# MediaChunks

chunk_id: 135_chunk_132
chunk_text:
7125.84s | that don't have black badges 7125.84s - 7128.44s | on the 30th anniversary winning team. 7128.44s - 7130.60s | We should give them two black badges. 7131.56s - 7146.04s | So, come up and get those two black badges, Hacker Jeopardy. 7146.04s - 7149.44s | 30 fucking years of Hacker Jeopardy, Jeff. 7150.80s - 7154.92s | Not many of you know that when we did Hacker Jeopardy one, 7154.92s - 7157.74s | Jeff was my van of vinyl. 7160.04s - 7163.60s | There are pictures, we will make sure that they are up. 7163.60s - 7167.60s | And Nikita has somehow tolerated our bullshit 7167.60s - 7169.64s | for how many years now? 7169.64s - 7173.12s | Grifter and DT, the support that we've had. 7173.12s - 7178.12s | And you guys, you've made this 30 years absolutely amazing. 7179.72s - 7183.16s | And as long as I fucking stay vertical, 7183.16s - 7185.56s | you can't get rid of me. 7185.56s - 7188.16s | We will return, Hacker Jeopardy. 7188.16s - 7190.92s | 30 fucking years, thank you all. 7191.20s - 7196.20s | This year, it came down at the very end. 7196.64s - 7200.00s | We had three teams for the final. 7200.00s - 7202.20s | And everybody could have won. 7202.20s - 7204.40s | Everybody could have won. 7204.40s - 7207.92s | And the final category was to do some sort of bullshit, 7207.92s - 7212.40s | figuring out what all the OSI layers were 7212.40s - 7214.20s | in reverse alphabetical order. 7214.20s - 7218.20s | So one of the teams got it absolutely right, 7218.20s - 7220.62s | not in the form of a question. 7221.12s - 7226.12s | Another team got it absolutely right, 7227.56s - 7230.30s | but not in reverse order. 7232.12s - 7235.28s | So the only team that got it right is, 7235.28s - 7239.32s | my other computer is your stepmom. 7239.32s - 7240.64s | Let's hear it for them. 7254.11s - 7255.31s | Congratulations, guys. 7258.47s - 7259.63s | Make it weird for them. 7260.67s - 7267.08s | All right, and last but certainly not least, 7267.60s - 7271.32s | I say this every year, they need no introduction, 7271.32s - 7272.32s | capture the flag. 7281.69s - 7283.57s | Good afternoon, DEF CON. 7283.57s - 7285.37s | We are Nautilus Institute, 7285.37s - 7288.25s |


chunk_id: 135_chunk_133
chunk_text:
had three teams for the final. 7200.00s - 7202.20s | And everybody could have won. 7202.20s - 7204.40s | Everybody could have won. 7204.40s - 7207.92s | And the final category was to do some sort of bullshit, 7207.92s - 7212.40s | figuring out what all the OSI layers were 7212.40s - 7214.20s | in reverse alphabetical order. 7214.20s - 7218.20s | So one of the teams got it absolutely right, 7218.20s - 7220.62s | not in the form of a question. 7221.12s - 7226.12s | Another team got it absolutely right, 7227.56s - 7230.30s | but not in reverse order. 7232.12s - 7235.28s | So the only team that got it right is, 7235.28s - 7239.32s | my other computer is your stepmom. 7239.32s - 7240.64s | Let's hear it for them. 7254.11s - 7255.31s | Congratulations, guys. 7258.47s - 7259.63s | Make it weird for them. 7260.67s - 7267.08s | All right, and last but certainly not least, 7267.60s - 7271.32s | I say this every year, they need no introduction, 7271.32s - 7272.32s | capture the flag. 7281.69s - 7283.57s | Good afternoon, DEF CON. 7283.57s - 7285.37s | We are Nautilus Institute, 7285.37s - 7288.25s | third time organizers of DEF CON Capture the Flag. 7288.25s - 7291.61s | And I assure you, there are actually more than three of us. 7291.61s - 7295.13s | So kicking things off, once again, 7295.13s - 7297.09s | we partnered with LiveCTF 7297.09s - 7301.85s | to bring more audience enjoyable activities into our game. 7301.85s - 7305.63s | LiveCTF is the head-to-head speed hacking component 7305.63s - 7307.45s | of DEF CON Capture the Flag, 7307.45s - 7310.01s | where participants must battle head-to-head 7310.01s - 7311.27s | in a tournament for points 7311.27s - 7313.89s | that are added to their final score. 7313.89s - 7318.37s | You can see the full recaps online at livectf.com 7318.37s - 7322.83s | or scan this QR code, pretend, 7322.83s - 7325.29s | to go right to the final match. 7325.29s - 7327.89s | All challenges are already open source 7327.89s - 7330.61s | and linked from that site as well. 7330.61s - 7333.37s | Our favorite moment was in one of the first rounds 7333.37s - 7336.69s | where last year's winning team, Maple Mallard Magistrates, 7336.69s - 7339.97s | were knocked right down into the spirit world lower


chunk_id: 135_chunk_134
chunk_text:
third time organizers of DEF CON Capture the Flag. 7288.25s - 7291.61s | And I assure you, there are actually more than three of us. 7291.61s - 7295.13s | So kicking things off, once again, 7295.13s - 7297.09s | we partnered with LiveCTF 7297.09s - 7301.85s | to bring more audience enjoyable activities into our game. 7301.85s - 7305.63s | LiveCTF is the head-to-head speed hacking component 7305.63s - 7307.45s | of DEF CON Capture the Flag, 7307.45s - 7310.01s | where participants must battle head-to-head 7310.01s - 7311.27s | in a tournament for points 7311.27s - 7313.89s | that are added to their final score. 7313.89s - 7318.37s | You can see the full recaps online at livectf.com 7318.37s - 7322.83s | or scan this QR code, pretend, 7322.83s - 7325.29s | to go right to the final match. 7325.29s - 7327.89s | All challenges are already open source 7327.89s - 7330.61s | and linked from that site as well. 7330.61s - 7333.37s | Our favorite moment was in one of the first rounds 7333.37s - 7336.69s | where last year's winning team, Maple Mallard Magistrates, 7336.69s - 7339.97s | were knocked right down into the spirit world lower bracket 7339.97s - 7342.39s | due to an unintended solution. 7342.39s - 7346.41s | Always watch your stir and comps versus mem comps. 7346.41s - 7348.67s | Congratulations to Blue Water 7348.67s - 7359.11s | for an undefeated run through LiveCTF. 7359.11s - 7361.07s | All right, you know we've got to say thanks 7361.07s - 7363.31s | to a bunch of people who made this possible. 7363.31s - 7366.07s | So thanks to all the hardworking DEF CON goons 7366.07s - 7369.19s | in every department, Dark Tangent, Nikita, Grifter, 7369.19s - 7372.47s | Caves, Seacove, Aster, the rest of the DEF CON staff, 7372.47s - 7374.25s | especially the knock and sock goons 7374.25s - 7376.91s | who were extremely helpful with our 7378.75s - 7381.63s | sometimes very quick needs. 7381.63s - 7384.41s | Your work, dedication and creativity and ingenuity 7384.41s - 7387.81s | inspire us to continue to make a mountain worth climbing. 7387.81s - 7389.51s | This year's finals hosted teams 7389.55s - 7391.95s | that qualified from many contests. 7391.95s - 7395.95s | DEF CON CTF finals in 2023, HITCON in Taiwan, 7395.95s - 7399.03s | Plaid CTF in the US, OCTF in


chunk_id: 135_chunk_135
chunk_text:
bracket 7339.97s - 7342.39s | due to an unintended solution. 7342.39s - 7346.41s | Always watch your stir and comps versus mem comps. 7346.41s - 7348.67s | Congratulations to Blue Water 7348.67s - 7359.11s | for an undefeated run through LiveCTF. 7359.11s - 7361.07s | All right, you know we've got to say thanks 7361.07s - 7363.31s | to a bunch of people who made this possible. 7363.31s - 7366.07s | So thanks to all the hardworking DEF CON goons 7366.07s - 7369.19s | in every department, Dark Tangent, Nikita, Grifter, 7369.19s - 7372.47s | Caves, Seacove, Aster, the rest of the DEF CON staff, 7372.47s - 7374.25s | especially the knock and sock goons 7374.25s - 7376.91s | who were extremely helpful with our 7378.75s - 7381.63s | sometimes very quick needs. 7381.63s - 7384.41s | Your work, dedication and creativity and ingenuity 7384.41s - 7387.81s | inspire us to continue to make a mountain worth climbing. 7387.81s - 7389.51s | This year's finals hosted teams 7389.55s - 7391.95s | that qualified from many contests. 7391.95s - 7395.95s | DEF CON CTF finals in 2023, HITCON in Taiwan, 7395.95s - 7399.03s | Plaid CTF in the US, OCTF in China, 7399.03s - 7402.53s | and our own qualifiers hosted this May. 7402.53s - 7406.75s | Our qualifiers saw 1,700 teams submit hundreds of solutions 7406.75s - 7408.79s | to dozens of challenges. 7408.79s - 7412.51s | For finals, 12 teams flew in from dozens of countries 7412.51s - 7417.37s | to the largest DEF CON CTF venue yet. 7417.37s - 7420.33s | We built eight attack-defense challenges, 7420.33s - 7422.09s | one King of the Hill challenge, 7422.09s - 7423.61s | and our friend from Live CTF 7423.61s - 7426.65s | ran 22 head-to-head Live CTF matches. 7426.65s - 7428.91s | The scoreboard was busy the whole time, 7428.91s - 7430.61s | and first place was up for grabs 7430.61s - 7434.68s | up until the last hour of the game. 7434.68s - 7437.46s | In third place this year, we had Super Dice Code. 7440.84s - 7444.64s | There we go. 7444.64s - 7447.64s | In second place, and the winners of the Live CTF, 7447.64s - 7454.33s | we had Blue Water. 7454.33s - 7456.97s | And in first place, some of the only people in the world 7456.97s - 7460.01s | who have been on this


chunk_id: 135_chunk_136
chunk_text:
China, 7399.03s - 7402.53s | and our own qualifiers hosted this May. 7402.53s - 7406.75s | Our qualifiers saw 1,700 teams submit hundreds of solutions 7406.75s - 7408.79s | to dozens of challenges. 7408.79s - 7412.51s | For finals, 12 teams flew in from dozens of countries 7412.51s - 7417.37s | to the largest DEF CON CTF venue yet. 7417.37s - 7420.33s | We built eight attack-defense challenges, 7420.33s - 7422.09s | one King of the Hill challenge, 7422.09s - 7423.61s | and our friend from Live CTF 7423.61s - 7426.65s | ran 22 head-to-head Live CTF matches. 7426.65s - 7428.91s | The scoreboard was busy the whole time, 7428.91s - 7430.61s | and first place was up for grabs 7430.61s - 7434.68s | up until the last hour of the game. 7434.68s - 7437.46s | In third place this year, we had Super Dice Code. 7440.84s - 7444.64s | There we go. 7444.64s - 7447.64s | In second place, and the winners of the Live CTF, 7447.64s - 7454.33s | we had Blue Water. 7454.33s - 7456.97s | And in first place, some of the only people in the world 7456.97s - 7460.01s | who have been on this stage more than I have for CTF, 7460.01s - 7479.83s | Maple Mallard Magistrates. 7479.83s - 7481.07s | Good afternoon, everyone. 7482.15s - 7487.15s | We're thrilled and honored to be the DEF CON 32 CTF winners. 7487.19s - 7490.79s | It's a privilege to represent MMM, 7490.79s - 7494.75s | our amazing international team with PPP from the US, 7494.75s - 7498.95s | Daduk from Korea, and Maple Bacon from Canada. 7498.95s - 7502.11s | Winning three years in a row 7502.11s - 7505.63s | really shows the dedication, brainpower we have, 7505.63s - 7507.91s | and teamwork we've got. 7507.91s - 7511.87s | The past few days were intense and challenging, 7511.87s - 7514.91s | but that's what pushed us to our best. 7514.91s - 7516.79s | And of course, a huge thank you 7516.79s - 7518.87s | to the organizers and DEF CON 7518.87s - 7522.75s | for crafting such a dynamic and engaging competition. 7522.75s - 7525.19s | And to my two teammates, 7525.19s - 7528.11s | your hard work, skill, and passion 7528.11s - 7531.55s | are the reasons we're standing here today 7531.55s - 7533.55s | as champions once again. 7534.39s - 7535.35s |


chunk_id: 135_chunk_137
chunk_text:
stage more than I have for CTF, 7460.01s - 7479.83s | Maple Mallard Magistrates. 7479.83s - 7481.07s | Good afternoon, everyone. 7482.15s - 7487.15s | We're thrilled and honored to be the DEF CON 32 CTF winners. 7487.19s - 7490.79s | It's a privilege to represent MMM, 7490.79s - 7494.75s | our amazing international team with PPP from the US, 7494.75s - 7498.95s | Daduk from Korea, and Maple Bacon from Canada. 7498.95s - 7502.11s | Winning three years in a row 7502.11s - 7505.63s | really shows the dedication, brainpower we have, 7505.63s - 7507.91s | and teamwork we've got. 7507.91s - 7511.87s | The past few days were intense and challenging, 7511.87s - 7514.91s | but that's what pushed us to our best. 7514.91s - 7516.79s | And of course, a huge thank you 7516.79s - 7518.87s | to the organizers and DEF CON 7518.87s - 7522.75s | for crafting such a dynamic and engaging competition. 7522.75s - 7525.19s | And to my two teammates, 7525.19s - 7528.11s | your hard work, skill, and passion 7528.11s - 7531.55s | are the reasons we're standing here today 7531.55s - 7533.55s | as champions once again. 7534.39s - 7535.35s | Thank you, everyone. 7535.35s - 7537.75s | We can't wait to see you all again next year. 7537.75s - 7550.40s | Thanks. 7550.40s - 7551.24s | All right. 7551.24s - 7554.24s | So this is where I would like to thank 7554.24s - 7555.52s | all of our departments 7555.52s - 7558.52s | that have made this conference possible. 7558.52s - 7560.76s | And I'd also like to point out, 7560.76s - 7564.04s | none of us were ready to change locations 7564.04s - 7565.88s | so quickly six months ago. 7566.88s - 7568.84s | I haven't really told the story, but... 7569.44s - 7572.72s | So we'd had this really long-standing relationship 7572.72s - 7573.76s | with Caesars, 7573.76s - 7577.12s | and the main person that I would work with, 7577.12s - 7578.60s | I wouldn't talk to very often 7578.60s - 7580.44s | because things would be going right. 7581.36s - 7583.80s | And almost 20 years. 7583.80s - 7586.36s | And I get a call, I get a message, 7586.36s - 7590.08s | and like, hey, are you available for a call sometime? 7590.08s - 7593.04s | And I'm thinking, oh, I don't hear from him


chunk_id: 135_chunk_138
chunk_text:
Thank you, everyone. 7535.35s - 7537.75s | We can't wait to see you all again next year. 7537.75s - 7550.40s | Thanks. 7550.40s - 7551.24s | All right. 7551.24s - 7554.24s | So this is where I would like to thank 7554.24s - 7555.52s | all of our departments 7555.52s - 7558.52s | that have made this conference possible. 7558.52s - 7560.76s | And I'd also like to point out, 7560.76s - 7564.04s | none of us were ready to change locations 7564.04s - 7565.88s | so quickly six months ago. 7566.88s - 7568.84s | I haven't really told the story, but... 7569.44s - 7572.72s | So we'd had this really long-standing relationship 7572.72s - 7573.76s | with Caesars, 7573.76s - 7577.12s | and the main person that I would work with, 7577.12s - 7578.60s | I wouldn't talk to very often 7578.60s - 7580.44s | because things would be going right. 7581.36s - 7583.80s | And almost 20 years. 7583.80s - 7586.36s | And I get a call, I get a message, 7586.36s - 7590.08s | and like, hey, are you available for a call sometime? 7590.08s - 7593.04s | And I'm thinking, oh, I don't hear from him very often. 7593.04s - 7594.72s | I wonder what's going on. 7594.72s - 7596.36s | So I ask our salespeople, 7596.52s - 7599.32s | Caesars sales, like, should I get ready for this call? 7599.32s - 7602.12s | They're like, we don't know what the call's about. 7602.12s - 7603.16s | I go, okay. 7603.16s - 7604.00s | Oh, 20 years. 7604.00s - 7605.64s | I bet he's retiring. 7605.64s - 7606.64s | He's gotta be retiring. 7606.64s - 7608.24s | He's gonna give me a heads up he's retiring 7608.24s - 7610.32s | and he's gonna pass me off to the next guy. 7610.32s - 7611.60s | Okay, cool. 7611.60s - 7613.96s | So I get on the phone call and we're chit-chatting 7613.96s - 7616.92s | and I'm waiting for him to tell me that he's retiring. 7616.92s - 7618.40s | And he's like, I've got some bad news. 7618.40s - 7620.04s | We're terminating the contract. 7621.28s - 7622.88s | Oh, so you're not gonna be able to do it? 7622.88s - 7625.88s | And I'm like, no, no, no, no, no, no, no, no, no, no, no. 7625.92s - 7627.36s | Oh, so you're not retiring.


chunk_id: 135_chunk_139
chunk_text:
very often. 7593.04s - 7594.72s | I wonder what's going on. 7594.72s - 7596.36s | So I ask our salespeople, 7596.52s - 7599.32s | Caesars sales, like, should I get ready for this call? 7599.32s - 7602.12s | They're like, we don't know what the call's about. 7602.12s - 7603.16s | I go, okay. 7603.16s - 7604.00s | Oh, 20 years. 7604.00s - 7605.64s | I bet he's retiring. 7605.64s - 7606.64s | He's gotta be retiring. 7606.64s - 7608.24s | He's gonna give me a heads up he's retiring 7608.24s - 7610.32s | and he's gonna pass me off to the next guy. 7610.32s - 7611.60s | Okay, cool. 7611.60s - 7613.96s | So I get on the phone call and we're chit-chatting 7613.96s - 7616.92s | and I'm waiting for him to tell me that he's retiring. 7616.92s - 7618.40s | And he's like, I've got some bad news. 7618.40s - 7620.04s | We're terminating the contract. 7621.28s - 7622.88s | Oh, so you're not gonna be able to do it? 7622.88s - 7625.88s | And I'm like, no, no, no, no, no, no, no, no, no, no, no. 7625.92s - 7627.36s | Oh, so you're not retiring. 7629.00s - 7631.12s | This is gonna be a problem. 7631.12s - 7633.76s | And yeah, that was quite the moment. 7633.76s - 7637.48s | And that's when it just all happened all at once. 7637.48s - 7642.48s | And so I said, what the fuck do I do now? 7642.92s - 7646.36s | And he said, oh, remember Janice used to work for us? 7646.36s - 7648.08s | Yeah, she's over at the LVCC now. 7648.08s - 7649.76s | We've got a date lined up for you. 7649.76s - 7651.12s | They're holding the space. 7651.12s - 7652.84s | Give them a call. 7652.84s - 7654.28s | Super awesome. 7654.28s - 7657.68s | And so it worked out and here we are, 7657.68s - 7660.12s | which meant that everybody on this list, 7660.12s - 7663.76s | all the teams, departments, contests, creators, villages, 7663.76s - 7667.40s | we all had to pivot at warp speed 7667.40s - 7669.36s | to make this conference happen, 7669.36s - 7671.56s | which I'll be honest at many times 7671.56s - 7673.22s | did not quite look possible. 7674.08s - 7675.96s | But I think what's happened 7676.92s - 7678.40s | is


chunk_id: 135_chunk_140
chunk_text:
7629.00s - 7631.12s | This is gonna be a problem. 7631.12s - 7633.76s | And yeah, that was quite the moment. 7633.76s - 7637.48s | And that's when it just all happened all at once. 7637.48s - 7642.48s | And so I said, what the fuck do I do now? 7642.92s - 7646.36s | And he said, oh, remember Janice used to work for us? 7646.36s - 7648.08s | Yeah, she's over at the LVCC now. 7648.08s - 7649.76s | We've got a date lined up for you. 7649.76s - 7651.12s | They're holding the space. 7651.12s - 7652.84s | Give them a call. 7652.84s - 7654.28s | Super awesome. 7654.28s - 7657.68s | And so it worked out and here we are, 7657.68s - 7660.12s | which meant that everybody on this list, 7660.12s - 7663.76s | all the teams, departments, contests, creators, villages, 7663.76s - 7667.40s | we all had to pivot at warp speed 7667.40s - 7669.36s | to make this conference happen, 7669.36s - 7671.56s | which I'll be honest at many times 7671.56s - 7673.22s | did not quite look possible. 7674.08s - 7675.96s | But I think what's happened 7676.92s - 7678.40s | is I think we've all just gone through 7678.40s - 7682.56s | this giant trial by fire experience, right? 7682.56s - 7685.16s | It was really kind of a little traumatic, 7685.16s - 7686.72s | but we pulled it off. 7686.72s - 7690.12s | And I think because the event was so positive 7690.12s - 7694.36s | and the space so good, we had a great experience. 7694.36s - 7696.36s | Who likes this space? 7696.36s - 7704.08s | It was not something we would have done on our own. 7707.14s - 7708.20s | We wouldn't have just decided 7708.20s - 7709.66s | to make this kind of a big change, 7709.66s - 7711.88s | but since we were forced to make the change, 7711.88s - 7713.90s | we made the best of it. 7713.90s - 7717.26s | So I just want to thank all the departments 7717.26s - 7719.06s | and all the goons that made it possible. 7719.06s - 7720.82s | Let's give you guys a round of applause. 7720.82s - 7730.22s | Thank you. 7730.22s - 7733.22s | And I'd like to acknowledge and recognize 7733.22s - 7735.30s | the goons that are retiring. 7735.30s - 7739.22s |


chunk_id: 135_chunk_141
chunk_text:
I think we've all just gone through 7678.40s - 7682.56s | this giant trial by fire experience, right? 7682.56s - 7685.16s | It was really kind of a little traumatic, 7685.16s - 7686.72s | but we pulled it off. 7686.72s - 7690.12s | And I think because the event was so positive 7690.12s - 7694.36s | and the space so good, we had a great experience. 7694.36s - 7696.36s | Who likes this space? 7696.36s - 7704.08s | It was not something we would have done on our own. 7707.14s - 7708.20s | We wouldn't have just decided 7708.20s - 7709.66s | to make this kind of a big change, 7709.66s - 7711.88s | but since we were forced to make the change, 7711.88s - 7713.90s | we made the best of it. 7713.90s - 7717.26s | So I just want to thank all the departments 7717.26s - 7719.06s | and all the goons that made it possible. 7719.06s - 7720.82s | Let's give you guys a round of applause. 7720.82s - 7730.22s | Thank you. 7730.22s - 7733.22s | And I'd like to acknowledge and recognize 7733.22s - 7735.30s | the goons that are retiring. 7735.30s - 7739.22s | Gmark, Noise, Ira, Estabang, Gattaca, Dekuna, 7739.22s - 7744.22s | The Saint, Morphix, Brick, or Bick, Wham, Casper, 7747.14s - 7750.74s | and all the current gold badge holders and all. 7750.74s - 7753.42s | So a gold badge holder is sort of like an Uber badge. 7753.42s - 7757.62s | After 10 years of service, if you decide to retire, 7757.62s - 7760.36s | you get attendance for life for the service. 7761.34s - 7764.38s | And then Noons, which are the new goons coming in. 7764.38s - 7765.82s | So thank you, everyone. 7765.82s - 7773.53s | Noons! 7773.53s - 7775.25s | So this is us, so I'll skip by that. 7775.25s - 7777.33s | Thank you, thank me, thank you. 7777.33s - 7778.17s | Okay. 7780.21s - 7784.31s | Also, we try to keep a lot of the content online year round. 7785.15s - 7787.91s | We have a bunch of social stuff that we try to do. 7787.91s - 7791.27s | Darrington does a movie night on our Discord. 7791.27s - 7794.31s | We have our DEF CON social server. 7794.31s - 7797.53s | We've got stuff on YouTube, Instagram, all that stuff. 7797.53s - 7799.91s


chunk_id: 135_chunk_142
chunk_text:
Gmark, Noise, Ira, Estabang, Gattaca, Dekuna, 7739.22s - 7744.22s | The Saint, Morphix, Brick, or Bick, Wham, Casper, 7747.14s - 7750.74s | and all the current gold badge holders and all. 7750.74s - 7753.42s | So a gold badge holder is sort of like an Uber badge. 7753.42s - 7757.62s | After 10 years of service, if you decide to retire, 7757.62s - 7760.36s | you get attendance for life for the service. 7761.34s - 7764.38s | And then Noons, which are the new goons coming in. 7764.38s - 7765.82s | So thank you, everyone. 7765.82s - 7773.53s | Noons! 7773.53s - 7775.25s | So this is us, so I'll skip by that. 7775.25s - 7777.33s | Thank you, thank me, thank you. 7777.33s - 7778.17s | Okay. 7780.21s - 7784.31s | Also, we try to keep a lot of the content online year round. 7785.15s - 7787.91s | We have a bunch of social stuff that we try to do. 7787.91s - 7791.27s | Darrington does a movie night on our Discord. 7791.27s - 7794.31s | We have our DEF CON social server. 7794.31s - 7797.53s | We've got stuff on YouTube, Instagram, all that stuff. 7797.53s - 7799.91s | There's ways to participate with the community year round, 7799.91s - 7803.03s | or even if you don't get to attend in person. 7804.67s - 7808.15s | So I have, I think I'm almost out of slides, 7808.15s - 7812.35s | but I do have something here, dark chocolate story. 7812.35s - 7815.51s | Okay, so I have to tell you the dark chocolate story. 7815.51s - 7817.55s | In the badge, at some point, 7817.55s - 7819.63s | you can elusively sometimes come across 7819.63s - 7820.77s | the dark tangent character. 7820.77s - 7823.57s | I guess I'm pretty elusive and I run away from you a lot. 7824.79s - 7828.27s | But apparently, and no one told me, Mar, 7828.27s - 7832.91s | that if you get near me and the bright stars align 7832.91s - 7834.79s | and there's some proximity something, 7834.79s - 7837.99s | it says that the dark tangent will give you dark chocolate. 7838.19s - 7842.43s | Or the dark chocolate character arrives. 7842.43s - 7843.59s | I don't know what it is. 7843.59s - 7845.61s | So the first time it happens to me, 7845.61s - 7847.43s | I'm walking


chunk_id: 135_chunk_143
chunk_text:
| There's ways to participate with the community year round, 7799.91s - 7803.03s | or even if you don't get to attend in person. 7804.67s - 7808.15s | So I have, I think I'm almost out of slides, 7808.15s - 7812.35s | but I do have something here, dark chocolate story. 7812.35s - 7815.51s | Okay, so I have to tell you the dark chocolate story. 7815.51s - 7817.55s | In the badge, at some point, 7817.55s - 7819.63s | you can elusively sometimes come across 7819.63s - 7820.77s | the dark tangent character. 7820.77s - 7823.57s | I guess I'm pretty elusive and I run away from you a lot. 7824.79s - 7828.27s | But apparently, and no one told me, Mar, 7828.27s - 7832.91s | that if you get near me and the bright stars align 7832.91s - 7834.79s | and there's some proximity something, 7834.79s - 7837.99s | it says that the dark tangent will give you dark chocolate. 7838.19s - 7842.43s | Or the dark chocolate character arrives. 7842.43s - 7843.59s | I don't know what it is. 7843.59s - 7845.61s | So the first time it happens to me, 7845.61s - 7847.43s | I'm walking down the hall and someone runs up to me 7847.43s - 7851.20s | and says, dark chocolate. 7851.20s - 7854.08s | I'm like, okay, what's going on? 7854.08s - 7856.32s | I had no idea, I was totally bewildered. 7856.32s - 7858.76s | The second time it happens though, 7858.76s - 7861.76s | it's last night, it looks like maybe a husband and wife 7861.76s - 7864.88s | or boyfriend, girlfriend, and they are like, 7864.88s - 7867.36s | we've got him, we found him, dark chocolate. 7867.36s - 7870.28s | And they come up to me and they're, dark chocolate. 7871.92s - 7874.96s | What do we, like if I'm near you, I get a, 7874.96s - 7877.86s | and I just so happen to have a chocolate bar in my pocket. 7877.86s - 7883.71s | And so, there they are. 7883.71s - 7885.85s | There they are, right there. 7892.88s - 7894.22s | There they are. 7894.22s - 7895.90s | And I'm thinking to myself, holy shit, 7895.90s - 7897.66s | I've got chocolate in my pocket. 7897.66s - 7900.10s | And so I'm, they're like, so dark chocolate, 7900.10s - 7903.06s | and I just unzip my


chunk_id: 135_chunk_144
chunk_text:
down the hall and someone runs up to me 7847.43s - 7851.20s | and says, dark chocolate. 7851.20s - 7854.08s | I'm like, okay, what's going on? 7854.08s - 7856.32s | I had no idea, I was totally bewildered. 7856.32s - 7858.76s | The second time it happens though, 7858.76s - 7861.76s | it's last night, it looks like maybe a husband and wife 7861.76s - 7864.88s | or boyfriend, girlfriend, and they are like, 7864.88s - 7867.36s | we've got him, we found him, dark chocolate. 7867.36s - 7870.28s | And they come up to me and they're, dark chocolate. 7871.92s - 7874.96s | What do we, like if I'm near you, I get a, 7874.96s - 7877.86s | and I just so happen to have a chocolate bar in my pocket. 7877.86s - 7883.71s | And so, there they are. 7883.71s - 7885.85s | There they are, right there. 7892.88s - 7894.22s | There they are. 7894.22s - 7895.90s | And I'm thinking to myself, holy shit, 7895.90s - 7897.66s | I've got chocolate in my pocket. 7897.66s - 7900.10s | And so I'm, they're like, so dark chocolate, 7900.10s - 7903.06s | and I just unzip my pocket, I hand them the chocolate bar 7903.06s - 7904.46s | and I turn around and walk away. 7904.46s - 7909.46s | And they're like, holy fuck, that worked. 7912.10s - 7913.58s | It was amazing, and here you are. 7913.58s - 7916.02s | I just, I knew that it was probably a story 7916.02s - 7918.30s | you're gonna tell forever because it was like perfect, 7918.30s - 7920.42s | everything aligned, so that was awesome. 7921.48s - 7922.78s | And there they, I'm glad I told the story, 7922.78s - 7924.98s | I'm glad I wrote that down, awesome. 7924.98s - 7928.66s | Okay, so for next year, we expect to see you back 7928.66s - 7930.36s | August 7th to 10th. 7937.24s - 7941.32s | I think this space is amazing, and it gives us a, 7941.32s - 7943.28s | so some of the comments I heard was, 7943.28s - 7947.28s | my shoulders aren't bruised from being bumped into. 7947.28s - 7950.94s | Other people said that it felt like a con from 10 years ago, 7950.94s - 7953.08s | even though there might be a lot of people here, 7953.08s - 7956.24s | they didn't


chunk_id: 135_chunk_145
chunk_text:
pocket, I hand them the chocolate bar 7903.06s - 7904.46s | and I turn around and walk away. 7904.46s - 7909.46s | And they're like, holy fuck, that worked. 7912.10s - 7913.58s | It was amazing, and here you are. 7913.58s - 7916.02s | I just, I knew that it was probably a story 7916.02s - 7918.30s | you're gonna tell forever because it was like perfect, 7918.30s - 7920.42s | everything aligned, so that was awesome. 7921.48s - 7922.78s | And there they, I'm glad I told the story, 7922.78s - 7924.98s | I'm glad I wrote that down, awesome. 7924.98s - 7928.66s | Okay, so for next year, we expect to see you back 7928.66s - 7930.36s | August 7th to 10th. 7937.24s - 7941.32s | I think this space is amazing, and it gives us a, 7941.32s - 7943.28s | so some of the comments I heard was, 7943.28s - 7947.28s | my shoulders aren't bruised from being bumped into. 7947.28s - 7950.94s | Other people said that it felt like a con from 10 years ago, 7950.94s - 7953.08s | even though there might be a lot of people here, 7953.08s - 7956.24s | they didn't feel so much like FOMO and pressure, 7956.24s - 7958.68s | and it was much more chill and relaxed. 7958.68s - 7961.16s | Is that a pretty honest estimation, you think? 7961.16s - 7962.06s | Yeah, pretty cool? 7964.12s - 7966.72s | I know there's always gonna be growing pains, but it, 7967.72s - 7972.20s | so as organizers, we're really close to the problem, 7972.20s - 7974.56s | and sometimes you don't see the big picture, 7974.56s - 7976.66s | and so for me, I was really obsessing 7976.66s - 7980.80s | over all the problems, and all I was reading online 7980.80s - 7984.40s | was people saying, amazing, everybody under one roof, 7984.40s - 7987.36s | this'll be great, we haven't done this since DEF CON 20, 7987.36s - 7988.28s | yeah, 27. 7988.44s - 7989.28s | Yeah. 7991.28s - 7995.16s | And so, that's when I realized the power 7995.16s - 7996.88s | of sort of community all under one roof 7996.88s - 7999.60s | was gonna just wash over all these problems, 7999.60s - 8002.32s | and that was really, I mean, that was one of the reasons 8002.32s - 8004.68s | why we really


chunk_id: 135_chunk_146
chunk_text:
feel so much like FOMO and pressure, 7956.24s - 7958.68s | and it was much more chill and relaxed. 7958.68s - 7961.16s | Is that a pretty honest estimation, you think? 7961.16s - 7962.06s | Yeah, pretty cool? 7964.12s - 7966.72s | I know there's always gonna be growing pains, but it, 7967.72s - 7972.20s | so as organizers, we're really close to the problem, 7972.20s - 7974.56s | and sometimes you don't see the big picture, 7974.56s - 7976.66s | and so for me, I was really obsessing 7976.66s - 7980.80s | over all the problems, and all I was reading online 7980.80s - 7984.40s | was people saying, amazing, everybody under one roof, 7984.40s - 7987.36s | this'll be great, we haven't done this since DEF CON 20, 7987.36s - 7988.28s | yeah, 27. 7988.44s - 7989.28s | Yeah. 7991.28s - 7995.16s | And so, that's when I realized the power 7995.16s - 7996.88s | of sort of community all under one roof 7996.88s - 7999.60s | was gonna just wash over all these problems, 7999.60s - 8002.32s | and that was really, I mean, that was one of the reasons 8002.32s - 8004.68s | why we really put the energy in to make this happen, 8004.68s - 8007.46s | was because we thought the benefits of all under one roof 8007.46s - 8009.36s | was gonna be amazing, and it really, 8009.36s - 8012.56s | holy, who, what, who's that by the door there? 8012.56s - 8013.40s | Hey there. 8014.48s - 8015.84s | Hey, giant chickens. 8016.40s - 8018.96s | Oh, Jesus Christ. 8024.68s - 8029.44s | All right, see you next year at the LVCC West Hall. 8029.44s - 8031.20s | More content will be online, 8031.20s - 8035.24s | and you are now authorized to disengage.


chunk_id: 135_chunk_147
chunk_text:
put the energy in to make this happen, 8004.68s - 8007.46s | was because we thought the benefits of all under one roof 8007.46s - 8009.36s | was gonna be amazing, and it really, 8009.36s - 8012.56s | holy, who, what, who's that by the door there? 8012.56s - 8013.40s | Hey there. 8014.48s - 8015.84s | Hey, giant chickens. 8016.40s - 8018.96s | Oh, Jesus Christ. 8024.68s - 8029.44s | All right, see you next year at the LVCC West Hall. 8029.44s - 8031.20s | More content will be online, 8031.20s - 8035.24s | and you are now authorized to disengage.


chunk_id: 136_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=pTSEViCwAig", "title": "DEF CON 32 - On Your Ocean's 11 Team, I'm the AI Guy (technically Girl) - Harriet Farlow", "description": "One of the best parts of DEF CON is the glitz and glam of Vegas, the gambling capital of the world. Many have explored hacking casinos (on and off stage). Unfortunately, it\u2019s just not like it is portrayed in the Oceans franchise.. in real life there\u2019s much less action, no George Clooney, and it\u2019s a lot harder to pull off a successful heist.\n\nFortunately I\u2019m not your typical hacker, I\u2019m an AI hacker. I use adversarial machine learning techniques to disrupt, deceive and disclose information from Artificial Intelligence systems.\n\nI chose my target carefully: Canberra Casino. It\u2019s the best casino in my city.. It\u2019s also the only casino but that\u2019s not the point. The casino industry is at an interesting inflection point. Many large casinos have already adopted AI for surveillance and gameplay monitoring, smaller casinos are starting to make the transition, and there\u2019s only a couple of companies in the world that provide this software. It\u2019s ripe for exploitation.\n\nIn this talk I\u2019m going to show you how I bypassed Casino Canberra's AI systems - facial recognition, surveillance systems and gameplay monitoring. AI Security is the new cyber security threat, and attacks on AI systems could have broad implications including misdiagnoses in medical imaging, navigation errors in autonomous vehicles.. and successful casino heists.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2261, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.08s - 2.76s | This text was transcribed using whisper model: large-v2 Are there any Australians here in the room? 2.76s - 8.40s | Yes, so you might be able to tell from my accent I'm from Australia and back home 8.40s - 11.80s | we have a drinking tradition as well for special occasions and it's called a 11.80s - 17.56s | shoey. I don't know if any of you have heard of it but basically you pour like a shot in a 17.56s - 21.72s | shoe and you drink it from the shoe which sounds disgusting but it's a thing 21.72s - 26.24s | that Aussies do so you know this this shot is a lot of fun but you'll have a 26.24s - 32.08s | lot to learn from Australians. All right so yeah thank you very much for being 32.08s - 38.12s | here I'm really stoked. The presentation today


chunk_id: 136_chunk_1
chunk_text:
and gameplay monitoring. AI Security is the new cyber security threat, and attacks on AI systems could have broad implications including misdiagnoses in medical imaging, navigation errors in autonomous vehicles.. and successful casino heists.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2261, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.08s - 2.76s | This text was transcribed using whisper model: large-v2 Are there any Australians here in the room? 2.76s - 8.40s | Yes, so you might be able to tell from my accent I'm from Australia and back home 8.40s - 11.80s | we have a drinking tradition as well for special occasions and it's called a 11.80s - 17.56s | shoey. I don't know if any of you have heard of it but basically you pour like a shot in a 17.56s - 21.72s | shoe and you drink it from the shoe which sounds disgusting but it's a thing 21.72s - 26.24s | that Aussies do so you know this this shot is a lot of fun but you'll have a 26.24s - 32.08s | lot to learn from Australians. All right so yeah thank you very much for being 32.08s - 38.12s | here I'm really stoked. The presentation today is called On Your Oceans 11 Team 38.12s - 42.80s | I'm the AI Guy even though I'm a girl that it just has a better ring to it I 42.80s - 47.92s | need to maybe find a better title but this is my second time at DEF CON and my 47.92s - 52.44s | first time speaking and I'm a little bit jet-lagged because of the the trope and 52.44s - 57.48s | I'm speaking four times this week so forgive me if I'm a bit tired like 57.48s - 60.64s | forgetting all the the order of the slides for various presentations you 60.64s - 64.92s | sort of submit things and I didn't actually expect to get all of them in so 64.92s - 68.48s | I'll be giving this talk a little later in the AI village as well and I gave a 68.48s - 74.48s | similar one at B-Sides but yeah as you can probably tell from the the 74.48s - 79.04s | description and the title of the talk I'm an AI person so maybe the casino 79.04s - 83.52s | part has kind of been shoehorned into an AI security talk


chunk_id: 136_chunk_2
chunk_text:
is called On Your Oceans 11 Team 38.12s - 42.80s | I'm the AI Guy even though I'm a girl that it just has a better ring to it I 42.80s - 47.92s | need to maybe find a better title but this is my second time at DEF CON and my 47.92s - 52.44s | first time speaking and I'm a little bit jet-lagged because of the the trope and 52.44s - 57.48s | I'm speaking four times this week so forgive me if I'm a bit tired like 57.48s - 60.64s | forgetting all the the order of the slides for various presentations you 60.64s - 64.92s | sort of submit things and I didn't actually expect to get all of them in so 64.92s - 68.48s | I'll be giving this talk a little later in the AI village as well and I gave a 68.48s - 74.48s | similar one at B-Sides but yeah as you can probably tell from the the 74.48s - 79.04s | description and the title of the talk I'm an AI person so maybe the casino 79.04s - 83.52s | part has kind of been shoehorned into an AI security talk but I think it makes 83.52s - 88.32s | sense for Vegas right we want it to be to be sort of relevant I thought it'd 88.32s - 92.42s | be an interesting topic to sort of go through AI security but before I get 92.42s - 98.16s | into the topic can I get a show of hands if you're like a cyber person if you can 98.16s - 103.68s | see yourself a cyber person okay and what about the people who would consider 103.68s - 110.00s | themselves an AI person cool okay and anyone who finds these robot tests 110.00s - 113.28s | these days really hard and isn't sure if they're a person at all I feel like 113.28s - 117.44s | that's the camp I sometimes sit in okay so I suspected that the crowd would 117.44s - 125.24s | mostly be cyber people so the talk is focused on sort of explaining AI 125.24s - 128.80s | security in a way for for cyber folks so there's a little bit of theory at the 128.80s - 132.36s | beginning and I apologize for that and if you're an AI person please don't come


chunk_id: 136_chunk_3
chunk_text:
but I think it makes 83.52s - 88.32s | sense for Vegas right we want it to be to be sort of relevant I thought it'd 88.32s - 92.42s | be an interesting topic to sort of go through AI security but before I get 92.42s - 98.16s | into the topic can I get a show of hands if you're like a cyber person if you can 98.16s - 103.68s | see yourself a cyber person okay and what about the people who would consider 103.68s - 110.00s | themselves an AI person cool okay and anyone who finds these robot tests 110.00s - 113.28s | these days really hard and isn't sure if they're a person at all I feel like 113.28s - 117.44s | that's the camp I sometimes sit in okay so I suspected that the crowd would 117.44s - 125.24s | mostly be cyber people so the talk is focused on sort of explaining AI 125.24s - 128.80s | security in a way for for cyber folks so there's a little bit of theory at the 128.80s - 132.36s | beginning and I apologize for that and if you're an AI person please don't come 132.36s - 138.92s | at me but before I now I know a little bit about who you are who am I I'm 138.92s - 144.12s | pretty sure I'm a human even though I failed the robot test sometimes but I'm 144.12s - 148.44s | in AI security I've been working at the intersection of AI and security for 148.44s - 152.32s | about 10 years now my undergraduate was in physics and I didn't really know what 152.32s - 156.16s | to do with it so like many physicists I went into data science and so I worked 156.16s - 160.64s | as a data scientist in Australia in a consulting company for a while mostly on 160.64s - 164.72s | defense projects I had my quarter-life crisis and moved to the United States 164.72s - 168.76s | and worked at a startup then during COVID I moved back to Australia and 168.76s - 172.16s | worked in the Australian government and that's when I did my PhD in machine 172.16s - 176.48s | learning security and I found that at the time when I started working in the 176.48s - 180.64s | field in 2021 no one


chunk_id: 136_chunk_4
chunk_text:
132.36s - 138.92s | at me but before I now I know a little bit about who you are who am I I'm 138.92s - 144.12s | pretty sure I'm a human even though I failed the robot test sometimes but I'm 144.12s - 148.44s | in AI security I've been working at the intersection of AI and security for 148.44s - 152.32s | about 10 years now my undergraduate was in physics and I didn't really know what 152.32s - 156.16s | to do with it so like many physicists I went into data science and so I worked 156.16s - 160.64s | as a data scientist in Australia in a consulting company for a while mostly on 160.64s - 164.72s | defense projects I had my quarter-life crisis and moved to the United States 164.72s - 168.76s | and worked at a startup then during COVID I moved back to Australia and 168.76s - 172.16s | worked in the Australian government and that's when I did my PhD in machine 172.16s - 176.48s | learning security and I found that at the time when I started working in the 176.48s - 180.64s | field in 2021 no one was really talking about machine learning security people 180.64s - 185.52s | are now fortunately but that's why about a year ago I left my job and I started 185.52s - 190.52s | my company more ever security labs and we're an Australian based startup we 190.52s - 193.48s | provide workshops and training in AI security and we just got funding to do 193.48s - 197.68s | our first tech product which is exciting but you can also find me at Harriet hacks 197.68s - 201.92s | on various social media platforms maybe you can find me there if you want it's 201.92s - 206.20s | it's a bit hacky like we all got to start somewhere so please be forgiving 206.20s - 211.52s | but our objectives today are to hack the casino we've probably all heard of some 211.52s - 216.00s | pretty high-profile casino related hacks in the cyberspace but I really wanted to 216.00s - 220.84s | explore the AI dimension specifically because we are at the sort of inflection 220.84s - 224.16s | point where so many organizations including casinos are adopting AI now 224.16s - 228.48s | and most of them are inherently


