things. Some services utilize others as resources as part of their logic/operation. Interestingly enough, it turns out that this could lead to catastrophic results if done unsafely.\n\nThis talk will present six critical vulnerabilities that we found in AWS, along with the stories and methodologies behind them. These vulnerabilities, which were all promptly acknowledged and fixed by AWS, could allow external attackers to breach almost any AWS account. The vulnerabilities range from remote code execution, which could lead to full account takeover, to information disclosure, potentially exposing sensitive data, or causing denial of service. The session will share our story of discovery, how we were able to identify commonalities among them, and how we developed a method to uncover more vulnerabilities and enhance the impact by using common techniques leading to privilege escalation. We will then detail our approach for mapping service external resources and release our Open-Source tool to research service internal API calls. We will also present a method to check if accounts have been vulnerable to this vector in the past.\n\nWe will conclude our talk with the lessons learned during this research and our future line of research. We will highlight new areas that cloud researchers need to explore when hunting for cloud vulnerabilities and highlight best practices for developers to use in complex environments.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2231,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

3.95s - 8.95s | This text was transcribed using whisper model: large-v2

 So, hello everybody. We are very excited to be here.
8.95s - 13.95s |  And welcome to the session, Breaching AWS Accounts Through Shadow Resources.
13.95s - 18.95s |  And in this session, we will demonstrate several vulnerabilities that we found on AWS.
18.95s - 23.95s |  The most severe of these vulnerabilities could allow an attacker to add an admin role to another account.
23.95s - 27.23s |  So, let's start.
27.23s - 34.23s |  Let's start by discussing the most debatable topic on AWS, which is AWS Account ID.
34.23s - 40.23s |  So, each AWS account has a unique identifier associated with it.
40.23s - 44.23s |  This identifier consists of 12 digits.
44.23s - 51.23s |  And the most important thing about this is that some treat it as a secret and some don't.
51.23s - 58.23s |  And along the history of AWS, we have many different opinions whether it is a secret or not.
58.23s - 65.23s |  Although AWS in their documentation states that this account ID should be shared carefully,
65.23s - 67.23s |  they do not consider this a secret.
67.23s - 71.23s |  But we as security practitioners, security researchers,
71.23s - 76.23s |  know that attackers could achieve problematic things only by knowing this account ID.
76.23s - 79.23s |  So, what is the right answer?
79.23s - 82.23s |  Are AWS account IDs secret or not?
82.23s - 88.23s |  We hope that by the end of this session, we will have a more solid opinion about this.
88.23s - 91.23s |  So, let us introduce ourselves.
91.23s - 98.23s |  My name is Yakir Kotkoda and here with me are Michael Kaczynski and Ofik Itach.
98.23s - 101.23s |  We are all security researchers from Aqua Security
101.23s - 107.23s |  and we are focusing in our daily on cloud vulnerabilities, open source vulnerabilities, and more.
107.23s - 109.23s |  Let me go over the agenda.
109.23s - 113.23s |  We will introduce something that's called shadow resources and what they are.
113.23s - 117.23s |  Then, several vulnerabilities that we found on AWS.
117.23s - 124.23s |  And an open source tool that we developed during our research that helped us to find more vulnerabilities.
124.23s - 128.23s |  After this, we will introduce a new technique called Bucket Monopoly
128.23s - 131.23s |  that helps us emphasize the risk of our findings.
131.23s - 137.23s |  And we will end our session by suggesting some mitigations and recommendations.
137.23s - 141.23s |  So, let's first talk how our journey began.
141.23s - 147.23s |  While we worked with the AWS Management Console, which is the GUI of AWS,
147.23s - 153.23s |  we noticed that when a user used the CloudFormation service and uploaded a template file,
153.23s - 158.23s |  AWS, behind the scenes, creates an S3 bucket for the user.
158.23s - 165.23s |  Although the user did not explicitly ask AWS to do so, this is how the service operates.
165.23s - 169.23s |  We have decided to name this kind of resources that spawned automatically
169.23s - 172.23s |  without the user intervention a shadow resource.
172.23s - 175.23s |  So, let's explain this term.
175.23s - 179.23s |  When we refer to shadow resources, we are mainly referring to resources
179.23s - 185.23s |  that are generated automatically or semi-automatically by AWS.
185.23s - 189.23s |  Most of the time, they spawn without user intervention
189.23s - 193.23s |  and they might go unnoticed by the account owner.
193.23s - 197.23s |  And the great example for this is just the S3 bucket that we saw
197.23s - 201.23s |  that the CloudFormation service creates for the user.
201.23s - 206.23s |  Now, let's align some common knowledge about S3 bucket,
206.23s - 210.23s |  which is one of the first services by AWS.
210.23s - 213.23s |  This service has some special uniqueness.
213.23s - 219.23s |  First of all, S3 bucket name must be globally unique across all AWS.
219.23s - 223.23s |  For example, if you create an S3 bucket called CoolBucket1,
223.23s - 227.23s |  no one else on AWS could claim this name.
227.23s - 230.23s |  It will be available only under your account.
230.23s - 235.23s |  So, let's set up a view and talk about our first vulnerability on CloudFormation.
235.23s - 238.23s |  So, first of all, what is CloudFormation?
238.23s - 242.23s |  CloudFormation is an infrastructure as code service by AWS
242.23s - 244.23s |  similar to the Terraform project.
244.23s - 249.23s |  A user will define a template file that contains AWS resources.
249.23s - 254.23s |  Then the user stores this template file locally or in S3 bucket.
254.23s - 259.23s |  And then the user will create a stack based on this template file.
259.23s - 262.23s |  And when the user will deploy this stack,
262.23s - 265.23s |  the CloudFormation service deploys the resources
265.23s - 268.23s |  that exist under this template file.
268.23s - 271.23s |  Now, I want us to understand what happens behind the scenes
271.23s - 274.23s |  when the user uploads a template file to this service.
274.23s - 281.23s |  So, first, the user clicks on the upload template file on the GUI.
281.23s - 287.23s |  And we need to remember that every operation on AWS is eventually an API request.
287.23s - 292.23s |  So, the create upload bucket API request will be invoked.
292.23s - 296.23s |  The CloudFormation service will try to create an S3 bucket.
296.23s - 299.23s |  Then it will return the bucket name.
299.23s - 307.23s |  And then the put object API request will upload the template file to the CloudFormation service.
307.23s - 310.23s |  Then we will have a lot of API requests.
310.23s - 312.23s |  But in the end, the user will submit the stack,
312.23s - 317.23s |  which will cause the CloudFormation service to deploy all the AWS resources
317.23s - 320.23s |  that exist under this template file.
320.23s - 326.23s |  Now, I want us to focus on the bucket naming pattern of this S3 bucket.
326.23s - 329.23s |  So, it will consist of three different parts.
329.23s - 333.23s |  The first one is a prefix, which is a constant string.
333.23s - 335.23s |  And it will remain the same.
335.23s - 338.23s |  In this case, it is CF template.
338.23s - 343.23s |  Then we have the hash, which is a unique identifier per account.
343.23s - 350.23s |  And then a region, which will be related to where the user initiates the CloudFormation service.
350.23s - 352.23s |  So, now let's visualize this.
352.23s - 357.23s |  So, basically, when a user uses the CloudFormation service via the AWS GUI,
357.23s - 362.23s |  AWS behind the scenes creates an S3 bucket with this pattern.
362.23s - 368.23s |  And when the user will try to create another CloudFormation service in a new region for the first time,
368.23s - 372.23s |  the CloudFormation service creates an S3 bucket with the same prefix,
372.23s - 376.23s |  with the same hash, but with a different region.
376.23s - 381.23s |  So, we have here a semi-predictable bucket name.
381.23s - 388.23s |  So, what if an attacker opens or claims this bucket before the user?
388.23s - 395.23s |  So, if an attacker does so, this technique is called bucket namesquatting or bucket sniping.
395.23s - 399.23s |  You can read a great blog by Oren McKay about this technique.
399.23s - 401.23s |  Now, let's explain this.
401.23s - 405.23s |  So, we have here the user with the CloudFormation service on a specific region.
405.23s - 409.23s |  And then an attacker on a new region.
409.23s - 415.23s |  And what attacker did here is that he creates a bucket under his account with the hash of the user.
415.23s - 418.23s |  We will talk about this later, the prefix and the region.
418.23s - 425.23s |  So, whenever the user will try to use the CloudFormation service in this region for the first time,
425.23s - 430.23s |  the CloudFormation service will try to interact with the attacker-claimed bucket.
430.23s - 433.23s |  But it will receive an error.
433.23s - 439.23s |  So, basically, we have here a way to prevent the other user from using the CloudFormation service
439.23s - 446.23s |  on a specific region, which can be considered as a DOS scenario.
446.23s - 451.23s |  And a DOS scenario is fine, but it isn't enough for a DEF concession.
451.23s - 454.23s |  So, let's escalate it.
454.23s - 458.23s |  What if an attacker opened a bucket for public access?
458.23s - 463.58s |  So, the reason why the CloudFormation service got an error before
463.58s - 468.58s |  is because the attacker needs still to define some settings on their S3 bucket.
468.58s - 474.58s |  First of all, the attacker needs to allow public access because it's blocked by default.
474.58s - 483.58s |  And then, in order to allow cross-account access, the attacker needs to define a resource-based policy.
483.58s - 489.58s |  In this case, we have a very permissive bucket policy that allows any principal on AWS
489.58s - 493.58s |  to perform any action on the S3 bucket of the attacker.
493.58s - 497.58s |  Of course, this is just a POC, and this is very dangerous.
497.58s - 502.58s |  So, after the attacker does so, now an interesting thing will happen.
502.58s - 508.58s |  The CloudFormation service of the victim will succeed to interact with the attacker-claimed bucket.
508.58s - 514.58s |  So, whenever the user uploads a template file, it will be dropped to the attacker S3 bucket.
514.58s - 521.58s |  So, we have here a way to enumerate different secrets and resources that the user wrote in their template file.
521.58s - 527.40s |  So, this is an information disclosure scenario.
527.40s - 535.40s |  But, if an attacker already has access to this template file, what if an attacker modifies it?
535.40s - 541.40s |  So, if an attacker does so, this is called resource injection in CloudFormation templates,
541.40s - 549.40s |  and it's a great technique that's published already by RhinoLab and also credited to Matthew Filler about this.
549.40s - 557.40s |  And all the idea behind this technique is some type of check, type of issue behavior that the CloudFormation service has by default
557.40s - 565.40s |  that allow an attacker a window of opportunity to modify a template's file before the CloudFormation service tries to deploy them.
565.40s - 571.40s |  So, it's possible for an attacker to modify this template file and actually do it manually
571.40s - 575.40s |  or with Lambda that will backdoor this template automatically.
575.40s - 577.40s |  So, now let's visualize this.
577.40s - 581.71s |  Here we have the user and the attacker account.
581.71s - 585.71s |  The attacker is in external account, and the attacker creates an S3 bucket
585.71s - 588.71s |  that the CloudFormation service of the victim will try to use.
588.71s - 593.71s |  And a Lambda that will backdoor any file that dropped to this S3 bucket.
593.71s - 602.71s |  So, whenever the user creates a stack, the CloudFormation service uploads the victim template to the attacker S3 bucket.
602.71s - 611.71s |  Then the Lambda will be triggered and gets the template file from the attacker claim bucket.
611.71s - 614.71s |  Then the Lambda will perform a resource injection.
614.71s - 617.71s |  And here we have a new resource.
617.71s - 621.71s |  It's an admin role that can be assumed by the attacker.
621.71s - 628.71s |  Then the Lambda will inject this backdoor template file to the S3 bucket.
628.71s - 632.71s |  And as I said before, we have here some type of check, type of use issue.
632.71s - 636.71s |  So, the user needs to deploy the template file.
636.71s - 638.71s |  So, the user clicks on the submit stack.
638.71s - 646.71s |  And then the previously vulnerable CloudFormation service will attempt to get the backdoor template file from the attacker S3 bucket.
646.71s - 650.71s |  And deploy this malicious role under the victim account.
650.71s - 655.71s |  So, we have here an admin role from external accounts that the attacker can claim.
655.71s - 659.71s |  So, actually, which means an account takeover.
659.71s - 666.48s |  Thank you.
666.48s - 670.48s |  But there are some important points to mention.
670.48s - 676.48s |  In order to add or inject an admin role to another account, the initiator of the CloudFormation service,
676.48s - 683.48s |  which is an AWS user or a service role, needs to have some high privilege.
683.48s - 689.48s |  And we can assume that users that use the CloudFormation service via the GUI have such privilege.
689.48s - 696.48s |  And even if they do not have high privilege, it's still possible to modify what exists in the template file.
696.48s - 704.48s |  And, of course, the attacker needs to wait for the victim to use the CloudFormation service in a new region for the first time.
704.48s - 708.48s |  So, now, let's see a really quick POC of this.
708.48s - 714.48s |  Here we have the victim account that tried to use the CloudFormation service via the GUI and upload the template file.
714.48s - 719.48s |  Behind the scenes, the template file already dropped to the attacker claim bucket.
719.48s - 723.48s |  And the user still needs to define stack name, privilege, and more.
723.48s - 726.48s |  And this is what caused the time-of-check, time-of-use issue.
726.48s - 731.48s |  As we can see here, we have the attacker as the bucket with the template file of the user.
731.48s - 733.48s |  And the attacker can modify it.
733.48s - 735.48s |  Meanwhile, the attacker deploys the stack.
735.48s - 743.48s |  And we can see that we have under this deployment an attacker user, which is a really privileged role, an admin role.
743.48s - 750.48s |  And we can see also that this role can be assumed from an external account, in this case the attacker account.
750.48s - 757.48s |  So, all attacker needs to do is to assume this role, find the related account ID of the user on the CloudWatch logs,
757.48s - 765.48s |  and then the attacker has an admin role on the victim account, which is one of the most severe things that we can receive in the cloud, right?
765.48s - 776.26s |  Thank you, Yakir, for showing us such a cool technique.
776.26s - 781.26s |  But before we continue, let's not ignore the elephant in the room.
782.26s - 791.26s |  Yakir showed us previously a way to, sorry.
791.26s - 798.26s |  Previously, Yakir showed us a way to, he showed us that the bucket name needs to be predictable.
798.26s - 803.26s |  But when we look at the bucket name, it's definitely not predictable, right?
803.26s - 805.26s |  It's due to the hash in the middle.
805.26s - 808.26s |  So, we knew we had to address this problem.
808.26s - 817.26s |  The first attempt that we did was actually trying to enumerate and calculate every possible hash.
817.26s - 823.26s |  But we quickly realized it's just not doable to the amount of option that we had.
823.26s - 828.26s |  Then we thought maybe we can reverse the hash or something like that.
828.26s - 831.26s |  Yakir said that the hash is unique per account.
831.26s - 837.26s |  So, maybe it's based on the account ID or other unique identifier in the account.
837.26s - 844.26s |  But after many unsuccessful attempts, we left that technique.
844.26s - 848.26s |  Then we decided to turn to open source.
848.26s - 852.26s |  In open source, we saw this code.
852.26s - 856.26s |  And in this code, we saw that there is some cases.
856.26s - 860.26s |  There is a code that shows that the bucket is actually randomized.
860.26s - 862.26s |  The hash is actually randomized.
862.26s - 871.41s |  And what that actually means is we can't predict the hash.
871.41s - 877.41s |  So, our technique is not going to work in the real world.
877.41s - 885.41s |  But as good researchers, we were sad about this.
885.41s - 888.41s |  Because we know that our technique is not going to work.
888.41s - 893.41s |  And we had to rethink about everything that we came so far.
893.41s - 895.41s |  We have a really nice technique.
895.41s - 899.41s |  We managed to remote account takeover.
899.41s - 903.41s |  But we don't have how to use it in the real world.
903.41s - 908.41s |  But as good researchers, we thought about a solution.
908.41s - 914.41s |  We used the greatest tool known to us, which is the search tool.
914.41s - 916.41s |  We used GitHub search.
916.41s - 919.41s |  And we used source graph search.
919.41s - 923.41s |  We managed to find over a thousand buckets.
923.41s - 926.41s |  Some of them with the hash that we mentioned.
926.41s - 928.41s |  All of them with the hash that we mentioned.
928.41s - 935.41s |  And it gave us the ability to hack a couple of big organizations.
935.41s - 937.41s |  But we didn't stop there.
937.41s - 946.41s |  During our searches, we actually find that there is cases where the bucket name of some services
946.41s - 950.41s |  is actually created by just using account ID.
950.41s - 959.41s |  So, we thought to ourselves, maybe instead of trying to find a mysterious hash
959.41s - 962.41s |  or trying to understand this randomized string,
962.41s - 969.41s |  maybe we can just use the account ID instead and find new vulnerability
969.41s - 973.41s |  that the bucket name actually contains the account ID.
973.41s - 982.82s |  So, we decided to shift our whole research and turn to find more bucket patterns.
982.82s - 987.82s |  We used the open source and looked for more bucket patterns.
987.82s - 990.82s |  We used AWS documentation and SDK.
990.82s - 996.82s |  We even started calling and trying to press nearly every possible button in AWS GUI.
996.82s - 1004.82s |  And we even created a tool, an open source tool that you can all play with it after this talk.
1004.82s - 1011.82s |  It lets you debug AWS like you're debugging network buckets.
1011.82s - 1018.82s |  And it shows the inner API calls made by AWS, which is kind of nice.
1018.82s - 1020.82s |  So, let's see how it works.
1020.82s - 1024.82s |  In one screen, we initiate an API call.
1024.82s - 1032.82s |  This API call in this scenario is the upload template that Kir talked about before.
1032.82s - 1037.82s |  In the other screen, we use Wireshark with our plugin.
1037.82s - 1039.82s |  We wrote a plugin for Wireshark.
1039.82s - 1045.82s |  And we're just starting to capture API calls that we made.
1045.82s - 1050.82s |  And what is interesting about what we've seen using this tool
1050.82s - 1055.82s |  is actually when we initiate the API call in the GUI, it's actually one API call.
1055.82s - 1059.82s |  But this API call is undocumented.
1059.82s - 1068.82s |  And the equivalent to that API call is actually five different API calls made by the inner services of AWS.
1068.82s - 1071.82s |  One of them is the create bucket that Kir told you before.
1071.82s - 1073.82s |  And it also calculates the hash.
1073.82s - 1077.82s |  So, we have here an undocumented API call used by AWS to create buckets.
1078.82s - 1085.82s |  So, all of the techniques that I mentioned before gave us around hundreds of buckets.
1085.82s - 1089.82s |  And we understand that we have tons of work to do.
1089.82s - 1095.82s |  Because, as a reminder, some of the buckets came from open source projects.
1095.82s - 1099.82s |  So, we need to understand which bucket is related to what service.
1099.82s - 1104.82s |  And we also need to understand if any of these services is exploitable.
1105.82s - 1110.82s |  So, you're probably wondering what is the answer for those questions.
1110.82s - 1117.82s |  And the answer was, we managed to find five different vulnerabilities within AWS.
1117.82s - 1120.82s |  Some of them by just using the account ID.
1120.82s - 1131.51s |  So, let's talk about the common steps that we need to take that is common to all the vulnerabilities that we found.
1131.51s - 1135.51s |  As Kir said before, we need to create a bucket name before the user.
1135.51s - 1137.51s |  We also need to open the bucket to the world.
1137.51s - 1142.51s |  And we need to put lambda or something to monitor the bucket.
1142.51s - 1145.51s |  And when a file is dropped to the bucket, we can change it.
1145.51s - 1147.51s |  It's the same technique.
1147.51s - 1152.95s |  So, let's explore our second vulnerability for today in AWS Glue.
1152.95s - 1161.95s |  This one is really strong because you only need the account ID to exploit a remote account.
1162.95s - 1167.95s |  And just a reminder, account ID is not a secret by AWS, right?
1167.95s - 1171.95s |  So, what is AWS Glue?
1171.95s - 1175.95s |  AWS Glue is a service for data engineers.
1175.95s - 1178.95s |  It is basically used for data manipulation.
1178.95s - 1183.95s |  To trigger the vulnerability, the user needs to create a job in Glue.
1183.95s - 1188.95s |  When you do so, a bucket is automatically configured with a predictable name.
1188.95s - 1191.95s |  There, files of Glue will be stored.
1191.95s - 1197.95s |  So, if a bucket is predictable, we can take it before the user.
1197.95s - 1200.95s |  And that's exactly what we did.
1200.95s - 1202.95s |  Our user creates a job.
1202.95s - 1206.95s |  When he creates a job, a script is dropped to our bucket.
1206.95s - 1209.95s |  We have our lambda that changes the file.
1209.95s - 1214.95s |  And when the user runs the job, he gets the modified script.
1215.95s - 1220.95s |  And voila, we have a remote code execution on the remote account.
1220.95s - 1231.66s |  So, you are probably wondering, what are the privileges of the AWS Glue service?
1231.66s - 1238.66s |  So, it's actually configured by the user that triggers the job.
1238.66s - 1247.66s |  Most of the time, it will be a default service role that you get when you use AWS Glue for the first time.
1247.66s - 1250.66s |  And that role is pretty interesting.
1250.66s - 1255.66s |  Because it has a lot of enumeration potential on the account.
1255.66s - 1258.66s |  And also, it has some write potential in the account.
1258.66s - 1263.66s |  So, as a red teamer, you could probably escalate from here.
1263.66s - 1266.66s |  But it's not the topic for our talk.
1266.66s - 1271.66s |  Another cool anecdote about this vulnerability is actually invisible.
1271.66s - 1273.66s |  And I will explain.
1274.66s - 1281.66s |  When the user tries to get the script and look at the script, he actually gets the original script.
1281.66s - 1284.66s |  Even though it's already modified.
1284.66s - 1288.66s |  And when he runs it, he actually runs the modified script.
1288.66s - 1291.66s |  This is just due to a bug in the AWS Glue.
1291.66s - 1293.66s |  But it's still cool.
1293.66s - 1296.66s |  So, let's see the full POC.
1296.66s - 1298.66s |  We recorded that in February.
1298.66s - 1303.66s |  Here you can see a user creating a Glue job.
1303.66s - 1310.66s |  When you press the save button, the files are dropped to the attacker bucket.
1310.66s - 1315.66s |  And that's what also gives us the time to modify the script.
1315.66s - 1323.66s |  Because if we are automating this, the Lambda takes just a couple of milliseconds to inject the code there.
1323.66s - 1330.66s |  In this POC, we just put a print for POC purposes.
1330.66s - 1336.66s |  And as you can see, when the user tries to get the script, he gets the original script.
1336.66s - 1348.48s |  And when he runs the script, if we look at the logs, you can see that the script is actually modified.
1348.48s - 1356.60s |  And we got remote code execution.
1356.60s - 1361.60s |  So, now let's explore the third vulnerability for today.
1361.60s - 1366.60s |  In EMR, which is another service of AWS.
1366.60s - 1372.60s |  This one is also kind of cool because, again, it's only the account ID.
1372.60s - 1374.60s |  That's what we were looking for.
1374.60s - 1380.60s |  And it has a cool post-exploitation technique.
1380.60s - 1386.60s |  So, EMR, it's a service for data consumption used by data scientists.
1386.60s - 1388.60s |  Another data service.
1388.60s - 1393.60s |  To trigger the vulnerability, the user needs to create a studio.
1393.60s - 1397.60s |  And when you do so, a bucket is automatically configured.
1397.60s - 1399.60s |  And that's where we come to the picture.
1399.60s - 1402.60s |  Again, we open the bucket before the user.
1402.60s - 1408.60s |  When the user creates a studio, he actually stores Jupyter notebooks to our bucket.
1408.60s - 1412.60s |  In our bucket, we have our Lambda that changes the code.
1412.60s - 1417.60s |  And in Jupyter notebook, you can inject JavaScript.
1417.60s - 1420.60s |  So, we decided to inject JavaScript here.
1420.60s - 1423.60s |  And it acts like stored XSS.
1423.60s - 1432.60s |  When the user tries to open his EMR, his service, he gets the modified Jupyter notebook.
1432.60s - 1439.60s |  And every time he will go to the notebook, he will be redirected to a fake login page created by us.
1439.60s - 1444.87s |  A quick disclaimer about this vulnerability.
1444.87s - 1446.87s |  It's not a zero shot.
1446.87s - 1454.87s |  It means that the vulnerability, when the user configures the page, he actually needs to do some changes.
1454.87s - 1456.87s |  Because he gets an error.
1456.87s - 1458.87s |  But the error is really vague.
1458.87s - 1463.87s |  And when I see an error like this as a user, I do one of two things.
1463.87s - 1466.87s |  Either I change the role.
1466.87s - 1470.87s |  Or I use the policy that is recommended by AWS.
1470.87s - 1474.87s |  In both cases, the vulnerability is going to work.
1474.87s - 1478.87s |  This is due to inconsistent in AWS.
1478.87s - 1487.87s |  The policy that they recommend is actually lacking a string condition that is supposed to protect you from such an attack.
1487.87s - 1489.87s |  But they forgot it.
1489.87s - 1493.87s |  Now Michael will show you a couple of more vulnerabilities.
1493.87s - 1498.87s |  And we'll show you how our technique applies on open source projects.
1498.87s - 1505.95s |  Thank you.
1505.95s - 1506.95s |  All right.
1506.95s - 1508.95s |  So, thank you, Ofek.
1508.95s - 1511.95s |  So nowadays, everyone loves AI and machine learning.
1511.95s - 1514.95s |  And we could not miss a chance to talk about this on our lecture.
1514.95s - 1519.95s |  Let's discuss the rest of the vulnerabilities and start from AWS SageMaker.
1519.95s - 1526.95s |  So SageMaker is a tool in AWS that is designed to build, train, and deploy machine learning models.
1526.95s - 1530.95s |  Canvas is part of the AWS SageMaker ecosystem.
1530.95s - 1534.95s |  And it's a very cool no code drag and drop interface.
1534.95s - 1541.95s |  We discovered that when a user creates a Canvas instance for the first time on a specific region,
1541.95s - 1546.95s |  then a bucket with the name SageMaker dash region dash account ID is created.
1547.95s - 1552.95s |  And the S3 bucket will store files that are utilized by the service.
1552.95s - 1555.95s |  So let's go over the full attack scenario.
1555.95s - 1558.95s |  So the attacker has claimed the bucket before the user.
1558.95s - 1561.95s |  And then the user opens Canvas.
1561.95s - 1564.95s |  And it will create a data set and uploads the files.
1564.95s - 1569.95s |  On the background, the files will be uploaded to the attacker control S3 bucket.
1569.95s - 1571.95s |  And then the attacker could get the data set.
1571.95s - 1573.95s |  And we will have data leakage.
1573.95s - 1578.95s |  But if that's not enough, the attacker could also manipulate the data set.
1578.95s - 1581.95s |  And then SageMaker will use the manipulated data set.
1581.95s - 1583.95s |  And we have data manipulation.
1583.95s - 1586.95s |  So it may lead to inaccurate models.
1586.95s - 1591.95s |  And all of this can happen without the user even knowing that something has changed.
1591.95s - 1595.95s |  And to our next vulnerability on AWS is on CodeStar.
1595.95s - 1599.95s |  So CodeStar is a tool that provides a unified user interface
1599.95s - 1602.95s |  to easily manage software development activities.
1602.95s - 1606.95s |  So the service was deprecated just, I think, two weeks ago.
1606.95s - 1610.95s |  And in this scenario, the attacker has claimed the bucket again before the user.
1610.95s - 1615.95s |  And when a user tries to create a CodeStar project on a region,
1615.95s - 1619.95s |  then CodeStar on the background will try to create a bucket.
1619.95s - 1623.95s |  And it will fail. And it will return the user an error.
1623.95s - 1626.95s |  So this is essentially a denial of service attack
1626.95s - 1632.95s |  since the attacker prevents the user from using CodeStar on a specific region.
1632.95s - 1635.95s |  And there's one more vulnerability on service catalog.
1635.95s - 1637.95s |  We won't elaborate about it right now.
1637.95s - 1642.95s |  But we're going to publish a blog in the next few hours so you could see it there.
1642.95s - 1649.95s |  Okay. So after we talked about the vulnerabilities in AWS,
1649.95s - 1652.95s |  on our research we also identified that this attack vector affects
1652.95s - 1655.95s |  many open source projects as well apparently.
1655.95s - 1660.95s |  And many open source projects create S3 buckets as part of functionality.
1660.95s - 1664.95s |  And the consequences change depending on the project.
1664.95s - 1668.95s |  But some projects are vulnerable and could allow an attacker
1668.95s - 1671.95s |  to gain full access to all of the files in the bucket.
1671.95s - 1677.95s |  So here you can see an example of a project that checks if the bucket exists.
1678.95s - 1682.95s |  And this check is wrong since an attacker could claim the bucket
1682.95s - 1686.95s |  and the project will print to the screen that the bucket already exists
1686.95s - 1690.95s |  but it will continue running without any problems.
1690.95s - 1695.95s |  And there's another example of a project that tries to verify that the bucket exists
1695.95s - 1699.95s |  and it tries to list the bucket. But this check is also wrong
1699.95s - 1704.95s |  since an attacker could claim the bucket, open it for public access,
1704.95s - 1708.95s |  set permissive policy and by doing so it will allow the victim
1708.95s - 1713.95s |  to list using the AWS S3 LS command to list the bucket
1713.95s - 1720.39s |  and again the script will continue running without any failure.
1720.39s - 1723.39s |  And also as part of our investigation we found services
1723.39s - 1726.39s |  that could be vulnerable in the past.
1726.39s - 1728.39s |  These services created predictable bucket names.
1728.39s - 1733.39s |  For instance Athena once created a bucket with the name AWS Athena
1733.39s - 1737.39s |  query results dash uh account ID dash region.
1737.39s - 1742.39s |  This bucket is not created anymore and when we when we encountered it
1742.39s - 1746.39s |  Athena did not seem to be vulnerable and now there's this bucket is created
1746.39s - 1751.39s |  by the user specification. Alright so we discussed vulnerabilities
1751.39s - 1754.39s |  in AWS services and open source projects as well.
1754.39s - 1759.39s |  Now let's explore how we can elevate what we've learned so far to the next level.
1760.39s - 1764.39s |  So we wanted to increase the chances of a victim to be compromised.
1764.39s - 1768.39s |  It would be important to us to show that this attack vector is not just theoretical
1768.39s - 1772.39s |  but it's also practical and effective on real world scenarios.
1772.39s - 1775.39s |  And we are proud to produce uh to introduce a new technique
1775.39s - 1779.39s |  we named bucket monopoly. So in previous vulnerabilities
1779.39s - 1782.39s |  we targeted specific regions of other accounts.
1782.39s - 1785.39s |  We could check if a bucket already already exists and if not
1785.39s - 1788.39s |  we could claim it before the victim. However as you all know
1788.39s - 1792.39s |  AWS has multiple regions so instead of focusing on a single region
1792.39s - 1797.39s |  we could claim all possible regions that the user has not claimed yet.
1797.39s - 1800.39s |  This strategy increases the likelihood of an unsuspecting victim
1800.39s - 1804.39s |  interacting with an attacker on S3 bucket.
1804.39s - 1807.39s |  But since we have several vulnerable services
1807.39s - 1811.39s |  let's create all of the buckets in all of the possible services.
1811.39s - 1815.39s |  This is practically a landmine. The victim is surrounded by malicious
1815.39s - 1820.39s |  buckets belonging to different services. Whenever the victim will use
1820.39s - 1825.39s |  a new service from uh the six services we presented on any new region
1825.39s - 1831.47s |  it will be immediately compromised. Let's explain step by step
1831.47s - 1836.47s |  how to perform this kind of attack. First of all we must identify
1836.47s - 1840.47s |  predictable bucket name. After finding these buckets we need to verify
1840.47s - 1843.47s |  that the associated services that create these kinds of buckets
1843.47s - 1848.47s |  are indeed vulnerable. Secondly we must recognize what is the unique identifier.
1848.47s - 1851.47s |  And the last step which is the easy one we need to claim
1851.47s - 1856.47s |  all the bucket names across all regions. So we showed you several ways
1856.47s - 1860.47s |  how to find these kinds of buckets. We start reconnaissance by looking for
1860.47s - 1864.47s |  bucket names that contains a prefix or a postfix alongside
1864.47s - 1869.47s |  with an identifier like account ID or a hash. And it could be achieved
1869.47s - 1873.47s |  by using the GitHub regex search. We could read AWS documentation as well.
1873.47s - 1877.47s |  And we could use, we could crawl AWS services with tools like
1877.47s - 1882.47s |  TrailShark that Ofek just showed you before. Next the second step is to understand
1882.47s - 1887.47s |  what is the unique identifier inside the bucket name. It might be a random hash
1887.47s - 1892.47s |  and it will require further instigation. It could also be account ID or some kind of
1892.47s - 1898.47s |  other public metadata information. If it's a hash we could search on GitHub
1898.47s - 1902.47s |  and on SourceGraph to find leaked hashes and then target them. And if it's
1902.47s - 1906.47s |  an account ID there are multiple ways to find them. So the first method is
1906.47s - 1911.47s |  to use GitHub. Uh we could search uh the GitHub regex search for specific patterns.
1911.47s - 1915.47s |  We could also leverage the GrayHat Warfare platform which is a platform
1915.47s - 1919.47s |  that collects publicly accessible S3 buckets. And then we could extract the account ID
1919.47s - 1925.47s |  out of the bucket. So Jerome Brown did it and he extracted nearly 197,000
1925.97s - 1931.47s |  unique account IDs. We could also extract the account ID out of the AWS access key ID.
1931.47s - 1936.47s |  Nice article by Tal Berry who showed how to do it. And lastly there are valuable
1936.47s - 1941.47s |  lists out there of known AWS accounts which includes account IDs of numerous large
1941.47s - 1946.47s |  organizations and vendors. And the last step is to monopolize. So Attacker
1946.47s - 1951.47s |  utilized the understanding of naming conventions and account IDs to strategically create
1951.47s - 1957.47s |  S3 buckets with predictable names across all AWS regions where these buckets do not exist yet.
1957.47s - 1963.47s |  Then the attacker will open the bucket for public access, set permissive policy and by doing
1963.47s - 1970.47s |  so they position themselves to intercept the victim future interactions with these buckets.
1970.47s - 1974.97s |  Now let's talk a little bit about disclosure and timeline. So we reported these vulnerabilities
1974.97s - 1979.97s |  at the middle of February and AWS immediately started fixing them. We got our final
1979.97s - 1985.47s |  confirmation that the vulnerabilities were fixed at uh the end of June. And the general
1985.47s - 1991.47s |  approach here was consistent. So AWS will either uh add some kind of a random sequence or a
1991.47s - 1997.47s |  number to the bucket and then create it. Or they will prompt the user to choose a new bucket
1997.47s - 2002.97s |  name thereby they will ignore the already claimed bucket. AWS also indicated that they are
2002.97s - 2006.97s |  confirming the results of each team investigation and they will ca- contact customers
2006.97s - 2013.47s |  directly in the event that they were affected. So to conclude what we've seen up until now. We
2013.47s - 2018.27s |  have identified six vulnerabilities in AWS uh that might enable an attacker to exploit
2018.27s - 2023.57s |  organization. We explained how these vulnerabilities occur and we presented a new attack vector
2023.57s - 2028.17s |  called Shadow Resources as well as the technique we named Bucket Monopoly. While the
2028.17s - 2033.47s |  vulnerabilities we mentioned were already mitigated by AWS, this attack vector can still be
2033.47s - 2039.81s |  applicable to other AWS services and many, many open source projects as you just saw. So to
2039.81s - 2045.37s |  prevent an entity that assumes a role accessing a bucket you do not trust, you can define a
2045.37s - 2050.67s |  scoped policy that contains the AWS resource account condition. So this approach will prevent
2050.67s - 2057.07s |  the user in your account to access and write data to buckets that are located on accounts you
2057.07s - 2064.27s |  do not trust. We also recommend verifying that the owner of the S3 bucket using the expected
2064.27s - 2070.11s |  bucket owner header to ensure that the buckets that are used by your services are indeed
2070.11s - 2075.57s |  under your account. It's very simple. You can just take each one of your buckets, the cloud
2075.57s - 2080.81s |  formation, the glue, the EMR and the rest of them and for each region check that no one has
2080.81s - 2085.77s |  claimed your bucket. It's a simple solution and it's great to check if you uh haven't been
2085.77s - 2093.74s |  exploited. Sorry, this command. And um the expected bucket owner header is also valuable for
2093.74s - 2102.25s |  open source projects as well to verify that no one has claimed the bucket. And lastly, name
2102.25s - 2109.03s |  your S3 bucket with some kind of um a random number or a string. Make it the bucket name less
2109.03s - 2118.41s |  predictable. So after everything we've demonstrated, do you still believe account ID is not a
2118.41s - 2126.82s |  secret? Thank you. We have short time for questions and you're welcome to follow us on Twitter.
2126.82s - 2138.86s |  Alright. Questions anyone? Alright. We can. So, so do I, do I policy to uh prevent a lot of these
2161.17s - 2166.17s |  attacks? So you can use them. Uh as as I showed you before um the, sorry, the the uh the
2171.48s - 2177.38s |  um. Thank you. So you should, we we showed you several ways. I think the the resource account
2177.38s - 2183.66s |  condition should be fine to prevent all your roles and users that assuming this role from
2183.66s - 2188.76s |  accessing buckets you do not trust. I mean for specific roles that need to access some kinds of
2188.76s - 2193.76s |  buckets, you just, I mean by default I recommend adding these like section to making sure that
2194.76s - 2199.76s |  the buckets you try to access or your services et cetera will not um access buckets that you do
2204.00s - 2209.00s |  not own or maybe someone else owns. Right. Cause you might also delete the bucket and then
2210.96s - 2216.94s |  someone can create it. So it's like a dangling resource as well. Alright. Yeah I think I'm gonna
2216.94s - 2221.94s |  have to go back through and double check my. Thank you. My uh deny policies. Thanks.
2221.94s - 2225.60s |  Alright. Thank you very much for attending.


