# Media

url: https://www.youtube.com/watch?v=WscuQr5X1kc
title: DEF CON 32 - Access Control Done Right the First Time - Tim Clevenger
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=WscuQr5X1kc",
  "title": "DEF CON 32 - Access Control Done Right the First Time - Tim Clevenger",
  "description": "Are you looking to install or upgrade a physical access control system? Having installed, repaired and upgraded dozens of large and small access control system installations, I have found that many vendors install a minimum viable product that can leave your new system unreliable and trivial to bypass.\n\nThis session will give you the tools and knowledge you need to work with your installer to implement your system using best practices in the following areas:\n\nWiring, supervision, encryption and tamper-resistance\nChoosing clone-resistant badges and securely programming badge readers\nSecuring controller equipment and managing issued badges\nMaintaining the system for maximum security and uptime",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1461,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.84s | This text was transcribed using whisper model: large-v2

 All right. Hello. Wow, that's loud. Hi, this is access control done right the first time. My name
5.84s - 12.00s |  is Tim Clevenger. A little bit about me. I'm a network cybersecurity engineer by day. By night,
12.00s - 16.48s |  I'm a low voltage hardware junkie, vintage computing enthusiast. In a previous life,
16.48s - 22.40s |  I was certified with Linnell and S2 access and video. And I got to drive around in a truck and
22.40s - 29.04s |  look at other systems available in Southern California. I'm on the Physical Security
29.04s - 33.36s |  Village Discord. My handle is NSFW. No, I will not tell you why it's my handle.
34.64s - 38.72s |  A little bit about this talk. You know, we have a lot of talks about bypasses.
38.72s - 44.64s |  My talk is more about the installation of a system. I'm looking to give some tips and tricks
44.64s - 49.92s |  based on the kind of systems that I had seen and had to work on. A lot of vendors out there,
49.92s - 54.64s |  you know, it's a low bid situation and you get a minimal viable product. You know, it kind of does
54.64s - 60.72s |  a job but it's not particularly maintainable, reliable, or even secure. I'm focusing more on
60.72s - 65.52s |  large facilities. You know, if you're a small gym with a single door, some of this will apply
65.52s - 72.96s |  to you but maybe not quite as much. Just starting off, I have an RFP based on this talk and some
72.96s - 77.52s |  other stuff that I've learned. I'll put this QR code up again at the end in case you can't catch
77.52s - 84.96s |  it right now. So choosing a system, most of the larger vendors use equipment created by a company
84.96s - 90.08s |  called Mercury Security. They're kind of the big gorilla. They have local storage and independent
90.08s - 96.48s |  processing so you don't have to worry about having to pry open your server room door if your DNS goes
96.48s - 103.04s |  down Facebook. They have multiple vendor support and they are reflashable. The cool thing about
103.04s - 107.52s |  that is if you decide you're tired of Linnell and you want to go with Genentech or Honeywell,
107.52s - 112.08s |  they can reflash the firmware on most of your existing equipment and it reduces the amount
112.08s - 118.16s |  of hardware that you have to buy to switch vendors. So a little bit about system layout
118.16s - 124.32s |  considerations. So depending on where you're going to do this installation, you'll have a couple of
124.32s - 130.16s |  different installation options. I'll start here with kind of a basic four-door layout. So this
130.16s - 135.36s |  is a typical enclosure right here. The top board is your access panel that has all the brains of
135.36s - 141.20s |  the operation. It makes all of the decisions about whether to let somebody in based on their card
141.20s - 146.40s |  number and access rights. The board below it is an additional door controller that's connected.
146.40s - 152.32s |  That additional controller doesn't have a lot of brains on its own. It will communicate with that
152.32s - 157.60s |  main panel board and that's where the decision happens. What that means is if you lose communication
157.60s - 163.04s |  between those two boards, any of those dumber, cheaper door controller boards become suddenly
163.04s - 170.00s |  very dumb. They will either lock down, lock open, or they'll just use a facility code to grant access,
170.00s - 175.84s |  which isn't always the best as far as security goes. There's an enclosure here obviously that
175.84s - 182.80s |  houses all of this. There's a power supply and then there are batteries. So when you go to place
182.80s - 188.40s |  this enclosure with your panels in it, there are a couple things to consider. Kind of the obvious
188.40s - 195.28s |  stuff like environment, heat, humidity, power, physical security. Is this going to be on a wall
195.28s - 201.36s |  that people can walk by and pry the door open on it? Accessibility. Is this going to be up
201.36s - 206.00s |  on a ceiling somewhere where maybe your batteries aren't going to get changed regularly because you
206.00s - 211.44s |  have to get out a long step ladder or something? And then the future, and I'll talk about that here
211.44s - 219.12s |  in just a second. So for wiring considerations, so the main access panel connects to your server
219.12s - 224.00s |  computer that runs the software with Ethernet typically. Ethernet as we know is kind of a
224.00s - 232.08s |  shorter range communications medium. So what they have between your access panel and your individual
232.08s - 240.32s |  door controllers is called RS-485. It's an older four-wire communications protocol. Theoretically
240.32s - 246.72s |  it's good to 4,000 feet. However, it's much more sensitive to interference than, you know, Ethernet
246.72s - 252.72s |  or some of the newer communications technologies. There's also, there's a foil shield in the wire
252.72s - 257.36s |  that you have to deal with. There's termination at the end of a string of devices. So what that
257.36s - 262.40s |  means is that RS-485 is substantially, in my opinion, as somebody who's had to go and crawl
262.40s - 268.64s |  into spaces and replace wire, it's less reliable over long distances. But we will see in a minute
268.64s - 274.16s |  there are some places that you just really don't have a choice. So next up we think about our
274.16s - 280.40s |  distances to doors. So for something like a magnetic lock or a motorized crash bar, that's
280.40s - 286.80s |  going to take a lot more amperage than just, you know, a kind of a simple relay-based door opener.
286.80s - 291.20s |  And if that door also happens to be a long way from where you want to place your panel,
291.20s - 296.88s |  then you end up with a voltage drop which causes the locks to either not unlock when you want them
296.88s - 302.80s |  to, or in the case of a magnetic lock, the magnet becomes so weak from low voltage that you could
302.80s - 307.76s |  just pull the door open anyway. And what will happen is when you go to do your installation,
307.76s - 311.84s |  the vendor will figure this out after they've already installed the door and installed the
311.84s - 316.32s |  panel and run all the wire, and they'll go, okay, well we're going to need to do a remote power
316.32s - 321.04s |  supply. And what they'll do is they'll find a place up in the ceiling nearest to the door
321.04s - 326.88s |  and put the cheapest power supply they possibly can, not having any consideration for the
326.88s - 330.64s |  environment it's going to be in. It's not going to have batteries. They're not going to tell you
330.64s - 336.24s |  where it is. It's going to be up in a soffit where when you do need to get to it, you're like ripping
336.24s - 342.00s |  out drywall or something even more expensive. So part of your system layout considerations with
342.00s - 347.28s |  your project manager is to say, okay, this door is way over here. Are we going to need a remote
347.28s - 356.14s |  power supply? If so, let's get this going now. In addition, again, hard lid. So if you've got
356.14s - 361.42s |  that drywall above your closet where you're going to be doing your installation, that's going to
361.42s - 367.42s |  affect your installation. Block walls or concrete walls, like maybe don't put this in a hallway
367.42s - 370.86s |  where you're going to have to tunnel through concrete to get all your wiring to your doors.
372.70s - 377.82s |  Integrity and security, I'm going to make sure that if I'm going to have wiring run
377.90s - 382.94s |  from my suite over here through a public hallway to this suite over here above a drop ceiling,
382.94s - 388.70s |  maybe I'll put that in conduit so it's not easy to get in either tamper with or cut or
389.58s - 395.98s |  other shenanigans. So here's one of the two kind of situations that I'm going to talk about. This
395.98s - 403.98s |  is a warehouse. We have 65, 70 doors for trucks to back into. And then every few doors you have
403.98s - 409.42s |  a person door so that somebody can get in and out of the warehouse. And you want to do access
409.42s - 415.10s |  control on these. Well, you know, we're talking 700 or 800 feet here or maybe more to go from
415.66s - 421.90s |  where your access panel might be at the far end across to each one of these drops to these doors.
421.90s - 427.42s |  So what you might do is you might go ahead and use that RS-485. It's not in a harsh environment,
427.42s - 431.02s |  so it's probably safe to use. It's going to be exposed there. So if something happens,
431.42s - 438.54s |  you can get to it. But it allows you to do this without having to run multiple Ethernet drops or
439.82s - 444.30s |  fiber with media converters or whatever it takes to get Ethernet 700 feet down that doorway.
446.86s - 453.97s |  Excuse me. Here's kind of a typical Class A office space. You know, this is a floor in
453.97s - 458.45s |  pretty much any Class A building that you'd be into. So this right here, you know, it's a
458.45s - 463.49s |  relatively small space here. What you probably want to do is a centralized panel somewhere near
463.49s - 470.29s |  the elevators where you kind of fan out to all of the doors that you need access to from there.
471.97s - 476.77s |  But something to consider for the future, you know, there might be, I don't know, a pandemic
476.77s - 483.57s |  and suddenly companies are trying to get rid of excess space because people are working from home.
483.57s - 487.17s |  So if you plan this out ahead of time when you're first moving into the space, you can say, you know
487.17s - 491.89s |  what, these are pretty much, you know, they're two half offices essentially. They each have their own
491.89s - 500.13s |  elevators, have their own entrance doors. Maybe I'll go ahead and put a panel on each side and
500.13s - 505.65s |  then RS-485 to my doors from there. And that way, if for some reason we need to get rid of half of
505.65s - 510.69s |  this floor, it's real easy to just put up some drywall, cut access to that half of the system,
510.69s - 514.93s |  and whoever moves in can handle that. So again, it's just something to consider if you're looking
514.93s - 519.25s |  at a space. Look at how you need to do it today, but also maybe look at the future.
521.46s - 527.14s |  This is a larger installation. I'm just showing this here for you. Again, power supply, batteries.
527.14s - 531.46s |  Here we have the access panel at the top with the Ethernet drop and then two door controller
531.46s - 535.94s |  boards that are below this. This is kind of, when you're talking about these centralized panel
535.94s - 542.18s |  situations, this is what you typically do. Use an enclosure. You have six or eight door controllers.
542.18s - 546.42s |  Each one can control two doors and you kind of keep them in one enclosure or two enclosures
546.42s - 551.54s |  right next to each other. The RS-485 runs are really short. In this case, it's a pre-wired
551.54s - 555.78s |  panel, so you don't even have to mess with it. And it just gives you that kind of extra security to
557.06s - 561.22s |  have that there instead of saying, I'm going to run a door controller way over on the other side
561.22s - 566.74s |  of the building. And that means that all of that wire from here to there can be a problem in the
566.74s - 572.90s |  future. Now let's talk a little bit about wiring to the doors. Some of this is a repeat if you've
572.90s - 578.98s |  seen some of the bypass stuff already, but I'll try to warp through that part because I think we
579.62s - 585.06s |  know how to bypass some of this stuff. So when you're wiring from your panels to the doors
585.06s - 590.18s |  themselves, so some of your wiring considerations, so you're going to need a power, some heavier
590.18s - 595.46s |  gauge wires to the door hardware, whatever unlocks the door. Motion sensors are going to need a power
595.46s - 600.74s |  in addition to their contacts. You're going to need some kind of shielded cable to the badge
600.74s - 606.10s |  reader. That could be RS-485 or it could be Wigan cable. You're going to have your door contact and
606.10s - 610.66s |  your request to exit wiring is going to need to go on there. And then it's a good idea to have
610.66s - 616.26s |  extra cables, extra conductors there for tamper switches, auxiliary inputs and outputs, and that
616.26s - 623.22s |  type of thing. The wrong way to do this is to let your vendors just decide because what they will do
623.22s - 627.78s |  is they will find the cheapest wire, often it's what they have on the truck, and they will run
627.86s - 633.46s |  undersized power connectors to doors they think don't need it. That could be a fire hazard in
633.46s - 639.86s |  addition to just having door opening problems. They could use unshielded splice cable. They could
639.86s - 645.62s |  use Ethernet or Cat 3 telephone wire if that's what they have access to, and that causes
645.62s - 650.58s |  communications issues. And then if they don't have those extra conductors in there, that means that
650.58s - 655.06s |  in the future if your receptionist needs a push button to be able to open the door without getting
655.06s - 660.90s |  up, I mean that could involve tunneling under the concrete or up in the ceiling or, you know,
660.90s - 665.54s |  it's a lot of extra work that you could have avoided if you had that already pre-wired with
665.54s - 671.78s |  those additional conductors. So the right way to do this is to specify composite access control
671.78s - 678.98s |  cable. So this is all together in one cable. It's produced by manufacturers who specialize in this.
679.70s - 682.98s |  It comes in multiple options depending on how many extra conductors you want,
683.38s - 688.66s |  what kind of locks you're using. It comes with the right card reader communications cable that's
688.66s - 693.78s |  shielded properly, has all the spare conductors, and then it has that thick extra jacket on the
693.78s - 697.94s |  outside. So if they're pulling it through a drop ceiling and they just grind, you know,
697.94s - 703.14s |  the cable against a sharp piece of metal, it's less likely to cause damage to the conductors
703.14s - 707.86s |  inside. It's also unique. You know, a thick yellow cable, they're not going to just go cutting
707.86s - 712.26s |  through that, you know, with, you know, willy-nilly like they might a bunch of thin white
713.22s - 719.14s |  cables. A little bit about power supplies and enclosures. So the way the power works in this
719.14s - 725.54s |  situation is typically AC or DC, 12 volts or 24 volts or accommodation of 12 and 24 volts.
725.54s - 731.30s |  Your project manager can help you pick the right system as far as voltage goes. You want to make
731.30s - 736.90s |  sure that they specify one that has a power supply with a charger. Batteries are extremely
736.90s - 740.10s |  important. The last thing you want is to get locked out of your building when the power goes
740.10s - 746.82s |  out because you didn't have batteries on this and all your doors are locked. Verify the amperage
746.82s - 750.50s |  and the temperature range. This is particularly important if you're going to be putting that
750.50s - 758.18s |  enclosure in a hot room. And then also AC fail and battery fail outputs on the power supply that
758.18s - 763.38s |  you can run back to your system and it'll alert you if your batteries are dead or if you're about
763.38s - 768.50s |  to or if you have an AC fail and it's running on batteries, it's good to catch that stuff before
768.50s - 776.06s |  your batteries die. The enclosure, you know, there are different sizes, single or multiple panels in
776.06s - 779.90s |  a single enclosure. You can also chain them together so that you can run multiple stuff in,
779.90s - 785.26s |  you know, multiple enclosures. They're typically sold as a kit with the power supply. So again,
785.26s - 791.02s |  make sure that you get that specified to what you need. You can get them pre-wired like the one that
791.02s - 796.70s |  we saw a couple slides ago or you can DIY if you want to wire your own. Make sure you get one that
796.70s - 801.82s |  has a tamper switch like you could see in the picture here and a key lock so that you can lock
801.82s - 806.78s |  that enclosure. If it's going to be in a public area, go ahead and change the lock on that because
806.78s - 811.66s |  all these enclosures have the same key. And then optionally weatherproof, if you've got a parking
811.66s - 816.86s |  lot with a gate on it way out in the, you know, at the other end of the property, maybe put it in a
816.86s - 821.90s |  weatherproof enclosure if you don't have a guard shack or someplace to install the panel out there.
823.26s - 827.66s |  And then a little bit about batteries. I cannot tell you how many times I've seen either no
827.66s - 833.26s |  batteries or dead batteries because they hadn't been changed since the system was installed.
833.26s - 838.78s |  They're right in the enclosure so they're hard to remember sometimes. Again, you have to have
838.78s - 843.42s |  a power supply with charging capability. What I like to do is write that install date on the
843.42s - 847.10s |  battery so if you're ever in that enclosure in the future, you can look at and see, you know,
847.10s - 851.74s |  how far ahead those batteries are going to need to be replaced. Typically, I do it every three to
851.74s - 855.90s |  five years. If it's in a nice air-conditioned server room, then I'll replace them every five
855.90s - 861.50s |  years. If they're out in a hot, you know, garage or something, then I'll replace them every three
861.50s - 865.34s |  years. You can usually tell because when you pick up the battery and shake it, you'll hear rattling
865.34s - 869.58s |  because the electrolytes drying up when the batteries are going dead. And again, use those
869.58s - 875.66s |  battery fail outputs. I grabbed this out of a hardware guide. Connect that and run it back to
875.66s - 883.18s |  your panels so that you can see when either the batteries are no longer chargeable or if the AC
883.18s - 889.22s |  has failed, maybe a breaker has tripped somewhere and you need to go take care of that. A little bit
889.22s - 894.66s |  about those remote power supplies. Again, for those power-hungry locks, make sure that you get those
894.66s - 898.90s |  specified out ahead of time during the planning phase. That way, you know where those are going
898.90s - 903.14s |  to go. You know they're going to be in a place that you can get to and not have to cut through
903.14s - 907.62s |  drywall. You're going to make sure then that it still has the power supply, the charger, and the
907.62s - 913.70s |  batteries. You know, having that exterior door on its own power supply with no batteries in it does
913.70s - 920.21s |  you no good because that's the door you want to get in when the power goes out. A little bit about
920.21s - 927.73s |  fire safety. Your doors, the locking mechanism on your door can be either fail safe or fail secure.
927.81s - 933.97s |  What that means is if your access system crashes and it does happen, you want to know whether you
933.97s - 938.21s |  can actually get out of the building or not. If it fails secure, then that door is not going to
938.21s - 943.33s |  open when the software is crashed. If it's fail safe, then the door is going to go unlocked. Now,
943.33s - 947.65s |  there's different reasons that people would choose a fail safe versus a fail secure depending on what
947.65s - 952.69s |  you're protecting. I would just say that if you choose to do something that is a fail secure,
952.69s - 957.89s |  make sure that people who are in that room can get out in the case of a fire, a power outage,
957.89s - 964.69s |  a software crash. It's not worth life safety to protect assets. Find another way to do it.
965.65s - 971.65s |  Make sure that your system is going to comply with the local fire code and the authority having
971.65s - 975.81s |  jurisdiction. That's sometimes a fire marshal. Sometimes it's a building inspector. It depends
975.81s - 981.09s |  on your jurisdiction. And also, if you're particularly in a class A building, you may
981.09s - 986.29s |  be required by your lease to tie your system into a building fire alarm using a relay like
986.29s - 994.05s |  one of these that opens the door or unlocks the lock when the fire alarm goes off. Again, make
994.05s - 999.57s |  sure that you take care of that. And then finally, there's a box in the U.S. at least on the outside
999.57s - 1004.93s |  of most of these buildings. It's called a Knox box. It's a little hardened metal box that the
1004.93s - 1010.21s |  fire department can open up to get a key into the building. I typically will put a badge in there
1010.21s - 1015.33s |  because I don't have keys. We don't do keys. But if you do, make sure that's in there. I strongly
1015.33s - 1020.45s |  recommend that you put a tamper switch in that so that if somebody uses the probably well-known
1021.41s - 1026.13s |  Knox box common keys out there, that you know that that's been tampered with.
1027.65s - 1032.77s |  A little bit about door hardware. I'm not going to go through these. These are pretty standard.
1033.33s - 1037.73s |  The electrified strike is the one that you see here. That's the one that makes a nasty buzzing
1037.73s - 1044.21s |  sound and the door never closes quite right. Solenoids are the more common ones that you see
1044.21s - 1049.09s |  on office doors. The only thing with those is if your door is set to stay open 8 to 10 or 12 hours
1049.09s - 1055.73s |  a day, that solenoid is staying engaged that entire time and those things can fail prematurely and then
1055.73s - 1061.65s |  you can't open the door. So it's just something to keep an eye on. Magnetic locks typically need
1061.65s - 1067.49s |  more power than standard locks because the electromagnet requires that voltage in order to
1067.49s - 1073.49s |  have the holding power. And those will always fail safe. So maybe don't use those for your front doors
1073.49s - 1078.61s |  because if the power goes out, they're going to open. And then finally, motorized crash bars,
1078.61s - 1082.77s |  which I've only seen in one place, but they're expensive, but they're pretty good.
1084.77s - 1090.21s |  So quick thing about door hardware. So you have two sensors on a door. Typically,
1090.29s - 1094.05s |  you'll have the door contact that tells you whether the door is open or closed.
1094.05s - 1100.53s |  That can be a reed switch up in the door frame. It can be integrated into the lock set itself.
1101.41s - 1106.69s |  And then the request to exit, that's what tells the access control system that this door is being
1106.69s - 1111.49s |  opened legitimately from the inside by the correct person and not being jimmied open
1111.49s - 1117.09s |  from the outside. So it detects if that door is being forced or bypassed and it still allows the
1117.09s - 1122.85s |  door to open from the secure side. There's also in cases where you have, for instance, a mag lock
1122.85s - 1126.85s |  that request to exit switch will actually unlock the door because there's not really any other way
1126.85s - 1133.89s |  to do it. And then typically, your other options are a button, a buzzer, a motion detector, or
1133.89s - 1139.09s |  a switch integrated into the handle for your Rex. The reason I mentioned these is because we need
1139.09s - 1144.37s |  to talk a little bit about supervision. Supervision is a set of resistors in series or parallel
1144.37s - 1150.21s |  that need to be as close to the door contact or Rex contact as possible. And what they do is they
1150.21s - 1156.29s |  change your situation from either these wires are open or closed, the circuit is open or closed,
1156.29s - 1161.73s |  it gives you now four different readings depending on whether the door is open, the door is closed,
1161.73s - 1167.25s |  or if the wires are cut or the wires are shorted. And that's very important because the last thing
1167.25s - 1171.81s |  you need is the door contact falling off and then people can just open the door and go in and out
1171.81s - 1179.73s |  and you don't know what's happened. Motion detectors, again, there's attack examples here.
1179.73s - 1183.73s |  We've talked about this quite a bit. You can come to Physical Security Village and we'll talk you
1183.73s - 1190.93s |  through it. They're often used to trigger and unlock, again, on motion, I'm sorry, on mag lock
1190.93s - 1196.53s |  doors and some other types. So not only do they, are they a security risk, but they can actually
1196.53s - 1202.37s |  open the door if you can bypass them. And then door handle attacks, I know that we just had a
1202.37s - 1207.25s |  presentation on this. Some of those mitigations, you know, dual Rex, so you have to have something
1207.25s - 1212.21s |  where they pull the door handle on the inside and there's a motion detector or a second badge reader
1212.21s - 1217.01s |  or a push button. Again, if you're going to use a badge reader to exit, make sure you have a way to
1217.01s - 1221.81s |  get out. Typically you get one of those plastic covers that you rip off and pull the handle and
1221.81s - 1226.45s |  they'll let you out while also setting off an alarm. That's what that's for is so that you can
1226.45s - 1232.69s |  get out in case of a fire and you don't happen to have your badge. A little bit about badges
1232.69s - 1237.17s |  and readers. So, you know, badges come in multiple sizes and shapes, you know, you got the fobs, you
1237.17s - 1241.65s |  got the smart card readers. If you're from the 80s, you got mag stripe cards, like there's all kinds.
1242.45s - 1247.33s |  Additional factors, biometrics and pin entry. This thing here is called a scramble pad. It's cool
1247.33s - 1250.53s |  every time you hit the button, all the numbers are in a different order so people watch you put
1250.53s - 1256.77s |  your pin in and they still can't figure out what it is. The badges, the most common types of badges,
1257.41s - 1263.81s |  125 kilohertz prox, that's what your gym gives you. 1356 megahertz I-class are what you typically
1263.81s - 1269.97s |  get in an office situation. They're pretty trivially broken and clonable. The MyFairDes
1269.97s - 1275.17s |  fire and the COs are not broken directly but there are downgrade attacks on those.
1276.13s - 1284.21s |  Prox and I-class, they have a facility code and a badge ID in a 26-bit format. The facility code
1284.21s - 1291.09s |  is 0 to 255 and you can buy any badges from eBay or any other vendor with whatever
1293.33s - 1297.89s |  facility code that you want. So, for instance, most of the places that I've worked,
1297.89s - 1304.45s |  for whatever reason, and this is Texas, California, Utah, the code 132 is the most
1304.45s - 1310.21s |  common facility code. I have no idea why but if you bought a batch of 132 codes or cards from
1311.09s - 1317.17s |  eBay and just walked up to a random building, you have a fair chance of getting in.
1317.89s - 1323.41s |  Again, the 26-bit prox and I-class is pretty trivial. Any compatible reader can
1323.41s - 1329.25s |  read it. So you can just go buy an HID reader off of eBay, attach it to an ESP32,
1330.13s - 1332.85s |  touch your badge to it, it'll give you the facility code and the badge number.
1333.73s - 1339.81s |  You can also do portable readers. I know we've had talks about, you know, the clipboard thing
1339.81s - 1344.69s |  where you put a badge reader in your clipboard and you just read people's badges with it.
1346.05s - 1351.65s |  So the solution is custom badges. Like I said, there are, there's the MyFair ones. I've never
1351.65s - 1358.53s |  used those. I've only used the HIDs. So they have a format, excuse me, a format called HID
1358.53s - 1364.53s |  Corporate 1000. It's CO's protected, so it's more secure. It has a dedicated facility code.
1364.53s - 1368.45s |  When you sign up, your company gets its own facility code because there's millions of
1368.45s - 1373.33s |  possibilities. And then only you can order more cards with that particular facility code.
1373.33s - 1378.85s |  They use a 48-bit format. So for each facility code, you can have 8.3 million badge numbers,
1378.85s - 1383.17s |  which is cool because you can pick a number in the high range and not worry about if you acquire
1383.17s - 1391.57s |  another company, those badge numbers coinciding with somebody else's. I'm going to warp through
1391.57s - 1396.13s |  this real quick because my time's out. Make sure you disable older formats on your readers. That's
1396.13s - 1402.29s |  the downgraded. Badge reader communications weakens the low speed protocol from 1975.
1402.77s - 1411.57s |  The mitigation is called OSDP. OSDP has very few compromises that are pretty easy to avoid.
1412.13s - 1419.49s |  The biggest problem with OSDP is that 84% of installers never or seldom use it. So it's almost
1419.49s - 1427.25s |  never used these. And this is from 2015. So what else should I do? Test your regulars. Yeah, test
1427.25s - 1432.77s |  your readers regularly. Set up alerts in your software. Again, so many people have software and
1432.77s - 1436.93s |  they've never set up alerts in it. Document everything. I put a sticker on the bottom of
1436.93s - 1441.25s |  every reader that has a number and I match that number to my access control system. So when they
1441.25s - 1447.41s |  say reader number 24 is not working, I can just go fix it. Check your batteries. Batteries die.
1447.41s - 1453.01s |  They don't do you any good. Audit your user list regularly and then come visit us in the physical
1453.01s - 1455.89s |  security village. I'm actually going to be volunteering over there right after this if
1455.89s - 1460.37s |  you have any questions for me. Thank you very much.


url: https://www.youtube.com/watch?v=YvqWlZK_fks
title: DEF CON 32 - 3DU Homo ex Machina - Lacey Harbour
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=YvqWlZK_fks",
  "title": "DEF CON 32 - 3DU  Homo ex Machina - Lacey Harbour",
  "description": "The future of healthcare is precise, personalized, and involves point of care with a wide variety of applications. Each application has its own unique set of challenges that change based on risk and the stakeholders\u2019 perspective. Foreseeing these challenges, in 2021 FDA issued the discussion paper 3D Printing Medical Devices at the Point of Care to expound upon pertinent challenges and request stakeholder feedback. Within this paper, the concept of the 3D Printing medical device production system (MDPS) as a medical device was presented. In this session, we will investigate the concept of the MDPS from the perspective of different stakeholders, the necessity of AI to make this in-hospital MDPS POC solution a reality, and the unique relationship the MDM and HDO must have to support the MDPS.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1423,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.16s | This text was transcribed using whisper model: large-v2

 Hi, everyone.
2.16s - 5.32s |  Thank you so much for coming to my talk.
5.32s - 7.76s |  If you'd like to, I have some detailed slides.
7.76s - 10.28s |  So if you'd like to get into those details,
10.28s - 12.08s |  please feel free to click the QR code.
12.08s - 13.64s |  I promise it's safe.
13.64s - 16.88s |  I don't know how to make it not safe.
16.88s - 20.36s |  And follow along for your use.
20.36s - 21.76s |  My name is Lacey Harbour.
21.76s - 24.40s |  I have a background in molecular biology,
24.40s - 27.00s |  but fell, unfortunately or fortunately,
27.00s - 30.04s |  into regulatory and quality and clinical studies.
30.04s - 34.48s |  And today, I want to present some ideas to everyone
34.48s - 39.28s |  here about how medical devices are being made
39.28s - 41.84s |  and how they're going to be made in the future.
41.84s - 44.32s |  And during this process, I'm going
44.32s - 46.54s |  to highlight some areas of concern
46.54s - 50.60s |  that is particularly applicable to our cybersecurity partners
50.60s - 54.24s |  and how we're not really ready for the future
54.24s - 58.12s |  of the medical device world.
58.12s - 63.56s |  So it goes without saying that AI is changing everything.
63.56s - 68.12s |  AI is particularly changing the health care ecosystem.
68.12s - 73.68s |  And this is a good thing for us because us as a population,
73.68s - 74.92s |  we're aging.
74.92s - 77.72s |  And our population isn't growing with new members
77.72s - 79.88s |  as much as it used to.
79.88s - 85.20s |  With that, we're going to need a new point of care, new care,
85.20s - 87.64s |  standard of care treatments.
87.64s - 91.80s |  And that's not going to be doable without AI.
91.80s - 96.24s |  So AI, being integrated into the products
96.24s - 98.68s |  are changing the scope of these products.
98.68s - 100.60s |  And my world is regulatory.
100.60s - 103.84s |  We like to bucket products into regulated and unregulated
103.84s - 104.64s |  product.
104.64s - 106.98s |  You can have the exact same instrument or device
106.98s - 108.12s |  or whatever.
108.12s - 110.28s |  And if you define it to be intended
110.28s - 112.28s |  for a medical purpose like diagnosis,
112.28s - 113.24s |  it's a medical device.
113.24s - 115.28s |  So you have all these controls in place
115.28s - 118.80s |  to deal with that product, to develop it, to manage it,
118.80s - 120.84s |  to monitor it.
120.84s - 123.32s |  But if it's not a medical device,
123.32s - 124.80s |  then you don't have to monitor it
124.80s - 126.64s |  to the same level of scrutiny.
126.64s - 132.01s |  And that can be a concern.
132.01s - 136.61s |  So when something is called a medical device,
136.61s - 138.69s |  particularly in the US, it's all depending
138.69s - 141.25s |  on its intended use.
141.25s - 144.53s |  Now, with the ecosystem changing,
144.53s - 146.25s |  with the scope of the products changing,
146.25s - 148.49s |  the intended use is not just the only thing
148.49s - 151.53s |  we need to be worried about or be mindful of.
151.53s - 154.85s |  We need to be mindful of how it's being used in the health
154.85s - 158.21s |  care system, what data sources and attributes it's
158.21s - 160.25s |  plugging into.
160.25s - 161.57s |  Who are the end users?
161.57s - 163.25s |  It's not just the physician anymore.
163.25s - 164.77s |  There's different voice of customers
164.77s - 166.81s |  that need to be paid attention to,
166.85s - 168.73s |  especially when you're building a product that
168.73s - 172.97s |  should be secure and safe and effective
172.97s - 179.25s |  across the entire use and its entire ecosystem.
179.25s - 181.89s |  In the past, I used to have to be worried just
181.89s - 184.61s |  about the FDA in the US market.
184.61s - 187.81s |  Now, I have to be mindful of all of these entities,
187.81s - 191.81s |  these regulatory entities that are listed on the screen.
191.81s - 195.05s |  And that's just the US market.
195.05s - 196.89s |  I'm part of an FDA collaborative community.
196.89s - 199.05s |  I'm one of the co-leaders of it.
199.05s - 203.61s |  And we have an NLP that just scans the internet,
203.61s - 207.09s |  picking up sources that we've deemed reliable,
207.09s - 210.17s |  and allowing us to analyze all these global sources
210.17s - 212.57s |  into a one-stop shop.
212.57s - 214.89s |  Within this year alone, there have
214.89s - 219.49s |  been 85 sources or materials that we,
219.49s - 221.21s |  as a regulatory equality partners,
221.21s - 224.61s |  must analyze and communicate to our companies
224.65s - 226.25s |  to take action upon.
226.25s - 228.21s |  And I don't know if you really appreciate
228.21s - 231.61s |  how much freaking work that is and how damn near impossible
231.61s - 234.61s |  that is, because not only do I have to analyze it,
234.61s - 237.57s |  and then I have to teach the executives this information,
237.57s - 240.41s |  then I have to get buy-in that they need to update procedures
240.41s - 241.49s |  and policies.
241.49s - 243.41s |  We have to do a business risk impact
243.41s - 246.05s |  and see how much it just keeps going and going and going.
246.05s - 249.09s |  Ultimately, you have to train the people
249.09s - 251.57s |  within the manufacturing line even what they can and cannot
251.57s - 252.09s |  do.
252.09s - 253.93s |  This is a huge task.
253.93s - 255.77s |  And of course, it's going to be easier
255.77s - 259.65s |  based on the size of your company, or maybe not.
259.65s - 263.61s |  Each company has their own problems with this.
263.61s - 267.05s |  It's not just the regulatory ecosystem.
267.05s - 270.05s |  It's also the relationship with our customers.
270.05s - 272.89s |  So as medical device manufacturers,
272.89s - 276.21s |  you always think the customer is the physician or the patient.
276.21s - 278.09s |  But that's not always the case.
278.09s - 281.17s |  We are plugging in our products into health delivery
281.17s - 282.13s |  organizations.
282.49s - 285.97s |  And they have to navigate their own set of regulations.
285.97s - 288.57s |  And they have their requirements.
288.57s - 291.01s |  And so we have to make sure that our products interact
291.01s - 292.41s |  with that.
292.41s - 294.73s |  Also, with the future of these products,
294.73s - 298.69s |  again, AI enablement is a really data-hungry process,
298.69s - 300.73s |  no matter where it's plugged into.
300.73s - 302.29s |  And who owns the data?
302.29s - 305.09s |  Well, the EHR companies like Epic.
305.09s - 307.37s |  You think they want to share that data with the medical
307.37s - 310.97s |  device manufacturers so that we can have good quality outputs?
310.97s - 312.29s |  Not necessarily.
312.29s - 314.49s |  So we have to build those relationships
314.49s - 317.05s |  with the medical device manufacturers, the EMR,
317.05s - 319.41s |  and any other applications that are
319.41s - 325.49s |  plugging in to the hospital delivery organization, or HDOs.
325.49s - 327.57s |  So FDA is seeing this.
327.57s - 332.37s |  And they're not the only agency globally
332.37s - 333.85s |  that's really making progress.
333.85s - 336.45s |  But they are really being public about it.
336.45s - 337.29s |  And it's accessible.
337.29s - 339.85s |  Any of you guys can go on the FDA website
339.85s - 341.53s |  and see all sorts of initiatives
341.53s - 344.81s |  that they're putting into place to make sure
344.81s - 346.21s |  that the public is being heard.
346.21s - 348.25s |  And they're actually engaging patients, even.
348.25s - 351.05s |  They're really paying attention to the voice of customer
351.05s - 353.61s |  and how these products are truly used.
353.61s - 359.13s |  For example, they'll even ask about the workflow
359.13s - 361.89s |  in a laboratory, even.
361.89s - 364.65s |  And so I highly recommend and encourage everyone
364.65s - 366.97s |  to go check out these resources.
366.97s - 369.53s |  But when the FDA is, in particular,
369.53s - 371.77s |  and they're working with an international group called
371.77s - 376.29s |  the IMDRF, when the FDA is hearing and seeing
376.29s - 380.89s |  where the industry is going, they're
380.89s - 384.41s |  trying to grow along with industry
384.41s - 387.49s |  so that they're not holding us back.
387.49s - 389.85s |  And one particular use case I'm going to talk to you guys
389.85s - 392.61s |  about today is called the medical device production
392.61s - 394.77s |  system.
394.77s - 399.13s |  But before I can get into this future device, essentially,
399.13s - 402.69s |  I want to level set everybody.
402.69s - 407.81s |  Who's here familiar with the total product lifecycle?
407.81s - 409.53s |  I have a handful of people.
409.53s - 412.53s |  All right, so the total product lifecycle
412.53s - 415.13s |  is basically the inception of a product
415.13s - 418.57s |  all the way to the end of life of a product.
418.57s - 422.69s |  And so I put together here a representation
422.69s - 425.65s |  of any kind of QMS or quality management system
425.65s - 428.33s |  that represents a total product lifecycle.
428.33s - 429.69s |  And it looks like a cell.
429.69s - 433.57s |  And maybe the biologist is being a little biased in me,
433.57s - 435.77s |  but it really is like feedback loops,
435.77s - 437.53s |  like what you get in a cellular function.
437.53s - 440.81s |  So you could break it down, in my mind,
440.81s - 443.73s |  a total product lifecycle into design controls, production
443.73s - 445.65s |  and process controls, and then there's
445.65s - 447.11s |  feedback loops for improvements.
447.11s - 449.77s |  And any of those improvements could be failure on the field.
449.77s - 452.41s |  It could be a non-conformance from a manufacturing line.
452.41s - 453.97s |  It could be a corrective action that's
453.97s - 457.89s |  discovered from anything else or regulatory updates.
457.93s - 462.61s |  But this is too complicated to really talk about and use.
462.61s - 467.01s |  So I further simplified the total product lifecycle
467.01s - 470.45s |  schema into these two basic buckets.
470.45s - 473.33s |  So you can see where I have the QMS,
473.33s - 477.41s |  and then I've broken it down to design controls and production
477.41s - 481.57s |  and process controls, where you have a prototype of a device.
481.57s - 484.81s |  It can be a digital device or a cyber device,
484.81s - 486.65s |  as they call it in the US.
486.65s - 492.33s |  It could be a tongue depressor, depending on the classification.
492.33s - 497.13s |  But say that you have the prototype.
497.13s - 498.09s |  You test it.
498.09s - 499.29s |  Hey, it's good.
499.29s - 503.29s |  I'm going to now scale up and manufacture this.
503.29s - 506.45s |  So then you transfer it to manufacturing.
506.45s - 507.05s |  You test it.
507.05s - 508.73s |  Hey, the manufacturing is working well.
508.73s - 512.69s |  Now we can actually start mass-producing these products.
512.69s - 515.85s |  And then you manufacture, and then you test it again.
515.85s - 519.01s |  And then finally, if they match all the quality control or QC
519.01s - 521.73s |  checks, that device is released out into the wild,
521.73s - 524.05s |  or software, or whatever.
524.05s - 526.45s |  Within each of these steps, there's feedback loops.
526.45s - 529.69s |  So something bad can happen during this process
529.69s - 533.53s |  to kick you all the way back to design of feasibility
533.53s - 536.01s |  and design phase.
536.01s - 538.05s |  But at the end of the day, the take-home message
538.05s - 541.45s |  is the output, the final device, is
541.45s - 543.65s |  from that whole end-to-end total product
543.65s - 547.79s |  lifecycle within the QMS.
547.79s - 550.99s |  So now that I've kind of given you
550.99s - 555.27s |  a very high level of the basics of what currently exists,
555.27s - 557.35s |  let's talk about the future.
557.35s - 562.47s |  The future of our products are going to be precise.
562.47s - 563.75s |  It's going to be personalized.
563.75s - 565.79s |  It's going to be at the point of care.
565.79s - 569.95s |  And there are several different industries, and sectors,
569.95s - 573.03s |  and technologies that are helping pushing
573.03s - 577.03s |  our standard of care practice to this point.
577.03s - 582.99s |  But the orthopedic sector has really
582.99s - 586.67s |  been leveraging the 3D printing technology
586.67s - 591.79s |  to bring us closer to that precise, personalized,
591.79s - 593.67s |  and point-of-care product.
593.67s - 597.47s |  And I'm going to reintroduce the idea of a medical device
597.47s - 599.47s |  production system to you.
599.47s - 602.91s |  And so this isn't the only use case involved
603.79s - 608.11s |  that does this, but these orthopedics, I guess because,
608.11s - 610.39s |  I mean, to be honest, it's human carpentry.
610.39s - 614.07s |  So the complexity isn't as much as maybe other devices.
614.07s - 616.75s |  So they're moving at a very fast pace.
616.75s - 619.23s |  And the FDA saw that, and so the IMDRF.
619.23s - 622.11s |  So they've started to put together some loose guidelines
622.11s - 627.47s |  to help lead this medical device production system.
627.47s - 631.51s |  So what is the medical device production system, or MDPS?
631.51s - 635.47s |  So let's go back, again, to the schema I showed you all before.
635.47s - 639.31s |  Again, the output is a device, right?
639.31s - 642.75s |  It's pretty simple, of a total product lifecycle of the QMS.
642.75s - 647.47s |  Well, a medical production system turns that on its head.
647.47s - 652.83s |  Now, the output, the device, isn't the final component.
652.83s - 655.63s |  And this is a little hard to wrap your head around.
655.63s - 657.79s |  It includes the manufacturing.
657.79s - 660.23s |  It includes the design phase.
660.23s - 663.63s |  So what happens is, I'm a medical device manufacturer,
663.63s - 667.07s |  and I'm going to make a medical device production system, an MDPS.
667.07s - 672.47s |  I'm going to design the production line just as I would before,
672.47s - 676.87s |  except now I'm going to realize that this production system
676.87s - 681.35s |  is going to be part of the device in the healthcare delivery organization.
681.35s - 685.59s |  So there will be manufacturing in the hospital.
685.59s - 689.35s |  And then I will allow a certain range of scope
689.35s - 694.75s |  or specs that can be allowed for the hospital to manufacture.
694.75s - 698.31s |  And so from that end-to-end process, they can design the product,
698.31s - 703.31s |  and they can manufacture it, and then the output is part of the entire device.
703.31s - 706.47s |  The output alone is no longer the singular device.
706.47s - 712.07s |  So if any of you are familiar with the quality system regulation,
712.07s - 715.51s |  or 13485 standards, your wheels may be turning,
715.51s - 717.71s |  like, how the hell do you control this?
717.71s - 720.07s |  And that is a big question.
720.07s - 725.83s |  But the precursors to this are existing right now.
725.83s - 733.07s |  Here I have an image of some 3D-printed EBM joint implants made.
733.07s - 736.67s |  They're called trabecular titanium, and they allow for bone engrowth.
736.67s - 738.99s |  And they are all patient-matched.
738.99s - 742.95s |  And these are printed in the hospital as we speak
742.95s - 745.83s |  from a medical device manufacturer.
745.83s - 752.99s |  And so I'm going to kind of introduce at a high level this current process.
752.99s - 756.39s |  And then we're going to talk about how this is going to become
756.39s - 759.43s |  the medical device production system.
759.43s - 762.19s |  So say I'm a patient.
762.19s - 765.23s |  I have a really janked-up shoulder.
765.23s - 769.39s |  And the physician says, hey, the standard products on the market,
769.39s - 770.83s |  they're not going to work for you.
770.83s - 772.51s |  We need to give you a custom device.
772.51s - 775.95s |  So they're going to send me to get a fresh CT scan.
775.95s - 777.59s |  I'm going to get my fresh CT scan.
777.59s - 782.03s |  And that DICOM file is going to go to the radiologist, to the surgeons.
782.03s - 786.11s |  And they're going to segment that file with the medical device
786.11s - 789.51s |  manufacturer or the designer.
789.51s - 792.19s |  They will identify the defects.
792.19s - 796.39s |  And then they will agree on how the physician wants to approach it.
796.39s - 799.35s |  So the physician is really close with the designer
799.35s - 802.51s |  through this whole process.
802.51s - 807.39s |  After they discuss it, the designer will then take that DICOM file
807.39s - 811.99s |  and convert it to an STL file within a 3D CAD program like Magix
811.99s - 814.55s |  or something similar to that.
814.55s - 819.19s |  And then they will propose potential designs.
819.19s - 820.91s |  And the designs don't come out of anywhere.
820.91s - 825.71s |  It's based off of historical data, recall data from standard devices.
825.75s - 829.55s |  But it'll be matching how the physician wants to perform the surgery
829.55s - 831.87s |  and what the physician actually wants to do.
831.87s - 834.67s |  And so there's a feedback loop there until the physician gives the green light.
834.67s - 838.19s |  And then it is released.
838.19s - 840.67s |  But just because you can design something
840.67s - 842.87s |  doesn't mean you can actually print it.
842.87s - 847.07s |  Within a 3D printer, there's XYZ zones.
847.07s - 849.43s |  And each zone has a different behavior.
849.43s - 852.23s |  It's their own animal.
852.23s - 856.59s |  And so what happens is that the designer will give the STL file
856.59s - 858.87s |  to the production engineer.
858.87s - 860.83s |  And then they will convert it to a machine file
860.83s - 865.15s |  and determine if it's possible to actually 3D print that geometry.
865.15s - 867.19s |  And some of that may be tied to demand planning
867.19s - 871.35s |  because you obviously, you'll have a large bed.
871.35s - 874.67s |  And you may be printing more than one patient's devices at a time.
874.67s - 878.99s |  And so you may have to strategize that.
878.99s - 882.27s |  But it's not uncommon for that device to be kicked back to the physician,
882.27s - 887.43s |  essentially, if the production engineer says, no, we can't do that.
887.43s - 892.35s |  After it's printed, there are a lot of supports that need to be removed.
892.35s - 897.07s |  And so typically, it's like a CNC or a saw that helps remove those products.
897.07s - 899.23s |  And then it goes to a QC check.
899.23s - 903.91s |  And the QC check is just not the outside dimension, but the inside integrity.
903.91s - 908.39s |  These devices have to resist weight and movement.
908.39s - 912.59s |  And so if there's any kind of flaw internally, that can cause device failure.
912.59s - 918.52s |  So there's a lot of checks that have to be happened with QC samples.
918.52s - 923.48s |  So what might be of interest is let's dissect a little bit more detail
923.48s - 928.32s |  of the first half of that from the relationship of the health delivery
928.32s - 933.00s |  organization and the medical device manufacturer.
933.00s - 937.00s |  I'm not going to go into all the detail of every bit of the schema.
937.08s - 943.20s |  But this is just a representation of what that data interaction might look like.
943.20s - 946.68s |  But what I really want to highlight, and I see some of you shaking your head
946.68s - 950.64s |  or maybe have some concerns, you might have noticed that there's something
950.64s - 951.80s |  called a PACS server.
951.80s - 956.36s |  And that holds all of the DICOM data for pretty much everything.
956.36s - 959.80s |  And how does that data get to the medical device manufacturer will depend
959.80s - 963.00s |  on the relationship the medical device manufacturer has with the health
963.00s - 964.60s |  delivery organization.
964.60s - 966.36s |  It could be a nurse downloading it.
966.36s - 970.64s |  It can be on a flash drive and handing it to the device manufacturer.
970.64s - 972.04s |  It could be an email.
972.04s - 973.52s |  It could be a CD.
973.52s - 980.08s |  Or it could be connected directly into the medical device's server.
980.08s - 984.04s |  The medical device manufacturer may have a software that sits on top of the PACS
984.04s - 990.16s |  server, or they may have a relationship where they have access to the EMR.
990.16s - 992.92s |  And now if they have access with the EMR, they have to have a relationship
992.92s - 993.64s |  with the EMR.
993.64s - 1001.12s |  So the problem is that I want to highlight is I just want to make a note
1001.12s - 1006.96s |  that medical device manufacturers are not HIPAA covered entities.
1006.96s - 1009.52s |  And I'm just going to leave that there and let you kind of think
1009.52s - 1011.64s |  on what that means.
1011.64s - 1022.44s |  So once the design is considered safe, at least from a failure mode analysis
1022.48s - 1028.36s |  perspective, then it goes back to the internally.
1028.36s - 1032.12s |  So now we're completely inside the medical device manufacturer's side
1032.12s - 1035.24s |  of the network.
1035.24s - 1039.04s |  Many device manufacturers are moving forward to using what's called machine
1039.04s - 1040.60s |  learning operations.
1040.60s - 1047.40s |  And this is just a high-level example of how that can look within the network.
1047.40s - 1052.16s |  You have the containers, of course, that are cross-talking with different
1052.16s - 1053.28s |  instruments.
1053.28s - 1056.96s |  And then you can also have these containers cross-talking with other
1056.96s - 1061.20s |  systems, like your product lifecycle management system, your quality
1061.20s - 1067.84s |  management system, or your ERPs, or even other sites, if you have multiple
1067.84s - 1069.56s |  sites interacting.
1069.56s - 1072.16s |  And that's something that would be a goal for medical device manufacturers
1072.16s - 1075.84s |  with MDPS, so that it'd be nice to have communications to see the success
1075.84s - 1081.84s |  of the products across all of your deployed MDPSs.
1081.84s - 1089.28s |  And so you can see here that there, again, you may be the design engineer.
1089.28s - 1091.44s |  How did you get the data from the designer?
1091.44s - 1093.64s |  Well, it could have been put up on a server.
1093.64s - 1098.08s |  It could have been a flash drive handed to you, and you work on this product
1098.08s - 1102.32s |  for the machine file, the machine planning, on your personal laptop or on
1102.32s - 1107.56s |  your work laptop, because the data processing for this is quite substantial.
1107.56s - 1111.48s |  And then how does that data get to the EBM in the first place?
1111.48s - 1113.40s |  Again, it could be a flash drive.
1113.40s - 1116.92s |  There's a lot of flash drives used in manufacturing, especially with smaller
1116.92s - 1119.72s |  firms.
1119.72s - 1124.89s |  So there's concerns there.
1124.89s - 1126.25s |  But this isn't MDPS.
1126.25s - 1130.49s |  This whole workflow that I presented, it's precursor to MDPS.
1130.49s - 1131.81s |  And it exists right now.
1131.81s - 1134.29s |  Here are just some firms that are doing this right now.
1134.29s - 1136.73s |  And this isn't even all of them.
1136.73s - 1140.49s |  There's a lot of research going into how to get the MDPS.
1140.49s - 1144.57s |  And so what is the MDPS?
1144.57s - 1149.73s |  Well, just for simplicity purposes, think about that whole workflow
1149.73s - 1151.61s |  and put it in a box.
1151.61s - 1153.17s |  You get the CT scan.
1153.17s - 1155.73s |  You plug that DICOM in this box.
1155.73s - 1159.69s |  There might be people remote, like designers or even people
1159.69s - 1163.37s |  monitoring the success of the instrument remotely.
1163.37s - 1168.53s |  And the physician is working with some kind of software interface
1168.53s - 1171.89s |  to say, hey, I want the design to look this way.
1171.89s - 1176.49s |  And then they press Go, and out pops your final device.
1176.49s - 1179.01s |  Now, if anyone's familiar with 3D printing,
1179.01s - 1182.17s |  the post-processing is going to be a problem for the future MDPS.
1182.17s - 1186.61s |  But it's not going to be unattainable.
1186.61s - 1187.73s |  We are working.
1187.73s - 1189.01s |  Technology is being researched.
1189.01s - 1190.77s |  Mineralization is being researched.
1190.77s - 1195.69s |  This is not like it's going to be 50 years from now.
1195.69s - 1197.53s |  What's going to make this even more powerful
1197.53s - 1201.65s |  is that you're going to have feedback from the surgical suite into the MDPS.
1201.65s - 1203.77s |  So you're going to get clinical outcomes.
1203.77s - 1206.45s |  But again, to get that, you have to have the relationship
1206.45s - 1210.38s |  with the medical device manufacturer.
1210.38s - 1214.86s |  So AI is going to be necessary to do this.
1214.86s - 1218.54s |  There's no way that you're not going to be able to have this without.
1218.54s - 1222.62s |  So let's highlight some of the areas where AI is being researched even
1222.62s - 1225.10s |  right now and where it's going to be plugged into this MDPS.
1225.10s - 1227.62s |  And I mean, if you look this up online, you're
1227.62s - 1231.50s |  going to see a slew of papers because this is the low-hanging fruit.
1231.50s - 1235.18s |  Again, human carpentry, everyone's going for this.
1235.18s - 1238.70s |  First place, automatic segmentation.
1238.70s - 1242.70s |  Have a mask, highlight the defect, give you recommendations on the defect.
1242.70s - 1246.78s |  The radiologist, the surgeon, or whomever can look at that
1246.78s - 1249.02s |  and give yes or no feedback.
1249.02s - 1254.86s |  The next place is the design.
1254.86s - 1260.10s |  You can have all of your data from your field feedback
1260.10s - 1262.70s |  from the designs that exist that are standard
1262.70s - 1264.30s |  to automatically generate design.
1264.30s - 1268.82s |  And all the designer has to do is say go, no go.
1268.82s - 1271.34s |  And the physician have their inputs as well.
1271.34s - 1274.46s |  And you can use LLMs to generate the surgical technique, which
1274.46s - 1276.46s |  is also considered part of the labeling, which
1276.46s - 1280.10s |  is part of the design of the device.
1280.10s - 1286.10s |  Finally, the demand planning, the design transfer.
1286.10s - 1290.38s |  You can have multiple products in the queue.
1290.38s - 1294.10s |  And you can determine, hey, this device needs
1294.10s - 1295.98s |  to be manufactured in this zone.
1295.98s - 1298.58s |  But this patient is suicidal, so they're a higher risk.
1298.58s - 1301.30s |  So that would adjust the demand planning.
1301.30s - 1303.90s |  And that's something, again, you need good connection
1303.90s - 1308.66s |  with the physician and the health HCPs to determine what's correct.
1308.66s - 1312.66s |  And then, of course, the enabling of manufacturing with ML
1312.66s - 1314.42s |  is already in progress.
1314.42s - 1316.66s |  And they're just going to miniaturize that.
1316.66s - 1318.90s |  And it would make everything more visible.
1318.90s - 1324.18s |  And you can monitor the manufacturing in real time.
1324.18s - 1328.30s |  So I can't stress enough that maybe
1328.30s - 1330.90s |  with the high-level schemas that I presented to everybody,
1330.90s - 1333.78s |  you might kind of detect that we, again,
1333.78s - 1336.74s |  are not ready for this, but the technology is getting there.
1336.74s - 1338.46s |  And we need it.
1338.98s - 1340.86s |  Now we need it yesterday.
1340.86s - 1344.50s |  And so medical device manufacturers
1344.50s - 1347.98s |  need to start being aware of the three customers down the road
1347.98s - 1352.14s |  so that we can have safe and effective products that
1352.14s - 1358.22s |  are consented, that are safe, that have encrypted or private.
1358.22s - 1360.42s |  And that's not something medical device manufacturers
1360.42s - 1362.50s |  are always mindful of.
1362.50s - 1368.34s |  We are really in a next-gen humanity moment here.
1368.34s - 1372.46s |  Here's an example of 3D printing autologous bone.
1372.46s - 1374.18s |  So you have a defect.
1374.18s - 1377.70s |  Instead of a joint implant, you 3D print
1377.70s - 1379.86s |  a mold that's based off the defect.
1379.86s - 1382.70s |  And then you use a bioreactor to print your bone.
1382.70s - 1384.22s |  It's not just orthopedics.
1384.22s - 1385.74s |  It's just the low-hanging fruit.
1385.74s - 1387.34s |  I mean, the application is huge.
1387.34s - 1390.78s |  And the MDPS is going to be amazing.
1390.78s - 1395.10s |  So we are in a deus ex-human moment.
1395.10s - 1398.02s |  This is something I stole from my friend Nina.
1398.02s - 1399.46s |  And it's true.
1399.46s - 1401.10s |  We are making new humans.
1401.10s - 1403.58s |  And so how are we going to do this safe?
1403.58s - 1406.30s |  I encourage everyone to go to the resources I pointed out,
1406.30s - 1407.46s |  kind of look at the schema.
1407.46s - 1409.30s |  What can you do to encourage this
1409.30s - 1413.26s |  and where we can all have a better future and better
1413.26s - 1416.06s |  health care practice and better standard of care?
1416.06s - 1417.98s |  So I appreciate everyone.
1417.98s - 1419.74s |  Thank you.


