# Media

url: https://www.youtube.com/watch?v=zBP2deuPQTg
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 -Your Smartcard is Dumb A Brief History of Hacking Access Control Systems - Chad Shortman

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=zBP2deuPQTg",
  "title": "DEF CON 32 -Your Smartcard is Dumb A Brief History of Hacking Access Control Systems - Chad Shortman",
  "description": "Have you ever wondered how those little boxes that you tap your card to open doors work? What are they reading on the card? How do they ultimately unlock the door? And, are they even secure? In this talk, we will answer all of those questions and more. We will walk through how access-control systems, in general, work, and dig into the details of the most popular systems. Fortunately for the entertainment value of this talk, there be dragons in our doors. We will walk through some of the most high-profile attacks in detail and then dive into some more fundamental flaws with how the systems are designed. All of these discussions will be accompanied with live demos and first hand experience. After this talk, you will look at the world, especially doors, differently -- weaknesses everywhere! My hope is that we can all learn from past mistakes and create a more secure and less frustrating tomorrow together",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3201,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.70s | This text was transcribed using whisper model: large-v2

 All right, let's kick this thing off. So I found out today. This was not an hacker tracker
4.92s - 9.60s |  So everybody in here must read the old ink version of the schedule
9.60s - 15.80s |  So thank you for reading the old paper version and showing up today. We're gonna learn how to break into buildings
16.44s - 20.00s |  Plain and clear why do I like breaking into buildings?
20.00s - 22.32s |  I've actually never broken into a building for context
22.32s - 28.20s |  But when you can do a computer exploit and it touches the real world that has always been the ultimate for me
28.20s - 31.68s |  So I played CTF for a long time done a lot of binary exploitation
32.08s - 39.28s |  But seeing a pound sign pop up on your screen versus seeing a door unlock is a very different adrenaline hit. So
40.04s - 41.16s |  let's
41.16s - 43.16s |  go back through the history and
44.08s - 49.24s |  See all the different ways you can break into buildings with laptops. So first we'll go over access control one-on-one
49.24s - 55.76s |  I'll just explain how these systems work. That's step one. What a smart card is. This is actually a pretty overloaded word
56.76s - 59.44s |  Everything looks like a smart card is just a piece of plastic with some
60.12s - 64.88s |  microcontrollers in it and then I'll go over all of the attacks that we've seen come out over the last couple decades and
65.32s - 68.36s |  Then some food for thought on what the future might look like
69.52s - 74.68s |  So if you look at a typical access control system, there's only a couple of components
74.68s - 80.08s |  This is the most complicated system you would ever see on the left side. You'll see that there's a door reader
80.08s - 82.92s |  this is the little box you tap your card to and it goes boop and
83.56s - 86.00s |  Green or red or blue or whatever color it turns
86.48s - 92.18s |  That then has a couple of wires that run all the way to the secure side into a controller board
92.28s - 94.64s |  That will ultimately make the yes-no decision
94.68s - 100.60s |  So it's gonna compare that number to some database and say does this person have access if it does it opens the door
101.00s - 106.48s |  For security reasons if you're using a mag lock, which is just an electromagnet
106.48s - 111.04s |  You'll plug it into 12 or 24 volts that electromagnet will hold the door shut
111.72s - 115.36s |  There's a problem here though that if you're on the inside of that building
115.52s - 119.88s |  You cannot get out unless you can pull harder than a let that electromagnet
119.88s - 124.28s |  Which is typically like 1,500 kilograms for a cheap one and they go way up
124.72s - 129.84s |  So in the event of a fire you need a button that you can push to cut the power
130.32s - 134.88s |  This actually was not deployed. Well on the initial ones a lot of people burned to death
134.88s - 139.36s |  So this is like fire marshal enforced now every door that has an electromagnetic lock
139.60s - 146.12s |  Will have a motion sensor and an exit button for egress and by law it has to be one motion
146.24s - 150.96s |  So if you hit the exit button, that needs to be all you do or a strike a big bar
151.36s - 156.08s |  So that comes into play quite a bit when you see some of the attacks and how to bypass these
157.08s - 161.32s |  So if we take away all the fluffy words and just look at what this is
161.32s - 165.20s |  It's an Arduino project at any high school or middle school student could build
165.88s - 167.88s |  There's just three relays
168.16s - 169.80s |  Ultimately there's one that matters
169.80s - 175.20s |  so on the secure side if that relay trips the power is either turned off or on and
175.60s - 177.60s |  The door will unlock on
177.92s - 185.36s |  The readers side there's just a little microcontroller that is going to do something over RF and then send a number out
185.76s - 186.72s |  over weekend
186.72s - 193.88s |  Which is this unencrypted two-wire protocol that has a data zero line to encode the number zero and a data one line to encode
193.88s - 195.32s |  the number one
195.32s - 197.86s |  Once it gets the other side decision is made
198.60s - 205.24s |  the other two things are also just relays the exit button when you hit it, it's just gonna cut the power and
205.96s - 213.36s |  The motion sensor again when you wave at it, it just touches a relay. These are either normally closed or normally open
213.88s - 216.28s |  We getting those relays a chip the door will unlock
217.28s - 224.76s |  So let's look at some of the worst relay fails in honor of the Olympics. This is not a running relay
224.76s - 226.76s |  We're talking about though. This is an electronic relay
227.12s - 230.12s |  I'm going to gamble that the internet works and show you
230.76s - 235.76s |  How you can trip these relays and not so sophisticated ways. We'll get to interesting
236.28s - 240.88s |  Computer hacks later, but you can see here in this video. The exit button is on the left
241.28s - 244.48s |  You get yourself a nice sturdy piece of metal
245.04s - 250.80s |  Shove that thing through the door and you just click that relay bang. You're in this is
251.36s - 257.56s |  Let's we'll keep going up in complexity. This is probably the least advanced way to trip one of those relays
258.64s - 260.96s |  So I call this the hook key
261.56s - 267.84s |  There's also the magnet key. So if you're aware of the internal mechanics in a relay
267.84s - 275.04s |  It's just two pieces of metal like this you touch them together. The connection is made you separate them. The connection is not made
275.48s - 277.48s |  so some of these
277.64s - 280.12s |  This is the locksmith lock picking lawyer
280.88s - 282.88s |  You hit the pin pad the door unlocks
283.24s - 289.12s |  You can literally take a magnet touch it to where the relay is and it just clicks the relay
289.40s - 296.36s |  So if you buy this system put on the outside of your building anyone can just come up with a magnet click clack click clack
298.16s - 300.16s |  Click the relay on
300.48s - 306.72s |  So don't do that when you install these systems make sure the relay is on the inside of the building not the outside
307.48s - 309.48s |  And then there's the motion sensor
309.96s - 311.00s |  so
311.00s - 313.40s |  For obvious reasons when there's motion
313.40s - 320.60s |  It's going to trigger if you vape it turns out the smoke in your vape for most of these motion sensors is
321.00s - 322.32s |  thick enough
322.32s - 329.52s |  That it will actually trip the motion sensor and you can just blow smoke through the crack and walk right through the door
330.00s - 333.16s |  So we'll call these the very unsophisticated
334.12s - 336.20s |  Uninteresting why the hell did I come to this talk?
336.72s - 338.84s |  Hacks there are much more
339.80s - 341.80s |  fun ways to do this
342.08s - 347.88s |  Just to note when you're looking at these systems, so there's the electromagnets that are just huge chunky electromagnets over the top
348.32s - 349.92s |  There's also electric strikes
349.92s - 353.64s |  so these are solenoids that are gonna have a pin that by and it's
354.16s - 359.08s |  Unpowered position is stuck down in the hole and then when you power it it pulls the solenoid out
359.20s - 361.20s |  These are far better for
361.68s - 366.92s |  Various reasons you can't get locked into your building and die. They're a little harder to trip
366.92s - 371.16s |  You know, you can't vape into these and have them, you know, pull a solenoid up
371.68s - 377.20s |  So if you're given an option you're installing these anytime you can put an electric strike. So
378.24s - 380.24s |  Now let's look at smart cards
381.12s - 387.04s |  First we need to answer the question. What do I mean by smart card? There's really I think three different forms
387.04s - 392.24s |  You'll see there's the ones that look like our credit cards that have these little pads on them
392.52s - 398.48s |  There's ones that are just pieces of plastic that do some RF stuff and then there's ones with the mag stripe on the back
399.64s - 400.80s |  so
400.80s - 403.80s |  These are all very very different technologies
403.80s - 409.44s |  the end goal of all of this is to take stuff from our digital world and encode it somehow and a
409.44s - 413.32s |  Physical piece of plastic that fits in our wallet and is the same size as our driver's license
414.52s - 416.52s |  so if we look at a mag stripe
417.76s - 424.32s |  This one normally like fascinates people that stuff that is stored on the magnetic strip of your credit card is
424.64s - 430.64s |  Exactly the data that is printed on the front of your credit card. It is just a way to encode
431.40s - 436.36s |  ASCII text effectively in a magnetic form. There is no security involved
436.36s - 441.60s |  There is no encryption if you want to clone some mag stripe cards. We have them over in the physical security village
441.76s - 444.56s |  This was like, you know attempt number one at hey
444.56s - 448.64s |  We're gonna use a physical thing to interface with a digital world. There is
449.52s - 454.00s |  Nothing interesting or sophisticated there other than some physics with like magnetic poles
454.76s - 456.76s |  Not smart at all
457.52s - 459.52s |  Then came the prox cards
459.76s - 466.48s |  These you literally just emanate radio waves at them. They can be passively powered which is really cool
466.48s - 472.36s |  So the the radio waves actually give them the power they need to power on and then they respond with a number
472.56s - 474.40s |  You can actually
474.40s - 478.44s |  Hack these things with AM radios. I have like a little kit when my sister was like five
478.44s - 483.48s |  We were playing around and like emulating these kind of smart cards. They are not encrypted
483.48s - 487.88s |  There is nothing really interesting from a cryptography standpoint going on there
488.08s - 493.56s |  The only thing to figure out is how they encode the data that coming back. Is it amplitude shift keying?
493.56s - 496.80s |  Is it phase shift keying? How are they encoding the radio frequency?
497.60s - 498.64s |  At the end of the day
498.64s - 505.38s |  It is just a number and that number is typically printed on the card just to add to the security of the whole situation
505.56s - 508.40s |  These were never intended as a high security thing yet
508.40s - 510.40s |  If you go to most enterprises on earth
510.84s - 517.28s |  Including the one my wife works at they still use these exact cards today as does the high-rise that my company is in in
517.60s - 521.40s |  Downtown Houston. It's it's a bummer. Like I saw her come home first day of work
521.40s - 526.16s |  Like why like I know where you work. Don't do that. Do you have sensitive stuff?
527.00s - 528.60s |  so
528.60s - 535.68s |  Then came along the near-field communication cards NFC or high-frequency cards. These run at 13.5 6 megahertz
535.76s - 542.36s |  These do have cryptography on them the way to think of the cryptography on all of these is as a memory card
542.48s - 545.28s |  There is a symmetric key that is on the card
545.28s - 548.76s |  And if you have it, you can read and write to that card
548.76s - 555.20s |  And if you don't you cannot so there is one key that will let you read and write data from these cards
555.88s - 557.84s |  Otherwise, I
557.84s - 561.16s |  Colloquially call them dumb cards there. They're not doing anything sophisticated
561.16s - 566.16s |  They're just memory cards, but they are better than the mag stripes and the prox cards
567.00s - 568.32s |  so
568.32s - 570.40s |  There's gonna be a shared key, which
571.36s - 575.96s |  That screen still looks like it's on so there's gonna be a key on the card and a key on the reader
576.24s - 579.16s |  So for the reader to read the card, it needs another key
580.60s - 584.84s |  Which you can kind of see where this is going if I'm deploying, you know a million of these
585.20s - 589.28s |  That means that that key has to be on all of the readers and all 1 million cards
591.60s - 596.00s |  Now we look at what is actually considered a smart card
596.00s - 601.40s |  So our credit cards that look like this with the little chip. These are actually little
602.24s - 609.56s |  Microprocessors, they're not microcontrollers. They actually run Java OS. They have a CPU. They have memory
609.72s - 612.68s |  They have non-volatile storage. They have you know
613.52s - 618.24s |  Dedicated crypto units and they can do public key cryptography. So these are actually
619.00s - 623.84s |  Smart in the sense that we would hope they are and do proper security things
625.44s - 629.88s |  With the asymmetric encryption, this is much better than the symmetric key encryption
629.88s - 631.00s |  It means if you break my card
631.00s - 636.16s |  You only get my private key and you're not going to take down my whole company and be able to clone every employee's card
637.76s - 641.20s |  Which is very good for the scalability point
641.60s - 647.80s |  And I put this diagram there because I think it's interesting that I didn't realize this till I started hacking smart cards in my
647.80s - 650.52s |  Career that these really are just little embedded
651.44s - 653.12s |  systems like I
653.12s - 657.60s |  There's far more sophisticated stuff in there than I thought and you can kind of see the overlap
657.60s - 659.72s |  You have contact cards that speak one protocol
659.88s - 663.92s |  You have contactless cards and then you have the dual interface cards
663.92s - 669.92s |  Which almost all credit cards are today you can tap to pay or you can shove that thing, you know into the the credit card reader
670.52s - 673.88s |  And if you look at the specs, you know, they're 1k mbit flash
673.88s - 681.64s |  There's an EEPROM that speaks I square seed and spy and spy they have segmented memory with a 64 kbit EEPROM like
682.36s - 684.64s |  Pretty decent specs for a credit card
685.20s - 691.14s |  If the way they work is if you look at those pads only
691.26s - 696.62s |  Formatter you have your power in your ground to power the little computer on you drive the clock externally
696.62s - 701.46s |  Which is interesting from a glitching perspective. So you have a you control both the voltage and the clock
701.46s - 704.70s |  And then you just have a single pin for IO
704.70s - 710.22s |  So as you're driving the clock use that IO to read and write commands and application data units
710.50s - 717.42s |  so a PD use you're gonna send commands you can actually send like admin commands and install Java applets and
717.82s - 719.82s |  manipulate the operating system or
720.42s - 724.46s |  You know unauthenticated commands that are just gonna query this thing for a challenge response
725.74s - 727.10s |  so I
727.10s - 733.58s |  Got my doctorate in embedded system security where I was glitching and doing all sorts of crazy things that break into embedded systems
733.82s - 740.66s |  So smart cards have always fascinated me because they actually do a very very good job at physical attacks
740.94s - 745.38s |  So it's common that you would drop your credit card and somebody could pick it up, right?
745.58s - 750.10s |  They can still go make payments, but actually extracting that key cloning cards is a big deal
750.70s - 756.94s |  So they actually lay if you look at the IC and delid it between every single layer of logic
756.94s - 759.86s |  There is a layer of mesh. That is a destroy
760.90s - 764.50s |  Mechanism if that is tampered and you break a single one of those traces
764.50s - 769.20s |  It actually will self-destruct the card by deleting all of the sensitive material
769.60s - 774.34s |  They also have to have brownout detection because you're controlling the voltage externally
774.62s - 781.70s |  There are glitching attacks you can do on embedded systems where while they are doing computation you can brown the voltage out
781.70s - 785.14s |  So that means you're gonna take it from your positive 5 volts to negative 5 volts
785.38s - 789.90s |  That can make your D flip-flops go crazy and you can have an if statement
790.14s - 793.90s |  Evaluate to true that otherwise should have been false or vice versa
795.30s - 802.82s |  They also because you're controlling power clock all of these things you have to program the logic very specially
803.10s - 807.78s |  So one of these two statements on the right is correct in
808.66s - 814.42s |  An embedded system standpoint if you're writing this for a computer software, they're both probably fine
814.94s - 820.70s |  But these this is the code to check the pin when I'm entering the pin to say unlock my debit card
821.10s - 823.30s |  Does anybody have an inkling of?
824.46s - 826.46s |  Which one is better than the other?
827.14s - 835.86s |  We think number two is better
836.62s - 838.74s |  Correct number two is better
839.14s - 846.30s |  So the reason that number one would fall vulnerable on a smart card is because you can do side channel analysis to actually see
846.30s - 849.54s |  if that if statement evaluated to true or false and
850.06s - 855.50s |  What you can do in this attack is that if you believe it evaluated to false you cut the power
855.82s - 860.74s |  Immediately before it has time to increment the counter and write that to the non-volatile storage
861.74s - 864.74s |  Which means you could then brute-force this with unlimited tries
864.86s - 870.34s |  Whereas if you increment the counter before you do the check you can still limit it to 10 or you know
870.34s - 872.34s |  15 pin attempts, whatever you have
872.86s - 875.38s |  The awesome part is on these smart cards
875.38s - 881.22s |  This is all actually they've thought about a lot of this because it's used for financial transactions in the EU, especially
881.94s - 886.34s |  So I read the whole book on smart card security and these were the highlights that I thought were
887.06s - 889.06s |  particularly interesting of security done well
889.90s - 891.66s |  So
891.66s - 894.58s |  Before we go break all these why did we even build these in the first place?
895.06s - 898.34s |  The real problem is that physical keys are one-to-one
898.34s - 902.74s |  There's one key that opens one door if I want 1,000 people to open that one door
902.74s - 908.50s |  They all have the exact same key and if one of those 1,000 people is bad and I have to fire them
908.50s - 910.50s |  I now have to give out
911.06s - 913.06s |  999
913.06s - 915.06s |  9999 new keys and rekey that door
915.18s - 921.02s |  So in enterprise this sucks smart cards can be one-to-many you can have many different
921.74s - 923.74s |  Credentials that get into the same door
923.82s - 929.90s |  It used to be really complicated to carry a full computer in your pocket as you can see the modern smart cards are actually little
929.90s - 931.90s |  mini computers our smartphones are
932.14s - 934.14s |  really big fast computers and
934.42s - 938.42s |  You can put a picture on them. This should not be you know ignored
938.42s - 943.86s |  It is nice that when you come to conferences and things there is something around everyone's neck that indicates
943.90s - 946.82s |  They are meant to be here and should not be escorted out
947.02s - 954.48s |  So even all the security and stuff aside the fact that people have things hanging around the neck that says that they belong is actually
954.48s - 956.06s |  valuable
956.06s - 959.70s |  Enough with all that fluffy stuff. Let's go through some exploits. That's why I write DEF CON
960.42s - 961.66s |  so
961.66s - 967.22s |  When you're doing a vulnerability assessment you first want to ask yourself. What's the goal right? What's the worst that can happen?
967.62s - 970.22s |  So we could use a card without someone's permission
970.22s - 973.86s |  I could you know, swipe it out of your back pocket. I
974.46s - 978.66s |  Can clone the smart card or I can subvert the need for it all together
978.98s - 984.62s |  So we already saw at the beginning some of the ways that you can just completely ignore the card
984.62s - 986.50s |  If you go to the physical security village
986.50s - 992.38s |  they have many many many more ways to get into buildings that have nothing to do with computer science and
993.18s - 998.22s |  Using the card without a person's permission is not particularly interesting because you're just stealing the card
998.26s - 1002.74s |  There are ways that there are some smart cards that will have like biometrics built into them
1003.30s - 1008.22s |  You know other things like that. We're gonna specifically focus on cloning the smart cards
1009.74s - 1013.50s |  So the way it works when you have a good, you know
1013.86s - 1021.78s |  One of the dumb cards the 13.5 megahertz 5 6 megahertz cards. There's gonna be two keys that really have to
1022.38s - 1024.94s |  Work together to store this credential
1024.94s - 1029.46s |  So there's me one an authentication key an in-transit key that lets you read and write data
1029.46s - 1033.14s |  And then you can also encrypt the data at rest on the card
1033.50s - 1039.86s |  So if my employee credential is 1 2 3 3 4 5 6 8 9 0 I will encrypt that while it's on the card
1039.86s - 1046.78s |  And then I will also have effectively a key that encrypts the in transit that lets me even talk to the card
1047.46s - 1053.74s |  It doesn't matter what the key for the encryption on the card is if I'm just going to clone it outright
1054.02s - 1061.98s |  So that is worth noting because one of the fixes I'll explain later. They fixed the in the in transit key or sorry
1062.46s - 1066.78s |  Yeah, they changed the in transit key, but it didn't actually fix the problem
1068.26s - 1074.18s |  So the whole goal of this when we're trying to break into buildings with laptops is just find that dang key
1074.18s - 1077.78s |  whatever the key is that lets me read and write data from the cards is
1078.30s - 1084.30s |  Game over for that security system because now I can walk up next to anybody and just outright clone
1084.50s - 1088.78s |  Employee IDs and in the case that I also know the at-rest key
1088.78s - 1092.54s |  I can just fabricate whatever keys I want and if it's printed on the badge
1092.54s - 1099.14s |  I can just read someone's ID badge walking by and then go become them and just go in whatever door
1099.14s - 1101.14s |  I know they can go into
1101.94s - 1103.26s |  So
1103.26s - 1105.42s |  How are these attacks done? These are
1106.62s - 1113.78s |  Almost all exclusively physical attacks on the cards and their readers first this one on the my fair classic
1113.78s - 1116.06s |  So this was the most prolific card
1117.06s - 1121.22s |  Early in the smart card era. This was used for everything public transit
1121.62s - 1125.38s |  Cash cards, so you'd actually store money in the value on the card
1125.74s - 1129.18s |  So breaking these was a really big deal in the research world
1129.70s - 1136.02s |  There were a couple professors at UVA that actually delidded the chip they dissolved it in acid and went layer by layer
1137.02s - 1143.90s |  Delidding this chip and taking really high-resolution pictures that you see here of the actual ASIC
1144.18s - 1148.14s |  Like the the circuitry of the IC and then they applied
1149.10s - 1155.26s |  Image recognition to all of these images to reverse engineer the algorithm that was encoded in that chip
1155.26s - 1158.46s |  And then from there, we're able to start analyzing
1158.70s - 1165.14s |  You know doing like crypt analysis to figure out if there are any vulnerabilities in the cryptography on these my fair classics
1165.82s - 1169.58s |  spoiler alert, yes, there was my fair classic at this point is
1170.50s - 1174.50s |  Quite broken anybody with a flipper zero can just go to RFID read
1174.78s - 1181.30s |  Put it up to the back of the flipper zero or to the back of the card and it will run some version of this
1181.30s - 1183.34s |  Program I wasn't involved in the porting of it
1183.34s - 1185.46s |  But mostly a user of all these great tools
1185.46s - 1190.74s |  But this is what it looked like way back in the day in your terminal window now, it's a very awesome
1191.14s - 1198.30s |  You know handheld little device, but you can effectively brute force all of those keys break the keys back to being a talk
1198.30s - 1201.50s |  Once you have the key it's game over you tap any card you're reading and writing
1202.70s - 1204.38s |  You can again come over to our booth
1204.38s - 1210.26s |  There's still hotel key cards and public transit cards and things today that are still using my for classic
1211.26s - 1215.06s |  So in the enterprise environment, there's
1215.66s - 1216.74s |  HID
1216.74s - 1218.74s |  dominated they were by far the
1219.22s - 1220.38s |  monopolist in
1220.38s - 1226.02s |  You know enterprise access control this thing on the left probably looks very familiar to most of you
1226.02s - 1232.62s |  You have to they're all around this conference. You've seen them probably in tons of buildings airports financial institutions, whatever
1232.62s - 1234.62s |  Every elevator here has one of these
1235.46s - 1240.46s |  These use symmetric keys, right so we go back to how would you deploy a system like this?
1241.22s - 1246.06s |  Every single one of these on earth that is sold has the exact same symmetric key
1246.42s - 1250.26s |  Every single card every single reader has the exact same key
1250.26s - 1256.62s |  So they've sold millions of these to many different buildings one of which we are standing in today with the same key
1257.02s - 1262.18s |  So that would be absolutely terrible if that one key got leaked
1263.18s - 1270.02s |  It took a while actually to get this key they did pretty good security nobody dissolved the cards in acid
1270.66s - 1276.62s |  Didn't anything like that back in 2010 below. She Marriac was looking at the back of one of these readers
1276.62s - 1283.78s |  I think is the rw40 said hey that looks a lot like the pin header on my pick my pick kit my pick microcontroller
1284.62s - 1290.06s |  turns out the way they secured this system was by flipping pin 1 and pin 3 because
1290.18s - 1296.46s |  You know nobody on earth would ever dream of flipping pin 1 and 3 pin 3 on their pick kit
1296.58s - 1300.18s |  So he just swapped pins 1 and pin 3
1301.02s - 1302.54s |  Plugged it in
1302.54s - 1310.10s |  Great. We're debugging it. There is a security feature on pick though where you can't just read memory that would be catastrophic and extremely dumb
1310.10s - 1315.62s |  They did not do that this particular one though had a vulnerability where you could wipe
1316.14s - 1318.02s |  individual sectors and
1318.02s - 1322.82s |  Write data to individual sectors. So the way this should work is I'm gonna write new firmware
1322.82s - 1325.70s |  I have to wipe the whole firmware and write my own custom firmware
1326.30s - 1332.06s |  With this little subtlety you could erase sector 0 write code in there
1332.06s - 1336.82s |  That would dump sectors 1 through n and then take another sacrificial reader
1337.54s - 1342.70s |  Delete sectors 1 through n and write code in all of those that would dump sector 0
1342.94s - 1349.06s |  So by sacrificing two of these you now put all of that together and you have the complete firmware
1349.62s - 1352.70s |  Dumped on your computer that you can now analyze with IDA Pro
1353.54s - 1356.42s |  They stored everything in PIC memory
1356.94s - 1362.30s |  Including those keys they weren't stored off chip and some sort of secure RAM or anything like that
1362.82s - 1368.58s |  So once you reverse engineer this go through lo and behold the keys just pop right out at you
1369.14s - 1374.30s |  That's game over since these are symmetric keys now when you go to clone an HID card
1374.30s - 1379.10s |  There is no brute brute forcing going on. You just read the freaking card
1379.46s - 1382.58s |  They did add an I class SE
1382.58s - 1386.90s |  So if you're in the industry and you see this on the back your card the SE I
1387.50s - 1393.38s |  Think stands for secure encryption or something like that, but they did encrypt the data at rest on the card
1393.94s - 1396.14s |  So it used to be you'd use this key
1396.14s - 1403.30s |  You just read the the credential off and you could write arbitrary credentials with the SE. They did use AES. That's good
1403.30s - 1408.06s |  They used a known algorithm to encrypt the blob on the card, but you can still clone it outright
1408.18s - 1412.40s |  So if I want to become you I just tap your card. I take your blob. I put on my card. Boom. I'm you
1413.14s - 1419.38s |  They also had a version that they would upsell you on called HID elite class
1419.74s - 1423.22s |  So what elite class would do is it would just change that standard key?
1423.22s - 1426.90s |  That's on every door on earth for your organization
1426.90s - 1432.78s |  They would give you an organization specific key and then your cards your employees would use a different key
1432.78s - 1434.78s |  So people couldn't come up and clone it
1434.98s - 1436.98s |  Sounds good
1436.98s - 1440.38s |  Unfortunately, the firmware at this point is you know, it's not open sourced
1440.38s - 1443.18s |  But it's out there if you know the right people and know where to look
1443.62s - 1447.70s |  There were some researchers Flavio Garcia a couple other folks
1448.26s - 1452.50s |  Looked at this algorithm and found that there was actually a vulnerability in the way
1452.74s - 1457.78s |  That the elite keys were derived and they were able to go up to an elite key reader
1458.38s - 1461.46s |  Send I think it was seven failed attempts of
1462.34s - 1465.90s |  Cards that wouldn't register at all the back end. It would never spit them out
1465.90s - 1470.36s |  They were total failed transactions and then offline you could brute force the elite key
1470.62s - 1473.04s |  So even if you paid to upgrade to the elite key
1473.44s - 1477.48s |  Somebody's had to walk by one of your readers tap their proxmark. Boom
1477.48s - 1481.80s |  Now they have the key and we're back to where we started just clone and employee IDs
1482.20s - 1484.88s |  This was like, I don't know at least in my career
1484.88s - 1492.08s |  This is like the coolest like heyday couple of years and breaking into the RFID things and all these papers are published
1492.08s - 1496.96s |  I'm like implementing the stuff as they're publishing it like emailing these guys like oh my god
1496.96s - 1502.28s |  Like I can't believe this works. Is this a typo? Is this algorithm real and then yes, it's all real
1502.28s - 1506.32s |  I've like wrote these on proxmarks. I wrote a version of Python wrote a version C
1506.32s - 1509.32s |  And now that's all been ported to the flipper zero
1509.32s - 1514.40s |  I think the guy who ported it was hanging out and the RFID village actually one of the co-authors. So like
1515.60s - 1517.88s |  It's awesome like crazy stuff
1519.00s - 1522.08s |  Totally works and people are literally flipping out these days
1522.08s - 1523.88s |  This used to be something that like
1523.88s - 1528.60s |  Do you know there was a small group of us that knew about these things and we come to DEF CON like hey
1528.60s - 1531.64s |  You know talk about these exploits. We had email threads going back and forth
1532.20s - 1533.24s |  Now it is
1533.24s - 1539.76s |  Everybody here is walking around with one of these things on their neck with the ability to just walk into pretty much any door
1539.76s - 1544.68s |  They run if they find the correct employee and kind of just nudge into them correctly. So
1545.56s - 1547.56s |  It is a pretty strange
1548.52s - 1553.32s |  Time to be in this world and that's why we're hosting at the physical security village now
1553.44s - 1555.72s |  The decades leading up to the flipper zero
1555.72s - 1558.32s |  I'm like, you know, this probably isn't the right time to talk about this
1558.32s - 1561.84s |  Like this is a pretty bad exploit, but now that it's commoditized
1562.52s - 1564.32s |  Hey come play with it
1564.32s - 1570.60s |  So the implications of this are actually huge most of the employee badges on like the world's largest companies
1570.60s - 1571.44s |  I still
1571.44s - 1577.80s |  today walk around and have friends and I'm always looking at people's IDs and trying to clone everything and I have like way way too
1577.80s - 1581.48s |  Many oh my god moments given that this key was leaked back in 2010
1581.76s - 1583.76s |  Like there are so many
1583.76s - 1590.12s |  Organizations either have the prox cards with no encryption at all or still have these standard i-class cards like in use
1590.12s - 1595.32s |  There was a brand new building that was built. I was a tenant there for like six months and on day one
1595.32s - 1600.28s |  I just like cloned the card. They gave me and started walking through doors. I'm like, this is
1600.92s - 1605.48s |  Why in 2024 did we just build this and buy this technology?
1606.36s - 1610.52s |  There's so there's still security theater though. So this actually is interesting
1610.52s - 1615.96s |  There is something to be said about like keeping the honest people honest and like as long as it looks good on paper
1616.40s - 1617.44s |  You know
1617.44s - 1620.74s |  You have all these security audits and sock twos and things like that
1620.74s - 1625.96s |  They're like you do have to do these things and it is not highly publicized that this is out there
1625.96s - 1632.56s |  It's highly publicized at DEF CON but outside of this, you know, there's not big signs like your HID reader key was leaked in 2010
1632.76s - 1634.76s |  What version are you running?
1634.84s - 1638.68s |  And it's just a absolute headache for admins like that
1638.68s - 1640.68s |  Now you don't know if your keys have been cloned
1640.68s - 1645.64s |  Upgrading these is a huge hassle because this is your whole infrastructure. These readers aren't cheap
1645.64s - 1651.60s |  They're like they can go up like $1,500 a piece not to mention the labor of ripping one out and rewiring it
1653.44s - 1655.44s |  so
1655.56s - 1662.52s |  Just to take a step back though, the only common feature here is bad implementation like trying to roll your own crypto
1663.12s - 1665.12s |  you know doing things that
1666.08s - 1669.88s |  In the grand scheme you'd look back and say that was a terrible decision
1669.88s - 1675.04s |  I wasn't there making the decision and normally you don't realize it at the time like, you know
1675.04s - 1681.12s |  Encoding strings that ended null bytes at the time you're writing see what could go wrong and now we have buffer overflows forever
1681.12s - 1685.76s |  So the design process I'm sure never dreamed that it would get to the point where my god
1685.76s - 1688.92s |  There's too many of these on earth and every building can be walked into
1689.72s - 1694.28s |  But otherwise the smart card community as a whole has really crushed it
1694.28s - 1701.60s |  I mean to attack like the DoD CAC or a modern credit card is actually pretty complicated
1701.76s - 1706.72s |  You'll see attacks here kind of few and far between the last one. I remember those quite notable
1707.72s - 1714.32s |  When I was in the smart card hacking world, there's somebody who found that on SIM cards. They use triple DES to authenticate and
1714.92s - 1719.08s |  I remember going through this with my colleague and I'm like man everything actually does look fine
1719.08s - 1725.80s |  It looks totally shady. But if anyone use single key DES instead of like the triple keys on triple DES
1725.80s - 1727.32s |  This would be catastrophic
1727.32s - 1730.64s |  There was a talk at DEF CON that was like hey every SIM card for this entire
1730.92s - 1735.48s |  manufacturer only uses a single key and they were just root SIM cards like crazy because
1735.72s - 1739.84s |  SIM cards are these cards if you just cut more plastic off and shove it in a phone
1740.24s - 1746.12s |  But the security of these at the at its core is actually quite good if implemented well
1747.00s - 1748.32s |  so
1748.36s - 1752.60s |  Okay, Chad, we have these ultra secure cards. Why don't we have more of them then?
1752.60s - 1754.60s |  Why don't I have one for my credit card?
1754.80s - 1760.56s |  They don't scale well at all. Like they were intended to have a bunch of applets. We'd all have one card
1760.56s - 1765.60s |  I'd have my Chad card and it has my bank ID and my gym pass and my employee ID
1765.92s - 1771.40s |  But the security architecture in this Java OS has almost no isolation and it's pretty terrible
1771.48s - 1777.96s |  So you can't trust that Gold's Gym had the same security standards as Bank of America to throw those in the same
1778.32s - 1783.76s |  Memory space. So now I need one card for everything and if I'm using them to log into websites now
1783.76s - 1786.52s |  We're talking a huge freaking nightmare, right?
1786.52s - 1790.08s |  I'm gonna have a Rolodex of 800 cards coming in here trying to log into a site
1790.72s - 1797.08s |  They also require extra hardware, which people don't love so like for me to log into this computer the smart card
1797.08s - 1801.56s |  I need some little dongle thing that I'm gonna plug into and then for all you know
1801.56s - 1807.16s |  Your wallets are just gonna be crazy fat and they have no user interface. This one is actually pretty relevant
1807.36s - 1811.48s |  So going back to the first attack of being able to use someone else's card
1811.84s - 1815.48s |  If you drop your smart card someone else picks it up. They become you instantly
1815.48s - 1819.48s |  There's no way to verify that if you had a user interface on there
1819.48s - 1820.92s |  Even with just as you know
1820.92s - 1827.28s |  Four digit pin you could pretty much mitigate that attack a four digit pin with some throttling or some, you know
1827.28s - 1834.72s |  Threshold of five attempts anyone who picked up that card would be doomed, but these are passively powered so you can't have interfaces
1835.48s - 1836.68s |  So
1836.68s - 1841.80s |  This is the research question. I've asked myself my whole career like can we do better?
1841.80s - 1844.56s |  I hate passwords smart cards things in my pocket and
1846.44s - 1848.36s |  This was back in
1848.36s - 1850.40s |  God, I don't know 2009
1850.60s - 1856.12s |  I'm like, why don't we use iPhones when they were new and everyone's like no one will ever take their iPhone to work
1856.32s - 1859.04s |  It's a terrible idea. The security on them was bad at the time
1859.68s - 1861.84s |  But I really do think we're at a point where
1862.88s - 1864.36s |  smartphones
1864.36s - 1869.48s |  Can kind of completely eliminate smart cards over the next 10 20 30 years
1869.68s - 1873.36s |  So they actually already put smart cards in every single smartphone today
1873.48s - 1876.80s |  So if you take that exact chip that I'm telling you that's in the SIM card
1876.80s - 1879.84s |  That's in your credit card take all the plastic off of it
1880.16s - 1884.60s |  It's called a secure element and it is soldered on the motherboard of every single person's phone in here today
1884.76s - 1887.72s |  And when you do tap-to-pay, that's where you're interacting with
1888.36s - 1891.32s |  Everything is stored in that secure element. In fact all of the initial
1891.88s - 1897.64s |  NFC stuff implemented on phones. They kind of had a hybrid chip that would do NFC plus the secure element
1897.64s - 1902.56s |  They're just taking everything they knew from a smart card trying to put in a phone so that you can do your digital payments
1903.08s - 1906.40s |  The other interesting thing that has unfolded on phones
1907.12s - 1909.28s |  Every modern arm processor on earth
1909.28s - 1915.52s |  Even the embedded processors have something in there called a trusted execution environment an arms version. They call it trust zone
1916.12s - 1919.60s |  So when the phone boots it boots into a secure world
1919.88s - 1926.92s |  That is your first stage bootloader in there is where you're supposed to keep only your most sacred secrets and code
1927.28s - 1932.28s |  So your cryptographic keys anything you use for authentication payments secure world
1932.48s - 1939.64s |  Then you create a sandbox called the non secure world and that's where you let iOS and Android and the operating systems play
1940.08s - 1945.28s |  So now if iOS gets totally rooted 100% rooted exploited
1945.28s - 1948.20s |  They still cannot touch the code in the secure world
1948.48s - 1952.40s |  So if you've ever played around with your Android phone, it tells you to push the physical button
1952.76s - 1956.16s |  That's because that code is I don't work for Google
1956.16s - 1961.44s |  But it's very likely running in the secure world and they're getting the interface from the physical button
1961.60s - 1966.52s |  Nobody to date has written a driver for all of the touchscreen all the graphics in the secure world
1966.68s - 1969.64s |  But you can securely detect yes
1969.80s - 1974.88s |  Somebody's physically hitting this button and wants to do this thing that is being requested of me
1975.08s - 1979.44s |  But not just being used by malware or some proximity trying to read your phone
1980.80s - 1982.12s |  so
1982.12s - 1987.64s |  the future that I am hoping for and literally bet my career on is that
1987.88s - 1993.92s |  We can put all of this cool security that we've learned to the smart car world into these phones that we already carry
1993.92s - 2000.76s |  And you get really amazing interactions because these can interact with everything they can interact with the smart card readers
2000.76s - 2006.00s |  We already have our computers each other and then we can replace everything in our wallet with these phones
2006.36s - 2008.40s |  And once you have a private key store
2008.40s - 2009.24s |  So, you know
2009.24s - 2014.76s |  we can do something more akin to what they wanted to do with the applets where we actually can store multiple different credentials in here and
2014.76s - 2021.24s |  I could have my gym pass next to my Bank of America card next to my DEF CON badge or whatever
2022.24s - 2026.00s |  So I quit my job in academia or I
2026.40s - 2032.84s |  Declined all my professorship offers and what I've built since is a company called authenticate where we actually do that
2032.84s - 2037.92s |  We have a an app that can talk to doors door readers. It all uses
2038.44s - 2043.46s |  Asymmetric encryption uses all the good stuff. We can also talk to computers SSH and servers
2044.16s - 2049.60s |  Websites, you name it. You can use that credential for all sorts of different protocols. So I
2050.56s - 2054.72s |  Would now welcome any questions about breaking into buildings or maybe
2055.16s - 2061.96s |  Securing buildings if you're into that as I've since switched my career to go from I don't know the fun side to the not fun
2061.96s - 2065.60s |  Side of trying to patch all of these holes that I just showed you
2066.28s - 2068.28s |  So thank you for attending
2076.24s - 2077.84s |  question
2077.84s - 2081.06s |  And I think on time I am very early
2081.76s - 2082.88s |  so
2082.88s - 2084.08s |  there's
2084.08s - 2097.36s |  Plenty of time for questions. Has anybody broken into the cat card?
2098.40s - 2102.68s |  That's one of those questions where even if I knew the answer I couldn't tell you
2105.20s - 2110.96s |  There is a library that we published when I used to work in Lincoln Laboratory called LL smart card
2110.96s - 2114.80s |  if you want to pull that on github and play with it, it gives you a
2115.52s - 2122.52s |  Decent interface in Python to like fuzz smart card interfaces over both the contact and contactless interface. So
2123.16s - 2128.56s |  If you want to look for yourself and plug some cards in it's and I I think we have some templates on there for like
2128.56s - 2131.74s |  A visa card and a cat card objects like basic interactions with it
2158.64s - 2163.48s |  What how well do trust execution environments stand up against physical attacks?
2164.28s - 2170.16s |  Is that a downgrade from smart cards that have all of these physical anti tamper in there? The answer is
2171.36s - 2174.72s |  Yes, there are some side channel attacks and things have been published on T's
2175.20s - 2180.48s |  The way you would implement this is really to couple the T with a secure element though
2180.56s - 2185.00s |  So you would keep all of your keying infrastructure in the secure element
2185.00s - 2187.76s |  So all of your digital signatures all of the cryptography
2188.00s - 2192.80s |  Everything is done in the secure element that has all of this physical anti tamper and side channel
2193.20s - 2196.34s |  You know defenses built in and you really need the T
2197.00s - 2199.64s |  Specifically for like a trusted user interaction
2199.76s - 2203.80s |  So you really want the T to like disable all of the you know
2204.12s - 2212.32s |  Accelerometers and side channels and then anything that's mildly sensitive interacting with the secure element, but the computation itself
2212.92s - 2214.92s |  should not be in
2215.48s - 2217.48s |  The T because you know
2217.48s - 2219.04s |  You don't want like RSA side channels
2219.04s - 2224.76s |  The one thing that I focused a lot of my PhD on on the T security in particular was glitching attacks
2224.76s - 2231.04s |  So the one thing you can do when you're booting into secure world is if you can glitch at just the right time
2231.04s - 2233.04s |  This is actually how the Xbox one was hacked
2233.24s - 2234.56s |  I love it
2234.56s - 2238.44s |  I if that person is here introduce me to them so I can like hug them and give them a high-five
2238.92s - 2241.36s |  but they actually you're able to glitch it and
2242.32s - 2245.32s |  Skip the part where you would then put everything in non secure world
2245.40s - 2250.40s |  So then you could have unfettered access to the secure element and start doing crazier attacks
2250.76s - 2252.48s |  So I actually looked
2252.48s - 2259.00s |  Extensively into how to write glitching resistant code in software only with a clang pass. We published a paper on it
2259.00s - 2261.60s |  I wanted to call it glitch glitch, please
2262.12s - 2268.52s |  In honor of bitch, please, but academics don't have the same sense of humor that I do. So I had to change it to
2269.28s - 2271.76s |  Glitching demystified or something far more lame
2271.76s - 2278.52s |  But we did show that in software only you can actually do an LLVM pass and make your code
2279.12s - 2285.24s |  Glitching resistant for all practical purposes on your bootloader to keep the the T code at least in the secure world where it belongs
2285.92s - 2316.06s |  So how effective are the RFID blocking badge holders and little sleeves that they get you?
2317.30s - 2322.78s |  They're very effective that like when I was doing this research that was actually my number one thing
2322.78s - 2328.94s |  I recommended to everybody and probably got the most enemies from cuz I'm like, hey these things are annoying
2328.94s - 2334.90s |  But they absolutely work and like I work here. I'm trying to protect, you know the stuff we're doing
2335.06s - 2340.74s |  So my favorite ones they have these badge holders that are plastic and they're spring-loaded
2340.74s - 2343.46s |  You can put your ID in them that has a Faraday cage in the back
2343.50s - 2349.98s |  but then you can flip the plastic up tap your badge and flip it back because otherwise you're like in this fight every morning trying
2349.98s - 2351.98s |  To like slide it out of this stupid metal thing
2352.34s - 2355.22s |  They're not cheap. So they're hard to do at scale
2355.22s - 2360.70s |  but I don't know they bought me one because I guess I exposed all this stuff and
2361.38s - 2365.62s |  They were not happy with me, but happy enough to get me the fancy one
2365.86s - 2369.18s |  But they totally work like RFID wallets and stuff
2369.18s - 2375.66s |  I guess the one thing I didn't mention here the one attack that can pretty much never be protected against and smart cards
2375.66s - 2380.58s |  It's called the relay attack. So this is where I would come near you with a software-defined radio
2380.58s - 2388.22s |  I would touch somewhere near your card and I my friend anywhere on earth with another software-defined radio that just re-emits back and forth
2388.46s - 2394.98s |  So there's almost no way to defend against that unless you have some like capacitive touch on the smart card that would stop it
2395.46s - 2397.92s |  And that's really like those RFID wallets
2398.18s - 2400.66s |  That's what those are all about because somebody could come up to you
2400.66s - 2402.58s |  You're nowhere near the cash register
2402.58s - 2408.44s |  Someone else has a Proxmark up their sleeve and then they just bought you know, a really fancy dinner on you. Thank you very much
2408.76s - 2445.08s |  So, yeah, they totally work though we've tested them in the lab and they do their job the question there was about the the
2445.72s - 2450.76s |  Legal action since the you know, this key has been leaked since 2010. Has there any been class action suits?
2450.76s - 2456.04s |  I I don't know. I and I don't know what the law is around that
2456.04s - 2461.80s |  I actually have a friend who's a law professor in Texas and asked her to speak recently about cyber security law
2462.24s - 2468.00s |  In particular and I came out of that talk with far more questions than I got answers. It is extremely
2468.76s - 2472.60s |  Complicated and confusing it does seem to me though
2472.60s - 2480.00s |  just like a gut feeling that if there's a security vulnerability the fix for it should be free for customers and it should be like
2480.80s - 2488.68s |  Strongly advertised like hey, you haven't updated yet. Maybe you should consider this free firmware update
2489.08s - 2490.92s |  so I
2490.92s - 2493.56s |  Don't know. I mean though that was part of the reason I also
2494.72s - 2496.80s |  Decided to throw my hat in the ring and try to build
2497.28s - 2501.44s |  Products instead of staying in my every tower just pointing fingers at people saying you did it wrong
2501.52s - 2505.64s |  It is really freaking hard though. I will stress like building a security product
2505.64s - 2510.32s |  It is way harder than it sounds when you're on the offensive side your whole career
2510.32s - 2514.22s |  Like why didn't they just do this and then you're on the other side like oh damn that is
2514.84s - 2519.92s |  That's a lift there. That is that is not as easy as I made it sound in my publication
2520.44s - 2544.65s |  Okay, I should have had this in my talk
2544.65s - 2550.37s |  Is there any way to secure your enterprise today with smart cards that I didn't go over? Yes hundred percent
2550.37s - 2552.37s |  These are just the known vulnerabilities
2552.37s - 2557.25s |  They do there there are cards like the Dez fire even like the my for Dez fire my for ultralights
2557.25s - 2562.57s |  There are cards that are properly like they're using Dez they're using a yes, they're using good cryptography
2562.57s - 2567.05s |  that is not broken so you can get these cards with the good cryptographic standards on them and
2567.61s - 2573.05s |  Key them to your organization and you know, at least for now, there's no known vulnerabilities
2573.57s - 2577.53s |  You're cruising. So yeah, there there are card stocks out there
2578.25s - 2580.25s |  HID even sells Dez fire cards
2580.29s - 2583.57s |  so it's not that like all of their cards have to be this I class or
2583.97s - 2588.73s |  You know any brand and most of these readers will read the good cards
2588.73s - 2591.41s |  So even if you buy off-brand readers, they'll read Dez fire cards
2591.41s - 2595.37s |  They'll read whatever cards you want and you can set them up in a way that you know
2595.37s - 2597.37s |  someone can't just come up with their flipper and
2597.97s - 2601.13s |  We plan on our website if we get time after Def Con
2601.13s - 2602.13s |  So I get this question a lot
2602.13s - 2607.81s |  We want to publish all of the known vulnerabilities kind of like the thumbs down don't buy this and then you know
2607.81s - 2613.47s |  Some of the other card stocks at least we'll try and keep a record of what's been broken. What hasn't on our website?
2614.05s - 2621.74s |  Any other question about how to break into buildings?
2622.38s - 2631.03s |  You got me for I'm legally allowed to stay up here for ten more minutes where I get ripped off the stage is what I?
2631.03s - 2658.62s |  Was told so we can hang out for a little bit more this question. I never know the answer to it
2658.62s - 2660.02s |  Someone's been coming to Def Con forever
2660.02s - 2664.54s |  How dangerous is it to walk around Def Con without the faith without your cards in a Faraday cage?
2664.66s - 2667.78s |  Your credit cards are fine unless it's a relay attack
2667.78s - 2673.94s |  There's no known like wireless attack that I'm aware of that can just clone cards if it is your employee badge
2673.94s - 2678.06s |  I would say if you have a 125 kilohertz card, it's pretty likely
2679.02s - 2682.58s |  Somebody here has read that card last year in the physical security village
2682.58s - 2688.10s |  We had the wall of sheep for everybody that would walk in with their prox cards in their pocket and it it caught quite a few
2688.10s - 2690.10s |  people
2690.70s - 2695.86s |  Yeah, and if you have an i-class card that you know if you're a target and someone bumped into you awkwardly
2695.86s - 2699.04s |  You know, maybe maybe go get a new badge when you get back to work
2699.26s - 2706.66s |  But I I don't know. I generally think that like the shenanigans at Def Con is I hope it's overhyped as someone
2706.66s - 2710.10s |  Who's been coming my whole life, but someone did steal something from our village this year
2710.10s - 2715.78s |  So now I'm like more more on your team like no, there's bad people here. We're not all good
2715.86s - 2719.86s |  We're not all honest hackers. So but I you know credit cards and stuff
2720.42s - 2727.10s |  You know, I would put them potentially in like a Faraday wallet or something, but you don't need to cancel them. You should be fine
2733.50s - 2735.14s |  Yeah
2735.14s - 2762.74s |  Well, let's keep let's keep rifting. Yeah, so if we let's say we go from smart cards to phones
2763.42s - 2766.46s |  What risk would we open ourselves up to so?
2767.46s - 2769.74s |  The biggest one there and the one
2770.26s - 2775.14s |  That I've spent a lot of my research thinking about was the software attack, right?
2775.14s - 2778.14s |  There are phones are on the internet. Our smart cards are not so
2778.86s - 2785.02s |  The question that's kind of been like my brain itch for the past 15 years. Like what if my phone gets hacked, right?
2785.02s - 2786.30s |  like that's
2786.30s - 2789.50s |  That's now an attack factor that wouldn't have existed on a smart card
2789.90s - 2795.38s |  So that's where the secure element the trust execution environment a lot of the hardware architecture
2795.38s - 2797.38s |  That's been built out on these phones
2797.62s - 2800.54s |  back to the bad implementation if done
2800.54s - 2806.26s |  Well, if done correctly, you can actually mitigate that the software based attack
2806.82s - 2808.90s |  It'll never be fully gone, right?
2808.90s - 2813.14s |  There's always gonna be a chance that you didn't have before it was zero percent chance before now
2813.14s - 2819.46s |  It's nonzero, but you really can push it down quite low to the point where you know
2819.46s - 2823.62s |  I think my hope is eventually we can use that to like vote for the president, right?
2823.62s - 2827.70s |  You could have your government ID on your phone and like election day comes out
2827.70s - 2831.10s |  You don't worry about waiting in some line. You could just cast your vote in some secure way
2831.82s - 2835.04s |  the physical attacks on the phone are gonna be no
2835.78s - 2841.58s |  no better than the physical attacks on the card because it's the same chip at the end of the day that you're gonna be attacking so
2842.14s - 2845.14s |  You're not really opening yourself up to another physical interface
2845.14s - 2848.62s |  But now that you do have all these radios you have an application processor
2848.62s - 2853.18s |  You have a lot more other ways to poke on that card remotely
2854.38s - 2856.70s |  That's the one that I've spent most of my research
2857.50s - 2863.14s |  Freaking out about and if you look at all my publications, we're like fuzzing the trusted execution environment on
2864.14s - 2866.94s |  Smartphones to figure out our other apps in there
2867.66s - 2870.38s |  Secure, you know if we put our stuff in there
2870.38s - 2874.70s |  Does it as a neighbor gonna be the one that actually crumbles the whole security? So that's
2876.75s - 2880.15s |  That's the sticky part of putting things on phones it can be done well
2880.15s - 2886.93s |  But it's it's hard and it is gonna take people to collaborate which you know and agree on security standards
2887.11s - 2922.27s |  Yeah, the question was in 2010 Chase sent out a bunch of you know
2922.27s - 2927.07s |  Tap to pay cards and then actually had a recall on them and had to send out new ones
2927.07s - 2931.87s |  And the question was was that because of a security vulnerability? I'm not I'm not sure
2933.39s - 2935.07s |  Probably
2935.07s - 2937.07s |  That seems like a good reason I
2937.23s - 2941.99s |  Know like that is the biggest issue with hardware tokens in general and back to the counterpoint on phones
2941.99s - 2946.75s |  You can actually push over there updates to phones where you can't the physical security keys like I know
2947.67s - 2953.63s |  YubiKey had an issue where they had some of their FIPS keys that had a vulnerability in them and you have to reissue hardware
2953.75s - 2955.75s |  So that is actually another
2956.23s - 2962.03s |  Interesting thing but then you run into these like specter meltdown attacks where you know, not only reissuing hardware
2962.03s - 2965.47s |  But you now have to like refab processors. That's gonna take 10 years
2966.47s - 2972.63s |  So it's it's a tough game like trying to build secure systems. It's it's really really complicated
2972.63s - 2977.03s |  I do think we're getting much better at it though. Just if you look at the frequency of exploits
2977.03s - 2981.51s |  It actually is going down over time. I don't think we're gonna be out of jobs anytime soon
2981.51s - 3000.27s |  But you know, we are doing a good job going forward. Am I familiar with laser fault injection?
3000.59s - 3003.79s |  Yes, like optical glitching attacks on hardware
3003.79s - 3008.55s |  I am familiar with I've actually done one of them not with the intent to succeed
3008.55s - 3013.11s |  but with the intent to learn and it is freaking rad like to look at a
3014.07s - 3019.39s |  electron microscope you're looking at like a couple nanometer resolution on this chip and like I
3020.23s - 3022.67s |  It's sweet. He's like red fuming nitric acid
3023.19s - 3025.79s |  So, how do I think that'll play into this going future?
3025.79s - 3030.17s |  I think that's where you stand on the the shoulders of giants in the smart card world, right?
3030.17s - 3032.17s |  So like these secure elements
3032.81s - 3040.93s |  Really are done. Well to try to prevent against that stuff like these physical attacks have really been thought about in depth
3041.49s - 3047.37s |  So if we can take all of that learned really leverage those secure elements on the phone and all that same technology
3048.09s - 3048.69s |  You know
3048.69s - 3052.73s |  We start to move forward the problem with kind of the industry as a whole
3052.85s - 3059.41s |  It's as being a hardware industry as it has been you're using all these low-end microcontrollers, right? You're trying to drive cross down
3059.93s - 3064.21s |  And I know pics in particular. That's what we had a pick is vulnerable to that attack
3064.41s - 3066.17s |  So we wanted to see that happen
3066.17s - 3066.65s |  We're like, okay
3066.65s - 3072.09s |  We want to spread hit UV light here flip the right protect bit and dump the firmware in particular
3072.25s - 3075.49s |  We were messing around with my Subaru WRX. I was like
3076.41s - 3080.21s |  We were able to roll the odometer and make the odometer say leet
3080.21s - 3085.01s |  That was like one of the fun the fun wins of that and then we just found some other things with known
3085.33s - 3092.45s |  Some other processors with known attacks, so I mean a hundred percent the more security we start putting in our phones
3092.85s - 3097.33s |  The more we need to beef up the defense and if you look at how phones have advanced
3097.33s - 3103.69s |  we're already at the point where like they are really wildly impressive from a hardware architectural point of view and
3104.09s - 3109.09s |  The more we throw in there the better job we have to do and I'll leave you with like
3109.25s - 3111.25s |  My adage on why I think that's a good thing
3111.97s - 3115.01s |  As a defender and I worked for the DoD for a bit
3115.01s - 3120.33s |  So if you watch the movie 300 as a defender, you want to create a choke point, right?
3120.33s - 3121.65s |  Like that's how you beat the Persians
3121.65s - 3126.17s |  You know exactly where they're coming and you can focus all of your attack power there and all your defensive power
3126.65s - 3131.85s |  So we really do put it all in the phone all in the secure element and this one chip that has a single line
3132.13s - 3133.53s |  for IO
3133.53s - 3136.25s |  Like you now your parsers are very
3137.01s - 3140.61s |  Rudimentary can actually be audited quite well
3140.61s - 3144.65s |  And if you get to the point where all you're looking at is this one input
3145.29s - 3147.29s |  Like one input channel in and out
3147.57s - 3153.13s |  You actually have a chance to defend that whereas now, you know with passwords and credentials and smart cards, you know
3153.13s - 3156.89s |  You have all these cards out in the wild. You have no clue what's
3157.77s - 3163.49s |  Happening where all these different technologies. So if you really do put all your eggs in one basket and guard that basket
3163.85s - 3170.53s |  It's not as crazy as it initially sounds or I've at least convinced myself of that after a 15-year academic career that
3170.77s - 3174.57s |  You know, I've convinced myself. I'm not crazy. I don't know if I've convinced others yet. I
3176.91s - 3181.31s |  Have two minutes for either a final question or an awkward silence
3181.95s - 3191.15s |  All right
3191.15s - 3193.75s |  Thank you all so much. Hopefully this was educational and useful
3194.15s - 3199.39s |  swing by the physical security village if you want to play with any of this stuff hands-on and see what it's actually like to
3199.39s - 3201.39s |  clone a card


url: https://www.youtube.com/watch?v=caY7ls4G460
title: DEF CON 32 - What To Expect When You’re Exploiting: 0Days Baby Monitors & Wi-Fi Cams - Mager, Forte
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=caY7ls4G460",
  "title": "DEF CON 32 - What To Expect When You\u2019re Exploiting: 0Days Baby Monitors & Wi-Fi Cams - Mager, Forte",
  "description": "Home surveillance technology is a modern convenience that has been made accessible to the masses through the rise of IoT devices, namely cloud-connected Wi-Fi cameras. From parents monitoring their infants to homeowners watching their entryways, these cameras provide users with access to instant, high definition video from the convenience of a mobile phone, tablet, or PC. However, the affordability of these devices and relative ease of cloud access generally correlates to flawed security, putting users at risk. We set out to explore the attack surface of various Wi-Fi camera models to gain a deeper understanding of how these devices are being exploited. In the end, we devised methods to gain local root access, uncovered user privacy issues, discovered a zero-day vulnerability within a prominent IoT device management platform that allows attackers to gain remote control of millions of cameras worldwide and access sensitive user data, and revealed how these devices may be vulnerable to remote code execution attacks through completely unauthenticated means thanks to an inherently flawed implementation of their underlying peer to peer networking protocol. Along with demonstrating our exploits against live cameras, we will highlight the methods used to obtain our most significant findings and provide guidance on remediating the issues we encountered so these devices can be used safely in your household. We will also invite audience members to probe and attack a camera during our talk and earn a prize in the process!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2401,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.28s | This text was transcribed using whisper model: large-v2