url: https://www.youtube.com/watch?v=kEIJFsOgEBY
title: DEF CON 32 - AMD Sinkclose-Universal Ring2 Privilege Escalation - Enrique Nissim, Krzysztof Okupski
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=kEIJFsOgEBY",
  "title": "DEF CON 32 - AMD Sinkclose-Universal Ring2 Privilege Escalation - Enrique Nissim, Krzysztof Okupski",
  "description": "System Management Mode (SMM) is one of the most powerful execution modes in the x86 architecture and code at this level is invisible to the Hypervisor and OS-level protections, including anti-cheat engines and anti-virus systems. While the BIOS ecosystem's complexity has led to a multitude of vulnerabilities in firmware over time, vendors are now making strides in delivering patches with greater speed and efficiency. Unfortunately, these efforts are not enough in the presence of a CPU vulnerability.\n\nWhen researching the AMD processor, our team noticed a flaw in one of the critical components required for securing SMM. This silicon-level issue appears to have remained undetected for nearly two decades.\n\nThis presentation starts by providing an introduction to SMM and the security mechanisms that the AMD processor provides to support it. Subsequently, it delves into the CPU design flaw and the complete methodology and engineering used to create a universal ring -2 privilege escalation exploit.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2614,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.76s | This text was transcribed using whisper model: large-v2

 as a bootkit or in some cases as a firmware implant as we'll see later. What's good also is
5.76s - 13.08s |  that code here is hidden from the OS and the hypervisor so antivirus EDRs or anti-cheat
13.08s - 18.48s |  engines won't won't won't see these things right? Now in terms of privilege level this is
18.48s - 22.86s |  just uh simplification but we can think it about like this we have our applications like for
22.86s - 28.46s |  instance our browser running at the very top of ring three then we have our OS ring zero and
28.46s - 35.12s |  if we have a hypervisor it's down the OS of course and only then we have SMM. Now how does
35.12s - 41.04s |  this work? We can divide the uh the thing in into two phases. We have boot time where the
41.04s - 46.04s |  firmware BIOS UFI code will after initializing the the hardware will load the SMM code into an
48.48s - 54.68s |  special area of memory called SM RAM. And then it will hand off the execution to the OS
54.68s - 60.64s |  loader then the OS loads and as you can see SMM is just a run time concept. It will provide
60.64s - 65.88s |  services for the for the platform. For instance power management, security and the OS can
65.88s - 71.32s |  invoke some services from it as well. So how does that happen? Well there's this con- concept
71.32s - 78.20s |  of system management interrupt. When an SMI occurs the processor gets interrupted and then
78.56s - 85.66s |  the the current register set of the processor is saved into the SM RAM into a safety area. And
85.66s - 90.66s |  then whatever needs to happen happens some um good feature for the system and it then comes
93.44s - 99.98s |  back to the OS. In this case we are doing a synchronous SMI like a software SMI the OS is um
99.98s - 104.98s |  invoking a service from SMM. Now we've been working on this area for a bit. Um we we
108.68s - 112.26s |  published some some blogs. We've done some some presentations before. How are you on
112.26s - 117.26s |  Hexagon? We have a couple of CVEs in 2023 and we also released some tools for um checking for
119.70s - 126.10s |  misconfigurations and known issues. Um all of these things that we've done before are mostly
126.10s - 131.44s |  related to either misconfigurations from vendors or software vulnerabilities in components.
131.44s - 137.48s |  Now we're gonna present today is an architectural flaw in the AMD processor itself. So that's
137.50s - 142.50s |  very different. And so for that we're gonna just see again what is what makes the security of
142.50s - 148.08s |  SMM. So we can think on the CPU when it's an SMM mode we have the memory controller in the
148.08s - 153.12s |  middle and we can just access this area with where the SMM code and data lives. We can
153.12s - 158.68s |  execute instructions from this area. We can write to this area and read. However when the CPU
158.68s - 165.02s |  is in normal mode meaning non-SMM the memory controller just rejects um if if if you read
165.04s - 170.44s |  from this um from this memory you're just gonna return receive F's. Writes are discarded and
170.44s - 176.84s |  of course execution is disallowed. How does this hap- how is this happening? Well we have
176.84s - 182.48s |  um what's called a TSEC region or top of memory segment region. Essentially the firmware
182.48s - 187.48s |  after loads uh after it loads SMM at boot time it will hopefully configure these 2 registers
188.02s - 193.02s |  and the idea is to overlap um have this region to overlap with all the contents of SMM to
197.16s - 202.30s |  protect it. We have uh 2 registers we have the TSEC base and the TSEC mask which is the
202.30s - 208.80s |  length. The TSEC ma- the TSEC mask as you can see have also uh additional fields and yeah
208.80s - 214.34s |  essentially this is the way. The memory controller will see that uh the CPU is executing in
214.38s - 221.08s |  normal mode and will just reject to read the content or write the content of the SMRAM. Has
221.08s - 226.08s |  to be enabled. That's why the T-valid bit is there. Now the layout of SMRAM uh basically is
229.72s - 234.72s |  up to the vendor to define but most systems out there are gonna follow what the EDK2 has
237.16s - 242.56s |  which is TianoCore. This is reference code. And uh essentially it's gonna consist at the
242.56s - 248.36s |  very bottom you can see here um SMM core area. This is just supporting code for the rest of
248.36s - 253.36s |  um of what's gonna be in there. And then for each core we're gonna have an SMM base and at a
255.64s - 260.74s |  specific offset 8000 from the SMM base we're gonna have the entry point which is where the
260.74s - 266.18s |  processor, the core is gonna start executing from when the SMI happens. And then we have a
266.18s - 272.42s |  safe state at offset FE00. This is TianoCore right? It can be laid out differently by the
272.42s - 277.52s |  vendor. And then we have the SMI handlers at the very top which is are gonna be the
277.52s - 282.12s |  functions that are are gonna be useful for for us for the system. Handling power, security or
282.12s - 288.12s |  whatever. Um so yeah just a summary of the SMRAM registers. We have the 3 just we just
288.12s - 293.80s |  mentioned. And we also have an SMM block. That's very important. Hopefully the firmware code
293.80s - 299.90s |  is gonna set this bit so that the whatever runs at run time the OS cannot tamper with these
299.92s - 305.82s |  registers. We don't want for example at run time having the OS disabling the TSEC location
305.82s - 312.24s |  because this will just um update or change the code at the SMRAM location and execute with
312.24s - 318.64s |  these additional privileges right? Now this need to be configured for each core. With that we
318.64s - 323.64s |  can see a first difference between how Intel and AMD manage the access to MSRs. On Intel
324.30s - 329.30s |  systems these MSRs that are related to SMM are only accessible while the CPU is in SMM. In
334.24s - 341.00s |  fact obtaining the SMM base for example on Intel could be considered a leak. On AMD all
341.00s - 348.12s |  these MSRs are accessible from ring zero no problem. Again if we have the SMM lock bit set
348.12s - 352.92s |  then the configuration cannot be changed. Not even SMM can change the configuration until
352.94s - 357.14s |  the next power cycle in which I mean the firmware will take over again and configure this in
357.14s - 362.14s |  the same way. But we can now spot the bug in the documentation. This is the same TSEC mask
365.52s - 372.08s |  register and the fields just a picture from the documentation. We can see how the SMM lock
372.08s - 378.12s |  is covering all of the fields except for two over there. These two fields are gonna be what
378.16s - 384.36s |  we're gonna be talking about um in this session. And we have T-Close and A-Close. Um we're
384.36s - 390.40s |  just gonna focus on T-Close. A-Close it stands for um the same feature but for uh a previous
390.40s - 394.08s |  region called ASEC which is overlaps on the video memory. It's not used anymore so it doesn't
394.08s - 399.08s |  matter. But what happens is when this bit is set the data accesses that the core that the
401.52s - 407.72s |  core performs when it's running in SMM are gonna be directed to MMIO instead of to SMRAM. And
407.72s - 413.70s |  that's that's that's cool because as we said before we could set this bit from ring 0
413.70s - 420.30s |  because it's not locked by the SMM lock right? It actually in the in the A-Close description
420.30s - 425.70s |  it also says hey I mean don't forget to unset this when you're returning from SMM cause
425.70s - 430.72s |  otherwise your safety are gonna be erroneously read from MMIO. That's bad. Um the
431.32s - 438.32s |  documentation says as well hey if you have a valid T-Close region and you're in SMM and the
438.32s - 443.16s |  T-Close is set then instruction fetches are still gonna be directed to DRAM but data
443.16s - 449.40s |  accesses are gonna go to MMIO instead. If you're not in SMM then both accesses, both type
449.40s - 454.40s |  of accesses are gonna go to MMIO. So we can say um x86 behaves in a hardware like a
454.80s - 461.70s |  hardware architecture goes to hardware right? If we have um our core core 0 for example
461.70s - 467.14s |  running in normal mode both data and instruction fetches just go to MMIO. If we have our
467.14s - 472.62s |  core 0 now in SMM with the T-Close off this is what happens. No problem we read and
472.62s - 478.42s |  execute from SMRAM. However when set T-Close on now data fetches go like this. This is a
478.42s - 483.42s |  problem because this portion can be controlled by an attacker. So triggering the
486.18s - 492.32s |  condition is super easy we just need to um set this this bit, this T-Close bit and call
492.32s - 497.30s |  into an SMI and the system will immediately freeze, hang or you're gonna spot the problem
497.30s - 502.30s |  right there. This feature exists because um while AMD wanted to have the ability to re-use
503.02s - 508.02s |  the physical address space and have SMM code um access an IO device that were using the
511.16s - 517.40s |  same SMRAM uh physical memory essentially. Um we haven't seen any vendor using this
517.40s - 522.40s |  feature um but yeah that's why. And it was on on what we could track is in 2006 there was
525.00s - 529.28s |  this document that first mentioned the feature so it means it's been around at least for
529.32s - 535.57s |  18 years. Now for people familiarized with um biosecurity they're probably gonna remember
538.65s - 543.69s |  this vulnerability presented by Christopher Thomas in 2015 called the memory sinkhole
543.69s - 549.49s |  attack. And what happened was that he was able to remap the APIC which is a specific
549.49s - 555.23s |  device um in the um available and overlap it with the T-Seq area and it caused the same
555.23s - 559.97s |  effect. Uh data fetches will go to MMIO instead of SMRAM. Now the difference here of
559.97s - 566.45s |  course is that uh that was only limited to the APIC and it only affected the 4K region where
566.45s - 572.25s |  the APIC was overlapped with. The sinkhole's behavior changed uh how the entire T-Seq
572.25s - 578.13s |  works. Um any device in theory could be overlapped right? Because we just direct any
578.13s - 584.38s |  access to the MMIO space. So we can bring some some attack ideas in. Our easy thing will
585.38s - 590.38s |  be, the easiest thing will be to just grab any PCI device and hopefully we'll have a good
593.42s - 597.66s |  register layout on its bar so that we can take control of the execution at the very
597.66s - 602.10s |  beginning of the entry point. As there are multiple integrated devices that we could use we
602.10s - 607.20s |  could just try remapping one of those and based on what we read the register should become
607.20s - 612.20s |  visible at the T-Seq location from the OS. However this failed. We can see here how the
614.84s - 619.84s |  uh we have an Ethernet controller uh with its original uh bar 2 uh D0714000. We have some
624.12s - 628.22s |  registers right here. They're visible registers. And we're gonna try to overlap when we try
628.22s - 633.22s |  to overlap it with the SMM entry uh BFEB0000 we can see that we're still reading F's. So the
634.92s - 639.94s |  remapping failed. Registers are not available. Um we can see that the registers were moved from
640.60s - 645.60s |  their original location. They're they're something happened. When we restore we can see
650.18s - 655.88s |  the registers again. So it's not that we broke anything. So it's just the the the priority
655.88s - 660.88s |  of the memory probably failed right? So what that that led us to try to understand ok how
660.88s - 667.90s |  that does how how is that working? Have this register called top of memory or TOM. Um this
667.92s - 672.92s |  thing defines a limit between the usable DRAM before 4 gigabytes on the physical address space
675.30s - 680.30s |  and MMIO space on top. Now on Intel this register has a lock bit. Once it's configured you
682.64s - 687.28s |  cannot tamper with it anymore at run time. But on AMD it doesn't have such a lock so we
687.28s - 692.78s |  can just you know modify this and maybe that's good for us. The idea is simple. We have
692.80s - 698.24s |  this is uh imagine this is the layout right? And we'll move the MMIO space or the TOM that
698.24s - 703.72s |  defines the MMIO space to match with the TSEC base. So we have something like that. Maybe
703.72s - 708.72s |  then trying the same trick that we uh did before could work. Unfortunately we could move the
711.02s - 715.76s |  TSEC no problem but it didn't change the behavior that we saw before. In practice it didn't
715.76s - 720.76s |  work. So that led us to dig dig uh dig uh deeper into into the computation of the
723.14s - 727.14s |  foundation and we found there are some actual priorities when the core access um some
727.14s - 731.10s |  portion of the physical address space. Essentially determines what what is going. And we
731.10s - 736.32s |  can see that the TSEC and ASIC mechanisms are listed 4. Which means 1, 2 and 3 with whatever
736.32s - 742.22s |  is listed there has less less priority than this. And at the at number 1 we can see the TOM
742.22s - 745.86s |  is is is listed there. So we have that's why it never worked. Right? It would have never
745.86s - 750.86s |  worked. What's at 5? Where we have the MMIO configuration space and the APIC. So
753.76s - 758.76s |  uh that makes sense. We the APIC was used before in the Intel attack. The MMIO config space
761.40s - 766.40s |  we cannot use really. Um and then at 6 we have this NORBRIDGE address space uh routing but uh
768.92s - 773.92s |  that probably stands for older architectures. This is not seen in modern modern stuff. So we
773.92s - 780.42s |  cannot use it. For the APIC we cannot really use it and we're gonna explain why. But for
780.44s - 785.44s |  that we need to give an analysis of of um how the SMM entry point code works. When the SMM
787.90s - 794.64s |  when the SMI occurs the SMM core uh that the core um executing at SMM starts executing in
794.64s - 800.52s |  real mode. In 16 bit mode flat. No protection whatsoever. What it has to do is quickly go
800.52s - 804.82s |  to protected mode 32 bit and then goes to long mode and then passes the execution to the
804.82s - 809.62s |  handlers. This is a very simplified view. Now that first step going to from real mode to
809.62s - 815.90s |  protected mode is is key right? That's the first thing that needs to happen. For this um on
815.90s - 820.90s |  x86 we need essentially an are enabled segmentation. Uh segmentation provides um the
824.10s - 828.30s |  ability for the for the core to see the memory in a segmented way. That's that's how it's
828.30s - 833.38s |  called. Essentially we can have different segments for memory and assigns uh different
833.38s - 838.38s |  permissions or like um the ability to execute code or or just read data and stuff like that.
838.42s - 844.28s |  We have this key data structure called global descriptor table of G or GDT. And we have a
844.28s - 849.72s |  register on the processor that is called GDTR that's gonna point to the base of our GDT
849.72s - 855.16s |  structure and it's gonna have a limit in bytes. And so the GDT is just really an array of
855.16s - 858.20s |  descriptors. And we can have different type of descriptors. We can have we can have code
858.20s - 862.74s |  descriptors, data descriptors. Each one is gonna have a base. The first one is never used.
862.74s - 866.80s |  That's why it's called it's called null descriptor. But then when we have a jump you can see
866.80s - 871.66s |  we'll have um a jump. It's not only having an offset like a target location but it's also
871.66s - 876.10s |  gonna have like a segment selector right here. That segment selector picks the descriptor
876.10s - 881.10s |  we're gonna use for the for for our our code segment. And then the top the the offset is
881.10s - 887.42s |  added to the base that it's indicated by the GDT. Forming the final linear address. With
887.42s - 892.42s |  that we can do uh an analysis of um the EDK2 SMM entry point. Essentially um we can see
896.98s - 903.70s |  that at the very beginning we are moving into the register BX. The entry point plus 4D. This
903.70s - 910.14s |  is in this is a decom like um extracted from a from from a compiled um SMM code. So you can
910.14s - 915.38s |  see at 4D right there we have a GDT description ready to to to be loaded into the GDTR. The
915.38s - 919.34s |  next instruction that matters for us is the load GDT. This is instruction that is gonna load
919.34s - 925.92s |  the GDTR with the content that BX points to. And finally we have a jump over here that's
925.94s - 932.44s |  gonna perform the actual um going into protected mode. And it has the selector of co of code
932.44s - 939.36s |  as as well and the offset. Now with this what what will happen if we over overlap a device
939.36s - 945.72s |  that we control on the entry point? And we control offset 4D. What will happen is that the
945.72s - 951.10s |  load GDT will be loading something that we control. So we can load our fake GDT right? So
951.12s - 956.58s |  that's what we're trying to do here. We're trying to get control over the offset 4D with any
956.58s - 962.02s |  device that we can find so that the the fake GDT then provides the descriptors we need and we
962.02s - 968.90s |  can take control and jump down there. That's the whole idea of the attack. And that's why
968.90s - 973.80s |  the APIC is a problem. Two things. First the system becomes unstable when the APIC is
973.80s - 979.28s |  moved. Super unstable. Second the APIC registers are not useful for taking control in the way
979.28s - 985.06s |  we need. We can see that at 4D we have these reserved regions with all 0s. Writes are
985.06s - 990.24s |  discarded here. We're not able to control here and if we load a GDTR with all 0s we're
990.24s - 996.84s |  essentially saying to the processor hey here's an empty GDT. So this won't work. And at this
996.84s - 1001.52s |  point we found another device not documented by the the the specification that also has
1001.52s - 1006.62s |  priority over uh the TSEC region. That's the spy controller and Christoph's gonna describe
1006.62s - 1011.64s |  it for us. Alright. So the spy controller is a very nice device for us because it's present
1014.34s - 1019.70s |  in all the systems we've tested and it's basically used to access the spy flash on um AMD uh
1019.70s - 1024.54s |  systems. So for example for reading, writing, erasing the spy flash it always goes for the
1024.54s - 1029.48s |  spy controller. And it has a couple of key features that are really uh interesting to us.
1029.48s - 1034.48s |  First of all we can relocate the bar over the SMM entry point. Secondly the portions which
1034.48s - 1038.86s |  are interesting to us at offset 4D we can control them. And three it actually takes
1038.86s - 1044.60s |  precedence over uh SMRAM when TCLOS is enabled. So with that in mind what we will do for our
1044.60s - 1051.30s |  attack is simply take the spy bar, relocate it over the SMM entry point of core zero and
1051.30s - 1056.30s |  then afterwards manipulate the values at offset 4D within that bar. Um the um registers
1058.30s - 1062.48s |  that actually correspond to that portion of memory in the bar uh are the memory range and
1062.48s - 1067.58s |  run protection zero register. Those were used in the past to uh lock down access to the spy
1067.58s - 1073.22s |  flash but mostly these are not configured and not fixed so we can fully control them. On
1073.22s - 1078.06s |  some systems they are fixed but actually they are fixed to values which are still useful for
1078.06s - 1083.06s |  us. So before I dive into the exploits uh I also want to uh show you a little bit our debugging
1085.58s - 1090.58s |  stuff because it's a little bit special. Um so we are facing actually two challenges uh
1092.54s - 1098.44s |  when we try to develop the exploit. First of all we didn't really have a way to know whether our
1098.44s - 1103.62s |  payload ran because the system just crashes, reboots and memory is just all wiped. Uh and
1103.62s - 1109.76s |  secondly we didn't really have any debugging framework for SMM. Um and like for example
1109.76s - 1114.36s |  when crashes happen we want to be able to modify the code however we see fit. So to resolve the
1114.36s - 1120.40s |  first issue we actually took a PCI squirrel which is typically used with PCI leach for a DMA
1120.42s - 1127.06s |  attacks but the nice thing about it is actually is that it has a bar buffer as we call it
1127.06s - 1133.30s |  where when we write to it it actually survives across reboots. So for instance a payload can
1133.30s - 1138.68s |  write a value to uh the bar buffer kind of like a checkpoint so we know it ran and then when the
1138.68s - 1143.04s |  system reboots it's still going to be there. Right. And if we want to modify for example for
1143.04s - 1148.52s |  the second issue if we want to modify uh code in SMM for some extra debugging capabilities for
1148.54s - 1154.04s |  that we just um injected a firmware implant uh that loads a nice SMM module that allows us to
1154.04s - 1159.02s |  do all of that. So the setup looks like this we just have the PCI squirrel connected to our
1159.02s - 1164.02s |  target device via an M2 uh adapter and all of this is powered externally by a power supply. So
1166.62s - 1171.36s |  it's time to get our hands dirty so let's take a look at how uh the exploit looks like. In the
1171.36s - 1175.86s |  first attempt uh we remap the spy bar just like mentioned before over the SMM entry point of
1175.94s - 1182.94s |  core zero. Then we tweak uh these values at offset 4D. We create a fake GDT in the beginning
1182.94s - 1187.38s |  of the address space uh with the with a nice base address that will allow us when the jump
1187.38s - 1193.72s |  happens to redirect execution to our own payload. And then when we uh execute the SMM entry
1193.72s - 1199.10s |  point code with TCLs enabled what's going to happen is uh the old GDT is actually going to
1199.10s - 1204.84s |  load the GDT register uh with a value that points to our own fake GDT so that's great. And
1204.84s - 1209.12s |  afterwards when the jump happens a descriptor from the fake GDT is going to be taken that we
1209.12s - 1214.12s |  control um and it's going to be used as a base uh for the jump. So and um this is going to
1218.26s - 1223.94s |  redirect execution like this at least in theory. So um an interesting detail is actually how
1223.94s - 1228.94s |  we pick the base address in the GDT descriptor um and for that we have to understand how it
1229.68s - 1234.68s |  normally executes and how it executes with TCLs in this case. So um when the 4 jump happens um
1238.76s - 1244.12s |  and the normal execution what happens is the GDT register is going to point to GDT within
1244.12s - 1248.66s |  SMRAM where it's nicely protected. Um and the segment selector is going to index into that
1248.66s - 1254.16s |  table um and the base is going to be actually fixed to zero. Which means with a base of zero
1254.16s - 1259.90s |  and we add it uh to the 4 jump offset what's going to happen is the linear address is going to
1259.90s - 1265.40s |  be the same. Now in our case actually we have a bit of an issue. We want to read the the
1265.40s - 1270.42s |  execution um outside of TSEG. The only problem is that within the first 4 gigs of memory
1273.02s - 1277.98s |  after TSEG there's not really any spot where we can put a payload right? So if we increase the
1277.98s - 1282.06s |  base a little bit sure the instruction pointer is going to go a bit more up up up up and the
1282.06s - 1287.80s |  address space we don't really have DRAM over there that we control. So we wondered okay what
1287.80s - 1292.80s |  happens if we actually increase the base such that when we uh the base of the GDT descriptor
1296.08s - 1301.08s |  such that when we add it to the 4 jump offset it actually overflows. Um yeah it just
1303.54s - 1308.28s |  overflows. So we thought okay this isn't going to be possible but actually it was. And this is
1308.28s - 1313.38s |  nice because uh if we choose the base sufficiently big and we add the offset we can actually
1313.38s - 1316.42s |  make it wrap around and make it jump to our own payload in the beginning of the physical
1316.42s - 1320.58s |  address space. The beginning of the physical address space we have DRAM there. Great we
1320.58s - 1326.66s |  control all of that. So uh that was one of the key takeaways actually that we had from the
1326.66s - 1333.00s |  research as well. So this worked our payload actually ran and we saw this because it would
1333.00s - 1337.24s |  write a value this nice checkpoint to our bar buffer but the system would crash and we
1337.26s - 1342.00s |  wondered okay why is this happening? Um the reason was the SMM safe state. So like Enrique
1342.00s - 1347.20s |  mentioned when a CPU goes to SMM mode it actually saves the current register state into the uh
1347.20s - 1354.02s |  SMM safe state. When it returns it just restores it. What happens is when TCLs is enabled
1354.02s - 1359.08s |  actually the writes when the core enters SMM are going to be discarded. Which means when we
1359.08s - 1364.36s |  return with TCLs disabled actually it's just going to use stale values that were still there
1364.38s - 1369.16s |  that were stored before. And to resolve this the trick is actually pretty straight forward.
1369.16s - 1375.66s |  We trigger the SMM twice. One time um without TCLs and the second time with TCLs. So we first
1375.66s - 1382.60s |  put the core zero into a known controlled state and then trigger an SMI without TCLs. This
1382.60s - 1387.70s |  is going to prime the SMM safe state and afterwards when we trigger the bug with TCLs
1387.70s - 1392.74s |  enabled the code is going to go for the same execution path and is just going to reuse the
1392.76s - 1399.60s |  values that we stored before. So that worked but unfortunately it crashed again. But this
1399.60s - 1404.70s |  time around we did see actually that the uh the core zero was returning from SMM so that was
1404.70s - 1409.78s |  great. We had full control of core zero. OS code was running. We saw our checkpoints. Great.
1409.78s - 1415.68s |  But no matter what we tried this damn thing was still crashing. Um so we spent an eternity
1415.68s - 1421.56s |  debugging this thing until we stumbled into this. When we enable TCLs what happens is we
1421.58s - 1427.32s |  enable it on core zero only but actually it gets enabled on both cores. Core zero and core
1427.32s - 1432.78s |  one. Um and we found that the culprit for this is symmetric multithreading. So this is AMD's
1432.78s - 1437.56s |  implementation of Intel hyperthreading. Um and what it does is it divides a physical core
1437.56s - 1442.26s |  into two logical cores. And some of the resources on these logical cores are shared and some
1442.26s - 1447.30s |  of them are not. So for instance the SMM base MSR is separate so every logical core has a
1447.34s - 1452.34s |  different base MSR. But the TSEC mask is actually shared which is what we just saw. Right? And
1455.68s - 1460.68s |  we wondered is this the actual issue because we assume when an SMI gets triggered that only
1460.68s - 1466.50s |  one core goes into SMM at a time. And we put this to the test and what we saw is the
1466.50s - 1472.40s |  following. When we have multiple cores running in normal mode so outside of SMM um when we
1472.58s - 1478.04s |  when one of them triggers an SMI an interrupt gets asserted on all of the cores. And all of
1478.04s - 1481.82s |  the cores are going to go into SMM mode and going to start executing the SMM entry point
1481.82s - 1486.82s |  codes um for uh for each and one of them. So our assumptions were actually wrong. Right? We
1489.32s - 1493.76s |  assume the SMIs are local but they're actually not. And we thought that this was actually the
1493.76s - 1499.36s |  case because the indicate two code has a so called rendezvous routine which will every time
1499.36s - 1503.96s |  you enter into SMM this routine is going to be triggered. And that core which entered into
1503.96s - 1510.54s |  SMM will send an explicit interprocessor interrupt to all of the logical cores to explicitly
1510.54s - 1515.58s |  pull them from whatever state they were in into SMM. And well what's the point of that if
1515.58s - 1519.88s |  actually all the cores always go into SMM anyway right? Um and we dug a little bit deeper
1519.88s - 1524.76s |  into the documentation and we found that the IO hub seems to be responsible for this to uh
1524.76s - 1529.76s |  basically assert this interrupt on all of the cores so we're out of luck. So to summarize we had
1532.70s - 1538.14s |  all cores always going into SMM and T-Cores being enabled on two cores at the same time and
1538.14s - 1543.84s |  not just one as we initially thought. And this will actually make just core one go haywire.
1543.84s - 1548.02s |  Right? We have control of core zero but core one is uh just going to go nuts and crash the
1548.02s - 1553.02s |  whole system. So to tackle the problem we had to get control of core one some way. Uh and we
1555.76s - 1560.86s |  dug deep into our bag of tricks to really uh see if maybe there's a nice elegant solution to
1560.86s - 1565.86s |  this to just take core one out of the running. Um so we tried to um we tried to find another
1569.10s - 1574.18s |  device to overlap with the entry point of core one. There was none. Uh we tried to disable
1574.18s - 1580.72s |  SMT and the BIOS that also didn't work. We tried to uh use the so called init IPI and also
1580.74s - 1586.68s |  the SKN instruction to put core one into a state that would actually make it ignore SMIs. That
1586.68s - 1592.08s |  also didn't work. And finally we also tried to send a so called SMI IPI which at least
1592.08s - 1597.20s |  according to the documentation would allow us to trigger an SMI on individual cores. And it
1597.20s - 1601.96s |  also didn't work. So despite the documentation indicating one thing in practice we didn't
1601.96s - 1607.00s |  manage to uh get it to work. So we're running out of options and we had to take a step back
1607.02s - 1611.56s |  and analyze the problem. And we realized okay the LGDT is the actual problem because it's
1611.56s - 1616.56s |  going to be load loading the GDT register with all Fs. Right? So is this is there maybe some way
1619.06s - 1625.24s |  we can actually still take advantage of this? Um so when the SMM entry point normally
1625.24s - 1629.24s |  executes what happens with the GDT register is it's going to be ordered with a nice value for
1629.24s - 1635.64s |  the base. It's going to be pointing to the GDT within uh SMRAM. Right? And afterwards the
1635.66s - 1641.30s |  segment selector is going to be taken, added to it uh and the base within that uh
1641.30s - 1648.24s |  descriptor is going to be used to calculate the final linear address. Now in our case what's
1648.24s - 1652.10s |  going to happen with tick codes is enabled uh the GDT register is going to be ordered with
1652.10s - 1658.48s |  all Fs. Both the limits and the base. And what's going to happen then is when the file
1658.48s - 1663.28s |  jump the segment selector is going to be added to it and once again we have our good old
1663.30s - 1669.66s |  friends integer overflow. It's actually going to result in the physical address 7. And this is
1669.66s - 1673.94s |  actually awesome because address 7 in the physical address space once again that's DRAM. We
1673.94s - 1679.18s |  control DRAM. So we can take advantage of that. We can put our GDT at the beginning of DRAM
1679.18s - 1685.52s |  and we can just overflow this thing like this. And afterwards uh from the GDT we control we
1685.52s - 1691.72s |  set a nice base so that afterwards uh the code jumps wherever we want it to. So to summarize
1691.72s - 1695.66s |  we have two types of wraparounds. One is between the GDT descriptor base and the file jump
1695.66s - 1701.10s |  offset. And the second one between the GDT register base and the file jump segment
1701.10s - 1707.54s |  selector. And the nice thing about this is we can actually reuse the same fake GDT for both
1707.54s - 1715.42s |  core zero and core one. And the added bonus is we don't even need the spy bar anymore. The
1715.42s - 1719.90s |  only thing that we really have to take care of is the SMM safe state once again for core one.
1719.90s - 1725.58s |  For core zero we just do the same thing as before. But core one is going to be running in some
1725.58s - 1729.62s |  unknown state. It could be running in ring three, ring zero, just in an unknown context. We
1729.62s - 1734.08s |  have to bring it to the same controlled state as core zero. And we do so by using a kernel
1734.08s - 1739.32s |  synchronization API. Which on Windows is the deferred procedure call. Or on Linux uh
1739.32s - 1745.80s |  symmetric multiprocessing. And basically once that's done uh we have both cores in a known
1745.80s - 1751.60s |  state. And we can use the same trick we did uh use for core zero. So all good things are
1751.60s - 1757.58s |  three. So let's try again. The exploit this time is greatly simplified. And well the only
1757.58s - 1762.32s |  thing we have to do is we create a fake GDT in the beginning of the address space. We choose
1762.32s - 1768.36s |  the um base address within the descriptor accordingly. And that's it. And then when we
1768.36s - 1773.86s |  trigger when we enable T-Close and run the uh SMM entry point code again. The all GDT this
1773.86s - 1779.06s |  time around is going to point to the very end of the address space of the first four gigs. But
1779.06s - 1783.10s |  then when the far jump happens it's going to wrap around. It's going to fetch the GDT
1783.10s - 1788.68s |  descriptor entry from the beginning of the address space from our fake GDT. And then
1788.68s - 1792.94s |  afterwards it's going to redirect execution for both core zero and core one to our own
1792.94s - 1798.38s |  payload. And that finally worked. Well we managed to control both cores. Core zero and core
1798.38s - 1805.18s |  one uh our payload was executed with SMM privileges. And uh it would return gracefully from SMM
1805.18s - 1809.18s |  to the operating system and nothing would crash. And that was great. There were only a couple
1809.18s - 1815.82s |  of things that we wanted to improve uh in our exploit. And that was um to reload the GDT
1815.82s - 1822.20s |  because the base actually is um a bit off. So we just reloaded the GDT so that the base
1822.20s - 1826.60s |  address is equal zero again so that we don't have strange misalignment issues. We set up
1826.62s - 1831.90s |  long modes uh so page tables, stack pointer etc. So we can execute like uh any SQL that we
1831.90s - 1837.46s |  want. Uh and then we also install an SMI handler so that we only have to exploit the bug
1837.46s - 1843.58s |  once and then basically we have kind of semi persistence and the whole system resets. Right?
1843.58s - 1849.34s |  So for the demo just to show you I'm not selling just some snake oil. Uh we have a system
1849.36s - 1854.36s |  over here which is a Huawei Matebook V16 from two thousand uh twenty three. And you can
1858.10s - 1862.44s |  see when the system boots it actually shows the Huawei logo. That logo is embedded in the
1862.44s - 1869.02s |  firmware code. For that um so for our exploit we're actually going to modify that uh that logo.
1869.02s - 1875.82s |  So um we're going to run our exploit with uh kernel privileges. So you'll see over here that
1875.84s - 1881.82s |  we have to elevate privileges and it's going to be triggered via a malicious driver. And then
1881.82s - 1886.14s |  our exploit is going to do uh three things. It's first it's going to use the synclose issue to
1886.14s - 1892.26s |  elevate privileges to SMM. Then it's going to disable the spy flash protections. And then
1892.26s - 1897.86s |  afterwards it's going to write to the spy flash the portion where the um boot splash logo is
1897.86s - 1902.74s |  actually residing. This takes a little while about fifteen minutes so we just fast forward
1902.76s - 1909.36s |  that portion. And you can see okay it shows done patching. All good. And at this point we just
1909.36s - 1914.36s |  reset the system and pray that it works. So let's see. Yeah this one takes a little while. And
1928.00s - 1941.80s |  there we go. We're successful. So I mean this was just one example of what we can do with this
1941.80s - 1946.64s |  kind of access into the system but let's take a more systematic approach to see whether this
1946.68s - 1950.96s |  works on all systems or just on some. What does this actually depend on? So the next attack
1950.96s - 1957.56s |  path um paths depend on how the platform is actually configured. Um so every vendor
1957.56s - 1962.00s |  configures certain features that uh AMD provides to them. And specifically there are two of
1962.00s - 1967.30s |  them which are key to this. One is room armor which can be used to restrict access to the
1967.30s - 1972.64s |  portions of the spy flash. And the second one is platform secure boot which is AMD's
1972.68s - 1979.36s |  equivalent of boot guard which will verify the initial stages of the firmware code. Um so if
1979.36s - 1984.26s |  everything is enabled the very least thing that we can do is we can write to a portion of the
1984.26s - 1987.60s |  spy flash where you have your variables live. So for instance in these variables you're going
1987.60s - 1993.50s |  to have things like the secure boot uh keys which I used. So we can break secure boot. That's
1993.50s - 1998.40s |  nice. Um but if nothing is enabled actually we have firmware implants. I'm going to explain in
1998.40s - 2002.10s |  a moment uh what the difference actually is. So the first configuration whenever where
2002.10s - 2007.88s |  everything is uh properly configured we see ok we escalate from the operating system to SMM
2007.88s - 2012.98s |  and from there we can write to the let's say firmware uh data portion of the spy flash where
2012.98s - 2017.62s |  the configurations are. So we can manipulate like secure boot keys so that afterwards we can
2017.62s - 2023.30s |  actually load our own malicious boot loader before the OS loader runs. And the second
2023.30s - 2028.10s |  configuration where the PSB is not enabled we have basically the same scenario. Um
2028.10s - 2033.10s |  Roam armor will still restrict write access to um to the data portion and we can we can still
2036.38s - 2042.28s |  just um uh inject our own boot kits. And the third configuration we can write to even
2042.28s - 2048.18s |  firmware code but that's going to be still verified by platform secure boot. So ok and these
2048.18s - 2052.50s |  three we have the same scenario we can just inject a boot kit which is still nice because it
2052.52s - 2056.60s |  runs before the OS loader. Any protections provided by the operating system would still be
2056.60s - 2063.60s |  um rendered null. But in the last scenario where none of these features are enabled what we
2063.60s - 2069.14s |  can do is we can inject our uh malware into the spy flash into the firmware code portion of it.
2069.14s - 2075.64s |  And when that happens uh is what we're going to get is we can um run our own malware at the
2075.64s - 2080.62s |  very earliest stage of the boot process. And there's a key difference here between a
2080.64s - 2087.92s |  firmware implant and uh a boot kit is that this attack actually is resistant to uh to OS
2087.92s - 2093.22s |  reinstallations. So even if you wipe your drive it's still going to be around. Um and even if
2093.22s - 2096.92s |  you try to push a firmware update from the operating system it's still going to be around
2096.92s - 2102.80s |  because the uh the malware can just say well the update was successful. Um and the only way
2102.80s - 2108.94s |  to really get rid of it at that point is to take apart your system, take a spy programmer to
2108.96s - 2113.96s |  read out the spy flash, inspect it and if it's infected um just uh rewrite it. But typically
2117.90s - 2123.44s |  it's not really in the repertoire of a typical IT guy right? So to illustrate how prevalent
2123.44s - 2127.84s |  actually these misconfigurations are we did some research last year on that and we saw that
2127.84s - 2132.04s |  the majority of the systems have none of the security features actually enabled. Which
2132.04s - 2136.36s |  means all the systems which have none of the features enabled are vulnerable to firmware
2136.38s - 2141.98s |  implants. Which is pretty bad. And to put a cherry on top we also found that once you're
2141.98s - 2146.62s |  infected with that kind of uh firmware implant you can even disable platform secure boot
2146.62s - 2151.76s |  forever by burning a specific fuse so that your system remains vulnerable to firmware uh
2151.76s - 2156.76s |  implant reinfections forever. Sweet. So let's wrap up the presentation. Thanks Christoph.
2157.24s - 2165.21s |  So yeah. In terms of affected systems right? Pretty much all of them. Uh yeah. Um our tests
2173.45s - 2180.45s |  were on Ryzen mostly. Several laptops. Uh but turns out the Threat Reaper series is also
2180.45s - 2185.47s |  affected. Epic series is also affected. Meaning servers. Um and yeah uh due to the longevity
2189.95s - 2194.95s |  of this this this thing we can estimate the total number of affected chips are in around
2197.75s - 2202.75s |  the hundreds of millions. Um there's an advisory from AMD published now um where more
2205.63s - 2211.89s |  information on the system the affected systems and cover uh that there's a microcode update
2211.89s - 2216.89s |  now. Information is there and so you can check. Mitigations. Yeah AMD as I just mentioned
2219.73s - 2225.55s |  is just set. Provided um with microcode updates. However it might not cover all of the
2225.55s - 2230.55s |  affected systems. Of course um in terms of what an OEM can do, they can just modify the
2233.31s - 2240.03s |  SMM entry point code to detect if the T-Close bit is set. And if it is then just abort the
2240.03s - 2245.87s |  execution and this this will just render the exploitation unfeasible. Uh this can even be
2245.87s - 2250.89s |  done at the EDK 2 level for AMD system right? And we wrote we really haven't covered here
2253.71s - 2259.65s |  core boot but core boot is affected in the same way. We just I mean um core boot does the
2259.65s - 2264.29s |  very beginning of the entry point performs a low GDT. They have to go to protected mode as
2264.29s - 2270.83s |  well so it's it's the same thing. Um and actually core boot they are checking for this uh for
2270.83s - 2274.81s |  for other issues as well at the entry point so they could they could very well do this.
2275.51s - 2280.51s |  Um and users well they can you know a hypervisor could trap the access on the T-Sec mask MSR
2283.25s - 2288.25s |  so that's another uh way to stop this. Timeline wise well we reported this back in October
2291.39s - 2296.39s |  to 2023. A CVE of 2023 uh 31315 was assigned in November and then we discussed mitigations
2299.23s - 2304.71s |  and impact with AMD over the course of the next months. Um and yeah finally yesterday
2304.83s - 2310.97s |  um the advisory was published and we are here at DEF CON today. This was the official AMD
2310.97s - 2315.99s |  response. Essentially we work with them in a process of uh responsible disclosure and yeah
2319.89s - 2326.23s |  they've been great to work with. Conclusions and takeaways. While the vulnerability has been
2326.23s - 2331.25s |  around for nearly 2 decades um the complexity of the architecture clearly plays in favor of
2331.55s - 2336.55s |  attackers and we see this uh with the flexibility of of of the GDT. Um the 2 types of
2339.65s - 2344.65s |  wraparounds the the the byte level uh um address um like granularity that there is with it no
2346.89s - 2351.89s |  problem. Um and also with the how the MSRs can be accessed without any restriction. Uh that
2355.67s - 2361.17s |  that's that's all good for attackers right? Um these things combined are what what
2361.39s - 2366.39s |  made this exploit approach possible. It might be on other exploit methods too. Um but yeah
2369.77s - 2375.47s |  all of this of of course requires an in depth understanding of the architecture and in the end
2375.47s - 2380.77s |  we managed to exploit this without requiring physical presence. So that's very good. And yeah
2380.77s - 2387.46s |  exploit code will be released soon so stay tuned for that. Questions?
2387.78s - 2399.37s |  Is there a microphone? Okay. Oh there's some stuff. Uh uh hello. Um it wasn't entirely
2411.06s - 2416.06s |  clear to me. Is the spy flash chip you're referring to on the uh CPU die or is it external?
2419.34s - 2424.34s |  External. Okay. Yes. Yep. Hi how are you? We were talking with Enrique that this is
2425.06s - 2429.76s |  interesting also to bypass an anti-cheat system right? Uh in the video game industry. Um
2429.76s - 2434.76s |  PlayStation 5 runs on an MID chip. Uh is is is it also vulnerable or is it uh a different
2439.76s - 2446.28s |  kind of chip and it doesn't affect it? Thank you. Um so I'm sorry if if I understood your
2446.28s - 2451.14s |  question correctly was about bypassing uh anti-cheat systems uh using this method?
2451.18s - 2456.18s |  No installing something to bypass uh the anti-cheat systems and uh uh once you achieve
2459.46s - 2464.46s |  arbitrary code execution in SMM uh yeah pretty much uh like modern anti-cheat systems
2467.70s - 2472.90s |  running uh either kernel or even maybe a hypervisor level could could could run and and
2472.90s - 2477.90s |  this this runs even below that if that makes sense. Um but uh since uh MID has disclosed
2478.74s - 2483.74s |  the processors that are vulnerable to this attack it is the it is not disclosed in
2486.08s - 2491.08s |  PlayStation 5 which has MID. So that's what I was asking if maybe it's also yeah. Ah okay.
2499.16s - 2504.24s |  But yeah I'm sorry I I don't know uh I I don't understand your question correctly.
2504.24s - 2509.24s |  The the PlayStation 5 hypervisor blocks the MSR. Oh. Uh if it's for that yes. The the yes.
2511.04s - 2516.04s |  We we check that. And it is being trapped by the hypervisor layer on the place. Yes. Sorry.
2518.72s - 2524.88s |  Hey thank you. Um quick question. Um why didn't disabling SMT prevent the system from
2524.88s - 2531.90s |  becoming unstable? Uh yes so the SMT when we try to disable it um essentially what
2531.90s - 2537.14s |  happened is the other logical core will just not run but it still be there and it will
2537.14s - 2541.40s |  be the all the entry points and um will be already configured by the firmware if that
2541.40s - 2546.38s |  makes sense. So when the SMI happens it was a level underneath I mean it won't you won't
2546.38s - 2553.12s |  see the processor available at the OS level but all all the layout and and and and at at
2553.12s - 2558.16s |  yeah at the deeper level the the logical core is still there if that makes sense. Yes it
2558.16s - 2565.10s |  does. So we have to deal with that regardless. Yes we try it. Thank you. Hello. Do you know
2565.12s - 2570.22s |  what uh changes AMD microcode update made? Um I'm sorry could you could you speak up
2570.22s - 2576.40s |  louder? I'm sorry. Do you know what changes AMD microcode update made to mitigate this issue?
2576.40s - 2581.40s |  Oh interesting question. Uh yes. Um no I mean officially we don't. Uh. Um what uh we
2581.40s - 2586.40s |  don't. That's a long and short of it. Uh yes. I think we're good. Okay well if no more
2606.58s - 2608.98s |  questions thank you so much for joining us today.


url: https://www.youtube.com/watch?v=pri4EJ0634c
title: DEF CON 32 - What History’s Greatest Heist Can Teach Us About Defense In Depth - Pete Stegemeyer
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=pri4EJ0634c",
  "title": "DEF CON 32 - What History\u2019s Greatest Heist Can Teach Us About Defense In Depth - Pete Stegemeyer",
  "description": "What\u2019s the real life equivalent of hacking a Gibson? Probably stealing hundreds of millions of dollars in diamonds, gold, and cash from one of the world's most formidable vaults. In 2003, a team of thieves did just that. Armed with hairspray, double sided tape, and nerves of steel, these thieves defeated layer after layer of security to pull off the haul of a lifetime.\n\nHowever, as much as this is a story of skilled criminals, it is every bit as much a story of security failures and the parallels between protecting diamonds and data. In this presentation we\u2019ll dive deep into what went right, what went wrong, and how to properly apply defense in depth to make your security program look like a hundred million bucks.\n\nDavis, J. (2009, March 12). The untold story of the World\u2019s biggest Diamond Heist. Wired. link\nSelby, S. A., & Campbell, G. (2012). Flawless: Inside the largest diamond heist in history. Sterling.\nStegemeyer, P. (2021). Heist: An inside look at the world\u2019s 100 Greatest Heists, cons, and capers: From burglaries to bank jobs and everything in between. Whalen Book Works.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1787,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.05s - 5.05s | This text was transcribed using whisper model: large-v2