url: https://www.youtube.com/watch?v=Lxg9YyFJ8s0
title: DEF CON 32 - Attacks on GenAI data & using vector encryption to stop them - Patrick Walsh, Bob Wall
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=Lxg9YyFJ8s0",
  "title": "DEF CON 32 - Attacks on GenAI data & using vector encryption to stop them - Patrick Walsh, Bob Wall",
  "description": "As the adoption of GenAI tools has soared, security has done little to keep up. New classes of data, and especially vector data, is flooding into new and untested data stores. Vector databases are getting copies of health data, financial data, HR data, emails, and everything else, but they have no intrinsic security. What's worse, the vectors themselves can be reversed in embedding inversion attacks that turn those vectors back into faces, sentences, and even pictures. We discuss these new attacks and a new branch of cryptography, vector encryption, which allows for privacy preserving searches to happen over the encrypted vectors. We'll discuss the benefits, trade-offs, and current state of the field and the open source software we've built to meet the new need.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1578,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.16s | This text was transcribed using whisper model: large-v2

 Welcome, this is the attacks on Gen AI data and using vector encryption to stop
5.16s - 10.68s |  them talk. I'm Patrick Walsh, this is Bob Wall, we're the co-founders of IronCore
10.68s - 15.12s |  Labs, where we help people protect data in their cloud applications by making
15.12s - 22.24s |  application layer encryption more easy and practical and usable. So this talk is
22.24s - 26.08s |  going to be about the ecosystems around LLMs, but we'll start by talking about
26.08s - 33.20s |  LLMs specifically, and in particular some limitations of LLMs, right? When an LLM is
33.20s - 38.44s |  trained, it's trained to predict a plausible completion to a prompt, and
38.44s - 42.32s |  that means it can sometimes make stuff up that sounds good but isn't necessarily
42.32s - 46.80s |  right. It's also trained on what, by the time it's released, is typically stale
46.80s - 50.76s |  data, because it takes a long time to train it, to test it, to fine-tune it, etc.
50.76s - 56.00s |  And then finally, it hopefully hasn't been trained on your data, and therefore
56.00s - 59.92s |  if you want it to do things that are cool across, you know, your corporate data,
59.92s - 63.84s |  your personal data, or something like that, it's not going to work. And to fill
63.84s - 68.04s |  those gaps, there's a thing called RAG, or Retrieval Augmented Generation.
68.04s - 72.68s |  Terrible name, basically means stuff extra stuff into the prompt so the LLM
72.68s - 77.32s |  can answer questions better. And it works a lot like this. You have a chat app, it
77.32s - 80.48s |  doesn't have to be a chat app, it's just like the most common thing to use, right?
80.48s - 85.44s |  A user asks a question, and now instead of passing that question to the LLM, the
85.44s - 90.40s |  first thing it does is a search. And that search is to find relevant documents
90.40s - 94.76s |  related to the query. That all gets jammed together into a prompt, which then
94.76s - 99.32s |  goes to the LLM. That's it, that's RAG in a nutshell, you get it. Here's a kind of
99.32s - 103.20s |  more practical example of what that looks like. There's a system prompt,
103.20s - 107.28s |  there's a history of the previous questions and answers from the chat, and
107.28s - 112.08s |  then there's the current, the most recent question, and then stuffed in with that
112.08s - 117.68s |  is any documents or web pages or whatever it is that might be related to
117.68s - 121.56s |  what the question was. In this case it's about, hey what's that draft 10Q,
121.56s - 126.12s |  it's a private document that's not public, and that's how it all gets in to
126.12s - 130.48s |  the LLM so it can answer questions on that private data. It's fundamental to
130.48s - 135.04s |  basically how everyone is using these stuff today, if you're using chat inside
135.04s - 140.28s |  an app. And to make all this work you need to have some type of more
140.28s - 144.52s |  intelligent search than what we typically do. Call it AI search, call it
144.52s - 148.32s |  semantic search or whatever you want to, and there's a bunch of ways to do this.
148.32s - 152.28s |  The most popular right now is an approach called vector search. It's kind
152.28s - 155.48s |  of what everyone is doing, although it's not the only way to do it.
155.48s - 161.16s |  And vector search and actually all of those AI search type techniques are
161.20s - 164.92s |  important because they, they differentiate between different
164.92s - 168.68s |  meanings of words, they can understand a sentence in context, they can understand
168.68s - 172.80s |  when arm means a division of an organization versus when arm is a body
172.80s - 179.16s |  part or, or even a verb, right. And in practice how these types of vector
179.16s - 184.48s |  search works is you start with some input document, and that input, do we lose
184.48s - 188.56s |  it, and that input document then gets chunked up into pieces. Sometimes it's by
188.56s - 193.24s |  sentence, sometimes it's sets of, call it 30 words, or it can be any strategy and
193.24s - 198.04s |  often overlapping. But each of those pieces gets run through something that's
198.04s - 203.56s |  very similar to an LLM, that sucks, that's very similar to an LLM, but is in fact
203.56s - 209.04s |  called a text embedding model. And a text embedding model, unlike an LLM, produces
209.04s - 214.52s |  something called a vector embedding. That's not great.
215.52s - 219.80s |  Produces something called a vector embedding. And the vector embedding is
219.80s - 224.76s |  basically just a long list of very small numbers. And those small numbers can be
224.76s - 229.40s |  hundreds or thousands in length. And we'll get into what they mean in a
229.40s - 232.76s |  minute here, but to give you some intuition on these, we'll take, look at a
232.76s - 236.00s |  list, like a vector that's only three long, right, because you can graph this in
236.00s - 239.04s |  3D space and you can understand it better. And if we have a bunch of
239.04s - 243.32s |  different vectors, let's say we have A and B and we have C, we can kind of look
243.32s - 246.60s |  at this visually and say, oh look, A and B kind of look like they're close
246.60s - 251.24s |  together and A and C look like they're far apart. And in fact, if we run a
251.24s - 255.76s |  distance comparison operation like this one, Euclidean distance, although there's
255.76s - 259.12s |  a bunch of different ones, they all have the same kind of effect, you can see that
259.12s - 264.72s |  you know A and B are 2.2 apart, whereas A and C are 5.6 apart. And the way this
264.72s - 269.60s |  works with search is we take a query, right, it's a sentence, and we reduce it
269.60s - 273.84s |  to, let's say, A. A is a vector representation of what we queried, and
273.84s - 277.20s |  then we search across all our vectors and we say, give me anything that's
277.20s - 281.64s |  similar to A, and then hopefully, if it does it right, it returns B but not C.
281.64s - 286.60s |  That's it. That's what vector search is doing. It's the whole shebang. The vector
286.60s - 291.68s |  represents the meaning of the content. And to make that work, we have this kind
291.68s - 295.72s |  of new concept, or at least new to a lot of us, at least to me, although I guess
295.72s - 299.40s |  it's been around for quite a while, and that's called a vector database. And a
299.40s - 302.84s |  vector database's purpose is to be able to do these nearest neighbor or
302.84s - 306.96s |  approximate nearest neighbor searches across the large amounts of data very
306.96s - 311.00s |  quickly. And there are a lot of these companies now that are doing this. In
311.00s - 315.20s |  fact, last year we saw hundreds of millions of VC money go into the
315.20s - 318.28s |  startups that are building vector databases. Startups like Pinecone and
318.28s - 324.20s |  Weaviate and Quadrant. And despite that, the idea of a vector database is already
324.20s - 328.44s |  eroding away to nothing because classic databases like Mongo and Postgres and
328.52s - 332.32s |  Oracle are all adding vector capabilities to their existing databases. So you're
332.32s - 335.68s |  getting these type of vector comparison nearest neighbor search capability
335.68s - 340.24s |  pretty much everywhere that you have a database now. Okay, changing tracks for a
340.24s - 345.96s |  second. We started thinking to ourself, who's using this stuff? Well, we looked at
345.96s - 351.92s |  the top 10 SaaS companies and we thought, how many of them are doing adding LLM
351.92s - 355.12s |  capabilities over private data? Which means that they're almost certainly
355.20s - 359.72s |  using RAG. The answer is 100%. Then we said, well what about security companies?
359.72s - 363.28s |  They wouldn't jump on to just using all this new technology that we don't know
363.28s - 368.44s |  how to secure yet, would they? No, 100% of them too. Also adding LLM capabilities on
368.44s - 373.64s |  top of private data. Think about that for a moment, right? It means that these AI
373.64s - 377.64s |  systems, whatever cloud services and things you're using, they are hoovering
377.64s - 381.84s |  up this data. Probably copies of it are going into the vector databases as
381.88s - 387.92s |  vectors and among other places, which I'll talk about ever so briefly later. So
387.92s - 393.72s |  do these vectors matter? I was talking to the CEO of one of the vector database
393.72s - 397.20s |  companies who's raised tens of million dollars last year and he told me that a
397.20s - 400.68s |  vector was like a hash and it was basically meaningless, except for
400.68s - 404.84s |  comparison purposes. So which my first thought is, well you clearly don't know
404.84s - 411.24s |  how people abuse hashes. And my second thought is, you're wrong. So that isn't
411.28s - 416.04s |  how it works at all. If you look at taking a phrase and you reduce it to an
416.04s - 420.80s |  embedding vector, an embedding model into a vector, okay, it looks pretty
420.80s - 426.32s |  meaningless to us. But then again, so does an animated GIF like this cat if you
426.32s - 430.00s |  look at it in a text editor, right? It just because it's meaningless to us to
430.00s - 434.36s |  look at doesn't mean it is meaningless to a computer or in this case to an AI
434.36s - 440.04s |  model. And so the way you go back from a vector to the original text or
440.08s - 443.92s |  something approximating it is using something called an inversion model. An
443.92s - 447.96s |  inversion model is just a model that's trained on vectors to sentences so that
447.96s - 452.56s |  it can make that same prediction. In this case it comes close. It's our
452.56s - 456.60s |  income is down instead of our earnings is down, right, in this example. 100%
456.60s - 462.20s |  match on meaning, not 100% match on words. There are some tens of thousands of
462.20s - 467.12s |  papers on this at this point. It's heavily studied in academia, not widely
467.24s - 472.84s |  known, I don't think, broadly. Best paper we've seen for text inversions, and it's
472.84s - 475.68s |  not just text that vectors represent, I'll talk about that in a second,
475.68s - 482.56s |  recovers 92% of exact words. That means full names, everything coming right back
482.56s - 487.12s |  out exactly as it went in on the text, okay? The other 8% is basically
487.12s - 493.28s |  effectively the same anyway. So are these attacks hard? Could, you know, what's the
493.28s - 497.96s |  skill level for doing this kind of attack? The answer is most of these
497.96s - 502.08s |  papers have accompanying open-source software on GitHub, and so really you
502.08s - 504.84s |  just need someone who can run the software, not someone who knows how to
504.84s - 509.64s |  build the software, which means it's script kitty level. And on that note, we
509.64s - 512.72s |  actually ran some of these attacks ourselves. We posted some blogs you can
512.72s - 516.72s |  check out. We did one on, so I mentioned vectors can represent different things.
516.72s - 520.28s |  They can represent images for image search. They can represent faces or
520.32s - 524.96s |  voice prints or other things for that. We did one against facial recognition. That
524.96s - 527.72s |  doesn't use an inversion model. That's a different technique, by the way. It's, so
527.72s - 530.56s |  it's kind of interesting for that purpose, and we did one on text
530.56s - 536.36s |  inversions. Really good results. Like, you can really get all the stuff back out or
536.36s - 542.57s |  very, very near approximations of the inputs. Alright, so let's talk about
542.57s - 547.25s |  these new vector database companies. They probably have good security, right?
547.29s - 552.53s |  Actually, no. Super immature. They'll fix it over time. It'll be fine, but if you
552.53s - 558.77s |  look closely at these as we have, two of them have no default, no authentication
558.77s - 562.53s |  required by default, right? Making the mistakes of Elasticsearch and MongoDB of
562.53s - 568.69s |  years past, but not learning. One of them has services that are meant to be
568.69s - 572.53s |  internal services, and that, you know, there's no protection or authentication
572.53s - 576.09s |  on them, so that if someone goes to access that because the firewall
576.09s - 580.37s |  neglected to block a port, direct access back to the data without any
580.37s - 584.17s |  authentication. Two of them claim to have end-to-end encryption when they only
584.17s - 590.37s |  have TLS in transport, and more. I could go on. It doesn't matter. The point is
590.37s - 593.81s |  that these vector database systems, and for that matter the chat apps, either way
593.81s - 599.09s |  are like total treasure troves of information, and even if you don't use it
599.09s - 603.05s |  and invert it, they're, they're at least treasure maps of information because
603.05s - 606.01s |  they point back to the data, and you can, you can query it, and if you think about
606.01s - 610.93s |  that for a second, imagine that you're in a CTF competition in that corner of this
610.93s - 614.33s |  thing, and you know, you get into a machine, cool, but now you have to get the
614.33s - 617.29s |  flag, and it's in a database, you have to get into the database, and now you have
617.29s - 622.25s |  to reverse the schema, and you know, figure out a query, and find the flag. It
622.25s - 625.97s |  ain't as easy as it sounds, right? It's a lot of expertise and time to do that,
626.09s - 635.01s |  versus, you know, give me that data. It is like incredibly far, far easier to attack
635.01s - 641.01s |  these systems because you can do it in natural language. So what do we think
641.01s - 645.09s |  about bringing AI into our infrastructure? Maybe we should pause for
645.09s - 647.77s |  a moment and think a little bit about it, or if it's in there, maybe if you're a
647.77s - 650.77s |  hacker in the audience, you should think about, holy shit, there's a lot here. Let
650.77s - 655.37s |  me give you some ideas. Obviously everyone knows about prompt injections.
655.37s - 659.01s |  Maybe you don't, haven't thought so much about the fact that you can put a prompt
659.01s - 662.17s |  injection in the documents being searched, and they get pulled into the
662.17s - 667.17s |  prompt, and you can poison the prompt that way. Logs are everywhere. If you're
667.17s - 670.53s |  putting private data into the things that go to the LLMs, and the LLMs log it,
670.53s - 675.01s |  that's a problem, but also the prompt firewalls, if you're using those, are
675.01s - 678.81s |  logging that stuff too, so the data is kind of exploding, and don't even get me
678.81s - 682.25s |  started on agents. Talk to me after if you want to hear about my thoughts on
682.25s - 686.61s |  that, but if you're generating code to run to query a database, you're, you're
686.61s - 691.17s |  beyond hope. Today though, we're not going to talk about any of that. We're going to
691.17s - 695.33s |  talk specifically about this vector stuff, and how to protect it. So basically
695.33s - 698.89s |  today, the way to protect that is to encrypt it, and there's two approaches to
698.89s - 702.57s |  this, at least in academia, that you could do. One is fully homomorphic encryption,
702.57s - 707.81s |  and the other is partially homomorphic. So fully homomorphic encryption, there's
707.81s - 710.45s |  actually quite a few papers on this, and they're fairly interesting. There's a lot
710.45s - 714.33s |  of different approaches. Some of them require sending all the vectors to the
714.33s - 718.05s |  server, or some require some other stuff. They typically suffer from being slow,
718.05s - 722.25s |  and you would have to build your own vector database, and be another logo on
722.25s - 725.65s |  that wall, and compete with all the other vector databases on every other thing.
725.65s - 730.29s |  The other option is partially homomorphic encryption, and the idea here
730.29s - 734.21s |  is that something that's partially homomorphic is, is able to do some
734.25s - 738.53s |  operations, but not arbitrary operations. And in this case, we're talking about
738.53s - 744.49s |  optimizing for that nearest neighbor search type of operation. Okay, so in this,
744.49s - 749.37s |  in this example, partially homomorphic, specific to nearest neighbor searches.
749.37s - 754.65s |  And to talk more about this paper, and the work that we've done around it, I'm
754.65s - 765.24s |  going to turn it over to Bob. All right, we found this paper about a way to
765.48s - 770.76s |  encrypt vectors, and you can see the title, Approximate Distance Comparison
770.76s - 778.16s |  Preserving Symmetric Encryption. So that's a mouthful, but the, this algorithm
778.16s - 782.48s |  is a type of property preserving encryption, which means it's kind of like
782.48s - 786.76s |  order preserving encryption, or maybe deterministic encryption, if you've heard
786.76s - 790.88s |  of those. The property that this algorithm is preserving, though, is
791.28s - 797.56s |  distance comparison instead of equality or order. And so if you can preserve the
797.56s - 802.28s |  ability to compare the distance between two vectors after they've been encrypted,
802.60s - 807.00s |  that means your vector database continues to work on the encrypted vectors just as
807.00s - 812.92s |  well as it did on the original vectors. So like deterministic and order preserving
812.92s - 819.56s |  encryption, there's a trade off. The more secure you make it, the less well the
819.56s - 824.76s |  compare, the property is preserved, and so the less well queries might work on
824.76s - 828.88s |  the data. So you can kind of make a, you have a decision to make about whether
828.88s - 832.72s |  you want a lot of security, and you can tolerate maybe a little less accuracy on
832.72s - 836.44s |  queries, or you want a lot of accuracy on the queries, and maybe you'll have a
836.44s - 843.16s |  little bit less protection of the data. But the system works by, if you've got a
843.16s - 847.08s |  system that's ingesting data, and it's making these vectors, putting them into a
847.08s - 851.96s |  vector database, it's easy to add this encryption. You just, in the system
851.96s - 856.16s |  that's already there, after you've taken the data and run it through the
856.16s - 859.32s |  embedding model and generated the vector embedding, you run it through this
859.32s - 864.24s |  algorithm and encrypt it, it's still a vector, it looks similar enough to the
864.24s - 869.64s |  original vector that the vector database is gonna take it and be happy with it. So
869.64s - 873.84s |  you, you'd use a secret key, you encrypt the vector, you throw it in the vector
873.84s - 879.96s |  database. So very simple change to the system to be able to do that. Now most of
879.96s - 884.32s |  these vector database systems support storing metadata along with the vectors,
884.32s - 889.44s |  and that metadata might have some sensitive data in it too, so you might
889.44s - 892.92s |  want to consider encrypting that, that's a whole different thing, we're just gonna
892.92s - 897.54s |  focus on the vectors for right now. So once you've got all of these vectors
897.54s - 902.04s |  encrypted, you've loaded them into your vector database, when it's time to do a
902.08s - 906.84s |  query, it's also pretty simple. Again, you, you know, the normal process would be to
906.84s - 910.56s |  take the query, run it through the embedding model, get a vector, so then you
910.56s - 915.28s |  just encrypt that vector with the same key and the same algorithm, and then you
915.28s - 919.12s |  do your normal search. And because the algorithm, the encryption, preserves
919.12s - 923.76s |  distance comparison, that means that when you give that encrypted query to the
923.76s - 928.24s |  vector database, it's gonna return the encrypted vectors that are closest to
928.24s - 933.60s |  the encrypted query, and those are gonna correspond to the decrypted vectors, the
933.60s - 938.08s |  original vectors, that are closest to the original query. So you get the same
938.08s - 944.52s |  results out, pretty much, and once you get them out, you can maybe decrypt the
944.52s - 948.36s |  vectors if you need to, or maybe you've got some metadata that lets you look up
948.36s - 955.04s |  the associated data in a database or something else. So without the key, an
955.04s - 960.28s |  attacker can't really understand the queries. They're, they are enough different
960.28s - 964.32s |  that they can't look at that and kind of know what the query was. They can't
964.32s - 968.48s |  invert the data that's in the database, even if they hacked it, exfiltrated all
968.48s - 975.04s |  the data, they can't easily invert it. The results are still fairly accurate. Again,
975.04s - 980.12s |  that's a trade-off between the security and the accuracy of their searches. The
980.12s - 985.04s |  whole thing is, it introduces a negligible penalty in terms of
985.04s - 991.16s |  performance. The encryption process is fast, so you can add this in and not add
991.16s - 996.12s |  a lot of time to your process. So I'm gonna talk a little bit more about this
996.12s - 1002.44s |  encryption function. So it's a function, it maps inputs to outputs, and it does it
1002.44s - 1007.44s |  such that for any distance function, the margin of error that you get when you
1007.44s - 1012.00s |  compare two encrypted vectors will be within some factor, we'll call that beta,
1012.00s - 1017.16s |  the approximation factor, of the original distance. And so if you can build a
1017.16s - 1021.24s |  function that preserves that for any pair of vectors that you give
1021.24s - 1026.48s |  as an input, then you have a distance comparison preserving encryption
1026.48s - 1031.84s |  function. So in real systems, we kind of talked about this, the comparison
1031.84s - 1035.48s |  function is used for nearest neighbor and approximate nearest neighbor
1035.56s - 1040.76s |  searches, which is what all these vector databases are doing. So, you know, if we
1040.76s - 1044.56s |  can build, and we can, we've built this function that preserves distance
1044.56s - 1050.08s |  comparison so we can use it to encrypt these vectors. So the paper introduced
1050.08s - 1055.00s |  this scale and perturb algorithm, and I won't go into a lot of details about how
1055.00s - 1061.52s |  it works, but I will give you a few key points about it. So there's a scale
1061.60s - 1066.56s |  factor, when you, when you set up the algorithm, you randomly choose this scale
1066.56s - 1075.94s |  factor and you choose a random key. And so there's also, when you go to encrypt
1075.94s - 1081.94s |  an individual vector, you generate an initialization vector, an IV value, just
1081.94s - 1085.90s |  the same as you might if you're doing symmetric encryption on data with,
1085.90s - 1092.98s |  you know, a normal symmetric algorithm. And you perturb each element of the
1092.98s - 1099.06s |  vector using that key in that initialization vector randomly. So every
1099.06s - 1101.94s |  element in the vector is going to get wiggled around a little bit, and that
1101.94s - 1106.22s |  amount that it gets wiggled around depends on that value beta, that
1106.22s - 1111.98s |  approximation value, and that's how it limits the change in the distance that
1111.98s - 1120.14s |  you can get. So the paper had this idea of perturbing the vectors as well, and
1120.14s - 1123.74s |  they basically had this idea of shuffling. If you had all of the vectors
1123.74s - 1128.82s |  you would shuffle the order of them before you encrypted them, and we wanted
1128.82s - 1133.26s |  an online algorithm so that you could, you know, you just encrypted the vectors
1133.26s - 1138.90s |  as you saw them. So we didn't find that shuffling to be beneficial, but we did
1138.90s - 1143.70s |  add a shuffle where we took the elements of the vector and shuffled them up. So we
1143.70s - 1147.74s |  randomly changed the order, and it's a deterministic shuffling based on the key.
1147.74s - 1153.26s |  So when you get done, all of the elements in the vector have been scaled, and then
1153.26s - 1157.38s |  they get shifted around, which makes it even harder if, even if you knew what the
1157.38s - 1161.78s |  algorithm, what the embedding model was, all of the elements of the vector are in
1161.78s - 1165.54s |  different places, which makes it a lot harder to look at it and try to even
1165.54s - 1173.68s |  guess how it corresponds to the original vectors. So to give a little bit of a more
1173.68s - 1178.88s |  intuition about this, you can think about these vectors, I mean, a vector is a line
1178.88s - 1184.22s |  from the origin to some point, and the point is defined by the elements in the
1184.22s - 1190.30s |  vector, right? Those are the coordinates of that point. And so the beta basically
1190.30s - 1196.70s |  defines a sphere in n-dimensional space around that point. And so as we perturb
1196.70s - 1202.06s |  the elements of the vector, the resulting point is somewhere within that sphere, and
1202.06s - 1206.30s |  the size of that sphere is governed by that beta value, the approximation
1206.30s - 1212.42s |  factor. So you can see that if you, if you bound the amount that you can move the
1212.42s - 1216.58s |  point around, and you've bound the amount that you've moved another point around,
1216.58s - 1221.30s |  the distance between those is bounded too. So that's how it manages to preserve the
1221.30s - 1227.58s |  distance comparison. So in addition, we talked about, we also scaled the vectors up
1227.58s - 1231.26s |  so that they're, you know, they get moved around a little bit, they get scaled, so
1231.26s - 1235.18s |  when, if you just look at them, and then the elements get shuffled, so it's very
1235.18s - 1241.18s |  difficult to correlate an encrypted vector and the original vector that was encrypted.
1241.18s - 1247.74s |  Again, because we've preserved that distance comparison, they're still relatively
1247.74s - 1255.38s |  close together to, with each other. Here's an example. We kind of turned off the shuffle
1255.38s - 1259.50s |  part of it so it wouldn't be quite as difficult to see, but you can see, you know, we
1259.50s - 1264.30s |  scaled it up, and then we perturb everything. So sometimes, depending on how much we
1264.30s - 1268.78s |  perturb stuff, signs on elements might change, you know, they bounce around a little
1268.78s - 1276.94s |  bit, but they're still in this vector. So we've implemented this algorithm. We've
1276.94s - 1282.18s |  got an open source library we call IronCoreAlloy that's out there on GitHub. It's
1282.18s - 1288.86s |  under the AGPL license, so if you can use GPL software, you can go grab it and use it.
1288.86s - 1296.10s |  If you can't use GPL software, you can talk to us about a different arrangement. Along
1296.10s - 1299.50s |  with the library, we've got some sample code that shows how you can use it with a
1299.50s - 1304.74s |  number of different vector databases, and it, as I said earlier, it's easy. So the
1304.74s - 1308.98s |  examples aren't super complicated. It's pretty easy to drop this into some code that's
1308.98s - 1313.74s |  going to put data in one of these vector databases. The library isn't written in Rust,
1313.74s - 1318.74s |  but we've exposed it in Java, Kotlin, and Python. We've got some more language support
1318.74s - 1327.50s |  on the way. Along with the examples, we've got some results of using this on some
1327.50s - 1336.74s |  output of different LLMs, open source LLMs, and you can see for an approximation factor
1336.74s - 1343.10s |  of one and a half, which is a pretty modest one, we don't impact the search performance.
1343.10s - 1346.70s |  We measured precision and recall loss, which are pretty common measures of search
1346.78s - 1355.84s |  accuracy. It didn't really impact the search accuracy much at all. So, you know, it works.
1355.84s - 1361.64s |  So now, once we've encrypted these vectors, suppose we want to run an attack on them.
1361.64s - 1366.96s |  We're going to run on one of the inversion models that Patrick was talking about. So
1366.96s - 1371.88s |  we know exactly, somehow we know exactly what the embedding model was that was used. It
1371.88s - 1375.88s |  was an open source one, so we don't have to, we train this up once and it's going to work
1375.88s - 1380.64s |  on every embedding that was generated by that embedding model. But we're going to try
1380.64s - 1386.52s |  to run it on the encrypted vectors. Well, it turns out because we've done the perturbation
1386.52s - 1395.00s |  and we shifted around all of the elements, okay, we, it's mostly gibberish that we get
1395.00s - 1404.16s |  out. So, you really can't tell much about them. Even if somebody knows the plaintext
1404.16s - 1411.00s |  and they have a black box access to the model and they're going to submit vectors, get encrypted
1411.00s - 1415.60s |  vectors out for a particular key and they're going to train their own inversion model,
1415.60s - 1421.04s |  the randomization makes that so that it's very difficult and you get a lot less valuable
1421.04s - 1428.08s |  results. You might get a little bit of the meaning. You're not going to get exact words.
1428.08s - 1436.56s |  And if you, and again, it depends on what value you use for that approximation model.
1436.56s - 1442.68s |  If you knew the plaintext and you knew the ciphertext, can you extract the key? No. It's
1442.68s - 1449.72s |  based on a probabilistic random function that's essentially like a 256-bit keyed hash. And
1449.72s - 1453.24s |  I don't know about you, but I don't want to spend my next two billion weekends trying
1453.24s - 1460.24s |  to brute force attack a 256-bit keyed hash. So, I'm going to turn it over to Patrick and
1460.24s - 1465.37s |  he'll summarize for you.
1465.37s - 1473.53s |  Okay. So, okay. So, the takeaways that we hope you have here as we just did a real brief
1473.53s - 1478.65s |  fast run through on what this is and how it works is first and foremost, you should walk
1478.65s - 1484.65s |  away realizing that RAG produces a lot of copies of data. So, if people are using AI
1484.65s - 1491.13s |  and LLMs in their applications and somehow that they're operating over data that model
1491.13s - 1495.81s |  wasn't trained on, probably they're doing this and probably lots of copies of that data
1495.81s - 1501.53s |  are being made. It's sprinkled everywhere. And vector databases are like a key part of
1501.53s - 1507.93s |  that. Second thing is that vectors and vector databases can be inverted back to their original
1508.01s - 1515.53s |  input or something very closely approximating it, right? High fidelity and low effort attack.
1515.53s - 1519.13s |  And oftentimes an attacker won't even need to do that. If they have access to the chat app,
1519.13s - 1523.61s |  they can bypass that even. But never mind. If they have access to the vector database,
1523.61s - 1528.97s |  that's as good as having access to the chat app, right? And then the third takeaway that
1528.97s - 1534.73s |  we want you to walk away with is this. It isn't that hard in this case because there's a built
1534.73s - 1541.77s |  open source library to implement a solution to this problem in your software. So, if you
1541.77s - 1548.41s |  want to, feel free. Check out the results. Go try it online. The results you get in a vector
1548.41s - 1553.69s |  search are really close to the original. Like it looks the same to me pretty much across the board.
1553.69s - 1558.01s |  The benchmarks show a few percent differences. There's almost no performance penalty.
1558.01s - 1563.05s |  From a latency perspective, there's almost no reason not to encrypt your vectors if they
1563.05s - 1568.57s |  contain sensitive data in them. And that's it. Thanks for your time today. We're going to be out
1568.57s - 1572.97s |  there probably just outside the Creator Stage area if people want to chat with us or have any
1572.97s - 1575.13s |  questions. Thanks for your time.


url: https://www.youtube.com/watch?v=O48DBFT02eU
title: DEF CON 32 - Simulating attacks against hydroelectric power plants - Julia Dewitz-Würzelberger
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=O48DBFT02eU",
  "title": "DEF CON 32 - Simulating attacks against hydroelectric power plants - Julia Dewitz-W\u00fcrzelberger",
  "description": "In this talk we will present the ICS firing range we built and hacked to simulate an actual attack against a hydroelectric power plant and create a DFIR training from the evidence left behind. The talk aims to emphasize the importance of attack simulation in the context of critical infrastructure and the potential benefit that firing ranges can provide to such assessments.\n\nFirst we will examine the motivation behind the construction and usage of a firing range, covering various aspects including:\n\nthe threats operators of critical infrastructure face,\nhow security assessments are conducted in an OT context and\nhow an ICS firing range can be utilized to support them.\nNext we will discuss the intended use cases of the firing range and the scenario it was made to display, the flooding of a hydroelectric power plant. As a result, the relevant components and production processes of the plant will be outlined. Then we will present and go into detail about the design & architecture of the firing range:\n\nindividual physical and virtual networks and components,\nseparate Active Directory environments,\nimplemented security measures\nspecific vulnerabilities intentionally left behind.\nPicking up this last bullet-point, we continue with how we hacked the firing range and performed a Red Team assessment against it, simulating an actual attack. Starting with the C2 infrastructure we set up for the attack, we will guide the audience through the kill chain in chronological order and highlight the most important and relevant steps of the attack.\n\nOnce the offensive part of the talk concludes, a shift of perspective takes place and the attack is evaluated from the defence's point-of-view: we'll show how we identified, secured and analyzed indicators of compromise left behind by the attack. This includes the analysis of network captures, Windows event logs, memory dumps and more.\n\nThis talk will be presented by not only people from NVISO as the IT security service provider who built the firing range and performed to attack against it, but also by people from VERBUND's IT security team who actively use the firing range for training. This way we can involve both the attacker's and the defence's point-of-view.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1360,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.16s | This text was transcribed using whisper model: large-v2