chunk_id: 136_chunk_5
chunk_text:
was really talking about machine learning security people 180.64s - 185.52s | are now fortunately but that's why about a year ago I left my job and I started 185.52s - 190.52s | my company more ever security labs and we're an Australian based startup we 190.52s - 193.48s | provide workshops and training in AI security and we just got funding to do 193.48s - 197.68s | our first tech product which is exciting but you can also find me at Harriet hacks 197.68s - 201.92s | on various social media platforms maybe you can find me there if you want it's 201.92s - 206.20s | it's a bit hacky like we all got to start somewhere so please be forgiving 206.20s - 211.52s | but our objectives today are to hack the casino we've probably all heard of some 211.52s - 216.00s | pretty high-profile casino related hacks in the cyberspace but I really wanted to 216.00s - 220.84s | explore the AI dimension specifically because we are at the sort of inflection 220.84s - 224.16s | point where so many organizations including casinos are adopting AI now 224.16s - 228.48s | and most of them are inherently insecure so I wanted to test this so we're going 228.48s - 232.12s | to start with some exploration work I didn't know much about casinos when I 232.12s - 236.64s | like to come out with this topic so that that was part of it then we're going to 236.64s - 241.52s | hack the facial recognition AI and then I guess we have to think of some lessons 241.52s - 246.20s | learned in AI security right so why did I pick the casino apart from thinking it 246.20s - 251.48s | would sort of fit for the Las Vegas DEF CON context so much AI is vulnerable 251.48s - 255.50s | however people only seem to care when you lose a lot of money or when there's 255.50s - 259.92s | a big hit on your brand reputation and casinos are a really good example of an 259.92s - 265.12s | organization like this where you know the casino always wins right so bringing 265.12s - 268.88s | people in the door and having people trust your brand and want to you know 268.88s - 271.80s | have entertainment when you're definitely statistically going to lose 271.80s


chunk_id: 136_chunk_6
chunk_text:
insecure so I wanted to test this so we're going 228.48s - 232.12s | to start with some exploration work I didn't know much about casinos when I 232.12s - 236.64s | like to come out with this topic so that that was part of it then we're going to 236.64s - 241.52s | hack the facial recognition AI and then I guess we have to think of some lessons 241.52s - 246.20s | learned in AI security right so why did I pick the casino apart from thinking it 246.20s - 251.48s | would sort of fit for the Las Vegas DEF CON context so much AI is vulnerable 251.48s - 255.50s | however people only seem to care when you lose a lot of money or when there's 255.50s - 259.92s | a big hit on your brand reputation and casinos are a really good example of an 259.92s - 265.12s | organization like this where you know the casino always wins right so bringing 265.12s - 268.88s | people in the door and having people trust your brand and want to you know 268.88s - 271.80s | have entertainment when you're definitely statistically going to lose 271.80s - 275.84s | money is tough and so thinking about security from that context is really 275.84s - 279.68s | important but it's also a good analogy for literally every organization right 279.68s - 285.72s | now that's adopting AI so a few disclaimers before I start I worked with 285.72s - 290.52s | casino Canberra on this and you know that I'm from Australia well I'm from a 290.52s - 296.92s | town in Australia called Canberra does anyone know Canberra yay yeah Canberra's 296.92s - 299.76s | I don't know I have a love-hate relationship with Canberra it's pretty 299.76s - 305.44s | boring but it's got a great quality of life and you know it's got some things 305.44s - 310.16s | going for it but we it's our political capital for those of you who might not 310.16s - 313.80s | know that a lot of people think Sydney's our capital but it's it's actually 313.80s - 321.52s | Canberra so imagine DC but like 1 14th of the size because Australia is 1 14th 321.52s - 325.20s | of the population of the United States so we only have one casino and I'm 325.20s -


chunk_id: 136_chunk_7
chunk_text:
- 275.84s | money is tough and so thinking about security from that context is really 275.84s - 279.68s | important but it's also a good analogy for literally every organization right 279.68s - 285.72s | now that's adopting AI so a few disclaimers before I start I worked with 285.72s - 290.52s | casino Canberra on this and you know that I'm from Australia well I'm from a 290.52s - 296.92s | town in Australia called Canberra does anyone know Canberra yay yeah Canberra's 296.92s - 299.76s | I don't know I have a love-hate relationship with Canberra it's pretty 299.76s - 305.44s | boring but it's got a great quality of life and you know it's got some things 305.44s - 310.16s | going for it but we it's our political capital for those of you who might not 310.16s - 313.80s | know that a lot of people think Sydney's our capital but it's it's actually 313.80s - 321.52s | Canberra so imagine DC but like 1 14th of the size because Australia is 1 14th 321.52s - 325.20s | of the population of the United States so we only have one casino and I'm 325.20s - 328.56s | really glad that they were willing to be you know really cooperative with with 328.56s - 333.36s | me on this so I'm you know massive thank you to casino Canberra so they are our 333.36s - 338.64s | town's best casino so that that's pretty exciting as a side note in my uber ride 338.64s - 345.32s | over here my uber driver said that his son vacationed in Australia and their 345.32s - 348.80s | honeymoon was in Canberra and they loved it so much that they named their child 348.80s - 355.76s | like Giovanna Canberra and I don't know any anyone who's familiar with Canberra 355.76s - 359.56s | would just find that shocking but anyway um so going on with the disclaimers um 359.56s - 364.72s | so obviously the attacks are real but you know I'm an ethical hacker I you 364.72s - 368.24s | know I care about casino Canberra I'm not literally showing you how to attack 368.24s - 373.56s | their systems or you know specific AI systems and like I said the talk is 373.56s - 380.16s | aimed at cyber cyber folk so a little bit about


chunk_id: 136_chunk_8
chunk_text:
328.56s | really glad that they were willing to be you know really cooperative with with 328.56s - 333.36s | me on this so I'm you know massive thank you to casino Canberra so they are our 333.36s - 338.64s | town's best casino so that that's pretty exciting as a side note in my uber ride 338.64s - 345.32s | over here my uber driver said that his son vacationed in Australia and their 345.32s - 348.80s | honeymoon was in Canberra and they loved it so much that they named their child 348.80s - 355.76s | like Giovanna Canberra and I don't know any anyone who's familiar with Canberra 355.76s - 359.56s | would just find that shocking but anyway um so going on with the disclaimers um 359.56s - 364.72s | so obviously the attacks are real but you know I'm an ethical hacker I you 364.72s - 368.24s | know I care about casino Canberra I'm not literally showing you how to attack 368.24s - 373.56s | their systems or you know specific AI systems and like I said the talk is 373.56s - 380.16s | aimed at cyber cyber folk so a little bit about casinos for the people like me 380.16s - 384.24s | who might not have known about casinos they obviously like a lot of money they 384.24s - 387.60s | have a controversial history and there's a lot of reasons why that history is 387.60s - 392.56s | sort of controversial casinos are a hotspot for money laundering because 392.56s - 396.44s | it's an easy way to move funds around particularly in Australia there's been 396.44s - 401.84s | some controversy lately our two big casino brands star and crown had to pay 401.84s - 406.56s | big fines because they didn't comply with any money laundering laws and 406.56s - 410.44s | there's been Royal Commissions and stuff and it's the same in other countries as 410.44s - 415.52s | well casinos are getting a little bit of heat so security is important they use 415.52s - 420.16s | AI obviously otherwise this talk wouldn't have gone as I planned and they 420.16s - 425.56s | use AI for lots of different reasons and as I'll go into later they rely 425.56s - 430.20s | specifically on facial recognition and person detection but the landscape is 430.20s - 432.72s


chunk_id: 136_chunk_9
chunk_text:
casinos for the people like me 380.16s - 384.24s | who might not have known about casinos they obviously like a lot of money they 384.24s - 387.60s | have a controversial history and there's a lot of reasons why that history is 387.60s - 392.56s | sort of controversial casinos are a hotspot for money laundering because 392.56s - 396.44s | it's an easy way to move funds around particularly in Australia there's been 396.44s - 401.84s | some controversy lately our two big casino brands star and crown had to pay 401.84s - 406.56s | big fines because they didn't comply with any money laundering laws and 406.56s - 410.44s | there's been Royal Commissions and stuff and it's the same in other countries as 410.44s - 415.52s | well casinos are getting a little bit of heat so security is important they use 415.52s - 420.16s | AI obviously otherwise this talk wouldn't have gone as I planned and they 420.16s - 425.56s | use AI for lots of different reasons and as I'll go into later they rely 425.56s - 430.20s | specifically on facial recognition and person detection but the landscape is 430.20s - 432.72s | really interesting when it comes to casinos because just like any 432.72s - 435.96s | organization they're trying to figure out exactly what the most strategic or 435.96s - 440.64s | the best way of actually adopting and integrating AI is and just like any 440.64s - 444.08s | organization they have to rely on third-party providers for the most part 444.08s - 446.44s | or they can bring in their own consultants but that's sort of 446.44s - 451.04s | expensive and not all casinos can necessarily do that and there are also a 451.04s - 457.16s | few companies that provide AI services to casinos that are you know already 457.24s - 461.28s | providing things like chips and and cards to casinos as well so it's a very 461.28s - 467.24s | small space. When I first started this talk I thought that things like card 467.24s - 473.24s | counting would be a use of AI in casinos and it's not so you're probably 473.24s - 477.44s | familiar with card counting and it's not illegal it's considered advantage play 477.44s - 482.12s | so a casino however does have the discretion to like prevent


chunk_id: 136_chunk_10
chunk_text:
| really interesting when it comes to casinos because just like any 432.72s - 435.96s | organization they're trying to figure out exactly what the most strategic or 435.96s - 440.64s | the best way of actually adopting and integrating AI is and just like any 440.64s - 444.08s | organization they have to rely on third-party providers for the most part 444.08s - 446.44s | or they can bring in their own consultants but that's sort of 446.44s - 451.04s | expensive and not all casinos can necessarily do that and there are also a 451.04s - 457.16s | few companies that provide AI services to casinos that are you know already 457.24s - 461.28s | providing things like chips and and cards to casinos as well so it's a very 461.28s - 467.24s | small space. When I first started this talk I thought that things like card 467.24s - 473.24s | counting would be a use of AI in casinos and it's not so you're probably 473.24s - 477.44s | familiar with card counting and it's not illegal it's considered advantage play 477.44s - 482.12s | so a casino however does have the discretion to like prevent people from 482.12s - 485.80s | playing there for any reason so if a person is very ostentatiously card 485.88s - 489.68s | counting and winning a lot of money probably the casino is going to not want 489.68s - 494.12s | to have them there but it was interesting because I expected that 494.12s - 501.08s | things like card counting would be a big use case for AI and it wasn't. So how do 501.08s - 508.88s | we actually hack an AI? Sorry this is the first bad joke of the day so when I 508.88s - 512.60s | first told my mum I worked in AI she said oh darling what are you doing 512.60s - 517.60s | working in artificial insemination because I know that was a pretty laugh 517.60s - 522.60s | but thank you. She works in medicine and so to her that's what AI is and so 522.60s - 527.40s | obviously for most people here AI is artificial intelligence but even though 527.40s - 531.28s | we know it means those two words what people have in their mind when they 531.28s - 535.92s | think of what artificial intelligence is


chunk_id: 136_chunk_11
chunk_text:
people from 482.12s - 485.80s | playing there for any reason so if a person is very ostentatiously card 485.88s - 489.68s | counting and winning a lot of money probably the casino is going to not want 489.68s - 494.12s | to have them there but it was interesting because I expected that 494.12s - 501.08s | things like card counting would be a big use case for AI and it wasn't. So how do 501.08s - 508.88s | we actually hack an AI? Sorry this is the first bad joke of the day so when I 508.88s - 512.60s | first told my mum I worked in AI she said oh darling what are you doing 512.60s - 517.60s | working in artificial insemination because I know that was a pretty laugh 517.60s - 522.60s | but thank you. She works in medicine and so to her that's what AI is and so 522.60s - 527.40s | obviously for most people here AI is artificial intelligence but even though 527.40s - 531.28s | we know it means those two words what people have in their mind when they 531.28s - 535.92s | think of what artificial intelligence is definitely differs. Some people imagine 535.92s - 540.64s | Skynet and things like artificial general intelligence, some people imagine 540.64s - 544.52s | algorithms, machine learning systems, some people just imagine anything that's 544.52s - 548.64s | sort of at the cutting edge of technology. So when we think about how to 548.64s - 552.32s | hack an AI system we really have to think about like the actual technology 552.32s - 555.84s | that we're trying to hack rather than sort of a some sort of AGI related goal 555.84s - 560.52s | so I'm focusing very much on machine learning models but if we really think 560.52s - 564.40s | about the history of AI and if we think about it as just something that does 564.40s - 569.52s | something a human might otherwise have done I mean the idea of hacking AI has 569.52s - 575.72s | been around for a long time. So this is an example from a casino context as we 575.72s - 578.88s | know that there are no random numbers in computers right it has to be an 578.88s - 582.32s | algorithm and so there are some pretty high-profile cases


chunk_id: 136_chunk_12
chunk_text:
definitely differs. Some people imagine 535.92s - 540.64s | Skynet and things like artificial general intelligence, some people imagine 540.64s - 544.52s | algorithms, machine learning systems, some people just imagine anything that's 544.52s - 548.64s | sort of at the cutting edge of technology. So when we think about how to 548.64s - 552.32s | hack an AI system we really have to think about like the actual technology 552.32s - 555.84s | that we're trying to hack rather than sort of a some sort of AGI related goal 555.84s - 560.52s | so I'm focusing very much on machine learning models but if we really think 560.52s - 564.40s | about the history of AI and if we think about it as just something that does 564.40s - 569.52s | something a human might otherwise have done I mean the idea of hacking AI has 569.52s - 575.72s | been around for a long time. So this is an example from a casino context as we 575.72s - 578.88s | know that there are no random numbers in computers right it has to be an 578.88s - 582.32s | algorithm and so there are some pretty high-profile cases of people being able 582.32s - 586.76s | to basically hack the algorithm. People who have access to sort of like the 586.76s - 591.08s | seed information of these algorithms have been able to like steal money 591.08s - 595.92s | pretty large sums. In 1995 Ron Harris was able to steal $100,000 this way 595.92s - 599.16s | because he knew about the algorithm was able to predict the next numbers very 599.16s - 603.72s | successfully in in a game of Keno. I hope they're not having more fun than 603.72s - 607.84s | us because they're very loud. Do I need more bad jokes? I don't think you really 607.84s - 612.84s | want that either. So that's one example of hacking an AI I guess and the other 612.84s - 617.16s | is sort of card counting. So if we think about it the reason that the casino 617.16s - 620.60s | always wins right is because the game is statistically in their favor and that 620.60s - 625.88s | goes anywhere from sort of a 2% to a 25% advantage where 25% would sort of be 625.88s - 629.80s | like the slot machines


chunk_id: 136_chunk_13
chunk_text:
of people being able 582.32s - 586.76s | to basically hack the algorithm. People who have access to sort of like the 586.76s - 591.08s | seed information of these algorithms have been able to like steal money 591.08s - 595.92s | pretty large sums. In 1995 Ron Harris was able to steal $100,000 this way 595.92s - 599.16s | because he knew about the algorithm was able to predict the next numbers very 599.16s - 603.72s | successfully in in a game of Keno. I hope they're not having more fun than 603.72s - 607.84s | us because they're very loud. Do I need more bad jokes? I don't think you really 607.84s - 612.84s | want that either. So that's one example of hacking an AI I guess and the other 612.84s - 617.16s | is sort of card counting. So if we think about it the reason that the casino 617.16s - 620.60s | always wins right is because the game is statistically in their favor and that 620.60s - 625.88s | goes anywhere from sort of a 2% to a 25% advantage where 25% would sort of be 625.88s - 629.80s | like the slot machines and then 2% would be a game of blackjack and that's 629.80s - 635.00s | why card counting and blackjack is most likely to be able to reduce the casinos 635.00s - 640.40s | favor because if you if you use like perfect strategy which is just doing the 640.40s - 644.84s | the plays that are statistically most likely to have you win plus card counting 644.84s - 649.48s | you can reduce that to like closer to closer to zero and the only reason that 649.48s - 653.80s | the slot machines are 25% max is because of regulation anyway otherwise the 653.80s - 656.92s | casinos would probably want them to be higher but that's an example of algorithm 656.92s - 660.00s | hacking too because you're hacking the statistical process of being able to do 660.00s - 664.92s | that. So when we think about the modern iteration of hacking an AI system we 664.92s - 668.44s | come to the realm of adversarial machine learning and everyone probably has seen 668.44s - 671.96s | this picture before so I feel like I have to show it but basically the idea 671.96s - 677.76s | is


chunk_id: 136_chunk_14
chunk_text:
and then 2% would be a game of blackjack and that's 629.80s - 635.00s | why card counting and blackjack is most likely to be able to reduce the casinos 635.00s - 640.40s | favor because if you if you use like perfect strategy which is just doing the 640.40s - 644.84s | the plays that are statistically most likely to have you win plus card counting 644.84s - 649.48s | you can reduce that to like closer to closer to zero and the only reason that 649.48s - 653.80s | the slot machines are 25% max is because of regulation anyway otherwise the 653.80s - 656.92s | casinos would probably want them to be higher but that's an example of algorithm 656.92s - 660.00s | hacking too because you're hacking the statistical process of being able to do 660.00s - 664.92s | that. So when we think about the modern iteration of hacking an AI system we 664.92s - 668.44s | come to the realm of adversarial machine learning and everyone probably has seen 668.44s - 671.96s | this picture before so I feel like I have to show it but basically the idea 671.96s - 677.76s | is that you're able to create specifically crafted adversarial 677.76s - 682.26s | examples that you can then input into a machine learning model to make it not do 682.26s - 687.14s | what it's meant to basically. So this example is from ten years ago and this 687.14s - 691.90s | is like an image of a panda where you can have an adversarial example 691.90s - 696.86s | superimposed on top of that which is just perturbations to the image 696.86s - 700.62s | specifically crafted based on the target model that you're trying to attack and 700.62s - 705.54s | it can disrupt or deceive the model really successfully even though a human 705.54s - 709.78s | can't recognize it. So adversarial machine learning is the field that my 709.78s - 714.86s | PhD was in and you can consider it sort of the offensive side of AI security 714.86s - 719.38s | it's basically the field that is coming up the attacks but it's traditionally 719.38s - 723.70s | been very academic. Recently we're starting to see more examples of these 723.70s - 730.10s | kinds of things in real life so being able to actually you


chunk_id: 136_chunk_15
chunk_text:
that you're able to create specifically crafted adversarial 677.76s - 682.26s | examples that you can then input into a machine learning model to make it not do 682.26s - 687.14s | what it's meant to basically. So this example is from ten years ago and this 687.14s - 691.90s | is like an image of a panda where you can have an adversarial example 691.90s - 696.86s | superimposed on top of that which is just perturbations to the image 696.86s - 700.62s | specifically crafted based on the target model that you're trying to attack and 700.62s - 705.54s | it can disrupt or deceive the model really successfully even though a human 705.54s - 709.78s | can't recognize it. So adversarial machine learning is the field that my 709.78s - 714.86s | PhD was in and you can consider it sort of the offensive side of AI security 714.86s - 719.38s | it's basically the field that is coming up the attacks but it's traditionally 719.38s - 723.70s | been very academic. Recently we're starting to see more examples of these 723.70s - 730.10s | kinds of things in real life so being able to actually you know implement some 730.10s - 733.66s | change in the physical world that's able to prevent say autonomous vehicles from 733.66s - 738.62s | being able to recognize stop signs so they drive straight through. And in terms 738.62s - 743.38s | of the landscape of adversarial machine learning attacks it's massive it's just 743.38s - 747.42s | exploded over the last ten years and if we think about all of the different 747.42s - 752.34s | attack surfaces represented by AI systems and so on the top things like 752.34s - 755.98s | convolutional neural networks which is a machine learning model really good at 755.98s - 761.02s | computer vision versus something like a transformer along the bottom which is 761.02s - 764.98s | very good at natural language processing in the backbone of things like GPT. 765.82s - 769.90s | They're very different attack surfaces but many different adversarial machine 769.90s - 774.58s | learning methods now exist that are able to very successfully do bad things at 774.58s - 779.62s | each stage of that attack at that attack surface. So most of the time these 779.62s - 783.70s | attacks require you to actually change


chunk_id: 136_chunk_16
chunk_text:
know implement some 730.10s - 733.66s | change in the physical world that's able to prevent say autonomous vehicles from 733.66s - 738.62s | being able to recognize stop signs so they drive straight through. And in terms 738.62s - 743.38s | of the landscape of adversarial machine learning attacks it's massive it's just 743.38s - 747.42s | exploded over the last ten years and if we think about all of the different 747.42s - 752.34s | attack surfaces represented by AI systems and so on the top things like 752.34s - 755.98s | convolutional neural networks which is a machine learning model really good at 755.98s - 761.02s | computer vision versus something like a transformer along the bottom which is 761.02s - 764.98s | very good at natural language processing in the backbone of things like GPT. 765.82s - 769.90s | They're very different attack surfaces but many different adversarial machine 769.90s - 774.58s | learning methods now exist that are able to very successfully do bad things at 774.58s - 779.62s | each stage of that attack at that attack surface. So most of the time these 779.62s - 783.70s | attacks require you to actually change something about the object itself right. 783.70s - 788.90s | So you have the panda example before we have things like adversarial glasses 788.90s - 793.38s | that prevent a person being recognized from detection. You have like a jumper 793.42s - 798.26s | that can also hide a person from person detection. And the example I love on the 798.26s - 803.18s | bottom right is this DARPA model that was meant to be used in sort of urban 803.18s - 807.14s | warfare environments to detect people and they asked their Marines to try and 807.14s - 810.74s | red team that model and they found that the Marines could just act not like 810.74s - 814.10s | people and very successfully deceive the model. So they did things like put 814.10s - 817.62s | cardboard boxes on their heads. They waved branches around and acted like 817.62s - 821.10s | trees whatever that means. And they were very successfully able to hack the 821.10s - 826.76s | model. The the challenge with all of these things is that you're actually 826.76s - 830.20s | required to change something about the object itself that's being classified. 831.40s -


chunk_id: 136_chunk_17
chunk_text:
something about the object itself right. 783.70s - 788.90s | So you have the panda example before we have things like adversarial glasses 788.90s - 793.38s | that prevent a person being recognized from detection. You have like a jumper 793.42s - 798.26s | that can also hide a person from person detection. And the example I love on the 798.26s - 803.18s | bottom right is this DARPA model that was meant to be used in sort of urban 803.18s - 807.14s | warfare environments to detect people and they asked their Marines to try and 807.14s - 810.74s | red team that model and they found that the Marines could just act not like 810.74s - 814.10s | people and very successfully deceive the model. So they did things like put 814.10s - 817.62s | cardboard boxes on their heads. They waved branches around and acted like 817.62s - 821.10s | trees whatever that means. And they were very successfully able to hack the 821.10s - 826.76s | model. The the challenge with all of these things is that you're actually 826.76s - 830.20s | required to change something about the object itself that's being classified. 831.40s - 835.52s | There are some examples of like attacks where you don't need to change the 835.52s - 839.56s | thing itself. This is called an adversarial sticker. So if I put this next 839.56s - 845.52s | to something else a model is going to like predict that this is a toaster. So 845.52s - 848.96s | if I put this next to a banana which is the sort of the example that they they 848.96s - 853.40s | give instead of recognizing the banana the model is going to see a toaster 853.40s - 857.84s | instead. However this is sort of challenging because like this is very 857.84s - 860.76s | obvious like if I put this next to a banana I'd be like that's not meant to 860.76s - 866.60s | be there. That's a banana. But a model doesn't see it that way. So I had a 866.60s - 871.00s | thought I was like what if you could like change something about what's in 871.00s - 875.92s | the image frame itself but you didn't have to perturb the actual image. And so 875.92s - 880.92s | I came up with this technique called


chunk_id: 136_chunk_18
chunk_text:
835.52s | There are some examples of like attacks where you don't need to change the 835.52s - 839.56s | thing itself. This is called an adversarial sticker. So if I put this next 839.56s - 845.52s | to something else a model is going to like predict that this is a toaster. So 845.52s - 848.96s | if I put this next to a banana which is the sort of the example that they they 848.96s - 853.40s | give instead of recognizing the banana the model is going to see a toaster 853.40s - 857.84s | instead. However this is sort of challenging because like this is very 857.84s - 860.76s | obvious like if I put this next to a banana I'd be like that's not meant to 860.76s - 866.60s | be there. That's a banana. But a model doesn't see it that way. So I had a 866.60s - 871.00s | thought I was like what if you could like change something about what's in 871.00s - 875.92s | the image frame itself but you didn't have to perturb the actual image. And so 875.92s - 880.92s | I came up with this technique called distributed adversarial regions. And this 880.92s - 885.00s | is part of my PhD where I was sort of coming up with this attack. And so the 885.00s - 889.12s | intent for this was largely in urban camouflage environments. So being able to 889.12s - 895.96s | do things like have specially crafted buoys around ships for example like 895.96s - 899.96s | military ships. So you think it's a container ship instead or having it 899.96s - 904.92s | around other different kinds of military platforms. And if I can easily get the 904.92s - 914.22s | video working. This is just a very quick example of what this would look like. So 914.22s - 918.82s | if you have these sorts of buoys around that's a Japanese U-boat. You can 918.82s - 925.22s | actually prevent the model from recognizing that platform. Also don't 925.22s - 927.94s | come at me for them not being real buoys. It would have been a very expensive 927.94s - 933.38s | endeavor to like put buoys around a vessel. The thing about being able to 933.50s - 938.70s | digitally manipulate the images is that um you know it's a


chunk_id: 136_chunk_19
chunk_text:
distributed adversarial regions. And this 880.92s - 885.00s | is part of my PhD where I was sort of coming up with this attack. And so the 885.00s - 889.12s | intent for this was largely in urban camouflage environments. So being able to 889.12s - 895.96s | do things like have specially crafted buoys around ships for example like 895.96s - 899.96s | military ships. So you think it's a container ship instead or having it 899.96s - 904.92s | around other different kinds of military platforms. And if I can easily get the 904.92s - 914.22s | video working. This is just a very quick example of what this would look like. So 914.22s - 918.82s | if you have these sorts of buoys around that's a Japanese U-boat. You can 918.82s - 925.22s | actually prevent the model from recognizing that platform. Also don't 925.22s - 927.94s | come at me for them not being real buoys. It would have been a very expensive 927.94s - 933.38s | endeavor to like put buoys around a vessel. The thing about being able to 933.50s - 938.70s | digitally manipulate the images is that um you know it's a really good surrogate 938.70s - 941.86s | for not being able to actually change the physical environment. Um and being 941.86s - 946.86s | able to test it. So I I wanted to see if I could apply this technique to things 950.78s - 955.78s | like um facial recognition for this casino context. So how does this relate to 957.06s - 962.06s | casinos? I assume everyone here is familiar with the Oceans 11 franchise. Yes 963.42s - 966.82s | I mean it's it's a heist. You know like we don't need to get too too thinking 966.82s - 971.90s | about it. The idea is that we're basically just bypassing all of these different um 971.90s - 976.30s | security levels that they have in a really cool way. Ideally there's um like 976.30s - 980.84s | bourbon and and suits and George Clooney. Um I did not get to have a George Clooney 980.84s - 985.88s | in my life. I'm doing this talk but that's okay. Um so we get the premise of the 985.88s - 990.88s | heist. This is what I wanted to do. I wanted to understand uh casino Canberra's I 990.88s -


chunk_id: 136_chunk_20
chunk_text:
really good surrogate 938.70s - 941.86s | for not being able to actually change the physical environment. Um and being 941.86s - 946.86s | able to test it. So I I wanted to see if I could apply this technique to things 950.78s - 955.78s | like um facial recognition for this casino context. So how does this relate to 957.06s - 962.06s | casinos? I assume everyone here is familiar with the Oceans 11 franchise. Yes 963.42s - 966.82s | I mean it's it's a heist. You know like we don't need to get too too thinking 966.82s - 971.90s | about it. The idea is that we're basically just bypassing all of these different um 971.90s - 976.30s | security levels that they have in a really cool way. Ideally there's um like 976.30s - 980.84s | bourbon and and suits and George Clooney. Um I did not get to have a George Clooney 980.84s - 985.88s | in my life. I'm doing this talk but that's okay. Um so we get the premise of the 985.88s - 990.88s | heist. This is what I wanted to do. I wanted to understand uh casino Canberra's I 990.88s - 995.88s | don't know AI operational environment. Um then I'm going to pick some target 998.12s - 1003.80s | models to create this attack. And then going to you know implement the the the 1003.80s - 1007.54s | DAS, the distributed adversarial regions. I'm going to test how I can sort of 1007.54s - 1012.54s | disguise them in different ways and then lessons learned and sort of next steps. 1014.40s - 1019.22s | So the first step. I I mentioned my PhD. I've been doing it part time for a really 1019.22s - 1024.02s | long time. So I feel like I should be finished but I'm not. Um now this is annoying 1024.02s - 1028.30s | because it's really hard to like simultaneously try and build a start up and also 1028.30s - 1033.00s | finish a PhD. My supervisors only one of them knows I'm here right now. The other 1033.00s - 1037.68s | thing comes in Canberra like working working from the university. Um so don't tell 1037.68s - 1042.54s | them. But the good thing about still doing a PhD is not only do I get really good 1042.54s - 1048.18s | student discounts but


chunk_id: 136_chunk_21
chunk_text:
995.88s | don't know AI operational environment. Um then I'm going to pick some target 998.12s - 1003.80s | models to create this attack. And then going to you know implement the the the 1003.80s - 1007.54s | DAS, the distributed adversarial regions. I'm going to test how I can sort of 1007.54s - 1012.54s | disguise them in different ways and then lessons learned and sort of next steps. 1014.40s - 1019.22s | So the first step. I I mentioned my PhD. I've been doing it part time for a really 1019.22s - 1024.02s | long time. So I feel like I should be finished but I'm not. Um now this is annoying 1024.02s - 1028.30s | because it's really hard to like simultaneously try and build a start up and also 1028.30s - 1033.00s | finish a PhD. My supervisors only one of them knows I'm here right now. The other 1033.00s - 1037.68s | thing comes in Canberra like working working from the university. Um so don't tell 1037.68s - 1042.54s | them. But the good thing about still doing a PhD is not only do I get really good 1042.54s - 1048.18s | student discounts but people are very helpful. So if I reach out to people and I tell 1048.18s - 1052.82s | them that I want to do something as part of my PhD, people generally say yes. It 1052.82s - 1056.68s | helps that I'm also sort of like nice and polite and you know people are always just 1056.68s - 1061.76s | very helpful. Um so this is what I did with Casino Canberra. And they were very 1061.76s - 1067.40s | willing to help which was nice of them. So this is Casino Canberra. Maybe it doesn't 1067.40s - 1072.90s | look like the Bellagio or the MGM Grand but like they have a a red carpet. Um it's 1072.90s - 1076.48s | very nice. It's right next to our civic centre. Um it's between there and the 1076.48s - 1081.88s | convention centre. Um it's you know they they do okay. Um they're very excited 1081.88s - 1085.28s | about a new upgrade that that they're doing. They're gonna get a lot bigger. 1085.28s - 1091.28s | There'll be a hotel. Um they they've got it going on. So as part of this upgrade 1091.28s - 1095.70s | they're thinking


chunk_id: 136_chunk_22
chunk_text:
people are very helpful. So if I reach out to people and I tell 1048.18s - 1052.82s | them that I want to do something as part of my PhD, people generally say yes. It 1052.82s - 1056.68s | helps that I'm also sort of like nice and polite and you know people are always just 1056.68s - 1061.76s | very helpful. Um so this is what I did with Casino Canberra. And they were very 1061.76s - 1067.40s | willing to help which was nice of them. So this is Casino Canberra. Maybe it doesn't 1067.40s - 1072.90s | look like the Bellagio or the MGM Grand but like they have a a red carpet. Um it's 1072.90s - 1076.48s | very nice. It's right next to our civic centre. Um it's between there and the 1076.48s - 1081.88s | convention centre. Um it's you know they they do okay. Um they're very excited 1081.88s - 1085.28s | about a new upgrade that that they're doing. They're gonna get a lot bigger. 1085.28s - 1091.28s | There'll be a hotel. Um they they've got it going on. So as part of this upgrade 1091.28s - 1095.70s | they're thinking about implementing artificial intelligence for the first time. 1095.70s - 1100.96s | Something I was really interested to learn through doing this sort of research was 1100.98s - 1105.98s | that um facial recognition and person detection was by far the largest um like the 1108.62s - 1113.86s | most important form of AI for casinos. But it's obviously very unequal in how casinos 1113.86s - 1120.00s | are able to adopt them. So all of the casinos we have here in Vegas would very much rely 1120.00s - 1124.04s | on using AI and they would have very mature practices around it. And in fact they 1124.04s - 1128.18s | would actually build their casinos using this AI in mind. So when we walk around the 1128.20s - 1132.94s | casino you might notice that sometimes there are like sort of narrow corridors that you're 1132.94s - 1136.24s | forced to walk through. And that's to make sure that your faces are actually caught by 1136.24s - 1142.04s | these cameras. So as as a casino like Casino Canberra is thinking about their redesign 1142.04s - 1146.78s | this is very much inherent in how they actually decide to


chunk_id: 136_chunk_23
chunk_text:
about implementing artificial intelligence for the first time. 1095.70s - 1100.96s | Something I was really interested to learn through doing this sort of research was 1100.98s - 1105.98s | that um facial recognition and person detection was by far the largest um like the 1108.62s - 1113.86s | most important form of AI for casinos. But it's obviously very unequal in how casinos 1113.86s - 1120.00s | are able to adopt them. So all of the casinos we have here in Vegas would very much rely 1120.00s - 1124.04s | on using AI and they would have very mature practices around it. And in fact they 1124.04s - 1128.18s | would actually build their casinos using this AI in mind. So when we walk around the 1128.20s - 1132.94s | casino you might notice that sometimes there are like sort of narrow corridors that you're 1132.94s - 1136.24s | forced to walk through. And that's to make sure that your faces are actually caught by 1136.24s - 1142.04s | these cameras. So as as a casino like Casino Canberra is thinking about their redesign 1142.04s - 1146.78s | this is very much inherent in how they actually decide to design the casino. So that they 1146.78s - 1152.22s | can use things like facial recognition to identify money launderers or known criminals 1152.22s - 1157.40s | or card counters I guess. Um also problem gamblers. Um there are some you know nice 1157.42s - 1160.52s | use cases for it as well. They want to make sure that people aren't gambling too much. 1160.52s - 1165.26s | Just the right amount. Um and things like number plate recognition for cars is also 1165.26s - 1169.80s | really important. Um but in terms of AI this is very much a computer vision problem. So 1169.80s - 1173.50s | being able to see things in the environment and understand it. They don't really have a 1173.50s - 1178.60s | lot of use for other kinds of AI right now anyway. Not not things like chat bots or signal 1178.60s - 1183.88s | processing. That's not that's not really in their realm. Um but right now they're also 1183.90s - 1188.80s | very much dependent on people. Just being able to um like identify those known people and 1188.80s - 1193.40s | then log them in the system. Um that's that's very


chunk_id: 136_chunk_24
chunk_text:
design the casino. So that they 1146.78s - 1152.22s | can use things like facial recognition to identify money launderers or known criminals 1152.22s - 1157.40s | or card counters I guess. Um also problem gamblers. Um there are some you know nice 1157.42s - 1160.52s | use cases for it as well. They want to make sure that people aren't gambling too much. 1160.52s - 1165.26s | Just the right amount. Um and things like number plate recognition for cars is also 1165.26s - 1169.80s | really important. Um but in terms of AI this is very much a computer vision problem. So 1169.80s - 1173.50s | being able to see things in the environment and understand it. They don't really have a 1173.50s - 1178.60s | lot of use for other kinds of AI right now anyway. Not not things like chat bots or signal 1178.60s - 1183.88s | processing. That's not that's not really in their realm. Um but right now they're also 1183.90s - 1188.80s | very much dependent on people. Just being able to um like identify those known people and 1188.80s - 1193.40s | then log them in the system. Um that's that's very much still dependent on on humans even 1193.40s - 1198.40s | here. So what I did next was I need to choose a victim right? Um like I said Casino Canberra 1200.62s - 1205.92s | doesn't currently use AI so I couldn't really use any like live facial recognition that 1205.92s - 1211.62s | they were using right now. So instead I had to pick uh an appropriate victim that would 1211.66s - 1216.30s | be close enough to something they would use. And you might think that this is a problem. 1216.30s - 1220.44s | However it's not fortunately because of this principle in machine learning and its 1220.44s - 1226.88s | convergence. I don't know if this works with a big crowd. Um but I might try some audience 1226.88s - 1230.42s | participation. I don't know. Does anyone want to shout out and guess what this number 1230.42s - 1238.57s | might represent? I actually can't hear anyone anyway. So I'm gonna assume that maybe one 1238.61s - 1243.61s | of you was right. Um so this number actually represents um some significant research into 1246.95s - 1251.95s | similarity of models. So if you have a


chunk_id: 136_chunk_25
chunk_text:
much still dependent on on humans even 1193.40s - 1198.40s | here. So what I did next was I need to choose a victim right? Um like I said Casino Canberra 1200.62s - 1205.92s | doesn't currently use AI so I couldn't really use any like live facial recognition that 1205.92s - 1211.62s | they were using right now. So instead I had to pick uh an appropriate victim that would 1211.66s - 1216.30s | be close enough to something they would use. And you might think that this is a problem. 1216.30s - 1220.44s | However it's not fortunately because of this principle in machine learning and its 1220.44s - 1226.88s | convergence. I don't know if this works with a big crowd. Um but I might try some audience 1226.88s - 1230.42s | participation. I don't know. Does anyone want to shout out and guess what this number 1230.42s - 1238.57s | might represent? I actually can't hear anyone anyway. So I'm gonna assume that maybe one 1238.61s - 1243.61s | of you was right. Um so this number actually represents um some significant research into 1246.95s - 1251.95s | similarity of models. So if you have a model trained on similar data to do similar things 1254.45s - 1259.43s | you end up with a similar model. Like basically the same model. Um and this is actually 1259.43s - 1264.43s | really significant because a lot of the models that companies rely on and produce as part 1264.43s - 1269.43s | of their IP are very much or like you know exactly the same as open source models. And in 1272.63s - 1276.17s | fact a lot of the time they do actually just use open source models and then do a bit of 1276.17s - 1280.15s | fine tuning. And that doesn't necessarily change the model itself. Certainly doesn't change 1280.15s - 1284.05s | the architecture. It might change uh you know sort of how you apply it to different use 1284.05s - 1289.05s | cases. But it a lot of research has been done to show that if you compare two models an open 1289.91s - 1294.91s | source model with uh like a a model that is a company's IP to do things like facial 1296.75s - 1301.75s | recognition. They are 95 to 99 percent similar. It's a minimum of 95 percent similarity.


