# MediaChunks

chunk_text:
402.56s | at some time or another where we're just in a loud room or we get old and our bodies start to 402.56s - 407.76s | fail us, all of us will be disabled at some point in our lives. So when we're talking about 407.76s - 412.08s | accessibility, don't make the mistake of thinking, oh, accessibility, that's for those people over 412.08s - 416.08s | there. Oh, accessibility, that's the thing that fricking bureaucrats make me want to check off 416.08s - 421.68s | a list so we don't get sued. It's not the case. Accessibility is for all of us. Quick show of 421.68s - 428.24s | hand, who here in the audience has either personally experienced accessibility or rather 428.24s - 433.20s | personally experienced disability or has a relative who has disabilities? Show of hands. 433.20s - 438.08s | I know I have. That's a good portion of you, and I think 100% of the people that are actually 438.08s - 445.44s | paying attention and thinking about it. So where does that leave us on accessibility and XR? 446.56s - 452.88s | Well, there's two perspectives when it comes to XR accessibility. The first is this idea of core 452.88s - 460.64s | platform accessibility, and that is the idea that every single XR app from, you know, Beat Saber to 460.64s - 466.24s | Vacation Simulator to, you know, all the stuff you see in the XR Village upstairs of working on labs 466.24s - 472.72s | and simulating national disasters, all of those should be accessible to anybody that wants to use 472.72s - 481.12s | them. The second way of thinking about XR accessibility is about XR as assistive technology, 481.12s - 485.52s | and so this would be tools that are aimed specifically at people with disabilities to 485.52s - 492.24s | support them and their use in everyday life. Now, normally I would focus this talk on core 492.24s - 497.20s | platform accessibility. You know, that's things like the curb cut effect, right? Everybody knows 497.20s - 501.28s | curb cuts, the little things that go from the sidewalk down to the street. They didn't have 501.28s - 506.16s | those back before, like, the 1960s. There was a whole disability civil rights movement where 506.16s - 510.96s | people were sneaking out at night to take


chunk_text:
first is this idea of core 452.88s - 460.64s | platform accessibility, and that is the idea that every single XR app from, you know, Beat Saber to 460.64s - 466.24s | Vacation Simulator to, you know, all the stuff you see in the XR Village upstairs of working on labs 466.24s - 472.72s | and simulating national disasters, all of those should be accessible to anybody that wants to use 472.72s - 481.12s | them. The second way of thinking about XR accessibility is about XR as assistive technology, 481.12s - 485.52s | and so this would be tools that are aimed specifically at people with disabilities to 485.52s - 492.24s | support them and their use in everyday life. Now, normally I would focus this talk on core 492.24s - 497.20s | platform accessibility. You know, that's things like the curb cut effect, right? Everybody knows 497.20s - 501.28s | curb cuts, the little things that go from the sidewalk down to the street. They didn't have 501.28s - 506.16s | those back before, like, the 1960s. There was a whole disability civil rights movement where 506.16s - 510.96s | people were sneaking out at night to take sledgehammers to sidewalks and then put in, you know, 510.96s - 517.28s | wooden ramps, and once, you know, they people had to fight tooth and nail to get these in for 517.28s - 523.04s | wheelchair users so that wheelchair users didn't have to, you know, wheel through the streets and 523.04s - 531.44s | be hit by cars, and once they did that, they realized, oh, hold on a sec, guys. I think, I think 531.44s - 537.52s | these are useful for everybody. They found that these curb cuts weren't just useful for people in 537.52s - 542.24s | wheelchairs, people who, you know, had no mobility. Uh, they were useful for people on bicycles and 542.24s - 550.24s | people with baby strollers and people with heavy dollies full of crap. So, these types of things, 550.24s - 553.84s | you know, when we make, uh, when we make things accessible for people with disabilities, 553.84s - 558.72s | we make them better for everybody. So, that's usually what I would do a whole 30-minute talk 558.72s - 564.16s | about, right? We talk about things like, uh, captions in VR, we talk about magnification, 564.16s


chunk_text:
sledgehammers to sidewalks and then put in, you know, 510.96s - 517.28s | wooden ramps, and once, you know, they people had to fight tooth and nail to get these in for 517.28s - 523.04s | wheelchair users so that wheelchair users didn't have to, you know, wheel through the streets and 523.04s - 531.44s | be hit by cars, and once they did that, they realized, oh, hold on a sec, guys. I think, I think 531.44s - 537.52s | these are useful for everybody. They found that these curb cuts weren't just useful for people in 537.52s - 542.24s | wheelchairs, people who, you know, had no mobility. Uh, they were useful for people on bicycles and 542.24s - 550.24s | people with baby strollers and people with heavy dollies full of crap. So, these types of things, 550.24s - 553.84s | you know, when we make, uh, when we make things accessible for people with disabilities, 553.84s - 558.72s | we make them better for everybody. So, that's usually what I would do a whole 30-minute talk 558.72s - 564.16s | about, right? We talk about things like, uh, captions in VR, we talk about magnification, 564.16s - 568.80s | we talk about co-piloting, uh, all the features that if you are designing or developing 568.80s - 576.08s | a VR, AR, XR app, you would put in to make it more usable. But today, we're talking about 576.08s - 584.16s | something else, because I know you all here, uh, at DEF CON, uh, care about a little thing called 584.16s - 594.88s | privacy, right? And there is a very interesting tension between accessibility and privacy when it 594.88s - 604.24s | comes to XR, because there are some tools like, for example, facial recognition, that if you are 604.24s - 608.96s | blind or you have, uh, you know, prosopagnosia, which is like face blindness, the inability to 608.96s - 615.52s | remember faces, uh, or if you just have memory problems, facial recognition could be a very 615.52s - 620.88s | helpful tool, right? Being able to have a little reminder of, oh, your brother just walked into the 620.88s - 629.28s | room, oh, here comes your friend Sam, right? That's really useful. But if that comes at the cost of 629.28s - 636.00s | every single person's face you see ending


chunk_text:
- 568.80s | we talk about co-piloting, uh, all the features that if you are designing or developing 568.80s - 576.08s | a VR, AR, XR app, you would put in to make it more usable. But today, we're talking about 576.08s - 584.16s | something else, because I know you all here, uh, at DEF CON, uh, care about a little thing called 584.16s - 594.88s | privacy, right? And there is a very interesting tension between accessibility and privacy when it 594.88s - 604.24s | comes to XR, because there are some tools like, for example, facial recognition, that if you are 604.24s - 608.96s | blind or you have, uh, you know, prosopagnosia, which is like face blindness, the inability to 608.96s - 615.52s | remember faces, uh, or if you just have memory problems, facial recognition could be a very 615.52s - 620.88s | helpful tool, right? Being able to have a little reminder of, oh, your brother just walked into the 620.88s - 629.28s | room, oh, here comes your friend Sam, right? That's really useful. But if that comes at the cost of 629.28s - 636.00s | every single person's face you see ending up in some meta or NSA database, that cost might not 636.00s - 641.68s | really be worth it, right? So, we have to figure out how to balance these. So, I'm going to start 641.68s - 646.64s | with the good news, uh, which is that there are some really powerful uses of this assistive 646.64s - 654.88s | technology. Um, if I had my slides, which I would, uh, I would show you that, uh, you know, there's 654.88s - 662.64s | technologies like ORCam, which is a, uh, a camera that you stick onto your glasses that helps to, 662.64s - 668.96s | uh, provide things like facial recognition, um, what types of, you know, what denominations of 668.96s - 674.80s | currency do I have? What color is my shirt? What's this text in front of me? Uh, applications that are 674.80s - 682.00s | really helpful if you are blind so that you don't have to, you know, just hope that there's a braille 682.00s - 688.96s | pattern or a, uh, audio version or somebody nearby who can read it out loud to you. Uh, these types 688.96s - 697.44s | of technologies offer


chunk_text:
up in some meta or NSA database, that cost might not 636.00s - 641.68s | really be worth it, right? So, we have to figure out how to balance these. So, I'm going to start 641.68s - 646.64s | with the good news, uh, which is that there are some really powerful uses of this assistive 646.64s - 654.88s | technology. Um, if I had my slides, which I would, uh, I would show you that, uh, you know, there's 654.88s - 662.64s | technologies like ORCam, which is a, uh, a camera that you stick onto your glasses that helps to, 662.64s - 668.96s | uh, provide things like facial recognition, um, what types of, you know, what denominations of 668.96s - 674.80s | currency do I have? What color is my shirt? What's this text in front of me? Uh, applications that are 674.80s - 682.00s | really helpful if you are blind so that you don't have to, you know, just hope that there's a braille 682.00s - 688.96s | pattern or a, uh, audio version or somebody nearby who can read it out loud to you. Uh, these types 688.96s - 697.44s | of technologies offer huge levels of independence, uh, to people that, that have disabilities. Um, 697.44s - 702.72s | there's tools like Be My AIs as well coming out recently that, you know, even more questions 702.72s - 706.96s | arise from this type of thing. These are tools that let you take a photo of something and then 706.96s - 711.20s | have a conversation with a chat bot about what's in it. Uh, and if you look at YouTube, there's 711.20s - 715.76s | examples of people saying, okay, you know, what's here? Oh, well, there's a microwave on a shelf. 715.76s - 721.52s | There's a knife next to it. Okay. Where's the button for popcorn on my microwave? Oh, it's the 721.52s - 728.08s | second button down on the left, right? That is incredible. That is game changing for blind 728.08s - 733.92s | people. But again, we run into these challenges of, well, it's fantastic that the blind person 733.92s - 741.44s | has access to this data. Who else gets access to that data? Uh, other examples I have here are 741.44s - 746.16s | things like captioning glasses, right? Um, for people who are deaf


chunk_text:
huge levels of independence, uh, to people that, that have disabilities. Um, 697.44s - 702.72s | there's tools like Be My AIs as well coming out recently that, you know, even more questions 702.72s - 706.96s | arise from this type of thing. These are tools that let you take a photo of something and then 706.96s - 711.20s | have a conversation with a chat bot about what's in it. Uh, and if you look at YouTube, there's 711.20s - 715.76s | examples of people saying, okay, you know, what's here? Oh, well, there's a microwave on a shelf. 715.76s - 721.52s | There's a knife next to it. Okay. Where's the button for popcorn on my microwave? Oh, it's the 721.52s - 728.08s | second button down on the left, right? That is incredible. That is game changing for blind 728.08s - 733.92s | people. But again, we run into these challenges of, well, it's fantastic that the blind person 733.92s - 741.44s | has access to this data. Who else gets access to that data? Uh, other examples I have here are 741.44s - 746.16s | things like captioning glasses, right? Um, for people who are deaf or hard of hearing, uh, or 746.16s - 750.24s | for people who don't have English as a first language, there are captioning glasses by 750.24s - 756.80s | companies like, uh, Xander and XRAI that will listen to what's going on and present a little 756.80s - 762.08s | transcripts, uh, for you to read. Uh, and this is again, something, if you are deaf, that makes you 762.08s - 768.16s | much more independent, much more able to partake in your kind of social life, uh, talk to people. 769.36s - 774.00s | And yet who else can now read all of the conversations you're having? 775.44s - 780.80s | Um, so there are many more examples of this, right? There's, there's many more things I could 780.80s - 786.72s | describe to you about, uh, how XR can enable all of these assistive technologies, but let's take a 786.72s - 795.36s | moment to talk about the risks. So the risks here are that in order for these things to function, 796.08s - 803.36s | they basically act as little data vacuums, just sucking up, uh, either discreetly or continuously 803.36s - 808.64s | data about you


chunk_text:
or hard of hearing, uh, or 746.16s - 750.24s | for people who don't have English as a first language, there are captioning glasses by 750.24s - 756.80s | companies like, uh, Xander and XRAI that will listen to what's going on and present a little 756.80s - 762.08s | transcripts, uh, for you to read. Uh, and this is again, something, if you are deaf, that makes you 762.08s - 768.16s | much more independent, much more able to partake in your kind of social life, uh, talk to people. 769.36s - 774.00s | And yet who else can now read all of the conversations you're having? 775.44s - 780.80s | Um, so there are many more examples of this, right? There's, there's many more things I could 780.80s - 786.72s | describe to you about, uh, how XR can enable all of these assistive technologies, but let's take a 786.72s - 795.36s | moment to talk about the risks. So the risks here are that in order for these things to function, 796.08s - 803.36s | they basically act as little data vacuums, just sucking up, uh, either discreetly or continuously 803.36s - 808.64s | data about you in terms of your gaze, your motion, uh, your biometric data, your location, 809.44s - 816.48s | or data about your surroundings, you know, visual, auditory, temporal, spatial, uh, and those, 817.28s - 821.28s | as you might expect, comes with a lot of risks. Um, three of them that I'd highlight for you. 822.00s - 831.60s | First is non-consensual recording. So let's say you have a Billy who's blind, right? And he wants 831.60s - 836.64s | to be able to recognize when his friend walks in the room. So he has a facial recognition app. 837.20s - 843.28s | Now that is going to have to look at the face of everybody that walks into the room to function. 843.92s - 851.76s | Uh, now how do we stop that from now reporting about all of the different bystanders that Billy 851.76s - 856.80s | doesn't care about that did not give consent for that? How do we keep their identities safe, but 856.80s - 862.88s | still make this tool useful? Uh, you can also think about the challenges of 3D mapping, right? 862.88s - 869.12s | You know, if you are at a public university,


chunk_text:
in terms of your gaze, your motion, uh, your biometric data, your location, 809.44s - 816.48s | or data about your surroundings, you know, visual, auditory, temporal, spatial, uh, and those, 817.28s - 821.28s | as you might expect, comes with a lot of risks. Um, three of them that I'd highlight for you. 822.00s - 831.60s | First is non-consensual recording. So let's say you have a Billy who's blind, right? And he wants 831.60s - 836.64s | to be able to recognize when his friend walks in the room. So he has a facial recognition app. 837.20s - 843.28s | Now that is going to have to look at the face of everybody that walks into the room to function. 843.92s - 851.76s | Uh, now how do we stop that from now reporting about all of the different bystanders that Billy 851.76s - 856.80s | doesn't care about that did not give consent for that? How do we keep their identities safe, but 856.80s - 862.88s | still make this tool useful? Uh, you can also think about the challenges of 3D mapping, right? 862.88s - 869.12s | You know, if you are at a public university, a library or an airport, uh, it's fantastic to have 869.12s - 874.08s | a 3D map of that for your navigation applications to be able to guide you to your gate, guide you 874.08s - 879.20s | to the classroom you're going to. But let's say I, you know, I wearing my headset cause I, I did 879.20s - 884.16s | my master's thesis on this of augmented reality for visually impaired people where we're using 884.16s - 889.04s | the hollow lenses ability to map out the environment, uh, and then communicate useful 889.04s - 894.16s | things about that. Now, let's say I'm wearing this as I walk around, it's mapping the space 894.16s - 900.08s | around me. You know, if I go into my home and I map out my home, I now have a digital twin of my 900.08s - 907.36s | home. Who has access to that twin, right? Same. If I go into a private facility or a government 907.36s - 911.76s | office that they don't really take kindly to there being a bunch of 3D maps floating around 911.76s - 917.28s | on the internet. Uh, how do we keep


chunk_text:
a library or an airport, uh, it's fantastic to have 869.12s - 874.08s | a 3D map of that for your navigation applications to be able to guide you to your gate, guide you 874.08s - 879.20s | to the classroom you're going to. But let's say I, you know, I wearing my headset cause I, I did 879.20s - 884.16s | my master's thesis on this of augmented reality for visually impaired people where we're using 884.16s - 889.04s | the hollow lenses ability to map out the environment, uh, and then communicate useful 889.04s - 894.16s | things about that. Now, let's say I'm wearing this as I walk around, it's mapping the space 894.16s - 900.08s | around me. You know, if I go into my home and I map out my home, I now have a digital twin of my 900.08s - 907.36s | home. Who has access to that twin, right? Same. If I go into a private facility or a government 907.36s - 911.76s | office that they don't really take kindly to there being a bunch of 3D maps floating around 911.76s - 917.28s | on the internet. Uh, how do we keep those safe? And all of these challenges with recording are 917.28s - 923.20s | doubled or tripled in things like educational settings and healthcare settings, uh, where there 923.20s - 930.40s | are major rules and laws covering what you can and can't record. Another big risk is data 930.40s - 935.36s | retention, right? Let's say I need to pass some data up to the cloud to get processed. 936.32s - 942.48s | Is it there and then gone? Is it just held in the moment or is it parked in some big server 942.48s - 947.36s | farm somewhere? That means the organization that I've sent it to now can use it in perpetuity 947.92s - 952.48s | or, you know, until they get a data breach and now everybody has that information. 953.04s - 957.76s | Uh, wanting to make sure that when we do pass information to the cloud, that it's only held 957.76s - 962.56s | for just as long as it needs to be is really important to keeping all our privacy safe. 964.08s - 967.76s | Finally, I'm going to dip into science fiction a little bit for this one because 967.76s -


chunk_text:
those safe? And all of these challenges with recording are 917.28s - 923.20s | doubled or tripled in things like educational settings and healthcare settings, uh, where there 923.20s - 930.40s | are major rules and laws covering what you can and can't record. Another big risk is data 930.40s - 935.36s | retention, right? Let's say I need to pass some data up to the cloud to get processed. 936.32s - 942.48s | Is it there and then gone? Is it just held in the moment or is it parked in some big server 942.48s - 947.36s | farm somewhere? That means the organization that I've sent it to now can use it in perpetuity 947.92s - 952.48s | or, you know, until they get a data breach and now everybody has that information. 953.04s - 957.76s | Uh, wanting to make sure that when we do pass information to the cloud, that it's only held 957.76s - 962.56s | for just as long as it needs to be is really important to keeping all our privacy safe. 964.08s - 967.76s | Finally, I'm going to dip into science fiction a little bit for this one because 967.76s - 974.72s | I'm a guess, I'm guessing that many of you like me are giant freaking nerds. Um, you can look at 974.72s - 980.48s | things like a ghost in the shell standalone complex, for examples of perception hacking. 980.48s - 986.48s | You know, if somebody is able to hack your headset, not only are they getting a record of 986.48s - 991.44s | everything that you see in here, they could potentially be changing what you see in here. 992.00s - 998.08s | Uh, you know, in ghost in the shell, there is the laughing man who is able to block himself out of 998.08s - 1003.12s | everybody's cybernetic eyes. So nobody actually knows what he looks like. Uh, you can also look 1003.12s - 1008.40s | at black mirror, because of course there's a black mirror episode about this, uh, for there's 1008.40s - 1014.24s | an episode called men against fire, where soldiers are told they're going off to fight monsters, 1014.24s - 1021.44s | mutants, these terrible monstrous creatures. Uh, and then a little flaunt, you know, a bug in the 1021.44s - 1027.12s | software reveals to one of the soldiers, no,


chunk_text:
974.72s | I'm a guess, I'm guessing that many of you like me are giant freaking nerds. Um, you can look at 974.72s - 980.48s | things like a ghost in the shell standalone complex, for examples of perception hacking. 980.48s - 986.48s | You know, if somebody is able to hack your headset, not only are they getting a record of 986.48s - 991.44s | everything that you see in here, they could potentially be changing what you see in here. 992.00s - 998.08s | Uh, you know, in ghost in the shell, there is the laughing man who is able to block himself out of 998.08s - 1003.12s | everybody's cybernetic eyes. So nobody actually knows what he looks like. Uh, you can also look 1003.12s - 1008.40s | at black mirror, because of course there's a black mirror episode about this, uh, for there's 1008.40s - 1014.24s | an episode called men against fire, where soldiers are told they're going off to fight monsters, 1014.24s - 1021.44s | mutants, these terrible monstrous creatures. Uh, and then a little flaunt, you know, a bug in the 1021.44s - 1027.12s | software reveals to one of the soldiers, no, these are innocent civilians that you've been hunting 1027.12s - 1032.24s | down and killing. Right. And now you may say, okay, this is all well and good. If you have 1032.24s - 1036.80s | cybernetic eyes, we're a little ways away from that, but there are a lot of subtle ways that 1036.80s - 1041.84s | this could be done. You know, for example, thinking about, um, advertisers who could 1042.40s - 1048.72s | swap out billboards for their ads without you knowing, uh, thinking about political operatives 1048.72s - 1054.96s | who could maybe every time you see a politician, make them a little bit uglier or something like 1054.96s - 1062.00s | that. Right. To, to just subtly influence your perceptions. We need to be careful with who has 1062.00s - 1066.56s | access to this data, both in and out, because these are the types of possibilities they're 1066.56s - 1071.52s | going to come when more and more people start to wear these augmented reality glasses and headsets. 1073.52s - 1079.36s | So we've talked about the good, you know, how XR technology can make life better for a lot of 1079.36s - 1084.16s |


chunk_text:
these are innocent civilians that you've been hunting 1027.12s - 1032.24s | down and killing. Right. And now you may say, okay, this is all well and good. If you have 1032.24s - 1036.80s | cybernetic eyes, we're a little ways away from that, but there are a lot of subtle ways that 1036.80s - 1041.84s | this could be done. You know, for example, thinking about, um, advertisers who could 1042.40s - 1048.72s | swap out billboards for their ads without you knowing, uh, thinking about political operatives 1048.72s - 1054.96s | who could maybe every time you see a politician, make them a little bit uglier or something like 1054.96s - 1062.00s | that. Right. To, to just subtly influence your perceptions. We need to be careful with who has 1062.00s - 1066.56s | access to this data, both in and out, because these are the types of possibilities they're 1066.56s - 1071.52s | going to come when more and more people start to wear these augmented reality glasses and headsets. 1073.52s - 1079.36s | So we've talked about the good, you know, how XR technology can make life better for a lot of 1079.36s - 1084.16s | people. We've talked about the bad, some of the risks that come with it. So how do we have the 1084.16s - 1090.24s | best of both worlds? Well, again, I'm going to start with three because I only got half an hour 1090.24s - 1097.92s | here. Um, the first one is on device processing. So doing as much as you can on the device and not 1097.92s - 1103.44s | in the cloud. Uh, the vision pro actually has a pretty good policy about this for now, at least, 1103.44s - 1110.24s | uh, where the pro acts as a gatekeeper between the data that is coming in from your sensors 1110.80s - 1116.64s | and the apps that might want to use that data. Right. So it's not just like every single app 1116.64s - 1121.84s | has full access to all your cameras and everything. It only get access to what it 1121.84s - 1127.52s | needs in order to function. There's all those things like, uh, the, the optic ID it uses for 1127.52s - 1133.68s | authentication is stored on device because as we know, uh, once your biometric data gets into the 1133.68s


chunk_text:
people. We've talked about the bad, some of the risks that come with it. So how do we have the 1084.16s - 1090.24s | best of both worlds? Well, again, I'm going to start with three because I only got half an hour 1090.24s - 1097.92s | here. Um, the first one is on device processing. So doing as much as you can on the device and not 1097.92s - 1103.44s | in the cloud. Uh, the vision pro actually has a pretty good policy about this for now, at least, 1103.44s - 1110.24s | uh, where the pro acts as a gatekeeper between the data that is coming in from your sensors 1110.80s - 1116.64s | and the apps that might want to use that data. Right. So it's not just like every single app 1116.64s - 1121.84s | has full access to all your cameras and everything. It only get access to what it 1121.84s - 1127.52s | needs in order to function. There's all those things like, uh, the, the optic ID it uses for 1127.52s - 1133.68s | authentication is stored on device because as we know, uh, once your biometric data gets into the 1133.68s - 1138.88s | cloud, it's a little harder to change than a password. Uh, there's a really great paper on 1138.88s - 1147.76s | this called bystand AR, uh, by Corbett and his team, um, that talks about this idea of, uh, 1147.76s - 1155.20s | basically automatically filtering out all bystanders from a scene. You know, you have the 1155.20s - 1161.20s | camera, the camera input coming through, uh, it identifies all the faces and blurs all of them out 1161.20s - 1166.32s | before it gets to a third party, except for the person you're talking to, right? There's a certain 1166.32s - 1172.80s | threshold, uh, where between eye contact, voice communication, and other clues that tell you this 1172.80s - 1179.04s | is the single person I'm interacting with. That one person gets their face and other information 1179.04s - 1186.32s | sent off in order to get info about everybody else. It's kept private. Uh, data transparency 1186.32s - 1191.20s | and control is another big one. We're talking about your right to know what is being collected 1191.20s - 1197.84s | and for what purpose, you know, are AIs being trained on my


chunk_text:
- 1138.88s | cloud, it's a little harder to change than a password. Uh, there's a really great paper on 1138.88s - 1147.76s | this called bystand AR, uh, by Corbett and his team, um, that talks about this idea of, uh, 1147.76s - 1155.20s | basically automatically filtering out all bystanders from a scene. You know, you have the 1155.20s - 1161.20s | camera, the camera input coming through, uh, it identifies all the faces and blurs all of them out 1161.20s - 1166.32s | before it gets to a third party, except for the person you're talking to, right? There's a certain 1166.32s - 1172.80s | threshold, uh, where between eye contact, voice communication, and other clues that tell you this 1172.80s - 1179.04s | is the single person I'm interacting with. That one person gets their face and other information 1179.04s - 1186.32s | sent off in order to get info about everybody else. It's kept private. Uh, data transparency 1186.32s - 1191.20s | and control is another big one. We're talking about your right to know what is being collected 1191.20s - 1197.84s | and for what purpose, you know, are AIs being trained on my gaze information, uh, control access 1197.84s - 1202.08s | to your data and revoke it when necessary, and to make sure that your data gets deleted when it's 1202.08s - 1207.12s | no longer needed. Now, if you're from Europe, congratulations, you have the GDPR and that 1207.12s - 1214.58s | protects you from a lot of this stuff. If you're in the US, anyway, there's a great, uh, great paper 1214.58s - 1220.66s | by, uh, Elise Dick of the Information Technology and Innovation Foundation a few years ago, uh, 1220.66s - 1225.46s | that lays out some of the things that ought to be done on this, uh, for kind of policymakers, 1225.46s - 1229.54s | lawmakers. So if you're interested, uh, I have that reference, I will happily send it to you. 1230.82s - 1236.26s | Uh, and finally, because I think I just have a few minutes left here, consent. You know, consent is 1236.26s - 1242.18s | the oldest and best way of protecting privacy, right? You consent to be recorded, you consent 1242.18s - 1248.90s | to having your data used in order to help disabled people navigate the world. Um, there's a lot