 Thanks for your patience, thanks for your interest in this talk today.
4.16s - 7.92s |  My colleagues and I, Sarah, Bernhard and I, my name is Julia,
7.92s - 11.68s |  we will talk about a project that we made together, a joint project,
11.68s - 15.84s |  and we actually created a run-of-river prototype together.
15.84s - 26.24s |  Since Verbund is a hydropower energy supplier in Austria,
26.24s - 29.28s |  actually, especially in the field of renewable energy,
29.28s - 32.00s |  like hydropower, solar power and wind power,
32.00s - 34.72s |  and maybe you just want to say a few words about Enviso.
36.24s - 42.48s |  Yes, hi everybody. Enviso is a security consulting company from Europe.
42.48s - 47.84s |  We are mainly focused on the financial and technology sector
47.84s - 50.80s |  and also the governmental and critical infrastructures.
51.44s - 54.80s |  So, I want to use the moment, since this was a team effort,
54.80s - 56.48s |  to give a shout-out to a few people.
56.48s - 62.64s |  So, great thanks to Alex, Moritz, Olaf, Nicolas, Vanessa and Patrick.
64.00s - 64.64s |  Thanks, Sarah.
65.20s - 68.00s |  Okay, so as I said, it's about a prototype that we built,
68.00s - 71.36s |  or specifically Enviso did a lot of the creating process.
72.00s - 75.84s |  And we chose a run-of-river power plant, hydropower plant,
75.84s - 79.60s |  to visualize the effects of a cyber attack on such a plant.
81.36s - 84.64s |  So, it's not only like a visual awareness tool,
84.64s - 87.68s |  it's also supposed to be a forensic training tool.
87.68s - 91.20s |  So, what also is included in this ICS firing range...
96.30s - 98.62s |  Okay, I hope you can still hear me.
100.46s - 105.98s |  Okay, but in fact, we really tried to also include a forensic training
105.98s - 110.06s |  in the ICS firing range that has more than, I think, 10 modules.
110.06s - 111.10s |  I think it's 15.
111.66s - 113.50s |  And Bernhard will get into that a bit later,
113.50s - 116.94s |  but you can really investigate a forensic training
116.94s - 119.82s |  in how the cyber attack on a run-of-river power plant worked.
123.44s - 125.36s |  Motivation and project idea.
127.78s - 128.28s |  Thank you.
129.22s - 133.54s |  So, what was the motivation for two companies like us to create such a prototype?
133.54s - 137.14s |  So, for Brint, it was especially that we are critical infrastructure.
138.10s - 141.06s |  We are a really large power supplier in Austria.
141.06s - 145.38s |  So, of course, IoT cybersecurity is like one of our biggest priorities.
146.10s - 148.90s |  And since all of us three are from this section,
149.54s - 152.18s |  we really wanted to do an innovative project together.
153.22s - 159.22s |  And what actually is also one of the most motivational parts for this project was
159.22s - 163.86s |  that for Brint is planning to build a really big cyber security range
163.86s - 169.14s |  focused on IoT in Austria, in Styria, at a local site of a plant.
169.14s - 172.66s |  And we really want to get all the IoT specialists there from for Brint,
172.66s - 177.30s |  but also externals to train there and to get their cybersecurity knowledge up.
177.86s - 183.54s |  So, first, we wanted to have a prototype before we really build a really big cyber range.
184.34s - 186.42s |  That was one of the great motivations.
186.42s - 187.94s |  Do you want to get into that?
188.50s - 189.22s |  Okay.
189.22s - 194.66s |  So, our main motivation is to strengthen the security resilience of our customers
195.46s - 203.54s |  by building realistic attack scenarios that represent actual IoT cyber threats.
203.54s - 206.26s |  So, we do this either in Red Team assessments or, as in this case,
206.26s - 212.18s |  we're building a realistic training scenario for Brint.
214.18s - 217.22s |  Different IoT environments has faced different challenges.
217.22s - 220.50s |  Therefore, it was very important for us to create a tailored training approach
221.14s - 224.50s |  that actually fit the requirements previously described by Julia.
225.54s - 245.10s |  So, having a visible and practical approach like in the cyber range can help to make things
245.10s - 247.42s |  more tangible and therefore to raise awareness.
257.42s - 260.46s |  And finally, if you look at the current IoT threat landscape,
260.46s - 263.42s |  you can see that the things are getting worse.
263.50s - 267.58s |  And therefore, it's even more important to have proper training capabilities at hand
267.58s - 272.38s |  to increase the detection and response readiness
272.38s - 275.42s |  of the people that actually have to deal with cyber incidents on site.
277.82s - 278.62s |  Thanks, Sarah.
278.62s - 280.78s |  So, as we said, let's summarize it.
280.78s - 284.38s |  Two things were the main objectives for this project.
284.38s - 289.18s |  It's awareness building for people who may only know a little bit about cybersecurity,
289.18s - 292.22s |  but also forensic training for specialists in the field.
292.22s - 293.02s |  Next slide, please.
297.41s - 300.53s |  So, what is really important to us, as I told you,
300.53s - 303.33s |  us three are from the field of IoT cybersecurity.
303.33s - 305.25s |  So, we're not in operational field.
305.97s - 309.49s |  We're not working directly in a power plant.
309.49s - 312.29s |  So, we need to include the knowledge from internal colleagues,
312.29s - 316.05s |  but also from manufacturers to gain really a good understanding
316.05s - 322.05s |  of how an ICS firing range could look like an abstracted model of a hydropower plant,
322.05s - 326.85s |  since it's not exactly a realistic one, but as close as possible.
327.41s - 332.53s |  And one of the really biggest inputs that we received from internal colleagues was,
332.53s - 334.37s |  of course, as we have, I think,
334.37s - 338.13s |  Verbund has already over 130 power plants in Austria.
338.93s - 343.01s |  We really need to have a control room where all the measured data comes together
343.01s - 346.45s |  and everyone can monetize the data that comes here
346.45s - 349.73s |  and see if everything's all right in the plant itself.
350.29s - 356.45s |  And we realized this kind of control room within an HMI on the ICS firing range,
356.45s - 359.73s |  where you can also control the range in itself
359.73s - 362.29s |  and you see all the measured data from the power plant.
362.29s - 366.13s |  And you can also give an input as to, say, control the wares
366.13s - 368.85s |  that is also included in this prototype.
368.85s - 371.57s |  But also, for example, you can raise the water levels.
373.17s - 378.61s |  And, yeah, so that was one of the main important inputs that our people gave us.
378.61s - 384.05s |  And we really tried to include it to make it as, you know, real as possible.
386.45s - 388.45s |  Next, I want to give you some...
389.41s - 390.21s |  Please, next slide.
394.48s - 397.84s |  I want to give you some hard facts about the ICS firing range.
397.84s - 401.12s |  As you can see, the project had a duration of around one year.
401.68s - 407.04s |  One of the challenges was that our team is in Austria, Bernhard and my team,
407.04s - 408.72s |  but Enviso is in Germany.
408.72s - 412.08s |  I think most of them were in Frankfurt and we were in Vienna.
412.08s - 414.32s |  So, of course, we had quite a big span.
415.12s - 419.28s |  And many or actually all of our meetings were remote meetings.
419.28s - 420.72s |  So, that's also a challenge.
420.72s - 424.08s |  Bernhard will get into the challenges later a bit.
424.08s - 428.40s |  But it's not so easy since we could not get together and build on it together.
428.96s - 431.28s |  But I think it still worked really well.
431.28s - 436.96s |  And what I also think is really cool is that we had a lot of people in this project.
436.96s - 438.80s |  So, now you're just seeing us three.
438.80s - 441.68s |  But as Sarah mentioned at the beginning, it was really a team effort.
441.68s - 443.76s |  We had over 30 people involved.
443.76s - 448.16s |  We had students from the university in Vienna, the technical university in Vienna,
448.16s - 450.40s |  who really programmed the cyber attack for us.
450.96s - 455.04s |  And Enviso did the part of going into the construction.
455.04s - 457.36s |  And that's why I want to give the mic to Sarah,
457.36s - 461.04s |  because she will get into the construction and logical construction part now for you.
463.36s - 464.88s |  Yeah, thank you, Julia.
464.88s - 467.12s |  So, now we're getting into the more technical part.
467.12s - 470.72s |  So, as you could see in the previous slide, the cyber range consists of two layers.
471.44s - 473.60s |  So, on top, which is the slide that you can see now,
473.60s - 476.00s |  is the scenario and visualization layer.
476.00s - 481.12s |  Below that, we have the electric cabinet with all the technical components inside.
483.12s - 491.36s |  The scenario and visualization layer has, at first, the modulated hydro power plants.
491.36s - 492.88s |  So, we have a river, of course.
492.88s - 494.56s |  We have head and tail water.
494.56s - 495.76s |  We have a turbine building.
495.76s - 496.88s |  And we have the weirs.
496.88s - 500.48s |  So, we have one twin weir for the normal operations.
500.48s - 502.64s |  And we have one emergency weir.
503.20s - 508.56s |  Since you cannot look into this little building, to make things more tangible,
508.56s - 516.08s |  we also added the HMI to the cyber range and also a model of the turbine,
516.08s - 519.92s |  including the shutters that actually control the water flow that hits the turbine.
521.60s - 523.28s |  Okay, next slide, please.
524.56s - 526.32s |  Now, you can see the electric cabinet.
527.92s - 530.64s |  Here, we have, at first, a few basic components,
530.64s - 535.36s |  as, for example, power supply and general safety and controlling equipment.
535.36s - 540.40s |  So, on the upper left, we have the contactor and electronic circuit breaker
540.40s - 541.84s |  that handle electric faults.
542.56s - 547.28s |  Additionally, we have the PSUs that provide 5, 12, or 24 volts
547.28s - 550.16s |  to the different components of the cyber range.
550.16s - 554.40s |  And below that, we have the terminal blocks that are used for the distribution of the power.
555.04s - 562.64s |  The heart for our cyber range is a network of programmable logic controllers
563.20s - 566.72s |  and Raspberry Pis that are orchestrated to emulate
567.44s - 570.32s |  electromechanical and hydraulic processes.
570.32s - 574.72s |  These PLCs are the decision-making brain of our firing range.
576.40s - 579.44s |  To make a realistic scenario, we actually implemented
579.52s - 586.56s |  a commonly used PLC, specifically the Siemens Seachem A8000.
587.76s - 591.84s |  The Raspberry Pis serve as remote IOs for these PLCs.
591.84s - 595.52s |  And in the little box on the right bottom, you can see
597.60s - 600.08s |  there are the IO drivers for the Raspberry Pi
600.08s - 602.80s |  to actually drive the stepper motors of the wheels.
602.80s - 607.36s |  Above that, in the upper right corner, you have the Siemens BoxPC.
607.36s - 610.16s |  And the Siemens BoxPC is used to drive the HMI.
611.12s - 613.04s |  So please, next slide.
613.04s - 614.96s |  So tying it all together, how does this work?
614.96s - 617.04s |  What is the logic of the cyber range?
617.04s - 621.60s |  So as I mentioned before, we have the PLCs and the Raspberry Pis
621.60s - 623.20s |  that are connected via Modbus.
624.32s - 628.40s |  We have the HMI that is connected via S7 COM with the PLCs.
629.04s - 635.12s |  And the sensors and actuators are connected via I2C and GPIOs with the Raspberry Pis.
635.12s - 640.72s |  If I talk about sensors here, then I mean the opening level sensors for the wheels
640.72s - 642.48s |  and also the shutters of the turbine.
643.60s - 645.52s |  OK, you may have recognized this.
645.52s - 648.96s |  We have a hydroelectric power plant, but we don't have water at the moment.
648.96s - 650.56s |  So that's actually bad.
650.56s - 652.00s |  So maybe there's something missing.
652.96s - 655.92s |  If you want to create a model including real water,
655.92s - 658.08s |  this is always kind of error prone.
658.08s - 661.44s |  We have a lot of electric here, so we decided to go a different approach.
662.40s - 667.44s |  And for this, we added a simulation layer to the logic of the cyber range.
668.24s - 671.36s |  In this simulation layer, we have a simulation program.
671.36s - 677.44s |  This program actually emulates the water level of the headwater of the power plant.
679.36s - 685.68s |  In combination with the actual data, so the sensor data retrieved from the Raspberry Pi,
687.12s - 689.60s |  this program calculates the new water levels
689.60s - 693.28s |  and publishes these water levels to the MQTT broker.
694.00s - 698.56s |  The Raspberry Pi's MQTT client is then subscribed to these values.
698.56s - 701.28s |  So it retrieves all the updates of the new water levels
701.28s - 703.60s |  and forwards these water levels to the PLCs.
704.24s - 704.88s |  OK, nice.
704.88s - 707.36s |  Now we have water, but still only in logic.
707.36s - 710.72s |  So you can still see no water on our model.
710.72s - 712.80s |  OK, so another step is necessary.
712.80s - 715.84s |  And therefore, we added another machine, the visualization machine.
716.64s - 723.36s |  The visualization machine is basically a projector that is tied on top of our model.
724.80s - 725.76s |  Please, next slide.
726.88s - 731.52s |  There you can see in the middle picture, you can see the projector that is on top of our model.
731.52s - 739.12s |  And in combination with our SYN client, they also consume the water levels
739.76s - 743.44s |  from the MQTT broker and project them on the model.
744.32s - 746.08s |  How did we do this?
746.08s - 750.96s |  To actually create the images for the water, there is a Unity game running
751.60s - 757.36s |  that contains that surface structure represents the surface structure of our range.
758.00s - 761.52s |  And additionally, we have a blue layer in this Unity game,
761.52s - 765.92s |  and its height is increased and decreased as needed to represent our water levels.
767.52s - 768.40s |  OK, nice.
768.40s - 770.40s |  Now we have a working power plant.
770.48s - 771.44s |  Working power plant.
772.64s - 778.24s |  But to actually create training scenarios for this cyber range,
778.24s - 779.76s |  we also need network infrastructure.
779.76s - 781.36s |  So please go to the next slide.
783.04s - 787.04s |  The network infrastructure for the firing range is also split up into two parts.
787.04s - 789.68s |  So we have the IT and the OT network.
789.68s - 796.88s |  The IT network hosts multiple virtual machines that emulate a classic office environment.
796.88s - 799.68s |  The IT network is completely virtualized.
800.56s - 804.56s |  And the OT network contains two networks.
804.56s - 806.16s |  So a virtual and a physical one.
806.16s - 809.92s |  The physical one hosts the PLCs.
810.48s - 814.96s |  And the virtual one hosts a virtualized active directory.
814.96s - 815.60s |  OK, nice.
815.60s - 819.04s |  Now we can actually start implementing attacks here in our cyber range.
820.08s - 823.44s |  And if you look at the current OT incidents,
823.44s - 827.12s |  then you can see that actually a lot of OT incidents start in IT.
827.12s - 829.44s |  So that is also the case for our attack scenario.
830.00s - 831.60s |  So a very classic one.
831.60s - 835.20s |  The attacker sends a phishing mail to the victim,
835.76s - 842.72s |  which orders the victim to download an executable from an attacker-controlled web server.
842.72s - 845.92s |  This executable, surprise, contains an SITU implant.
845.92s - 850.56s |  And after execution, the attacker has an initial foothold in the IT network.
851.20s - 854.80s |  Further, poorly configured workstation security allows the attacker to
854.96s - 862.16s |  dump credentials, escalate privileges, and finally move laterally and
862.80s - 866.00s |  compromise the jump host and the control technology DMC.
866.00s - 867.36s |  So actually very bad.
868.56s - 869.36s |  Why is this bad?
869.36s - 873.60s |  Well, the jump host and the control technology DMC is used to manage the PLCs.
873.60s - 878.40s |  So it's used to reprogram the PLCs in absolutely a place
878.40s - 880.80s |  where you do not want to have unauthorized personnel.
882.72s - 884.32s |  But it's even getting worse.
884.40s - 888.40s |  So the attacker starts enumeration of the network, dumps the active directory,
888.40s - 894.24s |  and further analyzes which servers are accessible with the currently owned privileges.
895.60s - 898.96s |  Unfortunately for the power plant, and fortunately for the attacker,
898.96s - 904.00s |  he is able to access the Nextcloud Datastore.
904.00s - 907.04s |  So what is the Nextcloud Datastore and why is this bad?
907.04s - 910.72s |  Well, the Nextcloud Datastore is used to host the project files for the PLCs.
910.72s - 914.40s |  So that's actually very valuable information for the attacker,
915.04s - 918.96s |  since the project files contain the logic of the PLCs.
918.96s - 921.92s |  And, well, the PLCs control the power plant.
921.92s - 923.12s |  So not too nice.
924.24s - 929.68s |  Attacker is happy, is exfiltrating these files via the previously established C2 channel,
931.12s - 936.48s |  analyzes it, modifies it, and re-uploads the files to the Nextcloud Datastore.
936.48s - 939.76s |  And what happens next and why this is a problem, Bernard will tell you.
942.51s - 947.39s |  At the next stage, as an OT operator, I took the project file,
947.39s - 950.11s |  deployed it on my PLCs, and the horror is starting.
950.11s - 956.51s |  So an immense flood is running over the water power plant and also the environment.
958.19s - 958.83s |  Next slide.
960.35s - 961.79s |  Training and DFIR.
963.07s - 967.87s |  We have separated into 15 labs, which are separated in three main parts.
967.87s - 970.75s |  The first main part is the analyzing part.
970.75s - 975.63s |  The second part is see how an attacker is working on the environment
975.63s - 978.35s |  and which tools they are using normally.
978.35s - 982.27s |  And also we use OS typical forensic parts.
982.27s - 986.27s |  So we will show the people who are working on a water power plant,
987.23s - 993.47s |  what can we see, what is a security engineer seeing, and what can he see in real life.
994.43s - 999.39s |  And also we get into deeper of the Siemens toolbox,
999.39s - 1002.59s |  which we use to program the logical units.
1002.59s - 1007.95s |  And we also do the analyzation of the files from the toolbox.
1008.59s - 1009.23s |  Next slide.
1013.10s - 1021.86s |  The lessons learned.
1023.14s - 1029.70s |  These are the heavy part because the ICS fire range is a bit bulky and heavy.
1030.34s - 1034.90s |  We heard before it's a lot of weight and a lot of metal in it.
1035.94s - 1040.90s |  Also, the most important part is to create an easy to use
1040.90s - 1044.66s |  and also good resilient backup and restore solution.
1044.66s - 1049.78s |  Because if we do some trainings, we should be really fast in restoring
1049.78s - 1055.38s |  and deploying and backuping the situation where we can do the live trainings on it.
1055.38s - 1061.78s |  So it took us a long time to create consistent ESXi backups
1061.78s - 1065.70s |  in combination with the graphics and also the Raspberry configuration.
1066.82s - 1067.38s |  The noise.
1068.26s - 1072.34s |  Noise is really important because it's not the best choice to
1072.34s - 1075.14s |  took the first switch which you have in your depot.
1075.14s - 1079.86s |  Normally we have a Cisco catalyst switch from an old environment.
1079.86s - 1081.70s |  So it was really noisy.
1081.70s - 1083.30s |  It was active cooled.
1083.30s - 1086.34s |  So we changed the switch to a passive cooled switch.
1086.34s - 1089.22s |  So everyone who is trying such a project,
1089.22s - 1094.26s |  use as most as you can passive components because there's some really loud.
1095.78s - 1096.66s |  Model building.
1096.66s - 1099.22s |  Yeah, model building is not a technique.
1099.22s - 1101.38s |  It's also a bit of art.
1101.38s - 1105.94s |  So you had to design the mountains and you had to design the cars and so on.
1105.94s - 1107.70s |  So a typical Austrian environment.
1108.74s - 1113.30s |  The PCAP size during the analysis and for the training is also important
1113.38s - 1119.30s |  because not everyone is happy to handle a lot of gigabytes from PCAP files.
1119.30s - 1123.14s |  And this is the next part to analyze them with Tshark.
1125.06s - 1127.86s |  Normally in the security we use Tshark.
1128.50s - 1132.58s |  But not every OT operator is familiar with Tshark.
1132.58s - 1138.02s |  So we had to switch to Wireshark which is more convenient for everybody to use.
1139.06s - 1142.10s |  And yeah, so that's all.
1145.82s - 1152.06s |  And for the toolbox, what is happening in the second part of the file?
1152.06s - 1156.06s |  Because the attacker is manipulating the toolbox file.
1157.02s - 1165.82s |  The toolbox file, the new one, is displaying the target values as the real values.
1165.82s - 1174.14s |  So the target values will show on the HMI and seems to the operator everything is fine.
1174.78s - 1179.82s |  And on the other side, the toolbox is sending zeros to the wires.
1179.82s - 1185.34s |  So the wires will not function at the moment during the attack.
1185.98s - 1188.70s |  And this is why the flood starts.
1188.70s - 1192.86s |  And the problem is normally you have the HMI,
1192.86s - 1197.34s |  the operator which is working on the HMI is not directly connected
1197.34s - 1200.70s |  or has no visual view to the water power plant.
1200.70s - 1205.10s |  And then, yeah, that's all for now.
1207.18s - 1210.30s |  Are there any questions so far?
1210.30s - 1216.14s |  Because we also have a short video where you can see what happens.
1227.44s - 1228.72s |  This is a short overview.
1229.36s - 1232.56s |  Here you see the top of the wires and the mountains.
1234.64s - 1235.92s |  I had to cheat a little bit.
1237.12s - 1239.68s |  Yeah, here are the mountains.
1239.68s - 1249.76s |  So we created a typical Austria environment to make it more home feeling for the students.
1250.32s - 1253.04s |  Here are the wires which are 3D printed.
1255.30s - 1258.90s |  This is the landscape which is getting flooded.
1261.41s - 1264.93s |  In the back, you can see the turbine which is a Kaplan turbine.
1265.73s - 1269.57s |  So it's also realistic to create.
1269.57s - 1272.85s |  It's also important to create a realistic Kaplan turbine.
1276.58s - 1278.50s |  On the left top, you see the HMI.
1281.95s - 1284.91s |  And here is the ICS component.
1284.91s - 1294.43s |  So here you can see the Siemens ICS, the A8000, and also the Siemens computer.
1298.98s - 1308.26s |  So we used everything or we tried to make the model as near as a real water power plant.
1308.26s - 1312.18s |  So normally, Siemens component will be used in this environment.
1316.96s - 1318.56s |  Yeah, it is mobile.
1318.56s - 1321.04s |  So you can bring it from point A to B.
1332.64s - 1335.52s |  Yeah, so are there any questions so far?
1339.26s - 1342.30s |  Okay, then thank you.
1347.41s - 1352.45s |  And as I see that there are some people waving, feel free to contact us and chat with us about
1352.45s - 1357.25s |  the rain and we can give you a bit more details than just the 25 minutes that we have here.
1357.89s - 1359.97s |  Thank you.


url: https://www.youtube.com/watch?v=JbnHaBY0sWM
title: DEF CON 32 - Travel Better Expedient Digital Defense - Grey Fox
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=JbnHaBY0sWM",
  "title": "DEF CON 32 - Travel Better  Expedient Digital Defense - Grey Fox",
  "description": "Expedient Digital Defense focuses on using free and readily available applications, or recommending paid-for commercial apps and tools that have proven records of credibility, to make our devices and online presence less harmful to us. We will follow a typical traveler in the United States, with some experiences drawn from overseas travel.\n\nThe talk stresses the value of Operational Security (OPSEC), and the mindset of seeing every piece of communication through the eyes of your adversary. The intent is to make people think twice before revealing anything considered sensitive, even if using the latest and greatest encryption. The surveillance economy and ever-present data collection in our modern world demand better awareness of how our digital world works. We\u2019ll discuss examples like invasive social media collection, foreign influence on public perception, data insecurity putting users in danger, and advertising models based on location and click tracking.\n\nFinally, the take-away is knowing the tools and tech available, and being able to select those which fit your needs, if at all. Most of the time, one mitigation isn't enough, and several need to be emplaced to achieve proper defense in depth, in case one solution fails. Even if no technical solutions are put in place, the user will have that \"red team\" mindset and awareness that calibrates better judgment over technical solutions, and promotes OPSEC and rational thinking for security rather than blindly depending on apps and gadgets.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1329,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.20s | This text was transcribed using whisper model: large-v2

 All right, everyone. Good morning. Thanks for bearing with us. New venue new everything. So,
5.84s - 10.56s |  you know, just a bunch of delayed delays, false starts, things like that. But hey,
10.56s - 16.00s |  I appreciate you coming out over here. So this is called as you can see on just the one screen,
16.00s - 25.04s |  travel better expedient digital defense. So I am Gray Fox. My background is retired Air Force.
25.04s - 29.04s |  I did basically intelligence for 20 years. A lot of that intelligence though,
29.60s - 34.56s |  involved some kind of either defensive or offensive cyber. It also involved briefing
34.56s - 38.64s |  a lot of people on how they can operate in environments where foreign intelligence
38.64s - 46.64s |  services were after them. So I created this briefing for them. It is it is typically long,
46.64s - 52.24s |  but we only have about a half hour with me. So we'll do our best over here. I do a bunch of
52.24s - 56.96s |  digital forensics on the side. I do product security and pen testing. Not so much on the
56.96s - 63.76s |  side. I really am into wireless stuff. My my big obsessions right now are setting up Wi-Fi
63.76s - 68.64s |  networks and then trying to break them. Wi-Fi is getting better. So I'm probably getting worse.
68.64s - 73.84s |  So I got to keep up with the times on that one. For my hobbies, I rock march. I put on heavy
73.84s - 79.20s |  weight and I walk around because, hey, who needs joints? Right. You know, but I don't do it on
79.20s - 83.44s |  sand. I'm sick of sand. I don't want to see sand ever again. Welcome to Las Vegas. Right.
84.96s - 87.44s |  So just to give you an idea of what we're getting into.
89.12s - 93.52s |  Just foundations. If you were coming in here expecting something very comprehensive,
93.52s - 98.08s |  I unfortunately can't give that. But what I'm hoping to leave you with is just a flavor
98.08s - 103.68s |  of what you can do to get a little bit deeper into things like wireless anti-tracking,
103.68s - 108.40s |  trying to reduce your attack surface when you're traveling and some things that you can do to
108.40s - 114.80s |  mitigate whatever dangers that or exploitation that could be posed to you if you happen to lose
114.80s - 120.00s |  your device or it gets stolen or you get pulled in by security and they take your devices and they
120.00s - 125.60s |  try to get information about you off of them. These things happen. Ask me how I know. I'm going
125.60s - 129.28s |  to give you some of those tips and some of those tools. What we're really looking for, though,
129.28s - 134.48s |  is a mindset. I'm not trying to sell you anything. It's just about how to think a little bit more like
134.48s - 138.88s |  the adversary when you're out and about, when you're in places where your information may be
138.88s - 145.52s |  exposed. What we're not going to do is cover the entire thing that I like to cover. I typically
145.52s - 150.96s |  do this for military members for 90 minutes. You're getting, I don't know, we'll see, maybe
150.96s - 156.72s |  20 minutes now. So I might go fast. If I do go fast, my contact information is going to be at
156.72s - 161.12s |  the end. Please hit me up. Please hit me up. I will answer your questions. I'll give you all
161.12s - 167.84s |  the time that you deserve. So biggest thing, if you take away nothing else from this talk,
168.48s - 174.32s |  is threat modeling. You have your attack surface. That's everything that you use. It is your phone,
174.32s - 179.44s |  your computer, your social media presence, your wireless presence, anything like that.
179.44s - 184.64s |  And then you have your threat profile. Those are the people that are after you. Those are anybody
184.64s - 189.52s |  that can benefit from getting your information. If I am going to attack your attack surface,
189.52s - 193.92s |  it's because I want something that you have. I am part of your threat profile. It's different
193.92s - 199.36s |  for everybody. A school teacher has a different threat profile than a school student. A computer
199.36s - 205.52s |  user at home has a much different threat profile than someone that's a computer user at an airport.
205.52s - 209.28s |  So that's something that you need to square away with is what is your attack surface? What does
209.28s - 214.40s |  it look like? What do you use? And then who's after it? This all comes down to the operation
214.48s - 220.08s |  security process. And this is something that we should all be living with. Operation security,
220.08s - 226.08s |  or OPSEC, is a cycle. You identify what your vulnerabilities are, your attack surface.
226.08s - 232.72s |  You identify who's after it, your threat profile. You look at what would happen if they exploited
232.72s - 239.28s |  that vulnerability. And then you do your risk analysis. Not every vulnerability needs to be
239.28s - 244.08s |  patched. Some of them carry a really low risk. I use a cell phone. Cell phones are full of
244.08s - 251.20s |  vulnerabilities. If I stop using a cell phone, am I safe? Well, maybe, maybe not. But you completely
251.20s - 255.28s |  lose the benefit of using a cell phone. So you're not going to stop using your cell phone, right?
255.28s - 260.24s |  You're going to accept that risk. When you accept that risk, then you need to think about, well,
260.24s - 265.12s |  what if the adversary did exploit me? How could I mitigate some of the worst issues of losing my
265.12s - 270.08s |  cell phone or getting it compromised? And then you put mitigations in place. You put defenses
270.08s - 274.72s |  in place. Maybe you change the way you use it a little bit. That's the OPSEC process. But the
274.72s - 279.84s |  important thing is, it's a mindset. It's something that you constantly do. It's going to become
279.84s - 283.84s |  second nature after a while. Everything that you do, you're going to think about it. What
283.84s - 288.64s |  risk does this pose? How does it increase or decrease my attack surface? How does it change
288.64s - 296.16s |  my threat model? So let's start off. These are things that you can do without traveling. You
296.16s - 300.72s |  could be sitting in your home and you can do these things and it'll still reduce your attack surface.
301.36s - 305.28s |  This audience, I don't have to explain to you what MFA is, password managers. I don't need to
305.28s - 311.12s |  go through that. You all already know what this is. It's been shoved down your throats so many
311.12s - 317.04s |  times over the past decade. Long, complicated passwords. Use a password manager. Multi-factor
317.04s - 321.76s |  authentication is going to stop a lot of these attacks. If you can use a PIN or a password,
321.76s - 326.80s |  definitely use it. If for some reason you happen to be traveling and you lose your phone, you lose
326.80s - 333.44s |  your computer, some applications allow you to have a standalone PIN or password that you use
333.44s - 338.40s |  to activate or to access that app, even if it's still on your device and your device is unlocked.
338.40s - 343.20s |  It's a good second layer of defense. I would definitely recommend that. Backups are a good
343.20s - 347.76s |  thing that a lot of people don't think about. If your devices are lost, stolen, or confiscated and
347.76s - 353.12s |  you need to recover, you can recover. My favorite way to back things up is putting it on a thumb
353.12s - 358.56s |  drive, leaving it somewhere like in my house, somewhere where I can access it, copying a second
358.56s - 364.40s |  thumb drive, maybe leaving it in my car. And if I really want overkill, I maybe backup stuff to a
364.40s - 368.80s |  third thumb drive and I leave it at a friend's or a relative's house. Because what if my car gets
368.80s - 373.68s |  broken into? What if my house burns down? I still have that third backup. You'll probably be thinking
373.68s - 379.12s |  about other things than re-imaging your computer or phone if your house burns down, but it's still
379.12s - 383.28s |  some peace of mind. One less thing you need to worry about. And then the last thing is end-to-end
383.28s - 389.20s |  encrypted chat and calling. This reduces your attack surface a lot. And I would normally spend
389.20s - 393.68s |  three slides talking to people about how to choose one. Are you going to choose WhatsApp? Are you going
393.68s - 398.88s |  to use Signal, Wire, Telegram? What is it going to be? I'm not going to sell you any apps. I'm not
398.88s - 404.24s |  going to give you recommendations. For all I know, Signal protocol gets broken tomorrow and I don't
404.24s - 408.80s |  want you going home thinking, oh man, Gray Fox told me to use Signal. What a jerk. So I'm not going to
408.80s - 413.36s |  do that. But what I will say is work with your ecosystem. If you're in an environment where
413.36s - 419.60s |  everyone else is using WhatsApp, use WhatsApp. Because app fatigue is a thing. Don't try to get
419.60s - 423.44s |  everyone to go with what you use. It's an uphill battle and you're probably going to lose that
423.44s - 429.84s |  battle. Really what you want to have in mind is thinking like the adversary. Using your OPSEC.
429.84s - 436.00s |  Every keystroke. There is a potential for every keystroke to be exposed. You could be using the
436.00s - 440.48s |  most secure thing in the entire world, but what if there's malware on your device that gets around
440.48s - 445.76s |  the encryption? So just think about it before you type it, before you say it. Blinky boxes are great,
445.76s - 449.04s |  but the technology is not going to save you. Your brain is going to save you.
450.96s - 457.04s |  Social media is another one. We're getting away from what you carry and now into what
457.04s - 461.76s |  your presence looks like. If I'm the adversary and I want to build an intelligence dossier on you,
462.88s - 466.88s |  damn sure I'm going to go to your LinkedIn, your Facebook, your Instagram,
466.88s - 470.40s |  wherever you have a presence, I'm going to find you and I'm going to put it together.
470.40s - 474.00s |  Every photograph that you post, I'm not only going to look at your face, I'm going to look at who
474.00s - 477.84s |  you're standing next to. I'm going to look at what's in the background. I'm going to look at
477.84s - 482.96s |  the date, time group, and I'm going to put together a pattern of life and a pattern of movement and a
482.96s - 488.00s |  pattern of communication. All of these things I can get from your social media. And the more that
488.00s - 493.60s |  I can get as an adversary about how you live and how you travel, the better I can determine if I
493.60s - 498.64s |  were a foreign intelligence, where I can possibly sit next to you and try to solicit you, get
498.64s - 504.16s |  information from you, maybe even try to turn you to my side. It's really nuanced, really,
504.16s - 508.72s |  really nuanced, but definitely go and take a look at what your social media presence looks like.
509.60s - 514.16s |  See if you were investigating yourself, what could you put together? It's pretty eye-opening.
514.16s - 518.40s |  I'm not saying get rid of your Facebook account. You don't have to do that, but I'm just saying
518.40s - 524.08s |  use it a little bit better. This is when you start getting into open source intelligence.
524.08s - 528.48s |  If you really want to see what your internet footprint looks like, use some of these resources.
528.48s - 534.40s |  See what's out there. These are all accessible to me. I can get you from these. If you can get
534.40s - 538.56s |  yourself from these, great. Even if you can't get rid of that information and deleting your
538.56s - 545.12s |  data off the internet is extremely hard. It's really time consuming. It may be a Sisyphean
545.12s - 549.76s |  task because whether you delete it in one place or not, it'll appear in another place. It's like
549.76s - 554.08s |  playing whack-a-mole, but at least you're aware that it's out there. If you know that it's out
554.08s - 559.28s |  there, you can put other mitigations in place. You can maybe alter some of your routines. Maybe
559.28s - 564.48s |  stop using an app. Maybe think a little bit more about whether you tag something, giving your
564.48s - 569.76s |  location out, stuff like that. It's an extremely useful exercise to think like the enemy and see
569.76s - 577.60s |  what you can find on you. Now let's talk about phones. I hate phones. I hate them. I hate them
577.60s - 583.52s |  because I absolutely need it. And it always, always tries to bite me. Always. You have so many
583.52s - 588.80s |  radio genes on a typical phone that there's no way to tamp it down. But there are some things that
588.80s - 593.60s |  you can do to try to mitigate the risk. All of the signals that your phone is going to put out
593.60s - 598.24s |  is collected by the operating system. It's collected by whatever's providing you internet
598.24s - 603.44s |  access. Every single application is trying to access all the way down to the kernel level,
603.44s - 609.84s |  all the inner workings of your device. Bluetooth, Wi-Fi, anything. If you're connected to something,
609.84s - 615.68s |  it wants your location. If I'm the adversary, getting your email's fine. Getting your
615.68s - 621.52s |  communications are good. I got some content and photos. Great. I might even get some file access.
622.16s - 627.52s |  But if I get your location, if I know where you are, that's my bread and butter. Because then I
627.52s - 632.56s |  know where I can find you. I know who you're meeting with. And I know for how long. And I'm
632.56s - 638.64s |  developing that pattern of life. Foreign intelligence, security services, FIS, they're the ones that are
638.64s - 644.56s |  typically after my clients, foreign military members. You can't really do much if you just
644.56s - 649.76s |  track them online. What's the end point? The end point is to try to solicit them in person.
649.76s - 654.48s |  This is a means to an end. I can't do that without location. That's when I start getting into
654.48s - 660.16s |  wireless anti-tracking. If I can try to tamp down how much my phone is giving out my location,
660.16s - 666.56s |  then that's what I'm going to go for. The reason why location is so dangerous is because it is the
666.56s - 672.96s |  business model for your device. So the way that advertising works is you use an application for
672.96s - 678.64s |  free. It's got to get paid for somehow. And so it follows this cycle. The organization that made
678.64s - 683.60s |  your app is collecting your data. It's selling it to a data broker. Data broker sells that to
683.60s - 688.56s |  advertisers. Advertisers send you advertisements. And every click is going to be more money.
688.56s - 693.28s |  It's a cycle, but it's innocuous. They're not the enemy. They're not trying to go after you.
693.28s - 697.92s |  But the problem is when you're making money from advertising, you're not making any money from
697.92s - 704.72s |  security. So that's why this is so bad. They're not trying to get after you. But if somebody
704.72s - 709.76s |  breaches those data and all of your collected information is out there, your location is out
709.76s - 715.04s |  there. And I, as the adversary, can buy it or I can steal it or I could just go open source and I
715.04s - 720.08s |  could find it somewhere for free anyway. So that's why it's a goldmine for someone like me.
720.64s - 724.24s |  That's why your phones are so dangerous. It's all about the location. It's all about the
724.24s - 730.88s |  advertising system. Can you get around it? Yeah, you can mitigate a lot of this. And we'll start
730.88s - 737.20s |  getting into that. Smart cities are becoming more and more prevalent. UTS or ubiquitous technical
737.20s - 742.64s |  surveillance is a reality. If you live in the United States, you're seeing these things pop
742.64s - 747.60s |  up more and more. If you live overseas, it's already what you live in. You have cameras
747.60s - 753.04s |  everywhere with facial recognition as your edge computing. So it doesn't really matter one way
753.04s - 757.12s |  or another if you have a mainframe or something like that that has all your faces in it. These
757.12s - 761.44s |  cameras can automatically use algorithms to detect your face. It's instantaneous.
762.72s - 768.40s |  ShotSpotter is a neat technology that takes audio from surrounding areas and it tries to correlate
768.40s - 773.36s |  that audio with gunshots and then it alerts law enforcement. So you have video and you have sound.
774.00s - 779.04s |  You have tag readers, license plate readers all over the place that'll read where your vehicle
779.04s - 784.72s |  is going. You also have point of sale systems. If any of you use touchless payment with your phone,
784.72s - 791.52s |  that's being collected as well. All of these things ostensibly are being collected anonymously,
791.52s - 795.68s |  but in order for them to work with the vast amount of collection that they need to do,
795.68s - 800.80s |  there's not a lot of overhead for security. So once again, just like the advertising system,
800.80s - 805.12s |  you're looking at something that is breachable. You're looking at anonymous data that can be
805.12s - 810.64s |  easily de-anonymized. So ubiquitous technical surveillance in a smart city is going to be
810.64s - 814.88s |  the enemy in this case. It doesn't want to be your enemy. It wants to do good. It wants to
814.88s - 820.80s |  alert a fire department when there's a fire. But as an adversary, you can weaponize these data.
821.60s - 825.92s |  So how do you get around it? If you want to take a picture of this slide, go for it because I'm not
825.92s - 829.36s |  going to explain everything. We don't have the time for that. But there are simple things that
829.36s - 834.24s |  you can do to mitigate. The biggest thing you can do is turning off some of those radio chains on
834.24s - 839.76s |  your devices, specifically Bluetooth and Wi-Fi. Wireless sensors are everywhere. If you don't put
839.76s - 844.72s |  out a wireless signal, I won't be able to get you. It's not 100%, but it comes close.
845.28s - 849.04s |  Same thing with your web browsers. If you use an ad blocker or if you put on strict cookie
849.04s - 853.52s |  protection, you should be okay. There's recent news that Firefox was kind of lying and not
853.52s - 858.56s |  really blocking your third-party cookies. You can go into your custom settings in Firefox and you
858.56s - 864.96s |  can customize blocking cookies. I think that kind of goes around that just overall strict problem.
864.96s - 871.28s |  But I would recommend something like uBlock Origin for the time that it still works. It's a pretty
872.24s - 876.64s |  good add-on that I think does the job of getting rid of a lot of those cookies, especially the ones
876.64s - 882.48s |  that collect location data. When you're looking at payment systems, cash is still king. If you
882.48s - 887.20s |  pay with cash, you're good. There is a camera that sees your face. There's probably audio that
887.20s - 892.72s |  will recognize your voice. But at least what you're paying and what you're buying might still
892.72s - 897.28s |  be a little bit of a secret, at least for now. And then lastly, if you're looking at your cars,
897.60s - 901.44s |  it's difficult. If you want a good car, it's going to be connected. It'll have many radio
901.44s - 908.24s |  chains. But do yourself a favor. Try to refrain from connecting your phone to your car because
908.24s - 912.64s |  the car is not just accessing your music. It's not just accessing apps and stuff like that
912.64s - 920.00s |  for navigation. It's also accessing usernames, contacts, call history, SMS history. And cars,
920.00s - 924.32s |  the security are not great in a car. So if I were to hack into a car, I would probably
925.04s - 929.84s |  in a car. So if I were to hack into a car, I basically have what is also on your phone,
929.84s - 934.40s |  especially when you're renting a car. Think about that. Think about the wireless implications of
934.40s - 939.04s |  tethering a device. So we can get into that. We could spend an hour. I don't have an hour.
939.04s - 944.32s |  I wish I did. So now let's get into a little bit more physical security stuff.
944.96s - 948.56s |  When you're going through any security checkpoints, I'm talking about airports,
948.56s - 954.56s |  rail, whatever, turn your devices off, completely cold. Even with the best forensics equipment,
954.56s - 959.36s |  something that is turned off, what we call a cold state, would be extremely hard to get into,
959.36s - 965.84s |  especially if it's a modern operating system. Android 13-ish and up, the latest iOS,
967.76s - 971.84s |  they all use file-based encryption, which forensically is a lot harder than full disk
971.84s - 976.64s |  encryption. If you have your device turned off, I as an adversary would have a hard time getting
976.64s - 981.28s |  into that device. If I only have you for 20 minutes in secondary at an airport, that's not
981.28s - 986.24s |  enough time to crack anything. If your device is locked but it's turned on, we call that a warm
986.24s - 991.60s |  state. Depending on the operating system and the version, maybe I can brute force your pin. If you
991.60s - 996.96s |  use a six-digit pin or higher, that would take too long. If you have your phone on and unlocked, well
996.96s - 1003.12s |  then, physical possession is always going to be the king and queen here. So if you don't have it
1003.12s - 1009.12s |  locked, that's on you, I got everything. So do yourself a favor, turn it off. If you have it on
1009.12s - 1013.52s |  your person and not in a bag, that's a bonus. Most places, when they pull you into secondary,
1013.52s - 1017.68s |  they're not going to search your body, they may search your bags. So do yourself a favor.
1018.72s - 1022.40s |  Another thing to keep in mind, and this is a little bit more advanced, if you're worried about
1022.40s - 1027.28s |  your phone or your computer being compromised and you have sensitive stuff in a chat app or over
1027.28s - 1032.32s |  email, uninstall that app before you go through the security checkpoint, because then there's no
1032.32s - 1036.72s |  evidence that it was there unless they do a full forensic rip. And if that's the case, you probably
1036.72s - 1040.80s |  have bigger problems than what the content was. But that's just something a lot of people don't
1040.80s - 1044.96s |  really take into account. You're not going to lose all your data if you uninstall the app. When you're
1044.96s - 1049.28s |  finished, you get everything back, you reinstall it, you're okay. But just keep those little tidbits
1049.28s - 1055.20s |  in mind. Security checkpoints, they're a minefield. Ask me how I know. I would also avoid doing any
1055.20s - 1059.12s |  dummy devices, because eventually they'll look at your phone that's a dummy phone and be like, oh,
1059.12s - 1064.08s |  there's nothing on here. That's strange. Then they may ask to search some other things. And
1064.08s - 1068.32s |  if they find your real phone, that's going to raise a couple more questions. Don't increase
1068.32s - 1072.72s |  your attack surface. Don't give yourself another bullseye. Avoid the whole dummy phone and dummy
1072.72s - 1079.68s |  computer thing. All right. Inevitably, I get asked about VPNs. This is probably the only really
1079.68s - 1087.04s |  technical conversation I'm going to get into here. A VPN is simple. It is a tunnel that encrypts data.
1087.04s - 1092.24s |  That's all it does. A lot of people use that for privacy. It's not private. It's more for security
1092.24s - 1097.68s |  than anything else. Commercial VPNs, stuff that your company would issue you, it gives you a tunnel
1097.68s - 1102.72s |  where you can work in their network, in their corporate infrastructure. That's what a virtual
1102.72s - 1108.48s |  private network is. You're virtually part of that private network. Off-the-shelf VPNs like NordVPN,
1108.48s - 1113.76s |  Proton, all those, what they essentially do is give you a tunnel from your end user device
1113.76s - 1119.12s |  to another server somewhere else that has a different IP address. Between your end user
1119.12s - 1124.40s |  device and that server, you have some pretty good encryption. If I were trying to sniff packets in
1124.40s - 1129.84s |  the air, I would just get a bunch of nonsense. But as soon as your traffic leaves this VPN server,
1129.84s - 1135.60s |  it is you. It is ostensibly you. Everything you're doing, all the sites you're going to,
1135.60s - 1140.40s |  any other traffic, it's all out there. It can be de-anonymized, especially if you're logging into
1140.40s - 1145.20s |  things using a username associated with you. The benefit of a VPN is that it changes your
1145.20s - 1150.80s |  location. Your perceived location over the internet changes. That's the good thing about a VPN.
1150.80s - 1156.88s |  So if I was in Somalia and I wanted to watch US Netflix, I VPN to a US server. I watch Netflix.
1156.88s - 1161.92s |  But it doesn't mean that somebody in the US that sees my traffic wouldn't be able to attack me.
1161.92s - 1167.04s |  They would just have a false impression of where I am. That's all a VPN does. It's a good security
1167.04s - 1171.20s |  measure. It's good for defense in depth. It is not an end-all be-all. It won't protect you from
1171.20s - 1177.28s |  malware, phishing, all the other bad things that are out there. I just want to make that clear
1177.28s - 1181.84s |  because I get a lot of questions about, will a VPN save me? It depends on who you're running away
1181.84s - 1187.44s |  from, but probably not. So other questions about VPNs definitely hit me up offline.
1188.88s - 1192.16s |  So let's cover what we went through in the very, very short time that I had.
1192.80s - 1198.16s |  We have physical security aspects. No location means I can't find you. I think that that's
1198.16s - 1204.08s |  relatively secure. You can't block all location, but you can try. Your online security. If you try
1204.08s - 1209.12s |  to target you on social media, you'll find where your vulnerabilities are and you can mitigate that.
1209.12s - 1215.60s |  Definitely OSINT yourself. For communication security, end-to-end encryption is what we got
1215.60s - 1220.88s |  and it works. If all of you could reverse engineer the apps that you use, we'd be golden, but you
1220.88s - 1226.72s |  can't. There's got to be some level of trust, but I would say if you're doing regular telephony like
1227.36s - 1232.16s |  your standard phone calls and your standard SMS, a lot less security than using something like
1232.16s - 1238.32s |  WhatsApp, Signal, Wire, Session, anything like that. So consider end-to-end encryption for your
1238.32s - 1244.96s |  communications. All right. Maybe I have time for questions. I think I have like, what,
1244.96s - 1250.64s |  just a few minutes. If you want to reach out to me, please reach out to me. That QR code,
1251.76s - 1255.68s |  I'm looking at people that are clicking it and I'm trying to make a note of like, did you really
1255.68s - 1259.12s |  do your threat model with this? But it's okay. You can click it. It's fine. I'm not going to come
1259.12s - 1264.16s |  after you. Those are some books and some websites that I recommend for further learning, but
1264.16s - 1267.92s |  definitely reach out to me if you have any questions because I am sorry this is very short,
1267.92s - 1279.06s |  but I hope you got something out of it and thanks very much. And I think I have two minutes. I have
1279.06s - 1283.14s |  two minutes if anyone has anything they want to ask. And please keep in mind, I lost my hearing
1283.14s - 1290.67s |  in the war. So please speak up if you're going to ask anything. I don't see any brave souls.
1292.67s - 1307.60s |  Yes, sir. You may be compelled to get an email from me if you email me because the email address
1307.60s - 1311.84s |  is also in the QR code and then you'll have to have a conversation with me. And I don't know
1311.84s - 1319.47s |  how that's going to go. That's up to you, but you're a brave soul. All right. Please come find
1319.47s - 1323.31s |  me. I'm probably going to be hanging out in Crypto Privacy Village if you want to have a chat.
1323.31s - 1325.87s |  And once again, thank you very much for sitting through this.


url: https://www.youtube.com/watch?v=TqKb7h8VFcA
title: DEF CON 32 - Top War Stories from a TryHard Bug Bounty Hunter -Justin Rhynorater Gardner
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=TqKb7h8VFcA",
  "title": "DEF CON 32 - Top War Stories from a TryHard Bug Bounty Hunter -Justin Rhynorater Gardner",
  "description": "Ask any top bug bounty hunter: the best part of a live hacking event is the Show & Tell; the time when the veil is lifted and we collectively revel in the ingenuity of the best finds from the competition. The goal of this talk is to give you that same experience. I will speak to you as the competent hackers that you are, not withholding the nitty-gritty technical details and the Ls along the way. Together, we\u2019ll journey through the highs and the lows of my hunts, both solo and in a Live Hacking Event context. You\u2019ll see everything from RCE to SQL injection, mass PII leakage to spying on people\u2019s homes and workplaces. You\u2019ll find some bugs mind-numbingly simple, and some bugs mind-bogglingly complex. Each bug in this talk was assigned the highest severity possible, and awarded somewhere between $10k-$60k in bounties.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3037,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.76s | This text was transcribed using whisper model: large-v2