chunk_id: 136_chunk_26
chunk_text:
model trained on similar data to do similar things 1254.45s - 1259.43s | you end up with a similar model. Like basically the same model. Um and this is actually 1259.43s - 1264.43s | really significant because a lot of the models that companies rely on and produce as part 1264.43s - 1269.43s | of their IP are very much or like you know exactly the same as open source models. And in 1272.63s - 1276.17s | fact a lot of the time they do actually just use open source models and then do a bit of 1276.17s - 1280.15s | fine tuning. And that doesn't necessarily change the model itself. Certainly doesn't change 1280.15s - 1284.05s | the architecture. It might change uh you know sort of how you apply it to different use 1284.05s - 1289.05s | cases. But it a lot of research has been done to show that if you compare two models an open 1289.91s - 1294.91s | source model with uh like a a model that is a company's IP to do things like facial 1296.75s - 1301.75s | recognition. They are 95 to 99 percent similar. It's a minimum of 95 percent similarity. 1303.35s - 1308.23s | Which is really significant because it means that I don't really need to you know do 1308.23s - 1313.23s | anything to um difficult to be able to find a good victim model. So that's convergence. 1315.52s - 1320.52s | So there's a lot of different victim models that I wanted to test. Um like I mentioned I 1322.62s - 1326.26s | already did this attack for things like urban camouflage. So being able to do things like 1326.26s - 1330.26s | object detection and testing some of those models. Um I also added some of these facial 1330.26s - 1334.94s | recognition models um as well. These are just a few of the the open source models available 1334.94s - 1339.94s | at the moment. So the next step is to create these distributed adversarial regions. Um and 1340.82s - 1345.82s | this is a fairly boring diagram. So maybe I'll show you instead a slightly less boring video. 1348.34s - 1353.34s | Um it it's very hard trying to create fun demos for this. I don't know. So um maybe I need to 1357.04s - 1362.04s | find a way. So so this is


chunk_id: 136_chunk_27
chunk_text:
1303.35s - 1308.23s | Which is really significant because it means that I don't really need to you know do 1308.23s - 1313.23s | anything to um difficult to be able to find a good victim model. So that's convergence. 1315.52s - 1320.52s | So there's a lot of different victim models that I wanted to test. Um like I mentioned I 1322.62s - 1326.26s | already did this attack for things like urban camouflage. So being able to do things like 1326.26s - 1330.26s | object detection and testing some of those models. Um I also added some of these facial 1330.26s - 1334.94s | recognition models um as well. These are just a few of the the open source models available 1334.94s - 1339.94s | at the moment. So the next step is to create these distributed adversarial regions. Um and 1340.82s - 1345.82s | this is a fairly boring diagram. So maybe I'll show you instead a slightly less boring video. 1348.34s - 1353.34s | Um it it's very hard trying to create fun demos for this. I don't know. So um maybe I need to 1357.04s - 1362.04s | find a way. So so this is the um the the video that I'm testing on right. This is me walking 1362.18s - 1367.18s | up to the the detection. And this is uh me implementing the attack on one of my target 1372.02s - 1377.46s | models. Um so I'll talk through the method because it takes a couple of minutes. But 1377.46s - 1382.90s | basically all I need to do to implement this attack is to uh perform an optimization 1382.90s - 1389.74s | algorithm on the video in question. To identify different regions where if I perturb them in 1389.74s - 1395.22s | certain ways um they're going to cause a misclassification which sounds really easy. Um but 1395.22s - 1400.82s | the the difficult thing is in sort of making those areas not too obvious or at least being able 1400.82s - 1405.82s | to pick uh a few different regions that could reasonably actually be altered. And so this 1407.86s - 1412.86s | code shows me being able to like perform that optimization uh based on one of these victim 1413.20s - 1418.20s | models. Um making a prediction on on this video. If you're not a person who finds the


chunk_id: 136_chunk_28
chunk_text:
the um the the video that I'm testing on right. This is me walking 1362.18s - 1367.18s | up to the the detection. And this is uh me implementing the attack on one of my target 1372.02s - 1377.46s | models. Um so I'll talk through the method because it takes a couple of minutes. But 1377.46s - 1382.90s | basically all I need to do to implement this attack is to uh perform an optimization 1382.90s - 1389.74s | algorithm on the video in question. To identify different regions where if I perturb them in 1389.74s - 1395.22s | certain ways um they're going to cause a misclassification which sounds really easy. Um but 1395.22s - 1400.82s | the the difficult thing is in sort of making those areas not too obvious or at least being able 1400.82s - 1405.82s | to pick uh a few different regions that could reasonably actually be altered. And so this 1407.86s - 1412.86s | code shows me being able to like perform that optimization uh based on one of these victim 1413.20s - 1418.20s | models. Um making a prediction on on this video. If you're not a person who finds the code 1424.73s - 1428.59s | interesting uh maybe at least the thing you can take away is that it only takes a minute to do. 1428.59s - 1434.57s | Like it it's very easy. Um and I don't even need to use like an existing um pre-built library 1434.57s - 1438.03s | or anything. It it's just an optimization algorithm. So so when I said before that there's 1438.03s - 1444.55s | over a hundred different kinds of adversarial machine learning attacks. Um it's it's really 1444.55s - 1452.76s | easy to just sort of build them yourself. It it's all optimization at the end of the day. So we 1452.76s - 1457.86s | can see on the screen here that the the code read out no match found. And then when I add the 1457.86s - 1463.96s | perturbed image um sorry so that there was a match found um for the clean image and then when 1463.96s - 1475.69s | I added the distributed adversarial regions there was no match found. So the interesting thing 1475.69s - 1482.09s | about being able to like do the testing or maybe not the most interesting thing actually. Um but 1482.09s


chunk_id: 136_chunk_29
chunk_text:
code 1424.73s - 1428.59s | interesting uh maybe at least the thing you can take away is that it only takes a minute to do. 1428.59s - 1434.57s | Like it it's very easy. Um and I don't even need to use like an existing um pre-built library 1434.57s - 1438.03s | or anything. It it's just an optimization algorithm. So so when I said before that there's 1438.03s - 1444.55s | over a hundred different kinds of adversarial machine learning attacks. Um it's it's really 1444.55s - 1452.76s | easy to just sort of build them yourself. It it's all optimization at the end of the day. So we 1452.76s - 1457.86s | can see on the screen here that the the code read out no match found. And then when I add the 1457.86s - 1463.96s | perturbed image um sorry so that there was a match found um for the clean image and then when 1463.96s - 1475.69s | I added the distributed adversarial regions there was no match found. So the interesting thing 1475.69s - 1482.09s | about being able to like do the testing or maybe not the most interesting thing actually. Um but 1482.09s - 1487.09s | the the process of actually thinking about the attack surface and let me skip through here. Um 1490.63s - 1496.37s | thinking about the actual attack surface and what we're like affecting in this attack. So all 1496.37s - 1500.87s | computer vision most computer vision relies on convolution convolutional neural networks 1500.87s - 1506.47s | because they're the most powerful sort of model to be able to do this. Um and being able to 1506.47s - 1510.75s | create attacks that work for most of them it's actually pretty easy. So if we think about facial 1510.77s - 1517.71s | recognition the way that it works is that it it sort of takes your facial geometry and then is able 1517.71s - 1523.05s | to compress it into an embedding space. Um and being able to identify clusters and sort of 1523.05s - 1530.03s | relationships between them and then um based on that mapping you know be able to identify me 1530.03s - 1535.47s | versus not me I guess. And so when I have that information I can do things like create specific 1535.49s - 1540.49s | patterns that change that distribution. So if


chunk_id: 136_chunk_30
chunk_text:
- 1487.09s | the the process of actually thinking about the attack surface and let me skip through here. Um 1490.63s - 1496.37s | thinking about the actual attack surface and what we're like affecting in this attack. So all 1496.37s - 1500.87s | computer vision most computer vision relies on convolution convolutional neural networks 1500.87s - 1506.47s | because they're the most powerful sort of model to be able to do this. Um and being able to 1506.47s - 1510.75s | create attacks that work for most of them it's actually pretty easy. So if we think about facial 1510.77s - 1517.71s | recognition the way that it works is that it it sort of takes your facial geometry and then is able 1517.71s - 1523.05s | to compress it into an embedding space. Um and being able to identify clusters and sort of 1523.05s - 1530.03s | relationships between them and then um based on that mapping you know be able to identify me 1530.03s - 1535.47s | versus not me I guess. And so when I have that information I can do things like create specific 1535.49s - 1540.49s | patterns that change that distribution. So if I go back and play um this other recording I want to 1550.63s - 1556.07s | be able to test doing things like um creating jewelry. So this is this is the example that I'm 1556.07s - 1561.07s | testing. So the the challenging thing about building models or thinking about model 1561.99s - 1566.99s | security is that all of these models that are that I'm testing on it doesn't actually take much to 1570.67s - 1575.67s | be able to disrupt them. Um creating this attack is really very simple. Let me skip back to the 1590.01s - 1597.67s | slides while this uh while this loads. So maybe it doesn't look so interesting but being able to 1598.21s - 1603.21s | do that attack and like have it not recognize me um I guess that's a way of saying that I hacked the 1604.75s - 1609.75s | model right. I mean it was able to not recognize me because I created these sort of adversarial 1611.59s - 1616.59s | earrings that you know when the model looks at that that image of me um it doesn't recognize me. 1618.13s - 1622.83s | When I test it um


chunk_id: 136_chunk_31
chunk_text:
I go back and play um this other recording I want to 1550.63s - 1556.07s | be able to test doing things like um creating jewelry. So this is this is the example that I'm 1556.07s - 1561.07s | testing. So the the challenging thing about building models or thinking about model 1561.99s - 1566.99s | security is that all of these models that are that I'm testing on it doesn't actually take much to 1570.67s - 1575.67s | be able to disrupt them. Um creating this attack is really very simple. Let me skip back to the 1590.01s - 1597.67s | slides while this uh while this loads. So maybe it doesn't look so interesting but being able to 1598.21s - 1603.21s | do that attack and like have it not recognize me um I guess that's a way of saying that I hacked the 1604.75s - 1609.75s | model right. I mean it was able to not recognize me because I created these sort of adversarial 1611.59s - 1616.59s | earrings that you know when the model looks at that that image of me um it doesn't recognize me. 1618.13s - 1622.83s | When I test it um that's the important part of the process right from machine learning 1622.83s - 1627.93s | perspective. This looks very boring too. Um I I tested all of those different models and I 1627.93s - 1632.41s | wanted to see the extent to which the attack actually works and decreases the confidence level 1632.41s - 1637.41s | of that attack. Um as a way of distilling all of the sort of the boring columns in the graph, the 1639.01s - 1644.01s | number that we ended up with was a 40.4 percent reduction in like confidence. Um so what does 1646.11s - 1651.93s | that actually mean? Is is that significant? Um when I implemented this attack on the urban 1651.95s - 1658.57s | camouflage environments um it was more successful honestly. It's it's a bit easier for things like 1658.57s - 1664.81s | ships and military platforms because those models tend to rely a lot more on context and in 1664.81s - 1670.11s | facial recognition it's a little bit harder because a lot of models would tend to um look at the 1670.11s - 1676.49s | geometry um slightly differently. But 40.4 percent on the whole of all of


chunk_id: 136_chunk_32
chunk_text:
that's the important part of the process right from machine learning 1622.83s - 1627.93s | perspective. This looks very boring too. Um I I tested all of those different models and I 1627.93s - 1632.41s | wanted to see the extent to which the attack actually works and decreases the confidence level 1632.41s - 1637.41s | of that attack. Um as a way of distilling all of the sort of the boring columns in the graph, the 1639.01s - 1644.01s | number that we ended up with was a 40.4 percent reduction in like confidence. Um so what does 1646.11s - 1651.93s | that actually mean? Is is that significant? Um when I implemented this attack on the urban 1651.95s - 1658.57s | camouflage environments um it was more successful honestly. It's it's a bit easier for things like 1658.57s - 1664.81s | ships and military platforms because those models tend to rely a lot more on context and in 1664.81s - 1670.11s | facial recognition it's a little bit harder because a lot of models would tend to um look at the 1670.11s - 1676.49s | geometry um slightly differently. But 40.4 percent on the whole of all of the models that I 1676.51s - 1682.09s | tested is actually really significant because that means that if I have say a confidence 1682.09s - 1687.09s | threshold of um like 90 percent. So a model looks at an image of me and says with 99 percent 1689.29s - 1694.29s | confidence that it is me, being able to decrease that confidence by around 40 percent means that 1696.83s - 1701.97s | if it was originally 99 percent then it's going to be um 40 percent less than that and it's not 1701.99s - 1708.37s | going to meet that threshold. So I don't actually need to affect a massive change in the model to 1708.37s - 1714.67s | be able to have it not recognize who I am. And I guess a way of thinking about that is by 1714.67s - 1719.91s | calling it context. But really what it means is that most of the models that are already out 1719.91s - 1725.01s | there, all of the open source models that we use and data scientists use and organizations in 1725.03s - 1732.03s | fact use and then fine tune are vulnerable to an attack like this,


chunk_id: 136_chunk_33
chunk_text:
the models that I 1676.51s - 1682.09s | tested is actually really significant because that means that if I have say a confidence 1682.09s - 1687.09s | threshold of um like 90 percent. So a model looks at an image of me and says with 99 percent 1689.29s - 1694.29s | confidence that it is me, being able to decrease that confidence by around 40 percent means that 1696.83s - 1701.97s | if it was originally 99 percent then it's going to be um 40 percent less than that and it's not 1701.99s - 1708.37s | going to meet that threshold. So I don't actually need to affect a massive change in the model to 1708.37s - 1714.67s | be able to have it not recognize who I am. And I guess a way of thinking about that is by 1714.67s - 1719.91s | calling it context. But really what it means is that most of the models that are already out 1719.91s - 1725.01s | there, all of the open source models that we use and data scientists use and organizations in 1725.03s - 1732.03s | fact use and then fine tune are vulnerable to an attack like this, which is really very 1732.03s - 1737.03s | simple you know. Um what I did by adding uh you know regions of perturbation to myself is 1741.01s - 1746.01s | really is definitely not the most sophisticated the most sophisticated kind of attack. Um 1746.01s - 1750.85s | yesterday I was at an AI security forum and it was amazing because everyone was sort of 1750.85s - 1756.33s | talking about all of the latest breakthroughs in in AI security and how we can make models 1756.33s - 1761.53s | extremely secure and the technical and the governance things. The the really challenging 1761.53s - 1767.61s | thing though is that most organizations don't have that existing level of maturity and the 1767.61s - 1772.05s | kinds of models that they're using are these kinds of open source models that only take a few 1772.05s - 1777.05s | regions to be disrupted and to cause a misclassification. And thinking about the uh I guess 1777.89s - 1782.89s | thinking about what this actually means is really significant because while I've applied 1785.03s - 1790.57s | this to a computer vision use case, so this could work for things like retina


chunk_id: 136_chunk_34
chunk_text:
which is really very 1732.03s - 1737.03s | simple you know. Um what I did by adding uh you know regions of perturbation to myself is 1741.01s - 1746.01s | really is definitely not the most sophisticated the most sophisticated kind of attack. Um 1746.01s - 1750.85s | yesterday I was at an AI security forum and it was amazing because everyone was sort of 1750.85s - 1756.33s | talking about all of the latest breakthroughs in in AI security and how we can make models 1756.33s - 1761.53s | extremely secure and the technical and the governance things. The the really challenging 1761.53s - 1767.61s | thing though is that most organizations don't have that existing level of maturity and the 1767.61s - 1772.05s | kinds of models that they're using are these kinds of open source models that only take a few 1772.05s - 1777.05s | regions to be disrupted and to cause a misclassification. And thinking about the uh I guess 1777.89s - 1782.89s | thinking about what this actually means is really significant because while I've applied 1785.03s - 1790.57s | this to a computer vision use case, so this could work for things like retina scanning, 1790.57s - 1795.07s | number plate recognition as well, without actually having to change the object itself but 1795.07s - 1800.91s | just changing things around the object um really just highlights how brittle most models 1800.95s - 1805.95s | are. Um it also highlights that while I did this in a computer vision use case because 1809.05s - 1815.33s | that's sort of what what works for this um facial recognition casino context, exactly the 1815.33s - 1820.43s | same kind of attack could be applied to different domains as well. So things like uh 1820.43s - 1825.43s | natural language processing and signal processing. And when we think about what natural 1825.67s - 1831.73s | language processing and signal processing actually are in an AI uh use case context, natural 1831.73s - 1836.61s | language processing does all the the cyber security applications as well. So being able to 1836.61s - 1841.61s | identify uh malware, being able to um identify like good versus bad code, um they're natural 1844.15s - 1849.85s | language processing problems. And if we can add perturbances that are actually not about 1849.85s - 1853.99s | the the thing that we're trying


chunk_id: 136_chunk_35
chunk_text:
scanning, 1790.57s - 1795.07s | number plate recognition as well, without actually having to change the object itself but 1795.07s - 1800.91s | just changing things around the object um really just highlights how brittle most models 1800.95s - 1805.95s | are. Um it also highlights that while I did this in a computer vision use case because 1809.05s - 1815.33s | that's sort of what what works for this um facial recognition casino context, exactly the 1815.33s - 1820.43s | same kind of attack could be applied to different domains as well. So things like uh 1820.43s - 1825.43s | natural language processing and signal processing. And when we think about what natural 1825.67s - 1831.73s | language processing and signal processing actually are in an AI uh use case context, natural 1831.73s - 1836.61s | language processing does all the the cyber security applications as well. So being able to 1836.61s - 1841.61s | identify uh malware, being able to um identify like good versus bad code, um they're natural 1844.15s - 1849.85s | language processing problems. And if we can add perturbances that are actually not about 1849.85s - 1853.99s | the the thing that we're trying to classify, but it's still able to disrupt the model, that's 1853.99s - 1859.33s | a real problem. It's the same in the signal processing space, that's things like um RF and 1859.33s - 1864.33s | audio and um and LIDAR, you know all the signal processing problems we have, medical 1865.67s - 1871.47s | imaging, um being able to add perturbances that aren't even related to the thing that you're 1871.47s - 1876.47s | trying to classify represent a massive problem. Um I did some other research that looked at 1876.67s - 1881.67s | this in large language models as well. Uh this isn't exactly a cool demo, though I I wish it 1885.07s - 1890.35s | could be, but basically I was looking at being able to add different sort of ideas to 1890.35s - 1895.35s | language models and see if they could um if they would sort of take up that information and 1897.39s - 1902.39s | have it alter the messages that they were giving. And we found that um after sort of a few 1902.39s - 1907.39s | simulations and a few iterations of being able to add this additional kind of like noise


chunk_id: 136_chunk_36
chunk_text:
to classify, but it's still able to disrupt the model, that's 1853.99s - 1859.33s | a real problem. It's the same in the signal processing space, that's things like um RF and 1859.33s - 1864.33s | audio and um and LIDAR, you know all the signal processing problems we have, medical 1865.67s - 1871.47s | imaging, um being able to add perturbances that aren't even related to the thing that you're 1871.47s - 1876.47s | trying to classify represent a massive problem. Um I did some other research that looked at 1876.67s - 1881.67s | this in large language models as well. Uh this isn't exactly a cool demo, though I I wish it 1885.07s - 1890.35s | could be, but basically I was looking at being able to add different sort of ideas to 1890.35s - 1895.35s | language models and see if they could um if they would sort of take up that information and 1897.39s - 1902.39s | have it alter the messages that they were giving. And we found that um after sort of a few 1902.39s - 1907.39s | simulations and a few iterations of being able to add this additional kind of like noise 1909.13s - 1914.13s | material, they did actually successfully adopt these other um these other ideas, even if 1916.13s - 1921.13s | that wasn't um sort of encoded into them already. The when when we think about attacking 1923.11s - 1928.51s | machine learning models, the the challenging thing as well is that it's not the same as 1928.53s - 1934.47s | cyber security. Like when we think about testing a model and identifying uh what what makes a 1934.47s - 1939.45s | good model, data scientists will use scores like this. Um so they look at accuracy, they look 1939.45s - 1944.25s | at precision, uh recall an F1 score sort of related to precision as well. They look at all 1944.25s - 1949.25s | the statistical um functions for a model that makes it um like largely accurate. But the 1952.59s - 1957.57s | security is rarely ever considered and it's very it's a very different problem to a 1957.59s - 1963.37s | cyber security problem. I mean what does it mean to hack an AI system itself? You know I I sort 1963.37s - 1970.01s | of looked at that 40.4 percent number and felt a little


chunk_id: 136_chunk_37
chunk_text:
1909.13s - 1914.13s | material, they did actually successfully adopt these other um these other ideas, even if 1916.13s - 1921.13s | that wasn't um sort of encoded into them already. The when when we think about attacking 1923.11s - 1928.51s | machine learning models, the the challenging thing as well is that it's not the same as 1928.53s - 1934.47s | cyber security. Like when we think about testing a model and identifying uh what what makes a 1934.47s - 1939.45s | good model, data scientists will use scores like this. Um so they look at accuracy, they look 1939.45s - 1944.25s | at precision, uh recall an F1 score sort of related to precision as well. They look at all 1944.25s - 1949.25s | the statistical um functions for a model that makes it um like largely accurate. But the 1952.59s - 1957.57s | security is rarely ever considered and it's very it's a very different problem to a 1957.59s - 1963.37s | cyber security problem. I mean what does it mean to hack an AI system itself? You know I I sort 1963.37s - 1970.01s | of looked at that 40.4 percent number and felt a little bit disappointed. Like I sort of wished 1970.01s - 1974.27s | that it was a bit more definitive. But the thing with hacking an AI system is that it's not 1974.27s - 1980.31s | really a a binary um did it work or did it not. But it's more about on the whole we were able 1980.31s - 1985.99s | to reduce the classification confidence of a model. So it's more it's better to think about it 1986.01s - 1992.11s | as part of the kill chain. And quite a lot of the attacks at the moment are very much um sort of 1992.11s - 1996.69s | like a Stuxnet equivalent. You know they're they're very complicated, they're very difficult 1996.69s - 2001.85s | to implement. That's why there's this idea that they're a bit more academic than than realistic 2001.85s - 2007.87s | or practitioner based. Whereas even though being able to add like these these random 2007.87s - 2013.27s | distributed regions to an image um isn't all that sophisticated that the fact that it works 2013.29s - 2017.49s | and it actually disrupts a model most of the time is a real problem. And it's it's sort


chunk_id: 136_chunk_38
chunk_text:
bit disappointed. Like I sort of wished 1970.01s - 1974.27s | that it was a bit more definitive. But the thing with hacking an AI system is that it's not 1974.27s - 1980.31s | really a a binary um did it work or did it not. But it's more about on the whole we were able 1980.31s - 1985.99s | to reduce the classification confidence of a model. So it's more it's better to think about it 1986.01s - 1992.11s | as part of the kill chain. And quite a lot of the attacks at the moment are very much um sort of 1992.11s - 1996.69s | like a Stuxnet equivalent. You know they're they're very complicated, they're very difficult 1996.69s - 2001.85s | to implement. That's why there's this idea that they're a bit more academic than than realistic 2001.85s - 2007.87s | or practitioner based. Whereas even though being able to add like these these random 2007.87s - 2013.27s | distributed regions to an image um isn't all that sophisticated that the fact that it works 2013.29s - 2017.49s | and it actually disrupts a model most of the time is a real problem. And it's it's sort of more 2017.49s - 2023.23s | akin to like the the DDoS attack equivalent in a machine learning sense. Because even though 2023.23s - 2028.23s | that number was 40.4 percent um in our experience if you're able to leverage some sort of AI attack 2030.93s - 2036.21s | or some sort of adversarial machine learning attack you're able to hack the system 100 percent 2036.21s - 2041.35s | of the time. Because there's always a way that you can adapt it for whichever case study you need 2041.39s - 2047.07s | to. So the fact that so many organizations are reliant on these like inherently insecure 2047.07s - 2053.86s | models is a real problem. Because AI security is real. So if if we're thinking about like next 2055.16s - 2059.84s | steps and and lessons learned from an attack like this um we already have a few companies 2059.84s - 2064.84s | starting to put out reports about the incidence of AI security related attacks. Uh and it's it's 2066.74s - 2072.92s | changing a lot like it's uh encouraging that since I started in the field it's definitely uh 2072.92s - 2077.84s | being taken more seriously


chunk_id: 136_chunk_39
chunk_text:
of more 2017.49s - 2023.23s | akin to like the the DDoS attack equivalent in a machine learning sense. Because even though 2023.23s - 2028.23s | that number was 40.4 percent um in our experience if you're able to leverage some sort of AI attack 2030.93s - 2036.21s | or some sort of adversarial machine learning attack you're able to hack the system 100 percent 2036.21s - 2041.35s | of the time. Because there's always a way that you can adapt it for whichever case study you need 2041.39s - 2047.07s | to. So the fact that so many organizations are reliant on these like inherently insecure 2047.07s - 2053.86s | models is a real problem. Because AI security is real. So if if we're thinking about like next 2055.16s - 2059.84s | steps and and lessons learned from an attack like this um we already have a few companies 2059.84s - 2064.84s | starting to put out reports about the incidence of AI security related attacks. Uh and it's it's 2066.74s - 2072.92s | changing a lot like it's uh encouraging that since I started in the field it's definitely uh 2072.92s - 2077.84s | being taken more seriously and we're starting to see these incidents. Um but it's it's really 2077.84s - 2082.50s | unfortunate because we have so many lessons from the field of cyber security that we could bring 2082.50s - 2087.44s | into the field of AI security but they just aren't. So it's really important that all of the 2087.44s - 2091.42s | cyber folk in the room are thinking about how to solve these sorts of problems in AI security 2091.42s - 2098.42s | as well. Some of the um as I mentioned the the the interview with uh Casino Canberra was part 2098.46s - 2104.90s | of um many of the interviews we've done and we we've got these interesting insights already. 2104.90s - 2111.20s | Um 94 percent of the like people and organizations we spoke to could articulate how they use AI. 2111.20s - 2115.74s | Um even if maybe it's not what everyone would define as AI they they had an idea of how they 2115.74s - 2120.92s | use AI. Um but only 8 percent could articulate how they secure their AI and most of the time 2120.92s - 2126.22s | it's never really considered at all. The


chunk_id: 136_chunk_40
chunk_text:
and we're starting to see these incidents. Um but it's it's really 2077.84s - 2082.50s | unfortunate because we have so many lessons from the field of cyber security that we could bring 2082.50s - 2087.44s | into the field of AI security but they just aren't. So it's really important that all of the 2087.44s - 2091.42s | cyber folk in the room are thinking about how to solve these sorts of problems in AI security 2091.42s - 2098.42s | as well. Some of the um as I mentioned the the the interview with uh Casino Canberra was part 2098.46s - 2104.90s | of um many of the interviews we've done and we we've got these interesting insights already. 2104.90s - 2111.20s | Um 94 percent of the like people and organizations we spoke to could articulate how they use AI. 2111.20s - 2115.74s | Um even if maybe it's not what everyone would define as AI they they had an idea of how they 2115.74s - 2120.92s | use AI. Um but only 8 percent could articulate how they secure their AI and most of the time 2120.92s - 2126.22s | it's never really considered at all. The other reason I wanted to use the Casino case study was 2126.26s - 2133.26s | because a casino is a really good sort of analogy for a society that it's starting to um be built 2133.26s - 2139.40s | around surveillance as well. Like casinos are built with surveillance in mind and societies 2139.40s - 2144.84s | are increasingly sort of moving towards using more AI specifically facial recognition AI to do 2144.84s - 2149.84s | important things as well. So the the the important thing to think about from like the the the 2156.58s - 2162.02s | perspective of actually what you can do with the knowledge of these attacks is that even now in 2162.02s - 2167.02s | the casino environment it's it's still entirely reliant on people and process. And especially as 2171.44s - 2175.94s | organizations like casinos are going through this inflection point in adopting different AI 2175.94s - 2181.72s | technologies. Um being able to actually like govern that and implement it well is still really 2181.72s - 2187.48s | hard. And even though over here we have lots of very um you know technical and and mature 2187.48s - 2191.62s | conversations about


chunk_id: 136_chunk_41
chunk_text:
other reason I wanted to use the Casino case study was 2126.26s - 2133.26s | because a casino is a really good sort of analogy for a society that it's starting to um be built 2133.26s - 2139.40s | around surveillance as well. Like casinos are built with surveillance in mind and societies 2139.40s - 2144.84s | are increasingly sort of moving towards using more AI specifically facial recognition AI to do 2144.84s - 2149.84s | important things as well. So the the the important thing to think about from like the the the 2156.58s - 2162.02s | perspective of actually what you can do with the knowledge of these attacks is that even now in 2162.02s - 2167.02s | the casino environment it's it's still entirely reliant on people and process. And especially as 2171.44s - 2175.94s | organizations like casinos are going through this inflection point in adopting different AI 2175.94s - 2181.72s | technologies. Um being able to actually like govern that and implement it well is still really 2181.72s - 2187.48s | hard. And even though over here we have lots of very um you know technical and and mature 2187.48s - 2191.62s | conversations about it most organizations aren't are out there are still really grappling with how 2191.62s - 2196.62s | to do it. It's you know it's still so so reliant on having people to surveil it. And at the end 2200.10s - 2204.76s | of the day you know I went into you know Casino Canberra I asked very nicely if I could you know 2204.76s - 2209.90s | try hacking their things and they said yes. So what does it really mean? Um in terms of what 2209.92s - 2214.62s | Casino Canberra was able to do with this it's it's tough because they're reliant on third party AI. 2214.62s - 2219.26s | So all you can do is sort of ask the questions and hope that you know you keep it in mind. But 2219.26s - 2224.00s | there we're really so reliant on these organizations that provide the AI and there's no 2224.00s - 2228.64s | regulation around how they have to actually secure them or make sure that they're robust. So it's 2228.64s - 2233.64s | really challenging but at least being able to ask the question um it sort of helps. So um so 2234.02s - 2239.02s


chunk_id: 136_chunk_42
chunk_text:
it most organizations aren't are out there are still really grappling with how 2191.62s - 2196.62s | to do it. It's you know it's still so so reliant on having people to surveil it. And at the end 2200.10s - 2204.76s | of the day you know I went into you know Casino Canberra I asked very nicely if I could you know 2204.76s - 2209.90s | try hacking their things and they said yes. So what does it really mean? Um in terms of what 2209.92s - 2214.62s | Casino Canberra was able to do with this it's it's tough because they're reliant on third party AI. 2214.62s - 2219.26s | So all you can do is sort of ask the questions and hope that you know you keep it in mind. But 2219.26s - 2224.00s | there we're really so reliant on these organizations that provide the AI and there's no 2224.00s - 2228.64s | regulation around how they have to actually secure them or make sure that they're robust. So it's 2228.64s - 2233.64s | really challenging but at least being able to ask the question um it sort of helps. So um so 2234.02s - 2239.02s | that's it. I am talking tomorrow as well um about my experience in the Australian government. 2241.66s - 2246.40s | I worked at an intelligence agency so I'm also speaking in the policy village. Um I'm one of the 2246.40s - 2251.40s | creative stages about um sort of the policy element of these AI security attacks as well. Um so 2253.90s - 2256.04s | thank you so much for coming and please do keep in touch.


chunk_id: 136_chunk_43
chunk_text:
| that's it. I am talking tomorrow as well um about my experience in the Australian government. 2241.66s - 2246.40s | I worked at an intelligence agency so I'm also speaking in the policy village. Um I'm one of the 2246.40s - 2251.40s | creative stages about um sort of the policy element of these AI security attacks as well. Um so 2253.90s - 2256.04s | thank you so much for coming and please do keep in touch.


chunk_id: 137_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=lF8NEsl3-kQ", "title": "DEF CON 32 - Where\u2019s the Money-Defeating ATM Disk Encryption - Matt Burch", "description": "Holding upwards of $400,000, ATMs continue to be a target of opportunity and have seen over a 600% increase in crime in just the last few years. During this time, I led security research with another colleague into the enterprise ATM industry resulting in the discovery of 6 zero-day vulnerabilities affecting Diebold Nixdorf\u2019s Vynamic Security Suite (VSS), the most prolific ATM security solution in the market. 10 minutes or less is all that a malicious actor would need to gain full control of any system running VSS via offline code injection and decryption of the primary Windows OS. Diebold Nixdorf is one of three major North American enterprise class ATM manufacturers with a global presence in the financial, casino/gaming, and point-of-sale markets. Similar attack surfaces are currently being used in the wild and impact millions of systems across the globe. Furthermore, VSS is known to be present throughout the US gaming industry, including most of the ATM/cash-out systems across Vegas.\n\nIn this session, I will publicly disclose this research, review the discovery process, and dive into the technical intricacies of each vulnerability. The Full Disk Encryption module of VSS conducts a complex integrity validation process to ensure a trusted system state, performed as a layered approach during system initialization. Examination of the workflow will highlight various deficiencies that I will demonstrate through PoC exploitation.\n\nEach vulnerability presented in this session has been observed to have a recursive impact across all major versions of VSS and represents a systemic ongoing risk. We will explore the root-cause, vendor remediation steps, and short-comings thereof \u2013 perpetuating the attack narrative. In conclusion, proper mitigation techniques and procedures will be covered, providing valuable insights into defending against potential compromise.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2313, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.11s - 6.81s | This text was transcribed using whisper model: large-v2 Over the past several years, this content has been both a passion and an obsession of mine 6.81s - 11.35s | that has led me down some very interesting paths. 11.35s - 17.11s | And I am very honored and privileged to be able to finally do public disclosure 17.11s - 25.14s | of this content here today. 25.14s - 30.44s | So, my name is Matt Birch, and I am an independent security researcher 30.44s -


chunk_id: 137_chunk_1
chunk_text:
Full Disk Encryption module of VSS conducts a complex integrity validation process to ensure a trusted system state, performed as a layered approach during system initialization. Examination of the workflow will highlight various deficiencies that I will demonstrate through PoC exploitation.\n\nEach vulnerability presented in this session has been observed to have a recursive impact across all major versions of VSS and represents a systemic ongoing risk. We will explore the root-cause, vendor remediation steps, and short-comings thereof \u2013 perpetuating the attack narrative. In conclusion, proper mitigation techniques and procedures will be covered, providing valuable insights into defending against potential compromise.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2313, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.11s - 6.81s | This text was transcribed using whisper model: large-v2 Over the past several years, this content has been both a passion and an obsession of mine 6.81s - 11.35s | that has led me down some very interesting paths. 11.35s - 17.11s | And I am very honored and privileged to be able to finally do public disclosure 17.11s - 25.14s | of this content here today. 25.14s - 30.44s | So, my name is Matt Birch, and I am an independent security researcher 30.44s - 33.44s | with a passion for IoT and hardware devices. 33.46s - 39.10s | I have developed several MFA bypass tools affecting various MDM solutions. 39.10s - 43.54s | I have performed expert opinion against a major ATM manufacturer, 43.54s - 51.65s | and I have had the opportunity of examining cartel-designed ATM black box devices. 51.65s - 55.93s | For today's agenda, we'll take a brief look at the ATM industry, 55.93s - 60.65s | and then we'll introduce Diebold Nixdorf's dynamic security suite. 60.65s - 64.45s | We'll then dive a little bit deeper into the pre-boot authentication process 64.45s - 70.65s | implemented within that software, and finally wrap up with a little bit of cat and mouse. 70.65s - 75.33s | So, starting off, let's take a look at the industry. 75.33s - 79.73s | The ATM market is essentially divided into two classes of systems. 79.73s - 84.77s | You have consumer-grade platforms, and these are the standalone units you typically see 84.77s - 90.61s | in your local grocer or at the gas station, pretty much all over the place in the market. 90.61s - 95.57s | These devices usually run Windows CE and


chunk_id: 137_chunk_2
chunk_text:
33.44s | with a passion for IoT and hardware devices. 33.46s - 39.10s | I have developed several MFA bypass tools affecting various MDM solutions. 39.10s - 43.54s | I have performed expert opinion against a major ATM manufacturer, 43.54s - 51.65s | and I have had the opportunity of examining cartel-designed ATM black box devices. 51.65s - 55.93s | For today's agenda, we'll take a brief look at the ATM industry, 55.93s - 60.65s | and then we'll introduce Diebold Nixdorf's dynamic security suite. 60.65s - 64.45s | We'll then dive a little bit deeper into the pre-boot authentication process 64.45s - 70.65s | implemented within that software, and finally wrap up with a little bit of cat and mouse. 70.65s - 75.33s | So, starting off, let's take a look at the industry. 75.33s - 79.73s | The ATM market is essentially divided into two classes of systems. 79.73s - 84.77s | You have consumer-grade platforms, and these are the standalone units you typically see 84.77s - 90.61s | in your local grocer or at the gas station, pretty much all over the place in the market. 90.61s - 95.57s | These devices usually run Windows CE and lack a lot of the enterprise security controls 95.57s - 98.41s | that you typically see within your corporate environment. 98.41s - 104.25s | On the other hand, the financial-class systems are the enterprise-class ATMs. 104.25s - 108.97s | These are the ones that are specifically located at your banking institution, 108.97s - 115.37s | and they're represented as the larger standalone units or the through-wall devices. 115.37s - 119.25s | These are equipped with Windows Embedded 10. 119.25s - 122.13s | Some of the newer models are starting to introduce 11, 122.13s - 126.09s | and each manufacturer has their own proprietary security stack, 126.09s - 130.89s | offering various endpoint detection and full-disk encryption. 130.89s - 137.29s | Here in the States, there are only three major financial institution ATM manufacturers, 137.29s - 144.40s | and those are Hyosung, NCR, and Diebold Nixdorf. 144.40s - 150.24s | So, opening up an ATM, the system is essentially divided into two hemispheres. 150.24s - 153.36s | You have the top portion, or the top hat. 153.36s - 157.76s | This contains all the PC peripherals and components of the device, 157.76s - 164.96s | and then the bottom portion, aka


chunk_id: 137_chunk_3
chunk_text:
lack a lot of the enterprise security controls 95.57s - 98.41s | that you typically see within your corporate environment. 98.41s - 104.25s | On the other hand, the financial-class systems are the enterprise-class ATMs. 104.25s - 108.97s | These are the ones that are specifically located at your banking institution, 108.97s - 115.37s | and they're represented as the larger standalone units or the through-wall devices. 115.37s - 119.25s | These are equipped with Windows Embedded 10. 119.25s - 122.13s | Some of the newer models are starting to introduce 11, 122.13s - 126.09s | and each manufacturer has their own proprietary security stack, 126.09s - 130.89s | offering various endpoint detection and full-disk encryption. 130.89s - 137.29s | Here in the States, there are only three major financial institution ATM manufacturers, 137.29s - 144.40s | and those are Hyosung, NCR, and Diebold Nixdorf. 144.40s - 150.24s | So, opening up an ATM, the system is essentially divided into two hemispheres. 150.24s - 153.36s | You have the top portion, or the top hat. 153.36s - 157.76s | This contains all the PC peripherals and components of the device, 157.76s - 164.96s | and then the bottom portion, aka the vault, carrying the cash cassettes and all the system's currency. 164.96s - 169.72s | Each component of the ATM is physically isolated from each other, 169.72s - 175.32s | but the physical security controls between those hemispheres vary drastically. 175.32s - 179.84s | The bottom portion of the ATM is equipped with multi-factor authentication, 179.84s - 186.28s | usually implemented with a digital combination lock and an I button for authorization verification. 186.28s - 191.80s | It's designed to have about one inch thick steel, has a very heavy bolt locking mechanism, 191.80s - 197.24s | and will be equipped with seismic detectors or tamper detection to indicate of any malicious entry. 197.24s - 203.28s | However, in contrast to that, you have the top hat of the ATM, 203.28s - 206.84s | and this only has about one-eighth inch thick steel. 206.84s - 212.68s | It is equipped with numerous vent holes for PC ventilation, airflow, 212.68s - 217.88s | comes with default tubular locks that you can actually pick up pretty easily online, 217.88s - 221.92s | and the locking mechanism is a cantilever-style lock 221.92s - 225.92s | that's activated from a cable that's hooked up


chunk_id: 137_chunk_4
chunk_text:
the vault, carrying the cash cassettes and all the system's currency. 164.96s - 169.72s | Each component of the ATM is physically isolated from each other, 169.72s - 175.32s | but the physical security controls between those hemispheres vary drastically. 175.32s - 179.84s | The bottom portion of the ATM is equipped with multi-factor authentication, 179.84s - 186.28s | usually implemented with a digital combination lock and an I button for authorization verification. 186.28s - 191.80s | It's designed to have about one inch thick steel, has a very heavy bolt locking mechanism, 191.80s - 197.24s | and will be equipped with seismic detectors or tamper detection to indicate of any malicious entry. 197.24s - 203.28s | However, in contrast to that, you have the top hat of the ATM, 203.28s - 206.84s | and this only has about one-eighth inch thick steel. 206.84s - 212.68s | It is equipped with numerous vent holes for PC ventilation, airflow, 212.68s - 217.88s | comes with default tubular locks that you can actually pick up pretty easily online, 217.88s - 221.92s | and the locking mechanism is a cantilever-style lock 221.92s - 225.92s | that's activated from a cable that's hooked up to the cylinder of the lock. 225.92s - 230.68s | Because of the plastic components that are usually presented in the front of the ATM, 230.68s - 234.68s | it's very easy to get access to the locking mechanism via destructive entry 234.68s - 240.21s | or just shoving a coat hanger in through a PC speaker. 240.21s - 244.73s | So, when we start taking a look at the attack factors affecting these platforms, 244.73s - 251.09s | there's one thing in common. Most of the attack factors require some level of physical access to the device. 251.09s - 255.77s | Uh, some of the most common attacks that we see are black box devices. 255.77s - 260.01s | Uh, and these are small little units that are placed inside or outside the ATM 260.01s - 268.49s | with the goal of manipulating, uh, dispense requests and, uh, simulating the ATM hosting network. 268.49s - 272.77s | We are all familiar with card skimmers. Uh, they attach to the front of the ATM. 272.77s - 280.29s | They're designed to steal your card data. Uh, and then there's the significant physical attacks, uh, RAM raiding. 280.29s - 283.69s |


chunk_id: 137_chunk_5
chunk_text:
to the cylinder of the lock. 225.92s - 230.68s | Because of the plastic components that are usually presented in the front of the ATM, 230.68s - 234.68s | it's very easy to get access to the locking mechanism via destructive entry 234.68s - 240.21s | or just shoving a coat hanger in through a PC speaker. 240.21s - 244.73s | So, when we start taking a look at the attack factors affecting these platforms, 244.73s - 251.09s | there's one thing in common. Most of the attack factors require some level of physical access to the device. 251.09s - 255.77s | Uh, some of the most common attacks that we see are black box devices. 255.77s - 260.01s | Uh, and these are small little units that are placed inside or outside the ATM 260.01s - 268.49s | with the goal of manipulating, uh, dispense requests and, uh, simulating the ATM hosting network. 268.49s - 272.77s | We are all familiar with card skimmers. Uh, they attach to the front of the ATM. 272.77s - 280.29s | They're designed to steal your card data. Uh, and then there's the significant physical attacks, uh, RAM raiding. 280.29s - 283.69s | Really awesome, you wrap a chain around an ATM, hook it up to your Ford pickup, 283.69s - 285.69s | and just rip it right out of the ground. 285.69s - 290.29s | Or you just borrow your local construction company equipment and bust a hole right through the wall. 290.29s - 296.21s | Uh, some of the less common attacks, though, that we see here in the States are explosive attacks against the ATMs 296.21s - 301.81s | because our currency, uh, is mostly paper derived and when you ignite it, it tends to catch on fire. 301.81s - 304.37s | So, it's very counterproductive to do that attack. 304.37s - 308.41s | However, internationally, where there's a higher plastic consistency of the money, 308.41s - 310.97s | uh, you do see a lot more explosive attacks. 310.97s - 318.77s | Uh, and they actually have started designing explosive proof ATMs to prevent this attack procedure. 318.77s - 329.29s | So, looking at the landscape, the ATM market is full of thousands of devices, all of which hold very large sums of cash. 329.29s - 336.93s | And despite the need of physical access, criminal activity has exponentially grown


chunk_id: 137_chunk_6
chunk_text:
Really awesome, you wrap a chain around an ATM, hook it up to your Ford pickup, 283.69s - 285.69s | and just rip it right out of the ground. 285.69s - 290.29s | Or you just borrow your local construction company equipment and bust a hole right through the wall. 290.29s - 296.21s | Uh, some of the less common attacks, though, that we see here in the States are explosive attacks against the ATMs 296.21s - 301.81s | because our currency, uh, is mostly paper derived and when you ignite it, it tends to catch on fire. 301.81s - 304.37s | So, it's very counterproductive to do that attack. 304.37s - 308.41s | However, internationally, where there's a higher plastic consistency of the money, 308.41s - 310.97s | uh, you do see a lot more explosive attacks. 310.97s - 318.77s | Uh, and they actually have started designing explosive proof ATMs to prevent this attack procedure. 318.77s - 329.29s | So, looking at the landscape, the ATM market is full of thousands of devices, all of which hold very large sums of cash. 329.29s - 336.93s | And despite the need of physical access, criminal activity has exponentially grown over just the last several years. 336.93s - 344.73s | But the logical infrastructure, uh, within these platforms provides little resistance against a logical attack. 344.73s - 353.05s | The foundation of how the ATM works relies on an unauthenticated API known as Extension for Financial Services, or XFS. 353.05s - 361.65s | This is the abstraction layer between the software and the hardware allowing vendor agnostic, uh, cash cassettes to be installed in the ATM. 361.65s - 367.85s | Additionally, most of the software on these ATM platforms all run in the context of high privilege 367.85s - 377.61s | and systems are designed with layers of default credentials to get into operator mode, system administration, and various other functions of the ATM. 377.61s - 383.93s | As a result, these devices have become a very lucrative target for organized crime. 383.93s - 390.41s | So, we can't really talk about ATMs without briefly discussing the network in which they work. 390.41s - 396.93s | In order for you to free your money from the bank, the ATM needs to be connected to the ATM network, 396.93s - 403.69s | uh, which is essentially a private network that's controlled


chunk_id: 137_chunk_7
chunk_text:
over just the last several years. 336.93s - 344.73s | But the logical infrastructure, uh, within these platforms provides little resistance against a logical attack. 344.73s - 353.05s | The foundation of how the ATM works relies on an unauthenticated API known as Extension for Financial Services, or XFS. 353.05s - 361.65s | This is the abstraction layer between the software and the hardware allowing vendor agnostic, uh, cash cassettes to be installed in the ATM. 361.65s - 367.85s | Additionally, most of the software on these ATM platforms all run in the context of high privilege 367.85s - 377.61s | and systems are designed with layers of default credentials to get into operator mode, system administration, and various other functions of the ATM. 377.61s - 383.93s | As a result, these devices have become a very lucrative target for organized crime. 383.93s - 390.41s | So, we can't really talk about ATMs without briefly discussing the network in which they work. 390.41s - 396.93s | In order for you to free your money from the bank, the ATM needs to be connected to the ATM network, 396.93s - 403.69s | uh, which is essentially a private network that's controlled through the hosting provider or gatekeeper. 403.69s - 409.41s | However, not all systems are provided access to the network and there's a specific certification approach 409.41s - 415.81s | where only certain pieces of software and hardware combinations are allowed access to the ATM network. 415.81s - 421.41s | So, in an environment or a financial institution that has ATMs across various vendors, 421.41s - 428.33s | administration of that platform can be very difficult, uh, because it's different software, different patch levels, 428.33s - 435.53s | which usually results in banking institutions working with a managed service provider. 435.53s - 442.09s | This all brings us to Diebold Nixdorf and their proprietary Dynamic Security Suite software. 442.09s - 449.93s | Unlike the other ATM security stacks, Dynamic, or Diebold, has multi-vendor certification, 449.93s - 457.81s | allowing their software to be installed on any ATM hardware platform and gain access to the ATM network. 457.81s - 463.73s | In 2015, they were assumed to represent about 35% of the ATM market. 463.73s - 472.61s | And in 2018 and 19, they partnered with two of the largest financial institutions representing the U.S. gaming industry. 472.61s - 479.29s |


chunk_id: 137_chunk_8
chunk_text:
through the hosting provider or gatekeeper. 403.69s - 409.41s | However, not all systems are provided access to the network and there's a specific certification approach 409.41s - 415.81s | where only certain pieces of software and hardware combinations are allowed access to the ATM network. 415.81s - 421.41s | So, in an environment or a financial institution that has ATMs across various vendors, 421.41s - 428.33s | administration of that platform can be very difficult, uh, because it's different software, different patch levels, 428.33s - 435.53s | which usually results in banking institutions working with a managed service provider. 435.53s - 442.09s | This all brings us to Diebold Nixdorf and their proprietary Dynamic Security Suite software. 442.09s - 449.93s | Unlike the other ATM security stacks, Dynamic, or Diebold, has multi-vendor certification, 449.93s - 457.81s | allowing their software to be installed on any ATM hardware platform and gain access to the ATM network. 457.81s - 463.73s | In 2015, they were assumed to represent about 35% of the ATM market. 463.73s - 472.61s | And in 2018 and 19, they partnered with two of the largest financial institutions representing the U.S. gaming industry. 472.61s - 479.29s | AKA, Dynamic Security is present in almost every casino across the United States, 479.29s - 485.97s | if not most or all of the casinos right here in the Vegas Strip. 485.97s - 491.93s | So, now that we have a little brief background of what the network looks like, 491.93s - 495.29s | let's introduce Dynamic Security. 495.29s - 499.17s | So, like all security stacks, it comes with a number of security features. 499.17s - 506.81s | Uh, you get USB filtering, firewall policy, tamper detection, delegated access, and then it also does disk encryption. 506.81s - 513.09s | But, it's not really full disk encryption, uh, and there's two unencrypted partitions on the disk. 513.09s - 520.01s | The standard partition is UEFI, and this isn't, uh, pretty common in most enterprise configurations. 520.01s - 526.77s | But, what isn't common is an unencrypted Linux partition, and that's somewhat of a red herring. 526.77s - 534.73s | Uh, initially investigating what that Linux partition is, it self-identifies itself as Super's Chaff. 534.73s - 542.13s | And online reconnaissance against that doesn't actually result in much information being identified. 542.13s - 546.41s | But, it does lead us