 Good morning DEF CON. Uh we are gonna be hacking some baby monitors and WiFi cameras today.
5.28s - 10.14s |  So a little bit about me, my name is Mark Mager, I'm senior manager of security research
10.14s - 15.18s |  at Elastic. Uh my background is primarily in Windows malware research and reverse engineering.
15.18s - 21.48s |  Uh so what do we need to know about uh WiFi cameras and baby monitors today? Um basically
21.48s - 24.52s |  we're gonna assume they're the exact same thing because they pretty much have the same
24.52s - 30.92s |  feature set. Uh they're literally marketed and sold as equivalent devices. So uh what
30.92s - 37.08s |  we're talking about is the $10 cameras you can find on Amazon uh that require internet
37.08s - 42.92s |  connectivity to that specific vendor's cloud platform. And there's very basic operations,
42.92s - 48.12s |  pan, tilt, zoom, uh things along those lines, motion detection, whatever. But yeah that's
48.12s - 52.88s |  the what we're talking about when we say WiFi cameras for today. Uh so why WiFi cameras?
52.88s - 59.68s |  Well there's literally almost 125 million households across the world that have these
59.68s - 66.36s |  cameras installed within their house. So uh these things are everywhere. Um and they're
66.36s - 70.72s |  obviously gotten going anywhere and they're super cheap. So you're gonna find them everywhere.
70.72s - 75.14s |  Um the attacks that are typically associated with these cameras, what you're probably gonna
75.14s - 81.76s |  hear about usually is uh people spying on babies uh and families, terrorizing them,
81.76s - 87.24s |  that sort of thing. Uh a bit upsetting there. And even things like uh Russians performing
87.24s - 96.24s |  uh reconnaissance on targets within Ukraine. Uh so when we set out to uh evaluate the attack
96.24s - 101.32s |  surface for WiFi cameras uh we wanted to break things down into a few different uh common
101.32s - 107.90s |  attack vectors. That broke down primarily into leak credentials and cloud vulnerabilities.
107.90s - 115.74s |  Those seem to be the most common um attack vectors, the most frequently seen ones um
115.74s - 121.30s |  in uh more of the the attacks that we kinda see across the board. Um yeah so kinda focusing
121.30s - 128.22s |  on those two, you know that's certainly what we wanted to kinda uh dig into was any vulnerabilities
128.22s - 135.26s |  specific to the cloud platforms, uh the applications that control the cameras, and uh the camera
135.26s - 144.31s |  hardware itself. Hello DEF CON. I'm Eric Forte and uh doing the presentation with Mark
144.31s - 149.27s |  and I'm a Security Research Engineer at Elastic. I'm on the Threat Research and Detection Engineering
149.27s - 155.47s |  team, otherwise known as TRADE. And my background is in Linux software development, IoT systems,
155.47s - 161.83s |  UAVs, civil space sector, and then also doing some threat research. And so when we're talking
161.83s - 165.75s |  about these cameras, we're for the purposes of this talk, we we looked at a number of
165.75s - 171.03s |  different cameras, but we're gonna primarily focus on the WandsView Q5 and the WandsView Q6.
171.03s - 178.11s |  And as far as why we picked these cameras, it was uh sort of clear to see on the Amazon reviews
178.11s - 182.35s |  that they uh might have something for us to look at, some vulnerabilities that other people had
182.35s - 191.23s |  just come across because they were readily hacked enough that um that it took notice. So these
191.31s - 197.47s |  cameras are made by WandsView, but there are other vendors that also produce cameras such as
197.47s - 202.35s |  Sonado and some others as well, which we'll touch on a little bit more in a little bit. But they're
202.35s - 207.95s |  primarily under the AJ Cloud management infrastructure. And so this is gonna be the
207.95s - 214.63s |  cloud services that provide you with the apps, with the weight of connecting to it. So they may,
214.63s - 218.83s |  the WandsView versus Sonado versus others may have their own little differences in the apps
218.91s - 224.91s |  themselves, but primarily this cloud interface is with AJ Cloud and we'll get into a lot more of
224.91s - 230.67s |  that in a minute. So when we were first with these cameras, we kind of looked at a few different
230.67s - 235.95s |  approaches for how we were gonna try and see if we could get some of those similar Amazon review
235.95s - 241.15s |  results. So first, we were looking at remote access. So this is gonna be accessing the camera
241.15s - 246.99s |  through whatever companion app that ships with with the camera. We also were gonna look at some
246.99s - 252.43s |  local attacks. So it's gonna be some active and passive networking recon in addition to seeing
252.43s - 257.63s |  what else other services and things were running there. Also looking at some device physical
257.63s - 263.31s |  manipulation, which obviously these are Wi-Fi cameras. They're not necessarily like closed
263.31s - 268.83s |  circuit TV cameras. So we're expecting that there's gonna be some physical attacks, which there are,
268.83s - 275.23s |  we'll get to that. But it's still, again, as an attack vector can enable some other aspects.
276.19s - 282.75s |  Then finally, looking at the hardware itself. So looking at the chip and seeing what we can use,
282.75s - 286.91s |  what we can either get the firmware off, what we can do to kind of, again, extend that vulnerability
286.91s - 291.95s |  process, look for serial communications and things like that, which spoiler alert, we have,
291.95s - 299.07s |  we found some over, over UART. So for our lab setup, we have a number of different things that
299.07s - 303.79s |  we wanted to look at, right? So we've got different apps. So, so we want to have a very controlled
303.79s - 308.43s |  environment because we, we know say one, they're easy to hack. So we don't want to be hacked
308.43s - 314.67s |  ourselves. But on top of that, we know as these are largely say Chinese make cameras that they
314.67s - 320.11s |  may also want to be watching what we're doing. So we wanted to have a completely different setup.
320.11s - 325.63s |  And so we have a mobile hotspot. I like the T-Mobile T9s. They're cheap. You can get them
325.63s - 331.15s |  for about 20 bucks and they do the job great. We have the camera of course itself. Then we needed
331.71s - 336.51s |  say Windows and Linux operating systems. You don't actually need Linux, except I would argue that you
336.51s - 341.15s |  do, but, but, but practically speaking, you don't need Linux to be able to run any of these things.
341.15s - 347.95s |  But, but we, we use that, but we did need Windows to also look at the companion Windows app in
347.95s - 353.55s |  addition to the iOS and Android apps, which we had phones and virtual machines set up for as well.
354.99s - 359.31s |  From a software side, we use a number of different tools, including say Wireshark,
360.27s - 364.91s |  running Android Studio to try and see what we could find out from the app, various other sort
364.91s - 372.19s |  of decompiling mechanisms, and also using the Elastic Stack to look at the network communication
372.19s - 376.91s |  logs and how we can parse some of the different protocols that we saw. And we will, again,
376.91s - 380.83s |  we'll talk to that more in a little bit, but specifically looking at some peer-to-peer traffic
380.83s - 386.99s |  there. From a hardware standpoint, since we wanted to do the full gamut of going from complete
386.99s - 391.95s |  hardware takedown as well as looking at all the software, we had some, some hardware teardown
391.95s - 399.15s |  tools. I like the, what iFixit has, but of course you can take your pick. Then we needed some USB
399.15s - 404.99s |  TTY connector, right? So in this case, you know, it's just your typical Adafruit USB TTY serial
404.99s - 412.03s |  connector there. We also have a, and we'll get to it more in a minute, but using the GreatFET 1
412.99s - 417.79s |  to, as a logic analyzer, to, and to be able to read voltages and things like that in case we
417.79s - 422.43s |  needed to actually like hard pull something off of the chip, solder something, or things like that.
422.43s - 426.35s |  Ultimately, we didn't need to do that, but we were prepared for that nonetheless.
427.79s - 432.99s |  Raspberry Pi, because it's easy to image and then make it, and distribute. So for,
433.79s - 437.63s |  for having, for doing cross-compilation and things like that, cheap, easy to come by.
437.63s - 446.67s |  And then also, we used Alpha Wi-Fi, just a USB Wi-Fi NIC, which for us, why this was important,
446.67s - 452.51s |  and why you'll need some NIC that you can get active, or rather passive sniffing on,
452.51s - 458.67s |  is because you're going to want to capture all of the traffic going from the camera to the cloud,
458.67s - 463.15s |  and not just what will appear as network traffic. And we'll get to that in a little bit,
463.23s - 467.79s |  because you're going to, if, to follow along, you'll need to, to parse some, some additional
467.79s - 473.55s |  protocols. So getting a little bit into our remote and local recon, initial attacks were
473.55s - 479.47s |  limited. They had a fairly locked down attack surface. The active network and local reconnaissance
479.47s - 484.75s |  doesn't reveal too much, or too much interesting as far as running on the traffic, the, or rather
484.75s - 491.87s |  running on the camera. The network traffic itself is fairly mundane. It uses encrypted web sockets,
491.87s - 495.39s |  which good sign, right, that they are at least using encryption, things like that.
496.75s - 501.47s |  So you, we tried to do some man-in-the-middle attacks, but ultimately we weren't particularly
501.47s - 506.83s |  successful with that. Looking at the apps themselves, they were likely obfuscated with
506.83s - 513.15s |  ProGuard. We couldn't, just from the, from being, unpacking the APK, get too far there.
514.59s - 520.43s |  But, so those APKs were just not easily that debuggable. But just as a quick note,
520.43s - 524.51s |  ultimately there's three lines of communication. We're going from the mobile app to the cloud,
524.51s - 528.75s |  the mobile app to the camera, and then also from the camera to the cloud, and then the mobile app.
528.75s - 532.67s |  And that, just as a sort of primer, we'll get into that more in a little bit.
534.03s - 539.71s |  Just as far as the physical device itself, again, we weren't really expecting it to be that secure.
539.71s - 544.75s |  It has an exposed reset button. So if you had this sitting, like let's say up here on stage,
544.75s - 549.31s |  if you were to walk by, hit the reset button and then flash a QR code, you could steal the camera
549.31s - 553.55s |  and then now it's yours. You have full control over it. Again, that's not particularly surprising
553.55s - 559.07s |  because that's part of the expected setup process. So, so in that sense, there's no,
559.07s - 565.95s |  once you have reset the camera, there's no verification. So there's also an exposed SD
565.95s - 571.23s |  card slot. So as we came to discover later, this can be used to load alternative firmware as well.
571.23s - 576.11s |  We'll get into what the bootloader looks like in a minute too, but this, if you were to craft a
576.11s - 580.59s |  malicious SD card, you could go plug it into the camera and then also have a field day there too.
582.03s - 587.23s |  The hardware recon starts to get a little bit more interesting. So when we look at the chip,
587.23s - 593.79s |  it's an Express T31 SoC. It's primarily a MIPS processor, but it also has a companion RISC-V
593.79s - 598.83s |  processor. But the primary thing I want you to focus on for the sake of the demonstration
598.83s - 606.27s |  is that we have an I2C and UART bus that we could be looking for right on the hardware,
606.27s - 613.87s |  on the chip itself. We also have a secure boot, which may, you know, that could throw a wrench
613.87s - 618.91s |  into things. And then we also have a hardware watchdog supported by this chip. Doesn't necessarily
618.91s - 623.87s |  mean they're using it, but again, these are things that we can look for in our hardware recon.
624.43s - 632.03s |  So in tearing down part of the camera, we found a potential UART, UN access ports there.
632.03s - 638.11s |  And so we connected a logic analyzer, the great FET-1, looked at the voltages, used some of the
638.11s - 646.59s |  protocol detection, saw that it appears to be UART. And if we look at the actual signal, we saw
646.59s - 653.31s |  that it indeed was. So we go ahead and use screen, but you can use again, whatever your favorite tool
653.31s - 661.95s |  is to connect over default baud rate to UART. And lo and behold on boot, we have UBOOT. So that
661.95s - 668.27s |  of course is useful for us, but also we in further expecting this, that secure boot is not enabled
668.83s - 673.71s |  by default, as far as the, on the camera, even though the chip supports it. So we can just do a
673.71s - 679.47s |  quick boot into single user mode and get a root shell so that we can start poking around further.
679.47s - 684.43s |  Now this camera was particularly easy to do this because you could just straight set the
684.43s - 689.23s |  environment variable, the environment variables for UBOOT to be able to boot into single user
689.23s - 693.15s |  mode and get root. Other cameras that we looked at were not as simple as this. And sometimes you
693.15s - 698.11s |  have to use memory offsets and things like that, but, but this one in particular, what was fairly
698.11s - 704.59s |  straightforward. So again, we can hit boot and then run, then just drop into our root shell
704.59s - 710.03s |  and then be able to poke around on the camera. So when, now that we're there, so a few things
710.03s - 714.43s |  that we want to then, then do to go forward. First off, we may want to try and establish
714.43s - 718.91s |  persistence, but if you've done this type of attack before going to say a single user mode,
718.91s - 724.11s |  especially on embedded devices and just embedded devices in general, you might see that you're on
724.11s - 731.39s |  a read only file system. Well, many times this is only read only ish. It's not quite truly read only.
731.39s - 739.07s |  So if we take a look at Fstab, we can see that a number of these mount points are separated,
739.07s - 747.31s |  but then also they are TempFS shares. So we can then you make our own TempFS partition,
747.31s - 753.79s |  or just mount a TempFS partition for read, write access, modify the desired settings. And we can
753.79s - 758.99s |  run whatever we want, of course, and have, have persistence, which largely for these type of
758.99s - 763.87s |  devices, you will need this type of interface, whether it be for, there's other methods for
763.87s - 768.91s |  logging, but again, when, when Linux is running, it often needs to be able to make some level
768.91s - 773.71s |  modifications. So this is just walking through one way of doing that of saying, Hey, I want to
773.71s - 781.79s |  create a, a TempFS share for dev, and then go ahead and mount it. And then also then mount Etsy
781.79s - 788.35s |  such that I can make Etsy read, write as well, which of course gives us access to,
788.35s - 794.51s |  to some other things. And so just demonstrating there that if I run that, if I just create a
794.51s - 800.83s |  file, then it does, in fact, it show up as opposed to when it didn't before. So if you want, so
800.83s - 804.03s |  that's just one way, of course, then you can go and do whatever you want from that perspective.
804.91s - 809.87s |  But if you want to go log into the existing root user, of course, you can pull Etsy password and
809.87s - 816.99s |  then go and just use John the Ripper or something to, to crack that hash and, and go from there.
816.99s - 820.75s |  But for, for our purposes, again, we want to keep going, looking for the other software
820.75s - 826.11s |  vulnerabilities. So this gives us a, an easy way to pull the firmware over the serial connection.
826.11s - 830.99s |  So we, and in addition to the firmware, we're pulling a JFS to read, write partition containing
830.99s - 836.83s |  any log data, again, just might be useful for us. So this is just demonstrating how you can,
836.83s - 840.99s |  one way of pulling the firmware. There are a number of different ways, but this is just how we
840.99s - 847.87s |  did it using, using binwalk. And then of course, just echoing the bytes out in the appropriate
847.87s - 853.23s |  format over the serial connection. So with that, I'm going to hand it over to Mark to see what he
853.23s - 860.40s |  did with the firmware. All right. So as Eric mentioned earlier, we definitely were running
860.40s - 867.92s |  into issues with the iOS and Android apps for Wansview specifically, right? So we're hitting
867.92s - 872.96s |  our heads against the wall a little bit. So we kind of back things up a little bit and went directly
872.96s - 879.60s |  to Wansview site and they host a version of Wansview cloud that is for older versions of
879.60s - 885.92s |  windows. I think it says windows seven specifically on their site. But the main takeaways from that
885.92s - 891.36s |  is that that app is still compatible with all Wansview devices. It does have a limited feature
891.36s - 897.52s |  set. I mean, they're still trying to push you towards using the apps. That's totally their
897.52s - 902.80s |  sort of thing because they want everybody to sign up for their cloud plan so they can make more money
902.80s - 911.28s |  off of everybody, not just the $10 sales from the device itself. A couple of other things related
911.28s - 917.28s |  to that, this windows app is it does generate a significantly less amount of network traffic
917.28s - 922.72s |  that's going to come in handy later. And the binaries are not packed. Eric mentioned that
923.76s - 929.52s |  the APKs look like they're probably packed with ProGuard. So, you know, definitely being able to
930.16s - 936.48s |  disassemble and decompile and debug pretty easily. That helps out quite a bit. And then
937.36s - 943.84s |  last but certainly not least is that it does generate a very, very verbose debug log file,
944.40s - 949.76s |  which I'm going to dig into right now. And the first thing we noticed when we ran the first time,
949.76s - 956.40s |  it logs user account credentials in clear text. That's obviously terrible. So, yeah,
956.40s - 963.68s |  not a great sign of things. And as Eric mentioned before, we had significant difficulties trying to
963.68s - 968.32s |  man in the middle any of the any of the app traffic before. So, we had no visibility into
968.32s - 976.40s |  that. But hopefully their developers decided to actually log all posts and post requests and
976.40s - 980.96s |  response data. So, it's all there in the clear. Who needs to man in the middle anything when you
980.96s - 988.81s |  have it in the clear on a file on disk? So, yeah. So, digging into it, yeah, we could definitely
988.81s - 994.17s |  get a ton of insight into the sign on process that we had we did not have before, including
994.97s - 1001.61s |  the actual endpoint APIs as well as, you know, all the fields that are involved both in the
1001.61s - 1007.77s |  requests and responses. So, you know, the first thing here is the app startup endpoint. It's not
1007.77s - 1016.25s |  really a ton there. It's more just initial setup. This check is more just to see if this is a valid
1016.25s - 1022.89s |  account that you're attempting to sign on. And then this here is where the actual let's see,
1022.89s - 1029.37s |  yeah, as an initial account where, but yeah, challenge involved where the tokens generated
1029.37s - 1034.49s |  for that specific client application. And then there's a little bit of a key exchange that
1034.49s - 1040.25s |  happens. But yeah, not too much else going on there. This is where the sign on really begins.
1042.01s - 1045.77s |  Yeah, your password is at least salted and hashed. So, it's not set in the clear, thank God.
1046.17s - 1053.37s |  And then yeah, I mean, it's mostly just to initialize the session and to confirm that
1053.37s - 1059.29s |  you are allowed to log into this account. From there, we, things really start to get interesting
1059.29s - 1065.85s |  because now we can, now that we're logged in, we can request a list of devices that are associated
1065.85s - 1071.69s |  with that specific account. And as you can see here, there's a specific device ID along with
1071.69s - 1080.73s |  some more configuration information, primarily endpoint URIs. And then there's another device
1080.73s - 1088.25s |  configuration API endpoint that's hit. This is very notable. We're going to refer back to this
1088.25s - 1096.97s |  later. But this is where a device ID is first transmitted from the application to the cloud.
1097.93s - 1104.97s |  And more configuration information comes through. We'll dig into that a bit. And then the last
1104.97s - 1114.01s |  request we really dig into is Fetch Infos. And this provides a much, much larger picture of
1114.01s - 1122.81s |  the data that is stored for that specific device. And there's a lot to kind of dig into. But what
1122.89s - 1129.05s |  you'll want to really highlight on is there's a snapshot URL that's provided. And that just
1129.05s - 1134.73s |  happens to be publicly accessible. And that's a picture of my kitchen. So from back in April.
1136.49s - 1143.29s |  So digging further into more of the response data, there's a few things certainly to note
1143.29s - 1149.85s |  here that are a bit concerning, right? The firmware version, the very specific firmware
1149.85s - 1156.89s |  version that is running on the device itself, that's referenced there along with the next
1156.89s - 1163.21s |  firmware version they're supposed to upgrade to, along with the actual SSID that the device is
1163.21s - 1167.53s |  currently signed on to, along with some other network configuration information,
1167.53s - 1174.65s |  including its MAC address. And then we also have geolocation data in the form of
1174.73s - 1182.49s |  uh you know time zone data and things like that. So going back to the device configuration uh
1182.49s - 1189.37s |  request, what we tried to do first is we wanted to see if we could actually access other devices
1189.37s - 1195.45s |  that weren't associated with the RPAS particular account. Um so we tried a very naive approach
1195.45s - 1201.61s |  where all we wanted to do was simply just replace the device ID in that particular request.
1201.61s - 1206.41s |  And uh without really doing a significant amount of reverse engineering, we can locate that
1206.41s - 1212.25s |  pretty easily based off of the verbose uh log data. Because if we just look up post request,
1212.25s - 1215.85s |  uh we can you know we can see how many times that's specifically logged
1215.85s - 1222.73s |  uh to the uh to the log file. And then we can cross-reference that with um the disassembly
1222.73s - 1229.93s |  in IDA in order to target the specific uh device configuration post request uh to get a better
1229.93s - 1236.01s |  idea of where we would want to jump in. And so some digging further into um the particular
1236.01s - 1242.49s |  function, um what we decided to do is we needed to set a breakpoint at this particular uh address
1242.49s - 1249.05s |  which would be before the post request actually goes out um before the uh the JSON is fully uh
1249.05s - 1253.53s |  fully formed as well. Um you know we're going to swap out the device IDs and memory and then
1253.53s - 1260.01s |  resume execution. So pretty straightforward. Uh what this uh ends up kind of looking like is you
1260.01s - 1265.61s |  know I wrote up maybe a 60 line uh Python script that that does this all for us uh which we will
1266.17s - 1276.81s |  dig into right now. Okay so what we have right here is um well first I'll demonstrate that
1276.81s - 1291.92s |  this account is so we already have one specific um camera that is tied to this account
1292.64s - 1298.72s |  and it's offline at the moment so nothing you know particularly concerning there right.
1298.72s - 1313.71s |  Uh we'll attempt to account uh to connect to it uh but nothing's going to happen. Now if we kick
1313.71s - 1319.39s |  off the exploit script what it's going to do is it's going to launch the same Wansview cloud for
1319.39s - 1329.23s |  Windows app uh we'll proceed to sign in as expected um and once we hit our breakpoint
1330.03s - 1336.83s |  we will swap out the device ID in memory uh and then once it says finished here
1336.83s - 1354.68s |  uh it will resume execution and we're online. So the thing is
1355.32s - 1363.66s |  so yeah we can we can do everything in the app we can we can pan and tilt um
1364.86s - 1369.26s |  yeah I mean that like I said it's a it is a bit more limited feature set compared to
1369.82s - 1377.58s |  the uh the mobile apps but basically right we've proven we can get access to uh an account that or
1377.58s - 1383.74s |  a device that's not associated with our account. It's obviously a very very uh significant uh
1384.30s - 1392.94s |  uh access control vulnerability um so yeah you know certainly that was a pretty big discovery
1392.94s - 1402.12s |  um you know right off the bat. So you might have seen in the background that there was a you know
1402.12s - 1407.96s |  certainly a lot of uh network traffic uh being generated in the background um it was all primarily
1407.96s - 1416.04s |  UDP um but we hadn't really no idea what it is in particular um now doing research before we
1416.04s - 1423.32s |  submitted Defcon we did come across uh a particular IoT peer-to-peer protocol uh called PPPP
1423.88s - 1431.96s |  um that was um pretty significantly researched and detailed by Polymer PC he has a website
1431.96s - 1439.88s |  um he presented a Defcon 28 in 2020 um fully tearing down the protocol and all that so uh
1439.88s - 1445.16s |  ideally this was going to be something that uh you know maybe that was going to be in use here too
1445.16s - 1452.52s |  so we kind of set out to explore that uh by just looking for references to P2P and and PPPP uh and
1452.52s - 1459.32s |  yeah sure enough within the Wansview cloud uh binary itself as well as the uh the DLLs we sound
1459.32s - 1465.08s |  we found you know numerous references uh even references to their specific PDBs which reference
1465.08s - 1472.20s |  both uh you know you know multiple peer-to-peer terms so yeah we're um pretty sure that we're
1472.20s - 1479.16s |  dealing with the same protocol and going from there then uh there is a excellent uh disector
1479.16s - 1484.36s |  for this peer-to-peer protocol that is uh available and posted on GitHub as of last year
1484.36s - 1488.76s |  um you know we load it in and all of a sudden that UDP traffic we have no idea what it is
1488.76s - 1494.44s |  turns into a very recognizable uh messaging sequence uh that's associated with peer-to-peer
1494.76s - 1502.76s |  uh so in very very briefly the peer-to-peer protocol is used by a ton of IoT devices across
1502.76s - 1508.04s |  hundreds of vendors it's been in use for uh you know the better part of the last decade if not
1508.04s - 1514.52s |  longer um it uses UDP hole punching in order to circumvent uh restrictive network configurations
1514.52s - 1519.96s |  uh and it allows you uh you know these apps to connect to the cameras from anywhere in the world
1519.96s - 1523.48s |  right they would they want it to be as accessible as possible right that's all point of these
1523.48s - 1528.76s |  devices um and yeah sometimes the connections are either they're either direct to the camera
1528.76s - 1533.24s |  depending on the configuration or they go through a relay uh if they have to if they have to um
1534.12s - 1543.61s |  you know get around certain restrictions uh all right nothing to do so now we have established
1543.61s - 1549.85s |  some initial access right so we also have as we looked at a little bit before the firmware which
1549.85s - 1555.85s |  we can now go into some of some of that static reverse engineering we have packet capture for
1555.93s - 1561.77s |  the camera and the app network communications we have log files from both the windows and the
1561.77s - 1568.33s |  camera logs the logs as when we logged in before under root we of course have access to all of the
1568.33s - 1575.29s |  the d message logs and things like that as well and then um we can get the camera logs from any
1575.29s - 1581.61s |  of its hardware mechanisms as well for the audio and camera hand tilt zoom etc so now we want to
1581.61s - 1587.29s |  kind of establish some more advanced access for looking for some additional exploits so one or
1587.29s - 1592.41s |  first we're going to look for that live log output for some immediate feedback to determine some of
1592.41s - 1598.25s |  the control flow again from the windows app right we were able to see that some of the they are
1598.25s - 1603.37s |  logging the post request and responses so we're hopeful that they're going to do something similar
1603.37s - 1608.33s |  on the camera but we also want to establish a we want to have a debugger running on that camera
1608.41s - 1614.97s |  so we can look at some of these applications and see what we can do so first for live log output
1614.97s - 1620.81s |  it's very very simple very easy you plug the uh serum you just get your serial shell over you
1620.81s - 1625.45s |  aren't plug it into say in this case a raspberry pi but again you could use whatever you like
1625.45s - 1629.93s |  and it spits out the logs over serial by default so you don't even necessarily need to use the the
1629.93s - 1635.21s |  root access or boot the single user mode to just get the logs but again that's just one way of
1635.21s - 1642.17s |  doing it but one thing that we'll quickly run into is the kernel watchdog so if the watchdog
1642.17s - 1649.45s |  is not written to it reboots the camera so this what we're seeing here is if you try to kill the
1649.45s - 1656.01s |  init the primary app or in this case we'll get to it in a minute but if you start to kill off things
1656.01s - 1662.01s |  in the camera to go look at them or pause things it will trigger the the kernel watchdog process
1662.01s - 1667.53s |  which will then reboot the camera this isn't the only say security mechanism this is just the one
1667.53s - 1672.25s |  that the primary one that you would have to get around to be able to run a debugger to be able to
1672.25s - 1677.93s |  look at the primary application that they're running on the camera which they call init app
1677.93s - 1684.25s |  which is which handles all of the connection to the aj cloud providing all of the video streaming
1684.25s - 1691.77s |  and the rest of the control the camera they wrap this init app in a daemon.sh script which is just
1691.77s - 1696.73s |  a simple while loop that says hey keep kicking off the init app if I have to kick it off more
1696.73s - 1701.53s |  the next number of times reboot it again acting sort of like again a catch-all in case something
1701.53s - 1708.33s |  went really wrong but that init app is reporting into the watchdog and so this is that's so if you
1708.33s - 1712.97s |  either kill the init app or again kill the daemon and then kill the init app that's where you're
1712.97s - 1717.21s |  going to end up rebooting the device and so if you're using single user mode to get root you're
1717.21s - 1722.65s |  going to to lose that and I and some of the unless you have set up some level of persistence
1722.65s - 1728.57s |  you're going to lose any of the the edits as well so of course next step is to defeat the watchdog
1728.57s - 1732.89s |  so there are a couple of approaches here right that you could do so the first one um which you
1732.89s - 1738.81s |  can actually get this example right off from the uh the kernel watchdog 8 api um information from
1738.81s - 1743.93s |  the the linux kernel you could just simply write some c code to keep sending a live messages to
1743.93s - 1749.21s |  the watchdog right and so since we have root access we could do something like that however
1749.21s - 1753.37s |  this approach is not necessarily what we want to do and not what we wanted to do either
1753.37s - 1760.41s |  because the the fundamental problem with this is that while you could keep sending the messages
1760.41s - 1765.53s |  or you could even use like take hold of the kernel semaphores and keep it open just for yourself so
1765.53s - 1772.81s |  init app can't write to it that doesn't necessarily that help you because init app if it can't write
1772.81s - 1778.73s |  to it then it's going to know that you're here and know that you're now disabling its ability
1778.73s - 1783.69s |  to operate and then it may change the way that it's going to operate in this case we know say
1783.69s - 1787.93s |  that it that it does but again that's not necessarily the approach you want to use even
1787.93s - 1792.17s |  though it might work for your environment so there's another way um there's there's other
1792.17s - 1795.05s |  ways other than these two but these are just the ones we're going to talk through today
1795.05s - 1801.13s |  um there's the magic close feature which if you go look in the linux kernel driver uh what the
1801.13s - 1807.61s |  watchdog driver api from linux kernel 2.4.18 you can see that there if you write a magic
1807.61s - 1811.77s |  character in this case an uppercase v there's another character that'll work as well but if
1811.77s - 1817.93s |  you write that to dev watchdog and that's the last thing that gets written to dev watchdog
1817.93s - 1824.17s |  it then can cleanly disable the watchdog uh the kernel watchdog now as a note the camera is not
1824.17s - 1830.73s |  running linux kernel 2.4.18 but it does still work um so your mileage may vary it's running a
1830.73s - 1836.09s |  three dot kernel but um again it still still may work so you could write a simple script such as
1836.09s - 1841.85s |  this or again however you would like to do it to just simply continuously write v and the reason
1841.85s - 1846.81s |  why you may want to do something like this instead of just write v and stop is something some other
1846.81s - 1851.53s |  process especially as you're doing your reverse engineering might come along and reactivate the
1851.53s - 1857.21s |  watchdog so if you want to try and keep making it such that that you're not going to be rebooted or
1857.21s - 1862.57s |  at least as have some protection against that you you might want to continuously write to it
1862.57s - 1868.01s |  so now with the watchdog generally defeated we need to be able to run a debugger on the camera
1868.01s - 1873.45s |  which means we need to be able to compile binaries that can run on the camera um so in this case we
1873.45s - 1881.61s |  discovered that our our camera is a little indian mint um so just as a quick um example we can
1881.61s - 1888.65s |  compile arbitrary c code using just out of the box um like the mips linux gcc compilers we can
1888.65s - 1895.77s |  run a quick hello mips and see so i did not know this at the time when i was doing it i built a
1895.77s - 1902.41s |  tool chain and compiled uh compiled gdb server myself using that tool chain but later on we
1902.41s - 1906.49s |  found that there is a pre-built one that works that that's the link to be able to get to it again
1906.49s - 1911.37s |  again that will be available but what you'll need to do to be able to run gdb server you'll need to
1911.37s - 1916.09s |  make sure that you're exporting the proper paths to get the proper libraries that an app needs
1916.09s - 1920.97s |  then expose it over some port it could be it works over serial i would recommend if you can use it
1920.97s - 1924.97s |  doing it over networking just because the serial debugging can be very slow when you're using this
1924.97s - 1934.57s |  many libraries um again just an example of how to do that um so we can then connect to our um use
1934.57s - 1939.61s |  and this is actually one important note when you're using gdb to connect to gdb server you will
1939.61s - 1945.69s |  likely you very likely need to use the multi-architecture version otherwise it will not
1945.69s - 1950.81s |  work unless you happen to be running um little indian mips on your laptop which at least for me
1950.81s - 1959.21s |  i i'm not um but once you get there again we know that an in-app is calling out to the watchdog so
1959.21s - 1964.89s |  we need to overwrite those functions in memory with no ops to be able to have it not call to
1964.89s - 1970.81s |  the watchdog at all is this absolutely necessary maybe not but it will make it a lot cleaner for
1970.81s - 1974.65s |  us if we just don't have to worry about it so that's that's what we did and you can at least
1974.65s - 1978.89s |  in our case we were able to find that that that those locations were where those functions were
1978.89s - 1986.65s |  and uh we just overwrote them sure so i'll hand it over to mark all right uh so yeah we're gonna
1986.65s - 1992.33s |  skip over the the this second demo on just kind of jump right into it so uh with the peer-to-peer
1992.33s - 1997.13s |  discovery what we wanted to do is build a client so we could actually connect directly to our
1997.13s - 2003.85s |  camera uh and uh issue commands to it in order to attack and exploit it right uh so the peer-to-peer
2003.85s - 2010.33s |  servers you can discover them uh using nmap or mass scan uh and delivering that 4-byte payload
2010.33s - 2018.49s |  uh to udp port 607222 um and yeah so very briefly how to establish a peer-to-peer connection
2018.49s - 2025.37s |  uh you need to send it a hello message from the client uh it'll it'll act back uh you need to
2025.37s - 2032.17s |  query for a specific device id if this peer-to-peer server has any idea of it uh those are device
2032.17s - 2036.01s |  ids are also serial numbers they're found on the bottom or on the back of these devices
2036.65s - 2041.37s |  um and hopefully the peer-to-peer server will say that it knows how to access the device
2041.45s - 2049.05s |  uh and then instruct you to punch a hole to a specific ip and port um and then once we have
2049.05s - 2054.97s |  the idea of where we're supposed to go to uh we can query that specific relay server or the device
2054.97s - 2061.93s |  itself uh you know if we can connect to it um it should hopefully say yes uh and then it'll send
2061.93s - 2066.73s |  its packets back and then yeah your peer-to-peer connection is ready uh so yeah there's a good
2066.73s - 2070.09s |  exploit script that we kind of base some of our work on uh definitely check that out when you
2070.09s - 2075.53s |  get a chance um but yeah basically uh in order to prove things out uh we we looked at how the
2075.53s - 2081.21s |  camera panned initially over wireshark uh it was very easy to tell which specific uh packet
2081.21s - 2087.45s |  belonged to a pan operation uh then we trace that back to uh debug debug log messages from the
2087.45s - 2093.93s |  firmware uh and then actually dug into the firmware itself specifically to find where uh
2093.93s - 2099.53s |  where that log uh message is being generated and what function is primarily handling um
2100.25s - 2107.77s |  a lot of the comms and all that so uh very brief uh demo and we're gonna just kind of jump ahead to
2107.77s - 2117.21s |  our more compelling demo of essentially what you can do um with our discovery of how to build a
2117.21s - 2125.53s |  peer-to-peer client so um what we can see here is there is a uh there's an ini file on the camera
2125.53s - 2132.25s |  itself that has the serial number and what we find out is that that's that is the only way that
2132.25s - 2140.65s |  the device knows what its own device id is and so there is actually a command through peer-to-peer
2140.65s - 2147.45s |  that allows us to overwrite the contents of that ini file so what we're trying to do is overwrite
2147.45s - 2154.01s |  uh the the serial number itself to an arbitrary value that's just going to completely brick this
2154.01s - 2159.05s |  machine and make it completely inaccessible to the internet and essentially the user is gonna
2159.05s - 2164.25s |  have to throw it away because there's no way to restore that unless you have access like we do
2164.89s - 2171.29s |  uh and so we send our packets uh and what we can see here is we pulled up the same ini file
2171.29s - 2178.09s |  and now it's full of garbage and we actually have another command we're gonna send to it that's
2178.09s - 2185.13s |  gonna crash and reboot the cam uh and from there uh what we can see is you know things are kind of
2185.13s - 2191.21s |  already going haywire a little bit uh the camera is attempting to reboot right now but what we'll
2191.21s - 2198.81s |  find out pretty shortly here is that it has uh it will attempt to issue requests to AJ Cloud's
2198.81s - 2203.45s |  infrastructure but ultimately it's going to be unsuccessful because it's sending along
2204.25s - 2213.07s |  absolute garbage uh in its curl requests and if we kind of like skip ahead a little bit here
2213.07s - 2223.68s |  this is a press for time um what we can see here yeah if you if you kind of highlight that
2223.68s - 2231.44s |  there's not much there ah yes so yeah yeah that doesn't really look like a good curl request
2231.52s - 2248.44s |  yes okay so very very briefly um what devices are actually affected by this right uh so Wansview
2249.24s - 2254.60s |  every single device associated with Wansview is affected including pet feeders, light bulbs,
2254.60s - 2259.88s |  indoor and outdoor cameras, uh Galayu as well since they're uh you know an affiliate company
2259.88s - 2267.72s |  of Wansview uh and Sonato as well um and then also Felimi is another uh manufacturer that that we
2268.04s - 2274.52s |  were able to experiment with um but ultimately the affected vendors uh it all stems from AJ
2274.52s - 2281.00s |  Cloud it's whoever's running their device firmware on their cloud platform and this
2281.00s - 2286.28s |  ultimately affects seven different vendors possibly even more we weren't able to confirm all of these
2288.70s - 2293.26s |  so just real quick what are some things that the vendors did right they have certificate web-based
2293.26s - 2297.02s |  authentication it was fairly difficult to do some man-in-the-middle attacks from that
2297.02s - 2301.90s |  they have signed and obfuscated APKs another good thing they have a pared down local operating
2301.90s - 2307.10s |  system that at least attempts to be read-only they could have had secure boot but again they have a
2307.10s - 2312.86s |  read-only ish file system so you have to do some work even with physical access to be able to go
2312.86s - 2317.34s |  and attack the machine what they did wrong of course unauthenticated cloud access are the
2317.34s - 2322.86s |  demos that we showed you again did not require any authentication we have significant verbose
2322.86s - 2327.90s |  debugging in the log app the vulnerable peer-to-peer access and again no secure boot despite
2327.90s - 2333.98s |  the SOC supporting it and it's very easy to manipulate when you have physical access so
2333.98s - 2338.22s |  mitigations of course if you want to use them segment them off your network the critical
2338.22s - 2342.30s |  vulnerabilities in the cloud infrastructure will put your data at risk so we would just recommend
2342.30s - 2349.26s |  not using them at all um again restrict the inbound outbound comms um you basically just
2349.26s - 2354.06s |  want to block all of the the different traffic that you have you could also flash it with a
2354.06s - 2359.10s |  different operating system for sake of time i'm going to kind of run through this really fast
2359.10s - 2364.78s |  open ipc i would recommend you checking it out the at least the q5 is directly uh supported so
2364.78s - 2370.94s |  you could flash it with that but it's surprise uh supports a lot of different socs so um we have our
2370.94s - 2377.10s |  tools that we used for this demo we'll be releasing them shortly on github um so and feel free to
2377.10s - 2382.22s |  follow along with the demo um there's some other future research opportunities again apologies
2382.22s - 2387.10s |  for having to run through this real quick but thank you so much for for coming to our talk
2387.10s - 2393.18s |  um special thanks to of course the following here and feel and definitely follow us um on
2393.18s - 2401.02s |  twitter and elastic security labs so again thank you very much defcon


url: https://www.youtube.com/watch?v=TK3A510jArc
title: DEF CON 32 - Using AI Computer Vision in Your OSINT Data Analysis - Mike Raggo
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=TK3A510jArc",
  "title": "DEF CON 32 - Using AI Computer Vision in Your OSINT Data Analysis  - Mike Raggo",
  "description": "OSINT is a great mechanism for the collection of data, but what do you do with all of it once it\u2019s collected? It can take significant time with the human eye to analyze each image or video. Furthermore, you may miss important artifacts in the foreground or background. Computer vision can churn through the plethora of data to pull out the relevant evidence at lightning speed. For the last 5 years we\u2019ve been exploring the use of Azure and AWS for computer vision to rapidly process large sets of image and video data acquisitions for forensic evidence.Through the use of AI we have analyzed thousands of images and videos to perform object detection, facial recognition, OCR, voice to text analysis, and more. In this session we\u2019ll explore the use of cloud platforms to exponentially increase your analysis of uncovering key artifacts to your case using demos and real world examples. We then apply chronolocation analysis to allow an investigator to paint a true-life narrative, for example an individual with a weapon at a location at a particular time. We\u2019ll provide live demos of common scenarios to reveal benefits to processing your data collections in a rapid, efficient, comprehensive, and accurate manner. We\u2019ll then wrap-up the presentation with additional AI computer vision recommendations and resources.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3159,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.18s | This text was transcribed using whisper model: large-v2