 Alrighty y'all, I think we're going to go ahead and get started a little bit early.
3.30s - 5.36s |  Sorry for any of the people that are coming in at the last minute,
5.36s - 7.36s |  but we'll go ahead and get rolling.
7.36s - 12.36s |  Also, I realized that I got super lucky because this is the last slot of the day.
12.76s - 15.36s |  So we can go a little bit long, which is exciting.
15.96s - 17.52s |  You guys can hear me all right on this one, too, right?
17.52s - 18.80s |  I kind of like to walk around a little bit.
18.80s - 22.26s |  OK, so. Oh, I need to point it right at it.
22.26s - 25.00s |  OK, so for any of you, the guys that don't know me,
25.00s - 27.00s |  I'm Justin Gardner, a.k.a. Rhino Raider.
27.00s - 29.80s |  I'm a professional live hacking event participant, a.k.a.
29.80s - 31.80s |  full time bug bounty, a.k.a.
32.50s - 33.86s |  no job.
33.86s - 37.90s |  And I hack web applications mostly and IOT devices
38.60s - 43.00s |  occasionally and sometimes mobile devices when Joel is here to help me out.
44.30s - 47.10s |  I'm the host of the Critical Thinking Bug Bounty Podcast with my boy
47.10s - 48.70s |  Joel right here as the co-host.
48.70s - 50.70s |  And I'm also advisor for Kaido.
51.66s - 53.86s |  So check those out if you're interested.
54.78s - 57.18s |  All right, let's go ahead and talk about the road map for today's talk.
58.78s - 62.52s |  We're going to hit 11 bugs and I don't have to rush, which is great.
62.86s - 65.28s |  I was going to give you a disclaimer that we're going to move pretty quickly.
65.92s - 69.66s |  The whole concept behind this talk was to kind of bring to you
69.66s - 74.06s |  all the experience that the hackers get at a live hacking event
74.32s - 77.06s |  during the show and tell portion, which is at the end of the event.
77.28s - 81.06s |  When we all sit down and we compare notes, some of the people go up on stage
81.28s - 83.26s |  and present the bugs that they've found.
83.26s - 85.76s |  So what I've done is I've compiled 11 vulnerabilities for you
85.76s - 89.32s |  over the past two or three years of bug bounty hunting, all criticals.
90.08s - 91.86s |  And I'm going to walk you through each one.
91.86s - 95.42s |  And I'm going to do so at as much technical depth as I can
95.42s - 96.58s |  without revealing the target.
98.26s - 99.82s |  We have three easy bugs.
99.82s - 102.68s |  We have two mediums, four hards and two very hards.
103.22s - 105.92s |  So we're going to start off easy and then we're going to go go
106.36s - 107.62s |  a little bit deeper after that.
107.62s - 108.68s |  All right, so let's jump into it.
108.68s - 112.88s |  First one is an NGINX 403 bypass to PII leak.
112.88s - 116.00s |  OK, so this is on a semi private program.
116.00s - 120.44s |  You'll see actually throughout the whole presentation that we that
120.44s - 123.60s |  most of the targets that I'm hacking on are public programs or
124.48s - 126.14s |  are semi private programs,
126.14s - 129.24s |  which is essentially a private program that everyone knows exists.
129.24s - 131.30s |  And they're very public about the fact that they exist.
131.30s - 134.88s |  And you can easily get added to that program and paid for a bug if you have a bug.
136.04s - 138.64s |  So when finding this bug, the first indicator
138.64s - 141.08s |  that there might be a bug here was that the application
141.64s - 146.28s |  or that the company was taking a piece of software that was meant for internal use.
146.64s - 149.38s |  And then they've modified it to be publicly used.
149.38s - 152.20s |  So anybody can sign up and log into this app. Right.
152.34s - 155.98s |  So when they do that, of course, the threat model changes for the application. Right.
156.70s - 157.98s |  So I thought that was really sketchy.
157.98s - 159.70s |  So I decided to look into it a little bit deeper.
161.14s - 163.80s |  So what I was thinking is, OK, well, when this app was intended
163.80s - 166.10s |  for private use only within an organization,
166.38s - 169.84s |  then there was probably a lot of implicit trust between the users in the organization.
170.10s - 173.26s |  You know, if I am in an organization with Joel,
173.50s - 177.20s |  it's probably not a huge problem if I can go and look and see his last name or whatever.
177.20s - 181.90s |  Right. However, in a public application, that information may be more sensitive.
181.90s - 183.84s |  So I decided to look for those sort of endpoints,
184.00s - 186.90s |  exploiting implicit trust and leak user data.
187.86s - 190.50s |  So I identified a couple of those endpoints in the
191.24s - 193.44s |  sort of internal use version of the software.
193.84s - 198.74s |  And when I hit them on the API, I noticed that I got an NGINX 403. Right.
199.24s - 202.16s |  Instead of the application level 403, you can see the differences over there.
202.96s - 207.10s |  The NGINX 403 seems to imply that there is a
208.50s - 211.26s |  this sort of structure. OK, so we're on the network.
211.50s - 214.56s |  We send a request over the Internet to the NGINX reverse proxy
214.56s - 217.06s |  that's standing in front of the back end server.
217.24s - 220.60s |  And then the back end server processes that request, gives the response
220.60s - 222.74s |  back to NGINX, which gives a response back to the user.
222.94s - 226.70s |  Pretty standard NGINX structure or reverse proxy structure.
227.06s - 230.62s |  However, when we request the point or the API endpoint slash API
230.86s - 233.96s |  slash internal slash get all users, that's not the API endpoint.
234.90s - 236.50s |  That's obfuscated.
236.80s - 239.32s |  It hits the reverse proxy
239.62s - 242.62s |  and then the reverse proxy says, but not allowed. Right.
243.36s - 247.02s |  So I noticed the difference between those two 403 pages.
247.26s - 249.36s |  And I thought we should try to fuzz that a little bit.
249.36s - 250.66s |  So what do we do?
250.66s - 252.36s |  We try get all users.
252.36s - 253.52s |  We hit the 403.
253.52s - 255.70s |  We try get all users with a Z.
256.50s - 260.70s |  Just to see if they had like blocked off that specific endpoint
260.70s - 265.96s |  at the NGINX level or whether they are blocking out the path before that.
265.96s - 267.70s |  Right. We get a 404 there.
267.70s - 272.66s |  So not that whole path is slash API slash internal is not all blocked.
272.82s - 274.60s |  Just get all users.
274.60s - 276.56s |  So then I tried some path traversal stuff.
276.56s - 279.80s |  And eventually I started encoding various characters and found out
279.80s - 284.46s |  that a double URL encoded S would pass through the reverse proxy
284.46s - 288.42s |  and not be perceived as a match for the block on get all users route.
288.68s - 293.22s |  And it would be parsed on the back end as an S.
293.28s - 297.12s |  So it would match that get all users route and dump back a ton of data.
298.42s - 301.62s |  So the impact of that one was four point five million users.
301.78s - 304.56s |  PII leaked. The bounty was between 15 and 20 K.
304.56s - 307.26s |  I'm going to give you ranges because
307.36s - 310.62s |  some of the ranges can the actual numbers can disclose the programs.
311.28s - 313.58s |  The severity was critical, critical, critical,
313.64s - 315.64s |  which is what we say from the critical thinking podcast.
315.64s - 317.14s |  Shout out to Whitey Cracker.
317.14s - 320.38s |  And and this program was very private, as mentioned before.
320.70s - 324.80s |  The takeaways for this one were obviously that changed the threat model.
324.80s - 328.38s |  Like we mentioned, identify odd and out of place for three pages.
328.38s - 333.18s |  Those can always tell can imply to you when a route is getting
333.44s - 336.94s |  essentially blocked off by a reverse proxy and might be bypassable
336.94s - 339.48s |  via some of these normalization tricks.
339.48s - 343.08s |  And yeah, there was an amazing talk by one of the guys at Portswager
343.20s - 345.70s |  earlier today on some of the amazing
345.70s - 348.74s |  path reversal and path normalization stuff you can do.
349.30s - 351.40s |  So I bet that would also be really helpful here.
352.70s - 355.14s |  So the last takeaway is know your bypass tricks,
355.14s - 357.94s |  URL encoding, double URL encoding, path reversal, et cetera.
358.10s - 359.30s |  All right. Let's move to the next one.
359.30s - 360.44s |  This one's really easy.
360.44s - 364.10s |  It's an arbitrary account takeover via docs, essentially.
364.10s - 365.00s |  So I open the docs.
365.00s - 368.98s |  I look at these endpoints and I notice that there is an API
368.98s - 372.34s |  endpoint for a slash slash slash token.
372.34s - 375.70s |  And the there's an authorization header required for that.
376.40s - 378.24s |  And the body is really simple.
378.24s - 380.54s |  It's just grant type equals password.
380.94s - 384.40s |  And then username equals user equals username.
384.40s - 385.34s |  Password equals password.
385.34s - 387.50s |  That's exactly what you would expect.
387.50s - 389.00s |  And it dumps back the access token.
389.00s - 390.00s |  Very, very reasonable.
391.14s - 392.18s |  But wait a second.
392.18s - 393.10s |  A password.
393.10s - 396.44s |  This application is a OTP login application.
397.10s - 397.98s |  There's no password.
397.98s - 398.94s |  You just put in your email.
398.94s - 400.04s |  They send you a link to your email.
400.04s - 401.80s |  You click on it and you're logged in.
401.80s - 403.00s |  So how does that work?
403.00s - 404.44s |  So I started building it out.
404.44s - 407.14s |  And when I sent the request, I got a 401 unauthorized.
407.14s - 411.40s |  Of course, we need to authorize with the
412.54s - 415.44s |  credentials mentioned in the doc for the authorization header.
416.54s - 420.20s |  So I went and I needed that.
420.20s - 421.60s |  So I was like, what do I do?
421.60s - 423.64s |  Of course, to the JS files.
424.14s - 425.90s |  So I search in the JS files.
425.90s - 430.86s |  I'm looking for the UI, the part of the UI that uses this request.
431.10s - 436.52s |  And I find sitting in the JS files these authorization credentials.
436.76s - 438.96s |  And they're obviously Base64 encoded.
438.96s - 440.36s |  And the values were kind of odd.
440.36s - 444.56s |  I can't show them to you, but they weren't they weren't random.
444.60s - 446.12s |  They were just a string.
446.12s - 448.76s |  So it was a little bit of an odd setup.
448.76s - 452.26s |  And so then using those authorization basic credentials,
452.46s - 455.60s |  we could literally just submit any password for any user.
455.86s - 459.90s |  And it would accept it and dump back the authorization token,
460.06s - 462.36s |  giving us access to arbitrary account takeover on this target.
462.66s - 464.26s |  This is a public program.
464.26s - 466.86s |  This is a very high paying public program.
466.86s - 468.00s |  And this sort of stuff is out there.
469.56s - 472.20s |  So this was a thank you. Thank you.
472.20s - 475.72s |  This was an arbitrary ATO on double digit million accounts,
475.96s - 478.90s |  40 to 60 K bounty, of course, critical.
478.90s - 481.20s |  And like I mentioned, public public program.
481.46s - 485.70s |  So takeaways for this will be read the docs, think about the docs
486.02s - 490.52s |  and then check the JS because there's a lot of good stuff in there.
491.62s - 493.32s |  All right. Next, bug number three.
493.32s - 495.46s |  This one's very similar to the last one.
495.46s - 499.22s |  Essentially, you take the auth bearer and you log into that API,
499.22s - 501.30s |  that godforsaken API.
501.30s - 505.36s |  And there's simply a numeric IDOR in that API
505.60s - 510.16s |  that literally leaks password hashes and password reset tokens.
511.40s - 513.80s |  And I see someone in the audience that is laughing
514.00s - 516.12s |  because I think they know the target that I'm talking about.
517.12s - 518.50s |  So that's interesting.
518.50s - 520.60s |  But yeah, the password reset token is there.
520.70s - 523.22s |  You can just password reset the account, hit the IDOR,
523.36s - 526.16s |  and then you'll be able to log into the person's account.
526.50s - 528.76s |  This was also 40 to 60 K.
528.76s - 531.62s |  And the takeaway from this one that's different from the other one
531.62s - 533.92s |  is just get really deep into these apps.
534.96s - 537.72s |  It probably took 40 hours of configuring stuff
537.72s - 540.20s |  and getting to know the various parts of the application
540.20s - 543.86s |  before I got to this point where I was needing to authenticate into this asset.
544.76s - 547.16s |  So that's the behind the scenes.
547.20s - 550.16s |  I don't want to make sure I want to make sure that it's not perceived
550.16s - 553.26s |  as looking too easy because there is some work that goes into it.
554.36s - 557.86s |  OK, bug number four, we're moving into the medium difficulty section now.
558.30s - 562.60s |  This was a blind XSS via SMS to arbitrary account takeover.
563.06s - 568.16s |  So this was on an app that was a place where you could buy a car.
568.48s - 573.82s |  And there was a sister app that would allow the dealers to deal with the
574.02s - 576.68s |  it's kind of like a CRM for the dealers, right?
576.68s - 578.72s |  So you go ahead and find a car.
578.72s - 581.18s |  I was interested in this DeLorean for 42 million.
582.12s - 584.32s |  And so I went ahead and filled it out.
584.62s - 588.52s |  And somebody named Christina from my local car place reached out to me and said,
588.52s - 591.28s |  Hey, Justin, I saw that you filled out the request for this.
592.28s - 594.02s |  You know, when can we meet to see the car?
594.02s - 595.78s |  I was like, OK, well, how did they do that?
595.78s - 599.28s |  Because I had access to the dealer panel as a part of this scope
599.64s - 601.38s |  and I didn't see where they did that.
601.38s - 604.60s |  So I said, OK, let me go ahead and log into the dealer software
605.04s - 606.18s |  and get that perspective.
606.18s - 607.04s |  So this is what I see.
607.04s - 608.18s |  You can select the
609.38s - 612.14s |  the users that you want to view the details for on the left hand side.
612.44s - 614.48s |  And there's like an info and a financing tab.
614.48s - 618.18s |  And you can kind of inspect that that lead that had come through the website.
619.50s - 621.48s |  And so I started reading the code on that page.
621.48s - 624.84s |  And there's like some super long window object that's kind of difficult to read.
624.84s - 627.40s |  But if you scroll through it and do your due diligence,
627.70s - 630.24s |  there's a section called feature flags,
630.24s - 633.70s |  which is something that I just talked about at my talk earlier in Bug Bounty Village.
634.44s - 636.54s |  And there was a messages feature flag.
636.90s - 639.24s |  So we turned that from false to true.
640.04s - 642.84s |  And you can see, yeah, from false to true
643.10s - 645.70s |  with this easy Kido match and replace rule.
646.74s - 649.80s |  And voila, the messages tab appears in the application
650.00s - 652.40s |  and we have the ability to use it.
652.40s - 655.22s |  So as we as we go into that application,
655.22s - 657.42s |  we can send messages to the various leads.
657.42s - 660.02s |  It'll go to the phone number that they submitted
660.02s - 662.66s |  and then you can interact with them. Great.
663.66s - 665.52s |  So I sent myself a message.
665.52s - 668.22s |  I submitted a lead, sent myself a message and I thought, OK, wow,
668.22s - 671.96s |  wouldn't it be cool if I could SMS myself a an XSS payload?
672.36s - 676.30s |  So I went ahead and first typoed my XSS payload to something that would never work.
677.06s - 679.86s |  Proceeded to reaction down it instinctually
680.36s - 683.56s |  and then submitted the actual XSS payload.
683.98s - 688.32s |  When the dealer came back to the screen, they would see that the XSS would pop.
688.52s - 692.72s |  And we were able to get a blind XSS of sorts in this environment.
694.72s - 698.42s |  So we've got blind XSS, but what can we do with it to get more impact?
699.12s - 702.36s |  Well, the authorization flow for this application happened
702.36s - 705.32s |  in an invisible eye frame right near this interface.
705.78s - 709.66s |  And what it would do is it would go through the OAuth flow on a different domain
709.88s - 711.78s |  and then it would call back with just a token.
713.28s - 717.72s |  And so what I did using the XSS is I cookie bombed that callback location
718.06s - 720.72s |  and then so that the code wouldn't get consumed.
720.96s - 724.86s |  And then I stole the code out of the eye frame and exfiltrated
724.86s - 726.22s |  that to the attacker server.
726.22s - 730.22s |  So whenever the dealer comes, their session token would be exfiltrated.
730.38s - 732.72s |  The attack, the victim.
732.72s - 737.06s |  The victim's token would be exfiltrated and the attacker can simply click the link
737.06s - 739.76s |  and they're logged into the victim's dealer account.
740.56s - 742.82s |  And you don't have to bypass MFA or anything like that
742.82s - 745.08s |  because the session token is there.
745.76s - 748.62s |  Great. So now we've got we can log in as the dealer.
748.62s - 751.32s |  We've got ATO. How can we get even more impact?
751.36s - 756.26s |  Well, that same request had three vulnerabilities in it.
756.28s - 760.66s |  OK, the send SMS message API endpoint had a dealer ID
760.66s - 764.06s |  that was vulnerable to IDOR, a client ID that was vulnerable to IDOR.
764.28s - 766.78s |  And the message was vulnerable to XSS.
767.10s - 770.94s |  So essentially what this means is that we can worm this XSS
770.94s - 772.34s |  across all of the dealers.
772.34s - 777.00s |  We can send a message to every client from every dealer with an XSS payload
777.14s - 779.30s |  and then proceed to hijack their accounts.
779.30s - 782.64s |  And when we get access to their accounts, then we get access to all of the PII
782.84s - 785.74s |  of all of the customers that have ever used this application.
786.70s - 789.34s |  So that was bad.
792.88s - 796.22s |  And that was an arbitrary ATO and
797.08s - 801.54s |  of double digit million users, PII leak, 20 to 40K.
801.82s - 803.44s |  This was on a private program.
803.44s - 806.22s |  However, this program will be going public soon, I'm aware.
806.78s - 811.34s |  And the takeaway for this is look at all the look at the application
811.34s - 812.52s |  from all perspectives, right?
812.52s - 813.24s |  We wouldn't have seen this
813.24s - 815.18s |  if we just looked at it from the dealer perspective
815.18s - 817.38s |  or just looked at it from the client perspective.
817.38s - 820.08s |  Make sure you're turning on all the feature flags with match and replace
820.32s - 823.14s |  that can enable features that are essential
823.90s - 827.04s |  and look for alternative data input paths like SMS.
827.86s - 831.04s |  And then lastly, of course, chain, chain, chain to get maximum impact.
832.70s - 836.44s |  OK, bug number five, Snoop on other people's meetings.
836.66s - 837.86s |  This was a really interesting one.
837.86s - 841.46s |  It's going to be a little brief, but there was a target that I came across
841.76s - 844.30s |  in a video chat and team collaboration app.
844.64s - 847.64s |  And for this specific
847.64s - 851.06s |  period, I decided to focus on a specific goal,
851.08s - 853.82s |  which was I wanted to be able to do creepy shit
855.06s - 856.96s |  in people's meetings, right?
856.96s - 859.68s |  So I started investigating how exactly that worked.
859.68s - 863.78s |  I read the developer's docs, the JavaScript code, the GitHub issues, everything.
864.26s - 868.38s |  And when I was investigating the GitHub issues,
868.72s - 869.96s |  this GitHub issue popped up.
869.96s - 874.32s |  It says the participant list is wrong when XYZ audio device is used.
874.62s - 876.18s |  And I was like, huh, that's weird.
876.18s - 878.48s |  So the participant list didn't get updated
878.70s - 881.04s |  when the user has a broken audio device.
881.58s - 882.58s |  Why would that be happening?
882.58s - 884.94s |  So I thought maybe I can make that happen.
884.94s - 888.74s |  And that would be I'd be able to enter meetings without people
888.74s - 889.48s |  knowing I was there.
890.64s - 894.34s |  So how does that how does this joining meeting work?
894.94s - 897.54s |  The user connects first over WebRTC.
897.84s - 902.30s |  Then they get all of the information like the call, comms channels, et cetera.
902.90s - 906.08s |  And then the JS code identifies an audio device
906.58s - 909.84s |  that the user can use or it creates a fake audio device.
910.08s - 914.90s |  And then the client side JS sends the audio connect signal to join.
916.54s - 917.30s |  Wait, what?
917.30s - 920.40s |  It sends an audio connect signal to join that little
921.18s - 922.74s |  that you hear when you join a meeting.
922.74s - 926.00s |  Was the thing actually triggering the participant list update,
926.40s - 928.50s |  which I really could not believe.
928.50s - 930.70s |  And so since this was happening on the client side,
931.08s - 933.88s |  we could just not send the signal.
934.48s - 936.94s |  And that's exactly what we did with this match and replace rule.
938.18s - 942.38s |  We just simply said has did a true false switch
942.58s - 944.68s |  on whether the audio signal had already been sent or not.
944.84s - 947.08s |  And it didn't send the signal.
947.08s - 949.74s |  And we became Snoop Dogg in that environment.
949.78s - 951.20s |  OK, so let's see how it worked.
951.20s - 953.14s |  Here's my Snoop Dogg POC right here.
953.14s - 953.94s |  That's what I named it.
953.94s - 954.84s |  The triagers loved it.
955.80s - 960.04s |  And essentially what you would do is paste in the meeting information
960.40s - 962.24s |  and then you would click Snoop.
962.26s - 967.04s |  And it would actually exfiltrate the user's transcripts.
967.24s - 970.86s |  And you would not see anything in the in the meeting participant list.
972.86s - 976.66s |  So that one was a 20 to 25 K bounty.
976.66s - 979.14s |  It was technically high, but it was paid as a critical
979.76s - 982.04s |  given the the various bonuses that were occurring.
982.30s - 984.20s |  This is on a public program as well.
984.20s - 987.90s |  So takeaways from this one, reading the GitHub issues can have massive dividends,
987.90s - 990.96s |  especially anything related to security or privacy.
992.34s - 995.44s |  Set goals for your target, like being able to snoop on meetings
995.74s - 1000.14s |  and then verify in the code base how this works, especially on the client side.
1001.54s - 1003.80s |  OK, we are 15 minutes in.
1003.80s - 1005.14s |  Dude, we are doing good.
1005.14s - 1007.84s |  I mean, I may not keep you here long.
1007.84s - 1009.80s |  We'll see, though, because now things are getting a little bit trickier.
1009.80s - 1011.90s |  OK, so this one's going to be a long one.
1012.64s - 1018.24s |  This one was a Perforce server to client RCE.
1018.50s - 1020.54s |  And I'll explain what that is in just a second.
1020.54s - 1024.90s |  The target for this was a desktop application used for game development.
1024.90s - 1028.36s |  OK, the problem is I suck at hacking desktop applications.
1028.36s - 1032.20s |  Note that I did not add that in the list of things that I often hack in the intro slide.
1033.10s - 1035.84s |  So I was thinking, all right, how can I attack this?
1036.10s - 1038.84s |  This is kind of a little bit outside of my comfort zone.
1039.40s - 1041.16s |  I can't really do privilege escalation stuff
1041.16s - 1043.26s |  because this doesn't really run in a privileged environment.
1043.54s - 1046.04s |  So I was thinking, OK, but local attacks are kind of dumb anyway.
1046.60s - 1048.60s |  Let me try to focus on remote attacks.
1048.60s - 1050.34s |  And these are some of the ideas that I came up with.
1050.34s - 1051.66s |  I just want to walk you through the process.
1051.66s - 1054.10s |  So all of this doesn't seem too easy.
1054.10s - 1056.96s |  And you see how often we fail when attacking targets like this.
1057.94s - 1059.90s |  So here are some of the attack factors I came up with.
1059.90s - 1063.80s |  I was thinking we could open a malicious file in the development thing
1063.80s - 1065.54s |  and something bad would happen.
1065.54s - 1068.30s |  We could connect to a malicious server with the development environment
1069.00s - 1070.46s |  and then something bad would happen.
1070.46s - 1074.10s |  We could attack the software development lifecycle
1074.10s - 1076.80s |  a la Lupin, a la Ronnie Carta right here,
1077.42s - 1081.26s |  and try to inject something into the build of this application itself.
1082.46s - 1087.80s |  We could take advantage of some sort of misconfiguration
1088.56s - 1090.10s |  in the actual code itself,
1090.10s - 1092.12s |  like maybe it's reaching out to an unclaimed domain
1092.12s - 1094.72s |  or an unclaimed S3 bucket and inject sort of there.
1095.12s - 1098.20s |  Or we could kind of take these reusable game component pieces
1098.20s - 1101.16s |  that were being processed and try to do something with those.
1101.56s - 1105.40s |  So I started going down these paths and I checked out,
1105.46s - 1107.20s |  open a malicious file.
1107.20s - 1112.12s |  So I broke apart some of the file extensions
1112.12s - 1114.36s |  associated with this and looked at the structure.
1114.36s - 1116.90s |  I was replacing paths with like UNC paths
1116.90s - 1119.12s |  to see if I could force it to reach out to a remote server.
1120.60s - 1123.60s |  I found that you could include settings for a project in a file.
1123.60s - 1124.52s |  That was kind of interesting,
1124.52s - 1127.36s |  but couldn't really do anything malicious with it at the time.
1128.26s - 1130.46s |  I noticed that there was lots of XML.
1130.46s - 1134.00s |  So I started spraying around various XXE payloads in there
1134.00s - 1135.36s |  and seeing if they would trigger.
1135.36s - 1136.22s |  No luck.
1136.22s - 1138.98s |  Symbolic links, I was kind of playing around with those.
1140.12s - 1142.92s |  And nothing's really working, kind of meh,
1142.92s - 1146.02s |  feeling kind of insufficient at this point to look at this target.
1146.02s - 1148.56s |  So I move along to the next attack factor.
1149.66s - 1151.52s |  So that was connect to a malicious server.
1151.52s - 1153.52s |  So what do I mean by that?
1153.52s - 1158.62s |  This software had the ability to connect to remote version control servers
1158.62s - 1160.22s |  so that you could store your code
1160.22s - 1163.72s |  that you were developing in a remote version control.
1164.38s - 1166.34s |  And there were multiple types,
1166.34s - 1168.78s |  and Perforce was one of those types.
1168.78s - 1172.58s |  And that was something that I hadn't really heard of before.
1172.58s - 1177.18s |  And I know from a lot of the work of like Alex Chapman
1177.18s - 1181.58s |  and some of the other great Git version control hackers out there,
1181.58s - 1183.82s |  that version control can be hella sketchy.
1185.02s - 1187.38s |  And so I kind of went down this route.
1188.94s - 1192.34s |  So I started looking up the Perforce protocol spec,
1192.36s - 1196.04s |  and I found this awesome article that told me about that.
1196.04s - 1198.26s |  Funny side note that I don't have in the slides,
1198.26s - 1199.76s |  the guy I just mentioned, Alex Chapman,
1199.76s - 1203.44s |  he was also working on this target at the same time.
1203.44s - 1206.40s |  And he actually had a public blog
1206.40s - 1209.94s |  on how to exploit this specific protocol
1209.94s - 1213.10s |  that I didn't find a little bit until a little bit later.
1213.10s - 1216.74s |  And then I realized, oh shit, he's going to find that same bug.
1216.74s - 1220.10s |  And we did have a bug collision, but it still worked out great.
1220.10s - 1221.86s |  So anyway, I clicked on this article,
1222.68s - 1227.08s |  and it was a really great article describing how this protocol works.
1227.08s - 1229.28s |  It broke down the RPC structure.
1229.28s - 1230.36s |  It's a binary protocol,
1230.36s - 1233.12s |  which I was a little bit uncomfortable with as a web guy,
1233.12s - 1235.42s |  but I decided to try to continue working on it.
1235.42s - 1236.86s |  And as I was reading through the article,
1236.86s - 1241.08s |  I see this very convenient file synchronization flow
1241.08s - 1242.38s |  on the right-hand side there.
1242.38s - 1243.58s |  Now, if you read that for a second,
1243.58s - 1246.28s |  you'll see something a little bit odd, right?
1246.28s - 1251.52s |  The server says, client open file, client write file.
1251.54s - 1254.98s |  And I was like, hmm, that seems odd
1254.98s - 1257.28s |  that the server can just say write files,
1257.28s - 1258.88s |  but it is a version control system.
1258.88s - 1260.68s |  I wonder if there's any path traversals
1260.68s - 1263.44s |  or something nasty that I can do with that.
1263.44s - 1268.78s |  So on a hunch, I started developing this malicious Perforce server.
1268.78s - 1270.18s |  And this was, I'm not going to lie to you guys,
1270.18s - 1273.78s |  this was really intimidating to me because I'm a web guy, like I said,
1273.78s - 1275.72s |  and I don't really deal a lot with binary protocols.
1275.72s - 1279.12s |  But I thought, now is probably the best chance I'll ever get
1279.14s - 1281.84s |  because this article literally breaks everything out
1281.84s - 1283.42s |  as clean as can possibly be.
1283.42s - 1285.38s |  So I decided to go down that path.
1285.38s - 1288.02s |  And in the end, the code was actually really simple.
1288.02s - 1292.28s |  I just created a function that would pass in a JSON blob,
1292.28s - 1294.58s |  and those names and values would then be encoded
1294.58s - 1297.22s |  into the binary format that was described in the article,
1297.22s - 1300.52s |  which was essentially the parameter name, a null byte,
1300.52s - 1305.48s |  the value length, and then the actual value itself,
1305.48s - 1307.82s |  and then a null byte, and then that would be sort of packed
1307.82s - 1313.94s |  into a bigger sort of call that would pass through the socket, okay?
1313.94s - 1321.32s |  So, man, working with struct.pack was really scary to me.
1321.32s - 1323.52s |  Whenever I saw those exploits where it's like,
1323.52s - 1327.94s |  all right, less than and B and I and H,
1327.94s - 1330.34s |  I was thinking like, wow, this is really complicated.
1330.34s - 1334.54s |  But one, ChatGPT is really helpful for that nowadays.
1334.56s - 1339.34s |  And two, you just kind of put your head down and keep working at it.
1339.34s - 1341.84s |  I think it comes pretty quickly.
1341.84s - 1343.74s |  So I was able to build the whole exploit.
1343.74s - 1347.64s |  And essentially, this is a funny part that I wanted to highlight for you guys.
1347.64s - 1350.56s |  When the client connects, of course, it's going to try to auth, right?
1350.56s - 1353.76s |  And my server was just like, yes, yes, you've authed correctly.
1353.76s - 1357.84s |  Let's go, and just ignored the whole auth part, which was really funny,
1357.84s - 1359.80s |  and then just said, write a file.
1359.80s - 1362.16s |  And essentially, what it would do is write a file
1362.16s - 1365.06s |  to anywhere on the file system via path traversal.
1365.06s - 1368.32s |  And so how do we convert that to RCE?
1368.32s - 1369.68s |  Well, it was really easy.
1369.68s - 1372.92s |  There was an exe file that was getting run every two seconds.
1372.92s - 1378.92s |  So you just take your malicious exe file, overwrite that file,
1378.92s - 1383.08s |  and then it gets run two seconds later and you pop a shell.
1383.08s - 1387.36s |  And yeah, how do we actually make this a plausible attack?
1387.36s - 1389.46s |  Well, as I mentioned earlier,
1389.46s - 1393.88s |  there was the ability to include malicious settings for the project.
1393.88s - 1398.68s |  And one of those settings, which was not super present in the documentation,
1398.68s - 1403.82s |  was the ability to provide a version control server to connect to.
1403.82s - 1406.78s |  And when it opened the file, it would automatically connect to that server.
1406.78s - 1409.06s |  So I could provide a victim with a file.
1409.06s - 1410.98s |  They'd open it, connect to my server.
1410.98s - 1415.06s |  My server would push a file down and shell the device.
1415.06s - 1417.92s |  So that was an RCE via malicious file.
1417.94s - 1420.88s |  And the bounty for that was $15,000 to $30,000.
1420.88s - 1422.88s |  Critical, critical, critical, of course.
1422.88s - 1425.28s |  And that was, again, on a public program.
1425.28s - 1427.08s |  Takeaways from this, read the freaking docs.
1427.08s - 1428.04s |  It really helps.
1428.04s - 1429.52s |  And articles.
1429.52s - 1431.22s |  Don't shy away from targets you're scared of.
1431.22s - 1438.28s |  And use your super amazing hacker brain for any struct pack calls or chat GPT,
1438.28s - 1440.14s |  whichever you're more comfortable with.
1440.14s - 1443.92s |  Okay, Joel, I've got some Easter eggs for you in this one, man.
1443.92s - 1445.18s |  You're going to like this, okay?
1445.20s - 1450.90s |  So the next bug that I wanted to talk about was shelling a public program router.
1450.90s - 1454.40s |  Once again, I wasn't super familiar with IoT devices before this.
1454.40s - 1460.98s |  And so I leaned heavily on my boy, Joel Margolis, my podcast co-host here.
1460.98s - 1464.14s |  And as cute as we are together there in that picture,
1464.14s - 1467.28s |  we are both independently married, although that would be great.
1471.14s - 1474.58s |  So let's get to the details, okay, guys?
1476.04s - 1479.24s |  Essentially, what we did is we took this router that was in a public program.
1479.24s - 1480.74s |  We broke it apart.
1480.74s - 1484.38s |  And we used the FCC website and Google and our brain
1484.38s - 1487.24s |  to identify that this chip was in,
1487.24s - 1488.88s |  this is what it sounded like to me the first time,
1488.88s - 1493.70s |  a BGAEMMCABC1234G74XYZ.
1493.70s - 1494.70s |  This is coming out of Joel's mouth.
1494.70s - 1496.64s |  And I was like, oh, my gosh, what the heck is that?
1496.64s - 1499.10s |  Well, it's a lot easier than you would think.
1499.10s - 1500.18s |  It's a ball grid array.
1500.18s - 1503.98s |  Those are those little pieces of silver pieces there,
1504.04s - 1506.34s |  the little pieces of solder, the connections.
1506.34s - 1510.54s |  And then this is an EMMC, which is essentially a SD card,
1510.54s - 1515.70s |  which is just attached to the firmware device or attached to the board.
1515.70s - 1516.90s |  So that was really cool.
1516.90s - 1518.84s |  So we wanted to get that chip off.
1518.84s - 1522.64s |  So and for some reason, Joel let me do it.
1522.64s - 1525.74s |  So what we did was we get a hot air.
1525.74s - 1527.70s |  I ordered a bunch of stuff on Amazon.
1527.70s - 1530.38s |  I got the hot air rework station and lots of flux.
1530.38s - 1533.78s |  And I sat down on the device and started blasting it
1533.78s - 1536.34s |  with 500 degrees Fahrenheit air.
1536.34s - 1538.34s |  And Joel was like, don't do that, bro.
1538.34s - 1542.54s |  And then I proceeded to pull the EMMC chip off
1542.54s - 1545.18s |  before the solder was completely liquid.
1545.18s - 1546.54s |  And Joel was like, don't do that.
1546.54s - 1548.10s |  And just give it some time.
1548.10s - 1551.18s |  And then finally, after bricking three of them,
1551.18s - 1556.86s |  we were actually able to get a clean read of the EMMC chip in our BGA reader
1556.86s - 1560.42s |  and pull off the firmware for that device.
1560.42s - 1562.78s |  Here's Joel's super awesome hardware hacking setup,
1562.78s - 1565.78s |  by the way, which I'm jealous of.
1565.78s - 1566.94s |  Yeah, bricked three of them.
1566.94s - 1567.74s |  Not a great feeling.
1567.74s - 1568.98s |  But the company paid for it.
1568.98s - 1570.46s |  So that was great.
1570.46s - 1573.38s |  So now we've got the firmware so we can start hunting reliably.
1573.38s - 1575.22s |  And it's time to shell that.
1575.22s - 1577.74s |  So what we did then, we were hoping it was
1577.74s - 1579.34s |  going to be a lot easier than it was.
1579.34s - 1582.98s |  But it was several days of weeding through Python code
1582.98s - 1588.10s |  to find the actual attack vector that we ended up getting RCE with.
1588.10s - 1590.86s |  And so the attack chain that we ended up going with
1590.86s - 1595.06s |  started with us using an HTTP request to the cloud provider
1595.06s - 1599.74s |  for this specific device that sent a certificate up.
1599.74s - 1601.90s |  And that certificate was then pushed to the device
1601.90s - 1608.02s |  and controlled certificate-based access to the Google RPC service
1608.02s - 1610.34s |  listening on a port on the device.
1610.34s - 1612.38s |  So once we pushed up that certificate, we
1612.38s - 1615.46s |  were able to communicate with gRPC, which we thought
1615.46s - 1617.66s |  was going to be super helpful.
1617.66s - 1620.62s |  But there was still not a lot of vulnerable code in there.
1620.62s - 1623.06s |  So we spent a couple of days continuing to look.
1623.06s - 1626.30s |  Then finally, we came across this specific piece
1626.30s - 1629.50s |  of functionality, which is write reservations.
1629.50s - 1635.02s |  And as you can see in there, there's a Jinja 2 template being referenced.
1635.02s - 1637.74s |  So everyone's probably thinking template injection.
1637.74s - 1638.46s |  But it's not.
1638.46s - 1640.06s |  They're using it correctly.
1640.06s - 1643.62s |  What it is, however, is configuration file injection,
1643.62s - 1650.30s |  which is a much rarer and, I think, totally underrated vulnerability class.
1650.30s - 1652.18s |  And it kind of looks like this.
1652.18s - 1655.70s |  This functionality would, what was this functionality doing?
1655.70s - 1659.62s |  Yeah, it was writing static IP reservations for the router, right?
1659.62s - 1664.14s |  And so what it would do is dynamically generate this DHCPD file, config file.
1664.14s - 1666.50s |  And it would put the IP address that we wanted to static
1666.50s - 1668.38s |  into the fixed address attribute.
1668.38s - 1670.66s |  However, it wasn't escaping the characters
1670.66s - 1673.78s |  that would allow us to write other DHCPD commands.
1673.78s - 1676.62s |  So we were able to identify a command that
1676.62s - 1682.74s |  would run a shell command when a new DHCP lease was issued.
1682.74s - 1686.58s |  And we were able to code golf it so that it keeps the correct syntax
1686.58s - 1688.74s |  and doesn't break anything.
1688.74s - 1692.46s |  And so then after we got that in place and the exploit went off successfully,
1692.46s - 1695.02s |  we grabbed our phones, connected to the device,
1695.02s - 1698.06s |  and we saw that beautiful shell connection come back,
1698.06s - 1701.06s |  which is one of my favorite moments I've ever had hacking.
1701.06s - 1704.58s |  Joel knows that I jumped up and screamed, and it was amazing.
1704.58s - 1708.42s |  So that one was 20 to 32K, once again, on a public program.
1708.42s - 1710.26s |  And I'm pretty proud of this fact.
1710.26s - 1714.46s |  It took us from zero, from knowing nothing about this target,
1714.46s - 1716.86s |  about 10 days to get that shell.
1716.86s - 1720.26s |  And so I thought it was going to be a lot harder than that.
1720.26s - 1722.26s |  So don't shy away from these sort of things
1722.26s - 1724.94s |  if you're intimidated by it like I was.
1724.94s - 1728.58s |  Takeaways from this one is hack with a collaborator or Joel Margolis,
1728.58s - 1730.06s |  one of those two.
1730.06s - 1733.86s |  Don't be afraid of hacking different types of scope.
1733.86s - 1737.34s |  Get your hands on source code as much as you possibly can.
1737.34s - 1740.06s |  And obviously, configuration file injection
1740.06s - 1744.10s |  is a pretty underrated vuln class, I think, especially in the IoT world.
1744.10s - 1747.30s |  OK, we're just going to do it again real quick,
1747.30s - 1749.26s |  and then we'll move on to the next one.
1749.26s - 1752.02s |  This one was really interesting, though, so I wanted to include it.
1752.02s - 1753.98s |  Another vulnerable endpoint on that same target
1753.98s - 1756.66s |  was doing the same thing for DNS mask.
1756.66s - 1759.14s |  So we're like, OK, let's see if we can do the same thing there.
1759.14s - 1763.34s |  So of course, we Google how to execute code with DNS mask config,
1763.34s - 1765.42s |  and nothing comes up.
1765.42s - 1767.54s |  Unfortunately, there's not a great way to do that.
1767.54s - 1771.14s |  However, what every good DNS caching software needs
1771.14s - 1774.22s |  is a built-in TFTP server.
1774.22s - 1775.26s |  Yeah.
1775.26s - 1780.26s |  So essentially, that can be turned on via a DHCPD configuration.
1780.26s - 1785.50s |  And then you will just be able to have FTP on the whole file system,
1785.50s - 1788.62s |  and we're able to grab another file that can have a lot of impact.
1788.62s - 1792.10s |  The problem was is that we had double injection points this time
1792.10s - 1793.90s |  around in the template, OK?
1793.90s - 1796.78s |  And we really got stuck here for a long time
1796.78s - 1800.30s |  because the user root directive, which
1800.30s - 1806.70s |  is required to open up this TFTP server, cannot be duplicated twice.
1806.70s - 1807.78s |  Just that one directive.
1807.78s - 1811.86s |  Everything else can be duplicated, but the user root cannot.
1811.86s - 1814.94s |  And so because of the double injection points,
1814.94s - 1817.82s |  we were having a really hard time with that.
1817.82s - 1820.42s |  So the solution, of course, is to reach out
1820.42s - 1826.30s |  to Sam Erb, a Googler and double time black badge guy,
1826.30s - 1828.50s |  and say, hey, we've got this problem.
1828.50s - 1829.34s |  And what does Sam do?
1829.34s - 1832.66s |  Of course, he just opens up the C code for DNS mask
1832.66s - 1836.02s |  and starts reviewing how lines are getting parsed,
1836.02s - 1840.26s |  which is very Sam Erb of him to do.
1840.26s - 1842.06s |  And he comes back and he says, hey, there's
1842.06s - 1846.98s |  a maximum character length on a config line for DNS mask,
1846.98s - 1849.22s |  and that's 1,025.
1849.22s - 1854.62s |  So you might be able to essentially align the directive that you need
1854.62s - 1858.34s |  and essentially utilize that maximum length
1858.34s - 1863.06s |  to create a discrepancy between your two injection points.
1863.06s - 1865.18s |  That's the code that's vulnerable.
1865.18s - 1868.30s |  It's not really vulnerable, it's just useful in this scenario.
1868.30s - 1872.06s |  And so what we did is one of those two double injection points
1872.06s - 1874.90s |  was the line was much longer than the other one.
1874.90s - 1880.98s |  So on the shorter line, we created an injection
1880.98s - 1885.14s |  that would not exceed the 1,025 byte limit.
1885.14s - 1890.58s |  And our user root directive would be placed inside of a comment
1890.58s - 1892.74s |  at the end of that, towards the end of that line,
1892.74s - 1893.98s |  but not at the end.
1893.98s - 1897.02s |  And then on the longer injection, let me see if I can show you.
1897.02s - 1901.02s |  Yeah, at the longer injection, the line would overflow,
1901.02s - 1903.98s |  the comments would be longer, and line up user root
1903.98s - 1909.86s |  just on the new line that would be read when parsing the config file.
1909.86s - 1913.66s |  So that was able to get one of our user root directives
1913.66s - 1915.82s |  in a commented out state, and the other one
1915.82s - 1920.06s |  would get bumped to the next line of the DNS mask config file.
1920.06s - 1922.18s |  So this is what the exploit looked like at the end.
1922.18s - 1928.78s |  You can see the top comment has user colon root at the end,
1928.78s - 1930.98s |  and then all the other directives, which are fine to repeat.
1930.98s - 1933.78s |  And then the IP set line has a bunch of A's,
1933.78s - 1938.70s |  and then the A's are right up to that 1,025 byte limit.
1938.70s - 1941.78s |  And then user root gets dropped down into the next line
1941.78s - 1944.98s |  and gets parsed and executed.
1944.98s - 1949.06s |  So using that, we were able to open up a TFTP server on port 69
1949.06s - 1953.14s |  and connect and exfiltrate data that we needed
1953.14s - 1955.94s |  to get our C on the target again.
1955.94s - 1958.54s |  That was another one, same program.
1958.54s - 1961.06s |  I think maybe this was a little bit after the 10 days.
1961.06s - 1962.74s |  It might have been 11 days or 12 days,
1962.74s - 1966.26s |  but we found it pretty quickly afterwards.
1966.26s - 1969.34s |  Takeaway for this one is if it works, do it again.
1969.34s - 1971.02s |  That's one of the big principles of bug bounty,
1971.02s - 1974.06s |  is if you find a bug in one particular area,
1974.06s - 1977.86s |  there's very likely to be bugs that are similar to it
1977.90s - 1979.74s |  in a similar location.
1979.74s - 1983.50s |  So definitely do your due diligence and go down that route.
1983.50s - 1985.18s |  Okay, we're gonna do another one really quick,
1985.18s - 1991.22s |  but I'm gonna get a drink of water first.
1991.22s - 1992.90s |  Okay, bug number nine.
1992.90s - 1993.74s |  We're doing really good.
1993.74s - 1995.98s |  Actually, I'm moving a little fast.
1995.98s - 1998.22s |  I may not use my full time block.
2000.82s - 2002.14s |  Okay, so this time we've got
2002.14s - 2004.54s |  a version control binary SQL injection.
2004.54s - 2006.02s |  And I'm gonna make this one a little bit shorter
2006.02s - 2008.42s |  because it's kind of complicated.
2008.42s - 2010.94s |  So we get this version control binary and I'm like,
2011.06s - 2014.26s |  let me see if I can do something out of my comfort zone
2014.26s - 2016.14s |  and load it up into Ghidra.
2016.14s - 2017.06s |  And then I get a bunch of errors
2017.06s - 2020.54s |  relating to Microsoft and CLR and .NET.
2020.54s - 2022.58s |  So I loaded up into .peek
2022.58s - 2024.98s |  and we were able to get the source code out,
2024.98s - 2026.14s |  which was great because apparently
2026.14s - 2029.62s |  you can decompile those binaries
2029.62s - 2031.58s |  and you get some really clean source code.
2031.58s - 2032.94s |  So we were looking at the source code
2032.94s - 2034.98s |  and essentially what was happening is
2035.86s - 2037.42s |  we would be able to upload a file
2037.42s - 2040.10s |  to a web version control interface.
2040.22s - 2042.26s |  And that file could have a malicious name.
2042.26s - 2043.62s |  And then it would be stored
2043.62s - 2044.90s |  in the version control environment.
2044.90s - 2046.70s |  And the next time the user opened up
2046.70s - 2048.70s |  and used that version control binary,
2048.70s - 2051.78s |  it would pull the malicious file down
2051.78s - 2055.78s |  and insert it into a SQLite database.
2055.78s - 2060.02s |  So if you name a file, an SQL injection payload,
2060.02s - 2063.94s |  it would fire that and escape the string
2063.94s - 2068.10s |  in the SQLite query and run arbitrary SQL
2068.10s - 2069.34s |  on the victim's machine.
2069.38s - 2070.46s |  This was found in collaboration
2070.46s - 2072.62s |  with an amazing hacker named Udyotuk.
2072.62s - 2075.50s |  And he reads C-sharp code to fall asleep at night.
2075.50s - 2078.78s |  So he was the original one who found this sink.
2079.78s - 2082.02s |  So how we exploited this was
2082.02s - 2084.66s |  we were able to upload the file, sink it down.
2084.66s - 2088.26s |  And then in the end, we weren't able to get code execution,
2088.26s - 2091.98s |  but what we were able to do was actually run code,
2091.98s - 2095.54s |  which would attach the user's Chrome cookies,
2095.54s - 2098.54s |  which are stored in a SQLite database
2099.30s - 2101.98s |  and vacuum it into a B.db file,
2101.98s - 2104.50s |  and then recheck that file back into version control,
2104.50s - 2106.58s |  which would push it back up to the web app.
2106.58s - 2107.98s |  And then we could download
2107.98s - 2110.94s |  and get ATO on that victim's web version control account.
2111.94s - 2113.90s |  And so that one, that was the end of the vuln.
2113.90s - 2115.14s |  That was where we chained it to.
2115.14s - 2116.70s |  That one was 30, 40K.
2116.70s - 2118.86s |  And once again, wanted to reiterate,
2118.86s - 2120.90s |  definitely hack with other hackers.
2120.90s - 2122.90s |  It really expands your knowledge,
2122.90s - 2125.26s |  especially in areas where you're uncomfortable.
2126.22s - 2129.30s |  I have to admit, I kind of underestimated SQLite.
2129.30s - 2131.30s |  I kind of thought SQLite was a thing of the past,
2131.30s - 2132.26s |  but they're out there,
2132.26s - 2135.18s |  and we see them pretty often in the live hacking events.
2135.18s - 2136.58s |  They're just a little bit deeper.
2136.58s - 2138.46s |  And sometimes they're not even just a little bit deeper.
2138.46s - 2139.46s |  They're out there.
2140.70s - 2141.94s |  .peek is super helpful
2141.94s - 2143.86s |  for those sort of decompilation scenarios
2143.86s - 2147.30s |  when the base language is, I think like .net or C-sharp.
2147.30s - 2149.58s |  So definitely check that out.
2149.58s - 2152.62s |  And yeah, I really liked the exploitation scenario
2152.62s - 2153.62s |  that we came up with there,
2153.62s - 2156.98s |  where we were able to vacuum the user's cookies
2156.98s - 2158.14s |  into the version control
2158.14s - 2160.42s |  and use that to exfiltrate the file as well.
2162.22s - 2164.30s |  Yeah, and maybe don't roll your own version control.
2164.30s - 2166.10s |  That's a nice takeaway as well.
2166.10s - 2168.26s |  That never seems to end well.
2168.26s - 2172.86s |  Okay, now we are on to the very hard exploits.
2172.86s - 2174.58s |  So buckle up.
2174.58s - 2176.70s |  This one's gonna take a hot second.
2176.70s - 2184.03s |  I'm gonna get water again.
2184.03s - 2187.79s |  Okay, target for this one was an in-home tabletop IoT device
2187.79s - 2189.19s |  with camera and microphone.
2189.19s - 2190.31s |  There's a couple out there.
2190.31s - 2192.55s |  It's probably not the one you're thinking of,
2192.55s - 2195.07s |  but it is one of the top four or five
2195.07s - 2196.31s |  you would be thinking of.
2198.83s - 2200.99s |  The end goal of this was, once again,
2200.99s - 2203.91s |  I wanted to do creepy shit that people always say,
2203.91s - 2206.71s |  okay, it's possible, but I haven't seen before.
2206.71s - 2208.03s |  And now I have.
2208.03s - 2210.87s |  So I wanted to do no user interaction spying
2212.67s - 2214.03s |  in somebody's house
2214.03s - 2217.71s |  and essentially just teleport myself into their house.
2218.47s - 2219.31s |  And so I started going after that path
2219.31s - 2220.15s |  and I started ideating
2220.15s - 2222.31s |  on what the possibilities for this were.
2222.31s - 2223.15s |  Here are a couple.
2223.15s - 2224.83s |  We could get a no interaction shell on the device.
2224.83s - 2226.63s |  That would be really challenging.
2226.63s - 2230.19s |  We could gain some sort of, insert company name here,
2230.19s - 2231.95s |  admin functionality on the device,
2231.95s - 2234.23s |  and maybe that would allow us to do it.
2234.23s - 2236.63s |  We could bypass auth specifically for the cam
2236.63s - 2238.47s |  and mic-related endpoints.
2238.47s - 2241.39s |  We could compromise storage for video and audio feeds
2241.39s - 2243.23s |  and maybe get access that way.
2243.23s - 2245.51s |  Or we could access the built-in functionality
2245.55s - 2249.23s |  to access the cam and mic stuff
2249.23s - 2252.27s |  via a full authentication bypass on that person's account.
2253.19s - 2254.55s |  So which one are we feeling, guys?
2254.55s - 2256.31s |  Raise your hands, put them up.
2256.31s - 2258.43s |  I'm gonna give a critical thinking t-shirt
2258.43s - 2263.55s |  to anybody who gets it right.
2263.55s - 2264.47s |  It was number three,
2264.47s - 2265.91s |  and the first person I see with number three
2265.91s - 2266.91s |  is this guy right here.
2266.91s - 2268.19s |  So I'll get you a t-shirt right after.
2268.19s - 2269.27s |  Come up and get it.
2269.27s - 2271.27s |  So it was bypass auth specifically
2271.27s - 2273.43s |  for the cam and mic-related endpoints.
2273.43s - 2274.27s |  That's how we got it.
2274.27s - 2276.27s |  So let's go ahead and go down that path.
2277.23s - 2280.43s |  Okay, this IoT device has a Android app,
2280.43s - 2282.91s |  and you can use that Android app
2282.91s - 2286.43s |  to video chat with this tabletop device, okay?
2286.43s - 2289.75s |  And when you call yourself from the mobile app,
2289.75s - 2291.99s |  there's an automatic answer on the IoT device
2291.99s - 2294.39s |  just allowing you sort of pop into your house
2294.39s - 2297.31s |  and say like, hey, cat, how's it going, right?
2297.31s - 2298.99s |  So I thought that was really sus
2298.99s - 2301.95s |  and was a prime feature for accomplishing the goal
2301.95s - 2303.15s |  that I mentioned before.
2304.11s - 2306.39s |  So I started, I took the mobile app
2306.39s - 2308.63s |  and I threw it into JADx and decompiled it
2308.63s - 2310.51s |  and got the source code.
2310.51s - 2313.15s |  And then the never-ending story began, okay?
2313.15s - 2316.15s |  So this app was kind of locked down.
2316.15s - 2319.07s |  So the first thing was it had root detection
2319.07s - 2321.71s |  and there was some weird stuff with Google Play.
2321.71s - 2324.75s |  So essentially what I had to do was patch the APK
2324.75s - 2328.59s |  to run Frida, and I did that with objection.
2328.59s - 2330.35s |  And then I would overwrite
2330.35s - 2332.83s |  all of the root detection on the app
2333.51s - 2334.83s |  so that it would think that I'm not,
2334.83s - 2336.59s |  I wasn't in a environment.
2336.59s - 2339.75s |  And then, and there was some other emulator detection
2339.75s - 2340.67s |  as well in there.
2341.63s - 2345.43s |  And so then the next one was bypassing TLS,
2345.43s - 2346.83s |  pinning for HTTP.
2346.83s - 2348.19s |  Of course, they had that in place.
2348.19s - 2349.87s |  Most apps do nowadays.
2349.87s - 2353.31s |  And so I had to come up
2353.31s - 2355.95s |  and they had unfortunately a custom cert pinning solution.
2355.95s - 2358.67s |  Most of the time, Joel, my boy here
2358.71s - 2363.23s |  has a public TLS cert pinning script
2363.23s - 2365.19s |  that will just unpin most of the apps,
2365.19s - 2366.39s |  which is super helpful,
2366.39s - 2367.59s |  but this one was not so easy.
2367.59s - 2368.83s |  So I had to break, you know,
2368.83s - 2370.31s |  go into the code and find exactly
2370.31s - 2373.27s |  where the cert pinning was occurring
2373.27s - 2374.39s |  and overwrite those functions
2374.39s - 2378.55s |  with the JavaScript in the Frida code.
2378.55s - 2380.31s |  I'm gonna check my time really quickly.
2380.31s - 2382.15s |  Nope, my phone died, so I'm not.
2383.95s - 2385.35s |  What you got?
2385.35s - 2386.91s |  536, all right, thanks guys.
2386.91s - 2389.67s |  I was running my hotspot off of it for the last workshop
2389.67s - 2391.83s |  and then I looked down and it was dead.
2391.83s - 2393.39s |  Okay, so at that point, cool,
2393.39s - 2395.31s |  we bypassed cert pinning
2395.31s - 2398.91s |  and we've got HTTP introspection, great.
2398.91s - 2401.67s |  Now let's see how this whole calling thing works, right?
2401.67s - 2404.87s |  Nope, because the calling thing is behind SIP
2404.87s - 2407.23s |  and more specifically SIPs,
2407.23s - 2410.55s |  which is the secure version of the SIP protocol.
2410.55s - 2411.39s |  Okay, what is SIP?
2411.39s - 2413.11s |  Well, let me tell you.
2413.11s - 2414.83s |  The session mission protocol SIP
2414.83s - 2415.99s |  is a signaling protocol
2415.99s - 2419.43s |  to initiate, maintain and terminate real time sessions
2419.43s - 2421.15s |  that involve video, voice, messaging
2421.15s - 2423.95s |  and other communication applications and services.
2423.95s - 2427.19s |  SIP is widely used for voice and video calls.
2427.19s - 2429.95s |  Great, now I've got to deal with another protocol
2429.95s - 2432.27s |  and it is also TLS wrapped.
2432.27s - 2435.19s |  So a bunch of stuff kind of going on there.
2435.19s - 2436.23s |  So I start working on that
2436.23s - 2439.31s |  and find a custom cert pinning solution for SIPs
2439.31s - 2442.03s |  and kind of am able to disable that.
2442.87s - 2446.31s |  But Burp, while it is SIPs friendly,
2446.31s - 2449.59s |  is not SIPs compatible
2449.59s - 2452.15s |  and will break the application if you try to proxy it.
2452.15s - 2455.07s |  So what I realized I needed is,
2455.07s - 2456.43s |  and this is kind of how it looks right there,
2456.43s - 2460.23s |  it'll issue the register requests with the SIP HTTP verb
2460.23s - 2461.95s |  or the register HTTP verb
2461.95s - 2463.83s |  that's associated with SIP protocol,
2463.83s - 2466.11s |  but then it'll just break the response.
2466.99s - 2470.23s |  So I had to find a transparent proxy
2470.23s - 2472.75s |  and for this I used PolarProxy.
2472.75s - 2476.67s |  It's a transparent TLS and SSL inspection proxy.
2476.67s - 2478.95s |  So I took that and I took the cert for that
2478.95s - 2481.03s |  and I inserted it into the trust store
2481.03s - 2482.75s |  for that specific mobile app
2482.75s - 2486.63s |  and then I proxied all the stuff through PolarProxy
2486.63s - 2489.23s |  and that would output a PCAP file
2489.23s - 2492.67s |  and then finally we had access to reading
2492.67s - 2495.59s |  what was going on and I was able to get introspection
2495.59s - 2497.83s |  on SIPs without breaking the whole app.
2497.83s - 2501.75s |  We are probably a week or two
2501.75s - 2503.63s |  into looking at this target at this point
2503.63s - 2508.63s |  with no leads, no potential loans, no gadgets, nothing.
2508.63s - 2510.55s |  Just set up at this point,
2510.55s - 2512.23s |  which is amazing to me as a bug hunter
2512.23s - 2514.75s |  because normally I spend a lot of time
2514.75s - 2515.79s |  looking to find gadgets
2515.79s - 2517.99s |  and I feel sort of accomplished going along the way,
2517.99s - 2519.43s |  but this was a big upfront investment
2519.43s - 2522.07s |  and I think people that do this sort of thing,
2522.07s - 2525.07s |  mobile hacking or IoT device hacking
2525.07s - 2527.79s |  have a lot more upfront, which is really tricky.
2527.79s - 2529.71s |  That's something from a bug bounty perspective
2529.71s - 2531.55s |  that the programs really need to help
2531.55s - 2533.27s |  and minimize as much as possible
2533.27s - 2534.39s |  if you want your mobile apps
2534.39s - 2537.43s |  and your IoT devices and your desktop applications
2537.43s - 2541.79s |  to get as much interest as your web applications do.
2543.11s - 2545.59s |  Okay, so now we finally get to see how all this works.
2545.59s - 2547.43s |  So let's talk through that flow a little bit.
2547.43s - 2550.91s |  So step one is let's talk about getting a call,
2550.91s - 2551.75s |  receiving a call.
2551.75s - 2553.11s |  So you open up the app
2553.19s - 2555.55s |  and it right away does a call
2555.55s - 2558.11s |  to slash API slash get SIP auth token, okay,
2558.11s - 2561.43s |  with your auth token associated with your account.
2561.43s - 2563.03s |  And then it will return a token
2563.03s - 2564.59s |  that sort of looks like this.
2564.59s - 2565.79s |  It's sort of like a JWT,
2565.79s - 2569.79s |  but it's not actually Base64 encoded
2569.79s - 2572.91s |  and it has these various delimiters in them.
2572.91s - 2574.39s |  The ones that's most interesting to us
2574.39s - 2576.27s |  is the payload delimiter, okay?
2576.27s - 2577.75s |  And in that payload delimiter,
2577.75s - 2582.75s |  there is a from field and a to field
2583.15s - 2584.11s |  and a bunch of other fields.
2584.11s - 2585.31s |  But the ones that are most interesting
2585.31s - 2587.23s |  are the from and to fields, okay?
2588.39s - 2589.79s |  So then what would happen then
2589.79s - 2591.03s |  is they would take that auth token
2591.03s - 2592.63s |  that they got from the API request.
2592.63s - 2594.59s |  They would put that as a header and SIP protocol,
2594.59s - 2596.51s |  which is very similar to HTTP in a lot of ways.
2596.51s - 2598.65s |  The concepts are very similar.
2598.65s - 2599.95s |  There's headers and stuff like that,
2599.95s - 2601.11s |  and they look similar.
2601.11s - 2603.59s |  And then it would put that auth token into the request
2603.59s - 2608.03s |  with its own SIP level from to and contact headers.
2608.03s - 2609.55s |  And that would essentially allow you
2609.55s - 2614.47s |  to register the address of record
2614.47s - 2616.95s |  that is in the to header, okay?
2616.95s - 2620.03s |  And when it does this registration,
2620.03s - 2622.47s |  it validates that the from and to fields
2622.47s - 2624.59s |  from the auth token match the from and to fields
2624.59s - 2626.47s |  in the SIP request.
2626.47s - 2628.63s |  And then somehow through black magic,
2628.63s - 2631.77s |  when somebody calls, your phone will ring.
2631.77s - 2632.61s |  It's kind of nut.
2632.61s - 2634.83s |  I don't know how all that transport stuff
2634.83s - 2636.13s |  happens in the background.
2637.13s - 2638.11s |  But I thought that was interesting.
2638.11s - 2640.51s |  So I went ahead and moved along.
2640.51s - 2642.83s |  And so now let's look at making a call, okay?
2642.83s - 2644.63s |  So say we want to call somebody else.
2644.63s - 2648.23s |  So we go ahead and send a request to slash API
2648.23s - 2653.11s |  slash init call auth, and we provide as a post parameter
2653.11s - 2654.87s |  to that a target, okay?
2654.87s - 2659.87s |  And this target, sorry, this target will be reflected
2660.23s - 2662.59s |  in the payload in the from field,
2662.59s - 2663.63s |  or I'm sorry, the to fields,
2663.63s - 2665.03s |  because we're making a call.
2666.11s - 2667.11s |  And that was great.
2667.11s - 2671.63s |  And then you use that in an invite SIP request
2671.63s - 2676.63s |  with the from and to headers matching the values
2676.63s - 2677.83s |  in the auth token.
2677.83s - 2680.83s |  And then somehow through black magic,
2680.83s - 2682.67s |  the other person's device starts ringing
2682.67s - 2684.87s |  and you go through all these networks
2684.87s - 2686.15s |  and you send the TCP data through
2686.15s - 2689.49s |  or the UDP data depending on the flow.
2689.49s - 2690.33s |  Okay.
2690.33s - 2692.75s |  And once again, I'm gonna reiterate for that to happen,
2692.75s - 2695.23s |  the from and to headers in the SIP request
2695.23s - 2698.61s |  have to match the auth token, right?
2699.55s - 2704.11s |  So let's talk a little bit about how we could fake a call.
2704.11s - 2709.11s |  So in the API slash init call request or call auth request,
2709.35s - 2711.19s |  the target that we would specify
2711.19s - 2714.11s |  was actually accepted arbitrary data.
2714.11s - 2715.59s |  And so what that would allow us to do
2715.59s - 2718.19s |  is then inject arbitrary data into that auth token
2718.19s - 2719.95s |  that is used at the SIP level.
2719.95s - 2722.19s |  And so then what we proceeded to do
2722.19s - 2726.31s |  was close the little delimiter there
2726.31s - 2728.97s |  or put the person in for the two headers
2728.97s - 2730.27s |  so it doesn't fail.
2730.27s - 2733.67s |  Semi colon out and then provide another header.
2733.67s - 2734.51s |  Five minutes.
2734.51s - 2735.35s |  Oh, wow.
2735.35s - 2736.43s |  Okay, I gotta move.
2736.43s - 2741.03s |  Then provide another from header as person two.
2742.03s - 2747.03s |  So this would look like the call was coming from person two,
2747.15s - 2749.99s |  the person receiving the call and to person two,
2749.99s - 2751.91s |  which right, we discussed earlier
2751.91s - 2755.11s |  was how you automatically auth into the device
2755.11s - 2756.73s |  and check on your cat or whatever
2756.73s - 2758.51s |  if you're calling from the mobile device.
2758.51s - 2761.27s |  So we were able to smuggle in that from field
2761.27s - 2765.69s |  and we would generate the token with request number one,
2765.69s - 2769.07s |  put it into the invite SIP request.
2769.07s - 2773.33s |  And since the from and to fields matched
2773.33s - 2777.83s |  and the auth token validated those two things,
2777.83s - 2780.11s |  the call would happen and it would auto answer.
2780.11s - 2783.91s |  However, there was no contact field in the auth token
2783.91s - 2785.03s |  so that wasn't validated.
2785.03s - 2787.17s |  And the contact thing is actually where,
2787.17s - 2788.87s |  the contact header is where the call
2788.87s - 2790.71s |  gets actually routed to.
2790.71s - 2792.41s |  So then you could see it on your device
2792.41s - 2795.79s |  and you would be looking through that person's IoT device,
2796.67s - 2798.97s |  which was nuts and I cannot believe it worked.
2800.53s - 2801.65s |  But wait, you might ask,
2801.65s - 2805.43s |  what is up with the from header there, right?
2805.43s - 2808.95s |  Well, the from header was an interesting situation
2808.95s - 2812.15s |  because as much as we thought we had source code,
2812.15s - 2814.55s |  there was one more challenge that awaited for us
2814.55s - 2818.11s |  at that point, which was, we're using PolarProxy,
2818.11s - 2822.23s |  so how do we do repeater or intercept on these things
2822.23s - 2824.51s |  to modify the requests as they were going through?
2824.51s - 2829.51s |  Well, the answer to that is a shit ton of Frida calls
2829.81s - 2832.71s |  to overwrite and actually use the mobile client
2832.71s - 2836.43s |  as our own proxy to send stuff through,
2836.43s - 2838.51s |  which was really painful.
2838.51s - 2841.27s |  And unfortunately, the section that set that from header
2841.27s - 2844.11s |  was automatically done inside of a .so file,
2844.11s - 2847.03s |  a binary file within the app.
2847.99s - 2850.43s |  So it couldn't be hooked very easily with Frida
2850.43s - 2851.51s |  because of the situation.
2851.51s - 2854.17s |  So I was kind of lost at this point, what do I do?
2855.05s - 2857.31s |  And I was talking to another awesome hacker
2857.31s - 2860.35s |  named Spacer Coon and he advised,
2860.39s - 2863.17s |  hey man, why don't you just patch the binary?
2864.07s - 2866.35s |  And I was like, that's scary as hell.
2866.35s - 2867.67s |  I don't know how to do that.
2867.67s - 2871.01s |  And then he realized, or he told me that it's just a string.
2871.01s - 2873.59s |  So just search the binary for that string
2873.59s - 2875.51s |  and replace the O with an A
2875.51s - 2877.49s |  and it will automatically put in a different header.
2877.49s - 2880.19s |  So I did that in a hex editor and it worked.
2880.19s - 2882.77s |  And then I was able to add another from header
2882.77s - 2886.11s |  via the Java bindings, which matched the auth token
2886.11s - 2888.07s |  and allowed me to bypass auth
2888.07s - 2891.47s |  and peer through anybody's desktop IoT device.
2892.87s - 2897.23s |  Okay, and that was a 20 to 50K bug.
2897.23s - 2900.47s |  And takeaways for that were set a goal
2900.47s - 2901.59s |  and go after it really hard
2901.59s - 2904.51s |  because some of this crazy stuff that they talk about
2904.51s - 2907.19s |  in the horror stories is really possible.
2907.19s - 2911.05s |  And I've become a believer in that since this happened.
2911.05s - 2913.35s |  Last bug is really quick
2913.35s - 2916.39s |  and I should be able to go through pretty quickly
2916.39s - 2918.83s |  because it's in the same stack.
2918.83s - 2922.67s |  This was a bug where you could hijack calls
2922.67s - 2923.99s |  going to other people.
2923.99s - 2927.95s |  And the way that you did that was using that token,
2927.95s - 2929.67s |  the call auth token.
2930.75s - 2933.11s |  So let me, yeah.
2933.11s - 2934.55s |  So you can see here, right?
2934.55s - 2937.07s |  That the register token, as a reminder,
2937.07s - 2939.21s |  the register token where you register your name
2939.21s - 2941.47s |  has a to and from field that match.
2941.47s - 2944.67s |  The call token has a from and to field
2944.67s - 2945.99s |  that are different from each other
2946.55s - 2948.55s |  because you're calling somebody else, right?
2948.55s - 2951.85s |  When we look at the register SIP request that occurs,
2951.85s - 2954.27s |  there's this caveat in the from section,
2954.27s - 2956.61s |  which essentially allows for this feature
2956.61s - 2958.07s |  called third-party registration
2958.07s - 2960.67s |  where you are registering for somebody else.
2960.67s - 2962.79s |  Now, when we use the init call,
2964.47s - 2967.17s |  HTTP request to generate the token,
2967.17s - 2969.55s |  we can specify a different from
2969.55s - 2972.79s |  or a different to header in that auth token, right?
2972.79s - 2975.01s |  Because that's the person we're calling to.
2975.01s - 2976.53s |  So then we could take that token,
2976.53s - 2978.41s |  which has the same signature,
2978.41s - 2980.79s |  and apply it to the register header.
2980.79s - 2982.31s |  And it will have a from header
2982.31s - 2983.97s |  that is different from the to header.
2983.97s - 2987.31s |  And the to header can be any one that we specify.
2987.31s - 2989.49s |  So then we could register,
2989.49s - 2992.41s |  essentially do a third-party register for any other user
2992.41s - 2995.17s |  and map their address of record, right?
2995.17s - 2996.89s |  The thing that routes the call to them
2996.89s - 3000.05s |  to our contact location.
3000.05s - 3002.93s |  And then when somebody calls that user,
3002.97s - 3004.61s |  our device would start ringing.
3005.61s - 3008.37s |  And that one was another 20 to 50K,
3008.37s - 3010.73s |  critical, critical, critical on a public program.
3010.73s - 3014.03s |  And takeaways are pretty much the same.
3014.03s - 3016.17s |  But don't be afraid of new protocols.
3016.17s - 3018.23s |  And that is one of the biggest takeaways I've found
3018.23s - 3020.13s |  in my many, many years of bug bounty.
3020.97s - 3022.29s |  All right, that was the recap.
3022.29s - 3024.05s |  11 bugs, all paid as critical.
3024.05s - 3028.51s |  The grand total for this was somewhere between 225 and 400K
3028.51s - 3030.21s |  for all those bugs.
3030.21s - 3031.33s |  And that's it.
3031.33s - 3032.17s |  Thank you guys.