chunk_id: 137_chunk_9
chunk_text:
AKA, Dynamic Security is present in almost every casino across the United States, 479.29s - 485.97s | if not most or all of the casinos right here in the Vegas Strip. 485.97s - 491.93s | So, now that we have a little brief background of what the network looks like, 491.93s - 495.29s | let's introduce Dynamic Security. 495.29s - 499.17s | So, like all security stacks, it comes with a number of security features. 499.17s - 506.81s | Uh, you get USB filtering, firewall policy, tamper detection, delegated access, and then it also does disk encryption. 506.81s - 513.09s | But, it's not really full disk encryption, uh, and there's two unencrypted partitions on the disk. 513.09s - 520.01s | The standard partition is UEFI, and this isn't, uh, pretty common in most enterprise configurations. 520.01s - 526.77s | But, what isn't common is an unencrypted Linux partition, and that's somewhat of a red herring. 526.77s - 534.73s | Uh, initially investigating what that Linux partition is, it self-identifies itself as Super's Chaff. 534.73s - 542.13s | And online reconnaissance against that doesn't actually result in much information being identified. 542.13s - 546.41s | But, it does lead us to a very interesting game known as Worms Armageddon. 546.41s - 550.57s | In Worms Armageddon, you launch sheep as mobile projectiles against your enemy. 550.57s - 555.17s | The game's really fun. I think we wasted several minutes playing the game once we identified it. 555.17s - 559.45s | But, unfortunately, it has absolutely nothing to do at all with ATMs. 559.45s - 570.69s | But, what it did do is help us identify what Super's Chaff was actually a German translation for Super Sheep. 570.69s - 579.69s | And, Super Sheep actually is the install directory located in user that contains most of the system binaries. 579.69s - 586.89s | Interestingly enough, this resulted in much more information from OSINT Discovery. 586.89s - 592.61s | Specifically, in 2016, a consulting firm known as SecConsult wrote a blog article 592.61s - 598.21s | detailing a code execution vulnerability in a piece of software known as Cryptware CryptoPro. 598.21s - 602.45s | And, the underlying Super Sheep Linux operating system. 602.45s - 607.85s | In the article, there were several similarities between the Vynamic Security Linux operating system 607.85s - 614.69s | and that of Super Sheep, leading us to


chunk_id: 137_chunk_10
chunk_text:
to a very interesting game known as Worms Armageddon. 546.41s - 550.57s | In Worms Armageddon, you launch sheep as mobile projectiles against your enemy. 550.57s - 555.17s | The game's really fun. I think we wasted several minutes playing the game once we identified it. 555.17s - 559.45s | But, unfortunately, it has absolutely nothing to do at all with ATMs. 559.45s - 570.69s | But, what it did do is help us identify what Super's Chaff was actually a German translation for Super Sheep. 570.69s - 579.69s | And, Super Sheep actually is the install directory located in user that contains most of the system binaries. 579.69s - 586.89s | Interestingly enough, this resulted in much more information from OSINT Discovery. 586.89s - 592.61s | Specifically, in 2016, a consulting firm known as SecConsult wrote a blog article 592.61s - 598.21s | detailing a code execution vulnerability in a piece of software known as Cryptware CryptoPro. 598.21s - 602.45s | And, the underlying Super Sheep Linux operating system. 602.45s - 607.85s | In the article, there were several similarities between the Vynamic Security Linux operating system 607.85s - 614.69s | and that of Super Sheep, leading us to go back and look at DeepWorld's user license agreements. 614.69s - 621.85s | Specifically, identifying Cryptware CryptoPro as a third-party integrator as part of Vynamic Security. 621.89s - 629.85s | However, that third-party integration was only mentioned once in version 3.0. 629.85s - 638.53s | Versions 4.0, 4.1, 4.2, 4.3 all remove any reference to the integration of Cryptware CryptoPro. 638.53s - 641.73s | So, who is Cryptware CryptoPro? 641.73s - 648.89s | It's a cryptographic spinoff started in 2002 with the objective of enhancing Microsoft BitLocker functionality. 648.89s - 653.45s | Specifically, by introducing a pre-boot authentication process. 653.45s - 663.21s | Today, the organization exists across numerous countries and drastically different domain and website presence. 663.21s - 670.73s | Each website has a significantly different representation of the content than any of the other websites put together. 670.73s - 676.21s | However, despite the suspicious online presence, they boast over half a million licenses sold 676.21s - 681.53s | and advertise that employees love their encryption, so it's gotta be good, right? 681.53s - 687.89s | So, let's dive a little bit deeper into the pre-boot authentication process. 687.89s - 692.61s | So, Vynamic Security essentially uses a


chunk_id: 137_chunk_11
chunk_text:
go back and look at DeepWorld's user license agreements. 614.69s - 621.85s | Specifically, identifying Cryptware CryptoPro as a third-party integrator as part of Vynamic Security. 621.89s - 629.85s | However, that third-party integration was only mentioned once in version 3.0. 629.85s - 638.53s | Versions 4.0, 4.1, 4.2, 4.3 all remove any reference to the integration of Cryptware CryptoPro. 638.53s - 641.73s | So, who is Cryptware CryptoPro? 641.73s - 648.89s | It's a cryptographic spinoff started in 2002 with the objective of enhancing Microsoft BitLocker functionality. 648.89s - 653.45s | Specifically, by introducing a pre-boot authentication process. 653.45s - 663.21s | Today, the organization exists across numerous countries and drastically different domain and website presence. 663.21s - 670.73s | Each website has a significantly different representation of the content than any of the other websites put together. 670.73s - 676.21s | However, despite the suspicious online presence, they boast over half a million licenses sold 676.21s - 681.53s | and advertise that employees love their encryption, so it's gotta be good, right? 681.53s - 687.89s | So, let's dive a little bit deeper into the pre-boot authentication process. 687.89s - 692.61s | So, Vynamic Security essentially uses a dual-boot operating system. 692.61s - 699.05s | From UEFI, it launches a Super Sheep Linux operating system, which performs some magic against the desk. 699.05s - 702.65s | It then shuts down, goes back through UEFI and launches Windows. 702.65s - 710.93s | Windows will perform an auto-logon and then initiate or launch all the ATM software, bringing the system operational. 710.93s - 717.33s | Any attempts to modify the content on a Linux partition result in an integrity error. 717.33s - 719.93s | However, not all files on the system are treated the same. 719.93s - 725.73s | Modifying different file content or directories results in a significantly different error message to be presented. 725.73s - 729.57s | However, this one provides a little bit more detail. 729.57s - 734.85s | Designating about 253 elements are validated on the desk, which is interesting. 734.85s - 738.29s | I wonder what those elements are. 738.29s - 749.33s | So, we go back to the Linux partition and look to identify any directory contents that may contain a SHA index or representation of what's validated. 749.33s - 751.73s | We stumbled across the log directory. 751.73s - 758.37s | Inside the


chunk_id: 137_chunk_12
chunk_text:
dual-boot operating system. 692.61s - 699.05s | From UEFI, it launches a Super Sheep Linux operating system, which performs some magic against the desk. 699.05s - 702.65s | It then shuts down, goes back through UEFI and launches Windows. 702.65s - 710.93s | Windows will perform an auto-logon and then initiate or launch all the ATM software, bringing the system operational. 710.93s - 717.33s | Any attempts to modify the content on a Linux partition result in an integrity error. 717.33s - 719.93s | However, not all files on the system are treated the same. 719.93s - 725.73s | Modifying different file content or directories results in a significantly different error message to be presented. 725.73s - 729.57s | However, this one provides a little bit more detail. 729.57s - 734.85s | Designating about 253 elements are validated on the desk, which is interesting. 734.85s - 738.29s | I wonder what those elements are. 738.29s - 749.33s | So, we go back to the Linux partition and look to identify any directory contents that may contain a SHA index or representation of what's validated. 749.33s - 751.73s | We stumbled across the log directory. 751.73s - 758.37s | Inside the directory, there was content evaluating about 2,500 files on the desk. 758.37s - 763.01s | The full Linux operating system had slightly under 11,000 files. 763.01s - 767.97s | This gave us a delta of about 8,000 files, which are potentially not validated. 767.97s - 779.09s | Although drastically more than 253, evaluating 8,000 files and determining whether or not they have any impact against the boot-up sequence is a rather daunting process. 779.09s - 783.61s | So, I prefer to step back and then take a look at background images. 783.61s - 785.13s | Those are really easy to modify. 785.13s - 786.45s | They're very representative. 786.45s - 789.01s | If there's any impact against the system. 789.01s - 793.93s | So, randomly pick an image, shut down and reboot. 793.93s - 798.81s | Although unfortunately, when the system powers back up, the default background is presented. 798.81s - 803.73s | However, after just a few seconds later, we did get our hacked image. 803.73s - 809.45s | Specifically indicating that the pre-boot authentication process is not completely infallible. 809.49s - 817.93s | And there is a way to take advantage of the pre-boot authentication process and maliciously


chunk_id: 137_chunk_13
chunk_text:
directory, there was content evaluating about 2,500 files on the desk. 758.37s - 763.01s | The full Linux operating system had slightly under 11,000 files. 763.01s - 767.97s | This gave us a delta of about 8,000 files, which are potentially not validated. 767.97s - 779.09s | Although drastically more than 253, evaluating 8,000 files and determining whether or not they have any impact against the boot-up sequence is a rather daunting process. 779.09s - 783.61s | So, I prefer to step back and then take a look at background images. 783.61s - 785.13s | Those are really easy to modify. 785.13s - 786.45s | They're very representative. 786.45s - 789.01s | If there's any impact against the system. 789.01s - 793.93s | So, randomly pick an image, shut down and reboot. 793.93s - 798.81s | Although unfortunately, when the system powers back up, the default background is presented. 798.81s - 803.73s | However, after just a few seconds later, we did get our hacked image. 803.73s - 809.45s | Specifically indicating that the pre-boot authentication process is not completely infallible. 809.49s - 817.93s | And there is a way to take advantage of the pre-boot authentication process and maliciously execute something. 817.93s - 829.81s | Ultimately, using the modified background image and modifying content within the Linux partition, we're able to map out the different phases of the pre-boot authentication process. 829.81s - 839.93s | The 253 elements are validated in UEFI during BIOS initialization in the boot XSA or boot XSA2 system binaries. 839.93s - 850.25s | Upon completing that validation check, Linux is then initialized, doing the rest of the validation of the other 2,500 files. 850.25s - 856.05s | Those 2,500 files are then used to unlock the TPM and recover the disk encryption key. 856.05s - 866.89s | Unfortunately, ATMs are equipped with secure boot and the ability to modify boot XSA or boot XSA2 within UEFI is not possible. 866.89s - 874.37s | Because all the UEFI binaries are digitally signed and that signature is associated to the BIOS. 874.37s - 882.61s | So, in order to take advantage of the system, we need to specifically map out what files are validated as part of phase one. 882.61s - 896.79s | And then look to identify anything that's not checked but may allow uh redirection of the execution workflow in Linux before phase two


chunk_id: 137_chunk_14
chunk_text:
execute something. 817.93s - 829.81s | Ultimately, using the modified background image and modifying content within the Linux partition, we're able to map out the different phases of the pre-boot authentication process. 829.81s - 839.93s | The 253 elements are validated in UEFI during BIOS initialization in the boot XSA or boot XSA2 system binaries. 839.93s - 850.25s | Upon completing that validation check, Linux is then initialized, doing the rest of the validation of the other 2,500 files. 850.25s - 856.05s | Those 2,500 files are then used to unlock the TPM and recover the disk encryption key. 856.05s - 866.89s | Unfortunately, ATMs are equipped with secure boot and the ability to modify boot XSA or boot XSA2 within UEFI is not possible. 866.89s - 874.37s | Because all the UEFI binaries are digitally signed and that signature is associated to the BIOS. 874.37s - 882.61s | So, in order to take advantage of the system, we need to specifically map out what files are validated as part of phase one. 882.61s - 896.79s | And then look to identify anything that's not checked but may allow uh redirection of the execution workflow in Linux before phase two is initiated. 896.79s - 901.97s | Fair enough. Challenge accepted. Let's play cat and mouse. 901.97s - 911.97s | We'll start off in version 18.x. So, version 18.x, the PBA authentication process scans about 253 elements on the disk. 911.97s - 922.25s | This is executed out of boot XSA2. Upon completing that process, Linux is bootstrapped through the system V architecture and several RC initialization scripts. 922.25s - 929.01s | After which, root performs an auto logon and phase two is initiated from root's profile script. 929.01s - 935.93s | Phase two then scans the other 2,500 files, ultimately unlocking the TPM. 935.93s - 941.17s | The run state of Linux operating system is designed through several temporary file systems. 941.17s - 946.05s | And these are designed to give the system a somewhat pseudo read only perspective. 946.05s - 961.65s | Uh, those temporary file systems are then populated from several tar archives, which unfortunately are validated during phase one. 961.65s - 980.05s | So, there isn't much of, so there isn't much of an ability to modify that content because they are validated during the phase one initialization process. 980.05s - 992.17s | Ultimately, in order to


chunk_id: 137_chunk_15
chunk_text:
is initiated. 896.79s - 901.97s | Fair enough. Challenge accepted. Let's play cat and mouse. 901.97s - 911.97s | We'll start off in version 18.x. So, version 18.x, the PBA authentication process scans about 253 elements on the disk. 911.97s - 922.25s | This is executed out of boot XSA2. Upon completing that process, Linux is bootstrapped through the system V architecture and several RC initialization scripts. 922.25s - 929.01s | After which, root performs an auto logon and phase two is initiated from root's profile script. 929.01s - 935.93s | Phase two then scans the other 2,500 files, ultimately unlocking the TPM. 935.93s - 941.17s | The run state of Linux operating system is designed through several temporary file systems. 941.17s - 946.05s | And these are designed to give the system a somewhat pseudo read only perspective. 946.05s - 961.65s | Uh, those temporary file systems are then populated from several tar archives, which unfortunately are validated during phase one. 961.65s - 980.05s | So, there isn't much of, so there isn't much of an ability to modify that content because they are validated during the phase one initialization process. 980.05s - 992.17s | Ultimately, in order to identify the attack surface, we take our phase one integrity index and then we examine that against the full system V initialization architecture. 992.17s - 1001.29s | Look to identify any RC scripts or other ancillary scripts that are pulled in during the boot up sequence, but aren't validated during phase one. 1001.29s - 1012.05s | Unfortunately, going through this process, most of the RC initialization scripts, the whole architecture, uh, is relatively locked down and there isn't much of an attack surface. 1012.05s - 1021.21s | However, taking a step back, there was one file that was overlooked. Etsy init tab. 1021.21s - 1030.37s | By having control over Etsy init tab and it not being validated during phase one, we have the ability to now gain a foothold in the architecture. 1030.37s - 1040.05s | However, we still need a staging directory. Like any good security solution, SuperSheep doesn't scan its own installation files. 1040.05s - 1048.23s | And since our objective is code execution on the ATM, what better staging directory to use than SuperSheep Avira? 1048.23s - 1058.67s | So, all we need to do is clone the RC initialization script over to our safe directory,


chunk_id: 137_chunk_16
chunk_text:
identify the attack surface, we take our phase one integrity index and then we examine that against the full system V initialization architecture. 992.17s - 1001.29s | Look to identify any RC scripts or other ancillary scripts that are pulled in during the boot up sequence, but aren't validated during phase one. 1001.29s - 1012.05s | Unfortunately, going through this process, most of the RC initialization scripts, the whole architecture, uh, is relatively locked down and there isn't much of an attack surface. 1012.05s - 1021.21s | However, taking a step back, there was one file that was overlooked. Etsy init tab. 1021.21s - 1030.37s | By having control over Etsy init tab and it not being validated during phase one, we have the ability to now gain a foothold in the architecture. 1030.37s - 1040.05s | However, we still need a staging directory. Like any good security solution, SuperSheep doesn't scan its own installation files. 1040.05s - 1048.23s | And since our objective is code execution on the ATM, what better staging directory to use than SuperSheep Avira? 1048.23s - 1058.67s | So, all we need to do is clone the RC initialization script over to our safe directory, patch global variables, inject our POC into X, 1058.67s - 1073.91s | and then call our new run level three from Etsy initialization. With that, I have a small demo for CVE-2023-24064. 1073.91s - 1082.29s | Inside this demo, uh, the dynamic security is virtualized. Initially powering on the system, we receive the integrity error. 1082.29s - 1091.33s | Shutting down the system, patching the disk, moving the RC initialization process, then gives us the ability to obtain code execution on the platform. 1091.33s - 1112.26s | Once we power the system back up, root will perform an auto log on, will receive, will gain code execution, and receive our callback shell. 1112.26s - 1128.97s | There we go. We have control of Linux. Although, vanilla code execution isn't enough. So what? We're on Linux. Windows is still encrypted. 1128.97s - 1137.01s | How are we gonna go from Linux to Windows? Luckily, SuperSheep has an app for that. Mount Winpart. 1137.01s - 1148.79s | Mount Winpart, as a command line argument, takes the TPM disk encryption key, decrypts Windows, and initializes a third phase of the integrity validation check. 1148.79s - 1165.07s | That, so, all we need to


chunk_id: 137_chunk_17
chunk_text:
patch global variables, inject our POC into X, 1058.67s - 1073.91s | and then call our new run level three from Etsy initialization. With that, I have a small demo for CVE-2023-24064. 1073.91s - 1082.29s | Inside this demo, uh, the dynamic security is virtualized. Initially powering on the system, we receive the integrity error. 1082.29s - 1091.33s | Shutting down the system, patching the disk, moving the RC initialization process, then gives us the ability to obtain code execution on the platform. 1091.33s - 1112.26s | Once we power the system back up, root will perform an auto log on, will receive, will gain code execution, and receive our callback shell. 1112.26s - 1128.97s | There we go. We have control of Linux. Although, vanilla code execution isn't enough. So what? We're on Linux. Windows is still encrypted. 1128.97s - 1137.01s | How are we gonna go from Linux to Windows? Luckily, SuperSheep has an app for that. Mount Winpart. 1137.01s - 1148.79s | Mount Winpart, as a command line argument, takes the TPM disk encryption key, decrypts Windows, and initializes a third phase of the integrity validation check. 1148.79s - 1165.07s | That, so, all we need to do to gain that key, is restart the integrity check, and monitor proc command line. Doing so, after a few seconds, we get our TPM disk encryption key, 1165.07s - 1183.81s | we're able to decrypt Windows, from here, we can install malware, directly interacting with the XFS API, and dispense money out of the ATM on demand. 1183.81s - 1192.11s | Alright, let's talk about timeline. This vulnerability was observed to only impact version 18 of the dynamic security suite. 1192.11s - 1201.59s | Uh, vulnerability was identified December of 21, and then confirmed remediated just a few days later when we looked at the next major release of dynamic security. 1201.59s - 1215.49s | It's somewhat misleading, uh, because from version 18 to version 3.0, D-Build actually changed the version strategy to introduce minor versioning, restarting the number from, from 3, uh, 3.3. 1215.49s - 1229.21s | So, the next major supported release actually was 3.0. So, inside this, the way that they patched the attack surface, is scinit-tab is now validated as part of phase 1. 1229.21s - 1242.75s | No longer able to manipulate the system that way. However, interestingly enough, the phase 1 integrity check


chunk_id: 137_chunk_18
chunk_text:
do to gain that key, is restart the integrity check, and monitor proc command line. Doing so, after a few seconds, we get our TPM disk encryption key, 1165.07s - 1183.81s | we're able to decrypt Windows, from here, we can install malware, directly interacting with the XFS API, and dispense money out of the ATM on demand. 1183.81s - 1192.11s | Alright, let's talk about timeline. This vulnerability was observed to only impact version 18 of the dynamic security suite. 1192.11s - 1201.59s | Uh, vulnerability was identified December of 21, and then confirmed remediated just a few days later when we looked at the next major release of dynamic security. 1201.59s - 1215.49s | It's somewhat misleading, uh, because from version 18 to version 3.0, D-Build actually changed the version strategy to introduce minor versioning, restarting the number from, from 3, uh, 3.3. 1215.49s - 1229.21s | So, the next major supported release actually was 3.0. So, inside this, the way that they patched the attack surface, is scinit-tab is now validated as part of phase 1. 1229.21s - 1242.75s | No longer able to manipulate the system that way. However, interestingly enough, the phase 1 integrity check is now reduced by 20%, going from 253 elements to only 56. 1242.75s - 1256.42s | Okay? Reporting this to D-Build, they had indicated that this is not a security vulnerability, because of the superior protections of IMA. Okay, what's IMA? 1256.44s - 1272.02s | IMA is a kernel signature verification check where all binaries on the system are digitally signed along with the kernel. That digital signature is applied as an extended attribute to each file, validating the file name, file path, and various details about the I-known. 1272.02s - 1284.66s | The kernel then validates the parent-child process of any executable, determining whether or not it's actually allowed to execute. However, what IMA doesn't do, is it doesn't validate script interpretation. 1284.66s - 1307.82s | For example, your, uh, bench shell is certified and allowed to execute, needed to run the Linux architecture, but then it, when it interprets a file such as profile, it goes through and performs all, any execution commands within that interpreted script in the context of a certified binary. 1307.82s - 1329.90s | Let's continue with service release 9. So, in service release 9, the Linux architecture is relatively unchanged from what was


chunk_id: 137_chunk_19
chunk_text:
is now reduced by 20%, going from 253 elements to only 56. 1242.75s - 1256.42s | Okay? Reporting this to D-Build, they had indicated that this is not a security vulnerability, because of the superior protections of IMA. Okay, what's IMA? 1256.44s - 1272.02s | IMA is a kernel signature verification check where all binaries on the system are digitally signed along with the kernel. That digital signature is applied as an extended attribute to each file, validating the file name, file path, and various details about the I-known. 1272.02s - 1284.66s | The kernel then validates the parent-child process of any executable, determining whether or not it's actually allowed to execute. However, what IMA doesn't do, is it doesn't validate script interpretation. 1284.66s - 1307.82s | For example, your, uh, bench shell is certified and allowed to execute, needed to run the Linux architecture, but then it, when it interprets a file such as profile, it goes through and performs all, any execution commands within that interpreted script in the context of a certified binary. 1307.82s - 1329.90s | Let's continue with service release 9. So, in service release 9, the Linux architecture is relatively unchanged from what was pre-release, previously discussed. But, reviewing the mountfs initialization script, we're able to identify mtab is deleted before the mount command is called. 1329.90s - 1357.82s | So, since there's a delete call before the mount command, and the security architecture of the system is based around temporary file systems, which are executed from fstab, we just replace mtab with fstab. Fstab gets deleted before the mount command is called, giving us persistence to root's home directory, allowing us to patch the profile script, and again, obtain code execution. 1357.82s - 1395.66s | With that, here is CVE-2023-24063. Inside this demo, we patch the offline desk, and we relocate fstab to mtab, powering back on the virtual system. Once root performs its auto logon activity, we'll receive code execution, and our callback shell. There we go. Again, we have control of the Linux architecture. 1395.66s - 1425.02s | So, let's go back to timeline. This vulnerability was observed to impact all prior versions of 3.3.0. Vulnerability was identified in June of 2022, and then confirmed or mediated the following day, magically, preemptively, in service release 10. In service release 10, the delete call to mtab is now removed from the mountfs


chunk_id: 137_chunk_20
chunk_text:
pre-release, previously discussed. But, reviewing the mountfs initialization script, we're able to identify mtab is deleted before the mount command is called. 1329.90s - 1357.82s | So, since there's a delete call before the mount command, and the security architecture of the system is based around temporary file systems, which are executed from fstab, we just replace mtab with fstab. Fstab gets deleted before the mount command is called, giving us persistence to root's home directory, allowing us to patch the profile script, and again, obtain code execution. 1357.82s - 1395.66s | With that, here is CVE-2023-24063. Inside this demo, we patch the offline desk, and we relocate fstab to mtab, powering back on the virtual system. Once root performs its auto logon activity, we'll receive code execution, and our callback shell. There we go. Again, we have control of the Linux architecture. 1395.66s - 1425.02s | So, let's go back to timeline. This vulnerability was observed to impact all prior versions of 3.3.0. Vulnerability was identified in June of 2022, and then confirmed or mediated the following day, magically, preemptively, in service release 10. In service release 10, the delete call to mtab is now removed from the mountfs initialization script, removing the opportunity to delete fstab before the temporary file systems are initialized. 1426.34s - 1450.54s | Alright, let's dive a little bit deeper into service release 10. So, service release 10, init-tab is validated, mtab does nothing, but what about the mount logic? So, mount is used to actually build a temporary file system architecture, but there's one interesting limitation with mount. The default behavior of mount is if you call 1450.54s - 1456.88s | mount against a mount point that's previously mounted, the call to mount will fail. And 1456.88s - 1461.98s | what's the default mount point associated with any Linux file system? The root file 1461.98s - 1467.86s | system. So if we flatten the file system and re-associate our critical mount points to 1467.86s - 1473.40s | that of root, we're able to regain persistence to root's home directory, patch the profile 1473.50s - 1478.50s | script, and then again obtain code execution. Here's CVE 2023-24062. Inside this demo, again, 1486.39s - 1491.55s | we patch the offline disk, we flatten the file system, uh gain persistence to root's home 1491.55s - 1496.97s | directory and power back on the virtual system. Once


chunk_id: 137_chunk_21
chunk_text:
initialization script, removing the opportunity to delete fstab before the temporary file systems are initialized. 1426.34s - 1450.54s | Alright, let's dive a little bit deeper into service release 10. So, service release 10, init-tab is validated, mtab does nothing, but what about the mount logic? So, mount is used to actually build a temporary file system architecture, but there's one interesting limitation with mount. The default behavior of mount is if you call 1450.54s - 1456.88s | mount against a mount point that's previously mounted, the call to mount will fail. And 1456.88s - 1461.98s | what's the default mount point associated with any Linux file system? The root file 1461.98s - 1467.86s | system. So if we flatten the file system and re-associate our critical mount points to 1467.86s - 1473.40s | that of root, we're able to regain persistence to root's home directory, patch the profile 1473.50s - 1478.50s | script, and then again obtain code execution. Here's CVE 2023-24062. Inside this demo, again, 1486.39s - 1491.55s | we patch the offline disk, we flatten the file system, uh gain persistence to root's home 1491.55s - 1496.97s | directory and power back on the virtual system. Once root performs its auto logon, we'll 1496.97s - 1518.83s | receive code execution and again our callback shell. Taking a look at the timeline here, it's 1518.83s - 1524.17s | a little bit different. So once again, all prior versions of 3.3.0 were made vulnerable to 1524.17s - 1529.17s | this attack surface, but now we have a patch for version 4.0, 4.1, and 4.2. Representing at 1531.47s - 1538.05s | the point in time, the entire software release of dynamic security. The vulnerability was 1538.05s - 1544.35s | identified in June of 2022 and I confirmed remediation in December of 22 as part of 1544.37s - 1550.74s | service release 12. In service release 12, MountFS is updated again. This time, adding several 1554.06s - 1560.06s | delete calls to remove root temp var amount and then recreate those directories. This 1560.06s - 1565.80s | essentially removes any sim links that we've defined or any other uh persistent content 1565.80s - 1572.24s | that we may have placed on that disk. Fair enough. Let's look at service release 12. So, in 1573.24s - 1578.24s | service release 12, how do you work around a delete call? Well, interestingly enough,


chunk_id: 137_chunk_22
chunk_text:
root performs its auto logon, we'll 1496.97s - 1518.83s | receive code execution and again our callback shell. Taking a look at the timeline here, it's 1518.83s - 1524.17s | a little bit different. So once again, all prior versions of 3.3.0 were made vulnerable to 1524.17s - 1529.17s | this attack surface, but now we have a patch for version 4.0, 4.1, and 4.2. Representing at 1531.47s - 1538.05s | the point in time, the entire software release of dynamic security. The vulnerability was 1538.05s - 1544.35s | identified in June of 2022 and I confirmed remediation in December of 22 as part of 1544.37s - 1550.74s | service release 12. In service release 12, MountFS is updated again. This time, adding several 1554.06s - 1560.06s | delete calls to remove root temp var amount and then recreate those directories. This 1560.06s - 1565.80s | essentially removes any sim links that we've defined or any other uh persistent content 1565.80s - 1572.24s | that we may have placed on that disk. Fair enough. Let's look at service release 12. So, in 1573.24s - 1578.24s | service release 12, how do you work around a delete call? Well, interestingly enough, there's 1583.08s - 1588.08s | still some black magic amount. Specifically, the uh kernel extension mount points are 1589.88s - 1596.62s | initialized earlier in the initialization process. And what's interesting about this is when 1596.62s - 1601.42s | you place a file in a mount point, once the mount point is mounted, the content is no longer 1601.44s - 1608.44s | accessible. Since all the previous mitigation checks were implemented within MountFS, why 1608.44s - 1614.46s | don't we just move MountFS to proc? Then once the kernel initializes, the file is no longer 1614.46s - 1620.82s | accessible, it doesn't delete our root directory and we again, regain persistence to root, patch 1620.82s - 1625.84s | the profile script, and gain code execution. Here's CVE 2023-28865. Inside this demo, again, 1626.30s - 1632.74s | we patch the offline disk, relocate MountFS to proc, power back on the virtualized system. Once 1639.18s - 1665.05s | root performs its auto logon, we again, gain code execution. Just as before, this vulnerability 1667.39s - 1672.39s | impacted all prior versions of 330. In addition, also required new patches for 4.0, 4.1, and 1672.71s - 1677.71s | 4.2. Also representing the entire


chunk_id: 137_chunk_23
chunk_text:
there's 1583.08s - 1588.08s | still some black magic amount. Specifically, the uh kernel extension mount points are 1589.88s - 1596.62s | initialized earlier in the initialization process. And what's interesting about this is when 1596.62s - 1601.42s | you place a file in a mount point, once the mount point is mounted, the content is no longer 1601.44s - 1608.44s | accessible. Since all the previous mitigation checks were implemented within MountFS, why 1608.44s - 1614.46s | don't we just move MountFS to proc? Then once the kernel initializes, the file is no longer 1614.46s - 1620.82s | accessible, it doesn't delete our root directory and we again, regain persistence to root, patch 1620.82s - 1625.84s | the profile script, and gain code execution. Here's CVE 2023-28865. Inside this demo, again, 1626.30s - 1632.74s | we patch the offline disk, relocate MountFS to proc, power back on the virtualized system. Once 1639.18s - 1665.05s | root performs its auto logon, we again, gain code execution. Just as before, this vulnerability 1667.39s - 1672.39s | impacted all prior versions of 330. In addition, also required new patches for 4.0, 4.1, and 1672.71s - 1677.71s | 4.2. Also representing the entire security stack of dynamic security. The vulnerability was 1682.29s - 1687.29s | identified in December of 2022 and then confirmed remediated in February of 23 as part of 1689.93s - 1694.93s | service release 15. Service release 15 is a slightly more complex remediation strategy. This 1694.95s - 1699.95s | time, phase one integrity checks are expanded to include a number of null sum indexes 1704.75s - 1710.59s | against critical mount points. This essentially confirms the content in those mount points has 1710.59s - 1715.63s | not been modified and those directories are truly empty before Linux is allowed to 1715.63s - 1724.60s | initialize. Let's look at service release 15. So, in service release 15, I like to fall back on 1724.98s - 1729.98s | the idea that the more complicated a security control is, the more likely something is going to 1736.66s - 1741.66s | be overlooked. However, in order to identify those barriers, we need to first understand how 1744.00s - 1749.00s | that security control is implemented. So, if we create a file or we create a SIM link to a known 1749.60s - 1754.60s | file, it produces a hash sum as part of


chunk_id: 137_chunk_24
chunk_text:
security stack of dynamic security. The vulnerability was 1682.29s - 1687.29s | identified in December of 2022 and then confirmed remediated in February of 23 as part of 1689.93s - 1694.93s | service release 15. Service release 15 is a slightly more complex remediation strategy. This 1694.95s - 1699.95s | time, phase one integrity checks are expanded to include a number of null sum indexes 1704.75s - 1710.59s | against critical mount points. This essentially confirms the content in those mount points has 1710.59s - 1715.63s | not been modified and those directories are truly empty before Linux is allowed to 1715.63s - 1724.60s | initialize. Let's look at service release 15. So, in service release 15, I like to fall back on 1724.98s - 1729.98s | the idea that the more complicated a security control is, the more likely something is going to 1736.66s - 1741.66s | be overlooked. However, in order to identify those barriers, we need to first understand how 1744.00s - 1749.00s | that security control is implemented. So, if we create a file or we create a SIM link to a known 1749.60s - 1754.60s | file, it produces a hash sum as part of the phase one integrity check and the system fails to 1756.54s - 1761.54s | boot. However, if we create a directory or a tree of empty directories, no sum value is 1762.98s - 1767.98s | created and the system boots successfully. Interestingly enough, null SIM links also 1772.06s - 1778.37s | produce a null sum value. In order to take advantage of that, we need to return, uh, and 1779.37s - 1784.37s | identify a new staging directory that allows us to establish a transversal point, uh, with a 1788.71s - 1793.61s | directory path that doesn't previously exist. In order to identify one, we return to our 1793.61s - 1799.75s | previous attack surface and look at what directory structures are created once the Linux 1799.75s - 1804.75s | kernel is initialized that may not actually exist in the offline desk. Allowing the creation 1805.25s - 1810.25s | of a transversal SIM link that will represent as a broken link on the offline desk during 1812.95s - 1817.95s | phase one integrity, but then becomes valid once Linux is launched, allowing us to redirect and 1819.13s - 1824.13s | gain access to our new root location. Luckily after just


chunk_id: 137_chunk_25
chunk_text:
the phase one integrity check and the system fails to 1756.54s - 1761.54s | boot. However, if we create a directory or a tree of empty directories, no sum value is 1762.98s - 1767.98s | created and the system boots successfully. Interestingly enough, null SIM links also 1772.06s - 1778.37s | produce a null sum value. In order to take advantage of that, we need to return, uh, and 1779.37s - 1784.37s | identify a new staging directory that allows us to establish a transversal point, uh, with a 1788.71s - 1793.61s | directory path that doesn't previously exist. In order to identify one, we return to our 1793.61s - 1799.75s | previous attack surface and look at what directory structures are created once the Linux 1799.75s - 1804.75s | kernel is initialized that may not actually exist in the offline desk. Allowing the creation 1805.25s - 1810.25s | of a transversal SIM link that will represent as a broken link on the offline desk during 1812.95s - 1817.95s | phase one integrity, but then becomes valid once Linux is launched, allowing us to redirect and 1819.13s - 1824.13s | gain access to our new root location. Luckily after just a few seconds, it wasn't hard to 1826.17s - 1831.17s | find dev block, which is actually a special mount point, routing or mounting the block device 1831.19s - 1836.19s | of the system itself. Uh, this special mount point was also observed to exist, uh, be 1840.17s - 1845.77s | contained in all prior versions of dynamic security, also giving some persistence against the 1845.77s - 1850.77s | other versions of software. So, we just move our mount points to the, uh, secondary mount 1853.45s - 1858.45s | points, VAR to VAR2, ROOT to ROOT2, and we SIM link to those via dev block. Offline desk 1859.11s - 1864.11s | link is broken, no SIMs are created, Linux powers up, links are valid, we get access to ROOT's 1866.95s - 1871.95s | home directory. Here's CVE-2023-33206. Again, the offline desk is patched, we relocate to 1879.76s - 1885.76s | our new mount points and establish the transversal SIM link. Powering back on the system, 1885.78s - 1891.18s | ROOT's gonna perform it's auto logon, we'll receive code execution and again, our callback 1891.18s - 1913.78s | shell. So, at this point, I kinda feel like I've been here before.


chunk_id: 137_chunk_26
chunk_text:
a few seconds, it wasn't hard to 1826.17s - 1831.17s | find dev block, which is actually a special mount point, routing or mounting the block device 1831.19s - 1836.19s | of the system itself. Uh, this special mount point was also observed to exist, uh, be 1840.17s - 1845.77s | contained in all prior versions of dynamic security, also giving some persistence against the 1845.77s - 1850.77s | other versions of software. So, we just move our mount points to the, uh, secondary mount 1853.45s - 1858.45s | points, VAR to VAR2, ROOT to ROOT2, and we SIM link to those via dev block. Offline desk 1859.11s - 1864.11s | link is broken, no SIMs are created, Linux powers up, links are valid, we get access to ROOT's 1866.95s - 1871.95s | home directory. Here's CVE-2023-33206. Again, the offline desk is patched, we relocate to 1879.76s - 1885.76s | our new mount points and establish the transversal SIM link. Powering back on the system, 1885.78s - 1891.18s | ROOT's gonna perform it's auto logon, we'll receive code execution and again, our callback 1891.18s - 1913.78s | shell. So, at this point, I kinda feel like I've been here before. All prior versions of 1913.78s - 1918.78s | 3.3.0 were vulnerable to this, including 4.0, 4.1, 4.2, and 4.3. Again, the entire dynamic 1920.58s - 1926.22s | security stack. The vulnerability was identified in April of 23, and then confirmed 1926.22s - 1931.22s | remediated in July of 23 as service release 16. In service release 16, the vulnerability 1934.26s - 1939.26s | release 16, the PBA phase one process now validates the integrity of SIM links. So, if 1941.94s - 1947.04s | there's a broken SIM link, the PBA integrity process will fail and the system doesn't boot 1947.04s - 1952.04s | up. However, what's also interesting are the prior, prior mitigation strategy of deleting 1954.98s - 1960.56s | the directories or the mount points in the ROOT or in the mount FS initialization script 1960.56s - 1965.04s | are now commented out and removed. Unfortunately, this didn't seem to reproduce the 1965.04s - 1970.54s | attack surface because we have null sum checks and SIM link validation as part of phase 1970.54s - 1975.54s | one. But it is an interesting approach to back out previous, uh, remediation strategy. With 1979.57s - 1986.36s | that, let's look at


chunk_id: 137_chunk_27
chunk_text:
All prior versions of 1913.78s - 1918.78s | 3.3.0 were vulnerable to this, including 4.0, 4.1, 4.2, and 4.3. Again, the entire dynamic 1920.58s - 1926.22s | security stack. The vulnerability was identified in April of 23, and then confirmed 1926.22s - 1931.22s | remediated in July of 23 as service release 16. In service release 16, the vulnerability 1934.26s - 1939.26s | release 16, the PBA phase one process now validates the integrity of SIM links. So, if 1941.94s - 1947.04s | there's a broken SIM link, the PBA integrity process will fail and the system doesn't boot 1947.04s - 1952.04s | up. However, what's also interesting are the prior, prior mitigation strategy of deleting 1954.98s - 1960.56s | the directories or the mount points in the ROOT or in the mount FS initialization script 1960.56s - 1965.04s | are now commented out and removed. Unfortunately, this didn't seem to reproduce the 1965.04s - 1970.54s | attack surface because we have null sum checks and SIM link validation as part of phase 1970.54s - 1975.54s | one. But it is an interesting approach to back out previous, uh, remediation strategy. With 1979.57s - 1986.36s | that, let's look at service release 16. So, service release 16. SIM link validation, null 1986.56s - 1991.56s | sums, bummer, that's pretty good security control. However, the entire integrity process of 1998.70s - 2003.70s | the system is based on the need to create hash sums and hash sum validation of files. You 2007.28s - 2012.28s | know what doesn't change the hash sum of a file? It's file attributes. So, for example, if we 2013.28s - 2018.28s | remove execute permissions from something, it has the same hash sum value. So, if we just 2022.57s - 2027.77s | remove the execute permissions of IMA, we disable the entire security architecture of 2027.77s - 2032.77s | dynamic security and have the ability to execute any unsigned binary we want. Here's CVE 2038.48s - 2045.27s | 2023-40261. In this demo, we remove execute permissions from IMA, gaining the ability to 2046.19s - 2051.19s | execute anything that we want, power back on the system, root performs its auto log on, and we 2055.41s - 2077.91s | receive our callback shell. Alright, just as before, the entire security stack of dynamic 2080.41s - 2085.41s | security is vulnerable to this attack surface. All prior versions


chunk_id: 137_chunk_28
chunk_text:
service release 16. So, service release 16. SIM link validation, null 1986.56s - 1991.56s | sums, bummer, that's pretty good security control. However, the entire integrity process of 1998.70s - 2003.70s | the system is based on the need to create hash sums and hash sum validation of files. You 2007.28s - 2012.28s | know what doesn't change the hash sum of a file? It's file attributes. So, for example, if we 2013.28s - 2018.28s | remove execute permissions from something, it has the same hash sum value. So, if we just 2022.57s - 2027.77s | remove the execute permissions of IMA, we disable the entire security architecture of 2027.77s - 2032.77s | dynamic security and have the ability to execute any unsigned binary we want. Here's CVE 2038.48s - 2045.27s | 2023-40261. In this demo, we remove execute permissions from IMA, gaining the ability to 2046.19s - 2051.19s | execute anything that we want, power back on the system, root performs its auto log on, and we 2055.41s - 2077.91s | receive our callback shell. Alright, just as before, the entire security stack of dynamic 2080.41s - 2085.41s | security is vulnerable to this attack surface. All prior versions of 330, all prior versions 2086.99s - 2091.99s | of 4.0, all prior versions of 4.1, all prior versions of 4.2, and all prior versions of 4.1 2093.75s - 2099.49s | and all prior versions of 4.3. The vulnerability was identified in July of 2023, and I've been 2099.49s - 2104.51s | informed from dbold that this was mitigated as part of the November 2023 release of service 2107.27s - 2112.27s | release 17. Additionally, version 3.3 was designated to be end of life at the end of December 2112.27s - 2117.29s | uh 23. So with that, do you need defense? Well, during the content of this talk, I've been 2128.06s - 2134.00s | able to demonstrate impact of the entire dynamic security suite and their hard drive 2134.00s - 2139.00s | encryption model. I've also identified that the attack surface is recursive, where new 2139.60s - 2144.60s | versions of the patch system are recursively vulnerable against, against those attacks. Um, but 2150.98s - 2156.16s | it's all based around the root cause of the Linux file system being unencrypted. So 2156.16s - 2161.26s | technically, it's a continuous cat and mouse game to defend against this attack


chunk_id: 137_chunk_29
chunk_text:
of 330, all prior versions 2086.99s - 2091.99s | of 4.0, all prior versions of 4.1, all prior versions of 4.2, and all prior versions of 4.1 2093.75s - 2099.49s | and all prior versions of 4.3. The vulnerability was identified in July of 2023, and I've been 2099.49s - 2104.51s | informed from dbold that this was mitigated as part of the November 2023 release of service 2107.27s - 2112.27s | release 17. Additionally, version 3.3 was designated to be end of life at the end of December 2112.27s - 2117.29s | uh 23. So with that, do you need defense? Well, during the content of this talk, I've been 2128.06s - 2134.00s | able to demonstrate impact of the entire dynamic security suite and their hard drive 2134.00s - 2139.00s | encryption model. I've also identified that the attack surface is recursive, where new 2139.60s - 2144.60s | versions of the patch system are recursively vulnerable against, against those attacks. Um, but 2150.98s - 2156.16s | it's all based around the root cause of the Linux file system being unencrypted. So 2156.16s - 2161.26s | technically, it's a continuous cat and mouse game to defend against this attack surface, and 2161.26s - 2166.26s | there are likely going to be new attacks. But, you can rest assured, because physical access is 2166.36s - 2171.36s | required to take advantage. So, let's discuss some mitigation strategies. First and foremost, 2177.54s - 2182.54s | the dynamic security platform should be patched up to the latest release of any uh of the 2185.44s - 2190.44s | major service releases that have been discussed here. In addition, I am very proud to announce 2191.44s - 2196.44s | that this security research has directly influenced Diebold Nixdorf to redesign the SuperSheep 2201.54s - 2207.92s | architecture, and as of April this year, they have released version 4.4 that is supposed to 2207.92s - 2216.50s | offer full encryption of the SuperSheep operating system. In addition, there is a security 2216.50s - 2221.50s | configuration check known as enable security check. If this is disabled in the dynamic 2229.94s - 2234.94s | security configuration, also first introduced in version 4.0 of the software, this disables 2237.74s - 2244.12s | the TPM key from being sent to mount winpart. Without that TPM key being sent as a command 2244.14s - 2249.88s | line argument, it


chunk_id: 137_chunk_30
chunk_text:
surface, and 2161.26s - 2166.26s | there are likely going to be new attacks. But, you can rest assured, because physical access is 2166.36s - 2171.36s | required to take advantage. So, let's discuss some mitigation strategies. First and foremost, 2177.54s - 2182.54s | the dynamic security platform should be patched up to the latest release of any uh of the 2185.44s - 2190.44s | major service releases that have been discussed here. In addition, I am very proud to announce 2191.44s - 2196.44s | that this security research has directly influenced Diebold Nixdorf to redesign the SuperSheep 2201.54s - 2207.92s | architecture, and as of April this year, they have released version 4.4 that is supposed to 2207.92s - 2216.50s | offer full encryption of the SuperSheep operating system. In addition, there is a security 2216.50s - 2221.50s | configuration check known as enable security check. If this is disabled in the dynamic 2229.94s - 2234.94s | security configuration, also first introduced in version 4.0 of the software, this disables 2237.74s - 2244.12s | the TPM key from being sent to mount winpart. Without that TPM key being sent as a command 2244.14s - 2249.88s | line argument, it does significantly reduce the attack surface. Because from just the Linux 2249.88s - 2254.16s | operating system itself, there is not much of an advantage point to attack the Windows 2254.16s - 2259.76s | operating system. Additionally, you can just choose to replace dynamic security with an 2259.76s - 2264.76s | industry recognized disk encryption solution, such as Microsoft BitLocker. Um, there are 2267.76s - 2273.84s | also a number of secondary actions. Uh, ensure the top hat entry is properly monitor- 2274.80s - 2280.30s | uh, any malicious entry to that system should be, uh, triggered as an alert. Disable all 2280.30s - 2285.30s | unused USB ports, ensure the USB ports validate what peripherals are connected, and lock the 2287.08s - 2293.02s | hard drive screws. There is no business justification for a hard drive on an ATM to be 2293.02s - 2299.26s | removed without having to completely pull out the chassis. That should significantly reduce 2299.28s - 2304.28s | the attack surface. With that, I'd like to thank all of you for, uh, coming here today and, uh, 2307.72s - 2308.72s | listening to this content.