 And with that, the stage is yours. Alright, awesome. Alright, perfect. Uh, can everybody
7.95s - 12.95s |  hear me okay? Excellent. Okay. I got that. That was good. Uh, awesome. Uh, so my name is Pete
15.79s - 22.53s |  Stegmaier. Uh, this is a treasure trove of failures. What history's greatest heist can teach
22.53s - 28.33s |  us about defense in depth. Uh, who am I? Uh, I'm Pete Stegmaier. You're probably tired of
28.33s - 33.55s |  hearing that by now. I'm kind of tired of saying it. Uh, I've been a senior security engineer
33.55s - 38.55s |  for seven years. Uh, in addition to that, I am a heist expert and it feels really douchey to
40.99s - 47.13s |  say that. Uh, it's true though. Uh, History Channel, Vice, uh, National Geographic have all
47.13s - 52.09s |  called me up and asked for like consultations. I've done, uh, history's greatest heist with
52.09s - 58.27s |  Pierce Brosnan, uh, as an expert. Uh, and I had a podcast and a book, uh, also about a bunch
58.27s - 63.27s |  of different heists. Um, so today I wanted to talk about my favorite heist and the parallels
65.87s - 72.45s |  between a real world attack and, uh, something that we can do in the digital world and how we
72.45s - 80.23s |  can either defend against that or exploit it depending on why you're here. Alright, so, uh,
80.27s - 84.87s |  we're gonna be talking about the Antwerp Diamond Heist. Uh, this happened, uh, between
84.87s - 89.87s |  February 15th and 16th in February of 2003. Uh, Antwerp, Belgium. Uh, this was pulled off
92.15s - 96.75s |  by the school of Turin. Uh, we're just gonna do a little bit of like details about everything
96.75s - 102.29s |  first and then we'll get into the process. And what ended up being stolen was between a
102.29s - 107.29s |  hundred million and a billion dollars worth of, uh, diamonds, gold, jewels, stocks,
110.43s - 116.07s |  uh, and the reason that there is a 900 million dollar range is because what was targeted
116.07s - 120.77s |  was actually safety deposit boxes and a lot of times people don't like to claim what they
120.77s - 126.21s |  have in there. So there's no way of actually knowing. And the reason that this, uh,
126.21s - 131.29s |  happened, believe it or not, like the team, the thieves were very talented, but it would
131.29s - 136.79s |  not have been possible without just a cascade of failures on behalf of the security team as
136.79s - 141.23s |  well. Uh, so we're gonna go ahead and start getting into that. Uh, first let's set the scene
141.23s - 147.23s |  with the Diamond Center itself. This is actually, uh, this is kind of like a nested
147.23s - 153.07s |  facility. Uh, so the Antwerp Diamond Center handles 80 percent of global diamond
153.07s - 158.91s |  transactions. Uh, so it's a pretty, pretty major throw point, uh, for anybody to try to
158.91s - 163.95s |  attack and because of that a lot of people thought that it was too big to attack. Uh, it is
163.95s - 169.99s |  in the most secure part of Antwerp. They have a dedicated private police force as well
169.99s - 175.13s |  as a local police force located just outside the facility. Uh, and because this is like
175.13s - 181.53s |  basically a neighborhood in Antwerp, um, in addition to having all that policing, they
181.53s - 186.27s |  also had, uh, a way to control traffic. So like a traffic control point, uh, with those
186.27s - 190.45s |  little car catchers, the little hydraulic spikes that come up, so they could literally
190.45s - 194.89s |  control all of the cars coming in and out of this controlled area. And then there were
194.89s - 199.99s |  multiple blocks of this Diamond Center, um, where different offices and different jewelers
199.99s - 203.89s |  could rent office space and things like that. So there were actually three buildings, A, B,
203.89s - 210.81s |  and C block. Uh, and let's get to the vault. Uh, I tried real hard to do like the Ocean's
210.81s - 217.45s |  Eleven, George Clooney, real smooth, like, uh, I, I can't do it. And I, like, they said
217.45s - 220.35s |  something about copyright. I'm kind of scared. I don't want this taken down. So we're just
220.35s - 225.35s |  going to describe this vault and I am not George Clooney. Um, so the first, uh, this vault
227.73s - 234.19s |  is a marvel of engineering. Um, it's my favorite vault. Uh, it's weird to have one, but this
234.19s - 240.23s |  is it. Uh, and it's got some really, it's got ten different security features baked into it.
240.23s - 245.25s |  Um, number one is a combination lock or a combination dial with a hundred million
245.25s - 250.25s |  possible combinations. Uh, it is a foot thick of solid steel and there is a 12 inch long key
253.65s - 257.83s |  that actually gets separated into two different parts. So there's like the stick part and then
257.83s - 263.83s |  the actual teeth, uh, or the comb of the, uh, the key. Then there's a day gate. So if you
263.83s - 269.33s |  open up that first gate, there's still, you know, another, uh, another door stopping you.
269.33s - 274.81s |  There's a magnetic sensor that detects if the door is opened. So if that magnetic field
274.83s - 281.71s |  breaks, it triggers an alarm. There is a guard, uh, or a guard shack and there's cameras like
281.71s - 288.05s |  watching the vault. There's an access card reader, seismic detector, so you can't, you can't
288.05s - 293.05s |  tunnel in. There is a combination motion and thermal sensor, uh, that because they had a lot
295.79s - 302.59s |  of false positives would only set off if it detected both extra temperature and motion. So
302.67s - 307.21s |  if it just got a little warm, not going to set it off. If like a mouse is running around, not
307.21s - 311.79s |  going to set it off. But if there's a person, they're warm enough and shaky enough to, to make
311.79s - 318.05s |  that happen. And then finally there are the safe deposit boxes themselves. Um, these are
318.05s - 323.07s |  pretty standard, although, uh, the owners of the box were given the opportunity to replace, uh,
325.93s - 331.93s |  basically what was a plastic plate behind, uh, the keyhole with a steel plate. And so some
331.97s - 339.05s |  people chose to update, uh, to that steel plate. Some people chose to, uh, you know, not patch
339.05s - 345.66s |  everything. And, uh, I'll let you guess which ones got hit later. That said, I mean, don't
345.66s - 350.66s |  patch everything like right away. Like maybe, like we learned that this week too. So, uh, so
353.50s - 359.84s |  this is, um, since we're all, uh, mostly tech people here, uh, this is basically just a very
359.84s - 365.28s |  poorly colored, uh, in retrospect diagram of what we're looking at. And I just wanted to
365.28s - 369.72s |  make this look like a network so you can kind of see the different layers of security and how
369.72s - 374.72s |  it would relate to the, uh, to the cloud. So over here we've got the world itself. And then
376.52s - 380.10s |  we've got our access point here, which is the car catches at the gateways into that
380.10s - 386.04s |  neighborhood. Uh, in there we've got the actual diamond center building. And then within
386.04s - 390.74s |  there is another series of access control points like, uh, an elevator that can take you
390.74s - 396.22s |  down to the antechamber below the ground for the vault. Um, you know, badge readers,
396.22s - 402.12s |  guards, things like that. And all of those security, uh, controls allow you access to the
402.12s - 407.12s |  vault. So it is kind of like a system in that. And it would be a really bad system design if,
409.30s - 414.70s |  you know, I don't know, somebody put a open port on this part, uh, that connected to the
414.72s - 417.96s |  world and then it just kind of had a tunnel to the vault, like that would be really bad and
417.96s - 422.96s |  nobody would do that, right? Alright, well that's my talk, so. Uh, alright. Uh, so this, this
426.08s - 430.14s |  heist was actually pulled off by a group called the School of Terran. Uh, that is not an
430.14s - 435.34s |  official name, that is a name that was given to them by the police. Uh, it is also not an
435.34s - 440.36s |  accredited school. Uh, this is a, uh, this is a group of highly specialized thieves that work
440.42s - 447.12s |  in a collective and they kind of refer each other, uh, to jobs based on the skill sets
447.12s - 451.26s |  required. So somebody might say, hey, I want to rob this Arby's. And you're going to say,
451.26s - 456.76s |  great, we need a safe guy, we need somebody with zero taste buds, we can make this happen. I
456.76s - 462.38s |  don't know why I said that, I love Arby's, please. Uh, anyways. Sorry, I'm going off on
462.38s - 468.28s |  tangents here. Um, yeah, they referred each other based on the skills that they needed, but
468.30s - 473.54s |  they were usually organized by, you know, specific masterminds. And in this case, that
473.54s - 478.54s |  mastermind was named Leonardo, Leonardo Noturbitarlo. Um, the other thing that this, uh,
480.48s - 485.92s |  group of thieves was great at was nicknames. Uh, so his was the mastermind, but there was
485.92s - 491.26s |  also the monster, uh, who was like damn near seven feet tall. Uh, he specialized in like
491.26s - 496.26s |  alarms. There was the genius who also specialized in alarms and electronics. The king of
497.02s - 504.02s |  keys, which is just the coolest name I've ever heard of in my life. And then speedy, because
504.02s - 511.47s |  sometimes you run out of budget. Alright, so, how do we plan this heist? Same way that we're
511.47s - 516.47s |  going to try and attack a network, right? So, you got to start with recon. So, 18 months
518.61s - 524.75s |  prior to the heist, uh, Noturbitarlo just walks up to the office space and rents an office. He
524.77s - 528.97s |  says, oh, I've got a jewel company. I'd like to get a safety deposit box. And they said,
528.97s - 534.91s |  great, you can stay here as long as you like. Uh, had they run a background check on him,
534.91s - 539.65s |  they would have known that he was like, he didn't even like change his name. He'd been
539.65s - 544.65s |  arrested many times. Many times. And they're like, yeah, we'll, we'll just give you an
547.55s - 553.69s |  access card to the, to the safety deposit box, to the vault. You're good to go. And so he
553.73s - 559.01s |  starts by establishing persistence. He goes there multiple times a week and he'll just hang
559.01s - 565.05s |  out in his office. He'll go down to the safe. Uh, he wore like hidden cameras in his pockets
565.05s - 571.29s |  and in his duffel bag so that he could start mapping this stuff out. And then, after he'd
571.29s - 574.95s |  kind of gleaned all the information that he could on that first run, he decides to try to
574.95s - 579.53s |  escalate his privileges a little bit and get, you know, a higher level of clearance by
579.53s - 584.87s |  renting a larger office space. And so he says, hey, you know, I want to give you guys more
584.87s - 588.97s |  money for some more floor space. Uh, can I see some floor plans just so I could pick out the
588.97s - 595.15s |  appropriate office? And they said, sure thing. Here's the blueprints for the entire
595.15s - 603.84s |  organization. Yeah. Uh, so, for those of you who keep track at home, that's least
603.84s - 610.66s |  privilege. Uh, and while he was going over, uh, going over the, uh, the schematics, he saw
614.90s - 619.90s |  two fatal flaws. Number one was a door in the parking garage that just opened out to the
622.70s - 628.48s |  street. That thing that we said couldn't possibly happen, it happened. And then from that
628.48s - 634.82s |  garage, there was a stairwell that took you down into the antechamber past the elevator.
634.84s - 641.86s |  So, you could just bypass, like, most of the access controls and be right in the vault room. I
641.86s - 647.16s |  sure hope they fired that guy. Uh, but as they were, as they were, like, you know, using their
647.16s - 651.90s |  cameras and figuring things out, uh, the school of Turin did something that I think is pretty,
651.90s - 657.54s |  pretty incredible. Uh, they built a replica vault. Uh, some of these guys, the genius
657.54s - 662.04s |  particularly, owned a security company. Uh, so he was able to get, like, the exact, like,
662.06s - 667.06s |  motion detectors and, uh, basically they were able to build a complete replica of this vault, and
669.60s - 674.84s |  they started practicing being able to open it in the dark. Uh, they got some safety deposit
674.84s - 682.50s |  boxes, and they basically just built a network that they could start running scripts in.
682.50s - 689.39s |  Alright, so now we gotta plan this thing. Hold on, I'm just gonna grab a drink. Whew, thirsty.
689.57s - 696.33s |  Alright. So, if you're gonna rob a diamond, uh, center, best time to do it is Valentine's Day
699.87s - 707.23s |  weekend. That's uh, and this time worked out for a lot of reasons. Number one, Valentine's Day
707.23s - 712.19s |  weekend. Either they just sold a lot of diamonds, or they have a bunch of unsold diamonds
712.19s - 716.73s |  sitting in that safe. So, there's extra cash, extra diamonds, because everybody's up in their
716.73s - 721.75s |  inventory. The next thing that made this particular weekend a really good time, was Serena
724.01s - 730.55s |  Williams was doing an exhibition tennis match across town, so all of the police were busy,
730.55s - 735.35s |  like, controlling traffic for that, because she was a big draw. Uh, so they, they just did the
735.35s - 740.37s |  Die Hard 4. Uh, and then also, it was a bank holiday, so there was a long weekend there, and the
741.05s - 747.35s |  president of the, uh, diamond exchange was getting married that week, so all of the
747.35s - 752.35s |  executives were at that. So, nobody's coming back to the office. Uh, and this, this timing, by
754.45s - 759.73s |  the way, if you're familiar with the Bank of Bangladesh heist, uh, or, uh, hack, they kinda
759.73s - 764.17s |  did the same thing. They were able to line up, I believe an Islamic holiday, uh, a national
764.17s - 769.57s |  holiday in the states, and basically made sure that nobody was gonna be checking those logs
769.57s - 775.71s |  for at least 3 days. So, picking a time like that is super great if you're, you know, a thief
775.71s - 780.95s |  or trying to find the right time to attack, but if you're looking to defend your networks,
780.95s - 785.69s |  don't just think about, like, hey guys, long weekend. You know, make sure that there are
785.69s - 792.19s |  systems in place, you know, so this doesn't happen. They did have a security guard that was
792.19s - 795.73s |  supposed to be there, uh, he took the night off just because he was getting drunk with his
795.73s - 803.45s |  brother. So, next, uh, we've got our final prep work before the heist. So, 5 days before, the
806.33s - 811.79s |  genius just takes Notre Bartolo's access card, swipes in because there was no other form of
811.79s - 817.91s |  authentication, if you had the key card, you were fine, and he actually goes into the vault
817.91s - 822.91s |  in the evening and starts testing a, uh, a way to, uh, bypass that magnetic sensor. Uh, and
823.91s - 831.21s |  that's, that's a pretty advanced system and he solves it with like $20 worth of stuff, uh,
831.21s - 835.41s |  which I just love. That's, that's part of the reason this is my favorite. It's like, just, they
835.41s - 840.43s |  did really cool stuff. Don't do it, but like, don't, don't not do it. Uh, so, and we're gonna,
842.99s - 848.67s |  I'll show you that in a, in a little bit here. Uh, 3 days before the heist, uh, and by the way,
848.69s - 853.33s |  they almost got caught 5 days out when he was trying to leave and then he just turned around
853.33s - 858.17s |  and slept in the office because he saw security guards like checking IDs. And nobody thought
858.17s - 863.17s |  that that was weird. Um, so, 3 days before the heist, uh, Notre Bartolo is going into the safe
865.97s - 870.91s |  again to just, you know, conduct his business and make sure everything is still looking, you
870.91s - 877.35s |  know, good for a heisting. And he places a hidden camera over the vault door. And this is
877.37s - 882.11s |  gonna give them a view of the combination. So, when somebody goes to open it, they can
882.11s - 887.11s |  hopefully, you know, see those numbers. The 100 million possible combinations. This is my
889.19s - 894.19s |  favorite part. The day before the heist, uh, right before, uh, right before closing, Notre
896.33s - 901.33s |  Bartolo takes out a bottle of hairspray and he sprays the heat and motion sensor with a light
901.75s - 906.75s |  film of hairspray that basically just disrupted it enough to not notice the increase in heat
909.23s - 914.23s |  right away. And so, because of that, it could detect motion and they bought themselves a few
915.87s - 920.87s |  extra minutes before the heat was hot enough to, to go ahead and do that. Uh, just honestly
923.77s - 928.41s |  genius. And then they got themselves a nice sandwich plate. That's gonna come into play
928.43s - 936.06s |  later. But always like, if you're gonna do a crime, like, eat up. Alright, so we're at the day
936.06s - 941.24s |  of the heist now. They enter through the garage, just like that, uh, problem in the
941.24s - 946.38s |  schematics showed them to do. Uh, they started taking like crown royal bags and covering all
946.38s - 952.18s |  the cameras because they knew exactly where those were as well. Um, this device here, if you
952.18s - 957.36s |  can see it on the, the right hand side of the slide, it's basically just an aluminum plate
957.38s - 962.88s |  that he stuck two sided tape on. So it had a magnet, it had two sided tape, and then
962.88s - 969.46s |  basically he just unscrewed the bolts so that when he took the, the whole sensor off the door,
969.46s - 975.94s |  it stayed together. And it never broke that magnetic seal because they were taped together.
975.94s - 980.94s |  So, doesn't matter how smart your system is, something stupid can and will beat it. Um, so
981.16s - 986.16s |  the next thing they do is they open the vault door and they turn the lights off because
989.56s - 994.56s |  there are the, uh, light detectors in there. And then the genius basically, he takes like a
996.86s - 1003.30s |  styrofoam cooler and puts it over the heat sensor. So this is gonna block motion and it's
1003.30s - 1008.48s |  gonna insulate the temperature, so now that's out of the way. Uh, the seven foot tall guy
1008.52s - 1014.02s |  disables the alarm on the top of the garage, uh, on the top of the safe. And then they go to
1014.02s - 1019.90s |  actually get the keys themselves. Now bear in mind, I said before, this is a, uh, two foot
1019.90s - 1024.90s |  long, or a foot long key kept in two different spots. Except, it's not. They just put it in
1027.90s - 1035.89s |  the coat closet next to the safe door and they didn't take it apart. Oh, if you like that,
1035.89s - 1040.89s |  just, here we go. The combination lock, you know, the hundred million combinations, turns
1043.77s - 1048.57s |  out, that's as much of a pain in the ass for a thief to figure out as it is for the security
1048.57s - 1056.16s |  guy. So when he closed the vault that night, he just didn't spin the lock. Yeah. Sometimes
1061.27s - 1065.47s |  your man on the inside doesn't even realize that he's on the inside. He doesn't know
1065.47s - 1072.52s |  anything. And then they just open the, uh, the day gate with a crowbar. Cause sometimes the
1072.52s - 1077.52s |  classics work. So, this is the hall. Of the hundred and sixty safe, uh, deposit boxes, a
1082.36s - 1087.36s |  hundred and twenty three of them got looted. Uh, including Notre Bartolo's own. Um, I, I like
1091.00s - 1095.80s |  to think that he was just doing it to like blend in, but in reality he was probably just too
1095.82s - 1101.50s |  cheap to get the new plate. Because the, the only boxes that weren't opened with that tool, uh,
1101.50s - 1106.40s |  that basically just snapped the back plate off to open the lock, was the ones where they spent
1106.40s - 1111.40s |  the extra twenty dollars to upgrade to the steel plate. That's your stuff. Don't, don't be
1115.04s - 1120.04s |  cheap when it comes to like keeping your diamonds safe. They stole so much stuff that they
1120.12s - 1125.12s |  had to start like prioritizing and they left like tens of millions of dollars worth of diamonds
1127.16s - 1133.53s |  and cash just on the floor because it was too heavy. Hashtag goals. Once they were done, and
1137.72s - 1143.36s |  this, this heist by the way lasted three days. Um, yeah, because everybody was gone, they just
1143.36s - 1151.28s |  kept coming back and stealing more stuff. And nobody figured like, hey, like, maybe I should
1151.28s - 1155.26s |  like check the vault, make sure nobody stole the money. It's weird, but like, you know, it's
1155.26s - 1161.76s |  a thing I should check. They didn't, they just didn't do it. Uh, and then also, um, the, the
1161.76s - 1165.94s |  diamond center themselves, like after the heist was finally completed, they're like, oh, we
1165.94s - 1170.44s |  gotta go grab those videotapes. So they went up to the second story guard shack where the tapes
1170.44s - 1176.44s |  were and they just removed, they just took them out of the VCR. That's right, they were still
1176.44s - 1182.88s |  using, uh, VHS tapes because they didn't want to spend the extra money on DVRs. So had they,
1182.88s - 1186.98s |  you know, not done that, or had they updated it, we would have caught these people a lot
1186.98s - 1196.72s |  sooner, but they decided, you know, who's going to break into the vault? Alright, so now we
1196.72s - 1201.72s |  get to kind of the, uh, the fun part where everything falls apart. They get away initially
1202.66s - 1207.66s |  about two hours into the drive, uh, back to Italy where all these guys were from, Speedy, the
1210.66s - 1215.66s |  discount henchman starts freaking out. He's never flown this close to the sun before. And so
1217.86s - 1224.04s |  he starts like just throwing trash out of the window of their getaway car. I'm going to say
1224.04s - 1229.04s |  this right now, rule number one of performing a crime, only do one crime at a time.
1233.53s - 1241.09s |  Like, like if you got a Monet in your backseat, do the speed limit. That's all I'm saying. Uh,
1245.33s - 1249.81s |  Speedy though, he started freaking out and he just pulls over and he's like, we got to burn
1249.81s - 1254.41s |  this evidence because they had like trash bags full of evidence. So I guess rule two would be
1254.41s - 1259.75s |  don't drive with trash bags full of incriminating evidence. I shouldn't have to say that
1259.77s - 1266.47s |  one. Uh, but yeah, they, they basically, he started panicking and he started trying to burn
1266.47s - 1271.17s |  all of the evidence in a, in a burn barrel. And when he realized that wasn't going to happen,
1271.17s - 1277.91s |  he just kind of dumped it on the side of the road. And then in a, a weird fun twist of fate,
1277.91s - 1283.89s |  the exact spot that he picked, uh, to dump his trash was the spot where like an old
1283.89s - 1289.19s |  curmudgeonly farmer had just kept calling the police because of the dang kids who were also
1289.19s - 1297.56s |  dumping trash there. It was like, it was just like a good spot for trash. And so he, he's like,
1297.56s - 1301.46s |  oh, these kids, like they did the trash again. And so the police are like, sure, Harold. And
1301.46s - 1304.84s |  then they start going out there and they start seeing envelopes that say Antwerp Diamond
1304.84s - 1309.84s |  Center. And like pieces of videotape from the, the cameras and diamonds. They threw away
1312.38s - 1317.38s |  diamonds. They also found some half eaten sandwiches. And from the sandwiches, this is my
1320.20s - 1325.20s |  favorite part, they were able to start like looking through security camera footage and they saw
1328.08s - 1334.38s |  like the receipt was purchased like from a shop next to the diamond center. And then they saw
1334.38s - 1338.02s |  the, the camera footage of that and they're like, who's this weird seven foot tall guy
1338.02s - 1344.50s |  buying a bunch of sandwiches? So another rule, delete your cookies. That's the one I'm
1345.44s - 1353.96s |  going to do this for. Oh, thank you. Alright. So the other thing that happened after this is
1363.53s - 1370.53s |  Notre Bartolo, this is too dark, that was just a gag. Notre Bartolo, he decides in what might be
1370.53s - 1374.97s |  the dumbest move I've ever seen. He's like, you know what I'm going to do on Monday? I'm
1374.97s - 1380.45s |  going to show up back to the office, be like, what happened? And you know, play it like, like
1380.45s - 1385.45s |  an innocent man would do. Don't do that. If you escape the country, don't go back. Don't,
1388.19s - 1393.19s |  like, but he did that and then the police were kind of there waiting for him already. And then
1393.19s - 1397.63s |  they went to his apartment that he rented in town and they found a bunch of, uh, what's
1397.63s - 1402.33s |  called pointer emeralds stuck in his carpet. Those are like the little tiny emeralds that
1402.33s - 1406.91s |  like, if you're, like if Cartier does like those jaguar heads that are like the little tiny
1406.93s - 1412.31s |  stones, those are usually pointer emeralds. They're more or less worthless, but, you know,
1412.31s - 1418.25s |  it's like finding, you know, a, a perfect mashing hash, like in a file dump or something like
1418.25s - 1425.14s |  that. It's just something that could only be from that. So, all of them with the exception of
1427.38s - 1432.38s |  the King of Keys, who to this day, nobody knows who he is, they all got arrested. Um, they
1433.34s - 1438.34s |  on average served three years in prison and they never recovered any of the money or the
1441.22s - 1448.22s |  diamonds. Which brings me to fun crime fact number four, or tip, I guess. If you're gonna
1448.22s - 1453.22s |  perform a heist, do it in Europe. Uh, these, these guys, they ended up, uh, yeah, they're
1454.22s - 1463.89s |  they're somewhere like retired with a bunch of money and a bunch of diamonds, and it's just,
1471.13s - 1476.57s |  I love that for them. Um, but there are lessons that, that we can take from this as well,
1476.57s - 1482.77s |  especially on the security side. Number one, defense in depth, like that, that vault door
1482.79s - 1487.79s |  had ten different security features alone. But it only works if you do it properly. Because
1490.53s - 1495.53s |  the specter of security is not in fact security. Like you can think something is secure, but
1498.01s - 1503.01s |  unless you're actually, you know, walking the walk, it doesn't really matter. Um, complacency
1503.83s - 1508.83s |  is the enemy of complexity. So again, if something is tedious for you, don't make it easy
1513.57s - 1519.41s |  for you at the expense of making it easy for somebody to pull off the heist of a lifetime.
1519.41s - 1524.15s |  You're worth that 30 seconds. Like the number of people that just like won't bother putting
1524.15s - 1529.15s |  like MFA on their phones like blows my mind. And finally, stupid and or lazy can be dangerous
1529.37s - 1534.37s |  both ways. It can be dangerous on the blue team, it can be dangerous on the red team. So make
1537.47s - 1542.17s |  sure that you're, you know, taking care of yourself, that you're being thorough about things
1542.17s - 1547.95s |  and that you're actually thinking about things in a layered approach. Like defensive depth
1547.95s - 1552.95s |  like is all about compensating controls. If something happens, like these guys just jumped
1552.95s - 1557.63s |  out of a plane with 60 parachutes and not one of them went off. Like that's, that's a problem.
1557.63s - 1563.61s |  Don't, don't do that. That's gonna make you fall faster because of the weight. Um, but yeah,
1563.61s - 1585.22s |  that's, that's pretty much the main takeaways from there. Uh, do we have any questions? I, I
1585.22s - 1590.22s |  wish. I, I'm gonna be honest, I am 40 years old, I still get a brain freeze when I eat ice
1591.82s - 1596.82s |  cream. I can't, I can't do that. What's up? I mean, I like them. Yes, you can do that.
1602.96s - 1619.29s |  You can come to this microphone for questions so everybody can hear the question. Is it
1619.29s - 1624.29s |  possible that the German police are retired in the islands? I, I'm not gonna say it's
1626.79s - 1632.37s |  impossible. Um, you never know like where people are gonna have inside, uh, inside people.
1632.37s - 1636.87s |  I personally feel like somebody had to have gotten paid off at this just because of the sheer,
1636.87s - 1642.37s |  like it's almost like mathematically impossible negligence. Um, but yeah, um, so that's
1642.37s - 1648.61s |  definitely possible. What changes did they make as a result of this to make it not happen
1648.61s - 1656.72s |  again? Uh, so number one, they stopped giving out blueprints. Uh, um, and some of the other
1656.72s - 1662.02s |  things that happened is, um, they started really forcing through those updates. Like the
1662.02s - 1666.42s |  security cameras, like they weren't waiting, they weren't making excuses to stop spending
1666.42s - 1671.16s |  money or to, you know, not spend the money. They updated their systems there. They made
1671.16s - 1676.36s |  sure that they were staying ahead of trends and they also worked on like actual enforcement
1676.36s - 1684.59s |  so that, um, you know, these things that they set up to work could actually do their job. Yes.
1684.59s - 1690.49s |  Is there a movie about this? Uh, not about this one specifically actually. There should be.
1690.49s - 1700.58s |  That's the real crime. Uh. So stay away you. Uh, so what is the answer to the, that type of
1702.56s - 1707.56s |  complacency issue? Cause I think that's something we see a lot when it comes to, for example,
1711.56s - 1715.56s |  you know, self-driving cars, the difference between asking people to remain alert all the
1715.56s - 1721.14s |  time and asking people to just, oh, it's fine until it suddenly isn't is a big one, right? So
1721.14s - 1725.48s |  how do you get people to, to take that key and split it in half and put it away properly every
1725.48s - 1730.48s |  single time? I, I, I think the solution for that has to be some sort of accountability. Uh,
1732.62s - 1738.52s |  and it doesn't, it doesn't fix anything, you know, necessarily in the long term, but if all
1738.52s - 1742.42s |  of a sudden, you know, these leaders and things like that are, are, you know, their
1742.42s - 1746.70s |  managers are checking to make sure that like the jobs are completed, uh, making sure that, you
1746.70s - 1752.24s |  know, due diligence is performed and making sure that, you know, there is something, there's
1752.24s - 1756.58s |  some sort of teeth that are gonna, you know, prevent that from happening. Like, uh, if say
1756.60s - 1763.34s |  you push, uh, an untested update out to a billion computers, uh, you know, probably get fired at
1763.34s - 1768.34s |  the very least, or some fines or something, you know? I mean, that's a hypothetical. Uh,
1774.18s - 1782.38s |  that wouldn't happen. Uh, any other questions? Alright, well, uh, this is a dream come
1782.38s - 1783.62s |  true, so thanks everybody.


url: https://www.youtube.com/watch?v=gg5zsWyZJ90
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Unlocking the Gates: Understanding Authentication Bypass Vulnerabilities - Vikas Khanna

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=gg5zsWyZJ90",
  "title": "DEF CON 32 - Unlocking the Gates: Understanding Authentication Bypass Vulnerabilities - Vikas Khanna",
  "description": "Industrial VPN gateways play a crucial role in operational technology by enabling secure remote access to systems within industrial networks. However, their importance goes hand in hand with increased security risks, as their architecture makes them lucrative targets for threat actors. Over the years, we have seen such devices being used in various industrial environments, which underlines their widespread use in critical infrastructures.\n\nThis talk is about a security analysis of a widely used industrial remote access solution. We will dive deep into and expose various vulnerabilities. This includes rooting the device, bypassing hardware-based security mechanisms such as the use of a hardware security module, and reverse engineering software and firmware. Ultimately, we will show how various identified vulnerabilities allowed us to hijack remote access sessions, creating significant security risks.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1831,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 10.82s | This text was transcribed using whisper model: large-v2

 It is my pleasure to introduce Vikas to the stage. Let's give him a round of applause.
10.82s - 19.82s |  Hello. I hope you can hear me. Thanks for the warm welcome. So welcome to the talk and
19.82s - 25.58s |  I hope you are having a good time so far. So my topic for today is authentication bypass
25.58s - 33.02s |  and account takeovers. So this talk is for people who are in pentesting, who are doing
33.02s - 38.58s |  red teaming activities and who are in bug bounty hunting. Other than that, if you are
38.58s - 45.76s |  a student or new to this field, this is for you as well. So I hope you will enjoy it.
45.76s - 51.16s |  All right. So the agenda for today's talk is I have divided it in three different phases.
51.16s - 56.64s |  First is introduction. I will discuss about what authentication is, why it's so crucial
56.64s - 63.92s |  and what are the different modules where you can look for such bugs. The phase two is techniques
63.92s - 72.04s |  and vulnerabilities which I personally use to take over the accounts and bypass the authentications
72.04s - 77.08s |  during my entire career. I mean, I have eight years of experience and I have used these
77.08s - 82.36s |  techniques during the pentesting activities, red teaming activities and bug bounty hunting.
82.36s - 89.44s |  The third phase is I identified account takeover or authentication bypass in Apple. I will
89.44s - 98.82s |  disclose that. A little bit about myself. My name is Vikas Khanna. I am technical specialist
98.82s - 107.54s |  at Privasec. My key focus is on AppSec, web applications, API security. Whenever I'm not
107.54s - 114.70s |  working on my professional stuff, I am bit active on bug bounty hunting. I got acknowledgments
114.70s - 120.34s |  from companies like Google, Microsoft, Apple and many more. Other than that, I have contributed
120.38s - 129.38s |  to the community. I have contributed to OWASP, WSTG and OWASP www community. Other than that,
129.38s - 136.38s |  I have a few CVs from Oracle and IBM for reporting them issues in their enterprise products.
138.26s - 143.98s |  So what is authentication? Basically authentication is a process to verify a user or a system
143.98s - 150.02s |  that they are what they are claiming to be by verifying their credentials in terms of
150.02s - 157.02s |  their user names, password, digital signatures and many more things. Authentication is very
157.58s - 163.94s |  crucial. For example, there are post login modules which are having sensitive information,
163.94s - 170.94s |  your PIIs and information which not everybody should be able to see without, you know, logging
171.02s - 177.38s |  into the application. So that is why authentication is very crucial. Okay, so whenever we are
177.38s - 184.38s |  hunting for authentication bypass and account takeovers, these are the abusable vectors
186.76s - 192.82s |  or functionalities where you can focus on. Basically I have identified issues in these
192.82s - 199.74s |  features, these functionalities but this bug is not limited to these features only. I mean
199.74s - 208.69s |  you can explore but this is based on my experience. Okay, real time abuse vectors like vulnerabilities
209.45s - 215.45s |  and techniques which you can use basically to take over the accounts and bypass the authentications.
215.45s - 221.21s |  Alright, first vulnerability is session puzzling. What is session puzzling? Session puzzling
221.21s - 228.21s |  is like whenever you have extra permissions on your session ID. For example, you are in
230.37s - 237.37s |  pre-login stage and for some modules or some activities you got a session ID and that session
237.69s - 244.01s |  ID is misconfigured and having a permission, over permission which you can use to access
244.01s - 249.13s |  the post-login modules as well. Basically it's in pre-login stage but you can access
249.13s - 257.68s |  post-login modules as well. Alright, so the example for this is forgot password functionality.
257.68s - 263.00s |  How forgot password functionality works? Like there is a forgot password module, you can
263.00s - 268.76s |  enter your email ID, application will redirect you to another page where application will
268.76s - 275.76s |  ask you for OTPs or maybe security questions and if you provide OTP, correct OTP or correct
276.32s - 281.72s |  security questions answer, application will redirect you to another page where you can
281.72s - 286.64s |  enter the new password and change the password. But for the second page where application
286.64s - 292.36s |  is asking for security questions answer or OTP, application have created a session which
292.36s - 298.28s |  is linked with your email ID which you provided on the first page. But that if the application
298.28s - 303.96s |  is misconfigured and that session variable, session ID is having over permissions, you
303.96s - 310.36s |  can without entering the security answer or OTP, you can access the post-login modules
310.36s - 316.20s |  by just using that particular session ID because it is activated globally. So this issue I
316.20s - 324.61s |  have identified in Apple and I will show in the later slides. Alright, other vulnerability
324.61s - 331.61s |  is session fixation. As name suggests that in this vulnerability you can fix the session
332.69s - 339.45s |  in pre-login stage. Basically the pre-login and post-login session variables value will
339.45s - 345.73s |  remain same. It will be just the state of the session token which will become active
345.73s - 352.73s |  or de-active. Alright, so there are two ways we can use this vulnerability. One is we can
355.13s - 362.13s |  whenever your victim is in the remote location, so how you can leverage that? So if you are
363.61s - 370.61s |  able to get the session ID in URL in pre-login stage, what you can do, you can copy that
371.49s - 377.45s |  and send it to your victims. Alright, whenever your victim will click on that link, since
377.45s - 383.77s |  the link belongs to the legitimate application, victim will click on that and will enter the
383.81s - 390.81s |  credentials. When victim will enter the credentials, the session ID will become in an active state.
390.81s - 394.65s |  Since you are the one, you are the attacker, you have that session ID, you can use it on
394.65s - 399.85s |  your machine and you can login into the victim's account directly. You don't have to enter
399.85s - 406.35s |  the passwords. So that's how you can bypass the authentication and take over the accounts.
406.35s - 412.81s |  This is when your victim is remote. The other thing is whenever let's say you are working
412.81s - 418.69s |  on a shared machine. There is a machine which is shared by multiple users. So what you can
418.69s - 425.05s |  do, you can go to that machine, you can copy the cookies. Since pre-login and post-login
425.05s - 429.65s |  cookie will be same, you can just copy that and whenever your victim will login to that
429.65s - 434.29s |  particular application, you can use that cookie and you can bypass the authentication by using
434.29s - 443.24s |  victim's account. Alright, the other is access control checks. IDRs, IDRs are best friends.
444.92s - 450.96s |  We can use that to perform a number of activities and one of them is account takeovers and authentication
450.96s - 456.16s |  bypasses. So how you can take over the accounts? For example, application performing some sort
456.16s - 461.48s |  of sensitive activities like change password, update profiles by just checking the user's
461.48s - 468.32s |  ID. Sometimes it's in even hidden parameters. You can use tools like client-side proxy tool
468.32s - 474.96s |  like Bob suit and you can just modify the user ID and if the application is vulnerable,
474.96s - 481.08s |  you will be able to take over the accounts of your victims. The other is privilege escalations.
481.08s - 486.88s |  Let's say if you are performing grey box assessments as a pen tester. So you will be aware with
486.88s - 493.88s |  admin level modules as well and non-privileged user or non-admin users modules as well. So
494.48s - 499.44s |  you can login into the least privileged user account and you can try to access the admin
499.44s - 504.76s |  account and if the application is vulnerable to access controls and privilege escalations,
504.76s - 511.28s |  you can access the admin level modules. Alright, depending on the application's functionality,
511.28s - 517.08s |  let's say there could be a number of you know, sensitive modules where you can play with
517.08s - 522.64s |  maybe let's say there is an admin module where you can see the number of users. You can deactivate
522.64s - 527.88s |  their accounts. You can change their passwords. You can block them. You know, you can depending
527.88s - 532.04s |  on the application's functionality, you can do a number of things. Other thing is forced
532.04s - 539.04s |  browsing. Forced browsing is something when you are forcefully trying to access post-authentication
539.14s - 545.76s |  modules by just hitting them without providing any credentials. If there is access control
545.76s - 551.48s |  bug, you will be able to access the post-login modules as well. And let's say there are configuration
551.72s - 557.16s |  files which are not linked with the application but are still present in the server. So you
557.16s - 562.36s |  can access those configuration files and you know, it will share, it will disclose a lot
562.36s - 569.16s |  of sensitive information depending on what kind of configuration file is there. Alright,
569.16s - 576.16s |  next is password reset link hijacking or poisoning by using host header injection. So let me
577.16s - 582.24s |  explain what is host header injection and how it works first. Then we will dig into
582.24s - 587.88s |  the how we can abuse it. So whenever you are hitting an application, application verify
587.88s - 594.88s |  okay what's the value of host header, it's origin and accordingly application will fetch
595.56s - 602.92s |  the responses from that particular application server and assign to you the resources. So
603.04s - 609.36s |  whenever you are having redirection 301, 302, you can use host header vulnerability. You
609.36s - 613.88s |  can change the host header's value and you can check the location header if your host
613.88s - 619.52s |  header's value is getting reflected into the location header in the response itself. How
619.52s - 624.48s |  you can use it to take over the accounts. So for example, there is a forgot password
624.48s - 629.00s |  functionality you can go there, you can enter your victim's email ID, you can capture the
629.04s - 635.40s |  request by using bobsuit and you can change the host value to the domain which you can
635.40s - 642.40s |  control. Alright, so here 0xnoob is for example my domain, I'm a attacker. Alright, so I can
644.08s - 649.12s |  enter my victim's email ID, I can capture the request and I can change the host header
649.12s - 654.48s |  value to 0xnoob. So what application will do? How forgot password functionality works?
654.48s - 659.20s |  Application will send you a reset token link to your email ID, you can click on that and
659.20s - 663.92s |  update the password. But here since you have updated the host header value, application
663.92s - 670.92s |  server will send a password reset link to your email ID with the password reset token
671.40s - 678.40s |  but the URL which will be embedded will be 0xnoob or the domain which you will provide.
679.40s - 686.40s |  Alright, so since it is coming from the legitimate application server, victim will click on the
686.84s - 691.80s |  link, you can use it in red teaming activities, you can try it on pen testing, bug bounty
691.80s - 698.80s |  hunting. Victim will click on that particular link and you can go to your server logs and
699.64s - 706.20s |  you can capture the, you can grab the reset token. Since it's still in the active state
706.20s - 711.44s |  because victim haven't used it on legitimate application yet. So you can go to the legitimate
711.44s - 717.60s |  application and embed that particular token and that's how you can take over the accounts
717.60s - 722.48s |  because a token is still in active state. You can enter the credentials and you can
722.48s - 730.92s |  change the credentials of your victim. That's how you can take over the accounts. JS files,
730.92s - 736.84s |  a lot of people usually don't get into the JS files, they don't bother about it. But
736.88s - 743.88s |  JS files are something which are very crucial and sometimes it's having some sort of sensitive
743.88s - 749.44s |  stuff, funny stuff, I mean depending on, you know, what sort of stuff is that. So you can
749.44s - 758.58s |  find API keys, you can find credentials, you can even find the sensitive API end points.
758.78s - 775.26s |  PHP type juggling, give me a moment. So type juggling is a feature of PHP. What does it
776.02s - 783.02s |  means? So it's a functionality of PHP where you don't have to define the data types, PHP
784.62s - 791.62s |  will do it for you. PHP will, whenever PHP will perform any operations or comparisons
791.98s - 797.18s |  on the variables or parameters, PHP will convert the data type accordingly and perform the
797.18s - 804.18s |  action. For example, the first parameter is number one, which is a string, 10 is in double
804.78s - 811.22s |  quotes. The second parameter is number two, which is five, which is integer. And in third
811.22s - 816.62s |  parameter we are performing operation, additional operation. Okay, so whenever we are performing
816.62s - 823.62s |  addition, PHP will convert string, which is 10, to an integer and will perform the addition
823.86s - 830.86s |  operation. So the result will be 15, 10 plus 5 is 15. So the other thing is comparison.
834.94s - 841.94s |  Whenever PHP will perform a comparison by using two times equals to, so what PHP will
842.62s - 848.26s |  do, first parameter here is integer, second is string. So the second parameter's value
848.26s - 854.70s |  is 10 ABC, which is a string. Whenever you will perform a comparison operation here,
854.70s - 861.70s |  PHP will convert that string 10 ABC to 10, which will become integer. And then PHP will
862.70s - 868.94s |  perform the action accordingly. So 10 is equal to 10, so the result will be equals. How we
868.94s - 875.94s |  can leverage it to take over the accounts? Alright, so let's say there is a value of
877.30s - 884.30s |  parameter, which is, which don't have the integer. So if you will convert that string
885.10s - 891.34s |  with the integer, PHP will convert that string to zero and then it will compare with the
891.38s - 898.38s |  user's provided input. So for example, the admin's password is not having integer value,
899.58s - 906.58s |  having a string only. So as an attacker, you can mention zero in the password. PHP will
906.58s - 911.94s |  compare it with admin password. Admin password is a string. PHP will convert admin's password
911.94s - 918.62s |  to zero and zero is equal to zero will become a true statement. That's how you can bypass
918.62s - 925.62s |  the authentication. But there is a prerequisite. It should be JSON or serialized object. Then
928.34s - 937.72s |  only you will be able to perform this attack. CSRF, let's say if in the application CSRF
937.72s - 943.16s |  tokens are missing and there is no CSRF protection. And there is a module where you can update
943.16s - 949.08s |  the mobile number, email ID, you can craft a HTML page and send it to your victim if
949.08s - 956.08s |  that victim is logged in into their account, you can literally update their mobile numbers
956.12s - 961.20s |  and email address. Once you will be able to do that, you can request for forward password,
961.20s - 966.16s |  you know, by entering the email or password with email or mobile number, which you have
966.16s - 973.16s |  mentioned during the HTML page creation, then you can take over the accounts because application
974.16s - 980.16s |  will send the OTPs or password reset links to your phone number and email ID, which belongs
980.16s - 985.96s |  to the user's, the victim's account. Let's say if there is a forward password functionality
985.96s - 991.12s |  where application is not asking for old passwords and application is vulnerable to CSRF, you
991.12s - 995.52s |  can just craft a request and send to, you know, your victim and you will be able to
995.52s - 1001.96s |  change the password. From there you can take over the accounts. HTTP parameter pollution.
1001.96s - 1008.64s |  It's a vulnerability where you can mention multiple parameters with the same name, but
1008.64s - 1014.04s |  the values will be different and the application will perform the action on the basis of that.
1014.04s - 1021.04s |  So let's say there is a forward password functionality, all right? And you can mention maybe you can
1021.48s - 1028.48s |  use that one parameter for twice, for two times, and mention the victim's email ID plus
1028.96s - 1034.60s |  your own email ID. So if the application is vulnerable, application will send password
1034.60s - 1041.60s |  reset token to both the email IDs, but it will be activated for one account only, depending
1041.80s - 1047.64s |  on how application is, you know, doing that. Maybe it is validating the first parameter
1047.64s - 1051.96s |  or second parameter. That you have to figure out. It depends on different applications.
1051.96s - 1057.84s |  I mean, so accordingly, let's say if it is, let's say whenever you will receive that link,
1057.84s - 1062.72s |  you can just go to application and you can just change the password of your victim and
1062.72s - 1067.60s |  you can take over the account. You can try this on reset password, update password, wherever
1067.60s - 1076.23s |  you are receiving OTPs, you can try that vulnerability. Authentication bypasses by using response
1076.35s - 1083.35s |  manipulation. So a few applications are validating the previous response and then perform the
1084.35s - 1091.35s |  next action, all right? So let's say the response is on the basis of true or false. If you have
1094.87s - 1101.87s |  provided the right credentials, application is throwing you the true response, okay? And
1102.31s - 1107.35s |  if you have provided the wrong credentials, application will throw the false response.
1107.35s - 1113.07s |  So you can change that to true and you can perform the next action. You can bypass it.
1113.35s - 1119.35s |  Similarly, you can manipulate the status codes. If application is throwing 400 or something
1119.35s - 1125.99s |  for wrong credentials and throwing 200, okay, for right credentials, you can try to manipulate
1125.99s - 1135.90s |  that. Two-factor authentication or OTP, you can break that. How? So whenever you are performing
1138.34s - 1145.10s |  pen testing specially, you can use these things. You can check for the integrity validation
1145.10s - 1151.86s |  of OTPs. For example, I can send OTP to my mobile number and send OTP to my victim's
1151.86s - 1158.86s |  mobile number. So these two OTPs are in active state now because neither I used nor my victim
1161.18s - 1166.66s |  used it for now. So what can I do? Since both the OTPs are in active state, I can check
1166.66s - 1173.58s |  the integrity. I can try my OTP on my victim's account just to validate that application
1173.58s - 1181.04s |  is checking the integrity of the OTP or not. And trust me, it's still working. Reusability
1181.04s - 1188.04s |  of OTPs, you can try to reuse the OTPs. And the third one is I found it in one of the
1189.12s - 1196.12s |  most popular banks. So they were disclosing the OTPs in the responses. So I mean, go for
1197.12s - 1204.12s |  it, check for responses as well. Master OTPs, I found it in one of the net banking application.
1207.60s - 1213.68s |  The master OTP was six times zeros. So you can log into any account by using six times
1213.68s - 1222.54s |  zero. I mean, you can try for other stuff also. So go for it. All right, brute force.
1223.18s - 1230.18s |  So whenever we are thinking about brute force, we are trying to brute force the passwords.
1230.30s - 1237.06s |  We can try another way as well by using password spraying attack. We can brute force the emails
1237.06s - 1242.46s |  by using one password. We have one password and we can try that on multiple users. We
1242.46s - 1246.58s |  can try to brute force in that way as well. So whenever you are performing red teaming
1246.58s - 1251.54s |  activities or bug hunting or something, you just need one account to perform your actions.
1251.54s - 1258.18s |  So this will be very handy. Try to check if there are rate limiting controls are enabled
1258.18s - 1265.18s |  or not. Other than that, sometimes application is blocking your IP address whenever you are
1265.82s - 1271.98s |  performing brute force attacks. So you can hop on different, you know, IP addresses.
1271.98s - 1277.26s |  You can change your IP addresses depending on how application is blocking it. Maybe after
1277.26s - 1283.54s |  15 requests or 50 requests and just before, let's say application is blocking IP after
1283.54s - 1289.86s |  every 50 requests, you know, within maybe some sort of time foundation. So you can change
1289.86s - 1297.63s |  on, you can change your IP on 49th attempt. Accordingly, you can try that. You can send
1297.63s - 1304.63s |  multiple credentials in request to validate that, I mean, it is working or not. There
1304.87s - 1311.87s |  is a very, very good lab of web security academy. Please check that. Default credentials, if
1313.35s - 1320.35s |  you are, okay, this is very, very handy in red teaming activities. So, I mean, almost
1320.55s - 1326.71s |  every organisation is using enterprise products. Go for it. Check for the default credentials.
1326.71s - 1333.71s |  I mean, it's still working. I usually find that. Wordpress, it is one of the most popular
1335.11s - 1342.11s |  CMS. So there is a so-called feature in Wordpress where you can use author parameter just to
1343.91s - 1350.51s |  verify that what's the username of one. I mean, let's say if you will enter the author's
1350.51s - 1355.03s |  value one, it will show you the first user of that particular application. If you will
1355.03s - 1359.75s |  change it to two, it will show you the second user of that particular application. It will
1359.75s - 1364.31s |  show you the username. It will show you the posts which are done by that user. It will,
1364.31s - 1369.19s |  it might show you the comments as well. So accordingly, you can, you know, enumerate
1369.19s - 1376.19s |  user's information. And whenever you are performing WP scan, don't perform directly from the,
1376.83s - 1383.71s |  you know, without using API keys. Please use API key. You can go to WP scan website. You
1383.71s - 1389.95s |  can get API key. It's free of cost. And by using that particular API key, if you will
1390.27s - 1397.45s |  perform the WP scan, the results will be definitely different. In secure logout management, whenever
1397.45s - 1403.77s |  you are working on pen testing, check for these things, especially for banking applications.
1403.77s - 1408.77s |  For example, reuse of session. Check if you can reuse that particular session. Login to
1408.77s - 1415.17s |  the application, logout from the application. Check if you can still use the old sessions.
1415.17s - 1420.85s |  Close the browser for the sensitive applications. Whenever you are closing the browser, it should,
1420.85s - 1425.81s |  you know, dissolve the entire session at the server side. Let's say if there is a net
1425.81s - 1430.41s |  banking application and you are closing the browser, whenever you are again accessing
1430.41s - 1435.69s |  the application by using new tab, it shouldn't work. I mean, application should ask you for
1435.69s - 1441.77s |  the login. Session should bound to IP address for sensitive applications. For example, as
1441.77s - 1448.77s |  an attacker, if I am able to get the session of my victim, okay, but if let's say that
1448.77s - 1457.43s |  is bound to their IP address only, I won't be able to use that. Check for it. All right.
1458.31s - 1465.19s |  So tips for red teamers and pen testers. Go to pastebin whenever you are performing red
1465.19s - 1472.19s |  teaming activities. Go to pastebin. Pastebin have a lot of sensitive stuff. DHash, go for
1472.35s - 1477.83s |  DHash. I mean, you can find the passwords of your victims. Open bug bounty. So this
1477.83s - 1483.71s |  website is very handy. I use it multiple times and it helped me a lot. So you can find
1483.71s - 1490.71s |  a lot of vulnerabilities which are identified by other attackers. All right. And they have
1491.91s - 1498.91s |  disclosed those vulnerabilities publicly because the vendor is not entertaining them. All right.
1499.91s - 1510.24s |  So you can use those vulnerabilities. My first bug, I found it in Apple. I found account
1511.52s - 1517.16s |  takeover or authentication bypass basically. I will call it as authentication bypass. So
1517.16s - 1529.44s |  that was my first bug in Apple. So this was session puzzling which I explained in the
1530.44s - 1537.44s |  earlier stage. So I was able to get the session variable which was active for post-login modules
1539.20s - 1546.20s |  as well in the pre-login stage. So here I am on login page. I'm trying. Okay. Application
1549.88s - 1556.24s |  is redirecting me to the login page only. Okay. There is a story behind that. So the
1556.28s - 1563.28s |  domain name is InstaVision.Apple.com. If I will go to that domain directly, it will redirect
1563.76s - 1570.40s |  me to the SSO of Apple. Based on my understanding, it is a bit secure. I haven't tested that
1570.40s - 1577.40s |  to be honest. But yeah, based on my understanding, it is secure. So then I did some sort of Google
1578.80s - 1584.00s |  docking and I got to know that there is a subdirectory with a random string folder name
1584.04s - 1594.21s |  and there is a login module there. So I tried to hunt here. I removed the login page. Application
1595.57s - 1604.42s |  is redirecting me to login again. Here it is. So application is asking me for a username
1605.34s - 1620.12s |  and email address. I provided a fake username and fake email ID. Okay. I got an error that
1620.92s - 1627.92s |  please try again. But for this particular thing, when application was throwing me an
1632.76s - 1639.00s |  error, application created a session which belongs to my email ID and they have activated
1639.00s - 1650.36s |  it for the entire application and which was linked to the admin module. Now I tried to
1650.36s - 1666.06s |  remove the login and try to access the subdirectory. Boom. Thank you. So here I was able to download
1668.54s - 1675.54s |  the confidential details. I have blurred a few contents because of sensitive information.
1676.30s - 1696.55s |  So yeah, I was able to download as well. Okay. Let's discuss if you have any questions. Please.
1704.78s - 1711.78s |  So WBSCAN, if you will use it without API key, it will definitely will give you results.
1713.18s - 1719.50s |  But with API keys, I use it in some sort of CTS and even during my red teaming activities,
1719.50s - 1726.22s |  it will give you extra privileges, extra features to use that. So by using that extra privileges,
1726.22s - 1734.94s |  you can get more information. Sorry? No, no, no. You can go to WBSCAN website and you can
1735.38s - 1743.52s |  create a custom key for yourself only. So that will be linked with your account. Yeah,
1743.52s - 1759.93s |  please. Sorry? Yeah. It is there. Yeah. No. So we were not discussing about traditional
1759.93s - 1763.69s |  brute forces. We were discussing about how you can, you know, if there is still there
1763.69s - 1768.53s |  is brute force protection, how you can bypass it. So we were discussing about bypasses.
1768.53s - 1802.98s |  Please. Obviously, I'm still exploring that particular things. So yeah. But yeah, valid
1802.98s - 1811.62s |  question. I mean, I look into it. I'll definitely look into it. Thank you so much. Excuse me.
1811.98s - 1818.98s |  Last thing. I'm still working on authentication bypasses stuff. And if someone from you guys
1818.98s - 1823.54s |  is working on authentication bypasses, feel free to reach out to me. I will be more than
1823.54s - 1827.22s |  happy to collaborate and, you know, work more on it. Thank you so much.