chunk_text:
gaze information, uh, control access 1197.84s - 1202.08s | to your data and revoke it when necessary, and to make sure that your data gets deleted when it's 1202.08s - 1207.12s | no longer needed. Now, if you're from Europe, congratulations, you have the GDPR and that 1207.12s - 1214.58s | protects you from a lot of this stuff. If you're in the US, anyway, there's a great, uh, great paper 1214.58s - 1220.66s | by, uh, Elise Dick of the Information Technology and Innovation Foundation a few years ago, uh, 1220.66s - 1225.46s | that lays out some of the things that ought to be done on this, uh, for kind of policymakers, 1225.46s - 1229.54s | lawmakers. So if you're interested, uh, I have that reference, I will happily send it to you. 1230.82s - 1236.26s | Uh, and finally, because I think I just have a few minutes left here, consent. You know, consent is 1236.26s - 1242.18s | the oldest and best way of protecting privacy, right? You consent to be recorded, you consent 1242.18s - 1248.90s | to having your data used in order to help disabled people navigate the world. Um, there's a lot of 1248.90s - 1253.14s | conversation about how to get consent in a feasible manner, right? Because, you know, if I 1253.14s - 1256.74s | had a headset on right now, I couldn't just walk around and ask every single one of you, hey, can I 1256.74s - 1263.86s | use this? Um, but you could imagine a scenario where, for example, uh, somebody's in a hospital 1263.86s - 1269.30s | and all of the doctors and nurses have some type of token, you know, like a QR code they wear on 1269.30s - 1276.50s | their shirt or something else that a headset could recognize and say, ah, these people have opted in 1276.50s - 1282.58s | to facial recognition. It's okay to tell them, you know, tell the person using the headset their 1282.58s - 1287.22s | name and their info and all of that. Um, there's a lot of interesting models around that. We don't 1287.22s - 1293.06s | have time to get into them now, but, uh, again, making sure that we have systems in place that 1293.06s - 1300.50s | know who has and who hasn't consented to having their information recorded, uh, is going


chunk_text:
of 1248.90s - 1253.14s | conversation about how to get consent in a feasible manner, right? Because, you know, if I 1253.14s - 1256.74s | had a headset on right now, I couldn't just walk around and ask every single one of you, hey, can I 1256.74s - 1263.86s | use this? Um, but you could imagine a scenario where, for example, uh, somebody's in a hospital 1263.86s - 1269.30s | and all of the doctors and nurses have some type of token, you know, like a QR code they wear on 1269.30s - 1276.50s | their shirt or something else that a headset could recognize and say, ah, these people have opted in 1276.50s - 1282.58s | to facial recognition. It's okay to tell them, you know, tell the person using the headset their 1282.58s - 1287.22s | name and their info and all of that. Um, there's a lot of interesting models around that. We don't 1287.22s - 1293.06s | have time to get into them now, but, uh, again, making sure that we have systems in place that 1293.06s - 1300.50s | know who has and who hasn't consented to having their information recorded, uh, is going to be 1300.50s - 1309.14s | vital as we go forward. So, that is, uh, XR accessibility and privacy in a nutshell. Um, I 1309.14s - 1312.34s | really want to thank you all for coming. I want to thank, uh, you all for having me. This is my 1312.34s - 1319.46s | first time at DEF CON. Uh, it is a weird and wonderful place. Um, and I would love to take 1319.46s - 1328.75s | a few questions in the time we have left. I see you all just came here to get comfy. 1329.39s - 1333.79s | All right. Well, if anybody has any, uh, feel free to come talk to me. Uh, you can reach us 1333.79s - 1344.43s | at xraccess.org. That's X-R-A-C-C-E-S-S dot O-R-G. Um, we have, uh, some really great resources. We 1344.43s - 1350.03s | have a research network. If you're doing research into these related topics, definitely reach out 1350.03s - 1355.87s | to us because we want to shine a spotlight on you. Um, because it takes all of us coming together 1356.11s - 1362.11s | to solve these problems. We need the tech companies. We need the legislators. We


chunk_text:
to be 1300.50s - 1309.14s | vital as we go forward. So, that is, uh, XR accessibility and privacy in a nutshell. Um, I 1309.14s - 1312.34s | really want to thank you all for coming. I want to thank, uh, you all for having me. This is my 1312.34s - 1319.46s | first time at DEF CON. Uh, it is a weird and wonderful place. Um, and I would love to take 1319.46s - 1328.75s | a few questions in the time we have left. I see you all just came here to get comfy. 1329.39s - 1333.79s | All right. Well, if anybody has any, uh, feel free to come talk to me. Uh, you can reach us 1333.79s - 1344.43s | at xraccess.org. That's X-R-A-C-C-E-S-S dot O-R-G. Um, we have, uh, some really great resources. We 1344.43s - 1350.03s | have a research network. If you're doing research into these related topics, definitely reach out 1350.03s - 1355.87s | to us because we want to shine a spotlight on you. Um, because it takes all of us coming together 1356.11s - 1362.11s | to solve these problems. We need the tech companies. We need the legislators. We need 1362.11s - 1367.55s | the watchdogs. We need the disabled people and we need all of you with your expertise. 1367.55s - 1370.67s | Uh, so I think we'll end it there and thanks so much.


chunk_text:
need 1362.11s - 1367.55s | the watchdogs. We need the disabled people and we need all of you with your expertise. 1367.55s - 1370.67s | Uh, so I think we'll end it there and thanks so much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=TuAZXkMCgXI", "title": "DEF CON 32 - How State Laws Meant to Protect Children Raise Other Risks - Anthony Hendricks", "description": "On February 25, 1998, hip-hop group the Wu-Tang Clan made Grammy history\u2026 for all the wrong reasons. After losing in the Rap Album of the Year category, Wu-Tang member ODB stormed the stage, interrupting an acceptance speech to declare the now infamous phrase \u201cWu-Tang is for the children.\u201d Anyone who has heard a song from Wu-Tang knows that despite ODB\u2019s insistence, it is certainly not true. It appears that States may be taking this same approach when it comes to children's privacy and safety online. Despite these laws being for the protection of children, they often raise other unintended consequences. State legislatures around the country are debating new laws to protect children online. This year, Tennessee, Maryland, Virginia, Georgia, Utah, and Florida have passed legislation focused on children's privacy, usually through restrictions on social media use. While privacy advocates have championed these laws, they have been met with criticism and, in some instances, legal challenges. This is because in order to implement laws that apply to kids online, companies have to identify which users are kids\u2014which requires the collection of sensitive personal information. Along with this privacy tension, there are First Amendment protection concerns that these laws limit online speech. This presentation will explore how youth privacy laws may not be protecting children in the ways that we hope by first discussing the attempts made by states to address youth privacy. Then, analyzing the unintended privacy consequences, focusing on how states are required to collect sensitive information that we are often trying to protect. Next, we will examine the First Amendment concerns using the example of the challenges to California\u2019s Age Appropriate Design Code Act before finally discussing a path forward to protecting children.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1319, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 1.28s | This text was transcribed using whisper model: large-v2 Good afternoon, everyone. 1.28s - 5.84s | I am so excited to be here to be presenting Wu-Tang is for the Children, 5.84s - 11.52s | How State Laws Intended to Protect Children Raise Unintended Risk and Consequences. 11.52s - 12.80s | My name is Anthony Hendricks. 12.80s - 17.28s | I'm a cybersecurity and data privacy attorney based in Oklahoma City. 17.28s - 21.92s | While I am a lawyer,


chunk_text:
collection of sensitive personal information. Along with this privacy tension, there are First Amendment protection concerns that these laws limit online speech. This presentation will explore how youth privacy laws may not be protecting children in the ways that we hope by first discussing the attempts made by states to address youth privacy. Then, analyzing the unintended privacy consequences, focusing on how states are required to collect sensitive information that we are often trying to protect. Next, we will examine the First Amendment concerns using the example of the challenges to California\u2019s Age Appropriate Design Code Act before finally discussing a path forward to protecting children.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1319, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 1.28s | This text was transcribed using whisper model: large-v2 Good afternoon, everyone. 1.28s - 5.84s | I am so excited to be here to be presenting Wu-Tang is for the Children, 5.84s - 11.52s | How State Laws Intended to Protect Children Raise Unintended Risk and Consequences. 11.52s - 12.80s | My name is Anthony Hendricks. 12.80s - 17.28s | I'm a cybersecurity and data privacy attorney based in Oklahoma City. 17.28s - 21.92s | While I am a lawyer, I am not your lawyer, and this presentation should not be considered 21.92s - 23.12s | legal advice. 23.12s - 27.04s | Instead, think of this as a conversation between friends. 27.04s - 32.48s | But if you need legal advice, please, please, please find a local lawyer that can help you. 33.68s - 39.52s | I also host a cybersecurity podcast that focuses on exposing underrepresented groups to the field 39.52s - 42.00s | of cybersecurity and data privacy. 42.00s - 46.16s | You can scan the QR code, and it will take you to the podcast, or you can find the podcast 46.16s - 48.40s | anywhere where great podcasts are found. 49.76s - 52.80s | So let's go back to 1998. 52.80s - 59.68s | So on February 25, 1998, hip-hop group Wu-Tang Clan made Grammy history for all the wrong 59.68s - 60.72s | reasons. 60.72s - 65.84s | After the Wu-Tang Clan lost Best Rap Album of the Year category, Wu-Tang Clan member 65.84s - 72.64s | ODB jumped on stage and said the infamous phrase, Wu-Tang is for the children. 72.64s - 77.52s | Now, if you're not familiar with the Wu-Tang Clan and


chunk_text:
I am not your lawyer, and this presentation should not be considered 21.92s - 23.12s | legal advice. 23.12s - 27.04s | Instead, think of this as a conversation between friends. 27.04s - 32.48s | But if you need legal advice, please, please, please find a local lawyer that can help you. 33.68s - 39.52s | I also host a cybersecurity podcast that focuses on exposing underrepresented groups to the field 39.52s - 42.00s | of cybersecurity and data privacy. 42.00s - 46.16s | You can scan the QR code, and it will take you to the podcast, or you can find the podcast 46.16s - 48.40s | anywhere where great podcasts are found. 49.76s - 52.80s | So let's go back to 1998. 52.80s - 59.68s | So on February 25, 1998, hip-hop group Wu-Tang Clan made Grammy history for all the wrong 59.68s - 60.72s | reasons. 60.72s - 65.84s | After the Wu-Tang Clan lost Best Rap Album of the Year category, Wu-Tang Clan member 65.84s - 72.64s | ODB jumped on stage and said the infamous phrase, Wu-Tang is for the children. 72.64s - 77.52s | Now, if you're not familiar with the Wu-Tang Clan and the Wu-Tang Clan's lyrics, I just 77.52s - 81.12s | pulled a quick sampling that I want to share with the group, if that's OK. 81.76s - 84.24s | Watch your stepkid and protect your neck. 84.24s - 86.40s | Cash rules everything around me. 86.40s - 87.52s | Cream, get your money. 87.52s - 88.72s | Dollar, dollar bills, y'all. 89.28s - 91.44s | If you want beef, then bring the ruckus. 91.44s - 94.80s | Wu-Tang Clan ain't nothing to, well, you get the point. 96.80s - 99.76s | So Wu-Tang Clan is not for the children. 99.76s - 105.76s | Despite what ODB says, their lyrics really aren't things you should be playing for kids. 105.76s - 109.76s | And it appears that states are taking the same kind of Wu-Tang Clan approach when it 109.76s - 111.20s | comes to state privacy. 111.20s - 115.52s | While they have all of these kind of laws that are focused on protecting children, when 115.52s - 119.76s | you start paying attention to what these laws are doing, you realize that they're raising 119.76s - 121.92s | a lot of privacy risk. 121.92s - 125.36s | And they're


chunk_text:
the Wu-Tang Clan's lyrics, I just 77.52s - 81.12s | pulled a quick sampling that I want to share with the group, if that's OK. 81.76s - 84.24s | Watch your stepkid and protect your neck. 84.24s - 86.40s | Cash rules everything around me. 86.40s - 87.52s | Cream, get your money. 87.52s - 88.72s | Dollar, dollar bills, y'all. 89.28s - 91.44s | If you want beef, then bring the ruckus. 91.44s - 94.80s | Wu-Tang Clan ain't nothing to, well, you get the point. 96.80s - 99.76s | So Wu-Tang Clan is not for the children. 99.76s - 105.76s | Despite what ODB says, their lyrics really aren't things you should be playing for kids. 105.76s - 109.76s | And it appears that states are taking the same kind of Wu-Tang Clan approach when it 109.76s - 111.20s | comes to state privacy. 111.20s - 115.52s | While they have all of these kind of laws that are focused on protecting children, when 115.52s - 119.76s | you start paying attention to what these laws are doing, you realize that they're raising 119.76s - 121.92s | a lot of privacy risk. 121.92s - 125.36s | And they're not doing what they say they're going to be doing, which is protecting children. 127.12s - 129.60s | So what exactly are we going to chat about today? 129.60s - 133.92s | So we're going to first start talking about children's privacy and safety laws. 133.92s - 136.64s | We'll then talk about how states are taking the lead. 136.72s - 139.20s | We'll then look at some unintended consequences. 139.20s - 143.52s | And then finally, we'll talk about some of my favorite Wu-Tang Clan songs and talk about 143.52s - 145.28s | ways that we can grow together. 145.28s - 146.16s | Does that sound good? 146.96s - 147.92s | All right, let's go. 148.80s - 151.84s | So children, privacy, and safety. 151.84s - 154.56s | So we're going to stay in 1998. 154.56s - 159.44s | And we're going to talk about Congress passing COPA, which is the Children's Online Privacy 159.44s - 160.32s | Protection Act. 160.88s - 165.92s | And this law protects children under the age of 18 requiring certain disclosures. 167.60s - 170.24s | So what led up to the creation of this federal law? 170.24s - 175.20s | So as people


chunk_text:
not doing what they say they're going to be doing, which is protecting children. 127.12s - 129.60s | So what exactly are we going to chat about today? 129.60s - 133.92s | So we're going to first start talking about children's privacy and safety laws. 133.92s - 136.64s | We'll then talk about how states are taking the lead. 136.72s - 139.20s | We'll then look at some unintended consequences. 139.20s - 143.52s | And then finally, we'll talk about some of my favorite Wu-Tang Clan songs and talk about 143.52s - 145.28s | ways that we can grow together. 145.28s - 146.16s | Does that sound good? 146.96s - 147.92s | All right, let's go. 148.80s - 151.84s | So children, privacy, and safety. 151.84s - 154.56s | So we're going to stay in 1998. 154.56s - 159.44s | And we're going to talk about Congress passing COPA, which is the Children's Online Privacy 159.44s - 160.32s | Protection Act. 160.88s - 165.92s | And this law protects children under the age of 18 requiring certain disclosures. 167.60s - 170.24s | So what led up to the creation of this federal law? 170.24s - 175.20s | So as people started getting on the internet, people had so many concerns about how we are 175.20s - 176.88s | going to protect our children. 176.88s - 182.24s | And so the Children's Advertising Review Unit, which is an industry group, drafted some guidelines 182.24s - 185.76s | on what they thought the industry should be doing to protect children. 185.76s - 188.72s | And so when you think about COPA, COPA was a remix. 188.72s - 194.64s | What they did is they took that industry kind of guidelines, and they turned it into legislation. 196.72s - 202.40s | So in 2013, COPA's rules were updated to kind of broaden the definition of children. 202.40s - 208.40s | And in 2017, the rules were updated again so that it applied to IoT devices, the internet 208.40s - 208.96s | of things. 210.40s - 211.44s | So problem solved. 211.44s - 212.88s | Why exactly are we here? 213.52s - 215.84s | Why am I taking up some of your time today? 215.84s - 223.28s | Well, COPA hasn't really been updated much besides 2013 and 2017. 223.28s - 228.32s | And our current laws weren't created to address how we actually


chunk_text:
started getting on the internet, people had so many concerns about how we are 175.20s - 176.88s | going to protect our children. 176.88s - 182.24s | And so the Children's Advertising Review Unit, which is an industry group, drafted some guidelines 182.24s - 185.76s | on what they thought the industry should be doing to protect children. 185.76s - 188.72s | And so when you think about COPA, COPA was a remix. 188.72s - 194.64s | What they did is they took that industry kind of guidelines, and they turned it into legislation. 196.72s - 202.40s | So in 2013, COPA's rules were updated to kind of broaden the definition of children. 202.40s - 208.40s | And in 2017, the rules were updated again so that it applied to IoT devices, the internet 208.40s - 208.96s | of things. 210.40s - 211.44s | So problem solved. 211.44s - 212.88s | Why exactly are we here? 213.52s - 215.84s | Why am I taking up some of your time today? 215.84s - 223.28s | Well, COPA hasn't really been updated much besides 2013 and 2017. 223.28s - 228.32s | And our current laws weren't created to address how we actually use the internet right now, 228.32s - 228.56s | right? 228.56s - 233.76s | And so other countries have passed laws that focused on children, and our laws look just 233.76s - 234.80s | simply out of date. 237.15s - 241.47s | One of the issues with our current laws is what exactly is a child, right? 241.47s - 245.07s | If I just asked a person on the street what a child was, they'd quickly tell me someone 245.07s - 246.67s | under the age of 18. 246.67s - 251.47s | But in COPA, they define a child as a person under the age of 13. 251.47s - 254.03s | So the law doesn't even look after teenagers. 254.03s - 258.51s | And so that leads to some issues with gaps in the law because we're not protecting our 258.51s - 262.91s | teenagers who are often more vulnerable because they are online all the time. 264.75s - 269.31s | Also, there's been a lot of talk about protecting our children, but not much action. 269.31s - 273.71s | For three years in a row, President Biden in the State of the Union starts to talk about 273.71s -


chunk_text:
use the internet right now, 228.32s - 228.56s | right? 228.56s - 233.76s | And so other countries have passed laws that focused on children, and our laws look just 233.76s - 234.80s | simply out of date. 237.15s - 241.47s | One of the issues with our current laws is what exactly is a child, right? 241.47s - 245.07s | If I just asked a person on the street what a child was, they'd quickly tell me someone 245.07s - 246.67s | under the age of 18. 246.67s - 251.47s | But in COPA, they define a child as a person under the age of 13. 251.47s - 254.03s | So the law doesn't even look after teenagers. 254.03s - 258.51s | And so that leads to some issues with gaps in the law because we're not protecting our 258.51s - 262.91s | teenagers who are often more vulnerable because they are online all the time. 264.75s - 269.31s | Also, there's been a lot of talk about protecting our children, but not much action. 269.31s - 273.71s | For three years in a row, President Biden in the State of the Union starts to talk about 273.71s - 274.91s | children's privacy. 274.91s - 279.31s | And he talks about how we need to strengthen privacy protection, how we need to stop big 279.31s - 282.75s | tech from collecting personal data on kids and teenagers online. 283.95s - 288.03s | And he always has those phrases, but nothing has really come from it. 289.15s - 293.55s | And there's been a number of laws that people have been debating, including the Kids Online 293.55s - 298.51s | Safety, the Teens Online Privacy Act, and COPA 2.0. 298.51s - 301.63s | So there's been a lot of conversations about protecting our children. 303.07s - 308.43s | So I was done with my slides, and then the Senate wanted to start doing stuff. 308.59s - 315.07s | And so the Senate began debating COSA and COPA, and they passed both of those laws, 315.07s - 315.31s | right? 315.31s - 318.35s | They passed it by wide margins, 91 to 3. 318.35s - 321.31s | So it got a lot of bipartisan support. 321.31s - 323.55s | So let's talk about those laws. 323.55s - 329.15s | So COSA would require social media companies to protect users under age


chunk_text:
274.91s | children's privacy. 274.91s - 279.31s | And he talks about how we need to strengthen privacy protection, how we need to stop big 279.31s - 282.75s | tech from collecting personal data on kids and teenagers online. 283.95s - 288.03s | And he always has those phrases, but nothing has really come from it. 289.15s - 293.55s | And there's been a number of laws that people have been debating, including the Kids Online 293.55s - 298.51s | Safety, the Teens Online Privacy Act, and COPA 2.0. 298.51s - 301.63s | So there's been a lot of conversations about protecting our children. 303.07s - 308.43s | So I was done with my slides, and then the Senate wanted to start doing stuff. 308.59s - 315.07s | And so the Senate began debating COSA and COPA, and they passed both of those laws, 315.07s - 315.31s | right? 315.31s - 318.35s | They passed it by wide margins, 91 to 3. 318.35s - 321.31s | So it got a lot of bipartisan support. 321.31s - 323.55s | So let's talk about those laws. 323.55s - 329.15s | So COSA would require social media companies to protect users under age 17. 329.15s - 333.31s | So it kind of expands that definition to include more and more people. 333.31s - 337.79s | It will require companies to provide guardians with more controls over minors' use 337.79s - 338.91s | on those platforms. 339.47s - 344.43s | COPA 2.0 would also create stronger online privacy protections for our teenagers. 345.79s - 347.07s | So good job. 347.07s - 347.79s | Problem solved. 347.79s - 349.47s | Why exactly are we still here? 350.19s - 353.15s | Well, it still has to be passed by the House. 353.15s - 357.07s | And the House is on vacation, and not the types of vacations that we take. 357.07s - 359.95s | I'm talking about a six-week vacation. 359.95s - 365.07s | And so we're not really going to have anything done by the House in a couple of months. 365.07s - 367.31s | And so we're still facing these issues. 368.03s - 372.03s | So let's start talking about how states are taking the lead. 372.03s - 375.55s | When the federal government fails to act, our states start acting. 376.67s - 380.51s | So if you're going to have any conversation about


chunk_text:
17. 329.15s - 333.31s | So it kind of expands that definition to include more and more people. 333.31s - 337.79s | It will require companies to provide guardians with more controls over minors' use 337.79s - 338.91s | on those platforms. 339.47s - 344.43s | COPA 2.0 would also create stronger online privacy protections for our teenagers. 345.79s - 347.07s | So good job. 347.07s - 347.79s | Problem solved. 347.79s - 349.47s | Why exactly are we still here? 350.19s - 353.15s | Well, it still has to be passed by the House. 353.15s - 357.07s | And the House is on vacation, and not the types of vacations that we take. 357.07s - 359.95s | I'm talking about a six-week vacation. 359.95s - 365.07s | And so we're not really going to have anything done by the House in a couple of months. 365.07s - 367.31s | And so we're still facing these issues. 368.03s - 372.03s | So let's start talking about how states are taking the lead. 372.03s - 375.55s | When the federal government fails to act, our states start acting. 376.67s - 380.51s | So if you're going to have any conversation about states and privacy, you have to start 380.51s - 383.95s | with California, because they're often the leader when it comes to privacy. 384.91s - 389.23s | In 2022, California passed the Age-Appropriate Design Code. 389.23s - 394.11s | And that law required digital platforms to kind of determine whether their product was 394.11s - 399.31s | targeting towards children, and to assess the type of risk of harm when it comes to 399.31s - 399.79s | children. 401.15s - 403.47s | And other states have gotten into the mix. 403.47s - 408.67s | Last year, 35 states, along with Puerto Rico, started debating proposed laws. 409.31s - 411.15s | And this year, it still continues. 411.15s - 415.95s | 12 state legislatures have pending legislation where they're talking about this. 415.95s - 421.31s | And these proposed laws range from bans on social media for children, to restrictions, 422.11s - 425.47s | to not allowing companies to have targeted ads towards children. 427.23s - 430.27s | So what exactly do these laws look like? 430.27s - 435.23s | So I threw them in a couple of different buckets so that we can talk about them just all together. 435.23s


chunk_text:
states and privacy, you have to start 380.51s - 383.95s | with California, because they're often the leader when it comes to privacy. 384.91s - 389.23s | In 2022, California passed the Age-Appropriate Design Code. 389.23s - 394.11s | And that law required digital platforms to kind of determine whether their product was 394.11s - 399.31s | targeting towards children, and to assess the type of risk of harm when it comes to 399.31s - 399.79s | children. 401.15s - 403.47s | And other states have gotten into the mix. 403.47s - 408.67s | Last year, 35 states, along with Puerto Rico, started debating proposed laws. 409.31s - 411.15s | And this year, it still continues. 411.15s - 415.95s | 12 state legislatures have pending legislation where they're talking about this. 415.95s - 421.31s | And these proposed laws range from bans on social media for children, to restrictions, 422.11s - 425.47s | to not allowing companies to have targeted ads towards children. 427.23s - 430.27s | So what exactly do these laws look like? 430.27s - 435.23s | So I threw them in a couple of different buckets so that we can talk about them just all together. 435.23s - 438.19s | So there are some that include just social media bans. 438.19s - 440.51s | So Montana says, hey, we're going to ban TikTok. 440.51s - 441.79s | No TikTok for anyone. 442.43s - 445.95s | Utah and Arkansas ban minors from using social media altogether. 445.95s - 448.43s | If you're under a certain age, you can't get online. 449.07s - 452.67s | Then there are other states that have just age restrictions. 452.67s - 455.23s | And so Arkansas has an age restriction law. 455.23s - 460.59s | Louisiana and Utah, where you're under the age of 13, you're not able to use these social 460.59s - 461.39s | media companies. 463.47s - 468.35s | Another category is restrictions on features, where they say, hey, certain features are 468.35s - 471.95s | not allowed to be used if the user is a child. 471.95s - 474.83s | And so usually it's related to targeted ads. 474.83s - 479.07s | And then there are bans on collecting minors information, where you can't collect certain 479.07s - 480.19s | information about kids. 482.67s - 484.03s | So problem solved, right? 484.03s - 485.47s | We're done. 485.47s -