 Good morning, everyone. Good morning. Hopefully everyone got some sleep? Ducks.
12.22s - 17.34s |  Before we begin, we got what? Two minutes? Oh, yeah, the clock. What am I doing? The clock is right here.
18.78s - 21.18s |  Just who's here? This is your first DEF CON.
22.10s - 25.06s |  Wow. Okay, so if this is your first DEF CON,
25.82s - 27.82s |  welcome.
28.62s - 30.62s |  You know, sitting in decks,
30.70s - 33.50s |  we haven't had a nice room like this for, you know, a
34.14s - 40.06s |  while, but 2019 was the last year and every time I look at a room of this size, it feels like
40.94s - 47.50s |  DEF CON of the ye good old days when talks weren't like 20, like 2,000 people and literally like
48.14s - 53.84s |  back in the ye good old days, like in the early 2000s, I mean, yeah, the talk room would be like this small and congregate.
56.06s - 58.06s |  You know, one of the things I tell people is
58.86s - 60.70s |  yeah, there's like
60.70s - 65.18s |  30, 40,000 people now at DEF CON, but the premise is the same
66.38s - 72.94s |  for anyone who, especially if this is your first time coming to the conference, learn as much as you can.
75.58s - 78.78s |  Make good use of your time. Talk to other people.
79.98s - 81.98s |  That's where the real learning happens.
82.70s - 85.98s |  Hallway Con is always, always valuable. You'll learn
86.62s - 88.62s |  probably more than
89.02s - 94.70s |  talking to the person next to you or sitting at the table than going to a lot of talks.
94.86s - 100.22s |  Oh, sorry, man. I didn't want to, I didn't, I didn't want to, I mean to say, I forgot. Oh,
101.02s - 102.86s |  but
102.86s - 105.74s |  no, the, you know, it is the size of the
107.90s - 110.06s |  talk rooms makes a big deal.
110.54s - 117.42s |  You know, it feels, this definitely feels like a more intimate setting than what it, you know, than what it is now.
117.50s - 120.38s |  I mean, I think my last DEF CON talk was like, holy,
121.10s - 127.18s |  you know, there's like, I didn't know what was, it was like eight, it went to 800 people and then it went to like
127.88s - 129.88s |  1,500 and like,
130.22s - 137.42s |  never had the honor of talking to a group of this size. So enjoy your time here at DEF CON.
137.98s - 139.50s |  And
139.50s - 141.10s |  we are now
141.10s - 145.10s |  at the top of the hour. Good morning. It's 10 o'clock
146.38s - 148.48s |  from beautiful Las Vegas, Nevada.
151.50s - 154.30s |  So our first of four talks of the day
157.00s - 159.18s |  presented by that Packet Hacking Village.
159.98s - 161.42s |  And
161.42s - 162.22s |  we
162.22s - 167.66s |  have the honor and it seems like this is like an annual, an annual get-together and
168.46s - 174.86s |  having Mike on stage to give a talk never ever disappoints and you're going to learn a lot. You're going to love this talk.
176.86s - 183.18s |  It is my pleasure to introduce to you all someone that we consider a friend. Mike Rago, everyone.
192.22s - 197.82s |  All right. Well, thanks so much for having me again. Shouts out to the Packet Hacking Village and Ming for
198.46s - 200.46s |  having me back again. Really enjoy
201.02s - 208.14s |  doing these particular talks at DEF CON. I've been coming here for I don't know how many years, I think since year 2000 and
209.34s - 214.22s |  try to never miss a con because there's just so much information and it's a great crowd and lots of friends.
216.22s - 217.82s |  In this particular
217.82s - 221.90s |  talk, we're going to talk about using AI for doing computer vision
222.86s - 228.00s |  to leverage all your data sets you may have across your OSINT data collections and performing
228.48s - 230.48s |  efficient analysis around that.
230.80s - 236.32s |  This is a culmination of a lot of research that myself and a very good friend of mine, Chet Hosmer,
236.80s - 243.68s |  have collaborated on for many years and actually have done talks in the past here in the Packet Hacking Village on
244.56s - 249.28s |  OSINT data collection, data analysis, reporting, pruning down that data,
249.68s - 255.20s |  really making it very actionable rather than really dealing with that wasteland of data and trying to prune that down.
255.20s - 256.88s |  So we'll talk a lot about
256.88s - 262.32s |  some of the previous strategies and just kind of highlight those for you again and then focus on really what we're going to talk about
262.40s - 268.72s |  today, which is looking at those images and video and trying to do a variety of cool and interesting things in them,
269.04s - 274.24s |  but in a very automated and efficient manner and with, in my opinion, a lot better accuracy.
274.24s - 276.24s |  But you know, I'll let you guys judge that for yourselves.
280.66s - 283.78s |  So Ming knows I don't really like to talk about myself too much.
283.78s - 289.54s |  So instead I'll tell you a funny story about how I got into cybersecurity and Ming has heard this story before.
290.50s - 291.46s |  So
291.46s - 292.88s |  it's circa
292.88s - 297.72s |  1994. I'm working at the NASDAQ stock market as a Unix system administrator
298.18s - 302.90s |  and it was long before there were vulnerability scanners out there like Nessus and other things. So
304.18s - 310.58s |  I saw this article on Information Week by a gentleman by the name of Dan Farmer who presented the first couple DEF CONs
311.22s - 317.30s |  and he released a tool called, of all names, called SATAN, which was an acronym for one of the first vulnerability scanners
317.30s - 319.80s |  and in this case for old Unix platforms.
320.34s - 324.74s |  So I thought, hey, it was always one of those types of people, probably much like yourselves.
324.98s - 330.02s |  I'm going to download it and run it wide open on the trading floor in the middle of the day and see what kind
330.02s - 332.02s |  of vulnerabilities I can find.
332.18s - 338.98s |  So obviously not a very bright idea because they accidentally knocked over a couple servers taking down the trading floor in the middle of the day.
339.86s - 345.06s |  But it was a good test of the failover for NASDAQ, failed over without missing a beat.
346.02s - 350.82s |  But I was called into the CISO's office and I fully expected to be fired.
351.30s - 356.10s |  And he said, Mike, I'm here to offer you one of two options. You're either fired or you can take a promotion.
356.82s - 361.38s |  So I certainly didn't want to be fired. So I took the promotion and and asked questions later.
361.38s - 367.06s |  But essentially he said, listen, you clearly demonstrated you could take down the network, albeit by accident.
367.62s - 369.22s |  But
369.22s - 371.38s |  now it's going to be your job to protect it.
371.62s - 376.50s |  So I had to build out first security team there and really start protecting the network.
377.46s - 380.90s |  One other thing I'd just highlight on this slide, you know,
381.46s - 383.62s |  Chet and I collaborate on a lot of research.
383.70s - 387.86s |  If you go back and look at the YouTube videos from the Packet Hacking Village in the Wall of Sheep,
388.10s - 392.42s |  you'll see a plethora of talks that we've done and many of them around OSINT.
392.74s - 398.34s |  So certain call outs I make out in these slides, if you're looking to go back in time and look at in detail at some
398.34s - 400.50s |  of those other presentations we've done around OSINT,
401.06s - 404.26s |  they are out there and on YouTube and Twitch and other places.
406.18s - 410.36s |  One last thing, one of the things I've taken on recently is also mentoring
411.06s - 415.54s |  folks that are looking to get into cybersecurity. They may be in IT today,
415.54s - 420.90s |  they may have graduated college or something else. And we know that there's this big gap between, you know,
420.98s - 427.38s |  folks that want to get into the cybersecurity industry and a plethora of jobs out there, millions of jobs around the globe.
428.10s - 432.18s |  But they all ask for experience, which is kind of odd considering it's an entry-level job.
432.18s - 437.86s |  So what we do is we work with folks and mentor them, give them research projects to work on.
438.02s - 443.22s |  They get that hands-on experience to help build their resume and hopefully land one of those jobs.
445.22s - 447.22s |  All right, into the presentation.
447.94s - 450.66s |  So we know with OSINT data collection,
451.54s - 456.98s |  whether you're investigating a person of interest, a top of interest or whatever it may be,
457.38s - 462.02s |  you typically end up with a wasteland of data, various types of social media,
462.98s - 467.22s |  information from various sites, RSS feeds, all kinds of different things.
467.86s - 473.14s |  And then you're left with the job of sifting through all that data to find the artifacts that
473.62s - 480.66s |  are actually the evidence that you're looking for. It's super time consuming. The majority of the data is worthless that you, you know,
480.82s - 485.70s |  collect. And so what we've talked about last year or the year before in a variety of talks is
486.18s - 490.02s |  collecting a lot of data and using efficient methods for pruning that down.
490.74s - 497.94s |  In one particular case, we talked about leveraging Power BI to sort that data, transform it, find the actual artifacts
497.94s - 504.02s |  you're looking for, and or create dashboards. And that presentation I think is last year that we did that here
504.66s - 506.66s |  in the Packet Hacking Village.
506.82s - 510.52s |  What we're going to talk about today is beyond all of that collection,
511.40s - 514.04s |  I've got a bunch of images. I've got a bunch of videos.
514.20s - 518.28s |  It's time consuming to go through those things and find the artifacts you're looking for.
518.60s - 522.28s |  You may be looking for a particular object like a gun or something else.
523.16s - 528.52s |  In the video, you may want to pull out certain audio, but if you've got a thousand video files
528.76s - 531.24s |  and they're all more than a gig in size,
531.56s - 536.12s |  it's super time consuming to try to watch all those videos and try to find the artifacts you're looking for.
536.44s - 538.44s |  And most of the time you're going to miss them.
538.68s - 542.28s |  So we're going to talk about using AI computer vision and
543.24s - 545.80s |  we'll talk about AWS as well as Azure.
545.88s - 547.88s |  We'll talk a little bit about ChatGBT,
548.20s - 554.36s |  but really kind of give you some thought provoking ideas and kind of a starting strategy in terms of how you can get started
554.44s - 556.92s |  with all of this if it's something that's somewhat new to you.
558.68s - 560.68s |  One other thing I find is
560.68s - 564.68s |  I find it kind of humorous that people refer to it as OSINT because
565.24s - 567.96s |  Chet and I agree that we kind of refer to it more as
568.52s - 575.00s |  OSINFO. You're collecting a ton of information. The intelligence is one small piece of it, right?
575.40s - 579.00s |  So a lot of what people are doing is collecting a wasteland of data
579.64s - 583.40s |  trying to convert it into intelligence or OSINT type data.
584.76s - 588.70s |  So at the end of the day, this really all just begs for some type of automation
589.42s - 592.46s |  and in testing AI and a lot of the research we've done,
592.86s - 599.02s |  computer vision across these various platforms and even what you may be able to do to an extent within Python and other things
599.26s - 601.42s |  can give you the ability to do this kind of thing.
605.13s - 610.49s |  In terms of OCR or optical character recognition, there's a lot of cool artifacts that you can
611.29s - 616.89s |  leverage and identify across images and video. They may be things such as signs or license plates.
617.13s - 623.37s |  There may be things in the foreground such as a store sign or in the background such as a military vehicle
623.69s - 628.97s |  with a specific serial number on it that maybe you can track in various locations across all your images.
629.37s - 631.37s |  We'll talk about a lot of those scenarios.
632.97s - 634.97s |  Also, you can do object
635.51s - 641.85s |  recognition or identification as well. So what type of object or objects are you actually looking for?
642.57s - 644.89s |  Are you monitoring events at
645.45s - 653.29s |  sports games and trying to identify amongst the crowd either inside the stadium or outside if maybe somebody has some form of a weapon?
653.69s - 660.09s |  Object identification can really help you with that and AI is super efficient at identifying those things across your data.
662.70s - 664.70s |  Also, when we talk about video,
664.94s - 666.30s |  there's also
666.30s - 667.66s |  speech recognition.
667.66s - 674.78s |  So whether they're conversations in the foreground or the background, being able to extract that and have the AI
675.34s - 681.90s |  really map out all those conversations for you. Maybe there's specific words you're actually looking for amongst the speech.
682.62s - 686.54s |  All of that speech recognition will also allow you to identify that too.
688.51s - 693.39s |  And then what we really want to do is it's great that we've automated and found all of this stuff,
693.79s - 695.79s |  but then how do we report on it?
695.79s - 699.57s |  How can we maybe consume it in an automated way into some kind of a dashboard?
700.11s - 702.43s |  Maybe I want to plot these things on a map.
702.75s - 708.03s |  We'll talk about some of those things we covered last year and how you can do that and some new ideas this year too.
711.63s - 714.91s |  So getting started with this, we'll first talk a little bit about Azure.
715.15s - 720.83s |  I'll kind of pivot to AWS and we'll kind of go back and forth as we go through the slides across these different topics.
721.95s - 723.55s |  Within Azure,
723.55s - 725.55s |  you can go to the main page,
725.63s - 731.15s |  you can upload images and play around with the optical character recognition as well as the object detection.
731.47s - 735.23s |  And there's also video analysis and a whole variety of other things that you can do.
735.87s - 737.55s |  There's also spatial analysis.
737.55s - 742.99s |  So if you have a video and you're looking at people that maybe come into a room and then leave a room or where they
742.99s - 749.95s |  are spatially, scattered throughout a large room or something else that you are monitoring or that you want to look at,
750.27s - 752.27s |  there's a whole variety of different
752.67s - 754.67s |  components that are available to you.
755.15s - 760.99s |  And if you start to dive into it, we'll talk about how you can train as well based on large data sets,
760.99s - 766.33s |  which we'll get into too.
766.33s - 772.49s |  So in a very simple way, you know, you can upload these images and perform optical character recognition on it.
772.57s - 776.73s |  You can upload an image and for a suite of images and say like,
777.37s - 782.25s |  what have you found in this image and let the AI computer vision identify that for you.
785.44s - 789.04s |  Anybody a fan of the the cult movie, They Live?
789.44s - 791.36s |  Okay, it was actually, you know,
791.84s - 796.08s |  a part of DEFCON a couple years ago, right, where it was sort of the theme for the conference.
796.08s - 798.08s |  So I was super stoked when I saw that.
798.48s - 801.36s |  Throughout the movie, there's all kinds of signs, right?
801.52s - 808.80s |  And, you know, the guys put on the sunglasses and they can actually see these signs that are otherwise somewhat hidden to the casual viewer.
809.68s - 814.24s |  But this is a good example that if you're collecting images and or video,
814.64s - 820.00s |  there's so much stuff going on, like if you've got a cityscape or something else that you're looking at,
820.32s - 825.20s |  like, how do I even look at this and am I going to miss something like a license plate in the background or
825.60s - 830.40s |  something else that's really important, maybe a document that somebody's holding and on the back of it,
830.40s - 832.64s |  you can see what, you know, what it's about.
833.28s - 840.00s |  So, you know, the optical character recognition obviously can create bounding boxes or you can look at the entire image
840.48s - 844.80s |  and have it automatically identify all of this for you. As you can see here,
844.88s - 850.64s |  there's a plethora of things that are identified in the image in a very quick and efficient manner in a matter of a couple seconds.
851.04s - 853.92s |  If you have, you know, a hundred thousand images,
854.16s - 859.36s |  yeah, you can use the back-end training and actually go through that and we'll talk about some of that too.
863.82s - 868.86s |  Common questions I get, you know, what about international languages? Yep, those are supported as well.
869.02s - 874.46s |  So it has the ability to identify that. If you're gathering a lot of OSINT data through social means,
875.10s - 879.26s |  in this case, this was a TikTok video and not only did it, you know,
879.74s - 885.42s |  grab and identify all the characters of whether it be Ukrainian, Russian or something else,
885.82s - 889.82s |  but furthermore, it captured something I didn't even notice in the image,
889.98s - 894.94s |  which is at the bottom in very fine print was their handle for actually for TikTok.
895.34s - 901.58s |  So those kinds of things will uncover artifacts that you probably miss trying to go through image by image yourself,
901.90s - 907.50s |  you know, using a, you know, human type of analysis to really do that vision and identify those things.
907.98s - 913.18s |  I will admit the majority of the time it always finds something in almost every image that I've missed
914.14s - 916.14s |  just simply by trying to look at it myself.
919.88s - 925.18s |  Geolocation information becomes increasingly difficult. If you attended our talk a few years ago,
925.18s - 927.66s |  we were talking about how to collect data
928.46s - 930.70s |  via Twitter and other means and
931.66s - 935.18s |  actually do geolocation on it in a very unique way.
936.30s - 937.82s |  And
937.82s - 943.26s |  as those things become locked down more and more and more becomes increasingly difficult.
944.14s - 951.34s |  But optical character recognition, object recognition, and all of these things can actually help paint a new picture
951.82s - 953.82s |  around the location information.
954.46s - 960.78s |  In this particular case, we had been and continue to do a lot of research around the Russian-Ukrainian war.
961.74s - 963.34s |  In this particular case,
963.34s - 968.70s |  I was actually collecting images looking for military vehicles and you can see that there's one here in the background.
969.18s - 973.84s |  What I didn't notice was the fact that there was a teeny little sign in the foreground
974.30s - 980.86s |  on the station facility there that actually tells me a little bit more about the location and where this is.
981.58s - 987.82s |  So again, if you're having issues with trying to identify where was this picture taken or where was this activity going on,
988.62s - 989.42s |  you know, again,
989.42s - 996.46s |  the optical character recognition of the bounding boxes might pick up on something really tiny in the background or foreground that you didn't even notice.
997.10s - 1001.50s |  We'll talk later about how we took this data, automated it, and plotted it on a map
1001.74s - 1008.14s |  and how we used it for predictive analysis related to the war and we had more than a 95 accuracy with this data.
1011.60s - 1015.68s |  In terms of MIST, I was wondering what it was. It's actually a shipping company
1016.32s - 1017.52s |  in the Ukraine.
1017.52s - 1023.52s |  But there were other signs and things in this image and others that exposed or enumerated in more detail again
1023.60s - 1026.24s |  where these locations were of these military vehicles.
1026.80s - 1029.36s |  And hold that thought because we'll come back to that in just a moment.
1033.64s - 1034.52s |  Also,
1034.52s - 1039.72s |  you know, during the beginning of the war, there were a lot of people trying to, you know, leave the country.
1040.28s - 1042.28s |  And there was, you know,
1042.68s - 1045.40s |  a lot of interesting pictures with mobs of people.
1046.20s - 1051.08s |  And again, in trying to identify where some of this activity was going,
1051.40s - 1057.88s |  the optical character recognition was great at picking up, again, location information based on signs of the train station and other things.
1058.28s - 1062.12s |  Again, this became super useful when trying to plot this out on a map.
1066.49s - 1067.61s |  In addition,
1067.61s - 1069.13s |  license plates.
1069.13s - 1072.09s |  Again, whether it's serial numbers on a tank,
1072.89s - 1075.53s |  letters that are on military vehicles,
1076.41s - 1080.59s |  license plates, and other things, these can be really useful if you identify
1081.45s - 1086.73s |  this vehicle in more than one location and also plotting that in a map and over a timeline.
1087.21s - 1092.73s |  So again, just another example of like a lot of information you may have scattered across, you know,
1092.87s - 1098.57s |  thousands if not hundreds of thousands of images or video that you have and which is really efficient at identifying this.
1102.75s - 1104.75s |  One of the things I also did
1104.83s - 1106.83s |  was, and some of this was,
1108.27s - 1112.91s |  we started to talk about it a little bit in the last few talks over the last few years here at DEFCON,
1113.39s - 1119.47s |  was around tracking all these military vehicles and trying to predict where they were going to, where Russia was going to attack next.
1120.27s - 1122.27s |  And in doing so, I, you know,
1122.35s - 1128.11s |  initially noticed that a lot of these military vehicles had all these serial numbers and things on the sides of them.
1128.51s - 1131.47s |  And, you know, my thought was thinking was that, you know,
1131.71s - 1134.59s |  I don't exactly know where all of these images are coming from,
1134.99s - 1141.79s |  unless the person, you know, that posted it or tweeted it or something else says spotted this vehicle at XYZ location in Kiev
1142.03s - 1144.03s |  or wherever it may be.
1144.19s - 1150.03s |  But I was kind of wondering, you know, from these numbers if I could start to kind of determine, you know,
1150.67s - 1155.31s |  how many, how often across my images maybe this particular vehicle showed up.
1155.79s - 1158.99s |  So if I did have limited vehicle information such as, you know,
1159.31s - 1162.35s |  the person, you know, posted from Kiev or something like that,
1163.15s - 1167.79s |  and then I saw this vehicle over on the other side of the country, which we actually did,
1168.19s - 1173.79s |  we were able to plot that stuff on a map. So pulling out these serial numbers was actually quite useful, too.
1174.51s - 1179.79s |  And there's sometimes various codes, as you can see here, too, that are representative of things, too.
1179.79s - 1184.03s |  So we're talking more than just numbers and letters and some special characters.
1184.03s - 1188.27s |  There may be weird codes, international languages, things like that, that is very good at bringing out.
1190.75s - 1196.27s |  Interestingly enough, this was another picture I had, and you can see the same vehicle number popped up.
1196.91s - 1201.79s |  Now, I was kind of wondering if it was maybe a category of vehicles or this number represented,
1202.19s - 1204.59s |  you know, a military team or things like that.
1204.91s - 1208.75s |  But as we looked through the data more and more, it was very unique to the truck.
1208.91s - 1213.79s |  We looked at the characteristics of the truck and some markings and scratches and things like that in the truck.
1213.87s - 1215.87s |  It was absolutely the same vehicle.
1215.95s - 1222.03s |  So again, it became super helpful in terms of the geolocation or really just plotting these things on a map.
1225.45s - 1228.01s |  Taking this data and making it useful,
1229.13s - 1231.61s |  you know, there's a lot of different tools out there.
1231.77s - 1235.13s |  You know, people use Grafana, Splunk, a whole bunch of different things.
1235.21s - 1240.17s |  I personally like to use Power BI because I like how it can take the data and do
1240.47s - 1244.81s |  transforms on it and look at it in a lot of different ways I didn't think about looking at the data.
1245.93s - 1248.01s |  In addition, it allows a lot of
1248.81s - 1251.71s |  click and point and create various widgets in your dashboard.
1251.93s - 1257.93s |  So now you can use it to kind of sort on the data, maybe by timeline, maybe by object type, maybe by
1259.13s - 1264.89s |  keyword or, you know, that was identified via optical character recognition and a whole variety of different things.
1265.69s - 1272.09s |  This also became very helpful in tying together posts and also the trustworthiness of those posts.
1272.41s - 1274.81s |  So one of the things that is always a challenge is,
1275.29s - 1279.77s |  is, you know, all of this content legitimate or is it meant to throw people off?
1281.93s - 1288.03s |  And so in doing so we were able to sort on the top 5, 10, 25 posters
1288.57s - 1292.73s |  and in cross validating like the data that they had posted said, you know,
1292.81s - 1298.33s |  these are the most trustworthy people that are posting a plethora of things around military vehicles or other things.
1298.81s - 1300.33s |  So sorting that
1300.33s - 1304.89s |  became very useful, very practical and was great because in a point and click I could say, okay,
1304.89s - 1309.29s |  I got it sorted in the way that I wanted. Now click, create a PDF report, boom,
1309.37s - 1313.37s |  I've got my triage report ready to use and, you know, put into action.
1315.79s - 1320.35s |  There's a variety of different widgets across all these different, you know, tools and many others.
1321.15s - 1326.91s |  In this particular case, there's all kinds of cool plugins. So there's word clouds and things like this.
1327.47s - 1334.91s |  What was really interesting about this one was I was not looking at the Oblast region of Kiev at all.
1335.23s - 1339.23s |  I was looking at other regions in Kiev where people were posting from and things like that.
1339.71s - 1343.39s |  And for whatever reason, I just overlooked this part of the city.
1343.95s - 1347.95s |  But you can see here, it's one of the top five largest words,
1348.35s - 1354.05s |  meaning that it's the, you know, in the top five quantity of posts where people were talking about Oblast.
1354.83s - 1356.51s |  What I uncovered was,
1356.51s - 1361.23s |  because I was looking at tanks and military vehicles, it didn't even pop up for me.
1362.03s - 1366.75s |  This was being posted because they were destroying a lot of churches around the Kiev area.
1367.15s - 1369.25s |  So I started to take a look at the churches.
1369.79s - 1375.23s |  That became one of the most interesting and key ingredients to the attacks and what was going on.
1375.71s - 1379.87s |  The Russians were really destroying the majority of the churches across the Ukraine.
1380.43s - 1385.41s |  And based on the timeline, we could see where they were based on when the church was destroyed.
1386.75s - 1391.31s |  So this really uncovered that artifact and it became the most precision,
1391.77s - 1396.03s |  predictive component of the data we looked at, even more than the military vehicles.
1396.59s - 1401.71s |  So again, leveraging transforms and these other things that are built into these reporting tools can help you look
1402.35s - 1405.71s |  at the data from a completely different angle you've had never considered.
1410.28s - 1413.32s |  As I mentioned, these things may show up in multiple pictures.
1413.64s - 1418.84s |  So if you're not exactly sure what you're looking for, but you kind of have a sense for what you're looking for,
1419.32s - 1423.32s |  again, this is where the computer vision is going to help you refine that and determine,
1423.64s - 1428.28s |  now I know what I am looking for. For me, I went into it looking for military vehicles.
1428.44s - 1430.78s |  It came out of it looking for destroyed churches.
1432.84s - 1439.34s |  And so these, you know, things of interest, person of interest, and more may be identified at multiple locations.
1439.64s - 1442.38s |  And again, this can be great for all kinds of location analysis.
1447.61s - 1450.89s |  Again, a lot of this stuff I overlooked by looking at it manually.
1451.77s - 1456.65s |  And in addition, there may be a lot of things in the foreground and the background that may be very informative.
1456.81s - 1461.77s |  So bottom line, in my humble opinion, my two cents, is if you're not using optical character recognition,
1462.01s - 1464.41s |  you're probably missing most of the important data points.
1473.07s - 1478.75s |  So, you know, we talked about Azure and we'll get into AWS here in a moment.
1479.63s - 1483.97s |  But in addition, you can use ChatGBT for doing some optical character recognition.
1484.77s - 1489.57s |  There are, of course, APIs available, just like there are for AWS and for Azure.
1490.29s - 1495.33s |  I've had kind of, you know, limited luck with identifying things within this.
1495.41s - 1499.89s |  You can see I uploaded an image, but it doesn't really show me the image that I uploaded.
1500.13s - 1505.75s |  It did find that number on the side of the military vehicle. So it was quite good at doing the optical character recognition.
1506.29s - 1509.73s |  But again, I didn't really dive into it, you know, very deeply.
1509.81s - 1514.93s |  But if you're looking for, you know, if you prefer ChatGBT, you can do some of this stuff with ChatGBT as well.
1517.36s - 1519.36s |  All right, so object recognition.
1519.36s - 1526.80s |  So up until now, we've talked about optical character recognition and identifying license plates and serial numbers and military numbers for vehicles.
1527.28s - 1532.72s |  Now we're looking for objects. It may be a gun. It may be a military vehicle. It may be a person. It may be a car.
1533.92s - 1540.56s |  And, you know, again, fundamentally with the, you know, free interface that's provided, in this case with Azure,
1540.88s - 1546.24s |  you can upload, you know, an image and have it identify for you things that are in the image.
1546.64s - 1549.68s |  It may be very transparent to you, and that's fine, right?
1550.16s - 1554.40s |  But again, we want to see what we've missed. And furthermore, we probably have a massive data set.
1554.40s - 1557.92s |  So we're not going to necessarily upload these images one at a time,
1558.16s - 1564.64s |  but the automation will allow you to either have a storage with a plethora of images that you can automate that will look at
1564.64s - 1569.12s |  it in much the same manner. We'll also talk about how you can train these classifiers, too.
1571.17s - 1578.53s |  So in this particular case, we identified, you know, two individuals as well as a land vehicle or a military vehicle,
1578.53s - 1584.69s |  but not a tank. And I was trying to do some training on tanks and really kind of test that out.
1585.49s - 1591.41s |  It also will give you kind of a threshold value and accuracy adjustments for the bounding boxes,
1591.57s - 1595.01s |  how you want to carve up the image and have the computer vision look at it.
1595.09s - 1597.65s |  So there's a lot of different options that you can leverage here.
1597.97s - 1601.49s |  And if it's something you want to play around with, I certainly encourage you to go out to,
1601.89s - 1606.13s |  you know, the Azure site and in what I'll talk about in a minute with AWS,
1606.29s - 1609.41s |  where you can test some of these things out and get more familiar with them if you want to,
1610.29s - 1612.29s |  you know, play around in your own sandbox.
1615.60s - 1617.60s |  When you actually create an account,
1618.08s - 1620.08s |  you can actually go in there and train the
1621.60s - 1626.02s |  model. And what this allows you to do is if you are looking for certain things in particular,
1626.42s - 1632.58s |  now you can upload from Kaggle or something else, a whole bunch of images, a huge corpus of data
1633.38s - 1637.06s |  that is already pre-sorted for you where they're all tanks, right?
1637.22s - 1641.30s |  And this is going to give me the fundamental baseline by which now when you
1641.68s - 1645.94s |  automate the feed of all of these images you have, this wasteland of data,
1646.34s - 1652.42s |  to help better identify if in any of those images, in this case, if they're in any of those images, if there's an actual tank.
1652.42s - 1660.02s |  So, I did exactly that. Went to Kaggle, downloaded a bunch of images, uploaded them into this and had,
1660.66s - 1665.62s |  and trained it, basically, in how to do this. And it wasn't difficult. This was a lot of point and click, right?
1665.78s - 1668.66s |  I'm not doing, like, command line coding, things like that.
1668.98s - 1671.06s |  I do use the API personally,
1671.06s - 1676.02s |  but I really wanted to kind of help people understand how I could get, how someone could get started very easily with this.
1676.50s - 1680.02s |  When you go ahead and create this, it will go ahead and generate keys for you,
1680.02s - 1682.90s |  so you can do it from a command line. You could even use curl.
1683.06s - 1687.46s |  There's a bunch of different ways in which you can easily use it. And on GitHub and other places,
1687.62s - 1690.50s |  there's a whole bunch of Python code and other things if you want to leverage
1691.06s - 1695.30s |  those bases that people may have created to help you more efficiently refine a lot of this.
1698.47s - 1703.99s |  As I mentioned, it'll create a bounding box around the object that's identified. When you upload these images,
1704.07s - 1708.87s |  you'll go ahead and actually manually tag them. Again, this is for the training purpose only.
1709.35s - 1713.43s |  And so you have these, in this case, tanks. You can go in there and label it as a tank.
1714.39s - 1719.91s |  And then once you're all done with doing that labeling, then you can go through the process of training.
1720.15s - 1724.87s |  So you'll upload or leverage the images that you've actually uploaded. And as a last step,
1724.95s - 1728.87s |  it'll go through and perform the training on all the images that you tagged.
1731.25s - 1734.21s |  Then you can start to test the accuracy of all of this.
1734.85s - 1736.77s |  So in this case here,
1736.77s - 1741.43s |  and one thing it kind of does is it sort of grays out the image a little bit when it shows the overlay
1741.73s - 1746.61s |  of what it identified and the level of accuracy to kind of see how well your model worked.
1747.17s - 1750.37s |  Within the training is the ability to iterate.
1750.45s - 1754.29s |  So there is a drop down that you can leverage where you can say, you know, it's pretty good,
1754.37s - 1757.17s |  but I want to train again and put some more images in here, right?
1757.33s - 1762.45s |  So you can actually go through that iteration over and over to hit the level of refinement that you're looking for.
1763.25s - 1769.89s |  In addition, at the bottom, it'll also show you things such as the threshold value, the accuracy.
1769.89s - 1774.29s |  You can also see the accuracy in the bounding box too, 90% accuracy.
1774.29s - 1775.65s |  I guess that's pretty good.
1775.65s - 1781.01s |  And we're going to show you in the next slide, though, is we're going to realize that like this isn't quite as accurate as we thought,
1781.01s - 1783.25s |  and it'll probably require additional iteration.
1784.05s - 1789.49s |  I love this episode, by the way.
1789.49s - 1794.13s |  So, you know, Homer had this vehicle that, you know, he designed that had, you know,
1795.09s - 1798.37s |  the biggest cup holder and all kinds of other things, you know, in it.
1798.37s - 1802.69s |  And I was like, you know, kind of looks like a military vehicle could maybe be mistaken by,
1802.69s - 1804.69s |  you know, the computer vision is maybe a tank.
1804.69s - 1807.73s |  So, you know, let me upload this and see how good this thing is.
1809.92s - 1815.12s |  Well, lo and behold, 98% accuracy that this is a tank, right?
1815.12s - 1817.04s |  We all know that it's not, right?
1817.04s - 1819.60s |  So it's not really a fault of the AI, right?
1819.60s - 1823.92s |  It just means we need to upload a larger corpus of data and do better training on it.
1824.48s - 1828.00s |  How many images did I load when I did the training on this?
1828.00s - 1829.36s |  11, right?
1829.36s - 1835.04s |  So clearly not enough images to, you know, accurately go ahead and train this model, right?
1835.04s - 1840.48s |  And what they typically recommend is, you know, upwards of 100, 500, maybe 1,000 images.
1840.48s - 1846.00s |  And again, websites like Kaggle and other things have, you know, large data sets like that.
1846.00s - 1848.48s |  I think you need an account, but you can download those
1849.12s - 1852.48s |  and then upload those to the training model to ensure better accuracy.
1855.54s - 1860.66s |  I also decided, hey, well, you know, let me, you know, with this limited training I've done,
1860.66s - 1864.50s |  let me upload, you know, just a regular vehicle in this case, a Land Rover.
1864.50s - 1869.06s |  Well, it also identified it as a tank with 95% accuracy, right?
1869.06s - 1870.34s |  Clearly not a tank.
1870.34s - 1875.46s |  So again, definitely want to go through iterations on this and upload large data sets.
1875.46s - 1876.66s |  Not a difficult thing, right?
1876.66s - 1878.66s |  A lot of this stuff is just point and click.
1878.66s - 1882.02s |  And if you do prefer command line, you can do it via those means too.
1882.02s - 1883.62s |  The API is available.
1883.62s - 1886.18s |  It creates a key within this screen here.
1886.18s - 1887.46s |  You can click over to that.
1887.46s - 1890.98s |  It'll give you your URL and the key and all of that kind of stuff.
1890.98s - 1894.42s |  So you can leverage the API to do the exact same type of analysis.
1898.31s - 1898.63s |  All right.
1898.63s - 1900.07s |  So let's talk about AWS.
1900.63s - 1908.07s |  So in a talk I did about five or six years ago, I did a talk around optical character recognition,
1908.07s - 1911.03s |  object detection, and things like that, and using AWS.
1911.67s - 1915.11s |  And continued to do testing, you know, within AWS as well.
1915.91s - 1921.51s |  And if you're familiar with AWS, you can download these CloudFormation templates
1922.07s - 1924.55s |  that are provided in the AWS store.
1924.55s - 1927.91s |  Upload that and it will build out some of this stuff for you
1927.91s - 1931.59s |  so that you have kind of a cool interface by which you can upload images.
1931.59s - 1936.23s |  So if you have an AWS account or you get a free account, you can look at the marketplace.
1936.23s - 1938.87s |  There'll be things sitting out there that people have built.
1938.87s - 1945.51s |  You can load it or download a CloudFormation template or Terraform, if you prefer, into AWS.
1945.51s - 1947.19s |  Have it build this out for you.
1947.19s - 1950.87s |  And then you can do, you know, similar kinds of things within AWS too.
1951.59s - 1957.43s |  In this particular case at the time, I was doing research around fake image detection.
1957.43s - 1960.95s |  And these images, some of them were fake.
1960.95s - 1962.31s |  Some of them were real.
1962.31s - 1970.15s |  And the AI available with the computer vision within AWS, also known as recognition with a K,
1971.35s - 1974.79s |  allows you to do very similar things to what I showed you within Azure.
1975.75s - 1981.11s |  So you can see at the bottom, it identified a whole variety of characteristics of the image,
1981.11s - 1983.59s |  such as humans, flag, symbol.
1984.79s - 1988.47s |  The symbol was identified actually from the flag that's orange and white,
1988.47s - 1989.91s |  which you can see in the background.
1992.31s - 1995.35s |  Apparel, clothing, a tie, things like that.
1995.35s - 1998.31s |  And so that became quite helpful in kind of determining,
1998.31s - 1999.99s |  comparing this to a couple different pictures.
1999.99s - 2001.59s |  Which one is the real one?
2001.59s - 2004.39s |  Well, the storyline was about a particular country,
2004.39s - 2009.43s |  whereas the image showed a flag from a different country with a different individual.
2009.43s - 2011.83s |  And again, you know, you can do facial recognition too.
2011.83s - 2015.19s |  I'll leave that up to you, you know, from a privacy standpoint.
2015.19s - 2020.39s |  But again, similar kind of thing that you can do also within AWS.
2020.39s - 2024.95s |  If you prefer AWS, again, that's a talk I did in the Packet Hacking Village,
2024.95s - 2029.19s |  maybe about five or six years ago, which I know is out on YouTube and other things too.
2033.24s - 2036.60s |  All right. So what are the benefits of the object detection?
2037.48s - 2039.16s |  It can help build out that timeline.
2039.16s - 2044.20s |  So if I can find characteristics of the image that enumerate where the picture was taken,
2044.20s - 2047.08s |  then I can actually map it out on a map just like this.
2048.68s - 2053.24s |  So I automated within Google Maps the ability to auto-label these images
2053.32s - 2057.64s |  and then plot them on a map because I wanted to use it for predictive analysis.
2057.64s - 2060.76s |  So here, and this is part of the presentation I covered last year,
2060.76s - 2066.28s |  but now using this with the optical character recognition and object detection
2066.28s - 2067.96s |  to map out a lot of these things.
2069.32s - 2073.96s |  So as I had these fed into Google Maps and then tagged,
2074.76s - 2077.72s |  and by location or estimated location,
2077.72s - 2082.92s |  I could start to kind of map out the formation and the ongoing war
2082.92s - 2085.72s |  in terms of a timeline, location, and other things.
2086.28s - 2090.84s |  Again, which is super helpful if you don't have latitude, longitude, geolocation,
2090.84s - 2093.00s |  specific type data, which many times you don't.
2093.88s - 2096.84s |  So this became super helpful in mapping this out
2096.84s - 2100.36s |  and understanding where the Russians might attack next within the Ukraine.
2104.24s - 2106.24s |  So again, if this is something you're interested in,
2106.80s - 2109.12s |  we dove really deep on this last year.
2109.12s - 2114.40s |  But one of the things I will say is it became very helpful with predictive analysis.
2114.40s - 2117.68s |  So we started to identify churches that were being destroyed,
2117.68s - 2119.68s |  which was a data point I wasn't looking at at all.
2119.68s - 2120.96s |  We talked about that earlier.
2121.76s - 2125.84s |  So in terms of looking at those data points of the churches being destroyed,
2125.84s - 2128.00s |  we actually could see the path of the military
2128.00s - 2130.16s |  and where they were going from a timeline perspective.
2130.72s - 2135.52s |  If you're tracking a person of interest unrelated to war or something like that,
2135.52s - 2138.96s |  again, you can leverage this data and potentially map it on a map too.
2139.52s - 2140.64s |  Very easy to do.
2140.64s - 2146.32s |  I just used Google Maps, went in there and leveraged the ability to create all of these pins,
2146.32s - 2149.28s |  put all that data in there, which was quite easy to do,
2149.28s - 2153.60s |  and then started looking at the data from a predictive analysis perspective.
2158.20s - 2160.76s |  So some of the lessons learned on the object detection side,
2161.32s - 2163.72s |  definitely train and then train again.
2163.72s - 2165.72s |  This takes an iterative approach.
2165.72s - 2167.96s |  But again, there's large data sets sitting out there
2167.96s - 2169.80s |  that are very easy to download and upload,
2170.28s - 2176.04s |  whole process, identifying that and getting those images in there just takes a few minutes,
2176.04s - 2179.88s |  but it might take a day or longer for it to train if you have a huge corpus of data.
2182.21s - 2185.25s |  But what's really great about it is when you do that training,
2185.25s - 2187.97s |  now it's focusing on the data you're most interested in.
2187.97s - 2191.25s |  And I'll take a day's worth of training versus
2191.25s - 2194.93s |  two weeks of sifting through a wasteland of OSINT data any day.
2198.08s - 2199.84s |  So you can also do video analysis.
2200.80s - 2204.16s |  This type of thing is available within AWS and Azure.
2204.72s - 2207.68s |  And the extraction is really interesting.
2209.44s - 2212.72s |  If you're trying to do this today, it's very manually intensive.
2213.44s - 2217.28s |  You may have a lot of videos, very time consuming as well.
2218.64s - 2223.52s |  And one of the cool things when I first started doing this a number of years back
2223.52s - 2225.04s |  is the speech recognition too,
2225.04s - 2227.92s |  which actually helped me find some really interesting things
2227.92s - 2230.40s |  going on with some of the investigations I was doing
2230.40s - 2232.56s |  and really brought out some cool evidence.
2232.56s - 2233.84s |  So let's talk more about that.
2236.79s - 2242.07s |  So in the case of AWS recognition, it will identify objects throughout the video.
2242.87s - 2246.95s |  It'll also tell you in the timeline where it showed up in the video,
2246.95s - 2254.15s |  how often it showed up in the video, and the location, as I mentioned in the timeline.
2255.03s - 2259.99s |  It may also miss a lot of subtleties that you actually didn't identify.
2260.63s - 2264.95s |  Much like the optical character recognition and the object detection,
2265.67s - 2268.95s |  with the video analysis, very similar approach in that regard.
2268.95s - 2272.23s |  But again, help identify things in the foreground or the background.
2272.95s - 2282.39s |  In the video, this was an interview myself and a coworker did for CNN.
2283.27s - 2286.95s |  I did a demo and later in the video was showing things in the video
2286.95s - 2290.71s |  and I was blown away with how it found all this stuff
2290.71s - 2293.27s |  in the actual demo that I was actually doing.
2293.27s - 2295.43s |  Things I didn't even realize were in the image.
2295.43s - 2297.75s |  So there's lots of cool stuff and you can see at the bottom
2299.35s - 2302.23s |  how you can really leverage this and automate this as a process.
2302.23s - 2305.43s |  You can upload all the images and just have it crank through all of them
2305.43s - 2308.23s |  and create reports or consolidated reports for you.
2308.23s - 2310.47s |  Very clean and efficient way to do it.
2310.47s - 2313.59s |  This was also related to a talk I did a couple years back,
2313.67s - 2318.07s |  which is also on YouTube if you're looking at this from an AWS standpoint.
2320.88s - 2322.96s |  You can do the same thing within Azure.
2322.96s - 2326.56s |  From that home screen, if you want to upload a sample video,
2326.56s - 2328.16s |  it'll do the same type of thing.
2328.16s - 2329.52s |  May look a little bit different, right?
2329.52s - 2330.96s |  Different cloud platform.
2330.96s - 2333.12s |  But it effectively does the same kind of thing.
2333.68s - 2337.92s |  And here I uploaded a presentation Chet and I had done at a different conference,
2337.92s - 2340.72s |  which was more like slides and talking,
2340.72s - 2343.28s |  but it did pick up on all the instances.
2343.28s - 2345.52s |  In this case, I wanted to find related to OSINT.
2346.32s - 2348.64s |  Any slide that had OSINT on it and all of that stuff,
2348.64s - 2351.44s |  it found it not by virtue of the PowerPoint,
2351.44s - 2354.88s |  but by virtue of the actual video itself, which I thought was pretty cool.
2354.88s - 2358.96s |  And this only took a couple minutes to run and it was an hour long presentation.
2362.56s - 2365.36s |  The speech recognition is also super awesome.
2365.36s - 2369.12s |  In the case of AWS, again, it'll help identify
2369.12s - 2371.52s |  where in the video in the timeline this occurred.
2372.16s - 2378.96s |  It'll also then transform this into words and phrases
2378.96s - 2382.24s |  and how frequently they showed up, the confidence level,
2382.24s - 2385.36s |  and actually gives you a search capability to go through that
2385.36s - 2387.36s |  if you're looking for somebody talking about
2387.36s - 2389.52s |  something suspicious to your investigation.
2392.72s - 2394.96s |  So when you dive into the details of it,
2394.96s - 2396.56s |  you have all these various filters.
2396.56s - 2399.52s |  You can see all the keywords, all the mentions,
2399.52s - 2401.92s |  and everything that were done as a result of
2402.88s - 2406.32s |  analyzing the video using AWS recognition
2406.32s - 2408.24s |  and the speech recognition componentry.
2409.92s - 2412.08s |  There are a variety of other things that you can do with it.
2412.08s - 2417.20s |  As you can see here, it used to have the capabilities with celebrities.
2417.20s - 2420.08s |  I know there's been some privacy lockdowns and things like that
2420.08s - 2424.08s |  with some of the cloud vendors, but also faces, words, cues.
2424.08s - 2427.28s |  You could upload a face of a person of interest
2427.28s - 2429.28s |  that you're investigating, things like that.
2429.28s - 2433.76s |  Again, rely on your laws, privacy, all of that kind of stuff.
2438.36s - 2441.96s |  So some of the things that come out of this then
2441.96s - 2445.72s |  are trying to improve the accuracy, the efficiency,
2445.72s - 2448.44s |  and what I consider time to evidence.
2448.44s - 2451.88s |  Again, if you collected a plethora of data or your team has,
2451.88s - 2454.68s |  and now it's your job to kind of sift through all of this,
2454.68s - 2457.80s |  these automated approaches are kind of priceless.
2457.80s - 2460.44s |  I mean, you could just leverage all this ability
2460.44s - 2463.48s |  to really find that data of interest you're most interested in.
2463.48s - 2465.56s |  It's impossible to do all of it manually.
2467.08s - 2471.08s |  In addition, it can also kind of validate narratives you may have
2471.08s - 2473.80s |  or nefarious activity that you're trying to prove out.
2474.44s - 2476.76s |  So as you start to look at the data,
2476.76s - 2480.04s |  you may eliminate things too that you thought were important artifacts
2480.04s - 2483.80s |  that are actually unrelated to the event, the activity,
2483.80s - 2486.20s |  the investigation as well.
2486.20s - 2488.20s |  So there's that other side of the coin too,
2488.20s - 2492.92s |  and making sure you kind of validate the legitimateness of that evidence.
2494.76s - 2497.56s |  And it's not a replacement for the human in the loop,
2498.44s - 2504.28s |  but it will vastly distill down your valuable data to less than 1%.
2505.16s - 2508.68s |  And then as your team may be going through and manually,
2508.68s - 2511.64s |  visually looking at a lot of these things to validate it,
2511.64s - 2515.56s |  help create that really refined, curated data set
2515.56s - 2517.08s |  that you're really focused on.
2517.08s - 2520.44s |  In other words, the human in the loop will really come into play
2520.44s - 2524.60s |  much more in that last mile with the analysis and the results of that.
2525.72s - 2528.36s |  So I know we have a few minutes left.
2529.24s - 2532.92s |  Anybody have any questions or anything related to what we've covered?
2536.32s - 2536.82s |  Go ahead.
2537.62s - 2540.02s |  How are you, you know, these sorts of data,
2540.02s - 2544.20s |  you know, there's these are offers and stuff like that.
2544.20s - 2547.08s |  But say, you know, you're, you're looking to do,
2547.88s - 2562.12s |  like, trace labs, but, you know, listed out there in images and stuff like that.
2562.84s - 2566.68s |  Where, besides X, you know, where, where would I go,
2566.68s - 2573.64s |  where things like that, where would you find availability for?
2573.64s - 2577.24s |  Yeah, I have found over the years,
2578.20s - 2583.56s |  the source, the sources that are best are related to the type of thing you're doing.
2583.56s - 2585.08s |  So here's an example.
2585.08s - 2588.84s |  So, yeah, X may have a plethora of data in the case of like,
2588.84s - 2589.88s |  I'll give a few examples.
2589.88s - 2592.20s |  The first being the Russian-Ukrainian war.
2592.20s - 2596.76s |  But we also found that the second most useful resource was actually Discord.
2596.76s - 2599.96s |  So people were posting stuff from around the world on there
2599.96s - 2602.68s |  that were both pro-Russian as well as pro-Ukrainian,
2602.68s - 2605.48s |  you know, not to get into the political side of it,
2605.48s - 2609.24s |  but there was, like, valuable data coming in from, like, both sides.
2609.24s - 2613.24s |  So those became a wealth of information for the type of research we did.
2613.24s - 2615.88s |  Did we get information from other locations too?
2615.88s - 2619.08s |  Sure, we got stuff from Facebook and Instagram and other locations,
2619.08s - 2622.12s |  but I would say those were the two standouts in terms of the war.
2623.32s - 2626.28s |  In other types of, you know, analysis and investigation,
2626.28s - 2629.40s |  we've done, for example, an imminent weather event.
2629.40s - 2632.04s |  You know, I live in Cape Coral, Florida, you know,
2632.04s - 2635.40s |  and we were hit directly by Hurricane Ian, you know.
2635.96s - 2639.24s |  And really trying to get that intelligence,
2639.24s - 2643.32s |  I was going out there and gathering all kinds of weather-related data.
2643.32s - 2646.44s |  I was also doing it not by just hitting up social media,
2646.44s - 2651.88s |  but RSS feeds and other things were incredibly useful for my OSINT data collection.
2651.88s - 2654.52s |  So I was able to gather a lot of that information,
2654.52s - 2657.00s |  you know, quite handy as well.
2657.00s - 2659.00s |  And that became a really important data source.
2659.00s - 2660.84s |  It was like, who uses RSS anymore?
2660.84s - 2662.44s |  And it was like, it's like bigger than ever.
2662.44s - 2665.00s |  I couldn't believe how much data was out there, you know.
2665.00s - 2667.96s |  So at the end of the day, I think it becomes, you know,
2667.96s - 2670.20s |  it becomes a little bit part of the tradecraft
2670.20s - 2673.80s |  in kind of determining like the type of investigation you're doing
2673.80s - 2678.84s |  and what the most useful, you know, locations are for that type of data.
2678.84s - 2681.32s |  You know, I don't know if that fully answers your question,
2681.32s - 2682.28s |  but that's what I've learned.
2682.76s - 2693.53s |  Yeah, right, exactly.
2694.09s - 2694.81s |  Cool.
2694.81s - 2696.25s |  I know someone had a question over here.
2705.82s - 2710.22s |  Yeah, there are options to assign weighted values to it as well.
2710.22s - 2713.26s |  There's a bunch of dropdowns I didn't really get into in a lot of detail
2713.26s - 2715.98s |  in like a 40-minute presentation, but you're absolutely right.
2715.98s - 2719.10s |  So whether it's in AWS or within Azure,
2719.10s - 2723.42s |  there are a lot of those weighted options and thresholds and performance stuff
2724.22s - 2726.54s |  that you can actually validate as you train
2726.54s - 2728.70s |  and then retrain and go through those iterations.
2728.70s - 2729.26s |  Good point.
2729.26s - 2730.22s |  Yep, absolutely.
2731.58s - 2732.38s |  Go ahead.
2732.38s - 2740.79s |  Oh, interesting.
2741.19s - 2747.91s |  Um, I know that in the example for Azure with Power Automate and Power Apps,
2747.91s - 2750.39s |  you can do it kind of like a live feed.
2750.39s - 2758.15s |  So as an example, I've done labs with X or formerly Twitter doing exactly that.
2758.15s - 2762.23s |  So as the tweets are coming out more based on the live feed,
2762.23s - 2765.27s |  whereas what you're viewing in the app is it may be a second old,
2765.27s - 2767.19s |  but it's historical data, right?
2767.19s - 2773.35s |  Using the live streaming Tweepy API versus the historical feed, right?
2773.35s - 2776.31s |  So techniques like that, yes, you know, to leverage that.
2776.31s - 2777.59s |  So the short answer is yes.
2777.59s - 2780.15s |  And I think that becomes a little part of the tradecraft too.
2780.15s - 2784.63s |  I know Chet and I did a presentation a few years ago on how to use Tweepy to do that with,
2785.27s - 2789.67s |  at the time it was Twitter, you know, but we also tested when it morphed into X as well.
2790.31s - 2792.23s |  I'm sorry, there's so many people raising their hands.
2792.23s - 2792.55s |  Go ahead.
2817.34s - 2820.46s |  We have and we demonstrated it in the Packet Hacking Village.
2821.34s - 2823.34s |  I think two years ago.
2823.98s - 2825.82s |  So if you go back and look at those videos,
2825.82s - 2829.82s |  we created a Python tool and a little mini UI for doing that.
2829.82s - 2834.30s |  And it would collect from multiple sources to do that kind of thing.
2834.30s - 2838.14s |  Again, kind of based on the tradecraft and knowing what you wanted to collect.
2838.14s - 2841.66s |  Again, we use the Russian-Ukrainian War because there was a ton of data around that.
2841.66s - 2843.18s |  We also did it around the election,
2843.18s - 2848.30s |  the previous election and things like that too, excuse me, to collect that data.
2848.30s - 2850.70s |  So the short answer is yes, you can definitely do that.
2850.70s - 2852.70s |  The APIs may be quite different.
2852.70s - 2856.38s |  So the API for Discord versus X versus all these different things
2856.38s - 2859.26s |  are all slightly proprietary unto themselves, right?
2859.26s - 2860.86s |  But the short answer is yes.
2860.86s - 2861.10s |  Yeah.
2861.90s - 2863.02s |  Someone had a question over here.
2863.58s - 2863.90s |  Go ahead.
2873.24s - 2876.28s |  I can't, honestly, I can't really comment on that
2876.28s - 2879.48s |  because it's changing so much and there's so many different laws.
2879.48s - 2880.12s |  Yeah.
2880.12s - 2882.04s |  So you're absolutely right.
2883.48s - 2886.12s |  The only advice I would really give is what you would expect,
2886.12s - 2889.08s |  which is like check your local vicinity, your country,
2889.32s - 2893.24s |  all of those things and see what you are and are not allowed to do.
2893.24s - 2895.08s |  There's so many overlapping laws now,
2895.08s - 2898.68s |  I'd probably get myself in trouble making any kind of recommendation.
2898.68s - 2899.88s |  So my apologies.
2899.88s - 2900.60s |  So, yeah.
2916.73s - 2921.69s |  So what you're talking about is testing to see
2922.49s - 2926.01s |  if you've created something that it will accidentally miss.
2926.57s - 2927.05s |  Yeah.
2927.05s - 2927.45s |  Yeah.
2927.45s - 2928.09s |  So I have.
2928.09s - 2931.69s |  And that was in a presentation a couple of years ago when I did the AWS one.
2931.69s - 2936.33s |  What I did in that particular one was I come from a steganography background.
2936.33s - 2940.97s |  So I was really looking for creative ways to circumvent the detection,
2940.97s - 2943.45s |  basically, for the optical character recognition.
2943.45s - 2946.01s |  In that presentation, I covered a couple of different types.
2946.65s - 2949.93s |  The easiest one was taking a Word document,
2951.45s - 2954.89s |  making it a black background instead of a white background,
2954.89s - 2960.41s |  and then changing the shade of my characters to just one off
2960.41s - 2962.41s |  from the main page.
2962.41s - 2964.57s |  So it looked like black on black.
2964.57s - 2967.21s |  If you looked at it at histogram or other type of analysis,
2968.01s - 2971.29s |  the exposure type of analysis, you would see it.
2971.29s - 2974.57s |  But I wanted to see if the AI could actually detect it or not.
2974.57s - 2975.13s |  And it didn't.
2975.69s - 2977.93s |  But I talked about that in the presentation.
2977.93s - 2981.13s |  So in the point I had made was like,
2981.13s - 2987.37s |  and I think the presentation I did at the time was remaining covert in an overt world.
2987.37s - 2989.05s |  I did it in the packet hacking village.
2989.05s - 2991.05s |  I think it was in that presentation where I talked about
2991.05s - 2994.57s |  how you could covertly communicate in a whole bunch of different ways.
2994.57s - 2995.53s |  And that was one of them.
2995.53s - 2998.81s |  And I showed how the optical character recognition didn't detect it.
2998.81s - 3000.25s |  So does that kind of help?
3000.25s - 3001.61s |  Is that we were kind of wondering?
3001.61s - 3002.25s |  Yeah.
3002.25s - 3002.65s |  Yeah.
3002.65s - 3006.25s |  If you're interested in that topic, that particular presentation,
3006.25s - 3008.33s |  I cover a bunch of other methods too.
3008.33s - 3008.89s |  Yep.
3008.89s - 3010.97s |  So any other questions?
3010.97s - 3011.47s |  Oh, go ahead.
3012.19s - 3015.07s |  So I see we have that string surface.
3015.07s - 3016.27s |  We have an object surface.
3018.19s - 3023.07s |  If we're looking for, let's say, an object with a specific variation,
3023.71s - 3028.59s |  do we have to then create that object dictionary with those variations in it?
3030.19s - 3033.23s |  So let's say I need to find this way of hearing
3033.23s - 3037.79s |  that has specifically no upcapping from the ground up.
3037.87s - 3041.95s |  I'm going to have to upload 100, 500 images of that with no upcapping.
3041.95s - 3042.75s |  What will it be?
3042.75s - 3046.19s |  Like, for an individual, like maybe a face tattoo or a scar.
3046.19s - 3049.63s |  At what point do I get to answer that in regularity?
3049.63s - 3054.59s |  Because sometimes that is really the difference between getting the info to the...
3055.47s - 3056.11s |  Yeah.
3056.11s - 3058.03s |  It's a complex answer.
3058.03s - 3062.19s |  So I'll see if I can kind of answer it with my knowledge.
3063.15s - 3070.43s |  One, the most key ingredient in that case, in my opinion, would be the bounding boxes.
3070.43s - 3075.71s |  Having bounding boxes focused on a smaller portion of a picture.
3075.71s - 3079.23s |  Because in most cases, you're going to have a picture of the whole car,
3079.23s - 3081.07s |  including the wheels and the hubcaps.
3081.07s - 3085.39s |  Not just pictures of wheels with hubcaps or not hubcaps, right?
3085.39s - 3091.87s |  And then in addition, you're looking for maybe the front left tire only, right?
3091.87s - 3096.51s |  And how does the AI know, like, am I looking at the driver's side of the car
3096.51s - 3098.27s |  or the passenger side of the car?
3098.27s - 3099.39s |  And those kinds of things.
3099.39s - 3102.91s |  So I think a little bit of it would be testing.
3102.91s - 3109.71s |  But the root of it, in my opinion, it starts with the bounding boxes type stuff.
3109.71s - 3113.87s |  So you're kind of training it to do a more refined look at every image,
3113.87s - 3116.43s |  which is mostly like each one is going to be a car.
3116.43s - 3118.59s |  And the car is going to be at different angles,
3118.59s - 3121.95s |  but that you specifically want to focus on the wheels and the hubcaps.
3121.95s - 3127.47s |  I know that on the Azure side, when you go through the training,
3127.47s - 3131.39s |  it will ask you the level of refinement that you want for those bounding boxes.
3131.39s - 3134.43s |  And in addition, the kinds of things you're actually looking for.
3134.43s - 3136.59s |  So it'll help you kind of get started with it.
3136.59s - 3139.31s |  And then you could kind of iterate with it too, you know, from there.
3140.83s - 3141.63s |  Sound cool? You're welcome.
3142.35s - 3144.27s |  Cool. Well, awesome.
3144.27s - 3146.99s |  I know we're probably, yeah, we're right at 150.
3146.99s - 3149.15s |  So thanks so much for attending.
3149.15s - 3151.63s |  I hope you guys got a couple good nuggets out of this.
3151.63s - 3153.23s |  And thanks so much for coming.