chunk_id: 137_chunk_31
chunk_text:
does significantly reduce the attack surface. Because from just the Linux 2249.88s - 2254.16s | operating system itself, there is not much of an advantage point to attack the Windows 2254.16s - 2259.76s | operating system. Additionally, you can just choose to replace dynamic security with an 2259.76s - 2264.76s | industry recognized disk encryption solution, such as Microsoft BitLocker. Um, there are 2267.76s - 2273.84s | also a number of secondary actions. Uh, ensure the top hat entry is properly monitor- 2274.80s - 2280.30s | uh, any malicious entry to that system should be, uh, triggered as an alert. Disable all 2280.30s - 2285.30s | unused USB ports, ensure the USB ports validate what peripherals are connected, and lock the 2287.08s - 2293.02s | hard drive screws. There is no business justification for a hard drive on an ATM to be 2293.02s - 2299.26s | removed without having to completely pull out the chassis. That should significantly reduce 2299.28s - 2304.28s | the attack surface. With that, I'd like to thank all of you for, uh, coming here today and, uh, 2307.72s - 2308.72s | listening to this content.


chunk_id: 138_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=vad7FiHlgMU", "title": "DEF CON 32 - Welcome to DEF CON 32 - The Dark Tangent", "description": "Opening remarks from our founder The Dark Tangent.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1216, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.21s - 5.21s | This text was transcribed using whisper model: large-v2 just a it's what I'm trying to get at is at the end of it when you boil down DEF CON it's 5.21s - 10.45s | community. Sense of community. People want to see each other, people want to talk to each 10.45s - 14.69s | other, they want to share experiences and if they don't have to walk to three or four 14.69s - 23.50s | different hotels that's awesome. So okay so I want to sort of officially start this off. I'm 26.40s - 31.42s | dark tangent um I started DEF CON 32 years ago and over the decades it has grown and grown and 34.42s - 37.82s | and uh and so I'm just going to give you a couple little insights that I've picked up along 37.82s - 42.82s | the way and then send you off into the stream of the con. We have fantastic speakers, we have 45.36s - 49.30s | great creators and I'm just going to try to orient you a little bit about kind of what's 49.30s - 54.30s | going on. Um something you'll hear frequently is that the con is what you make of it and the 56.74s - 62.38s | thinking here is that there's an unlimited number of things you could do. You can't do them 62.38s - 67.38s | all. So please be okay with yourselves when you can't do it all. My big moment for this was I 70.48s - 75.48s | think DEF CON 3 or so. DEF CON 1 I knew it all. I was there. I saw it. It was awesome. DEF CON 78.12s - 84.80s | 2 woo there's more people. This is great. DEF CON 3 after the con people are coming up to me 84.80s - 89.80s | and saying that was great. Did you see the thing that happened? Like no I didn't see the thing. 92.50s - 99.18s | It's my con. I didn't see the thing. It's like I'm missing out. DEF CON 4 rolls around you're 99.18s - 104.92s | like okay I'm never seeing


chunk_id: 138_chunk_1
chunk_text:
speakers, we have 45.36s - 49.30s | great creators and I'm just going to try to orient you a little bit about kind of what's 49.30s - 54.30s | going on. Um something you'll hear frequently is that the con is what you make of it and the 56.74s - 62.38s | thinking here is that there's an unlimited number of things you could do. You can't do them 62.38s - 67.38s | all. So please be okay with yourselves when you can't do it all. My big moment for this was I 70.48s - 75.48s | think DEF CON 3 or so. DEF CON 1 I knew it all. I was there. I saw it. It was awesome. DEF CON 78.12s - 84.80s | 2 woo there's more people. This is great. DEF CON 3 after the con people are coming up to me 84.80s - 89.80s | and saying that was great. Did you see the thing that happened? Like no I didn't see the thing. 92.50s - 99.18s | It's my con. I didn't see the thing. It's like I'm missing out. DEF CON 4 rolls around you're 99.18s - 104.92s | like okay I'm never seeing all the things. Like I just have to be okay with that. And then 104.92s - 109.62s | when you make that mental shift then it's like well then I want to create more things I won't 109.62s - 115.52s | see so I don't feel so guilty you know like I'll just be able to internalize that there's 115.52s - 120.56s | absolutely no way in the world and then other fuckers they also will have stuff that they 120.58s - 126.12s | don't see right and then we'll all be in the same boat together and it just kind of grew that 126.12s - 135.36s | way. So then that's where the phrase came. It is what you make of it. If you want to be 135.36s - 142.38s | social we try to create social experiences. If you want to be technical get at it. And so 142.38s - 146.98s | what's going on there is let's say there's a thousand people and then years later there's 146.98s - 151.98s | 10,000 people 20,000 people. It's hard to be social with 20,000 people. So we have to figure 154.46s - 160.32s | out a way to get


chunk_id: 138_chunk_2
chunk_text:
all the things. Like I just have to be okay with that. And then 104.92s - 109.62s | when you make that mental shift then it's like well then I want to create more things I won't 109.62s - 115.52s | see so I don't feel so guilty you know like I'll just be able to internalize that there's 115.52s - 120.56s | absolutely no way in the world and then other fuckers they also will have stuff that they 120.58s - 126.12s | don't see right and then we'll all be in the same boat together and it just kind of grew that 126.12s - 135.36s | way. So then that's where the phrase came. It is what you make of it. If you want to be 135.36s - 142.38s | social we try to create social experiences. If you want to be technical get at it. And so 142.38s - 146.98s | what's going on there is let's say there's a thousand people and then years later there's 146.98s - 151.98s | 10,000 people 20,000 people. It's hard to be social with 20,000 people. So we have to figure 154.46s - 160.32s | out a way to get you into smaller groups. So a lot of behind the scenes engineering is how to 160.32s - 166.30s | break up large groups into sort of affinity groups, car hacking and then break that up into 166.30s - 171.70s | like ODB hacking and now you're at a table with 10 other people doing the thing you're 171.70s - 175.34s | interested in at that moment and now you can make friends if you're at a table with 8 or 10 175.34s - 181.68s | people. You can do that physical security, lock picking, high security lock and now you're at a 181.68s - 188.00s | table with 10 lock pickers. And so when people say there's too many people here it's like yes 188.00s - 192.34s | we know that but we spend a lot of time trying to figure out how to get you to have more 192.34s - 197.18s | personal experiences like the food court. You sit at a table. People will join you and they 197.18s - 207.18s | will talk whether you like it or not. So that's part of it. Also we really try to instill this 207.22s - 212.16s | thing of


chunk_id: 138_chunk_3
chunk_text:
you into smaller groups. So a lot of behind the scenes engineering is how to 160.32s - 166.30s | break up large groups into sort of affinity groups, car hacking and then break that up into 166.30s - 171.70s | like ODB hacking and now you're at a table with 10 other people doing the thing you're 171.70s - 175.34s | interested in at that moment and now you can make friends if you're at a table with 8 or 10 175.34s - 181.68s | people. You can do that physical security, lock picking, high security lock and now you're at a 181.68s - 188.00s | table with 10 lock pickers. And so when people say there's too many people here it's like yes 188.00s - 192.34s | we know that but we spend a lot of time trying to figure out how to get you to have more 192.34s - 197.18s | personal experiences like the food court. You sit at a table. People will join you and they 197.18s - 207.18s | will talk whether you like it or not. So that's part of it. Also we really try to instill this 207.22s - 212.16s | thing of like ask questions. Maybe at DEF CON 1 there was a handful of people that knew how the 212.16s - 217.96s | world worked. Not anymore. There's no way any of us can understand how any of this technology 217.96s - 225.76s | works at any depth because the market forces have required specialisations in our careers. 225.76s - 231.72s | You will be like 9 miles deep on some tech stack and the guy next to you has never fucking heard 231.72s - 239.42s | of that tech stack because he's not in your area. He's in aerospace or in IOT or OT or something. 239.42s - 246.38s | And so that's super cool because now you have licence to ask what you think are dumb questions. 246.38s - 253.30s | So just ask questions. I'm not going to tell anybody if you ask me a dumb question. It's our 253.30s - 260.92s | secret. And so now we're creating this environment. You get these individual experiences. You can 260.92s - 271.12s | ask dumb questions. You can wear whatever you want. And we just want you to like so the origin 271.12s - 276.50s | story I'm sure


chunk_id: 138_chunk_4
chunk_text:
like ask questions. Maybe at DEF CON 1 there was a handful of people that knew how the 212.16s - 217.96s | world worked. Not anymore. There's no way any of us can understand how any of this technology 217.96s - 225.76s | works at any depth because the market forces have required specialisations in our careers. 225.76s - 231.72s | You will be like 9 miles deep on some tech stack and the guy next to you has never fucking heard 231.72s - 239.42s | of that tech stack because he's not in your area. He's in aerospace or in IOT or OT or something. 239.42s - 246.38s | And so that's super cool because now you have licence to ask what you think are dumb questions. 246.38s - 253.30s | So just ask questions. I'm not going to tell anybody if you ask me a dumb question. It's our 253.30s - 260.92s | secret. And so now we're creating this environment. You get these individual experiences. You can 260.92s - 271.12s | ask dumb questions. You can wear whatever you want. And we just want you to like so the origin 271.12s - 276.50s | story I'm sure probably many of you have heard it but when I started DEF CON I couldn't go to 276.50s - 284.38s | cons because they were all invite only. There was one con or two cons that weren't invite only. 284.38s - 290.84s | No. Summer con was invite only. Ho ho con. So they were all named after seasons. Ho ho con was in 290.84s - 298.08s | Christmas. Christmas con or Xmas con. Then there was pump con in Halloween. Summer had summer 298.08s - 304.34s | con. And so we named DEF CON or I named DEF CON not after a season because I didn't like how that 304.34s - 311.46s | locked me in and I wanted to make it not invite only because I had been excluded. So that meant I 311.46s - 317.00s | had to let everybody attend. I couldn't limit it. And so that's the biggest fork in the road 317.00s - 323.54s | that DEF CON ever had to make. Open or close. And since I'd been excluded by the open or closed 323.54s - 330.38s | I made it open. Okay now you're open. How do you limit attendance? You can't


chunk_id: 138_chunk_5
chunk_text:
probably many of you have heard it but when I started DEF CON I couldn't go to 276.50s - 284.38s | cons because they were all invite only. There was one con or two cons that weren't invite only. 284.38s - 290.84s | No. Summer con was invite only. Ho ho con. So they were all named after seasons. Ho ho con was in 290.84s - 298.08s | Christmas. Christmas con or Xmas con. Then there was pump con in Halloween. Summer had summer 298.08s - 304.34s | con. And so we named DEF CON or I named DEF CON not after a season because I didn't like how that 304.34s - 311.46s | locked me in and I wanted to make it not invite only because I had been excluded. So that meant I 311.46s - 317.00s | had to let everybody attend. I couldn't limit it. And so that's the biggest fork in the road 317.00s - 323.54s | that DEF CON ever had to make. Open or close. And since I'd been excluded by the open or closed 323.54s - 330.38s | I made it open. Okay now you're open. How do you limit attendance? You can't limit attendance 330.38s - 337.95s | because now you're rewarding type A personalities and I hate those fuckers because they get up 337.95s - 345.61s | early. They go down their checklists. So I needed to be able to balance them out with the 345.61s - 353.15s | type team type B. And so that's been one of our challenges right. As we grow we turned into 353.15s - 359.37s | through those two forks in the road we became a reflection of the community. Right. If people 359.37s - 365.41s | are complaining oh no there's too much aerospace this year. Sorry. That's the way the world's 365.45s - 371.03s | going then. Those people decided to show up so that must mean something. It wasn't artificially 371.03s - 377.91s | created. So sometimes when you look around you're like why are things the way they are. It's 377.91s - 388.57s | largely the result of extrapolating some of these early decisions. One other thing I say is so I 388.69s - 397.69s | was in college. Madonna had a documentary movie or something come out. And in it she's having 397.69s - 402.07s | this camera follow her


chunk_id: 138_chunk_6
chunk_text:
limit attendance 330.38s - 337.95s | because now you're rewarding type A personalities and I hate those fuckers because they get up 337.95s - 345.61s | early. They go down their checklists. So I needed to be able to balance them out with the 345.61s - 353.15s | type team type B. And so that's been one of our challenges right. As we grow we turned into 353.15s - 359.37s | through those two forks in the road we became a reflection of the community. Right. If people 359.37s - 365.41s | are complaining oh no there's too much aerospace this year. Sorry. That's the way the world's 365.45s - 371.03s | going then. Those people decided to show up so that must mean something. It wasn't artificially 371.03s - 377.91s | created. So sometimes when you look around you're like why are things the way they are. It's 377.91s - 388.57s | largely the result of extrapolating some of these early decisions. One other thing I say is so I 388.69s - 397.69s | was in college. Madonna had a documentary movie or something come out. And in it she's having 397.69s - 402.07s | this camera follow her around everywhere. And some other celebrity wants to talk to her 402.07s - 407.77s | privately and asks hey can you turn off the cameras. And she doesn't turn off the cameras 407.77s - 413.03s | because she says well if it's not recorded does it even exist? Did it even happen? And it's a 413.03s - 419.15s | famous other people have said this for years. But my first exposure to that quote was in this 419.15s - 424.77s | Madonna documentary. And so I was like aha. I have to record the first DEF CON. Because 424.77s - 430.35s | there's going to be people who wanted to come that didn't. So we audio record all the talks. And 430.35s - 433.89s | now I'm trying to sell these talks. And they're in cassette tapes and I'm duping them in a 433.89s - 439.31s | cassette tape duplicator. Not a hard drive duplicator. A cassette tape duplicator. And I'm 439.31s - 443.05s | trying to sell these things. And I do that for about a year or two. And then the next DEF CON I 443.05s - 448.81s | got another stack of tapes. But by the third


chunk_id: 138_chunk_7
chunk_text:
around everywhere. And some other celebrity wants to talk to her 402.07s - 407.77s | privately and asks hey can you turn off the cameras. And she doesn't turn off the cameras 407.77s - 413.03s | because she says well if it's not recorded does it even exist? Did it even happen? And it's a 413.03s - 419.15s | famous other people have said this for years. But my first exposure to that quote was in this 419.15s - 424.77s | Madonna documentary. And so I was like aha. I have to record the first DEF CON. Because 424.77s - 430.35s | there's going to be people who wanted to come that didn't. So we audio record all the talks. And 430.35s - 433.89s | now I'm trying to sell these talks. And they're in cassette tapes and I'm duping them in a 433.89s - 439.31s | cassette tape duplicator. Not a hard drive duplicator. A cassette tape duplicator. And I'm 439.31s - 443.05s | trying to sell these things. And I do that for about a year or two. And then the next DEF CON I 443.05s - 448.81s | got another stack of tapes. But by the third DEF CON streaming has come along. We have real 448.81s - 454.55s | streaming. I'm like oh yes. I am still selling these tapes. So I just encode everything and I put 454.55s - 460.71s | it online. And I just give away the talks for free. So much less hassle. And now that became 460.71s - 470.21s | the tradition. Just recorded and gave away all the content. Part of that was because again in 470.21s - 476.71s | the early days there was limited access to information. There was no Google or Alta Vista. No 476.71s - 483.57s | Amazon. No excuse me. You would spend half your energy trying to find the information. The 483.57s - 488.49s | person that knew the answer. Another half trying to understand it. Nowadays the time for you to 488.49s - 495.07s | reach the information is like I don't know a couple minutes. Doing a couple searches. Not the 495.07s - 500.99s | case. And so to accelerate that in the early days we gave away all the content. Well then when we 500.99s - 507.19s | started Black Hat, Black Hat gave away all the content. Now basically that's


chunk_id: 138_chunk_8
chunk_text:
DEF CON streaming has come along. We have real 448.81s - 454.55s | streaming. I'm like oh yes. I am still selling these tapes. So I just encode everything and I put 454.55s - 460.71s | it online. And I just give away the talks for free. So much less hassle. And now that became 460.71s - 470.21s | the tradition. Just recorded and gave away all the content. Part of that was because again in 470.21s - 476.71s | the early days there was limited access to information. There was no Google or Alta Vista. No 476.71s - 483.57s | Amazon. No excuse me. You would spend half your energy trying to find the information. The 483.57s - 488.49s | person that knew the answer. Another half trying to understand it. Nowadays the time for you to 488.49s - 495.07s | reach the information is like I don't know a couple minutes. Doing a couple searches. Not the 495.07s - 500.99s | case. And so to accelerate that in the early days we gave away all the content. Well then when we 500.99s - 507.19s | started Black Hat, Black Hat gave away all the content. Now basically that's the norm. Every 507.19s - 514.07s | conference at least in the hacking space gives away their content for free. And I like to say 514.07s - 520.77s | that's a master. It's weird. It was not. It was because I was type B and lazy. I didn't want to 520.77s - 529.85s | keep shipping those tapes. It's patched. I see it here. But I'm not getting it out of the actual 529.85s - 541.53s | channel. I mean there's something cool being at the music concert and seeing the artist. But you 541.53s - 548.49s | can also enjoy their music later. Same thing here. If you miss a talk you want to see, it's okay. 548.49s - 554.49s | We'll release it. You just do what you want to do. Make a couple bullet points each day of what you 554.49s - 561.49s | want to explore. If you get your two or three things done, victory. But don't feel bad. The other 561.49s - 572.95s | thing is we are not an InfoSec event. We are not RSA. We are a hacking event. What does that 572.95s - 579.07s | mean? It's one of the things


chunk_id: 138_chunk_9
chunk_text:
the norm. Every 507.19s - 514.07s | conference at least in the hacking space gives away their content for free. And I like to say 514.07s - 520.77s | that's a master. It's weird. It was not. It was because I was type B and lazy. I didn't want to 520.77s - 529.85s | keep shipping those tapes. It's patched. I see it here. But I'm not getting it out of the actual 529.85s - 541.53s | channel. I mean there's something cool being at the music concert and seeing the artist. But you 541.53s - 548.49s | can also enjoy their music later. Same thing here. If you miss a talk you want to see, it's okay. 548.49s - 554.49s | We'll release it. You just do what you want to do. Make a couple bullet points each day of what you 554.49s - 561.49s | want to explore. If you get your two or three things done, victory. But don't feel bad. The other 561.49s - 572.95s | thing is we are not an InfoSec event. We are not RSA. We are a hacking event. What does that 572.95s - 579.07s | mean? It's one of the things the CFP review team does. It's basically our filter. When you submit 579.07s - 587.03s | to DEF CON, one of the first questions that goes through our mind is, is this hacker? Is there a 587.03s - 593.91s | sense of joy of discovery? Is there like a spontaneous aha moment that the speaker, the 593.91s - 598.37s | presenter had? Oh, my gosh, that's how this chip really works? I would never have figured that 598.37s - 609.71s | out. Unless I spilled vodka on it. And so we don't have attendees that work on Oracle million 609.75s - 618.05s | dollar database servers. Who here has an Oracle million dollar database server? Nobody. So they 618.05s - 623.89s | might at RSA or Black Hat. That's where they're working. Corporate environments have that stuff. 623.89s - 628.63s | Not here. So the idea is if you're going to hear a talk, it should be with technology you can 628.63s - 632.89s | download. The tools that people are talking about should be released. You should be able to hear 632.89s - 637.43s | something and go and play with it. And so that means it limits our


chunk_id: 138_chunk_10
chunk_text:
the CFP review team does. It's basically our filter. When you submit 579.07s - 587.03s | to DEF CON, one of the first questions that goes through our mind is, is this hacker? Is there a 587.03s - 593.91s | sense of joy of discovery? Is there like a spontaneous aha moment that the speaker, the 593.91s - 598.37s | presenter had? Oh, my gosh, that's how this chip really works? I would never have figured that 598.37s - 609.71s | out. Unless I spilled vodka on it. And so we don't have attendees that work on Oracle million 609.75s - 618.05s | dollar database servers. Who here has an Oracle million dollar database server? Nobody. So they 618.05s - 623.89s | might at RSA or Black Hat. That's where they're working. Corporate environments have that stuff. 623.89s - 628.63s | Not here. So the idea is if you're going to hear a talk, it should be with technology you can 628.63s - 632.89s | download. The tools that people are talking about should be released. You should be able to hear 632.89s - 637.43s | something and go and play with it. And so that means it limits our pool. We're not going to have 637.43s - 641.79s | the cool super Oracle database hacking talk, but we'll have other cool talks that are also 641.79s - 650.87s | accessible to you. So we start trying to choose content that is more hacker, that gives you an 650.87s - 657.51s | idea how to think. And I had a friend, I might have told this story last year, I had a friend 657.51s - 663.41s | that I asked him, hey, are you sending anybody to DEF CON or Black Hat this year? And he was 663.43s - 668.43s | involved in a, let's say a part of the government that does stuff to people that don't like us. And 673.17s - 678.35s | so I'm always curious like what his thought process is. And he said, well, no, I'm not sending 678.35s - 684.49s | anybody to Black Hat, but I'm sending my team to DEF CON. It's like, well, that doesn't like, why 684.49s - 690.33s | would you do that? He said, well, my guy's pretty good. I mean, they're really good. And it's 690.45s - 696.55s | like polishing the edge of a knife, like


chunk_id: 138_chunk_11
chunk_text:
pool. We're not going to have 637.43s - 641.79s | the cool super Oracle database hacking talk, but we'll have other cool talks that are also 641.79s - 650.87s | accessible to you. So we start trying to choose content that is more hacker, that gives you an 650.87s - 657.51s | idea how to think. And I had a friend, I might have told this story last year, I had a friend 657.51s - 663.41s | that I asked him, hey, are you sending anybody to DEF CON or Black Hat this year? And he was 663.43s - 668.43s | involved in a, let's say a part of the government that does stuff to people that don't like us. And 673.17s - 678.35s | so I'm always curious like what his thought process is. And he said, well, no, I'm not sending 678.35s - 684.49s | anybody to Black Hat, but I'm sending my team to DEF CON. It's like, well, that doesn't like, why 684.49s - 690.33s | would you do that? He said, well, my guy's pretty good. I mean, they're really good. And it's 690.45s - 696.55s | like polishing the edge of a knife, like you're honing it, sending it to Black Hat. Like they'll 696.55s - 701.45s | get a little bit better technical skills, but I mean, hey, look, it's pretty fucking sharp. But I 701.45s - 706.43s | send them to DEF CON to learn how to think, how to approach the problem, how to think 706.43s - 711.77s | differently. That's more valuable to me now, right? They can sharpen their knives all day long 711.77s - 717.11s | elsewhere. And when he said that to me, it was this aha moment because running the con, you're 717.11s - 722.53s | very close to it. And you see all the problems. They're like in your face because everybody has 722.53s - 728.87s | no problem telling me where all the problems are. And so I sometimes don't see the big picture. 728.87s - 734.33s | But when somebody far away explains what they're seeing, it's like, okay, now that I understand 734.33s - 740.15s | that, we'll do things to try to help you learn how to think differently. I mean, we were doing 740.15s - 745.25s | that already, but it was never like up front and center. So that's


chunk_id: 138_chunk_12
chunk_text:
you're honing it, sending it to Black Hat. Like they'll 696.55s - 701.45s | get a little bit better technical skills, but I mean, hey, look, it's pretty fucking sharp. But I 701.45s - 706.43s | send them to DEF CON to learn how to think, how to approach the problem, how to think 706.43s - 711.77s | differently. That's more valuable to me now, right? They can sharpen their knives all day long 711.77s - 717.11s | elsewhere. And when he said that to me, it was this aha moment because running the con, you're 717.11s - 722.53s | very close to it. And you see all the problems. They're like in your face because everybody has 722.53s - 728.87s | no problem telling me where all the problems are. And so I sometimes don't see the big picture. 728.87s - 734.33s | But when somebody far away explains what they're seeing, it's like, okay, now that I understand 734.33s - 740.15s | that, we'll do things to try to help you learn how to think differently. I mean, we were doing 740.15s - 745.25s | that already, but it was never like up front and center. So that's super cool. And then the 745.25s - 750.79s | final thing is we really try to support the community. That's why I said hacker. We're a 750.79s - 757.13s | community. DEF CON is one part of the community. We've been around a long time. Maybe we're 757.13s - 760.93s | one of the biggest cons in the community, but there are lots of communities with lots of 760.93s - 767.41s | different like norms and behaviors. One of the things we like to do here is not stop. So we go 767.41s - 773.99s | to 2 in the morning or so and we have music and we have all these entertainment performances. 773.99s - 778.83s | And the hacking community is big enough. We have our own musical style, right? We've got 778.83s - 785.91s | nerd core. And when you go to other countries or when we were doing, we did DEF CON in China 785.91s - 789.33s | and Beijing for a couple of years. And I remember we get over there and we're like, yes, okay, 789.33s - 794.33s | what's the music scene like in China and Beijing? Are you into rock? Is it


chunk_id: 138_chunk_13
chunk_text:
super cool. And then the 745.25s - 750.79s | final thing is we really try to support the community. That's why I said hacker. We're a 750.79s - 757.13s | community. DEF CON is one part of the community. We've been around a long time. Maybe we're 757.13s - 760.93s | one of the biggest cons in the community, but there are lots of communities with lots of 760.93s - 767.41s | different like norms and behaviors. One of the things we like to do here is not stop. So we go 767.41s - 773.99s | to 2 in the morning or so and we have music and we have all these entertainment performances. 773.99s - 778.83s | And the hacking community is big enough. We have our own musical style, right? We've got 778.83s - 785.91s | nerd core. And when you go to other countries or when we were doing, we did DEF CON in China 785.91s - 789.33s | and Beijing for a couple of years. And I remember we get over there and we're like, yes, okay, 789.33s - 794.33s | what's the music scene like in China and Beijing? Are you into rock? Is it jazz? Like what is it? 794.33s - 797.75s | Like we've got to get people from the community. We've got to showcase people from the 797.75s - 802.89s | community and have them play music at our parties. And they're like, oh, yes, okay, yeah, we'll 802.91s - 807.19s | get music for the parties. I'm like, yeah, but who are they? What's the cool thing? It's like, 807.19s - 812.91s | oh, no, we don't have that. What do you mean? It's like, well, there's nobody does that here. 812.91s - 821.91s | Like there's no style or musical bands. Like, oh, no. What else does the community not do over 821.91s - 828.83s | here? And so it's made me think like something is more unique here where people have created 828.87s - 835.87s | musical genres around it. They've had enough space to express themselves to grow the community 835.87s - 841.45s | in different ways. And a lot of the questions we got when we were in China, like a dude in a 841.45s - 846.83s | giant fucking banana outfit would jump on stage and run around. And the Americans would be like, 846.83s -


chunk_id: 138_chunk_14
chunk_text:
jazz? Like what is it? 794.33s - 797.75s | Like we've got to get people from the community. We've got to showcase people from the 797.75s - 802.89s | community and have them play music at our parties. And they're like, oh, yes, okay, yeah, we'll 802.91s - 807.19s | get music for the parties. I'm like, yeah, but who are they? What's the cool thing? It's like, 807.19s - 812.91s | oh, no, we don't have that. What do you mean? It's like, well, there's nobody does that here. 812.91s - 821.91s | Like there's no style or musical bands. Like, oh, no. What else does the community not do over 821.91s - 828.83s | here? And so it's made me think like something is more unique here where people have created 828.87s - 835.87s | musical genres around it. They've had enough space to express themselves to grow the community 835.87s - 841.45s | in different ways. And a lot of the questions we got when we were in China, like a dude in a 841.45s - 846.83s | giant fucking banana outfit would jump on stage and run around. And the Americans would be like, 846.83s - 852.63s | oh, hey, banana guy. And they'd just keep going. And the Chinese people would be like, what the 852.63s - 858.05s | hell is going on here? There's a banana on the stage. Does that mean something? And they're 858.05s - 862.99s | looking in the program. It's like, when the banana shows up, am I supposed to do something? 862.99s - 869.03s | It's like, no, that's just the banana guy. And we were trying to inject a certain amount of 869.03s - 876.17s | weirdness. And it didn't go so well because they're not programmed for weird. You know, like 876.17s - 881.01s | the question they would get is like, okay, there's a scavenger hunt. Now, what do I get? Like, 881.01s - 887.75s | why would I do that? Why would I invest 8.2 minutes of my energy into that if it doesn't help 887.75s - 891.95s | my career? So, well, yeah, it's not going to help your career, but you're probably going to have 891.95s - 900.29s | fun doing it. And you can see them like really working through that. And so, the hacker spirit 900.29s - 904.33s | and the


chunk_id: 138_chunk_15
chunk_text:
852.63s | oh, hey, banana guy. And they'd just keep going. And the Chinese people would be like, what the 852.63s - 858.05s | hell is going on here? There's a banana on the stage. Does that mean something? And they're 858.05s - 862.99s | looking in the program. It's like, when the banana shows up, am I supposed to do something? 862.99s - 869.03s | It's like, no, that's just the banana guy. And we were trying to inject a certain amount of 869.03s - 876.17s | weirdness. And it didn't go so well because they're not programmed for weird. You know, like 876.17s - 881.01s | the question they would get is like, okay, there's a scavenger hunt. Now, what do I get? Like, 881.01s - 887.75s | why would I do that? Why would I invest 8.2 minutes of my energy into that if it doesn't help 887.75s - 891.95s | my career? So, well, yeah, it's not going to help your career, but you're probably going to have 891.95s - 900.29s | fun doing it. And you can see them like really working through that. And so, the hacker spirit 900.29s - 904.33s | and the mentality I think is universal. But the way in which people get there is quite 904.33s - 909.17s | different, right? And we were really lucky in the States that we got a lot of time between high 909.17s - 913.31s | school and college and having to have a career that we could screw around. Like, if I had to do 913.31s - 919.87s | my effort I put in college in high school years, I wouldn't be a hacker. I'd be too busy. And 919.87s - 925.89s | so, we're also really lucky the way that people got into hacking and allowed this amount of 925.89s - 930.45s | creativity. We want you, especially I think in America, you're allowed to fail. You're supposed 930.45s - 935.65s | to fail. If you don't fail, how do you learn? Like, we love the underdog. We love the comeback 935.65s - 941.77s | story. And partially I think it's because it shows somebody failing and then exceeding or 941.79s - 948.93s | succeeding. That's not such a universal story, you know, around the world. So, one of the things 948.93s - 954.77s | we do, before I run out of


chunk_id: 138_chunk_16
chunk_text:
mentality I think is universal. But the way in which people get there is quite 904.33s - 909.17s | different, right? And we were really lucky in the States that we got a lot of time between high 909.17s - 913.31s | school and college and having to have a career that we could screw around. Like, if I had to do 913.31s - 919.87s | my effort I put in college in high school years, I wouldn't be a hacker. I'd be too busy. And 919.87s - 925.89s | so, we're also really lucky the way that people got into hacking and allowed this amount of 925.89s - 930.45s | creativity. We want you, especially I think in America, you're allowed to fail. You're supposed 930.45s - 935.65s | to fail. If you don't fail, how do you learn? Like, we love the underdog. We love the comeback 935.65s - 941.77s | story. And partially I think it's because it shows somebody failing and then exceeding or 941.79s - 948.93s | succeeding. That's not such a universal story, you know, around the world. So, one of the things 948.93s - 954.77s | we do, before I run out of time, just to explain the back story, is you'll see around the 954.77s - 960.87s | con we have these signs up. It's our code of conduct. And it lays out what we do. The code of 960.87s - 965.49s | conduct applies to everybody. It applies to me. It applies to everybody in the Goonsher. It 965.49s - 975.89s | applies to you. Everybody. And the idea here is that we should respect each other and not make 975.89s - 982.33s | people feel afraid, unwelcome, you know. So, if you don't like what someone's saying, great, 982.33s - 988.37s | just move on. You don't have to get into a fist fight with them. But what's the natural 988.37s - 993.51s | consequence of having a policy is you have to enforce the policy. If you don't enforce the 993.53s - 998.77s | policy, people are watching and they'll see if we don't enforce the policy, it doesn't mean 998.77s - 1004.21s | anything. So, then a few years later we came up with our transparency report. And you'll hear 1004.21s - 1008.55s | this at closing ceremonies. Everything that we figured out that happened during the con


chunk_id: 138_chunk_17
chunk_text:
time, just to explain the back story, is you'll see around the 954.77s - 960.87s | con we have these signs up. It's our code of conduct. And it lays out what we do. The code of 960.87s - 965.49s | conduct applies to everybody. It applies to me. It applies to everybody in the Goonsher. It 965.49s - 975.89s | applies to you. Everybody. And the idea here is that we should respect each other and not make 975.89s - 982.33s | people feel afraid, unwelcome, you know. So, if you don't like what someone's saying, great, 982.33s - 988.37s | just move on. You don't have to get into a fist fight with them. But what's the natural 988.37s - 993.51s | consequence of having a policy is you have to enforce the policy. If you don't enforce the 993.53s - 998.77s | policy, people are watching and they'll see if we don't enforce the policy, it doesn't mean 998.77s - 1004.21s | anything. So, then a few years later we came up with our transparency report. And you'll hear 1004.21s - 1008.55s | this at closing ceremonies. Everything that we figured out that happened during the con that 1008.55s - 1012.45s | violated the code of conduct policy, we'll just kind of give you a quick summation at the 1012.45s - 1019.15s | closing ceremonies. And this is sort of a hack to make us accountable to ourselves. Because if 1019.17s - 1027.21s | we didn't know we were going to have to report all this stuff, there's an incentive to then, 1027.21s - 1032.91s | how would the community ever know we're actually taking their concerns seriously? Oh, yes, 1032.91s - 1040.75s | thank you for your report. Oh, sorry, no problems this year. And so, it's kind of painful. 1040.75s - 1046.53s | It's sad when we have serious things on the transparency report. But I also think it's 1046.53s - 1053.15s | absolutely a healthy thing that we have to do. And we must maintain to show the community 1053.15s - 1057.39s | that we're holding ourselves accountable. And I'm always open for ideas and rooms for 1057.39s - 1063.09s | improvement. Because ultimately, right, the con is what you make of it. And I want you guys 1063.09s - 1069.03s | to feel, gals, any, but you can do whatever you want. We're


chunk_id: 138_chunk_18
chunk_text:
that 1008.55s - 1012.45s | violated the code of conduct policy, we'll just kind of give you a quick summation at the 1012.45s - 1019.15s | closing ceremonies. And this is sort of a hack to make us accountable to ourselves. Because if 1019.17s - 1027.21s | we didn't know we were going to have to report all this stuff, there's an incentive to then, 1027.21s - 1032.91s | how would the community ever know we're actually taking their concerns seriously? Oh, yes, 1032.91s - 1040.75s | thank you for your report. Oh, sorry, no problems this year. And so, it's kind of painful. 1040.75s - 1046.53s | It's sad when we have serious things on the transparency report. But I also think it's 1046.53s - 1053.15s | absolutely a healthy thing that we have to do. And we must maintain to show the community 1053.15s - 1057.39s | that we're holding ourselves accountable. And I'm always open for ideas and rooms for 1057.39s - 1063.09s | improvement. Because ultimately, right, the con is what you make of it. And I want you guys 1063.09s - 1069.03s | to feel, gals, any, but you can do whatever you want. We're trying to create this experience. 1069.03s - 1077.31s | And the other thing is, I have 35 seconds. The other thing is, the origin story of DEF CON, 1077.31s - 1083.65s | of the speakers, was that there was so much bullshit online, or on voice bridges, about what 1083.65s - 1089.19s | was real and what was fake, what technically worked and what didn't. You know, if you call 1089.19s - 1095.37s | this one number and put in this code, the next phone call you make can't be traced. Like, 1095.37s - 1101.61s | really, can't be traced. What is that number you're calling? I don't know. It's a no-tracing 1101.61s - 1107.79s | phone number. Why does the no-tracing phone number exist? I don't know, but it's a no-tracing 1107.79s - 1113.26s | phone number. Oh, God, I've got to find somebody from the telco to come and explain what this 1113.26s - 1119.68s | number is. If you have a bulletin board and you put on the login page, law enforcement's not 1119.68s - 1126.18s | allowed to log in. No law enforcement. And they create an account and they log in. That's 1126.18s - 1134.12s


chunk_id: 138_chunk_19
chunk_text:
trying to create this experience. 1069.03s - 1077.31s | And the other thing is, I have 35 seconds. The other thing is, the origin story of DEF CON, 1077.31s - 1083.65s | of the speakers, was that there was so much bullshit online, or on voice bridges, about what 1083.65s - 1089.19s | was real and what was fake, what technically worked and what didn't. You know, if you call 1089.19s - 1095.37s | this one number and put in this code, the next phone call you make can't be traced. Like, 1095.37s - 1101.61s | really, can't be traced. What is that number you're calling? I don't know. It's a no-tracing 1101.61s - 1107.79s | phone number. Why does the no-tracing phone number exist? I don't know, but it's a no-tracing 1107.79s - 1113.26s | phone number. Oh, God, I've got to find somebody from the telco to come and explain what this 1113.26s - 1119.68s | number is. If you have a bulletin board and you put on the login page, law enforcement's not 1119.68s - 1126.18s | allowed to log in. No law enforcement. And they create an account and they log in. That's 1126.18s - 1134.12s | entrapment. Really? So, if the FBI's investigating you and you just put these signs up, like, 1134.12s - 1140.46s | FBI, you must raise your hands. Identify yourself. They got to do that? Oh, yeah. Yeah, that's 1140.46s - 1147.30s | called entrapment. I don't think that word means what you think it means. Like, Al Capone would 1147.30s - 1153.14s | have used that somehow to his advantage. Okay, I got to find a prosecutor now. So, we got the 1154.00s - 1157.76s | prosecutor that was prosecuting a bunch of people and she got up there and, you know, laughed 1157.76s - 1163.68s | about that. We got people from telco. We got people from Sun Microsystems talking about how 1163.68s - 1168.68s | exploitation and, you know, managing large systems actually worked. Hearing from the horse's 1168.68s - 1175.02s | mouth. From the source. And that's why sometimes you'll see speakers like our next speaker, 1175.02s - 1179.92s | previous director of the National Security Agency, General Nakasone, it's like, now you're 1179.92s - 1185.98s | hearing from the source. These aren't people you might normally come into contact with. So, 1185.98s - 1191.16s | that's


chunk_id: 138_chunk_20
chunk_text:
| entrapment. Really? So, if the FBI's investigating you and you just put these signs up, like, 1134.12s - 1140.46s | FBI, you must raise your hands. Identify yourself. They got to do that? Oh, yeah. Yeah, that's 1140.46s - 1147.30s | called entrapment. I don't think that word means what you think it means. Like, Al Capone would 1147.30s - 1153.14s | have used that somehow to his advantage. Okay, I got to find a prosecutor now. So, we got the 1154.00s - 1157.76s | prosecutor that was prosecuting a bunch of people and she got up there and, you know, laughed 1157.76s - 1163.68s | about that. We got people from telco. We got people from Sun Microsystems talking about how 1163.68s - 1168.68s | exploitation and, you know, managing large systems actually worked. Hearing from the horse's 1168.68s - 1175.02s | mouth. From the source. And that's why sometimes you'll see speakers like our next speaker, 1175.02s - 1179.92s | previous director of the National Security Agency, General Nakasone, it's like, now you're 1179.92s - 1185.98s | hearing from the source. These aren't people you might normally come into contact with. So, 1185.98s - 1191.16s | that's why sometimes you see these big name VIPs. It's because we're trying to expose you to 1191.16s - 1194.70s | people and content that you just, you might read about, but you don't normally bump into in 1194.70s - 1200.04s | your life. And luckily, we're big enough and they're interested in us enough. They want to 1200.04s - 1204.34s | come and meet us now. It's not just a one-way street. It's not just us wanting to know what 1204.34s - 1209.98s | they're doing. So, with that said, thank you very much. Sorry my voice is shot. I sound like a 1209.98s - 1214.48s | frog. Have a great time. Thank you very much. And I'll see you around.


chunk_id: 138_chunk_21
chunk_text:
why sometimes you see these big name VIPs. It's because we're trying to expose you to 1191.16s - 1194.70s | people and content that you just, you might read about, but you don't normally bump into in 1194.70s - 1200.04s | your life. And luckily, we're big enough and they're interested in us enough. They want to 1200.04s - 1204.34s | come and meet us now. It's not just a one-way street. It's not just us wanting to know what 1204.34s - 1209.98s | they're doing. So, with that said, thank you very much. Sorry my voice is shot. I sound like a 1209.98s - 1214.48s | frog. Have a great time. Thank you very much. And I'll see you around.