url: https://www.youtube.com/watch?v=8BC0oHu5QGQ
title: DEF CON 32 - Bridging Space and Medicine - Fernando De La Peña Llaca
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=8BC0oHu5QGQ",
  "title": "DEF CON 32 - Bridging Space and Medicine - Fernando De La Pe\u00f1a Llaca",
  "description": "In the vast expanse of space, holographic teleportation\u2014a futuristic blend of holography and teleportation\u2014has revolutionized astronaut communication. Imagine beaming a lifelike 3D image of yourself across light-years. Now, consider its potential in medicine: remote surgeries, expert consultations, and training\u2014where distance dissolves, and expertise transcends borders. Buckle up; holoconnect is our cosmic ticket to healing!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2132,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

8.69s - 13.69s | This text was transcribed using whisper model: large-v2

 a device called the HoloLens, which essentially is a mixed reality computer.
13.69s - 21.69s |  So, if you are wearing the huge headset back in the day, you can interact with the people,
21.69s - 25.69s |  but also you can interact with holograms, and the holograms can interact with you.
25.69s - 32.69s |  So, one of the NASA surgeons in Houston was assisting one of the astronauts.
32.69s - 35.69s |  Her name is Samantha Cristoforetti, as you can see over there.
35.69s - 43.69s |  In her view, she could see holograms about where to make the incisions, what to measure.
43.69s - 51.69s |  She was able to see x-rays and information to help her to perform a medical procedure.
51.69s - 58.69s |  It was a huge success. We performed this procedure with no issues at all.
58.69s - 67.48s |  This mission was led by the NASA surgeon and also Air Force General Dr. George Smith.
67.48s - 72.48s |  And after that, he came to me and said, hey, Fernando, I really like this.
72.48s - 78.48s |  It was cool. What else can we do? And that's Dr. George Smith and I.
78.48s - 86.48s |  And I said, well, I heard that Microsoft is developing something called holographic teleportation.
86.48s - 88.48s |  And he told me, okay, what's holographic teleportation?
88.48s - 96.48s |  I said, okay, they have this studio. They have 109 cameras with a laser, with a LiDAR.
96.48s - 104.48s |  You come into the studio, they capture you, and a couple of weeks later, they deliver you a file, which is huge.
104.48s - 109.48s |  You put it in the HoloLens, and you can see a hologram of yourself.
109.48s - 112.48s |  It's not live, but it's a hologram of yourself.
112.48s - 121.48s |  And he told me, hey, I really like this. I want you to make this happen on a station, and I want you to make it live.
121.48s - 126.48s |  And I said, okay, we can do that. That was 2018.
126.48s - 133.48s |  And to give you an idea about what is holographic teleportation, the best analogy for me is 3D printing.
133.48s - 141.48s |  With a 3D printer, you have thousands of layers of material until you have a solid object.
141.48s - 147.48s |  With holoportation, it is the same. We call it actually volumetric video.
147.48s - 153.48s |  You have thousands of layers of video until you have a solid hologram of someone.
153.48s - 161.48s |  You can interact with a hologram. You can feel the hologram with something we call haptics, and they can see you.
161.48s - 165.48s |  Why this is better compared with FaceTime or any video conference?
165.48s - 168.48s |  Well, you have six axes of freedom.
168.48s - 180.48s |  So going back to my story, Joe told me like, okay, let's put it on a station, but we have multiple limitations.
180.48s - 186.48s |  One, here on Earth, Microsoft has a studio with 109 cameras.
186.48s - 188.48s |  On a station, we only have one.
188.48s - 196.48s |  Second, here on Earth, it was recorded and processed using very powerful gaming computers.
196.48s - 201.48s |  On a station, it needs to be live and with very old computers.
201.48s - 207.48s |  Believe it or not, on the Space Station, we have something called SSE computers, Space Station computers.
207.48s - 218.48s |  And those are very old computers because those computers don't receive big damage from radiation or atomic oxygen or conditions in space.
218.48s - 224.48s |  Then the other challenge was we don't have a constant communication.
224.48s - 228.48s |  Here on Earth, we have a satellite. We have an antenna.
228.48s - 234.48s |  We just aim to any of the satellites, and we have communication.
234.48s - 244.48s |  On a station, the station is moving so fast, every 90 minutes, it completes an orbit on Earth.
244.48s - 249.48s |  So what happened, we have an antenna that aims down instead of up.
249.48s - 260.48s |  But because the station is moving so fast, we need to adjust that antenna, like maybe every 15, every 20 minutes, and aim to another satellite.
260.48s - 263.48s |  So in those gaps, we don't have any communication.
263.48s - 265.48s |  We call it satellite handovers.
265.48s - 268.48s |  Then we have multiple firewalls.
268.48s - 271.48s |  And then the biggest limitation is bandwidth.
271.48s - 278.48s |  On a station, we have something called Skynet, which is not related with the movie.
278.48s - 282.48s |  We have something called CloudNet, which is our internet on a station.
282.48s - 285.48s |  But we have 20 megabits per second.
285.48s - 293.48s |  It's super slow, and we use 20 megabits per second for everything, to run the station, trying to dock spacecrafts and everything.
293.48s - 300.48s |  So when we came with the idea of using holoportation, they only gave us 5 megabits per second.
301.48s - 312.48s |  And to give you a better idea how a hologram looks like, that picture is one of my employees in Alabama holoporting next to me in Texas.
312.48s - 314.48s |  So really, you can see the person.
314.48s - 323.48s |  You can see if I have a camera, and I'm aiming to this auditorium, I can beam you up and make you holograms everywhere.
323.48s - 325.48s |  And I have a very cool video.
325.48s - 332.77s |  Hopefully, it will play here about telemedicine.
333.77s - 334.77s |  Yes.
334.77s - 342.18s |  Let me fast-forward.
350.18s - 355.18s |  Though neither Nathan nor I have any medical experience or expertise,
355.18s - 363.18s |  we'd like to show you a few steps from the stroke evaluation test, as well as a few physical therapy exercises,
363.18s - 368.18s |  to give you a sense for the power of this software, as well as some potential use cases.
368.18s - 370.18s |  So let's get started.
370.18s - 375.73s |  Nathan, thanks for joining us today.
375.73s - 379.73s |  I'd like to go through a few steps of a stroke evaluation,
379.73s - 384.73s |  and then we'll do a couple of physical therapy-type exercises,
384.73s - 389.73s |  just to give our viewers an illustration of some of the power of this.
389.73s - 392.73s |  So let's start with the stroke evaluation.
392.73s - 394.73s |  So that's a stroke evaluation.
394.73s - 396.73s |  I don't know if you can hear it clearly.
396.73s - 401.73s |  But in front of my colleague, Mark, is Nathan Rehm in Alabama.
401.73s - 404.73s |  So for Mark, Nathan is right there.
404.73s - 407.73s |  And from Nathan, Mark is right there.
407.73s - 409.73s |  We are right here, person to person.
418.73s - 421.73s |  So he's asking to raise the hands and all the procedure.
421.73s - 424.73s |  And I'm going to move forward to the next slide.
424.73s - 430.73s |  But that will give you some idea about this technology.
430.73s - 440.96s |  So going back to using this technology on a station, on the space station,
440.96s - 447.96s |  during 2019, as you know, we had COVID and we had isolation.
447.96s - 452.96s |  And NASA was very sensitive about pushing the gas for technologies
452.96s - 456.96s |  that will help us in isolation situations
456.96s - 460.96s |  and also to literally bridge medicine
460.96s - 463.96s |  and trying to bring the best physicians to the station
463.96s - 465.96s |  and perform medical evaluations.
465.96s - 467.96s |  So we did it.
467.96s - 471.96s |  Dr. George Smith was the first human holoporter to the space station.
471.96s - 473.96s |  The second one was me.
473.96s - 478.96s |  And he performed a couple of medical evaluations to some of the astronauts.
478.96s - 482.96s |  That was a one-way holoportation.
482.96s - 484.96s |  So just to give you an idea,
484.96s - 489.96s |  that's Dr. George Smith at NASA's Mission Control, Building 30,
489.96s - 491.96s |  interacting with one of the astronauts.
491.96s - 496.96s |  So for the astronaut, for the crew member, Dr. Smith was there.
496.96s - 500.96s |  But for Dr. Smith, he was looking to a computer screen.
500.96s - 505.96s |  He was watching a computer screen just to try to interact with the astronaut.
505.96s - 507.96s |  It was very successful.
507.96s - 514.96s |  NASA sent a press release, which became viral in at least 15 different languages.
514.96s - 520.96s |  And one of the reasons is Dr. Smith is a huge fan of Star Trek,
520.96s - 524.96s |  so he made Live Long and Prosper from Spock.
524.96s - 527.96s |  So let me tell you a story.
527.96s - 531.96s |  His wife is from Japan, from a very remote island in Japan.
531.96s - 535.96s |  According to Dr. Smith, they don't have any television.
535.96s - 539.96s |  They only have radio, which was cool.
539.96s - 543.96s |  And then he was on vacation in Japan.
543.96s - 545.96s |  His brother-in-law came running and said,
545.96s - 547.96s |  Hey, Joe, Joe, guess what?
547.96s - 550.96s |  NASA invented some technology called holoportation,
550.96s - 556.96s |  and they sent a NASA surgeon to the space station as a hologram, blah, blah, blah.
556.96s - 559.96s |  And Joe asked him, Hey, how do you know that?
559.96s - 561.96s |  And he said, Well, it was on the radio.
561.96s - 564.96s |  He said, On the radio here in this remote island of Japan?
564.96s - 565.96s |  And he said, Yes.
565.96s - 569.96s |  So what happened then, he called me and said, Hey, Fernando, guess what?
569.96s - 571.96s |  The news are here in Japan.
571.96s - 573.96s |  I said, No, Joe, the news are everywhere.
573.96s - 577.96s |  This was one of the most viral press releases from NASA.
577.96s - 578.96s |  So NASA got excited.
578.96s - 580.96s |  I got excited.
580.96s - 584.96s |  And then that happened in October 2019.
584.96s - 587.96s |  We continue with the holoportations.
587.96s - 594.96s |  And then December 2019, NASA called me and I was like, Okay, I'm going to receive an award.
594.96s - 595.96s |  That's pretty cool.
595.96s - 597.96s |  They're going to give me a prize.
597.96s - 602.96s |  They told me, Hey, we need to move forward and have a two-way holoportation.
602.96s - 607.96s |  So that means like the astronaut on a station will be beamed down as a hologram
607.96s - 611.96s |  while someone at mission control will be beamed up as a hologram
611.96s - 613.96s |  and they can interact with each other.
613.96s - 614.96s |  And I said, Okay, that's cool.
614.96s - 616.96s |  And I was just taking notes.
616.96s - 621.96s |  I said, Okay, it's going to be the first mission with private citizens.
621.96s - 624.96s |  The name of the company is Axiom.
624.96s - 626.96s |  It's Axiom One Mission.
626.96s - 628.96s |  It's going to be the first time that this happened.
628.96s - 629.96s |  I was just taking notes.
629.96s - 632.96s |  I said, It's going to happen in April.
632.96s - 637.96s |  And most of the projects with the government take like four to five years at least.
637.96s - 639.96s |  So I was like, That was 2019.
639.96s - 641.96s |  And I asked, Okay, that's pretty cool.
641.96s - 644.96s |  So you're talking April 2024, 2025.
644.96s - 647.96s |  And they told me, No, it's April 2020.
647.96s - 649.96s |  So you need to move forward.
649.96s - 651.96s |  You need to make this fast.
651.96s - 657.96s |  You need to send all the equipment to the station because we want this to happen.
657.96s - 664.96s |  And they said the guy managing this is a billionaire from Montreal, from Canada,
664.96s - 665.96s |  and he wants to make this happen.
665.96s - 670.96s |  And I was like, Okay, you want me to risk my reputation, my success,
670.96s - 675.96s |  trying to put something together in three months with a crew member that didn't have all the training?
675.96s - 676.96s |  And they said, Yes.
676.96s - 681.96s |  I said, Okay, just to be sure, did you say millionaire with an M or billionaire with a B?
681.96s - 682.96s |  And they said billionaire.
682.96s - 684.96s |  And I said, Okay, that changed everything.
684.96s - 686.96s |  That means like money is not an issue.
686.96s - 688.96s |  So we moved forward.
688.96s - 689.96s |  It was hard.
689.96s - 693.96s |  We tested all the equipment that we needed on the station.
693.96s - 701.96s |  It was hard during Christmas to test all the equipment for radiation or radio frequencies and everything.
701.96s - 705.96s |  And it was very hard to try to find someone willing to stay.
705.96s - 712.96s |  Like this room, this chamber is like maybe this size, but it really isolate everything.
712.96s - 713.96s |  There's no light.
713.96s - 714.96s |  There's no sound.
714.96s - 716.96s |  You can hear your heartbeat.
716.96s - 718.96s |  There is no radio frequencies.
718.96s - 726.96s |  And what they want to do is to put the equipment there and be sure that there is no light coming from the equipment, no sound, no radio frequencies.
726.96s - 731.96s |  I was like, Well, it's going to be very hard to find an idiot to be there during Christmas.
731.96s - 733.96s |  But they found that it was me.
733.96s - 737.96s |  So I tested, which was a huge success.
737.96s - 750.96s |  And then during this period, NASA is one of the most positive agencies, always taking the best solutions and showing solutions.
750.96s - 752.96s |  We tried to make this happen.
752.96s - 757.96s |  We have a facility in Houston that simulates the space station.
757.96s - 759.96s |  It didn't work.
759.96s - 761.96s |  We work a full Friday.
761.96s - 763.96s |  We have 10 NASA centers.
763.96s - 765.96s |  And someone just connected trying to throw a solution.
765.96s - 767.96s |  It didn't work.
767.96s - 769.96s |  They said, Yeah, it's not going to happen.
769.96s - 771.96s |  I told them, Hey, let me try it with my team.
771.96s - 773.96s |  Let me create my own facility.
773.96s - 775.96s |  Give me the weekend.
775.96s - 777.96s |  And we figured out a way to make that happen.
777.96s - 778.96s |  It worked.
778.96s - 781.96s |  NASA told us four times it will not be able on that timeline.
781.96s - 783.96s |  We made it happen.
783.96s - 786.96s |  And they told me like, Hey, that was a huge Hail Mary.
786.96s - 791.96s |  So by April, we made this a success.
791.96s - 796.96s |  We had the first crew of astronauts on a station, holoporting back to Earth.
796.96s - 807.96s |  So what you will see on this video that looks like Minecraft, and I will explain to you why, is Mark Patti, the first human holoported from a station to mission control.
807.96s - 812.96s |  And also on the back, you may be able to see a camera of him on a station.
812.96s - 818.96s |  And that was a medical evaluation from one of the NASA surgeons holoported to a station.
818.96s - 826.94s |  Meanwhile, he was holoported down to Earth.
826.94s - 840.05s |  Can you point with your other hand to where that pain is?
840.05s - 844.05s |  And then we have other two astronauts that want to join to the party.
844.05s - 862.13s |  So this video was taken from a station, from two astronauts holoported from ground to station.
862.13s - 869.95s |  This one didn't work, but at least you can see the picture of these guys holoported from ground to the station.
869.95s - 876.76s |  Maybe it worked.
876.76s - 881.76s |  Before I move forward, we have been doing these holoportations for a while.
881.76s - 887.76s |  Let me just show you a quick video and walk you through these first holoportations on a station.
887.76s - 894.67s |  So that's Dr. Joe Smith during the first holoportation.
894.67s - 899.67s |  That's one of the crew members with a hololens interacting with Dr. Smith.
899.67s - 905.07s |  That's Dr. Smith as a hologram on a station.
905.07s - 911.64s |  Again, Dr. Smith on the ground, holoported to the station as a hologram.
911.64s - 918.42s |  Some of the crew members interacting with Dr. Smith.
918.42s - 922.42s |  That's me and Dr. Smith on a station.
922.42s - 936.38s |  That's Mark Patty before he was holoported from station to the ground.
936.38s - 947.84s |  That's Mark Patty floating at mission control as a hologram.
947.84s - 964.57s |  That's Thomas Pesquet, a French astronaut, interacting with a bunch of physicians during one medical evaluation.
964.57s - 969.57s |  So then from the media perspective, it was viral.
969.57s - 972.57s |  We went through CBS. We went to multiple media channels.
972.57s - 981.57s |  I'm going to skip on this one, but the media was very interested on this one.
981.57s - 983.57s |  Finally, NASA gave me an award.
983.57s - 989.57s |  We won the NASA Innovation of the Year award, which was good.
989.57s - 993.57s |  But then something happened, which was pretty interesting.
993.57s - 998.57s |  So during one of the holoportations, imagine the space station is small.
998.57s - 1002.57s |  It's the same size as a football field.
1002.57s - 1008.57s |  The crew live on a station between six months to a full year, so they know each other.
1008.57s - 1013.57s |  They know every single corner of the station, and the astronauts are very smart.
1013.57s - 1018.57s |  What happened before this holoportation, one of the crew members, Kayla Barron,
1018.57s - 1023.57s |  she was waiting for Dr. Smith to appear for the medical evaluation.
1023.57s - 1025.57s |  She got distracted for a second.
1025.57s - 1032.57s |  She moved her head to the left, and she floated forward a little bit, like a couple of inches,
1032.57s - 1038.57s |  moved her head back forward, and a hologram of Dr. Smith was in front of her,
1038.57s - 1042.57s |  and she shouted, like, hey, go back. You're invading my personal space.
1042.57s - 1046.57s |  And then she stopped, and she laughed, and she said, Houston,
1046.57s - 1050.57s |  I never believed that a hologram can invade my personal space, but that happened.
1050.57s - 1056.57s |  But that was very important because at that point, the Human Health Performance Division at NASA told me,
1056.57s - 1062.57s |  Space Medicine told me, like, hey, if in her mind the doctor was there, this is very powerful
1062.57s - 1065.57s |  because at least for a second she believed that the doctor was there.
1065.57s - 1069.57s |  Let me show you the video. I believe this one has audio.
1070.57s - 1078.94s |  Something that isn't just predefined.
1078.94s - 1082.94s |  Houston Station reporting that I can now hear audio.
1082.94s - 1088.94s |  The hologram image, however, has gotten really, really close to me.
1088.94s - 1095.94s |  Didn't know a hologram could invade my personal space, but it's happening.
1095.94s - 1097.94s |  So that was so nice.
1097.94s - 1102.94s |  So what happened, Dr. Smith came again with me and said, hey, Fernando, what else can we do?
1102.94s - 1108.94s |  And I say, well, what if we really build a holodeck, a room that doesn't require glasses,
1108.94s - 1116.94s |  technology that we don't require those special $4,000 VisionPros or Hololens,
1116.94s - 1127.94s |  and we create a way that whatever is happening on the moon, we can see it in this room from ceiling, floor, all the walls.
1127.94s - 1131.94s |  So you can bring a subject matter expert if they need to fix something.
1131.94s - 1140.94s |  You can bring family members. You can bring personnel for training, future astronauts, also politicians.
1140.94s - 1144.94s |  I said, OK, let's do it. So we're building four holodecks.
1144.94s - 1150.94s |  This one was we put it on the operation in October 2023.
1150.94s - 1154.94s |  It's at the Johnson Space Center, building 268.
1154.94s - 1157.94s |  And that's Joe making a little message.
1157.94s - 1159.94s |  Welcome to the future.
1159.94s - 1163.94s |  We are now experiencing what our astronauts experience on board the International Space Station.
1163.94s - 1166.94s |  We were all aboard the space station.
1166.94s - 1169.94s |  Now I'm all afforded to view there in the holodeck.
1169.94s - 1177.94s |  The future is now.
1177.94s - 1184.94s |  So when that happened, we when I say we as my company, we came with the idea like, hey, this is very powerful.
1184.94s - 1190.94s |  We are at least five companies working in different ways to use Holoportation.
1190.94s - 1194.94s |  There is Microsoft, which we have a great partnership with them.
1194.94s - 1203.94s |  There is Google. They are launching a special device that is like a telephone booth, but it's two way.
1203.94s - 1208.94s |  You can see the other person. That price will be like one million dollars, which is pretty cool.
1208.94s - 1212.94s |  There is a company in California. We have a very good relation with them.
1212.94s - 1224.94s |  The name of the company is Portal. It's also you walk into a studio and then you have a telephone booth on the other side and you can see yourself like you're inside a box.
1224.94s - 1227.94s |  And that's pretty cool. It's $150,000.
1227.94s - 1232.94s |  There is Samsung trying to do something meta, Cisco, Webex.
1232.94s - 1237.94s |  They also have some technology based on those glasses, the magic lips and the HoloLens.
1237.94s - 1241.94s |  And I was like, hey, this is very powerful, but it's very expensive.
1241.94s - 1245.94s |  What if we figure out a way to make this device agnostic?
1245.94s - 1250.94s |  What if we also figure out a way to project the HoloLens without the glasses?
1250.94s - 1258.94s |  So, again, when I say we, it's my company, we took the decision to split the company to two companies,
1258.94s - 1267.94s |  Aerospace, which serves the government, the U.S. government, and AXA Tech, which will serve the commercial market.
1267.94s - 1275.94s |  And then we came with the idea like, hey, a lot of people from here, maybe they have a Kinect camera from their Xbox, but not all the people have that.
1275.94s - 1279.94s |  But everyone has this. Everyone has a cell phone.
1279.94s - 1283.94s |  What if we can capture a three dimensional hologram with this camera?
1283.94s - 1291.94s |  And what if instead of telling you what device you need to use to visualize the hologram,
1291.94s - 1303.94s |  you can use the fancy HoloLens or Vision Pros, or you can use a $300 MetaQuest 3 device, or you can use also a smartphone or a tablet.
1303.94s - 1307.94s |  Right now, my technology works on 2,300 devices.
1307.94s - 1312.94s |  And I will show you the QR code right now for a limited time. It's free.
1313.94s - 1320.94s |  Because I really believe that this technology can help a lot of people, not only in space, everywhere.
1320.94s - 1325.94s |  And also, we will be able to create more applications based on this technology.
1325.94s - 1333.94s |  And also, from the other side, a lot of people either with augmented reality or mixed reality or virtual reality, some people, they don't like it.
1333.94s - 1339.94s |  So we built a device called HoloConnector, which we have two sizes.
1339.94s - 1348.94s |  One is the human size. The other one is table size, which will help you to project holograms without glasses.
1348.94s - 1356.94s |  So my technology, we made it available. We launched this device during a comic convention in Houston, Comicpalooza.
1356.94s - 1364.94s |  Then we made the official presentation at the Smithsonian Museum in Washington, D.C. two weeks ago.
1365.94s - 1372.94s |  So trying to figure out something, and what you can see there, there's people and the holograms projected next to them.
1372.94s - 1375.94s |  And you can play with this technology as well.
1375.94s - 1383.91s |  And this is kind of a render of the HoloConnector.
1383.91s - 1387.91s |  And now let me share a story before I go back to the application.
1387.91s - 1389.91s |  I have two children, and they say,
1390.91s - 1394.91s |  You should be an influencer and interview people with your technology.
1394.91s - 1400.91s |  And I was like, eh, I'm not an influencer, and I'm not that kind of guy.
1400.91s - 1407.91s |  But I'm going to show you how being an influencer is just fake and is not going to work.
1407.91s - 1412.91s |  So I launched a YouTube channel, which you can join if you want to. There's a QR code.
1412.91s - 1416.91s |  I started interviewing people with my technology as holograms.
1416.91s - 1421.91s |  And later on, you will be able to visualize these interviews as holograms as well.
1421.91s - 1426.91s |  For instance, I have one of the guys that invented the Internet, Dr. Vinton Cerf.
1426.91s - 1428.91s |  I have so many people.
1428.91s - 1433.91s |  And then after one month, YouTube sent me this creator award.
1433.91s - 1435.91s |  Like, now you are an influencer.
1435.91s - 1438.91s |  Right now, I believe we reached 3.5 million views.
1438.91s - 1442.91s |  We reached 650,000 subscribers.
1442.91s - 1445.91s |  And right now I'm receiving a check every month.
1445.91s - 1448.91s |  And I was like, yeah, this story really backfired me.
1448.91s - 1451.91s |  But I noticed, like, this technology is really powerful.
1451.91s - 1456.91s |  So I decided to make it available for anyone and go from there.
1459.91s - 1462.91s |  Because the applications are unlimited.
1462.91s - 1466.91s |  You can have your mechanic next to your car and helping you.
1466.91s - 1471.91s |  You can take your best buddy to you during a trip, capture unique memories.
1471.91s - 1474.91s |  You can do whatever you want to.
1474.91s - 1479.91s |  So that's why, and hopefully you can scan this one,
1479.91s - 1483.91s |  I decided with my company to make this technology available for anyone.
1483.91s - 1485.91s |  Right now it's free.
1485.91s - 1488.91s |  At some point, we're going to charge like $9 a month
1488.91s - 1493.91s |  because we don't really want to make money and charge you a lot of money.
1493.91s - 1495.91s |  We want people to use this technology.
1495.91s - 1498.91s |  At some point, we're going to release a software developer kit
1498.91s - 1501.91s |  so you can use this technology as a testbed
1501.91s - 1506.91s |  because I believe that we can lead the market of holographic communications.
1506.91s - 1513.91s |  Right now I have surgeons from the Houston Medical Center training people in Africa.
1513.91s - 1517.91s |  And we reduce the bandwidth from 5 megabits per second to 1 megabit per second
1517.91s - 1520.91s |  because you don't have great coverage on those areas.
1520.91s - 1525.91s |  So the real idea is to help not only medicine but help anyone.
1525.91s - 1529.91s |  So if you want to download it, it's free for now.
1529.91s - 1537.91s |  And saying that, I tried to go fast, especially because I started late,
1537.91s - 1541.91s |  but also to give you the opportunity to make questions.
1541.91s - 1544.91s |  So if you have any questions, I believe that we have some time.
1544.91s - 1546.91s |  Hopefully you like my presentation.
1546.91s - 1547.91s |  I tried to rush.
1547.91s - 1550.91s |  I know that you have a very full program today,
1550.91s - 1553.91s |  so I don't want to bore you during your first session.
1553.91s - 1556.91s |  And thank you so much for being here.
1557.91s - 1563.44s |  And with this light, I cannot see you.
1563.44s - 1565.44s |  It's like an interrogation room.
1565.44s - 1570.44s |  So if someone has a question, just let me know or try to do something,
1570.44s - 1573.44s |  turn on your device, and I will be happy to answer it.
1573.44s - 1591.62s |  Ideally, we love to have 5 megabits per second.
1591.62s - 1594.62s |  Right now it's working with 1 megabit per second.
1594.62s - 1600.62s |  And we are going to release a way to make it like ultra-high definition.
1600.62s - 1607.62s |  The biggest milestone is to get it like maybe 12 megabits per second
1607.62s - 1609.62s |  for ultra-high definition.
1609.62s - 1612.62s |  But what's going to happen is, and that's important,
1612.62s - 1617.62s |  every two weeks we push an update so the technology is changing every two weeks.
1617.62s - 1621.62s |  And I want this technology to make it your technology.
1621.62s - 1625.62s |  So every time that we have input, let me give you an example,
1625.62s - 1628.62s |  and I'm going to go back to your question.
1628.62s - 1632.62s |  Someday I receive an email like, hey, Fernando, can you add a selfie mode?
1632.62s - 1635.62s |  And I was like, what? A selfie mode?
1635.62s - 1638.62s |  Yeah, I want to love to have pictures or videos with my friends
1638.62s - 1640.62s |  while I'm on vacation.
1640.62s - 1642.62s |  I was like, okay, and we did it.
1642.62s - 1647.62s |  So every time someone comes with a question or a suggestion, we implement it.
1647.62s - 1651.62s |  Right now it's working with 1 up to 5 megabits per second.
1651.62s - 1656.62s |  We have in the backlog a way that if you have 12 megabits per second,
1656.62s - 1658.62s |  at some point it's going to take the 12,
1658.62s - 1662.62s |  and it will ask you if you want to go to like ultra-high definition.
1662.62s - 1665.62s |  And if not, you can go to 5 or 1.
1665.62s - 1670.62s |  Now, with 12, we have something called haptics, and I forgot to mention that.
1670.62s - 1675.62s |  With haptics, what happens, we have a glove that is 300 bucks
1675.62s - 1677.62s |  and some other equipment.
1677.62s - 1680.62s |  And as a surgeon, and I'm not a physician,
1680.62s - 1685.62s |  they just touch the patient as a hologram, take the lymph nodes,
1685.62s - 1688.62s |  and they do have an infection, and they do their magic.
1688.62s - 1691.62s |  We have been doing that, and that's part of the technology
1691.62s - 1693.62s |  that we're releasing to the public,
1693.62s - 1697.62s |  the capability of having the essence of the other person there
1697.62s - 1701.62s |  and also the capability of feeling the other person.
1701.62s - 1703.62s |  And right now it's multiplayer.
1703.62s - 1707.62s |  We can have up to four people at the same time during one session.
1707.62s - 1709.62s |  You create your own rooms.
1709.62s - 1712.62s |  But at some point, we want to make it unlimited,
1712.62s - 1715.62s |  at least have 300 people or more per room,
1715.62s - 1720.62s |  so you have a concert or an event, you can invite anyone.
1720.62s - 1725.62s |  Any other question?
1725.62s - 1727.62s |  If you have a question, just try to raise your hand
1727.62s - 1730.62s |  because I cannot really see from here.
1730.62s - 1740.62s |  Okay.
1740.62s - 1742.62s |  So the question is if I have competition.
1742.62s - 1746.62s |  And yes, we do have a bunch.
1746.62s - 1750.62s |  We play nice with at least four.
1750.62s - 1753.62s |  Meta or Zuckerberg, they are trying to do this.
1753.62s - 1756.62s |  It's not live, but they're trying to create
1756.62s - 1759.62s |  this holoportation technology as well.
1759.62s - 1763.62s |  Cisco, Webex, they call it Webex Hologram.
1763.62s - 1768.62s |  They have a way to capture holograms for two people.
1768.62s - 1770.62s |  You have a special rail of cameras,
1770.62s - 1772.62s |  and you need to have the Webex Business Edition,
1772.62s - 1774.62s |  and you need to have the HoloLens,
1774.62s - 1777.62s |  which is pretty cool but pretty expensive,
1777.62s - 1779.62s |  but that's one market.
1779.62s - 1782.62s |  Samsung, we don't play with them.
1782.62s - 1783.62s |  We tried to reach to them.
1783.62s - 1785.62s |  They didn't respond.
1785.62s - 1788.62s |  Because what I'm trying to do is to play nice with everyone
1788.62s - 1793.62s |  so we can create a standard of these same practices.
1793.62s - 1795.62s |  Microsoft, we have been playing very nice with them.
1795.62s - 1800.62s |  Actually, they added an article on their website about us
1800.62s - 1802.62s |  because also we use Microsoft technology.
1802.62s - 1805.62s |  Apple, we're playing nice with them.
1805.62s - 1808.62s |  Portal as well and Google as well.
1808.62s - 1810.62s |  They are different technologies.
1810.62s - 1814.62s |  Ours is the only one that is portable,
1814.62s - 1817.62s |  multiplayer, device agnostic.
1817.62s - 1819.62s |  And I don't want to challenge you.
1819.62s - 1821.62s |  I will be careful to say that here,
1821.62s - 1824.62s |  but it's pretty secure.
1824.62s - 1827.62s |  It's encrypted because we developed this technology for NASA
1827.62s - 1829.62s |  and the Department of Defense.
1829.62s - 1831.62s |  So it's not unhackable.
1831.62s - 1834.62s |  Don't try it, but try that technology.
1834.62s - 1836.62s |  But we try to make it pretty secure
1836.62s - 1841.62s |  because if you are having a HoloPortation session with anyone,
1841.62s - 1844.62s |  if it's happening, we don't have a way to know it.
1844.62s - 1846.62s |  Whatever happened is your stuff,
1846.62s - 1849.62s |  and we don't have a way to access it because it's your privacy.
1849.62s - 1854.62s |  We know that sometimes in medicine there are a lot of sensitive issues
1854.62s - 1858.62s |  or deployed military personnel overseas.
1858.62s - 1860.62s |  They want to meet with their family.
1860.62s - 1862.62s |  So we don't really capture that.
1862.62s - 1867.62s |  So we try to keep privacy and make it pretty secure.
1867.62s - 1870.62s |  Is there any other question?
1870.62s - 1874.62s |  If you have one, just raise your hand or shout.
1874.62s - 1904.98s |  You have one over there.
1904.98s - 1906.98s |  So the question is if we are using more haptics
1906.98s - 1909.98s |  other than big haptics or haptics feedback.
1909.98s - 1912.98s |  Yes, at NASA we have a base and we have a full suit
1912.98s - 1916.98s |  that has also a compressor, which is huge.
1916.98s - 1918.98s |  The sensitivity is better.
1918.98s - 1922.98s |  So you can feel with that kind of haptics,
1922.98s - 1926.98s |  if you are touching a holographic cat versus a holographic table,
1926.98s - 1929.98s |  you can feel it.
1929.98s - 1932.98s |  So we have two versions of this technology,
1932.98s - 1935.98s |  the government version, which is with aerospace,
1935.98s - 1938.98s |  and the commercial version, which is with AXA Tech.
1938.98s - 1941.98s |  We are trying to match both technologies.
1941.98s - 1944.98s |  Of course, the government version has more features,
1944.98s - 1946.98s |  more bells and whistles.
1946.98s - 1948.98s |  That's why on the commercial version,
1948.98s - 1951.98s |  we have used a glove that costs $300.
1951.98s - 1953.98s |  But it's compatible, and at some point,
1953.98s - 1957.98s |  I believe that people will be more engaged using the fancy haptics.
1957.98s - 1960.98s |  But for government, yes, we have the full base.
1960.98s - 1966.98s |  For the commercial version, we only have the glove.
1966.98s - 1973.98s |  Is there any other question?
1973.98s - 1984.98s |  I have one there, yeah.
1984.98s - 1989.98s |  Yes, so let me tell you, yes.
1989.98s - 1993.98s |  So if we go to Mars, let's say we have a crew on Mars,
1993.98s - 1997.98s |  and we're working on that one on the NASA version.
1997.98s - 2000.98s |  There is a delay in the communications between 16 to 32 minutes
2000.98s - 2002.98s |  for a two-way communication.
2002.98s - 2004.98s |  So imagine you are on Mars.
2004.98s - 2005.98s |  You have an accident.
2005.98s - 2010.98s |  You are bleeding and say, Houston, this is Mars.
2010.98s - 2011.98s |  I'm bleeding.
2011.98s - 2014.98s |  Thirty-two minutes later, they will say, from where?
2014.98s - 2016.98s |  You may be dead by then.
2016.98s - 2020.98s |  So according to the Space Medicine Division at NASA,
2020.98s - 2024.98s |  there are about 440 basic medical diagnostics.
2024.98s - 2029.98s |  So what we're trying to do is to put AI for this medical purpose.
2029.98s - 2033.98s |  So if you have an emergency on Mars or the moon,
2033.98s - 2037.98s |  the first thing that you're going to see is a hologram of a doctor
2037.98s - 2041.98s |  trying to give you at least the basic procedures
2041.98s - 2045.98s |  to keep you away from a bigger danger.
2045.98s - 2049.98s |  And then the biggest challenge for us is that at some point,
2049.98s - 2052.98s |  the communication from air will arrive,
2052.98s - 2056.98s |  and the biggest challenge for us is that the crew member or the astronaut
2056.98s - 2060.98s |  will not notice if he or she is still talking with the hologram,
2060.98s - 2062.98s |  with the AI, or the person.
2062.98s - 2066.98s |  But, yes, we are integrating that under the Space Medicine Division
2066.98s - 2073.98s |  because just having a 32-minute delay in the communications is a lot.
2073.98s - 2078.98s |  And at some point, I plan to integrate that also in the commercial version.
2078.98s - 2085.98s |  Any other questions?
2085.98s - 2089.98s |  Okay. Well, thank you so much for your time.
2089.98s - 2092.98s |  If you can, download the app. It's not perfect.
2092.98s - 2095.98s |  Every two weeks, we are pushing an update.
2095.98s - 2098.98s |  What we want is to have an app that is working for you,
2098.98s - 2102.98s |  available for anyone like you, and designed by you, by the people,
2102.98s - 2105.98s |  by users for something that you really like,
2105.98s - 2107.98s |  instead of us just coming with an idea and saying,
2107.98s - 2109.98s |  hey, this is how it's going to work.
2109.98s - 2112.98s |  So you can just download it, give us your feedback,
2112.98s - 2122.98s |  and we will try to tailor the application to your designs or your needs.
2122.98s - 2124.98s |  Okay? Thank you so much.
2124.98s - 2128.98s |  And if you need me, that's my email, if you want also to email me.
2128.98s - 2130.98s |  Thank you.