url: https://www.youtube.com/watch?v=fc6c2hP86Wk
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Unlocking the Gates  Hacking a secure Industrial Remote Access Solution - Moritz Abrell

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=fc6c2hP86Wk",
  "title": "DEF CON 32 - Unlocking the Gates  Hacking a secure Industrial Remote Access Solution - Moritz Abrell",
  "description": "Industrial VPN gateways play a crucial role in operational technology by enabling secure remote access to systems within industrial networks. However, their importance goes hand in hand with increased security risks, as their architecture makes them lucrative targets for threat actors. Over the years, we have seen such devices being used in various industrial environments, which underlines their widespread use in critical infrastructures.\n\nThis talk is about a security analysis of a widely used industrial remote access solution. We will dive deep into and expose various vulnerabilities. This includes rooting the device, bypassing hardware-based security mechanisms such as the use of a hardware security module, and reverse engineering software and firmware. Ultimately, we will show how various identified vulnerabilities allowed us to hijack remote access sessions, creating significant security risks.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1105,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

4.85s - 9.85s | This text was transcribed using whisper model: large-v2

 So, hi DEF CON, thanks for having me here today. Also, many thanks for those who made it to a
12.29s - 18.59s |  Sunday 10 AM DEF CON talk, I really appreciate it. My name is Moritz Abra and I am super
18.59s - 23.99s |  excited to present my research, Unlocking the Gates, Hacking a Secure Industrial Remote
23.99s - 29.01s |  Access Gateway. In this session we will delve deep into an industrial remote access gateway,
29.63s - 34.63s |  uncover vulnerabilities and exploit them to affect critical infrastructure worldwide. But
39.31s - 44.71s |  first of all, a few words about myself. My name is Moritz Abra, I'm working as a senior IT
44.71s - 50.35s |  security consultant and penetration tester at the German company SUS. So, I love breaking
50.35s - 57.13s |  stuff and I also regularly conduct security research and the results has been presented at
57.15s - 64.02s |  various security conferences such as Black Hat or DEF CON. So, how does an industrial
64.02s - 70.36s |  remote access solution work? Well, they all operate similarly. For instance, a device
70.36s - 76.80s |  inside the industrial network establishes a VPN connection to a VPN server. And this server
76.80s - 83.04s |  is usually operated by the vendor itself. Now, if a service technician wants to connect to
83.06s - 88.06s |  this uh industrial network, he uses vendor provided software to initiate a VPN connection.
90.62s - 96.70s |  Finally, the VPN server routes between those connections and thus the technician is able to
96.70s - 103.21s |  reach the targeted infrastructure through the industrial router. So, to analyze such a
103.21s - 110.19s |  solution, we need to acquire an industrial remote access gateway. And I chose the EVON
110.23s - 115.23s |  COSI Plus by HMS for several reasons. Firstly, it is widely used and the vendor claims that
119.01s - 124.01s |  over a half of a million of devices are connected, meaning finding vulnerabilities could have a
126.51s - 131.51s |  significant impact. Furthermore, a similar device has already been considered in the past
131.71s - 136.71s |  where some problems were identified resulting in a complete refactoring. So, the vendor
140.79s - 147.19s |  claims that the COSI Plus is developed with a focus on security and this involves, for
147.19s - 153.47s |  example, a hardware security module with a route of trust, individual certificates and secure
153.47s - 158.47s |  boot. And the solution was also tested and analyzed by an independent company and this
158.91s - 163.91s |  company issued a certificate available on the vendor's website stating that the hardware
167.41s - 174.49s |  backend and associated software were tested. So, let's take a closer look at this secure
174.49s - 179.49s |  gateway. Here we can see the hardware and here the disassembled view. And aside from the
180.49s - 185.49s |  mentioned hardware security module, nothing really special is going on on the PCB. But due
191.17s - 197.27s |  to the advanced hardware security claims, I initially skipped the hardware analysis to avoid
197.27s - 203.25s |  damaging something. And since firmware update files are encrypted, we need a different
203.25s - 208.25s |  approach. So, the goal was to find vulnerabilities in the software or firmware using a pure
210.79s - 217.04s |  black box approach. Surprisingly, this was quite easy. The device allows uploading custom
219.98s - 224.98s |  open VPN configuration files and open VPN on the other hand allows custom com- executing
227.52s - 234.30s |  custom commands using the up parameter. So, I attempted to upload a custom VPN configuration
234.30s - 239.30s |  with a command. But, unfortunately, the parameter was blacklisted. However, bypassing the
243.14s - 248.14s |  filter was also relatively easy. I added two dashes to the up parameter and this bypassed the
251.48s - 258.12s |  blacklist without breaking the parameter itself. And finally, the command executed with root
258.12s - 264.40s |  privileges. I then uploaded a new VPN configuration file including a reverse shell. And
266.54s - 271.54s |  finally, received this root shell. Nevertheless, this was only possible with administrative
273.92s - 278.92s |  access to the device. But, there is a way around this. I found a persistent cross-site
281.38s - 288.00s |  scripting vulnerability originating from FTP login attempts. This means, when an
288.00s - 293.00s |  administrative user visits the login page, the injected JavaScript executes. And the
295.64s - 301.68s |  attacker, to make things more convenient, there is an insecure cookie containing the base 64
301.68s - 308.58s |  encoded administrative password in plain text. At this point, I would also like to credit
308.58s - 313.58s |  Khan Ganeshin who reported probably this issue for a similar device to the vendor, uh, already
315.72s - 320.72s |  in 2015. Anyway, combining these vulnerabilities creates the following exploit chain. An
320.94s - 325.94s |  attacker injects JavaScript code through an FTP login attempt. An administrator visits the
330.12s - 335.12s |  login page. The administrator's browser loads JavaScript from the attacker server. The
337.92s - 343.06s |  malicious JavaScript accesses and sends the plain text administrative password to the
343.06s - 348.06s |  attacker. The attacker then uploads a malicious open VPN configuration and the command
348.38s - 353.38s |  executes with root privileges. Alright, so, let's see this in action. On the left side, we
361.07s - 367.60s |  can see the victim browser and on the right side, the attacker executing the exploit. Now,
373.40s - 378.40s |  the victim visits the login page and the malicious JavaScript is executed. The attacker
379.02s - 386.61s |  then uploads the open VPN configuration and after a moment, finally receives a reverse shell.
396.16s - 401.16s |  Now, with root access to the device, I was able to analyze the firmware internals. And one
404.86s - 409.88s |  of my first interests was how encrypted passwords in configuration files are encrypted. For
409.92s - 414.92s |  example, are attackers able to decrypt sensitive data such as passwords or VPN certificates
418.90s - 425.70s |  found in configuration files? So, I grabbed the used prefix and found the responsible code in
425.70s - 430.70s |  an ARM binary. And due to the use of well-known open SSL functions, the encryption could be
433.32s - 438.38s |  quickly reverse engineered and the hard-coded key and IV could be found in the read-only
438.38s - 443.38s |  data section. So, by re-implementing the encryption algorithm with the found key and IV, we
445.72s - 450.72s |  are now able to decrypt encrypted passwords. Great, but now I was looking for the firmware
454.00s - 459.00s |  update encryption. Remember, firmware update files are encrypted. So, during this, I found
461.40s - 467.44s |  references to the use of the hardware security module. So, I decided to have a closer look to
467.44s - 472.44s |  this HSM, which is from the EdgeLog family by NXP. And in regard to the application node, I
476.48s - 481.48s |  analyzed the I2C communication passively. And in regard to the APDO specification, we
484.96s - 489.96s |  observed the APDO command structure indicating it isn't encrypted, but the payload is. Thus,
490.46s - 495.46s |  we cannot eavesdrop on the physical connection between the HSM and the SOC. So, I went back to
501.55s - 507.39s |  the device and further analyzed the encryption and finally was able to reconstruct it, which
507.39s - 512.39s |  can be summarized as follows. Four bytes are read from an unencrypted flash memory, which
514.23s - 519.23s |  represents the length of data to be read in the next step. Then this data is decrypted using the
521.43s - 528.21s |  IMX6 cryptographic acceleration and assurance module. Afterwards, session keys are derived
528.21s - 533.21s |  from this data and used to encrypt the communication using AES and CBC mode. And since I had a
536.69s - 542.77s |  single device only, I do not know if the data stored on the unencrypted flash is unique or
542.77s - 550.61s |  device specific. Next, I attempted to access keys directly from the rooted device using the
550.63s - 557.76s |  block and trust middleware from NXP. So, I developed a small proof of concept tool to access
557.76s - 562.76s |  data on the HSM. However, the policies are configured correctly and I was not able to access
564.86s - 571.30s |  keys. Ok, so we cannot eavesdrop on the physical communication and we also cannot access data
573.64s - 578.64s |  stored on the HSM. But, how does the firmware encryption work? So, I further reverse
579.56s - 584.56s |  engineered the update process, which can be summarized as follows. A key type is read from
588.40s - 593.40s |  the update file. Next, an encrypted key and IV is read. The encrypted key is decrypted by the
597.84s - 602.84s |  HSM and stored in a file. An encrypted bash script is extracted from the update file and
603.58s - 608.58s |  decrypts, uh, and decrypted using the plain text key. And finally, the parser script extracts
613.80s - 621.72s |  the different firmware parts and decrypts it using the plain text key. So, in summary, each
621.72s - 627.76s |  firmware version has its own encryption key, but with access to a rooted device, we can
627.76s - 634.64s |  decrypt the key and therefore leak firmware specific encryption keys. So, as a proof of
634.64s - 640.68s |  concept, I decrypted such a key using the rooted device and used it to decrypt the firmware
640.68s - 648.73s |  update, for example, the root file system. Alright, so we can decrypt configuration files
648.73s - 655.37s |  using static keys and we can also decrypt firmware updates using our rooted device and its
655.37s - 661.23s |  hardware security module. So, now let's move on to the last topic, the backend
661.27s - 666.27s |  communication. As expected, communication with the vendor's API is encrypted and mutual
668.71s - 673.71s |  authentication is enforced. So, if we want to analyze the communication using a TLS proxy,
676.25s - 682.39s |  our certificate needs to be trusted by the Evon Cozy Plus. And we also need the client
682.39s - 688.89s |  certificate trusted by the backend. So, placing our own certificate in the hard-coded trust
688.89s - 693.89s |  store is simple, but extracting the client certificate turned out to be difficult. In fact,
697.13s - 703.63s |  we also found the hard-coded pass to the client certificate and key, but while the public
703.63s - 710.07s |  key looks good, something seems to be wrong with the private key and it looks like it is
710.07s - 717.73s |  filled up with null bytes. So, it turned out that this is not the private key itself, instead
717.73s - 724.07s |  it is a, it is a so-called reference key and the actual key is securely stored at the
724.07s - 729.07s |  HSM. So, extracting the key is not possible. But, I found a workaround. We can use this
734.17s - 741.05s |  open SSL configuration which references a specific open SSL engine to implement the HSM
741.05s - 746.05s |  for encryption. And now, by using this configuration, we can use open SSL encryption
747.73s - 756.05s |  aware tools like curl on the device itself to communicate with the backend. This also
756.05s - 760.95s |  means without the device's private key, we cannot route the communication through a TLS
760.95s - 767.39s |  proxy. And therefore, I used the following alternative approach to analyze the backend
767.39s - 772.39s |  communication. First, we intercept a request initiated by the device. Then we use curl on
773.39s - 778.39s |  the device to send this exact request and retrieve the response received on the device.
783.43s - 789.13s |  Afterwards, we can implement this response in our own web server and proceed with the next
789.13s - 795.67s |  request or stage. And by doing so, I observed the following endpoints. And especially this
796.49s - 801.49s |  one was quite interesting. In detail, the device generates a certificate signing request
805.77s - 811.91s |  during account assignment and sends it to the backend. The vendor server then signs this
811.91s - 818.91s |  request and the signed certificate can then be requested by the device. Afterwards, the
818.91s - 825.55s |  device has a certificate signed by the vendor which contains the device's serial number. And
825.57s - 831.17s |  this certificate is then used for authentication against the VPN server and the serial number
831.17s - 836.17s |  in the certificate is used by the VPN server to assign it to a specific account or a client.
838.91s - 845.35s |  Therefore, I ask myself, can I get signed certificates for other devices by generating a
845.35s - 850.35s |  certificate signing request with a foreign serial number? And to verify this, I reported my
850.49s - 855.49s |  thoughts and assumptions to the vendor and they gave me a serial number of a device located at
859.13s - 864.13s |  the vendor's lab. So, I generated a certificate signing request including this serial number
866.81s - 871.81s |  and sent it to the API using my routed device. And indeed, the request was successful and I
874.75s - 881.52s |  received a certificate for the foreign serial number. Afterwards, I successfully used the
881.56s - 887.16s |  certificate to initiate a VPN session in the context of the device located at the vendor's
887.16s - 892.16s |  lab. This in turn had the following impacts. First of all, the VPN session of the original
895.50s - 900.50s |  device was overwritten and therefore no longer accessible. Next, if a user tries to connect to
902.94s - 907.94s |  this serial number or device, he gets forwarded to the attacker without noticing. And due to
908.94s - 915.58s |  the missing network restrictions inside the VPN tunnel, the attacker is able to access all
915.58s - 920.58s |  services of the connected clients. So, let me illustrate this. An attacker can use a routed
923.72s - 930.42s |  EvonCozyPlus to get the correctly signed certificate for a foreign device. Then he is able
930.42s - 935.90s |  to use the certificate for VPN authentication, which results in a loss of connection of the
935.90s - 940.90s |  original device. Now, if a user of this solution tries to connect to this device, he will be
943.36s - 949.88s |  forwarded to the attacker and therefore the attacker is able to attack the victim's client,
949.88s - 956.64s |  for example, accessing the client's remote desktop service. And last but not least, the
956.64s - 963.12s |  attacker can imitate the original infrastructure to eavesdrop on sensitive data, for example,
963.14s - 968.14s |  authentication data, or if the victim uploads a secret program to a PLC. And given that the
971.82s - 978.20s |  serial numbers are more or less enumeratable, this attack is scalable and we are able to
978.20s - 985.18s |  disconnect more than 500,000 devices. This means that energy plants, industrial facilities,
987.38s - 993.72s |  critical infrastructures, or oil platforms all around the world are no longer accessible and the
993.74s - 1000.31s |  users trying to connect to them could be attacked. So, let me conclude. We were able to route
1003.81s - 1010.25s |  the device and decrypt encrypted passwords. Afterwards, we used the routed device to get
1010.25s - 1014.89s |  firmware specific encryption keys and getting correctly signed certificates for other
1014.89s - 1019.89s |  devices used for VPN authentication. With these certificates, we were finally able to impact the
1020.03s - 1025.03s |  whole remote access solution accessing devices of connected users and eavesdrop on sensitive
1027.87s - 1035.19s |  data. Of course, we reported the vulnerabilities to the manufacturer who immediately patched
1035.19s - 1042.19s |  the backend so getting certificates for other devices was no longer possible and a fixed
1042.19s - 1047.21s |  firmware version was also recently released. But what can we learn from this? First of all, it
1047.21s - 1052.21s |  is important to consider the risks and increase the tech surface of remote access solutions,
1056.29s - 1063.17s |  especially with infrastructure operated in the cloud or by third parties. And as
1063.17s - 1069.01s |  demonstrated in this talk, exploiting vulnerabilities in such solutions could impact many
1069.01s - 1074.01s |  facilities and maybe your infrastructure too. And for the security researchers among us,
1074.75s - 1079.75s |  some of the vulnerabilities shown were found by gaining root access, meaning similar
1082.71s - 1089.29s |  vulnerabilities may exist in other solutions and waiting for you to be found. Sometimes, you
1089.29s - 1095.23s |  just have to find the right initial foothold. And with that said, thanks for joining this
1095.23s - 1100.23s |  talk. Connect with me on X and feel free to check out the blog post. Thanks.


url: https://www.youtube.com/watch?v=jALLbBisg_8
title: DEF CON 32 - Troll Trapping Through TAS Tools Exposing Speedrunning Cheaters - Allan Cecil
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=jALLbBisg_8",
  "title": "DEF CON 32 - Troll Trapping Through TAS Tools  Exposing Speedrunning Cheaters - Allan Cecil",
  "description": "Trolls cheating in video games by passing Tool-Assisted Speedruns off as human effort break leaderboards and stifle speedrunners. Why do they do it when they could make a cool game hack or TAS to show off their work, and how do you trap these trolls? The answer is to use their own tools against them, often with popcorn bucket worthy results like taking down Guinness World Records. From a TASVideos member taking on 1980's Dragster cheat Todd Rogers, a passing mention of Billy Mitchell, and the TASBot team investigating Super Mario Maker shenanigans, this talk covers several notable cheating incidents and concludes with a systematic takedown of a troll that chilled the Diablo speedrunning community for more than a decade.\n\nThis talk includes several investigations I have been a part of in some capacity and will ultimately include additional references in the coming months; I've broken the references out by game, presented in Markdown format like the rest of this document:",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2629,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