chunk_id: 139_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=v6VMEeUcqzo", "title": "DEF CON 32 - The edges of Surveilance System and its supply chain - Chanin Kim, Myounghun Pak", "description": "With the development of artificial intelligence and image processing technology, the video industry such as CCTV is developing greatly. However, CCTV video may infringe on an individual's privacy, and personal information may be leaked due to hacking or illegal video collection. As such, Surveillance System's Security issues are also increasing, the importance of the video surveillance industry is becoming more prominent.\n\nIn order to prevent hacking or illegal video collection, research on camera security is being conducted. However, there is a lack of awareness of NVR (Network Video Recorder), a device that actually watches videos recorded by cameras, and research on this is also insufficient.\n\nWe selected Hikvision and Dahua, which have a high NVR market share, as target vendors, and also selected Synology's NVR-related package, Surveillance Station, as targets. Before proceeding with vulnerability analysis, several problems occurred during the file system extraction process, but U-Boot mitigation was successfully bypassed through various methods. Afterwards, various types of vulnerabilities were discovered through analysis, and OEM verification was also conducted to increase impact. We present exploit scenarios for surveillance devices through vulnerability linkage and present supply chain security issues in the Surveillance System.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2628, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.75s - 5.75s | This text was transcribed using whisper model: large-v2 Hello DEF CON. Thank you for coming to our presentation. 5.75s - 8.75s | We are excited to share our talk titled, 8.75s - 12.75s | Watchers Being Watched, Exploiting the Surveillance System and Its Supply Chain. 12.75s - 17.75s | We'll talk about our vulnerability research on surveillance system devices. 17.75s - 19.75s | Please enjoy. 19.75s - 22.75s | First, let us introduce our research group. 22.75s - 27.75s | I'm Chani Kim, and I'm currently working as an offensive researcher at S2W. 27.75s - 34.75s | He's Myungwoo Park, and he's a student attending a university in Korea, enjoying offensive research. 34.75s - 39.45s | And this is what we'll show you in this talk. 39.45s - 46.45s | We'll be talking about a $30,000 bounty and a four-month journey to become a DEF CON speaker. 46.45s - 49.45s | In our talk, we'll cover how we extract the firmware, 49.45s - 52.45s | then the steps we took to analyze the


chunk_id: 139_chunk_1
chunk_text:
vulnerability linkage and present supply chain security issues in the Surveillance System.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2628, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.75s - 5.75s | This text was transcribed using whisper model: large-v2 Hello DEF CON. Thank you for coming to our presentation. 5.75s - 8.75s | We are excited to share our talk titled, 8.75s - 12.75s | Watchers Being Watched, Exploiting the Surveillance System and Its Supply Chain. 12.75s - 17.75s | We'll talk about our vulnerability research on surveillance system devices. 17.75s - 19.75s | Please enjoy. 19.75s - 22.75s | First, let us introduce our research group. 22.75s - 27.75s | I'm Chani Kim, and I'm currently working as an offensive researcher at S2W. 27.75s - 34.75s | He's Myungwoo Park, and he's a student attending a university in Korea, enjoying offensive research. 34.75s - 39.45s | And this is what we'll show you in this talk. 39.45s - 46.45s | We'll be talking about a $30,000 bounty and a four-month journey to become a DEF CON speaker. 46.45s - 49.45s | In our talk, we'll cover how we extract the firmware, 49.45s - 52.45s | then the steps we took to analyze the vulnerabilities, 52.45s - 58.45s | and after that, the various vulnerabilities that could be exploited in the war and their scenarios. 58.45s - 62.45s | In the last, the impact of our research on the supply chain. 62.45s - 66.45s | That's it. Please look forward to it. 66.45s - 70.45s | This video will be the final goal, which happened in the real world. 70.45s - 74.45s | We wanted to see why we're doing this research. 74.45s - 76.45s | This was posted by Iranian hackers, 77.45s - 83.45s | and we would like to show that we have successfully demonstrated what the video is showing. 83.45s - 85.45s | Let's watch the video. 85.45s - 107.39s | That's like a hacker from a movie, isn't it? 107.39s - 112.77s | Next, why is making our surveillance device more securely important? 112.77s - 116.77s | We can see surveillance devices everywhere in our lives. 116.77s - 119.77s | Because of the COVID-19 pandemic outbreak, 119.77s - 124.77s | the demand for surveillance devices has been surging for various purposes, 124.77s - 129.77s | such as a main store, smart cities, and for those access control. 129.77s - 135.77s


chunk_id: 139_chunk_2
chunk_text:
vulnerabilities, 52.45s - 58.45s | and after that, the various vulnerabilities that could be exploited in the war and their scenarios. 58.45s - 62.45s | In the last, the impact of our research on the supply chain. 62.45s - 66.45s | That's it. Please look forward to it. 66.45s - 70.45s | This video will be the final goal, which happened in the real world. 70.45s - 74.45s | We wanted to see why we're doing this research. 74.45s - 76.45s | This was posted by Iranian hackers, 77.45s - 83.45s | and we would like to show that we have successfully demonstrated what the video is showing. 83.45s - 85.45s | Let's watch the video. 85.45s - 107.39s | That's like a hacker from a movie, isn't it? 107.39s - 112.77s | Next, why is making our surveillance device more securely important? 112.77s - 116.77s | We can see surveillance devices everywhere in our lives. 116.77s - 119.77s | Because of the COVID-19 pandemic outbreak, 119.77s - 124.77s | the demand for surveillance devices has been surging for various purposes, 124.77s - 129.77s | such as a main store, smart cities, and for those access control. 129.77s - 135.77s | Thus, the global surveillance device market is currently worth $4.1 billion. 135.77s - 139.77s | So, in these circumstances, surrounding by such devices, 139.77s - 145.77s | MVRs are taking on a more essential role in our lives and those users. 145.77s - 149.37s | Next is our target. 149.37s - 152.37s | Many people don't know much about MVR, 152.37s - 154.37s | but as we just highlighted, 154.37s - 160.37s | MVR is more than just important since it plays a brand-like role in all the surveillance systems. 160.37s - 164.37s | Therefore, we selected MVR as our target. 164.37s - 168.26s | So, what is an MVR? 168.26s - 175.26s | A network video recorder called MVR stores recorded video from CCTVs and live cameras 175.26s - 178.26s | and monitors or manages real-time video. 178.26s - 180.26s | Due to the nature of managing these videos, 180.26s - 183.26s | many devices can access them over the Internet. 183.26s - 186.26s | And the screen you see below is the MVR screen. 186.26s - 192.18s | This is our detailed research motivation. 192.18s - 195.18s | First, as we investigated enough online, 195.18s - 201.18s


chunk_id: 139_chunk_3
chunk_text:
| Thus, the global surveillance device market is currently worth $4.1 billion. 135.77s - 139.77s | So, in these circumstances, surrounding by such devices, 139.77s - 145.77s | MVRs are taking on a more essential role in our lives and those users. 145.77s - 149.37s | Next is our target. 149.37s - 152.37s | Many people don't know much about MVR, 152.37s - 154.37s | but as we just highlighted, 154.37s - 160.37s | MVR is more than just important since it plays a brand-like role in all the surveillance systems. 160.37s - 164.37s | Therefore, we selected MVR as our target. 164.37s - 168.26s | So, what is an MVR? 168.26s - 175.26s | A network video recorder called MVR stores recorded video from CCTVs and live cameras 175.26s - 178.26s | and monitors or manages real-time video. 178.26s - 180.26s | Due to the nature of managing these videos, 180.26s - 183.26s | many devices can access them over the Internet. 183.26s - 186.26s | And the screen you see below is the MVR screen. 186.26s - 192.18s | This is our detailed research motivation. 192.18s - 195.18s | First, as we investigated enough online, 195.18s - 201.18s | there was not as much as studies on it compared to CCTV or IP camera system. 201.18s - 205.18s | And as a result of a showdown search, 205.18s - 210.18s | we found that more than 30,000 devices are exposed to the Internet. 211.18s - 216.18s | However, there are cases where critical vulnerabilities have been discovered previously. 216.18s - 221.18s | There was a case when the Miraebonnet became popular in 2021, 221.18s - 227.18s | Hikvision's pre-auth RCE vulnerability was maliciously used for a DDoS attack. 227.18s - 233.18s | So, we are motivated by such examples which are serious vulnerabilities. 233.18s - 237.81s | Next is vendor choice. 237.81s - 240.81s | We chose four vendors, Hikvision and Tawa, 240.81s - 245.81s | because they have the highest market share in the world's surveillance system. 245.81s - 250.81s | We chose vendor A, which has the highest market share in Korea. 250.81s - 253.81s | Lastly, regardless of market share, 253.81s - 258.81s | we also selected Shinology's surveillance station package as a target vendor. 258.81s - 265.81s | This is because Shinology is famous for security and has an image of being safe, 265.81s


chunk_id: 139_chunk_4
chunk_text:
| there was not as much as studies on it compared to CCTV or IP camera system. 201.18s - 205.18s | And as a result of a showdown search, 205.18s - 210.18s | we found that more than 30,000 devices are exposed to the Internet. 211.18s - 216.18s | However, there are cases where critical vulnerabilities have been discovered previously. 216.18s - 221.18s | There was a case when the Miraebonnet became popular in 2021, 221.18s - 227.18s | Hikvision's pre-auth RCE vulnerability was maliciously used for a DDoS attack. 227.18s - 233.18s | So, we are motivated by such examples which are serious vulnerabilities. 233.18s - 237.81s | Next is vendor choice. 237.81s - 240.81s | We chose four vendors, Hikvision and Tawa, 240.81s - 245.81s | because they have the highest market share in the world's surveillance system. 245.81s - 250.81s | We chose vendor A, which has the highest market share in Korea. 250.81s - 253.81s | Lastly, regardless of market share, 253.81s - 258.81s | we also selected Shinology's surveillance station package as a target vendor. 258.81s - 265.81s | This is because Shinology is famous for security and has an image of being safe, 265.81s - 273.82s | so we wanted to check whether surveillance-related packages were also the same. 273.82s - 277.82s | Next, let us tell you about our firmware extraction methodology. 277.82s - 281.82s | We tried a variety of methods to extract the firmware, 281.82s - 284.82s | and this picture is a list of what we tried. 284.82s - 290.65s | Since three of these products had UART ports available, 290.65s - 293.65s | we tried to extract the firmware through UART. 293.65s - 299.65s | Shinology allowed root share access via SSH, so no other method was needed. 301.65s - 306.65s | Before that, let us tell you why we didn't perform the extraction via remote access. 306.65s - 312.65s | Hikvision and Tawa supported remote access, but only limited share access was possible. 312.65s - 319.65s | We tried many ways to bypass it, but they failed, so we had no choice but to use UART. 320.65s - 327.65s | We identified the UART port on the PC board and connected the cable to make it interactable with the U-boot share. 327.65s - 333.65s | However, all three devices were not regular U-boots but modified U-boots, 333.65s -


chunk_id: 139_chunk_5
chunk_text:
- 273.82s | so we wanted to check whether surveillance-related packages were also the same. 273.82s - 277.82s | Next, let us tell you about our firmware extraction methodology. 277.82s - 281.82s | We tried a variety of methods to extract the firmware, 281.82s - 284.82s | and this picture is a list of what we tried. 284.82s - 290.65s | Since three of these products had UART ports available, 290.65s - 293.65s | we tried to extract the firmware through UART. 293.65s - 299.65s | Shinology allowed root share access via SSH, so no other method was needed. 301.65s - 306.65s | Before that, let us tell you why we didn't perform the extraction via remote access. 306.65s - 312.65s | Hikvision and Tawa supported remote access, but only limited share access was possible. 312.65s - 319.65s | We tried many ways to bypass it, but they failed, so we had no choice but to use UART. 320.65s - 327.65s | We identified the UART port on the PC board and connected the cable to make it interactable with the U-boot share. 327.65s - 333.65s | However, all three devices were not regular U-boots but modified U-boots, 333.65s - 337.65s | so we couldn't use the U-boot share as shown in the picture on the right. 337.65s - 340.65s | We started looking for a way to bypass it. 340.65s - 351.34s | First, in the case of Hikvision, we couldn't bypass UART mitigation on the first NVR we purchased, 351.34s - 358.34s | so we used the downgrade method of repurchasing an older version of the Hikvision device. 358.34s - 361.34s | The older version device had lower UART versions, 361.34s - 366.34s | and there were differences from mitigation applied to the latest U-boot. 366.34s - 376.46s | We were able to access the U-boot share using Hikvision's U-boot mitigation bypass technique we could find on the Internet. 376.46s - 384.06s | And last, we updated the older version of the product to the latest firmware. 384.06s - 389.53s | The bypass technique already known in the older version… 389.53s - 411.82s | On the latest version, there was no reaction even though we tried our best on giving command input. 411.82s - 416.82s | But as shown in the picture on the right, which is the older version, 416.82s - 423.82s | using setenv and semicolons


chunk_id: 139_chunk_6
chunk_text:
337.65s | so we couldn't use the U-boot share as shown in the picture on the right. 337.65s - 340.65s | We started looking for a way to bypass it. 340.65s - 351.34s | First, in the case of Hikvision, we couldn't bypass UART mitigation on the first NVR we purchased, 351.34s - 358.34s | so we used the downgrade method of repurchasing an older version of the Hikvision device. 358.34s - 361.34s | The older version device had lower UART versions, 361.34s - 366.34s | and there were differences from mitigation applied to the latest U-boot. 366.34s - 376.46s | We were able to access the U-boot share using Hikvision's U-boot mitigation bypass technique we could find on the Internet. 376.46s - 384.06s | And last, we updated the older version of the product to the latest firmware. 384.06s - 389.53s | The bypass technique already known in the older version… 389.53s - 411.82s | On the latest version, there was no reaction even though we tried our best on giving command input. 411.82s - 416.82s | But as shown in the picture on the right, which is the older version, 416.82s - 423.82s | using setenv and semicolons caused the command injection, so we were able to insert U-boot command. 424.82s - 430.82s | Since we could use the U-boot command list, we were able to obtain a kernel share for the device 430.82s - 434.82s | by adding bin share to the rdnid argument in bootargs. 434.82s - 439.26s | Next, the case of Dahua. 439.26s - 442.26s | In Dahua, several U-boot command lists were available, 442.26s - 447.26s | but the most important command list such as printenv did not exist, 447.26s - 451.26s | so we used setenv to print the changed argument once again 451.26s - 456.26s | to check the value of the environment variable with the keys we know. 456.26s - 460.83s | However, bigger problem awaited us. 460.83s - 466.83s | We modified bootargs and booted the device, but we couldn't see the kernel output. 466.83s - 470.83s | In order to use the kernel share, of course, there must be kernel output. 470.83s - 474.83s | So we looked for a way to check the kernel output. 474.83s - 481.46s | First, we knew that the environment section exists using the mtdpart command 481.46s - 485.46s | and to


chunk_id: 139_chunk_7
chunk_text:
caused the command injection, so we were able to insert U-boot command. 424.82s - 430.82s | Since we could use the U-boot command list, we were able to obtain a kernel share for the device 430.82s - 434.82s | by adding bin share to the rdnid argument in bootargs. 434.82s - 439.26s | Next, the case of Dahua. 439.26s - 442.26s | In Dahua, several U-boot command lists were available, 442.26s - 447.26s | but the most important command list such as printenv did not exist, 447.26s - 451.26s | so we used setenv to print the changed argument once again 451.26s - 456.26s | to check the value of the environment variable with the keys we know. 456.26s - 460.83s | However, bigger problem awaited us. 460.83s - 466.83s | We modified bootargs and booted the device, but we couldn't see the kernel output. 466.83s - 470.83s | In order to use the kernel share, of course, there must be kernel output. 470.83s - 474.83s | So we looked for a way to check the kernel output. 474.83s - 481.46s | First, we knew that the environment section exists using the mtdpart command 481.46s - 485.46s | and to print the contents of this environment section, 485.46s - 490.46s | we used the ntdump command to print the contents of the environment variable. 492.46s - 497.46s | Now that we were able to check the key values of the environment variable, 497.46s - 505.46s | we changed the value of each environment variable one by one to see if we could grab the kernel output. 505.46s - 510.46s | We found out that there was an environment variable called dhkeyboard 510.46s - 516.46s | that specifies the kernel output mode, so we could change it to 0 to get kernel output. 516.46s - 519.78s | Next is vendor A. 519.78s - 523.78s | In the case of vendor A, unlike the previous two cases, 523.78s - 526.78s | it was not possible to even use the ubuntu share. 526.78s - 530.78s | As you can see, as soon as we booted the device, 530.78s - 534.78s | type password has appeared and we couldn't use any ubuntu command list. 535.78s - 541.78s | Vendor A was calling the secure UART and we started doing a lot of research to bypass this. 541.78s - 547.15s | We learned about the


chunk_id: 139_chunk_8
chunk_text:
print the contents of this environment section, 485.46s - 490.46s | we used the ntdump command to print the contents of the environment variable. 492.46s - 497.46s | Now that we were able to check the key values of the environment variable, 497.46s - 505.46s | we changed the value of each environment variable one by one to see if we could grab the kernel output. 505.46s - 510.46s | We found out that there was an environment variable called dhkeyboard 510.46s - 516.46s | that specifies the kernel output mode, so we could change it to 0 to get kernel output. 516.46s - 519.78s | Next is vendor A. 519.78s - 523.78s | In the case of vendor A, unlike the previous two cases, 523.78s - 526.78s | it was not possible to even use the ubuntu share. 526.78s - 530.78s | As you can see, as soon as we booted the device, 530.78s - 534.78s | type password has appeared and we couldn't use any ubuntu command list. 535.78s - 541.78s | Vendor A was calling the secure UART and we started doing a lot of research to bypass this. 541.78s - 547.15s | We learned about the glitching attack through a lot of research 547.15s - 550.15s | and let the ubuntu code to perform this attack. 550.15s - 555.15s | By reading the code, booting algorithm in the ubuntu system says that 555.15s - 559.15s | if the initialization process was successful or lost the kernel, 559.15s - 563.15s | and if it fails, it restarts the bootloader share. 563.15s - 568.15s | We assumed that vendor A wouldn't have exception handling for this method, 568.15s - 573.91s | and we found a way to make the initialization process fail. 573.91s - 576.91s | Let us tell you how to perform this attack. 576.91s - 581.91s | First, we will explain the process of loading kernel during the normal boot sequence. 582.91s - 586.91s | First, load the kernel into RAM from flash memory. 586.91s - 591.91s | Second, the CPU rests the kernel loaded into RAM and decompresses it. 592.91s - 598.91s | If the decompression is successful, the CPU starts the kernel and terminates the execution of uboot. 599.91s - 606.91s | Now, let us tell you the boot sequence's difference between performing the attack and vice versa. 607.91s - 612.91s | As with


chunk_id: 139_chunk_9
chunk_text:
glitching attack through a lot of research 547.15s - 550.15s | and let the ubuntu code to perform this attack. 550.15s - 555.15s | By reading the code, booting algorithm in the ubuntu system says that 555.15s - 559.15s | if the initialization process was successful or lost the kernel, 559.15s - 563.15s | and if it fails, it restarts the bootloader share. 563.15s - 568.15s | We assumed that vendor A wouldn't have exception handling for this method, 568.15s - 573.91s | and we found a way to make the initialization process fail. 573.91s - 576.91s | Let us tell you how to perform this attack. 576.91s - 581.91s | First, we will explain the process of loading kernel during the normal boot sequence. 582.91s - 586.91s | First, load the kernel into RAM from flash memory. 586.91s - 591.91s | Second, the CPU rests the kernel loaded into RAM and decompresses it. 592.91s - 598.91s | If the decompression is successful, the CPU starts the kernel and terminates the execution of uboot. 599.91s - 606.91s | Now, let us tell you the boot sequence's difference between performing the attack and vice versa. 607.91s - 612.91s | As with the normal process, load the kernel into RAM from flash memory. 612.91s - 619.91s | At this time, we gave it an electric shock which caused the kernel to be broken and to be loaded into RAM. 620.91s - 625.91s | As the CPU tries to decompress the broken kernel in RAM, it naturally fails. 626.91s - 632.91s | When this happens, the CPU restarts the bootloader share as I mentioned earlier. 633.91s - 637.91s | Through previous research, we learned that the attack is carried out 637.91s - 642.91s | by connecting the chip select and data out on the pad of flash memory. 642.91s - 647.91s | Therefore, we checked the data sheet of the flash memory available at vendor A 647.91s - 650.91s | and found out which chip should be connected. 650.91s - 654.91s | We are now all set, but how do we connect these two pads? 655.91s - 661.91s | We created a specialized tool for performing this particular attack 661.91s - 664.91s | by attaching the heads of jumper cables together. 664.91s - 666.91s | Looks very easy, right? 667.91s - 669.91s | Here is a demo of this attack. 670.91s - 681.74s


chunk_id: 139_chunk_10
chunk_text:
the normal process, load the kernel into RAM from flash memory. 612.91s - 619.91s | At this time, we gave it an electric shock which caused the kernel to be broken and to be loaded into RAM. 620.91s - 625.91s | As the CPU tries to decompress the broken kernel in RAM, it naturally fails. 626.91s - 632.91s | When this happens, the CPU restarts the bootloader share as I mentioned earlier. 633.91s - 637.91s | Through previous research, we learned that the attack is carried out 637.91s - 642.91s | by connecting the chip select and data out on the pad of flash memory. 642.91s - 647.91s | Therefore, we checked the data sheet of the flash memory available at vendor A 647.91s - 650.91s | and found out which chip should be connected. 650.91s - 654.91s | We are now all set, but how do we connect these two pads? 655.91s - 661.91s | We created a specialized tool for performing this particular attack 661.91s - 664.91s | by attaching the heads of jumper cables together. 664.91s - 666.91s | Looks very easy, right? 667.91s - 669.91s | Here is a demo of this attack. 670.91s - 681.74s | If we give it an electric shock and boom, we can use the bootloader share. 682.74s - 692.19s | Once we had the kernel shares for all devices, we needed to extract the file system. 692.19s - 697.19s | We ejected out the file system to our NAS using NFS and USB. 697.19s - 705.19s | One thing we didn't know was that the USB had to be formatted as XFS for the device to recognize it. 706.19s - 713.60s | As you can see, we were able to successfully transfer all devices' file systems to our NAS. 715.60s - 721.60s | However, we encountered a big failure while configuring the AWS analysis environment 721.60s - 727.60s | because most file systems were read-only, so no files could be modified or written. 727.60s - 732.60s | Now, even though we had a root share, the shares become unusable once the device boots up, 732.60s - 734.60s | so we had to bypass it. 734.60s - 741.98s | We found out that only the root file and device directory were modifiable, 741.98s - 744.98s | so we decided to use bind-mount. 744.98s - 749.98s | We discovered that when we


chunk_id: 139_chunk_11
chunk_text:
| If we give it an electric shock and boom, we can use the bootloader share. 682.74s - 692.19s | Once we had the kernel shares for all devices, we needed to extract the file system. 692.19s - 697.19s | We ejected out the file system to our NAS using NFS and USB. 697.19s - 705.19s | One thing we didn't know was that the USB had to be formatted as XFS for the device to recognize it. 706.19s - 713.60s | As you can see, we were able to successfully transfer all devices' file systems to our NAS. 715.60s - 721.60s | However, we encountered a big failure while configuring the AWS analysis environment 721.60s - 727.60s | because most file systems were read-only, so no files could be modified or written. 727.60s - 732.60s | Now, even though we had a root share, the shares become unusable once the device boots up, 732.60s - 734.60s | so we had to bypass it. 734.60s - 741.98s | We found out that only the root file and device directory were modifiable, 741.98s - 744.98s | so we decided to use bind-mount. 744.98s - 749.98s | We discovered that when we bind-mount an arbitrary file in a writeable directory, 749.98s - 752.98s | the file becomes editable. 752.98s - 757.98s | We immediately bind-mounted ETC password to a writeable location. 758.98s - 761.98s | Now, we can modify ETC password. 762.98s - 767.98s | However, the main binary ran an integrity check and rebooted the device 767.98s - 770.98s | when changes to file contents were detected. 770.98s - 775.42s | So, we found a way to get around this. 775.42s - 779.42s | First, we cloned ETC password to a writeable directory. 779.42s - 786.42s | If you look at the picture on the right, you can see that the root share is set to DSH, a restricted share. 786.42s - 794.30s | Second, bind-mount is performed in the RCS script after the initialization process is completed 794.30s - 798.30s | and immediately before starting the main binary. 798.30s - 806.16s | Next, we ran the main binary, and when the web service becomes available, 806.16s - 809.16s | we changed the contents of the bind-mounted file. 809.16s - 815.60s | Finally, we have a restricted root share access via SSH. 815.60s - 819.60s | Now, we can replicate the


chunk_id: 139_chunk_12
chunk_text:
bind-mount an arbitrary file in a writeable directory, 749.98s - 752.98s | the file becomes editable. 752.98s - 757.98s | We immediately bind-mounted ETC password to a writeable location. 758.98s - 761.98s | Now, we can modify ETC password. 762.98s - 767.98s | However, the main binary ran an integrity check and rebooted the device 767.98s - 770.98s | when changes to file contents were detected. 770.98s - 775.42s | So, we found a way to get around this. 775.42s - 779.42s | First, we cloned ETC password to a writeable directory. 779.42s - 786.42s | If you look at the picture on the right, you can see that the root share is set to DSH, a restricted share. 786.42s - 794.30s | Second, bind-mount is performed in the RCS script after the initialization process is completed 794.30s - 798.30s | and immediately before starting the main binary. 798.30s - 806.16s | Next, we ran the main binary, and when the web service becomes available, 806.16s - 809.16s | we changed the contents of the bind-mounted file. 809.16s - 815.60s | Finally, we have a restricted root share access via SSH. 815.60s - 819.60s | Now, we can replicate the file system using NFS. 819.60s - 825.60s | Additionally, this bind-mounting replaces the original file contents when the device is rebooted, 825.60s - 830.60s | so we created the previous process as a share script and used it. 830.60s - 839.85s | Next, we'll discuss the vulnerabilities we discovered and the MBR hacking scenarios we created by linking these vulnerabilities. 839.85s - 844.85s | Here, we will explain one scenario for each vendor we targeted. 844.85s - 849.22s | First, let's look at the scenario for vendor A. 849.22s - 853.22s | The code on the left is the query string parsing logic used in the web page. 853.22s - 860.22s | It calculates the start and end of the parameters based on the equal and n% characters. 860.22s - 866.22s | This parameter named length is used as the parameter for SDRN copy. 866.22s - 873.22s | Therefore, since the length is a controller parameter by the attacker, it can cause a buffer overflow. 873.22s - 880.54s | So, let's insert a large number of characters into the query string parameter. 880.54s - 888.54s | As you can see, the return address is overwritten because there is no canary


chunk_id: 139_chunk_13
chunk_text:
file system using NFS. 819.60s - 825.60s | Additionally, this bind-mounting replaces the original file contents when the device is rebooted, 825.60s - 830.60s | so we created the previous process as a share script and used it. 830.60s - 839.85s | Next, we'll discuss the vulnerabilities we discovered and the MBR hacking scenarios we created by linking these vulnerabilities. 839.85s - 844.85s | Here, we will explain one scenario for each vendor we targeted. 844.85s - 849.22s | First, let's look at the scenario for vendor A. 849.22s - 853.22s | The code on the left is the query string parsing logic used in the web page. 853.22s - 860.22s | It calculates the start and end of the parameters based on the equal and n% characters. 860.22s - 866.22s | This parameter named length is used as the parameter for SDRN copy. 866.22s - 873.22s | Therefore, since the length is a controller parameter by the attacker, it can cause a buffer overflow. 873.22s - 880.54s | So, let's insert a large number of characters into the query string parameter. 880.54s - 888.54s | As you can see, the return address is overwritten because there is no canary successfully manipulating the PC register. 888.54s - 893.14s | However, we encountered a few problems. 893.14s - 898.14s | First, Annex was enabled, so we needed to perform the ROP. 898.14s - 906.14s | Next, since the payload must be successfully delivered to the server, we could only insert printable characters. 906.14s - 913.14s | All gadgets in the binary start with 1, so we could not use gadgets within binary. 913.14s - 918.14s | For this reason, we also couldn't leak the libc address. 918.14s - 921.14s | So, how do we write the exploit code? 921.14s - 923.14s | We found several solutions. 923.14s - 929.14s | First, we discovered that the R0 register holds a stack address at a certain size. 929.14s - 935.14s | We confirmed that this stack address contains the string we inserted into the query string. 935.14s - 942.14s | Next, since the main binary has a 32-bit address space, it has low entropy. 942.14s - 950.14s | Lastly, the Lydie binary spawns a new child process whenever the child process dies. 950.14s - 955.14s | What do you think? Doesn't it seem like everything except for protocols? 955.14s - 963.14s | Look


chunk_id: 139_chunk_14
chunk_text:
successfully manipulating the PC register. 888.54s - 893.14s | However, we encountered a few problems. 893.14s - 898.14s | First, Annex was enabled, so we needed to perform the ROP. 898.14s - 906.14s | Next, since the payload must be successfully delivered to the server, we could only insert printable characters. 906.14s - 913.14s | All gadgets in the binary start with 1, so we could not use gadgets within binary. 913.14s - 918.14s | For this reason, we also couldn't leak the libc address. 918.14s - 921.14s | So, how do we write the exploit code? 921.14s - 923.14s | We found several solutions. 923.14s - 929.14s | First, we discovered that the R0 register holds a stack address at a certain size. 929.14s - 935.14s | We confirmed that this stack address contains the string we inserted into the query string. 935.14s - 942.14s | Next, since the main binary has a 32-bit address space, it has low entropy. 942.14s - 950.14s | Lastly, the Lydie binary spawns a new child process whenever the child process dies. 950.14s - 955.14s | What do you think? Doesn't it seem like everything except for protocols? 955.14s - 963.14s | Look here. As I mentioned, the R0 register holds a stack address containing the string we can manipulate. 963.14s - 967.14s | At that time, we can control the fish register. 967.14s - 974.14s | Now, we needed to reboot the binary until the fish register holds the libc system address. 974.14s - 976.14s | Here is the method. 976.14s - 982.14s | We send a request that makes the R0 register to hold the libshare command payload. 982.14s - 987.14s | Then, we set an arbitrary libc system address in the fish register. 987.14s - 990.14s | Now, let's start brute-forcing. 990.14s - 992.14s | Before long, we obtained a share. 992.14s - 1001.14s | Fortunately, we got the share within 600 tries, not the expected 2 to the power of 16 tries. 1001.14s - 1003.14s | Great, we got a root share. 1003.14s - 1005.14s | But what can we do with it? 1005.14s - 1011.14s | All critical files like video, account, user password were encrypted. 1011.14s - 1018.14s | So, we found additional vulnerabilities in the device so we can take over the admin web page. 1018.14s - 1025.14s | Unfortunately, since this vulnerability has not been


chunk_id: 139_chunk_15
chunk_text:
here. As I mentioned, the R0 register holds a stack address containing the string we can manipulate. 963.14s - 967.14s | At that time, we can control the fish register. 967.14s - 974.14s | Now, we needed to reboot the binary until the fish register holds the libc system address. 974.14s - 976.14s | Here is the method. 976.14s - 982.14s | We send a request that makes the R0 register to hold the libshare command payload. 982.14s - 987.14s | Then, we set an arbitrary libc system address in the fish register. 987.14s - 990.14s | Now, let's start brute-forcing. 990.14s - 992.14s | Before long, we obtained a share. 992.14s - 1001.14s | Fortunately, we got the share within 600 tries, not the expected 2 to the power of 16 tries. 1001.14s - 1003.14s | Great, we got a root share. 1003.14s - 1005.14s | But what can we do with it? 1005.14s - 1011.14s | All critical files like video, account, user password were encrypted. 1011.14s - 1018.14s | So, we found additional vulnerabilities in the device so we can take over the admin web page. 1018.14s - 1025.14s | Unfortunately, since this vulnerability has not been patched yet, we cannot disclose it in here. 1025.14s - 1031.14s | Alright, we can now access the device management page with admin privileges. 1031.14s - 1033.14s | Now, we can do anything. 1033.14s - 1040.14s | This is the real-time video manipulating scenario created by chaining the explained vulnerabilities. 1040.14s - 1044.14s | The attacker infiltrates the MVR through RCE. 1044.14s - 1057.41s | Then, using a vulnerability we cannot disclose here, the attacker gains access to the admin web page. 1057.41s - 1068.45s | Finally, the attacker manipulates the real-time video. 1068.45s - 1072.45s | Here is the demo video of this scenario. 1072.45s - 1079.45s | When we send a payload, the MVR screen is tampered. 1079.45s - 1084.66s | Thank you. 1084.66s - 1089.66s | Next, let's discuss the missing authorization scenario for Synology. 1089.66s - 1094.66s | Synology performs a load of MVR through the surveillance station package. 1094.66s - 1098.66s | Let's look at the authorization code of this package's API handler. 1098.66s - 1105.66s | First, it verifies if the user sending the request is logged in through the isAuthorized function. 1105.66s - 1111.66s | Then, it checks if the user has permission


chunk_id: 139_chunk_16
chunk_text:
patched yet, we cannot disclose it in here. 1025.14s - 1031.14s | Alright, we can now access the device management page with admin privileges. 1031.14s - 1033.14s | Now, we can do anything. 1033.14s - 1040.14s | This is the real-time video manipulating scenario created by chaining the explained vulnerabilities. 1040.14s - 1044.14s | The attacker infiltrates the MVR through RCE. 1044.14s - 1057.41s | Then, using a vulnerability we cannot disclose here, the attacker gains access to the admin web page. 1057.41s - 1068.45s | Finally, the attacker manipulates the real-time video. 1068.45s - 1072.45s | Here is the demo video of this scenario. 1072.45s - 1079.45s | When we send a payload, the MVR screen is tampered. 1079.45s - 1084.66s | Thank you. 1084.66s - 1089.66s | Next, let's discuss the missing authorization scenario for Synology. 1089.66s - 1094.66s | Synology performs a load of MVR through the surveillance station package. 1094.66s - 1098.66s | Let's look at the authorization code of this package's API handler. 1098.66s - 1105.66s | First, it verifies if the user sending the request is logged in through the isAuthorized function. 1105.66s - 1111.66s | Then, it checks if the user has permission to use the surveillance station package. 1111.66s - 1113.66s | Doesn't it seem like something is missing? 1113.66s - 1122.66s | It doesn't check if the user has necessary permissions to use specific features, whether the user is an admin or a guest. 1122.66s - 1130.66s | So, we found that even with guest permissions, one could abuse all features of the Synology surveillance station. 1130.66s - 1137.66s | We discovered that surveillance station features include reboot, shutdown, and package installation. 1137.66s - 1141.66s | Additionally, we found something unusual. 1141.66s - 1147.66s | Some requests usable in surveillance station are forwarded to the NAS's core package. 1147.66s - 1156.66s | Regardless of how the requesters identify, these requests are forwarded to the core package as admin, 1156.66s - 1163.66s | allowing a guest using surveillance station to request to the Synology NAS with admin privileges. 1163.66s - 1170.66s | We received a CVE with CVESS score 9.9 from Synology. 1170.66s - 1175.66s | Next, let's look at the scenario of hijacking real-time video. 1175.66s - 1182.66s | In a normal flow, guests do not have access to the camera, so they cannot view video on the front end. 1182.66s


chunk_id: 139_chunk_17
chunk_text:
to use the surveillance station package. 1111.66s - 1113.66s | Doesn't it seem like something is missing? 1113.66s - 1122.66s | It doesn't check if the user has necessary permissions to use specific features, whether the user is an admin or a guest. 1122.66s - 1130.66s | So, we found that even with guest permissions, one could abuse all features of the Synology surveillance station. 1130.66s - 1137.66s | We discovered that surveillance station features include reboot, shutdown, and package installation. 1137.66s - 1141.66s | Additionally, we found something unusual. 1141.66s - 1147.66s | Some requests usable in surveillance station are forwarded to the NAS's core package. 1147.66s - 1156.66s | Regardless of how the requesters identify, these requests are forwarded to the core package as admin, 1156.66s - 1163.66s | allowing a guest using surveillance station to request to the Synology NAS with admin privileges. 1163.66s - 1170.66s | We received a CVE with CVESS score 9.9 from Synology. 1170.66s - 1175.66s | Next, let's look at the scenario of hijacking real-time video. 1175.66s - 1182.66s | In a normal flow, guests do not have access to the camera, so they cannot view video on the front end. 1182.66s - 1188.66s | However, due to the vulnerability, even guests can obtain video information. 1188.66s - 1199.66s | Synology returns the RTSP server address and access credentials in the response, granting attackers unlimited access to the videos. 1199.66s - 1204.66s | Let's look at the scenario. Here, we included a request to terminate the layout. 1204.66s - 1207.66s | The attacker sends a request to terminate the layout, 1207.66s - 1218.82s | disconnecting all live video layouts connected to Synology on all computers. 1218.82s - 1224.82s | Then, the attacker sends getLiveViewPath request to steal the video information, 1224.82s - 1234.50s | and requests the video from the RTSP server using the stolen information. 1234.50s - 1242.31s | Now, the attacker has hijacked the real-time video. 1242.31s - 1247.38s | Here is the demo. 1247.38s - 1250.38s | When we send the payload, 1250.38s - 1257.38s | and boom, the layout is terminated and we can watch the live video. 1257.38s - 1259.70s | Thank you. 1259.70s - 1275.80s | Next, we will introduce the vulnerabilities and scenarios of DAWA. 1275.80s - 1281.80s | The first vulnerability is called reachable assertion, and we will explain how we found it. 1281.80s


chunk_id: 139_chunk_18
chunk_text:
- 1188.66s | However, due to the vulnerability, even guests can obtain video information. 1188.66s - 1199.66s | Synology returns the RTSP server address and access credentials in the response, granting attackers unlimited access to the videos. 1199.66s - 1204.66s | Let's look at the scenario. Here, we included a request to terminate the layout. 1204.66s - 1207.66s | The attacker sends a request to terminate the layout, 1207.66s - 1218.82s | disconnecting all live video layouts connected to Synology on all computers. 1218.82s - 1224.82s | Then, the attacker sends getLiveViewPath request to steal the video information, 1224.82s - 1234.50s | and requests the video from the RTSP server using the stolen information. 1234.50s - 1242.31s | Now, the attacker has hijacked the real-time video. 1242.31s - 1247.38s | Here is the demo. 1247.38s - 1250.38s | When we send the payload, 1250.38s - 1257.38s | and boom, the layout is terminated and we can watch the live video. 1257.38s - 1259.70s | Thank you. 1259.70s - 1275.80s | Next, we will introduce the vulnerabilities and scenarios of DAWA. 1275.80s - 1281.80s | The first vulnerability is called reachable assertion, and we will explain how we found it. 1281.80s - 1286.80s | While analyzing the login function, we discovered that there are many login options. 1286.80s - 1292.80s | As shown in the table below, there are six types of assert time and password type pairs. 1292.80s - 1296.80s | By default, the assert type and password type are set to default. 1297.80s - 1304.80s | The data sent in the request includes the username, hashed password, session, assert type, and password type. 1304.80s - 1310.80s | If the request is successful, a response containing true is received. 1310.80s - 1317.80s | We are curious about what will happen when attempting to log in with different authentication types 1317.80s - 1321.80s | will lead us to unable to analyze the login options. 1321.80s - 1327.80s | During the analysis, we found a developer's mistake in the processing of the login request data 1327.80s - 1332.80s | and were able to shut down the device with a reachable assertion as a result. 1332.80s - 1335.80s | Now, let me explain the vulnerability. 1335.80s - 1342.80s | First, before processing the login logic, the function's getPasswordType and its password value are called. 1342.80s - 1347.80s | The getPasswordType function extracts assert


chunk_id: 139_chunk_19
chunk_text:
- 1286.80s | While analyzing the login function, we discovered that there are many login options. 1286.80s - 1292.80s | As shown in the table below, there are six types of assert time and password type pairs. 1292.80s - 1296.80s | By default, the assert type and password type are set to default. 1297.80s - 1304.80s | The data sent in the request includes the username, hashed password, session, assert type, and password type. 1304.80s - 1310.80s | If the request is successful, a response containing true is received. 1310.80s - 1317.80s | We are curious about what will happen when attempting to log in with different authentication types 1317.80s - 1321.80s | will lead us to unable to analyze the login options. 1321.80s - 1327.80s | During the analysis, we found a developer's mistake in the processing of the login request data 1327.80s - 1332.80s | and were able to shut down the device with a reachable assertion as a result. 1332.80s - 1335.80s | Now, let me explain the vulnerability. 1335.80s - 1342.80s | First, before processing the login logic, the function's getPasswordType and its password value are called. 1342.80s - 1347.80s | The getPasswordType function extracts assert type and password type by parsing 1347.80s - 1352.80s | and compares specific strings such as default and default, respectively. 1352.80s - 1357.80s | If the strings match, the function returns a type for their own. 1357.80s - 1364.80s | If the type is both default, it returns 4, and if it is OTP and SSC, it returns 7. 1364.80s - 1370.80s | The next function is called isPasswordValid and parses the login parameters 1370.80s - 1375.80s | based on the type value returned by the previous function getPasswordType 1375.80s - 1377.80s | and creates a string object. 1377.80s - 1383.80s | The series of process enters when assert type and password type are set to default. 1383.80s - 1390.80s | You can see that there is an exception handling logic that checks to see if those parameters are null 1390.80s - 1394.80s | before generating a string object for both parameters. 1394.80s - 1400.80s | Most of the branches have this null exception handling logic, but not all of them. 1401.80s - 1407.80s | The following code handles the case when the authentication type is OTP and WSSC. 1407.80s - 1414.80s | As seen in the code below, string


chunk_id: 139_chunk_20
chunk_text:
type and password type by parsing 1347.80s - 1352.80s | and compares specific strings such as default and default, respectively. 1352.80s - 1357.80s | If the strings match, the function returns a type for their own. 1357.80s - 1364.80s | If the type is both default, it returns 4, and if it is OTP and SSC, it returns 7. 1364.80s - 1370.80s | The next function is called isPasswordValid and parses the login parameters 1370.80s - 1375.80s | based on the type value returned by the previous function getPasswordType 1375.80s - 1377.80s | and creates a string object. 1377.80s - 1383.80s | The series of process enters when assert type and password type are set to default. 1383.80s - 1390.80s | You can see that there is an exception handling logic that checks to see if those parameters are null 1390.80s - 1394.80s | before generating a string object for both parameters. 1394.80s - 1400.80s | Most of the branches have this null exception handling logic, but not all of them. 1401.80s - 1407.80s | The following code handles the case when the authentication type is OTP and WSSC. 1407.80s - 1414.80s | As seen in the code below, string objects for authority input and password type variables are created, 1414.80s - 1419.80s | but there is no exception handling logic for these objects. 1419.80s - 1427.80s | So, we remove the authority input parameter, set the authentication type to OTP, WSSC, and send a request. 1427.80s - 1433.80s | As a result, the authority input is set to null, which causes a retrieval assertion to be drawn 1433.80s - 1439.80s | when creating a string object for that parameter, causing the main binary to exit. 1439.80s - 1444.80s | When the main binary terminates, the watchdog causes the device to reboot. 1444.80s - 1447.80s | This is a pretty simple vulnerability. 1447.80s - 1453.80s | The following vulnerabilities are very important because they require the device to reboot. 1454.80s - 1458.80s | The second vulnerability is LP injection. 1458.80s - 1462.80s | First, that will set permissions by group, and once creating an account, 1462.80s - 1468.80s | it can only perform tasks included in the permissions of the assigned group. 1468.80s - 1475.80s | This group information is stored in a file named groupsec and is encrypted using ASCBC. 1475.80s - 1479.80s | We tried analyzing the source


chunk_id: 139_chunk_21
chunk_text:
objects for authority input and password type variables are created, 1414.80s - 1419.80s | but there is no exception handling logic for these objects. 1419.80s - 1427.80s | So, we remove the authority input parameter, set the authentication type to OTP, WSSC, and send a request. 1427.80s - 1433.80s | As a result, the authority input is set to null, which causes a retrieval assertion to be drawn 1433.80s - 1439.80s | when creating a string object for that parameter, causing the main binary to exit. 1439.80s - 1444.80s | When the main binary terminates, the watchdog causes the device to reboot. 1444.80s - 1447.80s | This is a pretty simple vulnerability. 1447.80s - 1453.80s | The following vulnerabilities are very important because they require the device to reboot. 1454.80s - 1458.80s | The second vulnerability is LP injection. 1458.80s - 1462.80s | First, that will set permissions by group, and once creating an account, 1462.80s - 1468.80s | it can only perform tasks included in the permissions of the assigned group. 1468.80s - 1475.80s | This group information is stored in a file named groupsec and is encrypted using ASCBC. 1475.80s - 1479.80s | We tried analyzing the source code to find the key in IV, 1479.80s - 1484.80s | but it was quite complicated and eventually failed to find it. 1484.80s - 1490.80s | However, since the configuration information must be decrypted and loaded into memory 1490.80s - 1496.80s | during the main binary boot process, so we performed a dynamic analysis of the boot process, 1496.80s - 1502.37s | and unfortunately, we were able to find the decrypted data. 1502.37s - 1506.37s | The structure of the decrypted groupsec file is as follows. 1506.37s - 1510.37s | The columns are ID, name, authority, and memo. 1510.37s - 1517.37s | Each column is separated by a column, and each line is separated by a line feed. 1517.37s - 1522.37s | When adding or modifying group information, the getline function is called 1522.37s - 1526.37s | as part of the process of saving the changed data. 1526.37s - 1531.37s | This function generates a line with the ID, name, authority, and memo, 1531.37s - 1535.37s | extracted from the logon request separated by columns. 1535.37s - 1540.37s | We found out that there was no validation checking procedure of the input value 1540.37s - 1544.37s | until generating a


chunk_id: 139_chunk_22
chunk_text:
code to find the key in IV, 1479.80s - 1484.80s | but it was quite complicated and eventually failed to find it. 1484.80s - 1490.80s | However, since the configuration information must be decrypted and loaded into memory 1490.80s - 1496.80s | during the main binary boot process, so we performed a dynamic analysis of the boot process, 1496.80s - 1502.37s | and unfortunately, we were able to find the decrypted data. 1502.37s - 1506.37s | The structure of the decrypted groupsec file is as follows. 1506.37s - 1510.37s | The columns are ID, name, authority, and memo. 1510.37s - 1517.37s | Each column is separated by a column, and each line is separated by a line feed. 1517.37s - 1522.37s | When adding or modifying group information, the getline function is called 1522.37s - 1526.37s | as part of the process of saving the changed data. 1526.37s - 1531.37s | This function generates a line with the ID, name, authority, and memo, 1531.37s - 1535.37s | extracted from the logon request separated by columns. 1535.37s - 1540.37s | We found out that there was no validation checking procedure of the input value 1540.37s - 1544.37s | until generating a line with the getline function. 1544.37s - 1551.90s | So, we added a line feed to the memo to tamper the structure and restarted the device 1551.90s - 1556.90s | to see what would happen during the parsing process of the groupsec file. 1556.90s - 1561.90s | As a result, the device entered the initialization routine 1561.90s - 1564.90s | and recreated the groupsec file. 1564.90s - 1569.90s | When entering the initialization routine, the user can change the add-in password on the web 1569.90s - 1571.90s | and perform any actions. 1571.90s - 1577.90s | We were curious if the initialization routine would still be entered if the file was deleted. 1577.90s - 1580.90s | After deleting the file and rebooting the device, 1580.90s - 1585.90s | we found that it still enters the initialization routine. 1585.90s - 1591.90s | Let me introduce the first scenario of DAWA using two vulnerabilities mentioned above. 1591.90s - 1594.90s | By using Retrieval Assertion and Alpha Injection, 1594.90s - 1599.90s | an attacker can take over the device and obtain admin privileges. 1599.90s - 1606.90s | First, the attacker obtains an account with UsUserManagedPrivileges through credential stuffing. 1606.90s - 1611.90s | Next,