url: https://www.youtube.com/watch?v=A-J3jGofYN8
title: DEF CON 32 - Tough Adversary Don’t Blame Sun Tzu - Gregory Carpenter, DrPH
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=A-J3jGofYN8",
  "title": "DEF CON 32 - Tough Adversary  Don\u2019t Blame Sun Tzu - Gregory Carpenter, DrPH",
  "description": "Years ago, when I started working at the NSA, I said to myself, now I can see what\u2019s really happening and what needs to be done to address our adversaries and put an end to cybercrime. Well, I was sure wrong. I worked in a few different offices and participated in hundreds of operations, only to find frustration time and time again. What happened? What was it that we just couldn\u2019t put our finger on? Yes, we were successful in addressing criminal activity. Yes, we could successfully negotiate the contested cyberspace domain. But adversarial activity kept popping up on our radar. It was Whack-A-Mole 2.0.\n\nWas it the technologies we used? No, we had state-of-the-art capabilities. Was there a lack of technical training amongst operators? No, again, taxpayers coughed up plenty, and they got their money\u2019s worth. I concluded that it was strategy; it was philosophy. Sure, we had all the technical capabilities in the world, but we were using everything wrong.\n\nI was in the Information Warfare Support Center. We were supposed to know what to do and how to do it! So, I started studying not only traditional but contemporary philosophy as well. I gained access to curricula in China, Russia, and the USA. This presentation informs the attendees of the adversarial philosophy taught in the military academies in China and Russia, which is taken from their curricula and papers published in various journals and practice today.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1365,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.32s | This text was transcribed using whisper model: large-v2

 I am Greg Carpenter, former NSA guy outed on WikiLeaks, so I get to come out here and
7.32s - 13.51s |  do stuff now and meet real people, so it's nice.
13.51s - 17.31s |  I have an interesting, I think it's an interesting talk today, I've studied for the last couple
17.31s - 28.91s |  years now, pulling information from Russian and Chinese curriculum at their military universities.
28.91s - 35.17s |  And we're going to take a look at how that ties to national strategic goals, their philosophy
35.17s - 37.71s |  and their strategy.
37.71s - 42.99s |  So this is, pretty much it's a no Sun Tzu zone, so no quotes from Sun Tzu for anybody
42.99s - 43.99s |  out here today, okay?
43.99s - 48.50s |  I don't want to hear any.
48.50s - 52.76s |  Quick agenda, just so you can see where we're going to go, pretty straightforward, Chinese
52.76s - 57.30s |  history influences how they're working it today and how it links to national goals,
57.30s - 61.16s |  and the same thing with Russia.
61.16s - 67.52s |  One thing that's common in both Chinese and Russian, and I would say American psychological
67.52s - 74.94s |  warfare and information warfare strategies, are basically controlling the language, controlling
74.94s - 77.20s |  the meaning of words.
77.20s - 80.84s |  Russia has a deep rooted history in this, China's come along just in the last hundred
80.84s - 88.64s |  years or so and started to focus on epistemology and ontology, basically the meaning of words
88.64s - 92.02s |  and the meaning of reality.
92.02s - 98.10s |  I think Philip Dick said it best, because it's the basis for all three psychological
98.10s - 100.98s |  warfare programs.
100.98s - 106.50s |  I'm doing some work on Iran right now too, I'd like to have that soon.
106.50s - 111.08s |  Theirs is a little bit different approach, but they use the same concept as put out by
111.08s - 113.42s |  Philip Dick.
113.42s - 117.90s |  So standard disclaimer from NSA, I've got to tell you this because this is, if I don't
117.90s - 123.10s |  say this, they told me I get to go to jail, which is fine, I met a lot of good people
123.10s - 126.06s |  there, so that's that.
126.06s - 129.58s |  So let's start talking about Chinese influences real quick.
129.58s - 134.98s |  Now everyone, pretty much everyone's heard of Sun Tzu, which is probably why you're here,
134.98s - 139.70s |  the whole art of war, and that's about as much as we're going to talk about him.
139.70s - 146.42s |  Now even though he is the seminal historical figure in Chinese information warfare, he's
146.42s - 150.50s |  not the only one taught at the universities.
150.50s - 154.58s |  China focuses on these seven military classics.
154.58s - 156.86s |  Of course the first is the art of war.
156.86s - 161.74s |  Has anyone heard of these other books that are in Chinese curriculum at all?
161.74s - 165.36s |  A few, okay great, that's great.
165.36s - 170.38s |  So think of it this way, the art of war is considered or understood to be the oldest
170.38s - 174.98s |  influence in Chinese strategy and philosophy right now.
175.02s - 181.22s |  But these other books, four of them came out during the warring period, back when China
181.22s - 184.94s |  was consolidating into one national entity.
184.94s - 191.34s |  The rest of them came on 1600s or so, but they're all a different twist on strategy.
191.34s - 197.98s |  For example, the Three Strategies is directly translated into Mao Tse Tung's Art of War,
197.98s - 199.54s |  which we'll go through a little bit later.
200.10s - 206.34s |  Of course Mao had to have his own art of war because he can't be left out, right?
206.34s - 215.30s |  Wu Xi, the fourth one down, basically talked about, as a politician, how do you manipulate
215.30s - 218.50s |  and influence other politicians?
218.50s - 221.30s |  And how do you manipulate and influence the public?
221.30s - 225.22s |  Not only your public, but everybody else.
225.22s - 231.26s |  So each of these connects back to the Chinese strategy of influencing everyone in different
231.26s - 232.26s |  ways.
232.26s - 235.94s |  But wait, there's more.
235.94s - 241.30s |  Anybody hear of Sun Bin, Sun Tzu's relative?
241.30s - 242.94s |  No.
242.94s - 249.66s |  So until 1972, all of Sun Bin's work, that's his picture there in the middle by the way,
249.66s - 253.38s |  all of his work was considered to be Sun Tzu's work.
253.38s - 257.06s |  And Sun Tzu's Art of War was this huge piece.
257.06s - 263.10s |  Only until they found the documents from Sun Bin in 1972, when they were excavating one
263.10s - 269.26s |  of the emperor's gravesites, did they realize that they had more than one document.
269.26s - 275.42s |  Now other documents in here, like the Book of Swindles, is not a strategic book.
275.42s - 282.02s |  It's basically, you could use it at the lock picking village, because it's for thievery.
282.02s - 288.14s |  But it's linked back to, conceptually, a philosophy on how to manipulate other people.
288.14s - 294.70s |  So all of these books are extremely interesting and important in Chinese philosophy, because
294.70s - 297.66s |  they're all taught today.
297.66s - 304.18s |  The periods in China that were the most influential and had the biggest impact on how China would
304.18s - 309.66s |  engage the rest of the world was during, number one, the Warring States period, back
309.66s - 315.00s |  500 or so BC to 200 BC, right?
315.00s - 320.58s |  Each of the different parts of China were fighting for autonomy and control over the
320.58s - 322.74s |  rest of China.
322.74s - 330.18s |  And there was, you know, consolidation in, I think, 220 BC or something like that.
330.18s - 336.90s |  That's when the art of war was actually consolidated into a national program.
336.90s - 342.10s |  Not like we'd know a national program today, but it was the emperor's philosophy at the
342.10s - 349.62s |  time to control and manage the population in China as one China.
349.62s - 355.66s |  The century of humiliation was from 1839 to 1949.
355.66s - 358.18s |  And what happened in that period?
358.18s - 363.06s |  Well, you had the Opium Wars, the Boxer Rebellion.
363.06s - 367.34s |  There were numerous treaties that China was forced to sign where they got the raw end
367.34s - 371.10s |  of the deal, specifically from the West.
371.10s - 377.54s |  They considered the West to be extremely manipulative of their national sovereignty and national
377.54s - 378.90s |  goals.
378.90s - 384.10s |  So they take great offense to the West in many ways.
384.10s - 387.90s |  And you'll see that when we get into the curriculum a little bit later.
387.90s - 393.42s |  And then 8-1-29, anybody know that date by chance?
393.42s - 394.42s |  It's on there.
394.42s - 395.42s |  It's on the flag.
395.42s - 397.06s |  It's a People's Liberation Army.
397.06s - 400.58s |  That's the date that it was formed.
400.58s - 411.26s |  And the star and the Chinese characters for 8-1, Gaoyat.
411.26s - 421.02s |  So here's a copy of the syllabus in the National Defense University of the People's Liberation
421.02s - 422.02s |  Army.
422.02s - 428.62s |  I pulled this out of their website, their internal website.
428.62s - 436.26s |  And if you look closely, you'll see, and I'll translate it for you basically.
436.26s - 439.70s |  Item number one is Chinese National Defense.
439.70s - 441.94s |  Number two is China's armed forces.
441.94s - 445.90s |  And then they get into the international and how to develop the army.
445.90s - 449.98s |  Number five of topics is Mao Zedong's art of war.
449.98s - 458.86s |  Mao is the first theory taught linking Chinese teaching to Chinese strategic goals.
458.86s - 460.42s |  After that, it's Sun Tzu.
460.42s - 462.06s |  Number six is Sun Tzu.
462.06s - 465.98s |  And it goes into seven is the military revolution.
465.98s - 468.66s |  And then number eight is information warfare.
468.66s - 470.66s |  It's not kinetic warfare.
470.66s - 473.02s |  It's all information warfare.
473.02s - 481.90s |  Because 95% of the Chinese historical background for teaching and understanding information
481.90s - 485.58s |  warfare is about non-kinetic activity.
485.58s - 487.26s |  It's not about kinetic activity.
487.26s - 492.10s |  All those books that I showed you, and if anybody wants the references and have some
492.10s - 500.36s |  other stuff, there'll be a PDF available for anybody to download later on.
500.36s - 504.26s |  But the information warfare aspect, number eight, is extremely important because that
504.26s - 507.58s |  includes all of the other authors.
507.58s - 512.10s |  Now some of them are intermingled in number five, which is Mao Zedong's art of war.
512.10s - 514.62s |  Like I talked about the three strategies before.
514.62s - 516.78s |  But it's all right here.
516.94s - 522.78s |  Everything from the warring period, from the age of humiliation, everything is right here
522.78s - 528.58s |  in this orientation to the National Defense University.
528.58s - 530.78s |  So immediately first thing up, you come in.
530.78s - 537.37s |  These guys here are the teachers of the class.
537.37s - 546.37s |  In Mao Zedong's art of war, it kind of sums up what Chinese internal philosophy is in
546.37s - 551.17s |  how China fits in the universe.
551.17s - 560.37s |  China compared to the rest of the environment and with the rest of the international community,
560.37s - 564.93s |  how they see themselves and how they plan their strategy.
564.93s - 569.69s |  So for example, if the foe moves in, I scram.
569.69s - 573.77s |  That's a rough translation.
573.77s - 580.61s |  It applies to information warfare in the same manner that it applies to a kinetic activity.
580.61s - 587.33s |  So if you're hunting and you're chasing Chinese guys on the web, for the most part, if you
587.33s - 592.49s |  try to go after them, they'll disappear on you and you won't find them.
592.49s - 596.89s |  Some groups stay around, but for the most part, they'll go away.
596.89s - 604.01s |  We were working a number of years ago with APT1 and a guy named Ugly Gorilla, Wang Dong,
604.01s - 610.21s |  and he literally, any time that we came across him or found him on a computer anywhere, he
610.21s - 613.13s |  was gone like a ghost.
613.13s - 620.53s |  So Chinese philosophy is definitely linked to Mao Zedong's interpretation and understanding
620.53s - 624.29s |  of the historical books.
624.29s - 632.69s |  But externally from China out, they study Americans and they study Russians in the same
632.69s - 642.14s |  way that we try to study their techniques, tools, procedures, things like that.
642.14s - 649.36s |  This is also, this website is also from the state controlled information office.
649.36s - 655.16s |  So their plan is to not only teach the people that are going into the military, but the
655.16s - 657.96s |  general population.
657.96s - 662.68s |  So the state controlled information office broadcasts to the rest of the population in
662.68s - 668.52s |  China and there's tons of documents on there, you can go there and download anything you
668.52s - 676.24s |  want about what China is teaching the people of China and how they should act and interact
676.24s - 679.32s |  with foreigners.
679.32s - 687.56s |  An interesting note here, this is the, this is the most interesting classes in the PLA
687.56s - 693.60s |  National Defense University and you can see there, the fifth most popular class is the
693.60s - 704.28s |  Art of War and that is Sun Tzu, Sun Bin, and Mao Zedong's philosophy all linked together.
704.28s - 713.20s |  And the key thing here is that all of these classes, the top classes, all involve elements
713.20s - 721.28s |  of understanding human behavior, decision making, or systems of organization, I would
721.28s - 722.64s |  say.
722.64s - 730.16s |  So to understand from the individual up to the strategic level in any organization is
730.16s - 738.64s |  how China looks at implementing a different information environment for you to operate
738.64s - 739.64s |  in.
739.64s - 745.28s |  So we all know that the information environment is a contested environment.
745.28s - 752.72s |  Chinese philosophy is to let it be contested, let it be confusing, like in a Clausewitz
752.72s - 761.40s |  type of a way, but that gives us exactly what we need to not apply kinetic resources
761.40s - 764.04s |  to achieve our sovereignty.
764.04s - 769.56s |  And Chinese sovereignty is basically regional control, they're looking to be a regional
769.56s - 770.56s |  power.
770.56s - 776.26s |  In 2000 there was a great book that came out on the National Defense University Press by
776.26s - 781.52s |  Michael Pillsbury called China Debates Future Security Environment.
781.52s - 788.84s |  And in there he lays out how Chinese generals and politicians understood how easy it would
788.84s - 795.16s |  be for North Korea to defeat the United States in a one-on-one war.
795.16s - 800.84s |  And that caused me to think for a minute because the disparity of how we would look at a war
800.84s - 806.22s |  with North Korea and how China looked at it was extremely interesting to me.
806.22s - 812.66s |  And it told a lot about the Chinese understanding of what they believe the information environment
812.66s - 816.02s |  really is.
816.02s - 823.10s |  They see America declining and by 2032 we'll be a regional power, the same as Russia and
823.10s - 824.34s |  the same as China.
824.34s - 833.88s |  They see themselves rising and they see us declining and this is in a balanced world.
833.88s - 839.70s |  Let's go to Russia for a minute.
839.70s - 848.10s |  Russia had three significant periods of influence into their information warfare strategy and
848.10s - 850.22s |  philosophy.
850.22s - 859.42s |  The pre-Kremlin period, Lenin, Marx, their theory on war, and the development of military
859.42s - 869.10s |  theory under recent Soviet leadership in the late 70s, early 80s.
869.10s - 878.62s |  The biggest impact on Russian control of information was the Slavophile and Westernizers
878.62s - 883.38s |  fight that was happening in the 1800s.
883.38s - 889.54s |  Russia was an imperial power and more than half, I would say, of the population, or at
889.54s - 895.78s |  least the imperial court, believed that Russia could be strong by itself, separate from Western
895.78s - 897.06s |  influence.
897.10s - 904.26s |  The Westernizers were the people in the court who wanted to be able to influence the Russian
904.26s - 915.38s |  philosophy for socioeconomic power structure, politics, from Western democracy.
915.38s - 922.18s |  And during this period of time, significant propaganda was actually infused into the Russian
922.18s - 932.59s |  population, which kind of changed how things had operated from the 1600s, 1500s or so.
932.59s - 939.31s |  Russia became a much more censored country, even back then, and it followed through.
939.31s - 950.92s |  And it's still a significant part of the strategy today.
950.92s - 958.72s |  So in Russia, you see, to this day, you still see state-controlled media.
958.72s - 965.00s |  State-controlled newspapers were a big thing back during the Slavophile-Westernizer fight
965.00s - 967.60s |  back in the 1800s.
967.60s - 976.92s |  And the idea for Pravda came out of that historical aspect of controlling the information environment.
976.92s - 983.34s |  Fast forward a few years, we get into the Cold War aspect of it.
983.34s - 988.54s |  And the Cold War was—let's start with World War II first, sorry about that.
988.54s - 992.62s |  World War II was a significant event for Russia, right?
992.62s - 997.54s |  It was—how would you say?
997.54s - 999.58s |  More Russians died, right?
999.58s - 1006.38s |  The population shift in Russia was huge compared to pretty much any other country in the world.
1006.38s - 1009.72s |  And that really affected politics in Russia.
1009.72s - 1015.22s |  It became a much more closed society and started to close even tighter, which meant that they
1015.22s - 1018.58s |  had more control over their information.
1018.58s - 1023.90s |  Into the Cold War period, the U.S. started to infuse Russia because they saw them as
1023.90s - 1028.46s |  a threat, right, with more propaganda at every aspect they could.
1028.46s - 1034.02s |  I mean, we sent Louis Armstrong over, right, to Europe to tour throughout Europe to teach
1034.02s - 1036.78s |  people that America was better than Russia.
1036.78s - 1040.46s |  We did some very popular and interesting things.
1040.46s - 1046.98s |  Jackson Pollock, famous painter, right, paid through a third party, through the CIA, to
1046.98s - 1055.10s |  go make art, art, you know, dripping paint on a drop cloth to show Russia that we were
1055.10s - 1058.02s |  much more advanced in an artistic manner.
1058.02s - 1064.54s |  So the Russians, what they did was they actually sent people over to be art critics in the
1064.54s - 1065.54s |  States.
1065.54s - 1070.30s |  And there's many cases of this where they became the people to judge what art was.
1070.30s - 1073.34s |  So we were giving them and saying, this is great art.
1073.34s - 1077.06s |  Then they sent us art critics to counterbalance.
1077.06s - 1082.14s |  And this type of a back and forth control of information happened all the way through
1082.14s - 1083.14s |  the 80s.
1083.14s - 1091.34s |  And it wasn't until the early 90s or so when there was a change that the big propaganda
1091.34s - 1098.06s |  that went against each country started to subside a little bit.
1098.06s - 1104.14s |  And Russia focused more internally on, again, going back to the base and population and
1104.14s - 1107.54s |  propagandizing them.
1107.54s - 1112.34s |  So that's a background of the Russian history.
1112.34s - 1120.42s |  Now, this is basically a list of all the universities in Russia from the Ministry of Defense's website,
1120.42s - 1128.50s |  their internal website, showing everyone that conducts information warfare and propaganda
1128.50s - 1133.86s |  integrated with offensive cyber actions.
1133.86s - 1137.70s |  So and again, this will be available to anybody you want to go there, you know, you figure
1137.70s - 1140.10s |  out how to get in.
1140.10s - 1144.94s |  The big picture on the right is just big enough so you can see it.
1144.94s - 1151.22s |  But they literally have information warfare and propaganda integrated into everything
1151.22s - 1153.18s |  that they teach.
1153.18s - 1161.88s |  It's not separate, a little different from the Chinese model.
1161.88s - 1169.14s |  So let's talk about how they're similar first.
1169.14s - 1176.18s |  Both Russia and China, and the US, by the way, all focus on psychological operations
1176.18s - 1184.34s |  and influence campaigns at a strategic level and at a tactical level.
1184.34s - 1191.46s |  If information can be infused in a tactical level that will actually affect national policy,
1191.46s - 1192.46s |  it'll happen.
1192.46s - 1198.62s |  Just think of any incident that had, it was a one-off, you would call it, that had strategic
1198.62s - 1200.90s |  influence.
1200.90s - 1205.74s |  Several years ago, there was a guy who was caned, American, who was caned in Thailand,
1205.74s - 1206.74s |  right?
1206.74s - 1209.70s |  He violated a very simple law, right?
1209.70s - 1215.70s |  How do you think that played in Russian propaganda, in Chinese propaganda against the United States
1215.70s - 1221.94s |  as the unruly, the people that won't follow or respect other laws?
1221.94s - 1228.85s |  It played extremely well to their base.
1228.85s - 1235.17s |  And of course, both are affected by historical injuries that happened to them from the West,
1235.17s - 1239.49s |  like for the last couple of hundred years.
1239.49s - 1241.49s |  Differences.
1241.49s - 1248.21s |  The context in how Russia operates and how China operate are completely, I would say,
1248.21s - 1251.17s |  unique to their culture.
1251.17s - 1255.49s |  China controls vast numbers.
1255.49s - 1262.57s |  And they have a bunch of attackers, they have a bunch of defenders, and they're integrated.
1262.57s - 1267.69s |  And some are really loud, you may have noticed, and some are really stealthy.
1267.69s - 1269.29s |  And you really don't know what you get.
1269.29s - 1273.53s |  And sometimes the Chinese will come in and they'll do OSIN on a website, you know, and
1273.53s - 1276.49s |  they'll leave the language setting to Russian.
1276.49s - 1279.81s |  So you know, on first glance, you're looking at a Russian.
1279.81s - 1280.81s |  No, you're not.
1280.97s - 1284.13s |  You're looking at somebody else, just look at the searches, okay?
1284.13s - 1290.13s |  So China will come in and do a whole bunch of different types of operations.
1290.13s - 1295.85s |  On the other hand, the Russians will come in very strategic, and they try to be really
1295.85s - 1302.41s |  good about how they're operating, because limited resources in Russia only allow them
1302.41s - 1312.64s |  to do onesies, twosies in a very strategic manner, directly linked to national strategies.
1312.64s - 1320.76s |  So in short, these two guys are still directing and managing national strategy and philosophy,
1320.76s - 1325.92s |  but it's only based and only linked to the historical injuries that China and Russia
1325.92s - 1331.36s |  have had incurred on them from the West.
1331.36s - 1338.46s |  And with that, I'll leave it up if anybody has any questions at all.
1338.46s - 1339.46s |  No.
1339.46s - 1342.46s |  Okay, fair enough.
1342.46s - 1345.30s |  So as I promised, no Sun Tzu, okay?
1345.30s - 1349.70s |  We didn't give any theory on Sun Tzu, thank God, but there's a Twitter, the Discord, all
1349.70s - 1350.70s |  that stuff.
1350.70s - 1354.98s |  If you want a copy of the slides, you know, hit me up, and I'll send you a PDF, including
1354.98s - 1360.74s |  all the references, and you can have at it yourself.
1360.74s - 1361.38s |  Thank you very much.


url: https://www.youtube.com/watch?v=13o-MQtANpo
title: DEF CON 32 - The Risk and Reward of Distributed Industrial Control - Joe Slowik
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=13o-MQtANpo",
  "title": "DEF CON 32 - The Risk and Reward of Distributed Industrial Control - Joe Slowik",
  "description": "Economic efficiency and increasing automation mean that many industrial assets are remotely monitored and controlled. While some assets, such as oil production platforms, remain manned in isolated conditions, the ecosystem of renewable energy and distributed energy resources (DERs), pipelines, and other assets are increasingly unmanned with control extending over common information links. While this has been a boon for cost, it has also resulted in a radical extension of attack surface for cyber operations.\n\nIn this discussion, we will explore the nature of distributed industrial asset operation and the opportunities this presents for adversaries to infiltrate and potentially disrupt critical infrastructure operations. To make this point, we will review examples of adversary activity, from the 2022 ViaSat incident through historical pipeline intrusions (NOT Colonial!), showing how adversaries intentionally or inadvertently prey on brittle communication links for industrial disruption. We will conclude with a discussion of how these risks can be mitigated in a way that is sensible and economical, because wind farm operators won't lay their own dedicated fiber anytime soon.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1595,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.60s | This text was transcribed using whisper model: large-v2

 So, should we get started? Okay, I guess we're getting started. So, hello everyone. Welcome to
5.60s - 10.00s |  DEF CON at the lovely Las Vegas Convention Center. A fabulous new venue that we're all
10.00s - 14.00s |  learning to deal with. First off, can folks who are sitting in the back hear me? Because I know
14.00s - 19.68s |  it's a pretty difficult room. So, there's plenty of space up here. Feel free to move forward or
19.68s - 23.28s |  whatever. The screens are also a little tiny if you're sitting in the back. Trust me, I don't
23.28s - 27.52s |  bite and I don't think anyone else here does either. But what we'll talk about today is
27.52s - 32.96s |  getting into the risk and reward of distributed industrial control systems. First, who am I? My
32.96s - 37.68s |  name is Joe Slowik. I currently do a bunch of things over at the MITRE Corporation, like leading
37.68s - 41.76s |  up some of the functions within ATT&CK and doing critical infrastructure research. And I've done
41.76s - 45.60s |  a bunch of things previously, but no one gives a crap about me. We're here to talk about industrial
45.60s - 50.40s |  control systems and how these things are increasingly interconnected and exposed.
50.40s - 54.56s |  So, our agenda is we're going to talk about what distributed operations mean and how this
54.56s - 60.56s |  works to extend the ATT&CK surface of industrial assets. We'll look at this from the perspective
60.56s - 65.12s |  of what opportunities this affords adversaries, and then talk about some risks and considerations
65.12s - 69.76s |  and what we can meaningfully do about this new interconnected, networked, and exposed
69.76s - 74.00s |  landscape that we're dealing with for fairly important things like critical infrastructure
74.00s - 79.52s |  operations. So first, distributed industrial operations. What does that actually mean?
80.16s - 83.92s |  Well, if you talk to a lot of people that don't have a whole lot of experience or have a lot of
83.92s - 87.84s |  assumptions around what industrial environments look like, you would get a picture such as what I
87.84s - 93.28s |  hope is up on the screen right now, because I know there's been some issues, that there is an
93.28s - 98.88s |  error gap that exists segmenting networks quite thoroughly between an internet-connected environment
98.88s - 104.08s |  and a plant environment, which has no external connectivity whatsoever. That may still be the
104.08s - 108.64s |  case in certain areas, like nuclear generation, for example, but has largely never really been
108.64s - 113.52s |  the case in many environments and certainly isn't the case anymore for the majority of operations
113.52s - 118.96s |  that exist. Instead, we're all living in a networked world right now, where we're increasingly
118.96s - 123.76s |  seeing systems that you would normally assume would be walled off from the rest of the world
123.76s - 130.32s |  are connected and need to be connected to systems that need to talk to something external to your
130.32s - 134.56s |  environment. There is a measure of internet connectivity involved. It can be controlled,
134.56s - 138.48s |  limited. You can talk about things like data diodes and other sorts of technologies,
138.48s - 142.40s |  but generally speaking, data needs to get in and some data is going to need to get out.
143.04s - 148.08s |  So in looking at this, in legacy environments, we're really talking about operations and control
148.08s - 152.96s |  are co-located. So one of the things that enabled that error gap to exist is that you had
152.96s - 157.20s |  your operators and the physical equipment they were dealing with were co-located at the same
157.20s - 162.80s |  physical site where plant networks stop at the physical boundary of the facility. So you didn't
162.80s - 167.12s |  have to worry about networking these things. However, more modern operations, if we're talking
167.12s - 172.16s |  about things like wind farms, pipelines, increasingly ambitious mining operations,
172.16s - 177.92s |  or offshore oil and gas exploration, we're really talking about controlling systems that now extend
177.92s - 183.76s |  in geographically dispersed ways where we have to distribute operations and a lack of manning,
183.76s - 188.64s |  both because it's very difficult to try to staff every single compressor station along a pipeline
188.64s - 193.52s |  or every single wind farm that exists in Western Kansas or something along those lines,
193.52s - 197.84s |  that we need remote operations control, monitoring, et cetera, to make these things happen.
197.84s - 202.32s |  So this isn't just a cost-saving mechanism at this point. It's a necessity based upon how we have
202.32s - 207.28s |  built out infrastructure and how very vital aspects of the current critical infrastructure
207.28s - 212.88s |  mix function. Now, this isn't especially new. So those of you who are familiar with the electric
213.68s - 217.84s |  operations and similar, like, well, we've had energy management systems, transmission management
217.84s - 223.36s |  systems, and similar that have centralized management of fairly complex and geographically
223.36s - 228.80s |  distributed systems for quite some time and has operated in a fairly analog fashion in a number
228.80s - 234.48s |  of cases as well. So even getting outside of digital technologies. So we've been doing bits
234.48s - 239.76s |  of this for quite some time and do it rather well in certain cases, too. But what we're really
239.76s - 243.92s |  looking at now is a radicalization of how this connectivity works, because now we're getting
243.92s - 249.76s |  away from things like hardline connectivity to all of these assets or using things like,
249.76s - 254.96s |  you know, telephone lines or buried fiber and getting into an increasingly wireless ecosystem
254.96s - 260.08s |  to facilitate this communication where we're relying upon things like satellite communications,
260.08s - 264.40s |  5G, 4G networks, and similar to make this happen, which introduced some interesting
264.40s - 270.24s |  security repercussions to how this communication is taking place. So what we're looking at is that,
270.24s - 274.08s |  yes, we've done some of this remote management historically, but now we're doing it in a much
274.08s - 280.64s |  more prevalent and in a much more potentially insecure or attack surface magnifying way,
280.64s - 285.44s |  where economics, efficiency, and just the way that we operate have driven unmanned and remote
285.44s - 290.24s |  operations in a number of sectors. Technology advances, however, are permitting easier
290.24s - 294.96s |  connectivity with remote assets. Having a classic VSAT, very small arpiture terminal,
294.96s - 299.44s |  10 or 20 years ago for a remote mining site is like trying to suck a grape through a straw
299.44s - 305.12s |  when it comes to bandwidth and connectivity, whereas now advances in technology,
305.12s - 309.12s |  the expansion of satellite constellations and so forth have dramatically increased the bandwidth
309.12s - 314.80s |  available for these type of networks and expanded the scope of what we could reasonably expect to do
314.80s - 319.04s |  with these sorts of control systems. And furthermore, industry trends like distributed
319.04s - 324.16s |  energy resources, as well as things like vendor remote telemetry and remote preventative maintenance
324.16s - 329.36s |  and so forth, are accelerating these trends by requiring that asset owners increasingly
329.36s - 334.32s |  allow for connectivity to their industrial assets. So now we're getting into things like having
334.32s - 339.76s |  assets or at least elements of assets connected to, if not residing, in cloud-based instances,
339.76s - 346.16s |  which dramatically changes what the ideas of segmentation look like in terms of how these
346.16s - 350.96s |  environments can operate. So in looking at our options for remote connectivity, we certainly
350.96s - 355.68s |  have some traditional items that are out there, like our plain old telephone system, dedicated
355.68s - 361.28s |  fiber, or fairly uncontroversial and historical in nature. But now we're really talking about
361.28s - 364.72s |  expanding the use of cellular modems, which have also been around for quite some time,
365.36s - 370.56s |  getting into increased adoption of satellite systems for enabling these systems to talk to
370.56s - 376.00s |  one another, and using a variety of 5G and wireless technologies to facilitate this sort
376.00s - 382.08s |  of communication. So what does this mean? Well, it has lots of operational elements to it in terms
382.08s - 388.48s |  of how industrial asset management, monitoring, and control function, but also adversaries are
388.48s - 393.12s |  involved in these conversations as well, because we're also talking about dramatic changes to what
393.12s - 398.32s |  the attack surface looks like for these types of resources. So when looking at always online
398.32s - 403.20s |  industrial systems, we're really expanding scope out so that if we're talking about a distributed
403.20s - 407.92s |  satellite communication network, where you have communications bouncing to an overhead asset and
407.92s - 412.96s |  then going to a ground communication center, that you have a variety of wired and wireless links that
412.96s - 418.16s |  become involved in connecting various assets up and multiple potential touch points to get into
418.16s - 423.76s |  and interact with that network. Similarly, for 5G or other sorts of wireless terrestrial networks,
423.76s - 428.64s |  we're talking about mesh networks of multiple devices that can talk to one another and communicate
428.64s - 433.44s |  in a variety of ways that introduce a very interesting landscape in terms of who can
433.44s - 438.16s |  talk to whom and how you control the directionality of such communication. But also, we're talking
438.16s - 443.20s |  about systems where we're rapidly integrating vendors being able to consistently monitor and
443.20s - 449.44s |  potentially even interact with their environments as well, such as the GE Atlanta data highway for
453.84s - 458.48s |  generating assets produced by that company. We're seeing this across a variety of vendors where you
458.56s - 464.08s |  have assets tied to vendor management and monitoring for preventative maintenance, remote
464.08s - 469.12s |  management, and just big data analytics and so forth to fuel product development and product
469.12s - 474.32s |  support. So in looking at these connectivity functions and dependencies, there's certainly
474.32s - 479.52s |  the remote access and maintenance aspect of things of how do you operate power plants that are spread
479.52s - 484.96s |  out over a wide geographic area and control them in a way that makes sense, that remote control and
484.96s - 489.36s |  operations aspect, but also the telemetry and health check aspect of how do I make sure things
489.36s - 494.40s |  are running and running as I want them to, but also getting into very commercial aspects like
494.40s - 499.20s |  licensing and use monitoring. Are you operating your equipment in line with the contract that
499.20s - 503.84s |  you signed and using it within the boundaries of what it is that we agreed to commercially?
504.56s - 509.20s |  Finally, we get system of system items as well, such as coordination, balancing, and management
509.20s - 513.28s |  of wider scope systems, whether we're talking about things like maintaining frequency phase,
513.28s - 517.60s |  et cetera, for the overall electric system or managing pipelines to ensure that they are
517.60s - 522.88s |  adequately pressurized along their entire length to allow for product delivery across their entire
522.88s - 527.92s |  network. So what this means is that as we've started expanding these sorts of functionalities
527.92s - 532.88s |  and exposing these items through wireless and other means, it's providing opportunities for
532.88s - 538.00s |  adversaries to interact with these elements in ways that didn't really exist previously.
538.00s - 542.88s |  So what does that look like? Well, what it looks like is that we have distributed overlapping
542.88s - 549.20s |  communications that are really good for efficient, reasonably reliable if there are fail-safes and
549.20s - 553.76s |  backups involved in how these are put together. But in doing so, we've also expanded the attack
553.76s - 561.04s |  surface in such a manner that it's no longer about accessing the external facing IT or classic
561.04s - 565.84s |  business network assets of an industrial asset owner and operator, and then digging your way
565.84s - 570.40s |  through the network to get into the industrial environment through several lateral movement hops
570.40s - 575.12s |  and so forth. But instead, I may be able to hit those assets directly either through a wireless
575.12s - 580.56s |  communication mechanism or because the way in which these assets are networked overall allows
580.56s - 585.60s |  me to access the provider in such a way that I can now start delivering payloads directly to
585.60s - 590.72s |  the critical assets within the environment, or at least the networking assets that are facilitating
590.72s - 594.40s |  the connectivity of those assets to the wider environment. And we're going to look at an
594.40s - 599.44s |  example of that here in just one slide. But the thing is that we're really talking about
599.44s - 604.16s |  expanding the opportunities of adversaries to interact via these new communication mechanisms
604.16s - 610.24s |  in a distributed environment that increases the opportunities for adversaries to interfere with,
610.24s - 617.60s |  inject into, or otherwise send commands to these sorts of assets for a variety of potential reasons.
617.60s - 622.48s |  So what does this look like in practice? Well, we have one really interesting example from a couple
622.48s - 626.48s |  of years ago. For those who were following the news at the time, at the very start of the current
626.48s - 633.52s |  phase of Russia's invasion of Ukraine, there was a interruption to the KASAT network owned by
633.52s - 639.20s |  Viasat, managed by a subsidiary, by a contracting entity that resulted not just in a disruption of
639.20s - 645.60s |  communication for Ukrainian military operations that was using the KASAT network, but also resulted
645.60s - 651.12s |  in a significant outage for wind turbines manufactured by a German company called Enercon,
651.12s - 658.08s |  where essentially a loss of view and debatably a loss of control situation manifested because the
658.96s - 663.76s |  terminals, the modems that were being used to connect these wind farm systems to remote control
663.76s - 669.36s |  and management systems were bricked by a family of malware labeled by Sentinel-1 researchers as
669.36s - 675.04s |  acid rain. While it was not intentional, or we at least do not think that it was intentional in this
675.04s - 681.76s |  event, that taking out this wind generation was purposeful, still in attacking the KASAT network
681.76s - 688.00s |  through the delivery of the push of basically a malicious software payload to customer terminals
688.00s - 693.28s |  within the overall environment, they were able to knock offline a variety of generating assets. Now
693.28s - 699.36s |  certainly if you're talking about remote wind and etc, there are fail safes that step into play in
699.36s - 704.96s |  order to cause these things to at least fail safely, fail relatively securely, but we're still
704.96s - 709.92s |  talking about placing these assets into a state where they're no longer able to sync effectively
709.92s - 715.04s |  with the broader environment and no longer able to effectively manage them as we would if that
715.04s - 720.24s |  connectivity existed as it was intended to do so. So certainly putting a fairly interesting element
720.24s - 725.04s |  and an increasingly important element of our generating mix at risk when we start talking
725.04s - 730.64s |  about things like distributed wind, distributed solar, and even getting into things like rooftop
730.64s - 735.20s |  solar etc, which may rely upon wireless communication mechanisms and the use of
736.08s - 740.88s |  various networking devices and so forth that have vulnerabilities in them, or have the possibility
740.88s - 745.84s |  of a acid rain like scenario where we could potentially push a malicious payload via access
745.84s - 751.20s |  to some other elements within the overall network to cause widespread impacts and outages across all
751.20s - 756.96s |  the interlinked devices. We also have the colonial pipeline incident. I put an asterisk on this
756.96s - 762.00s |  because this really was more of a proof of concept in terms of what may have occurred as
762.00s - 767.36s |  opposed to what actually occurred. So for colonial pipeline, colonial pipeline basically shut their
767.36s - 772.08s |  own operations down because they lacked the visibility and the confidence in saying that
772.08s - 776.96s |  they were able to run a effective network that was also that could be ran safe but also could
776.96s - 781.92s |  track things like product delivery as a result of a ransomware incident. But out of the colonial
781.92s - 788.96s |  pipeline event, you saw a number of commentators, I'll use that word pejoratively, that asked
788.96s - 792.08s |  questions about, well, why not just air gap everything? It's like, it's a couple thousand
792.08s - 796.80s |  mile pipeline. It's only got like seven or eight compressor stations and maybe a dozen PLCs, right?
796.80s - 801.68s |  How hard could that be to network all that together with buried fiber? The answer to that is
801.68s - 806.80s |  that it's not easy. And while colonial pipeline resulted from an impact on the business network,
806.80s - 811.12s |  it doesn't take a whole lot to expand our conception of what a pipeline incident might look
811.12s - 817.60s |  like to being able to interact with compressor stations that are remote, often unmanned, and
817.60s - 822.48s |  relying upon increasingly wireless communications, although there are still hardwired communications
822.48s - 827.60s |  in play, to allow for interaction with how that pipeline functions to induce conditions like a
827.60s - 831.76s |  loss of view because you're no longer able to communicate with a specific compressor station.
831.76s - 835.92s |  Depending on how things work, and this gets a little bit more interesting in terms of what
835.92s - 841.20s |  possibilities are available, you could, with sufficient access and poor segmentation and so
841.20s - 846.48s |  forth, be able to inject controls into a legitimate way of operating and maintaining that pipeline
846.48s - 850.96s |  to start inducing potential catastrophic events like an overpressure or underpressure
850.96s - 856.88s |  situation that would result in pipeline disruption. Not really easy, and it's debatable how practical
856.88s - 861.44s |  that would be for an adversary to do, but if we're exposing control systems that relate to the
861.44s - 865.52s |  fundamental operation of these assets, then especially if those controls are going over the
865.52s - 870.32s |  air in an unencrypted way that aren't using proper check sums to validate commands and controls that
870.32s - 876.16s |  are going over that environment, the possibilities for replaying, capturing, or potentially modifying
876.16s - 881.44s |  control system logic as it moves over unsecure lines or over the air starts becoming a very
881.44s - 886.96s |  interesting scenario for how to achieve far more lasting and concerning effects than what we saw
886.96s - 892.32s |  with the ransomware incident a few years ago. So, in looking overall at this, we see that there's
892.32s - 897.04s |  a variety of diverse opportunities that are available for adversaries in terms of their
897.04s - 904.64s |  ability to control or to interact with critical infrastructure elements enabled by an increasingly
904.64s - 909.60s |  remote perspective on how these systems are managed and maintained. So, certainly there are
909.60s - 914.88s |  IT-focused disruption mechanisms that can take place against control centers, which can be very
914.88s - 919.76s |  interesting because rather than having, say, control centers distributed among various assets,
919.76s - 925.76s |  now I have one centralized control and management station sitting in Spain, if I'm Siemens Gamesa
925.76s - 931.20s |  or something like that, or one centralized control station located elsewhere that the vendor is
931.20s - 935.84s |  managing in order to maintain a wind farm or a fleet of wind farms, that if that gets taken out
935.84s - 941.04s |  through ransomware, something deliberate and more malicious, etc., can I still operate all those
941.04s - 945.44s |  facilities in a safe and effective manner that allows for them to continue to be part of the
945.44s - 953.92s |  overall energy mix? But also, we have more end state or field device potential scenarios that
953.92s - 959.28s |  come from subversion or injection into these communication environments. So, here we're talking
959.28s - 965.52s |  about possibilities like, well, looking at the Enercon scenario where I can specifically and
965.52s - 970.72s |  deliberately take out the communication devices that tie these systems back into
970.72s - 977.28s |  centralized monitoring and control, or like a theoretical pipeline attack scenario,
977.28s - 982.96s |  leverage my ability to inject into insecure communication streams to send rogue commands
982.96s - 988.56s |  similar to what we see – ooh, there's a microphone – similar to what we see like the using of a tool
988.56s - 994.72s |  like Frosty Goop, which was in the news a few weeks ago, in terms of injecting Modbus communication
994.72s - 998.64s |  logic in order to have effects on central heating in Ukraine, but something like that
998.64s - 1004.24s |  taking place without having the IT intrusion, but rather based off of the ability to interact
1004.24s - 1009.12s |  directly with control systems over a wireless communication link that doesn't involve breaching
1009.12s - 1015.12s |  another aspect of the asset owner's network, or may involve breaching the contracting entity
1015.12s - 1020.88s |  that's providing that communication infrastructure in order to then deliver that follow-on effect
1020.88s - 1025.60s |  to the actual industrial assets that are interesting. Either way, we look at these
1025.60s - 1031.20s |  two different sides of the equation between going after the centralized control and management,
1031.20s - 1035.12s |  the single points of failure for how these networks are operated in many ways, which is why
1035.12s - 1040.80s |  they are typically very well secured. If you've gone to an electric utilities EMS or transmission
1040.80s - 1045.68s |  management system, where it's physically located, there is significant physical security. These are
1045.68s - 1051.52s |  crown jewel assets for IT security. They're not exactly poorly defended, but if we start talking
1051.52s - 1056.24s |  one layer up from the actual management and maintenance, that if you can't get commands
1056.24s - 1061.04s |  out from that center, from those consoles out to the devices in the field that you're trying to
1061.04s - 1066.40s |  maintain and manage, things can go south very quickly and result in systems that, if they don't
1066.40s - 1073.44s |  have the proper resilience and failovers in place, can start entering into very unsafe and uncertain
1073.44s - 1079.60s |  states fairly quickly. In looking at these considerations, the main worry that I have,
1079.60s - 1085.68s |  at least, and that we're starting to see in some of these technologies and implementations is that
1085.68s - 1090.96s |  in the drive for efficiency, like, oh, we could use the Starlink constellation and just put little
1090.96s - 1096.24s |  satellite receivers or whatever at all of our end stations, and we have connectivity for relatively
1096.24s - 1101.52s |  low cost with fairly good bandwidth that we can tie all these items together. That's true, but if
1101.52s - 1106.40s |  that constellation should go down or if there is a malicious update that's pushed to Starlink
1106.40s - 1111.92s |  terminals or some other scenario manifests, how do we then ensure that that system can retain
1111.92s - 1116.96s |  operational, and how long do we have until that system needs to switch into an emergency state
1116.96s - 1121.60s |  to ensure the continued viable operation of critical infrastructure assets like
1121.60s - 1127.68s |  electricity generation, pipeline operations, remote mining operations, offshore oil and gas
1127.68s - 1133.20s |  exploration and drilling, etc. So, the result is that the possibilities emerge for severing or
1134.00s - 1138.80s |  degrading active control mechanisms in these sorts of environments that can place these
1138.80s - 1144.00s |  ecosystems at risk. This gets us into a situation where, if you're familiar with ICS for ATT&CK,
1144.00s - 1148.88s |  the framework for mapping out potential adversary opportunities for interacting
1148.88s - 1153.68s |  with industrial assets, that we can start seeing the possibilities emerge for inducing a loss of
1153.68s - 1158.48s |  view, the ability to monitor and extract information from these environments for the
1158.48s - 1164.00s |  purpose of determining are they operating in the way that we want them to, and are they
1164.00s - 1169.76s |  doing their job safely, efficiently, etc., but also potentially and more worryingly a loss of control
1169.76s - 1174.64s |  where we get into a scenario not whether I can start a process, but rather can I stop it if that
1174.64s - 1181.12s |  process starts deviating from safe or desirable parameters for its overall functionality.
1182.00s - 1186.88s |  So, in looking at this, what risks are we talking about and what considerations are involved in this
1186.88s - 1191.20s |  discussion? Well, first, you know, we could make the argument, well, why not just turn back the
1191.20s - 1195.68s |  clock? And I've seen people say this, you know, why not just air gap all the important control
1195.68s - 1200.72s |  systems? Well, that'd be really hard, really expensive, and I don't think anyone really
1200.72s - 1205.20s |  expects that we could realistically do this at this point. That ship has sailed and it probably
1205.20s - 1210.56s |  sailed a very, very long time ago, and looking at things like the type of energy mix that we need
1210.56s - 1215.60s |  for the future, as well as increasingly ambitious things like oil and gas exploration and mining
1215.60s - 1222.64s |  operations, we're going to need these sorts of non-wired, over-the-air, and distributed
1222.64s - 1228.48s |  communication environments to tie all these assets into centralized data retrieval, monitoring,
1228.48s - 1232.96s |  maintenance, and control in order for them to be effective. So, we're not able to turn back
1232.96s - 1238.88s |  the clock. We can't just say wire all the things together, bury, you know, 7,000 kilometers worth
1238.88s - 1243.04s |  of dedicated fiber to tie all these things together is just not a realistic option at this
1243.04s - 1249.12s |  point, unless everyone's willing to pay a lot more for a lot of these services that are enabled by
1249.12s - 1253.92s |  the various infrastructure sectors. So, instead, we need to acknowledge reality, that remote
1253.92s - 1260.16s |  connectivity and especially management of critical assets is a fact of existence right now. However,
1260.16s - 1263.68s |  in doing so, that doesn't mean that we just need to throw our hands up and say, well, okay,
1263.68s - 1268.40s |  I accept the risk and bad things are going to happen. There are ways that we can and must do
1268.40s - 1273.76s |  these sorts of items safely, securely, but also redundantly to ensure that we have the sort of
1275.04s - 1278.56s |  resiliency built in to allow these operations to continue.
1279.76s - 1284.64s |  So, in a very simplified way, we can break this down in terms of OT remote operations between
1284.64s - 1289.36s |  security considerations and reliability considerations. From a security standpoint,
1289.36s - 1294.56s |  you know, availability, if we talk our classic confidentiality, integrity, availability triad,
1294.56s - 1298.00s |  we're not going to really worry about availability right now. We're going to assume availability has
1298.00s - 1303.20s |  to be there and we're going to work our damnedest to ensure it, and that is where reliability comes
1303.20s - 1308.00s |  into play. But for ComSec or communication security considerations, we're really talking
1308.00s - 1312.56s |  about ensuring the integrity of those communications, which can be as simple as ensuring that
1312.56s - 1319.12s |  we're doing a robust checksums applied to controls that are communicated over insecure networks.
1319.76s - 1323.52s |  You know, if we're talking about a satellite downlink or wireless communications,
1323.52s - 1328.40s |  some of these links, as you can probably tell from other talks that have taken place at DEF CON's
1328.40s - 1332.96s |  past and present, have emphasized the insecurity of some of these links and how they can be both
1332.96s - 1338.32s |  eavesdropped upon as well as potentially injected into or otherwise subverted for malicious purposes.
1338.32s - 1343.20s |  So, being able to verify the integrity of commands that are sent over these links is vital and
1343.20s - 1348.80s |  something that we need to start pursuing or layering on top of existing industrial control
1348.80s - 1353.92s |  protocols and similar to make that happen. Confidentiality may be part of this. You could
1353.92s - 1358.64s |  argue, well, why not just encrypt all of these items? That might work. There is debate as to
1358.64s - 1363.84s |  how useful or how effective that would be because encryption adds overhead and potential latency in
1363.84s - 1368.16s |  terms of how these commands get passed and processed. And as we start talking about pretty
1368.16s - 1373.52s |  thin pipes like remote satellite communication links and so forth and potential latency issues
1373.52s - 1378.48s |  that surround that, it might not be desirable. But it is something that, especially when it comes to
1378.48s - 1383.20s |  OT or ICS-related protocols, that needs to be considered more strongly instead of just throwing
1383.20s - 1388.16s |  up our hands in the air and saying, well, this is hard, so let's not do it. From a reliability
1388.16s - 1392.40s |  standpoint, yes, it is cheap and easy just to try to wire things together with commercial satellite
1392.40s - 1396.96s |  modems and so forth and call it good. But if we're talking about critical assets that feed into
1396.96s - 1402.56s |  national critical infrastructure, we need to have something more or build in the correct ways of
1402.56s - 1406.80s |  ensuring those operations can be sustained in a challenging environment, whether that be because
1406.80s - 1411.04s |  a satellite constellation gets knocked out by an anti-satellite missile or something along those
1411.04s - 1416.56s |  lines or similar wild scenarios, or something like we saw with the KASAT event with the distributed
1416.56s - 1422.08s |  denial of service mechanism that was used in parallel with the acid rain wiper that was
1422.08s - 1426.72s |  causing significant degradation to that network. How do we operate in a way that if this link is
1426.72s - 1432.88s |  removed, that we have a backup link or a way of securely and safely winding down operations until
1432.88s - 1437.68s |  those links can be restored? That's going to cost a little bit of money, unfortunately, but if we want
1437.68s - 1444.08s |  to reap the rewards of having the flexibility created by these sorts of environments, we need
1444.08s - 1449.36s |  to ensure that we're also doing so in a way that is maintainable and sustainable in realistic fashion.
1450.40s - 1454.48s |  It also means, and this is where we come to DEF CON and most of the audience here,
1454.48s - 1459.28s |  offensive security testing has a role to play here, validating communications and how they work,
1459.28s - 1464.40s |  especially from an adversary's mindset and in the eyes of disruption, is critical, which means
1464.40s - 1469.28s |  offensive testing, which could be anything from tabletop exercises that run through like, oh wait,
1469.28s - 1473.76s |  if that goes away, what do we actually do, to validating that certain networks can be reached
1473.76s - 1478.24s |  or interacted with through over-the-air links and thus demonstrating risk to decision makers that,
1478.24s - 1483.12s |  oh wait a minute, this is not a notional problem but actually can manifest, can allow asset owners
1483.12s - 1488.80s |  to deploy well, evaluating what risk propositions are available. And this gets into a variety of
1488.80s - 1493.20s |  disciplines that become very interesting very quickly in terms of what we can do to test and
1493.20s - 1498.32s |  validate how these networks are deployed and how they function. In terms of additional considerations,
1498.32s - 1502.24s |  there are other things that we need to worry about, and we only have a short period of time here,
1502.24s - 1506.16s |  but I'll have a link to some resources if you want to look a little bit further, that we do
1506.16s - 1510.96s |  have the possibility of physical attacks and disruptions on remote links, insecure protocols
1510.96s - 1514.64s |  that are used over the air, which I talked about a little bit already, as well as latency and
1514.64s - 1518.96s |  observability concerns that come about with communications that start getting pushed into
1518.96s - 1525.20s |  more extreme and more interesting arenas. But overall, the central point or thesis behind this
1525.20s - 1530.16s |  is that we're in a state where we've extended attack surface but haven't really validated how
1530.16s - 1534.64s |  we will operate securely and safely in that new environment as effectively as I think that we
1534.64s - 1539.20s |  should. And these are considerations that asset owners need to keep in mind. So I don't think we
1539.20s - 1543.92s |  have much time for questions, but before I get back to that slide, if anyone wants to snap a
1543.92s - 1547.28s |  picture of this or these slides will be available on the media server, I believe,
1547.28s - 1551.04s |  just a couple of links to articles and some of the things I talked about. But also, if you're
1551.04s - 1555.20s |  really interested in a deep dive into one particular event on this, I'll be presenting
1555.20s - 1559.68s |  at length, including a very lengthy paper at the Virus Bulletin Conference later this year on the
1559.68s - 1564.32s |  KASAT incident. That'll get published in October, so bookmark this if you're interested and really
1564.32s - 1568.64s |  want to explore the nuts and bolts of what not just an attack scenario looks like in this regard,
1568.64s - 1573.44s |  but also what defensive options exist when it comes to doing this sort of activity.
1573.44s - 1578.16s |  So that's forthcoming, and certainly look out for that if you are interested. Otherwise,
1578.88s - 1582.96s |  there's my information. So happy to answer questions. I know we got a quick turnaround
1582.96s - 1587.76s |  time here, so I will hang out probably in the back of the room so that our next speaker can get ready.
1587.76s - 1591.68s |  And yeah, I'm good to go. Thanks, everyone, for hanging out.