2.86s - 15.10s | This text was transcribed using whisper model: large-v2

 Hello, DEF CON! I am DuangoAC, Keeper of TASBOT, this cute guy right over here, I am so thankful
15.10s - 18.42s |  to not be able to see you because the lights are really bright, but I'm assuming you're
18.42s - 23.26s |  in the audience. Uh, thank you very much for showing up. First of all, this is a dynamic
23.26s - 28.70s |  talk that is changing by the minute. Uh, things have been developing rapidly over the course
28.70s - 33.18s |  of the last week, which I didn't anticipate. So, uh, we're gonna have a lot of fun walking
33.18s - 38.74s |  through this. Uh, first of all, on my screen, I have a paper that I, we just released in
38.74s - 47.10s |  the last seven minutes. Uh, it is at diablo.tas.bot, and you are welcome to follow along from your
47.10s - 51.66s |  own personal device if you so choose to do so. Uh, what we have done is put together
51.66s - 57.82s |  a document that we'll be talking about later on in the talk. Uh, there is a lot to cover
57.82s - 62.46s |  of, of some background of what I'll be doing here. Uh, first of all, if you don't know
62.46s - 69.02s |  me, I am known for a variety of weird things. I am a senior ambassador on-site staff for
69.02s - 75.90s |  TASvideos.org. I am also the founder of the TASbot organization that does tool-assisted
75.90s - 81.66s |  speedrun content on real hardware at places like Games Done Quick events. Uh, there's
81.66s - 86.22s |  some interesting stuff that I've managed to get into over the course of the last few years,
86.22s - 92.02s |  and I'm gonna quickly go over some highlights from some past things that have happened.
92.02s - 96.82s |  Some of them are rather bizarre. Uh, there are things that I didn't expect would happen
96.82s - 104.22s |  that did. Um, for instance, in 2017, there was someone named Todd Rogers who cheated
104.22s - 111.10s |  at a video game. He cheated all the way back in the 80s, but we found out about it in 2017.
111.10s - 118.62s |  And getting involved in that little bit of, of intrigue started a process of, uh, aligning
118.62s - 124.82s |  me in weird ways of trying to help take down cheaters in speedruns, which is not something
124.82s - 128.86s |  I expected to do. I'm used to making them and playing them on a real console for charity.
128.86s - 134.10s |  Uh, so, so this talk is actually very different than most of the other talks I've given because
134.10s - 139.98s |  it's really a lot more about finding something interesting, going, hmm, that's not right.
139.98s - 144.30s |  And then somehow getting attached to these investigations and getting sidelined off in
144.30s - 151.30s |  some weird project. So, I want to talk to you about what happened in 2017. In the 1980s,
151.30s - 157.82s |  a game for the Atari 2600 came out named Dragster. And a runner at the time, someone who was
157.82s - 163.20s |  playing video games competitively named Todd Rogers, set a record of being able to complete
163.20s - 170.22s |  the game, allegedly, in 5.51 seconds. In other words, the fastest amount of in-game time
170.54s - 176.90s |  to, to beat the game effectively. Now, this ended up ultimately becoming a Guinness Book
176.90s - 182.18s |  of World Records because this record that was on Twin Galaxies went unbeaten for over
182.18s - 189.18s |  three decades. And there was an effort in about 2016-2017 by tool-assisted speedrun
190.54s - 195.70s |  author and TASOvideos member OmniGamer to make a tool-assisted speedrun of the game.
196.06s - 200.82s |  It's a little bit of context. You might have played a game like Metroid or Super Metroid
200.82s - 205.02s |  in the past where you get to the end of the game and it will show you how long it took
205.02s - 209.74s |  you to complete the game. It shows a timer and sometimes even different graphics depending
209.74s - 213.50s |  on how quickly you've managed to finish the game. So, speedrunning started to become a
213.50s - 220.06s |  thing based on games that encouraged you to try to beat them quickly. And a normal speedrun
220.06s - 224.94s |  with human effort involves the process of grinding through trying to play a game as
224.94s - 231.40s |  quickly as possible. And from that came an off, kind of a rather interesting branch of
234.96s - 239.96s |  doing this, but without any human limitations of skill, reflexes, memory, luck, things like
239.96s - 244.74s |  that. And that's called a tool-assisted speedrun. One of the most famous examples of those is
244.74s - 250.14s |  from 2003, someone named Morimoto released what was called a Super Mario Brothers time
250.14s - 255.78s |  attack, Super Mario Brothers 3 time attack run. Uh, it was not labeled. Uh, it was ridiculous
255.78s - 261.02s |  because it had Mario jumping all over the place, randomly getting 99 lives, never dying,
261.02s - 265.56s |  getting really close to enemies. And there was no labeling to say that it was a tool-assisted
265.56s - 270.90s |  speedrun. And it caused a lot of, you know, pre-YouTube days controversy. Just a WMV file
270.90s - 275.40s |  floating around the internet didn't have enough context to explain it. It was a tool-assisted
275.40s - 279.98s |  speedrun and ultimately something that someone named Bizkwit developed NES videos, which
279.98s - 285.42s |  became TAS videos, to host tool-assisted speedruns like that. In other words, you can play a
285.42s - 290.62s |  game as a human or you can use tools to play the game inside of an emulator. Tools like
290.62s - 296.44s |  save states, being able to stop at any point and back up and try a section again. Tools
296.44s - 302.44s |  like frame advance or slow motion, being able to go forward one video frame at a time. Uh,
302.44s - 308.24s |  being able to, uh, record a movie while you're going and record all of the button presses.
308.24s - 313.44s |  So that's, that's kind of the difference between a speedrun and a tool-assisted speedrun. And
313.44s - 319.08s |  you see, when OmniGamer, back to our Dragster story, attempted to make a tool-assisted speedrun
319.08s - 325.28s |  of Dragster, he ran into a minor problem. Even with superhuman precision, he was unable to
325.28s - 331.86s |  match Todd Rogers' time. Which raised some questions. So, how exactly did Todd Rogers
331.86s - 338.30s |  manage to beat Dragster in 5.57 seconds? Uh, in the process of this investigation, OmniGamer
338.30s - 342.94s |  looked at the source code, the ROM, from the cartridge. So we took the actual physical
342.94s - 348.74s |  cartridge, put it in a reader, pulled the contents of the ROM off, examined the way the code
348.74s - 353.88s |  worked, and determined that the fastest time that all versions of Dragster that we've ever
353.88s - 358.34s |  found, prototypes through released versions, all versions had the same algorithm that would
358.34s - 364.36s |  not allow for a time, a time of 5.51. In fact, the fastest speedrun time that was achievable
364.36s - 369.46s |  through the code was 5.57. And in that time frame, I had already started doing something
369.46s - 376.86s |  interesting with TaskBot. By 2013, I had formed a community of people taking tool-assisted
376.86s - 380.96s |  speedruns and playing them back on real hardware with our cute little mascot here. He looked a
380.96s - 385.74s |  little different at the time. He was based on a robot at the time. But at that time, I had
385.74s - 391.78s |  worked with a bunch of folks like True and Micro 500 and a bunch of other tools designers
391.80s - 397.24s |  that created what's called a replay device that pretends to be an Atari 2600 controller. And we
397.24s - 402.24s |  used TaskBot to play Dragster and beat the game on a real console with superhuman input. And
404.82s - 411.22s |  the fastest time we could achieve was 5.57. In other words, we used a real console, a real
411.22s - 417.90s |  cartridge, and superhuman input, and couldn't reproduce the time that Todd Rogers claimed. As
417.92s - 423.10s |  a result of that investigation, Todd Rogers' records were stripped from Twin Galaxies and also
423.10s - 429.54s |  from Guinness Book of World Records. It was a huge effort on OmniGamer's part to do all of the
429.54s - 433.74s |  research and to assemble all of that information. And I was really thankful to be able to play a
433.74s - 439.84s |  small part in being able to do the tool-assisted speedrun on real hardware. I didn't expect to
439.84s - 444.18s |  ever return to that world. That was back in 2017. And somehow this year, I've now had two
444.20s - 450.54s |  separate instances of getting embroiled in, hey, wait a minute, we're trying to do something, and
450.54s - 455.54s |  we think that something is cheated. The other time was in January, February, well, I guess March
455.54s - 461.42s |  timeframe of this year. The Super Mario Maker community was trying to complete every single
461.42s - 467.62s |  Super Mario Maker level before Nintendo shut the servers down. They had cleared all of the levels
467.62s - 475.42s |  that they knew about, except one named Trimming the Herbs by a level author named Ahoyo. And there
475.42s - 481.78s |  was a massive group of people trying to grind out beating this one 10-second long speedrun-oriented
482.14s - 486.02s |  Super Mario Maker level. And they couldn't do it. It was really challenging. And the question
486.02s - 493.46s |  became, how did they do it? Ultimately, Ahoyo came forward and said, hey, I admit it, I used tools to
493.46s - 498.66s |  do this. And through that investigation, there's a series of Ars Technica articles. I worked with a
498.66s - 504.82s |  team of folks in my Taskbot community and a bunch of amazing subject matter experts to recreate that
504.82s - 510.66s |  tool-assisted speedrun based on what Ahoyo had said. We were able to get it to work. And amazingly, not
510.66s - 515.66s |  only were we able to get a tool-assisted speedrun to work that was first cleared by someone who just
515.66s - 522.62s |  joined the Taskbot community, but amazingly, a human somehow after many, many attempts, a human
522.62s - 526.74s |  actually managed to clear this level that we thought was completely impossible. But yet again, I got
526.74s - 533.62s |  caught up in a situation where a run was seemingly legit, a video game record seemed to be legit, but
533.62s - 541.42s |  was not. So imagine my surprise when earlier this year, I worked with a speedrunner named FunkmasterMP
541.54s - 545.46s |  who runs the video game Diablo. And he came up to me and said, I would like to make a tool-assisted
545.46s - 551.82s |  speedrun of Diablo. Let's figure out how to do this. The tools were just starting to become developed to
551.82s - 557.90s |  do this. It was just starting to, to come together. And I said, yeah, sure. Let's, let's do that.
557.94s - 566.54s |  Let's uh, let's try, let's try to make a task of this. We used the fastest speedrun we could find, which
566.54s - 572.66s |  was on Speed Demos Archive, a website that records the fastest speedruns of games. And the run had
572.66s - 580.34s |  been released, or had been created in 2009 by a runner named Grubo. It was a segmented run, meaning
580.34s - 587.54s |  that the runner was allowed to do individual levels, and grind out one level, and then do the next
587.54s - 592.94s |  level and stitch them together. But it did represent a very fast time that we wanted to use as the
592.94s - 598.34s |  basis for a tool-assisted speedrun. With the assumption that if a human could do it, that we
598.34s - 604.06s |  could do it. The only problem was we couldn't reproduce several of the things that we saw in
604.06s - 610.06s |  Grubo's run, even with superhuman precision. And it started a long conversation with the team of
610.06s - 615.42s |  developers behind the Devolution and DevolutionX projects that decompiled the game Diablo.
616.06s - 621.70s |  Ultimately, it raised enough questions that we developed a team to start to analyze this video.
622.06s - 630.06s |  And the bulk of my talk today is going to be about what we found. Now, I want to play that video. And
630.06s - 638.06s |  what I want you to do is I want you to, as you watch this, see if you can spot where things might be a
638.06s - 642.26s |  little bit funny. Now, the downside, of course, is you're going to see this in real time, but that's
642.30s - 648.62s |  okay. So this is the run should be on screen, and hopefully the volume is not blastingly loud. I'm
648.62s - 653.06s |  going to play this, you can see that it says speed demos archive verified no cheating. And I'm going
653.06s - 663.31s |  to play this run now. So there's our title screen, you can see this was a game made by Diablo. It was
663.31s - 669.23s |  originally released back in 1996. Here is our screen to start the game and our character screen.
670.23s - 673.23s |  Yeah, that's that's a little loud, but should be okay. Yeah, let's turn that volume down just a
673.23s - 685.23s |  hair there. So this run was done by Grubo on a on on a believe the time he was running a Windows. I
685.23s - 689.23s |  don't I don't want to speculate what operating system is on. We never actually isolated that one.
689.23s - 695.23s |  But this was done back in 2009 with the releases of Diablo that were available at that time. Diablo
695.23s - 699.23s |  Diablo is by the way, a show of hands now that I can kind of sort of see you who here has played
699.23s - 705.23s |  Diablo before. Wow, almost half the audience sanctity of this book. That wasn't me talking.
705.23s - 710.23s |  Don't worry. There's going to be some random stuff. So for observe here that he walks from the
710.23s - 719.23s |  upstairs to the downstairs, grabs an item here walks back down the stairs. grabs another actually
719.23s - 723.23s |  I guess that's where he's grabbing the item. A couple of quick notes. This particular category
723.23s - 730.23s |  allows removing those load screens from the calculated time. So again, we're going he's going
730.23s - 734.23s |  directly from the upstairs to the downstairs very rapidly. This is incredible luck that you would
734.23s - 741.23s |  never find anyone who's played Diablo before knows that you just don't get that that doesn't happen.
741.23s - 750.23s |  Okay, so here he's killing an enemy and grabbed a staff allows him to basically warp which you saw
750.23s - 756.23s |  there. He's he's phasing and hopping around the level really fast. He grabbed that item from the
756.23s - 761.23s |  very first enemy in the game that happened to be dungeon level nine. That'll be important later.
761.23s - 768.23s |  And again, he's just phasing and portaling trans moving all over the place as fast as possible.
768.23s - 779.23s |  Right here. You can see he walks back to town to go buy some more items. He did. He did a couple
779.23s - 785.23s |  of things that were way too fast there. Right here he is duping a stave. He's got he's picked up an
785.23s - 794.94s |  additional staff. He's gonna head over to the shop and make a couple of purchases. This part is a
794.94s - 800.94s |  little bit easier to to catch in real time. Some of these things are really hard to notice unless
800.94s - 810.94s |  you're you're watching in slow motion. For instance right there. Can we turn that volume down just a
810.94s - 817.94s |  little more? It's still pretty loud. All right, so the shop there, there was some inventory on screen.
817.94s - 832.62s |  I'll be coming back to that in a second. There's a ring there. Okay, now we're back into the action.
832.62s - 838.62s |  Again, a nice fast portal. There was something interesting on that screen I'll point out later.
838.62s - 846.62s |  Okay, another set of phases. Okay, this is a battle. For anyone who's played Diablo, there's some
846.62s - 852.62s |  improbably lucky things happening here. Legitimate though.
856.62s - 860.62s |  All right, finished that fight. And now the final section.
879.13s - 886.13s |  And that's it. That was the entire run. So, now you've been a little spoiled because I accidentally
886.13s - 892.13s |  left this on my screen, but that's okay. Based on what you saw, did you guys happen to notice
892.13s - 897.13s |  anything that seemed a little bit off in any of those? Especially anyone who's played Diablo before.
897.13s - 903.13s |  So, if you kind of had some suspicions that something wasn't right, what approach would you take
903.13s - 908.13s |  to prove it? What techniques might you use? Now, I'm going to have these slides on screen,
908.13s - 913.13s |  but you can also head over to diablo.tasks.bot to see a version that's a little bit less squished.
913.13s - 917.13s |  So, I'm just going to run through a little bit. We have a whole bunch of background that I've kind of
917.13s - 923.13s |  already talked about here. What I'm going to do is just start at the very first thing here,
923.13s - 932.13s |  which is this title screen. So, if you look here, right here, the copyright date says 1996 through 2001.
932.13s - 940.13s |  What the team did is made a full table of every single release of Diablo and every single bit of metadata
940.65s - 948.65s |  about it. And we can see that if the copyright date shown on the screen is 2001, then it must be version
948.65s - 954.65s |  1.09 of the game. Okay. Alright. So, now we know what version of the game he's running, except there's
954.65s - 965.57s |  one minor problem. Um, it says Diablo version 1.00 on the next screen. Hmm. Okay, so which is it?
965.57s - 973.57s |  Is it Diablo 1.09 or is it Diablo 1.00? Alright. So, this was something we saw early on that gave us
973.57s - 979.57s |  some suspicion about how exactly was this run made anyway? So, then we get to this character screen.
979.57s - 985.57s |  Now, this is not all that interesting. It's just a screenshot, but when we played the video, I was kind
985.57s - 989.57s |  of talking over it a little bit, but I was quiet long enough for you to perhaps notice that there was no
989.57s - 993.57s |  music playing during this character select screen. So, if you go back and watch his submission, you'll
993.57s - 1001.57s |  note that there is no music at that point. That was only something that happened in Diablo 1.05 and later.
1001.57s - 1009.57s |  So, that means we started with 1.09, went back to 1.0, and then somehow ended up with 1.05 or later,
1009.57s - 1021.57s |  which is kind of an interesting conundrum. Like, how is it that this happened? Okay. Well, let's get
1021.57s - 1027.57s |  into it a little bit more. Remember how you saw the stairs constantly going? You'd have an upstairs and a downstairs.
1027.57s - 1033.57s |  They'd be right next to each other. Once or twice is one thing, but he got it on nearly every level.
1033.57s - 1037.57s |  We're like, okay, well, we want to make a tool-assisted speedrun. We want that. Well, we didn't know
1037.57s - 1045.57s |  exactly what Grubo had done, which game seed he had started with, so we made an entire open-source
1045.57s - 1053.57s |  code set to entirely disassemble every little last bit of the Diablo map generation and use those tools
1053.57s - 1059.57s |  to identify what exact game he used. And there's some information in here that I'll leave for an exercise
1059.57s - 1067.57s |  to the reader for later. But the key thing that comes out of this is we managed to find the game seed
1067.57s - 1073.57s |  that he used for the first level. Now, quick note. Diablo is a game where every single dungeon level,
1073.57s - 1079.57s |  Dungeon Levels 1 through 16, are all generated at the moment that you start the character. In other words,
1079.57s - 1085.57s |  you have a game seed and all of your dungeon seeds are generated from that. There was only one minor problem.
1085.57s - 1093.57s |  The next level, Dungeon Level 2, didn't match. The first level matched, but not the second or any of them
1093.57s - 1099.57s |  after that. So we had a puzzle that we had to solve. We basically repeated the same search that we were doing
1099.57s - 1107.57s |  16 times for each of the dungeon levels and found that Grubo hadn't played one game of Diablo.
1107.57s - 1115.57s |  He'd taken save files from 15 different games and stitched them together. And because our tools are very accurate,
1115.57s - 1121.57s |  we were able to identify the exact game time of each one of these. And you know all of these are in 2008
1121.57s - 1127.57s |  all the way till this one, which is in 2009. Grubo submitted his run in 2009, in January 2009.
1127.57s - 1137.14s |  So these are very likely the exact levels that Grubo found. Just to put some context around that,
1137.14s - 1145.14s |  we have high confidence that we exactly matched what's shown on the screen to the levels and we have an appendix
1145.14s - 1153.14s |  in this document that describes how we identified those levels in detail. But we missed two levels.
1153.14s - 1160.14s |  Dungeon Levels 3 and 4 were entirely missing and Dungeon Level 9, the one where you saw him pick up a staff
1160.14s - 1169.14s |  from the first enemy, was there, but the items were wrong. So this definitely caused us to ask a few more questions.
1169.14s - 1176.14s |  Like, okay, what's going on here? How did this happen? There were some other things that were very interesting.
1176.14s - 1182.14s |  One of them was an inconsistent inventory issue. So if you're playing legitimately, you're generally going to
1182.14s - 1193.14s |  not have any discrepancies in your run. We found a couple. For instance, in Dungeon Level 4, we pick up a ring
1193.14s - 1202.14s |  from that sarcophagus. Then when we're... I'm sorry, not we, Grubo. Grubo then went to Dungeon Level 9
1202.14s - 1207.14s |  and opened his inventory, which you can note here that there's no ring in his inventory.
1207.14s - 1212.14s |  But later on in town, he opens his inventory again and there's the ring again. So wait a minute.
1212.14s - 1216.14s |  We had a ring, we lost a ring, we got the ring again. How did this happen?
1216.14s - 1222.14s |  Okay, that seems to be proof that there is an irregularity in the speedrun.
1222.14s - 1228.14s |  Another thing we noticed, and I'm not going to get into too many details on this, but there are some impossible
1228.14s - 1234.14s |  quest combinations. There's groups of quests. For instance, Poisoned Water Supply and the Curse of King Leoric
1234.14s - 1239.14s |  is the first group. You're going to have one of these and not the other. The other group down here, say
1239.14s - 1245.14s |  The Butcher, Garibald the Weak, and Ogden's Sign, you're going to have two out of three of those.
1245.14s - 1252.14s |  But not all three at once. And what we found is extensive evidence of those not necessarily always aligning.
1252.14s - 1266.14s |  Like right here we have the Poisoned Water Supply in evidence, but then later on we see that the Butcher's Red Room
1266.14s - 1280.67s |  was present. Well, let's see. Getting my own notes mixed up. Basically, we expected that the quest Ogden's Sign
1283.37s - 1291.37s |  would not be active. If it were, these stairs here would be behind walls. But most of the levels that we found
1291.37s - 1297.37s |  in those seeds had those walls in place. Basically meaning that the speedrun wouldn't have been
1297.37s - 1302.37s |  completable. So, wait a minute, what's going on here? We found a couple of other inconsistencies there.
1302.37s - 1313.37s |  A quest was available on dungeon level 13 that was used. I'm sorry, let me rephrase this. A quest was available
1313.37s - 1320.37s |  in four of the games. So we found it in four of them. And if that had really been the case, Gruber wouldn't have
1320.37s - 1328.37s |  been able to continue forward if that had actually been active. So basically we ran into all these weird
1329.37s - 1336.37s |  inconsistencies. Effectively there were just the wrong numbers of wrong combinations of quests that the game
1336.37s - 1342.37s |  logic would never allow. We have some additional information on that in here for later. Now this is the one
1342.37s - 1348.37s |  that was probably the most curious to us. We described this as inaccessible dungeon level. So when we got to
1348.37s - 1357.37s |  dungeon level nine, we found the right room layout, but the problem is that even with conducting a search
1357.37s - 1367.37s |  across all ranges, we couldn't quite identify any levels that exactly matched what was there. Basically some
1367.37s - 1376.37s |  context. The game Diablo uses the current epochs and the 32-bit signed integer of number of seconds since 1970
1376.37s - 1383.37s |  to determine what the game seed is. And in Windows, you can't really go beyond certain years. In other words,
1383.37s - 1388.37s |  if you go beyond the year 2038, Diablo will just keep repeating the same level over and over again. There's no
1388.37s - 1396.37s |  natural way to get to levels after that. But the only levels we found that exactly matched what we saw in Gruber's
1396.37s - 1405.37s |  dungeon level nine were in the years 2056 and the years 2074, which again, something just seemed really wrong
1405.37s - 1410.37s |  about that. He played this game in 2008, 2009. So there was just something really weird. And more than that,
1410.37s - 1417.37s |  the fact that the first enemy dropped an item in a way that just would not be possible, despite searching the
1417.37s - 1427.37s |  entire 32-bit signed space, every possible level, not one instance of finding that combination anywhere, just
1427.37s - 1433.37s |  seemed very, very strange to the team. There was also some aspects that were a little bit tricky to figure out.
1433.37s - 1438.37s |  For instance, there's some missing gameplay, and we went so specific as to go down to a single frame. For instance,
1438.37s - 1446.37s |  there's an animation of him walking and turning. We have a first frame in Gruber's video where, well, we did a
1446.37s - 1456.37s |  demo video here. So this is a demo video. We're facing down, then we're facing away, and then we are facing away,
1456.37s - 1461.37s |  and the right leg is in front of the left. You won't be able to see this on screen. It's way too tiny. But in Gruber's
1461.37s - 1467.37s |  initial video, it's walking forward and then immediately goes backward with a frame missing. So there's just, for
1467.37s - 1475.37s |  whatever reason, a single frame of video that we can, without a shadow of a doubt, say is just not there. Now, that
1475.37s - 1482.37s |  means that the encoder might have had a problem. It doesn't necessarily mean that he cheated there. It's just odd.
1482.37s - 1488.37s |  It did make it harder to identify where things might have been spliced incorrectly. However, there were sections
1488.37s - 1495.37s |  that were missing gameplay entirely. For instance, when we entered dungeon level 15, this red portal is already
1495.37s - 1503.37s |  open at the moment it appears, which means that that section of that portal initially opening is entirely
1503.37s - 1509.37s |  missing. In other words, that portion of gameplay was cut off, which indicates a potential video splice problem.
1509.37s - 1517.37s |  And there's a couple of other instances of that as well. I talked about this earlier, the inconsistent item drop
1517.37s - 1526.37s |  here, where we just cannot manage to find any way that that could have possibly happened. So that's kind of a rehash.
1526.37s - 1535.37s |  But then there's another thing. There's what we describe as improbable item duplication. We see that as Gruber is
1535.37s - 1543.37s |  walking, there are staffs that are like a nauseous puzzler. It's being duplicated in movement. The only problem is,
1543.37s - 1548.37s |  and you can see that there are two of them here in inventory in the screenshot. The only problem with that is we saw on the
1548.37s - 1556.37s |  version screen that it was using version 1.0. But in version 1.0, that duping glitch is very, very difficult to do
1556.37s - 1564.37s |  because of a very tight timing loop. This likely wouldn't have been possible for a human to do until Diablo version 1.02
1564.37s - 1571.37s |  or later. So we again had that weird, what's going on with these version mismatches? Then we ended up with this next
1571.37s - 1580.37s |  one, which was what we described as inconsistent music playback. We went so far as to bust out everyone's favorite tool, a
1580.37s - 1587.37s |  spectrograph. So this is a spectrogram view. And what we did is we looked at the section of video where we had some
1587.37s - 1593.37s |  questions about how they did something. We can see footsteps, footsteps, footsteps, footsteps, and then there's this really
1593.37s - 1601.37s |  sharp line right here. And this sharp line is where a video splice clearly happened. You can hear the music abruptly
1601.37s - 1609.37s |  changing, and then the shop character starts speaking right here at this edge. Um, that basically gave us a pretty clear
1609.37s - 1619.37s |  indication, based on that, on that audible signal, that there was something funny going on with, with, with this, uh, with this
1619.37s - 1627.37s |  section. There was, there's something weird here. Then we ended up with this shop inventory, which was pretty puzzling. Uh, so
1627.37s - 1638.37s |  there's this level, there's these items in inventory. And then on the next, uh, page, there's these items. And I'll go back
1638.37s - 1645.37s |  here. Okay. Let me see if I can get both of them on the screen. Basically, the issue is, they have one set of items, and then
1645.37s - 1654.37s |  suddenly they get a totally different set of items. The challenge with this is, you'd either have to, in version 1.00 to 1.02,
1654.37s - 1662.37s |  you'd have to walk all the way to the dungeon and walk back. Or, if using version 1.03 or later, you would have to, at this
1662.37s - 1671.37s |  point, save and then reload to force the shop to, to ro- to, uh, to change. Um, that theoretically should have been
1671.37s - 1678.37s |  included in here one way or another, or at least a note about it in the description, but that wasn't included here. So, we saw this
1678.37s - 1686.37s |  and went, hmm, there's, there's something missing in this location. Uh, then there's this fun one. Um, if you look really
1686.37s - 1694.37s |  carefully, we have a little red section right here. It's probably not visible on the display. Uh, but this says, this says
1694.37s - 1706.37s |  hit points negative 22. In, um, in this game, it is possible, through certain glitches, to overflow the health, and it not only
1706.37s - 1714.37s |  gives you negative health, it even goes so far as to draw the health in the orb backward. It's drawing it from the bottom- from the
1714.37s - 1725.37s |  top instead of the bottom. Uh, the only challenge here, though, is that the glitch was fixed in version 1.07. Meaning, going back to
1725.37s - 1734.37s |  our initial screen that said 1.09, he couldn't have used 1.09. So, we come into this, okay, well, what version did he use anyway?
1734.37s - 1741.37s |  There's no one version where all of these factors can all be in play at the same time. So, out of that, we, we came up with our own
1741.37s - 1750.37s |  conclusions. Now, I'm gonna pause here. Based on this evidence, and, and show of hands, based on the evidence that I've shown you so far,
1750.37s - 1759.37s |  does it seem like this run is completely legitimate? Or, raise your hand if you think this is perhaps not legitimate. Okay, not legitimate?
1759.37s - 1764.37s |  Most, okay, most folks are like, okay, most folks in the audience are like, eh, this is probably not legitimate. Well, that was our
1764.37s - 1772.37s |  conclusion as well. Like, there's just so many factors here, especially given that these dungeon layouts aren't correct. And we, we spent so much
1772.37s - 1780.37s |  time, so many members of the team spent so much time disassembling the code and diving in to understand what had happened here. Uh, but we just
1780.37s - 1788.37s |  couldn't come up with, with any, any way to, to handle this. Like, we, we, we knew that there was something funny. So, our conclusion were,
1789.37s - 1796.37s |  when we finished this analysis, our conclusion was that this run should be removed from record sites. Not just SDA, Speed Demos Archive, where the
1796.37s - 1804.37s |  record is held now, but also Guinness Book of World Records, because there are two separate records on that site. We had attempted to contact
1804.37s - 1813.37s |  Rubo in February through LinkedIn, didn't receive a reply, didn't have any other contact information. So, the analysis you just saw was based on no
1813.37s - 1821.37s |  information from the runner. Remember how I said I was kind of scrambling a bit? Well, that's because in the last week, we got in touch with Rubo
1821.37s - 1829.37s |  thanks to a journalist who was interested in this story and reached out to Rubo directly using the premium LinkedIn, actually. This is not an ad. Um, but
1829.37s - 1841.37s |  managed to get in touch with Rubo. And suddenly, all of our carefully constructed theories got really interesting. So, our talk is going to take a bit of a
1841.37s - 1852.37s |  turn. And also, you can kind of gather that I'm kind of presenting this in a very different way than I intended to. Rubo responded just this month,
1852.37s - 1862.37s |  just in the last week, that because it was a segmented run, everything that we saw was completely explainable and totally allowed.
1863.37s - 1875.87s |  Specifically, that the version number seen on the initial title screen versus the credit screen of the splash screen, and the discrepancies with
1875.87s - 1884.87s |  versions, that was just because he'd used old encodes and just stitched all that together for flavor. It didn't matter to the timing of the run and wasn't a
1884.87s - 1895.87s |  problem. Okay. He further said that there was an exception in place that allowed him to start runs from multiple different saves, and then use tools
1895.87s - 1904.87s |  to modify the memory, and ultimately, what gets saved in the save file, in order to basically catch up levels to match what previous levels had
1904.87s - 1913.87s |  done. Now, obviously, we show that that wasn't always right. There's multiple cases where, for instance, that ring that appears and then disappears
1913.87s - 1922.87s |  and then reappears again. That's a, that's a little bit funny. He obviously, if he did use those tools in the way he said, there were some mistakes
1922.87s - 1931.87s |  made. Okay, not, not the end of the world. His exact quote, just so that it's here on the record, my run is a segmented spliced run, it always has been, and it was
1931.87s - 1938.87s |  never passed off as anything else, nor was it part of any competition or leaderboards. The speed demos archive page states that outright. Now, I would
1938.87s - 1946.87s |  slightly disagree with Grubo on this point. I would say that speeds demos archives is a leaderboard. It is a records holding site. And furthermore,
1946.87s - 1954.87s |  it's not entirely clear how the Guinness Book of World Records ended up there. But I would say Guinness Book of World Records is a records leaderboard
1954.87s - 1965.87s |  site in every sense of the word. So that little bit of nitpick aside, Grubo's statement was basically, well, this was segmented, it was, it was possible to
1965.87s - 1972.87s |  split wherever I wanted to. Sure, you showed that there was a video split right before the shot, but that's completely allowed. I can do that. And SDA timing
1972.87s - 1988.27s |  says that I can remove the loading screens and just take a half second penalty. So, alright, where does this leave us? What do we do? We put a lot of effort
1988.75s - 1999.75s |  into taking apart all of these elements, only to discover that the runner didn't do this with malice, at least according to his statement. And in all
1999.75s - 2009.75s |  honesty, as, as a presenter, I have to agree with that. I don't think that Grubo maliciously tried to hurt anyone. But I need to pause there for a second,
2010.75s - 2020.75s |  because in 2009, when Grubo released this run, that was only three minutes and 12 seconds long using SDA timing that removed those load screens. It
2020.75s - 2033.27s |  completely stopped speedrunning in that category. No one else could get times anywhere near what Grubo had. Why? Because none of us read what Grubo submitted in
2033.27s - 2042.35s |  his notes and interpreted it as, oh, yeah, I just took multiple different games and hacked together to save files using external tools that wrote to
2042.35s - 2052.99s |  memory. No one made that assumption. The exception that Grubo claims to have had is nowhere to be found. Now that doesn't mean it didn't exist at the
2052.99s - 2061.95s |  time. SDA staff has rotated since then. But nevertheless, there is is doubt maybe Grubo did have an exception. We don't have any of the save
2061.95s - 2072.27s |  files. The SDA folks didn't keep them. Grubo didn't keep them. Well, all right, here we are. We're in a situation where we can't prove
2072.27s - 2085.23s |  anything necessarily outside of one aspect. It's still a little bit interesting that despite all of the disassembly we did, we never found any
2085.23s - 2094.67s |  possible route for Grubo to produce dungeon level nine with that drop of the item right away. It's simply it can't happen. There's no possible way
2094.67s - 2106.31s |  that we were able to analyze in any version of Diablo that could produce that. So where does that leave us? Well, speedrunning on that category
2106.31s - 2115.21s |  effectively stopped in 2009. No one could beat it. But in the last couple of weeks, as we've had folks streaming on Twitch, and talking about
2115.23s - 2128.39s |  about, hey, well, maybe maybe now we can use new new methods to complete this faster. We've now come to a place where we can get very close to
2128.39s - 2139.39s |  Grubo's time, we won't necessarily be able to beat it with human skill just yet. But we in the last week, scrounged and scraped and a whole bunch of
2139.39s - 2147.71s |  folks on the team work together, Stephan and a Jenbo and FunkmasterMP and Nightcat and a bunch of other folks. There's a huge credits list, by the
2147.71s - 2160.23s |  way, all got together and made a tool assisted speedrun to demonstrate what could be done on a real, legitimate playthrough, where we have one
2160.23s - 2168.07s |  game seed and all of the dungeon levels that we encounter are legitimate dungeon seeds, and there's no issues whatsoever with with
2168.07s - 2178.43s |  splicing. And I would like to just quickly show you that video. I'm going to be talking over it. So we'll keep the volume a little bit quieter. But
2178.95s - 2197.57s |  you know, it'd really help if I had the video up. Okay, let me just load that right quick. Go. Well, I'm looking that up. Oh, yeah, of course, it's
2197.57s - 2210.98s |  not in my history. Why would it be? Okay. You know, it's always fun when you're doing a talk, and things are changing right beforehand. There it is.
2210.98s - 2221.10s |  There's the test. All right, there we go. So I want you guys to watch this really quick. I'll be talking over it as we go. Right. Just make sure the
2221.10s - 2236.54s |  right task came up. Nope, it ain't there. All right, let's hope they don't splash my whole desktop. All right. Yep, I definitely tried to
2236.54s - 2244.90s |  splash something I didn't mean to but that's all right. There we go. Here we go. Let me make that in big and and I will also restart it for the sake
2244.90s - 2255.26s |  of of there we go. Okay, so this is a tool assisted speedrun, which isn't necessarily quite as fair. You might consider this a super segmented
2255.26s - 2263.62s |  run. Um, Grubo did did his run in 27 segments, this tool assisted speedrun is doing it in a lot more than that. But right here, we're duplicating
2263.62s - 2270.58s |  gold by dropping it on the ground and immediately picking it back up in a way that allows us to double our gold pile every time that you can see we
2270.58s - 2278.98s |  played this entirely on Diablo version 1.04. Here in the second is going to be the flashiest thing that happens in this run. We're going to go to the
2278.98s - 2293.34s |  shop and we're going to buy a few items. Okay, there it is. Yeah, that's that's not fair. Now, as as this is playing, what's interesting about
2293.34s - 2303.30s |  this is that we could not possibly create a number of dungeon levels that were that had stairs as close as Grubo did. But what we were able to get
2303.30s - 2312.14s |  were a fair number of them that were reasonably short. And the first level though here is Diablo dungeon level one here, there's a bunch of walls
2312.14s - 2319.42s |  in the way between us and the stairs that go down. So we use a new new glitch recently discovered that allows us to repeatedly phase without
2319.42s - 2328.78s |  consuming any resources and just you know, go right through the walls. So while the level itself is physically longer distance between the stairs that
2328.78s - 2335.62s |  go up and the stairs that go down, we were still able to clear that section relatively quickly. And as you'll see, several of these are still
2335.70s - 2349.42s |  remarkably fast. Like there's the stairs literally right there. So while this is playing, a couple of things I want to say was Grubo a cheater? Was
2349.42s - 2357.74s |  was he actually intending to troll like Todd Rogers did? Because we can pretty much say that Todd Rogers was a troll. I think that's pretty fair to
2357.74s - 2366.18s |  say every single one of his records was eliminated from Twin Galaxies and Guinness Book of World Records. I think his case is very clearly a
2366.18s - 2377.78s |  troll. The Super Mario Maker situation with Ahoyo. Was he a troll? Not? Well, sort of he deliberately said he did this to troll people. But is he
2377.78s - 2385.42s |  really a troll? Well, not really. He came forward and he admitted, okay, well, here's the tools and he gave us the tools that he used. And he came
2385.42s - 2395.18s |  clean. Yes, it caused a lot of consternation. And it was a little bit of a bittersweet ending to the original Super Mario Maker for the Wii U. But was he
2395.18s - 2405.90s |  really a troll? Was he really a cheater? And Grubo? Is Grubo really a cheater? And you know what, I thought so. Like when I went through this
2405.90s - 2414.02s |  analysis and all of these tools that we put together, yeah, I thought so. And then I talked to him. And then we kind of looked at things through a
2414.02s - 2422.82s |  different lens of, hey, it was 2009. And things were a little bit looser at Speed Demos Archive back then and records are not really intact. And was he
2422.82s - 2433.34s |  really a cheater? You know? No, I don't think so. Personally, there are other members on the team with more strong opinions about that. But at the end
2433.34s - 2443.02s |  of the day, I'm only calling for Grubo's run to be retracted because it doesn't meet current standards. And it shouldn't have met the standards
2443.02s - 2453.74s |  even in 2009 because of the impossibility of what was there. In a tool-assisted speedrun and a real speedrun, you can't just go in and modify how the
2453.74s - 2463.82s |  game works. If you want to do that, watch some of my GDQ stuff that the Taskbot team has done. Maybe Triforce Percent is a great one if you have not
2463.82s - 2470.42s |  seen it before. Look up Legend of Zelda Ocarina of Time Beta Showcase or Legend of Zelda Ocarina of Time Triforce Percent. It's the same run.
2470.70s - 2477.86s |  Highly recommend watching that. You can see what happens when you play by the game's rules on an original cartridge and well, in that case, cartridge and on an
2477.86s - 2486.66s |  original console. And you just use arbitrary code execution to then get the game to change how it works itself. That's totally legitimate. But modifying it
2486.66s - 2495.42s |  externally and doing a ROM hack, that's not the same game anymore. And that's basically what happened here. The modifications that were made, even
2495.42s - 2505.82s |  though they weren't intended to be malicious, had the impact that, you know, it changed things and it made it so that people didn't have a fair shot at
2505.82s - 2519.22s |  reproducing it. Now we can make a run that does all this crazy phasing. Oh, by the way, that is an alt tab to stop some dialogue from happening. If we'd
2519.22s - 2526.94s |  used a different resolution, it wouldn't have stayed there. A couple other quick notes here. This is not fully optimized as a tool assisted speed run. This was
2526.94s - 2539.22s |  made rather rapidly in the last few days. It could be improved even further from where it's at. We're almost there, almost there to the end. This task is a
2539.22s - 2550.43s |  demonstration of what the game playthrough could be legitimate. We already have as of today, and I'll be updating the document after this talk, the
2550.43s - 2561.55s |  Diablo.tas.bot website. I'll be updating it with links. Just in the last hour and a half, someone managed to get a time less than five minutes with a
2561.55s - 2570.95s |  single segment attempt. Not even segmented, just a single segment attempt. We feel that even a human can manage to beat Rubo's time with legitimate
2570.95s - 2588.32s |  stances. And here's the final boss. And, uh, that's it. That's it. That's, that's the whole run. This task is one second faster than Rubo without
2588.32s - 2599.20s |  cheating. It's a completely legitimate playthrough. Okay. I have talked about a lot of crazy things. We are coming to the end of our time. There is so much more I
2599.20s - 2605.08s |  would love to tell you if I had more time, but I don't. If you would like to know more about tool-assisted speedruns in general, come to
2605.08s - 2614.56s |  TASvideos.org. If you would like to know more about playing tool-assisted speedruns on real consoles, go to TAS.bot. And if you happen to be
2614.56s - 2622.60s |  interested in having me research projects like this, let me know. I could use the work. Um, thank you. Sorry. Thank you. Thank you so much,
2622.60s - 2626.48s |  DEFCON, for having me again, and I look forward to the next opportunity. Thanks all.


url: https://www.youtube.com/watch?v=hwuIb-Vv2Ew
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - The XZ Backdoor Story: The Undercover Op That Set the Internet on Fire -  Thomas Roccia

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=hwuIb-Vv2Ew",
  "title": "DEF CON 32 - The XZ Backdoor Story: The Undercover Op That Set the Internet on Fire -  Thomas Roccia",
  "description": "On Fri, 29 Mar 2024, at exactly 08:51:26, OSS security received a message from Andres Freund, a software engineer at Microsoft, stating he had discovered a backdoor in upstream xz/liblzma that could compromise SSH servers. The open-source project XZ, specifically the liblzma library, has been compromised by a mysterious maintainer named Jia Tan, putting the entire internet at risk. Fortunately, this discovery helped us avoid the worst.\n\nBut what happened? How long has this rogue maintainer been part of the project? Who is Jia Tan? Was he involved in other projects? How does the backdoor work? And what should we learn from this?\n\nThese are questions we will attempt to answer. First, we will discuss the discovery, which is so riddled with coincidences and chance that it's hard not to think about all the ones we've missed. Then, we'll examine the process itself, from gaining trust within the project to deploying the backdoor, dissecting the operating methods and the main protagonists. We will also dive into the technical details, explaining how the backdoor is deployed and how it can be exploited.\n\nThe XZ backdoor is not just an incredible undercover operation but also a gigantic puzzle to solve. Beyond the technical background, there is a story to tell here, to capitalize on what went wrong and what we could improve.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2501,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