url: https://www.youtube.com/watch?v=YtMutNk8RpY
title: DEF CON 32 - Offensive Security Testing Safeguarding the Final Frontier - Andrzej Olchawa
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=YtMutNk8RpY",
  "title": "DEF CON 32 - Offensive Security Testing  Safeguarding the Final Frontier - Andrzej Olchawa",
  "description": "Every space mission is underpinned by critical software that spacecraft operators utilize to monitor and command their assets. The Mission Control System serves as the primary interface with a spacecraft, marking it as a crucial component of the ground segment. For decades, these systems were operated exclusively within the confines of mission control rooms, accessible only to a select group of individuals through a limited number of computer workstations. This paradigm has recently shifted, with numerous space organizations enabling their personnel to manage space assets remotely, including from the comfort of their homes. This increased accessibility has rendered space-related systems susceptible to the same security vulnerabilities that affect our daily-use software.\n\nDespite the adoption of newer technology stacks in many mission control systems\u2014either through upgrades or complete replacements\u2014the consideration of security requirements has often been deferred to the final stages of development or overlooked entirely. This negligence presents a significant risk, exposing the space sector to potential exploitation by malicious entities. Like in other technology domains, merely expanding strategies to incorporate security measures, instituting security policies, and integrating new security requirements are positive but insufficient. Despite being developed and tested by extensive teams and presumably adhering to best practices, we have observed firsthand how contemporary mission control systems remain prone to elementary security flaws.\n\nThe most effective strategy to equip space systems with a robust defense against malicious actors involves integrating offensive security testing throughout their development lifecycle.\n\nIn this presentation, we share the results of the security research we have recently conducted on the more established, open-source Mission Control Systems: NASA OpenMCT and YaMCS. We present the details of the vulnerabilities we have discovered in those two systems, and their potential impact on a space mission when they are chained together into one exploit. We conclude by presenting with the audience the lessons learned from those security assessments.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 841,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 3.60s | This text was transcribed using whisper model: large-v2

 Hi everyone. My name is Andy. Uh I'm going to present you with
3.60s - 8.14s |  some uh offensive security testing. Um in this
8.14s - 12.18s |  presentation I will uh briefly introduce you to the uh ground
12.18s - 16.82s |  segment and the software that we use uh on it. Uh I will focus
16.82s - 20.68s |  on one particular software which is the mission control system.
20.68s - 25.52s |  And I will um show you some some uh vulnerabilities which we have
25.52s - 28.76s |  found on those uh software applications and then give you a
28.76s - 34.65s |  couple of demos on uh how we managed to exploit them. So um
34.65s - 38.31s |  ground segment consists of many uh interconnected components uh
38.31s - 44.35s |  or elements. You can see in this orange on this orange part um
44.35s - 48.49s |  where exactly it lies in the in the uh in the mission um in the
48.49s - 52.19s |  space mission. Uh it consists of different elements. Uh the all
52.19s - 55.83s |  those elements uh perform different functions but they all
55.83s - 59.11s |  depend on each other uh either by receiving input from or
59.11s - 62.97s |  sending outputs to other components. However most of
62.97s - 65.75s |  those components they don't require any user interaction and
65.75s - 69.25s |  this is what brings us to the mission control system. Uh which
69.25s - 74.25s |  is the main interface um it is the main interface between the
74.25s - 78.39s |  ground station uh and uh and other components. Uh it is also
78.39s - 83.19s |  it also serves as um primary interface between the uh between
83.19s - 85.89s |  between the spacecraft controllers and um and the
86.25s - 91.25s |  spacecraft itself. Which uh I would argue is the it makes it
91.25s - 94.83s |  the most vulnerable system in the whole ground segment. As uh
94.83s - 97.83s |  as we know the weakest link of every information system is
97.83s - 103.83s |  humans. So for decades uh the space missions were operated
103.83s - 107.93s |  from uh dedicated mission control rooms. Uh accessible
107.93s - 114.27s |  only by uh specific um only by the spacecraft controllers. And
114.29s - 116.93s |  this however has changed recently mainly due to COVID.
116.93s - 122.23s |  Um and the organization started opening up and letting their
122.23s - 126.81s |  users or their uh spacecraft operators to conduct operations
126.81s - 130.97s |  uh remotely. So this of course creates a new attack surface for
130.97s - 134.15s |  uh for the mission control system which is usually uh very
134.15s - 138.75s |  outdated software and vulnerable to typical um typical
138.75s - 141.95s |  vulnerabilities which we have on any other software uh that we
141.97s - 147.47s |  use on a daily basis. So what is being done about it? Um from
147.47s - 150.11s |  the community from the space community perspective obviously
150.11s - 153.81s |  we expand strategies and include um security uh to include
153.81s - 158.69s |  security aspects. We impose uh security policies. And then we
158.69s - 161.99s |  also introduce security requirements to our systems.
161.99s - 166.63s |  Um however I don't think it's gonna be enough at this point.
166.63s - 170.13s |  And as we will see later there is one uh very specific element
170.15s - 174.55s |  that is missing into those um into the actions which is the
174.55s - 182.29s |  offensive security testing. So um every organization uh has a
182.29s - 184.37s |  their own mission control system. They try to develop
184.37s - 188.77s |  their own uh software. Because uh you know what as they say the
188.77s - 194.31s |  space is hard right? So uh they have to do it themselves. So um
194.31s - 197.47s |  some of that software is open source. So what we have done we
197.47s - 199.95s |  decided to have a look at it and see how they perform from the
200.93s - 205.03s |  from the vulnerability standpoint. And here is what we
205.03s - 207.91s |  have found out. Uh for full disclosure all those
207.91s - 211.67s |  vulnerabilities have been already disclosed uh using the
211.67s - 215.71s |  um contacting the vendor and they have been already
215.71s - 223.05s |  addressed and um and all of them have CVE assigned. So on uh NASA
223.05s - 226.05s |  OpenMCT we have found a couple of vulnerabilities such as uh
226.05s - 232.07s |  prototype pollution XSS and CSRF. On the IMCS which is
232.07s - 235.13s |  another mission control system. It is one of the more established
235.13s - 239.71s |  ones. One um we have found uh a few more vulnerabilities such as
239.71s - 243.31s |  directory traversal uh arbitrary file deletion session hijacking
243.31s - 247.95s |  and uh a few XSS vulnerabilities. And then on
247.95s - 252.01s |  NASA AIT core we have found and NASA AIT core is like a
252.01s - 255.95s |  framework to develop ground ground segment software um by
255.95s - 259.99s |  different missions. We have found SQL injection uh a few
259.99s - 264.79s |  local code executions and also um realize that the encryption
264.79s - 268.67s |  and the communication is completely missing. So as you
268.67s - 271.27s |  seen before that most of those vulnerabilities they don't have
271.27s - 275.93s |  that um much of an impact on the mission. However this is where
275.93s - 279.91s |  the training of vulnerabilities come in play. And in case of the
279.91s - 282.95s |  IMCS we decided to combine a directory traversal session
282.95s - 288.65s |  hijacking and XSS. And that led us to quite severe sensitive
288.65s - 292.73s |  information disclosure because now the attackers can when they
292.73s - 294.93s |  trigger when the XSS is triggered the attackers can
294.93s - 298.57s |  actually retrieve any arbitrary file that is stored on the IMCS
298.57s - 304.89s |  server. So uh here is uh let's have a look at typical scenario.
304.89s - 308.59s |  Um so this is like um at the very high level overview of a
308.59s - 311.13s |  space mission. You have a space segment from right to left
311.13s - 314.33s |  you have a space left you have a space segment. There is a
314.33s - 316.71s |  ground station, there is IMCS which is the mission control
316.71s - 321.87s |  system uh in subject that is um that is used by Bob uh to send
321.87s - 324.65s |  telemetry uh send telecoms and receive telemetry from
324.65s - 328.99s |  spacecraft. We also have Alice that is working with Bob and the
328.99s - 332.09s |  whole organization has a publicly facing website. Now we
332.09s - 337.79s |  also have an attacker and that is um that has a C2 server. Now
337.79s - 341.05s |  as it usually goes there is a recon and phishing campaign.
341.05s - 344.33s |  Uh the adversaries learn about Alice from the um public
344.33s - 348.33s |  website. They decide to uh target her with um phishing
348.33s - 354.62s |  campaign. Alice takes the bait uh unfortunately she then clicks
354.62s - 357.86s |  on a link or opens a word document and that deploys the
357.86s - 362.12s |  C2 beacon uh on her workstation. This way uh making her
362.12s - 368.67s |  workstation compromised. Um the attackers now have access to her
368.67s - 373.23s |  workstation. They learn about Bob um from her emails and they
373.23s - 376.91s |  decided to target Bob with uh eternal phishing campaign. They
376.91s - 380.45s |  uh send him an email with uh some payload that would trigger
380.45s - 388.11s |  the XSS and they do it as Alice. So uh Bob trusts Alice. He um
388.11s - 391.95s |  executes the payload that triggers the XSS. That XSS then
391.95s - 395.09s |  uh because there are um there is a session hijacking
395.09s - 399.59s |  vulnerability and the traversal director vulnerability
399.59s - 404.59s |  um that triggers the um this lets the attackers to retrieve
404.59s - 412.97s |  all any arbitrary file on uh on the XSS server. Now if Bob has
412.97s - 415.77s |  access to the internet uh the files can directly be retrieved
415.77s - 420.07s |  and sent to attacker workstation. Otherwise um if
420.07s - 424.05s |  Bob is behind the firewall or is using VPN uh we can use
424.07s - 427.61s |  Alice workstation to um as a proxy and then retrieve the
427.61s - 433.82s |  files using the C2 beacon. So I have prepared uh short demo how
433.82s - 440.30s |  that would look like in practice. So what you will see
440.30s - 443.98s |  here, this is our, this is the exploit we developed. Um it
443.98s - 448.74s |  generates a payload that will end up uh being sent to the to
448.74s - 452.82s |  the Bob and Bob will uh actually use that payload and um
452.82s - 456.48s |  because he thought that it was received from Alice, load it on
456.50s - 463.69s |  the YAMCS and then that will trigger our exploit chain. So
463.69s - 467.93s |  first this exploit generates the payload which is called XSV uh
467.93s - 474.91s |  XSVJS and also starts the HTTP server. Bob is gonna load that
474.91s - 479.37s |  file on the YAMCS server. Imagine that is one of the
479.37s - 487.92s |  telemetry displays that Alice decided to share with him. So he
487.92s - 494.20s |  loads the file and he decides to open it. And that's all he
494.26s - 499.96s |  sees. Now, under the hoods, there was an XSS triggered that
499.96s - 502.60s |  would retrieve the file and then send it back because of the
502.60s - 506.26s |  directed traversal and send the back the back the content to the
506.26s - 511.14s |  HTTP server that was started by um that was started by the
511.14s - 516.54s |  attacker. So here like in any uh any example of for proof of
516.54s - 521.68s |  concept you can see we got the access to XC password file
521.68s - 526.16s |  content. So that's um combining those vulnerabilities is
526.16s - 548.18s |  actually quite easy. So, the whole exploit is easy. So, next
548.18s - 552.14s |  up is the uh vulnerability chain, the the exploit chain uh
552.14s - 556.68s |  for NASA EIT Corp. Um combining one of the local execution uh
556.68s - 559.12s |  code execution and missing missing encryption, we managed
559.12s - 563.02s |  to uh conduct the man in the middle attack and inject our own
563.02s - 569.26s |  payload uh into the into the uh communication um string which
569.26s - 572.20s |  uh which then is triggered on the telemetry client and then
572.20s - 577.84s |  it's executed giving us the reversal. So, I'll quickly
577.84s - 586.66s |  start on the demo and explain what you see. Sir. Like this?
586.66s - 591.73s |  Yup. Okay. Okay. So, basically, what you see here on the left
591.73s - 595.33s |  side, uh you have, on the top left side, you have telemetry
595.33s - 602.47s |  client. On the left, uh bottom side, you have telemetry
602.47s - 607.01s |  simulator that is both are provided by the EIT Corp. On the
607.01s - 610.01s |  right side, you have our exploit on the top and then on the
610.01s - 613.25s |  bottom side, on the right bottom, you have the Nesca's
613.25s - 618.83s |  list that was gonna grab the or is gonna receive the reversal.
618.83s - 624.09s |  So, we start the telemetry client first on the on the left
624.09s - 629.32s |  side. Now, this is what would normally be happening on the
629.32s - 636.59s |  mission control or on the ground station. Then, we start
636.59s - 640.33s |  telemetry uh simulator which will generate some telemetry
640.33s - 646.05s |  packets as if they were coming down from spacecraft. We start
646.05s - 650.01s |  our uh Netcat listener and you can see on the left hand side,
650.01s - 652.19s |  on the left hand side, we already have started receiving
652.19s - 665.80s |  some telemetry from the simulator. Then, we run our
665.80s - 669.50s |  exploit that is conducting the man in the middle attack and
669.50s - 672.70s |  then the first frame. So, we have injected our frame and the
672.70s - 674.66s |  first frame. So, the first frame that is sent from
674.66s - 679.08s |  telemetry simulator to the ground station is called um by
679.08s - 682.10s |  the man in the middle attack. There, we injected our payload
682.10s - 686.32s |  which you can see down here as well and that was actually
686.32s - 690.38s |  executed and it was triggered and it gives us, it gave us the
690.38s - 693.68s |  reversal uh to the telemetry client running on the mission
693.68s - 721.98s |  control. So, that's another proof of concept. Sorry about
721.98s - 733.20s |  that. So, just for reference, we have um this is speed um
733.20s - 737.34s |  between dynamic, static, and dynamic uh analysis which we
737.34s - 741.30s |  have done on those systems. Um it is still important to
741.30s - 743.84s |  conduct static analysis because as you can see, uh the low
743.84s - 746.88s |  hanging fruits and many other vulnerabilities are found uh
746.88s - 750.28s |  using those but they will static analysis will not uh
750.28s - 752.82s |  will will not catch everything. So, you have to conduct the
752.82s - 757.02s |  dynamic analysis and then you have to try to uh conduct
757.08s - 762.18s |  the exploitation phase. Um in case of SCoS 2000, SCoS 2000 is
762.18s - 764.88s |  one of the main mission control systems developed by uh by
764.88s - 768.56s |  European Space Agency. Uh we haven't done any um extensive
768.56s - 771.66s |  analysis on the system, any vulnerability research. We only
771.66s - 776.12s |  run the flow finder on it and using the static code analysis
776.12s - 780.10s |  you can see uh I'm pretty sure that at least one of those uh
780.10s - 783.70s |  almost 2500 buffer overflow uh vulnerabilities would be
783.72s - 791.14s |  exploitable. So, uh in conclusions, um the point I'm
791.14s - 793.54s |  trying to make is that the space applications are still
793.54s - 796.52s |  not properly being tested from the offensive security
796.52s - 801.72s |  standpoint. Um the best way is to uh hire a service to do it
801.72s - 805.92s |  properly or you can also you can also try to do it yourself but
805.92s - 807.70s |  you have to do it and you have to include it in your
807.70s - 812.80s |  frameworks and uh you should do it before uh the adversaries do
812.82s - 817.32s |  it for you. So, as I mentioned before, all that research was
817.32s - 821.32s |  already published. So, here you can find um I guess the slides
821.32s - 824.96s |  will be uh provided afterwards so we can we can have a look at
824.96s - 828.40s |  the publications. Otherwise, if you want the links uh today, you
828.40s - 830.80s |  can hit me up after the after the talk and I'll give it to
830.80s - 837.04s |  you. And that was it. Thank you very much.


url: https://www.youtube.com/watch?v=LysMyDrOGn4
title: DEF CON 32 - XR for All: Accessibility and Privacy for Disabled Users - Dylan Fox
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=LysMyDrOGn4",
  "title": "DEF CON 32 - XR for All:  Accessibility and Privacy for Disabled Users - Dylan Fox",
  "description": "Extended Reality (XR) technologies offer tremendous new possibilities for socializing, entertainment, training, and more. Unfortunately, many disabled users find themselves excluded from XR entirely or exposed to severe privacy risks for using it. In this talk, Dylan Fox, Director of Operations for the XR Access Initiative at Cornell Tech, will discuss the core challenges disabled people face in using XR, the tensions between privacy and assistive capabilities, and the open-source efforts happening now to ensure XR is accessible to everyone.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1375,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.52s | This text was transcribed using whisper model: large-v2

 Hello everybody, uh, love to get started for you today. As I just mentioned, uh, I didn't bring my
5.52s - 12.48s |  laptop because, uh, I had been given many fear-mongering tales, excuse me, uh, of DEF CON
12.48s - 18.48s |  and the vicious hackers within, as this is my first time at DEF CON. Um, now, ideally we're
18.48s - 24.96s |  gonna have a laptop from the, uh, XR Village host for me to present on, but unfortunately I haven't
24.96s - 30.72s |  been able to get in contact with her, so I'm gonna do, uh, what is called a pro-gamer move
30.72s - 36.64s |  and ask if anybody in the audience has a laptop they would be willing to let me present my slides
36.64s - 44.48s |  from. This is a great look for me, I know. Uh, if not, that's okay, we will, I'll, I'll bring
44.48s - 48.80s |  out my phone for you and you all can just, um, look at the, look at the slides from here. That'll
48.80s - 60.88s |  work, right? Um, uh, well, that's all right. Uh, we'll do this theater of the mind. So, hello everybody,
60.88s - 67.04s |  uh, my name is Dylan Fox, uh, and I'm here to talk to you today about XR for All, accessibility and
67.04s - 74.24s |  privacy for disabled users. Uh, I am the Director of Operations for XR Access, which I'll be talking
74.24s - 81.68s |  to you about in just a moment, uh, and you can reach me at dylan at xraccess.org. Uh, our agenda
81.68s - 86.00s |  today is I'm going to tell you a little bit about the XR Access Initiative that I represent.
86.00s - 92.64s |  Uh, we're going to talk about the benefits that accessibility-focused XR can provide to people
92.64s - 97.84s |  with disabilities. Uh, we're talking about the privacy risks that those benefits come along with,
97.84s - 102.24s |  uh, and then best practices for mitigating those risks, or how we can have the, the best of both
102.24s - 109.36s |  worlds. Uh, and hopefully at the end, we'll have some time for Q and A. Uh, so to start with, uh,
109.36s - 118.48s |  the XR Access Initiative, uh, is a community dedicated to connecting people in order to make
118.48s - 125.04s |  virtual augmented and mixed reality accessible for people with disabilities. Uh, we were originally
125.04s - 130.56s |  founded in 2019 as just kind of a community of people coming together to wanted to make this
130.56s - 136.32s |  new tech accessible. Uh, and now we are a proud research initiative of Cornell Tech in New York.
137.12s - 143.92s |  Uh, we do a lot in terms of researching the fundamentals of accessibility. You know, how do
143.92s - 150.80s |  we make these technologies accessible, especially to blind and low vision people? Uh, we also make a
150.80s - 156.88s |  lot of resources that we provide to designers and developers on how to make their apps accessible.
156.88s - 163.76s |  Uh, we con- connects different communities in terms of the, uh, big, you know, the big technical
163.76s - 170.64s |  platforms, the content creators, uh, researchers, government people, uh, and of course, people who
170.64s - 175.52s |  are disabled and advocates, uh, in order to come together to solve some of these really thorny
175.52s - 182.16s |  problems, uh, on how to make these things accessible. Uh, and we advocate and educate for XR
182.16s - 188.96s |  accessibility, just like I'm doing right here. Uh, we also hold every year our XR Access Symposium.
188.96s - 195.52s |  Uh, you just missed the one June 6th and 7th, but, uh, we have our, all of our videos up on YouTube. So
195.52s - 200.16s |  if you're interested in learning more about kind of the hot topics in XR accessibility,
200.16s - 204.88s |  uh, I'd encourage you to check that out. Uh, our website is xraccess.org.
205.76s - 213.28s |  So let's talk about accessibility-focused XR. Now, XR, for those of you who aren't aware,
213.28s - 220.56s |  is, uh, an umbrella term, uh, referring to extended reality. Uh, and that covers virtual reality,
220.56s - 226.96s |  where you are immersed in this virtual space, augmented reality, where you augment reality
226.96s - 231.76s |  with data, uh, and mixed reality, which is a little column A and a little column B.
231.76s - 237.28s |  Uh, and all of these come together to form a technology that has really grown in popularity
237.28s - 243.44s |  over the last five or ten years, uh, and is really poised to make a big change in people's lives if
243.44s - 250.48s |  we use it correctly. So that's XR. What about the accessibility half of XR accessibility?
251.76s - 258.72s |  Now, the first thing, the notion that I want to dispel for you all, is that accessibility
259.36s - 267.20s |  is a checklist that you run down in order to support a few people who are in wheelchairs
267.20s - 270.88s |  or what have you out of the goodness of your heart. Because that's a lie.
272.24s - 280.72s |  Uh, accessibility affects all of us. Accessibility is defined as basically being able to use
280.72s - 287.44s |  something no matter what your ability is, because we all have abilities to see, to hear, to touch,
288.40s - 295.60s |  um, and sometimes those abilities can become hampered, right? Uh, now that can be permanently,
295.60s - 300.80s |  right? If you are, you know, have a genetic condition that makes you born without ears,
301.52s - 306.72s |  you're probably deaf, right? And that would be a permanent condition. But you might also be deaf
306.72s - 313.04s |  because you have an ear infection, or you might be deaf because you're at a really loud bar,
313.04s - 316.08s |  like, you know, the middle of the arcade party last night. That thing was deafening.
317.04s - 325.44s |  Um, and accessibility will help everybody no matter what that source of disability is from.
326.08s - 334.24s |  Because disability isn't really just about your hampered ability. Disability is when your
334.24s - 341.44s |  abilities don't match up with the expectations or the assumptions of the technology that you use,
341.44s - 348.40s |  or the spaces around you. So somebody in a wheelchair is not disabled inherently.
348.40s - 352.96s |  They are disabled when they come to a place that the only way to get in is stairs,
352.96s - 357.68s |  right? You know, never use the term wheelchair bound, because a lot of the people that use
357.68s - 361.44s |  wheelchairs will tell you, I'm not bound to this wheelchair. The wheelchair is what
362.32s - 366.64s |  gives me mobility. It's what lets me move around and be where I want to be.
367.60s - 374.48s |  So when we talk about accessibility, accessibility is about technology that adapts to your needs.
374.48s - 379.92s |  It's about technology that no matter what your abilities are, you'll still be able to use.
381.60s - 388.16s |  There's a woman, Cindy Lee, who wrote the book on CSS and was also an accomplished accessibility
388.16s - 396.24s |  advocate, and she had this idea that we're all just temporarily abled, right? All of us,
397.12s - 402.56s |  at some time or another where we're just in a loud room or we get old and our bodies start to
402.56s - 407.76s |  fail us, all of us will be disabled at some point in our lives. So when we're talking about
407.76s - 412.08s |  accessibility, don't make the mistake of thinking, oh, accessibility, that's for those people over
412.08s - 416.08s |  there. Oh, accessibility, that's the thing that fricking bureaucrats make me want to check off
416.08s - 421.68s |  a list so we don't get sued. It's not the case. Accessibility is for all of us. Quick show of
421.68s - 428.24s |  hand, who here in the audience has either personally experienced accessibility or rather
428.24s - 433.20s |  personally experienced disability or has a relative who has disabilities? Show of hands.
433.20s - 438.08s |  I know I have. That's a good portion of you, and I think 100% of the people that are actually
438.08s - 445.44s |  paying attention and thinking about it. So where does that leave us on accessibility and XR?
446.56s - 452.88s |  Well, there's two perspectives when it comes to XR accessibility. The first is this idea of core
452.88s - 460.64s |  platform accessibility, and that is the idea that every single XR app from, you know, Beat Saber to
460.64s - 466.24s |  Vacation Simulator to, you know, all the stuff you see in the XR Village upstairs of working on labs
466.24s - 472.72s |  and simulating national disasters, all of those should be accessible to anybody that wants to use
472.72s - 481.12s |  them. The second way of thinking about XR accessibility is about XR as assistive technology,
481.12s - 485.52s |  and so this would be tools that are aimed specifically at people with disabilities to
485.52s - 492.24s |  support them and their use in everyday life. Now, normally I would focus this talk on core
492.24s - 497.20s |  platform accessibility. You know, that's things like the curb cut effect, right? Everybody knows
497.20s - 501.28s |  curb cuts, the little things that go from the sidewalk down to the street. They didn't have
501.28s - 506.16s |  those back before, like, the 1960s. There was a whole disability civil rights movement where
506.16s - 510.96s |  people were sneaking out at night to take sledgehammers to sidewalks and then put in, you know,
510.96s - 517.28s |  wooden ramps, and once, you know, they people had to fight tooth and nail to get these in for
517.28s - 523.04s |  wheelchair users so that wheelchair users didn't have to, you know, wheel through the streets and
523.04s - 531.44s |  be hit by cars, and once they did that, they realized, oh, hold on a sec, guys. I think, I think
531.44s - 537.52s |  these are useful for everybody. They found that these curb cuts weren't just useful for people in
537.52s - 542.24s |  wheelchairs, people who, you know, had no mobility. Uh, they were useful for people on bicycles and
542.24s - 550.24s |  people with baby strollers and people with heavy dollies full of crap. So, these types of things,
550.24s - 553.84s |  you know, when we make, uh, when we make things accessible for people with disabilities,
553.84s - 558.72s |  we make them better for everybody. So, that's usually what I would do a whole 30-minute talk
558.72s - 564.16s |  about, right? We talk about things like, uh, captions in VR, we talk about magnification,
564.16s - 568.80s |  we talk about co-piloting, uh, all the features that if you are designing or developing
568.80s - 576.08s |  a VR, AR, XR app, you would put in to make it more usable. But today, we're talking about
576.08s - 584.16s |  something else, because I know you all here, uh, at DEF CON, uh, care about a little thing called
584.16s - 594.88s |  privacy, right? And there is a very interesting tension between accessibility and privacy when it
594.88s - 604.24s |  comes to XR, because there are some tools like, for example, facial recognition, that if you are
604.24s - 608.96s |  blind or you have, uh, you know, prosopagnosia, which is like face blindness, the inability to
608.96s - 615.52s |  remember faces, uh, or if you just have memory problems, facial recognition could be a very
615.52s - 620.88s |  helpful tool, right? Being able to have a little reminder of, oh, your brother just walked into the
620.88s - 629.28s |  room, oh, here comes your friend Sam, right? That's really useful. But if that comes at the cost of
629.28s - 636.00s |  every single person's face you see ending up in some meta or NSA database, that cost might not
636.00s - 641.68s |  really be worth it, right? So, we have to figure out how to balance these. So, I'm going to start
641.68s - 646.64s |  with the good news, uh, which is that there are some really powerful uses of this assistive
646.64s - 654.88s |  technology. Um, if I had my slides, which I would, uh, I would show you that, uh, you know, there's
654.88s - 662.64s |  technologies like ORCam, which is a, uh, a camera that you stick onto your glasses that helps to,
662.64s - 668.96s |  uh, provide things like facial recognition, um, what types of, you know, what denominations of
668.96s - 674.80s |  currency do I have? What color is my shirt? What's this text in front of me? Uh, applications that are
674.80s - 682.00s |  really helpful if you are blind so that you don't have to, you know, just hope that there's a braille
682.00s - 688.96s |  pattern or a, uh, audio version or somebody nearby who can read it out loud to you. Uh, these types
688.96s - 697.44s |  of technologies offer huge levels of independence, uh, to people that, that have disabilities. Um,
697.44s - 702.72s |  there's tools like Be My AIs as well coming out recently that, you know, even more questions
702.72s - 706.96s |  arise from this type of thing. These are tools that let you take a photo of something and then
706.96s - 711.20s |  have a conversation with a chat bot about what's in it. Uh, and if you look at YouTube, there's
711.20s - 715.76s |  examples of people saying, okay, you know, what's here? Oh, well, there's a microwave on a shelf.
715.76s - 721.52s |  There's a knife next to it. Okay. Where's the button for popcorn on my microwave? Oh, it's the
721.52s - 728.08s |  second button down on the left, right? That is incredible. That is game changing for blind
728.08s - 733.92s |  people. But again, we run into these challenges of, well, it's fantastic that the blind person
733.92s - 741.44s |  has access to this data. Who else gets access to that data? Uh, other examples I have here are
741.44s - 746.16s |  things like captioning glasses, right? Um, for people who are deaf or hard of hearing, uh, or
746.16s - 750.24s |  for people who don't have English as a first language, there are captioning glasses by
750.24s - 756.80s |  companies like, uh, Xander and XRAI that will listen to what's going on and present a little
756.80s - 762.08s |  transcripts, uh, for you to read. Uh, and this is again, something, if you are deaf, that makes you
762.08s - 768.16s |  much more independent, much more able to partake in your kind of social life, uh, talk to people.
769.36s - 774.00s |  And yet who else can now read all of the conversations you're having?
775.44s - 780.80s |  Um, so there are many more examples of this, right? There's, there's many more things I could
780.80s - 786.72s |  describe to you about, uh, how XR can enable all of these assistive technologies, but let's take a
786.72s - 795.36s |  moment to talk about the risks. So the risks here are that in order for these things to function,
796.08s - 803.36s |  they basically act as little data vacuums, just sucking up, uh, either discreetly or continuously
803.36s - 808.64s |  data about you in terms of your gaze, your motion, uh, your biometric data, your location,
809.44s - 816.48s |  or data about your surroundings, you know, visual, auditory, temporal, spatial, uh, and those,
817.28s - 821.28s |  as you might expect, comes with a lot of risks. Um, three of them that I'd highlight for you.
822.00s - 831.60s |  First is non-consensual recording. So let's say you have a Billy who's blind, right? And he wants
831.60s - 836.64s |  to be able to recognize when his friend walks in the room. So he has a facial recognition app.
837.20s - 843.28s |  Now that is going to have to look at the face of everybody that walks into the room to function.
843.92s - 851.76s |  Uh, now how do we stop that from now reporting about all of the different bystanders that Billy
851.76s - 856.80s |  doesn't care about that did not give consent for that? How do we keep their identities safe, but
856.80s - 862.88s |  still make this tool useful? Uh, you can also think about the challenges of 3D mapping, right?
862.88s - 869.12s |  You know, if you are at a public university, a library or an airport, uh, it's fantastic to have
869.12s - 874.08s |  a 3D map of that for your navigation applications to be able to guide you to your gate, guide you
874.08s - 879.20s |  to the classroom you're going to. But let's say I, you know, I wearing my headset cause I, I did
879.20s - 884.16s |  my master's thesis on this of augmented reality for visually impaired people where we're using
884.16s - 889.04s |  the hollow lenses ability to map out the environment, uh, and then communicate useful
889.04s - 894.16s |  things about that. Now, let's say I'm wearing this as I walk around, it's mapping the space
894.16s - 900.08s |  around me. You know, if I go into my home and I map out my home, I now have a digital twin of my
900.08s - 907.36s |  home. Who has access to that twin, right? Same. If I go into a private facility or a government
907.36s - 911.76s |  office that they don't really take kindly to there being a bunch of 3D maps floating around
911.76s - 917.28s |  on the internet. Uh, how do we keep those safe? And all of these challenges with recording are
917.28s - 923.20s |  doubled or tripled in things like educational settings and healthcare settings, uh, where there
923.20s - 930.40s |  are major rules and laws covering what you can and can't record. Another big risk is data
930.40s - 935.36s |  retention, right? Let's say I need to pass some data up to the cloud to get processed.
936.32s - 942.48s |  Is it there and then gone? Is it just held in the moment or is it parked in some big server
942.48s - 947.36s |  farm somewhere? That means the organization that I've sent it to now can use it in perpetuity
947.92s - 952.48s |  or, you know, until they get a data breach and now everybody has that information.
953.04s - 957.76s |  Uh, wanting to make sure that when we do pass information to the cloud, that it's only held
957.76s - 962.56s |  for just as long as it needs to be is really important to keeping all our privacy safe.
964.08s - 967.76s |  Finally, I'm going to dip into science fiction a little bit for this one because
967.76s - 974.72s |  I'm a guess, I'm guessing that many of you like me are giant freaking nerds. Um, you can look at
974.72s - 980.48s |  things like a ghost in the shell standalone complex, for examples of perception hacking.
980.48s - 986.48s |  You know, if somebody is able to hack your headset, not only are they getting a record of
986.48s - 991.44s |  everything that you see in here, they could potentially be changing what you see in here.
992.00s - 998.08s |  Uh, you know, in ghost in the shell, there is the laughing man who is able to block himself out of
998.08s - 1003.12s |  everybody's cybernetic eyes. So nobody actually knows what he looks like. Uh, you can also look
1003.12s - 1008.40s |  at black mirror, because of course there's a black mirror episode about this, uh, for there's
1008.40s - 1014.24s |  an episode called men against fire, where soldiers are told they're going off to fight monsters,
1014.24s - 1021.44s |  mutants, these terrible monstrous creatures. Uh, and then a little flaunt, you know, a bug in the
1021.44s - 1027.12s |  software reveals to one of the soldiers, no, these are innocent civilians that you've been hunting
1027.12s - 1032.24s |  down and killing. Right. And now you may say, okay, this is all well and good. If you have
1032.24s - 1036.80s |  cybernetic eyes, we're a little ways away from that, but there are a lot of subtle ways that
1036.80s - 1041.84s |  this could be done. You know, for example, thinking about, um, advertisers who could
1042.40s - 1048.72s |  swap out billboards for their ads without you knowing, uh, thinking about political operatives
1048.72s - 1054.96s |  who could maybe every time you see a politician, make them a little bit uglier or something like
1054.96s - 1062.00s |  that. Right. To, to just subtly influence your perceptions. We need to be careful with who has
1062.00s - 1066.56s |  access to this data, both in and out, because these are the types of possibilities they're
1066.56s - 1071.52s |  going to come when more and more people start to wear these augmented reality glasses and headsets.
1073.52s - 1079.36s |  So we've talked about the good, you know, how XR technology can make life better for a lot of
1079.36s - 1084.16s |  people. We've talked about the bad, some of the risks that come with it. So how do we have the
1084.16s - 1090.24s |  best of both worlds? Well, again, I'm going to start with three because I only got half an hour
1090.24s - 1097.92s |  here. Um, the first one is on device processing. So doing as much as you can on the device and not
1097.92s - 1103.44s |  in the cloud. Uh, the vision pro actually has a pretty good policy about this for now, at least,
1103.44s - 1110.24s |  uh, where the pro acts as a gatekeeper between the data that is coming in from your sensors
1110.80s - 1116.64s |  and the apps that might want to use that data. Right. So it's not just like every single app
1116.64s - 1121.84s |  has full access to all your cameras and everything. It only get access to what it
1121.84s - 1127.52s |  needs in order to function. There's all those things like, uh, the, the optic ID it uses for
1127.52s - 1133.68s |  authentication is stored on device because as we know, uh, once your biometric data gets into the
1133.68s - 1138.88s |  cloud, it's a little harder to change than a password. Uh, there's a really great paper on
1138.88s - 1147.76s |  this called bystand AR, uh, by Corbett and his team, um, that talks about this idea of, uh,
1147.76s - 1155.20s |  basically automatically filtering out all bystanders from a scene. You know, you have the
1155.20s - 1161.20s |  camera, the camera input coming through, uh, it identifies all the faces and blurs all of them out
1161.20s - 1166.32s |  before it gets to a third party, except for the person you're talking to, right? There's a certain
1166.32s - 1172.80s |  threshold, uh, where between eye contact, voice communication, and other clues that tell you this
1172.80s - 1179.04s |  is the single person I'm interacting with. That one person gets their face and other information
1179.04s - 1186.32s |  sent off in order to get info about everybody else. It's kept private. Uh, data transparency
1186.32s - 1191.20s |  and control is another big one. We're talking about your right to know what is being collected
1191.20s - 1197.84s |  and for what purpose, you know, are AIs being trained on my gaze information, uh, control access
1197.84s - 1202.08s |  to your data and revoke it when necessary, and to make sure that your data gets deleted when it's
1202.08s - 1207.12s |  no longer needed. Now, if you're from Europe, congratulations, you have the GDPR and that
1207.12s - 1214.58s |  protects you from a lot of this stuff. If you're in the US, anyway, there's a great, uh, great paper
1214.58s - 1220.66s |  by, uh, Elise Dick of the Information Technology and Innovation Foundation a few years ago, uh,
1220.66s - 1225.46s |  that lays out some of the things that ought to be done on this, uh, for kind of policymakers,
1225.46s - 1229.54s |  lawmakers. So if you're interested, uh, I have that reference, I will happily send it to you.
1230.82s - 1236.26s |  Uh, and finally, because I think I just have a few minutes left here, consent. You know, consent is
1236.26s - 1242.18s |  the oldest and best way of protecting privacy, right? You consent to be recorded, you consent
1242.18s - 1248.90s |  to having your data used in order to help disabled people navigate the world. Um, there's a lot of
1248.90s - 1253.14s |  conversation about how to get consent in a feasible manner, right? Because, you know, if I
1253.14s - 1256.74s |  had a headset on right now, I couldn't just walk around and ask every single one of you, hey, can I
1256.74s - 1263.86s |  use this? Um, but you could imagine a scenario where, for example, uh, somebody's in a hospital
1263.86s - 1269.30s |  and all of the doctors and nurses have some type of token, you know, like a QR code they wear on
1269.30s - 1276.50s |  their shirt or something else that a headset could recognize and say, ah, these people have opted in
1276.50s - 1282.58s |  to facial recognition. It's okay to tell them, you know, tell the person using the headset their
1282.58s - 1287.22s |  name and their info and all of that. Um, there's a lot of interesting models around that. We don't
1287.22s - 1293.06s |  have time to get into them now, but, uh, again, making sure that we have systems in place that
1293.06s - 1300.50s |  know who has and who hasn't consented to having their information recorded, uh, is going to be
1300.50s - 1309.14s |  vital as we go forward. So, that is, uh, XR accessibility and privacy in a nutshell. Um, I
1309.14s - 1312.34s |  really want to thank you all for coming. I want to thank, uh, you all for having me. This is my
1312.34s - 1319.46s |  first time at DEF CON. Uh, it is a weird and wonderful place. Um, and I would love to take
1319.46s - 1328.75s |  a few questions in the time we have left. I see you all just came here to get comfy.
1329.39s - 1333.79s |  All right. Well, if anybody has any, uh, feel free to come talk to me. Uh, you can reach us
1333.79s - 1344.43s |  at xraccess.org. That's X-R-A-C-C-E-S-S dot O-R-G. Um, we have, uh, some really great resources. We
1344.43s - 1350.03s |  have a research network. If you're doing research into these related topics, definitely reach out
1350.03s - 1355.87s |  to us because we want to shine a spotlight on you. Um, because it takes all of us coming together
1356.11s - 1362.11s |  to solve these problems. We need the tech companies. We need the legislators. We need
1362.11s - 1367.55s |  the watchdogs. We need the disabled people and we need all of you with your expertise.
1367.55s - 1370.67s |  Uh, so I think we'll end it there and thanks so much.


url: https://www.youtube.com/watch?v=TuAZXkMCgXI
title: DEF CON 32 - How State Laws Meant to Protect Children Raise Other Risks - Anthony Hendricks
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=TuAZXkMCgXI",
  "title": "DEF CON 32 -  How State Laws Meant to Protect Children Raise Other Risks - Anthony Hendricks",
  "description": "On February 25, 1998, hip-hop group the Wu-Tang Clan made Grammy history\u2026 for all the wrong reasons. After losing in the Rap Album of the Year category, Wu-Tang member ODB stormed the stage, interrupting an acceptance speech to declare the now infamous phrase \u201cWu-Tang is for the children.\u201d Anyone who has heard a song from Wu-Tang knows that despite ODB\u2019s insistence, it is certainly not true. It appears that States may be taking this same approach when it comes to children's privacy and safety online. Despite these laws being for the protection of children, they often raise other unintended consequences. State legislatures around the country are debating new laws to protect children online. This year, Tennessee, Maryland, Virginia, Georgia, Utah, and Florida have passed legislation focused on children's privacy, usually through restrictions on social media use. While privacy advocates have championed these laws, they have been met with criticism and, in some instances, legal challenges. This is because in order to implement laws that apply to kids online, companies have to identify which users are kids\u2014which requires the collection of sensitive personal information. Along with this privacy tension, there are First Amendment protection concerns that these laws limit online speech. This presentation will explore how youth privacy laws may not be protecting children in the ways that we hope by first discussing the attempts made by states to address youth privacy. Then, analyzing the unintended privacy consequences, focusing on how states are required to collect sensitive information that we are often trying to protect. Next, we will examine the First Amendment concerns using the example of the challenges to California\u2019s Age Appropriate Design Code Act before finally discussing a path forward to protecting children.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1319,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 1.28s | This text was transcribed using whisper model: large-v2