chunk_text:
- 438.19s | So there are some that include just social media bans. 438.19s - 440.51s | So Montana says, hey, we're going to ban TikTok. 440.51s - 441.79s | No TikTok for anyone. 442.43s - 445.95s | Utah and Arkansas ban minors from using social media altogether. 445.95s - 448.43s | If you're under a certain age, you can't get online. 449.07s - 452.67s | Then there are other states that have just age restrictions. 452.67s - 455.23s | And so Arkansas has an age restriction law. 455.23s - 460.59s | Louisiana and Utah, where you're under the age of 13, you're not able to use these social 460.59s - 461.39s | media companies. 463.47s - 468.35s | Another category is restrictions on features, where they say, hey, certain features are 468.35s - 471.95s | not allowed to be used if the user is a child. 471.95s - 474.83s | And so usually it's related to targeted ads. 474.83s - 479.07s | And then there are bans on collecting minors information, where you can't collect certain 479.07s - 480.19s | information about kids. 482.67s - 484.03s | So problem solved, right? 484.03s - 485.47s | We're done. 485.47s - 489.95s | Well, these state laws are talking about children's privacy and online safety. 489.95s - 491.63s | So we should be good to go, right? 492.99s - 494.19s | Not exactly. 494.19s - 495.95s | And then the lawsuits happened. 495.95s - 497.87s | Lots and lots of lawsuits. 498.67s - 502.75s | So federal courts have granted preliminary injunctions that blocked laws in Arkansas, 502.75s - 503.95s | California, and Texas. 504.83s - 509.23s | And so there are a lot of lawsuits that are saying, hey, these laws that are intended 509.23s - 512.35s | for children really raise unintended consequences. 512.35s - 514.51s | They create a lot of problems. 515.31s - 517.15s | So let's talk about those consequences. 517.15s - 519.39s | Let's talk about those problems with these laws. 521.60s - 526.24s | If you are going to create a law that protects children, you got to know who's a child, right? 526.24s - 528.80s | You got to know who's a child and who's an adult. 528.80s - 533.28s | And while the goal is more protection for children, it comes with two big costs. 533.28s - 538.32s | It comes with


chunk_text:
489.95s | Well, these state laws are talking about children's privacy and online safety. 489.95s - 491.63s | So we should be good to go, right? 492.99s - 494.19s | Not exactly. 494.19s - 495.95s | And then the lawsuits happened. 495.95s - 497.87s | Lots and lots of lawsuits. 498.67s - 502.75s | So federal courts have granted preliminary injunctions that blocked laws in Arkansas, 502.75s - 503.95s | California, and Texas. 504.83s - 509.23s | And so there are a lot of lawsuits that are saying, hey, these laws that are intended 509.23s - 512.35s | for children really raise unintended consequences. 512.35s - 514.51s | They create a lot of problems. 515.31s - 517.15s | So let's talk about those consequences. 517.15s - 519.39s | Let's talk about those problems with these laws. 521.60s - 526.24s | If you are going to create a law that protects children, you got to know who's a child, right? 526.24s - 528.80s | You got to know who's a child and who's an adult. 528.80s - 533.28s | And while the goal is more protection for children, it comes with two big costs. 533.28s - 538.32s | It comes with a cost related to our privacy and a cost related to our First Amendment 538.32s - 538.80s | rights. 541.09s - 546.29s | So these laws require companies to provide additional protections for minors. 546.29s - 549.41s | And so you need to find out who exactly is a kid. 549.41s - 553.25s | And you do this by requiring age verifications, right? 553.81s - 557.25s | And so we've probably all kind of seen these things where it's online. 557.25s - 559.81s | Please verify that you're over the age of 18. 560.53s - 562.77s | But these state laws are asking for more. 562.77s - 569.89s | They're usually asking for third party verifications or even some weird stuff like age estimations. 569.89s - 571.17s | And so that's really weird. 571.17s - 572.61s | And we'll talk about that for a moment. 574.05s - 575.89s | So third party verifications. 575.89s - 579.25s | This is when a third party is used to verify someone's age. 579.25s - 583.65s | So this can be something like, hey, take a picture of your ID so that we can show that 583.65s - 585.57s | you are over the


chunk_text:
a cost related to our privacy and a cost related to our First Amendment 538.32s - 538.80s | rights. 541.09s - 546.29s | So these laws require companies to provide additional protections for minors. 546.29s - 549.41s | And so you need to find out who exactly is a kid. 549.41s - 553.25s | And you do this by requiring age verifications, right? 553.81s - 557.25s | And so we've probably all kind of seen these things where it's online. 557.25s - 559.81s | Please verify that you're over the age of 18. 560.53s - 562.77s | But these state laws are asking for more. 562.77s - 569.89s | They're usually asking for third party verifications or even some weird stuff like age estimations. 569.89s - 571.17s | And so that's really weird. 571.17s - 572.61s | And we'll talk about that for a moment. 574.05s - 575.89s | So third party verifications. 575.89s - 579.25s | This is when a third party is used to verify someone's age. 579.25s - 583.65s | So this can be something like, hey, take a picture of your ID so that we can show that 583.65s - 585.57s | you are over the age of 18. 585.57s - 587.25s | Or, hey, use your credit card. 587.25s - 591.89s | Put your credit card information in and we'll know that you are over the age of 18 because 591.89s - 592.85s | you have a credit card. 593.49s - 599.01s | Other sites require users to sign up for other third party software where you put in your 599.01s - 599.97s | information for them. 599.97s - 601.01s | You get an account. 601.01s - 605.41s | And then they say, hey, just give us the information from your account and we can verify how old 605.41s - 605.81s | you are. 607.57s - 613.17s | Another way, which is a little bit weirder, companies attempt to guess a user's age. 613.17s - 619.33s | And so this can be done by turning on your camera and having facial recognition guess 619.33s - 621.65s | if you are over the age of 18. 621.65s - 623.41s | That sounds a little creepy, doesn't it? 624.21s - 629.89s | Others have suggested that a user's age can be guessed based on their online activities. 629.89s - 635.17s | So they'll kind of look at


chunk_text:
age of 18. 585.57s - 587.25s | Or, hey, use your credit card. 587.25s - 591.89s | Put your credit card information in and we'll know that you are over the age of 18 because 591.89s - 592.85s | you have a credit card. 593.49s - 599.01s | Other sites require users to sign up for other third party software where you put in your 599.01s - 599.97s | information for them. 599.97s - 601.01s | You get an account. 601.01s - 605.41s | And then they say, hey, just give us the information from your account and we can verify how old 605.41s - 605.81s | you are. 607.57s - 613.17s | Another way, which is a little bit weirder, companies attempt to guess a user's age. 613.17s - 619.33s | And so this can be done by turning on your camera and having facial recognition guess 619.33s - 621.65s | if you are over the age of 18. 621.65s - 623.41s | That sounds a little creepy, doesn't it? 624.21s - 629.89s | Others have suggested that a user's age can be guessed based on their online activities. 629.89s - 635.17s | So they'll kind of look at what website you're going to to determine if you are an adult. 637.25s - 638.45s | So what's the problem? 638.45s - 640.29s | What is the exact problem with this? 640.29s - 644.77s | Well, it's too much information and too little information. 644.77s - 649.01s | So people have to give even more information to companies. 649.01s - 651.49s | You have to give them your ID, your credit card. 651.49s - 654.85s | You have to give them access to your online activities. 654.85s - 659.49s | Does anybody feel comfortable with giving more and more information to companies? 660.13s - 663.25s | But also, there are some people who don't have that information. 663.25s - 667.25s | If you don't have a credit card, it means that you can't get on social media. 667.97s - 673.25s | If you don't have an ID, it means that, well, you can't get on to any of these websites. 673.25s - 676.77s | And so there's a problem with too much information and too little information. 679.25s - 682.05s | And then accuracy with this biometrics. 682.05s - 685.73s | Can these systems accurately identify a person's age, right?


chunk_text:
what website you're going to to determine if you are an adult. 637.25s - 638.45s | So what's the problem? 638.45s - 640.29s | What is the exact problem with this? 640.29s - 644.77s | Well, it's too much information and too little information. 644.77s - 649.01s | So people have to give even more information to companies. 649.01s - 651.49s | You have to give them your ID, your credit card. 651.49s - 654.85s | You have to give them access to your online activities. 654.85s - 659.49s | Does anybody feel comfortable with giving more and more information to companies? 660.13s - 663.25s | But also, there are some people who don't have that information. 663.25s - 667.25s | If you don't have a credit card, it means that you can't get on social media. 667.97s - 673.25s | If you don't have an ID, it means that, well, you can't get on to any of these websites. 673.25s - 676.77s | And so there's a problem with too much information and too little information. 679.25s - 682.05s | And then accuracy with this biometrics. 682.05s - 685.73s | Can these systems accurately identify a person's age, right? 686.85s - 689.65s | Even though we've had advancements in these systems, 689.65s - 694.13s | this software still has trouble with distinguishing faces of women and people of color. 694.13s - 698.29s | And so I like to call this the black doesn't crack problem, right? 698.29s - 701.57s | The software is going to be looking at you, and they're not going to be able to identify 701.57s - 706.13s | your age, largely because it was trained using white men as the model. 707.09s - 711.89s | But there's also questions about the ability for companies to protect your biometric information. 711.89s - 714.45s | You're giving them more and more information about you. 715.81s - 719.89s | And so we've seen so many of these headlines about all of these lawsuits 719.89s - 724.21s | and these lawsuit settlements related to biometric information. 724.21s - 729.49s | Last month, Metta agreed to pay $1.4 billion to settle a biometric lawsuit 729.49s - 731.01s | with the state of Texas. 731.01s - 735.17s | Instagram reached a settlement in Illinois for $68.5 million. 736.13s - 740.45s | TikTok reached a $92 million settlement for a biometric case.


chunk_text:
686.85s - 689.65s | Even though we've had advancements in these systems, 689.65s - 694.13s | this software still has trouble with distinguishing faces of women and people of color. 694.13s - 698.29s | And so I like to call this the black doesn't crack problem, right? 698.29s - 701.57s | The software is going to be looking at you, and they're not going to be able to identify 701.57s - 706.13s | your age, largely because it was trained using white men as the model. 707.09s - 711.89s | But there's also questions about the ability for companies to protect your biometric information. 711.89s - 714.45s | You're giving them more and more information about you. 715.81s - 719.89s | And so we've seen so many of these headlines about all of these lawsuits 719.89s - 724.21s | and these lawsuit settlements related to biometric information. 724.21s - 729.49s | Last month, Metta agreed to pay $1.4 billion to settle a biometric lawsuit 729.49s - 731.01s | with the state of Texas. 731.01s - 735.17s | Instagram reached a settlement in Illinois for $68.5 million. 736.13s - 740.45s | TikTok reached a $92 million settlement for a biometric case. 740.45s - 745.17s | And so do we trust these companies with having more and more of our information, 745.17s - 747.25s | especially our biometric information? 750.35s - 752.91s | It also raises First Amendment problems. 753.47s - 758.59s | And First Amendment laws, some of these laws are creating First Amendment concerns from everyone. 758.59s - 763.07s | And you may be wondering, why is this a First Amendment issue, right? 763.15s - 768.51s | So let's take a moment and talk about constitutional law for non-attorneys. 768.51s - 772.75s | Just one slide, and you will walk away knowing more constitutional law 772.75s - 774.67s | than most people in this country. 774.67s - 775.07s | All right. 775.63s - 779.55s | So the First Amendment protects my speech, right? 779.55s - 781.15s | It protects your speech. 781.15s - 783.71s | But the First Amendment also applies to children. 783.71s - 785.79s | It protects our children's speeches. 786.35s - 789.39s | Another area is that it protects company speeches. 789.39s - 793.79s | A lot of people don't understand that, but the First Amendment applies to companies. 794.91s - 800.03s | And also, we need


chunk_text:
740.45s - 745.17s | And so do we trust these companies with having more and more of our information, 745.17s - 747.25s | especially our biometric information? 750.35s - 752.91s | It also raises First Amendment problems. 753.47s - 758.59s | And First Amendment laws, some of these laws are creating First Amendment concerns from everyone. 758.59s - 763.07s | And you may be wondering, why is this a First Amendment issue, right? 763.15s - 768.51s | So let's take a moment and talk about constitutional law for non-attorneys. 768.51s - 772.75s | Just one slide, and you will walk away knowing more constitutional law 772.75s - 774.67s | than most people in this country. 774.67s - 775.07s | All right. 775.63s - 779.55s | So the First Amendment protects my speech, right? 779.55s - 781.15s | It protects your speech. 781.15s - 783.71s | But the First Amendment also applies to children. 783.71s - 785.79s | It protects our children's speeches. 786.35s - 789.39s | Another area is that it protects company speeches. 789.39s - 793.79s | A lot of people don't understand that, but the First Amendment applies to companies. 794.91s - 800.03s | And also, we need to remember that freedom of speech doesn't mean freedom from consequences. 800.03s - 806.35s | So you could be online saying crazy things, and you will still face consequences. 806.35s - 810.51s | It is a freedom of speech from the government creating laws about that, 810.51s - 812.35s | but not freedom of consequences. 813.07s - 818.91s | But also, the First Amendment protects the creation and dissemination of information, 818.99s - 821.07s | because that's considered speech. 822.67s - 825.39s | So now you are our constitutional scholars. 827.15s - 827.47s | All right. 827.47s - 829.63s | So let's talk about the First Amendment again. 830.27s - 832.67s | Kids and parents have a First Amendment, right? 833.47s - 836.67s | These laws restrict children's access to social media sites. 836.67s - 842.67s | And children, even ones under the age of 13, have a constitutional right to speech. 843.31s - 846.19s | Also, their parents have a right to make decisions 846.19s - 849.55s | about what type of speech their children are being able to give. 849.55s - 853.39s | And a lot of these laws say, hey, even if your parents are fine with


chunk_text:
to remember that freedom of speech doesn't mean freedom from consequences. 800.03s - 806.35s | So you could be online saying crazy things, and you will still face consequences. 806.35s - 810.51s | It is a freedom of speech from the government creating laws about that, 810.51s - 812.35s | but not freedom of consequences. 813.07s - 818.91s | But also, the First Amendment protects the creation and dissemination of information, 818.99s - 821.07s | because that's considered speech. 822.67s - 825.39s | So now you are our constitutional scholars. 827.15s - 827.47s | All right. 827.47s - 829.63s | So let's talk about the First Amendment again. 830.27s - 832.67s | Kids and parents have a First Amendment, right? 833.47s - 836.67s | These laws restrict children's access to social media sites. 836.67s - 842.67s | And children, even ones under the age of 13, have a constitutional right to speech. 843.31s - 846.19s | Also, their parents have a right to make decisions 846.19s - 849.55s | about what type of speech their children are being able to give. 849.55s - 853.39s | And a lot of these laws say, hey, even if your parents are fine with you 853.39s - 857.71s | getting on these social media sites, we don't want you because you're under the age of 13. 858.35s - 861.23s | And you can't do that because you're infringing on 861.23s - 863.79s | the children and the parents' First Amendment rights. 865.47s - 867.95s | It also has an impact on company rights. 867.95s - 871.31s | As we talked about, companies have a First Amendment right. 872.11s - 878.03s | These laws also prohibit and restrict the collection, sale, and sharing of children's data. 878.03s - 882.03s | And so when courts looked at this issue, the courts have repeatedly said, 882.03s - 885.63s | hey, if you're going to create these laws that restrict the rights of companies 886.19s - 892.27s | to collect this information, then there must be a very important compelling government interest. 892.27s - 894.35s | And it has to be narrowly tailored. 894.35s - 897.07s | You need to have the least restrictive laws. 897.07s - 899.87s | And only then are we going to allow you to do something 899.87s - 904.51s | that may potentially infringe on these First Amendment rights. 906.43s - 908.03s |


chunk_text:
you 853.39s - 857.71s | getting on these social media sites, we don't want you because you're under the age of 13. 858.35s - 861.23s | And you can't do that because you're infringing on 861.23s - 863.79s | the children and the parents' First Amendment rights. 865.47s - 867.95s | It also has an impact on company rights. 867.95s - 871.31s | As we talked about, companies have a First Amendment right. 872.11s - 878.03s | These laws also prohibit and restrict the collection, sale, and sharing of children's data. 878.03s - 882.03s | And so when courts looked at this issue, the courts have repeatedly said, 882.03s - 885.63s | hey, if you're going to create these laws that restrict the rights of companies 886.19s - 892.27s | to collect this information, then there must be a very important compelling government interest. 892.27s - 894.35s | And it has to be narrowly tailored. 894.35s - 897.07s | You need to have the least restrictive laws. 897.07s - 899.87s | And only then are we going to allow you to do something 899.87s - 904.51s | that may potentially infringe on these First Amendment rights. 906.43s - 908.03s | So what about adults? 908.03s - 913.31s | While these laws are focused on children, they also impact the rights of adults. 913.31s - 916.51s | These laws could have a chilling effect on your speech. 916.51s - 921.87s | If you have to show your ID or put in your credit card information before logging on to Twitter, 922.67s - 925.63s | that's probably going to change what you're going to say online, right? 925.71s - 927.79s | Because everybody knows exactly who you are. 929.15s - 932.35s | And so it has an impact on what people may say. 936.85s - 940.61s | Another common element in all of these state laws is content moderation. 941.17s - 944.13s | The focus is keeping harmful information away from children. 944.69s - 948.21s | However, this encourages companies to censor all information. 948.21s - 951.33s | It encourages them to delete posts meant for adults 952.05s - 954.85s | because they may not be appropriate for children. 954.85s - 959.89s | And companies' content moderation is very different from government-required restrictions. 960.53s - 964.53s | But it encourages more content moderation by companies. 966.53s - 970.37s | So now let's


chunk_text:
So what about adults? 908.03s - 913.31s | While these laws are focused on children, they also impact the rights of adults. 913.31s - 916.51s | These laws could have a chilling effect on your speech. 916.51s - 921.87s | If you have to show your ID or put in your credit card information before logging on to Twitter, 922.67s - 925.63s | that's probably going to change what you're going to say online, right? 925.71s - 927.79s | Because everybody knows exactly who you are. 929.15s - 932.35s | And so it has an impact on what people may say. 936.85s - 940.61s | Another common element in all of these state laws is content moderation. 941.17s - 944.13s | The focus is keeping harmful information away from children. 944.69s - 948.21s | However, this encourages companies to censor all information. 948.21s - 951.33s | It encourages them to delete posts meant for adults 952.05s - 954.85s | because they may not be appropriate for children. 954.85s - 959.89s | And companies' content moderation is very different from government-required restrictions. 960.53s - 964.53s | But it encourages more content moderation by companies. 966.53s - 970.37s | So now let's talk about ways that we can address these issues. 970.93s - 973.81s | Maybe not through the use of state laws, but through other mechanisms 973.81s - 977.81s | by looking at some of my favorite Wu-Tang Clan songs and skits. 977.81s - 978.37s | Sounds good? 978.93s - 979.49s | All right. 981.01s - 982.93s | Could it all be so simple? 982.93s - 986.29s | One of the closing tracks of Enter the 36 Chambers, 987.01s - 991.73s | where the Wu-Tang Clan members talk about the simpler things in life. 992.29s - 993.97s | So it's not all doom and gloom. 994.53s - 998.85s | There are still ways that we can protect children and respect our rights. 999.89s - 1003.41s | So we should think about simpler solutions. 1003.41s - 1005.41s | So what's the problem that we want to solve? 1005.41s - 1007.73s | What exactly is the problem that we want to address? 1008.29s - 1011.41s | And solve that problem in the least restrictive way. 1014.19s - 1016.83s | Next, we need to stop being sharks. 1016.83s - 1021.23s | One of the skits from a Wu-Tang Clan album was talking about people


chunk_text:
talk about ways that we can address these issues. 970.93s - 973.81s | Maybe not through the use of state laws, but through other mechanisms 973.81s - 977.81s | by looking at some of my favorite Wu-Tang Clan songs and skits. 977.81s - 978.37s | Sounds good? 978.93s - 979.49s | All right. 981.01s - 982.93s | Could it all be so simple? 982.93s - 986.29s | One of the closing tracks of Enter the 36 Chambers, 987.01s - 991.73s | where the Wu-Tang Clan members talk about the simpler things in life. 992.29s - 993.97s | So it's not all doom and gloom. 994.53s - 998.85s | There are still ways that we can protect children and respect our rights. 999.89s - 1003.41s | So we should think about simpler solutions. 1003.41s - 1005.41s | So what's the problem that we want to solve? 1005.41s - 1007.73s | What exactly is the problem that we want to address? 1008.29s - 1011.41s | And solve that problem in the least restrictive way. 1014.19s - 1016.83s | Next, we need to stop being sharks. 1016.83s - 1021.23s | One of the skits from a Wu-Tang Clan album was talking about people who are sharks. 1021.79s - 1023.15s | Sharks are people who are biters. 1023.15s - 1023.87s | They're copiers. 1024.59s - 1026.83s | Most people tried to steal the Wu-Tang Clan style. 1027.55s - 1031.63s | In the US, states are trying to steal what they're doing in Europe. 1031.63s - 1036.51s | And a lot of these state laws are just copycats of laws in the EU. 1037.23s - 1042.43s | And that's a problem because this is America and we do freedom differently. 1042.43s - 1048.59s | Our First Amendment protections are very different than protections found in other countries. 1048.59s - 1053.15s | And so that means when you're taking a law from another country and trying to apply it here, 1053.15s - 1055.79s | it raises all types of issues. 1055.79s - 1058.83s | So instead of trying to steal or bite from other people, 1058.83s - 1062.83s | we need to create American-focused solutions. 1062.83s - 1065.23s | We shouldn't just look to see what other countries are doing. 1065.95s - 1068.19s | We should focus on what our rights are, 1068.19s - 1072.67s | what our beliefs and our traditions are to create specific


chunk_text:
who are sharks. 1021.79s - 1023.15s | Sharks are people who are biters. 1023.15s - 1023.87s | They're copiers. 1024.59s - 1026.83s | Most people tried to steal the Wu-Tang Clan style. 1027.55s - 1031.63s | In the US, states are trying to steal what they're doing in Europe. 1031.63s - 1036.51s | And a lot of these state laws are just copycats of laws in the EU. 1037.23s - 1042.43s | And that's a problem because this is America and we do freedom differently. 1042.43s - 1048.59s | Our First Amendment protections are very different than protections found in other countries. 1048.59s - 1053.15s | And so that means when you're taking a law from another country and trying to apply it here, 1053.15s - 1055.79s | it raises all types of issues. 1055.79s - 1058.83s | So instead of trying to steal or bite from other people, 1058.83s - 1062.83s | we need to create American-focused solutions. 1062.83s - 1065.23s | We shouldn't just look to see what other countries are doing. 1065.95s - 1068.19s | We should focus on what our rights are, 1068.19s - 1072.67s | what our beliefs and our traditions are to create specific US laws. 1074.91s - 1077.47s | Cash rules everything around me, right? 1077.47s - 1080.03s | We need to talk about the importance of money, 1080.03s - 1082.91s | the importance of involvement with industry. 1082.91s - 1086.11s | We can't exclude industry when we attempt to create these laws. 1086.11s - 1090.99s | I think it's important for us to remember that COPPA was an industry standard. 1090.99s - 1093.79s | Like, we took something from the industry as guidelines 1093.79s - 1096.51s | and we used that as a starting point to create a law. 1097.31s - 1100.35s | A number of these restrictions that states are coming up with, 1100.35s - 1105.39s | they are expensive to implement for not only for companies, but for the government, 1105.39s - 1109.87s | for the government to be able to monitor whether people are following these things. 1109.87s - 1113.31s | And so we need to focus on better industry standards 1113.31s - 1118.43s | and allowing them to be part of the process that we can have better solutions. 1121.74s - 1124.46s | Next, we need to proceed with caution. 1124.46s - 1128.62s | The law is constantly