2.45s - 7.45s | This text was transcribed using whisper model: large-v2

 Well, thank you for waiting. It was quite intense from the, the stage. Alright. So, thank you
11.35s - 17.69s |  very much for attending this talk. Uh, I hope you will find it uh, enjoyable. It's uh, it's a
17.69s - 22.69s |  cool story to tell and there is a lot to cover so, buckle up. So over the past uh, few years,
29.92s - 34.92s |  the security industry have, you know, investigated a lot of different security incidents.
37.66s - 43.60s |  But only a few of them were truly sophisticated. Meaning, something that was really
43.60s - 52.17s |  different than what we used to be. We can talk about, for example, the SolarWinds case, the
52.17s - 57.17s |  Lopetia attack or even the 3CX uh, supply chain attack last year. But today I want to talk
59.61s - 64.61s |  about um, another attack which surpasses even the most sophisticated we've seen before. This
64.89s - 69.89s |  is uh, an undercover operation that lasted almost three years, which is very impressive in
74.77s - 81.05s |  terms of technical details, but also the social engineering aspect is very impressive as
81.05s - 86.05s |  well. So I'm going to talk about the XE backdoor story, the undercover operation that set
87.99s - 93.09s |  the internet on fire. And I'm pretty sure that by the end of this presentation, your
93.11s - 98.11s |  definition of what is a sophisticated uh, sophisticated attacker is, will be changed. So I'm
101.05s - 106.71s |  Thomas Rocha, I'm a senior threat researcher at Microsoft. I've been working on the XE
106.71s - 113.15s |  campaign when it came out by uh, uh, Andres Freund, which is uh, a colleague of mine and we,
113.15s - 118.19s |  we, we discovered the, the backdoor itself. I'm French, as you probably may have heard, and
118.19s - 122.23s |  I'm living in Australia so I'm, I'm good with the jet lag now because it's been a week in
122.23s - 127.25s |  uh, in Vegas already. Uh, if you want to learn more about my work, you can visit my website
127.25s - 133.96s |  securitybreak.io or you can, you can also follow me on Twitter. What I will cover in this
133.96s - 139.56s |  presentation, first, how the backdoor was found. Then I will talk about the long term
139.56s - 145.50s |  operation and the timeline itself. I will then deep dive into the technical details and we
145.50s - 150.68s |  will discuss about some assumptions. And finally, I want to conclude this presentation of
150.72s - 159.14s |  what it means for us, for the security industry. Okay, this story began on Friday 29th of
159.14s - 164.14s |  March at exactly 851 minutes and it was uh, a message sent by Andres Freund to the OSS
170.22s - 175.22s |  security DL list. With the, the subject, backdoor in upstream exit libel ZMA leading to
176.22s - 181.22s |  SSH server compromise. So that's pretty much around that time when I saw the, the email and
186.36s - 191.56s |  read the investigation that I started to investigate more about the backdoor itself and how it
191.56s - 196.58s |  was working. But before, I want to talk a little bit about Andres and how he found the, the
198.58s - 203.54s |  backdoor. Because on the internet, there was a kind of a legend where everyone was saying
203.54s - 208.54s |  that the backdoor was discovered because of a 500 millisecond and uh, for, from Andres that
211.14s - 218.14s |  triggered the investigation. The reality is a bit different. Actually, what triggered the
218.14s - 224.46s |  investigation from Andres was that he found that the SSH login in some of the tasted, the
224.46s - 231.06s |  testing he was doing was actually failing. So he decided to investigate a little bit more to
231.08s - 237.36s |  try to understand why the SSH was uh, the SSH logins were actually failing. And he
237.36s - 242.36s |  discovered that there was a substantial CPU usage during the SSH and he found out the 500
245.20s - 254.57s |  millisecond delay which he identified, identified later in the new package uh, exit. And he
254.57s - 260.77s |  said that, he said itself, it was a bunch of coincidences. So if we, if we have a look to how
260.79s - 267.53s |  he discovered the backdoor. First, he saw that there was some issue with the SSH uh, login.
267.53s - 274.13s |  Then he decided to investigate and then he found uh, a little bit of uh, amount of CPU uh,
274.13s - 280.35s |  using by the SSH deep process. So he decided to investigate a little more and he, and he
280.35s - 285.35s |  found out that this amount of CPU usage was used by the Libel ZMA. But then that's now which
286.13s - 291.13s |  is becoming a little bit crazy because he actually used some specific setup which led him to
297.01s - 303.61s |  find the backdoor. First, he decided to choose a Debian unstable which at the time of the
303.61s - 308.65s |  release of the, the backdoor uh, only this kind of Linux version was affected by the
308.65s - 314.79s |  backdoor. Then he chose to use a specific flag. And without this flag, this flag, he
314.79s - 319.79s |  wouldn't have found uh, the, the backdoor because he was actually tracing the process using
319.79s - 326.21s |  Valgrind and Valgrind complaining, complained about uh, the, the processes because of the
326.21s - 332.47s |  flag he was setting up before. So that's super crazy because thanks to that, he was able to
332.47s - 337.49s |  investigate and to find out the high CPU usage was in the SSH deep processes below get CPU
337.85s - 344.99s |  ID. Keep that information in mind because it will be interesting and important for the next
344.99s - 357.28s |  part of the presentation. But you may wondering what the fuck is uh, exe, exe-utils
357.28s - 362.28s |  package. So the exe, the exe-utils package is a free software, an open source software which
364.66s - 371.42s |  is dedicated for lossless data compression through SDMA algorithm and exe. It, it is
371.44s - 377.12s |  maintained by Lasikolin which is the main maintainer of the backdoor of the, sorry, of the, of
377.12s - 384.00s |  the package since more than a, than a decade. The backdoor has been found in Libel ZMA in the
384.00s - 389.00s |  version of exe-560 and 561. And it was introduced by a mysterious user called Jiatan in
392.64s - 397.64s |  February 2024. The, the package and the backdoor affected mostly uh, development version so
398.50s - 403.50s |  it was not widely deployed when Andres found the backdoor itself. And Red Hat assigned the
406.04s - 411.04s |  vulnerability CVE 2024-30-94. There is something interesting here because you may
413.98s - 418.98s |  wondering as well why the exe-utils package has in, uh, has in any relation with uh, SSH.
419.98s - 424.98s |  Well I'm glad you ask. Actually the exe-utils uh, backdoor uh, package is widely used in
431.68s - 437.38s |  many Linux uh, distribution and it's a trusted open source component for pro- for
437.38s - 442.40s |  compression uh, and any kind of uh, optimization. The exe-utils has been used in the open
442.76s - 447.76s |  source industry for years and which is interesting is that open SSH is using the exe
451.60s - 456.60s |  compression to reduce the size of transfer data when you are doing a connection. So quite
459.40s - 466.46s |  interesting target for an attacker. Okay I want now to talk about the timeline. And it's a
466.46s - 471.46s |  bit uh, heavy so what I did I actually split the timeline into five different phases. The
472.08s - 477.08s |  first phase, the first phase which I called initial involvement of Gi-Tan from October 29,
481.96s - 486.96s |  2021 to June 29, 2022. So during this phase the user Gi-Tan started to get, started to
489.86s - 495.54s |  gain trust into the exe uh, project and started to do some commit and to work a little bit
495.54s - 500.54s |  more. Which is interesting is um, during that phase as well, there was, there was a
502.18s - 508.92s |  additional persona that was part of a kind of a pressure campaign against Lassie Collin, the
508.92s - 513.92s |  main maintainer of the exe package. To move the member, the um, the maintainership to another
517.20s - 522.20s |  user. So some additional personnel, persona such as Giga Kumar and Dennis Hance have been
524.54s - 531.04s |  part of this pressure campaign to put the pressure on Lassie Collin. And in June 29 of
531.06s - 536.06s |  2022, Lassie Collin started to mention Gi-Tan as a co-maintainer already. Then in phase 2,
539.00s - 544.00s |  which I call transition of mentorship from September 27 of 2022 to March 18 uh, 2023.
547.98s - 552.98s |  During this time Gi-Tan continued to contribute to the project to gain trust with uh, with
554.98s - 559.98s |  the, the main maintainer and to the project itself. On October 2022, Lassie Collin
561.72s - 567.86s |  was added to the Tukeni organization on GitHub, which is the organization uh, that released
567.86s - 572.86s |  the exe package. And an additional event as well during this time. Then during phase 3, which
575.14s - 580.14s |  I call preparation for the attack from March 2023 to January 19, 2024. During this time, a
583.64s - 588.64s |  bunch of information happened as well. First Gi-Tan uh, updates the Google OSS first to send
589.28s - 594.28s |  bugs to his own email. Then another persona, Hans Jensen, sends patches for GNU indirect uh,
598.92s - 603.92s |  function features, which is quite important as well. And uh, and Gi-Tan also disables uh,
606.96s - 612.30s |  iPhone support during the OSS first build, which is quite important because it's a kind of uh,
612.30s - 617.30s |  evading some, some security protections. And then during phase 4, which I call backdoor
618.68s - 623.68s |  insertion and distribution from February 23 uh, to March 28 of 2024, this is where Gi-Tan
627.48s - 633.66s |  started to release the backdoor. So in February 24, Gi-Tan merged hidden backdoor binary
633.66s - 638.66s |  code in kind of test files, which are actually fake text test files. And then he released the
641.66s - 646.64s |  version 5.6.0 with an additional file that was not present in the GitHub repository itself.
649.20s - 654.20s |  And in March 9, uh, Gi-Tan committed uh, an update of the backdoor because there was a bug and
657.48s - 663.18s |  then he released the version 5.6.1, which was backdoored as well. And then on the last phase,
663.18s - 668.18s |  phase uh, phase number 5, which I call discovery and response from March 28 to March 30, this
670.82s - 676.56s |  is where Andres found the backdoor, started to alert and to send the email with his own
676.58s - 684.12s |  investigation. And this is where internet was on fire as well. But there is something which is
684.12s - 688.12s |  interesting, I talk about the pressure campaign. So let me give you a little bit more detail
688.12s - 695.14s |  about that. Cause this is quite interesting from the social engineering aspect. So first I
695.14s - 700.24s |  mentioned that some additional personas were part of this pressure campaign to move the
700.24s - 705.24s |  mentorship of the, of the backdoor to someone else. So in March, uh, in April 2022,
708.68s - 713.68s |  Jigar Kumar sent a message. Patches spend years. In May 2022, Dennis Hance, the, the other
716.22s - 721.62s |  persona, sent another message as well and said, I asked a question here a week ago and I have
721.62s - 727.34s |  not heard back. It has not updated in over a year. Is there a plan for this thing in the future?
727.34s - 732.54s |  Lassie Colleen, which at the time was getting all these messages from these personas and
732.62s - 737.62s |  so on. Jihatan has helped me with exe-utils and he might have a bigger role in the future. It's
741.34s - 748.22s |  clear that my resources are too limited. In May 2022, Jigar Kumar answered. Over a month and
750.42s - 756.26s |  no closer to being merged. Not a surprise. Jigar Kumar sent another message. Progress will not
756.26s - 761.50s |  happen until there is a new maintainer. The current maintainer lost interest or doesn't care
761.52s - 766.52s |  to maintain anymore. Quite aggressive. Then on June 2022, Lassie Colleen answered. My
769.16s - 774.16s |  ability to care has been fairly limited, mostly due to long term mental health, but also due to
774.16s - 779.16s |  some other things. Jihatan may have a bigger role in the future. And he mentioned also, and I
781.54s - 786.88s |  think this is quite important in this case, he mentioned, it's also good to keep in mind that
786.90s - 793.15s |  this is a non-paid OB project. In June 2022, Jigar Kumar sent another message. Right now you
795.35s - 802.35s |  shock your repo. Why wait until 540 to change maintainer? Why delay what your repo needs?
802.35s - 807.73s |  Dennis Ant sends a message. Why not pass on mentorship for exe for C so you can give exe for
807.73s - 814.63s |  Java more attention? And then Jigar Kumar sent another message. Jia, this is the first time he
814.63s - 820.21s |  actually talked to Jia. Jia, I see you have recent commits. Why can't you commit this
820.21s - 825.21s |  yourself? And then Lassie Colleen replied on June 2022, on the day 29. Jihatan may have a
828.61s - 833.61s |  bigger role. He is practically a co-maintainer already. Some change in mentorship is already
836.29s - 841.29s |  in progress. Mission accomplished. Jihatan is no part of the project and he has more rights
844.69s - 849.73s |  to contribute. Alright, so now I want to talk about the technical details and how the back
849.73s - 855.81s |  door was deploying and how the back door works as well. So remember, I mentioned that the
855.81s - 862.15s |  user Jihatan deployed two different test files. The first one was bad3corrupt underscore
862.15s - 867.15s |  lzma2 dot exe and the second one was goodlarge underscore compressed dot lzma. And
867.85s - 872.85s |  additionally, when he released the latest version, version 5.6.0 of the exe package, he
878.93s - 884.79s |  shipped the version with an additional file called build2host dot m4. If you are not
884.79s - 890.53s |  familiar with m4 files, it's a kind of macro file used for configuration during the
890.53s - 898.85s |  compilation process. And this file was present in the release but not in the repository. So
898.87s - 905.79s |  let me talk a little bit more about the build2host dot m4 file. And I will focus here on the
905.79s - 910.79s |  version 5.6.0. So what you see on the screen is just the malicious part of this file just to
913.83s - 918.63s |  focus on what it is exactly doing but imagine that this file is super big with a lot of
918.63s - 923.63s |  different configuration and a lot of legitimate actions. So the ones that you saw, you see on
923.89s - 928.89s |  the screens are only the malicious part. So first, you can see there is a variable called
931.93s - 936.93s |  glam config make with a grep which actually look for one of the malicious test file that have
940.41s - 945.41s |  been released and specifically the bad3corrupt underscore lzma2 dot exe. Then we have in
946.33s - 951.33s |  number two, two additional variable. The first one which is the TR tool translate which is
956.61s - 961.61s |  basically doing a kind of a substitution algorithm for part of the backdoor of the file
964.31s - 969.31s |  itself, the bad3. And the second one is actually showing the test file and making a set to
969.59s - 974.59s |  retrieve the extension of this file exe which will later be used as a common line. And as you
981.53s - 986.53s |  can see, the translation of this piece of screen is the cat at the end of the presentation.
988.53s - 993.53s |  So basically transforming the file itself and decompressing using exe, the file which have
993.97s - 998.97s |  been the obfuscated, the obfuscated kind of using TR. So here you have a look of what was
1008.46s - 1013.46s |  the original bad3corrupt lzma2 file before the decryption, the, the, the, the substitution
1015.56s - 1020.56s |  and the, the decompression using exe and you have the malicious script on your right. So if
1020.92s - 1026.92s |  you have a look to this malicious script, there is some interesting information here. So
1026.92s - 1031.94s |  first I highlighted a comment which is actually an hexadecimal string. So today we still
1035.40s - 1041.38s |  don't know what is exactly this strings but I believe because in version five six one, this
1041.38s - 1046.88s |  hexadecimal string was not the same. So I believe this strings was potentially related to a
1046.90s - 1053.28s |  kind of a versioning number. Then we have a bunch of uh head command which are used to
1053.28s - 1058.68s |  manipulate input data stream. And at the end we have the stash3 and backdoor extraction
1058.68s - 1063.68s |  because in the bad3corrupt um uh in the, in the bad3corrupt lzma and the second file, the
1065.76s - 1071.66s |  good large compressed lzma, there is the next part of the, of the, the release of the
1071.66s - 1076.86s |  backdoor and also the decompression of an object. I will come to it later. I just
1076.86s - 1082.68s |  give me, let, let me give you a look, a deeper look of what the file, what the script is
1082.68s - 1089.06s |  doing to release the next part. So first is decompress the second malicious file, remember
1089.06s - 1095.74s |  the second test file, good large underscore compressed dot lzma that cons, contains the
1095.74s - 1100.74s |  stash3 and the binary backdoor. It remove a ju, a bunch of junk data and unius byte
1101.12s - 1108.06s |  because the file is a bit obfuscated. There is again a custom substitution cipher using
1108.06s - 1113.06s |  tr and then all the, the deciphering data uh decompressed again using exe. Which lead to
1116.64s - 1121.64s |  the stash3 which is another script which is doing a bunch of checking during the compilation
1122.64s - 1127.64s |  process. So let me walk through some of the checking this stash3 is doing. First, it's
1131.02s - 1135.72s |  checked for the iPhone support, remember previous commit we discussed about it, keep that in
1135.72s - 1140.72s |  mind for the, for the next part. Then you verify crc source file, crc64 underscore fastc
1143.00s - 1149.24s |  and crc32 underscore fastc for require iPhone code because the backdoor require this
1149.24s - 1155.68s |  feature. There is a bunch of multiple checks, it verify the version of the Linux system, uh
1155.68s - 1160.28s |  validate the gcc comp, compiler, check for the previous two test file because if the two
1160.28s - 1165.06s |  test file are not present there is no need to continue to deploy the backdoor, so it's a kind
1165.06s - 1170.06s |  of protection. It ensures position independent code and also it extract the backdoor from
1170.86s - 1175.86s |  the, the test file goodlarge compressed dot lzma and this backdoor ex uh extracted from this
1182.01s - 1187.01s |  file will be embedded into the, the object file liblzma la dash crc64 dash fast dot o. Then
1192.79s - 1197.79s |  there is a modification of a function isarch extension supported in crc xx86clmul dot h
1198.75s - 1203.75s |  and it replaces getcpuid with two underscore with getcpuid with one underscore. Remember
1212.52s - 1217.52s |  getcpuid was where address trust the execution of the backdoor and the amount of CPU usage.
1228.54s - 1231.78s |  So I want to talk little bit about the backdoor extraction itself because it's quite
1231.80s - 1236.80s |  interesting how the attacker did it as well. So in the code there is a, a piece which is using
1239.14s - 1244.14s |  the AWK function um tools from Linux and this is actually doing like a kind of a RC4 like
1247.72s - 1252.72s |  algorithm to decrypt the payload itself that will be later store into the liblzma la crc64.
1253.44s - 1258.44s |  So quite interesting to see that as well. So to recapitulate a little bit the compilation
1266.41s - 1272.05s |  process because I know it could be quite uh quite complex. So first we have the execution of
1272.05s - 1278.29s |  the macro file the build to host dot m4 which is executed and subsequent scripts are also
1278.29s - 1283.29s |  executed. It run all the checks and it create the make file if previous conditions are met
1285.59s - 1289.83s |  because there was a bunch of information. If all the conditions are not met then the
1289.83s - 1295.57s |  backdoor is not released. Then during the make process there is a backup of the original
1295.57s - 1300.57s |  file which has been backdoor and liblzma la crc64 fast dot o. There is a backup because
1303.15s - 1309.09s |  if something, something goes wrong the backdoor itself I mean the the code itself can push
1309.09s - 1314.09s |  back the original file and so there is no track into the final release of the exe utility.
1315.09s - 1321.59s |  Package. There is also some specific compilation flag. I think I think resolvers run at
1321.59s - 1326.59s |  startup. Modification of the file crc64 fast dot c and crc32 fast dot c and then finally
1330.51s - 1337.15s |  compilation linking stage manipulation and clean up because the attacker did well they also
1337.15s - 1342.41s |  have a bunch of clean cleaning up to avoid any forensic investigation or further further
1342.41s - 1347.43s |  investigation. And then at this point we are here malicious liblzma is incorporated into the
1350.63s - 1358.15s |  compiled liblzma. So now I want to talk a little bit more about the backdoor itself and some of
1358.15s - 1364.13s |  the functionalities. So first it's using the iFunc feature which allows for dynamic
1364.13s - 1369.23s |  resolution of function implementation during the run time meaning it can load some specific
1369.23s - 1374.51s |  features at the run time. And actually the backdoor hijacks the iFunc resolver to load the
1374.51s - 1380.85s |  modification of the global offset table which which is a kind of a table with address to some
1380.85s - 1387.05s |  specific functions. And here on the screen what you can see is actually the malicious get CPU
1387.05s - 1395.72s |  ID that will trigger the backdoor and continue the execution to the global offset table hijack.
1395.72s - 1402.26s |  Another interesting feature about the backdoor is the usage of dlaudit to set up the hook and to
1402.26s - 1407.64s |  bypass railroad and to intercept also redirect function so function call. If you are not
1407.64s - 1412.64s |  familiar with railroad it's a kind of a memory protection space to avoid uh to avoid to have
1412.64s - 1417.98s |  some some space that could be vulnerable for some vulnerability exploitation. So what it is
1417.98s - 1422.98s |  doing here, so first it's checking that the loaded target process is SSHD because remember it
1423.26s - 1428.26s |  is our target here. And verify that the shell library and specifically libel ZMA because
1432.12s - 1438.66s |  this is the vulna the the this is where the backdoor is loaded is already present. Then it set up
1438.66s - 1443.66s |  the dlaudit structure to start the audit mechanism. And during the dynamic linking so think
1445.80s - 1450.80s |  about all these steps uh doing doing the the loading. It resolve and bind symbols and then
1453.98s - 1460.72s |  the dlaudit bind function is called by the linker whenever a symbol needs binding. And if all
1460.72s - 1465.72s |  the conditions are met then it set the backdoor to the install hook function to install the the
1467.96s - 1476.32s |  hooking function that the payload will need later. There is also the global offset table uh
1476.32s - 1481.32s |  redirect which I mentioned is a kind of a table with uh function address. And in that case at
1482.28s - 1487.28s |  the runtime the backdoor will manipulate these pointers into the global offset table to
1490.62s - 1499.49s |  redirect calls to the main malware function. And if you have a look to the investigation, if
1499.49s - 1506.63s |  you have a look to the to the running at this time, everything will look like it's been
1506.63s - 1515.25s |  called through the CPU ID functions. On top of that there is additional evasion
1515.27s - 1522.27s |  mechanisms and kind of obfuscation. First there is a strings obfuscation. In that case what
1522.27s - 1529.35s |  the backdoor is doing is looking for a tree structure. A tree structure is basically uh a
1529.35s - 1534.99s |  corresponding reference between a strings and a number. And what the backdoor is doing is
1534.99s - 1540.23s |  looking for a specific number to retrieve the strings it needs for the execution of the
1540.25s - 1547.70s |  payload. So if you it's kind of uh if you are familiar it's kind of API API hashing where you
1547.70s - 1552.70s |  are retrieving the function call uh based on a specific hash. And in that case the sample the
1555.74s - 1560.74s |  payload is is looking for some specific string and for example 0x1d0 is for RSA public
1563.62s - 1568.62s |  decrypt which is one of the hooked function. Or for example for 0x300 for the ELF header
1568.74s - 1573.74s |  which is used for the deployment mechanism as well. And you have some of the strings that was
1577.58s - 1585.62s |  extracted by the backdoor and needed for the rest of the execution. So as I said there is
1585.62s - 1590.62s |  function hook that have been added by the by the by the payload itself. So first what it is,
1593.62s - 1598.50s |  what it what it is doing, it's actually retrieving obfuscated string from the tree
1598.54s - 1605.12s |  structure. And one of the string which is important here are the RSA public decrypt function
1605.12s - 1610.62s |  which is a hook and the RSA gate zero key function which is also a hook. These two
1610.62s - 1615.62s |  function are used in the latest SSH server version and are called when an RSA certificate is
1617.86s - 1623.10s |  configured is using for the authentication. Remember that because this is important. And the
1623.10s - 1629.54s |  last function which have been hook is the EVP PK set one RSA which it's a little bit well
1629.54s - 1634.64s |  because it's not used in the latest SSH version but probably that it has been set up for
1634.64s - 1642.90s |  compatibility or probably for a specific environment. There is a bunch of other checks and
1642.90s - 1649.12s |  evasion used by the sample uh by the payload. Here there is an overview so first as we saw
1649.12s - 1654.46s |  it is checks that the current process is well SSHG because there is no need to deploy the
1654.46s - 1659.46s |  backdoor if we if we are not running uh if SSHG is not running. It check for a potential kill
1661.40s - 1667.50s |  switch. So this one is not very clear. This is a string that was present into the malware
1667.50s - 1672.10s |  itself, the payload. But it's not very clear what's the goal, what was the goal of this
1672.10s - 1676.08s |  string. Some researcher are thinking that it could be like a kind of a kill switch if the
1676.08s - 1681.08s |  backdoor see the this uh strings into the the environment the the memory then it will not run.
1681.68s - 1686.68s |  Potentially a kill switch. It also abuses the legit LZMA alloc function for memory
1689.18s - 1695.62s |  allocation which is required by the payload at some point. And there is also it is the
1695.62s - 1700.62s |  backdoor is also hooking the logging function. Meaning for every authentication through the
1703.96s - 1711.38s |  backdoor nothing will be logged into the into the log of the machine. So that means it's also
1711.40s - 1716.14s |  more difficult for forensic investigation and incident response. And there is a bunch of
1716.14s - 1722.14s |  other advanced functionality such as encryption, anti-replay, it also embeds its own tiny
1722.14s - 1729.09s |  embedded disassembler which is required at some point as well. But how the how does the
1729.09s - 1734.87s |  backdoor works really? So remember I said there is uh three main function that have been
1734.87s - 1740.67s |  hooked and which is interesting as well is that the backdoor embeds three main function to be
1740.69s - 1746.67s |  triggered. To trigger this function there is kind of a magic number actually three magic
1746.67s - 1751.37s |  number and there is an operation which is used by the backdoor itself which is magic one
1751.37s - 1757.67s |  multiply by magic two plus magic draw which which will give us the command number that will
1757.67s - 1763.51s |  be triggered by the payload itself and the backdoor. So the first one command zero and
1763.51s - 1768.51s |  command one is actually an SSH authentication bypass using root login. Second one is a
1771.35s - 1776.35s |  remote code execution via systemd, cmd2 and the third one is uh cleaning uh close the
1778.73s - 1783.97s |  pre-authent authentication that have been previously opened. And if you pay attention to the
1783.97s - 1788.97s |  to the diagram below to trigger this specific uh command the attacker have to embed the
1792.45s - 1797.45s |  payload into an RSA certificate that will be read by the by the backdoor server during the
1800.91s - 1806.29s |  authentication and then there is bunch of decryption. Of course to exploit this specific
1806.29s - 1811.29s |  backdoor there is a not coded certificate used so that means only the attacker itself can log
1816.03s - 1824.47s |  in to the compromise server because he already have the private key. So to give you a little
1824.47s - 1829.47s |  more details of how was the certificate payload. So you have here a kind of an overview of
1833.25s - 1840.25s |  what is inside the certificate itself. So first this certificate is used to the connection to
1840.25s - 1845.25s |  the SSH uh to the SSH uh process to the backdoor server. Then there is an exchange of the
1847.83s - 1854.83s |  public key and this public key there is also a sharp 256 which is calculated as well. So let
1854.83s - 1860.13s |  me give you an overview of the certificate itself. First if you have a look it's a normal RSA
1860.17s - 1867.07s |  certificate but there is some interesting information. In the IV, I call that the IV because
1867.07s - 1873.75s |  it's used later. The this IV is actually the magic numbers. Remember the magic numbers are
1873.75s - 1880.39s |  used to calculate the common number that will be interpreted by the the server and the the
1880.39s - 1887.53s |  backdoor itself. And then in the modulus N uh payload in the in the modulus N part of the RSA
1887.57s - 1892.57s |  certificate there is the payload which is encrypted in Shasha 2020 uh Shasha 20 sorry. And
1895.91s - 1900.91s |  this payload is decrypted using the outcoded ED448 public key that have been exchanged
1904.99s - 1909.99s |  during the initiation of the connection. But only with the first 32 byte. And it's also
1909.99s - 1914.99s |  using the IV which are the magic numbers used outcoded into the the malicious RSA key. And
1917.89s - 1924.27s |  to decrypt the payload. Then in the decryption of the payload we have two main parts. The
1924.27s - 1930.51s |  first which is the signatures which have been verified by the payload to be sure this is
1930.51s - 1936.65s |  well this is well the attacker that has been trying to connect. And we have the payload itself
1936.65s - 1943.65s |  which have been executed. And the signature is generated with the CMD value which have
1943.67s - 1950.55s |  been calculated. A five byte flag which we don't know at this time what is it exactly. The
1950.55s - 1955.55s |  payload itself and the Shasha 256 that have been calculated from the ED448 signature. So a
1958.19s - 1964.33s |  bunch of mechanisms to avoid also uh the replay of the certificate and to investigate a
1964.33s - 1971.15s |  little bit more. And at this point JITAN is in. So there is a small um let me show you. I did a
1971.15s - 1979.90s |  small uh demonstration using I did a small demonstration using uh a payload using uh
1991.69s - 1996.69s |  someone someone reused um uh recoded actually the the backdoor. So I reused this code. So on
1999.83s - 2004.77s |  on the right you have the target which is the attacker. So what I did here I recompiled the
2004.77s - 2010.41s |  backdoor itself with my own certificate so I can reuse the code and authenticate like if I
2010.87s - 2017.11s |  was the attacker. So you have the target on your right. On the on the bottom you have the logs
2017.11s - 2022.11s |  because some researcher found that if you activate the verbose mechanism in the in the logs
2024.69s - 2030.69s |  and the configuration of SSH there is a logging feature uh that appear and then there is some
2030.69s - 2035.69s |  track some trace into the into the logs. So what I'm using here I'm actually running the
2036.05s - 2041.05s |  backdoor against my server which have been compromised and here you can see there is what I
2044.09s - 2049.33s |  did here is extracting some of the components that have been used to generate the RSA
2049.33s - 2054.93s |  certificate used to authenticate to the compromised server. And as you can see here you can
2054.93s - 2061.07s |  see the OSCE, the SHA256, the different magic number, the magic command in that case it's
2061.09s - 2067.27s |  number two so I'm using the RCE remote code execution and then we have the certificate that
2067.27s - 2073.27s |  have been sent to the compromised server. And if you look to the target here I've been
2073.27s - 2078.27s |  written a file called it's me and that have been executed by uh the certificate itself. And
2080.31s - 2085.81s |  this payload was actually part of the RSA uh key that are sent to the mal- to the
2085.83s - 2090.83s |  compromised server. The second one is a um is a remote code execution as well just to uh have a
2093.87s - 2099.01s |  river shell and to be able to uh authenticate and to do some action onto the mali- onto the
2099.01s - 2146.02s |  compromised server. Okay. Sorry about that. Okay so you may wondering who is behind uh this
2148.66s - 2154.90s |  attack. So as I as I discussed at the beginning there was multiple personas involved into
2154.92s - 2159.92s |  the uh into the deployment of the backdoor for the pressure campaign against LaCie calling. So
2162.42s - 2167.42s |  remember I talk about Jigar Kumar, Dennis Ants and Ants Jensen and G. Atan as well. So what I
2169.50s - 2175.74s |  did here I wanted to know if because we already had this their their email address also their
2175.74s - 2182.38s |  username and I wanted to understand if there is some connection or if the specific email
2182.42s - 2187.42s |  addresses were known before or not. So what I actually did I look for some uh connection using
2191.60s - 2197.64s |  this email address especially for the G. Atan user and I found out that there was only a few
2197.64s - 2204.14s |  server only a few website that was using this email address. What I found out as well is that
2204.14s - 2211.02s |  for Jigar Kumar with the proton mail address I was able to recover the date of creation of
2211.02s - 2217.66s |  this email address which was on twenty twenty-two April, April twenty-seven and which is
2217.66s - 2224.14s |  interesting because this email address have been created just a day before Jigar Kumar sent
2224.14s - 2229.14s |  the first email to the to the XE uh utils uh DL list and and project. So Jigar Kumar, Ants
2232.88s - 2237.82s |  Jensen and Dennis Ants was part of the first pressure campaign and the second one,
2237.82s - 2243.30s |  Misoator and Krigorin was part of the second pressure campaign which occurred between the
2243.30s - 2249.04s |  release of the version five six oh and the release of the version five five six one. And which
2249.04s - 2254.04s |  is interesting is that if you have a look to the structure of this email addresses they all have
2256.68s - 2262.48s |  the same structures. They have a username, they have a number and they all use used a free
2262.48s - 2267.48s |  email service. And also what I wanted to discover is does this email address are using I've been
2270.32s - 2276.86s |  for example known in public data leak database. And I checked for all of them and all of them
2276.86s - 2283.10s |  were not present in any of the public leak leak database. And Brian Krebs at the time of uh the
2283.10s - 2288.10s |  investigation and when everyone was crazy about it uh said it's super rare to have one email
2288.76s - 2293.76s |  address which is not present in data leak databases. But it's even more rare to have multiple
2298.54s - 2303.68s |  email address which are not present in any of the data leaks. Which could give us some
2303.68s - 2308.68s |  information about you know a really well crafted uh operation. So what can we do about it?
2313.05s - 2318.19s |  Well it's not an easy question and I don't think I have the the answer today. But here is some
2318.21s - 2324.09s |  elements maybe to you know just to think about it. Maybe something that could be done
2324.09s - 2328.53s |  specially on project like this one that have been widely used everywhere will be to have like a
2328.53s - 2334.37s |  strict contributor verification. Also to ensure that the builds are reproducible meaning to
2334.37s - 2340.47s |  have like the equivalent of the GitHub repository and the release of the tarball. Then
2340.47s - 2345.25s |  hooded hooks and railroad protection but as we saw in that case the backdoor were actually
2345.27s - 2351.91s |  using uh bypassing for of the railroad. And also improving dependency management could be a
2351.91s - 2359.76s |  good way to improve issue like this one. There is also something which is important to keep in
2359.76s - 2365.40s |  mind which is what does it mean for the security community and beyond. So first I think it's
2365.40s - 2371.68s |  important to keep in mind that the entire industry relies on open source tools and as we saw
2371.70s - 2376.70s |  for the XE util package some people are relying of a base project such as the XE uh util package.
2381.44s - 2387.28s |  I think also the discovery of the backdoor itself was a mix of luck, coincidence and
2387.28s - 2393.02s |  expertise because without the investigation of Andres then we won't be able to we probably
2393.02s - 2397.86s |  wouldn't wouldn't have been able to find the backdoor itself. So I think it's kind of
2397.90s - 2404.28s |  important to think about it. I believe also if you are if you have a look to the
2404.28s - 2410.68s |  sophistication, the mechanisms and the deep understanding of Linux operating systems I
2410.68s - 2416.72s |  believe it's also redefine what we call sophisticated attacker. And of course as I said
2416.72s - 2421.56s |  there is no easy solution probably the knowledge of what I'm trying to do today meaning
2421.56s - 2427.84s |  explaining you how the backdoor is working and what the attacker did is also maybe part of
2427.84s - 2433.02s |  the solution because knowledge potentially is the key so you are you are well prepared for
2433.02s - 2440.14s |  the next one. Of course in 45 minutes it's super difficult to give you the whole details.
2440.14s - 2445.98s |  There is a bunch of technical uh details uh into the the backdoor itself. There is a lot of
2445.98s - 2451.18s |  information to cover. So I want to acknowledge uh all the researcher that have been working
2451.18s - 2454.96s |  on it because they did a fantastic job and I really recommend you to have a look to the
2454.96s - 2461.60s |  different blogs at the end if you want to learn more about it. And because because of uh I
2461.60s - 2466.64s |  mean thanks to all the writer we know a little bit more today how the backdoor works but
2466.64s - 2471.52s |  there is potentially more to discover and potentially stuff that we will never discover. And
2471.52s - 2477.52s |  before to conclude on the presentation I just want you to to ask you a question to think
2477.52s - 2484.00s |  about for potentially the the rest of the day, the rest of the week or potentially the the rest
2484.00s - 2492.74s |  of your career. How many other JATAN do you think are paid are are paid to insert
2492.74s - 2496.38s |  backdoors in open source project? And thank you very much for listening me today.


url: https://www.youtube.com/watch?v=jEexnbk9kaI
title: DEF CON 32 - The Pwnie Awards
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=jEexnbk9kaI",
  "title": "DEF CON 32 - The Pwnie Awards",
  "description": "The Pwnies are an annual awards ceremony celebrating and making fun of the achievements and failures of security researchers and the wider security community. Every year, members of the infosec community nominate the best research and exploits they\u2019ve seen. The Pwnie Award nominations are judged by a panel of respected security researchers and former pwnie award recipients \u2013 the closest to a jury of peers a hacker is likely to ever get. At this event DEF CON attendees will get a first person look at some of the most groundbreaking research and hacks in the cyber security community of the past year, and the winners get some well deserved recognition from the broader community for the great work they\u2019ve done.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2981,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

1.71s - 12.51s | This text was transcribed using whisper model: large-v2

 Hello. Welcome to the 2024 Pony Awards. I'm so happy to see all of you. And I'm so happy
12.51s - 21.83s |  none of you had to spend $5,000 to get in this time. So, oh yeah, sorry we have an intro
21.83s - 41.38s |  reel I forgot. Good morning everyone. Welcome to the 2024 Pony Awards ceremony. Today we
41.38s - 48.30s |  celebrate this year's outstanding achievements in security. And some, well, not so outstanding
48.30s - 54.74s |  ones, all for the first time ever at DEF CON. We hope you enjoy the show. Without further
54.74s - 70.74s |  ado, please welcome your host, Ian Roos. You can tell we didn't do a dry run. It'll be
70.74s - 76.58s |  good though. Uh, yeah. So, thank you so much for coming. I'm so happy to see you all here.
76.58s - 80.74s |  Uh, we do like maybe a rough show of hands. How many of you are already familiar with
80.74s - 84.66s |  the Pony Awards? Alright, I should do that backwards. How many of you have never seen
84.66s - 91.82s |  the Pony Awards? It's like the same people. Um, okay. So, the Pony Awards are a annual
91.82s - 98.34s |  award show for security research where we try to celebrate both the successes and failures
98.34s - 107.22s |  of the security community. Uh, the, the general kind of gist of it is, you know, we have some
107.22s - 112.38s |  very good awards. We have some maybe not so good awards, but people tend to kind of
112.38s - 120.62s |  appreciate it, roll with it, have fun. Um, the, as a heads up, uh, as we give out the
120.62s - 127.06s |  awards today, um, there will very hopefully be people in the crowd who are available to
127.06s - 134.10s |  accept the award. If that happens, please come up on stage. We'll give you a horse and
134.10s - 139.22s |  then you can take a couple of minutes in order to, uh, talk about, uh, the research that
139.22s - 144.54s |  you did. Now, something we've run into in the past is not everybody can make it out
144.54s - 150.14s |  despite our best efforts. Uh, we are a purely volunteer effort and, uh, do not make any
150.14s - 155.78s |  money so we're not flying people out for this yet, but we'd love to get there one day. Um,
155.78s - 162.22s |  in the event that, uh, the winner is not available, I would love for someone who is maybe
162.22s - 166.78s |  familiar with the body of research or the work that they did to come up on stage and
166.78s - 172.22s |  give, you know, a couple minutes, kind of explain what it is, why it's important. Uh, if
172.22s - 177.46s |  you feel like maybe you deserve the pony instead, I'm not gonna tell you what to do, but,
177.46s - 184.74s |  um, you can fight over it. Uh, and then, um, yeah, that's sort of the plan. Does that sound
184.82s - 198.92s |  good? All right, right on. So, for our first award, I would, uh, like to invite, uh, the
198.92s - 210.68s |  ransomware actor, Elf, on stage.
210.68s - 219.48s |  Hello. I am Elf, also known as Black Hat Ransomware Group. I'm your typical, uh,
219.48s - 229.34s |  ransomware as a service animal. Hey. I know there's been lots of speculation as to how
229.34s - 234.38s |  they've let me stateside, but do you think you would get far if you had a six-foot-tall
234.38s - 241.46s |  Russian handler? Speaking of the cat getting out of the bag, I ran into the president of
241.46s - 247.74s |  CrowdStrike backstage. Hey, listen, Mike is a great guy. Huge fan of his work, really.
247.74s - 251.78s |  They're true artists over there at CrowdStrike. Truly humbling to see a big tech company
251.78s - 257.50s |  putting art and memes first. Let's just say, if I got my paws on 8 million devices and
257.54s - 262.62s |  execution in kernel, I would make enough ransomware money to maybe afford a CrowdStrike
262.62s - 269.30s |  subscription. I'm here to present the award for best cryptographic bug. Folks, as a
269.30s - 273.94s |  ransomware operator, encryption is near and dear to my heart, and we got some great
273.94s - 279.02s |  research here. Neural network-aided cryptanalysis, Apple processor, side channel
279.02s - 285.14s |  attacks, and, hey, UPnP. For those who have ever looked at UPnP's security stack, we
285.14s - 293.78s |  have an old saying. I pee, you pee, we all pee on UPnP. Well, folks, I got to snort some
293.78s - 300.22s |  catnip and I got to snort some catnip with some cyber insurance dollars, so let's hear it
300.22s - 306.18s |  for these nominees. What?
308.42s - 315.22s |  First up, presenting the nominees for best crypto bug. Breach extraction attacks by
315.22s - 320.62s |  Corneropolis, leveraging leakage from cryptographic protocols and compromised credential
320.62s - 325.98s |  checking services, specifically Cloudflare's implementation to reconstruct encrypted
325.98s - 333.46s |  passwords on servers using cryptographic insights and neural networks. GoFetch, breaking
333.46s - 339.70s |  constant-time cryptographic implementations using data-memory dependent prefetchers by
339.70s - 345.70s |  Boruchan, a micro-architectural side channel attack that exploits data-memory dependent
345.70s - 351.26s |  prefetchers on Apple processors to extract secret keys from constant-time cryptographic
351.26s - 359.62s |  implementations. Blast Radius, RADIUS UDP, considered harmful by Nadia. This significant
359.62s - 365.38s |  attack targets a major protocol using a powerful, underused vector that exploits the legacy
365.38s - 381.46s |  use of MD5, which lacks chosen prefix collision resistance. And the pony goes to, it's hard
381.46s - 392.46s |  with pause, Boruchan for GoFetch, breaking constant-time cryptographic implementations using
392.46s - 408.25s |  data-memory dependent prefetchers. Congratulations. Boruchan, are you here? All right.
417.25s - 425.65s |  It's on now. Okay. So first dry run. You ready? Is anyone here familiar with this work? Come on.
425.65s - 431.41s |  No crypto. No crypto people in the crowd. I understand. It's really difficult. It's all weird
431.41s - 438.53s |  math and shit. You sure? All right. Well, I encourage you. Hi. Maybe they need to study math
438.53s - 445.65s |  at Deep State University. I would encourage all of you to look up this research. We'll be
445.65s - 451.57s |  publishing links to the papers that they're writing, blog posts, all of that, online, probably
451.57s - 457.09s |  in a couple days when I've actually slept. And, yeah. With that, I think we'll move on to the
457.09s - 471.99s |  next presenter. All righty. For the presenter for best desktop bug, I'd like to invite Mark
472.15s - 487.64s |  Trumpor on stage. Good evening. Well, it's evening somewhere. And it's Vegas, so there's no clocks.
489.16s - 492.92s |  So, yeah. Evening. Maybe next year we can do this later in the day.
494.84s - 499.24s |  Your dinner jacket is excellent. Thank you. Thank you. I can't believe you can see it.
501.96s - 507.08s |  I'm Mark Trumpor. I'm the executive director of SummerCon, America's oldest hacker conference,
507.08s - 517.54s |  which has been running continuously since 1987. It is our honor to host the Pony Award
517.54s - 526.04s |  nominations, and it is my pleasure to introduce the contenders for best desktop bug. In a world
526.04s - 531.96s |  where general purpose computing happens everywhere, from the cloud to the door of your refrigerator,
531.96s - 539.88s |  desktop bug might sound a bit anachronistic. But as recent events have shown, from airline
539.88s - 547.16s |  check-in kiosks to the blue sphere of death, okay, maybe the sphere pictures were a hoax,
547.16s - 554.60s |  but they were still funny. Um, desktop systems are everywhere, proving that this category is as
554.60s - 563.32s |  relevant as ever. Let's take a look at this year's nominees. Here are the nominees for best desktop
563.32s - 571.05s |  bug. Ben Barnea's three episode research on Windows Paths by Nachos Kernel. Highlighting
571.05s - 576.89s |  the complexity of parsing Windows Paths, leading to severe consequences like zero-click vulnerabilities
576.89s - 584.49s |  in Outlook or Windows Explorer. A Chrome zero day caused by improperly triggered audio rendering
584.49s - 592.09s |  by 708v1. A long-standing bug in Chrome allows forced real-time audio rendering without user
592.09s - 600.09s |  interaction, exploited in last year's Tianfu Cup. Byte code breakdown. Unraveling Factorio's Lua
600.09s - 605.77s |  security flaws by Daniels B. Exploiting a vulnerability in the Lua implementation of
605.77s - 613.29s |  Factorio. Enabling a malicious server to execute arbitrary code on clients, affecting every player.
613.29s - 628.87s |  And the pony for best desktop bug goes to 708v1 for a Chrome O day caused by improperly triggered
629.11s - 638.23s |  audio rendering. Congratulations. All right. I'm going to start just pulling people up at some
638.23s - 647.19s |  point. Is anyone familiar with this body of work? Okay. I have used Chrome. Here's what we're going
647.19s - 654.79s |  to do. Has anyone done any interesting desktop exploitation Chrome bug research recently?
654.87s - 660.07s |  Anyone maybe pitch your work very briefly? I know you're out there. It's fine. You can come
660.07s - 667.27s |  up. I'll call someone out. Just pick somebody at random. Make them describe some. They're all
667.27s - 673.67s |  very nervous. I know. We were actually thinking about dropping this category at a certain point
673.67s - 680.79s |  because no one uses desktops anymore. It's all in the cloud. It's all desktops. It's smart. It's
680.79s - 690.07s |  very clearly laptops. All right. Well, with that, let's move on to our next category. I know some
690.07s - 700.38s |  of you are here, by the way. Okay. For our next category, we have the best mobile bug research of
700.38s - 718.92s |  the year presented by Kai. So, hello. I am very excited to be here primarily because I have
718.92s - 724.04s |  another reason to wear this really expensive jacket that I have only had one opportunity to
724.04s - 729.64s |  wear before. Uh, I thought the tombstone logs in the back of it would be a little too niche, so
729.64s - 734.88s |  bear with me on this. Uh, the state of mobile security has been, I think, steadily improving,
734.88s - 739.08s |  and that's kind of commensurate by some of the best researchers fucking off to go audit Ethereum
739.08s - 746.60s |  smart contracts or something. Um, but I am really happy to be here and I want to give you guys a
746.60s - 752.44s |  little bit of advice. Uh, for any aspiring mobile security researchers out there, pay attention in
752.44s - 758.16s |  your complexity theory class. Building Turing machines is no longer just an academic exercise.
758.16s - 764.92s |  I also want to say, pay attention- I also want to say, pay attention in your undocumented
764.92s - 771.50s |  hardware feature class. You'll never know when you'll need a PPL bypass. Uh, and with that, uh,
771.50s - 776.90s |  my only real move in these situations is, I have students and generally I have power over them and
776.90s - 781.78s |  threaten to fail them if they don't laugh, so I will fail you if you don't laugh. And the nominees
781.78s - 786.78s |  are- right a button? Here are the nominees for best mobile bug. Operation Triangulation by, who
792.46s - 798.72s |  knows, one of the most sophisticated attacks targeting iPhones, notable for being the first to
798.72s - 806.92s |  exploit a hardware feature in iPhones. Gaining kernel code execution on an MTE-enabled Pixel 8 by
806.92s - 813.50s |  Manwei Mo, exploiting a vulnerability in the ARM Mealy GPU to achieve arbitrary kernel code
813.50s - 821.00s |  execution and gain root access on an Android phone, even with MTE mitigation enabled. That
821.06s - 829.06s |  Samsung Galaxy A bug chain by MaxRB. Triggered via USB, allowing code execution in the boot
829.06s - 835.20s |  loader, control over Android, and leakage of secrets stored in trust zone, affecting many
835.20s - 847.80s |  devices in the Galaxy A family. And the winner is- Operation Triangulation. Operation
851.42s - 858.06s |  Triangulation, are you out there? I- Anyone want to take credit for this? I would be so happy. Oh
858.08s - 864.12s |  my gosh, they're here. Operation Triangulation is in the room. Please. Yeah? Please come up on
864.12s - 869.50s |  stage. Hi. Would you like to say a few words? I'm just- I'm just here to- I'm not going to take
869.50s - 874.26s |  credit. Um, I think it's pretty cool, this category, because it's mobile, and mobile still has
874.26s - 878.50s |  lots of hardware crap put together in it, and this is kind of a great example of it, because
878.50s - 884.68s |  you've got a core that someone makes and has debug features, and they forget to turn them off.
884.68s - 888.10s |  It's awesome. It happens all the time. If you're not into hardware, check it out, because
888.10s - 894.24s |  there's a lot of wide open doors all over everything in hardware. And if we agree that this
894.24s - 898.52s |  pony has zero value, there is a possibility I could at least get it back to the folks who
898.52s - 902.98s |  discovered and reported it. Because, you know, no sanction violations if I bring something of
902.98s - 906.82s |  zero value. I mean, there's no money attached to this, so I don't know. Winona, is this
906.82s - 912.82s |  illegal? Sorry. This is a pony? It is a pony. It's a gummy bear. You can eat it. Is it clean? I
921.72s - 927.36s |  wouldn't ask. Okay. Well, yeah. Hack on hardware. Hardware is awesome. I'll do my best to see
927.36s - 934.26s |  if I can get this to someone who knows. Either side. I don't give a shit. Either end of it. Up
934.28s - 938.52s |  to you, man. Well, no, not triangulation folks. The Kaspersky votes who found it. But, you
938.52s - 941.16s |  know, they didn't really want the first ones to find it. They were just the ones who saw someone
941.16s - 945.12s |  else who found it. I think they're in another category coming up, too. Oh, they are? I'm pretty
945.12s - 954.93s |  happy. I'll stay close to the front. You should give it to them. Thank you. All right. Now
966.02s - 978.46s |  introducing our presenter for the best song category, Claudia. Thank you, everyone. I get very
978.48s - 984.58s |  excited about this. And also, isn't Ian doing a great job? He is crushing it. It's not easy when
984.58s - 988.86s |  you don't really know who's going to be in the audience and, uh, you know, there's a lot of
988.86s - 994.86s |  mystery on both sides here. So you might be asking yourself, best song in the ponies award? Why?
999.20s - 1006.40s |  The answer is vibes. I think all of us can agree that working in security, you need to generate
1006.44s - 1013.36s |  the right vibes to get to the right goal. You know, when we're running CTFs, you need to have
1013.36s - 1020.36s |  some epic gamer music. Shout out to EDM for powering us through many a late night coding
1021.00s - 1034.28s |  sesh. So today it is my honor to talk about who might in the last year have generated those rare
1034.64s - 1040.64s |  vibes that we needed in moments of difficulty. So without further ado, the nominees for best song
1045.44s - 1051.44s |  are the nominees for best song 2024 touch some grass by UWU underground. Kids out here believing
1054.92s - 1060.92s |  what they're told. The X on the ground, code snail loads by Lava Dose. It's falling back. It's
1064.52s - 1070.52s |  right through them. That works too. And the pony for best song goes to UWU for touch some grass.
1093.08s - 1100.08s |  Let's go. A good reminder for us all. Do we have someone? Yes. I think we have someone to
1100.08s - 1107.33s |  accept the award. I mean, who wouldn't want to take credit for this, you know? Nice. Awesome.
1109.33s - 1114.83s |  Hi, my name is Int 80. I'm the rapper in a group called dual core and also in a group called the
1114.83s - 1120.83s |  troubleshooters and also in a group called no friends and I am not magical malware girls. However,
1123.37s - 1129.37s |  we do have a collaboration in the mix and I have been nominated by UWU underground to accept this
1129.37s - 1135.37s |  award on their behalf. I will say I get asked a lot as a rapper, what do you think about AI
1138.13s - 1144.03s |  generated music? And as a rapper, I do not consider myself a real musician because rapping does not
1144.03s - 1150.03s |  require talent. And I actually genuinely love the music that UWU underground makes and so that is
1151.25s - 1156.07s |  why I reached out to them to collaborate. So I'm very excited that they have won this award.
1156.11s - 1162.11s |  Jonathan Scott can eat my butt from the front. Man wipes his phone and calls it a POC. Hack all the
1164.85s - 1170.85s |  things, touch some grass and get off the screen. Speaking of mobile researchers, damn. Thank you so
1172.77s - 1178.77s |  much. Would you like to select? Yes. Oh, no. It's dealer's choice. Okay. And I will somehow, I
1179.77s - 1186.23s |  don't know the identity of UWU underground but I will ship internationally if needed. This speaks
1186.23s - 1198.28s |  UWU underground to me. Touch grass. Very good point. Thank you so much. All right, wonderful.
1201.25s - 1207.25s |  Next up, we have the pony for most innovative research being presented by Ryan Spears. Welcome
1209.33s - 1219.99s |  to the stage. Good morning everyone. This category is pretty fun to see. When we go through the
1219.99s - 1226.69s |  nominations for these and basically take away your democratic process behind the scenes, we get to
1226.69s - 1233.99s |  see some truly innovative ideas as well as, I guess I wasn't supposed to say that part. Some truly
1233.99s - 1239.99s |  innovative ideas. We talked about this. And those ideas that were already done 20 years ago and you
1241.57s - 1248.37s |  all are self-nominating and claiming they're still innovative. That's true. There were some in
1248.37s - 1253.03s |  this category of exploiting IP facing protocols and that's not innovative but some of the
1253.03s - 1260.25s |  approaches this year truly were. We had a long section of DNS bugs uh that somebody had fun I
1260.25s - 1266.45s |  think making 30 plus CVEs so good scoring for yourself. There were other attacks against
1266.45s - 1272.07s |  security infrastructure and the new features. Which is good. It shows the circle of life in this
1272.07s - 1278.49s |  community. Right? Some of you worked hard all of last year since the last ponies to help add
1278.49s - 1285.35s |  attack surface in the name of security features. And that's important because otherwise I'd be
1285.35s - 1291.31s |  worried about the future of this category. But thanks to your hard work, we continue to have new
1291.31s - 1298.19s |  innovative attack surface and so let's see this year's nominations. Here are the nominees for most
1298.19s - 1307.07s |  innovative research. Ahoy Attacks by Benedict Schluter. Introducing a novel method of injecting
1307.07s - 1313.33s |  virtual interrupts into confidential VMs, CVMs, to alter their execution state and break
1313.33s - 1319.25s |  confidentiality. Two-door attack. Systematically exploring and exploiting logic,
1319.29s - 1324.87s |  vulnerabilities, and DNS response. Pre-processing with malformed packets by IDEALEAR.
1325.67s - 1331.03s |  Exploiting DNS response pre-processing vulnerabilities to perform DNS cache poisoning within
1331.03s - 1338.67s |  one second. Leading to the assignment of 33 CVE IDs. Let the cache cache and let the web assembly
1338.67s - 1345.79s |  assemble. Knocking on Chrome's shell by Eduard Bochin and Tao Yan. Successfully demonstrated a
1345.79s - 1353.71s |  novel V8 sandbox escape technique at Pwn2Own Vancouver 2024. Setting a new precedent in V8
1353.71s - 1366.76s |  exploitation. So let's see. And the pony goes to, for most innovative research, Edward and Tao for
1366.76s - 1375.26s |  let the cache cache and let the web assembly assemble. Knocking on Chrome's shell. I think
1375.26s - 1380.34s |  someone stood up back there. Are you going to the bathroom? Are you coming up? Oh shoot, they're
1380.34s - 1389.65s |  here. This is so exciting. Congrats, come on.
1389.65s - 1396.55s |  Thank you so much. You can, you can give a talk.
1396.55s - 1404.57s |  I wouldn't want to come on.
1409.57s - 1418.21s |  Hey, hi everyone. Um, so yeah, basically, uh, uh, our research is based on, uh, the release of a new
1418.21s - 1424.61s |  sandbox for the V8 JavaScript engine. Uh, that was, uh, the beta release was actually, uh,
1424.61s - 1436.17s |  released in March of this year. So, uh, we needed to actually bypass it for Pwn2Own and, um, uh, so
1436.17s - 1441.61s |  new features were involved and we need to actually find new ways to bypass that sandbox. That's
1441.61s - 1447.81s |  what we did at Pwn2Own. We did a talk to Black Hat, uh, a couple of days ago. Uh, the slides are
1447.81s - 1453.65s |  available on the Black Hat website and, uh, the video will be available also soon, I guess. So,
1453.65s - 1455.65s |  uh, just check it out and yeah, thanks.
1455.65s - 1463.28s |  Thank you.
1463.28s - 1476.25s |  Thank you so much. Oh, I'm next. How about that? Oh, this is a fun one. I'm really excited for
1476.25s - 1483.66s |  this one. You guys don't even know what's about to happen. Next up, we have the Pony Award for
1483.66s - 1491.86s |  Most Epic Fail. Now we kind of snitched on ourselves because I really couldn't help myself.
1491.86s - 1498.50s |  Um, the, the, if you're following on Twitter, you know who the winner is already. Uh, that ended
1498.50s - 1504.34s |  up happening because, uh, normally we present the nominees, as Mark said earlier, at SummerCon and
1504.34s - 1510.58s |  this happened like a day beforehand. And so we kind of just ended up scrapping all the nominees
1510.58s - 1515.70s |  and, uh, made an executive decision, uh, when you knock off like every airline.
1515.86s - 1522.10s |  And now here are the nominees for Most Epic Fail.
1523.22s - 1539.97s |  LOL. Today's adversaries move fast. CrowdStrike moves fast. CrowdStrike, we stop breaches.
1540.93s - 1552.11s |  Wow, you're a winner. How about that? Well, do we have anyone here who would like to accept this
1552.11s - 1567.06s |  Pony Award? Oh my goodness gracious. We do. Uh, which, uh, I don't know if these, yeah, I think
1567.06s - 1579.50s |  these are too small. I think we need another, I think we might need a different award. Look at
1579.50s - 1589.39s |  that. I can open the envelope if we need to, but it's all yours. Can I put it down there? Yeah.
1589.47s - 1596.13s |  That's a big trophy. Uh, hey everyone, Mike Santonis, president of CrowdStrike.
1602.13s - 1607.25s |  Definitely, uh, not the award to be proud of receiving, but, uh, I think the team was
1607.25s - 1611.65s |  surprised when I said straight away that I would come and get it because we got this horribly wrong.
1611.65s - 1616.85s |  We've said that a number of different times and it's, uh, super important to own it when you do
1616.85s - 1620.53s |  things well. It's super important to own it when you do things, uh, horribly wrong, which we did in
1620.53s - 1626.45s |  this case. Uh, the reason why I wanted the trophy is I'm heading back to headquarters. Uh, I'm going
1626.45s - 1630.93s |  to take the trophy with me. It's going to sit pride of place because I want every CrowdStriker
1630.93s - 1636.85s |  who comes to work to see it because, you know, our goal is to protect people and, uh, we got this
1636.85s - 1639.97s |  wrong and I want to make sure that everybody understands these things can't happen and that's
1639.97s - 1644.13s |  what this community is about. So from that perspective, I will say thank you and I will
1644.13s - 1649.25s |  take the trophy and we'll put it in the right place and, uh, make sure everybody sees it. So
1649.25s - 1664.69s |  thank you. See, people are mad at us for giving out like negative awards, but then you get people
1664.69s - 1672.77s |  like really, you know, taking it and speaking to it. It's good. I'm very happy. Um, all right, let's
1672.77s - 1678.85s |  keep moving along. Next up, we have the pony for most underhyped research being presented by
1678.85s - 1686.37s |  Ong Kwee, the CEO of RedBlue Insecurity and one of our sponsors. All right, all right. I am Ong
1686.37s - 1694.05s |  and, um, this is the award for the best research, right? No, it's the most underrated research. Um,
1694.05s - 1700.61s |  as a recipient of, of this years and years ago, I have some things to say, but in the audience,
1700.61s - 1707.62s |  show of hands, has anyone else received this award in the past? Nope. We all work at Wendy's. We got
1707.62s - 1713.54s |  jobs, you losers. All right. Um, so some of the things that I want to, you know, for example, I
1713.54s - 1717.94s |  want to give examples of really innovative, impactful things that have changed our lives
1718.50s - 1724.82s |  that most of us don't even care or know about. So I was reading this paper that is also very
1724.82s - 1731.94s |  underrated. It's the breeding behavior of blind Mexican cave fish, uh, in river dwelling cavities
1731.94s - 1737.06s |  of, of types, right? That's important. That's literally going to change the world and stuff.
1737.06s - 1743.46s |  Um, some other examples, Gregor Mandel, right? He like made peas, you know, do their business,
1743.46s - 1750.58s |  uh, and created the theory behind genetics and hybridization. Awesome, important work. Uh, people
1750.58s - 1756.90s |  gave him a high five for that 16 years after he died. So, you know, there's always something to
1756.90s - 1762.18s |  look forward to. And then, uh, you know, not all, well, also the plate tectonics, right? Remember
1762.18s - 1768.90s |  for the thousands of years, uh, 2000, a thousand people thought the world was always the way it is,
1768.90s - 1772.74s |  even though, you know, even any five-year-old can look at like all the continents and say, like,
1772.74s - 1778.26s |  if I squish them together, don't they all kind of fit? Right. So yeah, that was the paper that
1778.26s - 1788.58s |  was written. Let me check in, uh, in 1596. And it was officially accepted in 1959 that plates move
1788.58s - 1795.14s |  and the round thing, you know, they shift and there used to be Pangea, right? So, uh, last example,
1795.14s - 1802.58s |  um, the wonderful man, very, very, very underrated, uh, Thomas Midgley, Midgley. Does anybody know who
1802.58s - 1809.14s |  Thomas Midgley is? Show of hands. All right. Underrated indeed. This is a man in one decade
1809.14s - 1816.26s |  invented leaded gasoline and chlorofluorocarbons, right? To make the world kick ass. So, you know,
1816.26s - 1823.22s |  he's pretty underrated too, right? So in that context, um, let's look at some of the most
1823.22s - 1833.20s |  underrated research of this year. And finally, the nominees for most underhyped research.
1833.36s - 1840.16s |  See no eval. Runtime dynamic code execution in Objective-C by CodeColorist. Highlighting
1840.16s - 1846.96s |  a technique for dynamic code execution in Objective-C used in several iOS exploits since 2021.
1848.72s - 1856.08s |  Dangerous import. SourceForge patches. Critical code vulnerability by Scry. Vulnerability in
1856.08s - 1861.20s |  Apache Allura. Potentially compromising SourceForge and spreading malware to millions of users.
1862.00s - 1871.04s |  Flexo by Ping-Lun Wang, Ricardo Paganiella, Riyadh Wabai, and Fraser Brown. Showcasing a
1871.04s - 1878.16s |  binary unpacker operating within a microarchitectural weird machine making malware analysis significantly
1878.16s - 1889.65s |  harder. All right. And uh, Pony goes to uh, ch-ch-ch-ch-ch-ch-ch-ch-ch-ch. One second,
1889.65s - 1894.65s |  One second. One second. Uh, C, no, C, no eval.
1898.09s - 1904.70s |  Runtime dynamic code execution. Objective C. Anybody? Uh,
1904.74s - 1908.78s |  anybody here? Anybody here? Uh, bathroom?
1909.02s - 1912.06s |  He's going to the bathroom. Yes. Yes. Oh my gosh. Let's go.
1914.41s - 1915.45s |  What are you forgetting?
1917.01s - 1919.25s |  No running at the pool, sir. Picture. Yeah. Yeah. Yeah.
1920.29s - 1923.41s |  I think they're recording this, so it's all right. Come on.
1926.59s - 1929.11s |  I'm not sure what order if you want to talk about it cause you're excited or
1929.11s - 1930.95s |  you want to grab a pony. Yeah. Talk, talk, talk, go, go.
1931.43s - 1934.99s |  Actually I'm taking it. I'm a friend of my behave. Yeah.
1934.99s - 1939.83s |  They told you the Georgia win the award and I'm taking it on and behave of him.
1940.51s - 1945.51s |  Yeah. Actually I was a previously winner in the 2022 and I'm taking this on
1947.75s - 1951.87s |  behavioral with the, or my friend. Yeah. He win this. Congratulations to him.
1953.07s - 1955.03s |  Yeah. Thank you. Thank you so much.
1955.15s - 1973.10s |  Yeah. He also says, thanks mom. Thank you. All right. Thank you so much.
1973.34s - 1976.38s |  That's another thing. Like I love it when like, you know,
1976.50s - 1978.30s |  except on a friend's behalf, you know,
1979.06s - 1983.50s |  make it so we don't have to mail a horse. Fun fact, um,
1983.54s - 1987.34s |  designing these things. So, uh, these were all manufactured,
1987.50s - 1991.58s |  certainly not using any type of child labor and a undisclosed basement in the DC
1991.58s - 1995.66s |  metro area. Um, paint fumes, uh,
1996.66s - 2000.50s |  the, um, I'm in New York.
2001.86s - 2004.34s |  Have you ever had to buy 11 my little ponies off Amazon?
2005.42s - 2009.58s |  Do you know what that does to your ad targeting? I do.
2009.94s - 2014.58s |  It's not great. Um, uh, and then the, the best part was, uh,
2014.62s - 2016.78s |  I taking all of them and shoving 11,
2016.78s - 2020.42s |  my little ponies into a backpack and then taking the train down cause I really
2020.42s - 2023.38s |  didn't want to explain it to a TSA agent. Uh,
2023.78s - 2027.54s |  but you get a really weird thrill just thinking like nobody on this train knows I
2027.54s - 2032.34s |  have 11 my little pony horses in my backpack right now up until
2032.82s - 2036.58s |  they were buying podiums for it and demanded that I open it up and pull one out
2036.58s - 2040.82s |  and start measuring it on the train, which I had to do. So thanks guys.
2042.06s - 2044.50s |  All right. Um, moving right along.
2044.50s - 2047.94s |  We have the pony for best privilege escalation being presented by Nika.
2057.00s - 2057.84s |  Hi Defcon.
2058.84s - 2060.40s |  Standing here today,
2060.48s - 2064.24s |  I feel very privileged to present this category,
2064.92s - 2068.24s |  but it's this category that takes that to a new level,
2068.56s - 2070.88s |  a level we're told we're not allowed to reach,
2071.52s - 2076.36s |  but rules are for suckers and this year's nominees are rule breakers.
2077.76s - 2080.68s |  Privilege escalation. There we go.
2081.48s - 2085.60s |  Privilege escalation is an exploitation technique that is used to gain access to
2085.60s - 2089.28s |  resources or functionality. A user should be restricted from accessing.
2090.04s - 2093.88s |  It's like when you make friends with the bouncer and cut the line at Burkheim.
2095.36s - 2096.20s |  Yeah.
2097.28s - 2102.28s |  The bouncer is the trust boundary and you and your crew look at each other and go
2103.12s - 2104.56s |  low. We're going in anyway.
2106.24s - 2110.88s |  It's about saying fuck you and showing that your ex boy is sicker than whatever
2110.88s - 2112.96s |  code the devs push to prod.
2113.08s - 2113.92s |  Yeah.
2114.64s - 2118.52s |  Privilege escalation is about breaking into spaces where the doors are locked.
2118.72s - 2123.04s |  The glass ceiling feels stratospherically high and the guards are ruthless.
2124.12s - 2126.92s |  In the Olympics, people always want to reach the next level,
2127.52s - 2129.52s |  earn the privilege of a gold medal.
2130.32s - 2133.04s |  Here we have people who can cheat the best,
2133.36s - 2135.60s |  whisper the best incantations,
2136.00s - 2137.48s |  cast the best spells.
2138.36s - 2142.72s |  This category is for those who put in the best effort to slide the scale in
2142.76s - 2147.76s |  their favor for best privilege escalation for staying lifted by any means
2148.16s - 2150.44s |  possible. Scored on style.
2151.88s - 2156.40s |  I'm going to defer to the artist known as D noise for some spiritually
2156.40s - 2159.96s |  enlightening verse on the hollow topic of per desk.
2163.80s - 2165.76s |  When I'm told I'm offensive,
2166.16s - 2170.72s |  I need to check my privilege and T authority system.
2171.68s - 2174.12s |  Here are the nominees for best progress.
2174.88s - 2184.61s |  And now the nominees for best privilege escalation,
2185.33s - 2192.31s |  unplugging XHCI and enabling step on the road to VMware VM
2192.31s - 2197.31s |  escape by Victor V detailing a successful VMware workstation escape exploit
2198.55s - 2203.55s |  from the TN for cup 2023 by removing the XHCI USB controller within the virtual
2205.03s - 2208.39s |  machine, triggering a use after free vulnerability.
2209.79s - 2213.11s |  A registry window to kernel memory by M jerk sick,
2214.27s - 2217.43s |  highlighting memory corruption in windows registry handling,
2217.91s - 2222.51s |  providing direct access to kernel memory and turning rigid eat into a kernel
2222.51s - 2223.35s |  memory editor.
2224.79s - 2229.79s |  Windows streaming service UAF used at home to own Vancouver by chompy,
2230.55s - 2234.91s |  exploiting an improper object reference count update in the Microsoft kernel
2234.91s - 2235.75s |  streaming server,
2236.19s - 2241.19s |  causing a use after free for a virtual table call earning $15,000 at the
2241.23s - 2242.07s |  competition.
2246.14s - 2257.30s |  And the pony goes to chompy for windows streaming service.
2275.78s - 2278.10s |  Okay. I don't have anything prepared. Uh,
2279.22s - 2282.34s |  didn't even know if I was going to come. I, uh,
2282.98s - 2286.78s |  I don't know who decided to make this at 10am on Saturday after Defcon,
2286.78s - 2290.74s |  but I'm here a little underdressed. Everyone looks amazing. Um,
2291.10s - 2295.66s |  don't have that much to say other than I'm super grateful for my, uh,
2295.70s - 2300.22s |  management and my team that support me and allowing me to do public research.
2300.26s - 2303.54s |  I know that's not a common thing. So I get to share, uh,
2303.54s - 2308.54s |  all my work publicly and a shout out to the other people that were nominated.
2308.82s - 2313.02s |  Victor V and drew were legends, uh, stiff competition.
2313.34s - 2317.86s |  And also to, uh, my husband that puts up with me when I don't,
2317.94s - 2320.14s |  on the days I don't find bugs. So.
2320.74s - 2321.58s |  Thank you.
2338.31s - 2342.83s |  Thank you so much. Chompy. Um, all right.
2342.99s - 2344.95s |  I could tell there was a crowd favorite out there too.
2345.07s - 2349.55s |  Like you guys kind of lay your souls away. Um, let's see.
2349.55s - 2354.27s |  Next up we have the pony award for best remote code execution being presented by
2354.27s - 2355.11s |  Ryan again.
2361.74s - 2367.99s |  I'm so glad this is still a category as well. And I'm told I can't say much.
2368.03s - 2373.03s |  So there's all types of RC and there were a lot of logic and web app bypasses
2373.63s - 2378.39s |  this year. And a lot of people asked me, do those count yet? Yes.
2378.39s - 2381.91s |  They're remotes. That's fine. But we also, um,
2381.95s - 2385.67s |  all too often talk about web drive buys and zero and one clicks.
2385.67s - 2390.47s |  And this year we had a lot of nominations that luckily took advantage of things
2390.47s - 2394.47s |  like exchange and just parked it in your inbox and let the computer click it over
2394.47s - 2396.31s |  and over and over for you.
2397.87s - 2402.51s |  And then we of course had nominations of the classic patterns and everyone made
2402.51s - 2403.95s |  sure this year, again,
2403.95s - 2408.95s |  thank you to the community for leaving in buffer overflows use after freeze.
2409.67s - 2414.11s |  We and the nominees appreciate your dedication to these patterns.
2415.31s - 2417.87s |  Otherwise this could get boring or more interesting.
2418.31s - 2419.91s |  So now let's see for the nominees.
2421.59s - 2425.71s |  Next up here are the nominees for best remote code execution.
2428.30s - 2433.18s |  Jump server pre-auth RCE exploit full chain by Lolliot and Jin Yang Peng.
2434.10s - 2438.50s |  Exploiting insecure random number logic in Python to achieve authentication
2438.50s - 2441.50s |  bypass resulting in pre-auth RCE.
2442.78s - 2447.78s |  Half measures and full compromise chain of three vulnerabilities to PwnExchange
2448.42s - 2449.58s |  by Piotr Bazidlo.
2450.66s - 2455.66s |  This Microsoft exchange RCE chain consists of three vulnerabilities enabling
2455.86s - 2457.98s |  RCE by any domain user.
2458.78s - 2463.78s |  The overlooked pattern path to pre-auth RCE by root OX Koshell a critical
2464.90s - 2469.26s |  pre-authenticated remote code execution vulnerability affecting all windows
2469.26s - 2474.26s |  versions from server 2008 to server 2022 and windows 10 and 11.
2479.41s - 2483.93s |  So the pony for best remote code execution goes to,
2483.93s - 2488.93s |  let's see root OX Koshell for the overlooked pattern CVE 2024 380 path to
2491.73s - 2493.21s |  pre-auth RCE.
2499.98s - 2503.66s |  I stopped using it. Are we back now? Okay. I stopped using it so I don't blame them.
2503.70s - 2506.82s |  Um, the, are you here? No,
2506.86s - 2509.54s |  that's maybe good because we're running short on time. All right,
2509.54s - 2517.18s |  let's move right along. We'll send it over to them. All right.
2517.18s - 2520.74s |  Next up for the lamest vendor response, we have Winona.
2524.89s - 2527.17s |  Hey, what's up guys? Um, my name is Winona.
2527.17s - 2531.45s |  I'm a former reverse engineer now in law school, but I am not anyone's lawyer yet.
2531.93s - 2536.93s |  Um, don't, don't tell me all the shit you do Ian. Um, so first off, um,
2537.25s - 2540.57s |  I have the distinct pleasure of introducing the lamest vendor response.
2540.77s - 2543.33s |  Although I do want to say thank you guys all for coming.
2543.53s - 2545.53s |  Like the hacker community is so wonderful.
2545.53s - 2549.69s |  Like who else is going to come all the way out to the devil's armpit of America
2550.01s - 2554.77s |  and go party all night and then show up at 10 AM for an award show with people
2554.77s - 2558.69s |  who are as hungover as you guys are. Um, so, uh,
2558.73s - 2561.45s |  there's also Gatorades up here if y'all want them. Uh,
2561.45s - 2566.45s |  I brought some of them just for you. Um, on the lamest vendor response,
2566.53s - 2570.65s |  the reason why we give this award out is that when a company makes business
2570.65s - 2574.53s |  decisions that runs against the hacker ethos, we want to call that out.
2574.69s - 2576.33s |  Things that are damaging,
2576.49s - 2580.97s |  things that actively result in us having to clean up their stuff or even just
2580.97s - 2585.77s |  things that are just in poor form. Um, that being said, uh, you know,
2585.77s - 2587.61s |  it says, Hey guys, not cool.
2587.61s - 2590.33s |  And it hopefully will pressure them to change their habits a little bit.
2590.85s - 2593.69s |  Of course the hacker community is super diverse.
2593.73s - 2597.89s |  We have a lot of different opinions and if you don't agree with some of the
2597.89s - 2601.29s |  nominees up here, I truly hope that we hear from you next year.
2601.41s - 2605.25s |  Please tell us who you think your lamest vendor is and we will gladly bring them
2605.25s - 2613.21s |  up here. Um, so now let's hear the nominees. Hit what? Arrow? Okay.
2615.24s - 2622.74s |  The nominees for lamest vendor response are Linux CVE CNA,
2623.46s - 2628.26s |  the Linux kernel team is giving every bug CVE, not just the vulnerabilities.
2628.82s - 2633.86s |  What could go wrong? Xiaomi's pwn2own infrastructure fail.
2634.66s - 2637.06s |  Xiaomi disabled parts of its infrastructure,
2637.38s - 2641.54s |  including its global app store to stop pwn2own contestants from honing.
2643.02s - 2647.74s |  Kaspersky antivirus trying to claim a bug bounty from Apple for triangulation.
2648.22s - 2651.98s |  Can't pay out sanctioned entities, guys. Sorry. Sucks to suck.
2654.48s - 2659.48s |  And the pony award goes to Xiaomi for their pwn2own infrastructure fail.
2664.24s - 2668.40s |  Come on up, please. No, nobody.
2668.64s - 2670.80s |  Nobody. All right. We're really running low on time,
2670.80s - 2672.40s |  so we're just going to keep moving.
2673.16s - 2676.48s |  All right. I also have the distinct honor. Yeah, it's me again. Uh,
2676.48s - 2681.24s |  I also have the distinct honor of giving out the Epic achievement award. Um,
2681.28s - 2682.12s |  which again,
2682.64s - 2686.40s |  this is such an awesome group of people and we're all out here trying to do the
2686.40s - 2690.72s |  best that we can, uh, to protect or not. And, um,
2691.52s - 2693.84s |  what? Oh, we're gonna, we're just gonna move it.
2695.16s - 2697.40s |  Here are the nominees for Epic achievement.
2701.10s - 2704.46s |  Discovery of the XZ backdoor by Andres Freund.
2705.30s - 2709.62s |  Discover the backdoor in XZ oodles while troubleshooting performance issues,
2709.98s - 2714.06s |  ultimately saving several Linux distros. Windows downdate,
2714.38s - 2718.18s |  downgrade attacks using windows updates by Alon Leviev.
2718.94s - 2723.38s |  Uncovered a critical flaw in windows updates that allows attackers to downgrade
2723.38s - 2727.78s |  files, enabling privilege escalation and disabling VBS.
2728.66s - 2731.86s |  Flexo by Ping Lun Wang, Ricardo Pacaniela,
2732.18s - 2734.66s |  Riyad S. Wabi and Fraser Brown.
2735.50s - 2740.30s |  Showcasing a binary unpacker operating within a micro architectural weird
2740.30s - 2743.74s |  machine, making malware analysis significantly harder.
2745.98s - 2750.02s |  And the most Epic achievement award of the ponies goes to Andres Freund for the
2750.02s - 2752.10s |  discovery of the XZ backdoor.
2756.23s - 2759.83s |  I really hope you would be here cause I really like this work. Uh, by the way,
2760.35s - 2762.39s |  um, honorable shout out to the windows downdate guys.
2762.39s - 2765.99s |  I like was really actually pretty cool research. Um,
2766.99s - 2771.99s |  uh, okay. So, um, we are getting towards the end. Uh,
2772.67s - 2776.99s |  we don't always give out, uh, this award,
2777.03s - 2780.07s |  but due to extenuating circumstances, um,
2780.51s - 2785.51s |  this year we are giving out a pony awards, lifetime achievement award. Uh,
2786.27s - 2794.80s |  and we are giving it to Sophia Danton. Uh,
2796.32s - 2800.24s |  many of you may be unaware, uh, but, uh, Sophia, uh,
2800.32s - 2802.92s |  passed away earlier this year. Um,
2802.96s - 2806.56s |  those of you familiar with the margin research or the pony awards are likely
2806.56s - 2810.96s |  aware that it wasn't just me doing this these past few years as doing it with
2810.96s - 2815.72s |  Sophia. Um, and I can confidently say that myself, the community,
2815.76s - 2818.60s |  the country, and quite unironically,
2818.60s - 2823.12s |  the world would be a worse place if not for what she achieved in her life.
2824.64s - 2827.00s |  Uh, I can't talk about some of them, but, uh,
2827.00s - 2830.16s |  the ones I can are too numerous to detail. So, uh,
2830.16s - 2833.64s |  I will simply ask that you all take a lesson with you that I received from her,
2834.08s - 2837.84s |  which is to take care of each other and stay curious. Uh,
2838.16s - 2840.28s |  so speaking of, uh, curiosity,
2840.32s - 2844.76s |  here is a curious and delightful and smart, uh, individual.
2844.92s - 2848.72s |  I'd like to welcome Sophia's sister and the president of margin research,
2848.72s - 2852.08s |  Claudia Danton up to accept the lifetime achievement award.
2862.82s - 2866.58s |  Thank you everyone. Um, I know we're running a little short on time,
2866.58s - 2871.42s |  but I just wanted to thank everyone here at probably the
2871.42s - 2875.14s |  largest conference I've been to in the last couple of months following my
2875.14s - 2877.50s |  sister's death. Um,
2877.70s - 2882.34s |  whether any of you knew her as Sophia, as Kalakwendi, um,
2882.38s - 2885.34s |  through her work and hacking for soju, um,
2885.50s - 2889.66s |  doing training with the folks at binary Ninja, um,
2889.86s - 2893.14s |  or even her work on a lot of policy stuff. Um,
2893.66s - 2896.46s |  she interacted with most,
2896.46s - 2899.86s |  if not all elements of what this conference stands for.
2900.10s - 2905.18s |  And it's a great honor to be accepting this on her behalf. Um,
2905.26s - 2906.38s |  thank you all very much.
2919.26s - 2924.30s |  All right. Well, um, that's, uh, that's all folks.
2924.42s - 2928.82s |  Uh, thank you so much for coming to the, uh, 2024 pony awards,
2929.54s - 2931.02s |  uh, for you head out.
2931.02s - 2934.58s |  I do really want to call out and thank, uh, our sponsors,
2934.62s - 2938.42s |  margin research, red balloon security, and the summer con foundation,
2938.70s - 2942.70s |  as well as the multitude of people who helped out. Uh, you know, folks,
2943.14s - 2947.94s |  come on. Hey, come on. Heard, heard, heard the cats. Let's go.
2947.94s - 2950.86s |  Alpha as well. Um,
2951.46s - 2955.50s |  we've got a Neil Durkin, Claudia Danton, Mark Trump, or Dawn Bolsonaro,
2955.54s - 2960.06s |  the entire pony awards construction crew, every presenter, uh,
2960.06s - 2964.74s |  the nominees, the winners, uh, and honestly, most of all,
2964.78s - 2968.70s |  all of you, uh, for coming out at 10 AM on a Saturday DEF CON.
2970.18s - 2974.02s |  Uh, so thank you so much. We hope to see you next year. Have a good DEF CON.