 Good afternoon, everyone.
1.28s - 5.84s |  I am so excited to be here to be presenting Wu-Tang is for the Children,
5.84s - 11.52s |  How State Laws Intended to Protect Children Raise Unintended Risk and Consequences.
11.52s - 12.80s |  My name is Anthony Hendricks.
12.80s - 17.28s |  I'm a cybersecurity and data privacy attorney based in Oklahoma City.
17.28s - 21.92s |  While I am a lawyer, I am not your lawyer, and this presentation should not be considered
21.92s - 23.12s |  legal advice.
23.12s - 27.04s |  Instead, think of this as a conversation between friends.
27.04s - 32.48s |  But if you need legal advice, please, please, please find a local lawyer that can help you.
33.68s - 39.52s |  I also host a cybersecurity podcast that focuses on exposing underrepresented groups to the field
39.52s - 42.00s |  of cybersecurity and data privacy.
42.00s - 46.16s |  You can scan the QR code, and it will take you to the podcast, or you can find the podcast
46.16s - 48.40s |  anywhere where great podcasts are found.
49.76s - 52.80s |  So let's go back to 1998.
52.80s - 59.68s |  So on February 25, 1998, hip-hop group Wu-Tang Clan made Grammy history for all the wrong
59.68s - 60.72s |  reasons.
60.72s - 65.84s |  After the Wu-Tang Clan lost Best Rap Album of the Year category, Wu-Tang Clan member
65.84s - 72.64s |  ODB jumped on stage and said the infamous phrase, Wu-Tang is for the children.
72.64s - 77.52s |  Now, if you're not familiar with the Wu-Tang Clan and the Wu-Tang Clan's lyrics, I just
77.52s - 81.12s |  pulled a quick sampling that I want to share with the group, if that's OK.
81.76s - 84.24s |  Watch your stepkid and protect your neck.
84.24s - 86.40s |  Cash rules everything around me.
86.40s - 87.52s |  Cream, get your money.
87.52s - 88.72s |  Dollar, dollar bills, y'all.
89.28s - 91.44s |  If you want beef, then bring the ruckus.
91.44s - 94.80s |  Wu-Tang Clan ain't nothing to, well, you get the point.
96.80s - 99.76s |  So Wu-Tang Clan is not for the children.
99.76s - 105.76s |  Despite what ODB says, their lyrics really aren't things you should be playing for kids.
105.76s - 109.76s |  And it appears that states are taking the same kind of Wu-Tang Clan approach when it
109.76s - 111.20s |  comes to state privacy.
111.20s - 115.52s |  While they have all of these kind of laws that are focused on protecting children, when
115.52s - 119.76s |  you start paying attention to what these laws are doing, you realize that they're raising
119.76s - 121.92s |  a lot of privacy risk.
121.92s - 125.36s |  And they're not doing what they say they're going to be doing, which is protecting children.
127.12s - 129.60s |  So what exactly are we going to chat about today?
129.60s - 133.92s |  So we're going to first start talking about children's privacy and safety laws.
133.92s - 136.64s |  We'll then talk about how states are taking the lead.
136.72s - 139.20s |  We'll then look at some unintended consequences.
139.20s - 143.52s |  And then finally, we'll talk about some of my favorite Wu-Tang Clan songs and talk about
143.52s - 145.28s |  ways that we can grow together.
145.28s - 146.16s |  Does that sound good?
146.96s - 147.92s |  All right, let's go.
148.80s - 151.84s |  So children, privacy, and safety.
151.84s - 154.56s |  So we're going to stay in 1998.
154.56s - 159.44s |  And we're going to talk about Congress passing COPA, which is the Children's Online Privacy
159.44s - 160.32s |  Protection Act.
160.88s - 165.92s |  And this law protects children under the age of 18 requiring certain disclosures.
167.60s - 170.24s |  So what led up to the creation of this federal law?
170.24s - 175.20s |  So as people started getting on the internet, people had so many concerns about how we are
175.20s - 176.88s |  going to protect our children.
176.88s - 182.24s |  And so the Children's Advertising Review Unit, which is an industry group, drafted some guidelines
182.24s - 185.76s |  on what they thought the industry should be doing to protect children.
185.76s - 188.72s |  And so when you think about COPA, COPA was a remix.
188.72s - 194.64s |  What they did is they took that industry kind of guidelines, and they turned it into legislation.
196.72s - 202.40s |  So in 2013, COPA's rules were updated to kind of broaden the definition of children.
202.40s - 208.40s |  And in 2017, the rules were updated again so that it applied to IoT devices, the internet
208.40s - 208.96s |  of things.
210.40s - 211.44s |  So problem solved.
211.44s - 212.88s |  Why exactly are we here?
213.52s - 215.84s |  Why am I taking up some of your time today?
215.84s - 223.28s |  Well, COPA hasn't really been updated much besides 2013 and 2017.
223.28s - 228.32s |  And our current laws weren't created to address how we actually use the internet right now,
228.32s - 228.56s |  right?
228.56s - 233.76s |  And so other countries have passed laws that focused on children, and our laws look just
233.76s - 234.80s |  simply out of date.
237.15s - 241.47s |  One of the issues with our current laws is what exactly is a child, right?
241.47s - 245.07s |  If I just asked a person on the street what a child was, they'd quickly tell me someone
245.07s - 246.67s |  under the age of 18.
246.67s - 251.47s |  But in COPA, they define a child as a person under the age of 13.
251.47s - 254.03s |  So the law doesn't even look after teenagers.
254.03s - 258.51s |  And so that leads to some issues with gaps in the law because we're not protecting our
258.51s - 262.91s |  teenagers who are often more vulnerable because they are online all the time.
264.75s - 269.31s |  Also, there's been a lot of talk about protecting our children, but not much action.
269.31s - 273.71s |  For three years in a row, President Biden in the State of the Union starts to talk about
273.71s - 274.91s |  children's privacy.
274.91s - 279.31s |  And he talks about how we need to strengthen privacy protection, how we need to stop big
279.31s - 282.75s |  tech from collecting personal data on kids and teenagers online.
283.95s - 288.03s |  And he always has those phrases, but nothing has really come from it.
289.15s - 293.55s |  And there's been a number of laws that people have been debating, including the Kids Online
293.55s - 298.51s |  Safety, the Teens Online Privacy Act, and COPA 2.0.
298.51s - 301.63s |  So there's been a lot of conversations about protecting our children.
303.07s - 308.43s |  So I was done with my slides, and then the Senate wanted to start doing stuff.
308.59s - 315.07s |  And so the Senate began debating COSA and COPA, and they passed both of those laws,
315.07s - 315.31s |  right?
315.31s - 318.35s |  They passed it by wide margins, 91 to 3.
318.35s - 321.31s |  So it got a lot of bipartisan support.
321.31s - 323.55s |  So let's talk about those laws.
323.55s - 329.15s |  So COSA would require social media companies to protect users under age 17.
329.15s - 333.31s |  So it kind of expands that definition to include more and more people.
333.31s - 337.79s |  It will require companies to provide guardians with more controls over minors' use
337.79s - 338.91s |  on those platforms.
339.47s - 344.43s |  COPA 2.0 would also create stronger online privacy protections for our teenagers.
345.79s - 347.07s |  So good job.
347.07s - 347.79s |  Problem solved.
347.79s - 349.47s |  Why exactly are we still here?
350.19s - 353.15s |  Well, it still has to be passed by the House.
353.15s - 357.07s |  And the House is on vacation, and not the types of vacations that we take.
357.07s - 359.95s |  I'm talking about a six-week vacation.
359.95s - 365.07s |  And so we're not really going to have anything done by the House in a couple of months.
365.07s - 367.31s |  And so we're still facing these issues.
368.03s - 372.03s |  So let's start talking about how states are taking the lead.
372.03s - 375.55s |  When the federal government fails to act, our states start acting.
376.67s - 380.51s |  So if you're going to have any conversation about states and privacy, you have to start
380.51s - 383.95s |  with California, because they're often the leader when it comes to privacy.
384.91s - 389.23s |  In 2022, California passed the Age-Appropriate Design Code.
389.23s - 394.11s |  And that law required digital platforms to kind of determine whether their product was
394.11s - 399.31s |  targeting towards children, and to assess the type of risk of harm when it comes to
399.31s - 399.79s |  children.
401.15s - 403.47s |  And other states have gotten into the mix.
403.47s - 408.67s |  Last year, 35 states, along with Puerto Rico, started debating proposed laws.
409.31s - 411.15s |  And this year, it still continues.
411.15s - 415.95s |  12 state legislatures have pending legislation where they're talking about this.
415.95s - 421.31s |  And these proposed laws range from bans on social media for children, to restrictions,
422.11s - 425.47s |  to not allowing companies to have targeted ads towards children.
427.23s - 430.27s |  So what exactly do these laws look like?
430.27s - 435.23s |  So I threw them in a couple of different buckets so that we can talk about them just all together.
435.23s - 438.19s |  So there are some that include just social media bans.
438.19s - 440.51s |  So Montana says, hey, we're going to ban TikTok.
440.51s - 441.79s |  No TikTok for anyone.
442.43s - 445.95s |  Utah and Arkansas ban minors from using social media altogether.
445.95s - 448.43s |  If you're under a certain age, you can't get online.
449.07s - 452.67s |  Then there are other states that have just age restrictions.
452.67s - 455.23s |  And so Arkansas has an age restriction law.
455.23s - 460.59s |  Louisiana and Utah, where you're under the age of 13, you're not able to use these social
460.59s - 461.39s |  media companies.
463.47s - 468.35s |  Another category is restrictions on features, where they say, hey, certain features are
468.35s - 471.95s |  not allowed to be used if the user is a child.
471.95s - 474.83s |  And so usually it's related to targeted ads.
474.83s - 479.07s |  And then there are bans on collecting minors information, where you can't collect certain
479.07s - 480.19s |  information about kids.
482.67s - 484.03s |  So problem solved, right?
484.03s - 485.47s |  We're done.
485.47s - 489.95s |  Well, these state laws are talking about children's privacy and online safety.
489.95s - 491.63s |  So we should be good to go, right?
492.99s - 494.19s |  Not exactly.
494.19s - 495.95s |  And then the lawsuits happened.
495.95s - 497.87s |  Lots and lots of lawsuits.
498.67s - 502.75s |  So federal courts have granted preliminary injunctions that blocked laws in Arkansas,
502.75s - 503.95s |  California, and Texas.
504.83s - 509.23s |  And so there are a lot of lawsuits that are saying, hey, these laws that are intended
509.23s - 512.35s |  for children really raise unintended consequences.
512.35s - 514.51s |  They create a lot of problems.
515.31s - 517.15s |  So let's talk about those consequences.
517.15s - 519.39s |  Let's talk about those problems with these laws.
521.60s - 526.24s |  If you are going to create a law that protects children, you got to know who's a child, right?
526.24s - 528.80s |  You got to know who's a child and who's an adult.
528.80s - 533.28s |  And while the goal is more protection for children, it comes with two big costs.
533.28s - 538.32s |  It comes with a cost related to our privacy and a cost related to our First Amendment
538.32s - 538.80s |  rights.
541.09s - 546.29s |  So these laws require companies to provide additional protections for minors.
546.29s - 549.41s |  And so you need to find out who exactly is a kid.
549.41s - 553.25s |  And you do this by requiring age verifications, right?
553.81s - 557.25s |  And so we've probably all kind of seen these things where it's online.
557.25s - 559.81s |  Please verify that you're over the age of 18.
560.53s - 562.77s |  But these state laws are asking for more.
562.77s - 569.89s |  They're usually asking for third party verifications or even some weird stuff like age estimations.
569.89s - 571.17s |  And so that's really weird.
571.17s - 572.61s |  And we'll talk about that for a moment.
574.05s - 575.89s |  So third party verifications.
575.89s - 579.25s |  This is when a third party is used to verify someone's age.
579.25s - 583.65s |  So this can be something like, hey, take a picture of your ID so that we can show that
583.65s - 585.57s |  you are over the age of 18.
585.57s - 587.25s |  Or, hey, use your credit card.
587.25s - 591.89s |  Put your credit card information in and we'll know that you are over the age of 18 because
591.89s - 592.85s |  you have a credit card.
593.49s - 599.01s |  Other sites require users to sign up for other third party software where you put in your
599.01s - 599.97s |  information for them.
599.97s - 601.01s |  You get an account.
601.01s - 605.41s |  And then they say, hey, just give us the information from your account and we can verify how old
605.41s - 605.81s |  you are.
607.57s - 613.17s |  Another way, which is a little bit weirder, companies attempt to guess a user's age.
613.17s - 619.33s |  And so this can be done by turning on your camera and having facial recognition guess
619.33s - 621.65s |  if you are over the age of 18.
621.65s - 623.41s |  That sounds a little creepy, doesn't it?
624.21s - 629.89s |  Others have suggested that a user's age can be guessed based on their online activities.
629.89s - 635.17s |  So they'll kind of look at what website you're going to to determine if you are an adult.
637.25s - 638.45s |  So what's the problem?
638.45s - 640.29s |  What is the exact problem with this?
640.29s - 644.77s |  Well, it's too much information and too little information.
644.77s - 649.01s |  So people have to give even more information to companies.
649.01s - 651.49s |  You have to give them your ID, your credit card.
651.49s - 654.85s |  You have to give them access to your online activities.
654.85s - 659.49s |  Does anybody feel comfortable with giving more and more information to companies?
660.13s - 663.25s |  But also, there are some people who don't have that information.
663.25s - 667.25s |  If you don't have a credit card, it means that you can't get on social media.
667.97s - 673.25s |  If you don't have an ID, it means that, well, you can't get on to any of these websites.
673.25s - 676.77s |  And so there's a problem with too much information and too little information.
679.25s - 682.05s |  And then accuracy with this biometrics.
682.05s - 685.73s |  Can these systems accurately identify a person's age, right?
686.85s - 689.65s |  Even though we've had advancements in these systems,
689.65s - 694.13s |  this software still has trouble with distinguishing faces of women and people of color.
694.13s - 698.29s |  And so I like to call this the black doesn't crack problem, right?
698.29s - 701.57s |  The software is going to be looking at you, and they're not going to be able to identify
701.57s - 706.13s |  your age, largely because it was trained using white men as the model.
707.09s - 711.89s |  But there's also questions about the ability for companies to protect your biometric information.
711.89s - 714.45s |  You're giving them more and more information about you.
715.81s - 719.89s |  And so we've seen so many of these headlines about all of these lawsuits
719.89s - 724.21s |  and these lawsuit settlements related to biometric information.
724.21s - 729.49s |  Last month, Metta agreed to pay $1.4 billion to settle a biometric lawsuit
729.49s - 731.01s |  with the state of Texas.
731.01s - 735.17s |  Instagram reached a settlement in Illinois for $68.5 million.
736.13s - 740.45s |  TikTok reached a $92 million settlement for a biometric case.
740.45s - 745.17s |  And so do we trust these companies with having more and more of our information,
745.17s - 747.25s |  especially our biometric information?
750.35s - 752.91s |  It also raises First Amendment problems.
753.47s - 758.59s |  And First Amendment laws, some of these laws are creating First Amendment concerns from everyone.
758.59s - 763.07s |  And you may be wondering, why is this a First Amendment issue, right?
763.15s - 768.51s |  So let's take a moment and talk about constitutional law for non-attorneys.
768.51s - 772.75s |  Just one slide, and you will walk away knowing more constitutional law
772.75s - 774.67s |  than most people in this country.
774.67s - 775.07s |  All right.
775.63s - 779.55s |  So the First Amendment protects my speech, right?
779.55s - 781.15s |  It protects your speech.
781.15s - 783.71s |  But the First Amendment also applies to children.
783.71s - 785.79s |  It protects our children's speeches.
786.35s - 789.39s |  Another area is that it protects company speeches.
789.39s - 793.79s |  A lot of people don't understand that, but the First Amendment applies to companies.
794.91s - 800.03s |  And also, we need to remember that freedom of speech doesn't mean freedom from consequences.
800.03s - 806.35s |  So you could be online saying crazy things, and you will still face consequences.
806.35s - 810.51s |  It is a freedom of speech from the government creating laws about that,
810.51s - 812.35s |  but not freedom of consequences.
813.07s - 818.91s |  But also, the First Amendment protects the creation and dissemination of information,
818.99s - 821.07s |  because that's considered speech.
822.67s - 825.39s |  So now you are our constitutional scholars.
827.15s - 827.47s |  All right.
827.47s - 829.63s |  So let's talk about the First Amendment again.
830.27s - 832.67s |  Kids and parents have a First Amendment, right?
833.47s - 836.67s |  These laws restrict children's access to social media sites.
836.67s - 842.67s |  And children, even ones under the age of 13, have a constitutional right to speech.
843.31s - 846.19s |  Also, their parents have a right to make decisions
846.19s - 849.55s |  about what type of speech their children are being able to give.
849.55s - 853.39s |  And a lot of these laws say, hey, even if your parents are fine with you
853.39s - 857.71s |  getting on these social media sites, we don't want you because you're under the age of 13.
858.35s - 861.23s |  And you can't do that because you're infringing on
861.23s - 863.79s |  the children and the parents' First Amendment rights.
865.47s - 867.95s |  It also has an impact on company rights.
867.95s - 871.31s |  As we talked about, companies have a First Amendment right.
872.11s - 878.03s |  These laws also prohibit and restrict the collection, sale, and sharing of children's data.
878.03s - 882.03s |  And so when courts looked at this issue, the courts have repeatedly said,
882.03s - 885.63s |  hey, if you're going to create these laws that restrict the rights of companies
886.19s - 892.27s |  to collect this information, then there must be a very important compelling government interest.
892.27s - 894.35s |  And it has to be narrowly tailored.
894.35s - 897.07s |  You need to have the least restrictive laws.
897.07s - 899.87s |  And only then are we going to allow you to do something
899.87s - 904.51s |  that may potentially infringe on these First Amendment rights.
906.43s - 908.03s |  So what about adults?
908.03s - 913.31s |  While these laws are focused on children, they also impact the rights of adults.
913.31s - 916.51s |  These laws could have a chilling effect on your speech.
916.51s - 921.87s |  If you have to show your ID or put in your credit card information before logging on to Twitter,
922.67s - 925.63s |  that's probably going to change what you're going to say online, right?
925.71s - 927.79s |  Because everybody knows exactly who you are.
929.15s - 932.35s |  And so it has an impact on what people may say.
936.85s - 940.61s |  Another common element in all of these state laws is content moderation.
941.17s - 944.13s |  The focus is keeping harmful information away from children.
944.69s - 948.21s |  However, this encourages companies to censor all information.
948.21s - 951.33s |  It encourages them to delete posts meant for adults
952.05s - 954.85s |  because they may not be appropriate for children.
954.85s - 959.89s |  And companies' content moderation is very different from government-required restrictions.
960.53s - 964.53s |  But it encourages more content moderation by companies.
966.53s - 970.37s |  So now let's talk about ways that we can address these issues.
970.93s - 973.81s |  Maybe not through the use of state laws, but through other mechanisms
973.81s - 977.81s |  by looking at some of my favorite Wu-Tang Clan songs and skits.
977.81s - 978.37s |  Sounds good?
978.93s - 979.49s |  All right.
981.01s - 982.93s |  Could it all be so simple?
982.93s - 986.29s |  One of the closing tracks of Enter the 36 Chambers,
987.01s - 991.73s |  where the Wu-Tang Clan members talk about the simpler things in life.
992.29s - 993.97s |  So it's not all doom and gloom.
994.53s - 998.85s |  There are still ways that we can protect children and respect our rights.
999.89s - 1003.41s |  So we should think about simpler solutions.
1003.41s - 1005.41s |  So what's the problem that we want to solve?
1005.41s - 1007.73s |  What exactly is the problem that we want to address?
1008.29s - 1011.41s |  And solve that problem in the least restrictive way.
1014.19s - 1016.83s |  Next, we need to stop being sharks.
1016.83s - 1021.23s |  One of the skits from a Wu-Tang Clan album was talking about people who are sharks.
1021.79s - 1023.15s |  Sharks are people who are biters.
1023.15s - 1023.87s |  They're copiers.
1024.59s - 1026.83s |  Most people tried to steal the Wu-Tang Clan style.
1027.55s - 1031.63s |  In the US, states are trying to steal what they're doing in Europe.
1031.63s - 1036.51s |  And a lot of these state laws are just copycats of laws in the EU.
1037.23s - 1042.43s |  And that's a problem because this is America and we do freedom differently.
1042.43s - 1048.59s |  Our First Amendment protections are very different than protections found in other countries.
1048.59s - 1053.15s |  And so that means when you're taking a law from another country and trying to apply it here,
1053.15s - 1055.79s |  it raises all types of issues.
1055.79s - 1058.83s |  So instead of trying to steal or bite from other people,
1058.83s - 1062.83s |  we need to create American-focused solutions.
1062.83s - 1065.23s |  We shouldn't just look to see what other countries are doing.
1065.95s - 1068.19s |  We should focus on what our rights are,
1068.19s - 1072.67s |  what our beliefs and our traditions are to create specific US laws.
1074.91s - 1077.47s |  Cash rules everything around me, right?
1077.47s - 1080.03s |  We need to talk about the importance of money,
1080.03s - 1082.91s |  the importance of involvement with industry.
1082.91s - 1086.11s |  We can't exclude industry when we attempt to create these laws.
1086.11s - 1090.99s |  I think it's important for us to remember that COPPA was an industry standard.
1090.99s - 1093.79s |  Like, we took something from the industry as guidelines
1093.79s - 1096.51s |  and we used that as a starting point to create a law.
1097.31s - 1100.35s |  A number of these restrictions that states are coming up with,
1100.35s - 1105.39s |  they are expensive to implement for not only for companies, but for the government,
1105.39s - 1109.87s |  for the government to be able to monitor whether people are following these things.
1109.87s - 1113.31s |  And so we need to focus on better industry standards
1113.31s - 1118.43s |  and allowing them to be part of the process that we can have better solutions.
1121.74s - 1124.46s |  Next, we need to proceed with caution.
1124.46s - 1128.62s |  The law is constantly changing and our courts continue to look at these issues.
1128.62s - 1133.50s |  And so what might be fine a couple of months ago, isn't fine now.
1133.50s - 1136.70s |  So remember, yesterday's price is not today's price.
1136.70s - 1139.90s |  Things that might be okay when we looked in the past,
1139.90s - 1141.82s |  aren't exactly going to be fine now
1141.82s - 1146.06s |  because the law is constantly changing and developing in this area.
1148.19s - 1150.75s |  And then finally, a better tomorrow.
1150.75s - 1153.55s |  We need to focus on data minimization, right?
1153.55s - 1159.07s |  We need to focus on ways to have the least amount of information given to companies.
1159.63s - 1163.71s |  We can protect children by placing an emphasis on funding law enforcement
1163.71s - 1166.67s |  and groups that tackle child exploitation.
1166.67s - 1171.39s |  We need to educate kids on how to be safer online, right?
1171.39s - 1175.39s |  Not only just having laws that place additional protections for children,
1175.39s - 1177.95s |  we also need to tell children that they need to protect themselves.
1177.95s - 1181.31s |  They need to watch their step and protect their neck, right?
1181.31s - 1185.87s |  And then finally, we need to have comprehensive privacy protections for everyone.
1185.87s - 1188.35s |  We need to create laws that protect all of us,
1188.35s - 1191.15s |  not just our children, but every single American.
1193.10s - 1194.78s |  So what did we learn today?
1195.50s - 1200.38s |  People forget about half of all new information within an hour of learning it.
1200.38s - 1202.22s |  So it's not uncommon for someone to say,
1202.22s - 1205.26s |  okay, you stayed an extra day at DEF CON for that last day.
1205.90s - 1207.34s |  What exactly did you learn?
1207.34s - 1210.46s |  I saw that there was someone talking about children's privacy.
1210.46s - 1211.18s |  What did you learn?
1211.18s - 1212.78s |  And it's not uncommon for you to be like,
1214.38s - 1218.30s |  I can't recall, but he did a great job and I loved his suit, right?
1219.58s - 1224.06s |  And it's not your fault because a human brain can only focus on
1224.06s - 1230.06s |  six to nine new pieces of information before there is a steep drop-off.
1230.06s - 1232.94s |  So I am going to help everyone out.
1232.94s - 1236.14s |  Here are six takeaways so that if someone asks you,
1236.14s - 1239.10s |  what exactly did you learn from this presentation?
1239.10s - 1243.18s |  You will be able to remember at least one thing, right?
1243.18s - 1246.78s |  So first, the public is right to be concerned
1246.78s - 1249.10s |  with the privacy and safety of our children.
1249.66s - 1257.26s |  Two, the federal government has not been able to update and pass new laws,
1257.26s - 1258.94s |  so states are taking the lead.
1259.50s - 1264.83s |  Three, state laws will be all right.
1266.19s - 1270.91s |  State laws have unintended consequences that impact our privacy and rights.
1270.91s - 1275.23s |  Four, state children privacy laws ask us to trade our rights
1275.23s - 1278.75s |  for potential protections, but it's not a fair trade.
1279.71s - 1283.71s |  Laws should be narrowly focused based on U.S. standards and laws
1283.71s - 1286.19s |  and include industry input.
1286.19s - 1290.99s |  And then six, Wu-Tang is not for the children, but their songs still slap.
1291.63s - 1293.95s |  All right, so thank you so much.
1293.95s - 1296.99s |  If you like the slides and you want to get a copy,
1296.99s - 1298.19s |  you can scan a QR code.
1298.19s - 1302.03s |  It'll take you to my website, and then you can download the slides.
1302.03s - 1304.99s |  They won't be available until probably tomorrow
1304.99s - 1307.47s |  because hotel Wi-Fi is not the best.
1308.99s - 1310.51s |  All right, well, thank you so much.
1310.51s - 1315.07s |  I really appreciate this time to talk about children's privacy.


url: https://www.youtube.com/watch?v=M-2d3sM3I2o
title: DEF CON 32 - Winning the Game of Active Directory - Brandon Colley
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=M-2d3sM3I2o",
  "title": "DEF CON 32 - Winning the Game of Active Directory - Brandon Colley",
  "description": "The Game Of Active Directory (GOAD) is a prebuilt vulnerable Active Directory (AD) environment primarily created for pentesters. Touting over 30 methods of attack, GOAD offers multiple paths to full AD takeover. But is that really how you win the game? Regardless of color, as security professions our goal should be to better secure environments. This talk walks through AD attack strategies, exploiting misconfigurations that ultimately pwn AD. Mitigations for these attacks are discussed and implemented, showcasing how they stop common attacks. Implementing these protections in your environment is truly how you win the Game Of Active Directory.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2584,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.37s - 9.29s | This text was transcribed using whisper model: large-v2

 Okay, I am with the Packet Hacking Village, and this particular speaker is being sponsored
9.29s - 15.85s |  by us, and we are delighted to present Brandon Colley, who is going to obviously talk to
15.85s - 17.97s |  you about Active Directory.
17.97s - 23.53s |  He has been, he'll tell a little bit about himself, but he works for Trimark Security,
23.53s - 25.81s |  and I'm also proud to call him friend.
25.81s - 32.24s |  Take it away.
32.24s - 37.00s |  Thank you, Kathy, friend Kathy, Investigator Chick, everybody.
37.00s - 40.44s |  Alright, can you guys hear me okay in the back?
40.44s - 41.44s |  Awesome.
41.44s - 42.44s |  Let's do this.
42.44s - 47.96s |  So, title, as you all know, is Winning the Game of Active Directory.
47.96s - 53.28s |  So a little bit about myself is I served in an operations role, managed Active Directory
53.28s - 58.84s |  for about 15 years for multiple different organizations before I joined Trimark about
58.84s - 61.00s |  two and a half years ago.
61.00s - 66.84s |  A senior security consultant for them, and just got promoted to the service lead role
66.84s - 70.72s |  for our Microsoft Cloud assessment, so I'm kind of joking and saying that this might
70.72s - 76.96s |  be my last on-prem Active Directory presentation, so maybe next year you'll come to see, like,
76.96s - 81.36s |  Winning the Game of Entra ID or something like that, so.
81.36s - 87.00s |  Recently founded my own company and got a logo created, so I threw it up there, so B&R
87.00s - 89.40s |  Consulting is a company that I just started.
89.44s - 96.12s |  I'm a father, here's one of my kids with me at a Chiefs game, I saw a Chiefs hat, go Chiefs,
96.12s - 101.20s |  and my wife Bridget came with me today, so I am a very loving husband, as I hope she'd
101.20s - 102.20s |  also agree.
102.20s - 114.17s |  First time at DEF CON as well, so, and so before we really start digging in, I want,
114.17s - 118.33s |  I mean, the title of the game is How to Win the Game of Active Directory, so let's talk
118.33s - 122.81s |  about what I'm talking about when I talk about the game of Active Directory.
122.81s - 129.29s |  So GoAD, as I like to call it, or somebody said GoAD, so Prebuilt Active Directory Lab
129.29s - 137.37s |  is a multi-domain environment, they have multiple different builds that you can create and touts
137.37s - 141.81s |  over 30 different vulnerable configurations just out of the box.
141.81s - 147.05s |  It's created and maintained by Mayfly of Orange Cyber Defense, and Mayfly gave me permission
147.05s - 152.49s |  to go ahead and use this in the presentation, he just wanted to know when it gets posted
152.49s - 155.49s |  online and he wants my slides, so.
155.49s - 160.37s |  It was originally created for penetration testers to practice attacking Active Directory,
160.37s - 166.73s |  so real quick, where are my penetration testers in the audience, or any red team side people,
166.73s - 171.39s |  how about anybody on the blue side, okay, so we're heavily blue, awesome, and then everyone
171.39s - 177.17s |  else is just unaffiliated, I'm assuming, you don't get a vote.
177.17s - 181.73s |  So when you start playing a game, first thing you gotta do is character selection screen,
182.01s - 186.93s |  so we can choose to be a penetration tester, which your job is to exploit vulnerabilities,
186.93s - 191.37s |  misconfigurations, moving to a little bit of a red teamer, you're gonna start looking
191.37s - 195.77s |  a little bit more at testing detections and doing a little bit more stealthy activities
195.77s - 201.49s |  when performing Active Directory tests, and then our defenders, like most of you, are
201.49s - 206.85s |  looking forward to learning how to harden your environments, performing consistent monitoring
206.85s - 210.97s |  of those environments and just consistently improving the overall security posture of
210.97s - 213.11s |  your Active Directory.
213.11s - 216.13s |  The other character you could choose is to be an adversary, so I'm gonna assume that
216.13s - 220.41s |  the rest of you didn't raise your hands are my adversaries, right, but they don't play
220.41s - 223.09s |  by the rules anyway.
223.09s - 226.13s |  So the most important rule when you play a game is how do you win, right, and that's
226.13s - 229.53s |  what I'm here to talk about, is how do you win the game of Active Directory, and a lot
229.53s - 233.93s |  of people think that you can win the game of Active Directory by gaining domain admins,
233.93s - 238.93s |  right, that's the keys to the kingdom, once you get domain admin, it's game over, it may
238.93s - 243.57s |  be exfil of data, maybe you want some of that, uh, that juicy information that's in
243.57s - 248.61s |  Active Directory, or maybe you just wanna create persistence and you wanna be slow and
248.61s - 253.49s |  methodic about your efforts, however I'm here to kind of challenge that a little bit and
253.49s - 258.41s |  say that the way that you truly win the game of Active Directory, regardless of which character
258.41s - 264.41s |  you choose, is to maintain a secure environment, continuously improve that environment and
264.41s - 268.73s |  implement the safeguards that are needed to keep your Active Directory safe, and also
268.73s - 270.37s |  continuous progress.
270.37s - 274.09s |  So what I'm here to do today is kind of show you both sides of that, I'm gonna take a little
274.09s - 279.73s |  bit of an attack methodology and also defense methodology, so we have a, Ted Mosby likes
279.73s - 283.97s |  to say we have a tightly scheduled evening of awesomeness ahead of us, so let's go, and
283.97s - 289.73s |  I guess technically now it is evening, or afternoon anyway, so our agenda, we're gonna
289.73s - 295.33s |  stick with the gameplay idea, uh, we've got three different levels, so level one, we're
295.33s - 300.49s |  gonna call Reconnaissance, Enumeration, PrivEsc, and then level four is when we pwn Active
300.49s - 308.06s |  Directory and that's really our, our end boss.
308.06s - 313.54s |  So starting off with Reconnaissance, our first question when we are, are either protecting
313.54s - 319.94s |  or attacking Active Directory is kind of what's visible with simply network access, right,
319.94s - 324.44s |  no usernames, no passwords, we just are on the network and, and maybe in this case we
324.44s - 327.50s |  just know the IP address of a domain controller.
327.50s - 332.22s |  So here's an example of using CrackMap Exec, and this is our first misconfiguration which
332.22s - 338.26s |  is called anonymous access, if this is configured in your domain, anybody with network access
338.26s - 343.66s |  direct line of sight to your domain controller can query for a list of users as well as some
343.66s - 347.26s |  of the public information such as description.
347.26s - 352.22s |  And so here if we drill in, we identify that we've already got our first credential in
352.22s - 357.62s |  Samwell who had, must have had an administrator put his password in the description field
357.62s - 360.73s |  for some odd reason.
360.73s - 364.89s |  So how do we mitigate this other than just don't put passwords in description fields,
364.89s - 373.17s |  right, that's kind of the obvious one here, is removing these groups from your domain,
373.17s - 379.57s |  domain root, sorry, the pre-Windows 2000 group, I'm not saying to delete this from the domain
379.61s - 385.89s |  root, but if the members of this include the everyone group or the authenticated, I'm sorry,
385.89s - 391.89s |  not authenticated, the anonymous logons group, then this is possible.
391.89s - 396.49s |  In, in the Goad lab, the screenshot on the right is actually how it was configured, is
396.49s - 402.09s |  you're just giving root access to anonymous logon and that's what enables the ability
402.09s - 406.57s |  to, to see everything without having any sort of initial user.
406.65s - 410.53s |  So once we've removed that, we rerun the attack, we get nothing.
410.53s - 416.57s |  So we get an error message, nothing comes back, anonymous access no longer relevant,
416.57s - 419.33s |  so now we have to dig in a separate way.
419.33s - 424.05s |  So if we can't do it anonymously, we're going to have to build a user list, and so the game
424.05s - 429.01s |  of Active Directory, if you've, if you've used it before, you, you may know it's based
429.01s - 432.95s |  on the game of Thrones, which is kind of where the game of thing comes from, right?
432.95s - 439.55s |  So this is a good place for us to start scraping credentials, I'm sorry, not credentials, usernames.
439.55s - 444.55s |  So we're going to pull out the first names, last names, combine those, and form a user
444.55s - 445.59s |  list.
445.59s - 450.71s |  So the screenshot on the left is the user list that I'm using, which is a first name
450.71s - 457.67s |  dot last name, that's the, the, the methodology that's used in the lab, but in your environments
457.67s - 461.95s |  it might be a first initial dot last name, you might not have a dot, it might be your
461.95s - 464.95s |  last name and then your first name, something like that.
464.95s - 470.15s |  So we can go ahead and we can throw all of those into a user list, and then we can attack
470.15s - 474.29s |  Active Directory, still anonymously, using a script like this.
474.29s - 480.03s |  So this is just an in-map script that all you need to have is your user list in a text
480.03s - 485.27s |  file, and again the domain IP, and what it's going to do is it's going to attempt to authenticate
485.27s - 490.27s |  to Kerberos, or it's going to query Kerberos, Kerberos is going to come back and, and tell
490.27s - 493.99s |  you one of two things, it's either going to say, uh, yeah, that's valid, or no, that's
493.99s - 494.99s |  invalid.
494.99s - 500.35s |  So now we've got a list of nine valid accounts that were in that, uh, file, and so now we
500.35s - 502.55s |  know who we can attack.
502.55s - 505.91s |  And you guys might say, hey, it's not fair, you knew it was the Game of Thrones, so you
505.91s - 510.83s |  knew who you were attacking, well, there are plenty of lists out there on GitHub that you
510.83s - 516.87s |  can just do a, a very top 100 common names, and you can do the same style of attack.
516.87s - 521.11s |  And once you get one or two hits, then you kind of know the naming convention, right,
521.11s - 525.87s |  and then you just go out to LinkedIn, and you search up, uh, Microsoft, or whoever you're
525.87s - 530.55s |  attacking, and you scrape from there, right, so this is real world stuff that, that you
530.55s - 534.31s |  can obviously do.
534.31s - 539.27s |  And so the reason that this works is, is ingrained in the Kerberos protocol.
539.27s - 543.39s |  So if an account doesn't exist, then you're going to get this first, uh, error message,
543.39s - 545.51s |  which is that the principle's unknown.
545.51s - 550.03s |  If the user does exist, you're going to get one of those other, other two responses, and
550.03s - 553.23s |  that's basically what happens under the covers of this in-map script.
553.23s - 567.19s |  Sorry, I'm gonna drink, and this is weird, so.
567.19s - 576.27s |  Okay, so the fix for, for this is not easy, um, and sometimes not even possible.
576.27s - 582.03s |  And this is a, this is a no-fix, uh, bug, I guess you can say, Microsoft doesn't consider
582.23s - 589.07s |  user enumeration to be a bug, so the, the best thing that we can really offer is just,
589.07s - 593.59s |  if you're looking at being able to change things, is don't use the same, uh, email address
593.59s - 598.35s |  that you use for your same account name, or vice versa, uh, instead maybe create some
598.35s - 602.35s |  sort of non-standard naming convention by throwing something about the department, or,
602.35s - 606.11s |  or the type of person, if it's, um, like I used to work at a university, so maybe like
606.11s - 610.39s |  a F for faculty, S for staff, A for administration.
610.39s - 614.59s |  Maybe you do F for finance, um, I for IT, something like that, right?
614.59s - 619.91s |  Or probably the best thing to do is use multiple trailing digits, uh, and this is gonna exponentially
619.91s - 624.35s |  create a whole lot more trouble, where you're gonna have to have a much larger user list
624.35s - 629.47s |  and a whole lot more time to be able to really enumerate a full contents of Active Directory.
629.47s - 634.91s |  And I understand that this is hard, um, mitigations are more around password policies, which we're
634.91s - 638.39s |  gonna attack here, um, in a little while.
638.39s - 644.07s |  But because I talked about the Kerberos protocol, I wanna go back through another anonymous
644.07s - 649.47s |  thing that you can do, is attack, uh, Kerberos pre-authentication, and so this is known as
649.47s - 654.51s |  an AS rep-roast, and so this is what it looks like when you perform an AS rep-roast attack
654.51s - 657.59s |  using the ImpactKit toolkit.
657.59s - 662.87s |  And accounts that do not require pre-authentication are going to come back and give us a password
662.87s - 663.87s |  hash.
663.87s - 668.83s |  And in this case, Brandon Stark, uh, no relation, by the way, uh, gives us password hash for
668.83s - 671.82s |  free.
671.82s - 676.22s |  And with that, we can use Hashcat or John the Ripper or some other, um, offline attack
676.22s - 681.14s |  tool where we can throw this through, and I just threw it through, uh, a ROKU, which
681.14s - 687.58s |  is just a typical user list, uh, password list, sorry, and we get the clear text credentials,
687.58s - 695.21s |  uh, in just a matter of a few, a few minutes.
695.21s - 698.45s |  So fixing this is, is pretty easy.
698.45s - 699.45s |  It's just a checkbox.
699.45s - 705.41s |  So there is a Kerberos pre-authentication checkbox on user accounts, says do not require
705.41s - 707.09s |  Kerberos pre-authentication.
707.09s - 712.53s |  This is a super, super legacy thing, uh, pretty, pretty free of a win in an environment.
712.53s - 717.29s |  So if you've got any of this in your environment, um, removing that checkbox is gonna mitigate
717.29s - 723.29s |  it, which means after we remove that checkbox, Brandon no longer gives out his password freely,
723.29s - 727.89s |  uh, so we're gonna have to attack the passwords using some of the more, uh, more well-known
727.89s - 729.73s |  styles of, of password attacks.
729.73s - 738.65s |  I need, like, a desk someplace, like, right here, I'm gonna spill that on my computer.
738.65s - 744.49s |  Okay, so password attacks kind of fall into a few different categories, and so we're gonna
744.49s - 748.13s |  attack password reuse by doing a password spray.
748.13s - 756.29s |  And so, excuse me, password spray is, uh, trying a small handful of passwords against
756.29s - 758.75s |  all usernames in an environment.
758.75s - 763.75s |  So in this case, I used some of the passwords that I already found in the environment, and
763.75s - 768.87s |  I'm just seeing if there's possible password reuse, uh, across user accounts.
768.87s - 773.41s |  In this one, it didn't hit anything, but some common uses for this is things like using
773.41s - 783.02s |  Summer 2024, or Defcon 32, or whatever, right, like, um, and just seeing kind of what hits.
783.02s - 788.66s |  Uh, a similar attack is a credential stuff attack, and this is more commonly used with
788.66s - 795.14s |  breach credentials, so this is also a password reuse attack, but it's more specific to the
795.14s - 801.02s |  user account themselves, so, or the user themselves, so if they use the same password, say, for
801.02s - 807.10s |  LinkedIn, and we're able to identify that the, the email address that they signed in
807.10s - 812.42s |  with LinkedIn was the same as the Active Directory that we're attacking, it's possible that,
812.42s - 816.82s |  that we may be able to hit something using a credential stuffing attack.
816.82s - 821.86s |  In this specific account, um, sorry, this specific screenshot, uh, I kind of lazily
821.86s - 828.62s |  just used the same user list, and, as the password list, which simulates the, the situation
828.62s - 835.26s |  where a user has the same password as their username, which is not terribly common anymore,
835.26s - 838.98s |  but, uh, used to be common around, like, service accounts and things like that, so if you got
838.98s - 844.94s |  passwords that haven't changed in your environment for a very long time, this may, may be possible.
844.94s - 850.78s |  And so we did get a hit on that one, uh, we got the account Hodor, which, uh, we'll
850.78s - 856.94s |  use later in another authenticated attack, but so some of the things that we can do is,
856.94s - 861.40s |  and I showcase here just checking out the password policy to prove that you can view
861.40s - 865.66s |  it as any user in the domain, so once you have that initial user, you can query the
865.66s - 870.86s |  password policy and maybe tailor your password attacks a little bit more specific, and so
870.86s - 875.38s |  if you're wondering why on earth someone could have the same username and password,
875.38s - 882.06s |  it's due to the complexity requirement that's disabled in this lab, also the, the character
882.06s - 888.86s |  limit is only five, which I have seen worse than that, so five, not, not the worst, um,
888.86s - 892.06s |  some other things that you want to do with your password policy, other than kind of the
892.06s - 896.62s |  obvious two there, is looking at some of the account lockout threshold, as far as, and
896.62s - 901.46s |  also some of the other password, uh, requirements in there, I do, I do have a link to an article
901.46s - 906.14s |  I wrote called password policy a la carte, that's gonna be in my resources, so, uh, check
906.14s - 912.99s |  that out, uh, after the talk, I do want to talk a little bit about account lockout, because
912.99s - 917.95s |  it is an effective strategy to blocking some password style attacks, um, not gonna talk
917.95s - 922.93s |  about monitoring, because that's another, another thing, um, but you can query things
922.97s - 928.63s |  using password, um, crack map exec, and so, here, I've just simulated something, uh, uh,
928.63s - 933.17s |  I, this is an oopsie, so for the red teamers, you're probably somewhat familiar, hopefully
933.17s - 937.41s |  not, with seeing something like this, where you see log on failure, log on failure, log
937.41s - 941.45s |  on failure, and then you see account locked out, and hopefully this is just the one account,
941.45s - 947.55s |  and not, like, all the accounts, right? Um, mistakes happen, uh, but log on failures are,
947.57s - 953.15s |  are going to kind of reset that account lockout counter. So, to help combat that, whether
953.15s - 957.75s |  you're looking, I am showing the attack tools, but defense tools is kind of, um, another way
957.75s - 962.75s |  that you can look at stuff like this. When we rerun the, the crack map exec script, using
964.59s - 970.43s |  the user's flag authenticated, we can get the bad password count, so, here, we identify
970.43s - 973.87s |  the very bottom account was the one that we accidentally locked out, the other ones are
973.89s - 980.43s |  sitting at four, and so, we can wait, uh, for those password, um, resets to retime before you
980.43s - 987.51s |  attempt to attack them again. So, that concludes level one. Yes, right? So, we gained three
988.79s - 992.89s |  attack credentials, uh, three account credentials, but that's not necessarily the goal that we
992.89s - 997.35s |  talked about, so, the goal, rather than getting those credentials, is more so the
997.35s - 1002.89s |  vulnerabilities that we've identified as being able to patch, and so, in level one, we
1002.91s - 1007.07s |  talked about anonymous access, removing that from an environment, using a little bit more
1007.07s - 1012.51s |  robust usernames, and how attacks like that might occur, Kerberos pre-authentication, and
1012.51s - 1017.61s |  how that's a pretty quick, easy win, and then improvements to password hygiene and account
1017.61s - 1029.74s |  lockout. Alright, so, on to level two. I like that cute little bunny over there. Um, so, I
1033.40s - 1038.10s |  called this one enumeration, and then I, I told myself, nah, I should change it, cause this
1038.10s - 1043.02s |  is a little bit more, like, privilege escalation, and lateral movement stuff, and I realized
1043.02s - 1049.23s |  that, whatever, it's, it's just hard, so we're just gonna call it more hacks. So, the main
1049.23s - 1052.97s |  difference between this level and the first level is that we're doing a little bit more while
1052.97s - 1058.05s |  authenticated. So, what type of Active Directory presentation would be complete without
1058.05s - 1063.11s |  talking about Kerberosting? So, Kerberosting is an attack on accounts that have, uh,
1063.11s - 1067.65s |  service principal names, or SPNs. So, here's what that looks like. It's an authenticated
1067.65s - 1072.65s |  attack. You're able to identify both Jon Snow and the SQL service account are vulnerable to a
1074.17s - 1079.43s |  Kerberosting attack. So, we're gonna take those hashes, we're gonna throw those through
1079.43s - 1085.87s |  Hashcat again, and here we cracked the Jon Snow account, because it was a weak password. So, you
1090.10s - 1094.80s |  can run something like this. So, this is a quick PowerShell search that you can run, uh, get
1094.80s - 1099.80s |  an AD user, where you just are looking for accounts that have service principals, and these
1101.00s - 1105.44s |  usually are not cleaned up, because service accounts are scary. So, if you're an
1105.44s - 1109.14s |  administrator, you don't want to touch a service account, because you don't know if it's being
1109.14s - 1113.28s |  used, or where it's used, and you dare not change the password, because you have no idea where
1113.28s - 1116.68s |  to change it, what's gonna break, and change it back, like what's gonna happen, right? I've been
1116.68s - 1120.16s |  there, I did that for 15 years, and no, I didn't do this, and no, I didn't change those
1120.18s - 1125.66s |  passwords. Um, but what I'm telling you we can do, is we can look at things like LastLogon, which
1125.66s - 1130.66s |  may not be 100% accurate, but it may be helpful. Is the account privileged? If it's
1131.96s - 1137.80s |  privileged, and it's Kerberostable, then that's pretty much a free win for an adversary. So,
1137.80s - 1142.80s |  specify, uh, specifically look at those first. For the remaining ones, go ahead and look at what
1144.48s - 1149.44s |  the service principal says. So, in our case, the Jon Snow account, and I realize that's a little
1149.46s - 1154.00s |  bit small, but there's a HTTP setting in there, so there's a website that it's attempting to
1154.00s - 1159.64s |  coordinate with, called the wall.north, seven kingdoms, etc. If I check DNS for that, it
1159.64s - 1164.64s |  doesn't even exist. So, if I can't access that web server at all, then this service account's
1165.98s - 1170.98s |  not doing anything. So, we're gonna go ahead and remove that. The one that's going to remain
1170.98s - 1176.42s |  is the SQL service account, because it actually is running SQL, it's required to do that. Uh,
1176.44s - 1182.18s |  that one didn't crack, because it's using a long, strong, complicated, random password. And so,
1182.18s - 1187.18s |  that's how you protect other accounts that are, um, Kerberostable, is with, with that. And so,
1189.12s - 1193.76s |  this is what the attack looks like now that we removed the service principal. Jon Snow no
1193.76s - 1207.24s |  longer shows up as even being attackable. On path attacks. So, this I like to claim to be God's
1208.16s - 1213.16s |  gift to AD pentesters. Is that right, you pentesters? Right? This, um, responder, you set
1217.00s - 1223.34s |  this up and it, it'll just listen and respond to clients on the network. It's gonna say, uh,
1223.34s - 1227.34s |  client's gonna come out and say, hey, I'm looking for so and so, and it's like, yeah, that's me.
1227.34s - 1232.28s |  Yeah, that's me too, that's me too. And, um, if we have it set up in this way, it can poison
1232.32s - 1238.46s |  those requests and we can actually get NTLM hashes. In this case, it's NTLM v1 hashes for these
1238.46s - 1242.96s |  accounts. And so, we can do what we've done twice already, is we can crack them hashes again
1242.96s - 1248.48s |  with Hashcat. And so, here we've got our third account that we've been able to crack. And this
1248.48s - 1255.32s |  one was just from listening to the network. And while that's scary, the scarier thing that you
1255.32s - 1260.42s |  can do is you can configure responder to run in a similar way, but instead of giving you the
1260.46s - 1265.94s |  hashed credentials, you can tell it to go ahead and pass those or relay those using NTLM relay
1265.94s - 1271.00s |  X. And you can relay that authentication attempt to a target or targets. So, in this case, I'm
1271.00s - 1276.64s |  targeting a web server, the one that ends in 22 there. And I'm just gonna wait for responder to
1276.64s - 1282.28s |  get some authentication to happen. It's gonna send that here and then I've told it to set up a
1282.28s - 1286.76s |  SOX proxy. So, I've got an active connection using Edward Stark, which just happens to be an
1286.76s - 1293.78s |  administrator on that web server. So, now, we've got a shell on our target. So, we can do
1293.78s - 1299.94s |  things like this, where we can interrupt, uh, interact with that session and we can run
1299.94s - 1307.56s |  secrets dump on it. Pardon me. So, you can see I specified no password. I don't need a
1307.56s - 1311.84s |  password. I've already authenticated to it. I have an active session and I can run secrets dump
1311.84s - 1317.04s |  against it and I can dump the local SAM hashes. So, this includes the local administrator
1317.08s - 1320.92s |  account. Any other local accounts that exist. So, if you've got like a help desk account or
1320.92s - 1325.68s |  something like that, that you've, you've placed on systems. This will dump all local credentials
1325.68s - 1330.70s |  on that, that server or workstation. Also more fun, it's gonna extract saved credentials. So, here
1333.20s - 1339.26s |  we're attacking service account. So, if you may recognize the SQL service account that was not
1339.26s - 1345.64s |  Kerberoastable. You will not be Kerberoasting me. Uh, was in plain text because it's configured as
1345.64s - 1351.44s |  a service. It's running a service which is required for SQL, SQL Express. So, that account
1351.44s - 1356.46s |  was free on that machine. And so, what can we do for on path attacks? So, the quickest and
1358.96s - 1365.10s |  probably, uh, the easiest of all of these is preventing the LLMNR, which is link local
1365.10s - 1370.36s |  multicast name resolution. Yes, I had to write that down and no, I'll not memorize that. Um, I
1370.36s - 1375.32s |  do have a, a great article linked for that one as well. Actually, I have articles for all
1375.32s - 1382.34s |  these. Um, you may have remembered or noticed that, that those hashes were NTLMV1 hashes
1382.34s - 1388.24s |  with, which are infinitely easier to attack than NTLMV2. So, enforcing this on your domain
1388.24s - 1393.24s |  controller and setting it to the highest security level of enforcing NTLMV2 to exist on your
1393.90s - 1398.90s |  network. Ideally, not allowing NTLM at all and allowing Kerberos to do what it's supposed to do
1401.74s - 1407.98s |  for the last 20 years. Uh, this is hard and I don't know that I've ever fully seen this. I've
1407.98s - 1412.52s |  seen people auditing it and, and really starting to get ready for it. Um, another thing that
1412.52s - 1418.42s |  we've seen, I think twice at Trimark is LDAP signing and channel binding. This is another
1418.42s - 1422.96s |  thing that's incredibly difficult. It can break a lot of those non-Windows devices. I've
1422.98s - 1430.60s |  also got a couple links to some articles that have been written about this as well. A thing
1430.60s - 1434.70s |  that I don't think's all that hard, some administrators do think that's hard, that this is
1434.70s - 1439.48s |  hard. Um, this is protecting the accounts themselves. So, this might be a little bit easier
1439.48s - 1444.52s |  to get through some of that change management for you, is using the protected users group.
1444.52s - 1447.82s |  Because you're only impacting whatever users you put in it and not the enterprise when you're
1447.82s - 1453.30s |  making domain controller changes. Uh, co-worker of mine, Jake Hildreth, which owns our Active
1453.32s - 1458.12s |  Directory Security Assessments. He has a blog and a presentation. He's writing a tool to help
1458.12s - 1464.40s |  assist with end users adding, uh, accounts to the protected users group. So, again, I've got
1464.40s - 1469.40s |  that in the resources. Alright, so level two's down. We Kerberos to John Snow. We cracked the
1471.00s - 1476.00s |  hash from responder for Rob Stark. And we found the SQL service account running. So, now
1476.54s - 1481.54s |  we've got six accounts. And we've got five more vulnerabilities that we have patched. So, we
1483.82s - 1488.82s |  cleaned up SPNs. We disabled LLMNR and NTLM V1 by enforcing V2. We talked a little bit about
1492.40s - 1496.76s |  at least thinking about LDAP signing and channel binding. And then also the protected users
1496.76s - 1505.68s |  group. Protecting, um, those highly privileged users in your, your domain. So, level three, I
1505.68s - 1509.92s |  called PrivEsc. Again, this is maybe a little bit more lateral movement-y. Um, also some
1509.92s - 1515.70s |  pretty, pretty domain crushing attacks in this one too. And I'm gonna kinda start by going
1515.70s - 1520.44s |  backwards just a smidge. Cause I wanted to show Bloodhound just a, just a little bit. Um,
1520.44s - 1525.34s |  Bloodhound is an amazing tool that you can use to scan your Active Directory environment. And
1525.34s - 1531.38s |  here I'm just showcasing what paths are available to domain admin. And here I'm gonna zoom in
1531.38s - 1536.32s |  on the one that we just owned. So, we just got that Rob Stark account. And Rob Stark is a
1536.32s - 1540.82s |  member of the administrators group, which is just this very simple step away from domain
1540.82s - 1544.82s |  admins. And so, that one's just a little bit too boring, cause you can just add yourself to that
1544.82s - 1550.40s |  group, right? So, we're gonna do something cool. And we're gonna identify what ACL modification
1550.40s - 1555.18s |  may look like. So, here you might remember our old friend Samwell, who was our first attack
1555.18s - 1559.54s |  with that description field misconfiguration. Well, Samwell, for whatever reason, has the
1559.54s - 1564.54s |  ability, has a write DAQL on a GPO that's linked to the domain root. So, what does that look
1566.38s - 1573.65s |  like? So, here's what it looks like when we look at the policy itself. We see that the
1573.65s - 1578.79s |  delegation tab shows us that we have some privileges with Samwell. If we dig into him a
1578.79s - 1582.83s |  little bit, we identify he doesn't look too terribly dangerous, because he doesn't have write
1582.83s - 1587.83s |  permission. He has read and he has, um, delete. But we have to actually look at advanced to
1588.07s - 1593.07s |  identify what the real threat to this is, which is that write DAQL permission, which
1594.23s - 1600.27s |  translates to modify permissions and modify ownership. So, Sam can give himself, or anyone
1600.27s - 1605.47s |  else, access to modify this GPO. And there's a number of different things you can do once you
1605.47s - 1611.55s |  can modify a GPO, specifically at the domain root. One such example is just creating a file
1611.55s - 1616.79s |  that's gonna run at login for all users on all computers in your environment. So, we can do
1616.79s - 1622.85s |  some pretty messy stuff with that. So, mitigating this is, is fairly simple. You just have to
1622.85s - 1628.49s |  check out the, the GPOs. I don't have a script for this. Um, I should probably write one. So, I
1628.49s - 1632.29s |  may write one and put it up on GitHub, where you can actually scan some of the ACLs that might
1632.29s - 1636.73s |  be dangerous. But specifically start with your domain root and then move on to domain
1636.73s - 1642.55s |  controllers, move to, uh, other protected OUs to identify group policies that maybe have
1642.57s - 1647.57s |  delegations. Uh, also ownership. So, identify who has owner on your GPOs. And so, if we clean
1650.91s - 1658.23s |  that up, then we're in a lot better shape for any of that ACL modification. So, I'm gonna take
1658.23s - 1664.03s |  us a little bit back. So, you remember when we attacked the web server that we were
1664.03s - 1669.97s |  targeting, this stuff? Um, I don't really remember either, but basically what we did was we
1670.01s - 1676.19s |  were able to gain the local credentials for that web server. And what we can do with local
1676.19s - 1682.69s |  credentials is we can do a pass the hash attack. So, in this example, we're using the
1682.69s - 1686.99s |  administrator. This could be, like I said, a help desk account or any other local account. And
1686.99s - 1693.07s |  we can target all other known IPs in that domain. And this could be, uh, servers. This could
1693.07s - 1699.35s |  be workstations. And in this case, we identify that very first one, the castle black. That's
1699.35s - 1702.93s |  the one that we attacked. We expected that one to show up as pwned. But that bottom one,
1702.93s - 1709.09s |  Winterfell, is actually a domain controller. It's, I mean, this is a lab, so this is fairly
1709.09s - 1713.37s |  unrealistic. But the reason this works is because when you promote your first domain
1713.37s - 1718.37s |  controller, it's going to use that credential as the domain administrator credential. Um, so
1720.31s - 1725.11s |  just a little bit of digression on that. But with that, we don't even need to know what the
1725.11s - 1729.69s |  password is for that administrative account. We can just pass that hash and authenticate. And
1729.69s - 1734.89s |  here, I'm using EvilWinRM. And you can see at the bottom that I've got a shell on our domain
1734.89s - 1739.89s |  controller. And solution for this is to use something like LAPS. So, old admins like myself
1742.67s - 1747.67s |  maybe remember that the days before LAPS was a thing where you would use a GPO and you'd set the
1748.17s - 1753.17s |  local administrator account on all machines. And thanks to the C password, where everybody
1755.51s - 1761.05s |  could read that, we've now got clear text credentials. So, other than even just reuse and
1761.05s - 1766.05s |  passing the hash, uh, C password has clear text creds. That's not even an attack that, that I
1767.49s - 1772.69s |  showcased in this. It's fairly old. We do still see it on old GPOs. Even if they're unlinked, they
1772.71s - 1778.65s |  still have some C passwords in them. So, you may check that. But this is what LAPS looks like. Um,
1778.65s - 1785.07s |  I've got articles on that as well. Cause I'm not gonna go super into LAPS. I am gonna go a little
1785.07s - 1795.28s |  bit into Kerberos delegation though. So, Kerberos delegation is a required feature of Windows.
1798.02s - 1803.58s |  It's when, an example would be when a user authenticates to a web server and then that web
1803.60s - 1809.30s |  server needs to authenticate on behalf of that user to a database server, for example, to be able
1809.30s - 1815.12s |  to, uh, provide the, the correct results for the user that's asking. So, it's kind of a security
1815.12s - 1818.88s |  thing. It's pretty much built in. But in this case, when we talk about delegation, we're talking
1818.88s - 1824.16s |  about impersonation. Which means that web server has the ability to impersonate any user in the
1824.16s - 1829.64s |  domain. And so, what that looks like, specifically when we're attacking const- uh,
1829.66s - 1835.32s |  unconstrained delegation, is we have a shell on that web server that we had shown that we
1835.32s - 1841.84s |  attacked earlier. And since it's set up for unconstrained delegation, we either wait, or we
1841.84s - 1846.84s |  can con, um, coerce an administrator to log into that system that we're in control of. And so,
1848.24s - 1854.38s |  here, using Mimikatz, I was able to export the tickets for Brandon. So, a client named Brandon.
1854.40s - 1862.56s |  Uh, Brandon was very impressionable admin at the time. So, Brandon logged into our, our server
1865.02s - 1871.22s |  that we had control of. Using Mimikatz, we were able to set up what's called a pass the ticket
1871.22s - 1876.74s |  attack. And then we load that ticket into our session. And we can view that using that K list
1876.74s - 1881.84s |  tickets to identify that we have that cached ticket for Brandon. And then that last command in
1881.84s - 1887.08s |  the bottom is just opening a PowerShell, PowerShell session to a domain controller. So,
1887.08s - 1894.10s |  we're authenticating as a domain admin to a domain controller. And now, we've got a shell on
1894.10s - 1899.94s |  the domain. We run whoami. We just look at sysvol. And so, now, we've basically owned that
1899.94s - 1905.08s |  domain controller. I've got a lot more attacks to, to go. So, I'm not gonna stop there, though.
1905.08s - 1910.38s |  So, how do we stop this specifically? So, moving unconstrained delegation to constrained
1910.38s - 1916.78s |  delegation is a good way to mitigate this. Uh, you can specify the specific service or server
1916.78s - 1925.21s |  that's required instead of just allowing delegation to occur wherever, wherever it needs.
1925.21s - 1931.39s |  That, again, can be somewhat difficult to identify. So, what I like to do, even in the, I'm not
1931.39s - 1936.33s |  saying don't do that, but what I am saying do is mark accounts as sensitive and cannot be
1936.33s - 1941.19s |  delegated. So, all of your administrators, this is kind of a baby step to the protected users
1941.19s - 1945.81s |  group. Set them up like this. Because, like I said, Brandon was very impressionable. And he
1945.81s - 1950.65s |  could be tricked to logging into wherever, because he's an admin. You know, somebody, user
1950.65s - 1954.55s |  calls, he logs in wherever they tell him to log in as his domain admin credentials, right?
1954.55s - 1960.73s |  What could go wrong? So, now that I've set Brandon as sensitive, he can't be delegated, on
1960.73s - 1965.77s |  the right here is what we just did. So, that's what the attack looked like in Mimi Cats. If
1965.77s - 1972.03s |  that attack were to attempt, be attempted when the account was set up, he, he was still, he
1972.03s - 1976.83s |  still logged in and we can still look at some stuff in Mimi Cats, but we don't have that ticket
1976.83s - 1980.31s |  granting ticket, which means we can't load it into the session and we can't attack that account
1980.31s - 1990.05s |  anymore. Alright, so, level 3 is over. We don't have any new accounts, but we're kind of beyond
1990.05s - 1994.93s |  that now. You know, we've kind of gotten to the point where we're already, uh, on the precipice
1994.93s - 1999.93s |  of domain admin. We've already kind of gained that full domain, uh, compromise. So, what we've
2000.63s - 2005.63s |  learned in, in level 3 is how to fix ACL and ownership issues, specifically on GPOs, but other
2008.07s - 2013.61s |  objects are also important. Configuring laps to prevent things like local administrative
2013.61s - 2018.45s |  credentials beyond multiple machines being able to perform lateral movement. Implementing
2018.45s - 2022.65s |  constrained delegation instead of unconstrained, and then protecting your admin accounts using
2022.65s - 2035.60s |  the account as sensitive and cannot be delegated flag. Alright, now the fun one. We're gonna
2035.60s - 2040.60s |  pwn AD. So, the print nightmare. I don't know if you all remember this. Um, it was 3 years ago,
2043.70s - 2048.00s |  I think now, and this I like to call the attack that got me into InfoSec. So, I told you I
2048.00s - 2052.88s |  worked for TriMark for 2 and a half years now. Print nightmare came out when I was still a
2052.88s - 2058.82s |  sysadmin. It let me poke at it and proved to my administrators that it was exploitable. So, we
2058.82s - 2064.62s |  had something to do. So, this is what that looks like. So, running a CrackMap exec tool as
2064.64s - 2071.02s |  well as the impact tool, we identified that the spooler is running on our target system and the
2071.02s - 2079.25s |  protocols necessary to perform the attack are also available. So, what this attack looks like
2079.25s - 2083.99s |  is we can just host a malicious DLL on a Samba share from this Kali box. This is where the
2083.99s - 2088.99s |  screenshots are coming from. Using the cube 0x0 exploit, we can target the domain controller and
2091.79s - 2095.81s |  we're using just a regular user account. So, that Hodor account that we grabbed, no
2095.83s - 2100.29s |  administrative credentials in the domain whatsoever, can authenticate to that domain
2100.29s - 2106.51s |  controller and because the print spooler is is available on that server, we can throw this
2106.51s - 2111.51s |  nightmare DLL at it and it says exploit completed. And what that exploit does is it's created a
2114.75s - 2120.29s |  new account for us in the domain. It's called print nightmare 2 and it is in the
2120.29s - 2127.70s |  administrator's group. And this is my favorite mitigation because it's the easiest
2127.74s - 2133.02s |  mitigation. So, we just disable the print spooler. And yes, I I know print nightmare has been
2133.02s - 2138.42s |  patched, thank goodness. So, not this specific attack is available everywhere anymore, but the
2138.42s - 2144.06s |  print spooler is used in so many coercion attacks that can occur now that I like to say, if
2144.06s - 2150.66s |  you're not printing or performing printing as a print server, then you have no need to run the
2150.66s - 2157.04s |  print spooler whatsoever. So, disable it either manually here or use a GPO to to disable it and
2157.08s - 2165.42s |  here you see on the right hand side that that server is no longer vulnerable to attack. So, our
2165.42s - 2171.92s |  last attack is gonna be um one of the active directory certificate services, so ADCS, uh
2171.92s - 2177.12s |  vulnerable con-configuration that we're gonna attack using the certify tool. So, this has been
2177.12s - 2183.14s |  very popular over the last couple years. Uh about two years ago or so, we saw this as a
2183.14s - 2187.60s |  critical vulnerability on almost every single assessment that we did. Thankfully, things have
2187.60s - 2191.84s |  gotten a little bit better in the industry now. But this is what that looks like. So, we're
2191.84s - 2198.52s |  gonna run our certify tool with a find command. This is just using a regular user account to a
2198.52s - 2206.37s |  domain controller. So, our output's gonna include all the vulnerabilities that exist in that
2206.37s - 2210.29s |  domain, if it's running uh certificate services. And yeah, I'm gonna drill into that,
2210.29s - 2216.95s |  cause it's hard to see. So, the specific one that we're gonna pick out is called ESC1 or uh
2216.95s - 2222.19s |  escalation one. This is from the certify pre-owned stuff that Spectrops put out. Um it's
2222.19s - 2228.23s |  also in the resources. So, what makes us vulnerable is that enrollee subject uh enrollee
2228.23s - 2233.07s |  supply subject, which equals the subject alternative name, can be applied when you enroll a
2233.07s - 2238.07s |  certificate. The second half of that puzzle is who can enroll dangerous certificates. So, in
2241.01s - 2246.61s |  this case, we have domain users, have enrollment rights, and that means that anybody can
2247.27s - 2253.44s |  enroll a certificate and they can specify that they are whoever they want to be. And so, we
2253.44s - 2258.44s |  can go uh take the next step and we can run certify and request our certificate. So, here we
2259.74s - 2264.52s |  can see we're targeting that ESC1 template. We're telling it that we want to be
2264.52s - 2270.46s |  administrator. We can tell it whatever we want. But of course, we wanna be the administrator
2270.46s - 2279.64s |  account. So, we've saved that private key locally and now we're gonna authenticate with it. So,
2279.64s - 2284.64s |  now we run the certify auth command. We specify the PFX, the domain controller, and we've
2285.88s - 2290.88s |  now got the uh credential cache. So, the Kerberos credential as well as the hash for the
2292.18s - 2298.62s |  administrator account. Which means we can do bad things. So, we can run secrets dump using
2300.00s - 2304.96s |  that hash. We could also authenticate with that that C cache file doing that and we can dump
2304.96s - 2310.28s |  the entirety of the domain controller. So, here we've got the the SAM, but that's not even
2310.28s - 2316.28s |  really what we want. We want the NTDS.DIT file. So, this contains the entire contents of
2316.28s - 2322.16s |  Active Directory and all the NT hashes for every single user. And we did this with very little
2322.16s - 2327.16s |  privilege whatsoever. So, in that context, that attack was game over, right? But we're not
2329.42s - 2332.90s |  quite done. We still have some work to do because we're learning that domain admin doesn't
2332.90s - 2338.64s |  mean that we're we're finished as administrators. So, we need to investigate why the
2338.66s - 2343.24s |  vulnerable template existed in the first place. So, this is what I said earlier. It's that
2343.24s - 2348.54s |  two-piece. The domain users, it doesn't have to be domain users. It could just be a subset of
2348.54s - 2354.04s |  regular user accounts that could enroll certificates. So, the bigger issue is that supply
2354.04s - 2358.98s |  and the request. So, a little bit better of a mitigation is to require manager approval for
2358.98s - 2365.27s |  specific certificates. There's a number of different things that you can do. And this is what
2365.27s - 2369.85s |  the certificate that was issued looks like. So, here you'll see the subject was Brandon,
2369.87s - 2374.21s |  because he was the one that requested the certificate. But he requested it using the subject
2374.21s - 2381.84s |  alternative name as administrator. So, that's what it looks like when a certificate's enrolled.
2381.84s - 2386.18s |  And so, we already talked about how you can detect it, but how can you do it automatically? So,
2386.18s - 2391.18s |  this is another tool that a friend of mine, Jake, has put out called Locksmith. You can run
2392.68s - 2397.76s |  this whether you're on the blue side or the red side. This is a fantastic tool that discovers
2398.74s - 2403.48s |  several different misconfigurations in environments. So, this is what it looks like when it
2403.48s - 2409.82s |  detects ESC1. I think the coolest thing that it does is it provides fixes for you. So, it can
2409.82s - 2416.06s |  output some PowerShell that will actually mitigate this. And it looks at not only ESC1, but all
2416.06s - 2420.66s |  the way through 8, with the exception of 7. And also looks at some auditing being enabled,
2420.66s - 2426.00s |  which does not happen by default in ADCS. So, it provides fixes for every single one of these
2426.04s - 2436.37s |  as well. And so, we technically we created the Brandon Rocks account, but I wanted to put it up
2436.37s - 2443.98s |  here because I hope you agree. So, we got our last two vulnerabilities patched. So, two more
2443.98s - 2450.22s |  bin- mitigations is to disable that print spooler and run Locksmith in your environment. Our
2450.22s - 2454.36s |  game is still not over though. So, even though we've reached the end boss and we fought it,
2454.36s - 2458.40s |  there's always that next level. Our princess is always in another castle. There's always
2458.40s - 2463.54s |  something else you can do. There's always that next step. Um, Active Directory is not, is not
2463.54s - 2469.44s |  done with new vulnerabilities that come out on a regular basis. It's old, but it's, there's
2469.44s - 2473.96s |  new, new research that occurs every day. So, I urge you all to get an assessment done, get a
2473.96s - 2479.66s |  pen test done, uh, try out some of these tools. So, this is a list of all the resources that I
2479.66s - 2485.76s |  used. So, use, if you have permission to run these tools, everybody please, right? I'm not
2485.76s - 2491.34s |  telling you to go hack yourself without permission. Um, I'll hold that up there just for a
2491.34s - 2499.14s |  second. Um, I will, I will share these on my, my GitHub and, cause here's a list of all those
2499.14s - 2504.24s |  resources I talked about. As well as the character selection screen. So, I put this back up
2504.24s - 2511.24s |  because I love AI art and how bad it is at spelling things specifically. Um, I also told it to
2511.24s - 2516.38s |  give me a character selection screen for the game of Active Directory. And it came back with
2516.38s - 2525.72s |  this. And everybody is sad. Every single person has a frown on their face. Like, this guy
2525.72s - 2530.20s |  bottom, like, three from the right, he's got circles under his eyes. I don't know, he's beat
2530.20s - 2535.84s |  up. And then there's the names of them. There's Dad, and Oh Lordy, and Doy, and, and, it's
2535.84s - 2554.08s |  fantastic. So, with, with that, thank you all for coming. Packed house, fantastic, guys. Um,
2554.08s - 2558.76s |  so, you can, um, follow me or find me on pretty much everything. I'm TechBrandon, GitHub's
2558.92s - 2564.46s |  TechBrandon. Um, Twitter, LinkedIn. Uh, thank you, Packet Hacking Village. Thank you, DefCon.
2564.46s - 2569.14s |  Um, I do think I've got a decent amount of time for questions. So, if anyone wants to stick
2569.14s - 2579.14s |  around and has any questions, I will, uh, do my best. Cool. Or you can just, or you can go early
2579.14s - 2581.38s |  and you can go get a snack, cause it's lunchtime.