chunk_text:
US laws. 1074.91s - 1077.47s | Cash rules everything around me, right? 1077.47s - 1080.03s | We need to talk about the importance of money, 1080.03s - 1082.91s | the importance of involvement with industry. 1082.91s - 1086.11s | We can't exclude industry when we attempt to create these laws. 1086.11s - 1090.99s | I think it's important for us to remember that COPPA was an industry standard. 1090.99s - 1093.79s | Like, we took something from the industry as guidelines 1093.79s - 1096.51s | and we used that as a starting point to create a law. 1097.31s - 1100.35s | A number of these restrictions that states are coming up with, 1100.35s - 1105.39s | they are expensive to implement for not only for companies, but for the government, 1105.39s - 1109.87s | for the government to be able to monitor whether people are following these things. 1109.87s - 1113.31s | And so we need to focus on better industry standards 1113.31s - 1118.43s | and allowing them to be part of the process that we can have better solutions. 1121.74s - 1124.46s | Next, we need to proceed with caution. 1124.46s - 1128.62s | The law is constantly changing and our courts continue to look at these issues. 1128.62s - 1133.50s | And so what might be fine a couple of months ago, isn't fine now. 1133.50s - 1136.70s | So remember, yesterday's price is not today's price. 1136.70s - 1139.90s | Things that might be okay when we looked in the past, 1139.90s - 1141.82s | aren't exactly going to be fine now 1141.82s - 1146.06s | because the law is constantly changing and developing in this area. 1148.19s - 1150.75s | And then finally, a better tomorrow. 1150.75s - 1153.55s | We need to focus on data minimization, right? 1153.55s - 1159.07s | We need to focus on ways to have the least amount of information given to companies. 1159.63s - 1163.71s | We can protect children by placing an emphasis on funding law enforcement 1163.71s - 1166.67s | and groups that tackle child exploitation. 1166.67s - 1171.39s | We need to educate kids on how to be safer online, right? 1171.39s - 1175.39s | Not only just having laws that place additional protections for children, 1175.39s - 1177.95s | we also need to tell children that they need to protect themselves. 1177.95s - 1181.31s |


chunk_text:
changing and our courts continue to look at these issues. 1128.62s - 1133.50s | And so what might be fine a couple of months ago, isn't fine now. 1133.50s - 1136.70s | So remember, yesterday's price is not today's price. 1136.70s - 1139.90s | Things that might be okay when we looked in the past, 1139.90s - 1141.82s | aren't exactly going to be fine now 1141.82s - 1146.06s | because the law is constantly changing and developing in this area. 1148.19s - 1150.75s | And then finally, a better tomorrow. 1150.75s - 1153.55s | We need to focus on data minimization, right? 1153.55s - 1159.07s | We need to focus on ways to have the least amount of information given to companies. 1159.63s - 1163.71s | We can protect children by placing an emphasis on funding law enforcement 1163.71s - 1166.67s | and groups that tackle child exploitation. 1166.67s - 1171.39s | We need to educate kids on how to be safer online, right? 1171.39s - 1175.39s | Not only just having laws that place additional protections for children, 1175.39s - 1177.95s | we also need to tell children that they need to protect themselves. 1177.95s - 1181.31s | They need to watch their step and protect their neck, right? 1181.31s - 1185.87s | And then finally, we need to have comprehensive privacy protections for everyone. 1185.87s - 1188.35s | We need to create laws that protect all of us, 1188.35s - 1191.15s | not just our children, but every single American. 1193.10s - 1194.78s | So what did we learn today? 1195.50s - 1200.38s | People forget about half of all new information within an hour of learning it. 1200.38s - 1202.22s | So it's not uncommon for someone to say, 1202.22s - 1205.26s | okay, you stayed an extra day at DEF CON for that last day. 1205.90s - 1207.34s | What exactly did you learn? 1207.34s - 1210.46s | I saw that there was someone talking about children's privacy. 1210.46s - 1211.18s | What did you learn? 1211.18s - 1212.78s | And it's not uncommon for you to be like, 1214.38s - 1218.30s | I can't recall, but he did a great job and I loved his suit, right? 1219.58s - 1224.06s | And it's not your fault because a human brain can only focus on 1224.06s - 1230.06s | six to nine new pieces of


chunk_text:
They need to watch their step and protect their neck, right? 1181.31s - 1185.87s | And then finally, we need to have comprehensive privacy protections for everyone. 1185.87s - 1188.35s | We need to create laws that protect all of us, 1188.35s - 1191.15s | not just our children, but every single American. 1193.10s - 1194.78s | So what did we learn today? 1195.50s - 1200.38s | People forget about half of all new information within an hour of learning it. 1200.38s - 1202.22s | So it's not uncommon for someone to say, 1202.22s - 1205.26s | okay, you stayed an extra day at DEF CON for that last day. 1205.90s - 1207.34s | What exactly did you learn? 1207.34s - 1210.46s | I saw that there was someone talking about children's privacy. 1210.46s - 1211.18s | What did you learn? 1211.18s - 1212.78s | And it's not uncommon for you to be like, 1214.38s - 1218.30s | I can't recall, but he did a great job and I loved his suit, right? 1219.58s - 1224.06s | And it's not your fault because a human brain can only focus on 1224.06s - 1230.06s | six to nine new pieces of information before there is a steep drop-off. 1230.06s - 1232.94s | So I am going to help everyone out. 1232.94s - 1236.14s | Here are six takeaways so that if someone asks you, 1236.14s - 1239.10s | what exactly did you learn from this presentation? 1239.10s - 1243.18s | You will be able to remember at least one thing, right? 1243.18s - 1246.78s | So first, the public is right to be concerned 1246.78s - 1249.10s | with the privacy and safety of our children. 1249.66s - 1257.26s | Two, the federal government has not been able to update and pass new laws, 1257.26s - 1258.94s | so states are taking the lead. 1259.50s - 1264.83s | Three, state laws will be all right. 1266.19s - 1270.91s | State laws have unintended consequences that impact our privacy and rights. 1270.91s - 1275.23s | Four, state children privacy laws ask us to trade our rights 1275.23s - 1278.75s | for potential protections, but it's not a fair trade. 1279.71s - 1283.71s | Laws should be narrowly focused based on U.S. standards and laws 1283.71s - 1286.19s | and include industry input. 1286.19s - 1290.99s | And then six, Wu-Tang is not


chunk_text:
information before there is a steep drop-off. 1230.06s - 1232.94s | So I am going to help everyone out. 1232.94s - 1236.14s | Here are six takeaways so that if someone asks you, 1236.14s - 1239.10s | what exactly did you learn from this presentation? 1239.10s - 1243.18s | You will be able to remember at least one thing, right? 1243.18s - 1246.78s | So first, the public is right to be concerned 1246.78s - 1249.10s | with the privacy and safety of our children. 1249.66s - 1257.26s | Two, the federal government has not been able to update and pass new laws, 1257.26s - 1258.94s | so states are taking the lead. 1259.50s - 1264.83s | Three, state laws will be all right. 1266.19s - 1270.91s | State laws have unintended consequences that impact our privacy and rights. 1270.91s - 1275.23s | Four, state children privacy laws ask us to trade our rights 1275.23s - 1278.75s | for potential protections, but it's not a fair trade. 1279.71s - 1283.71s | Laws should be narrowly focused based on U.S. standards and laws 1283.71s - 1286.19s | and include industry input. 1286.19s - 1290.99s | And then six, Wu-Tang is not for the children, but their songs still slap. 1291.63s - 1293.95s | All right, so thank you so much. 1293.95s - 1296.99s | If you like the slides and you want to get a copy, 1296.99s - 1298.19s | you can scan a QR code. 1298.19s - 1302.03s | It'll take you to my website, and then you can download the slides. 1302.03s - 1304.99s | They won't be available until probably tomorrow 1304.99s - 1307.47s | because hotel Wi-Fi is not the best. 1308.99s - 1310.51s | All right, well, thank you so much. 1310.51s - 1315.07s | I really appreciate this time to talk about children's privacy.


chunk_text:
for the children, but their songs still slap. 1291.63s - 1293.95s | All right, so thank you so much. 1293.95s - 1296.99s | If you like the slides and you want to get a copy, 1296.99s - 1298.19s | you can scan a QR code. 1298.19s - 1302.03s | It'll take you to my website, and then you can download the slides. 1302.03s - 1304.99s | They won't be available until probably tomorrow 1304.99s - 1307.47s | because hotel Wi-Fi is not the best. 1308.99s - 1310.51s | All right, well, thank you so much. 1310.51s - 1315.07s | I really appreciate this time to talk about children's privacy.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=M-2d3sM3I2o", "title": "DEF CON 32 - Winning the Game of Active Directory - Brandon Colley", "description": "The Game Of Active Directory (GOAD) is a prebuilt vulnerable Active Directory (AD) environment primarily created for pentesters. Touting over 30 methods of attack, GOAD offers multiple paths to full AD takeover. But is that really how you win the game? Regardless of color, as security professions our goal should be to better secure environments. This talk walks through AD attack strategies, exploiting misconfigurations that ultimately pwn AD. Mitigations for these attacks are discussed and implemented, showcasing how they stop common attacks. Implementing these protections in your environment is truly how you win the Game Of Active Directory.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2584, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.37s - 9.29s | This text was transcribed using whisper model: large-v2 Okay, I am with the Packet Hacking Village, and this particular speaker is being sponsored 9.29s - 15.85s | by us, and we are delighted to present Brandon Colley, who is going to obviously talk to 15.85s - 17.97s | you about Active Directory. 17.97s - 23.53s | He has been, he'll tell a little bit about himself, but he works for Trimark Security, 23.53s - 25.81s | and I'm also proud to call him friend. 25.81s - 32.24s | Take it away. 32.24s - 37.00s | Thank you, Kathy, friend Kathy, Investigator Chick, everybody. 37.00s - 40.44s | Alright, can you guys hear me okay in the back? 40.44s - 41.44s | Awesome. 41.44s - 42.44s | Let's do this. 42.44s - 47.96s | So, title, as you all know, is Winning the Game of Active Directory. 47.96s - 53.28s | So a little bit about myself is I served in an operations role, managed Active Directory 53.28s - 58.84s | for about 15 years for multiple different organizations before I joined Trimark about 58.84s - 61.00s | two and a half years ago. 61.00s - 66.84s | A senior security consultant for them, and just got promoted to the service lead role 66.84s - 70.72s | for our Microsoft Cloud assessment, so I'm kind of joking and saying that this might 70.72s - 76.96s | be my last on-prem Active Directory presentation, so maybe next year you'll come to see, like, 76.96s - 81.36s | Winning the Game of Entra ID or something like that, so. 81.36s - 87.00s


chunk_text:
for Trimark Security, 23.53s - 25.81s | and I'm also proud to call him friend. 25.81s - 32.24s | Take it away. 32.24s - 37.00s | Thank you, Kathy, friend Kathy, Investigator Chick, everybody. 37.00s - 40.44s | Alright, can you guys hear me okay in the back? 40.44s - 41.44s | Awesome. 41.44s - 42.44s | Let's do this. 42.44s - 47.96s | So, title, as you all know, is Winning the Game of Active Directory. 47.96s - 53.28s | So a little bit about myself is I served in an operations role, managed Active Directory 53.28s - 58.84s | for about 15 years for multiple different organizations before I joined Trimark about 58.84s - 61.00s | two and a half years ago. 61.00s - 66.84s | A senior security consultant for them, and just got promoted to the service lead role 66.84s - 70.72s | for our Microsoft Cloud assessment, so I'm kind of joking and saying that this might 70.72s - 76.96s | be my last on-prem Active Directory presentation, so maybe next year you'll come to see, like, 76.96s - 81.36s | Winning the Game of Entra ID or something like that, so. 81.36s - 87.00s | Recently founded my own company and got a logo created, so I threw it up there, so B&R 87.00s - 89.40s | Consulting is a company that I just started. 89.44s - 96.12s | I'm a father, here's one of my kids with me at a Chiefs game, I saw a Chiefs hat, go Chiefs, 96.12s - 101.20s | and my wife Bridget came with me today, so I am a very loving husband, as I hope she'd 101.20s - 102.20s | also agree. 102.20s - 114.17s | First time at DEF CON as well, so, and so before we really start digging in, I want, 114.17s - 118.33s | I mean, the title of the game is How to Win the Game of Active Directory, so let's talk 118.33s - 122.81s | about what I'm talking about when I talk about the game of Active Directory. 122.81s - 129.29s | So GoAD, as I like to call it, or somebody said GoAD, so Prebuilt Active Directory Lab 129.29s - 137.37s | is a multi-domain environment, they have multiple different builds that you can create and touts 137.37s - 141.81s | over 30 different vulnerable configurations just out of


chunk_text:
| Recently founded my own company and got a logo created, so I threw it up there, so B&R 87.00s - 89.40s | Consulting is a company that I just started. 89.44s - 96.12s | I'm a father, here's one of my kids with me at a Chiefs game, I saw a Chiefs hat, go Chiefs, 96.12s - 101.20s | and my wife Bridget came with me today, so I am a very loving husband, as I hope she'd 101.20s - 102.20s | also agree. 102.20s - 114.17s | First time at DEF CON as well, so, and so before we really start digging in, I want, 114.17s - 118.33s | I mean, the title of the game is How to Win the Game of Active Directory, so let's talk 118.33s - 122.81s | about what I'm talking about when I talk about the game of Active Directory. 122.81s - 129.29s | So GoAD, as I like to call it, or somebody said GoAD, so Prebuilt Active Directory Lab 129.29s - 137.37s | is a multi-domain environment, they have multiple different builds that you can create and touts 137.37s - 141.81s | over 30 different vulnerable configurations just out of the box. 141.81s - 147.05s | It's created and maintained by Mayfly of Orange Cyber Defense, and Mayfly gave me permission 147.05s - 152.49s | to go ahead and use this in the presentation, he just wanted to know when it gets posted 152.49s - 155.49s | online and he wants my slides, so. 155.49s - 160.37s | It was originally created for penetration testers to practice attacking Active Directory, 160.37s - 166.73s | so real quick, where are my penetration testers in the audience, or any red team side people, 166.73s - 171.39s | how about anybody on the blue side, okay, so we're heavily blue, awesome, and then everyone 171.39s - 177.17s | else is just unaffiliated, I'm assuming, you don't get a vote. 177.17s - 181.73s | So when you start playing a game, first thing you gotta do is character selection screen, 182.01s - 186.93s | so we can choose to be a penetration tester, which your job is to exploit vulnerabilities, 186.93s - 191.37s | misconfigurations, moving to a little bit of a red teamer, you're gonna start looking 191.37s - 195.77s | a little bit more at testing detections and doing a little bit


chunk_text:
the box. 141.81s - 147.05s | It's created and maintained by Mayfly of Orange Cyber Defense, and Mayfly gave me permission 147.05s - 152.49s | to go ahead and use this in the presentation, he just wanted to know when it gets posted 152.49s - 155.49s | online and he wants my slides, so. 155.49s - 160.37s | It was originally created for penetration testers to practice attacking Active Directory, 160.37s - 166.73s | so real quick, where are my penetration testers in the audience, or any red team side people, 166.73s - 171.39s | how about anybody on the blue side, okay, so we're heavily blue, awesome, and then everyone 171.39s - 177.17s | else is just unaffiliated, I'm assuming, you don't get a vote. 177.17s - 181.73s | So when you start playing a game, first thing you gotta do is character selection screen, 182.01s - 186.93s | so we can choose to be a penetration tester, which your job is to exploit vulnerabilities, 186.93s - 191.37s | misconfigurations, moving to a little bit of a red teamer, you're gonna start looking 191.37s - 195.77s | a little bit more at testing detections and doing a little bit more stealthy activities 195.77s - 201.49s | when performing Active Directory tests, and then our defenders, like most of you, are 201.49s - 206.85s | looking forward to learning how to harden your environments, performing consistent monitoring 206.85s - 210.97s | of those environments and just consistently improving the overall security posture of 210.97s - 213.11s | your Active Directory. 213.11s - 216.13s | The other character you could choose is to be an adversary, so I'm gonna assume that 216.13s - 220.41s | the rest of you didn't raise your hands are my adversaries, right, but they don't play 220.41s - 223.09s | by the rules anyway. 223.09s - 226.13s | So the most important rule when you play a game is how do you win, right, and that's 226.13s - 229.53s | what I'm here to talk about, is how do you win the game of Active Directory, and a lot 229.53s - 233.93s | of people think that you can win the game of Active Directory by gaining domain admins, 233.93s - 238.93s | right, that's the keys to the kingdom, once you get domain admin, it's game over, it may 238.93s - 243.57s | be exfil


chunk_text:
more stealthy activities 195.77s - 201.49s | when performing Active Directory tests, and then our defenders, like most of you, are 201.49s - 206.85s | looking forward to learning how to harden your environments, performing consistent monitoring 206.85s - 210.97s | of those environments and just consistently improving the overall security posture of 210.97s - 213.11s | your Active Directory. 213.11s - 216.13s | The other character you could choose is to be an adversary, so I'm gonna assume that 216.13s - 220.41s | the rest of you didn't raise your hands are my adversaries, right, but they don't play 220.41s - 223.09s | by the rules anyway. 223.09s - 226.13s | So the most important rule when you play a game is how do you win, right, and that's 226.13s - 229.53s | what I'm here to talk about, is how do you win the game of Active Directory, and a lot 229.53s - 233.93s | of people think that you can win the game of Active Directory by gaining domain admins, 233.93s - 238.93s | right, that's the keys to the kingdom, once you get domain admin, it's game over, it may 238.93s - 243.57s | be exfil of data, maybe you want some of that, uh, that juicy information that's in 243.57s - 248.61s | Active Directory, or maybe you just wanna create persistence and you wanna be slow and 248.61s - 253.49s | methodic about your efforts, however I'm here to kind of challenge that a little bit and 253.49s - 258.41s | say that the way that you truly win the game of Active Directory, regardless of which character 258.41s - 264.41s | you choose, is to maintain a secure environment, continuously improve that environment and 264.41s - 268.73s | implement the safeguards that are needed to keep your Active Directory safe, and also 268.73s - 270.37s | continuous progress. 270.37s - 274.09s | So what I'm here to do today is kind of show you both sides of that, I'm gonna take a little 274.09s - 279.73s | bit of an attack methodology and also defense methodology, so we have a, Ted Mosby likes 279.73s - 283.97s | to say we have a tightly scheduled evening of awesomeness ahead of us, so let's go, and 283.97s - 289.73s | I guess technically now it is evening, or afternoon anyway, so our agenda, we're gonna


chunk_text:
of data, maybe you want some of that, uh, that juicy information that's in 243.57s - 248.61s | Active Directory, or maybe you just wanna create persistence and you wanna be slow and 248.61s - 253.49s | methodic about your efforts, however I'm here to kind of challenge that a little bit and 253.49s - 258.41s | say that the way that you truly win the game of Active Directory, regardless of which character 258.41s - 264.41s | you choose, is to maintain a secure environment, continuously improve that environment and 264.41s - 268.73s | implement the safeguards that are needed to keep your Active Directory safe, and also 268.73s - 270.37s | continuous progress. 270.37s - 274.09s | So what I'm here to do today is kind of show you both sides of that, I'm gonna take a little 274.09s - 279.73s | bit of an attack methodology and also defense methodology, so we have a, Ted Mosby likes 279.73s - 283.97s | to say we have a tightly scheduled evening of awesomeness ahead of us, so let's go, and 283.97s - 289.73s | I guess technically now it is evening, or afternoon anyway, so our agenda, we're gonna 289.73s - 295.33s | stick with the gameplay idea, uh, we've got three different levels, so level one, we're 295.33s - 300.49s | gonna call Reconnaissance, Enumeration, PrivEsc, and then level four is when we pwn Active 300.49s - 308.06s | Directory and that's really our, our end boss. 308.06s - 313.54s | So starting off with Reconnaissance, our first question when we are, are either protecting 313.54s - 319.94s | or attacking Active Directory is kind of what's visible with simply network access, right, 319.94s - 324.44s | no usernames, no passwords, we just are on the network and, and maybe in this case we 324.44s - 327.50s | just know the IP address of a domain controller. 327.50s - 332.22s | So here's an example of using CrackMap Exec, and this is our first misconfiguration which 332.22s - 338.26s | is called anonymous access, if this is configured in your domain, anybody with network access 338.26s - 343.66s | direct line of sight to your domain controller can query for a list of users as well as some 343.66s - 347.26s | of the public information such as description. 347.26s - 352.22s | And so here if we


chunk_text:
289.73s - 295.33s | stick with the gameplay idea, uh, we've got three different levels, so level one, we're 295.33s - 300.49s | gonna call Reconnaissance, Enumeration, PrivEsc, and then level four is when we pwn Active 300.49s - 308.06s | Directory and that's really our, our end boss. 308.06s - 313.54s | So starting off with Reconnaissance, our first question when we are, are either protecting 313.54s - 319.94s | or attacking Active Directory is kind of what's visible with simply network access, right, 319.94s - 324.44s | no usernames, no passwords, we just are on the network and, and maybe in this case we 324.44s - 327.50s | just know the IP address of a domain controller. 327.50s - 332.22s | So here's an example of using CrackMap Exec, and this is our first misconfiguration which 332.22s - 338.26s | is called anonymous access, if this is configured in your domain, anybody with network access 338.26s - 343.66s | direct line of sight to your domain controller can query for a list of users as well as some 343.66s - 347.26s | of the public information such as description. 347.26s - 352.22s | And so here if we drill in, we identify that we've already got our first credential in 352.22s - 357.62s | Samwell who had, must have had an administrator put his password in the description field 357.62s - 360.73s | for some odd reason. 360.73s - 364.89s | So how do we mitigate this other than just don't put passwords in description fields, 364.89s - 373.17s | right, that's kind of the obvious one here, is removing these groups from your domain, 373.17s - 379.57s | domain root, sorry, the pre-Windows 2000 group, I'm not saying to delete this from the domain 379.61s - 385.89s | root, but if the members of this include the everyone group or the authenticated, I'm sorry, 385.89s - 391.89s | not authenticated, the anonymous logons group, then this is possible. 391.89s - 396.49s | In, in the Goad lab, the screenshot on the right is actually how it was configured, is 396.49s - 402.09s | you're just giving root access to anonymous logon and that's what enables the ability 402.09s - 406.57s | to, to see everything without having any sort of initial user. 406.65s - 410.53s | So once we've removed that, we rerun the attack, we get


chunk_text:
drill in, we identify that we've already got our first credential in 352.22s - 357.62s | Samwell who had, must have had an administrator put his password in the description field 357.62s - 360.73s | for some odd reason. 360.73s - 364.89s | So how do we mitigate this other than just don't put passwords in description fields, 364.89s - 373.17s | right, that's kind of the obvious one here, is removing these groups from your domain, 373.17s - 379.57s | domain root, sorry, the pre-Windows 2000 group, I'm not saying to delete this from the domain 379.61s - 385.89s | root, but if the members of this include the everyone group or the authenticated, I'm sorry, 385.89s - 391.89s | not authenticated, the anonymous logons group, then this is possible. 391.89s - 396.49s | In, in the Goad lab, the screenshot on the right is actually how it was configured, is 396.49s - 402.09s | you're just giving root access to anonymous logon and that's what enables the ability 402.09s - 406.57s | to, to see everything without having any sort of initial user. 406.65s - 410.53s | So once we've removed that, we rerun the attack, we get nothing. 410.53s - 416.57s | So we get an error message, nothing comes back, anonymous access no longer relevant, 416.57s - 419.33s | so now we have to dig in a separate way. 419.33s - 424.05s | So if we can't do it anonymously, we're going to have to build a user list, and so the game 424.05s - 429.01s | of Active Directory, if you've, if you've used it before, you, you may know it's based 429.01s - 432.95s | on the game of Thrones, which is kind of where the game of thing comes from, right? 432.95s - 439.55s | So this is a good place for us to start scraping credentials, I'm sorry, not credentials, usernames. 439.55s - 444.55s | So we're going to pull out the first names, last names, combine those, and form a user 444.55s - 445.59s | list. 445.59s - 450.71s | So the screenshot on the left is the user list that I'm using, which is a first name 450.71s - 457.67s | dot last name, that's the, the, the methodology that's used in the lab, but in your environments 457.67s - 461.95s | it might be a first initial dot last


chunk_text:
nothing. 410.53s - 416.57s | So we get an error message, nothing comes back, anonymous access no longer relevant, 416.57s - 419.33s | so now we have to dig in a separate way. 419.33s - 424.05s | So if we can't do it anonymously, we're going to have to build a user list, and so the game 424.05s - 429.01s | of Active Directory, if you've, if you've used it before, you, you may know it's based 429.01s - 432.95s | on the game of Thrones, which is kind of where the game of thing comes from, right? 432.95s - 439.55s | So this is a good place for us to start scraping credentials, I'm sorry, not credentials, usernames. 439.55s - 444.55s | So we're going to pull out the first names, last names, combine those, and form a user 444.55s - 445.59s | list. 445.59s - 450.71s | So the screenshot on the left is the user list that I'm using, which is a first name 450.71s - 457.67s | dot last name, that's the, the, the methodology that's used in the lab, but in your environments 457.67s - 461.95s | it might be a first initial dot last name, you might not have a dot, it might be your 461.95s - 464.95s | last name and then your first name, something like that. 464.95s - 470.15s | So we can go ahead and we can throw all of those into a user list, and then we can attack 470.15s - 474.29s | Active Directory, still anonymously, using a script like this. 474.29s - 480.03s | So this is just an in-map script that all you need to have is your user list in a text 480.03s - 485.27s | file, and again the domain IP, and what it's going to do is it's going to attempt to authenticate 485.27s - 490.27s | to Kerberos, or it's going to query Kerberos, Kerberos is going to come back and, and tell 490.27s - 493.99s | you one of two things, it's either going to say, uh, yeah, that's valid, or no, that's 493.99s - 494.99s | invalid. 494.99s - 500.35s | So now we've got a list of nine valid accounts that were in that, uh, file, and so now we 500.35s - 502.55s | know who we can attack. 502.55s - 505.91s | And you guys might say, hey,