chunk_id: 139_chunk_23
chunk_text:
line with the getline function. 1544.37s - 1551.90s | So, we added a line feed to the memo to tamper the structure and restarted the device 1551.90s - 1556.90s | to see what would happen during the parsing process of the groupsec file. 1556.90s - 1561.90s | As a result, the device entered the initialization routine 1561.90s - 1564.90s | and recreated the groupsec file. 1564.90s - 1569.90s | When entering the initialization routine, the user can change the add-in password on the web 1569.90s - 1571.90s | and perform any actions. 1571.90s - 1577.90s | We were curious if the initialization routine would still be entered if the file was deleted. 1577.90s - 1580.90s | After deleting the file and rebooting the device, 1580.90s - 1585.90s | we found that it still enters the initialization routine. 1585.90s - 1591.90s | Let me introduce the first scenario of DAWA using two vulnerabilities mentioned above. 1591.90s - 1594.90s | By using Retrieval Assertion and Alpha Injection, 1594.90s - 1599.90s | an attacker can take over the device and obtain admin privileges. 1599.90s - 1606.90s | First, the attacker obtains an account with UsUserManagedPrivileges through credential stuffing. 1606.90s - 1611.90s | Next, the structure of the groupsec file is tampered through Alpha Injection. 1611.90s - 1618.88s | Then, the attacker reboots the device using Retrieval Assertion. 1618.88s - 1627.65s | When rebooted, the device enters the initialization routine, 1627.65s - 1633.65s | allowing the attacker to change the admin password and perform malicious activities. 1633.65s - 1641.99s | Next is Stack Overflow. 1641.99s - 1648.99s | First, this vulnerability occurs not in the main binary but in a background service called AOL. 1648.99s - 1653.99s | This service is used to attempt online recovery when the device is abnormal 1653.99s - 1656.99s | and is open on port 8088. 1656.99s - 1661.99s | Since this port is not forwarded, it can only be accessed from the same network. 1661.99s - 1666.99s | It consists of 16 bytes of fixed size of headers and data. 1666.99s - 1672.99s | For header, the constitutional data byte index 0 indicates the function index 1672.99s - 1676.99s | and the byte chat indexes 4 to 7 indicate the data size. 1676.99s - 1682.99s | The data is then used as an argument for the input handler remitted by the data size. 1682.99s - 1687.99s | However,


chunk_id: 139_chunk_24
chunk_text:
the structure of the groupsec file is tampered through Alpha Injection. 1611.90s - 1618.88s | Then, the attacker reboots the device using Retrieval Assertion. 1618.88s - 1627.65s | When rebooted, the device enters the initialization routine, 1627.65s - 1633.65s | allowing the attacker to change the admin password and perform malicious activities. 1633.65s - 1641.99s | Next is Stack Overflow. 1641.99s - 1648.99s | First, this vulnerability occurs not in the main binary but in a background service called AOL. 1648.99s - 1653.99s | This service is used to attempt online recovery when the device is abnormal 1653.99s - 1656.99s | and is open on port 8088. 1656.99s - 1661.99s | Since this port is not forwarded, it can only be accessed from the same network. 1661.99s - 1666.99s | It consists of 16 bytes of fixed size of headers and data. 1666.99s - 1672.99s | For header, the constitutional data byte index 0 indicates the function index 1672.99s - 1676.99s | and the byte chat indexes 4 to 7 indicate the data size. 1676.99s - 1682.99s | The data is then used as an argument for the input handler remitted by the data size. 1682.99s - 1687.99s | However, the pinpoint is that the data size can be publicated. 1687.99s - 1691.99s | Now, let me explain the request processing procedure. 1691.99s - 1698.06s | The following function is called PerMessage. 1698.06s - 1704.06s | First, this function uses the structure with the way which consists of functions 1704.06s - 1708.06s | and variables related to each feature. 1708.06s - 1711.06s | As shown in the table on the left, 1712.06s - 1717.06s | each structure includes the permission level index verification function, 1717.06s - 1720.06s | parameter parsing function, handler function, 1720.06s - 1724.06s | parameter allocation free function, and next table pointer. 1724.06s - 1727.06s | There are about 20 such tables. 1727.06s - 1730.06s | Here is how it works internally. 1730.06s - 1736.06s | The function iterates through a loop calling the index verification function of each structure 1736.06s - 1740.06s | with the first byte of the header as an argument. 1740.06s - 1744.06s | The index verification function, as seen in the code on the bottom right, 1744.06s - 1751.06s | checks if the value obtained by subtracting a specific constant number from the argument is not 0. 1751.06s - 1754.06s | If


chunk_id: 139_chunk_25
chunk_text:
the pinpoint is that the data size can be publicated. 1687.99s - 1691.99s | Now, let me explain the request processing procedure. 1691.99s - 1698.06s | The following function is called PerMessage. 1698.06s - 1704.06s | First, this function uses the structure with the way which consists of functions 1704.06s - 1708.06s | and variables related to each feature. 1708.06s - 1711.06s | As shown in the table on the left, 1712.06s - 1717.06s | each structure includes the permission level index verification function, 1717.06s - 1720.06s | parameter parsing function, handler function, 1720.06s - 1724.06s | parameter allocation free function, and next table pointer. 1724.06s - 1727.06s | There are about 20 such tables. 1727.06s - 1730.06s | Here is how it works internally. 1730.06s - 1736.06s | The function iterates through a loop calling the index verification function of each structure 1736.06s - 1740.06s | with the first byte of the header as an argument. 1740.06s - 1744.06s | The index verification function, as seen in the code on the bottom right, 1744.06s - 1751.06s | checks if the value obtained by subtracting a specific constant number from the argument is not 0. 1751.06s - 1754.06s | If the result is 0, it returns 0. 1754.06s - 1757.06s | Otherwise, it returns minus 1. 1757.06s - 1759.06s | Referring back to the code on the left, 1759.06s - 1764.06s | if the return value is greater than 0 or meaning a matching index is found, 1764.06s - 1769.06s | the current table pointer is told in the A to variable and 0 is returned. 1769.06s - 1776.06s | If the matching index is found, minus 1 is returned and the request is not processed. 1776.06s - 1780.76s | Next, the dpStackParse function is called. 1780.76s - 1786.76s | This function retrieves the table corresponding to the index and calls the parseParam function. 1786.76s - 1789.76s | As shown in the parseParam function on the right, 1789.76s - 1796.76s | it appropriately processes the data according to the requested function and then returns the result. 1796.76s - 1800.76s | Finally, once all preprocessing steps are complete, 1800.76s - 1806.76s | the dpHandleQuery function is called to register the input handler and then execute it. 1806.76s - 1811.14s | There are many different functions that could be called, 1811.14s - 1816.14s | including login, query, and update, but they all


chunk_id: 139_chunk_26
chunk_text:
the result is 0, it returns 0. 1754.06s - 1757.06s | Otherwise, it returns minus 1. 1757.06s - 1759.06s | Referring back to the code on the left, 1759.06s - 1764.06s | if the return value is greater than 0 or meaning a matching index is found, 1764.06s - 1769.06s | the current table pointer is told in the A to variable and 0 is returned. 1769.06s - 1776.06s | If the matching index is found, minus 1 is returned and the request is not processed. 1776.06s - 1780.76s | Next, the dpStackParse function is called. 1780.76s - 1786.76s | This function retrieves the table corresponding to the index and calls the parseParam function. 1786.76s - 1789.76s | As shown in the parseParam function on the right, 1789.76s - 1796.76s | it appropriately processes the data according to the requested function and then returns the result. 1796.76s - 1800.76s | Finally, once all preprocessing steps are complete, 1800.76s - 1806.76s | the dpHandleQuery function is called to register the input handler and then execute it. 1806.76s - 1811.14s | There are many different functions that could be called, 1811.14s - 1816.14s | including login, query, and update, but they all require the login. 1816.14s - 1820.14s | So, we started analyzing the login function first. 1820.14s - 1825.42s | The function is executed if the first byte is A0. 1825.42s - 1832.42s | The data consists of username, password, and a random value with a double ampersand used as a delimiter. 1832.42s - 1838.42s | The vulnerability occurs when parsing this data, which we'll explain in a moment. 1838.42s - 1841.66s | As you can see in the code on the right, 1841.66s - 1849.66s | the strings for the username and password are set to 128 and 160 bytes respectively, 1849.66s - 1853.66s | and the memory is initialized with a memset. 1853.66s - 1860.66s | Next, the addStringString function is called to find the positions of the double ampersands and null. 1860.66s - 1864.66s | The data before the first double ampersand is copied to username, 1864.66s - 1869.66s | and the data before the next double ampersand is copied to password. 1869.66s - 1874.66s | The problem is that there is no length validation checking during the copying process, 1874.66s - 1877.66s | allowing us to input data of any size. 1877.66s - 1881.66s | As a


chunk_id: 139_chunk_27
chunk_text:
require the login. 1816.14s - 1820.14s | So, we started analyzing the login function first. 1820.14s - 1825.42s | The function is executed if the first byte is A0. 1825.42s - 1832.42s | The data consists of username, password, and a random value with a double ampersand used as a delimiter. 1832.42s - 1838.42s | The vulnerability occurs when parsing this data, which we'll explain in a moment. 1838.42s - 1841.66s | As you can see in the code on the right, 1841.66s - 1849.66s | the strings for the username and password are set to 128 and 160 bytes respectively, 1849.66s - 1853.66s | and the memory is initialized with a memset. 1853.66s - 1860.66s | Next, the addStringString function is called to find the positions of the double ampersands and null. 1860.66s - 1864.66s | The data before the first double ampersand is copied to username, 1864.66s - 1869.66s | and the data before the next double ampersand is copied to password. 1869.66s - 1874.66s | The problem is that there is no length validation checking during the copying process, 1874.66s - 1877.66s | allowing us to input data of any size. 1877.66s - 1881.66s | As a result, a buffer overflow occurs. 1882.66s - 1887.66s | You can cover the return address by putting 156 bytes of random data, 1887.66s - 1893.98s | the desired value, and the password location, as shown below. 1893.98s - 1898.98s | Since there was no stack canary, we couldn't manipulate the PC register. 1898.98s - 1903.98s | However, we encountered an issue where we couldn't include a null in the payload, 1903.98s - 1905.98s | making our pain possible. 1905.98s - 1909.98s | We didn't want to conclude with just a simple buffer overflow, 1909.98s - 1913.98s | so we began analyzing the source code. 1913.98s - 1916.98s | Fortunately, we found some useful functions. 1916.98s - 1921.98s | There were functions for rebooting, starting SSH, removing intersettings, 1921.98s - 1925.98s | performing a soft recovery, and killing all MBR-related binaries. 1925.98s - 1929.98s | Among these, the most interesting function was the soft recovery. 1929.98s - 1935.98s | This function deletes the configure directory, resetting all configuration information. 1936.98s - 1941.98s | As seen in the previous vulnerability, if the groupseq file is deleted or tampered, 1941.98s - 1944.98s | the initialization routine is entered upon reboot, 1944.98s - 1948.98s


chunk_id: 139_chunk_28
chunk_text:
result, a buffer overflow occurs. 1882.66s - 1887.66s | You can cover the return address by putting 156 bytes of random data, 1887.66s - 1893.98s | the desired value, and the password location, as shown below. 1893.98s - 1898.98s | Since there was no stack canary, we couldn't manipulate the PC register. 1898.98s - 1903.98s | However, we encountered an issue where we couldn't include a null in the payload, 1903.98s - 1905.98s | making our pain possible. 1905.98s - 1909.98s | We didn't want to conclude with just a simple buffer overflow, 1909.98s - 1913.98s | so we began analyzing the source code. 1913.98s - 1916.98s | Fortunately, we found some useful functions. 1916.98s - 1921.98s | There were functions for rebooting, starting SSH, removing intersettings, 1921.98s - 1925.98s | performing a soft recovery, and killing all MBR-related binaries. 1925.98s - 1929.98s | Among these, the most interesting function was the soft recovery. 1929.98s - 1935.98s | This function deletes the configure directory, resetting all configuration information. 1936.98s - 1941.98s | As seen in the previous vulnerability, if the groupseq file is deleted or tampered, 1941.98s - 1944.98s | the initialization routine is entered upon reboot, 1944.98s - 1948.98s | allowing the admin password to be changed. 1948.98s - 1953.98s | Therefore, we manipulated the PC register to call the soft recovery function. 1953.98s - 1957.98s | However, soft recovery deleted even the network files, 1957.98s - 1960.98s | making external access impossible. 1960.98s - 1965.22s | Unfortunately, we faced another challenge. 1965.22s - 1968.22s | After several days of analysis and contemplation, 1968.22s - 1972.22s | it soon came to my head that during the boot, 1972.22s - 1977.22s | there is a process where configuration files in the configure directory 1977.22s - 1980.22s | are decrypted and loaded into memory. 1980.22s - 1983.22s | So, we began analyzing the boot loads. 1983.22s - 1988.22s | As a result, we found that the network configuration file is loaded first, 1988.22s - 1993.22s | and then the account file is loaded around 5 seconds later. 1994.22s - 2000.22s | I was curious to see what would happen if the main binary center soft recovery failed 2000.22s - 2004.22s | within 5 seconds of loading the network configuration file. 2004.22s - 2010.22s | The most fortunate point is that AOR is loaded before the main binary boots. 2010.22s - 2017.22s


chunk_id: 139_chunk_29
chunk_text:
| allowing the admin password to be changed. 1948.98s - 1953.98s | Therefore, we manipulated the PC register to call the soft recovery function. 1953.98s - 1957.98s | However, soft recovery deleted even the network files, 1957.98s - 1960.98s | making external access impossible. 1960.98s - 1965.22s | Unfortunately, we faced another challenge. 1965.22s - 1968.22s | After several days of analysis and contemplation, 1968.22s - 1972.22s | it soon came to my head that during the boot, 1972.22s - 1977.22s | there is a process where configuration files in the configure directory 1977.22s - 1980.22s | are decrypted and loaded into memory. 1980.22s - 1983.22s | So, we began analyzing the boot loads. 1983.22s - 1988.22s | As a result, we found that the network configuration file is loaded first, 1988.22s - 1993.22s | and then the account file is loaded around 5 seconds later. 1994.22s - 2000.22s | I was curious to see what would happen if the main binary center soft recovery failed 2000.22s - 2004.22s | within 5 seconds of loading the network configuration file. 2004.22s - 2010.22s | The most fortunate point is that AOR is loaded before the main binary boots. 2010.22s - 2017.22s | First, we kill the main binary using the recover assertion, causing the device to reboot. 2017.22s - 2021.22s | Then, we wait until the network configuration file is loaded. 2021.22s - 2026.22s | In our case, it took approximately 10 seconds for the device. 2026.22s - 2033.22s | Next, we send the soft recovery failure to AOR, which deletes all configuration files. 2033.22s - 2038.22s | Then, the main binary can't access the account configuration file 2038.22s - 2041.22s | and enters the initialization routine. 2041.22s - 2045.22s | As a result, we are able to change the admin account. 2046.22s - 2052.22s | Let me explain the admin takeover vulnerability using recover assertion and stack buffer overflow. 2052.22s - 2056.22s | First, we will reboot the device via recover assertion. 2056.22s - 2063.27s | After rebooting, wait for the network configuration file to be loaded, 2063.27s - 2072.03s | and then send the soft recovery failure to AOR to remove all configuration files. 2072.03s - 2079.26s | In the process of loading account setting files such as groupsec, 2079.26s - 2084.26s | it enters an initialization routine because the files do not exist. 2084.26s - 2091.74s | The


chunk_id: 139_chunk_30
chunk_text:
| First, we kill the main binary using the recover assertion, causing the device to reboot. 2017.22s - 2021.22s | Then, we wait until the network configuration file is loaded. 2021.22s - 2026.22s | In our case, it took approximately 10 seconds for the device. 2026.22s - 2033.22s | Next, we send the soft recovery failure to AOR, which deletes all configuration files. 2033.22s - 2038.22s | Then, the main binary can't access the account configuration file 2038.22s - 2041.22s | and enters the initialization routine. 2041.22s - 2045.22s | As a result, we are able to change the admin account. 2046.22s - 2052.22s | Let me explain the admin takeover vulnerability using recover assertion and stack buffer overflow. 2052.22s - 2056.22s | First, we will reboot the device via recover assertion. 2056.22s - 2063.27s | After rebooting, wait for the network configuration file to be loaded, 2063.27s - 2072.03s | and then send the soft recovery failure to AOR to remove all configuration files. 2072.03s - 2079.26s | In the process of loading account setting files such as groupsec, 2079.26s - 2084.26s | it enters an initialization routine because the files do not exist. 2084.26s - 2091.74s | The attacker changes the admin password and gains access to the admin page. 2091.74s - 2093.74s | This is a demo. 2093.74s - 2110.34s | The last vulnerability is from HikeVision. 2110.34s - 2116.34s | HikeVision was much more solid compared to other devices, making it more challenging. 2116.34s - 2121.34s | However, we found an interesting vector, a local subs component. 2121.34s - 2126.34s | That is a plugin that must be installed for users to view video from the web. 2126.34s - 2134.34s | This plugin runs with admin privileges on Windows and is accessible on port 33686, 2134.34s - 2137.34s | meaning anyone on the same network can access it. 2137.34s - 2144.34s | It was a very interesting plugin, so we started analyzing it and found the vulnerability. 2144.34s - 2151.34s | Due to an ending associated with a bounty for this vendor, we can't disclose detailed root cause. 2151.34s - 2157.34s | In short, it is a vulnerability that allows RCE by sending a crafted message. 2157.34s - 2160.34s | Instead, we will show you a demo. 2160.34s - 2164.34s | Through RCE, we can completely take control of Windows. 2164.34s - 2168.34s | With admin


chunk_id: 139_chunk_31
chunk_text:
attacker changes the admin password and gains access to the admin page. 2091.74s - 2093.74s | This is a demo. 2093.74s - 2110.34s | The last vulnerability is from HikeVision. 2110.34s - 2116.34s | HikeVision was much more solid compared to other devices, making it more challenging. 2116.34s - 2121.34s | However, we found an interesting vector, a local subs component. 2121.34s - 2126.34s | That is a plugin that must be installed for users to view video from the web. 2126.34s - 2134.34s | This plugin runs with admin privileges on Windows and is accessible on port 33686, 2134.34s - 2137.34s | meaning anyone on the same network can access it. 2137.34s - 2144.34s | It was a very interesting plugin, so we started analyzing it and found the vulnerability. 2144.34s - 2151.34s | Due to an ending associated with a bounty for this vendor, we can't disclose detailed root cause. 2151.34s - 2157.34s | In short, it is a vulnerability that allows RCE by sending a crafted message. 2157.34s - 2160.34s | Instead, we will show you a demo. 2160.34s - 2164.34s | Through RCE, we can completely take control of Windows. 2164.34s - 2168.34s | With admin privileges, we can perform any actions. 2168.34s - 2179.18s | The next vulnerability is OS command injection, 2179.18s - 2185.18s | which allows a user with admin privileges to execute arbitrary commands. 2185.18s - 2192.18s | We create a scenario to take control of the internal network using these two vulnerabilities. 2192.18s - 2197.18s | First, we obtain admin privileges through credential stuffing. 2197.18s - 2203.81s | Next, we offer a reversal through command injection to enter the MVR. 2203.81s - 2214.50s | Then, we perform network scanning to find Windows computers using the application named local subs component. 2214.50s - 2221.50s | Finally, by exploiting the plugin RCE, we could take control of Windows and perform malicious activities. 2221.50s - 2225.14s | Here is the demo. 2225.14s - 2236.91s | By just pressing the button, we can automatically take control of Windows computer in the... 2253.07s - 2260.07s | One of the things we learned during the project is the Hikvision and our Huzy OEM supplier. 2260.07s - 2270.07s | Both companies also sell under their own brands, but they are relabeled and sell to various retailers in the U.S. such as Lorex and Luma. 2270.07s - 2277.07s |


chunk_id: 139_chunk_32
chunk_text:
privileges, we can perform any actions. 2168.34s - 2179.18s | The next vulnerability is OS command injection, 2179.18s - 2185.18s | which allows a user with admin privileges to execute arbitrary commands. 2185.18s - 2192.18s | We create a scenario to take control of the internal network using these two vulnerabilities. 2192.18s - 2197.18s | First, we obtain admin privileges through credential stuffing. 2197.18s - 2203.81s | Next, we offer a reversal through command injection to enter the MVR. 2203.81s - 2214.50s | Then, we perform network scanning to find Windows computers using the application named local subs component. 2214.50s - 2221.50s | Finally, by exploiting the plugin RCE, we could take control of Windows and perform malicious activities. 2221.50s - 2225.14s | Here is the demo. 2225.14s - 2236.91s | By just pressing the button, we can automatically take control of Windows computer in the... 2253.07s - 2260.07s | One of the things we learned during the project is the Hikvision and our Huzy OEM supplier. 2260.07s - 2270.07s | Both companies also sell under their own brands, but they are relabeled and sell to various retailers in the U.S. such as Lorex and Luma. 2270.07s - 2277.07s | This means that devices are being used all around us without realizing that they are made in China. 2277.07s - 2282.07s | First, OEM stands for Original Equipment Manufacturer. 2282.07s - 2292.07s | It refers to the manufacturing method in which a company outsources the production of its products to another company and then sells them under its own brand. 2292.07s - 2299.07s | If a product is made by Company A, it's sold under the brand name of Company B. 2299.07s - 2304.07s | Company A becomes the OEM supplier and Company B becomes the OEM vendor. 2304.07s - 2308.07s | The images below show Dallas MVR and OEM MVR. 2308.07s - 2311.07s | They look very similar, don't they? 2312.07s - 2315.07s | This picture illustrates the OEM sales process. 2315.07s - 2324.07s | Products manufactured by OEM suppliers like Hikvision and Dahua are relabeled by OEM vendors and sold to users. 2324.07s - 2335.07s | If a vulnerability occurs in a product produced by an OEM supplier, it can affect the products sold by the OEM vendor as well. 2335.07s - 2340.07s | This means that many devices can be impacted by the same vulnerability. 2340.07s -


chunk_id: 139_chunk_33
chunk_text:
This means that devices are being used all around us without realizing that they are made in China. 2277.07s - 2282.07s | First, OEM stands for Original Equipment Manufacturer. 2282.07s - 2292.07s | It refers to the manufacturing method in which a company outsources the production of its products to another company and then sells them under its own brand. 2292.07s - 2299.07s | If a product is made by Company A, it's sold under the brand name of Company B. 2299.07s - 2304.07s | Company A becomes the OEM supplier and Company B becomes the OEM vendor. 2304.07s - 2308.07s | The images below show Dallas MVR and OEM MVR. 2308.07s - 2311.07s | They look very similar, don't they? 2312.07s - 2315.07s | This picture illustrates the OEM sales process. 2315.07s - 2324.07s | Products manufactured by OEM suppliers like Hikvision and Dahua are relabeled by OEM vendors and sold to users. 2324.07s - 2335.07s | If a vulnerability occurs in a product produced by an OEM supplier, it can affect the products sold by the OEM vendor as well. 2335.07s - 2340.07s | This means that many devices can be impacted by the same vulnerability. 2340.07s - 2347.07s | So, we decided to check if the vulnerabilities were valid for OEMs using the same firmware. 2347.07s - 2355.07s | First, we ran bin-deep on the main binaries of Dahua and OEM vendor Bush and found that the logic was similar. 2355.07s - 2360.07s | Hikvision also confirmed similar through deeping. 2360.07s - 2368.07s | After confirming that OEM vendors use similar firmware, we decided to purchase devices and test them. 2368.07s - 2375.07s | For Hikvision, we purchased Anki and Ampibis. 4 out of 6 vulnerabilities were valid. 2375.07s - 2382.07s | For Dahua, we purchased Zhiyun and EGPS. 4 out of 6 of the 7 vulnerabilities were valid, respectively. 2382.07s - 2391.07s | We confirmed that the vulnerabilities were validly exploited and reported them to Mitre, KISA, which is the Korean CNA, 2391.07s - 2400.07s | to get CBs and KBEs, which increased the number of recognized vulnerabilities by 61%. 2400.07s - 2406.35s | Finally, we will show you a video of vulnerability testing on OEM vendors. 2406.35s - 2410.35s | The first video is the OEM vendor testing for Dahua. 2410.35s - 2415.35s | By sending Dahua's recover assertion payload, we could shut down all


chunk_id: 139_chunk_34
chunk_text:
2347.07s | So, we decided to check if the vulnerabilities were valid for OEMs using the same firmware. 2347.07s - 2355.07s | First, we ran bin-deep on the main binaries of Dahua and OEM vendor Bush and found that the logic was similar. 2355.07s - 2360.07s | Hikvision also confirmed similar through deeping. 2360.07s - 2368.07s | After confirming that OEM vendors use similar firmware, we decided to purchase devices and test them. 2368.07s - 2375.07s | For Hikvision, we purchased Anki and Ampibis. 4 out of 6 vulnerabilities were valid. 2375.07s - 2382.07s | For Dahua, we purchased Zhiyun and EGPS. 4 out of 6 of the 7 vulnerabilities were valid, respectively. 2382.07s - 2391.07s | We confirmed that the vulnerabilities were validly exploited and reported them to Mitre, KISA, which is the Korean CNA, 2391.07s - 2400.07s | to get CBs and KBEs, which increased the number of recognized vulnerabilities by 61%. 2400.07s - 2406.35s | Finally, we will show you a video of vulnerability testing on OEM vendors. 2406.35s - 2410.35s | The first video is the OEM vendor testing for Dahua. 2410.35s - 2415.35s | By sending Dahua's recover assertion payload, we could shut down all devices. 2415.35s - 2422.26s | The second video is OEM vendor testing for Hikvision. 2422.26s - 2431.26s | After sending the voice command injection payload, we could connect a reverse shell and input the shutdown command to turn off all devices. 2431.26s - 2439.61s | Also, we were curious about how many devices were affected by the vulnerabilities we found. 2439.61s - 2442.61s | So, we searched using Shoda. 2442.61s - 2452.95s | In the case of Hikvision, most model devices' names or firmware versions were not present in the banner data. 2452.95s - 2457.95s | So, we needed a different approach to identify as many as possible. 2457.95s - 2465.95s | We found that for MBR devices, when accessing the login page, a config.json file is requested. 2465.95s - 2470.95s | This file contains the configuration information related to MBR. 2470.95s - 2481.95s | For version information, we used the web version and plug-in version coded in the C.js to search for devices with versions equal to or lower than the one we did our study. 2481.95s - 2488.95s | As a result, we found that approximately 130,000 devices were vulnerable. 2488.95s - 2494.95s | For Dahua, since the


chunk_id: 139_chunk_35
chunk_text:
devices. 2415.35s - 2422.26s | The second video is OEM vendor testing for Hikvision. 2422.26s - 2431.26s | After sending the voice command injection payload, we could connect a reverse shell and input the shutdown command to turn off all devices. 2431.26s - 2439.61s | Also, we were curious about how many devices were affected by the vulnerabilities we found. 2439.61s - 2442.61s | So, we searched using Shoda. 2442.61s - 2452.95s | In the case of Hikvision, most model devices' names or firmware versions were not present in the banner data. 2452.95s - 2457.95s | So, we needed a different approach to identify as many as possible. 2457.95s - 2465.95s | We found that for MBR devices, when accessing the login page, a config.json file is requested. 2465.95s - 2470.95s | This file contains the configuration information related to MBR. 2470.95s - 2481.95s | For version information, we used the web version and plug-in version coded in the C.js to search for devices with versions equal to or lower than the one we did our study. 2481.95s - 2488.95s | As a result, we found that approximately 130,000 devices were vulnerable. 2488.95s - 2494.95s | For Dahua, since the device name was present in the banner, we simply searched for it. 2494.95s - 2499.95s | As a result, we found approximately 100,000 devices. 2499.95s - 2503.95s | Finally, we came to the conclusion part. 2503.95s - 2509.95s | First of all, this is what we would like to comment to offensive researchers in MBR field like us. 2509.95s - 2514.95s | The vulnerabilities we discovered during our research period include. 2514.95s - 2520.95s | Even when analyzing one-day cases, we found that these vulnerabilities were statically numerous. 2520.95s - 2527.95s | So, when you want to analyze your MBR, we recommend that you focus on these vulnerabilities. 2528.95s - 2540.95s | We conducted an analysis focusing on HTTP communication process of domain binary in order to achieve good results as much as possible over the project of four months. 2540.95s - 2550.95s | However, MBRs have numerous attack surfaces, including private protocols with their cloud service, SDK communication with VMS, 2550.95s - 2558.95s | private protocols used to communicate with MBRs or IP cameras, and communication with other sensors. 2558.95s - 2568.95s | Therefore, we recommend that you do not focus solely on analyzing the HTTP process, but analyze


chunk_id: 139_chunk_36
chunk_text:
device name was present in the banner, we simply searched for it. 2494.95s - 2499.95s | As a result, we found approximately 100,000 devices. 2499.95s - 2503.95s | Finally, we came to the conclusion part. 2503.95s - 2509.95s | First of all, this is what we would like to comment to offensive researchers in MBR field like us. 2509.95s - 2514.95s | The vulnerabilities we discovered during our research period include. 2514.95s - 2520.95s | Even when analyzing one-day cases, we found that these vulnerabilities were statically numerous. 2520.95s - 2527.95s | So, when you want to analyze your MBR, we recommend that you focus on these vulnerabilities. 2528.95s - 2540.95s | We conducted an analysis focusing on HTTP communication process of domain binary in order to achieve good results as much as possible over the project of four months. 2540.95s - 2550.95s | However, MBRs have numerous attack surfaces, including private protocols with their cloud service, SDK communication with VMS, 2550.95s - 2558.95s | private protocols used to communicate with MBRs or IP cameras, and communication with other sensors. 2558.95s - 2568.95s | Therefore, we recommend that you do not focus solely on analyzing the HTTP process, but analyze various attack surfaces. 2568.95s - 2573.95s | The following is what we would like to recommend to users. 2574.95s - 2583.95s | What we felt while conducting a one-day case study is that as long as MBR is not exposed to the external network, it is safe from these attacks. 2583.95s - 2594.95s | Major MBR vendors provide solutions that allow external access using things like DDNS without exposing the device to an external network. 2594.95s - 2600.95s | You can take advantage of these solutions to keep your devices safe from these attacks. 2600.95s - 2606.80s | Thank you to people who helped us with research. 2606.80s - 2612.30s | Especially, thank you to Dr. Junsang Yoo. 2612.30s - 2614.30s | Thank you for listening to our presentation. 2614.30s - 2618.30s | If you have any questions, please contact us on Twitter below. 2618.30s - 2622.30s | More details of our research can be found via the QR code on the right. 2622.30s - 2623.30s | Thank you.


chunk_id: 139_chunk_37
chunk_text:
various attack surfaces. 2568.95s - 2573.95s | The following is what we would like to recommend to users. 2574.95s - 2583.95s | What we felt while conducting a one-day case study is that as long as MBR is not exposed to the external network, it is safe from these attacks. 2583.95s - 2594.95s | Major MBR vendors provide solutions that allow external access using things like DDNS without exposing the device to an external network. 2594.95s - 2600.95s | You can take advantage of these solutions to keep your devices safe from these attacks. 2600.95s - 2606.80s | Thank you to people who helped us with research. 2606.80s - 2612.30s | Especially, thank you to Dr. Junsang Yoo. 2612.30s - 2614.30s | Thank you for listening to our presentation. 2614.30s - 2618.30s | If you have any questions, please contact us on Twitter below. 2618.30s - 2622.30s | More details of our research can be found via the QR code on the right. 2622.30s - 2623.30s | Thank you.


chunk_id: 140_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=asd33hSRJKU", "title": "DEF CON 32 - OH MY DC Abusing OIDC all the way to your cloud - Aviad Hahami", "description": "As DevOps and developers are slowly shifting away from storing long-lived static credentials to the more secure, still kinda-new, OIDC alternative - the underlying logic, mechanisms and implementations tend to feel like complicated magic and are mostly overlooked.\n\nIn this talk, we'll begin by recapping what OIDC is, who are the interacting entities when OIDC is used, and how OIDC is taking place to securely access one's cloud using CI/CD flows.\n\nOnce covered, we will be able to alternate our point-of-view between the entities in play and demonstrate potential vulnerabilities in various setups.\n\nStarting with the user PoV, we will show what \"under-configurations\" look like, and continue by demonstrating how new OIDC configuration options can actually be misconfigurations that can result with a compromise.\n\nWe will then see another attack vector where leaking an OIDC token from a single repository in an organization can allow an attacker to abuse under-configurations and access private clouds.\n\nAfter that, we will shift our PoV to be of the Identity Provider (IdP) so that we can look into what happens if an IdP is misconfigured, and disclose a real-world security vulnerability found in one of the most popular CI vendors that allowed us to access any of their customers' cloud environments.\n\nI'll refer to this talk by the Tinder Security team link where they show how they could \"claim\" in the name of other identities due to under-configured WIFs.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2259, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.66s - 5.66s | This text was transcribed using whisper model: large-v2 Yeah, yeah, yeah. What's up? Good to go? Okay. So, uh, hi everybody. Today's talk is, uh, 9.50s - 15.50s | called Ohm IDC, where we gonna, uh, learn and see how we can we abuse OIDC setups in the 15.50s - 21.54s | context of CI. Um, this is extremely exciting for me. That's my first time speaking in the 21.54s - 27.32s | con, so thank you very much for showing up. And thank, thank you very much for having me. 27.32s - 32.56s | That was the first voice breakdown, so it's fine. Okay, uh, by the way, if Adnan and John are 32.56s - 39.56s | here, thank you for the build up. I hope I'll satisfy that. So, I'll, uh,


chunk_id: 140_chunk_1
chunk_text:
disclose a real-world security vulnerability found in one of the most popular CI vendors that allowed us to access any of their customers' cloud environments.\n\nI'll refer to this talk by the Tinder Security team link where they show how they could \"claim\" in the name of other identities due to under-configured WIFs.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2259, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.66s - 5.66s | This text was transcribed using whisper model: large-v2 Yeah, yeah, yeah. What's up? Good to go? Okay. So, uh, hi everybody. Today's talk is, uh, 9.50s - 15.50s | called Ohm IDC, where we gonna, uh, learn and see how we can we abuse OIDC setups in the 15.50s - 21.54s | context of CI. Um, this is extremely exciting for me. That's my first time speaking in the 21.54s - 27.32s | con, so thank you very much for showing up. And thank, thank you very much for having me. 27.32s - 32.56s | That was the first voice breakdown, so it's fine. Okay, uh, by the way, if Adnan and John are 32.56s - 39.56s | here, thank you for the build up. I hope I'll satisfy that. So, I'll, uh, present myself. My 39.56s - 46.04s | name is Aviad Hachami. This is my, uh, Twitter handler. I do security research at Palo Alto. Um, 46.04s - 51.64s | I do CI domain mainly. Uh, I welcome you to check my latest publication. Uh, this is Azure 51.64s - 58.44s | CLI, um, information leakage with the 8.6 core somehow. Um, but it probably affected all 58.44s - 63.44s | your ASG, uh, usages. I also do bug bounty, I DJ, I do graph theory, and FPV drones. Not 65.28s - 72.28s | necessarily in this order. Okay. So, before we go into the agenda, I want to try and 72.28s - 78.00s | convince you why you should listen. Um, so first thing first, if you're completely new to 78.02s - 83.36s | this world or you have like a rough idea of what OIDC is, I hope you get today the full 83.36s - 89.20s | context of what's up with that. What's up internally. There's noise. What's up internally and, 89.20s - 94.24s | uh, how does it play? If you're already a user, I hope you're gonna learn some pitfalls and 94.24s - 99.34s | misconfiguration.


chunk_id: 140_chunk_2
chunk_text:
present myself. My 39.56s - 46.04s | name is Aviad Hachami. This is my, uh, Twitter handler. I do security research at Palo Alto. Um, 46.04s - 51.64s | I do CI domain mainly. Uh, I welcome you to check my latest publication. Uh, this is Azure 51.64s - 58.44s | CLI, um, information leakage with the 8.6 core somehow. Um, but it probably affected all 58.44s - 63.44s | your ASG, uh, usages. I also do bug bounty, I DJ, I do graph theory, and FPV drones. Not 65.28s - 72.28s | necessarily in this order. Okay. So, before we go into the agenda, I want to try and 72.28s - 78.00s | convince you why you should listen. Um, so first thing first, if you're completely new to 78.02s - 83.36s | this world or you have like a rough idea of what OIDC is, I hope you get today the full 83.36s - 89.20s | context of what's up with that. What's up internally. There's noise. What's up internally and, 89.20s - 94.24s | uh, how does it play? If you're already a user, I hope you're gonna learn some pitfalls and 94.24s - 99.34s | misconfiguration. I'm gonna, I hope I'm gonna save you some weekends. And if you're a 99.34s - 103.52s | bounty hunter, um, like most of us here, I hope you're gonna get some new ideas for 103.54s - 108.54s | exploitation. Alright. So, with that, let's go into the agenda. We're gonna start with an 111.24s - 115.92s | OIDC overview. Okay, for those of you who are familiar with this, uh, topic, uh, hold on 115.92s - 122.42s | tight for a sec. Um, after this, we're gonna move into no configs. Uh, this is just a weird 122.42s - 128.96s | term I set up. Um, I'm gonna explain about it, uh, soon enough. We're gonna move into, uh, 128.96s - 133.36s | advanced configurations, misconfigurations, and we're gonna learn what happens when the 134.20s - 139.20s | CI vendor, um, makes a misconfig and why do we care about the CI vendor in that context. Alright. 141.38s - 147.58s | So, first thing first, let's begin with an OIDC overview. So, when I actually rehearsed this 147.58s - 153.38s | talk, um, to some of my friends, some of them are, uh, uh, good researchers, uh, used terms


chunk_id: 140_chunk_3
chunk_text:
I'm gonna, I hope I'm gonna save you some weekends. And if you're a 99.34s - 103.52s | bounty hunter, um, like most of us here, I hope you're gonna get some new ideas for 103.54s - 108.54s | exploitation. Alright. So, with that, let's go into the agenda. We're gonna start with an 111.24s - 115.92s | OIDC overview. Okay, for those of you who are familiar with this, uh, topic, uh, hold on 115.92s - 122.42s | tight for a sec. Um, after this, we're gonna move into no configs. Uh, this is just a weird 122.42s - 128.96s | term I set up. Um, I'm gonna explain about it, uh, soon enough. We're gonna move into, uh, 128.96s - 133.36s | advanced configurations, misconfigurations, and we're gonna learn what happens when the 134.20s - 139.20s | CI vendor, um, makes a misconfig and why do we care about the CI vendor in that context. Alright. 141.38s - 147.58s | So, first thing first, let's begin with an OIDC overview. So, when I actually rehearsed this 147.58s - 153.38s | talk, um, to some of my friends, some of them are, uh, uh, good researchers, uh, used terms 153.38s - 158.76s | like workflow, job, uh, the CI config, et cetera, et cetera, and they were, they said at some 158.76s - 164.94s | point, this is nice, but I'm not sure how CI works. So, in the case you're like my friend and 164.94s - 170.08s | you slept under a rock for the past 10 years, I'm gonna show you what CI is in one slide so we 170.08s - 176.18s | can move on. So, extremely quickly, what is CI? Assuming you're a developer, you performed 176.18s - 181.12s | some GitHub, uh, operation, maybe push, pull request, et cetera, this was, uh, pushed to your 181.12s - 186.06s | VCS provider, GitHub, GitLab, you name it. Um, and it was reflected in your online 186.06s - 190.86s | repository. So far, so good. Now, since you've configured your CI provider, cause this is what we 190.86s - 196.44s | care about, then the VCS provider notified your CI provider that something happened using a 196.44s - 201.44s | webhook with payload, nothing special here. Uh, in, in turn, the CI providers, uh, spin a 203.78s - 208.78s | machine for you, it can be


chunk_id: 140_chunk_4
chunk_text:
153.38s - 158.76s | like workflow, job, uh, the CI config, et cetera, et cetera, and they were, they said at some 158.76s - 164.94s | point, this is nice, but I'm not sure how CI works. So, in the case you're like my friend and 164.94s - 170.08s | you slept under a rock for the past 10 years, I'm gonna show you what CI is in one slide so we 170.08s - 176.18s | can move on. So, extremely quickly, what is CI? Assuming you're a developer, you performed 176.18s - 181.12s | some GitHub, uh, operation, maybe push, pull request, et cetera, this was, uh, pushed to your 181.12s - 186.06s | VCS provider, GitHub, GitLab, you name it. Um, and it was reflected in your online 186.06s - 190.86s | repository. So far, so good. Now, since you've configured your CI provider, cause this is what we 190.86s - 196.44s | care about, then the VCS provider notified your CI provider that something happened using a 196.44s - 201.44s | webhook with payload, nothing special here. Uh, in, in turn, the CI providers, uh, spin a 203.78s - 208.78s | machine for you, it can be any OS according to your configuration, aka workflow. Um, these 209.48s - 214.48s | machines do whatever you want, it can be lints, builds, compilations, and since we're in 216.28s - 222.28s | 2024, they also push to your cloud environments. It can be GCP, AWS, Docker Hub, basically 222.28s - 228.96s | everything out there. This is CI, welcome. So, something I want to emphasize is that those are 228.96s - 233.20s | all split entities, okay? We're gonna come into that later on, we're gonna show this diagram 233.22s - 239.26s | again, but I want you to remember that these are split entities. Cool. Our problem space is 239.26s - 245.00s | this small arrow, welcome to the OIDC and CI niche. This small arrow, which basically makes us 245.00s - 250.04s | ask, uh, an important question, we're in a machine to machine world, so how does 250.04s - 255.04s | authentication happen, right? How can we access Docker Hub, for example? An easy answer, 257.04s - 262.06s | right, will be to hard code your secrets, this is great for my bug bounty, please do that. Um, 262.12s - 266.92s | but, yeah, continue. Um,


chunk_id: 140_chunk_5
chunk_text:
any OS according to your configuration, aka workflow. Um, these 209.48s - 214.48s | machines do whatever you want, it can be lints, builds, compilations, and since we're in 216.28s - 222.28s | 2024, they also push to your cloud environments. It can be GCP, AWS, Docker Hub, basically 222.28s - 228.96s | everything out there. This is CI, welcome. So, something I want to emphasize is that those are 228.96s - 233.20s | all split entities, okay? We're gonna come into that later on, we're gonna show this diagram 233.22s - 239.26s | again, but I want you to remember that these are split entities. Cool. Our problem space is 239.26s - 245.00s | this small arrow, welcome to the OIDC and CI niche. This small arrow, which basically makes us 245.00s - 250.04s | ask, uh, an important question, we're in a machine to machine world, so how does 250.04s - 255.04s | authentication happen, right? How can we access Docker Hub, for example? An easy answer, 257.04s - 262.06s | right, will be to hard code your secrets, this is great for my bug bounty, please do that. Um, 262.12s - 266.92s | but, yeah, continue. Um, the second option will be secrets, right, uh, this is a feature by 266.92s - 271.66s | the CI providers, et cetera. Um, but we all know that at some point or another it's gonna leak, 271.66s - 275.86s | right? We're gonna see some articles saying company whatever was leaked, was breached 275.86s - 280.86s | because of a leakage. So we don't want to do that anymore. And then OIDC comes into help. So 283.60s - 289.84s | OIDC is uh, open identity, this is uh, initials for open identity, something I forgot 289.86s - 294.16s | because I'm stressed, obviously, but that's fine. Uh, but what I want to emphasize is that it's a 294.16s - 299.20s | simple OAuth extension. I believe most of you know what OAuth is at this point in time. If 299.20s - 304.68s | you're on YouTube and you're not familiar with, pause now, go learn OAuth, come back. Yeah, 304.68s - 308.98s | um, it's, it's the basics. So OIDC comes into help and gonna help us solve this whole 308.98s - 313.72s | credentials problem and it's gonna allow us to use um, uh, something called identities that 313.72s


chunk_id: 140_chunk_6
chunk_text:
the second option will be secrets, right, uh, this is a feature by 266.92s - 271.66s | the CI providers, et cetera. Um, but we all know that at some point or another it's gonna leak, 271.66s - 275.86s | right? We're gonna see some articles saying company whatever was leaked, was breached 275.86s - 280.86s | because of a leakage. So we don't want to do that anymore. And then OIDC comes into help. So 283.60s - 289.84s | OIDC is uh, open identity, this is uh, initials for open identity, something I forgot 289.86s - 294.16s | because I'm stressed, obviously, but that's fine. Uh, but what I want to emphasize is that it's a 294.16s - 299.20s | simple OAuth extension. I believe most of you know what OAuth is at this point in time. If 299.20s - 304.68s | you're on YouTube and you're not familiar with, pause now, go learn OAuth, come back. Yeah, 304.68s - 308.98s | um, it's, it's the basics. So OIDC comes into help and gonna help us solve this whole 308.98s - 313.72s | credentials problem and it's gonna allow us to use um, uh, something called identities that 313.72s - 318.82s | we're gonna see in a second. So, what is this OIDC flow? We're gonna learn the vanilla 318.84s - 323.04s | version and then the CI version cause they're a bit different. Um, this is just a slide taken 323.04s - 328.48s | from Microsoft. Um, you are all familiar with the try to log in, go to the identity provider, 328.48s - 333.38s | come get like uh, the token, come back, exchange it. But now we see something different. 333.38s - 337.56s | Instead of access token and refresh token, we're relying on something called ID token. 337.56s - 342.62s | Welcome. Um, so we're gonna learn what ID tokens are in a second, but I just want to plug 342.62s - 347.30s | in some terminology. This is the authent part, the authentication where you actually put 347.34s - 353.42s | credentials and this is the auth Z part where you actually authorize someone to access 353.42s - 357.38s | something regardless of their authentication state. Obviously they should be authenticated by 357.38s - 362.40s | this point in time. So ID tokens. Um, standard JWTs, right, JWTs, base 64. Uh, we're gonna 365.40s