url: https://www.youtube.com/watch?v=anrgU7LjN1A
title: DEF CON 32 - Warflying in a Cessna - Matt Thomassen, Sean McKeever
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=anrgU7LjN1A",
  "title": "DEF CON 32 - Warflying in a Cessna - Matt Thomassen, Sean McKeever",
  "description": "Wardriving is cool, and airplanes are cool. What happens if we combine the two? Is it safe? Is it legal? How much WiFi is it possible to see from an airplane? How far does WiFi leak into the atmosphere? How far away can we see an access point? Can we catch a specific network at 1500 feet above the ground? How about 2500? We loaded up a small plane and flew around in circles to find out. This talk will share both our preparation and our results, including figuring out the best places to warfly, what equipment to use, and how to do it safely. We will present the flights we made, the data we gathered, how we analyzed it, and what we discovered. (Spoiler alert: flying a Cessna is a really, really non-stealthy way to collect information about wireless access points.)",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1468,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.50s - 3.50s | This text was transcribed using whisper model: large-v2

 Good morning, happy Sunday at DEF CON.
3.50s - 7.50s |  Thank you for coming to our talk, because we can.
7.50s - 10.50s |  Warflying in a Cessna.
10.50s - 14.50s |  I'm Sean McKeever. I'm a senior security researcher,
14.50s - 17.50s |  and I do other stuff from Metro Detroit.
17.50s - 19.50s |  Sometimes I race cars.
19.50s - 22.50s |  Matt Thomason, also Metro Detroit.
22.50s - 26.50s |  My day job is in security and has pretty much nothing whatsoever to do with warflying.
26.50s - 31.50s |  I am also a commercial multi-engine pilot, instrument rating,
31.50s - 34.50s |  and licensed airframe and power plant mechanic.
34.50s - 38.50s |  And all of the opinions that are expressed here are our own.
38.50s - 40.50s |  Statement, yeah.
40.50s - 43.50s |  And probably have nothing to do with our respective employers.
43.50s - 46.50s |  I didn't even tell them I was coming.
46.50s - 50.50s |  All right, so the story. It's November 2019,
50.50s - 54.50s |  and I was awash in a sea of mats, Matt.
54.50s - 56.50s |  This was our cube area.
56.50s - 60.50s |  I had a mat and a mat and a mat, coffee, and then a not-mat.
60.50s - 64.16s |  So we're sitting around.
64.16s - 65.16s |  It's, you know, like I said, November.
65.16s - 69.16s |  DEF CON had come and gone, and Matt and I are like, let's do a DEF CON talk.
69.16s - 71.16s |  I'm like, yeah, but I tried that.
71.16s - 72.16s |  I can't talk about work.
72.16s - 75.16s |  What else are we going to talk about?
75.16s - 77.16s |  Matt goes, I have a plane.
77.16s - 79.16s |  Like, oh, Wi-Fi?
79.16s - 81.16s |  Yeah, let's do that.
81.16s - 88.84s |  And then 2020 happens.
88.84s - 92.84s |  So, you know, we did finally get together and do it.
92.84s - 96.84s |  Warflying, it's like war driving, or war dialing,
96.84s - 99.84s |  or as in greetings, Professor Falcon.
99.84s - 103.84s |  We're looking for wireless access points from the air,
103.84s - 106.84s |  and there are unfortunately no weapons involved.
106.84s - 107.84s |  Fortunately, I said fortunately.
107.84s - 109.84s |  Fortunately, yeah.
109.84s - 111.84s |  And so we're warflying into Cessna.
111.84s - 112.84s |  Not these Cessnas.
112.84s - 115.84s |  Cessna has actually made warplanes, but we weren't using those.
115.84s - 118.84s |  Although the L-19 on the bottom is kind of close.
118.84s - 122.84s |  If somebody wants to donate an L-19 for further research, please see me afterwards.
122.84s - 125.84s |  Our Cessna was more like this.
125.84s - 127.84s |  Cessna 182.
127.84s - 131.84s |  Not this airplane, because I think that one's registered for not in the U.S.
131.84s - 133.84s |  But four-seat airplane.
133.84s - 138.84s |  High wing, which gives us a little better visibility to the ground.
138.84s - 140.84s |  230 horsepower engine.
140.84s - 144.84s |  Cruises comfortably around 150 miles an hour.
144.84s - 149.84s |  And one nice thing is we've got six hours of fuel, so with reserve figure five hours,
149.84s - 155.84s |  we can go for a long time and long distance if we want to do such.
155.84s - 158.25s |  A few disclaimers.
158.25s - 160.25s |  This is not legal advice.
160.25s - 162.25s |  Neither of us is a lawyer.
162.25s - 164.25s |  This is not flight instruction.
164.25s - 165.25s |  We are not flight instructors.
165.25s - 168.25s |  We are also not expert war drivers.
168.25s - 173.25s |  But we are grateful to the war driving community that has made great tools like Wiggle,
173.25s - 177.25s |  and many of those people are over in the RF hackers village.
177.25s - 179.25s |  And we're not the first to do this.
179.25s - 181.25s |  During our research, we found that about 20 years ago,
181.25s - 186.25s |  somebody wrote a paper on collecting data on wireless access points from the air,
186.25s - 192.25s |  but there doesn't seem to have been a lot of discussion or work on the topic since then.
192.25s - 197.25s |  So we thought it was worth doing some experimenting and firing up the conversation again.
197.25s - 199.59s |  Why would we do this?
199.59s - 200.59s |  Big reason.
200.59s - 201.59s |  Three magic words.
201.59s - 202.59s |  Line of sight.
202.59s - 206.59s |  Radio frequencies, especially in the Wi-Fi ranges,
206.59s - 214.59s |  are very subject to interference from the ground, from objects, vegetation, buildings, houses.
214.59s - 218.59s |  Am I hopefully doing okay with my mic position here?
218.59s - 221.59s |  But is that better?
221.59s - 222.59s |  Okay.
222.59s - 223.59s |  Hey, okay.
223.59s - 224.59s |  I should know how to do this.
224.59s - 235.59s |  Anyway, so trying to raise one end of the device on the end of the radio conversation,
235.59s - 239.59s |  potentially we have much greater distance and much greater line of sight.
239.59s - 240.59s |  And airplanes are cool.
240.59s - 241.59s |  Radios are cool.
241.59s - 242.59s |  We were curious.
242.59s - 247.59s |  Maybe we can see a lot of access points quickly.
247.59s - 255.59s |  And there's a fair amount of discussion right now about the interaction of aircraft and RF
255.59s - 258.59s |  and what radio signals can do with those.
258.59s - 260.59s |  So we thought it was an interesting topic to explore.
260.59s - 262.59s |  A few constraints we'll talk through.
262.59s - 264.59s |  One, safety.
264.59s - 270.59s |  And I'm going to belabor this a little bit because I don't want to read any NTSB reports
270.59s - 274.59s |  about somebody who crashed an airplane trying to look for wireless access points.
274.59s - 280.59s |  So, seriously, the job of the pilot in this is fly the airplane.
280.59s - 285.59s |  And this is often expressed in aviation as aviate, navigate, and communicate.
285.59s - 295.59s |  First job, aviate, which is keep the airplane flying, keep the shiny side up,
295.59s - 298.59s |  keep it at a proper airspeed, don't run into anything.
299.59s - 304.59s |  If and only if you are successfully aviating, then figure out where you are
304.59s - 306.59s |  and figure out where you're going.
306.59s - 310.59s |  If and only if you are successfully aviating and navigating,
310.59s - 314.59s |  then maybe think about talking to somebody on the radio about what you're doing.
314.59s - 318.59s |  At no point in here get distracted by scanning equipment,
318.59s - 321.59s |  shiny electronic displays in the airplane.
321.59s - 323.59s |  Ah, that looks cool.
324.59s - 329.59s |  Particularly during critical phases of flight, taxi takeoff, approach, landing,
329.59s - 332.59s |  and low-level maneuvering because when you're doing warflying,
332.59s - 337.59s |  you may want to be down closer to the ground, and that increases risk.
337.59s - 343.59s |  Is it possible to, or so, because of this, warflying we think is best done as a team sport
343.59s - 346.59s |  because, hey, it's more fun to share the flight with somebody anyway.
346.59s - 349.59s |  Is it possible to warfly safely while solo?
349.59s - 353.59s |  We'll talk about the details of that a little bit later,
353.59s - 356.59s |  but obviously we want to be watching the constraints.
356.59s - 365.59s |  I will mention this issue specifically as a reference to why I'm concerned about this.
365.59s - 369.59s |  Not that long ago, not very far away from where we live,
369.59s - 374.59s |  there was a Cessna 182 that crashed, and based on the NTSB report,
374.59s - 379.59s |  there's strong evidence that the pilot was in the process of taking a Snapchat video
379.59s - 383.59s |  and making a post and got distracted, got a little left of the course,
383.59s - 386.59s |  flew into the guy wires of a tower, crashed, and died.
386.59s - 393.59s |  So distraction, especially during low-level maneuvering, can be fatal.
393.59s - 396.59s |  So please, please, please, pilot, fly the airplane.
396.59s - 401.59s |  And if you are flying with the pilot, as the scanner,
401.59s - 410.59s |  if the pilot is not comfortable doing something, don't do it, and don't distract the pilot.
410.59s - 417.59s |  Regulations, basically the FAA says it's the responsibility of the aircraft operator
417.59s - 422.59s |  to determine if the portable electronic device will interfere with the operation of the aircraft.
422.59s - 427.59s |  So as the pilot, figure out will this interfere with the operation of the aircraft.
427.59s - 438.79s |  Also, remember FAR 91.3, the pilot in command of an aircraft is directly responsible for
438.79s - 441.79s |  and is the final authority as to the operation of that aircraft.
441.79s - 448.79s |  So if you are the scanner, the pilot's word is law on safety things.
448.79s - 454.79s |  Also, 91.13, the great catch-all, careless and reckless operation is prohibited.
454.79s - 461.79s |  So don't do anything stupid while you're flying around trying to collect access point data.
461.79s - 466.79s |  FCC perspective, FCC basically does not want cell phones in cell phone mode
466.79s - 468.79s |  trying to talk to cell phone towers while flying around.
468.79s - 472.79s |  So put your phone in airplane mode, and you can still have your Wi-Fi on,
472.79s - 481.79s |  have your GPS on, which are what you need for collecting wireless access point data.
481.79s - 483.79s |  Where can you war flight?
483.79s - 484.79s |  Know your airspace.
484.79s - 490.79s |  So we're from Metro Detroit area, and Detroit Metro Airport has this nice big thing
490.79s - 496.79s |  called the Class Bravo airspace, which you can visualize as an upside-down wedding cake
496.79s - 502.79s |  centered around the primary airport, and the Class Bravo airspace is well-protected,
502.79s - 507.79s |  and you can only get in there with explicit permission either if you're on an instrument flight plan
507.79s - 511.79s |  or if the approach controllers say you can come in here.
511.79s - 517.79s |  This is a very good safety thing because it lets all of the airliners get in and out safely,
517.79s - 520.79s |  heavy traffic areas, and it works well.
520.79s - 525.79s |  For what we're doing, we are probably not on an instrument flight plan
525.79s - 528.79s |  unless we happen to be war flying while we're going somewhere,
528.79s - 531.79s |  but if we're trying to gather data about a specific area,
531.79s - 534.79s |  we're probably operating under something called visual flight rules,
534.79s - 540.79s |  which means we're doing our own navigation, and we're responsible for our own traffic separation,
540.79s - 543.79s |  but we've got a lot of flexibility in where we can do that,
543.79s - 546.79s |  but we need to stay out of the Class Bravo for sure,
546.79s - 549.79s |  and then there are smaller airports that we want to be watching for
549.79s - 553.79s |  so we don't go get in their traffic patterns and runways.
553.79s - 558.79s |  Pontiac Airport that we fly out of is a Class Delta, so they have a control tower.
558.79s - 560.79s |  They own that airspace.
561.79s - 565.79s |  They're pretty nice and flexible on working with us for maneuvering that we need to do,
565.79s - 567.79s |  and so you have a lot more options out of Class Delta airspace,
567.79s - 574.79s |  but at the end of the day, it's their airspace, so we have to comply with what they want.
574.79s - 579.79s |  Over populated areas, it's legal to fly 1,000 feet.
579.79s - 582.79s |  You have to stay 1,000 feet above the ground.
582.79s - 586.79s |  Over unpopulated areas, you can go down to 500 feet.
586.79s - 590.79s |  When we were trying to fly over the suburbs of Metro Detroit,
590.79s - 595.79s |  we basically had an area between 1,000 feet and 3,000 feet above the ground
595.79s - 599.79s |  that we could get in to maintain clearance above the ground
599.79s - 602.79s |  but stay below the Class Bravo shelf,
602.79s - 607.79s |  so that kind of constrained where we were able to go,
607.79s - 613.79s |  but we were able to collect some good data.
614.79s - 618.79s |  An airplane is a metal box, or at least a lot of them.
618.79s - 622.79s |  Cessna 182 is an aluminum box with plexiglass windows,
622.79s - 627.79s |  so we want to get the radios up out of the aluminum box
627.79s - 632.79s |  and put them as close as we can to the plexiglass windows so that they can receive Wi-Fi,
632.79s - 635.79s |  and that was one of the things that we were curious about.
635.79s - 640.79s |  How well does this work if we're inside the airplane
640.79s - 644.79s |  and just getting the radios through the plexiglass?
644.79s - 647.79s |  So next year, I'm going to be outside the airplane?
647.79s - 649.79s |  Yes.
649.79s - 654.79s |  Yeah, we'll attach a safety line, though, so that'll work well.
654.79s - 658.79s |  Optimally, the antenna would be outside the airplane,
658.79s - 662.79s |  but you get into some issues with rigs and safety and stuff,
662.79s - 664.79s |  one, if you're trying to permanently attach something to the airplane,
664.79s - 668.79s |  and two, just practically, you don't want to try attaching it
668.79s - 671.79s |  and then have it not work and fall off,
671.79s - 674.79s |  and then you're calling the tower saying,
674.79s - 677.79s |  hey, can you see if my phone fell off on the runway?
677.79s - 685.28s |  Also, from a privacy perspective, this is probably the least stealthy way to war drive
685.28s - 688.28s |  because you're in a big metal box making a lot of noise,
688.28s - 691.28s |  flying over everybody's head with a 12-inch tail number on the back of the airplane
691.28s - 696.28s |  and constantly chirping ADS-B packets telling everybody exactly who you are
696.28s - 699.28s |  and exactly where you are.
699.28s - 702.28s |  People will call and complain about aircraft doing annoying things,
702.28s - 708.28s |  so please, be a good citizen, don't be a jerk, don't go buzz people's houses,
708.28s - 713.28s |  probably don't go orbit somebody's house 10 times
713.28s - 718.84s |  because that can collect some negative attention.
718.84s - 720.84s |  So, yeah, data collection.
720.84s - 723.84s |  We did a series of test flights, kind of figuring it out as we went.
723.84s - 728.84s |  The first flight, we took one phone, this Google Pixel,
728.84s - 731.84s |  which thankfully my girlfriend had to use because my phones are Apple,
731.84s - 733.84s |  but we put Wiggle on it.
733.84s - 736.84s |  I just kind of held it in my lap and we kind of flew around,
736.84s - 744.57s |  largely 1,500 to 2,500 feet at roughly 150 miles an hour.
744.57s - 747.57s |  And, you know, where are the access points?
747.57s - 748.57s |  We don't know.
748.57s - 751.57s |  We know where we started seeing them and where we stopped seeing them,
751.57s - 754.57s |  so we kind of have like a blob for each one,
754.57s - 758.57s |  but we can't say, oh, that's at Sean's house down there.
758.57s - 760.57s |  If we can see them more than once over multiple flights,
760.57s - 764.57s |  we could maybe pinpoint it a little better, but it's very inexact.
764.57s - 768.57s |  So for our first flight, we took three passes down Woodward Avenue,
768.57s - 772.57s |  which if you're a fan of cars, it's where they have the Woodward Dream Cruise,
772.57s - 774.57s |  and, you know, we're from automotive.
774.57s - 777.57s |  It's also Highway 1 in Michigan.
777.57s - 782.57s |  We did two at 2,500 feet above sea level, which is 1,500 above ground,
782.57s - 789.57s |  and then one at 3,500, which is 2,500 feet with just my Android phone running.
789.57s - 792.57s |  And this map doesn't make a ton of sense to me because I'm not a pilot,
792.57s - 796.57s |  but you can see the various airspaces that we were operating in,
796.57s - 802.57s |  and the orange-yellow squiggles are our actual flight path.
802.57s - 804.57s |  But for me, this makes more sense.
804.57s - 807.57s |  This is actually a road map of where we were flying.
807.57s - 810.57s |  So the circles you can see on the right side,
810.57s - 813.57s |  that would be our laps around Woodward.
813.57s - 816.65s |  So data formats.
816.65s - 822.65s |  Wiggle has their own proprietary format as a KML file, but they'll also output as CSV.
822.65s - 824.65s |  We get one entry per observation out of Wiggle,
824.65s - 828.65s |  so we can track how many times we saw a specific point.
828.65s - 830.65s |  And it also includes altitude, which is nice for us,
830.65s - 835.65s |  so we can correlate also that to our flight plan and where we were and whatnot.
835.65s - 837.65s |  And then what counts as airborne detection?
837.65s - 840.65s |  Because we're seeing, as soon as we fire up the phone, we're seeing things.
840.65s - 845.65s |  So we capped that at 500 feet above ground level is when we're going to consider it.
845.65s - 850.43s |  We caught it in the air.
850.43s - 855.43s |  And then we got home, and we looked at the data, and went, oh, there's a lot.
855.43s - 857.43s |  I wasn't a lot more than we were expecting.
857.43s - 864.43s |  And full disclosure, we both used GPT to help us with some Python to figure this stuff out.
864.43s - 867.43s |  So on our first flight, again, our maximum altitude, 3,500 feet.
867.43s - 871.43s |  We were in the air for about 32 minutes above 500.
871.43s - 881.97s |  And we caught 2,822 unique BSS IDs or MAC addresses while we were in the air, which is 88 per minute.
881.97s - 882.97s |  How far away?
882.97s - 886.97s |  We did a lot of, like, mathing, trying to calculate distance and such.
886.97s - 889.97s |  And I was curious what the official spec is.
889.97s - 896.97s |  The Wi-Fi Alliance doesn't really say explicitly Wi-Fi is good for this range, but it's about 150 feet.
896.97s - 901.41s |  We kind of went past that quite a bit.
901.41s - 904.41s |  So this was our first attempt to analyze the data.
904.41s - 913.41s |  And if you look at it a little closely, you'll notice we have the same distance for every single device that we caught, right?
913.41s - 914.41s |  The first sets of them.
914.41s - 917.41s |  The first sets of them.
917.41s - 919.41s |  So then we flew again.
919.41s - 921.41s |  We took a second flight, and this was your flight, right?
921.41s - 922.41s |  Yeah.
922.41s - 928.41s |  So then I was asking the question, okay, is it okay to warfly safely when you're solo?
928.41s - 934.41s |  And I needed to go do some takeoffs and landings, so I thought, well, hey, maybe I'll fire up the phone.
934.41s - 943.41s |  So what I did, my procedure was fire up the phone during preflight, before the airplane's on, start Wiggle, leave it there.
943.41s - 944.41s |  Don't touch it.
944.41s - 945.41s |  Don't mess with it.
945.41s - 946.41s |  Don't worry about it.
946.41s - 952.41s |  And then go fly, come back, shut the airplane down, get everything good, then check the Wiggle data.
952.41s - 953.41s |  And that worked.
953.41s - 959.41s |  So for this, I went to the ‑‑ there's kind of a northeast practice area that's over an unpopulated area.
959.41s - 962.41s |  A lot of flight training activity goes on up there.
962.41s - 965.41s |  So I went to see what I could collect.
965.41s - 976.41s |  Went up to 2,500 feet, 54 minutes, just under 6,000 access points for a rate, which ‑‑ and I think this is a unique metric that nobody else has published.
976.41s - 977.41s |  I could be wrong.
977.41s - 978.41s |  I don't know.
979.41s - 983.41s |  But max per minute.
983.41s - 985.41s |  So got 108 max per minute.
985.41s - 989.41s |  Test three, similar exercise, just going up, flying around a little bit myself.
989.41s - 991.41s |  Had the phone mounted the same way.
991.41s - 998.41s |  And got ‑‑ went up 6,500 feet, about 7,000 max, 130 max per minute.
998.41s - 1011.41s |  And then was working on the distance analysis and saw for that flight we had like over a dozen where we had a starting and ending range where we saw them over a range of over five kilometers.
1011.41s - 1016.41s |  So we were seeing them from a couple miles away, pretty sure.
1016.41s - 1019.41s |  Test four, top access points on this one.
1019.41s - 1021.41s |  Top was nine kilometers.
1021.41s - 1029.41s |  And then saw several of these 000D97s.
1029.41s - 1032.41s |  And I don't know what they are, but it's registered to Hitachi Energy USA.
1032.41s - 1036.41s |  So we're wondering if it's some kind of IoT energy distribution something.
1036.41s - 1040.41s |  We did talk to the ICS village folks and they said yeah, probably.
1040.41s - 1043.41s |  So test four, biennial flight review.
1043.41s - 1049.41s |  The quick story on that one was I was with an instructor but didn't have time to pay attention to the phone.
1049.41s - 1054.41s |  Got back and I just put it in my flight bag to see what would happen.
1054.41s - 1058.41s |  And got back and realized that I didn't have any data.
1058.41s - 1062.41s |  So the good thing was ‑‑ or the bad thing was we lost the data.
1062.41s - 1066.41s |  The good thing was I demonstrated that I was not getting distracted by the phone.
1066.41s - 1070.41s |  And then ‑‑ thank you.
1070.41s - 1072.41s |  Don't get distracted by the phone.
1072.41s - 1082.41s |  Test flight number five, there is a path that you can take that's kind of a scenic river tour that avoids the controlled air spaces in downtown Detroit.
1082.41s - 1086.41s |  So we decided to do that for our next test flight.
1086.41s - 1090.41s |  And fun for flying, you get to take pictures like this.
1090.41s - 1093.41s |  So we decided we're using two phones.
1093.41s - 1096.41s |  Can we get data a better way or a different way?
1096.41s - 1100.41s |  So I also brought along a laptop running Linux with lin SSID on it.
1100.41s - 1105.41s |  Stuffed a USB Wi‑Fi card in the window.
1105.41s - 1110.41s |  And then you can see, again, my pixel in the handle of the plane.
1110.41s - 1115.41s |  Matt's Android was on the other side of the plane in his handle.
1115.41s - 1127.01s |  And so we started counting MAC addresses at different altitudes through lin SSID and correlating that with legal as well.
1128.01s - 1134.01s |  So with lin SSID, I got 10,208 unique MAC addresses.
1134.01s - 1137.01s |  Wiggle on my phone was super underperforming on this flight for some reason.
1137.01s - 1140.01s |  It only got 2,753.
1140.01s - 1143.01s |  But Matt was able to grab, again, almost 8,000.
1143.01s - 1148.77s |  And then we, again, tried to do distance analysis on it.
1148.77s - 1153.77s |  So we've got, again, our topping out at almost 10 kilometers.
1153.77s - 1155.77s |  But most of them, you know, five or six.
1156.77s - 1159.77s |  And then I broke down the lin SSID specifically as well.
1159.77s - 1163.77s |  And one thing, when I ‑‑ lin SSID, you can tune it.
1163.77s - 1165.77s |  I turned it all the way down so it would sample constantly.
1165.77s - 1167.77s |  That was a really bad idea.
1167.77s - 1171.77s |  I had two gigabytes of data to try and wrangle.
1171.77s - 1178.77s |  But here's a list of the longest duration SSIDs I was able to catch out of lin SSID.
1178.77s - 1181.77s |  I still have the MAC addresses or the BSSIDs.
1182.77s - 1186.77s |  But, yeah, the Krusty Krab is apparently a really long range Wi‑Fi network in Metro Detroit.
1186.77s - 1193.26s |  And a minute and a half of observation is about five and a half kilometers.
1193.26s - 1196.26s |  And this is that same flight plan, right?
1196.26s - 1197.26s |  Yeah, so this is the flight plan.
1197.26s - 1199.26s |  So we wanted to compare altitudes.
1199.26s - 1202.26s |  So we basically ‑‑ so I was using ForeFlight.
1202.26s - 1206.26s |  So flew kind of an S pattern over Lake Orient and Oxford, Michigan.
1206.26s - 1211.26s |  Thank you to the citizens of Lake Orient and Oxford for letting us bother your skies that day.
1211.26s - 1216.26s |  So we did one path at 2,500 feet and then climbed up to 3,500 feet and tried to just follow the same path.
1216.26s - 1220.26s |  And you see how well I did or did not do.
1220.26s - 1225.26s |  So at 1,500, altitude of 1,500, we got 101.
1225.26s - 1227.26s |  Again, max per minute.
1227.26s - 1230.26s |  When we increase that by 1,000 feet, we're getting 49.
1230.26s - 1233.26s |  So you can see the signals are starting to degrade the higher we're getting.
1233.26s - 1239.15s |  But we're still getting some significant traffic.
1239.15s - 1240.15s |  Oh, I'm sorry.
1240.15s - 1242.15s |  I'm hitting the wrong button.
1242.15s - 1243.15s |  Yeah, did we go too fast?
1243.15s - 1244.15s |  I don't know.
1244.15s - 1248.15s |  I don't think that's a thing you can do is go too fast.
1248.15s - 1253.15s |  Yeah, so this was one thing that we would like to explore more is what is the speed?
1253.15s - 1257.15s |  Because we were going about 220 feet per second horizontally.
1257.15s - 1260.15s |  Wiggles seemed to be taking samples about every five seconds.
1260.15s - 1264.15s |  So that's about 1,100 feet per sample.
1264.15s - 1268.15s |  So that may have impacted our ability to scan.
1268.15s - 1272.53s |  And then we still had this kind of nagging question.
1272.53s - 1273.53s |  Are we seeing a lot of data?
1273.53s - 1274.53s |  Are we seeing more than we should be?
1274.53s - 1276.53s |  Are we seeing less than we should be?
1276.53s - 1278.53s |  So we decided to do some more driving.
1278.53s - 1285.53s |  And since we love Woodward Avenue, decided to go do a war drive from 11-mile road to Square Lake Road on Woodward,
1285.53s - 1288.53s |  which is a distance of 9.8 miles.
1288.53s - 1290.53s |  And you see the results there.
1290.53s - 1295.53s |  War driving, we took 14 minutes to cover that path, speed of 42 miles an hour.
1295.53s - 1301.53s |  And we observed 2,210 MAC addresses for a rate of 157 MACs per minute.
1301.53s - 1308.53s |  War flying, we went a lot faster, covered the distance in 4 minutes at 148 miles an hour, got about a third the number of MACs.
1308.53s - 1314.53s |  We got a lot less MACs, 783, but we collected them a lot faster at 197 MACs per minute.
1314.53s - 1323.53s |  So our conclusion from that is that, at least in this case, war driving collects more MACs, but war flying collects them faster.
1323.53s - 1324.53s |  Right.
1324.53s - 1326.53s |  So take your pick.
1326.53s - 1328.53s |  I would say flying is probably more fun.
1329.53s - 1331.53s |  So, yeah, a little more distance analysis.
1331.53s - 1338.53s |  This is on the stretch down Woodward Avenue, which we had a discrete starting and stopping distance without any overlap,
1338.53s - 1347.53s |  so we could get a clear measure of how long we could see a signal without worrying about, oh, was it looping around and whatnot.
1347.53s - 1352.53s |  So, again, our maximum distance here is about 4 kilometers.
1352.53s - 1359.53s |  One of the things I find really interesting, again, we got a car and then Uconnect based on a past thing I used to do.
1359.53s - 1360.53s |  I know that's awful.
1360.53s - 1361.53s |  We love Uconnect.
1361.53s - 1362.53s |  Right, I love Uconnect.
1362.53s - 1363.53s |  Yes, yes.
1363.53s - 1367.53s |  But so we were able to catch cars from the air while we were flying down Woodward.
1367.53s - 1369.53s |  Sorry, this was the war drive.
1369.53s - 1370.53s |  Oh, was that the war drive one?
1370.53s - 1371.53s |  Yeah, this was the war drive one.
1371.53s - 1381.53s |  And so what we see from here is the distance, because our top distances on the war flying were like 9 kilometers, 5 kilometers.
1381.53s - 1385.53s |  These are down to like 4, so we're pretty sure we were just tracking cars.
1385.53s - 1393.53s |  And then our old friend 000D97 shows up again, something fairly visible from wherever,
1393.53s - 1397.53s |  but we were getting a lot less distance clearly with the war driving versus the war flying.
1397.53s - 1399.87s |  And then?
1399.87s - 1404.87s |  And then when you fly, you have to take a cockpit selfie because it's cool.
1404.87s - 1405.87s |  Right.
1405.87s - 1406.87s |  I can be like.
1406.87s - 1407.87s |  It's so cool.
1407.87s - 1408.87s |  I was flying.
1408.87s - 1409.87s |  You got to do it twice.
1409.87s - 1410.87s |  Way to do it again.
1410.87s - 1418.98s |  So, yeah, further investigation, you know, different speeds and altitudes.
1418.98s - 1421.98s |  I would really love to just, you know, every 500 feet, same route and all that.
1421.98s - 1424.98s |  But that takes a lot of time, uses a lot of fuel.
1424.98s - 1425.98s |  Aircraft construction.
1425.98s - 1430.98s |  Do we get better results if we're in a composite aircraft without metal wrapping around us?
1430.98s - 1435.98s |  And if somebody wants to donate a Cirrus for further research, please also see me afterwards.
1435.98s - 1442.98s |  Hardware platforms, maybe using some drones that could carry a payload, antenna placement, additional radios.
1442.98s - 1447.98s |  And then directional antennas, et cetera.
1447.98s - 1448.98s |  Yeah.
1448.98s - 1450.98s |  So that's what we got.
1450.98s - 1451.98s |  So thank you.
1451.98s - 1452.98s |  Thank you all for coming out.
1452.98s - 1454.98s |  Thanks to Pontiac Tower and Detroit Approach for working with us,
1454.98s - 1457.98s |  even though they had no idea what we were doing up there.
1457.98s - 1458.98s |  Thanks to all the mats.
1458.98s - 1460.98s |  There were more of them.
1460.98s - 1461.98s |  Yes.
1461.98s - 1464.98s |  Their mats at the Aerospace Village were all over the place.
1464.98s - 1465.98s |  All right.
1465.98s - 1466.98s |  Thank you all.


url: https://www.youtube.com/watch?v=Ui2etjRyrUE
title: DEF CON 32 - V2GEvil: Ghost in the Wires - Pavel Khunt & Thomas Sermpinis aka Cr0wTom
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=Ui2etjRyrUE",
  "title": "DEF CON 32 - V2GEvil: Ghost in the Wires - Pavel Khunt & Thomas Sermpinis aka  Cr0wTom",
  "description": "This research aims to enhance electric vehicle cybersecurity by uncovering vulnerabilities in the Electric Vehicle Communication Controller (EVCC), crucial for charging communication. We've developed a specialized security tool after examining electric vehicle charging ports and On-Board Charging (OBC) protocols, with a focus on ISO 15118 standards.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1459,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.00s | This text was transcribed using whisper model: large-v2