url: https://www.youtube.com/watch?v=dLOUzF6_Y54
title: DEF CON 32 - Behind Enemy Lines: Going undercover to breach LockBit Ransomware Op- Jon DiMaggio
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=dLOUzF6_Y54",
  "title": "DEF CON 32 - Behind Enemy Lines: Going undercover to breach LockBit Ransomware Op- Jon DiMaggio",
  "description": "Delve into the clandestine world of the LockBit ransomware gang! In this revealing presentation, I will recount my two-year journey spent infiltrating the inner ranks of the LockBit crime syndicate. Learn about the strategies employed to earn the trust of key individuals within the syndicate, including the gang's leader, LockBitSupp.\n\nYou will see firsthand accounts of these exchanges, and I will detail the intricacies of my relationship with LockBit's leadership and its network of affiliate hackers. You will also gain insight into the unintended consequences of my actions, including how my perceived breach of their infrastructure impacted the syndicate's operations. More importantly, I will share how I assisted in unmasking the real-world person behind the mask of LockBitSupp.\n\nJoin me as I illustrate the pivotal role of human intelligence in tandem with cyber threat intelligence to combat ransomware threats. This talk offers a compelling narrative of real-world efforts to thwart ransomware activities and safeguard organizations from LockBit ransomware attacks.\n\n60 min (full episode): 4/14/2024: Scattered Spider; Knife; Tasmanian Tiger - CBS News\n60 Min Overtime (additional footage from my interview about LockBit): Infiltrating ransomware gangs on the dark web - CBS News\nRansomware Diaries\nRansomware Diaries: Volume 1 | Analyst1\nRansomware Diaries V. 2: A Ransomware Hacker Origin Story (analyst1.com)\nRansomware Diaries V. 3: LockBit's Secrets (analyst1.com)\nRansomware Diaries Volume 5: Unmasking LockBit (analyst1.com)",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2180,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.26s | This text was transcribed using whisper model: large-v2