chunk_text:
name, you might not have a dot, it might be your 461.95s - 464.95s | last name and then your first name, something like that. 464.95s - 470.15s | So we can go ahead and we can throw all of those into a user list, and then we can attack 470.15s - 474.29s | Active Directory, still anonymously, using a script like this. 474.29s - 480.03s | So this is just an in-map script that all you need to have is your user list in a text 480.03s - 485.27s | file, and again the domain IP, and what it's going to do is it's going to attempt to authenticate 485.27s - 490.27s | to Kerberos, or it's going to query Kerberos, Kerberos is going to come back and, and tell 490.27s - 493.99s | you one of two things, it's either going to say, uh, yeah, that's valid, or no, that's 493.99s - 494.99s | invalid. 494.99s - 500.35s | So now we've got a list of nine valid accounts that were in that, uh, file, and so now we 500.35s - 502.55s | know who we can attack. 502.55s - 505.91s | And you guys might say, hey, it's not fair, you knew it was the Game of Thrones, so you 505.91s - 510.83s | knew who you were attacking, well, there are plenty of lists out there on GitHub that you 510.83s - 516.87s | can just do a, a very top 100 common names, and you can do the same style of attack. 516.87s - 521.11s | And once you get one or two hits, then you kind of know the naming convention, right, 521.11s - 525.87s | and then you just go out to LinkedIn, and you search up, uh, Microsoft, or whoever you're 525.87s - 530.55s | attacking, and you scrape from there, right, so this is real world stuff that, that you 530.55s - 534.31s | can obviously do. 534.31s - 539.27s | And so the reason that this works is, is ingrained in the Kerberos protocol. 539.27s - 543.39s | So if an account doesn't exist, then you're going to get this first, uh, error message, 543.39s - 545.51s | which is that the principle's unknown. 545.51s - 550.03s | If the user does exist, you're going to get one of those other, other two responses, and 550.03s - 553.23s | that's


chunk_text:
it's not fair, you knew it was the Game of Thrones, so you 505.91s - 510.83s | knew who you were attacking, well, there are plenty of lists out there on GitHub that you 510.83s - 516.87s | can just do a, a very top 100 common names, and you can do the same style of attack. 516.87s - 521.11s | And once you get one or two hits, then you kind of know the naming convention, right, 521.11s - 525.87s | and then you just go out to LinkedIn, and you search up, uh, Microsoft, or whoever you're 525.87s - 530.55s | attacking, and you scrape from there, right, so this is real world stuff that, that you 530.55s - 534.31s | can obviously do. 534.31s - 539.27s | And so the reason that this works is, is ingrained in the Kerberos protocol. 539.27s - 543.39s | So if an account doesn't exist, then you're going to get this first, uh, error message, 543.39s - 545.51s | which is that the principle's unknown. 545.51s - 550.03s | If the user does exist, you're going to get one of those other, other two responses, and 550.03s - 553.23s | that's basically what happens under the covers of this in-map script. 553.23s - 567.19s | Sorry, I'm gonna drink, and this is weird, so. 567.19s - 576.27s | Okay, so the fix for, for this is not easy, um, and sometimes not even possible. 576.27s - 582.03s | And this is a, this is a no-fix, uh, bug, I guess you can say, Microsoft doesn't consider 582.23s - 589.07s | user enumeration to be a bug, so the, the best thing that we can really offer is just, 589.07s - 593.59s | if you're looking at being able to change things, is don't use the same, uh, email address 593.59s - 598.35s | that you use for your same account name, or vice versa, uh, instead maybe create some 598.35s - 602.35s | sort of non-standard naming convention by throwing something about the department, or, 602.35s - 606.11s | or the type of person, if it's, um, like I used to work at a university, so maybe like 606.11s - 610.39s | a F for faculty, S for staff, A for administration. 610.39s - 614.59s | Maybe you do F for finance, um, I for IT, something like that, right? 614.59s


chunk_text:
basically what happens under the covers of this in-map script. 553.23s - 567.19s | Sorry, I'm gonna drink, and this is weird, so. 567.19s - 576.27s | Okay, so the fix for, for this is not easy, um, and sometimes not even possible. 576.27s - 582.03s | And this is a, this is a no-fix, uh, bug, I guess you can say, Microsoft doesn't consider 582.23s - 589.07s | user enumeration to be a bug, so the, the best thing that we can really offer is just, 589.07s - 593.59s | if you're looking at being able to change things, is don't use the same, uh, email address 593.59s - 598.35s | that you use for your same account name, or vice versa, uh, instead maybe create some 598.35s - 602.35s | sort of non-standard naming convention by throwing something about the department, or, 602.35s - 606.11s | or the type of person, if it's, um, like I used to work at a university, so maybe like 606.11s - 610.39s | a F for faculty, S for staff, A for administration. 610.39s - 614.59s | Maybe you do F for finance, um, I for IT, something like that, right? 614.59s - 619.91s | Or probably the best thing to do is use multiple trailing digits, uh, and this is gonna exponentially 619.91s - 624.35s | create a whole lot more trouble, where you're gonna have to have a much larger user list 624.35s - 629.47s | and a whole lot more time to be able to really enumerate a full contents of Active Directory. 629.47s - 634.91s | And I understand that this is hard, um, mitigations are more around password policies, which we're 634.91s - 638.39s | gonna attack here, um, in a little while. 638.39s - 644.07s | But because I talked about the Kerberos protocol, I wanna go back through another anonymous 644.07s - 649.47s | thing that you can do, is attack, uh, Kerberos pre-authentication, and so this is known as 649.47s - 654.51s | an AS rep-roast, and so this is what it looks like when you perform an AS rep-roast attack 654.51s - 657.59s | using the ImpactKit toolkit. 657.59s - 662.87s | And accounts that do not require pre-authentication are going to come back and give us a password 662.87s - 663.87s | hash. 663.87s - 668.83s | And in this case, Brandon


chunk_text:
- 619.91s | Or probably the best thing to do is use multiple trailing digits, uh, and this is gonna exponentially 619.91s - 624.35s | create a whole lot more trouble, where you're gonna have to have a much larger user list 624.35s - 629.47s | and a whole lot more time to be able to really enumerate a full contents of Active Directory. 629.47s - 634.91s | And I understand that this is hard, um, mitigations are more around password policies, which we're 634.91s - 638.39s | gonna attack here, um, in a little while. 638.39s - 644.07s | But because I talked about the Kerberos protocol, I wanna go back through another anonymous 644.07s - 649.47s | thing that you can do, is attack, uh, Kerberos pre-authentication, and so this is known as 649.47s - 654.51s | an AS rep-roast, and so this is what it looks like when you perform an AS rep-roast attack 654.51s - 657.59s | using the ImpactKit toolkit. 657.59s - 662.87s | And accounts that do not require pre-authentication are going to come back and give us a password 662.87s - 663.87s | hash. 663.87s - 668.83s | And in this case, Brandon Stark, uh, no relation, by the way, uh, gives us password hash for 668.83s - 671.82s | free. 671.82s - 676.22s | And with that, we can use Hashcat or John the Ripper or some other, um, offline attack 676.22s - 681.14s | tool where we can throw this through, and I just threw it through, uh, a ROKU, which 681.14s - 687.58s | is just a typical user list, uh, password list, sorry, and we get the clear text credentials, 687.58s - 695.21s | uh, in just a matter of a few, a few minutes. 695.21s - 698.45s | So fixing this is, is pretty easy. 698.45s - 699.45s | It's just a checkbox. 699.45s - 705.41s | So there is a Kerberos pre-authentication checkbox on user accounts, says do not require 705.41s - 707.09s | Kerberos pre-authentication. 707.09s - 712.53s | This is a super, super legacy thing, uh, pretty, pretty free of a win in an environment. 712.53s - 717.29s | So if you've got any of this in your environment, um, removing that checkbox is gonna mitigate 717.29s - 723.29s | it, which means after we remove that checkbox, Brandon no longer gives out his password


chunk_text:
Stark, uh, no relation, by the way, uh, gives us password hash for 668.83s - 671.82s | free. 671.82s - 676.22s | And with that, we can use Hashcat or John the Ripper or some other, um, offline attack 676.22s - 681.14s | tool where we can throw this through, and I just threw it through, uh, a ROKU, which 681.14s - 687.58s | is just a typical user list, uh, password list, sorry, and we get the clear text credentials, 687.58s - 695.21s | uh, in just a matter of a few, a few minutes. 695.21s - 698.45s | So fixing this is, is pretty easy. 698.45s - 699.45s | It's just a checkbox. 699.45s - 705.41s | So there is a Kerberos pre-authentication checkbox on user accounts, says do not require 705.41s - 707.09s | Kerberos pre-authentication. 707.09s - 712.53s | This is a super, super legacy thing, uh, pretty, pretty free of a win in an environment. 712.53s - 717.29s | So if you've got any of this in your environment, um, removing that checkbox is gonna mitigate 717.29s - 723.29s | it, which means after we remove that checkbox, Brandon no longer gives out his password freely, 723.29s - 727.89s | uh, so we're gonna have to attack the passwords using some of the more, uh, more well-known 727.89s - 729.73s | styles of, of password attacks. 729.73s - 738.65s | I need, like, a desk someplace, like, right here, I'm gonna spill that on my computer. 738.65s - 744.49s | Okay, so password attacks kind of fall into a few different categories, and so we're gonna 744.49s - 748.13s | attack password reuse by doing a password spray. 748.13s - 756.29s | And so, excuse me, password spray is, uh, trying a small handful of passwords against 756.29s - 758.75s | all usernames in an environment. 758.75s - 763.75s | So in this case, I used some of the passwords that I already found in the environment, and 763.75s - 768.87s | I'm just seeing if there's possible password reuse, uh, across user accounts. 768.87s - 773.41s | In this one, it didn't hit anything, but some common uses for this is things like using 773.41s - 783.02s | Summer 2024, or Defcon 32, or whatever, right, like, um, and just seeing kind of what hits. 783.02s - 788.66s | Uh, a similar attack is


chunk_text:
freely, 723.29s - 727.89s | uh, so we're gonna have to attack the passwords using some of the more, uh, more well-known 727.89s - 729.73s | styles of, of password attacks. 729.73s - 738.65s | I need, like, a desk someplace, like, right here, I'm gonna spill that on my computer. 738.65s - 744.49s | Okay, so password attacks kind of fall into a few different categories, and so we're gonna 744.49s - 748.13s | attack password reuse by doing a password spray. 748.13s - 756.29s | And so, excuse me, password spray is, uh, trying a small handful of passwords against 756.29s - 758.75s | all usernames in an environment. 758.75s - 763.75s | So in this case, I used some of the passwords that I already found in the environment, and 763.75s - 768.87s | I'm just seeing if there's possible password reuse, uh, across user accounts. 768.87s - 773.41s | In this one, it didn't hit anything, but some common uses for this is things like using 773.41s - 783.02s | Summer 2024, or Defcon 32, or whatever, right, like, um, and just seeing kind of what hits. 783.02s - 788.66s | Uh, a similar attack is a credential stuff attack, and this is more commonly used with 788.66s - 795.14s | breach credentials, so this is also a password reuse attack, but it's more specific to the 795.14s - 801.02s | user account themselves, so, or the user themselves, so if they use the same password, say, for 801.02s - 807.10s | LinkedIn, and we're able to identify that the, the email address that they signed in 807.10s - 812.42s | with LinkedIn was the same as the Active Directory that we're attacking, it's possible that, 812.42s - 816.82s | that we may be able to hit something using a credential stuffing attack. 816.82s - 821.86s | In this specific account, um, sorry, this specific screenshot, uh, I kind of lazily 821.86s - 828.62s | just used the same user list, and, as the password list, which simulates the, the situation 828.62s - 835.26s | where a user has the same password as their username, which is not terribly common anymore, 835.26s - 838.98s | but, uh, used to be common around, like, service accounts and things like that, so if you got 838.98s - 844.94s | passwords that haven't changed in your environment for a


chunk_text:
a credential stuff attack, and this is more commonly used with 788.66s - 795.14s | breach credentials, so this is also a password reuse attack, but it's more specific to the 795.14s - 801.02s | user account themselves, so, or the user themselves, so if they use the same password, say, for 801.02s - 807.10s | LinkedIn, and we're able to identify that the, the email address that they signed in 807.10s - 812.42s | with LinkedIn was the same as the Active Directory that we're attacking, it's possible that, 812.42s - 816.82s | that we may be able to hit something using a credential stuffing attack. 816.82s - 821.86s | In this specific account, um, sorry, this specific screenshot, uh, I kind of lazily 821.86s - 828.62s | just used the same user list, and, as the password list, which simulates the, the situation 828.62s - 835.26s | where a user has the same password as their username, which is not terribly common anymore, 835.26s - 838.98s | but, uh, used to be common around, like, service accounts and things like that, so if you got 838.98s - 844.94s | passwords that haven't changed in your environment for a very long time, this may, may be possible. 844.94s - 850.78s | And so we did get a hit on that one, uh, we got the account Hodor, which, uh, we'll 850.78s - 856.94s | use later in another authenticated attack, but so some of the things that we can do is, 856.94s - 861.40s | and I showcase here just checking out the password policy to prove that you can view 861.40s - 865.66s | it as any user in the domain, so once you have that initial user, you can query the 865.66s - 870.86s | password policy and maybe tailor your password attacks a little bit more specific, and so 870.86s - 875.38s | if you're wondering why on earth someone could have the same username and password, 875.38s - 882.06s | it's due to the complexity requirement that's disabled in this lab, also the, the character 882.06s - 888.86s | limit is only five, which I have seen worse than that, so five, not, not the worst, um, 888.86s - 892.06s | some other things that you want to do with your password policy, other than kind of the 892.06s - 896.62s | obvious two there,


chunk_text:
very long time, this may, may be possible. 844.94s - 850.78s | And so we did get a hit on that one, uh, we got the account Hodor, which, uh, we'll 850.78s - 856.94s | use later in another authenticated attack, but so some of the things that we can do is, 856.94s - 861.40s | and I showcase here just checking out the password policy to prove that you can view 861.40s - 865.66s | it as any user in the domain, so once you have that initial user, you can query the 865.66s - 870.86s | password policy and maybe tailor your password attacks a little bit more specific, and so 870.86s - 875.38s | if you're wondering why on earth someone could have the same username and password, 875.38s - 882.06s | it's due to the complexity requirement that's disabled in this lab, also the, the character 882.06s - 888.86s | limit is only five, which I have seen worse than that, so five, not, not the worst, um, 888.86s - 892.06s | some other things that you want to do with your password policy, other than kind of the 892.06s - 896.62s | obvious two there, is looking at some of the account lockout threshold, as far as, and 896.62s - 901.46s | also some of the other password, uh, requirements in there, I do, I do have a link to an article 901.46s - 906.14s | I wrote called password policy a la carte, that's gonna be in my resources, so, uh, check 906.14s - 912.99s | that out, uh, after the talk, I do want to talk a little bit about account lockout, because 912.99s - 917.95s | it is an effective strategy to blocking some password style attacks, um, not gonna talk 917.95s - 922.93s | about monitoring, because that's another, another thing, um, but you can query things 922.97s - 928.63s | using password, um, crack map exec, and so, here, I've just simulated something, uh, uh, 928.63s - 933.17s | I, this is an oopsie, so for the red teamers, you're probably somewhat familiar, hopefully 933.17s - 937.41s | not, with seeing something like this, where you see log on failure, log on failure, log 937.41s - 941.45s | on failure, and then you see account locked out, and hopefully this is just the one account, 941.45s - 947.55s | and


chunk_text:
is looking at some of the account lockout threshold, as far as, and 896.62s - 901.46s | also some of the other password, uh, requirements in there, I do, I do have a link to an article 901.46s - 906.14s | I wrote called password policy a la carte, that's gonna be in my resources, so, uh, check 906.14s - 912.99s | that out, uh, after the talk, I do want to talk a little bit about account lockout, because 912.99s - 917.95s | it is an effective strategy to blocking some password style attacks, um, not gonna talk 917.95s - 922.93s | about monitoring, because that's another, another thing, um, but you can query things 922.97s - 928.63s | using password, um, crack map exec, and so, here, I've just simulated something, uh, uh, 928.63s - 933.17s | I, this is an oopsie, so for the red teamers, you're probably somewhat familiar, hopefully 933.17s - 937.41s | not, with seeing something like this, where you see log on failure, log on failure, log 937.41s - 941.45s | on failure, and then you see account locked out, and hopefully this is just the one account, 941.45s - 947.55s | and not, like, all the accounts, right? Um, mistakes happen, uh, but log on failures are, 947.57s - 953.15s | are going to kind of reset that account lockout counter. So, to help combat that, whether 953.15s - 957.75s | you're looking, I am showing the attack tools, but defense tools is kind of, um, another way 957.75s - 962.75s | that you can look at stuff like this. When we rerun the, the crack map exec script, using 964.59s - 970.43s | the user's flag authenticated, we can get the bad password count, so, here, we identify 970.43s - 973.87s | the very bottom account was the one that we accidentally locked out, the other ones are 973.89s - 980.43s | sitting at four, and so, we can wait, uh, for those password, um, resets to retime before you 980.43s - 987.51s | attempt to attack them again. So, that concludes level one. Yes, right? So, we gained three 988.79s - 992.89s | attack credentials, uh, three account credentials, but that's not necessarily the goal that we 992.89s - 997.35s | talked about, so, the goal, rather than getting those credentials, is more so the 997.35s - 1002.89s | vulnerabilities


chunk_text:
not, like, all the accounts, right? Um, mistakes happen, uh, but log on failures are, 947.57s - 953.15s | are going to kind of reset that account lockout counter. So, to help combat that, whether 953.15s - 957.75s | you're looking, I am showing the attack tools, but defense tools is kind of, um, another way 957.75s - 962.75s | that you can look at stuff like this. When we rerun the, the crack map exec script, using 964.59s - 970.43s | the user's flag authenticated, we can get the bad password count, so, here, we identify 970.43s - 973.87s | the very bottom account was the one that we accidentally locked out, the other ones are 973.89s - 980.43s | sitting at four, and so, we can wait, uh, for those password, um, resets to retime before you 980.43s - 987.51s | attempt to attack them again. So, that concludes level one. Yes, right? So, we gained three 988.79s - 992.89s | attack credentials, uh, three account credentials, but that's not necessarily the goal that we 992.89s - 997.35s | talked about, so, the goal, rather than getting those credentials, is more so the 997.35s - 1002.89s | vulnerabilities that we've identified as being able to patch, and so, in level one, we 1002.91s - 1007.07s | talked about anonymous access, removing that from an environment, using a little bit more 1007.07s - 1012.51s | robust usernames, and how attacks like that might occur, Kerberos pre-authentication, and 1012.51s - 1017.61s | how that's a pretty quick, easy win, and then improvements to password hygiene and account 1017.61s - 1029.74s | lockout. Alright, so, on to level two. I like that cute little bunny over there. Um, so, I 1033.40s - 1038.10s | called this one enumeration, and then I, I told myself, nah, I should change it, cause this 1038.10s - 1043.02s | is a little bit more, like, privilege escalation, and lateral movement stuff, and I realized 1043.02s - 1049.23s | that, whatever, it's, it's just hard, so we're just gonna call it more hacks. So, the main 1049.23s - 1052.97s | difference between this level and the first level is that we're doing a little bit more while 1052.97s - 1058.05s | authenticated. So, what type of Active Directory presentation would be complete without 1058.05s - 1063.11s | talking about Kerberosting? So, Kerberosting is an attack on


chunk_text:
that we've identified as being able to patch, and so, in level one, we 1002.91s - 1007.07s | talked about anonymous access, removing that from an environment, using a little bit more 1007.07s - 1012.51s | robust usernames, and how attacks like that might occur, Kerberos pre-authentication, and 1012.51s - 1017.61s | how that's a pretty quick, easy win, and then improvements to password hygiene and account 1017.61s - 1029.74s | lockout. Alright, so, on to level two. I like that cute little bunny over there. Um, so, I 1033.40s - 1038.10s | called this one enumeration, and then I, I told myself, nah, I should change it, cause this 1038.10s - 1043.02s | is a little bit more, like, privilege escalation, and lateral movement stuff, and I realized 1043.02s - 1049.23s | that, whatever, it's, it's just hard, so we're just gonna call it more hacks. So, the main 1049.23s - 1052.97s | difference between this level and the first level is that we're doing a little bit more while 1052.97s - 1058.05s | authenticated. So, what type of Active Directory presentation would be complete without 1058.05s - 1063.11s | talking about Kerberosting? So, Kerberosting is an attack on accounts that have, uh, 1063.11s - 1067.65s | service principal names, or SPNs. So, here's what that looks like. It's an authenticated 1067.65s - 1072.65s | attack. You're able to identify both Jon Snow and the SQL service account are vulnerable to a 1074.17s - 1079.43s | Kerberosting attack. So, we're gonna take those hashes, we're gonna throw those through 1079.43s - 1085.87s | Hashcat again, and here we cracked the Jon Snow account, because it was a weak password. So, you 1090.10s - 1094.80s | can run something like this. So, this is a quick PowerShell search that you can run, uh, get 1094.80s - 1099.80s | an AD user, where you just are looking for accounts that have service principals, and these 1101.00s - 1105.44s | usually are not cleaned up, because service accounts are scary. So, if you're an 1105.44s - 1109.14s | administrator, you don't want to touch a service account, because you don't know if it's being 1109.14s - 1113.28s | used, or where it's used, and you dare not change the password, because you have no idea where 1113.28s - 1116.68s | to change it, what's gonna break, and change it back, like what's


chunk_text:
accounts that have, uh, 1063.11s - 1067.65s | service principal names, or SPNs. So, here's what that looks like. It's an authenticated 1067.65s - 1072.65s | attack. You're able to identify both Jon Snow and the SQL service account are vulnerable to a 1074.17s - 1079.43s | Kerberosting attack. So, we're gonna take those hashes, we're gonna throw those through 1079.43s - 1085.87s | Hashcat again, and here we cracked the Jon Snow account, because it was a weak password. So, you 1090.10s - 1094.80s | can run something like this. So, this is a quick PowerShell search that you can run, uh, get 1094.80s - 1099.80s | an AD user, where you just are looking for accounts that have service principals, and these 1101.00s - 1105.44s | usually are not cleaned up, because service accounts are scary. So, if you're an 1105.44s - 1109.14s | administrator, you don't want to touch a service account, because you don't know if it's being 1109.14s - 1113.28s | used, or where it's used, and you dare not change the password, because you have no idea where 1113.28s - 1116.68s | to change it, what's gonna break, and change it back, like what's gonna happen, right? I've been 1116.68s - 1120.16s | there, I did that for 15 years, and no, I didn't do this, and no, I didn't change those 1120.18s - 1125.66s | passwords. Um, but what I'm telling you we can do, is we can look at things like LastLogon, which 1125.66s - 1130.66s | may not be 100% accurate, but it may be helpful. Is the account privileged? If it's 1131.96s - 1137.80s | privileged, and it's Kerberostable, then that's pretty much a free win for an adversary. So, 1137.80s - 1142.80s | specify, uh, specifically look at those first. For the remaining ones, go ahead and look at what 1144.48s - 1149.44s | the service principal says. So, in our case, the Jon Snow account, and I realize that's a little 1149.46s - 1154.00s | bit small, but there's a HTTP setting in there, so there's a website that it's attempting to 1154.00s - 1159.64s | coordinate with, called the wall.north, seven kingdoms, etc. If I check DNS for that, it 1159.64s - 1164.64s | doesn't even exist. So, if I can't access that web server at all, then this service account's 1165.98s - 1170.98s | not doing


chunk_text:
gonna happen, right? I've been 1116.68s - 1120.16s | there, I did that for 15 years, and no, I didn't do this, and no, I didn't change those 1120.18s - 1125.66s | passwords. Um, but what I'm telling you we can do, is we can look at things like LastLogon, which 1125.66s - 1130.66s | may not be 100% accurate, but it may be helpful. Is the account privileged? If it's 1131.96s - 1137.80s | privileged, and it's Kerberostable, then that's pretty much a free win for an adversary. So, 1137.80s - 1142.80s | specify, uh, specifically look at those first. For the remaining ones, go ahead and look at what 1144.48s - 1149.44s | the service principal says. So, in our case, the Jon Snow account, and I realize that's a little 1149.46s - 1154.00s | bit small, but there's a HTTP setting in there, so there's a website that it's attempting to 1154.00s - 1159.64s | coordinate with, called the wall.north, seven kingdoms, etc. If I check DNS for that, it 1159.64s - 1164.64s | doesn't even exist. So, if I can't access that web server at all, then this service account's 1165.98s - 1170.98s | not doing anything. So, we're gonna go ahead and remove that. The one that's going to remain 1170.98s - 1176.42s | is the SQL service account, because it actually is running SQL, it's required to do that. Uh, 1176.44s - 1182.18s | that one didn't crack, because it's using a long, strong, complicated, random password. And so, 1182.18s - 1187.18s | that's how you protect other accounts that are, um, Kerberostable, is with, with that. And so, 1189.12s - 1193.76s | this is what the attack looks like now that we removed the service principal. Jon Snow no 1193.76s - 1207.24s | longer shows up as even being attackable. On path attacks. So, this I like to claim to be God's 1208.16s - 1213.16s | gift to AD pentesters. Is that right, you pentesters? Right? This, um, responder, you set 1217.00s - 1223.34s | this up and it, it'll just listen and respond to clients on the network. It's gonna say, uh, 1223.34s - 1227.34s | client's gonna come out and say, hey, I'm looking for so and so, and it's like, yeah, that's me. 1227.34s - 1232.28s | Yeah, that's me too, that's me too. And, um, if we have it