chunk_id: 140_chunk_7
chunk_text:
- 318.82s | we're gonna see in a second. So, what is this OIDC flow? We're gonna learn the vanilla 318.84s - 323.04s | version and then the CI version cause they're a bit different. Um, this is just a slide taken 323.04s - 328.48s | from Microsoft. Um, you are all familiar with the try to log in, go to the identity provider, 328.48s - 333.38s | come get like uh, the token, come back, exchange it. But now we see something different. 333.38s - 337.56s | Instead of access token and refresh token, we're relying on something called ID token. 337.56s - 342.62s | Welcome. Um, so we're gonna learn what ID tokens are in a second, but I just want to plug 342.62s - 347.30s | in some terminology. This is the authent part, the authentication where you actually put 347.34s - 353.42s | credentials and this is the auth Z part where you actually authorize someone to access 353.42s - 357.38s | something regardless of their authentication state. Obviously they should be authenticated by 357.38s - 362.40s | this point in time. So ID tokens. Um, standard JWTs, right, JWTs, base 64. Uh, we're gonna 365.40s - 370.00s | decode them and we're gonna get the header which we don't care about for the sake of this 370.00s - 375.60s | talk. I'll just add that this is how you verify the integrity of an incoming ID token, but 375.60s - 380.92s | I'm not gonna touch this any further. Don't care symbol. And the second part is the actually 380.92s - 386.02s | ID token body and we're gonna dive into the contents of it in a sec, but for the, for the 386.02s - 391.66s | purpose of this slide, I want you to remember that ID tokens, um, the body of it is a simple 391.66s - 396.50s | dictionary where each key is called claim. So now onwards I'm gonna say the token claims 396.50s - 403.14s | something. Okay? Good. So let's conclude the OIDC in the vanilla version of it. Um, it's an 403.14s - 407.92s | OAuth extension and it allows it to rely on short-lived tokens that are based on identity. 407.92s - 412.92s | That's it. TLDR of the whole magic. Right, so let's put it in the context of CICD. If I'm 415.06s - 419.70s |


chunk_id: 140_chunk_8
chunk_text:
- 370.00s | decode them and we're gonna get the header which we don't care about for the sake of this 370.00s - 375.60s | talk. I'll just add that this is how you verify the integrity of an incoming ID token, but 375.60s - 380.92s | I'm not gonna touch this any further. Don't care symbol. And the second part is the actually 380.92s - 386.02s | ID token body and we're gonna dive into the contents of it in a sec, but for the, for the 386.02s - 391.66s | purpose of this slide, I want you to remember that ID tokens, um, the body of it is a simple 391.66s - 396.50s | dictionary where each key is called claim. So now onwards I'm gonna say the token claims 396.50s - 403.14s | something. Okay? Good. So let's conclude the OIDC in the vanilla version of it. Um, it's an 403.14s - 407.92s | OAuth extension and it allows it to rely on short-lived tokens that are based on identity. 407.92s - 412.92s | That's it. TLDR of the whole magic. Right, so let's put it in the context of CICD. If I'm 415.06s - 419.70s | bringing back this small snippet here, right, and I told you this is our problem space, we 419.70s - 424.80s | have two important questions now. First, this is a machine, how does it authenticate? We 424.80s - 430.20s | don't know, we no longer have credentials, so how do we log in? Second question is, is 430.20s - 435.78s | assuming this ID token, how do we verify it? What do we verify it and who does this for us? 435.78s - 442.02s | Okay? So let's address these questions, um, this is the diagram that you all saw like a few 442.02s - 447.36s | slides ago and if I'm gonna call her back, who's in charge of what? And we see that the only 447.36s - 452.36s | entity that is in charge about, of the CI machine is the CI provider, right? So what 454.76s - 459.36s | actually happens behind the scene, and again I'm gonna pop up this question, how do we get 459.36s - 464.56s | the credentials? The CI provider records, reacts, sorry, in accordance to our 464.56s - 469.24s | configuration, right? And when we were configured, we were authenticated to


chunk_id: 140_chunk_9
chunk_text:
bringing back this small snippet here, right, and I told you this is our problem space, we 419.70s - 424.80s | have two important questions now. First, this is a machine, how does it authenticate? We 424.80s - 430.20s | don't know, we no longer have credentials, so how do we log in? Second question is, is 430.20s - 435.78s | assuming this ID token, how do we verify it? What do we verify it and who does this for us? 435.78s - 442.02s | Okay? So let's address these questions, um, this is the diagram that you all saw like a few 442.02s - 447.36s | slides ago and if I'm gonna call her back, who's in charge of what? And we see that the only 447.36s - 452.36s | entity that is in charge about, of the CI machine is the CI provider, right? So what 454.76s - 459.36s | actually happens behind the scene, and again I'm gonna pop up this question, how do we get 459.36s - 464.56s | the credentials? The CI provider records, reacts, sorry, in accordance to our 464.56s - 469.24s | configuration, right? And when we were configured, we were authenticated to the CI 469.24s - 474.34s | provider. So in a sense, you can say that when a CI executes, the machine runs on our 474.34s - 480.12s | behalf. Hence, it's associated with our identity. And this is important to remember. A CI 480.12s - 486.22s | invocation is in the context of the owner of the CI integration. So, in the context of 486.22s - 491.26s | CI CD, uh, the CI vendor also gets to be the identity provider. It's the only one that can 491.26s - 495.70s | give this machine who it is. Okay? Otherwise, it's just an ephemeral machine, right? Nobody 495.70s - 500.06s | knows what it is. Like, why should I give you access to something? So this is the first 500.06s - 505.80s | question answered. Now, the second question was, assuming I do have this ID token, who 505.80s - 510.82s | authorizes this and how exactly? So, I'm gonna close the global protect. So, um, I'm gonna 511.82s - 516.82s | bring back this ID token and this, the Auth Z part is actually composed of two components. The 519.92s - 524.56s | first is the ID token. And this


chunk_id: 140_chunk_10
chunk_text:
the CI 469.24s - 474.34s | provider. So in a sense, you can say that when a CI executes, the machine runs on our 474.34s - 480.12s | behalf. Hence, it's associated with our identity. And this is important to remember. A CI 480.12s - 486.22s | invocation is in the context of the owner of the CI integration. So, in the context of 486.22s - 491.26s | CI CD, uh, the CI vendor also gets to be the identity provider. It's the only one that can 491.26s - 495.70s | give this machine who it is. Okay? Otherwise, it's just an ephemeral machine, right? Nobody 495.70s - 500.06s | knows what it is. Like, why should I give you access to something? So this is the first 500.06s - 505.80s | question answered. Now, the second question was, assuming I do have this ID token, who 505.80s - 510.82s | authorizes this and how exactly? So, I'm gonna close the global protect. So, um, I'm gonna 511.82s - 516.82s | bring back this ID token and this, the Auth Z part is actually composed of two components. The 519.92s - 524.56s | first is the ID token. And this is an example ID token that is shipped by, uh, GitHub's 524.56s - 528.70s | identity provider. Most of these, uh, example are gonna be on GitHub. I really like you 528.70s - 534.18s | folks. Um, so, and if you look at the contents, you see various claims like, uh, the Git 534.18s - 539.68s | SHA, the repository name, run ID, et cetera, et cetera, et cetera. Like, claims. And the most 539.70s - 545.04s | important for us to remember is, uh, to note, sorry, is the sub. Sub short for subject. And 545.04s - 550.32s | this is the default property to assert. When the, uh, basically when we check those claims, 550.32s - 555.98s | it's called assertion. Um, and this is the default property to assert. Now, if we actually 555.98s - 561.60s | dissect this for a second, we know the following. The repo, short for repository, contains 561.60s - 567.94s | the value of the repository claim. Okay? And the ref, right, the ref prefix contains the 567.96s - 573.54s | value of the Git ref coming from the ref claim. So, we can actually see that there's a 573.54s - 579.00s


chunk_id: 140_chunk_11
chunk_text:
is an example ID token that is shipped by, uh, GitHub's 524.56s - 528.70s | identity provider. Most of these, uh, example are gonna be on GitHub. I really like you 528.70s - 534.18s | folks. Um, so, and if you look at the contents, you see various claims like, uh, the Git 534.18s - 539.68s | SHA, the repository name, run ID, et cetera, et cetera, et cetera. Like, claims. And the most 539.70s - 545.04s | important for us to remember is, uh, to note, sorry, is the sub. Sub short for subject. And 545.04s - 550.32s | this is the default property to assert. When the, uh, basically when we check those claims, 550.32s - 555.98s | it's called assertion. Um, and this is the default property to assert. Now, if we actually 555.98s - 561.60s | dissect this for a second, we know the following. The repo, short for repository, contains 561.60s - 567.94s | the value of the repository claim. Okay? And the ref, right, the ref prefix contains the 567.96s - 573.54s | value of the Git ref coming from the ref claim. So, we can actually see that there's a 573.54s - 579.00s | format behind the scenes. And we're gonna come back to that later on. So, an ID token, in 579.00s - 583.64s | the context of CI, I'm gonna summarize that, contains information about the Git event that 583.64s - 587.74s | triggered the pipeline, uh, alongside other vendor information. And we're gonna see 587.74s - 593.86s | later on what this other vendor information, where exactly does it bite us. The second 593.88s - 598.74s | part, the second component of the AuthZ is the, something called identity federation. As 598.74s - 604.22s | the name implies, it, it federates identities coming in. Um, this is an example 604.22s - 610.56s | configuration, uh, for AWS specifically. And the file is pretty simple. Um, you have the 610.56s - 615.30s | identity name, just a string, the identity provider, this is usually the URL of it. Um, and 615.30s - 621.54s | then you set up conditions for who can claim to be this identity. Um, then we see what 621.58s - 627.32s | claims we assert, right? We have the sub, does it work? Okay. We have the sub and then we 627.32s - 631.46s | have the


chunk_id: 140_chunk_12
chunk_text:
| format behind the scenes. And we're gonna come back to that later on. So, an ID token, in 579.00s - 583.64s | the context of CI, I'm gonna summarize that, contains information about the Git event that 583.64s - 587.74s | triggered the pipeline, uh, alongside other vendor information. And we're gonna see 587.74s - 593.86s | later on what this other vendor information, where exactly does it bite us. The second 593.88s - 598.74s | part, the second component of the AuthZ is the, something called identity federation. As 598.74s - 604.22s | the name implies, it, it federates identities coming in. Um, this is an example 604.22s - 610.56s | configuration, uh, for AWS specifically. And the file is pretty simple. Um, you have the 610.56s - 615.30s | identity name, just a string, the identity provider, this is usually the URL of it. Um, and 615.30s - 621.54s | then you set up conditions for who can claim to be this identity. Um, then we see what 621.58s - 627.32s | claims we assert, right? We have the sub, does it work? Okay. We have the sub and then we 627.32s - 631.46s | have the odd, odd short for audience by the way. And then we see that there, we can define 631.46s - 636.76s | the comparators, right? We can do string like or string equals and set the values. Okay, so 636.76s - 642.86s | this is roughly, this is how it goes. So, per the question, how exactly do we authorize 642.86s - 647.58s | someone? Then we have this entity called identity federation and it's gonna assert tokens 647.58s - 654.32s | claims coming, uh, from, uh, CI machines. In this case, obviously. Alright, so now that we 654.32s - 659.22s | know that the CI provider is also the identity provider, right? This is something new. And we 659.22s - 665.64s | also know that this, uh, we have this federation. Then let's redraw the, the OIDC flow in 665.64s - 672.14s | the context of CI. So in the context of CI we actually have this diagram. Now the CI 672.14s - 677.54s | provider also gets to be the identity provider, so it hosts both, uh, like both the CI and 677.54s - 683.12s | itself, the identity. And also we see on the cloud provider, we have


chunk_id: 140_chunk_13
chunk_text:
odd, odd short for audience by the way. And then we see that there, we can define 631.46s - 636.76s | the comparators, right? We can do string like or string equals and set the values. Okay, so 636.76s - 642.86s | this is roughly, this is how it goes. So, per the question, how exactly do we authorize 642.86s - 647.58s | someone? Then we have this entity called identity federation and it's gonna assert tokens 647.58s - 654.32s | claims coming, uh, from, uh, CI machines. In this case, obviously. Alright, so now that we 654.32s - 659.22s | know that the CI provider is also the identity provider, right? This is something new. And we 659.22s - 665.64s | also know that this, uh, we have this federation. Then let's redraw the, the OIDC flow in 665.64s - 672.14s | the context of CI. So in the context of CI we actually have this diagram. Now the CI 672.14s - 677.54s | provider also gets to be the identity provider, so it hosts both, uh, like both the CI and 677.54s - 683.12s | itself, the identity. And also we see on the cloud provider, we have the federation. So the 683.12s - 688.26s | flow is as follows. You ask for an ID token, you get an ID token, you go to your cloud, you 688.26s - 694.42s | say I wanna access, the clouds verify the integrity, this is done using the header. And then 694.42s - 699.20s | it's gonna assert the incoming token against its policies and assuming everything was fine, 699.20s - 705.10s | you're gonna get a set of short-lived credentials. This, this microphone hiccups, right? Right? 705.10s - 710.10s | Uh, oops. The mic hiccups. It doesn't work. Roughly. Halfway. Okay, Asi, take care of that. 713.58s - 720.08s | Okay. Um, I'm gonna plug back in the terminology. This is the auth n bit, okay? And this is 720.08s - 725.08s | the auth z bit. Now since the flow is different, what does it imply? I'm gonna border this 725.08s - 730.08s | square and let's zoom in. Since everything here happens within the CI provider, if we are 734.02s - 739.02s | able to trigger a CI pipeline, we basically granted the owner's identity, okay? Now you can 740.96s - 747.96s | limit that using, you can


chunk_id: 140_chunk_14
chunk_text:
the federation. So the 683.12s - 688.26s | flow is as follows. You ask for an ID token, you get an ID token, you go to your cloud, you 688.26s - 694.42s | say I wanna access, the clouds verify the integrity, this is done using the header. And then 694.42s - 699.20s | it's gonna assert the incoming token against its policies and assuming everything was fine, 699.20s - 705.10s | you're gonna get a set of short-lived credentials. This, this microphone hiccups, right? Right? 705.10s - 710.10s | Uh, oops. The mic hiccups. It doesn't work. Roughly. Halfway. Okay, Asi, take care of that. 713.58s - 720.08s | Okay. Um, I'm gonna plug back in the terminology. This is the auth n bit, okay? And this is 720.08s - 725.08s | the auth z bit. Now since the flow is different, what does it imply? I'm gonna border this 725.08s - 730.08s | square and let's zoom in. Since everything here happens within the CI provider, if we are 734.02s - 739.02s | able to trigger a CI pipeline, we basically granted the owner's identity, okay? Now you can 740.96s - 747.96s | limit that using, you can limit that using specific, uh, uh, orders we'll see later on, but if 747.96s - 753.94s | you're able to trigger a CI machine, you're basically passed the auth n part, okay? This 753.96s - 758.50s | leaves us with the auth z part to guard everything, basically, cause we have the CI machine 758.50s - 764.08s | running. And in a sense, if we're able to trigger a CI pipeline, all that stands between us 764.08s - 768.62s | and accessing a target's resources is just the policy pattern matching, right? So you can see 768.62s - 774.16s | on the bottom part, examples for, uh, subclaims. It can begin with repo, uh, multi-banana 774.16s - 779.52s | Zurich, um, the name of the, uh, uh, repository, the git ref. And on the right hand side, you 779.54s - 785.24s | can see an example of assertion, for example, repo colon star, and where star will expand to 785.24s - 791.58s | everything using pattern matching. Okay, so this was the summary for, uh, OIDC in the 791.58s - 797.50s | context of CI. This is how it works. This is the whole magic. So, in the context of


chunk_id: 140_chunk_15
chunk_text:
limit that using specific, uh, uh, orders we'll see later on, but if 747.96s - 753.94s | you're able to trigger a CI machine, you're basically passed the auth n part, okay? This 753.96s - 758.50s | leaves us with the auth z part to guard everything, basically, cause we have the CI machine 758.50s - 764.08s | running. And in a sense, if we're able to trigger a CI pipeline, all that stands between us 764.08s - 768.62s | and accessing a target's resources is just the policy pattern matching, right? So you can see 768.62s - 774.16s | on the bottom part, examples for, uh, subclaims. It can begin with repo, uh, multi-banana 774.16s - 779.52s | Zurich, um, the name of the, uh, uh, repository, the git ref. And on the right hand side, you 779.54s - 785.24s | can see an example of assertion, for example, repo colon star, and where star will expand to 785.24s - 791.58s | everything using pattern matching. Okay, so this was the summary for, uh, OIDC in the 791.58s - 797.50s | context of CI. This is how it works. This is the whole magic. So, in the context of CI, we can 797.50s - 802.00s | say that it is done by asserting incoming ID tokens from CI machine using an identity 802.00s - 807.00s | federation in exchange for credentials. That's it. Easy. Cool. We can move on to the next 809.54s - 815.68s | no-configs, and let's have some fun. So, no-configs is basically when there is no one at the 815.68s - 820.56s | door. If you think about the Auth Z as the bouncer, if the bouncers allows anyone into the 820.56s - 826.76s | club, then anybody can get in, right? So, a no-config is a state, uh, where the federator is 826.76s - 833.10s | asserting lax rules, if any. Um, and they will, it will authorize almost any ID token. Okay, 833.10s - 838.14s | what does it mean? So let's take a look at these 3 snippets. These are snippets from the 838.16s - 842.70s | identity federation example you just saw, but different assertions. So, the first one, we 842.70s - 847.70s | have, uh, uh, an asterisk, right? Using pattern matching, it's gonna expand to anything. 847.70s - 852.38s | Obviously, you didn't check anything here. Um, second option,


chunk_id: 140_chunk_16
chunk_text:
CI, we can 797.50s - 802.00s | say that it is done by asserting incoming ID tokens from CI machine using an identity 802.00s - 807.00s | federation in exchange for credentials. That's it. Easy. Cool. We can move on to the next 809.54s - 815.68s | no-configs, and let's have some fun. So, no-configs is basically when there is no one at the 815.68s - 820.56s | door. If you think about the Auth Z as the bouncer, if the bouncers allows anyone into the 820.56s - 826.76s | club, then anybody can get in, right? So, a no-config is a state, uh, where the federator is 826.76s - 833.10s | asserting lax rules, if any. Um, and they will, it will authorize almost any ID token. Okay, 833.10s - 838.14s | what does it mean? So let's take a look at these 3 snippets. These are snippets from the 838.16s - 842.70s | identity federation example you just saw, but different assertions. So, the first one, we 842.70s - 847.70s | have, uh, uh, an asterisk, right? Using pattern matching, it's gonna expand to anything. 847.70s - 852.38s | Obviously, you didn't check anything here. Um, second option, repo column star, so 852.38s - 856.58s | everything begins with repo. There's nothing specific to your account here. So, again, you 856.58s - 860.62s | didn't check anything. And the last one is everything that begins with my org, and 860.62s - 866.66s | something to note, there is no slash between the org and the star. So, if you open a GitHub 866.68s - 872.32s | organization called my org one, it will satisfy this as well. Cool. Now, this was already 872.32s - 877.86s | talked about in, uh, in, uh, 2 talks. One by, uh, Rojan of Tinder, and one by Christoph that 877.86s - 883.76s | maybe sits in the audience here. So, hi, Christoph. Um, I also talked about it, uh, on the 883.76s - 889.50s | latest, um, b-sides. And basically, I, I really, I highly recommend watching these talks. 889.50s - 894.68s | They explain exactly how those misconfigs look like, okay? And how to hunt for them, and how 894.70s - 900.56s | to exploit them. I'm not gonna talk about, uh, when there's no config kind of situation, um, and 900.56s - 906.48s | yes, go ahead and watch them.


chunk_id: 140_chunk_17
chunk_text:
repo column star, so 852.38s - 856.58s | everything begins with repo. There's nothing specific to your account here. So, again, you 856.58s - 860.62s | didn't check anything. And the last one is everything that begins with my org, and 860.62s - 866.66s | something to note, there is no slash between the org and the star. So, if you open a GitHub 866.68s - 872.32s | organization called my org one, it will satisfy this as well. Cool. Now, this was already 872.32s - 877.86s | talked about in, uh, in, uh, 2 talks. One by, uh, Rojan of Tinder, and one by Christoph that 877.86s - 883.76s | maybe sits in the audience here. So, hi, Christoph. Um, I also talked about it, uh, on the 883.76s - 889.50s | latest, um, b-sides. And basically, I, I really, I highly recommend watching these talks. 889.50s - 894.68s | They explain exactly how those misconfigs look like, okay? And how to hunt for them, and how 894.70s - 900.56s | to exploit them. I'm not gonna talk about, uh, when there's no config kind of situation, um, and 900.56s - 906.48s | yes, go ahead and watch them. So, since we're not talking about the no config situation, what 906.48s - 912.48s | happens when I have partial configs? How safe are they, if at all? Let's zoom in. So, the 912.48s - 916.62s | first one, we're gonna assert everybody in the org name, right? Repo column org name. Let's 916.62s - 922.46s | say I can say anybody in Palo Alto can access this identity. Is this okay? Is this safe? What 922.46s - 927.74s | about everybody in Palo with respect to a branch? So, the answer is, the first one is 927.74s - 931.82s | potentially unsafe, so does the second one. We're gonna see later how we can exploit and 931.82s - 938.62s | abuse such cases. And the workflow example is actually the worst. This is very bad. If you 938.62s - 943.52s | configure using the workflow, you're exploited immediately, okay? And we're gonna see how. And 943.52s - 948.20s | another thing you gotta ask yourself, how come this claim begins with workflow? All you've 948.20s - 954.08s | seen was repo column. How come we're at workflow column? What happened here? Alright, so 954.08s - 959.64s | let's move


chunk_id: 140_chunk_18
chunk_text:
So, since we're not talking about the no config situation, what 906.48s - 912.48s | happens when I have partial configs? How safe are they, if at all? Let's zoom in. So, the 912.48s - 916.62s | first one, we're gonna assert everybody in the org name, right? Repo column org name. Let's 916.62s - 922.46s | say I can say anybody in Palo Alto can access this identity. Is this okay? Is this safe? What 922.46s - 927.74s | about everybody in Palo with respect to a branch? So, the answer is, the first one is 927.74s - 931.82s | potentially unsafe, so does the second one. We're gonna see later how we can exploit and 931.82s - 938.62s | abuse such cases. And the workflow example is actually the worst. This is very bad. If you 938.62s - 943.52s | configure using the workflow, you're exploited immediately, okay? And we're gonna see how. And 943.52s - 948.20s | another thing you gotta ask yourself, how come this claim begins with workflow? All you've 948.20s - 954.08s | seen was repo column. How come we're at workflow column? What happened here? Alright, so 954.08s - 959.64s | let's move to misconfiguration when you do some configurations, but they're insufficient. Uh, 959.64s - 964.02s | we're gonna see some pitfalls for advanced configurations, including a demo. And then we're 964.02s - 969.92s | gonna see how you can abuse, uh, pipelines. This is partially what Adnan, uh, talked about in 969.92s - 976.26s | the, in the last talk. Um, but we're gonna see how we can abuse lax policies and access, um, 976.30s - 981.30s | various identities. So, misconfigs. We're gonna start with a short demo. Um, and just click 985.42s - 991.66s | here. Okay. So, what you see here is a video that was uploaded by, uh, JFrog explaining to 991.66s - 997.00s | their customers how to configure OIDC in front of, uh, JFrog. So, you can access the 997.00s - 1001.56s | artifactory, x-ray, et cetera. So, this is a great feature, by the way. Nothing bad to say 1001.56s - 1006.60s | about them. And what we see in this example is how they configure the identity provider on 1006.60s - 1011.64s | JFrog's side and how they configure the identity. Here we see the example, uh, claims 1011.64s - 1016.84s | GitHub


chunk_id: 140_chunk_19
chunk_text:
to misconfiguration when you do some configurations, but they're insufficient. Uh, 959.64s - 964.02s | we're gonna see some pitfalls for advanced configurations, including a demo. And then we're 964.02s - 969.92s | gonna see how you can abuse, uh, pipelines. This is partially what Adnan, uh, talked about in 969.92s - 976.26s | the, in the last talk. Um, but we're gonna see how we can abuse lax policies and access, um, 976.30s - 981.30s | various identities. So, misconfigs. We're gonna start with a short demo. Um, and just click 985.42s - 991.66s | here. Okay. So, what you see here is a video that was uploaded by, uh, JFrog explaining to 991.66s - 997.00s | their customers how to configure OIDC in front of, uh, JFrog. So, you can access the 997.00s - 1001.56s | artifactory, x-ray, et cetera. So, this is a great feature, by the way. Nothing bad to say 1001.56s - 1006.60s | about them. And what we see in this example is how they configure the identity provider on 1006.60s - 1011.64s | JFrog's side and how they configure the identity. Here we see the example, uh, claims 1011.64s - 1016.84s | GitHub allows us to rely upon. And we can see on the right-hand side that they instruct us to 1016.84s - 1023.42s | assert workflow equals JFrog NPM. This is according to their video. Alright. Um, I'm a 1023.42s - 1029.32s | naive user. I'm gonna copy-paste that, right? Uh, I just learned OAuth and, and OIDC. So, 1029.32s - 1035.56s | this is me creating the same identity provider at JFrog. Um, just naming it my provider, 1035.56s - 1040.90s | et cetera, et cetera. Nothing fancy. I mean, some arbitrary, arbitrary identity. And I'm 1040.90s - 1045.40s | gonna do the same instruction. I'm gonna assert that the workflow equals corporate usable 1045.40s - 1050.40s | workflow. This is coming from my corporation. Alright. Um, I'm gonna save it, uh, and then 1053.14s - 1056.84s | I'm gonna copy the snippet. This is for GitHub Actions. Uh, for those of you who are 1056.84s - 1062.38s | unfamiliar somehow with this product, this is GitHub's CI. Um, once I saved it, I'm gonna go 1062.40s - 1067.84s | to my leaking pond repository and I'm gonna create a new GitHub Actions file. I'm gonna 1067.84s - 1072.58s | commit


chunk_id: 140_chunk_20
chunk_text:
allows us to rely upon. And we can see on the right-hand side that they instruct us to 1016.84s - 1023.42s | assert workflow equals JFrog NPM. This is according to their video. Alright. Um, I'm a 1023.42s - 1029.32s | naive user. I'm gonna copy-paste that, right? Uh, I just learned OAuth and, and OIDC. So, 1029.32s - 1035.56s | this is me creating the same identity provider at JFrog. Um, just naming it my provider, 1035.56s - 1040.90s | et cetera, et cetera. Nothing fancy. I mean, some arbitrary, arbitrary identity. And I'm 1040.90s - 1045.40s | gonna do the same instruction. I'm gonna assert that the workflow equals corporate usable 1045.40s - 1050.40s | workflow. This is coming from my corporation. Alright. Um, I'm gonna save it, uh, and then 1053.14s - 1056.84s | I'm gonna copy the snippet. This is for GitHub Actions. Uh, for those of you who are 1056.84s - 1062.38s | unfamiliar somehow with this product, this is GitHub's CI. Um, once I saved it, I'm gonna go 1062.40s - 1067.84s | to my leaking pond repository and I'm gonna create a new GitHub Actions file. I'm gonna 1067.84s - 1072.58s | commit everything. If you are unfamiliar with how the workflows of GitHub Action looks like, 1072.58s - 1077.26s | then this is it. This is the recipe. And all you gotta know for the sake of this demo is that 1077.26s - 1083.06s | assuming a success, the machine invocation as a whole will be successful. Otherwise, it will 1083.06s - 1088.06s | fail. So, uh, I've committed the CI React to my Git event. So, it fires. Um, we're gonna see a 1088.32s - 1093.32s | machine being run. And then we're gonna see that this account, as the video instruct us, was 1095.66s - 1100.46s | indeed able to access GitHub. Now, let's exploit that. Okay? We're gonna use the special 1100.46s - 1106.76s | technique called copy paste. I'm gonna copy the exact same workflow configuration file. And 1106.76s - 1111.68s | I'm gonna commit it to my own private, uh, uh, account. Which I was told that it's not safe to 1111.68s - 1116.72s | do at Defcon, but whatever. Um, gonna do a special commit message cause it's important for 1117.60s - 1123.64s | nothing. And in reaction, the CI will trigger again. Now, what we


chunk_id: 140_chunk_21
chunk_text:
everything. If you are unfamiliar with how the workflows of GitHub Action looks like, 1072.58s - 1077.26s | then this is it. This is the recipe. And all you gotta know for the sake of this demo is that 1077.26s - 1083.06s | assuming a success, the machine invocation as a whole will be successful. Otherwise, it will 1083.06s - 1088.06s | fail. So, uh, I've committed the CI React to my Git event. So, it fires. Um, we're gonna see a 1088.32s - 1093.32s | machine being run. And then we're gonna see that this account, as the video instruct us, was 1095.66s - 1100.46s | indeed able to access GitHub. Now, let's exploit that. Okay? We're gonna use the special 1100.46s - 1106.76s | technique called copy paste. I'm gonna copy the exact same workflow configuration file. And 1106.76s - 1111.68s | I'm gonna commit it to my own private, uh, uh, account. Which I was told that it's not safe to 1111.68s - 1116.72s | do at Defcon, but whatever. Um, gonna do a special commit message cause it's important for 1117.60s - 1123.64s | nothing. And in reaction, the CI will trigger again. Now, what we will see, uh, we're gonna go 1123.64s - 1127.82s | into this logs. We're gonna count one, two, three. Worker's gonna pick it up. And we were able 1127.82s - 1132.82s | to successfully access the same account. Right? From a different account. Amazing. Magic. 1132.82s - 1137.82s | What happened? Right? What happened here? On JFrog's end, we defined the identity 1140.60s - 1145.20s | federation to be something, whatever the name of the, uh, provider, but workflow. I'm gonna 1145.22s - 1150.22s | set the workflow to be corpusable workflow, correct? Good. When my token showed up and said, 1151.48s - 1156.46s | hi, I'm coming from a Vias repository, et cetera, et cetera, and the workflow is called 1156.46s - 1162.00s | corpusable workflow, so the federation said, yeah, it's the same claim, get in. And you gotta 1162.00s - 1167.84s | ask yourself, where is this value coming from? And the answer is, as always, user input. So 1167.84s - 1172.84s | you can just, this is the name of the workflow, you can put any string there and, yeah. So, 1172.92s - 1177.92s | copy paste for the win. And we can see, by showing


chunk_id: 140_chunk_22
chunk_text:
will see, uh, we're gonna go 1123.64s - 1127.82s | into this logs. We're gonna count one, two, three. Worker's gonna pick it up. And we were able 1127.82s - 1132.82s | to successfully access the same account. Right? From a different account. Amazing. Magic. 1132.82s - 1137.82s | What happened? Right? What happened here? On JFrog's end, we defined the identity 1140.60s - 1145.20s | federation to be something, whatever the name of the, uh, provider, but workflow. I'm gonna 1145.22s - 1150.22s | set the workflow to be corpusable workflow, correct? Good. When my token showed up and said, 1151.48s - 1156.46s | hi, I'm coming from a Vias repository, et cetera, et cetera, and the workflow is called 1156.46s - 1162.00s | corpusable workflow, so the federation said, yeah, it's the same claim, get in. And you gotta 1162.00s - 1167.84s | ask yourself, where is this value coming from? And the answer is, as always, user input. So 1167.84s - 1172.84s | you can just, this is the name of the workflow, you can put any string there and, yeah. So, 1172.92s - 1177.92s | copy paste for the win. And we can see, by showing one example, that not all claims are safe, 1181.36s - 1186.06s | right? I've showed you once, this is sufficient to say that not all are safe. If we look 1186.06s - 1192.04s | into the RFC of RDC, then basically we're instructed to have five required claims, issuer, 1192.04s - 1196.88s | subject, audience, expiration, and issued at. Let's translate them to an attacker point of 1196.88s - 1202.18s | view, the URL of the provider, the target, just a string that you can modify if you have an 1202.18s - 1207.66s | RC in the case of odd. Expiration time for the RDC token is roughly four minutes, and 1207.66s - 1215.00s | nobody cares when it was issued. On top of these five claims, we have a plethora of other 1215.00s - 1219.76s | custom claims. These are given by the CI vendors, which get to be the identity providers, 1219.76s - 1225.70s | right? For example, GitHub supplies with various claims, but all of these are unique to GitHub, 1225.70s - 1230.48s | right? Repository owner, runner, environment, run number, whatever, whatever, these are all 1230.48s - 1235.92s | GitHub unique. If we go to Circle,


chunk_id: 140_chunk_23
chunk_text:
one example, that not all claims are safe, 1181.36s - 1186.06s | right? I've showed you once, this is sufficient to say that not all are safe. If we look 1186.06s - 1192.04s | into the RFC of RDC, then basically we're instructed to have five required claims, issuer, 1192.04s - 1196.88s | subject, audience, expiration, and issued at. Let's translate them to an attacker point of 1196.88s - 1202.18s | view, the URL of the provider, the target, just a string that you can modify if you have an 1202.18s - 1207.66s | RC in the case of odd. Expiration time for the RDC token is roughly four minutes, and 1207.66s - 1215.00s | nobody cares when it was issued. On top of these five claims, we have a plethora of other 1215.00s - 1219.76s | custom claims. These are given by the CI vendors, which get to be the identity providers, 1219.76s - 1225.70s | right? For example, GitHub supplies with various claims, but all of these are unique to GitHub, 1225.70s - 1230.48s | right? Repository owner, runner, environment, run number, whatever, whatever, these are all 1230.48s - 1235.92s | GitHub unique. If we go to Circle, they have their own world, right? Workflow ID, VCS origin, 1235.92s - 1242.80s | whatever, whatever, and GitLab has their own stuff, right? Nobody, like, what's going on? So, 1242.80s - 1247.24s | it adds up to a lot of confusion. If you're at DevOps for a company and you're trying to set up 1247.24s - 1252.40s | using custom claims, you can get lost really quickly, because you have so many and there's 1252.40s - 1258.40s | almost zero instructions on which values are safe in this context. So, if you'd like to have 1258.40s - 1264.20s | a situation like I just showed, a rule of thumb for using custom claims coming from the 1264.20s - 1269.00s | vendor is to remember that they're provided regardless of their strength. By strength, I mean 1269.00s - 1277.34s | how hard they are to fraud. So, check where the values come from, okay? Now, a hidden pitfall 1277.34s - 1287.36s | of this behavior or this basically behavior is the custom claim format feature, okay? So, as 1287.36s - 1293.60s | the name suggests, it's a custom format, and it comes to answer a problem where some federators 1293.60s -


chunk_id: 140_chunk_24
chunk_text:
they have their own world, right? Workflow ID, VCS origin, 1235.92s - 1242.80s | whatever, whatever, and GitLab has their own stuff, right? Nobody, like, what's going on? So, 1242.80s - 1247.24s | it adds up to a lot of confusion. If you're at DevOps for a company and you're trying to set up 1247.24s - 1252.40s | using custom claims, you can get lost really quickly, because you have so many and there's 1252.40s - 1258.40s | almost zero instructions on which values are safe in this context. So, if you'd like to have 1258.40s - 1264.20s | a situation like I just showed, a rule of thumb for using custom claims coming from the 1264.20s - 1269.00s | vendor is to remember that they're provided regardless of their strength. By strength, I mean 1269.00s - 1277.34s | how hard they are to fraud. So, check where the values come from, okay? Now, a hidden pitfall 1277.34s - 1287.36s | of this behavior or this basically behavior is the custom claim format feature, okay? So, as 1287.36s - 1293.60s | the name suggests, it's a custom format, and it comes to answer a problem where some federators 1293.60s - 1298.84s | do not assert custom claims directly, like we saw with JFrog asserting workflow. Some just don't 1298.84s - 1304.32s | want to do that. Why? I don't know. It's just a JSON. But therefore, some identity providers 1304.32s - 1309.64s | allow reformatting the structure of the subclaim to contain custom claims values, okay? What do I 1309.64s - 1315.72s | mean by that? Consider the top option. This is what you're familiar with. It begins with repo 1315.72s - 1320.64s | and then the ref, right, the git ref. But now you can put actor ID, this in GitHub's world. So, 1320.64s - 1325.96s | now you can put actor ID and repository ID, and it will be later populated with the values with 1325.96s - 1332.56s | respect to where this was fired from, where the CI ran from. So, something that can be easily 1332.56s - 1339.48s | missed with this feature is that the claims order is critical, all right? Let's see why. Consider 1339.48s - 1344.60s | this format and this claim. So, we're going to have repo, my org, and then the name of the 1344.60s - 1350.84s | workflow, fine. So,


chunk_id: 140_chunk_25
chunk_text:
1298.84s | do not assert custom claims directly, like we saw with JFrog asserting workflow. Some just don't 1298.84s - 1304.32s | want to do that. Why? I don't know. It's just a JSON. But therefore, some identity providers 1304.32s - 1309.64s | allow reformatting the structure of the subclaim to contain custom claims values, okay? What do I 1309.64s - 1315.72s | mean by that? Consider the top option. This is what you're familiar with. It begins with repo 1315.72s - 1320.64s | and then the ref, right, the git ref. But now you can put actor ID, this in GitHub's world. So, 1320.64s - 1325.96s | now you can put actor ID and repository ID, and it will be later populated with the values with 1325.96s - 1332.56s | respect to where this was fired from, where the CI ran from. So, something that can be easily 1332.56s - 1339.48s | missed with this feature is that the claims order is critical, all right? Let's see why. Consider 1339.48s - 1344.60s | this format and this claim. So, we're going to have repo, my org, and then the name of the 1344.60s - 1350.84s | workflow, fine. So, we all know by now that this is very unsafe, right? I just showed you how it 1350.84s - 1357.00s | can be abused. But this one is actually safe. The prefix is safe. Why? Because GitHub will 1357.00s - 1361.08s | actually put the name of the organization and repository. You can't just fake that, at least not 1361.08s - 1366.56s | in this talk. But you can't just fake that. So, this is fine. This is an example of fine, although 1366.56s - 1372.32s | it relies on unsafe claim for the second half of it. If you flip it, however, then you're done 1372.32s - 1380.88s | with, okay? So, let's see how. In order to abuse such a case, basically, all you have to do is 1380.88s - 1387.40s | create a workflow, name it everything after the workflow prefix, go to your favourite CI provider, 1387.40s - 1393.08s | change the subclaim to be workflow only, and they will grant you with a pretty and beautiful 1393.08s - 1398.08s | signed token that has the exact same claim like the other organisation asserts. Obviously, you 1398.08s - 1405.28s | can put whatever, my org in


chunk_id: 140_chunk_26
chunk_text:
we all know by now that this is very unsafe, right? I just showed you how it 1350.84s - 1357.00s | can be abused. But this one is actually safe. The prefix is safe. Why? Because GitHub will 1357.00s - 1361.08s | actually put the name of the organization and repository. You can't just fake that, at least not 1361.08s - 1366.56s | in this talk. But you can't just fake that. So, this is fine. This is an example of fine, although 1366.56s - 1372.32s | it relies on unsafe claim for the second half of it. If you flip it, however, then you're done 1372.32s - 1380.88s | with, okay? So, let's see how. In order to abuse such a case, basically, all you have to do is 1380.88s - 1387.40s | create a workflow, name it everything after the workflow prefix, go to your favourite CI provider, 1387.40s - 1393.08s | change the subclaim to be workflow only, and they will grant you with a pretty and beautiful 1393.08s - 1398.08s | signed token that has the exact same claim like the other organisation asserts. Obviously, you 1398.08s - 1405.28s | can put whatever, my org in Palo Alto, Microsoft, you can just write whatever. So, a rule of 1405.28s - 1409.68s | thumb for this feature is that the claims order is critical. I haven't seen even one manual page 1409.68s - 1414.44s | that mentions that. When you use custom claims, they just let you use it, but they don't tell you 1414.44s - 1422.60s | what not to do. So, the order is critical. In order to help everybody here to either escape from 1422.60s - 1430.00s | these bugs or to exploit them, I've created this tool. You can scan the QR code to get the latest 1430.00s - 1436.40s | zero click for your Android. But basically, it lists all the GitHub possible custom claims with 1436.40s - 1441.00s | information about the strength of each one. This is a nice guide. It can check your subclaim 1441.00s - 1446.28s | format for safety, and it will allow you to modify the subclaim if you want to attack with it or you 1446.28s - 1450.52s | just want to fix it for your organisation or repository. There is some hierarchy option, so 1450.52s - 1455.60s | it's interesting. This is how the


chunk_id: 140_chunk_27
chunk_text:
Palo Alto, Microsoft, you can just write whatever. So, a rule of 1405.28s - 1409.68s | thumb for this feature is that the claims order is critical. I haven't seen even one manual page 1409.68s - 1414.44s | that mentions that. When you use custom claims, they just let you use it, but they don't tell you 1414.44s - 1422.60s | what not to do. So, the order is critical. In order to help everybody here to either escape from 1422.60s - 1430.00s | these bugs or to exploit them, I've created this tool. You can scan the QR code to get the latest 1430.00s - 1436.40s | zero click for your Android. But basically, it lists all the GitHub possible custom claims with 1436.40s - 1441.00s | information about the strength of each one. This is a nice guide. It can check your subclaim 1441.00s - 1446.28s | format for safety, and it will allow you to modify the subclaim if you want to attack with it or you 1446.28s - 1450.52s | just want to fix it for your organisation or repository. There is some hierarchy option, so 1450.52s - 1455.60s | it's interesting. This is how the tool looks like. All you've got to bring is your favourite 1455.60s - 1461.64s | GitHub token with admin permissions, not necessarily of your organisation, but, yeah. And, 1461.64s - 1465.16s | for example, in the inspect mode, you can see that these are the claims, and they're not safe 1465.16s - 1473.52s | because it's set right surplus, so go ahead, get a zero click, and, yeah. Okay. Now, this is 1473.52s - 1479.96s | behind us, and let's move into pipeline abuses that can lead to OIDC abuse. Basically, 1479.96s - 1486.32s | misconfigs that lead to abuses, abuses, sorry, of lax policies. So we saw that this was very 1486.32s - 1493.04s | bad, right? We now know why this is, this sucks. But what about these two? We did just say 1493.04s - 1500.76s | that, for example, saying everybody in Apollo is fine, right? Or not? So let's abuse those. The 1500.76s - 1505.56s | answer is pretty simple. Poison pipeline execution, which is the most common entry vector 1505.60s - 1512.44s | for CIs, right? And lax policies. So let's explain for a second. A PPE is a pull request from a 1512.44s -


chunk_id: 140_chunk_28
chunk_text:
tool looks like. All you've got to bring is your favourite 1455.60s - 1461.64s | GitHub token with admin permissions, not necessarily of your organisation, but, yeah. And, 1461.64s - 1465.16s | for example, in the inspect mode, you can see that these are the claims, and they're not safe 1465.16s - 1473.52s | because it's set right surplus, so go ahead, get a zero click, and, yeah. Okay. Now, this is 1473.52s - 1479.96s | behind us, and let's move into pipeline abuses that can lead to OIDC abuse. Basically, 1479.96s - 1486.32s | misconfigs that lead to abuses, abuses, sorry, of lax policies. So we saw that this was very 1486.32s - 1493.04s | bad, right? We now know why this is, this sucks. But what about these two? We did just say 1493.04s - 1500.76s | that, for example, saying everybody in Apollo is fine, right? Or not? So let's abuse those. The 1500.76s - 1505.56s | answer is pretty simple. Poison pipeline execution, which is the most common entry vector 1505.60s - 1512.44s | for CIs, right? And lax policies. So let's explain for a second. A PPE is a pull request from a 1512.44s - 1516.92s | fork that will trigger a vulnerable CI execution in the context of the target, right? We're all 1516.92s - 1523.64s | familiar with this by now. I hope so. The second bit, the lax policies, they will allow a token 1523.64s - 1529.56s | from the same, from the targeted organisation, sorry, to slip through lax policies, okay? Now 1529.60s - 1536.32s | what do I mean by that? Let's see how it plays. Demo. In order to demo that, we have to define a 1536.32s - 1540.84s | few entities, right? Let's begin with the identity federation on the resource side. So we're 1540.84s - 1546.32s | gonna set up something like this. We wanna assert that the audience equals, uh, the Amazon AWS 1546.32s - 1551.56s | thing. Um, and we wanna assert that all the identities coming in from the banana multi 1551.56s - 1557.28s | organisation are okay to go in. This is the federation. If you put it, by the way, on AWS, it's 1557.28s - 1562.60s | gonna look something like this. And although AWS did some changes in order to enforce more 1562.60s - 1569.60s | strict policies, they will allow