 All right.
2.26s - 4.40s |  OSI model troubleshooting.
4.40s - 7.40s |  It's always physical layer.
7.40s - 9.56s |  So I wasn't planning on giving an intro,
9.56s - 10.74s |  but I'm going to do that.
10.74s - 15.40s |  It's an honor to intro my friend John DiMaggio with AnalystOne.
15.40s - 17.80s |  Most of you probably are here because you've
17.80s - 19.84s |  read some of the work he has done,
19.84s - 22.72s |  either his book, The Art of Cyberwarfare,
22.72s - 25.36s |  or the Ransomware Diaries series that's
25.36s - 28.32s |  pretty popular that sort of culminated in this talk.
28.32s - 30.12s |  This is his first DEF CON talk.
30.12s - 31.92s |  It's way overdue.
31.92s - 34.80s |  He's one of the top cyber espionage practitioners
34.80s - 36.00s |  on the planet.
36.00s - 38.22s |  And with that, I'll turn it over to John.
38.22s - 38.92s |  Here you go, man.
38.92s - 39.42s |  Thanks, man.
39.42s - 40.40s |  Appreciate you, brother.
44.82s - 45.86s |  Thank you.
45.86s - 47.62s |  Where there's a will, there's a way.
47.62s - 48.86s |  I'm glad we got this started.
48.86s - 50.62s |  Let me get this mic adjusted.
50.62s - 51.22s |  All right.
51.22s - 52.90s |  Everybody hear me?
52.90s - 53.78s |  All right.
53.78s - 55.14s |  Well, hear what he said in my name.
55.14s - 56.06s |  Yep, I'm an author.
56.06s - 56.94s |  That's all great.
56.94s - 58.90s |  I'm not here to talk to you about that today.
58.90s - 60.74s |  I do write the Ransomware Diaries.
60.74s - 62.98s |  That is not what this is about, but the output
62.98s - 65.18s |  of what I'm going to talk to you about today is there.
65.18s - 68.18s |  But this is a story.
68.18s - 71.14s |  I am a storyteller, and this is like a once-in-a-lifetime
71.14s - 73.78s |  story, and I'm just so excited to be able to be up here
73.78s - 77.46s |  and tell you this story today.
77.46s - 80.34s |  This is a ransomware story, but it's also
80.34s - 83.02s |  a story of friendship, it's a story of love,
83.02s - 88.18s |  it's a story of betrayal, and it's a story of deceit.
88.18s - 89.74s |  I'm going to be honest with you guys.
89.74s - 93.58s |  When I started to create the content for this,
93.58s - 97.18s |  I found that there was a particular similarity
97.18s - 99.94s |  between my relationship with LockBit,
99.94s - 104.90s |  the man behind LockBit, and the horrific dating love story
104.90s - 107.66s |  shows that my girlfriend tortures me with.
107.66s - 109.54s |  So I'm going to share some of that
109.54s - 111.30s |  and add that element into this today.
111.30s - 115.86s |  So anyway, on that note, let's kick this shit off.
115.86s - 119.46s |  So when I began this, I knew that if I
119.46s - 122.10s |  was going to get LockBit to like me,
122.10s - 124.86s |  I was going to have to talk to him as someone besides myself.
124.86s - 126.70s |  LockBit was sort of the prom queen.
126.70s - 130.30s |  Everybody talking about wanted LockBit to like them,
130.30s - 133.58s |  and he's sort of the top dog.
133.58s - 136.08s |  This was two years ago, though, so it wasn't the number one
136.08s - 138.38s |  ransomware group at the time, but he was moving up.
138.38s - 140.38s |  I knew he wasn't going to talk to me as me,
140.38s - 142.70s |  so I put on a puppet show.
142.70s - 146.94s |  Spent a lot of time developing sock puppets.
146.94s - 150.70s |  I cultivated these puppets, but still, at the same time,
150.70s - 153.42s |  I could only use them if they were believable
153.42s - 156.58s |  and if other people around him believed it.
156.58s - 158.30s |  So the first thing that I had to do
158.30s - 160.34s |  was I needed to hang out at his spots.
160.34s - 162.70s |  What I mean, his favorite spots, what I mean by this,
162.70s - 164.66s |  though, is the places online where
164.66s - 166.94s |  he would go to recruit, the places online where
166.94s - 169.14s |  he would go to socialize, the places where
169.14s - 172.14s |  he'd go to talk with other criminals and other hackers.
172.14s - 173.46s |  This isn't his infrastructure.
173.46s - 175.46s |  These are the places where he spends his time.
175.46s - 178.62s |  So once I found those, I needed to find his accounts.
178.62s - 179.82s |  That was pretty easy.
179.82s - 182.90s |  This dude calls himself LockBit or variations of LockBit
182.90s - 186.18s |  in all of his accounts, so it didn't take too much work.
186.18s - 187.70s |  And once I'd sort of profiled that
187.70s - 190.58s |  and gotten into these various forums that he was on,
190.58s - 192.50s |  I stalked his business partners.
192.50s - 195.30s |  Now, what I mean by that is I looked at the people
195.30s - 197.30s |  he was buying attack resources from,
197.30s - 200.14s |  but I also looked at the conversations
200.14s - 201.26s |  that he was having.
201.30s - 204.10s |  I was looking at the affiliates he was talking to,
204.10s - 206.38s |  but this dude talked to a lot of people.
206.38s - 210.18s |  He is an extreme extrovert when it comes to these forums,
210.18s - 211.94s |  and there was a lot of conversations.
211.94s - 214.02s |  So I needed to figure out who was relevant.
214.02s - 216.94s |  I needed to find those high-value targets.
216.94s - 218.70s |  So I started to look for the people
218.70s - 220.94s |  that he talked to the most, and I started to look
220.94s - 223.90s |  for affiliates that had relationships with not just him,
223.90s - 226.26s |  but with other ransomware groups,
226.26s - 228.46s |  and sort of vetted that list.
228.46s - 232.02s |  Once I had that list and I knew who they were,
232.02s - 235.70s |  that allowed me to spy on them.
235.70s - 238.42s |  So I spent a lot of time going through these forums,
238.42s - 241.30s |  and I mean, I stalked the shit out of these dudes.
241.30s - 243.54s |  I read everything they ever wrote.
243.54s - 246.86s |  Now, taking that information, what I had to do
246.86s - 250.06s |  was sort of overlay that going backwards in time
250.06s - 252.94s |  to see what attacks were taking place in the world
252.94s - 255.66s |  and what significant events were happening.
255.66s - 257.54s |  But that wasn't the important thing.
257.58s - 259.78s |  The important thing was the conversations
259.78s - 261.78s |  that had nothing to do with that.
261.78s - 262.62s |  Think about it.
262.62s - 263.82s |  If you wanna date somebody,
263.82s - 265.50s |  you wanna know their personality,
265.50s - 267.46s |  you gotta know the things that make them tick.
267.46s - 269.26s |  You gotta know the things they find funny.
269.26s - 272.38s |  You gotta know the music they like, their politics,
272.38s - 274.62s |  whatever it might be, if they're religious.
274.62s - 277.34s |  So I really focused on those aspects
277.34s - 279.86s |  of his conversations with other people,
279.86s - 284.14s |  sort of profiled him before I ever engaged or talked to him.
284.14s - 285.78s |  And this helped me a lot by going
285.78s - 287.74s |  and looking through all these resources
287.74s - 290.62s |  and identifying these conversations.
290.62s - 292.54s |  I mean, the attack elements are what everybody read
292.54s - 295.34s |  in the ransomware diaries, but this part,
295.34s - 297.14s |  the stuff that wasn't anything about that
297.14s - 300.70s |  was really the resource that helped me
300.70s - 302.22s |  to get to that end result.
303.54s - 306.98s |  So after that, I stole all of his friends.
306.98s - 310.34s |  So what I mean by that is he talked to a lot of people,
310.34s - 312.34s |  but those people that he had those conversations
312.34s - 313.18s |  that I just mentioned,
313.18s - 315.14s |  those non-work-related conversations,
315.14s - 317.10s |  people he talked to a lot,
317.10s - 318.22s |  those are the people that I wanted
318.22s - 319.90s |  to spend my time talking to.
319.90s - 321.02s |  So I did.
321.02s - 323.90s |  This is Matt Veve, or as I used to know him, Boris,
323.90s - 326.90s |  and as most of you guys know him, Wazowaka.
326.90s - 329.50s |  This was him getting married last year.
329.50s - 332.26s |  This is one of his laptops that he uses to commit crimes.
332.26s - 334.74s |  I guess it's kind of cool to have your name written on that.
334.74s - 336.46s |  He's got me, some other researchers,
336.46s - 338.56s |  and some other criminals written on there.
339.74s - 341.46s |  He's an interesting guy.
343.14s - 344.64s |  Putting a researcher's name on an attack
345.04s - 346.48s |  that you do crimes on, I mean, I don't know,
346.48s - 348.64s |  that's just, what do you say to that?
348.64s - 349.48s |  Thank you?
350.88s - 353.52s |  But getting to become friends with these guys
353.52s - 358.20s |  was important because as I was going to approach LockBit,
358.20s - 360.84s |  I needed to have sort of that validation
360.84s - 363.68s |  from the people who were important to him.
363.68s - 365.96s |  This is Buster, again, most of one knows him
365.96s - 369.16s |  as Basterlord, wrote The Ransomware Diaries
369.16s - 370.84s |  volume two about him.
370.84s - 372.96s |  He'll be upset that I posted this picture.
372.96s - 375.92s |  He got indicted, kind of all knew who he was now,
376.76s - 379.76s |  but he says it's not him, of course it's not.
379.76s - 382.04s |  The funny thing about this picture is, as you see,
382.04s - 384.08s |  I asked him to sign The Ransomware Diaries,
384.08s - 386.56s |  so he did, he signed it APT.
386.56s - 389.08s |  What's so ironic about this is the very first time
389.08s - 392.48s |  I ever talked to him was through Talks,
392.48s - 394.24s |  cryptic communication app, and I said,
394.24s - 396.48s |  hey, Basterlord, how's it going, man, let's talk,
396.48s - 399.04s |  and he said to me, call me Ivan.
399.04s - 401.08s |  Fast forward two years, he's indicted,
401.08s - 402.88s |  this motherfucker's real name's Ivan.
402.88s - 407.88s |  Can't make that shit up, can't make that up.
408.72s - 409.72s |  But yeah, we became friends.
409.72s - 412.04s |  I still like the guy, I mean, you know,
412.04s - 413.72s |  I spend more time talking to criminals
413.72s - 416.72s |  than I do corporate people, maybe that's something about me,
416.72s - 419.40s |  but I enjoy talking to hackers, criminals,
419.40s - 421.78s |  I mean, that's kind of like the culture that I love,
421.78s - 424.82s |  so this dude, you know, I do consider him to be a friend,
424.82s - 427.08s |  wish he chose a different life, but you know,
427.08s - 430.00s |  interesting guy, and then Mr. B brought,
430.00s - 431.80s |  well, lots of people probably hate this guy,
431.80s - 434.40s |  but he's always been respectful to me.
434.40s - 438.72s |  Sometimes he likes to be really sarcastic, poke fun,
438.72s - 440.72s |  but again, this is somebody who's close to LockBit
440.72s - 443.32s |  and spends a lot of time being close to LockBit,
443.32s - 446.20s |  so you know, I wanted to be friends with him.
446.20s - 450.28s |  I had a conversation, me, Azeem from Cisco Talos,
450.28s - 453.70s |  we were joking around with Brava and Wazowaka,
453.70s - 455.92s |  and just to give you an idea of the things
455.92s - 458.28s |  that we talked about, you know, they're not always a source.
458.28s - 459.68s |  Some of the dumb things we talked about
460.36s - 461.88s |  were so silly and fictitious, we were talking about
461.88s - 463.40s |  getting on a boat between, you know,
463.40s - 465.76s |  on international waters between Russia and Poland,
465.76s - 467.96s |  and I was gonna bring a copy of my book,
467.96s - 470.64s |  and Azeem was gonna bring some vodka,
470.64s - 473.40s |  and Wazowaka was gonna cook some food for us,
473.40s - 474.64s |  and we were gonna hang out, I mean,
474.64s - 476.24s |  dumbass conversations just like you'd have
476.24s - 477.16s |  with your regular friends,
477.16s - 479.12s |  but these guys are regular people too,
479.12s - 481.60s |  so when I say, like, I wanna get close to their friends,
481.60s - 483.40s |  that doesn't mean they're like sources
483.40s - 484.98s |  or they're betraying anybody,
484.98s - 488.20s |  it literally means you just became friends with them.
488.20s - 489.88s |  Again, but important to the bigger picture
489.88s - 491.98s |  of my real target, who was LockBit.
492.94s - 495.36s |  Okay, so after I did that, I needed to check out their place,
495.36s - 497.12s |  this is DataLeak's site, obviously,
497.12s - 498.64s |  it's where victims are posted,
498.64s - 500.64s |  but the important thing for this operation
500.64s - 502.12s |  was the affiliate rules,
502.12s - 504.16s |  and the reason that was important to me
504.16s - 508.04s |  was because I wanted to join their gang,
508.04s - 509.88s |  and I tried to do just that.
509.88s - 512.18s |  Now, I knew I wasn't gonna make it all the way through,
512.18s - 515.24s |  because, well, I'm not actually a ransomware criminal,
515.52s - 518.84s |  but I wanted to see what I could learn,
518.84s - 520.40s |  and I figured, fuck it, why not?
520.40s - 522.20s |  It sounded like fun at the time.
522.20s - 524.20s |  So I went through the process,
524.20s - 525.84s |  talked to LockBit on Talks,
525.84s - 527.76s |  he asked me a bunch of technical questions,
527.76s - 529.92s |  now this was my puppet, to be clear,
529.92s - 531.88s |  asked me a bunch of technical questions,
531.88s - 533.88s |  wanted to know who I knew,
533.88s - 536.28s |  what ransomware groups I was affiliated with,
536.28s - 539.24s |  and I had a puppet, I had hijacked another account,
539.24s - 541.92s |  I had somebody that people would vouch for,
541.92s - 543.64s |  but I hadn't committed enough crimes
543.96s - 545.92s |  for his ransomware operations,
545.92s - 548.84s |  so didn't get in, again, knew that,
548.84s - 551.40s |  but something unexpected happened.
551.40s - 554.00s |  You know, with Talks, you have to sort of approve the access
554.00s - 555.80s |  in order to be able to have those conversations
555.80s - 557.00s |  and be in that channel.
558.20s - 560.76s |  After he did not let me into the group,
560.76s - 561.68s |  he kept that open,
561.68s - 564.92s |  he kept that line of communication open.
564.92s - 567.82s |  So what I quickly realized was, this is great,
567.82s - 569.36s |  I can talk to this dude every day now,
569.36s - 571.90s |  if he'll respond to me,
571.90s - 575.82s |  so I did that, and I tried to have conversations with him,
575.82s - 578.30s |  and I acted like I was an upcoming hacker
578.30s - 580.54s |  who looked at him like a mentor
580.54s - 583.94s |  and was asking questions to get better at what I did
583.94s - 586.18s |  and pretended that I was trying to join these other groups
586.18s - 588.06s |  and what he thought and how I should approach them
588.06s - 589.06s |  and things like that,
589.06s - 592.70s |  and he was really receptive to that sort of treatment
592.70s - 594.70s |  of him being this idol in me looking,
594.70s - 596.66s |  or my puppet looking up to him,
596.66s - 597.98s |  and that was pretty effective,
597.98s - 599.98s |  and that's where I got a lot of the intel
600.18s - 603.38s |  that you see in the first volume of the Ransomware Diaries,
603.38s - 606.30s |  but once I got through all of this,
606.30s - 609.70s |  the best part was because LockBit was still talking to me,
609.70s - 611.66s |  he let me play with his toys,
611.66s - 613.40s |  and that was pretty fucking awesome
613.40s - 617.38s |  because LockBit 3.0 did not exist at the time,
617.38s - 620.46s |  he shared some of these pictures with me,
620.46s - 622.94s |  he shared some with VXUnderground and a couple people,
622.94s - 625.72s |  but this was like January, February, 2022,
625.72s - 628.30s |  this didn't come out to be used in attacks
628.30s - 630.50s |  until June of 2022,
630.50s - 631.66s |  so getting to see this,
631.66s - 634.34s |  it allowed me to compare it to the previous panel
634.34s - 637.54s |  and identify what new capabilities we were gonna see.
637.54s - 638.62s |  Now this was significant,
638.62s - 640.36s |  everybody knows how this story ends,
640.36s - 642.64s |  LockBit made a lot of the attacks
642.64s - 645.10s |  that previously required technical expertise
645.10s - 646.62s |  and hands-on keyboard,
646.62s - 648.26s |  he made a lot of those automated.
648.26s - 649.70s |  Seeing that that was coming,
649.70s - 651.78s |  I knew attacks were gonna be quicker,
651.78s - 653.22s |  there was gonna be a higher volume,
653.22s - 656.44s |  and LockBit was gonna move up to the top of the ranks
656.48s - 658.52s |  as far as attack volume,
658.52s - 663.40s |  and that's exactly what happened starting in June of 2022,
663.40s - 665.64s |  but if I hadn't got in there and done all that bullshit
665.64s - 667.80s |  and pretended to be someone else and been friends with him,
667.80s - 669.16s |  I never would have got to see this,
669.16s - 673.16s |  so that was very helpful in this operation.
674.68s - 677.44s |  And then everything has to come to an end,
677.44s - 679.76s |  I wrote up everything that I found,
679.76s - 681.40s |  I exposed him publicly,
681.40s - 683.36s |  and being the smart guy that I am,
683.36s - 685.24s |  I put my name and face on my work,
687.20s - 689.44s |  made for an interesting week, I assure you,
690.64s - 692.28s |  but when you do things like that,
692.28s - 693.96s |  you gotta ask yourself,
693.96s - 695.32s |  are these guys gonna be pissed,
695.32s - 697.52s |  are they gonna be upset?
697.52s - 699.20s |  Either way, I knew those sock puppets
699.20s - 701.84s |  that I spent all that time crafting,
701.84s - 702.80s |  I knew they were burnt,
702.80s - 706.28s |  so this was supposed to be the end of the story,
706.28s - 707.76s |  but it wasn't.
707.76s - 710.60s |  So I asked Azeem from Cisco Talos,
710.60s - 711.72s |  a researcher that I'm friends with,
711.72s - 715.40s |  I asked him to ask LockBit what he thought of my work,
715.40s - 717.08s |  and he did that,
717.08s - 721.44s |  and LockBit says, of course I read it,
721.44s - 723.56s |  I was hoping that there would be a photo
723.56s - 725.40s |  of my yacht, girls, and marijuana.
725.40s - 728.52s |  Now, this is important, this is funny,
728.52s - 730.92s |  the guy that I know is not the guy
730.92s - 733.92s |  that we all see on these forums,
733.92s - 736.92s |  the guy in the forums is like Tony Montana from Scarface,
736.92s - 738.60s |  I think LockBit saw these movies
738.60s - 740.60s |  and just decided he needed to be this badass
740.60s - 742.40s |  and portray himself that way,
742.40s - 745.40s |  because the guy I know, yeah, he loves money,
745.40s - 747.52s |  but he's not flashy.
747.52s - 750.32s |  This is a guy who is more to himself,
750.32s - 753.52s |  more about gardening than yachts.
753.52s - 756.36s |  Okay, so I found it funny
756.36s - 758.56s |  the way he portrayed himself to other people.
758.56s - 760.12s |  And then, of course, he called me Johnny,
760.12s - 761.52s |  which nobody used to call me,
761.52s - 762.80s |  but ever since he started doing it,
762.80s - 764.76s |  it's become the new cool,
764.76s - 766.96s |  it seems that's now what all the criminals like to call me,
766.96s - 769.20s |  so I guess there's worse things to be called.
770.12s - 771.88s |  But knowing what he thought of my work,
771.88s - 774.36s |  which is still kind of a bullshit answer,
774.36s - 776.56s |  I wanted to know what he thought about me.
776.56s - 778.48s |  Well, I didn't have to wait very long.
780.12s - 784.12s |  A few days later, LockBit updated his profile
784.12s - 787.64s |  on one of those forums that I've mentioned that I was on.
787.64s - 790.08s |  Now, you know, he went to my LinkedIn profile,
790.08s - 791.04s |  he took my headshot,
791.04s - 793.64s |  and I remember logging in and seeing this,
793.64s - 797.16s |  and it was, it was a no shit, you know,
797.16s - 799.28s |  asshole fucker moment, I'm not gonna lie.
799.28s - 801.80s |  It was like milliseconds, but it was like in slow motion,
802.56s - 803.88s |  it was like, did I somehow do this?
803.88s - 805.56s |  Like, how is this on here?
805.56s - 808.52s |  And then it clicked, oh my God, this dude's using my face.
809.60s - 812.20s |  I thought it was maybe a threat at first.
812.20s - 813.04s |  It wasn't.
813.04s - 815.60s |  What I've learned about the Russian hacking culture,
815.60s - 817.96s |  it's very different than the US hacking culture.
817.96s - 820.88s |  It kind of reminds me, let me use this analogy,
820.88s - 822.48s |  if you guys have seen like the Godfather movies
822.48s - 824.84s |  back in the day, the Italian mob,
824.84s - 826.12s |  they did bad things to each other,
826.12s - 828.04s |  but there was sort of this respect,
828.04s - 829.48s |  and there were guidelines.
829.48s - 830.48s |  They might kill you,
830.48s - 833.32s |  but they're not gonna kill your kid or your wife.
833.32s - 834.84s |  You know, we got street gangs today,
834.84s - 836.60s |  they'll kill women, children, it doesn't matter,
836.60s - 838.48s |  you piss them off, they're gonna come after you.
838.48s - 840.96s |  Well, the Russian hacking culture is not like that.
840.96s - 843.52s |  There is still a base level of respect
843.52s - 845.52s |  amongst one another in things they do.
845.52s - 849.08s |  LockBit looked at it like, hey, you got me, motherfucker.
849.08s - 850.52s |  Good on ya, respect.
850.52s - 852.88s |  And I can appreciate that.
852.88s - 854.36s |  So that's what this was.
854.36s - 857.92s |  So thankfully, it wasn't a threat like I had first thought.
857.92s - 859.24s |  But it made for an interesting few days.
860.00s - 860.96s |  And he kept this on there
860.96s - 863.48s |  until the account got banned this year.
863.48s - 866.94s |  So it was there for a long time.
866.94s - 869.94s |  So I figured if he likes me or respected my work,
869.94s - 872.22s |  maybe we could still talk, you know?
872.22s - 874.30s |  Maybe we could still hang out.
874.30s - 877.74s |  So I said, hey, man, you know, I just wrote about you.
877.74s - 879.22s |  You know who I am?
879.22s - 880.18s |  Let's talk.
880.18s - 882.78s |  And I still thought he might tell me to fuck off
882.78s - 885.42s |  because direct messages are very different
885.42s - 889.86s |  than how you tell people, perceive people publicly.
889.86s - 891.02s |  But I didn't know what to expect,
891.02s - 892.74s |  but I sure shit didn't expect him to tell me
892.74s - 895.30s |  that he loved me and that I was the best researcher.
896.38s - 897.82s |  That made me laugh.
897.82s - 900.30s |  And, you know, I'm actually not showing stuff like this
900.30s - 901.38s |  to embarrass the dude.
901.38s - 902.46s |  I'm showing this to you guys
902.46s - 905.10s |  because he is a human being just like you and me.
905.10s - 908.58s |  And I legitimately did like a version of him
908.58s - 910.02s |  for a while anyway.
911.22s - 912.10s |  And you can't help that.
912.10s - 913.38s |  You know, you do human engagements.
913.38s - 914.94s |  You can't help how you feel about somebody.
914.94s - 916.34s |  You may not like what they do.
916.34s - 918.38s |  You've got an objective and a mission.
918.38s - 920.94s |  You do that, but you can't help how you feel about it.
920.94s - 922.82s |  But it was cool that the dude liked me back
922.82s - 923.78s |  and seemed to respect me.
923.78s - 925.50s |  I really didn't expect it to go the way,
925.50s - 927.26s |  but this shit made me laugh when I read it.
927.26s - 928.82s |  I was like, what the fuck, man?
930.50s - 933.38s |  So going back to this whole thing
933.38s - 934.94s |  where I really wanted him to like me
934.94s - 939.94s |  and my wooing of LockBit, you know, I asked him questions.
940.34s - 942.38s |  I knew he wasn't gonna tell me a lot,
942.38s - 943.54s |  but I asked him about what he did
943.54s - 944.98s |  before he was in LockBit.
944.98s - 946.94s |  And I'm just showing this part of the conversation
946.98s - 948.34s |  because it's kind of interesting.
948.34s - 949.82s |  You know, he told me that he basically
949.82s - 952.22s |  always wanted to be a cyber criminal.
952.22s - 953.86s |  So he started learning OPSEC
953.86s - 955.78s |  long before he committed crimes.
955.78s - 957.94s |  That way, when he became a criminal,
957.94s - 961.62s |  he didn't have to worry about the FBI arresting him.
961.62s - 963.06s |  Really hasn't worked out that well.
963.06s - 964.86s |  Not arrested, but they clearly
964.86s - 967.26s |  have gotten a lot closer to him.
967.26s - 968.78s |  But I thought this was interesting,
968.78s - 972.14s |  especially now that I know more about him and his past.
973.38s - 975.42s |  So the next thing I needed to do
975.46s - 977.02s |  was I needed to send him gifts.
977.02s - 978.78s |  I mean, if we're gonna go out and date,
978.78s - 981.06s |  you know, I gotta send him some gifts.
981.06s - 983.30s |  And again, this picture,
983.30s - 984.62s |  let me break this down for you guys
984.62s - 986.26s |  because it may not seem like much,
986.26s - 989.94s |  but from an operational standpoint,
989.94s - 991.22s |  this is in my office.
991.22s - 992.54s |  I'm not blurring the background.
992.54s - 993.62s |  I'm showing me.
993.62s - 995.18s |  He knows my book is something
995.18s - 997.38s |  I put a lot of work into that was important.
997.38s - 999.14s |  And this note's handwritten.
999.14s - 999.98s |  I signed it.
999.98s - 1001.62s |  It's got the date.
1001.62s - 1003.34s |  Before I took this picture, I asked him,
1003.34s - 1006.38s |  I said, hey man, I just need your real world name
1006.38s - 1007.66s |  and your home address.
1007.66s - 1009.54s |  I'm gonna send you this awesome gift.
1009.54s - 1011.74s |  And he, I did.
1011.74s - 1014.38s |  And he laughed and, you know, he said to me,
1014.38s - 1015.90s |  yeah, Johnny, I can't do that.
1015.90s - 1018.38s |  If I do that, you're gonna get me arrested.
1018.38s - 1021.42s |  But I'm sharing that because this was very much
1021.42s - 1024.30s |  a cat and mouse chase relationship.
1024.30s - 1027.82s |  And he enjoyed this as much as I did.
1027.82s - 1031.98s |  There's a, I mean, I wrote over 400 pages of content
1032.18s - 1033.98s |  about this dude in the past two years
1033.98s - 1036.74s |  amongst all the Ransomware Diaries volumes.
1036.74s - 1038.62s |  Every time something would come out, he'd get pissed,
1038.62s - 1039.86s |  but he'd always come back
1039.86s - 1042.50s |  because he loved the game as much as I did.
1043.50s - 1045.42s |  And I was obsessed with this motherfucker.
1045.42s - 1046.26s |  I'm not gonna lie.
1046.26s - 1048.34s |  Like, this is where I spent every waking moment
1048.34s - 1049.22s |  was doing this stuff.
1049.22s - 1051.58s |  Like, I really, really was obsessed.
1051.58s - 1052.98s |  But back to this picture.
1052.98s - 1054.62s |  There's the most important part of it
1054.62s - 1056.30s |  that I want you guys to pay attention to
1056.30s - 1060.18s |  is this seductive look in my eyes.
1060.30s - 1064.42s |  That was not an accident, okay?
1064.42s - 1067.38s |  I sent him that picture and he responded,
1067.38s - 1068.70s |  thank you for the photo.
1068.70s - 1070.30s |  You're a very handsome man, right?
1070.30s - 1071.78s |  Yeah, yeah.
1071.78s - 1074.46s |  You look like Bruce Willis and Chuck Norris.
1076.30s - 1078.42s |  I see Chuck, you know, the hair.
1078.42s - 1079.30s |  I don't know about Bruce,
1079.30s - 1081.50s |  but you guys tell me what you think.
1084.82s - 1086.46s |  It was crazy, this was a crazy experience
1086.46s - 1087.30s |  I had with this dude, man.
1087.30s - 1089.26s |  I'll never have a story like this in the rest of my career,
1089.26s - 1091.86s |  but this was what happened.
1091.86s - 1093.50s |  You know, we were cool with each other, we were joking.
1093.50s - 1096.10s |  You know, this wasn't a thing where he's like,
1096.10s - 1097.26s |  oh, you're hot type of thing.
1097.26s - 1098.42s |  I'm making that a joke.
1098.42s - 1100.42s |  But we were just shooting the shit, you know?
1100.42s - 1101.54s |  We were just cool with each other.
1101.54s - 1106.10s |  But all of those things built up to the output
1106.10s - 1107.70s |  of all that information over the years
1107.70s - 1108.98s |  that I've put out on LockBit
1108.98s - 1111.50s |  and nobody's just ever gotten to see this stuff.
1112.74s - 1115.78s |  So after that, we went on our first date.
1115.78s - 1118.10s |  So LockBit and I had the opportunity
1118.10s - 1119.70s |  to go on this show Trafficked
1119.70s - 1122.94s |  and got them to agree to it.
1122.94s - 1126.38s |  And it took about six months to produce this show
1126.38s - 1127.42s |  from where they started
1127.42s - 1129.46s |  to when it was actually put on the air.
1129.46s - 1131.86s |  And that was important because it gave us stuff
1131.86s - 1134.10s |  to talk about and to bond
1134.10s - 1137.14s |  that was not related to their criminal operation.
1137.14s - 1138.66s |  If all I do is ask this dude
1138.66s - 1140.22s |  about stuff with his criminal operation,
1140.22s - 1142.46s |  this would have been a pretty short relationship.
1142.46s - 1145.54s |  And there's only so much content you can have
1145.54s - 1147.02s |  outside of the crimes.
1147.02s - 1149.50s |  So this gave us lots of stuff to talk to.
1149.50s - 1150.58s |  We were both pretty upset.
1150.58s - 1152.78s |  We spent all this time working with these people
1152.78s - 1155.14s |  and we actually got about two minutes on the show.
1155.14s - 1156.94s |  Him too, not just me.
1156.94s - 1158.94s |  Anyway, it gave us something to bitch about.
1158.94s - 1159.98s |  But it was good
1159.98s - 1161.90s |  because we really sort of formed this bond.
1161.90s - 1164.06s |  And our relationship got strong
1164.06s - 1166.02s |  and we were talking so much
1166.02s - 1167.98s |  that I couldn't go on vacation
1167.98s - 1170.10s |  without bringing my second laptop
1170.10s - 1172.34s |  to have conversations with this dude.
1172.34s - 1175.10s |  And I can't be like, hey, it's after 5 p.m. dude
1175.14s - 1178.58s |  or hey, it's a Saturday, I'm off, I'm not gonna talk
1178.58s - 1181.30s |  because this is supposed to be a real relationship.
1181.30s - 1183.10s |  I'm supposed to really be his friend.
1183.10s - 1186.30s |  So again, and when I say this was an obsession,
1186.30s - 1188.30s |  I really mean this was an obsession for me.
1188.30s - 1191.02s |  I really got, I lived for this work.
1191.02s - 1193.82s |  I wanted this dude, I wanted to get this dude.
1193.82s - 1196.02s |  So it took over my life.
1196.02s - 1198.26s |  It took time away from my family.
1198.26s - 1201.50s |  It was not healthy, but it's what I chose to do.
1201.50s - 1204.06s |  And it was very effective,
1204.06s - 1205.70s |  but it was very time consuming.
1205.70s - 1208.62s |  And I needed to take a step back from it.
1208.62s - 1212.26s |  And things started to get awkward between us.
1212.26s - 1214.26s |  And the reason it got awkward is,
1214.26s - 1217.30s |  and it's not so much, this is just one example of many,
1217.30s - 1219.54s |  but LockBit on the forums
1219.54s - 1222.66s |  is extremely confrontational and dramatic.
1223.58s - 1224.86s |  So, and this is just an example.
1224.86s - 1227.10s |  He's talking to Batty, who's one of the leads
1227.10s - 1229.58s |  for what was Royal Ransomware
1229.58s - 1231.46s |  at the time of this conversation.
1231.46s - 1233.42s |  He was trying to get into their panel.
1233.46s - 1235.18s |  He wanted to take their builder.
1235.18s - 1236.38s |  Batty was pissed and was like,
1236.38s - 1239.70s |  why are you trying to get my guys to give you access?
1239.70s - 1242.30s |  LockBit's accusing of being in the FSB.
1242.30s - 1244.02s |  He's always getting into these heated arguments,
1244.02s - 1246.34s |  but he's doing it, at least on this particular forum,
1246.34s - 1247.42s |  with my face.
1247.42s - 1249.10s |  So you've got all these criminals.
1249.10s - 1251.54s |  You've probably got the FSB out there looking at stuff
1251.54s - 1254.18s |  and somebody's gonna ask, who the fuck is this guy?
1256.18s - 1258.50s |  So I needed things to take a step back
1258.50s - 1261.46s |  and I needed to find a way to do that gracefully
1261.46s - 1262.62s |  and with style.
1262.66s - 1265.22s |  So, I started the motherfucker.
1267.22s - 1268.50s |  I actually did this.
1268.50s - 1270.02s |  I knew, he knew me, I knew him.
1270.02s - 1271.58s |  I knew he'd know I was fucking with him
1271.58s - 1273.34s |  or I thought he'd know I was fucking with him.
1273.34s - 1275.06s |  So I made this post.
1275.06s - 1278.02s |  I made myself the bad guy, JohnBit3.0.
1278.02s - 1279.74s |  I made him the victim
1279.74s - 1281.94s |  and I put in there LockBit Ransomware Gang
1281.94s - 1285.22s |  being a pain in my ass since September 3rd, 2019
1285.22s - 1287.38s |  and told him if he didn't pay me $10 million,
1287.38s - 1289.10s |  I was gonna release his secrets.
1289.10s - 1290.78s |  Now, that was just the fucking report.
1290.78s - 1293.22s |  It was the Ransomware Diaries called LockBit Secrets.
1293.22s - 1294.38s |  Yes, there were secrets.
1294.38s - 1297.26s |  They were like stuff he'd lied to his business partners about
1297.26s - 1298.90s |  and problems in his operation
1298.90s - 1300.02s |  that he didn't want people to know
1300.02s - 1302.18s |  but nobody was paying $10 million.
1302.18s - 1303.14s |  It was a joke.
1303.14s - 1305.46s |  But to make sure he took me seriously,
1305.46s - 1307.34s |  I posted this the next day.
1307.34s - 1308.18s |  All right?
1312.26s - 1314.98s |  Now, I went to go talk to him about it
1314.98s - 1318.18s |  to see what he would say when I didn't hear from him
1318.18s - 1319.90s |  but something interesting happened.
1319.90s - 1321.66s |  He went offline.
1321.66s - 1323.06s |  I thought he blocked me.
1323.06s - 1325.06s |  He didn't, nobody could access him
1325.06s - 1326.18s |  and it was both his accounts,
1326.18s - 1329.02s |  his support account and his private account were offline
1329.02s - 1331.30s |  and then I started getting messages from his affiliates
1331.30s - 1332.74s |  and from security researchers too
1332.74s - 1336.22s |  but the important part of that is the affiliates
1336.22s - 1338.58s |  saying, you know, he's been offline.
1338.58s - 1339.74s |  We're beginning to worry.
1339.74s - 1341.78s |  We think he's in prison or dead.
1341.78s - 1343.14s |  Are you part of this?
1344.86s - 1347.14s |  Look guys, that's cool you think I'm like,
1347.14s - 1348.66s |  you know, that effective
1348.66s - 1350.50s |  but I'm not kicking anybody's door in.
1350.50s - 1352.22s |  I'm not jumping out of planes in Russia
1352.22s - 1353.70s |  and pulling you out in the middle of the night.
1353.70s - 1355.78s |  You know, I was just fucking around.
1355.78s - 1356.62s |  It was a post.
1356.62s - 1359.34s |  I couldn't believe that people were believing this.
1359.34s - 1360.66s |  This is another one.
1360.66s - 1361.50s |  Bastard Lord, you know,
1361.50s - 1363.10s |  you actually found a way to de-anonymize
1363.10s - 1364.06s |  everyone from LockBit.
1364.06s - 1367.02s |  Like guys, I wish I was a badass hacker to that level.
1367.02s - 1368.70s |  Like, you know, I can fuck around a little bit
1368.70s - 1370.78s |  but damn, no, no, this was a joke.
1370.78s - 1373.38s |  I wouldn't have used Twitter to do it if it was real.
1375.10s - 1377.46s |  But I found out why.
1377.46s - 1380.34s |  I got this DM with this image
1380.34s - 1382.06s |  and I cut off the top of this
1382.06s - 1383.66s |  because it had the URL.
1383.66s - 1385.82s |  But anyway, it was to the admin page
1385.82s - 1387.86s |  and it said, it was the old URL.
1387.86s - 1390.10s |  But anyway, it said, do we really have to?
1390.10s - 1392.62s |  And it was referencing the authentication
1392.62s - 1394.54s |  part of the page for the panel.
1394.54s - 1395.78s |  So obviously it insinuates, okay,
1395.78s - 1397.94s |  we bypassed it and we got in.
1397.94s - 1399.50s |  Now things were making sense.
1399.50s - 1401.02s |  I threatened the dude.
1401.02s - 1404.30s |  He finds out somebody's really trying to hack him.
1404.34s - 1407.42s |  He starts to believe maybe I actually did
1407.42s - 1409.26s |  and thinks that I'm in his, in his,
1409.26s - 1411.70s |  in his infrastructure fucking around.
1411.70s - 1413.86s |  I found out pretty quickly what happened.
1413.86s - 1415.78s |  Thank you, ProDaft.
1415.78s - 1416.90s |  They actually did an op
1416.90s - 1419.22s |  and apparently they're the ones who hacked him.
1419.22s - 1422.14s |  I was just there, good timing to, to,
1422.14s - 1426.30s |  to make that threat and, and, and fit into that situation.
1426.30s - 1427.78s |  But it made for fun.
1427.78s - 1429.34s |  It made for, that happened last summer
1429.34s - 1432.14s |  and that made for a really fun DEF CON for me, trust me.
1432.18s - 1436.54s |  Uh, so after that, uh, LockBit did come back
1436.54s - 1437.82s |  about two weeks later.
1437.82s - 1440.46s |  Uh, you know, we hugged it out, we were good,
1440.46s - 1443.18s |  but things were off still, all right?
1443.18s - 1445.66s |  This is how I know things were off.
1445.66s - 1448.90s |  I said, sorry, um, told him I'm glad he wasn't dead
1448.90s - 1450.54s |  or anything like that.
1450.54s - 1452.70s |  He didn't send me a cat emoji.
1452.70s - 1455.38s |  He always sent me cat emojis and stickers.
1455.38s - 1457.02s |  This is a very passive aggressive way
1457.02s - 1458.70s |  of him telling me that he's mad at me.
1458.70s - 1462.30s |  Uh, but, and our conversation started to dwindle
1462.30s - 1465.42s |  and, um, it didn't take long.
1465.42s - 1468.30s |  He was having an emotional relationship with someone else.
1468.30s - 1469.78s |  He was.
1469.78s - 1471.98s |  Uh, I drove by his house one night,
1471.98s - 1475.06s |  by his house I mean his, uh, his infrastructure.
1475.06s - 1477.42s |  And this new bitch left their shit all over.
1477.42s - 1480.46s |  The hairbrush was on the kitchen sink, okay?
1480.46s - 1481.92s |  Their hair tie is on the door.
1481.92s - 1484.34s |  They wanted me to know they had been there.
1484.34s - 1488.66s |  Uh, so the NCA had locked down LockBit's infrastructure,
1488.66s - 1491.86s |  um, put their shit up everywhere.
1491.86s - 1494.90s |  So, you know, I was upset and I didn't like that.
1494.90s - 1498.14s |  Uh, but then when, when you go to log into the panel,
1498.14s - 1500.14s |  there's this new message and it's basically saying,
1500.14s - 1504.06s |  hey, uh, we, we've got all of your, your chat logs.
1504.06s - 1507.14s |  We know what victims you're responsible for
1507.14s - 1508.68s |  and we've got your wallets.
1508.68s - 1513.68s |  Now, this is meant for criminals to see and they did.
1513.88s - 1516.52s |  And it was meant to play a psychological role
1516.52s - 1517.80s |  and it certainly did.
1517.80s - 1518.88s |  But you guys got to remember,
1518.88s - 1521.80s |  they're also looking at my conversations.
1521.80s - 1522.64s |  They're looking at all the,
1522.64s - 1524.04s |  all the conversations that I'm having.
1524.04s - 1525.98s |  They're probably seeing my account in there
1525.98s - 1526.82s |  and everything else.
1526.82s - 1528.56s |  So, um, that was a little bit like,
1528.56s - 1530.28s |  oh boy, I might be in some trouble here.
1530.28s - 1533.96s |  Uh, but again, they were fucking with my man.
1533.96s - 1534.84s |  So I was upset.
1535.84s - 1538.06s |  Uh, but LockBit wasn't going to go down, uh,
1538.06s - 1538.90s |  without swinging.
1538.90s - 1540.56s |  I knew he wasn't going to rebrand.
1540.56s - 1543.80s |  He stood a new, his new, uh, infrastructure up,
1543.80s - 1546.56s |  made, made the FBI his first victim.
1546.56s - 1547.68s |  But when you click on it,
1547.68s - 1550.56s |  he's got like this three page long ass letter
1550.56s - 1552.78s |  that nobody wants to fucking read about what happened.
1552.78s - 1554.48s |  Basically saying he got fat and lazy
1554.48s - 1557.92s |  and forgot to upgrade some stuff and they came in
1557.92s - 1559.88s |  and it wouldn't happen again.
1559.88s - 1562.04s |  And that business would continue as usual.
1563.12s - 1566.86s |  Um, but like I said, our relationship was now affected.
1566.86s - 1571.46s |  And like all things, um, you know,
1571.46s - 1572.50s |  they do come to an end.
1572.50s - 1574.02s |  And, and hitting pause on the jokes,
1574.02s - 1575.54s |  like we really did have a relationship
1575.54s - 1577.18s |  and it really did have ups and downs.
1577.18s - 1579.14s |  I, I'm just kind of adding some,
1579.14s - 1581.94s |  some theatrics to it to make it a, a fun talk.
1581.94s - 1584.54s |  But, but we really did have this, this long-term,
1584.54s - 1587.30s |  this was like over two years, this long-term relationship.
1587.30s - 1590.94s |  Um, and I did actually get to like the guy a little bit
1590.94s - 1592.02s |  and then this happened
1592.02s - 1594.82s |  and this got me really, really upset.
1594.86s - 1597.70s |  Uh, so LockBit hit St. Anthony's Hospital
1597.70s - 1599.38s |  and I'm talking to him about it.
1599.38s - 1602.22s |  And I truly believed that I could get him
1602.22s - 1603.74s |  to give them decryption key.
1603.74s - 1606.66s |  And the reason I believe that is because, you know,
1606.66s - 1610.10s |  sick kids, which, uh, it deals with, with kids with cancer,
1610.10s - 1613.34s |  um, he did the right thing and, and gave the key back to them.
1613.34s - 1614.78s |  Well, St. Anthony's Hospital
1614.78s - 1617.30s |  has a large children's cancer ward.
1618.18s - 1620.78s |  So I talked to him about it and I said, look, man, uh,
1620.78s - 1621.62s |  give them back the key.
1621.62s - 1622.78s |  You've still got their data.
1622.78s - 1624.62s |  If you're going to extort them, you're going to extort them.
1624.62s - 1626.94s |  You know, you're greedy, but you're not a monster.
1626.94s - 1627.94s |  Just do the right thing.
1627.94s - 1629.82s |  And he wouldn't do it and kept telling me, you know,
1629.82s - 1632.30s |  when he, he, when I saw the data, I'd understand.
1632.30s - 1633.70s |  Well, unless you're going to show me
1633.70s - 1636.58s |  that they hired a bunch of kids to pretend they had cancer,
1636.58s - 1637.78s |  I'm not going to change my mind.
1637.78s - 1639.34s |  I don't give a shit what they do with their money.
1639.34s - 1641.70s |  Like these are kids suffering.
1641.70s - 1643.86s |  And, uh, I started to realize, you know,
1643.86s - 1645.62s |  I'd gotten too close to this.
1645.62s - 1647.50s |  You know, this guy's a fucking cockroach.
1647.50s - 1649.58s |  Anybody that fucks with kids, like, I mean,
1649.58s - 1651.90s |  I, I guess I got too close cause I, I didn't see it.
1651.90s - 1653.58s |  And I, I naively believed I'd get,
1653.58s - 1655.30s |  I could get him to give the key back.
1655.30s - 1658.42s |  Um, and I couldn't, and I sat there for,
1658.42s - 1660.50s |  I was in my office and I sat there for a good hour
1660.50s - 1662.06s |  and I typed this message up,
1662.06s - 1663.42s |  telling him to go fuck himself,
1663.42s - 1665.18s |  telling him that I was coming for him.
1665.18s - 1667.74s |  Think I even had the fucking taking quotes in there.
1667.74s - 1670.86s |  Uh, but if you do this type of work,
1670.86s - 1672.50s |  there's some rules that you have to play by.
1672.50s - 1674.10s |  And that's that you never let your emotions
1674.10s - 1675.30s |  affect what you do.
1675.30s - 1677.06s |  And the day that I do let that happen
1677.06s - 1678.30s |  is the day that I need to go back
1678.30s - 1682.10s |  to being a CTI straight zeros and ones researcher.
1682.10s - 1684.54s |  Um, so I didn't, I didn't click send on that.
1684.54s - 1688.46s |  Instead, I, I just sent a thumbs up and, and I regrouped.
1688.46s - 1690.42s |  But I was, I, I was legitimately,
1690.42s - 1692.18s |  personally like affected by this.
1692.18s - 1694.46s |  Like it really, really bothered me.
1694.46s - 1697.38s |  And, you know, making things worse.
1697.38s - 1700.06s |  Um, I know I kind of catfished him
1700.06s - 1701.90s |  at the beginning with sock puppets,
1701.90s - 1704.26s |  but you know, Lockwood had told me that,
1704.26s - 1706.26s |  you know, he lived in New York.
1706.26s - 1707.70s |  Sounds legitimate, right?
1707.70s - 1709.86s |  Uh, he told me he owned two restaurants
1709.90s - 1713.06s |  and he told me he drove a Ferrari.
1713.06s - 1717.30s |  And now that me and the other man were talking,
1717.30s - 1720.02s |  uh, apparently he didn't live in the United States.
1720.02s - 1722.18s |  Uh, obviously I knew he lives in Russia.
1722.18s - 1723.42s |  I'm being facetious,
1723.42s - 1725.06s |  but they said he didn't drive a Lamborghini
1725.06s - 1726.38s |  and he drives a Mercedes.
1726.38s - 1727.66s |  Now I was pissed.
1727.66s - 1729.70s |  Do I look like I'm going to fuck around
1729.70s - 1732.06s |  with some dude that's picking me up in a Mercedes?
1732.06s - 1733.02s |  That shit better be,
1733.02s - 1735.30s |  you better be rolling up in at least a quarter mil.
1735.30s - 1736.98s |  I want a Bugatti something.
1736.98s - 1738.26s |  I'm not fucking riding around
1738.26s - 1739.58s |  with some dude in a Mercedes.
1739.58s - 1740.66s |  Get the fuck out of here.
1740.66s - 1742.10s |  That shit's a dime a dozen.
1742.10s - 1743.06s |  So I was upset.
1743.06s - 1744.46s |  I didn't like being lied to.
1744.46s - 1748.22s |  So, now shit was, was gonna, was up.
1748.22s - 1750.58s |  You know, we, he had both me pissed,
1750.58s - 1752.38s |  he had law enforcement pissed,
1752.38s - 1754.22s |  and, and I really did want to get him.
1754.22s - 1755.38s |  Now that he fucked with kids,
1755.38s - 1757.38s |  like, like before I was just fucking around.
1757.38s - 1758.78s |  I wanted to get shit so I could write,
1758.78s - 1760.06s |  you know, interesting stories.
1760.06s - 1762.42s |  As I said, I love telling stories and I love writing.
1762.42s - 1764.42s |  But now I was like, it was, it was personal.
1764.42s - 1766.46s |  Like I wanted to get this guy.
1766.46s - 1768.54s |  Uh, so that shit was on.
1768.58s - 1771.98s |  And I was reaching out to, to all my resources.
1771.98s - 1774.78s |  Now remember, I built a vast network of,
1774.78s - 1776.42s |  of relationships with criminals,
1776.42s - 1779.38s |  with affiliates, and with security researchers.
1779.38s - 1781.42s |  And I mean, I'm calling in favors
1781.42s - 1783.74s |  and I'm, I'm, I'm using myself
1783.74s - 1786.70s |  and I'm using also sock puppets all at the same time.
1786.70s - 1788.38s |  And I'm trying to extract data
1788.38s - 1789.90s |  and, and trying to do everything I can
1789.90s - 1791.74s |  to figure out who this dude is.
1791.74s - 1794.74s |  And LockBin knew what I was doing at this point.
1794.74s - 1796.54s |  He started hearing the rumors, you know,
1796.54s - 1798.70s |  that I was asking all these questions.
1798.70s - 1801.06s |  Um, and I often get tips from people.
1801.06s - 1802.98s |  I'll be honest, before the Ransomware Diaries,
1802.98s - 1804.82s |  there were probably like 10 of you to who I was,
1804.82s - 1807.62s |  uh, unless you were into nation state work.
1807.62s - 1810.54s |  Um, but, but once the Ransomware Diaries kicked off,
1810.54s - 1812.58s |  uh, you know, it was like being the hot new kid,
1812.58s - 1815.02s |  like a hot new, new, new girl at school.
1815.02s - 1816.50s |  Like I was getting a lot of attention.
1816.50s - 1819.14s |  So I get tips a lot, but often they're bullshit.
1819.14s - 1820.78s |  So I wasn't exactly sure,
1820.78s - 1823.90s |  but I got one saying that follow this email address,
1823.94s - 1828.26s |  sitedev5index.ru, and you will find that person
1828.26s - 1831.62s |  is the guy behind the LockBitSup persona.
1831.62s - 1833.18s |  Um, so I started to look into it,
1833.18s - 1835.86s |  but this guy owned two legitimate businesses.
1835.86s - 1838.14s |  He owned a handful of websites.
1838.14s - 1840.42s |  Every one of them were legitimate businesses.
1840.42s - 1843.46s |  So I almost thought this was, was, was,
1843.46s - 1845.42s |  was bullshit and walked away.
1845.42s - 1847.18s |  And then I saw this.
1847.18s - 1849.26s |  Now, most of you have seen this, but you gotta remember,
1849.26s - 1851.42s |  this was before the indictment
1851.42s - 1853.10s |  and all that other shit that's taken place in the,
1853.10s - 1854.10s |  in real world.
1854.10s - 1855.46s |  This was before all of that.
1855.46s - 1858.18s |  So I saw this and I remember that the, uh,
1858.18s - 1860.58s |  the NCA had said, you know, he drove a Mercedes.
1860.58s - 1863.30s |  So when I saw this in combination with that tip,
1863.30s - 1866.10s |  it was just enough to, for me to decide, okay,
1866.10s - 1868.06s |  I need to dig in a little further.
1868.06s - 1869.70s |  I almost walked away right here.
1869.70s - 1871.58s |  And that, again, that would have been the end of the story
1871.58s - 1873.66s |  if I had, um, but I didn't.
1873.66s - 1875.58s |  And it brought me to this guy, uh,
1875.58s - 1878.02s |  Dimitri Horoshevev, if I'm saying that right.
1878.02s - 1880.54s |  Uh, and I found these accounts
1880.54s - 1883.66s |  and they were all related to malicious things.
1883.66s - 1886.34s |  Uh, ransomware, botnets, malware.
1886.34s - 1889.82s |  And one of his accounts was even on the same forum
1889.82s - 1892.62s |  where he now has my, or used to have my picture
1892.62s - 1893.86s |  before he got banned.
1893.86s - 1895.98s |  Um, so there are lots of similarities.
1895.98s - 1898.34s |  Uh, so I, I wasn't sure I had the right guy,
1898.34s - 1899.94s |  but I definitely was interested
1899.94s - 1902.38s |  and was, was continuing to dig on him.
1903.42s - 1906.66s |  So then it was a Sunday and, uh, I got this alert.
1906.66s - 1908.58s |  Most people watch TV.
1908.58s - 1910.02s |  I watch LockBit.
1910.50s - 1912.10s |  Uh, I got this alert to his,
1912.10s - 1914.26s |  that said that the site, the site was up.
1914.26s - 1916.74s |  And remember the site had been taken over by the NCA.
1916.74s - 1918.42s |  He created a new one.
1918.42s - 1920.46s |  And I got this alert saying it was online
1920.46s - 1922.34s |  and I thought it was a false positive.
1922.34s - 1924.98s |  I log in and I see it is online
1924.98s - 1926.70s |  and it's populated with, you know,
1926.70s - 1928.90s |  all this law enforcement propaganda,
1928.90s - 1930.70s |  but I see this who is LockBit sup
1930.70s - 1932.94s |  and it's got a countdown timer.
1932.94s - 1934.18s |  And I go check social media.
1934.18s - 1936.26s |  Like nobody else has said anything about this.
1936.26s - 1937.94s |  And I'm like, can I really be the only person
1937.94s - 1938.86s |  that's seen this?
1938.90s - 1940.14s |  And apparently I was,
1940.14s - 1942.18s |  cause I posted it and people went nuts.
1942.18s - 1945.14s |  Um, but this, this, this was pretty crazy
1945.14s - 1946.54s |  because I'm, now I'm in this position
1946.54s - 1947.62s |  where I'm like, fuck man,
1947.62s - 1949.30s |  I got to put this report together.
1949.30s - 1950.34s |  I might have the right guy.
1950.34s - 1952.18s |  I might not, but if they're going to name him,
1952.18s - 1954.54s |  you know, this is, this is my opportunity.
1954.54s - 1955.94s |  Uh, but I had a problem.
1955.94s - 1957.86s |  I had to get on a plane and fly to RSA.
1957.86s - 1960.98s |  So, um, I couldn't take my research box with me.
1960.98s - 1963.62s |  Um, I remember landing, going to my hotel room
1963.62s - 1965.90s |  and that next 24 hours, I didn't leave.
1965.90s - 1966.74s |  I didn't eat.
1966.74s - 1967.82s |  I didn't order food.
1967.82s - 1970.82s |  I just sat and wrote and I wrote 25 pages of content.
1970.82s - 1972.74s |  Now, remember, I couldn't tell anybody
1972.74s - 1973.94s |  in my company about this.
1973.94s - 1975.70s |  Okay. I didn't, couldn't take the chance
1975.70s - 1978.02s |  that if I had the right guy, it getting leaked.
1978.02s - 1982.38s |  Um, so I wrote it and I sat quietly and I waited.
1982.38s - 1985.78s |  And the next morning, May 7th,
1985.78s - 1987.26s |  they do the identity reveal
1987.26s - 1989.70s |  and it's the same fucking dude.
1989.70s - 1993.54s |  So I was like, there's no way that could be a coincidence.
1993.54s - 1994.86s |  Um, the problem is they didn't release
1994.86s - 1996.34s |  a lot of information about him.
1996.34s - 1997.62s |  You know, there's an email address,
1997.62s - 1999.82s |  some passport numbers and a picture,
1999.82s - 2001.98s |  but there's not a lot of info about him.
2001.98s - 2005.26s |  So I had to wait a little bit
2005.26s - 2007.02s |  cause nobody knew I had to get the web team.
2007.02s - 2008.78s |  I'm like, you gotta get this thing published.
2008.78s - 2010.58s |  Like move, it has to be now.
2010.58s - 2014.66s |  Uh, so an hour later, uh, my first,
2014.66s - 2017.50s |  I helped in doxing the shit out of this motherfucker.
2017.50s - 2018.82s |  I knew where he lived.
2018.82s - 2019.90s |  I had his phone number.
2019.90s - 2022.18s |  You know how hard it was for me to not call this guy?
2022.18s - 2024.30s |  Uh, I had his phone number.
2024.30s - 2025.50s |  I had his email addresses.
2025.50s - 2028.14s |  I even had like the pictures of his apartment building
2028.14s - 2029.58s |  before he rented it out.
2029.58s - 2032.66s |  Um, his door, his pin code from his door,
2032.66s - 2034.18s |  the beautiful multi-ego graph
2034.18s - 2037.54s |  with all this information on him, social media accounts.
2037.54s - 2039.90s |  You know, I knew a lot about his family,
2039.90s - 2041.98s |  though I would never include that in any of this.
2041.98s - 2045.18s |  But my point is, is that, uh, I put all that shit out there
2045.18s - 2047.42s |  and, uh, the one part of the story
2047.42s - 2048.42s |  I didn't share with you guys,
2048.42s - 2050.30s |  I probably wouldn't have done this.
2050.30s - 2053.66s |  The reason that I did this is what I found out
2053.70s - 2055.74s |  when I was really digging into this at the end
2055.74s - 2056.90s |  after the NCA came in,
2056.90s - 2058.70s |  when I was trying to find out who he was,
2058.70s - 2061.18s |  he caught wind of me asking all these questions
2061.18s - 2064.46s |  to the affiliates, um, and some affiliates told me
2064.46s - 2067.54s |  that he was pissed and he was coming after me,
2067.54s - 2069.82s |  um, and that he wanted revenge against me.
2069.82s - 2071.10s |  Um, if that hadn't happened,
2071.10s - 2073.38s |  I probably wouldn't have blown his shit up,
2073.38s - 2075.58s |  but I wanted him to know if he knew where I lived,
2075.58s - 2077.02s |  I knew where he did too.
2077.02s - 2078.26s |  Game on, motherfucker.
2078.26s - 2079.50s |  You know, I wanted to make sure
2079.50s - 2080.94s |  everybody knew where he lived.
2080.94s - 2082.50s |  Uh, he needs to be so busy,
2082.50s - 2084.86s |  he doesn't have time to worry about me, so.
2084.86s - 2088.22s |  Anyway, the perfect ending to the story, however,
2088.22s - 2089.98s |  uh, we couldn't end it here.
2089.98s - 2092.54s |  I needed to say goodbye to him, so I did.
2092.54s - 2095.98s |  I know he reads all my stuff, so I wanted him to know
2095.98s - 2097.82s |  I had too much respect for him
2097.82s - 2099.94s |  to let somebody else do this, and that's true.
2099.94s - 2101.74s |  Uh, all these people that say,
2101.74s - 2104.94s |  oh, well, he has horrible, uh, OSINT practices,
2104.94s - 2106.82s |  uh, it was so easy for- to find him.
2106.82s - 2108.86s |  This guy, you know, it's amateur hour.
2108.86s - 2110.06s |  Okay, these are all people that say that
2110.06s - 2112.34s |  after his name and address and everything else
2112.34s - 2114.98s |  were released, it's really easy to work backwards
2114.98s - 2117.14s |  and be like, oh, yeah, it's easy to figure this guy out.
2117.14s - 2119.06s |  Well, nobody was finding him before
2119.06s - 2121.14s |  they put his name on an indictment.
2121.14s - 2123.78s |  Um, I- I did, but- but what I'm saying
2123.78s - 2125.18s |  is the general public hadn't.
2125.18s - 2127.38s |  So I needed him to know it needed to be me,
2127.38s - 2130.74s |  it was time to go, I needed to say my goodbyes,
2130.74s - 2131.74s |  but before this could end,
2131.74s - 2134.78s |  I had one final thing I needed to do,
2134.78s - 2137.62s |  and that was to come to DEF CON
2137.62s - 2140.90s |  and troll the shit out of that motherfucker.
2140.90s - 2142.66s |  So that's happening today.
2142.66s - 2144.38s |  And this is our memory reel.
2144.38s - 2146.30s |  Dimitri, if you're out there watching this,
2146.30s - 2148.54s |  the kids wanna know when you're coming home, baby.
2148.54s - 2149.38s |  I miss you.
2151.02s - 2152.90s |  These are my two favorite Dimitris, by the way.
2152.90s - 2155.18s |  The- the other guy is Dimitri Smolatos,
2155.18s - 2156.46s |  uh, from Recorded Future.
2156.46s - 2159.18s |  But, uh, this is- this is LockBit, this is me.
2159.18s - 2160.34s |  I've been having fun with this.
2160.34s - 2163.38s |  Uh, I really appreciate you guys being patient with us.
2163.38s - 2165.22s |  Um, if I have time for questions,
2165.22s - 2167.38s |  I don't think that we do, because we started late,
2167.38s - 2169.02s |  you guys tell me, but if- if not,
2169.02s - 2171.22s |  I'll be happy to hang around and answer them.
2171.22s - 2172.06s |  Um, but thank you.
2172.06s - 2173.94s |  This is my first DEF CON talk.
2173.94s - 2174.94s |  It's always been a dream.
2174.94s - 2177.18s |  Thanks for- for being here with me.
2177.18s - 2178.02s |  Thank you.