chunk_text:
anything. So, we're gonna go ahead and remove that. The one that's going to remain 1170.98s - 1176.42s | is the SQL service account, because it actually is running SQL, it's required to do that. Uh, 1176.44s - 1182.18s | that one didn't crack, because it's using a long, strong, complicated, random password. And so, 1182.18s - 1187.18s | that's how you protect other accounts that are, um, Kerberostable, is with, with that. And so, 1189.12s - 1193.76s | this is what the attack looks like now that we removed the service principal. Jon Snow no 1193.76s - 1207.24s | longer shows up as even being attackable. On path attacks. So, this I like to claim to be God's 1208.16s - 1213.16s | gift to AD pentesters. Is that right, you pentesters? Right? This, um, responder, you set 1217.00s - 1223.34s | this up and it, it'll just listen and respond to clients on the network. It's gonna say, uh, 1223.34s - 1227.34s | client's gonna come out and say, hey, I'm looking for so and so, and it's like, yeah, that's me. 1227.34s - 1232.28s | Yeah, that's me too, that's me too. And, um, if we have it set up in this way, it can poison 1232.32s - 1238.46s | those requests and we can actually get NTLM hashes. In this case, it's NTLM v1 hashes for these 1238.46s - 1242.96s | accounts. And so, we can do what we've done twice already, is we can crack them hashes again 1242.96s - 1248.48s | with Hashcat. And so, here we've got our third account that we've been able to crack. And this 1248.48s - 1255.32s | one was just from listening to the network. And while that's scary, the scarier thing that you 1255.32s - 1260.42s | can do is you can configure responder to run in a similar way, but instead of giving you the 1260.46s - 1265.94s | hashed credentials, you can tell it to go ahead and pass those or relay those using NTLM relay 1265.94s - 1271.00s | X. And you can relay that authentication attempt to a target or targets. So, in this case, I'm 1271.00s - 1276.64s | targeting a web server, the one that ends in 22 there. And I'm just gonna wait for responder to 1276.64s - 1282.28s | get some authentication to happen. It's gonna send that here and


chunk_text:
set up in this way, it can poison 1232.32s - 1238.46s | those requests and we can actually get NTLM hashes. In this case, it's NTLM v1 hashes for these 1238.46s - 1242.96s | accounts. And so, we can do what we've done twice already, is we can crack them hashes again 1242.96s - 1248.48s | with Hashcat. And so, here we've got our third account that we've been able to crack. And this 1248.48s - 1255.32s | one was just from listening to the network. And while that's scary, the scarier thing that you 1255.32s - 1260.42s | can do is you can configure responder to run in a similar way, but instead of giving you the 1260.46s - 1265.94s | hashed credentials, you can tell it to go ahead and pass those or relay those using NTLM relay 1265.94s - 1271.00s | X. And you can relay that authentication attempt to a target or targets. So, in this case, I'm 1271.00s - 1276.64s | targeting a web server, the one that ends in 22 there. And I'm just gonna wait for responder to 1276.64s - 1282.28s | get some authentication to happen. It's gonna send that here and then I've told it to set up a 1282.28s - 1286.76s | SOX proxy. So, I've got an active connection using Edward Stark, which just happens to be an 1286.76s - 1293.78s | administrator on that web server. So, now, we've got a shell on our target. So, we can do 1293.78s - 1299.94s | things like this, where we can interrupt, uh, interact with that session and we can run 1299.94s - 1307.56s | secrets dump on it. Pardon me. So, you can see I specified no password. I don't need a 1307.56s - 1311.84s | password. I've already authenticated to it. I have an active session and I can run secrets dump 1311.84s - 1317.04s | against it and I can dump the local SAM hashes. So, this includes the local administrator 1317.08s - 1320.92s | account. Any other local accounts that exist. So, if you've got like a help desk account or 1320.92s - 1325.68s | something like that, that you've, you've placed on systems. This will dump all local credentials 1325.68s - 1330.70s | on that, that server or workstation. Also more fun, it's gonna extract saved credentials. So, here 1333.20s - 1339.26s | we're attacking


chunk_text:
then I've told it to set up a 1282.28s - 1286.76s | SOX proxy. So, I've got an active connection using Edward Stark, which just happens to be an 1286.76s - 1293.78s | administrator on that web server. So, now, we've got a shell on our target. So, we can do 1293.78s - 1299.94s | things like this, where we can interrupt, uh, interact with that session and we can run 1299.94s - 1307.56s | secrets dump on it. Pardon me. So, you can see I specified no password. I don't need a 1307.56s - 1311.84s | password. I've already authenticated to it. I have an active session and I can run secrets dump 1311.84s - 1317.04s | against it and I can dump the local SAM hashes. So, this includes the local administrator 1317.08s - 1320.92s | account. Any other local accounts that exist. So, if you've got like a help desk account or 1320.92s - 1325.68s | something like that, that you've, you've placed on systems. This will dump all local credentials 1325.68s - 1330.70s | on that, that server or workstation. Also more fun, it's gonna extract saved credentials. So, here 1333.20s - 1339.26s | we're attacking service account. So, if you may recognize the SQL service account that was not 1339.26s - 1345.64s | Kerberoastable. You will not be Kerberoasting me. Uh, was in plain text because it's configured as 1345.64s - 1351.44s | a service. It's running a service which is required for SQL, SQL Express. So, that account 1351.44s - 1356.46s | was free on that machine. And so, what can we do for on path attacks? So, the quickest and 1358.96s - 1365.10s | probably, uh, the easiest of all of these is preventing the LLMNR, which is link local 1365.10s - 1370.36s | multicast name resolution. Yes, I had to write that down and no, I'll not memorize that. Um, I 1370.36s - 1375.32s | do have a, a great article linked for that one as well. Actually, I have articles for all 1375.32s - 1382.34s | these. Um, you may have remembered or noticed that, that those hashes were NTLMV1 hashes 1382.34s - 1388.24s | with, which are infinitely easier to attack than NTLMV2. So, enforcing this on your domain 1388.24s - 1393.24s | controller and setting it to the highest security level of enforcing NTLMV2 to exist on your 1393.90s


chunk_text:
service account. So, if you may recognize the SQL service account that was not 1339.26s - 1345.64s | Kerberoastable. You will not be Kerberoasting me. Uh, was in plain text because it's configured as 1345.64s - 1351.44s | a service. It's running a service which is required for SQL, SQL Express. So, that account 1351.44s - 1356.46s | was free on that machine. And so, what can we do for on path attacks? So, the quickest and 1358.96s - 1365.10s | probably, uh, the easiest of all of these is preventing the LLMNR, which is link local 1365.10s - 1370.36s | multicast name resolution. Yes, I had to write that down and no, I'll not memorize that. Um, I 1370.36s - 1375.32s | do have a, a great article linked for that one as well. Actually, I have articles for all 1375.32s - 1382.34s | these. Um, you may have remembered or noticed that, that those hashes were NTLMV1 hashes 1382.34s - 1388.24s | with, which are infinitely easier to attack than NTLMV2. So, enforcing this on your domain 1388.24s - 1393.24s | controller and setting it to the highest security level of enforcing NTLMV2 to exist on your 1393.90s - 1398.90s | network. Ideally, not allowing NTLM at all and allowing Kerberos to do what it's supposed to do 1401.74s - 1407.98s | for the last 20 years. Uh, this is hard and I don't know that I've ever fully seen this. I've 1407.98s - 1412.52s | seen people auditing it and, and really starting to get ready for it. Um, another thing that 1412.52s - 1418.42s | we've seen, I think twice at Trimark is LDAP signing and channel binding. This is another 1418.42s - 1422.96s | thing that's incredibly difficult. It can break a lot of those non-Windows devices. I've 1422.98s - 1430.60s | also got a couple links to some articles that have been written about this as well. A thing 1430.60s - 1434.70s | that I don't think's all that hard, some administrators do think that's hard, that this is 1434.70s - 1439.48s | hard. Um, this is protecting the accounts themselves. So, this might be a little bit easier 1439.48s - 1444.52s | to get through some of that change management for you, is using the protected users group. 1444.52s - 1447.82s | Because you're only impacting whatever users you put in it and


chunk_text:
- 1398.90s | network. Ideally, not allowing NTLM at all and allowing Kerberos to do what it's supposed to do 1401.74s - 1407.98s | for the last 20 years. Uh, this is hard and I don't know that I've ever fully seen this. I've 1407.98s - 1412.52s | seen people auditing it and, and really starting to get ready for it. Um, another thing that 1412.52s - 1418.42s | we've seen, I think twice at Trimark is LDAP signing and channel binding. This is another 1418.42s - 1422.96s | thing that's incredibly difficult. It can break a lot of those non-Windows devices. I've 1422.98s - 1430.60s | also got a couple links to some articles that have been written about this as well. A thing 1430.60s - 1434.70s | that I don't think's all that hard, some administrators do think that's hard, that this is 1434.70s - 1439.48s | hard. Um, this is protecting the accounts themselves. So, this might be a little bit easier 1439.48s - 1444.52s | to get through some of that change management for you, is using the protected users group. 1444.52s - 1447.82s | Because you're only impacting whatever users you put in it and not the enterprise when you're 1447.82s - 1453.30s | making domain controller changes. Uh, co-worker of mine, Jake Hildreth, which owns our Active 1453.32s - 1458.12s | Directory Security Assessments. He has a blog and a presentation. He's writing a tool to help 1458.12s - 1464.40s | assist with end users adding, uh, accounts to the protected users group. So, again, I've got 1464.40s - 1469.40s | that in the resources. Alright, so level two's down. We Kerberos to John Snow. We cracked the 1471.00s - 1476.00s | hash from responder for Rob Stark. And we found the SQL service account running. So, now 1476.54s - 1481.54s | we've got six accounts. And we've got five more vulnerabilities that we have patched. So, we 1483.82s - 1488.82s | cleaned up SPNs. We disabled LLMNR and NTLM V1 by enforcing V2. We talked a little bit about 1492.40s - 1496.76s | at least thinking about LDAP signing and channel binding. And then also the protected users 1496.76s - 1505.68s | group. Protecting, um, those highly privileged users in your, your domain. So, level three, I 1505.68s - 1509.92s | called PrivEsc. Again, this is maybe a little bit more lateral movement-y.


chunk_text:
not the enterprise when you're 1447.82s - 1453.30s | making domain controller changes. Uh, co-worker of mine, Jake Hildreth, which owns our Active 1453.32s - 1458.12s | Directory Security Assessments. He has a blog and a presentation. He's writing a tool to help 1458.12s - 1464.40s | assist with end users adding, uh, accounts to the protected users group. So, again, I've got 1464.40s - 1469.40s | that in the resources. Alright, so level two's down. We Kerberos to John Snow. We cracked the 1471.00s - 1476.00s | hash from responder for Rob Stark. And we found the SQL service account running. So, now 1476.54s - 1481.54s | we've got six accounts. And we've got five more vulnerabilities that we have patched. So, we 1483.82s - 1488.82s | cleaned up SPNs. We disabled LLMNR and NTLM V1 by enforcing V2. We talked a little bit about 1492.40s - 1496.76s | at least thinking about LDAP signing and channel binding. And then also the protected users 1496.76s - 1505.68s | group. Protecting, um, those highly privileged users in your, your domain. So, level three, I 1505.68s - 1509.92s | called PrivEsc. Again, this is maybe a little bit more lateral movement-y. Um, also some 1509.92s - 1515.70s | pretty, pretty domain crushing attacks in this one too. And I'm gonna kinda start by going 1515.70s - 1520.44s | backwards just a smidge. Cause I wanted to show Bloodhound just a, just a little bit. Um, 1520.44s - 1525.34s | Bloodhound is an amazing tool that you can use to scan your Active Directory environment. And 1525.34s - 1531.38s | here I'm just showcasing what paths are available to domain admin. And here I'm gonna zoom in 1531.38s - 1536.32s | on the one that we just owned. So, we just got that Rob Stark account. And Rob Stark is a 1536.32s - 1540.82s | member of the administrators group, which is just this very simple step away from domain 1540.82s - 1544.82s | admins. And so, that one's just a little bit too boring, cause you can just add yourself to that 1544.82s - 1550.40s | group, right? So, we're gonna do something cool. And we're gonna identify what ACL modification 1550.40s - 1555.18s | may look like. So, here you might remember our old friend Samwell, who was our first attack 1555.18s - 1559.54s | with that description field misconfiguration.


chunk_text:
Um, also some 1509.92s - 1515.70s | pretty, pretty domain crushing attacks in this one too. And I'm gonna kinda start by going 1515.70s - 1520.44s | backwards just a smidge. Cause I wanted to show Bloodhound just a, just a little bit. Um, 1520.44s - 1525.34s | Bloodhound is an amazing tool that you can use to scan your Active Directory environment. And 1525.34s - 1531.38s | here I'm just showcasing what paths are available to domain admin. And here I'm gonna zoom in 1531.38s - 1536.32s | on the one that we just owned. So, we just got that Rob Stark account. And Rob Stark is a 1536.32s - 1540.82s | member of the administrators group, which is just this very simple step away from domain 1540.82s - 1544.82s | admins. And so, that one's just a little bit too boring, cause you can just add yourself to that 1544.82s - 1550.40s | group, right? So, we're gonna do something cool. And we're gonna identify what ACL modification 1550.40s - 1555.18s | may look like. So, here you might remember our old friend Samwell, who was our first attack 1555.18s - 1559.54s | with that description field misconfiguration. Well, Samwell, for whatever reason, has the 1559.54s - 1564.54s | ability, has a write DAQL on a GPO that's linked to the domain root. So, what does that look 1566.38s - 1573.65s | like? So, here's what it looks like when we look at the policy itself. We see that the 1573.65s - 1578.79s | delegation tab shows us that we have some privileges with Samwell. If we dig into him a 1578.79s - 1582.83s | little bit, we identify he doesn't look too terribly dangerous, because he doesn't have write 1582.83s - 1587.83s | permission. He has read and he has, um, delete. But we have to actually look at advanced to 1588.07s - 1593.07s | identify what the real threat to this is, which is that write DAQL permission, which 1594.23s - 1600.27s | translates to modify permissions and modify ownership. So, Sam can give himself, or anyone 1600.27s - 1605.47s | else, access to modify this GPO. And there's a number of different things you can do once you 1605.47s - 1611.55s | can modify a GPO, specifically at the domain root. One such example is just creating a file 1611.55s - 1616.79s | that's gonna


chunk_text:
Well, Samwell, for whatever reason, has the 1559.54s - 1564.54s | ability, has a write DAQL on a GPO that's linked to the domain root. So, what does that look 1566.38s - 1573.65s | like? So, here's what it looks like when we look at the policy itself. We see that the 1573.65s - 1578.79s | delegation tab shows us that we have some privileges with Samwell. If we dig into him a 1578.79s - 1582.83s | little bit, we identify he doesn't look too terribly dangerous, because he doesn't have write 1582.83s - 1587.83s | permission. He has read and he has, um, delete. But we have to actually look at advanced to 1588.07s - 1593.07s | identify what the real threat to this is, which is that write DAQL permission, which 1594.23s - 1600.27s | translates to modify permissions and modify ownership. So, Sam can give himself, or anyone 1600.27s - 1605.47s | else, access to modify this GPO. And there's a number of different things you can do once you 1605.47s - 1611.55s | can modify a GPO, specifically at the domain root. One such example is just creating a file 1611.55s - 1616.79s | that's gonna run at login for all users on all computers in your environment. So, we can do 1616.79s - 1622.85s | some pretty messy stuff with that. So, mitigating this is, is fairly simple. You just have to 1622.85s - 1628.49s | check out the, the GPOs. I don't have a script for this. Um, I should probably write one. So, I 1628.49s - 1632.29s | may write one and put it up on GitHub, where you can actually scan some of the ACLs that might 1632.29s - 1636.73s | be dangerous. But specifically start with your domain root and then move on to domain 1636.73s - 1642.55s | controllers, move to, uh, other protected OUs to identify group policies that maybe have 1642.57s - 1647.57s | delegations. Uh, also ownership. So, identify who has owner on your GPOs. And so, if we clean 1650.91s - 1658.23s | that up, then we're in a lot better shape for any of that ACL modification. So, I'm gonna take 1658.23s - 1664.03s | us a little bit back. So, you remember when we attacked the web server that we were 1664.03s - 1669.97s | targeting, this stuff? Um, I don't really remember either,


chunk_text:
run at login for all users on all computers in your environment. So, we can do 1616.79s - 1622.85s | some pretty messy stuff with that. So, mitigating this is, is fairly simple. You just have to 1622.85s - 1628.49s | check out the, the GPOs. I don't have a script for this. Um, I should probably write one. So, I 1628.49s - 1632.29s | may write one and put it up on GitHub, where you can actually scan some of the ACLs that might 1632.29s - 1636.73s | be dangerous. But specifically start with your domain root and then move on to domain 1636.73s - 1642.55s | controllers, move to, uh, other protected OUs to identify group policies that maybe have 1642.57s - 1647.57s | delegations. Uh, also ownership. So, identify who has owner on your GPOs. And so, if we clean 1650.91s - 1658.23s | that up, then we're in a lot better shape for any of that ACL modification. So, I'm gonna take 1658.23s - 1664.03s | us a little bit back. So, you remember when we attacked the web server that we were 1664.03s - 1669.97s | targeting, this stuff? Um, I don't really remember either, but basically what we did was we 1670.01s - 1676.19s | were able to gain the local credentials for that web server. And what we can do with local 1676.19s - 1682.69s | credentials is we can do a pass the hash attack. So, in this example, we're using the 1682.69s - 1686.99s | administrator. This could be, like I said, a help desk account or any other local account. And 1686.99s - 1693.07s | we can target all other known IPs in that domain. And this could be, uh, servers. This could 1693.07s - 1699.35s | be workstations. And in this case, we identify that very first one, the castle black. That's 1699.35s - 1702.93s | the one that we attacked. We expected that one to show up as pwned. But that bottom one, 1702.93s - 1709.09s | Winterfell, is actually a domain controller. It's, I mean, this is a lab, so this is fairly 1709.09s - 1713.37s | unrealistic. But the reason this works is because when you promote your first domain 1713.37s - 1718.37s | controller, it's going to use that credential as the domain administrator credential. Um, so 1720.31s - 1725.11s | just a little bit


chunk_text:
but basically what we did was we 1670.01s - 1676.19s | were able to gain the local credentials for that web server. And what we can do with local 1676.19s - 1682.69s | credentials is we can do a pass the hash attack. So, in this example, we're using the 1682.69s - 1686.99s | administrator. This could be, like I said, a help desk account or any other local account. And 1686.99s - 1693.07s | we can target all other known IPs in that domain. And this could be, uh, servers. This could 1693.07s - 1699.35s | be workstations. And in this case, we identify that very first one, the castle black. That's 1699.35s - 1702.93s | the one that we attacked. We expected that one to show up as pwned. But that bottom one, 1702.93s - 1709.09s | Winterfell, is actually a domain controller. It's, I mean, this is a lab, so this is fairly 1709.09s - 1713.37s | unrealistic. But the reason this works is because when you promote your first domain 1713.37s - 1718.37s | controller, it's going to use that credential as the domain administrator credential. Um, so 1720.31s - 1725.11s | just a little bit of digression on that. But with that, we don't even need to know what the 1725.11s - 1729.69s | password is for that administrative account. We can just pass that hash and authenticate. And 1729.69s - 1734.89s | here, I'm using EvilWinRM. And you can see at the bottom that I've got a shell on our domain 1734.89s - 1739.89s | controller. And solution for this is to use something like LAPS. So, old admins like myself 1742.67s - 1747.67s | maybe remember that the days before LAPS was a thing where you would use a GPO and you'd set the 1748.17s - 1753.17s | local administrator account on all machines. And thanks to the C password, where everybody 1755.51s - 1761.05s | could read that, we've now got clear text credentials. So, other than even just reuse and 1761.05s - 1766.05s | passing the hash, uh, C password has clear text creds. That's not even an attack that, that I 1767.49s - 1772.69s | showcased in this. It's fairly old. We do still see it on old GPOs. Even if they're unlinked, they 1772.71s - 1778.65s | still have some C passwords in them. So, you may check that.


chunk_text:
of digression on that. But with that, we don't even need to know what the 1725.11s - 1729.69s | password is for that administrative account. We can just pass that hash and authenticate. And 1729.69s - 1734.89s | here, I'm using EvilWinRM. And you can see at the bottom that I've got a shell on our domain 1734.89s - 1739.89s | controller. And solution for this is to use something like LAPS. So, old admins like myself 1742.67s - 1747.67s | maybe remember that the days before LAPS was a thing where you would use a GPO and you'd set the 1748.17s - 1753.17s | local administrator account on all machines. And thanks to the C password, where everybody 1755.51s - 1761.05s | could read that, we've now got clear text credentials. So, other than even just reuse and 1761.05s - 1766.05s | passing the hash, uh, C password has clear text creds. That's not even an attack that, that I 1767.49s - 1772.69s | showcased in this. It's fairly old. We do still see it on old GPOs. Even if they're unlinked, they 1772.71s - 1778.65s | still have some C passwords in them. So, you may check that. But this is what LAPS looks like. Um, 1778.65s - 1785.07s | I've got articles on that as well. Cause I'm not gonna go super into LAPS. I am gonna go a little 1785.07s - 1795.28s | bit into Kerberos delegation though. So, Kerberos delegation is a required feature of Windows. 1798.02s - 1803.58s | It's when, an example would be when a user authenticates to a web server and then that web 1803.60s - 1809.30s | server needs to authenticate on behalf of that user to a database server, for example, to be able 1809.30s - 1815.12s | to, uh, provide the, the correct results for the user that's asking. So, it's kind of a security 1815.12s - 1818.88s | thing. It's pretty much built in. But in this case, when we talk about delegation, we're talking 1818.88s - 1824.16s | about impersonation. Which means that web server has the ability to impersonate any user in the 1824.16s - 1829.64s | domain. And so, what that looks like, specifically when we're attacking const- uh, 1829.66s - 1835.32s | unconstrained delegation, is we have a shell on that web server that we had shown that we 1835.32s - 1841.84s |


chunk_text:
But this is what LAPS looks like. Um, 1778.65s - 1785.07s | I've got articles on that as well. Cause I'm not gonna go super into LAPS. I am gonna go a little 1785.07s - 1795.28s | bit into Kerberos delegation though. So, Kerberos delegation is a required feature of Windows. 1798.02s - 1803.58s | It's when, an example would be when a user authenticates to a web server and then that web 1803.60s - 1809.30s | server needs to authenticate on behalf of that user to a database server, for example, to be able 1809.30s - 1815.12s | to, uh, provide the, the correct results for the user that's asking. So, it's kind of a security 1815.12s - 1818.88s | thing. It's pretty much built in. But in this case, when we talk about delegation, we're talking 1818.88s - 1824.16s | about impersonation. Which means that web server has the ability to impersonate any user in the 1824.16s - 1829.64s | domain. And so, what that looks like, specifically when we're attacking const- uh, 1829.66s - 1835.32s | unconstrained delegation, is we have a shell on that web server that we had shown that we 1835.32s - 1841.84s | attacked earlier. And since it's set up for unconstrained delegation, we either wait, or we 1841.84s - 1846.84s | can con, um, coerce an administrator to log into that system that we're in control of. And so, 1848.24s - 1854.38s | here, using Mimikatz, I was able to export the tickets for Brandon. So, a client named Brandon. 1854.40s - 1862.56s | Uh, Brandon was very impressionable admin at the time. So, Brandon logged into our, our server 1865.02s - 1871.22s | that we had control of. Using Mimikatz, we were able to set up what's called a pass the ticket 1871.22s - 1876.74s | attack. And then we load that ticket into our session. And we can view that using that K list 1876.74s - 1881.84s | tickets to identify that we have that cached ticket for Brandon. And then that last command in 1881.84s - 1887.08s | the bottom is just opening a PowerShell, PowerShell session to a domain controller. So, 1887.08s - 1894.10s | we're authenticating as a domain admin to a domain controller. And now, we've got a shell on 1894.10s - 1899.94s | the domain. We run whoami. We just look at sysvol. And so,


chunk_text:
attacked earlier. And since it's set up for unconstrained delegation, we either wait, or we 1841.84s - 1846.84s | can con, um, coerce an administrator to log into that system that we're in control of. And so, 1848.24s - 1854.38s | here, using Mimikatz, I was able to export the tickets for Brandon. So, a client named Brandon. 1854.40s - 1862.56s | Uh, Brandon was very impressionable admin at the time. So, Brandon logged into our, our server 1865.02s - 1871.22s | that we had control of. Using Mimikatz, we were able to set up what's called a pass the ticket 1871.22s - 1876.74s | attack. And then we load that ticket into our session. And we can view that using that K list 1876.74s - 1881.84s | tickets to identify that we have that cached ticket for Brandon. And then that last command in 1881.84s - 1887.08s | the bottom is just opening a PowerShell, PowerShell session to a domain controller. So, 1887.08s - 1894.10s | we're authenticating as a domain admin to a domain controller. And now, we've got a shell on 1894.10s - 1899.94s | the domain. We run whoami. We just look at sysvol. And so, now, we've basically owned that 1899.94s - 1905.08s | domain controller. I've got a lot more attacks to, to go. So, I'm not gonna stop there, though. 1905.08s - 1910.38s | So, how do we stop this specifically? So, moving unconstrained delegation to constrained 1910.38s - 1916.78s | delegation is a good way to mitigate this. Uh, you can specify the specific service or server 1916.78s - 1925.21s | that's required instead of just allowing delegation to occur wherever, wherever it needs. 1925.21s - 1931.39s | That, again, can be somewhat difficult to identify. So, what I like to do, even in the, I'm not 1931.39s - 1936.33s | saying don't do that, but what I am saying do is mark accounts as sensitive and cannot be 1936.33s - 1941.19s | delegated. So, all of your administrators, this is kind of a baby step to the protected users 1941.19s - 1945.81s | group. Set them up like this. Because, like I said, Brandon was very impressionable. And he 1945.81s - 1950.65s | could be tricked to logging into wherever, because he's an admin. You know, somebody, user 1950.65s - 1954.55s | calls, he logs in wherever they tell him to