 Hello. Hello, everyone. First of all, thank you for joining us today.
5.00s - 9.00s |  And our topic is V2G will ghost in the wires.
9.00s - 16.00s |  Where will we talk about the V2G and the cybersecurity issues that come with it?
16.00s - 22.89s |  First of all, let me introduce us. I am Pavel Kuhn, cybersecurity researcher,
22.89s - 29.89s |  and I'm currently working at Auxilium Pentest Lab with Tom.
29.89s - 32.89s |  Hello from myself, too. I'm Thomas Rampinis.
32.89s - 35.89s |  I'm the technical director of Auxilium Pentest Labs.
35.89s - 38.89s |  And yeah, let's start.
38.89s - 43.89s |  Our main goal today is to analyze the state of cybersecurity in the automotive industry
43.89s - 49.89s |  and get an in-depth look on the EV architecture and this undeniably emerging attack vector.
49.89s - 55.89s |  We want to explore and understand the communication protocols used in EV charging today
55.89s - 63.89s |  and introduce you to our security tool, V2G Evil, that we built with Pavel during his university thesis
63.89s - 68.89s |  and finally create a reference point for EV security research and evaluation,
68.89s - 72.89s |  something that we feel our industry is lacking, basically,
72.89s - 77.89s |  alongside other vectors in the automotive security landscape.
77.89s - 81.89s |  So let's start with the introduction to vehicle cybersecurity.
82.89s - 86.89s |  Basically, it goes without question that the automotive industry cannot be considered something new.
86.89s - 91.89s |  We are basically talking about 100-plus-year-old mechanical engineering industries,
91.89s - 93.89s |  and nothing is new about this.
93.89s - 97.89s |  The constant need for connectivity and technological aspects of it
97.89s - 104.89s |  push those companies to make restructuring and start implementing technologies
104.89s - 110.89s |  that didn't have the know-how or the capacity to do so before, which is good for us.
110.89s - 112.89s |  That's why we are here in the end,
112.89s - 116.89s |  but really bad for the security and safety of the affected vehicles that we're testing.
116.89s - 122.89s |  On the other hand, you have all these startups that started as technology companies first,
122.89s - 127.89s |  which have a way better security posture and culture,
127.89s - 131.89s |  but the industry as a whole struggles for the last decade.
131.89s - 137.87s |  And to be honest, I cannot see a clear light in this path.
137.87s - 141.87s |  Isolating the part we will focus on in this talk,
141.87s - 145.87s |  we have the emerging industry of electric and hybrid vehicles,
145.87s - 150.87s |  mainly developed to decentralize pollution and make better use of clean energy solutions.
150.87s - 157.87s |  And additionally, you have several advantages in comparison to internal combustion engine vehicles,
157.87s - 161.87s |  for example, heavy gains in speed and efficiency.
161.87s - 164.87s |  And while early models used basic charging,
164.87s - 170.87s |  the last decade charging standards are applied and enforced in many ways,
170.87s - 175.87s |  which led to the standardization of the ports, protocols and underlying data
175.87s - 180.87s |  in a wide range of applicability for different continents and standards.
180.87s - 185.87s |  And this is, of course, in addition to the digital communication needed during charging,
185.87s - 190.87s |  which expanded the attack surface of the vehicles as we knew from them before
190.87s - 196.87s |  and created new attack vectors that we can start playing with.
196.87s - 203.87s |  What I'm saying here is that it's not something new or groundbreaking by any means,
203.87s - 207.87s |  but the state of EV charging security is a barely touched topic by researchers.
214.30s - 218.30s |  And here we have a really simple representation of a modern vehicle,
218.30s - 221.30s |  which normally includes a bunch of interconnected ECUs
221.30s - 224.30s |  responsible for different functionality in the vehicle.
224.30s - 230.30s |  This can be from single headlight ECUs to huge DC-DC converters.
230.30s - 237.30s |  And what we see, though, is that while this vehicle till now was reasonably isolated by the outside world,
237.30s - 243.30s |  now we have a new externally accessible port which connects to a charging station.
243.30s - 245.30s |  And this leaves a big room for error.
245.30s - 250.30s |  And if not properly implemented and designed, several unexpected instances can occur.
251.30s - 257.30s |  And while architecture and vehicle design of interconnected vehicles might not seem as important,
257.30s - 264.30s |  there are numerous instances that they played a big part of how severe our findings are during a pen test
264.30s - 270.30s |  and how, in the end, can or cannot affect the safety of the driver, passengers, or even pedestrians.
271.30s - 278.30s |  And as we keep digging deeper, let's discuss a bit about charging in terms of vehicles and the automotive industry.
278.30s - 285.30s |  So first of all, there are several charging methods, including conductive, wireless, and some exotic ones
285.30s - 290.30s |  that we only see in some manufacturers, like battery swaps and bidirectional charging.
290.30s - 295.30s |  And on top of that, there are different types depending on the needs of the user
295.30s - 301.30s |  and the capabilities of the vehicle, including AC and DC charging,
301.30s - 305.30s |  supplying different advantages and disadvantages, as we will see later.
305.30s - 309.30s |  And finally, during charging, there are also different modes of charging,
309.30s - 315.30s |  where basically the first three modes are focused to AC and the fourth one in DC charging.
316.30s - 321.30s |  Talking about some boring stuff here, there are a lot of different available standards,
321.30s - 329.30s |  and as our main focus is the Combined Charging Standard, or CCS, basically for Europe.
329.30s - 336.30s |  And we just have this undeniably big list of standards for different levels of this full implementation,
336.30s - 343.30s |  ranging from the connector itself to the high-level communication needed between the EV and the charger.
343.30s - 350.30s |  And this CCS standard is basically an effort towards a single unified for electric vehicle charging,
350.30s - 354.30s |  which, considering where we are today, you might disagree.
355.30s - 362.30s |  And the reason I said this is because there are a number of different standards out there in the wild,
362.30s - 366.30s |  mostly divided to the different continents,
366.30s - 371.30s |  but lately several manufacturers have decided to move into the Tesla standard,
371.30s - 374.30s |  the supercharger standard, mainly in the USA,
374.30s - 378.30s |  and mainly because of the heavily invested charging network in the US roads.
378.30s - 382.30s |  And of course that does not affect Europe, at least for now,
382.30s - 387.30s |  but the opportunity for a unified standard, in my opinion, is kind of lost at this point.
388.30s - 394.30s |  And, yeah, as we look at this circle of this CCS AC type 2 connector,
394.30s - 396.30s |  we can distinguish several pins.
396.30s - 402.30s |  Some of them is the CP pin, which is crucial for communication between the car and the charging station,
402.30s - 407.30s |  and the pin with the highest interest for us as cybersecurity researchers.
408.30s - 413.30s |  It basically allows the station to check the vehicle status and ensure it's safe to charge.
413.30s - 418.30s |  And then the PP pin ensures that the correct connector is used
418.30s - 424.30s |  and provides information on the current carrying capacity of the cable that we're using.
424.30s - 429.30s |  The AC type 2 connector supports charging at various power levels,
429.30s - 433.30s |  from household outlets to high power public chargers.
434.30s - 437.30s |  And here we have the DC CCS type 2 connector,
437.30s - 443.30s |  an extension of the AC type 2 connector designed to support direct current fast charging.
443.30s - 448.30s |  And this connector, also known as combo 2, basically incorporates the same pins
448.30s - 451.30s |  as the AC type 2 connector for AC charging,
451.30s - 455.30s |  but adds two additional pins specifically for DC charging.
455.30s - 461.30s |  And the combination of these pins in a single connector is what gives this combined charging name.
462.30s - 466.30s |  And it provides the flexibility of using either AC or DC,
466.30s - 469.30s |  depending on the charging station and the vehicle capabilities.
470.30s - 474.30s |  Here we can basically get an understanding of how this works internally
474.30s - 478.30s |  in the different implementations of DC or AC charging.
478.30s - 482.30s |  And on the other hand, we have the DC charging where the power electronics
482.30s - 486.30s |  for the conversion of the current exists in the EVSC side.
486.30s - 491.30s |  So the charger, while when you want to use the slower solution of AC charging,
491.30s - 496.30s |  the conversion is still happening inside the vehicle itself by the onboard charger.
496.30s - 500.30s |  Additionally, we can get an understanding of the communication channel
500.30s - 504.30s |  that exists in those scenarios, really important as we will see later,
504.30s - 510.30s |  especially in safety critical cases where the current needs to be negotiated.
511.30s - 516.30s |  From this, we clearly understand that charging is not only simple power transfer
516.30s - 519.30s |  and data exchange is also happening under the hood,
519.30s - 523.30s |  many times with important information like payment details, voltage,
523.30s - 527.30s |  current requirements, time of charging and others.
527.30s - 531.30s |  And to get a better understanding of how this communication is structured,
531.30s - 532.30s |  I will pass it to Pavel.
533.30s - 541.50s |  So let's have a look at the charging flow, its high-level overview.
541.50s - 549.50s |  So first, the user plugs the CCS connector to his car and then the low-level communication starts.
550.50s - 555.50s |  If the EV is in the state B and the signal has the 5% duty cycle,
555.50s - 561.50s |  it can change to the high-level communication and during the high-level communication,
561.50s - 564.50s |  they are exchanged to digital information about the charging.
565.50s - 571.77s |  And that's how my journey and master thesis started.
571.77s - 573.77s |  So it's just a meme.
576.77s - 579.77s |  So let's have a look at the low-level communication at first.
583.30s - 588.30s |  Low-level communication in the charging process is also called basic signaling
588.30s - 604.16s |  and it offers basic control of the charging process between the EV and EVSE.
605.16s - 612.16s |  The EV controls the voltage value by adding or removing the resistors in the pilot signal
612.16s - 618.16s |  and based on the measured voltage, the EVSE can recognize the EV's state.
620.16s - 625.16s |  The most important is the state B and state C, as you can see in the table.
628.21s - 633.21s |  Depending on the given state resulting from the measured voltage value,
633.21s - 639.21s |  the EVSE generates a pulsed modulation signal with a specific duty cycle.
647.09s - 651.09s |  The duty cycle value is controlled by the charging station and measured in the vehicle.
652.09s - 656.09s |  And the simplified outcome from the low-level communication is that
656.09s - 662.09s |  the state B means that EV is connected but not charging
662.09s - 666.09s |  and the state C is EV is connected and ready for charge.
666.09s - 671.09s |  And as I said, 5% duty cycle affords the high-level communication.
674.09s - 678.09s |  So as you could see, the low-level communication is not so interesting
678.09s - 684.09s |  from the cybersecurity perspective because it only involves physical signaling.
685.09s - 689.09s |  However, low-level communication is important in the sense that
689.09s - 694.09s |  it enforces high-level communication for the specific state and the duty cycle.
695.09s - 698.09s |  So let's explore the high-level communication.
699.09s - 702.09s |  First of all, why do we need the high-level communication?
702.09s - 705.09s |  Why the low-level communication is not sufficient enough?
706.09s - 711.09s |  In the beginning, EV charging relied on the basic signaling methods only,
711.09s - 715.09s |  which are sufficient for simple on-off commands to start or stop.
716.09s - 721.09s |  But after some time, with the growing number of the electric vehicles
721.09s - 725.09s |  and the complexity of our energy ecosystem,
725.09s - 730.09s |  this basic form of the communication is no longer sufficient.
731.09s - 735.09s |  High-level communication provides the optimized charging process.
735.09s - 742.77s |  As we already described before, the precondition for high-level communication
742.77s - 746.77s |  is the low-level communication with specific state and the duty cycle
746.77s - 752.77s |  and the high-level communication is only applicable for charging modes 3 and 4.
753.77s - 758.77s |  And the high-level communication is mandatory for the mode 4, which is the DC charging,
759.77s - 763.77s |  because there is a need to exchange some additional information
763.77s - 765.77s |  to avoid the damage to the battery.
766.77s - 775.62s |  The ISO 15118 defines all the high-level communication
776.62s - 779.62s |  and the full name is Vehicle-to-Grid Communication Interface.
780.62s - 783.62s |  And the part Vehicle-to-Grid has an acronym V2G.
784.62s - 787.62s |  That's the reason why we named our tool V2GEvil,
787.62s - 791.62s |  because it stands for the evaluation of the V2G communication.
792.62s - 800.57s |  There is the comparison of the ISO and the IEC.
801.57s - 805.57s |  As you can see, the ISO implements all of the OSI layers
806.57s - 810.57s |  and the new protocol is V2G Transfer Protocol,
811.57s - 814.57s |  which I will explain in the following slides.
816.57s - 824.57s |  We are aiming from the third network layer and above up to the application layer.
828.57s - 833.57s |  The high-level communication is more complex, so there is bigger space for mistakes
833.57s - 835.57s |  and we are aiming for this.
837.57s - 840.57s |  Here you can see the V2G communication flow,
840.57s - 844.57s |  which is basically changing from one state to another
844.57s - 848.57s |  and there is also exchange of the V2G messages.
851.26s - 856.26s |  And after this is done, the charging is completed.
857.26s - 860.26s |  Here you can see the V2G message, the header,
861.26s - 863.26s |  the structure of the V2G message.
864.26s - 868.26s |  I have to be really fast, because we have only a few minutes.
870.26s - 872.26s |  This is the structure of the header.
873.26s - 876.26s |  We have a different payload type, as you can see on the slide.
877.26s - 881.26s |  The first of the V2G messages is the SDP request.
882.26s - 886.26s |  There is some exchange for the Security and Transfer Protocol for this.
887.26s - 889.26s |  We have also the structure of the SDP request.
890.26s - 894.26s |  Then the station will respond with the SDP response
895.26s - 901.26s |  with the information of IP address and the port for the communication over TCP protocol.
903.26s - 905.26s |  And then the V2G communication can start.
906.26s - 910.86s |  Here you can see the V2G message structure.
911.86s - 915.69s |  It is divided into two different types.
916.69s - 924.69s |  And the concept that we are aiming is to cause some issues in this part,
925.69s - 927.69s |  which is the decoding from EXI to XML
928.69s - 935.69s |  and also to this part, which is from this content and structure to the data structures.
937.69s - 946.50s |  Here you can see just a simple representation of the message in XML format,
946.50s - 949.50s |  which is later encoded to EXI.
953.50s - 956.50s |  I think we have to skip this.
959.94s - 962.94s |  Some words about the testing environment,
963.94s - 966.94s |  because we need some specified testing environment
967.94s - 971.94s |  where we use the DLAN Green PHY eval board and the DLAN Green PHY module.
972.94s - 975.94s |  Basically, it has PLC support and PLC to Ethernet bridging support,
975.94s - 978.94s |  which helps us with everything that was described in theory before.
979.94s - 983.94s |  And we use this QCA 7000 Green PHY firmware,
984.94s - 989.94s |  which allows us to configure a module as an EMOB charger or EMOB vehicle.
990.94s - 994.94s |  So we potentially have the ability to act both as a charger and a vehicle.
995.94s - 999.94s |  And it has implicit support for the Slack, EVSC and the ACCC side,
1000.94s - 1002.94s |  so the charger and the vehicle in this case.
1002.94s - 1005.94s |  Here we have a sort of our complete development setup,
1006.94s - 1011.94s |  where one board acts as the vehicle and one as the charger or the EVSC.
1012.94s - 1015.94s |  And there are several ways that we can perform the PLC communication as you see,
1016.94s - 1020.94s |  but we chose to use a coax cable as it will also be more appropriate
1021.94s - 1025.94s |  for using the real world scenario to avoid interferences from other cables.
1026.94s - 1028.94s |  And to conclude, you will be surprised if I tell you that
1028.94s - 1032.94s |  many of the cheap Chinese controllers for Ethernet over power line
1033.94s - 1035.94s |  use the same exact Qualcomm chip that we are also using.
1036.94s - 1039.94s |  And if you are in one tight budget, let's say in most cases,
1040.94s - 1043.94s |  you can reflash this chip with the appropriate firmware
1044.94s - 1046.94s |  and run our tool with a budget of around 20 euros
1047.94s - 1050.94s |  comparing to a couple of hundred euros on the boards that I showed you before.
1051.94s - 1054.94s |  And as always, we're referring to the first two layers.
1055.94s - 1057.94s |  For the rest of the layers, we used as a reference
1058.94s - 1061.94s |  the joint operating system for EV chargers.
1062.94s - 1066.94s |  In the start, we used both for the EVSC and the SECC parts
1067.94s - 1069.94s |  in order to properly implement all the parts of the communication.
1070.94s - 1073.94s |  But later on, we developed our own malicious SECC part
1074.94s - 1078.94s |  to test against the Joseph EVSC reference implementation.
1080.94s - 1083.94s |  And yeah, now let's go to our tool.
1084.94s - 1088.94s |  So here you can see the architecture of our tool,
1089.94s - 1091.94s |  and it's modular, so you have different modules.
1092.94s - 1096.94s |  And we will explain the most important modules in the next slides.
1097.94s - 1101.94s |  So first of all, we have the implementation of V2G transfer protocol,
1102.94s - 1106.94s |  which is basically the module V2GTP
1107.94s - 1110.94s |  is basically the implementation of that transfer protocol.
1110.94s - 1115.94s |  So this module is responsible for the V2G packet parsing,
1116.94s - 1118.94s |  decoding, and creating V2GTP packets.
1119.94s - 1122.94s |  And the next module is the sniffer.
1123.94s - 1125.94s |  The initial reason for developing the sniffer was
1126.94s - 1132.94s |  to capture the V2G communication between the EV and EVSC
1133.94s - 1136.94s |  and verify the correctness of our implementation
1137.94s - 1139.94s |  of the V2G transfer protocol.
1141.94s - 1144.94s |  So let's take a look at the demo.
1149.98s - 1154.98s |  So first of all, we start the station reference implementation,
1155.98s - 1159.45s |  which is waiting for connection.
1160.45s - 1164.45s |  Then we start our sniffer module with option V2GTP,
1165.45s - 1172.45s |  which decodes the TCP raw data to V2G transfer protocol packet.
1173.45s - 1176.45s |  Then we start the EVCC module,
1177.45s - 1179.45s |  which is connecting, like the car is connecting to the station,
1180.45s - 1183.45s |  and then you can see the message exchange.
1184.45s - 1188.45s |  And this is the output of the sniffer module
1189.45s - 1193.45s |  that you can see that there's the V2GTP header and V2GTP payload.
1194.45s - 1196.45s |  These are the SDP requests and the response.
1197.45s - 1203.89s |  The next slide, you can also see that our sniffer module
1204.89s - 1207.89s |  can also decode the EXI data, which are this payload
1208.89s - 1213.89s |  that it's decoded to the XML document.
1214.89s - 1217.89s |  The next two modules are the messages and the station.
1218.89s - 1220.89s |  Messages are responsible for creating the messages
1221.89s - 1224.89s |  and the conversion between the EXI and XML.
1224.89s - 1229.89s |  And the station module is our implementation of the SECC,
1230.89s - 1234.89s |  which is the Supply Equipment Communication Controller.
1235.89s - 1239.89s |  And the station module is the core for the security modules.
1242.84s - 1246.84s |  Let's start with the modules that are dedicated to the security testing.
1247.84s - 1249.84s |  First of all, we have the enumerator module,
1250.84s - 1252.84s |  which can help to enumerate the EV.
1253.84s - 1255.84s |  For example, if the TLS is required or not,
1256.84s - 1257.84s |  what is the TLS version?
1258.84s - 1260.84s |  What are the supported cipher suites?
1261.84s - 1266.84s |  And what is the application protocol required by the EV?
1267.84s - 1269.84s |  So here you can see the demo
1270.84s - 1273.84s |  that we start our station in enumerate mode.
1274.84s - 1276.84s |  We enumerate all of the possible information.
1277.84s - 1280.84s |  Then we start the EVCC to connect to our station.
1280.84s - 1286.84s |  And then you can see the outcome of the enumerator.
1287.84s - 1288.84s |  Here you can see the result.
1289.84s - 1291.84s |  As I said, you can see the supported protocols,
1292.84s - 1295.84s |  the TLS version and ciphers.
1298.28s - 1300.28s |  And the last module is the FASER module,
1301.28s - 1303.28s |  which is the most important module for the security testing.
1304.28s - 1305.28s |  And using the FASER module,
1306.28s - 1308.28s |  we can test the resilience of the EV
1308.28s - 1312.28s |  to the invalid or malformed parameter values
1313.28s - 1315.28s |  in the V2G response messages.
1316.28s - 1320.28s |  So basically the FASER is sending malicious and invalid values
1321.28s - 1324.28s |  for the parameters and it aims to
1325.28s - 1328.28s |  the process of decoding the EXI to XML.
1329.28s - 1330.28s |  So let's have a look at the demo.
1331.28s - 1340.06s |  We start the FASER and waiting again for the EVCC to connect.
1341.06s - 1347.06s |  And after the EVCC connects, there is some message exchange
1348.06s - 1351.06s |  and in some of the messages we supply the invalid data.
1352.06s - 1355.06s |  And here you can see the invalid data of some parameters.
1356.06s - 1360.06s |  And the result is that we can cause some errors on the EVCC side.
1361.06s - 1364.06s |  The FASER module also can FAS only one message
1364.06s - 1370.06s |  and the result is that we can cause some decoding error
1371.06s - 1374.06s |  in the unmarshal binary,
1375.06s - 1377.06s |  which has some handful unmarshal method
1378.06s - 1380.06s |  that reads a source of the XML data
1381.06s - 1384.06s |  and binds its values to a new instance of Java object.
1385.06s - 1386.06s |  And as we know from some articles,
1387.06s - 1392.06s |  the unmarshal can be vulnerable to XML external entity injection attacks.
1392.06s - 1398.06s |  So there is the space to implement the exploitation modules
1399.06s - 1402.06s |  and exploit this further.
1403.06s - 1407.94s |  So let's finish.
1408.94s - 1411.94s |  Basically, there are a lot of enhancements that we can do on the tool.
1412.94s - 1413.94s |  We will not go through them. We don't have time.
1414.94s - 1417.94s |  But to conclude, communication in electric vehicles
1418.94s - 1420.94s |  has assumed potential from our point of view
1421.94s - 1422.94s |  with bigger needs in the future, more sensitive data.
1423.94s - 1427.94s |  Will start to flow and subsequently passed by EVs and EVSCs.
1428.94s - 1430.94s |  And there are no open source tools available
1431.94s - 1432.94s |  to cover this emerging attack vectors.
1433.94s - 1435.94s |  That's why we build this and we hope that you will start using it
1436.94s - 1439.94s |  and you will start getting to research vehicles in this way
1440.94s - 1441.94s |  that it's uncovered till now.
1442.94s - 1444.94s |  We want our tool to act as an easy way for people to get introduced
1445.94s - 1447.94s |  and start researching both EVs and chargers
1448.94s - 1450.94s |  in an efficient and modular way.
1450.94s - 1454.94s |  Thank you and our tool will be released after DEF CON 32.


url: https://www.youtube.com/watch?v=Utz4o7CJmAU
title: DEF CON 32 - War Games Red Team for OT Based on Real World Case Studies- Shishir Gupta
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=Utz4o7CJmAU",
  "title": "DEF CON 32 - War Games  Red Team for OT Based on Real World Case Studies- Shishir Gupta",
  "description": "In this talk, Shishir will share some critical insights from performing a decade worth of Red Team (attack simulation) exercises for large-scale industrial operations across the globe.\n\nThe presentation will also cover real-world examples of attack vectors leveraged by Google's Mandiant Red Team while performing offensive security exercises for operational technology and control system environments.\n\nThis talk will cover:\n\nInsights into common TTPs and attack vectors for large-scale industrial networks\nNetwork propagation and mission execution across ICS-OT attack life-cycle\nExamples from real-world case studies of penetrating cyber-physical systems",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1388,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.00s | This text was transcribed using whisper model: large-v2

 Hi, everyone. It's really hard to see everyone with this slide.
7.00s - 10.00s |  So if you cannot hear me, just shout out, and I'll try to
10.00s - 14.00s |  adjust the microphone. Can everybody hear me?
14.00s - 17.00s |  Good afternoon, everyone. My name is Shishir, and I'm
17.00s - 20.00s |  here to talk about red team and attack vectors for
20.00s - 23.00s |  operation technology. My objective here is to go
23.00s - 26.00s |  beyond the hypothetical, and I'm here to talk about red
26.00s - 30.00s |  team and attack vectors or real-world examples for some
30.00s - 33.00s |  of our red team exercises for critical infrastructure.
33.00s - 35.00s |  However, before I start, a quick disclaimer.
35.00s - 38.00s |  Even though everything that I present here is based on
38.00s - 41.00s |  real-world case studies, the content itself is highly
41.00s - 46.00s |  redacted to remove any and all identifying information.
46.00s - 48.00s |  Now, we're not here to talk about it myself, but it's
48.00s - 50.00s |  still customary to do a quick introduction.
50.00s - 52.00s |  My name is Shishir. I'm a technical manager at
52.00s - 55.00s |  Mandiant slash Google. I'm part of a dedicated team
55.00s - 58.00s |  at Mandiant that specializes in security services for
58.00s - 61.00s |  operational technology and control systems.
61.00s - 65.00s |  Personally, I've had more than 12 years of experience
65.00s - 68.00s |  performing offensive security work for industrial control
68.00s - 71.00s |  and cyber-physical systems, and in that time, I have been
71.00s - 75.00s |  fortunate to basically dabble with almost every critical
75.00s - 79.00s |  infrastructure sector on the planet, including power,
79.00s - 83.00s |  transport, rail, air traffic control, manufacturing,
83.00s - 87.00s |  wastewater, telco, and even building management systems.
87.00s - 90.00s |  Now, I believe everyone here would already understand
90.00s - 92.00s |  what we mean by operational technology.
92.00s - 95.00s |  That said, I still wanted to take a minute and remind
95.00s - 98.00s |  that operational technology basically deals with systems
98.00s - 102.00s |  and platforms that are used to control and automate
102.00s - 104.00s |  industrial-scale physical processes.
104.00s - 107.00s |  People often tend to silo OT into a specific sector
107.00s - 111.00s |  or industry, but I'd like to remind that OT covers
111.00s - 114.00s |  a wide range of infrastructure, and my talk here
114.00s - 116.00s |  is industry-agnostic.
116.00s - 118.00s |  I'll be covering examples from different verticals,
118.00s - 121.00s |  including power, utilities, transportation, manufacturing,
121.00s - 126.27s |  and even telecommunications.
126.27s - 129.27s |  I would also like to call out that real-world attack
129.27s - 133.27s |  simulations against industrial networks do not involve
133.27s - 137.27s |  just HMIs or PLCs, but in fact, involve the entire
137.27s - 140.27s |  ecosystem, ranging from the enterprise network that
140.27s - 143.27s |  supports OT to level-one devices that control the
143.27s - 145.27s |  physical processes in the field.
145.27s - 148.27s |  One more disclaimer here, offensive security exercises,
148.27s - 150.27s |  such as red teaming and penetration testing,
150.27s - 153.27s |  essentially involve adversarial testing against
153.27s - 156.27s |  cyber-physical systems that can pretty much blow and burn.
156.27s - 160.27s |  Thus, any kind of offensive security testing for OT
160.27s - 163.27s |  should only be performed by trained individuals
163.27s - 167.27s |  after careful consideration of scenarios, hazards,
167.27s - 170.27s |  risks, and pre-approved rules of control engagement.
170.27s - 173.78s |  Now, before we move into the crux of this talk
173.78s - 176.78s |  and talk about attack vectors and case studies for OT,
176.78s - 179.78s |  I'd like to quickly touch upon one more topic,
179.78s - 182.78s |  that is the ICS OT attack life cycle.
182.78s - 186.78s |  Most people in cyber are already aware of attack life cycles,
186.78s - 189.78s |  but when we talk about hacking OT, people often tend
189.78s - 192.78s |  to assume that we are talking about some cool exploit
192.78s - 195.78s |  against an isolated ICS or a control system device,
195.78s - 198.78s |  so I'd like to call out that there is a difference
198.78s - 200.78s |  between hacking an individual control system
200.78s - 204.78s |  and hacking a large-scale industrial OT operation.
204.78s - 208.78s |  Real-world OT attacks are rarely single-step compromises,
208.78s - 211.78s |  often involve a multi-step attack life cycle
211.78s - 213.78s |  covering multiple phases.
213.78s - 217.78s |  From an attacker's perspective, this typically translates
217.78s - 220.78s |  to information gathering, perimeter breach,
220.78s - 222.78s |  privilege escalation, internal reconnaissance,
222.78s - 226.78s |  network propagation, and finally, a precise execution
226.78s - 230.78s |  to achieve a predetermined objective in an OT environment.
230.78s - 233.78s |  The basic idea here is to obtain prior information
233.78s - 234.78s |  about the target system,
234.78s - 237.78s |  breach the protected perimeter of the OT environment,
237.78s - 239.78s |  remain undetected while operating
239.78s - 241.78s |  within the target environment,
241.78s - 243.78s |  and then finally launch a precise attack
243.78s - 245.78s |  to achieve the target objective.
245.78s - 247.78s |  Consequently, if you think about it
247.78s - 248.78s |  from the defender's perspective,
248.78s - 250.78s |  each phase of this attack life cycle presents
250.78s - 253.78s |  an opportunity for detection and mitigation.
253.78s - 254.78s |  Thus, it's important to understand
254.78s - 256.78s |  the ICS OT attack life cycle,
256.78s - 258.78s |  identify security issues before an attacker
258.78s - 260.78s |  has a chance to exploit them,
260.78s - 263.78s |  develop preventive or detective controls for known TTPs,
263.78s - 266.78s |  and mitigate attack vectors across multiple phases
266.78s - 268.78s |  of the attack life cycle.
268.78s - 269.78s |  Now, I don't believe I have the time
269.78s - 271.78s |  to go through each phase of the attack life cycle
271.78s - 272.78s |  in the next 20 minutes,
272.78s - 273.78s |  so for the remaining session,
273.78s - 276.78s |  I'd like to distill the life cycle into four key phases
276.78s - 279.78s |  listed on the lower side of the slide here,
279.78s - 281.78s |  and walk through some real world examples
281.78s - 284.78s |  and case studies for common attack vectors
284.78s - 285.78s |  across the four phases.
287.78s - 289.78s |  The first phase I'd like to cover is initial compromise.
289.78s - 292.78s |  As the name suggests, the objective of this phase
292.78s - 295.78s |  is to gain an initial foothold in the target environment.
295.78s - 297.78s |  In most real world scenarios,
297.78s - 300.78s |  this typically translates to using a social engineering
300.78s - 301.78s |  or spear phishing campaign
301.78s - 304.78s |  to compromise the enterprise side of the organization.
304.78s - 307.78s |  In fact, the majority of the red team exercises for OT
307.78s - 310.78s |  that we perform begin with some form of attempt
310.78s - 312.78s |  to gain access or foothold
312.78s - 314.78s |  on the corporate side of the network.
314.78s - 317.78s |  That said, the initial compromise phase
317.78s - 320.78s |  could also entail other more direct attack vectors
320.78s - 323.78s |  to gain a direct foothold in the OT network.
323.78s - 326.78s |  The list on the slide here lists some examples
326.78s - 328.78s |  like direct connection to ICS on the internet,
328.78s - 330.78s |  supply chain compromise, third party compromise,
330.78s - 333.78s |  hardware implants, and last but not the least,
334.78s - 337.78s |  physical or wireless access to OT systems in the field.
337.78s - 339.78s |  Industrial environments often have
339.78s - 342.78s |  a geographically dispersed field network,
342.78s - 344.78s |  often connected using wireless networks
344.78s - 347.78s |  and thus present a large attack surface for attackers
347.78s - 350.78s |  to gain direct access to OT devices.
350.78s - 352.78s |  The simplest example of such a system here
352.78s - 354.78s |  would be residential smart meters
354.78s - 356.78s |  in advanced metering infrastructure.
356.78s - 359.78s |  So if an attacker, let's say, is able to gain
359.78s - 361.78s |  or manipulate the communication traffic
361.78s - 363.78s |  between the residential smart meter
363.78s - 365.78s |  and a back-office collector,
365.78s - 367.78s |  they could potentially use that as an entry point
367.78s - 370.78s |  into the back-office, back-inherent system.
370.78s - 375.59s |  The first example I have here
375.59s - 377.59s |  is for a communication-based train control system.
377.59s - 380.59s |  In a CVDC network, onboard ECUs in the train
380.59s - 382.59s |  typically connect to the back-office network
382.59s - 384.59s |  through radio-based communications
384.59s - 387.59s |  such as wireless network or cellular network.
387.59s - 390.59s |  In this specific case, we found that a CVDC radio network
390.59s - 392.59s |  was implemented using a hidden
392.59s - 394.59s |  but essentially open SSID,
394.59s - 396.59s |  thus providing an unauthenticated access
396.59s - 399.59s |  to the onboard embedded network on the trains.
399.59s - 401.59s |  The right side of the screen here shows us
401.59s - 403.59s |  using the open wireless network
403.59s - 405.59s |  to connect to a VNC session
405.59s - 408.59s |  on one of the operator displays in the local cab.
408.59s - 410.59s |  Insecure wireless networks are probably
410.59s - 412.59s |  not as common as in the recent past,
412.59s - 415.59s |  but we still find examples of unencrypted protocols
415.59s - 418.59s |  or legacy encryption in older networks.
418.59s - 423.41s |  The next example I have here
423.41s - 425.41s |  is for an unprotected cellular network
425.41s - 427.41s |  for a public transport operator.
427.41s - 429.41s |  In this case, our team was able to use
429.41s - 431.41s |  an arbitrary personal SIM
431.41s - 433.41s |  to connect to the private APN
433.41s - 436.41s |  for the field network and gain direct access
436.41s - 439.41s |  to traffic monitoring cameras across the metropolitan region.
439.41s - 442.41s |  To be clear, this is probably an exception and not the norm
442.41s - 446.41s |  to have an unauthenticated private APN,
446.41s - 448.41s |  but such was the case here,
448.41s - 450.41s |  and it does show an interesting example
450.41s - 453.41s |  of an initial entry point into an OT environment
453.41s - 457.41s |  through an insecure cellular network.
457.41s - 460.41s |  The last example I have here for initial foothold
460.41s - 465.41s |  is an initial compromise point into a telco network.
465.41s - 468.41s |  Modern telco networks are essentially IP-based
468.41s - 471.41s |  and involve an IP-based tunnel between the mobile device
471.41s - 474.41s |  and a gateway node in the core network.
474.41s - 476.41s |  The gateway node forwards the traffic
476.41s - 478.41s |  to the intended destination
478.41s - 480.41s |  through a backbone network,
480.41s - 483.41s |  and it's best practice to basically
483.41s - 485.41s |  have the gateway node
485.41s - 487.41s |  allow only access to the intended networks
487.41s - 489.41s |  and block any or all attempts
489.41s - 492.41s |  to access the private nodes in the operated network.
492.41s - 494.41s |  However, in this case, we found
494.41s - 496.41s |  that we were able to actually use a commercial
496.41s - 499.41s |  off-the-shop SIM for the said operator
499.41s - 502.41s |  to connect to the core nodes in the telco network.
502.41s - 504.41s |  Long story short, we were able to compromise
504.41s - 507.41s |  the core nodes, such as session border controller,
507.41s - 509.41s |  and intercept user traffic,
509.41s - 512.41s |  including SMS and voice call data.
512.41s - 514.41s |  Now, I realize that it's probably not as obvious
514.41s - 515.41s |  from a single screenshot here,
515.41s - 517.41s |  but the picture here on the right-hand side
517.41s - 519.41s |  shows us intercepting an SMS message
519.41s - 523.41s |  from the traffic captured on an SPC controller.
523.41s - 525.41s |  Think about using your personal mobile phone
525.41s - 528.41s |  as an entry point into your telco operator's network
528.41s - 530.41s |  and compromising lawful interception
530.41s - 532.41s |  across the national network.
532.41s - 534.41s |  To be clear, this is also very rare,
534.41s - 536.41s |  but still, it does provide another interesting example
536.41s - 538.41s |  of an initial entry point
538.41s - 542.41s |  into what is essentially an operational network.
542.41s - 545.41s |  The next phase I'd like to cover is internal reconnaissance.
545.41s - 547.41s |  The objective of this phase
547.41s - 550.41s |  is to leverage the foothold gained in the previous phase
550.41s - 553.41s |  to extract specific information about the target system.
553.41s - 555.41s |  This is especially relevant in the context
555.41s - 558.41s |  of initial compromise in the enterprise IT environment.
558.41s - 560.41s |  The enterprise network is important
560.41s - 564.41s |  not only from the perspective of IT-OT network segmentation,
564.41s - 566.41s |  but it is also important
566.41s - 568.41s |  from the perspective of data segmentation.
568.41s - 571.41s |  A typical enterprise network often hosts multiple sources
571.41s - 573.41s |  that can provide an attacker
573.41s - 575.41s |  with critical information about the target asset.
575.41s - 579.41s |  Some examples on the slide here include documentation,
579.41s - 582.41s |  department of file shares, email communications,
582.41s - 584.41s |  development resources, management consoles,
584.41s - 587.41s |  and even key logging and screen monitoring.
587.41s - 589.41s |  Some examples of target information
589.41s - 592.41s |  that an attacker would typically like to retrieve
592.41s - 593.41s |  at this phase of the exercise
593.41s - 596.41s |  include network diagrams, host names, IP addresses,
596.41s - 599.41s |  process documentation, operator manuals,
599.41s - 603.41s |  and even potentially plaintiff's credentials.
603.41s - 607.41s |  This is probably the most boring stage of an attack lifecycle
607.41s - 608.41s |  from an attacker's perspective,
608.41s - 611.41s |  but in my experience, an attacker will spend
611.41s - 614.41s |  the maximum time operating within this stage
614.41s - 617.41s |  because the more information that I can obtain at this stage,
617.41s - 619.41s |  the higher my chances of success
619.41s - 623.41s |  and precise execution in the subsequent stages.
623.41s - 625.41s |  Internal reconnaissance often comes down
625.41s - 627.41s |  to strategic targeting information sources
627.41s - 629.41s |  and key employees that are responsible
629.41s - 633.41s |  for the administration and maintenance of the OT environment.
633.41s - 636.41s |  I realize that the screenshots here on the slide
636.41s - 637.41s |  are highly redacted.
637.41s - 639.41s |  However, they still provide a snippet
639.41s - 642.41s |  of the kind of information that an attacker might target
642.41s - 644.41s |  during internal reconnaissance phase.
644.41s - 647.41s |  Firewall rules, operation guides, department shares,
647.41s - 649.41s |  plaintiff's credentials, password managers,
649.41s - 652.41s |  are all critical information that are typically hosted
652.41s - 654.41s |  in the enterprise side of the environment
654.41s - 657.41s |  but provide invaluable resources of information
657.41s - 659.41s |  for attackers targeting OT networks.
659.41s - 661.41s |  Now, from a defender's perspective,
661.41s - 663.41s |  it is easy to underestimate the value
663.41s - 665.41s |  of the information exfiltrated
665.41s - 667.41s |  during this phase of the attack lifecycle,
667.41s - 669.41s |  and security teams, in my opinion,
669.41s - 671.41s |  often ignore the importance of this phase
671.41s - 674.41s |  from a detection perspective.
674.41s - 677.41s |  In fact, I would argue that this phase
677.41s - 680.41s |  provides the maximum opportunity for detection.
680.41s - 683.41s |  If I, as a defender, can flag indicators of compromise
683.41s - 686.41s |  for internal reconnaissance in my enterprise environment,
686.41s - 688.41s |  I could potentially detect an attacker
692.41s - 695.41s |  before they even have a chance to reach the OT environment.
695.41s - 698.41s |  Now, I'm not going to go into specific case studies
698.41s - 699.41s |  for this phase.
699.41s - 701.41s |  Almost every exercise that we perform
701.41s - 703.41s |  involves some kind of internal reconnaissance,
703.41s - 705.41s |  but I still wanted to cover some examples
705.41s - 708.41s |  of target sources and information sources.
708.41s - 714.84s |  Moving on, initial compromise in internal reconnaissance
714.84s - 716.84s |  is often followed by network propagation.
716.84s - 718.84s |  In the context of a typical attack lifecycle,
718.84s - 720.84s |  this often translates to network propagation
720.84s - 723.84s |  from an initial foothold in the IT network
723.84s - 725.84s |  to the target system in the OT network.
725.84s - 728.84s |  Now, I know that we all expect our OT systems
728.84s - 730.84s |  to be completely isolated in air gap,
730.84s - 731.84s |  using nothing but space.
731.84s - 734.84s |  However, in practice, that is rarely the case
734.84s - 736.84s |  for modern industrial environments.
736.84s - 739.84s |  In an ideal world, I would probably love to see
739.84s - 742.84s |  perfect segmentation using unidirectional gateways.
742.84s - 744.84s |  However, the reality is that we still continue
744.84s - 748.84s |  to find OT environments that lack basic segmentation.
748.84s - 750.84s |  Now, there are probably a million different ways
750.84s - 752.84s |  to hose up segmentation, but some common examples
752.84s - 755.84s |  of insecure segmentation between IT and OT
755.84s - 757.84s |  include lack of properly secure authentication
757.84s - 759.84s |  for remote access, dual home servers
759.84s - 761.84s |  with one leg in IT, one leg in OT,
761.84s - 763.84s |  shared active directory domains
763.84s - 765.84s |  or domain trust between IT and OT,
765.84s - 768.84s |  and exploitable services in OT DMZ.
768.84s - 771.84s |  That said, the most fundamental issue
771.84s - 773.84s |  around IT-OT segmentation is the use
773.84s - 776.84s |  of shared infrastructure and management platforms.
776.84s - 778.84s |  A classic example of that would be
778.84s - 780.84s |  a hypervisor server hosted in the IT environment,
780.84s - 783.84s |  which hosts guest machines for OT network.
783.84s - 785.84s |  So potentially, if I can compromise
785.84s - 787.84s |  the hypervisor server in the IT environment
787.84s - 790.84s |  using active credentials, I could pretty much gain access
790.84s - 792.84s |  to the OT consoles, thus bypassing
792.84s - 794.84s |  the firewall rules between IT and OT.
794.84s - 796.84s |  Like I said, unfortunately, it is very common
796.84s - 798.84s |  to find both physical and logical flaws
798.84s - 800.84s |  in segmentation between IT and OT,
800.84s - 802.84s |  and such issues can often be used
802.84s - 806.84s |  to propagate from the IT network to the OT network.
810.84s - 812.84s |  This slide here shows an example
812.84s - 814.84s |  of installing a key logger
814.84s - 816.84s |  on a compromised engineer desktop
816.84s - 819.84s |  in the IT network to basically obtain
819.84s - 821.84s |  the single-factor authentication credentials
821.84s - 823.84s |  for a remote access point
823.84s - 825.84s |  or a jump-host server in the OT network.
825.84s - 827.84s |  The screenshot on the right-hand side here
827.84s - 831.84s |  shows us basically connecting
831.84s - 833.84s |  to a successful remote desktop connection
833.84s - 836.84s |  to an HMI interface for a subway line
836.84s - 838.84s |  or a subway over line.
838.84s - 845.94s |  This is another interesting example
845.94s - 848.94s |  of compromising remote access credentials
848.94s - 849.94s |  in the corporate network.
849.94s - 852.94s |  However, this time, through direct compromise
852.94s - 854.94s |  of an enterprise password manager
854.94s - 856.94s |  or an enterprise password vault,
856.94s - 858.94s |  which basically stored OT credentials.
858.94s - 860.94s |  Enterprise password management systems
860.94s - 862.94s |  often authenticate to a corporate domain,
862.94s - 864.94s |  so if an attacker is able to compromise
864.94s - 866.94s |  the password, say, for example,
866.94s - 869.94s |  engineering teams, the attacker could gain
869.94s - 871.94s |  credentials for remote access to OT systems.
871.94s - 873.94s |  The screenshot on the right again here
873.94s - 876.94s |  shows a successful remote desktop connection
876.94s - 878.94s |  to an ITS server for a traffic control
878.94s - 880.94s |  or a traffic light monitoring system.
880.94s - 885.02s |  This slide here shows an example
886.02s - 888.02s |  of a segmentation flaw, like I said,
888.02s - 891.02s |  using domain trust between IT and OT.
891.02s - 894.02s |  It is probably not as clear from the screenshot
894.02s - 897.02s |  that I have on the slide here,
897.02s - 900.02s |  but you will find that the IT domain here
900.02s - 903.02s |  is actually superseded as the root domain
903.02s - 905.02s |  for OT domains across multiple DCS.
905.02s - 908.02s |  The end result is that my team was basically
908.02s - 910.02s |  able to use compromised credentials
910.02s - 912.02s |  in the root IT domain to gain access
912.02s - 914.02s |  to child domains for multiple plants
914.02s - 917.02s |  across the globe.
917.02s - 920.02s |  Finally, this is a real world example
920.02s - 922.02s |  of the issue of shared infrastructure
922.02s - 923.02s |  between IT and OT.
923.02s - 926.02s |  The virtualization platform on the left
926.02s - 929.02s |  authenticates to an IT domain,
929.02s - 931.02s |  but hosts guest machines for both
931.02s - 933.02s |  IT and OT environments.
933.02s - 936.02s |  Our team was able to gain administrative access
936.02s - 938.02s |  to the hypervisor management interface
938.02s - 940.02s |  using credentials compromised in the IT domain
940.02s - 943.02s |  and leverage the same to gain access
943.02s - 946.02s |  to the local console on the guest virtual machines
946.02s - 948.02s |  in the OT environment.
948.02s - 950.02s |  The screenshot on the right-hand side here
950.02s - 953.02s |  shows an example of direct console access
953.02s - 955.02s |  to the guest VM for a WSIS server
955.02s - 958.02s |  in the OT network, which hosts software updates
958.02s - 960.02s |  for engineering workstations
960.02s - 964.02s |  in the PCN plant network.
964.02s - 966.02s |  The final attack phase I'd like to cover
966.02s - 968.02s |  is mission execution in OT.
969.02s - 971.02s |  As the name suggests, this is the phase
971.02s - 973.02s |  where we are dealing with core OT
973.02s - 976.02s |  and the attacker will either attempt
976.02s - 978.02s |  to leverage the access that they've already obtained
978.02s - 980.02s |  or launch a pre-built exploit
980.02s - 983.02s |  to achieve the final objective.
983.02s - 985.02s |  As you can imagine, the tactics, techniques,
985.02s - 987.02s |  and procedures that an attacker might use
987.02s - 989.02s |  in this phase would highly depend
989.02s - 991.02s |  on the specific OT system in question
991.02s - 994.02s |  and more importantly, the attacker objective.
994.02s - 997.02s |  For example, there are attacker objectives
997.02s - 1001.02s |  that could potentially be achieved
1001.02s - 1003.02s |  through direct access and direct control
1003.02s - 1007.02s |  of an HMI or simply abusing the built-in features
1007.02s - 1009.02s |  of the target system.
1009.02s - 1012.02s |  While there are some other attack vectors
1012.02s - 1015.02s |  or attacker objectives which might require
1015.02s - 1017.02s |  manipulation of the control logic
1017.02s - 1019.02s |  and input-output signals on the lower-level
1019.02s - 1021.02s |  embedded systems.
1021.02s - 1023.02s |  To be honest, I think we could spend an entire session
1023.02s - 1026.02s |  talking about attack vectors for mission execution in OT,
1026.02s - 1028.02s |  but some common examples in the slide here
1028.02s - 1030.02s |  include remote command execution through HMI interface,
1030.02s - 1032.02s |  manipulation of configuration data
1032.02s - 1034.02s |  for a remote terminal or a PLC,
1034.02s - 1037.02s |  spoof communication for an ICS protocol,
1037.02s - 1039.02s |  and last but not the least, a pre-built exploit
1039.02s - 1041.02s |  to manipulate the process control logic
1041.02s - 1043.02s |  or the process memory and an embedded controller
1043.02s - 1046.02s |  in the OT network.
1046.02s - 1049.02s |  As a general term of rule, it is relatively easier
1049.02s - 1051.02s |  to cause process disruption
1051.02s - 1054.02s |  as compared to process manipulation.
1054.02s - 1057.02s |  ICS systems are built with redundancy, safety,
1057.02s - 1059.02s |  risks, and hazards in mind,
1059.02s - 1062.02s |  and thus high-consequence manipulation
1062.02s - 1065.02s |  often requires prior reverse engineering
1065.02s - 1067.02s |  and exploit development.
1067.02s - 1069.02s |  Some common examples of security issues
1069.02s - 1071.02s |  that we typically find while assessing
1071.02s - 1075.02s |  and building exploits for embedded ICS systems
1075.02s - 1078.02s |  include insecure firmware updates,
1078.02s - 1080.02s |  unpopulated interfaces,
1080.02s - 1082.02s |  hidden backdoors, shared SSH keys
1082.02s - 1084.02s |  between different customers,
1084.02s - 1086.02s |  obviously buffer overflows,
1086.02s - 1088.02s |  and then leftover debug functions
1088.02s - 1090.02s |  from development and testing
1090.02s - 1094.02s |  that have carried over to the production systems.
1094.02s - 1096.02s |  Here I'd like to once more stress
1096.02s - 1099.02s |  that we are essentially dealing with cyber-physical systems
1099.02s - 1102.02s |  and thus any kind of offensive security testing
1102.02s - 1104.02s |  for lower-level ICS devices
1104.02s - 1106.02s |  should only be performed in a non-production
1106.02s - 1111.02s |  or a laboratory environment under controlled conditions.
1111.02s - 1113.02s |  The first example I have here
1113.02s - 1117.02s |  is for a Red Team exercise for a power utility
1117.02s - 1120.02s |  with advanced metering infrastructure.
1120.02s - 1124.02s |  This shows an example of simply using an HMI command
1124.02s - 1126.02s |  to achieve the final objective,
1126.02s - 1129.02s |  that is, remote disconnect of a target smart meter
1129.02s - 1131.02s |  at a specific location.
1131.02s - 1134.02s |  A team was effectively able to breach the external perimeter,
1134.02s - 1136.02s |  gain remote access to the command and control interface
1136.02s - 1138.02s |  for the head-end system,
1138.02s - 1140.02s |  and initiate remote disconnect command
1140.02s - 1143.02s |  for the endpoint mirrors.
1143.02s - 1146.02s |  This slide is another example of mission execution
1146.02s - 1148.02s |  through direct control of HMI.
1148.02s - 1151.02s |  A team was able to gain remote access
1151.02s - 1153.02s |  to the physical access control interface
1153.02s - 1155.02s |  for a building management system,
1155.02s - 1158.02s |  thus obtaining the ability to open doors and turnstiles
1158.02s - 1160.02s |  through a simple click of a button.
1160.02s - 1163.02s |  Unfortunately, I cannot show you the actual pictures here,
1163.02s - 1165.02s |  but effectively we were able to use
1165.02s - 1167.02s |  the command and control interface for the BMS
1167.02s - 1170.02s |  to walk into an operations control center
1170.02s - 1172.02s |  while one of us was actually operating
1172.02s - 1177.02s |  and controlling the doors and turnstiles remotely.
1177.02s - 1180.02s |  This slide shows an example
1180.02s - 1183.02s |  of basically spoofing ICS traffic
1183.02s - 1185.02s |  for a locomotive control system.
1185.02s - 1188.02s |  The screenshot shows us plugging into an onboard Ethernet switch
1188.02s - 1189.02s |  in the locomotive cab
1189.02s - 1192.02s |  and manipulating the speed sensor reading
1192.02s - 1194.02s |  on the operator's screen.
1194.02s - 1197.02s |  The train here obviously is not moving at 80 miles per hour.
1197.02s - 1200.02s |  This is essentially the effect of spoofing canvas traffic
1200.02s - 1202.02s |  to an existing binary on one of the ECUs
1202.02s - 1204.02s |  on the embedded network on the train.
1204.02s - 1207.81s |  Last but not the least,
1207.81s - 1211.81s |  I have here an example of using debug features
1211.81s - 1213.81s |  to manipulate the input-output signals
1213.81s - 1216.81s |  for a light-trail vehicle control system.
1216.81s - 1218.81s |  It's actually quite surprising how many times
1218.81s - 1220.81s |  one might find a debug console
1220.81s - 1222.81s |  enabled in a production environment,
1222.81s - 1224.81s |  and this can often be used to manipulate
1224.81s - 1226.81s |  control signals and input-output signals
1226.81s - 1228.81s |  beyond the intended.
1228.81s - 1230.81s |  The screenshot there on the left
1230.81s - 1232.81s |  basically shows us using a vendor IDE,
1232.81s - 1234.81s |  which I'm not going to name,
1234.81s - 1237.81s |  to basically connect to a live unit on an LRV
1237.81s - 1239.81s |  and using force tables
1239.81s - 1241.81s |  to override input-output signal tags
1241.81s - 1244.81s |  for the vehicle control system.
1244.81s - 1246.81s |  Again, unfortunately, I cannot show the video here,
1246.81s - 1249.81s |  but essentially we were able to access
1249.81s - 1253.81s |  or gain access to an IP-based Ethernet network on the LRV,
1253.81s - 1255.81s |  connect to the vehicle control ECU,
1255.81s - 1257.81s |  and override operator input
1257.81s - 1259.81s |  for doors, throttle, direction,
1259.81s - 1261.81s |  and even emergency braking.
1261.81s - 1263.81s |  Have you ever seen a movie
1263.81s - 1265.81s |  where you see a hacker
1265.81s - 1267.81s |  scribbling on a laptop trying to stop a train?
1267.81s - 1269.81s |  This is exactly that, but much worse,
1269.81s - 1271.81s |  because we were actually able to
1271.81s - 1273.81s |  control the throttle,
1273.81s - 1276.81s |  basically override the dead-man switch,
1276.81s - 1278.81s |  move the train, and disable
1278.81s - 1282.81s |  all and every operator input.
1282.81s - 1284.81s |  I think I've run through 25 minutes,
1284.81s - 1286.81s |  so I realize that I pretty much
1286.81s - 1288.81s |  run through my slides,
1288.81s - 1290.81s |  but I only have 30 minutes,
1290.81s - 1292.81s |  so I hope that I have been able to provide
1292.81s - 1294.81s |  some practical real-world experience
1294.81s - 1296.81s |  or perspective on some common attack vectors
1296.81s - 1298.81s |  that an attacker might use
1298.81s - 1300.81s |  to hack operational technology.
1300.81s - 1302.81s |  But if nothing else,
1302.81s - 1304.81s |  I would like to conclude with four key takeaways
1304.81s - 1306.81s |  from my talk.
1306.81s - 1308.81s |  It is possible to conduct offensive security testing for OT,
1308.81s - 1310.81s |  but such testing should only be performed
1310.81s - 1312.81s |  after careful consideration of
1312.81s - 1314.81s |  risks, hazards, controls,
1314.81s - 1316.81s |  and pre-approved rules of engagement.
1316.81s - 1318.81s |  Real-world OT attacks
1318.81s - 1320.81s |  are rarely single-step compromises
1320.81s - 1322.81s |  and often involve a multi-step attack lifecycle
1322.81s - 1324.81s |  covering multiple phases.
1324.81s - 1326.81s |  It's relatively easier
1326.81s - 1328.81s |  to cause a process disruption
1328.81s - 1330.81s |  as compared to process manipulation.
1330.81s - 1332.81s |  Process disruption can often be achieved
1332.81s - 1334.81s |  through direct abuse of pre-built features
1334.81s - 1336.81s |  of the system,
1336.81s - 1338.81s |  whereas high-consequence manipulation
1338.81s - 1340.81s |  often requires prior reverse engineering
1340.81s - 1342.81s |  and exploit development.
1342.81s - 1344.81s |  Lastly, from a defender's
1344.81s - 1346.81s |  perspective, it is important
1346.81s - 1348.81s |  to understand the ICS-OT attack lifecycle,
1348.81s - 1350.81s |  develop preventive or
1350.81s - 1352.81s |  detective controls for known TTPs,
1352.81s - 1354.81s |  and mitigate attack vectors
1354.81s - 1356.81s |  across different phases of
1356.81s - 1358.81s |  the attack lifecycle.
1358.81s - 1360.81s |  Cool, that's it.
1360.81s - 1362.81s |  That's all I have for you today.
1362.81s - 1364.81s |  I realize it's 3 p.m.
1364.81s - 1366.81s |  on Saturday afternoon in Vegas,
1366.81s - 1368.81s |  so thanks everybody for joining in
1368.81s - 1370.81s |  and listening in.
1370.81s - 1372.81s |  If you have any questions,
1372.81s - 1374.81s |  although I cannot see anybody here,
1374.81s - 1376.81s |  but if you have any questions,
1376.81s - 1378.81s |  you can hit me up face-to-face.
1378.81s - 1380.81s |  If you want to reach out and discuss in more detail,
1380.81s - 1382.81s |  you can reach out to us
1382.81s - 1384.81s |  over email or LinkedIn.