url: https://www.youtube.com/watch?v=q1Uap5uinIo
title: DEF CON 32 - Color Blasted Badge Making: How Hard Could It Be - Abhinav Panda, Bradán Lane
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=q1Uap5uinIo",
  "title": "DEF CON 32 - Color Blasted Badge Making: How Hard Could It Be - Abhinav Panda, Brada\u0301n Lane",
  "description": "Without plan or intent, three Makers took three paths to achieve colorful badges and none were smart enough to turn back. Join our panel discussion to learn our different approaches, the strengths and weaknesses of each, and ask your probing questions. Perhaps you too will be foolish enough to venture into the technicolor labyrinth.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3047,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.00s | This text was transcribed using whisper model: large-v2

 Is this thing on? Hi, guys. Welcome.
5.00s - 8.00s |  I'm Reanimation of the Badgelife Discord,
8.00s - 12.00s |  and today we're going to be talking about color-blasted badge making.
12.00s - 13.00s |  How hard could it be?
13.00s - 17.00s |  On our panel here, we're going to start with Panda,
17.00s - 21.50s |  who's going to talk about UV printing.
21.50s - 24.50s |  All right, so my name's Abhinav.
24.50s - 27.50s |  So I have been doing Badgelife for eight years now,
27.50s - 30.50s |  and it's a funny story how I started.
30.50s - 31.50s |  I started very randomly.
31.50s - 34.50s |  I was trying to make badges for an Indian conference,
34.50s - 37.50s |  and I happened to just hang on to it instantly,
37.50s - 39.50s |  and that's what I wanted to do.
39.50s - 41.50s |  Over the time, we built our own Badgelife lab
41.50s - 45.50s |  with our own machineries and our fabrication and all the stuff,
45.50s - 49.50s |  so we keep doing a hell of a lot of crazy weird experiments
49.50s - 53.50s |  with crazy failures and crazy successes.
53.50s - 60.50s |  So my technique for the full-color badge making is UV printing,
60.50s - 65.50s |  and so you must have seen UV printing in a lot of technology.
65.50s - 68.50s |  They print banners with it.
68.50s - 75.50s |  They print acrylic and phone cases and a lot of stuff,
75.50s - 79.50s |  and so that is how the UV printer looks like.
79.50s - 81.50s |  It has a header that goes back and forth
81.50s - 85.50s |  and tries to print the stuff on it.
85.50s - 92.50s |  So my story started with these are all just examples.
92.50s - 100.50s |  So the very bottom one, the RSA badge, was our first UV printed badge.
100.50s - 105.50s |  The conference had a very unique logo with a specific shade of pink
105.50s - 107.50s |  on the bottom right corner,
107.50s - 112.50s |  and despite all the efforts, we couldn't get it done in the screen printing.
112.50s - 119.20s |  So we got thinking, what could we do here?
119.20s - 123.20s |  Yeah, what could we do here?
123.20s - 128.20s |  A sudden light bulb came up, and we heard UV can print on anything.
128.20s - 133.20s |  So we started doing those trials, and long story short,
133.20s - 138.20s |  that eventually became our UV printing thing.
138.20s - 142.20s |  We bought our own UV printer, and over the course of time,
142.20s - 145.20s |  we did a lot of badges.
145.20s - 150.20s |  There's a Pacific Hackers badge, a really cool community in Silicon Valley.
150.20s - 153.20s |  There's a Wombat badge from PCS Adelaide,
153.20s - 160.20s |  and we're trying to mix around with a lot of materials and a lot of unique ideas.
160.20s - 163.20s |  For example, there's an old badge on the top,
163.20s - 168.20s |  which is a combination of some gemstones and gold plating and so on.
168.20s - 174.20s |  So we keep experimenting, keep trying to find something new that's out there
174.20s - 177.20s |  that's not yet done before.
177.20s - 180.20s |  So this is how the process looks like.
180.20s - 183.20s |  The machine has its own software,
183.20s - 189.20s |  and so you can load your PNGs or PDFs in that.
189.20s - 193.20s |  You adjust the print positions on the bed.
193.20s - 197.20s |  The bed is basically the area that you print.
197.20s - 205.20s |  So what we eventually learned to do is we print directly on the bed first.
205.20s - 207.20s |  So we print a layer on the bed,
207.20s - 213.20s |  and we manually align each PCB on top of that bed and then print it once again.
213.20s - 217.20s |  So that is how we managed to fix the alignment issues,
217.20s - 220.20s |  which is very common with EU printing.
220.20s - 224.20s |  So the machine we have, this is actually the second machine we have.
224.20s - 229.20s |  It's a local brand with a custom Epson header on it
229.20s - 233.20s |  because the machines are super expensive if you want to go big.
233.20s - 236.20s |  So this is like 2 feet by 3 feet.
236.20s - 238.20s |  It fits in about 60, 70 badges,
238.20s - 244.20s |  and on average it's like a minute for each badge to print.
244.20s - 248.20s |  And there are many cheaper EU printers in market,
248.20s - 252.20s |  and those take longer time to cure, I think.
252.20s - 258.20s |  And we tried with both assembled badges and preassembled badges.
258.20s - 261.20s |  And if you assemble the badges first, you need to use the jig
261.20s - 265.20s |  to keep things in place and not wobble it.
265.20s - 269.20s |  So a lot of experimentation.
269.20s - 273.20s |  I find out that when we print on assembled badges,
273.20s - 276.20s |  the UV layer also prints on the components, on top of components.
276.20s - 281.20s |  It colors the components as well, which is super funny.
281.20s - 284.20s |  And the hand soldering is perfectly fine.
284.20s - 289.20s |  There's no issue with hand soldering after EU print.
289.20s - 293.20s |  Reflow on is where you run into your first problems.
293.20s - 300.20s |  When you reflow a UV printed layer, it does get yellowish or it loses its shade.
300.20s - 303.20s |  And for that, you have to keep adjusting.
303.20s - 307.20s |  If you get a UV printer, you have to keep experimenting a lot to find a sweet spot.
307.20s - 309.20s |  And that's for every design and every badge.
309.20s - 313.20s |  So there's a lot of experimentation involved.
313.20s - 318.20s |  And so UV printer on its own is a super high maintenance.
318.20s - 322.20s |  You have to print. On average, you should print something every day.
322.20s - 329.20s |  So to keep it healthy, so to speak, and not let the hair dry.
329.20s - 333.20s |  Yeah, and that's what we have been doing for the most part.
333.20s - 342.20s |  So over the course of time, we built all this tech for badges that we made in-house.
342.20s - 348.20s |  And I might start PCB assembly service or just UV printing service in the future, this year or later on.
348.20s - 350.20s |  So stay tuned.
350.20s - 352.20s |  Off to Hamster now.
352.20s - 355.20s |  It's breeding.
355.20s - 358.20s |  We chose to do this alphabetically.
358.20s - 359.20s |  All right. So, yeah.
359.20s - 363.20s |  Next, we have Brayden Lane, who's going to talk about screen printing as a different method.
363.20s - 366.20s |  Yeah, so I'm Brayden Lane.
366.20s - 370.20s |  And actually, I've been talking to Panda quite a bit about colored PCBs.
370.20s - 378.20s |  But I didn't have the resources, I guess is a good choice of word, to do UV printing.
378.20s - 387.20s |  And also in talking to Panda about the solutions and the challenges that they were encountering about things like reflow.
387.20s - 393.20s |  I started thinking about, well, what would be tolerant of the whole reflow process?
393.20s - 397.20s |  Well, solder mask ink is going to be completely tolerant of it.
397.20s - 399.20s |  So I said, well, if I've got ink, how can I print ink?
399.20s - 409.26s |  And the answer was traditional silk screening.
409.26s - 413.26s |  So this is me a few years ago when I started this process.
413.26s - 416.26s |  You can see it aged me quite a bit.
416.26s - 418.26s |  But this is not me.
418.26s - 420.26s |  But this is the technology I use.
420.26s - 425.26s |  It's the old school, classic silk screening for making T-shirts.
425.26s - 428.26s |  I just applied it to doing printed circuit boards.
428.26s - 437.02s |  And so the entire process that you'd go through for traditional silk screening.
437.02s - 438.02s |  Can you advance it for me?
438.02s - 441.02s |  Yeah.
441.02s - 443.02s |  I'm looking. That's the one. Thank you.
443.02s - 446.02s |  So the process is exactly the same as if you're doing a T-shirt.
446.02s - 452.02s |  So I start out with, you know, publicly commercially available silk screens.
452.02s - 456.02s |  They're aluminum frame and they've got a stretch silk screen on them.
456.02s - 463.02s |  I go through the process of applying a UV exposed emulsion on them, just like you do for doing T-shirts.
463.02s - 465.02s |  And then I expose that with UV light.
465.02s - 470.02s |  And if you look in the very center of that slide, there's some black and white.
470.02s - 473.02s |  That's my negative.
473.02s - 476.02s |  And so I just expose the screen.
476.02s - 478.02s |  It takes about eight minutes.
478.02s - 481.02s |  And then I rinse them out, wash them out.
481.02s - 482.02s |  And I end up with a screen.
482.02s - 489.02s |  Once that screen has been washed out, I can leave it for a year and it doesn't change.
489.02s - 496.02s |  And then I go through the process of setting up what would be a traditional silk screening piece of equipment.
496.02s - 502.02s |  But for doing PCBs, which are very small, I want something that's very accurate.
502.02s - 514.02s |  And so the only thing I had at my disposal that could allow me to align very accurately a silk screen to a PCB was my solder paste stenciling printer.
514.02s - 521.02s |  So that's what you see, the orange with the yellow second to the right.
521.02s - 529.02s |  That's actually just the standard manual solder paste stenciling piece of equipment that a lot of makers use when they're making their PCBs and putting down solder paste.
529.02s - 534.02s |  I pull out my solder paste stencil and I put in my silk screening stencil.
534.02s - 542.02s |  And there's a quick example right there, but I want to bring up the samples page.
542.02s - 544.02s |  There we go.
544.02s - 550.02s |  So some of the challenges that come to be is it doesn't really scale that well.
550.02s - 557.02s |  So if we look at the bottom left corner, that is the 2023 Challenge coin.
557.02s - 561.02s |  I order PCBs from the manufacturer in black and white.
561.02s - 567.02s |  And the white is anything that I want to be white, but the white is also anything I want to be colored.
567.02s - 571.02s |  And then I go through the process of silk screening any color.
571.02s - 575.02s |  Well, one color is one entire silk screening process.
575.02s - 579.02s |  Two colors is two entire silk screening processes.
579.02s - 587.02s |  So that board had to go through the silk screening process four times, which meant it also had to be exposed to UV light four times and everything else is four times.
587.02s - 594.02s |  And so it's good for adding a couple of colors, but you don't want to go wild with it.
594.02s - 601.02s |  You also really can't do, you know, full RGB color with it.
601.02s - 602.02s |  It's just not going to work.
602.02s - 609.02s |  What you can do is in the traditional silk screening process, there's something called a split fountain.
609.02s - 614.02s |  We would know it as a gradient, but there is a difference between split fountain and a gradient.
614.02s - 619.02s |  And actually, you can just see it in the DC Kids example.
619.02s - 623.02s |  So what I ordered from the PCB manufacturer is the top one.
623.02s - 636.02s |  I then did one pass in gray, and then I did one pass in a single pass with the red and blue, and then they blend together in the process of applying it.
636.02s - 642.02s |  It's, now can we go to the, there we go.
642.02s - 648.02s |  So I wanted to show this example of that same DC Kids badge.
648.02s - 650.02s |  You'll notice that the blue changed over time.
650.02s - 662.02s |  So the left side of that bottom photo was the very first PCB that I squeegeed across, and the right side is the very last PCB that I squeegeed across.
662.02s - 666.02s |  And you'll notice that the blues and the reds started to bleed together.
666.02s - 677.02s |  So that was one of the issues I had to realize that if you do split fountain, yes, it's very creative, but it doesn't scale because after a certain number of PCBs, everything kind of turns into mud.
677.02s - 681.02s |  Another thing to think about is silk screening is ink.
681.02s - 691.02s |  It's the old CMYK, which means when you think of digital art, if you mix red and blue together, you get a purple.
691.02s - 698.02s |  In the world of inks, if you mix red and blue together, you get a kind of a cocoa gray.
698.02s - 702.02s |  And so you have to take that into account when you're mixing colors.
702.02s - 704.02s |  It's not going to be like on a computer.
704.02s - 706.02s |  It ends up being something very different.
706.02s - 722.02s |  The other challenge, and I thank Panda for this because we were talking about both my technique of traditional silk screening and his technique of using UV printing, you still need to UV cure the inks afterwards.
722.02s - 730.02s |  And when I did the original challenge coin, I just had fixed UV lights that I bought from online.
730.02s - 735.02s |  And I learned that the closer they are to the PCB, the better they work.
735.02s - 738.02s |  But they still need to be there for a period of time.
738.02s - 745.02s |  And so what Panda had done was they had built, I think you built a custom conveyor system for yours.
745.02s - 748.02s |  Well, I tried to do that and I failed miserably.
748.02s - 751.02s |  But then I realized I have a conveyor system.
751.02s - 753.02s |  It is my reflow oven.
753.02s - 756.02s |  So I popped open my reflow oven.
756.02s - 759.02s |  I stacked in four UV lamps.
759.02s - 763.02s |  And I can now basically feed as fast as I can feed boards into it.
763.02s - 765.02s |  It will UV cure them for me.
765.02s - 770.02s |  So that's what that rig is in the upper corner there.
770.02s - 778.02s |  Another difference between doing a T-shirt and doing a PCB is a PCB is very small versus a T-shirt.
778.02s - 791.02s |  And so to get the level of detail that we grow accustomed to on PCBs, instead of using, say, a 100 or a 160 mesh, I end up at 230 and 305.
791.02s - 794.02s |  And 305 is now my standard.
794.02s - 805.02s |  So from that standpoint, the technique is the same, but the equipment has to get more and more refined to keep the accuracy that we want.
805.02s - 811.02s |  I would say, in general, it's more of an art than a science.
811.02s - 817.02s |  And with that, I'm going to hand it off to Hamster.
817.02s - 823.02s |  Next, we have Hamster, and he's going to describe yet another method of coloring called dye sublimation.
823.02s - 830.20s |  All right. Howdy. I'm Hamster.
830.20s - 834.20s |  I've been doing badge making for a number of years now.
834.20s - 837.20s |  I really like hacking the process.
837.20s - 847.20s |  I often wonder what the Chinese fabs think about us abusing their machines to do artistic things when, historically, you know, they're used to square green boards coming out.
847.20s - 852.20s |  And here we are, like, trying to cram all this artwork into the process.
852.20s - 863.20s |  So I've, in the process of trying to add color to PCBs, there's lots of ways of doing with the standard silkscreen and solder mask and copper to get colors.
863.20s - 868.20s |  But I've always kind of wanted to do full color things.
868.20s - 878.20s |  I settled on dye sublimation mostly because my wife is an avid crafter, and she buys all kinds of interesting things.
878.20s - 886.20s |  She bought an entire setup for doing dye sublimation to dye t-shirts and coffee mugs and such to sell on Etsy.
886.20s - 889.20s |  But the equipment sits idle for quite a while.
890.20s - 894.20s |  And I kind of got to looking at it one day, and I'm like, wait, I have some white PCBs.
894.20s - 898.20s |  I wonder if the dye sublimation technique will work on PCBs.
898.20s - 900.20s |  And it turns out that it does.
900.20s - 903.20s |  I was very surprised with it.
903.20s - 906.20s |  It's a fairly simple process.
906.20s - 909.20s |  You create the image on your computer.
909.20s - 913.20s |  You modify your inkjet printer to use dye sub ink, which is cheap.
913.20s - 916.20s |  You print it out on dye sub paper, which is cheap.
916.20s - 927.20s |  And then you put the PCB onto the paper and put it in a t-shirt press, which is reasonably priced, $150 or so for a heated t-shirt press.
927.20s - 930.20s |  And then your badge comes out the other end.
930.20s - 932.20s |  So it's not painful.
932.20s - 943.20s |  You can kind of go quick through these sort of things, and it gives you the ability to get that whatever you put on the screen, you can get on the final PCB.
944.20s - 945.20s |  Let's see.
945.20s - 948.45s |  It'll go forward a slide.
948.45s - 951.45s |  So for some examples here.
951.45s - 953.45s |  Sorry, if you go back a slide.
953.45s - 961.45s |  So for some of the examples here, so like the DCZ badge that we did last year had a nice color gradient to it.
961.45s - 963.45s |  I've got another one of my friend Bob.
963.45s - 972.45s |  I took a photo of him at one point, and I made these SAOs with his face on it, which you can't really see in here, but the eyes bleed through.
972.45s - 977.45s |  He's got some LEDs behind it, so it has a nice strobe effect with his eyes.
977.45s - 984.45s |  The only real downsides I've seen so far with it is that it's really hard to get rich colors out of it.
984.45s - 987.45s |  So your black colors kind of get washed out.
987.45s - 990.45s |  So you kind of have to take that into account.
990.45s - 997.45s |  I'm experimenting with it still to see what I can do with it to try to help that situation out.
997.45s - 1000.45s |  But so far, it's been working out for me.
1000.45s - 1002.45s |  One more slide there.
1002.45s - 1004.45s |  Yeah, so we talked a little bit about a process.
1004.45s - 1006.45s |  So this is kind of what it looks like for me with a PCB.
1006.45s - 1014.45s |  So there at the top, I have the dye sub paper where I've printed the image reversed on the paper.
1014.45s - 1020.45s |  And I usually put an outline on it so I can kind of visually line up the board.
1020.45s - 1025.45s |  One of the other issues with this system is that dye sub is a heat process.
1025.45s - 1030.45s |  It won't go through a reflow oven without losing most of your color.
1030.45s - 1034.45s |  So you need to populate and reflow your boards first.
1034.45s - 1040.45s |  And then you put them onto the dye sub paper, tape it down with some Kapton tape, polymide tape.
1040.45s - 1042.45s |  And then it goes into the heat press.
1042.45s - 1050.45s |  So I usually have to use, like, I've got some bits of flooring that I use to space the board up off of the press
1050.45s - 1052.45s |  so that the components can fit underneath there.
1052.45s - 1057.45s |  And then it's, you know, about 30 seconds in the press at about 360 degrees Fahrenheit.
1057.45s - 1062.45s |  You pull them off, let them cool down, peel it off, and you have the final result.
1062.45s - 1069.45s |  So the fun part about this is that it's a cheap enough process.
1069.45s - 1075.45s |  We have a convention back in Utah, St. Con, that's reasonably close to my house,
1075.45s - 1080.45s |  that it's kind of fun to see what's happening at St. Con, go home at the end of the night,
1080.45s - 1085.45s |  and then make a whole bunch of SAOs the next day that are topical.
1085.45s - 1089.45s |  So it's really neat to be able to turn these things around very quickly.
1089.45s - 1093.45s |  It also allows for when I design the badge, artwork can come later.
1093.45s - 1098.45s |  I can concentrate on getting the hardware done, and then the artist can work on it,
1098.45s - 1103.45s |  and then art can literally slap on at the very end.
1103.45s - 1105.45s |  I think that's it.
1105.45s - 1108.45s |  Nope, I guess I do have one more slide.
1108.45s - 1113.45s |  One of the tricks about it is time and temperature make a big difference.
1113.45s - 1117.45s |  So I always have to make sure that I have enough extra boards so that I can try out,
1117.45s - 1122.45s |  okay, do I need to go a little hotter, do I need to go longer so that I get the best color transfer?
1122.45s - 1125.45s |  Because it can vary wildly, as you can see in these images.
1125.45s - 1132.45s |  So, again, really hard to get that deep black color, but it's really easy to not get the deep black color.
1132.45s - 1137.45s |  And the whole setup for me, anyway, under $250, I'm all in on this.
1137.45s - 1142.45s |  It's approachable by the home gamer to put this together.
1142.45s - 1145.45s |  It's not overly painful to do this process.
1145.45s - 1154.52s |  I think I've done like 100 panels in about four hours and been okay with that.
1154.52s - 1157.52s |  All right, so this is formatted as a panel.
1157.52s - 1163.52s |  So if anybody has any questions, I'd ask that we kind of come up and form a line.
1163.52s - 1169.52s |  If you don't have any questions, I've got some that I can ask the panel.
1169.52s - 1172.52s |  So, yeah.
1172.52s - 1175.52s |  We'll start off with a couple of those.
1175.52s - 1176.52s |  So a question for Panda.
1176.52s - 1180.52s |  How long does it take to fully color one batch?
1180.52s - 1189.52s |  So depending on how you place those PCBs or the bed, for me it takes a minute if I use the entire bed,
1189.52s - 1192.52s |  which was like two feet by three feet.
1192.52s - 1198.52s |  Could be like one and a half minutes if we use maybe half the bed or something.
1198.52s - 1200.52s |  Got a couple people up here.
1200.52s - 1203.52s |  Panda, I'm going to steal your mic actually.
1203.52s - 1205.52s |  I think they've got a mic down there maybe.
1205.52s - 1221.99s |  Yeah, go ahead.
1221.99s - 1226.34s |  I think there's a mic on the floor there for that.
1226.34s - 1238.45s |  So you guys have talked about how there's different issues with color quality across the different methods.
1238.45s - 1247.41s |  If you wanted to do, does that come into these different methods as well?
1247.41s - 1254.62s |  Have you seen sort of like one method is more capable than others for that?
1254.62s - 1259.62s |  He's asking if you have to worry about matte versus shiny.
1259.62s - 1270.84s |  Yeah, so the question was you guys focused on color quality, but what about finish like matte versus shiny?
1270.84s - 1272.84s |  How can you kind of control that?
1272.84s - 1274.84s |  And do you want that from all three of us?
1274.84s - 1275.84s |  Okay.
1275.84s - 1276.84s |  So I'll start.
1276.84s - 1281.84s |  So in the world of silk screening, it's going to be one finish.
1281.84s - 1284.84s |  It's going to be sort of a semi.
1284.84s - 1290.84s |  The truth is in silk screening, I am using actual PCB UV ink.
1290.84s - 1296.84s |  So it's going to be the same as your solder mask, the same as your silk screen that you'd get from a PCB manufacturer.
1296.84s - 1300.84s |  Most of the time, that's going to be a fairly glossy finish.
1300.84s - 1304.84s |  It's possible to add a matting agent to it.
1304.84s - 1309.84s |  But in general, because this is more, in my case, it's more art than science.
1309.84s - 1311.84s |  That's going to be very variable.
1311.84s - 1314.84s |  So my default is I would never try for a matte finish.
1314.84s - 1320.84s |  I'm always going to get the default glossy finish of a UV ink.
1320.84s - 1321.84s |  Yeah, similar for me.
1321.84s - 1328.84s |  It's going to be whatever the surface of the PCB is since it's so small amount of ink that's getting transferred over.
1328.84s - 1337.18s |  So whatever that standard silk screen or solder mask layer is going to be, it's going to end up being like that.
1337.18s - 1338.18s |  Right.
1338.18s - 1342.18s |  So for the UV printing, the default is matte finish.
1342.18s - 1345.18s |  But I have this one example here where we tried.
1345.18s - 1351.18s |  So this is like UV printed on an actual surface and then we put like a varnish coating on it.
1351.18s - 1356.18s |  So that has brought in a little bit of glossy finishing to it.
1356.18s - 1364.18s |  If not that, then you can try putting like an acrylic layer and that has like nothing gets more glossier than this.
1364.18s - 1367.18s |  So this is like the gold standard of being glossy.
1367.18s - 1371.18s |  But as far as UV printing goes, the default is matte finish.
1372.18s - 1374.18s |  OK.
1374.18s - 1377.18s |  I have a question for Panda.
1377.18s - 1387.18s |  Brayden was saying that you reflow or not reflow, but you pass your boards under the UV light on a custom conveyor thing.
1387.18s - 1392.18s |  So one question is, doesn't the UV printer cure the ink as it's printing?
1392.18s - 1394.18s |  So why would it need to go through a second time?
1394.18s - 1398.18s |  And also, I forgot my other question.
1398.18s - 1399.18s |  So that's the only one I got.
1399.18s - 1400.18s |  Thanks.
1400.18s - 1401.18s |  Yeah.
1401.18s - 1412.18s |  So when we were experimenting with the screen printing and we're trying to put more and more layers on colors basically on top of one another.
1412.18s - 1415.18s |  And so we wanted a faster way to cure those colors.
1415.18s - 1422.18s |  So we built that custom UV curing conveyor belt.
1422.18s - 1430.18s |  And that was when we were using, we use it right now for the masking ink, usually on the backside of the board.
1430.18s - 1436.18s |  And for the UV printing, of course, the UV printer, it cures the ink instantly when you use the UV printer.
1436.18s - 1442.18s |  So it sprays the color from one nozzle and then it goes back and forth and back and forth.
1442.18s - 1445.18s |  And the curing time for it is like instant.
1445.18s - 1446.18s |  It doesn't take too long.
1446.18s - 1451.18s |  So there's two UV curing now we are doing it, one for masking and then one for UV.
1451.18s - 1453.18s |  And I remember my other question.
1453.18s - 1456.18s |  So you said you printed on the bed to align.
1456.18s - 1460.18s |  Are you doing like a full print or are you just kind of doing like an outline print?
1460.18s - 1461.18s |  Yeah.
1461.18s - 1469.18s |  So when we're using the full bed, sometimes we're able to fit like 50 or 60 badges depending on the size.
1469.18s - 1473.18s |  So we typically print on the entire bed.
1473.18s - 1475.18s |  But are you printing full color?
1475.18s - 1478.18s |  Yeah, we're printing full color on the entire bed.
1478.18s - 1479.18s |  Why?
1480.18s - 1487.18s |  We need to do that, one, because we need to ensure the print is coming out right and it has enough resolution.
1487.18s - 1489.18s |  Second, the color correction on it.
1489.18s - 1497.18s |  So sometimes we put like a banner, which is like your standard, you know, banners and white color banner.
1497.18s - 1505.18s |  And you just basically print on that banner and you have better color correction when you print on that.
1506.18s - 1517.18s |  So once we print on just the bed and then we just keep the PCBs on it and then at the exact spot and print it once more.
1517.18s - 1518.18s |  Thank you.
1518.18s - 1520.18s |  Yeah, thank you.
1520.18s - 1522.18s |  Yes, this is one of the badges we did.
1522.18s - 1526.18s |  We combined FR4 with masking.
1526.18s - 1530.18s |  So the side, the portion where there are LEDs, that's like FR4.
1530.18s - 1533.18s |  And the rest of the PCB is like proper white masking.
1533.18s - 1539.18s |  So that was like a combination and more explanation on how we print.
1539.18s - 1546.18s |  For UV printing, can you print transparently if you wanted to avoid printing on top of LEDs that were already populated?
1546.18s - 1547.18s |  Certainly.
1547.18s - 1553.18s |  So the way UV printer works is that it prints the file that you provide.
1553.18s - 1560.18s |  And so when we want that a certain area should not be printed, we need to make that area transparent.
1560.18s - 1563.18s |  And that can happen only in PNG format.
1563.18s - 1569.18s |  So the trick here is you need to, one, you need to make sure you have a good source file.
1569.18s - 1577.18s |  And when you have the good source file, you convert that to really high-risk PNG with close to 500 dpi.
1577.18s - 1583.18s |  And you make those areas transparent where you do not want the print.
1583.18s - 1587.18s |  And how high does the printhead traverse?
1587.18s - 1595.18s |  Like if you had potentiometers or something that were high and populated already, can you adjust the height or how does it work?
1595.18s - 1597.18s |  Adjust the height of the?
1597.18s - 1599.18s |  Of the printhead that's sweeping over it.
1599.18s - 1604.18s |  You can adjust the height of the printhead, but I don't think it will make a difference for potentiometer.
1604.18s - 1611.18s |  So either way, it's still going to get printed on if you don't have that removed in the file.
1611.18s - 1614.18s |  If you don't have that transparent in the file.
1614.18s - 1617.18s |  So the printhead is how high off the board typically?
1617.18s - 1620.18s |  That's typically like 5 to 10 centimeters high.
1620.18s - 1622.18s |  It's not too much.
1622.18s - 1625.18s |  So can you raise that if you had a higher component?
1625.18s - 1633.18s |  You can raise that, but we haven't played around with that because almost all of our badges are totally flush on front side.
1633.18s - 1638.18s |  We don't put components on front side to avoid the issue in the first place.
1638.18s - 1648.18s |  But a good turnaround for that is you just make those areas transparent in the PNG file and that should avoid printing over it.
1648.18s - 1651.18s |  Are there any concerns with printing on both sides?
1651.18s - 1653.18s |  I mean, I guess you just flip it over and it acts like any other.
1653.18s - 1654.18s |  No, not at all.
1654.18s - 1664.18s |  The only concern is you have to deduct each and every single component if you don't want to be printing on those components, on top of those components.
1664.18s - 1669.18s |  So that is just a lot of manual work, so to speak.
1669.18s - 1671.18s |  Okay, this is going to be a little weird.
1671.18s - 1675.18s |  As a panel member, I'm going to ask a question of everybody on the panel.
1675.18s - 1687.18s |  So for each of these three techniques, when do you color the PCB in the assembly process?
1687.18s - 1692.18s |  Yeah, for the die sublimation, I color a PCB just before I assemble them.
1692.18s - 1696.18s |  So it'll be close to the last thing I do.
1696.18s - 1699.18s |  I've already populated everything.
1699.18s - 1702.18s |  It's ready to be bolted together or whatever is needed.
1702.18s - 1707.18s |  So it's very tail end of things.
1707.18s - 1710.18s |  Yeah, so for UV, it's similar.
1710.18s - 1712.18s |  It's right in the end.
1712.18s - 1717.18s |  Sometimes it is before the assembly and sometimes it's right after the assembly.
1717.18s - 1720.18s |  It depends on the artwork.
1720.18s - 1726.18s |  And that's actually why I wanted to ask the question because in the case of traditional silk screening, it's the very first process.
1726.18s - 1734.18s |  So literally as soon as my PCBs arrive from the manufacturer, I run them through the silk screening process because they're completely tolerant of heat.
1734.18s - 1739.18s |  No matter how much heat I bake into them, it doesn't matter because it's solder mask inks.
1739.18s - 1745.18s |  And so I do it before I even start the whole process of paste and population and reflow.
1745.18s - 1749.18s |  So mine's at the very beginning of the process rather than anywhere in the middle or the end.
1750.18s - 1752.18s |  Yeah.
1752.18s - 1753.18s |  All right.
1753.18s - 1756.18s |  If you guys don't have any further questions, I've got some more.
1756.18s - 1760.18s |  So this question is for Hamster.
1760.18s - 1768.18s |  If I'm ordering badges, how many extras should I order to print and test and perfect the process?
1768.18s - 1769.18s |  Yeah, that's a good question.
1769.18s - 1775.18s |  I typically try to order like an extra between 25 and 30 blanks.
1775.18s - 1786.18s |  And usually I will end up using the front and back of them to try to get to dial in color temperature, trying to dial in artwork, registration.
1786.18s - 1795.18s |  If you're still wishy-washy about what you want the design to look like and you want to see it on the real thing, you might consider bumping that number up a little bit.
1795.18s - 1805.18s |  I usually do runs of about 100 badges, so it is a substantial amount, but cost-wise, it's really not much money.
1805.18s - 1806.18s |  Okay.
1806.18s - 1810.18s |  This is a question for Panda, but you might all answer this.
1810.18s - 1815.18s |  Any failure stories and any interesting ways you corrected them?
1815.18s - 1819.18s |  We have had some failure stories all the time.
1819.18s - 1823.18s |  And if you go back to slides.
1823.18s - 1826.18s |  How do you...
1826.18s - 1827.18s |  Let me...
1827.18s - 1835.18s |  Yeah, so when we started, one of the first challenges, of course, the ink turning yellowish after you reflow.
1835.18s - 1842.18s |  And that we figured out, maybe we'll just print it after assembly and that solved the problem.
1842.18s - 1851.18s |  And then the other time, we just kept experimenting to find the accurate temperature to reduce the impact as much as possible.
1851.18s - 1854.18s |  So there are some badges here.
1854.18s - 1865.18s |  So some of the badges shown here, we did a lot of refining with each badge and every process.
1865.18s - 1874.18s |  So one of the badge, in particular, we had seen it had like a flaking off or like a peeling off issue.
1875.18s - 1879.18s |  And we chose the Wombat badge, actually.
1879.18s - 1882.18s |  It was from a conference called B-Sides AdLib.
1882.18s - 1889.18s |  And so what happened is we couldn't figure out why, because it never happened before.
1889.18s - 1893.18s |  And the coating started to kind of peel off.
1893.18s - 1898.18s |  And so we talked to the manufacturer and we asked, what the hell is this?
1898.18s - 1900.18s |  And they were like, we don't know.
1900.18s - 1904.18s |  We have never given you inks for like the PCBs and stuff.
1904.18s - 1907.18s |  And so we started getting into it.
1907.18s - 1914.18s |  And they were like, yeah, maybe it has to do with moisture in Australia or like the heat or even part of it outdoors.
1914.18s - 1916.18s |  So maybe it was outdoor heat in Australia.
1916.18s - 1922.18s |  So we kept going through it and we still don't know exactly why it happened.
1922.18s - 1928.18s |  But we tried recreating it and we couldn't recreate.
1928.18s - 1934.18s |  So that is one of like a small failure story, so to speak.
1934.18s - 1938.18s |  And eventually we realized we could just avoid printing the masking at all.
1938.18s - 1941.18s |  And then we just print on FR4 plate.
1941.18s - 1943.18s |  And that seemed to fix the problem.
1943.18s - 1950.18s |  I think it was due to the ink being printed on a glossy surface that was resulting in those things.
1950.18s - 1958.12s |  Yeah, I'd say for me, man, I hate inkjet printers.
1958.12s - 1963.12s |  The problem is that a lot of times is my Dice-Up printer will sit for a long time.
1963.12s - 1970.12s |  And if I don't remember to print a nozzle check once in a while, I start to lose nozzles.
1970.12s - 1980.12s |  And it really sucks when you're counting on the thing and you go to print it and half your nozzles aren't printing and the color is coming out wrong and you're under the wire.
1980.12s - 1985.12s |  There is a process out there for doing laser, for doing Dice-Up with laser.
1985.12s - 1988.12s |  But the cartridges are way more expensive.
1988.12s - 1995.12s |  Dice-Up ink is like $40, gets you like 400mm bottle or 100ml bottles of ink.
1995.12s - 1999.12s |  But the laser process, you're looking at like $500 in toner.
1999.12s - 2004.12s |  But yeah, I wish I could get rid of the inkjet printer part of it.
2004.12s - 2013.12s |  Outside of that, some of the very early runs I did, I didn't really take into account how many boards I would need to test to get the color.
2013.12s - 2016.12s |  Or get the time and temperature correct.
2016.12s - 2023.12s |  And I just about ran out of boards trying to get it down before I started eating into the actual production run.
2023.12s - 2032.30s |  Probably the biggest process problem I ran into, and I never would have thought this was the case, was registration.
2032.30s - 2039.30s |  And it isn't the registration of my silkscreen to my PCB.
2039.30s - 2047.30s |  It turned out the fact that, as I pointed out in mine, I have the black and the white printed by the PCB manufacturer.
2047.30s - 2049.30s |  And then I do the colors on top of that.
2049.30s - 2061.30s |  Which means my registration of my silkscreen art has to be 100% accurate to whatever process the printed circuit board manufacturer did.
2062.30s - 2073.30s |  And I found that for whatever reason, my nice high-quality laser printer has about a 1.5% error in one axis only.
2073.30s - 2080.30s |  Which meant I have to go back and scale my artwork and stretch it in one axis only.
2080.30s - 2088.30s |  To get my art that goes onto the silkscreen to match up with the art that came from the PCB manufacturer.
2088.30s - 2091.30s |  And I had never anticipated that that would be a problem.
2091.30s - 2095.30s |  Once I found it and documented it, it was easy to resolve.
2095.30s - 2098.30s |  But that was the one thing I never anticipated happening.
2098.30s - 2109.30s |  What I did find that makes my life a lot easier is the UV inks, both for the emulsion on my silkscreen and then the UV ink itself.
2109.30s - 2116.30s |  I started out with the traditional darkroom set with the amber lights and the timers and all that stuff.
2116.30s - 2121.30s |  Because I was afraid of things getting overexposed or exposed out of sync and stuff.
2121.30s - 2123.30s |  I found out the stuff is really, really tolerant.
2123.30s - 2128.30s |  So I just do it in my garage with the lights turned off on a cloudy day and it's fine.
2128.30s - 2131.30s |  The exposure of my screens is about eight minutes.
2131.30s - 2140.30s |  And so what I do is I wash out all my old screens in one day, dry them out and then apply an emulsion to them and stack them in a box.
2140.30s - 2143.30s |  And two or three months later when I need a screen, I pull it out.
2143.30s - 2148.30s |  I put the artwork on it and I expose it and then it sits until the PCBs arrive.
2148.30s - 2152.30s |  So I can do things in stages, which saves me a lot of time.
2152.30s - 2160.30s |  But the alignment of my laser printer to what the Chinese company did to the PCBs, I never anticipated that that would be an issue.
2160.30s - 2167.71s |  So this question is for Braden again.
2167.71s - 2176.71s |  So along that same line of getting started, what did you need to get started and what special equipment did you add and why?
2179.06s - 2182.06s |  So when I started, I looked at it as traditional silk screening.
2182.06s - 2191.06s |  And so I just went online and bought, I think I started originally with a 230 mesh because I found an article that said, you know,
2191.06s - 2197.06s |  you get sort of good accuracy and fairly high resolution with a 230 mesh screen.
2197.06s - 2201.06s |  And those screens are $17 or $18 a piece.
2201.06s - 2203.06s |  And I bought, I think, two of them.
2203.06s - 2205.06s |  And so that was my initial.
2205.06s - 2211.06s |  And then I realized, OK, you can get emulsion films, but they're expensive and stuff.
2211.06s - 2214.06s |  But a tub of emulsion will last me years.
2214.06s - 2216.06s |  And it cost me $12 or $15.
2216.06s - 2219.06s |  And a squeegee was $3 or $4.
2219.06s - 2224.06s |  And a UV lamp was, I think, $18 or $20.
2224.06s - 2227.06s |  And that's all I had to get started.
2227.06s - 2232.06s |  Along the line, to make things go faster, you know, I got two more screens.
2232.06s - 2234.06s |  And eventually I got two more after that.
2234.06s - 2244.06s |  And the last two I went to a 305 mesh, which is basically it's 300 dpi in screen format.
2244.06s - 2253.06s |  And instead of using one LED UV lamp that is rated at, I think, 60 or 75 watts, I went to two.
2253.06s - 2259.06s |  And eventually I'm now at four that sit inside my reflow oven in a conveyor.
2259.06s - 2264.06s |  The one thing that Panda taught me that was really useful was the proximity of the UV lamps to the board.
2264.06s - 2266.06s |  I started out at, like, eight inches.
2266.06s - 2269.06s |  And it was taking forever for me to cure my boards with the ink on it.
2269.06s - 2273.06s |  I got it down to about 10 or 15 centimeters, which is about a half inch.
2273.06s - 2277.06s |  And then it was, like, really fast.
2277.06s - 2283.06s |  But to get started, it was probably $65 or $70.
2283.06s - 2290.06s |  And I would probably say I'm into it now for $250 or $300.
2290.06s - 2301.06s |  I started out, I found out that literally the little 100 milliliter container of UV ink in each color was more than enough to do hundreds of boards.
2301.06s - 2307.06s |  So I didn't need the big, you know, one kilo tub of ink.
2307.06s - 2311.06s |  The little ones were more than enough to get me through all my designs.
2311.06s - 2313.06s |  This is for Hamster first.
2313.06s - 2321.06s |  Speaking of quantity, how viable is it for you to do, like, 100 badges versus 500 badges?
2321.06s - 2325.06s |  So, like, scaling, time, things like that.
2325.06s - 2329.34s |  Yeah, I don't know if this mic is still on.
2330.34s - 2332.34s |  There you go.
2332.34s - 2336.34s |  Yeah, so it's fairly scalable.
2336.34s - 2339.34s |  Doing 100 boards isn't painful.
2339.34s - 2345.34s |  If I was doing 1,000 boards, I'd probably rethink a lot of things beyond just trying to put color on it.
2345.34s - 2348.34s |  But a lot of the process is kind of automated.
2348.34s - 2350.34s |  Like, you have to print out.
2350.34s - 2353.34s |  You have every single board has to get a printout.
2353.34s - 2356.34s |  So you have that time to bake into it.
2356.34s - 2365.34s |  But, you know, the printer can go off and do its thing unless you've got a printer like mine that every fifth sheet decides that it can't recognize one of the color tanks.
2365.34s - 2374.34s |  And then you have to tape each one of them individually onto each printed thing and then put it through the heated T-shirt press.
2374.34s - 2383.34s |  You kind of get into a rhythm, but I probably wouldn't want to do more than, say, 250 boards through this process without rethinking life.
2384.34s - 2385.34s |  Okay.
2385.34s - 2388.34s |  Did either of you want to answer that one?
2388.34s - 2393.34s |  It's like, again, how well does it scale and how does it impact time to do more?
2393.34s - 2397.34s |  I think in terms of scale, it's extremely scalable.
2397.34s - 2410.34s |  We have done, like, the thing is it just takes, like, initial setup, as I said, to set up the bed and to do the alignment and do the initial print and that.
2410.34s - 2415.34s |  But afterwards, it's just about printing on and on.
2415.34s - 2421.34s |  So it doesn't make a difference if you do 100 or you do 10,000.
2421.34s - 2426.96s |  So it's very, very scalable.
2426.96s - 2429.96s |  For me, the scalability comes down to the size of the PCB.
2429.96s - 2441.96s |  So if the PCB is so big that I can only put one under the silkscreen at a time, then the squeegeeing process takes, you know, 10 or 15 seconds, lifting the board out, putting it away.
2441.96s - 2444.96s |  And so, you know, there's a lot of manual steps.
2444.96s - 2449.96s |  When I did the first e-challenge coin, I did the silkscreening in panel form.
2449.96s - 2453.96s |  So all of a sudden, that one squeegee was four challenge coins at a time.
2453.96s - 2459.96s |  If I had done those panels at eight, it would be eight challenge coins in that same 15 seconds.
2459.96s - 2471.96s |  So from that standpoint, my scalability comes down to the manual labor, and it really comes down to how many of the end unit PCBs can I fit on my silkscreen in one shot.
2471.96s - 2474.96s |  And that's the only way I can scale.
2474.96s - 2487.96s |  From a reality standpoint, 100 boards or 100 panels is fairly easy because, like I said, they take, you know, 20 or 30 seconds maximum between them.
2487.96s - 2490.96s |  So that was fairly easy.
2490.96s - 2497.96s |  And because the e-challenge coin, there was four coins on a panel, that was 400 coins.
2497.96s - 2499.96s |  And so that went fairly quickly.
2499.96s - 2511.24s |  But if I had had to do a board that I could only put one, you know, one badge down at a time, you know, I probably would start to rethink after about 100 or 150.
2511.24s - 2512.24s |  All right.
2512.24s - 2515.24s |  This one's for Panda.
2515.24s - 2519.24s |  You've made a lot of different badges, and it seems like you've experimented a lot.
2519.24s - 2524.24s |  Can you tell us about your experiments with different materials and boards?
2524.24s - 2530.24s |  Right.
2530.24s - 2537.24s |  So over there on the corner, we have the owl badge, the red one.
2537.24s - 2543.24s |  And that was the combination of gold plated PCB with the gemstone on it.
2543.24s - 2553.24s |  And the gemstone was like, well, like the main focus of it was like the point was to make the PCB as special as possible.
2553.24s - 2558.24s |  So there was that combination of gemstone and U printing and gold plating.
2558.24s - 2565.24s |  There's a Budobot badge, which is like red and there's a white, it's called hurricane in it.
2565.24s - 2571.24s |  So that was a really interesting, like a crash course in light diffusion.
2571.24s - 2573.24s |  And I hated that topic in school.
2573.24s - 2581.24s |  And so what happened is they had this idea, they were basically like, we want to make a digital version of our logo.
2581.24s - 2588.24s |  It needs to glow as brightly as possible at every inch on it.
2588.24s - 2594.24s |  No glow spots and no shadow spots on it, which is what typically what happens in PCBs.
2595.24s - 2600.24s |  So we just filled the board with red and white LEDs at first, and then we are testing it.
2600.24s - 2609.24s |  And we put one layer of acrylic and we can see that some spots are glowing too high and then some spots are like not glowing too high.
2609.24s - 2615.24s |  And as a result, the spots with more glow were like yellowish and the others were like reddish.
2615.24s - 2621.24s |  And so we kept reiterating and then we were thinking, well, how can we make this better?
2621.24s - 2628.24s |  And so we put one layer of white on the bottom and then we print the artwork once again.
2628.24s - 2632.24s |  And we see how that turns out and that seemed to improvise.
2632.24s - 2634.24s |  We were like, OK, cool.
2634.24s - 2637.24s |  So let's do one more layer.
2637.24s - 2640.24s |  And so and that seemed to improvise further.
2640.24s - 2646.24s |  So now we are at three UV print layers on the bottom and then one UV print layer on the top.
2646.24s - 2649.24s |  And that is how that badge ended up becoming.
2649.24s - 2653.24s |  It was like a four layer on top of one another on an acrylic.
2653.24s - 2664.24s |  And that is mounted with a screw on a PCB to distribute all that glow to just as equally as that we wanted.
2664.24s - 2667.24s |  So there was that badge.
2667.24s - 2679.24s |  There was, of course, the Pacific Hackers I talked about, a combination of FR4 on the side with LEDs behind it and just the masking for the most part.
2679.24s - 2684.24s |  There's Wombat with a drill hole right in the center.
2684.24s - 2690.24s |  And so we, over the course of time, we did a fair amount of experiments.
2690.24s - 2693.24s |  Yeah, that should be it.
2693.24s - 2695.24s |  Quick follow up to that.
2695.24s - 2701.24s |  Yours is obviously the probably the most costly of all the setups in terms of equipment.
2701.24s - 2709.24s |  So what would you say equipment that you're using here to do UV printing would cost if you were to build your own?
2709.24s - 2714.24s |  Right. So the first printer we bought, it was still a local brand.
2714.24s - 2717.24s |  And that was just all right.
2717.24s - 2720.24s |  We did. There's an astronaut badge in the bottom.
2720.24s - 2723.24s |  We did that with that printer.
2723.24s - 2726.24s |  There's a world global thing.
2726.24s - 2730.24s |  And that badge we did with that printer, they turned out OK.
2730.24s - 2736.24s |  But I had this really bad thought of it. It's not it's not printing black, blacker enough.
2736.24s - 2740.24s |  And so we go out and try to make it better.
2740.24s - 2747.24s |  And the first UV printer we bought was close to $10,000.
2747.24s - 2753.24s |  And then somehow we thought we had to keep doing better and we had to keep improvising.
2753.24s - 2761.24s |  So we went ahead and bought another printer which was much larger and could do badges faster and print faster.
2761.24s - 2765.24s |  And that was another $10,000 in the hole.
2765.24s - 2772.24s |  So and we figured that it still wasn't actually there where we wanted.
2772.24s - 2776.24s |  And so we take out his head and we put an Epson head on it.
2776.24s - 2784.24s |  So now it's our own custom badge UV printer with so much of funds went into it that it's now.
2784.24s - 2788.24s |  Yeah, it's a white elephant for us, but it's a lovely white elephant.
2788.24s - 2791.24s |  I love that machine. So.
2791.24s - 2797.24s |  So, yeah. So if you want a good UV printer, there's typically they start at $10,000.
2797.24s - 2801.24s |  If you want the really, really fancier ones, those are like $50,000.
2801.24s - 2804.24s |  But, you know, you don't need that. That would be like overkill.
2804.24s - 2814.24s |  So a standard one somewhere, if you just want to make one badge a year, that I think should be around $5,000 or something.
2814.24s - 2820.24s |  But don't take my word for it. The ink varies what the manufacturer recommends you for inks.
2820.24s - 2825.24s |  Those inks vary and the cost varies. And as I said, it's a really high maintenance machine.
2826.24s - 2834.24s |  So you can't you can't push it in a storage unit for a year and expect it to work on like 365 days.
2834.24s - 2839.24s |  So, yeah, it's a lot of heavy use, heavy maintenance thing. Yeah.
2839.24s - 2843.24s |  So that should give some idea. All right.
2843.24s - 2846.24s |  This will be my last question. We've got about four minutes left.
2846.24s - 2853.24s |  So you each chose your own printing method. Starting with you, Brayden, would you choose the same method again?
2853.24s - 2860.24s |  Would you would you use silk screening again or would you maybe consider one of your your colleagues printing methods here?
2860.24s - 2872.24s |  Yes. I like the artistic side of silk screening and I will do it again.
2872.24s - 2876.24s |  I will pick a project very carefully for it or vice versa.
2876.24s - 2883.24s |  I will pick the process of color very careful for the project that I want to do.
2883.24s - 2889.24s |  And I'll be totally honest. So I originally had planned to do what is now the D.C.
2889.24s - 2893.24s |  Next Gen badge using traditional silk screening.
2893.24s - 2903.24s |  There was a decision made fairly late in the game where they needed very specific Pantone accurate color.
2904.24s - 2907.24s |  And I couldn't guarantee that in my technique.
2907.24s - 2914.24s |  It just I mean, I could have tried, but it would have been a massive amount of trial and error to get to an accurate Pantone color.
2914.24s - 2923.24s |  And so ultimately for that badge, I transitioned to a manufacturer to do the UV printing for me.
2923.24s - 2931.24s |  And so if I either have to scale very large on a large badge, I would use UV printing.
2931.24s - 2936.24s |  But I would like to do silk screening, knowing now where it works well and where it doesn't work.
2936.24s - 2943.24s |  And so don't be surprised if you see at least one next year that's traditional silk screening.
2943.24s - 2949.24s |  I like the art side of it. It's a it's a very tactile experience to play with inks.
2949.24s - 2960.93s |  Yeah, I I like hacking with a process and silk screening sounds scary, which means I really want to try it now.
2960.93s - 2969.93s |  So I may have a process next year where I do partial silk screen and then dye sublimation because I got to keep that inkjet printer from clogging up anyway.
2969.93s - 2983.98s |  Yeah, I think we've been doing silk screening a lot of times when we started and really trying to do something unique every time.
2983.98s - 2990.98s |  But as the number of badges grew, we kept realizing we had to find something more scalable.
2990.98s - 3002.98s |  And UV printing was that unexpected moment that helped us scale to the scale where we are making almost a badge or many badges a month somewhere across the world.
3002.98s - 3015.98s |  So even if I wanted to, maybe for a smaller limited badge runs, I would really love to go back to silk screening and try to do some stuff there.
3015.98s - 3029.45s |  But as the situation is right now, we can't let go of UV printing for the scalability and the efficiency and speed that it offers.
3029.45s - 3035.45s |  All right. I think that I think that does it for our questions. Any final questions from the audience?
3035.45s - 3043.18s |  It looks like a no. So thank you very much to our panelists. We appreciate you guys sharing your knowledge.
3043.18s - 3046.18s |  And that's it. Thank you.