chunk_text:
now, we've basically owned that 1899.94s - 1905.08s | domain controller. I've got a lot more attacks to, to go. So, I'm not gonna stop there, though. 1905.08s - 1910.38s | So, how do we stop this specifically? So, moving unconstrained delegation to constrained 1910.38s - 1916.78s | delegation is a good way to mitigate this. Uh, you can specify the specific service or server 1916.78s - 1925.21s | that's required instead of just allowing delegation to occur wherever, wherever it needs. 1925.21s - 1931.39s | That, again, can be somewhat difficult to identify. So, what I like to do, even in the, I'm not 1931.39s - 1936.33s | saying don't do that, but what I am saying do is mark accounts as sensitive and cannot be 1936.33s - 1941.19s | delegated. So, all of your administrators, this is kind of a baby step to the protected users 1941.19s - 1945.81s | group. Set them up like this. Because, like I said, Brandon was very impressionable. And he 1945.81s - 1950.65s | could be tricked to logging into wherever, because he's an admin. You know, somebody, user 1950.65s - 1954.55s | calls, he logs in wherever they tell him to log in as his domain admin credentials, right? 1954.55s - 1960.73s | What could go wrong? So, now that I've set Brandon as sensitive, he can't be delegated, on 1960.73s - 1965.77s | the right here is what we just did. So, that's what the attack looked like in Mimi Cats. If 1965.77s - 1972.03s | that attack were to attempt, be attempted when the account was set up, he, he was still, he 1972.03s - 1976.83s | still logged in and we can still look at some stuff in Mimi Cats, but we don't have that ticket 1976.83s - 1980.31s | granting ticket, which means we can't load it into the session and we can't attack that account 1980.31s - 1990.05s | anymore. Alright, so, level 3 is over. We don't have any new accounts, but we're kind of beyond 1990.05s - 1994.93s | that now. You know, we've kind of gotten to the point where we're already, uh, on the precipice 1994.93s - 1999.93s | of domain admin. We've already kind of gained that full domain, uh, compromise. So, what we've 2000.63s - 2005.63s | learned in, in level 3 is how to fix ACL and ownership issues,


chunk_text:
log in as his domain admin credentials, right? 1954.55s - 1960.73s | What could go wrong? So, now that I've set Brandon as sensitive, he can't be delegated, on 1960.73s - 1965.77s | the right here is what we just did. So, that's what the attack looked like in Mimi Cats. If 1965.77s - 1972.03s | that attack were to attempt, be attempted when the account was set up, he, he was still, he 1972.03s - 1976.83s | still logged in and we can still look at some stuff in Mimi Cats, but we don't have that ticket 1976.83s - 1980.31s | granting ticket, which means we can't load it into the session and we can't attack that account 1980.31s - 1990.05s | anymore. Alright, so, level 3 is over. We don't have any new accounts, but we're kind of beyond 1990.05s - 1994.93s | that now. You know, we've kind of gotten to the point where we're already, uh, on the precipice 1994.93s - 1999.93s | of domain admin. We've already kind of gained that full domain, uh, compromise. So, what we've 2000.63s - 2005.63s | learned in, in level 3 is how to fix ACL and ownership issues, specifically on GPOs, but other 2008.07s - 2013.61s | objects are also important. Configuring laps to prevent things like local administrative 2013.61s - 2018.45s | credentials beyond multiple machines being able to perform lateral movement. Implementing 2018.45s - 2022.65s | constrained delegation instead of unconstrained, and then protecting your admin accounts using 2022.65s - 2035.60s | the account as sensitive and cannot be delegated flag. Alright, now the fun one. We're gonna 2035.60s - 2040.60s | pwn AD. So, the print nightmare. I don't know if you all remember this. Um, it was 3 years ago, 2043.70s - 2048.00s | I think now, and this I like to call the attack that got me into InfoSec. So, I told you I 2048.00s - 2052.88s | worked for TriMark for 2 and a half years now. Print nightmare came out when I was still a 2052.88s - 2058.82s | sysadmin. It let me poke at it and proved to my administrators that it was exploitable. So, we 2058.82s - 2064.62s | had something to do. So, this is what that looks like. So, running a CrackMap exec tool as 2064.64s - 2071.02s | well as the impact tool, we identified that


chunk_text:
specifically on GPOs, but other 2008.07s - 2013.61s | objects are also important. Configuring laps to prevent things like local administrative 2013.61s - 2018.45s | credentials beyond multiple machines being able to perform lateral movement. Implementing 2018.45s - 2022.65s | constrained delegation instead of unconstrained, and then protecting your admin accounts using 2022.65s - 2035.60s | the account as sensitive and cannot be delegated flag. Alright, now the fun one. We're gonna 2035.60s - 2040.60s | pwn AD. So, the print nightmare. I don't know if you all remember this. Um, it was 3 years ago, 2043.70s - 2048.00s | I think now, and this I like to call the attack that got me into InfoSec. So, I told you I 2048.00s - 2052.88s | worked for TriMark for 2 and a half years now. Print nightmare came out when I was still a 2052.88s - 2058.82s | sysadmin. It let me poke at it and proved to my administrators that it was exploitable. So, we 2058.82s - 2064.62s | had something to do. So, this is what that looks like. So, running a CrackMap exec tool as 2064.64s - 2071.02s | well as the impact tool, we identified that the spooler is running on our target system and the 2071.02s - 2079.25s | protocols necessary to perform the attack are also available. So, what this attack looks like 2079.25s - 2083.99s | is we can just host a malicious DLL on a Samba share from this Kali box. This is where the 2083.99s - 2088.99s | screenshots are coming from. Using the cube 0x0 exploit, we can target the domain controller and 2091.79s - 2095.81s | we're using just a regular user account. So, that Hodor account that we grabbed, no 2095.83s - 2100.29s | administrative credentials in the domain whatsoever, can authenticate to that domain 2100.29s - 2106.51s | controller and because the print spooler is is available on that server, we can throw this 2106.51s - 2111.51s | nightmare DLL at it and it says exploit completed. And what that exploit does is it's created a 2114.75s - 2120.29s | new account for us in the domain. It's called print nightmare 2 and it is in the 2120.29s - 2127.70s | administrator's group. And this is my favorite mitigation because it's the easiest 2127.74s - 2133.02s | mitigation. So, we just disable the print spooler. And yes,


chunk_text:
the spooler is running on our target system and the 2071.02s - 2079.25s | protocols necessary to perform the attack are also available. So, what this attack looks like 2079.25s - 2083.99s | is we can just host a malicious DLL on a Samba share from this Kali box. This is where the 2083.99s - 2088.99s | screenshots are coming from. Using the cube 0x0 exploit, we can target the domain controller and 2091.79s - 2095.81s | we're using just a regular user account. So, that Hodor account that we grabbed, no 2095.83s - 2100.29s | administrative credentials in the domain whatsoever, can authenticate to that domain 2100.29s - 2106.51s | controller and because the print spooler is is available on that server, we can throw this 2106.51s - 2111.51s | nightmare DLL at it and it says exploit completed. And what that exploit does is it's created a 2114.75s - 2120.29s | new account for us in the domain. It's called print nightmare 2 and it is in the 2120.29s - 2127.70s | administrator's group. And this is my favorite mitigation because it's the easiest 2127.74s - 2133.02s | mitigation. So, we just disable the print spooler. And yes, I I know print nightmare has been 2133.02s - 2138.42s | patched, thank goodness. So, not this specific attack is available everywhere anymore, but the 2138.42s - 2144.06s | print spooler is used in so many coercion attacks that can occur now that I like to say, if 2144.06s - 2150.66s | you're not printing or performing printing as a print server, then you have no need to run the 2150.66s - 2157.04s | print spooler whatsoever. So, disable it either manually here or use a GPO to to disable it and 2157.08s - 2165.42s | here you see on the right hand side that that server is no longer vulnerable to attack. So, our 2165.42s - 2171.92s | last attack is gonna be um one of the active directory certificate services, so ADCS, uh 2171.92s - 2177.12s | vulnerable con-configuration that we're gonna attack using the certify tool. So, this has been 2177.12s - 2183.14s | very popular over the last couple years. Uh about two years ago or so, we saw this as a 2183.14s - 2187.60s | critical vulnerability on almost every single assessment that we did. Thankfully, things have 2187.60s - 2191.84s | gotten a little


chunk_text:
I I know print nightmare has been 2133.02s - 2138.42s | patched, thank goodness. So, not this specific attack is available everywhere anymore, but the 2138.42s - 2144.06s | print spooler is used in so many coercion attacks that can occur now that I like to say, if 2144.06s - 2150.66s | you're not printing or performing printing as a print server, then you have no need to run the 2150.66s - 2157.04s | print spooler whatsoever. So, disable it either manually here or use a GPO to to disable it and 2157.08s - 2165.42s | here you see on the right hand side that that server is no longer vulnerable to attack. So, our 2165.42s - 2171.92s | last attack is gonna be um one of the active directory certificate services, so ADCS, uh 2171.92s - 2177.12s | vulnerable con-configuration that we're gonna attack using the certify tool. So, this has been 2177.12s - 2183.14s | very popular over the last couple years. Uh about two years ago or so, we saw this as a 2183.14s - 2187.60s | critical vulnerability on almost every single assessment that we did. Thankfully, things have 2187.60s - 2191.84s | gotten a little bit better in the industry now. But this is what that looks like. So, we're 2191.84s - 2198.52s | gonna run our certify tool with a find command. This is just using a regular user account to a 2198.52s - 2206.37s | domain controller. So, our output's gonna include all the vulnerabilities that exist in that 2206.37s - 2210.29s | domain, if it's running uh certificate services. And yeah, I'm gonna drill into that, 2210.29s - 2216.95s | cause it's hard to see. So, the specific one that we're gonna pick out is called ESC1 or uh 2216.95s - 2222.19s | escalation one. This is from the certify pre-owned stuff that Spectrops put out. Um it's 2222.19s - 2228.23s | also in the resources. So, what makes us vulnerable is that enrollee subject uh enrollee 2228.23s - 2233.07s | supply subject, which equals the subject alternative name, can be applied when you enroll a 2233.07s - 2238.07s | certificate. The second half of that puzzle is who can enroll dangerous certificates. So, in 2241.01s - 2246.61s | this case, we have domain users, have enrollment rights, and that means that anybody can 2247.27s - 2253.44s | enroll a certificate and


chunk_text:
bit better in the industry now. But this is what that looks like. So, we're 2191.84s - 2198.52s | gonna run our certify tool with a find command. This is just using a regular user account to a 2198.52s - 2206.37s | domain controller. So, our output's gonna include all the vulnerabilities that exist in that 2206.37s - 2210.29s | domain, if it's running uh certificate services. And yeah, I'm gonna drill into that, 2210.29s - 2216.95s | cause it's hard to see. So, the specific one that we're gonna pick out is called ESC1 or uh 2216.95s - 2222.19s | escalation one. This is from the certify pre-owned stuff that Spectrops put out. Um it's 2222.19s - 2228.23s | also in the resources. So, what makes us vulnerable is that enrollee subject uh enrollee 2228.23s - 2233.07s | supply subject, which equals the subject alternative name, can be applied when you enroll a 2233.07s - 2238.07s | certificate. The second half of that puzzle is who can enroll dangerous certificates. So, in 2241.01s - 2246.61s | this case, we have domain users, have enrollment rights, and that means that anybody can 2247.27s - 2253.44s | enroll a certificate and they can specify that they are whoever they want to be. And so, we 2253.44s - 2258.44s | can go uh take the next step and we can run certify and request our certificate. So, here we 2259.74s - 2264.52s | can see we're targeting that ESC1 template. We're telling it that we want to be 2264.52s - 2270.46s | administrator. We can tell it whatever we want. But of course, we wanna be the administrator 2270.46s - 2279.64s | account. So, we've saved that private key locally and now we're gonna authenticate with it. So, 2279.64s - 2284.64s | now we run the certify auth command. We specify the PFX, the domain controller, and we've 2285.88s - 2290.88s | now got the uh credential cache. So, the Kerberos credential as well as the hash for the 2292.18s - 2298.62s | administrator account. Which means we can do bad things. So, we can run secrets dump using 2300.00s - 2304.96s | that hash. We could also authenticate with that that C cache file doing that and we can dump 2304.96s - 2310.28s | the entirety of the domain controller. So, here we've got the the SAM, but that's not even


chunk_text:
they can specify that they are whoever they want to be. And so, we 2253.44s - 2258.44s | can go uh take the next step and we can run certify and request our certificate. So, here we 2259.74s - 2264.52s | can see we're targeting that ESC1 template. We're telling it that we want to be 2264.52s - 2270.46s | administrator. We can tell it whatever we want. But of course, we wanna be the administrator 2270.46s - 2279.64s | account. So, we've saved that private key locally and now we're gonna authenticate with it. So, 2279.64s - 2284.64s | now we run the certify auth command. We specify the PFX, the domain controller, and we've 2285.88s - 2290.88s | now got the uh credential cache. So, the Kerberos credential as well as the hash for the 2292.18s - 2298.62s | administrator account. Which means we can do bad things. So, we can run secrets dump using 2300.00s - 2304.96s | that hash. We could also authenticate with that that C cache file doing that and we can dump 2304.96s - 2310.28s | the entirety of the domain controller. So, here we've got the the SAM, but that's not even 2310.28s - 2316.28s | really what we want. We want the NTDS.DIT file. So, this contains the entire contents of 2316.28s - 2322.16s | Active Directory and all the NT hashes for every single user. And we did this with very little 2322.16s - 2327.16s | privilege whatsoever. So, in that context, that attack was game over, right? But we're not 2329.42s - 2332.90s | quite done. We still have some work to do because we're learning that domain admin doesn't 2332.90s - 2338.64s | mean that we're we're finished as administrators. So, we need to investigate why the 2338.66s - 2343.24s | vulnerable template existed in the first place. So, this is what I said earlier. It's that 2343.24s - 2348.54s | two-piece. The domain users, it doesn't have to be domain users. It could just be a subset of 2348.54s - 2354.04s | regular user accounts that could enroll certificates. So, the bigger issue is that supply 2354.04s - 2358.98s | and the request. So, a little bit better of a mitigation is to require manager approval for 2358.98s - 2365.27s | specific certificates. There's a number of different things that you can do. And this is what


chunk_text:
2310.28s - 2316.28s | really what we want. We want the NTDS.DIT file. So, this contains the entire contents of 2316.28s - 2322.16s | Active Directory and all the NT hashes for every single user. And we did this with very little 2322.16s - 2327.16s | privilege whatsoever. So, in that context, that attack was game over, right? But we're not 2329.42s - 2332.90s | quite done. We still have some work to do because we're learning that domain admin doesn't 2332.90s - 2338.64s | mean that we're we're finished as administrators. So, we need to investigate why the 2338.66s - 2343.24s | vulnerable template existed in the first place. So, this is what I said earlier. It's that 2343.24s - 2348.54s | two-piece. The domain users, it doesn't have to be domain users. It could just be a subset of 2348.54s - 2354.04s | regular user accounts that could enroll certificates. So, the bigger issue is that supply 2354.04s - 2358.98s | and the request. So, a little bit better of a mitigation is to require manager approval for 2358.98s - 2365.27s | specific certificates. There's a number of different things that you can do. And this is what 2365.27s - 2369.85s | the certificate that was issued looks like. So, here you'll see the subject was Brandon, 2369.87s - 2374.21s | because he was the one that requested the certificate. But he requested it using the subject 2374.21s - 2381.84s | alternative name as administrator. So, that's what it looks like when a certificate's enrolled. 2381.84s - 2386.18s | And so, we already talked about how you can detect it, but how can you do it automatically? So, 2386.18s - 2391.18s | this is another tool that a friend of mine, Jake, has put out called Locksmith. You can run 2392.68s - 2397.76s | this whether you're on the blue side or the red side. This is a fantastic tool that discovers 2398.74s - 2403.48s | several different misconfigurations in environments. So, this is what it looks like when it 2403.48s - 2409.82s | detects ESC1. I think the coolest thing that it does is it provides fixes for you. So, it can 2409.82s - 2416.06s | output some PowerShell that will actually mitigate this. And it looks at not only ESC1, but all 2416.06s - 2420.66s | the way through 8, with the exception of 7. And


chunk_text:
2365.27s - 2369.85s | the certificate that was issued looks like. So, here you'll see the subject was Brandon, 2369.87s - 2374.21s | because he was the one that requested the certificate. But he requested it using the subject 2374.21s - 2381.84s | alternative name as administrator. So, that's what it looks like when a certificate's enrolled. 2381.84s - 2386.18s | And so, we already talked about how you can detect it, but how can you do it automatically? So, 2386.18s - 2391.18s | this is another tool that a friend of mine, Jake, has put out called Locksmith. You can run 2392.68s - 2397.76s | this whether you're on the blue side or the red side. This is a fantastic tool that discovers 2398.74s - 2403.48s | several different misconfigurations in environments. So, this is what it looks like when it 2403.48s - 2409.82s | detects ESC1. I think the coolest thing that it does is it provides fixes for you. So, it can 2409.82s - 2416.06s | output some PowerShell that will actually mitigate this. And it looks at not only ESC1, but all 2416.06s - 2420.66s | the way through 8, with the exception of 7. And also looks at some auditing being enabled, 2420.66s - 2426.00s | which does not happen by default in ADCS. So, it provides fixes for every single one of these 2426.04s - 2436.37s | as well. And so, we technically we created the Brandon Rocks account, but I wanted to put it up 2436.37s - 2443.98s | here because I hope you agree. So, we got our last two vulnerabilities patched. So, two more 2443.98s - 2450.22s | bin- mitigations is to disable that print spooler and run Locksmith in your environment. Our 2450.22s - 2454.36s | game is still not over though. So, even though we've reached the end boss and we fought it, 2454.36s - 2458.40s | there's always that next level. Our princess is always in another castle. There's always 2458.40s - 2463.54s | something else you can do. There's always that next step. Um, Active Directory is not, is not 2463.54s - 2469.44s | done with new vulnerabilities that come out on a regular basis. It's old, but it's, there's 2469.44s - 2473.96s | new, new research that occurs every day. So, I urge you all to get an assessment done, get a 2473.96s - 2479.66s |


chunk_text:
also looks at some auditing being enabled, 2420.66s - 2426.00s | which does not happen by default in ADCS. So, it provides fixes for every single one of these 2426.04s - 2436.37s | as well. And so, we technically we created the Brandon Rocks account, but I wanted to put it up 2436.37s - 2443.98s | here because I hope you agree. So, we got our last two vulnerabilities patched. So, two more 2443.98s - 2450.22s | bin- mitigations is to disable that print spooler and run Locksmith in your environment. Our 2450.22s - 2454.36s | game is still not over though. So, even though we've reached the end boss and we fought it, 2454.36s - 2458.40s | there's always that next level. Our princess is always in another castle. There's always 2458.40s - 2463.54s | something else you can do. There's always that next step. Um, Active Directory is not, is not 2463.54s - 2469.44s | done with new vulnerabilities that come out on a regular basis. It's old, but it's, there's 2469.44s - 2473.96s | new, new research that occurs every day. So, I urge you all to get an assessment done, get a 2473.96s - 2479.66s | pen test done, uh, try out some of these tools. So, this is a list of all the resources that I 2479.66s - 2485.76s | used. So, use, if you have permission to run these tools, everybody please, right? I'm not 2485.76s - 2491.34s | telling you to go hack yourself without permission. Um, I'll hold that up there just for a 2491.34s - 2499.14s | second. Um, I will, I will share these on my, my GitHub and, cause here's a list of all those 2499.14s - 2504.24s | resources I talked about. As well as the character selection screen. So, I put this back up 2504.24s - 2511.24s | because I love AI art and how bad it is at spelling things specifically. Um, I also told it to 2511.24s - 2516.38s | give me a character selection screen for the game of Active Directory. And it came back with 2516.38s - 2525.72s | this. And everybody is sad. Every single person has a frown on their face. Like, this guy 2525.72s - 2530.20s | bottom, like, three from the right, he's got circles under his eyes. I don't know, he's beat 2530.20s - 2535.84s | up. And


chunk_text:
pen test done, uh, try out some of these tools. So, this is a list of all the resources that I 2479.66s - 2485.76s | used. So, use, if you have permission to run these tools, everybody please, right? I'm not 2485.76s - 2491.34s | telling you to go hack yourself without permission. Um, I'll hold that up there just for a 2491.34s - 2499.14s | second. Um, I will, I will share these on my, my GitHub and, cause here's a list of all those 2499.14s - 2504.24s | resources I talked about. As well as the character selection screen. So, I put this back up 2504.24s - 2511.24s | because I love AI art and how bad it is at spelling things specifically. Um, I also told it to 2511.24s - 2516.38s | give me a character selection screen for the game of Active Directory. And it came back with 2516.38s - 2525.72s | this. And everybody is sad. Every single person has a frown on their face. Like, this guy 2525.72s - 2530.20s | bottom, like, three from the right, he's got circles under his eyes. I don't know, he's beat 2530.20s - 2535.84s | up. And then there's the names of them. There's Dad, and Oh Lordy, and Doy, and, and, it's 2535.84s - 2554.08s | fantastic. So, with, with that, thank you all for coming. Packed house, fantastic, guys. Um, 2554.08s - 2558.76s | so, you can, um, follow me or find me on pretty much everything. I'm TechBrandon, GitHub's 2558.92s - 2564.46s | TechBrandon. Um, Twitter, LinkedIn. Uh, thank you, Packet Hacking Village. Thank you, DefCon. 2564.46s - 2569.14s | Um, I do think I've got a decent amount of time for questions. So, if anyone wants to stick 2569.14s - 2579.14s | around and has any questions, I will, uh, do my best. Cool. Or you can just, or you can go early 2579.14s - 2581.38s | and you can go get a snack, cause it's lunchtime.