url: https://www.youtube.com/watch?v=A5SefnQPyn0
title: DEF CON 32 - An adversarial approach to Airline Revenue Management Proving Ground - Craig Lester
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=A5SefnQPyn0",
  "title": "DEF CON 32 - An adversarial approach to Airline Revenue Management Proving Ground - Craig Lester",
  "description": "Richard Branson is oft quoted with the quip that the quickest way to become a millionaire in the Airline Industry is to start as a billionaire. An Industry constrained by high fixed capital costs, bi-lateral capacity treaties, airport slots and curfews, labour etc; Airlines use the practice of revenue management to fill planes, maximise earnings and keep competitors at bay. But you\u2019re not interested in an economics talk \u2013 this is a hacker con. I\u2019m here to provide a birds-eye view and introduction into how fares and ticketing work, debunking some myths while outlining system constraints and limitations that introduce vulnerabilities. As an outcome, attendees should gain an introductory understanding of airline industry pricing, published fares and terminology. With most blogged 'deals' patched quicker than RCEs, the deeper understanding of not what but how, facilitates a progression for those interested to interact on more specialised discussion forums.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2556,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.14s - 7.84s | This text was transcribed using whisper model: large-v2

 Good morning. Ah, there we go. Good morning everyone. I am a Lillian Ashbaker. I represent the aerospace village
7.84s - 15.78s |  I do the speaker CFP process the aerospace village is in conjunction with the creator stage team is pleased to introduce Craig
16.06s - 23.10s |  He is presenting on an adversarial approach to airline revenue management. So please welcome Craig to the stage
30.14s - 32.14s |  Well, hey everyone
37.50s - 39.98s |  I'm Craig a little about me. I
42.38s - 45.54s |  First moved interstate for work about 15 years ago and
46.34s - 48.34s |  started flying a lot since then
48.50s - 53.28s |  by trade, I'm I work with Splunk and Simtools now, but my
54.06s - 57.18s |  Background was Cisco and carrier sort of networking stuff
57.94s - 59.94s |  But yeah
60.02s - 63.86s |  So firstly what what's this talk not about so it's I'm not all about
65.74s - 72.50s |  These big clickbait, you know sort of travel articles where when really when you break them down at the end of the day
72.66s - 75.80s |  It's like sign up for this credit card get a sign on bonus
76.90s - 80.86s |  and you know pick the most expensive fare out there to
81.98s - 83.82s |  To advertise it through
83.82s - 85.82s |  So with that just a little disclaimer
86.82s - 89.74s |  That already intended audience, so
96.61s - 99.41s |  Okay, it's just a little disclaimer I guess
99.93s - 103.25s |  The intended audience for this talk is supposed to be I guess people that
103.77s - 106.77s |  Airlines or whatever so they can defend their systems better, right? It's ethically
108.45s - 111.45s |  But yeah, and with that just caveats
113.29s - 117.05s |  Look I'm just a dude. This is an interest topic to me. I haven't been trained
117.05s - 122.29s |  I just sort of you know black box as it got along and learn stuff. So I'm sharing that with you
122.69s - 126.77s |  There's a lot of information to cover. So I've got it probably will be a bit high-level
127.81s - 130.97s |  Come see me later. I'll get us copy the slides if you like, but
133.29s - 135.29s |  Yeah
135.89s - 139.65s |  So firstly why is the airline and travel industry the way it is
140.53s - 143.13s |  It's high fixed costs. It's very regulated
143.85s - 147.77s |  You know not only do airlines have to get approval from you know
147.77s - 150.65s |  Both governments to operate fair flights between two countries
150.69s - 155.49s |  They actually have to you know apply for slots and so these slots sometimes like, you know
155.49s - 161.29s |  I'd be for addresses where it's pretty congested at some of the airports like London and JFK and whatnot
161.37s - 163.33s |  so in fact, in fact
163.33s - 169.85s |  you see things like a big Malaysian is flying almost empty planes to London just to keep their slots because if they don't use them they
170.57s - 172.57s |  They lose them right and that
172.73s - 178.97s |  They do your trades and it you know, it's a 75 billion once for one of the slots recently sold for so with that
178.97s - 181.57s |  There's also these concept of fortress hubs
181.69s - 186.29s |  Which are like the big hubs of certain airlines that they have such a dominant hold on the market
189.21s - 195.61s |  So with that, what does the revenue management team do and what they do is basically try and maximize the return they can get on
196.21s - 199.05s |  By filling an aircraft and what they're concerned about is either
199.97s - 202.09s |  If we if you boil it down, so this is a
202.85s - 206.09s |  Bit of an academic science. This is quite a good is a few general art
206.09s - 208.09s |  There's quite a lot of general articles and research on this
208.13s - 213.53s |  but for our purposes if you boil it down really what they're trying to look out for is
214.45s - 219.17s |  Making sure the sit they get the highest price for every seat not letting it go empty or selling it out too cheap
220.33s - 222.53s |  So thinking about that, how can they?
223.41s - 227.57s |  How can they be disrupted? We're not going to really talk about any of these today
228.09s - 229.89s |  But
229.89s - 233.49s |  Just wanted to just wanted to highlight the fact that it ranges straight from
234.01s - 241.13s |  I guess using a same-day flight change or some of your actual benefits that they offer in some ways can you know produce the
241.77s - 246.61s |  Return they would get but you know and other things actually become more related
246.61s - 251.73s |  You know like fraud where it's credit card abuse and that sort of stuff or by cashing out things for gift cards
251.73s - 258.17s |  So with that how do fares exist in the world like so when you when you go to an airline website or
258.17s - 262.01s |  You know your Expedia or whatever. What do you actually see? Why why does it come up that way?
263.13s - 267.09s |  I've often overheard people go all the price went up because of my cookies or whatever
267.09s - 271.81s |  But generally you find there are things like there are things called rules attached to them. There might be
272.37s - 278.53s |  Days of the week or where the publish it there is published and the other the other concern is the dynamic inventory that's involved
278.65s - 283.61s |  It's extremely it's extremely complex computationally and there is
287.53s - 289.53s |  Written a very great
291.17s - 295.65s |  Very great presentation on the computer complexity of actually calculating these things because
296.53s - 299.13s |  Most international trips or where there's multiple connections
299.81s - 304.53s |  Actually, it can be tens of millions of possible connections of fares in the world
304.73s - 310.31s |  Actually, it can be tens of millions of possible connections of fares and flights and whatnot
310.57s - 316.69s |  So that's why sometimes when you go to book it might say this price is expired because actually you've sort of looking at case
317.09s - 319.09s |  availability
319.37s - 321.01s |  So what affairs look like
321.01s - 327.49s |  this is the example from probably one of the tools that you can sort of buy closer access to these the actual
327.89s - 330.65s |  Like border travel agent would say it's not the same system
330.65s - 334.01s |  But it's like a it's like a read-only one that consumers can subscribe to
334.89s - 338.11s |  but this is what you this is sort of what they look like so they all have like a
340.17s - 343.69s |  Basis or an identifier code and now this code is a bunch of numbers
343.69s - 345.05s |  But I mean so a bunch of letters
345.05s - 352.29s |  but usually these letters indicate the first one is the inventory code and the others depending on the airline might indicate the seasonality or other
352.29s - 357.97s |  Sorts of you know restrictions for a family affairs. So this is some here. It's just example for
358.45s - 364.61s |  London to New York, you can see the round-trip that those prices are actually the base fare before you add taxes and surcharges
365.25s - 369.75s |  And you can also see there things like the minimum maximum stay that they have
369.75s - 374.05s |  So the SU is a Sunday stay and it's an old sort of traditional
374.37s - 378.65s |  concept that they used to catch business travelers with because if you forced a
379.05s - 384.61s |  You know leisure travelers are more likely to stay over a weekend. Whereas business travelers, you don't want to go home on Friday or whatever
384.89s - 389.49s |  So as we as I talked about that they're published on two sort of basis's generally the
390.37s - 394.53s |  the routing spaces where it's explicitly show you which which which
395.13s - 398.97s |  transit points and you can book with that particular fare and
399.49s - 401.49s |  The other way is the the mileage
402.13s - 404.13s |  Or an NPM basis now
404.53s - 409.41s |  I've got a little calculation there if you can see on the screen of how an NPM sort of works, but essentially
409.73s - 412.49s |  It's using the great circle distance the
413.17s - 416.33s |  That you it's something you may have seen with like impossible travel and whatnot
417.41s - 419.89s |  alerts and your seems and then
422.13s - 427.01s |  So they can make it work through their particular hubs often you they have a concept of a ticketed point deduction
427.25s - 430.73s |  where basically you can get extra miles to finish the trip because they
432.37s - 435.73s |  Because say for instance this one they allow you to fly through the city
436.65s - 439.97s |  Because say for instance this one they allow you to fly through Chicago
441.05s - 443.05s |  So just a brief thing
443.05s - 445.45s |  When you combining these fares and looking at stuff
445.45s - 448.97s |  There's quite a number of rules that are involved and we just sort of looked at the routing
448.97s - 455.25s |  But as you can see there did speak about that Sunday stay, but yeah, there's there's all these other things to take into account
457.17s - 460.53s |  So behind the scenes when you actually buy a ticket it kind of looks like this
460.65s - 464.53s |  So how did I did have a picture earlier of a Qatar ticket on there?
464.85s - 469.81s |  But this just shows a more complex sort of ticket where all these leases my understanding anyway
470.49s - 475.01s |  But the important thing to know is that when you get your reservation your P&R
475.01s - 480.09s |  Yes, you know your six-letter identifier just because it says confirmed or on request or whatever in there
480.09s - 484.89s |  It doesn't actually mean you can board the flight. You need a you actually need that valid e-ticket
485.53s - 487.29s |  in there and
487.29s - 491.33s |  Then when you check in that's what actually marks the basically coupon
491.33s - 492.89s |  It's similar to the old paper tickets
492.89s - 498.17s |  But marks that is used and these have to be used in order or basically your rest of your flights are cancelled
499.37s - 500.97s |  Just going back to that last one
500.97s - 506.57s |  we can sort of see there an example of where there is an issue with the e-ticket even though you have a valid reservation and
506.57s - 508.57s |  You can't can't check in on that one yet
509.85s - 511.85s |  so moving across to the
513.05s - 519.45s |  The dynamic how they manage dynamic inventory you might have seen things like five seats less or whatnot
519.93s - 522.49s |  But essentially they use what they use is
523.37s - 526.25s |  his buckets which are given letters and they
526.77s - 531.81s |  And the different fans will attach to different buckets and that that's how they sort of manage the pricing
533.05s - 535.05s |  So if you look in if you look at that
535.09s - 539.85s |  Here's an example of a is example in what would it what a travel agent would see in what they call as G
540.25s - 546.05s |  Distribution systems that shows the availability for a particular flight. This is a flight from Dubai to London
546.89s - 548.69s |  And what you can actually see on this one
548.69s - 554.01s |  That's quite interesting is that because the the why is the highest price or fully flex economy
554.01s - 556.93s |  It's the highest I have and also the generic term for that class
557.17s - 561.61s |  but what you can see because it's zero it means is it's like completely no seats to sail and
563.21s - 565.13s |  Generally, we know that they
565.13s - 570.13s |  Oversell by about 10 or 20 percent most flights if they can so with it being zero and closed
570.13s - 571.85s |  They weren't not taking any more bookings
571.85s - 578.29s |  But the other interesting thing is we're seeing nine which is the maximum for any one time that if there are any single digits
579.21s - 583.09s |  So the actual business and first cabin on this particular flight is quite empty
583.09s - 588.85s |  So there's probably a chance that people will get there be a bit of a cabin roll and to feel to sell more seats and
588.85s - 590.85s |  to fill it up the some of the
590.93s - 594.93s |  More frequent flyers or people traveling alone might actually get or you know
595.29s - 598.17s |  When they go to the gate might be given a new seat upgraded
600.42s - 602.42s |  So
602.62s - 605.74s |  Moving on how do we handle connections now with connections?
605.78s - 607.10s |  It's the same sort of thing
607.10s - 613.58s |  But what you need to keep in mind is your fare class or your availability needs to match for all segments
613.58s - 616.54s |  And not only that you also need it for every person
616.54s - 623.22s |  So if you search for one person on this you would get you you would see the cheaper like our fare for business
623.38s - 629.14s |  But if you had two people if you going it it would show a higher price when you actually search
629.14s - 631.02s |  That's not like a cookie because you already search
631.02s - 635.74s |  It's because it's because this second connecting flight only has one seat available in that our class
636.14s - 638.14s |  So learning some of this can help you
639.02s - 643.82s |  Piece together and understand like I found a good fare. I want to book this which days can actually go
644.46s - 646.46s |  And net really narrow it down
648.30s - 650.38s |  So following the money where it all goes
651.94s - 657.30s |  Basically, there's a thing called a valid validating carrier and that's the one that issues the ticket and that's the e-ticket database
657.30s - 663.38s |  They use interesting factors American Airlines has all their serial numbers start with double zero one
663.38s - 666.78s |  But every because they were the first computerized airline
666.78s - 674.02s |  But all of all of the airlines basically have one of these three digit identifiers that for identifying which stock that is
675.06s - 677.70s |  You also have a concept of a marketing carrier now
677.70s - 682.62s |  that's the flight number you buy and so you might if you've heard of a code share before or ever booked a flight like that
682.62s - 684.10s |  where you're like
684.10s - 687.62s |  Maybe you've booked fit air, but it's actually like a American or British flight
687.66s - 691.66s |  That's what a code share is an operating carrier. Obviously the metal that you're on
692.66s - 698.00s |  so just an example like to tie some of these concepts together this is a little bit of an unusual boarding pass because it's
698.00s - 703.74s |  Printed by air lingus and then on and it's a it's an it's an American flight that was sold as British Airways
703.74s - 707.46s |  And but you can also see there with this electronic. There's the longer
707.98s - 713.86s |  There's the longer marking there with starting in 125 and that's the e-ticket. That's the e-ticket serial number number, right?
714.82s - 716.82s |  the the 25
717.10s - 723.90s |  Below there is also like a sequence number of how which you know the check-in or when they were at that
724.94s - 730.85s |  At the outstation when you sort of checked in online and when it went on the manifest
732.53s - 736.97s |  So having having regard to those sort of concepts, I'll talk about some of the weaknesses so
738.41s - 743.97s |  Why you sometimes see those flat fares now for getting so low like $1 or $15 as we saw before
744.09s - 751.41s |  Is that a lot of the components now come up as you know carrier surcharges under this fuel surcharge that started in 2004?
752.69s - 753.89s |  so
753.89s - 757.97s |  Yeah, initially, they're only like 20 bucks or something because the oil price is fluctuating
758.01s - 762.57s |  But then what happened was I guess the airlines realized they weren't didn't have to pay at that time
762.57s - 765.53s |  They thought they didn't have to pay commissions and other things on these
766.37s - 772.61s |  Amounts so so from my perspective they kind of seem a bit like junk fees like resort fees and stuff that you might pay at hotels
773.97s - 774.97s |  the
774.97s - 776.97s |  interesting fact is that
777.37s - 780.89s |  Because the way they're levied. It's actually it actually has become more complicated
781.41s - 786.33s |  The calculations have become more complicated and one thing that's that's interesting to note. Is that
787.13s - 792.37s |  The way and the way they're published the validating carrier decides whether to apply it or not
792.37s - 794.37s |  It's not necessarily the airline that you're flying on
794.89s - 800.87s |  So this presented some opportunities to that that could force the errors could creep in
801.27s - 804.51s |  So as I say here that is the s1 record is like a
805.19s - 807.19s |  it's just a database record that has
807.79s - 812.47s |  you know the criteria for applying the surcharge and how much it is, but
814.51s - 819.87s |  You know when all the things that matches so we'll go and the fact that it has like sequence numbers
819.87s - 821.87s |  It's sort of works a bit like a firewall world
823.27s - 828.71s |  So when we talk about exploits for this the the good old days what people were doing for a while
829.39s - 833.83s |  Was was that they were actually just going over to another airlines desk and getting them to book flights
833.83s - 838.59s |  You know like a ticketing desk and getting them to book the flights for the other airline and have them issued by
840.15s - 845.15s |  One that didn't levy the surcharge, but there was an IATA resolution and that's kind of gone away
847.15s - 850.33s |  But the more I guess the more interesting ones and the more technical ones for us
851.23s - 856.75s |  and for defenders is is the way that those s1 records work and
856.91s - 860.19s |  And they apply it so you I've got a bit of an example here from one of the the
860.75s - 863.99s |  From the apps code the fair publishing manual there, right?
864.79s - 867.51s |  So some of you may also be able to see why?
868.59s - 873.59s |  How these can sort of break or be pushed at the end of that sequence can be skipped. So for instance like
874.95s - 879.27s |  And and it might depend on whether the fair actually has is compatible with other fares
879.31s - 885.01s |  But if it is for instance, if all the last one has if all ticketed points are wholly within the u.s
885.29s - 890.69s |  Well, what happens if you have a you know domestic segment in Canada or Mexico or whatever for instance, right?
891.37s - 893.37s |  It wouldn't apply it, right? So
893.93s - 897.33s |  Just a demo of this I can show you this is this is quite an old one
897.93s - 901.73s |  People in that sort of travel community don't really like this stuff shared
902.53s - 907.25s |  But this is an old one. I found it interesting to try and even just get this to work stuff to work
907.25s - 909.05s |  It's a bit like pen testing
909.05s - 910.45s |  but
910.45s - 913.19s |  This is one here where it's a it's a fair for
914.01s - 918.81s |  $727 a normal return what we and with the surcharge of you know close to 60%
920.21s - 926.41s |  So what happens is if we actually add a another segment that's compatible there and and and break that
927.21s - 928.45s |  application
928.45s - 930.45s |  it will
930.81s - 936.77s |  You know what you're doing is you're actually adding, you know another fare on there and it's pushing the base price up
936.77s - 939.93s |  But because the surcharge was so low. It's actually dropped your price down
940.45s - 941.61s |  You know
941.61s - 944.61s |  You've added a hundred pounds in this instance, but you've lost
945.25s - 948.51s |  It's you know miscalculated the price by 260
949.89s - 952.05s |  Another thing that's this sort of interesting is the way
952.85s - 958.29s |  Because of the competitive nature of markets how there is sometimes arbitrage opportunities
958.29s - 960.45s |  But this can be a bit of effort like you you know
960.45s - 962.01s |  You might have to see if to start your ticket there
962.01s - 965.37s |  So like but sometimes it could be worth it like for instance if you're in Hong Kong
965.37s - 969.55s |  You want you know, you start your journey in Japan or you're in the US and you start it in Canada
969.55s - 971.55s |  But these things fluctuate and change
972.51s - 976.11s |  Another thing to look for is some of these countries with unstable currencies
977.35s - 981.51s |  Some ticket, you know, sometimes they or fixed exchange rates for instance Egypt
981.91s - 987.23s |  Changed their official exchange rate by 50% and there was some you know, good deals that came out of that
987.91s - 993.63s |  For a period but a lot of the other countries actually publish in euros or US dollars that have unstable currency
993.63s - 995.63s |  So it's not a doesn't happen all the time
996.63s - 1002.67s |  Another one that's I guess a bit more another vulnerability that's been a bit more popularized and talked about
1003.83s - 1009.95s |  Over the last 10 years is the is hidden city ticketing. This is a you know, a very well-known practice
1009.95s - 1015.47s |  That's you know that all airlines sort of hate, you know bash up agents if they try and do it, right?
1015.55s - 1021.03s |  But essentially you can see here if you're comparing this this is a Delta flight
1021.71s - 1025.99s |  You're trying to go to Atlanta, right, but if you look directly it's gonna be close to $200
1026.03s - 1029.19s |  But but when when a Nashville flight is tacked on to the end of it
1029.19s - 1032.19s |  It actually, you know, it's less than half
1032.39s - 1038.99s |  now the reason for that is I guess business customers want to fly direct generally people pay more for a direct and whatever competitions in
1038.99s - 1042.61s |  The different markets so they want to fill those seats, but not do it
1043.87s - 1048.97s |  The issues with these kind of things is that it is generally against the terms of conditions of carriage
1049.29s - 1053.93s |  And what they also do is if people are checking bags, they don't they don't short check it to you destination
1054.01s - 1056.85s |  That is of course unless you have an overnight or longer layover
1056.89s - 1062.17s |  so if the fare is actually flexible what and you're you could be totally within the rules by
1062.65s - 1065.89s |  Booking one of these and say well, I'll go to Nashville for a weekend
1065.89s - 1069.49s |  You know three weeks, you know in three weeks because you live in Atlanta for instance
1069.49s - 1074.31s |  So sometimes you can make these things work without without actually, you know breaking the rules
1076.01s - 1078.01s |  Another thing I'll talk about is
1078.29s - 1082.37s |  Mistake fares. So sometimes you see things in the press. There's been a few good ones where
1083.85s - 1085.85s |  You know that they will
1086.61s - 1089.91s |  in a first class of 500 bucks return from Asia or whatever because
1090.25s - 1095.05s |  someone's either the often to see that the route they allowed routing has been there's a mistake or
1095.29s - 1100.81s |  The base fare has been uploaded incorrectly because it's still I believe it's still kind of manual in a lot of ways
1100.81s - 1106.13s |  There's still a lot of spreadsheets that are used. So in the past the USD OT used to be very
1106.93s - 1110.77s |  Aggressive in enforcing this legislation on post purchasing price increase
1111.01s - 1116.49s |  But in 2015 what happened was there was a very large issue with United if you Google you
1116.73s - 1118.53s |  You might be able to find some more information
1118.53s - 1122.69s |  But essentially this issue was they published in Danish Corona?
1122.69s - 1126.45s |  They made a mistake where it was a divide by 1,000 issue on the base fare
1126.57s - 1131.93s |  now this is because Dana in the Danish Corona uses the comma as a decimal point rather than a
1132.85s - 1137.41s |  Period right. So the key thing to know out of this now is that
1138.61s - 1145.25s |  that they're they're allowing airlines to eat more easily get out of these these fares if they demonstrate it was a
1145.57s - 1148.09s |  Mistaken fare now one of the ways they would do that
1148.09s - 1152.41s |  I guess is there's a lot of blogs and stuff that sort of try to profit off this and
1153.61s - 1155.61s |  Yeah, so I mean it
1155.89s - 1158.77s |  As roaring kitty would say as to me. I like the fair
1158.77s - 1162.81s |  It's just a good fair because sometimes you don't understand. It's hard to understand I guess
1163.49s - 1170.69s |  When they you often see them publishing base fares of $1 for transatlantic flights like hat. How do you know necessarily?
1172.01s - 1178.69s |  So if you're an airline, what could you do? Right? So they have a thing called an agency debit debit memo. Now, that's a
1179.41s - 1181.97s |  You can find those policies online as well
1181.97s - 1187.25s |  most airlines publish them and that also will show you sort of conditions of what they're actually looking for and how they go after travel
1187.25s - 1193.49s |  Agents that maliciously do stuff the example of what a travel agent might do is hold stuff on a fictitious name
1193.49s - 1197.09s |  So like, you know, wait, you know like how you can do free holds for instance
1197.09s - 1201.81s |  They're basically holding the seats and then they without and then they cancel it and rehold it, you know
1202.17s - 1206.57s |  So they think they do chargebacks for that and there's like it's like a credit cards chargeback
1206.57s - 1211.99s |  There's like a processing fee attached to that. But I guess my other point is that they could kind of think like us
1212.87s - 1219.43s |  You know, I think fraud teams and other teams could learn a lot from how what we the advanced detections and things we run in socks
1220.23s - 1224.47s |  because in a lot of ways a lot of the detection stuff is similar and we're just used to
1225.79s - 1227.99s |  hackers and impossible travel and things like that and
1229.15s - 1230.95s |  sort of finally
1230.95s - 1233.55s |  If this if you'd be interested by this you want to know a bit more
1235.19s - 1236.63s |  It's great to be out of those
1236.63s - 1241.47s |  It's sometimes hard to get the same visibility into all these things that they look like a travel agent would get
1241.99s - 1245.67s |  But with the with those tools like expert flyer that I showed before
1246.11s - 1250.15s |  KBS tool they like subscription ones where you can actually get sort of read-only access
1250.31s - 1255.87s |  But it's it's not a hundred percent what you can do and they don't actually can't support pricing
1256.39s - 1260.79s |  But another one that's great. It's really really good is the ITX matrix
1261.25s - 1267.27s |  So that that will actually give you sort of a full pricing engine that you can it was basically the back end for Google was
1267.27s - 1273.03s |  The back end for Google flights at one stage and what I like about that is that you can put really advanced pairing specs in
1273.03s - 1275.03s |  There so you can say only show me
1275.51s - 1282.71s |  Only use like for the calculation only use fares or any show me stuff that's compatible with this particular fair basis code
1284.35s - 1289.13s |  Lock it down to all that sort of stuff and the even better thing is that you can actually turn off the availability checks
1290.87s - 1294.39s |  Because to get more better CPU use of your CPU time
1294.67s - 1296.67s |  So with that I
1297.99s - 1302.47s |  Guess to say thanks for everyone. I've got a few more things here if people are interested
1303.19s - 1310.31s |  Particularly recommend that the MIT. I guess it was for a computing course, but that MIT's computational complexity of air travel planning
1310.83s - 1312.83s |  Really really good. I
1312.83s - 1314.83s |  wouldn't like to talk about that, but I
1315.35s - 1317.35s |  hope that's a bird's-eye
1317.39s - 1318.91s |  overview and
1318.91s - 1322.17s |  If you have any questions come see me at the bar or something good
1323.13s - 1327.89s |  Now conscious of time let's crack on I want to talk today about electronic flight bags
1328.41s - 1333.49s |  But before we go there a little bit about me. I am a pilot. I'm a really bad pilot
1333.49s - 1336.81s |  I've landed at the wrong runway before so never fly with me
1336.81s - 1341.13s |  But I also am part of a company called pen test partners where we do a lot of red teaming
1341.13s - 1345.17s |  But also a lot of embedded system work. We've got multiple pilots on the team
1345.17s - 1349.01s |  So we do quite a bit with airplanes and over the last few years
1349.01s - 1351.53s |  We've learned how to hack or not hack airplanes
1353.13s - 1359.01s |  Before we start though, it's really really important that we disclose vulnerabilities in aviation
1359.97s - 1361.21s |  responsibly
1361.21s - 1365.45s |  There's something about hacking planes that drives the media into a frenzy
1365.45s - 1371.01s |  You say plane hacking they go crazy and a result it damages industry and I think it makes us less safe
1371.69s - 1377.27s |  My wife is a lousy flyer. So the last thing I want to do is make her more scared of flying
1379.01s - 1381.61s |  It does take a long time to fix bugs in aviation
1381.61s - 1386.93s |  I'll explain why in a bit but the most important thing you cannot do you cannot hack an airplane
1387.13s - 1391.45s |  Sat in your seat in coach. It doesn't work like that
1392.33s - 1398.13s |  There have been some issues over the years with the media going crazy with stories about hacking airplanes. I'm not gonna dwell on those
1399.05s - 1403.97s |  But before we start, how do you connect to an airplane? Well, there are lots of different interfaces
1403.97s - 1407.89s |  We all want in-flight Wi-Fi nowadays, but pilots have had that for years
1408.09s - 1414.03s |  You've got maintenance access. You've got quick access recorders that now spin up over Wi-Fi
1414.17s - 1417.85s |  But just to prove that point you cannot hack an airplane from the cabin
1417.85s - 1424.37s |  And the reason for that is we have really good network segregation in the bit in the back the bit that we sit in
1424.77s - 1429.17s |  That's called the passenger information entertainment services domain and we consider it to be dirty
1429.69s - 1434.45s |  Up front. We have the aircraft control domain, which is really sick. It sounds secure
1434.61s - 1438.33s |  Really well segregated and completely isolated from the other networks
1438.33s - 1441.77s |  But the one I want to look at at the moment is the electronic flight bag
1441.77s - 1448.57s |  Which was one of the systems the pilots use and connect to with connectivity. So what is an EFB? Well
1449.41s - 1453.13s |  Last time you boarded an airplane and you look left into the cockpit as you walked in
1453.13s - 1458.89s |  Did you see the pilots had a tablet? Maybe it was a little computer. Maybe it was an iPad or maybe a an Android tab
1458.97s - 1464.93s |  It's essentially a device that they use to make their operations safer and more efficient
1465.21s - 1467.67s |  So there's lots of different things that an EFB does
1468.25s - 1472.25s |  It's for example, it has your roster your passenger list
1473.09s - 1480.13s |  It has your weight and balance so you can make sure the airplane is properly balanced and within its performance envelope, but most importantly
1481.13s - 1483.13s |  We're still there. I just lost audio
1483.81s - 1487.22s |  Can we have a there we go? We're back again
1487.38s - 1493.86s |  Most importantly it also is used to calculate your calculate engine performance or Perth
1494.30s - 1496.02s |  now performance
1496.02s - 1502.26s |  You might not appreciate this. It's very rare that we use full power when we take off really rare
1502.26s - 1508.30s |  and the reason we don't is we don't want to burn lots of fuel because it's expensive and bad for the environment and we also
1508.54s - 1513.62s |  Don't want to wear the engines much. So if you use less power if we've got lots of runway
1514.10s - 1520.84s |  We're not very heavily loaded we use a D rate or a what's called a flex temp in Airbus or a D rate with Boeing planes
1521.90s - 1526.34s |  and we calculate that using lots and lots of different data sources like the wind the weight the
1526.78s - 1531.26s |  Pressure altitude of the runway all sorts of things that tell us how much power to use on departure
1531.86s - 1535.98s |  But before we go there, I want to look at some of the bugs things that have gone wrong not hacks
1535.98s - 1537.82s |  Just things that have gone wrong
1537.82s - 1542.10s |  There's all sorts of examples of things that have just gone wrong. For example Raven air
1542.10s - 1548.58s |  They used a digital maintenance system and they got ransomed and their backup got ransomed as a result of that
1548.58s - 1551.60s |  They couldn't prove the airplanes were airworthy. So they didn't fly
1553.10s - 1560.26s |  American had a lockup on their electronic flight bags. There was a duplication in one of the Jefferson databases
1560.26s - 1564.30s |  I think they duplicated the chart. So the map of the runways
1564.98s - 1569.86s |  Reagan National and it caused the entire application to lock up and a lot of airplanes didn't move that day
1570.58s - 1574.18s |  Southwest had a bug a few years ago. They lost their their weather feed now
1575.10s - 1577.82s |  Pilots, you can't just look out the window. See what the weather's doing
1577.82s - 1581.82s |  You need to know what it's doing up there and also where you're going and you need that weather feed no weather
1581.82s - 1583.82s |  No flying. They've a lot of flights didn't go
1584.90s - 1589.26s |  Mistakes happen with weight and balance as well. This is a really interesting instant. It's published
1589.26s - 1595.54s |  You can go and read it yourself and the airplane type was changed at the very last minute from a Airbus a320 to an Airbus
1595.54s - 1597.18s |  a321
1597.18s - 1603.74s |  primary difference is it's longer but the load sheet wasn't changed to all the passengers from the shorter plane were loaded at the front and
1604.14s - 1606.14s |  The airplane ended up out of balance
1606.46s - 1612.22s |  Pilot goes down the runway tries to rotate on the stick and nothing happened. There's not very much runway left
1612.22s - 1614.22s |  What do you do? You've passed v1
1614.50s - 1618.02s |  You've got to VR. You're not a v2. So you can't really fly away yet
1618.62s - 1625.54s |  So the pilot very sensible individual gave it full power toga and the airplane took off
1626.50s - 1633.06s |  Primarily to do with the increased rotation moment because the engines dangle off the wings so they got away
1633.58s - 1634.98s |  Because they gave it full power
1634.98s - 1640.46s |  But yeah, that was a really very nearly very nearly serious instant another one to do with performance
1640.46s - 1643.78s |  This was a confusing instant that happened at Lisbon Airport
1644.58s - 1647.34s |  Now there was some runway intersection markers
1647.42s - 1652.06s |  So quite often on the short-haul flights, you might see they don't line up for the whole runway
1652.06s - 1654.06s |  They go from a displaced threshold, right?
1654.06s - 1658.62s |  They they run maybe halfway along the runway sometimes and they don't need the whole runway. So it's quicker
1659.62s - 1662.06s |  But the intersection markings were a bit confusing
1662.06s - 1667.38s |  They've been renamed they were given temporary names and when pilots were putting them into their flight bag to do their performance
1667.78s - 1673.82s |  Calculations from the engines the calculator thought there was more runway than they actually had. So I said, hey we need less power
1673.82s - 1677.70s |  We've got more runway and over a period of a couple of weeks eight flights
1678.38s - 1681.86s |  Very nearly didn't make it out of Lisbon. Now that was all fixed, which is great
1682.66s - 1684.66s |  We lost that audio again
1686.90s - 1688.90s |  Audio yeah, there we go. We're back good
1689.50s - 1694.26s |  Very interesting incident happened earlier this year. This was Alaska. They had two tail strikes
1694.26s - 1698.26s |  So they hit the back of the airplane when they were trying to take off on January 26th
1699.02s - 1703.90s |  Amazing response. So within the matter of minutes they realized there was an issue had a ground stop
1704.22s - 1709.30s |  Awesome awesome response from the airline and what had gone wrong. There was a software bug in one of their flight bag
1709.90s - 1714.14s |  Applications there was miscalculating their load. Therefore not enough power was going on
1714.26s - 1716.82s |  There was another one that happened on April 17th
1716.82s - 1723.46s |  They had a related application issue with weight and balance, but actually I was really impressed just how quickly they responded to this
1724.38s - 1726.06s |  But things do go wrong sometimes
1726.06s - 1730.82s |  so this is an airplane that had a really nasty tail strike tore the backside out of the plane and
1731.46s - 1737.98s |  yeah, they didn't realize they'd had that tail strike until they tried to pressurize the aircraft and it wouldn't pressurize and
1738.30s - 1740.58s |  They have very sadly been deaths
1741.46s - 1747.60s |  The picture on the right is from an incident report a crash that happened in Canada a very tired
1747.98s - 1749.62s |  747 freight crew
1749.62s - 1751.62s |  miscalculated the amount of weight they had on board and
1751.70s - 1758.66s |  Very sadly the airplane never made it airborne went straight through the instrument landing system and sadly burst into flames a very very sad incident
1759.10s - 1764.86s |  It also happens on landing as well when we land in commercial airliners. We don't want to use too much break
1765.46s - 1769.74s |  Because brake pads are expensive that carbon fiber. We don't want to use too much
1770.30s - 1776.82s |  so we'll typically use an auto brake setting that's related to our weight the length of the runway the amount of headwind we got all
1776.82s - 1778.42s |  sorts of cool things and
1778.42s - 1781.78s |  this is Quito Airport very difficult approach surrounded by hills and
1782.74s - 1787.50s |  Overstressed pilots used the wrong auto brake setting from their calculations and over around the end of the runway
1787.50s - 1792.06s |  They chose auto land. So auto brake 2 and they should have been using auto brake 4
1792.94s - 1794.98s |  So where I'm getting to with all of this is
1796.26s - 1803.58s |  Could you cause an incident like that as a result of a hack and we found some bugs that we think could in
1804.30s - 1805.90s |  certain scenarios
1805.90s - 1808.14s |  So the first major problem you need to know about those
1808.78s - 1814.82s |  Computers those tablets that the pilots are using you might be really surprised to know about the quality of the lockdown on those devices
1815.54s - 1817.06s |  Sometimes we'll find
1817.06s - 1819.06s |  EFBs with no pin or
1819.98s - 1821.98s |  The pilots birthdates or
1822.82s - 1825.30s |  On smaller operators you find no MDM
1825.30s - 1832.38s |  No real lockdown even some small operators have sent their pilots off to Best Buy to buy the tablet for themselves Wow
1833.14s - 1835.06s |  But also there's a lack of
1835.06s - 1842.58s |  Proper understanding on the ground cyber security experts in the air pilots. Sometimes those interactions don't go so well and good examples of that
1842.58s - 1848.86s |  Hey, let's use face ID. Let's use face ID to make my EFB nice and secure
1848.86s - 1855.26s |  So it's really easy great. Unfortunately pilots have a habit of wearing mirrored sunglasses, which does not work
1855.26s - 1862.74s |  Well with face ID, I promise you and the one time you probably need your electronic flight bag more than anything is when shit goes down
1863.10s - 1865.26s |  Maybe you have a depressurization events
1866.10s - 1870.78s |  You go to your electronic quick reference handbook, which is of course on your iPad
1870.78s - 1875.46s |  But you're wearing an oxygen mask because the oxygen is just flown out of the door plug
1876.46s - 1879.94s |  Not a good day, right so we really need to think carefully about how we unlock things
1880.18s - 1882.78s |  so first of all, we've got problems with local lockdowns and
1883.62s - 1884.58s |  with
1884.58s - 1887.14s |  Physical access to an EFB for a short period of time
1887.14s - 1891.34s |  We found some interesting bugs and I'm going to walk you through one of the very first we found was in Boeing
1891.50s - 1896.62s |  OPT on board performance tool and this is the tool that's used to calculate performance
1896.62s - 1900.70s |  So you'll spit in a bunch of data and it'll give you your V speeds
1900.70s - 1904.38s |  So V one the point at which you can break and stop without going off the end
1905.30s - 1906.34s |  VR
1906.34s - 1913.34s |  Rotation v2 the point at which you can climb away safely with any one engine that spot between V 1 and V 2 is kind
1913.34s - 1915.34s |  Of squeaky bum time if it all goes wrong
1915.38s - 1918.34s |  Now that's actually a photograph of one of Boeing's tools
1918.34s - 1920.14s |  They brought it along to RSA a couple of years ago
1920.14s - 1925.34s |  Really really cool thing to do and we discovered that the database had no integrity text
1925.34s - 1928.26s |  So with a few moments physical access you could change the data
1928.50s - 1932.38s |  You could make the runway look longer than it actually was and therefore it spit out the wrong data
1932.74s - 1938.70s |  You could extend the runway and then the V speeds went wrong and the pilots would use the wrong amount of power for departure
1939.46s - 1940.94s |  Good news
1940.94s - 1945.66s |  Boeing handle it brilliantly. I could not have asked for a better response to this vulnerability
1945.66s - 1948.86s |  It's kind of good news for buying which I think they kind of need at the moment. I don't know
1949.54s - 1951.54s |  It was a really good experience. They
1952.34s - 1954.50s |  Responded to us really quickly. They acknowledged it
1954.50s - 1957.68s |  They gave us a call every month to say this is how we're doing it and said by the way
1958.36s - 1965.12s |  It's gonna take two years to fix it like what you know, Google project zero that's 90 days, right and you drop it like it's hot
1966.16s - 1974.36s |  Aviation is different. It took him a couple of weeks to fix the bug. It took him a couple of years to recertify the code
1975.24s - 1978.36s |  Because you can't just go and update aviation systems
1978.36s - 1981.72s |  You need to recertify them to make sure they are safe in
1982.00s - 1987.04s |  Absolutely every possible scenario and that was fine and they published it and it was all good. They got it sorted
1987.68s - 1989.68s |  Another bug. This is a
1990.48s - 1991.92s |  semi-installed
1991.92s - 1998.72s |  BFB it was a kiosk and a 747 we looked at and it was unbelievably poorly secure so you could break out
1999.12s - 2003.92s |  Password was password great and there were two of them for redundancy purposes
2004.32s - 2009.68s |  But they were networked together and it was easy to compromise one from the other so that removed the value of having
2009.96s - 2013.56s |  Redundancy and a cross-check because you could hack them both to spit out the same wrong data
2014.88s - 2016.88s |  This was funny
2017.68s - 2021.96s |  Had a USB port on it and a sticker saying not to use it. Okay
2024.00s - 2030.08s |  Now this vendor never ever engaged properly actually Boeing even gave him better kick on our behalf
2030.08s - 2034.44s |  They intervene to try and help it along still nothing and actually after 18 months
2034.44s - 2038.36s |  We agreed with the aviation ISAC, which is the industry's cyber security and sharing body
2038.92s - 2044.84s |  That actually it was reasonable to disclose in public once we told the airlines about it first and they helped us do that
2044.84s - 2046.36s |  That was really cool
2046.36s - 2048.64s |  What about some new things so we've done Boeing
2049.32s - 2055.48s |  Let's talk about Airbus. So this is Airbus nav blue fly smart LPG
2055.88s - 2060.00s |  LPC NG there are more TLA's in aviation than there are in cyber security
2060.48s - 2067.76s |  LPC less paper cockpit NG next generation nav blue is a company that's been acquired by Airbus and we found a bug
2068.24s - 2074.84s |  Almost exactly the same as Boeing OPT so you can tamper with the runway databases and make pilots use the wrong amount of power
2075.00s - 2078.10s |  So it's spit out the wrong information pilots do the wrong thing
2078.32s - 2084.20s |  So we started vulnerability disclosure and you're probably looking at going that's 2021 Ken. Yes, it is
2084.84s - 2088.56s |  So we sent it to Airbus. They've got a great piece of team. We sent it to them
2088.56s - 2093.60s |  They came back to us quickly. They replied to us after a month and said yeah, it's the operators problem
2093.60s - 2100.28s |  I'm summarizing about four pages of email here. But yeah, that's that's not a problem. That's that's for the airlines
2101.28s - 2103.28s |  Okay, that's a novel discussion
2103.44s - 2107.32s |  So we started going into some of the regulations and I'm not going to talk about
2107.60s - 2110.76s |  EFB regs because they're really complicated but they are different around the world
2111.28s - 2115.56s |  IASA European Aviation Safety Agency has is actually fairly
2116.16s - 2120.08s |  Robust on EFB regs FAA slightly different installed
2120.56s - 2126.76s |  EFBs completely different set of regulations to a portable EFB and the Civil Aviation Authority in my home country
2127.04s - 2129.04s |  Also has a different set of regs as well
2129.60s - 2136.36s |  So we look at looked at the regs and found AMC 2025 at AMC additional means of compliance
2136.36s - 2140.32s |  so this is basically the regulation that you're supposed to follow when you're keeping your
2141.28s - 2148.36s |  EFB software up-to-date and actually said you're supposed to do an integrity check and that's the one thing we thought was missing great
2149.20s - 2154.68s |  so we had another call with Airbus and said hey, we think you're not following the regs and
2155.44s - 2162.08s |  This is a really weird conversation where they said we're not going to fix it because we've analyzed your vulnerability and decided that fixing it
2162.08s - 2164.08s |  Would be a product improvement
2164.20s - 2168.84s |  I've got that in writing long version. Basically. We had a near argument with their
2169.72s - 2170.92s |  engineering team and
2170.92s - 2176.56s |  They told us that it didn't matter because you'd have to hack both EFBs at once because pilots cross-check on both
2176.56s - 2181.08s |  Well, they don't actually they use one typically one pilot will do the entry of the data
2181.52s - 2187.04s |  Passed to the co-pilot and they will verify the data entry then make the calculation and to prove that most
2188.76s - 2194.00s |  Planes now have a minimum equipment list that only requires one EFB. So that was a shame. So
2195.44s - 2198.12s |  we pushed over the period of a year and
2198.92s - 2205.32s |  They came back and said yeah, it's we've evaluated it. We consider it as a product improvement. So we're not going to fix it. Okay
2206.44s - 2208.44s |  And then one of our friendly
2208.92s - 2212.56s |  Airline clients said you know what you could do you could have a chat with the regulator
2212.56s - 2216.16s |  I'm like, why didn't we think of this before have a chat with the regulator?
2216.72s - 2219.96s |  so we spoke to EASA who are lovely by the way, and
2220.56s - 2224.92s |  We said we've got this vulnerability and Airbus have said they won't fix it. I'm like
2225.72s - 2231.56s |  What do you think and they said hmm? I think we agree and then miraculously on 10th of April. It's been fixed
2231.76s - 2236.12s |  It's amazing what happens when you get the regulator involved, isn't it? So it has been fixed, which is great
2236.12s - 2237.64s |  Which is why we're talking about it now
2237.64s - 2242.20s |  But why was it so hard? I think some of it is around
2243.12s - 2245.12s |  some of the struggles between
2245.56s - 2247.56s |  flight safety and
2248.52s - 2254.56s |  Engineering and cybersecurity because some of those are competing interests. It's so critically important same problem. We see an OT
2255.52s - 2257.52s |  cultural separations between
2258.48s - 2260.48s |  cybersecurity and safety engineering I
2261.08s - 2263.80s |  Think there was also a bit of a reluctance to acknowledge it
2263.80s - 2267.32s |  I've spoken to Airbus a few times about this and they've never publicly acknowledged
2267.68s - 2272.68s |  The detail of this vulnerability and what's really weird is actually Airbus have got a really good reputation
2273.40s - 2279.72s |  With their customers for being really engaging with them on cybersecurity. They've got test rigs all sorts of stuff
2279.72s - 2283.00s |  It's actually they do some really cool things. So we don't understand
2283.64s - 2288.76s |  Why we had to involve the regulator here. There's another bug we found this was well handled by them
2288.84s - 2291.32s |  This is a slightly different set of the package
2291.32s - 2297.54s |  It's called fly smart plus and the updater for the iOS app had intentionally had ATS disabled
2297.54s - 2301.06s |  So application transport security, they turned it off which meant weirdly
2301.94s - 2304.78s |  You could man the middle over Wi-Fi and tamper with the updates
2305.74s - 2310.62s |  Unlike attacks over Wi-Fi really, but actually there's one odd thing about pilots
2310.62s - 2313.38s |  Does he always stay in the same damn layover hotels every night?
2313.54s - 2318.34s |  You can guarantee that layover hotel is gonna have a pilot from their airline in so actually, you know
2318.34s - 2321.14s |  Where they're going to be so maybe a Wi-Fi attack is a bit more plausible
2322.14s - 2324.22s |  Another one so a Lufthansa
2324.42s - 2330.62s |  This is actually the Lufthansa systems part of the business that produce a really good charting application called eRoute manual
2330.86s - 2332.86s |  used by loads and loads of
2333.10s - 2339.10s |  Airlines, and we had a very similar issue whilst they did have a an integrity check
2340.06s - 2344.74s |  Unfortunately, the key for that integrity check was one two, three, four five six seven eight
2345.86s - 2350.10s |  Nine ten twice and so we flagged this to them. They said yeah, that's great
2350.10s - 2352.38s |  We got we agree with you. We disclosed it to them
2352.42s - 2357.02s |  What it meant was you could tamper with for example approach plates so you could tamper with
2358.42s - 2361.66s |  I'll walk you through this. So this is a how you approach
2362.42s - 2368.50s |  To an airport so you're supposed to arrive at 5,000 feet at DME 14 to the BRA VOR
2368.50s - 2371.18s |  That's your initial fix your safety heights now
2371.78s - 2375.34s |  4,600 feet till you get the top of descent D at DME 12.4
2375.54s - 2380.34s |  You then descend on 170 degree heading to a safe point at your final fix at
2380.98s - 2386.70s |  3,900 and then you can go down to your minimum descent altitude to the point of getting to the middle marker at DME 4
2386.70s - 2390.38s |  So four miles from the airport at which point you either go around or you land
2390.46s - 2396.62s |  We discovered you could tamper with all those so you could convince the pilots to go lower and potentially have a control flight into the
2396.62s - 2398.62s |  Ground. I hope that doesn't happen
2398.74s - 2400.34s |  They were awesome
2400.34s - 2405.46s |  It took him two years, but they were really good really engaging and have since asked us out to give some talks to them
2406.82s - 2408.74s |  Yeah
2408.74s - 2413.06s |  So that is me and EFBs. I want to give a very quick rattle around airports next
2414.14s - 2416.14s |  the other side of things
2416.38s - 2420.46s |  Airports are incredibly complicated places with lots of really interesting things going on
2421.10s - 2427.46s |  We were asked by one aviation one Airport. Sorry to look at their departure boards. We said, yeah, we've got bugs in those
2427.46s - 2433.14s |  We think we can inject our own flights and completely tamper with everything. They said what a cool organization said go on then
2434.06s - 2436.30s |  Put a flight on our boards. So we did
2437.26s - 2441.70s |  But of course that was just proving the point we could have trashed that system and then there would have been chaos at the airport
2443.02s - 2444.74s |  Runway lighting is also a major issue
2444.74s - 2451.14s |  We know of one airport where their runway lighting controllers were airside and then they expanded the parking lots and they ended up
2451.30s - 2456.74s |  Landside and then someone came along and stole all the controllers and the runway light stopped working. Oops
2457.50s - 2458.42s |  These are really good fun
2458.42s - 2461.58s |  If you ever fly into Heathrow's Terminal 5 they use robot pushback tugs
2462.02s - 2465.34s |  Never got to have a go at them haven't managed to pen test them yet
2465.34s - 2470.02s |  But I'm really pushing BA and IAG to see if we can have a pop really interesting devices
2470.74s - 2476.86s |  Fueling is also a major problem. There's two primary providers. It's all API based all done through tablets
2476.86s - 2481.96s |  I think there's a really interesting set of research to be done there and ground power is a major problem as well
2483.22s - 2485.42s |  I'm not going to talk about spoofing ADS-B
2485.42s - 2486.90s |  I'm not going to talk about that either
2486.90s - 2493.30s |  But what I really wanted to get to here is if you're doing research in aviation, please make sure you disclose it responsibly
2493.54s - 2500.02s |  Don't drop it like it's hot in the public. It's not going to be possible to fix that bug and publish it 90 days data
2500.02s - 2503.54s |  It's gonna take a while if you're struggling to get
2504.10s - 2505.82s |  airlines or
2505.82s - 2508.78s |  Manufacturers to listen to you. There's a couple of really awesome routes
2508.78s - 2512.30s |  You can go so the Aviation ISAC will help broker vulnerability disclosure for you
2512.34s - 2517.98s |  If you're struggling to the DEFCON aerospace village wherever there we help found it we will help you as well
2517.98s - 2522.94s |  There's lots of really cool organizations that can help you disclose vulnerabilities to airline and get things
2524.30s - 2525.74s |  fixed
2525.74s - 2527.50s |  Planes are very complicated
2527.50s - 2533.90s |  They're really really important safety engineering in there. So it does take a while to get the bugs fixed. So just bear with
2534.90s - 2536.90s |  whilst they fixed it safely and
2537.62s - 2544.66s |  Responsibly it would be lovely just to push an update wouldn't it but the chance of blue screening a plane. Should we just not go there?
2545.22s - 2549.58s |  Anyway, that is me. Hope you found it interesting. That's my email. That's the firm I work for
2549.58s - 2552.06s |  We're over in the aerospace village. If you want to come and have a chat
2552.06s - 2554.62s |  We've got a flight simulator to play with but thank you so much