url: https://www.youtube.com/watch?v=tJyH6FDFy_E
title: DEF CON 32 - Famous and Not So Famous Unsolved Codes - Elonka Dunin & Klaus
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=tJyH6FDFy_E",
  "title": "DEF CON 32 - Famous and Not So Famous Unsolved Codes  - Elonka Dunin & Klaus",
  "description": "There are many famous codes and ciphers still waiting to be solved, such as the encrypted Voynich manuscript and Edward Elgar's Dorabella cipher. All hold a special fascination. In this talk, prepare to be entertained and informed by Elonka Dunin and Klaus Schmeh, as we briefly discuss the encryption on Kryptos, the mysterious sculpture at the center of CIA Headquarters; NKrypt, an encrypted sculpture in Australia; an encrypted engraving on an early 20th century German silver cigarette case; details about the message attached to the leg of a WWII carrier pigeon that was found in an English chimney; an encrypted postcard by the owner of UK's Luton soccer team; and the intriguing encrypted messages created by the mysterious Henry Debosnys while awaiting his murder trial in New York in the late 1800s.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2971,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.32s | This text was transcribed using whisper model: large-v2

 Welcome, everyone. Today, our last day of DEF CON, congratulations on surviving.
8.24s - 16.16s |  We're going to be talking about famous and not so famous unsolved codes. So I am Ilan Kadunin,
16.16s - 22.00s |  and I am a game developer and a crypto authority and a book author and...
22.56s - 28.48s |  Hello, I'm Klaus Schmee. I'm a German IT security expert, crypto expert,
28.48s - 34.56s |  crypto history expert and book author. Right. And together, we wrote a couple books,
35.28s - 42.32s |  one of which is Codebreaking, a practical guide, which I believe is sold out in the vendor hall
42.32s - 47.52s |  right now. They might have like one copy left. And it came out in September of last year. So
47.52s - 53.28s |  we're going to be going through a very small number of unsolved encrypted messages,
54.16s - 65.66s |  starting with one of my favorites. Cryptos. This is Langley, Virginia, CIA headquarters.
66.22s - 72.22s |  And that white building with the funny shaped roof is the cafeteria. And outside the windows
72.22s - 79.02s |  of the cafeteria, there is a green landscaped area with a sculpture called Cryptos. It was
80.62s - 89.58s |  commissioned in 1988, installed in 1990. And it has an encrypted inscription on it. And there are
89.58s - 99.74s |  four parts. So the sculptor was or is Jim Sanborn. And the designer of the ciphers on it is Ed Scheidt.
100.46s - 109.90s |  I've met both of them. Jim Sanborn, no public list of his works really existed until I started
109.90s - 115.50s |  making one around 2003. And then he kind of called me up and he said, Who are you? And why do you
115.50s - 123.02s |  have a web page about me? And I explained that I was a big fan. And now we're getting along much
123.02s - 131.34s |  better. And Ed Scheidt, also he's listed as the retired chairman of a CIA cryptographic center.
131.90s - 139.18s |  There is no CIA cryptographic center, but he is. He's a spook. Okay. He's been involved with the
139.18s - 146.14s |  CIA for a long time. So the inscription, I won't go into great detail about how these are made.
146.14s - 154.70s |  We kind of number them K1 through K4. And we solved the first three parts. The fourth part
154.70s - 160.54s |  has not been solved yet. So it is one of the most famous unsolved codes in the world. And
160.54s - 168.54s |  Sanborn has actually given us some clues about it. He gave us the clue that in 2010,
169.18s - 176.14s |  that starting at the 64th character, there is the word Berlin. And after that, we have the word
176.70s - 183.10s |  clock. So there's been a lot of research done on clocks in Berlin. And then in January 2020,
183.10s - 188.38s |  he gave us another clue, the word Northeast. And then the pandemic started and he kind of wanted
188.38s - 195.34s |  to stir things up. And so he gave another clue, which is the word East. So it's kind of embarrassing
195.34s - 202.46s |  now because we have a big chunk of what is supposedly the deciphered text, and we still
202.46s - 210.70s |  don't know what it says. So the cryptos I should also mention is a big part of a book by Dan Brown,
210.70s - 217.82s |  who wrote the book, The Da Vinci Code in 2003, which and this sequel, The Lost Symbol takes
217.82s - 226.30s |  place in Washington, DC, published in 2009. And it does feature both cryptos and Freemasons as
226.30s - 233.42s |  recurring themes. And in the book, there is a character named Nola K, which he put in there,
233.42s - 239.98s |  he named after me. So it's sort of a scrambled version of my name there, because I helped him
239.98s - 246.46s |  with some of the research for the book. So why hasn't K4 been solved yet? Well, it's short,
246.46s - 255.58s |  it's just 97 characters. So it's very difficult. There may be a key that is only accessible on CIA
255.58s - 263.26s |  grounds, we might have missed something, we might have been misdirected. And he may have messed it
263.26s - 270.94s |  up, there might be a mistake that makes it unsolvable. So we have it on our list here as
271.50s - 273.42s |  an unsolved cryptomystery.
275.74s - 282.94s |  Okay, let's now come to the next cryptomystery, the so called de Bosnian cryptograms. Well, this
282.94s - 292.86s |  story takes us to the year 1882. And it takes place in New York State. Well, honestly, there
292.86s - 300.78s |  are not many pictures about this story. So I created a couple of pictures myself. I use Lego
300.78s - 311.34s |  for it. So the story takes place in Essex County, New York. And in the year 1882, a stranger came
311.34s - 320.14s |  to this place. His name was Henry de Bosnius. And after only a few weeks, he started courting
320.14s - 329.26s |  a widow who lived in this area. Her name was Elizabeth Wells. And after only a few weeks later,
329.98s - 336.54s |  the two married. So all this went pretty fast. And it was all already Henry de Bosnius third
336.54s - 344.94s |  marriage. His first two wives had died pretty early after the wedding. Now, he had found a
344.94s - 350.86s |  third wife. But again, the marriage didn't last very long because after only about five weeks or
350.86s - 361.34s |  so, his wife was found dead. She was both stabbed and shot. And well, it's no wonder that
361.34s - 367.50s |  Henry de Bosnius became the prime suspect. And all the events I told you about took place within
367.50s - 374.38s |  a very short timeframe. On May the 1st, Henry de Bosnius came to Essex County. Only five weeks
374.38s - 382.46s |  later, he married. And seven weeks later, his wife was murdered. And as I said, Henry de Bosnius
382.46s - 391.82s |  became the prime suspect. He was arrested, put into jail. And while he was in jail, he wrote a
391.82s - 398.78s |  couple of poems, a couple of other texts. He drew a few pictures. Apparently, he was quite good at
398.78s - 405.42s |  things like that. He knew a lot about literature. He spoke several languages. And he also was a
405.42s - 413.98s |  good artist. And in addition, he created a couple of encrypted messages. I will come back to this
413.98s - 425.42s |  later. Well, then he was put on trial. The trial started on January 20th, 1883. It ended with a
425.42s - 432.62s |  verdict. He was condemned to death on April 16th. And well, there's an interesting story about this.
433.50s - 441.42s |  Before he died, or before he went to execution, he sold his body to a local physician who could
441.42s - 449.02s |  use it for scientific experiments. And with the money he gained, he bought himself a suit so
449.98s - 458.06s |  he could die in a nice suit. And apparently, that was important to him. Well, he was hanged.
458.78s - 465.98s |  And as you can see here, he was hanged in his nice suit he had purchased with the money he had made.
465.98s - 474.14s |  And that was on April 27th, 1883. And somehow, well, as I said, he sold his body to a physician.
474.22s - 482.30s |  And somehow, his skull finally made it to a local museum, the Adirondack History Center Museum.
482.30s - 488.94s |  And there it can be seen along with the hangman's rope that was used. Well, this is certainly an
488.94s - 495.50s |  interesting case with a couple of open questions. For example, the first question, of course, is
495.50s - 502.86s |  was Henry de Bosnitz really guilty? Well, he probably was. He always denied being the murderer
502.86s - 510.70s |  of his wife. But apparently, there was enough evidence to find him guilty. Well, as I said,
510.70s - 517.02s |  his first two wives died pretty early too. So the question is, of course, did he murder them too?
517.74s - 524.46s |  We don't know. And who was he anyway? Because while on trial, he said, well, I'm not really
524.46s - 530.86s |  Henry de Bosnitz. This is only a pseudonym. I'm somebody else. This is not my true identity.
531.42s - 536.94s |  This might have been a lie. But it was not really clear who he really was. And his background was
536.94s - 543.26s |  not really clear. So there are a couple of questions. And maybe these questions could be
543.26s - 551.02s |  answered if it was possible to decipher the encrypted messages he created in jail. Well,
551.02s - 557.74s |  altogether, he created four messages, four cryptograms. As you see here, he also added a
557.74s - 566.06s |  couple of drawings. And as you can also see, these messages contain a lot of different letters.
566.06s - 574.94s |  So the alphabet he used was pretty large. And we have no clue what is written in these notes.
576.30s - 581.26s |  De Bosnitz, he spoke several languages, English, French, Portuguese, Latin, Greek. So it's not
581.26s - 589.42s |  even clear which plain text language he used. Of course, when one tries to solve an encrypted
589.42s - 595.74s |  message of this kind, it's always a good idea to look for crypts. And in this case, there is a
595.74s - 602.06s |  potential crypt. Because what you see here is a poem de Bosnitz wrote while in jail. And this
602.06s - 607.50s |  looks pretty similar as one of his encrypted messages. So maybe there's a one-to-one relationship.
608.46s - 615.90s |  If this really is the case, it would go a long way in solving the mystery. But so far, nobody
615.90s - 625.66s |  has really managed to match the two texts and to make sense of it. So maybe it is not a crypt,
625.66s - 630.38s |  or maybe the correct way to use this crypt hasn't been found yet.
631.26s - 637.74s |  So the message is still undeciphered. And so we are dealing with an unsolved,
637.74s - 642.78s |  more or less unsolved criminal case. And it's also an unsolved crypto mystery.
643.66s - 656.32s |  So next, we're going to go to something I find super interesting. This is from World War Two.
656.40s - 665.84s |  World War Two, a pigeon, a carrier pigeon was found in the chimney of someone in Surrey in
665.84s - 675.60s |  England. He found it in 1982, brought it to public attention and in 2012. So we think that the pigeon
675.60s - 685.76s |  was on its way to RAF Bomber Command in High Wycombe there. And the pigeon carried an encrypted
685.76s - 694.08s |  message. So carrier pigeons very briefly in World War Two were used extensively. There were over
694.08s - 702.72s |  250,000 that were being used. And there was even a special medal that was created for particularly
702.72s - 709.92s |  brave pigeons such as ones that took an injury and still managed to get to their destination.
710.48s - 717.28s |  This was a medal that was also given to other animals, dogs, horses, and even some cats received
717.28s - 725.28s |  it. So here's the message. It was in the and that's actually the the leg of the pigeon and a
725.28s - 733.52s |  red canister there. Red canisters tended to be used either by the United States forces or by the
733.52s - 742.16s |  British Army. And there's the code two, which we know was RAF Bomber Command in High Wycombe. And
742.16s - 748.48s |  these are the identifiers of the two pigeons. This was a message that was sent in duplicate.
749.20s - 759.04s |  The NURP there, N-U-R-P, meant National Union of Racing Pigeons. And then the 40 and 37 were the
759.04s - 767.04s |  years that these particular pigeons were banded. Then these were probably the the homes of the
767.04s - 773.12s |  pigeons where they were hatched and raised and then their number in that particular year.
773.92s - 783.44s |  So the T-W probably means either Twickenham or Tunbridge Wells and the D-K probably means
783.44s - 791.36s |  Dorking. Also we have, so of the numbers there, there's the number six, which would have been
791.36s - 799.92s |  the day of the month, which would tie in with D-Day, June 6, 1944. The time that the form was
799.92s - 806.48s |  filled in, the time that the message was created, and the number of copies sent.
807.92s - 813.68s |  So this section was in different handwriting, was probably filled in by someone else,
813.68s - 820.48s |  probably someone in France, as opposed to someone who was English. And that would tie in with that
820.48s - 828.08s |  word L-I-B, which would mean Libéré, the pigeon was freed at that particular time at 425.
829.04s - 836.24s |  And it was sent by a Sergeant Stott. And research shows that there was a Sergeant William Stott,
836.24s - 843.84s |  he was 27 years old, a paratrooper, and did parachute into occupied Normandy on a reconnaissance
843.84s - 850.24s |  mission on D-Day. So this was probably him sending a message back to home after that.
851.20s - 858.80s |  Now of this message, there are 27 groups of letters, five letters each. And we also know
858.80s - 868.32s |  that this A-O-A-K-N appears twice, both at the beginning and at the end. So what kind of system
868.32s - 874.56s |  might have been used? Well, there's several. It might have been a manual cipher, might have been
875.52s - 882.00s |  a codebook, or an encryption machine, or a one-time pad. There's several kinds of machines
882.00s - 889.76s |  that were used in World War II around the time. So we don't know. And so it is one of the unsolved
889.76s - 900.42s |  mysteries. Yes. And let's now look at another unsolved crypto mystery. This one takes us to
900.42s - 907.94s |  my home country, to Germany. To be more precise, it takes us to Thuringia, which is today one of
907.94s - 916.50s |  the 16 states of Germany. And a couple of years ago, a blog reader of mine contacted me and he
916.50s - 925.14s |  said, well, my family is from Thuringia. And for generations, we have possessed a cigarette case.
926.02s - 933.54s |  And this cigarette case, well, first of all, it bears this two-letter engravement here. These
933.54s - 940.02s |  letters stand for AES, but this is not the important part. In addition, it contains a
940.02s - 948.50s |  dedication, which was probably engraved here, probably not by a professional, but maybe by
948.50s - 955.94s |  the person who used this cigarette case as a gift, as a present for somebody. And apparently,
955.94s - 964.82s |  this dedication is encrypted. You can see it here. We have four lines of unknown symbols.
964.82s - 970.18s |  We have no idea how this can be read, how this can be deciphered. At least it's clear
970.90s - 980.98s |  that the date mentioned here is Christmas Eve, the 24th of December in 1909. And in Germany,
980.98s - 990.34s |  in my home country, Christmas presents are usually given on Christmas Eve. So my suspicion is that
990.34s - 998.18s |  this cigarette case was a Christmas present for somebody. And of course, as I already mentioned,
998.66s - 1002.98s |  when trying to break such an encryption, it's always good to look for crypts.
1002.98s - 1008.26s |  And if this really was a Christmas present, it seems possible that something like
1008.26s - 1015.54s |  Merry Christmas, or in German, Frohe Weihnachten, is included. But this crypt, if it is one,
1015.54s - 1021.94s |  hasn't helped so far. I can't find anything here that looks like Frohe Weihnachten. So
1022.90s - 1029.86s |  in my view, the whole cryptogram is pretty strange. Well, first of all, it's not strange at all.
1030.98s - 1038.50s |  Because there are many encryptions that look like this. Here you have a few on the right side,
1038.50s - 1044.18s |  you have a few encrypted texts from the same time. And I think the similarity is obvious.
1045.06s - 1050.50s |  These encrypted texts from the right side are from encrypted postcards. And it would be no
1050.74s - 1057.54s |  problem to add 100 more here. This is the kind of encryption that was used by people who wrote
1057.54s - 1064.18s |  encrypted postcards or maybe encrypted letters 100 years ago. And almost all of these encryptions
1064.18s - 1071.70s |  can be broken very easily today. So this dedication is an absolute exception because
1071.70s - 1077.06s |  it looks like all the encryptions from this time. But contrary to almost all others,
1077.62s - 1084.74s |  we have no idea how it can be deciphered. So it's something that looks easy,
1084.74s - 1090.50s |  but appears to be very difficult. If you have an idea on how this can be broken,
1091.06s - 1094.82s |  let us know. But so far, this is an unsolved crypto mystery.
1100.29s - 1105.25s |  So here's one when we talk about famous and not so famous. This is one of the famous ones,
1105.97s - 1116.53s |  the Dorabella cryptogram from Worcester. And it was created by the composer Edward Elgar,
1116.53s - 1125.49s |  who is most famous for a piece called Pomp and Circumstance that you've probably heard
1125.49s - 1133.17s |  at graduation ceremonies. He had an interest in puzzles, and even wrote something called the
1133.17s - 1141.33s |  Enigma variations with 14 different sections, each one that was dedicated to a different person.
1145.47s - 1157.15s |  And one of them was a young woman named Dora Penny, who frequently accompanied his family
1157.15s - 1165.39s |  as they traveled around. She was one of his companions. And she later wrote an autobiography
1165.39s - 1174.43s |  called Memories of Variation. And at one point when his family was staying with her family,
1174.43s - 1182.27s |  and his mother sent a thank you note, and he included a small note of his own to Dora,
1182.91s - 1193.95s |  and it was in code. This was in 1897. And she was not able to decrypt it and later printed it
1193.95s - 1200.59s |  in her autobiography, right? And said, if anyone can solve it, I would most appreciate it if you
1200.59s - 1209.07s |  could tell me what it says. But no one was able to. And here it is, well over 100 years later,
1209.07s - 1214.43s |  we still don't know what it says. It looks like a simple substitution cipher.
1215.07s - 1222.75s |  Now, Elgar did write other encrypted messages. We have access to his notes. And, you know,
1222.83s - 1231.23s |  some of them are alphabetical and very similar symbols, but applying them to the Dorabella
1231.23s - 1238.03s |  cryptogram does not really give us anything. So if we take that alphabet and apply it,
1238.03s - 1246.91s |  we get something that is not intelligible. And if we try doing other methods of frequency analysis,
1247.63s - 1254.67s |  that is not intelligible either. We've done frequency analysis and said, well, you know,
1254.67s - 1262.19s |  maybe this one is, you know, the highest frequency one is the letter E and haven't come up with
1262.19s - 1268.67s |  anything there either. We've done other methods. We could, you know, just guessing words,
1268.67s - 1274.91s |  which is difficult because it doesn't really have spaces between the words. And we've tried a
1274.91s - 1280.99s |  technique called hill climbing, but has not come up with anything. The best it has is like
1280.99s - 1290.51s |  now droop beige weeds. So that doesn't seem helpful. And so why do these methods fail?
1291.39s - 1298.11s |  Well, maybe it's not a substitution cipher. Maybe it's some other method entirely,
1298.11s - 1303.71s |  Morse code or something. Maybe these things are meant to indicate musical notes
1304.67s - 1311.87s |  or something musical. Maybe he made a mistake. Maybe he wrote it when he wasn't feeling well
1311.87s - 1318.83s |  or inebriated or something. And so maybe there's a mistake and maybe it was never intended to mean
1318.83s - 1327.95s |  anything, which is unlikely. I mean, she was a friend and there's no reason that he would have
1327.95s - 1334.83s |  sent her a fraudulent message. And maybe the plain text can't be solved because it doesn't
1334.83s - 1341.79s |  have the patterns of English. For example, there's a sentence, do you go to London tomorrow,
1341.79s - 1346.67s |  which would be very difficult to solve. It doesn't have any ease in it. It doesn't
1347.23s - 1353.71s |  match the normal frequencies. So this remains an unsolved message.
1356.82s - 1362.18s |  Let's now come to the next one. This is again one of the not so famous
1363.38s - 1371.38s |  cipher mysteries. You won't find this one in the collection you find on YouTube or in the books
1371.38s - 1377.06s |  that have been published. So this is something not very famous, but very interesting.
1378.42s - 1384.82s |  Well, first of all, let's talk about encrypted postcards. About a hundred years ago in the early
1385.70s - 1391.78s |  20th century, encrypted postcards were very popular. There are literally hundreds of them.
1391.78s - 1397.22s |  I know several people who collect encrypted postcards and I've seen large collections.
1397.22s - 1404.10s |  I've seen series of encrypted postcards. The longest ones are something like 200 postcards
1404.10s - 1411.30s |  written back and forth, usually between lovers. I think 90% of the encrypted postcards I've seen
1411.38s - 1420.02s |  are from men to their lovers. So apparently they contained love messages. So apparently
1420.02s - 1423.38s |  love messages were encrypted quite often a hundred years ago.
1424.10s - 1432.58s |  And here you see two examples. It would be no problem to show many more. Here are two more
1432.58s - 1438.98s |  encrypted postcards. And most of these encrypted postcards are not very difficult to solve.
1439.78s - 1444.66s |  Well, this one is especially easy. If you read it backwards, you get
1445.46s - 1451.38s |  you darling. Of course, most others are not that easy, but still for an experienced code breakers,
1451.38s - 1459.22s |  it's not really a challenge usually. For example, this encrypted message consists of numbers from
1459.38s - 1467.70s |  1 to 25, I think. So probably every number stands for a letter. And in fact,
1468.50s - 1473.14s |  with some frequency analysis and some word guessing, it's not very difficult to find
1473.14s - 1479.14s |  the substitution table. And there's one complication. This message is written from
1479.14s - 1486.42s |  right to left, but that's easy to get because as you see, it's a straight line on the right side.
1486.42s - 1493.70s |  So if you look at it, it's a good guess to assume that it's written from right to left.
1493.70s - 1499.94s |  And again, it's a love message. Baby, I wanted to talk to you so bad. I'm so sorry you did not
1499.94s - 1505.14s |  have time and so on. This is very typical. Most of the encrypted postcards we have looked at
1505.78s - 1513.62s |  have a message of this kind. So as I said, most of the postcard, almost all of them are solved,
1514.18s - 1520.58s |  but there's one, this one exception, which is almost driving me mad because I really
1520.58s - 1526.90s |  have absolutely no idea what to do with this postcard. Well, first of all, it's the oldest
1526.90s - 1534.82s |  one I know. It's from 1873. All other encrypted postcards I've seen so far were written at a later
1534.82s - 1542.02s |  point of time. And well, this is the front side. As you can see here, it was written to a certain
1542.02s - 1550.82s |  Lizzie Furlong. She lived actually near Luton. And this is the rear side. Here's the message
1550.82s - 1559.94s |  written to this Lizzie. It was written from Luton and the sender was a certain George Furlong. And
1559.94s - 1566.50s |  in fact, it was the great, great grandson of George Furlong, who today lives in Canada,
1566.50s - 1572.02s |  who informed me about this postcard. It's in family position for generation and he has
1572.02s - 1577.86s |  absolutely no clue what this message means. He sent it to me and he was hoping I could decipher
1577.86s - 1583.38s |  it or my blog readers could decipher it. But in fact, nobody was successful.
1585.06s - 1591.38s |  Well, if you look at this text here, it looks different from almost all other encrypted
1591.38s - 1598.58s |  postcards. Well, first of all, apparently the writer was fluent. So my guess would be that
1598.58s - 1605.38s |  it's by far not the first time that this person wrote in this script. And this is unusual. Most
1605.38s - 1613.14s |  other postcards look not like the writer was so fluent. And then some of the letters are not
1614.98s - 1620.50s |  all of the letters are in one line, which is also unusual. I don't know if these additional letters
1621.22s - 1629.06s |  are meant as a correction or if it's from the beginning it was supposed to look this way.
1629.06s - 1637.92s |  I have no idea. Usually frequency analysis is a good tool to start
1639.04s - 1643.92s |  analyzing such an encrypted message. But in this case, frequency analysis is really different
1643.92s - 1651.92s |  because it's sometimes different to distinguish between the symbols. So this doesn't help very
1651.92s - 1657.84s |  much. Of course, looking for crypts is always a good idea. And well, my guess would be that
1657.84s - 1664.56s |  this is a month, but I don't know which one and I don't know how to make sense of it.
1665.92s - 1672.48s |  This is probably the name of the recipient, which would be Lizzie. But can you make Lizzie
1672.48s - 1680.24s |  out of these letters? I can't. And finally, here's an underlined word at the top.
1680.24s - 1686.16s |  It's probably not a place because the place Lutent is mentioned in the clear. Basically,
1686.16s - 1692.32s |  I have no idea what it is. So if you would know what would be written at the top of such a message,
1693.28s - 1702.72s |  please let me know. Okay, so I have looked at many hypotheses of what all this could be about.
1702.72s - 1709.92s |  And so far, the best one in my view I found is that it's a phonetic script. Well, as we all know,
1709.92s - 1714.88s |  in the English language, it happens quite often that letter combinations or that the same letter
1714.88s - 1720.96s |  combination is pronounced in a different way or sometimes several letters stand for one
1721.92s - 1728.64s |  sound or sometimes some letters are not pronounced at all. And for this reason,
1728.64s - 1734.64s |  in the 19th century, there were linguists who tried to create phonetic scripts. A phonetic
1734.64s - 1747.44s |  script is a script where every letter corresponds to one sound of the language. And here on the
1747.44s - 1753.20s |  right, you see a few examples, the Shaw alphabet, the Désiré alphabet, and the QuickScript alphabet.
1754.56s - 1760.00s |  I think there is a certain similarity and I wouldn't be surprised if this message had been
1760.00s - 1765.28s |  written in a phonetic script too. But so far, I didn't find a phonetic script that looks like this.
1765.28s - 1772.96s |  So it seems like a good theory, but so far, it has proven to be a dead end.
1772.96s - 1783.44s |  Finally, this is the cover of our book. And as you can see here, the Furlong postcard is one of
1783.44s - 1789.68s |  our favorite unsolved crypto mysteries. And this is why we even mentioned it or we even used it
1789.68s - 1796.40s |  on the cover of our book. So the lines you see here are from the Furlong postcard. So maybe
1796.40s - 1801.28s |  someday somebody will see the cover of the book and we will immediately recognize, well, this is
1801.28s - 1807.84s |  the so-and-so script and he will tell us how all this works. But so far, this hasn't happened.
1808.96s - 1812.56s |  Again, we are dealing with an unsolved crypto mystery.
1816.61s - 1826.14s |  Thank you. So now we're going to talk about something that surely is solvable, which is
1826.14s - 1836.22s |  called Encrypt. And it's from south of the equator in Canberra, where a science museum has
1836.22s - 1844.30s |  a science educator who created this sculpture. You might call it the Southern Cryptos, but he
1844.30s - 1854.70s |  called it Encrypt. And for the anniversary, one of the Canberra founding anniversaries in 2013,
1855.50s - 1864.22s |  he created the sculpture, right? And this is Glenn McIntosh, who's probably one of the number
1864.22s - 1869.98s |  one fans of Encrypt and has a website with lots of information about it.
1871.74s - 1881.66s |  So Encrypt comprises eight pillars. And on these pillars, there are cryptograms of different types.
1881.66s - 1890.70s |  We know that there are at least 16 there, about six of which are solved. Here is an example of
1890.70s - 1899.74s |  one on pillar C. The rings there that you see on the pillar can be turned. So it's clearly
1899.74s - 1907.18s |  indicating something relating to Enigma and the rotors on the Enigma machine. And so you can map
1907.18s - 1914.38s |  out how the different letters are connected to each other. And this is one that is solved,
1914.38s - 1924.22s |  that is on pillar B. So with this narrower portion of pillar B, it's as though you could
1924.22s - 1932.62s |  wrap something around it with a very specific diameter. And this is indicating an old system
1932.62s - 1942.30s |  called a scatale, where you would wrap a piece of leather or papyrus around some sort of a wooden
1942.94s - 1950.86s |  stick and write the message and then unwrap it and send it. And the receiver would have to have
1950.86s - 1959.34s |  a stick of the exact same diameter in order to be able to read the message. And this is the message
1959.34s - 1971.10s |  from pillar B. And here's pillar H, one of the ones that is still unsolved. And if you look at
1971.10s - 1977.34s |  the different letters that are on this metallic pillar, you'll see that certain of the letters,
1977.90s - 1986.78s |  specifically P, L, and V, are a little bit larger than the other letters. We don't know why.
1987.66s - 1995.18s |  We've talked to the artist and he has told us that all of the different puzzles together
1995.98s - 2004.06s |  are connected and some need to be solved before others. And that this particular one
2004.06s - 2009.10s |  is one that will have to wait till towards the end before it can be solved.
2010.06s - 2014.54s |  All right. And all together, there are several unsolved crypto mysteries.
2016.54s - 2023.50s |  Okay. So this is the last chapter now. We are going to look at a few more crypto mysteries
2023.50s - 2030.70s |  in brief now. For example, this is a mystery we found on a Russian website.
2031.98s - 2038.14s |  This takes us to Kaliningrad, which is today a city in Russia. It used to be German until
2039.02s - 2045.82s |  the end of the Second World War. The name was Königsberg. And near Kaliningrad, there's a
2045.82s - 2053.10s |  place or a town named Baltisk. And according to this Russian website we found a couple of years
2053.10s - 2061.10s |  ago, something was found in Baltisk. It was a bottle post. Well, as you can see here, this
2061.10s - 2066.62s |  place is not on the seashore or it is not near water. So it's certainly unusual to find a bottle
2066.62s - 2074.38s |  post there. But it happened next to this house. In 2015, a bottle post was found here.
2075.74s - 2081.90s |  And this is, we don't have a picture of the bottle, but we have a picture of the message.
2081.90s - 2089.58s |  It's the front side and the rear side. And we don't know what this message says.
2089.74s - 2096.54s |  And it's also completely unclear what the purpose or the background of this message is.
2098.54s - 2105.34s |  Our estimation is that it's from the 1950s, more or less, or maybe a little later, maybe a little
2105.34s - 2111.98s |  earlier. And of course, it could be a Cold War dead drop. Maybe it was a message written by a spy
2111.98s - 2120.22s |  or for a spy with an encryption system used by secret services. And maybe somebody put this
2120.22s - 2126.86s |  bottle with this message somewhere there for a spy to pick it up. Would be a possibility. Of
2126.86s - 2133.42s |  course, it would be a spectacular possibility. Maybe it could also be a toy created by a couple
2133.42s - 2138.86s |  of children or something like that. You never know. Of course, it would be interesting to know
2138.86s - 2145.26s |  what the message says. But so far, it's an unsolved crypto mystery. Here's a completely
2145.26s - 2152.30s |  different one, but also very interesting. The man here is Ignatius Polacki, a private detective from
2152.30s - 2160.62s |  London in the 19th century. He was one of the first private detectives known in history. And some
2160.62s - 2166.70s |  people call him the real Sherlock Holmes. It's pretty clear that when Arthur Conan Doyle wrote
2166.70s - 2172.86s |  his Sherlock Holmes stories a few decades later, he clearly had Polacki and maybe a few other real
2172.86s - 2181.18s |  detectives in his mind. So Polacki certainly influenced the criminal literature of the times.
2181.98s - 2190.38s |  And contrary to Sherlock Holmes, Ignatius Polacki published encrypted newspaper advertisements in
2190.38s - 2196.86s |  the times. We actually don't know how many he published, but we know about five or six
2196.86s - 2203.90s |  that contain his name. There might be many more because usually if you publish a secret message
2203.90s - 2208.62s |  on encrypted message, you don't mention your name. But in some cases, he apparently did.
2209.66s - 2216.46s |  This one is more a code message. Turkeys are in gangs, eagles fly alone. We have no idea what
2216.46s - 2223.66s |  this sentence means, and it will be pretty difficult to find out. Here we have a few more,
2223.66s - 2228.06s |  and these are not code messages, but really encrypted messages, cipher messages.
2229.50s - 2234.94s |  You see in all of these messages, the name Polacki is mentioned, sometimes including the
2234.94s - 2243.58s |  address. And honestly, we have no clue how these messages can be deciphered. So Polacki might have
2243.58s - 2250.46s |  used a code book. So it could be possible to decipher the messages if we find the code book he
2250.46s - 2256.22s |  used. But it looks difficult because even if he used a code book, he might have used super
2256.22s - 2263.74s |  encryptions or an additional encryption. Very difficult. So these are clearly unsolved crypto
2263.74s - 2271.10s |  mysteries, but very hard one. Or if you look at the lower one, he uses symbols. I've never seen
2271.74s - 2277.58s |  symbols like these before. And in my view, they're pretty complicated to encrypt something. You don't
2277.58s - 2283.34s |  need symbols of this kind, especially if you want to print this in a newspaper. So I have absolutely
2283.34s - 2291.66s |  no idea why he used these symbols and what they mean. And all of them are different. So frequency
2291.66s - 2298.38s |  analysis doesn't help very much. Almost all are different. There's one repetition. So frequency
2298.38s - 2307.74s |  analysis doesn't help. We have no idea what all this is about. And finally, a list of unsolved
2307.74s - 2315.42s |  crypto mysteries would be incomplete without the famous Voynich manuscript. The Voynich manuscript
2315.42s - 2322.86s |  is a handwritten book from the 15th century, probably. It was handmade, so it was handwritten.
2322.86s - 2335.74s |  The drawings were made by hand. It has 230 pages and over 200 illustrations. And the remarkable
2335.74s - 2341.58s |  thing about the Voynich manuscript is that it's written in a script nobody knows and nobody can
2341.58s - 2349.50s |  read. So we have 230 pages filled with this writing. And of course, there have been dozens of
2349.50s - 2359.42s |  analyses of all kinds, but this has led nowhere so far. So this is a really fascinating and really
2359.42s - 2366.94s |  hard crypto mystery. And of course, the question is, is it solvable at all? It could also be a
2366.94s - 2374.70s |  hoax. It could be an encrypted text. It's also possible that an ordinary writing system was used,
2374.70s - 2382.14s |  but that this writing system is lost now. Basically, we have no idea. I think every year,
2382.14s - 2390.30s |  two or three new solutions are published. But so far, I think 70 solutions also can be found on
2390.30s - 2397.98s |  the internet. But in my view, everything is crap so far. And I'm not the only one who thinks this
2397.98s - 2405.50s |  way. Okay, so it's another unsolved crypto mystery and certainly a very famous one.
2407.71s - 2416.27s |  So in conclusion, there are lots of unsolved messages out there. If you would like to help
2416.27s - 2425.47s |  with any of these, a site that we recommend is Mystery Twister. And they have hundreds of
2425.47s - 2433.87s |  different challenges. Some are solved, some are not solved. And you can go in there and you can
2433.87s - 2440.59s |  sort them by what you want. If you want something easy to cut your teeth on, go to a level one
2441.23s - 2448.35s |  cipher. And if you want one of the unsolved messages or one of the very difficult ones,
2448.35s - 2463.10s |  go for a level X. And thank you. Thank you. We have 17 more minutes for questions. Are there any?
2464.14s - 2471.50s |  And again, congratulations to everyone on surviving DEF CON thus far. Just a little
2471.50s - 2483.26s |  bit more to go. Okay. Any questions? Yes. Yes. Back there. Well, we did a book signing
2483.26s - 2488.94s |  on Friday. And of course, we are welcome. You're welcome to come here and we will sign
2488.94s - 2495.02s |  any books. No problem. We also have some book plates with our autographs on them.
2495.02s - 2508.70s |  If someone doesn't have a book. Yes. Repeat the question. The question was, during our research,
2508.70s - 2516.22s |  if we also solved any crypto mysteries? Well, definitely. Well, honestly, we are more the people
2516.22s - 2523.02s |  who talk about it. We are not the great code breakers. But of course, many of the cryptograms
2523.02s - 2529.66s |  that are found are solved. I had a blog introducing unsolved crypto mysteries
2530.54s - 2537.42s |  twice a week or three times a week. And most of the cryptograms I introduced were solved by my
2537.42s - 2542.94s |  blog readers pretty soon. For example, encrypted postcards. I at least published 100 encrypted
2542.94s - 2550.46s |  postcards on my blogs. And I think 99% were solved, except for this only one. So in many cases,
2550.46s - 2554.78s |  it's not even very difficult. In some cases, it's very difficult. So there are very good
2554.78s - 2560.46s |  code breakers around. And in some cases, but that's the exception, no solution is found.
2560.46s - 2568.38s |  Yeah, I mean, I solved probably the biggest one is the Cyrillic Projector. This is also created by
2568.38s - 2574.78s |  Jim Sanborn. And this is a cylinder, which is currently at the University of North Carolina,
2574.78s - 2581.18s |  Charlotte. And it's all the letters are in the Cyrillic language. And I didn't do it alone,
2581.18s - 2586.62s |  it was part of a team. But that's probably the most famous one. Yes.
2603.74s - 2609.42s |  Okay, so if I have understood the question correctly, you ask how to start. If you have
2609.42s - 2617.34s |  an encrypted text, you don't know what it is, how to start? Okay, well, usually you start by,
2617.98s - 2621.74s |  well, first of all, you need background information. So if you get an encrypted text,
2621.74s - 2626.14s |  you always look who might have created it, which languages did this person speak,
2626.70s - 2632.78s |  when was it created? This is important background information. And then you usually
2632.78s - 2639.02s |  apply statistics. So you do a frequency count of the letters, frequency count of the letter pairs
2639.02s - 2644.94s |  of the letter triplets of the word lengths and things like that. Very often, this tells you
2646.38s - 2652.70s |  where to go or what kind of encryption system might have been used. And word guessing is also
2653.66s - 2661.98s |  sometimes a very helpful tool. So yes, and maybe in a couple of years, there will be AI tools who
2661.98s - 2667.90s |  can do this part of the job. I know people who work on this question, and maybe in a couple of
2667.90s - 2673.74s |  years, you feed such a message to an AI tool, and it will at least tell you, well, this looks like
2674.70s - 2679.82s |  a substitution cipher, or this looks like a transposition cipher. And maybe it will even be
2680.62s - 2684.62s |  capable of breaking the cipher. Yeah, some years in the future. And, you know,
2684.62s - 2688.54s |  Captain Picard, computer, please solve the Voynich manuscript, right?
2689.10s - 2695.90s |  Okay, yeah, you can ask. Well, I don't think that this will be successful, but we will see. Yes.
2706.62s - 2715.34s |  Could be. The question was if the encrypted postcard could be something like a pigpen cipher.
2715.34s - 2721.34s |  The pigpen cipher was a very popular cipher for centuries. It's also named the Freemason cipher,
2721.34s - 2729.58s |  because the Freemasons used it, but others used it as well. I wouldn't know how to match
2729.58s - 2734.46s |  these letters of this message with the Freemason cipher with the pigpen cipher. But
2734.46s - 2738.54s |  maybe that's something we could look at again. Who knows?
2739.34s - 2755.06s |  Yeah. Any other questions? Yes. Yes.
2758.58s - 2774.56s |  Okay. Okay. Okay. Yeah. Yeah. I mean, there's so many different ways to slice and dice it.
2775.60s - 2781.92s |  If you have an idea, by all means, have at it. Yes. Well, one thing might be important to note,
2781.92s - 2788.72s |  the spaces that can be seen here are added by us. So there are no spaces in the original. It's just
2788.72s - 2794.96s |  to make the thing better readable. Yeah. Put it in groups of five up to the end of the line and
2794.96s - 2801.92s |  then start the next line with groups of five. Sure. No. Any other? All the help we can get.
2801.92s - 2834.35s |  Yes. I can't hear. Sorry. You mean that this message here that it was created with a system
2834.35s - 2841.63s |  that includes a key and without the key, it's not possible? Well, this kind of system, this
2841.63s - 2848.03s |  was available at the time at the end of the 19th century. So it's certainly possible. The question
2848.03s - 2855.71s |  is if Edward Elgar used such a system to write a message to a friend who apparently had no clue
2855.71s - 2862.91s |  about cryptography. But it certainly would have been possible to use a system that is not
2862.91s - 2884.11s |  breakable today. Yes. You mean a language? You mean a cipher and a writing system?
2884.11s - 2893.68s |  How do we tell if we're dealing with a language or a cipher? Great question.
2894.56s - 2900.32s |  Well, from a cryptographic point of view, a writing system and a simple substitution cipher
2900.32s - 2909.20s |  are the same. So you can use the same methods to break them. So if simply other letters are used,
2909.20s - 2915.12s |  it can be regarded as an encryption, although it was not really meant to be an encryption. It was
2915.12s - 2922.08s |  simply used, simply another system was used. If the encryption is more complicated,
2922.08s - 2927.68s |  you usually see this when you look at the statistics. For example, in English,
2927.68s - 2934.00s |  the E is the most frequent letter with a frequency of about 12 or 14 percent.
2935.52s - 2941.60s |  And if the distribution looks more even, you know that it's not a simple substitution cipher and not
2941.60s - 2946.64s |  an unknown writing system. It must be something else, either a good or a better encryption system
2946.88s - 2954.00s |  or maybe random data or whatever. Sometimes it's difficult to tell.
2960.48s - 2962.00s |  Any other questions?
2963.84s - 2970.48s |  All right. Okay. Thank you. Thank you. Thank you. Good questions.