chunk_text:
then there's the names of them. There's Dad, and Oh Lordy, and Doy, and, and, it's 2535.84s - 2554.08s | fantastic. So, with, with that, thank you all for coming. Packed house, fantastic, guys. Um, 2554.08s - 2558.76s | so, you can, um, follow me or find me on pretty much everything. I'm TechBrandon, GitHub's 2558.92s - 2564.46s | TechBrandon. Um, Twitter, LinkedIn. Uh, thank you, Packet Hacking Village. Thank you, DefCon. 2564.46s - 2569.14s | Um, I do think I've got a decent amount of time for questions. So, if anyone wants to stick 2569.14s - 2579.14s | around and has any questions, I will, uh, do my best. Cool. Or you can just, or you can go early 2579.14s - 2581.38s | and you can go get a snack, cause it's lunchtime.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=anrgU7LjN1A", "title": "DEF CON 32 - Warflying in a Cessna - Matt Thomassen, Sean McKeever", "description": "Wardriving is cool, and airplanes are cool. What happens if we combine the two? Is it safe? Is it legal? How much WiFi is it possible to see from an airplane? How far does WiFi leak into the atmosphere? How far away can we see an access point? Can we catch a specific network at 1500 feet above the ground? How about 2500? We loaded up a small plane and flew around in circles to find out. This talk will share both our preparation and our results, including figuring out the best places to warfly, what equipment to use, and how to do it safely. We will present the flights we made, the data we gathered, how we analyzed it, and what we discovered. (Spoiler alert: flying a Cessna is a really, really non-stealthy way to collect information about wireless access points.)", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1468, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.50s - 3.50s | This text was transcribed using whisper model: large-v2 Good morning, happy Sunday at DEF CON. 3.50s - 7.50s | Thank you for coming to our talk, because we can. 7.50s - 10.50s | Warflying in a Cessna. 10.50s - 14.50s | I'm Sean McKeever. I'm a senior security researcher, 14.50s - 17.50s | and I do other stuff from Metro Detroit. 17.50s - 19.50s | Sometimes I race cars. 19.50s - 22.50s | Matt Thomason, also Metro Detroit. 22.50s - 26.50s | My day job is in security and has pretty much nothing whatsoever to do with warflying. 26.50s - 31.50s | I am also a commercial multi-engine pilot, instrument rating, 31.50s - 34.50s | and licensed airframe and power plant mechanic. 34.50s - 38.50s | And all of the opinions that are expressed here are our own. 38.50s - 40.50s | Statement, yeah. 40.50s - 43.50s | And probably have nothing to do with our respective employers. 43.50s - 46.50s | I didn't even tell them I was coming. 46.50s - 50.50s | All right, so the story. It's November 2019, 50.50s - 54.50s | and I was awash in a sea of mats, Matt. 54.50s - 56.50s | This was our cube area. 56.50s - 60.50s | I had a mat and a mat and a mat, coffee, and then a not-mat. 60.50s


chunk_text:
talk, because we can. 7.50s - 10.50s | Warflying in a Cessna. 10.50s - 14.50s | I'm Sean McKeever. I'm a senior security researcher, 14.50s - 17.50s | and I do other stuff from Metro Detroit. 17.50s - 19.50s | Sometimes I race cars. 19.50s - 22.50s | Matt Thomason, also Metro Detroit. 22.50s - 26.50s | My day job is in security and has pretty much nothing whatsoever to do with warflying. 26.50s - 31.50s | I am also a commercial multi-engine pilot, instrument rating, 31.50s - 34.50s | and licensed airframe and power plant mechanic. 34.50s - 38.50s | And all of the opinions that are expressed here are our own. 38.50s - 40.50s | Statement, yeah. 40.50s - 43.50s | And probably have nothing to do with our respective employers. 43.50s - 46.50s | I didn't even tell them I was coming. 46.50s - 50.50s | All right, so the story. It's November 2019, 50.50s - 54.50s | and I was awash in a sea of mats, Matt. 54.50s - 56.50s | This was our cube area. 56.50s - 60.50s | I had a mat and a mat and a mat, coffee, and then a not-mat. 60.50s - 64.16s | So we're sitting around. 64.16s - 65.16s | It's, you know, like I said, November. 65.16s - 69.16s | DEF CON had come and gone, and Matt and I are like, let's do a DEF CON talk. 69.16s - 71.16s | I'm like, yeah, but I tried that. 71.16s - 72.16s | I can't talk about work. 72.16s - 75.16s | What else are we going to talk about? 75.16s - 77.16s | Matt goes, I have a plane. 77.16s - 79.16s | Like, oh, Wi-Fi? 79.16s - 81.16s | Yeah, let's do that. 81.16s - 88.84s | And then 2020 happens. 88.84s - 92.84s | So, you know, we did finally get together and do it. 92.84s - 96.84s | Warflying, it's like war driving, or war dialing, 96.84s - 99.84s | or as in greetings, Professor Falcon. 99.84s - 103.84s | We're looking for wireless access points from the air, 103.84s - 106.84s | and there are unfortunately no weapons involved. 106.84s - 107.84s | Fortunately, I said fortunately. 107.84s - 109.84s | Fortunately, yeah. 109.84s - 111.84s | And so we're warflying into Cessna. 111.84s - 112.84s | Not these Cessnas. 112.84s - 115.84s


chunk_text:
- 64.16s | So we're sitting around. 64.16s - 65.16s | It's, you know, like I said, November. 65.16s - 69.16s | DEF CON had come and gone, and Matt and I are like, let's do a DEF CON talk. 69.16s - 71.16s | I'm like, yeah, but I tried that. 71.16s - 72.16s | I can't talk about work. 72.16s - 75.16s | What else are we going to talk about? 75.16s - 77.16s | Matt goes, I have a plane. 77.16s - 79.16s | Like, oh, Wi-Fi? 79.16s - 81.16s | Yeah, let's do that. 81.16s - 88.84s | And then 2020 happens. 88.84s - 92.84s | So, you know, we did finally get together and do it. 92.84s - 96.84s | Warflying, it's like war driving, or war dialing, 96.84s - 99.84s | or as in greetings, Professor Falcon. 99.84s - 103.84s | We're looking for wireless access points from the air, 103.84s - 106.84s | and there are unfortunately no weapons involved. 106.84s - 107.84s | Fortunately, I said fortunately. 107.84s - 109.84s | Fortunately, yeah. 109.84s - 111.84s | And so we're warflying into Cessna. 111.84s - 112.84s | Not these Cessnas. 112.84s - 115.84s | Cessna has actually made warplanes, but we weren't using those. 115.84s - 118.84s | Although the L-19 on the bottom is kind of close. 118.84s - 122.84s | If somebody wants to donate an L-19 for further research, please see me afterwards. 122.84s - 125.84s | Our Cessna was more like this. 125.84s - 127.84s | Cessna 182. 127.84s - 131.84s | Not this airplane, because I think that one's registered for not in the U.S. 131.84s - 133.84s | But four-seat airplane. 133.84s - 138.84s | High wing, which gives us a little better visibility to the ground. 138.84s - 140.84s | 230 horsepower engine. 140.84s - 144.84s | Cruises comfortably around 150 miles an hour. 144.84s - 149.84s | And one nice thing is we've got six hours of fuel, so with reserve figure five hours, 149.84s - 155.84s | we can go for a long time and long distance if we want to do such. 155.84s - 158.25s | A few disclaimers. 158.25s - 160.25s | This is not legal advice. 160.25s - 162.25s | Neither of us is a lawyer. 162.25s - 164.25s | This is not flight instruction. 164.25s - 165.25s | We are


chunk_text:
| Cessna has actually made warplanes, but we weren't using those. 115.84s - 118.84s | Although the L-19 on the bottom is kind of close. 118.84s - 122.84s | If somebody wants to donate an L-19 for further research, please see me afterwards. 122.84s - 125.84s | Our Cessna was more like this. 125.84s - 127.84s | Cessna 182. 127.84s - 131.84s | Not this airplane, because I think that one's registered for not in the U.S. 131.84s - 133.84s | But four-seat airplane. 133.84s - 138.84s | High wing, which gives us a little better visibility to the ground. 138.84s - 140.84s | 230 horsepower engine. 140.84s - 144.84s | Cruises comfortably around 150 miles an hour. 144.84s - 149.84s | And one nice thing is we've got six hours of fuel, so with reserve figure five hours, 149.84s - 155.84s | we can go for a long time and long distance if we want to do such. 155.84s - 158.25s | A few disclaimers. 158.25s - 160.25s | This is not legal advice. 160.25s - 162.25s | Neither of us is a lawyer. 162.25s - 164.25s | This is not flight instruction. 164.25s - 165.25s | We are not flight instructors. 165.25s - 168.25s | We are also not expert war drivers. 168.25s - 173.25s | But we are grateful to the war driving community that has made great tools like Wiggle, 173.25s - 177.25s | and many of those people are over in the RF hackers village. 177.25s - 179.25s | And we're not the first to do this. 179.25s - 181.25s | During our research, we found that about 20 years ago, 181.25s - 186.25s | somebody wrote a paper on collecting data on wireless access points from the air, 186.25s - 192.25s | but there doesn't seem to have been a lot of discussion or work on the topic since then. 192.25s - 197.25s | So we thought it was worth doing some experimenting and firing up the conversation again. 197.25s - 199.59s | Why would we do this? 199.59s - 200.59s | Big reason. 200.59s - 201.59s | Three magic words. 201.59s - 202.59s | Line of sight. 202.59s - 206.59s | Radio frequencies, especially in the Wi-Fi ranges, 206.59s - 214.59s | are very subject to interference from the ground, from objects, vegetation, buildings, houses. 214.59s - 218.59s | Am I hopefully doing


chunk_text:
not flight instructors. 165.25s - 168.25s | We are also not expert war drivers. 168.25s - 173.25s | But we are grateful to the war driving community that has made great tools like Wiggle, 173.25s - 177.25s | and many of those people are over in the RF hackers village. 177.25s - 179.25s | And we're not the first to do this. 179.25s - 181.25s | During our research, we found that about 20 years ago, 181.25s - 186.25s | somebody wrote a paper on collecting data on wireless access points from the air, 186.25s - 192.25s | but there doesn't seem to have been a lot of discussion or work on the topic since then. 192.25s - 197.25s | So we thought it was worth doing some experimenting and firing up the conversation again. 197.25s - 199.59s | Why would we do this? 199.59s - 200.59s | Big reason. 200.59s - 201.59s | Three magic words. 201.59s - 202.59s | Line of sight. 202.59s - 206.59s | Radio frequencies, especially in the Wi-Fi ranges, 206.59s - 214.59s | are very subject to interference from the ground, from objects, vegetation, buildings, houses. 214.59s - 218.59s | Am I hopefully doing okay with my mic position here? 218.59s - 221.59s | But is that better? 221.59s - 222.59s | Okay. 222.59s - 223.59s | Hey, okay. 223.59s - 224.59s | I should know how to do this. 224.59s - 235.59s | Anyway, so trying to raise one end of the device on the end of the radio conversation, 235.59s - 239.59s | potentially we have much greater distance and much greater line of sight. 239.59s - 240.59s | And airplanes are cool. 240.59s - 241.59s | Radios are cool. 241.59s - 242.59s | We were curious. 242.59s - 247.59s | Maybe we can see a lot of access points quickly. 247.59s - 255.59s | And there's a fair amount of discussion right now about the interaction of aircraft and RF 255.59s - 258.59s | and what radio signals can do with those. 258.59s - 260.59s | So we thought it was an interesting topic to explore. 260.59s - 262.59s | A few constraints we'll talk through. 262.59s - 264.59s | One, safety. 264.59s - 270.59s | And I'm going to belabor this a little bit because I don't want to read any NTSB reports 270.59s - 274.59s | about somebody who


chunk_text:
okay with my mic position here? 218.59s - 221.59s | But is that better? 221.59s - 222.59s | Okay. 222.59s - 223.59s | Hey, okay. 223.59s - 224.59s | I should know how to do this. 224.59s - 235.59s | Anyway, so trying to raise one end of the device on the end of the radio conversation, 235.59s - 239.59s | potentially we have much greater distance and much greater line of sight. 239.59s - 240.59s | And airplanes are cool. 240.59s - 241.59s | Radios are cool. 241.59s - 242.59s | We were curious. 242.59s - 247.59s | Maybe we can see a lot of access points quickly. 247.59s - 255.59s | And there's a fair amount of discussion right now about the interaction of aircraft and RF 255.59s - 258.59s | and what radio signals can do with those. 258.59s - 260.59s | So we thought it was an interesting topic to explore. 260.59s - 262.59s | A few constraints we'll talk through. 262.59s - 264.59s | One, safety. 264.59s - 270.59s | And I'm going to belabor this a little bit because I don't want to read any NTSB reports 270.59s - 274.59s | about somebody who crashed an airplane trying to look for wireless access points. 274.59s - 280.59s | So, seriously, the job of the pilot in this is fly the airplane. 280.59s - 285.59s | And this is often expressed in aviation as aviate, navigate, and communicate. 285.59s - 295.59s | First job, aviate, which is keep the airplane flying, keep the shiny side up, 295.59s - 298.59s | keep it at a proper airspeed, don't run into anything. 299.59s - 304.59s | If and only if you are successfully aviating, then figure out where you are 304.59s - 306.59s | and figure out where you're going. 306.59s - 310.59s | If and only if you are successfully aviating and navigating, 310.59s - 314.59s | then maybe think about talking to somebody on the radio about what you're doing. 314.59s - 318.59s | At no point in here get distracted by scanning equipment, 318.59s - 321.59s | shiny electronic displays in the airplane. 321.59s - 323.59s | Ah, that looks cool. 324.59s - 329.59s | Particularly during critical phases of flight, taxi takeoff, approach, landing, 329.59s - 332.59s | and low-level maneuvering because when you're doing warflying, 332.59s - 337.59s | you may want


chunk_text:
crashed an airplane trying to look for wireless access points. 274.59s - 280.59s | So, seriously, the job of the pilot in this is fly the airplane. 280.59s - 285.59s | And this is often expressed in aviation as aviate, navigate, and communicate. 285.59s - 295.59s | First job, aviate, which is keep the airplane flying, keep the shiny side up, 295.59s - 298.59s | keep it at a proper airspeed, don't run into anything. 299.59s - 304.59s | If and only if you are successfully aviating, then figure out where you are 304.59s - 306.59s | and figure out where you're going. 306.59s - 310.59s | If and only if you are successfully aviating and navigating, 310.59s - 314.59s | then maybe think about talking to somebody on the radio about what you're doing. 314.59s - 318.59s | At no point in here get distracted by scanning equipment, 318.59s - 321.59s | shiny electronic displays in the airplane. 321.59s - 323.59s | Ah, that looks cool. 324.59s - 329.59s | Particularly during critical phases of flight, taxi takeoff, approach, landing, 329.59s - 332.59s | and low-level maneuvering because when you're doing warflying, 332.59s - 337.59s | you may want to be down closer to the ground, and that increases risk. 337.59s - 343.59s | Is it possible to, or so, because of this, warflying we think is best done as a team sport 343.59s - 346.59s | because, hey, it's more fun to share the flight with somebody anyway. 346.59s - 349.59s | Is it possible to warfly safely while solo? 349.59s - 353.59s | We'll talk about the details of that a little bit later, 353.59s - 356.59s | but obviously we want to be watching the constraints. 356.59s - 365.59s | I will mention this issue specifically as a reference to why I'm concerned about this. 365.59s - 369.59s | Not that long ago, not very far away from where we live, 369.59s - 374.59s | there was a Cessna 182 that crashed, and based on the NTSB report, 374.59s - 379.59s | there's strong evidence that the pilot was in the process of taking a Snapchat video 379.59s - 383.59s | and making a post and got distracted, got a little left of the course, 383.59s - 386.59s | flew into the guy wires of a tower, crashed, and died. 386.59s - 393.59s | So distraction,


chunk_text:
to be down closer to the ground, and that increases risk. 337.59s - 343.59s | Is it possible to, or so, because of this, warflying we think is best done as a team sport 343.59s - 346.59s | because, hey, it's more fun to share the flight with somebody anyway. 346.59s - 349.59s | Is it possible to warfly safely while solo? 349.59s - 353.59s | We'll talk about the details of that a little bit later, 353.59s - 356.59s | but obviously we want to be watching the constraints. 356.59s - 365.59s | I will mention this issue specifically as a reference to why I'm concerned about this. 365.59s - 369.59s | Not that long ago, not very far away from where we live, 369.59s - 374.59s | there was a Cessna 182 that crashed, and based on the NTSB report, 374.59s - 379.59s | there's strong evidence that the pilot was in the process of taking a Snapchat video 379.59s - 383.59s | and making a post and got distracted, got a little left of the course, 383.59s - 386.59s | flew into the guy wires of a tower, crashed, and died. 386.59s - 393.59s | So distraction, especially during low-level maneuvering, can be fatal. 393.59s - 396.59s | So please, please, please, pilot, fly the airplane. 396.59s - 401.59s | And if you are flying with the pilot, as the scanner, 401.59s - 410.59s | if the pilot is not comfortable doing something, don't do it, and don't distract the pilot. 410.59s - 417.59s | Regulations, basically the FAA says it's the responsibility of the aircraft operator 417.59s - 422.59s | to determine if the portable electronic device will interfere with the operation of the aircraft. 422.59s - 427.59s | So as the pilot, figure out will this interfere with the operation of the aircraft. 427.59s - 438.79s | Also, remember FAR 91.3, the pilot in command of an aircraft is directly responsible for 438.79s - 441.79s | and is the final authority as to the operation of that aircraft. 441.79s - 448.79s | So if you are the scanner, the pilot's word is law on safety things. 448.79s - 454.79s | Also, 91.13, the great catch-all, careless and reckless operation is prohibited. 454.79s - 461.79s | So don't do anything stupid while you're flying around trying to collect access point data. 461.79s - 466.79s | FCC


chunk_text:
especially during low-level maneuvering, can be fatal. 393.59s - 396.59s | So please, please, please, pilot, fly the airplane. 396.59s - 401.59s | And if you are flying with the pilot, as the scanner, 401.59s - 410.59s | if the pilot is not comfortable doing something, don't do it, and don't distract the pilot. 410.59s - 417.59s | Regulations, basically the FAA says it's the responsibility of the aircraft operator 417.59s - 422.59s | to determine if the portable electronic device will interfere with the operation of the aircraft. 422.59s - 427.59s | So as the pilot, figure out will this interfere with the operation of the aircraft. 427.59s - 438.79s | Also, remember FAR 91.3, the pilot in command of an aircraft is directly responsible for 438.79s - 441.79s | and is the final authority as to the operation of that aircraft. 441.79s - 448.79s | So if you are the scanner, the pilot's word is law on safety things. 448.79s - 454.79s | Also, 91.13, the great catch-all, careless and reckless operation is prohibited. 454.79s - 461.79s | So don't do anything stupid while you're flying around trying to collect access point data. 461.79s - 466.79s | FCC perspective, FCC basically does not want cell phones in cell phone mode 466.79s - 468.79s | trying to talk to cell phone towers while flying around. 468.79s - 472.79s | So put your phone in airplane mode, and you can still have your Wi-Fi on, 472.79s - 481.79s | have your GPS on, which are what you need for collecting wireless access point data. 481.79s - 483.79s | Where can you war flight? 483.79s - 484.79s | Know your airspace. 484.79s - 490.79s | So we're from Metro Detroit area, and Detroit Metro Airport has this nice big thing 490.79s - 496.79s | called the Class Bravo airspace, which you can visualize as an upside-down wedding cake 496.79s - 502.79s | centered around the primary airport, and the Class Bravo airspace is well-protected, 502.79s - 507.79s | and you can only get in there with explicit permission either if you're on an instrument flight plan 507.79s - 511.79s | or if the approach controllers say you can come in here. 511.79s - 517.79s | This is a very good safety thing because it lets all of the airliners get in and out safely, 517.79s - 520.79s | heavy traffic areas,


chunk_text:
perspective, FCC basically does not want cell phones in cell phone mode 466.79s - 468.79s | trying to talk to cell phone towers while flying around. 468.79s - 472.79s | So put your phone in airplane mode, and you can still have your Wi-Fi on, 472.79s - 481.79s | have your GPS on, which are what you need for collecting wireless access point data. 481.79s - 483.79s | Where can you war flight? 483.79s - 484.79s | Know your airspace. 484.79s - 490.79s | So we're from Metro Detroit area, and Detroit Metro Airport has this nice big thing 490.79s - 496.79s | called the Class Bravo airspace, which you can visualize as an upside-down wedding cake 496.79s - 502.79s | centered around the primary airport, and the Class Bravo airspace is well-protected, 502.79s - 507.79s | and you can only get in there with explicit permission either if you're on an instrument flight plan 507.79s - 511.79s | or if the approach controllers say you can come in here. 511.79s - 517.79s | This is a very good safety thing because it lets all of the airliners get in and out safely, 517.79s - 520.79s | heavy traffic areas, and it works well. 520.79s - 525.79s | For what we're doing, we are probably not on an instrument flight plan 525.79s - 528.79s | unless we happen to be war flying while we're going somewhere, 528.79s - 531.79s | but if we're trying to gather data about a specific area, 531.79s - 534.79s | we're probably operating under something called visual flight rules, 534.79s - 540.79s | which means we're doing our own navigation, and we're responsible for our own traffic separation, 540.79s - 543.79s | but we've got a lot of flexibility in where we can do that, 543.79s - 546.79s | but we need to stay out of the Class Bravo for sure, 546.79s - 549.79s | and then there are smaller airports that we want to be watching for 549.79s - 553.79s | so we don't go get in their traffic patterns and runways. 553.79s - 558.79s | Pontiac Airport that we fly out of is a Class Delta, so they have a control tower. 558.79s - 560.79s | They own that airspace. 561.79s - 565.79s | They're pretty nice and flexible on working with us for maneuvering that we need to do, 565.79s - 567.79s


chunk_text:
and it works well. 520.79s - 525.79s | For what we're doing, we are probably not on an instrument flight plan 525.79s - 528.79s | unless we happen to be war flying while we're going somewhere, 528.79s - 531.79s | but if we're trying to gather data about a specific area, 531.79s - 534.79s | we're probably operating under something called visual flight rules, 534.79s - 540.79s | which means we're doing our own navigation, and we're responsible for our own traffic separation, 540.79s - 543.79s | but we've got a lot of flexibility in where we can do that, 543.79s - 546.79s | but we need to stay out of the Class Bravo for sure, 546.79s - 549.79s | and then there are smaller airports that we want to be watching for 549.79s - 553.79s | so we don't go get in their traffic patterns and runways. 553.79s - 558.79s | Pontiac Airport that we fly out of is a Class Delta, so they have a control tower. 558.79s - 560.79s | They own that airspace. 561.79s - 565.79s | They're pretty nice and flexible on working with us for maneuvering that we need to do, 565.79s - 567.79s | and so you have a lot more options out of Class Delta airspace, 567.79s - 574.79s | but at the end of the day, it's their airspace, so we have to comply with what they want. 574.79s - 579.79s | Over populated areas, it's legal to fly 1,000 feet. 579.79s - 582.79s | You have to stay 1,000 feet above the ground. 582.79s - 586.79s | Over unpopulated areas, you can go down to 500 feet. 586.79s - 590.79s | When we were trying to fly over the suburbs of Metro Detroit, 590.79s - 595.79s | we basically had an area between 1,000 feet and 3,000 feet above the ground 595.79s - 599.79s | that we could get in to maintain clearance above the ground 599.79s - 602.79s | but stay below the Class Bravo shelf, 602.79s - 607.79s | so that kind of constrained where we were able to go, 607.79s - 613.79s | but we were able to collect some good data. 614.79s - 618.79s | An airplane is a metal box, or at least a lot of them. 618.79s - 622.79s | Cessna 182 is an aluminum box with plexiglass windows, 622.79s - 627.79s | so


chunk_text:
| and so you have a lot more options out of Class Delta airspace, 567.79s - 574.79s | but at the end of the day, it's their airspace, so we have to comply with what they want. 574.79s - 579.79s | Over populated areas, it's legal to fly 1,000 feet. 579.79s - 582.79s | You have to stay 1,000 feet above the ground. 582.79s - 586.79s | Over unpopulated areas, you can go down to 500 feet. 586.79s - 590.79s | When we were trying to fly over the suburbs of Metro Detroit, 590.79s - 595.79s | we basically had an area between 1,000 feet and 3,000 feet above the ground 595.79s - 599.79s | that we could get in to maintain clearance above the ground 599.79s - 602.79s | but stay below the Class Bravo shelf, 602.79s - 607.79s | so that kind of constrained where we were able to go, 607.79s - 613.79s | but we were able to collect some good data. 614.79s - 618.79s | An airplane is a metal box, or at least a lot of them. 618.79s - 622.79s | Cessna 182 is an aluminum box with plexiglass windows, 622.79s - 627.79s | so we want to get the radios up out of the aluminum box 627.79s - 632.79s | and put them as close as we can to the plexiglass windows so that they can receive Wi-Fi, 632.79s - 635.79s | and that was one of the things that we were curious about. 635.79s - 640.79s | How well does this work if we're inside the airplane 640.79s - 644.79s | and just getting the radios through the plexiglass? 644.79s - 647.79s | So next year, I'm going to be outside the airplane? 647.79s - 649.79s | Yes. 649.79s - 654.79s | Yeah, we'll attach a safety line, though, so that'll work well. 654.79s - 658.79s | Optimally, the antenna would be outside the airplane, 658.79s - 662.79s | but you get into some issues with rigs and safety and stuff, 662.79s - 664.79s | one, if you're trying to permanently attach something to the airplane, 664.79s - 668.79s | and two, just practically, you don't want to try attaching it 668.79s - 671.79s | and then have it not work and fall off, 671.79s - 674.79s | and then you're calling the tower saying, 674.79s - 677.79s | hey, can you see


chunk_text:
we want to get the radios up out of the aluminum box 627.79s - 632.79s | and put them as close as we can to the plexiglass windows so that they can receive Wi-Fi, 632.79s - 635.79s | and that was one of the things that we were curious about. 635.79s - 640.79s | How well does this work if we're inside the airplane 640.79s - 644.79s | and just getting the radios through the plexiglass? 644.79s - 647.79s | So next year, I'm going to be outside the airplane? 647.79s - 649.79s | Yes. 649.79s - 654.79s | Yeah, we'll attach a safety line, though, so that'll work well. 654.79s - 658.79s | Optimally, the antenna would be outside the airplane, 658.79s - 662.79s | but you get into some issues with rigs and safety and stuff, 662.79s - 664.79s | one, if you're trying to permanently attach something to the airplane, 664.79s - 668.79s | and two, just practically, you don't want to try attaching it 668.79s - 671.79s | and then have it not work and fall off, 671.79s - 674.79s | and then you're calling the tower saying, 674.79s - 677.79s | hey, can you see if my phone fell off on the runway? 677.79s - 685.28s | Also, from a privacy perspective, this is probably the least stealthy way to war drive 685.28s - 688.28s | because you're in a big metal box making a lot of noise, 688.28s - 691.28s | flying over everybody's head with a 12-inch tail number on the back of the airplane 691.28s - 696.28s | and constantly chirping ADS-B packets telling everybody exactly who you are 696.28s - 699.28s | and exactly where you are. 699.28s - 702.28s | People will call and complain about aircraft doing annoying things, 702.28s - 708.28s | so please, be a good citizen, don't be a jerk, don't go buzz people's houses, 708.28s - 713.28s | probably don't go orbit somebody's house 10 times 713.28s - 718.84s | because that can collect some negative attention. 718.84s - 720.84s | So, yeah, data collection. 720.84s - 723.84s | We did a series of test flights, kind of figuring it out as we went. 723.84s - 728.84s | The first flight, we took one phone, this Google Pixel, 728.84s - 731.84s | which thankfully my girlfriend had to use because my phones are Apple, 731.84s


chunk_text:
if my phone fell off on the runway? 677.79s - 685.28s | Also, from a privacy perspective, this is probably the least stealthy way to war drive 685.28s - 688.28s | because you're in a big metal box making a lot of noise, 688.28s - 691.28s | flying over everybody's head with a 12-inch tail number on the back of the airplane 691.28s - 696.28s | and constantly chirping ADS-B packets telling everybody exactly who you are 696.28s - 699.28s | and exactly where you are. 699.28s - 702.28s | People will call and complain about aircraft doing annoying things, 702.28s - 708.28s | so please, be a good citizen, don't be a jerk, don't go buzz people's houses, 708.28s - 713.28s | probably don't go orbit somebody's house 10 times 713.28s - 718.84s | because that can collect some negative attention. 718.84s - 720.84s | So, yeah, data collection. 720.84s - 723.84s | We did a series of test flights, kind of figuring it out as we went. 723.84s - 728.84s | The first flight, we took one phone, this Google Pixel, 728.84s - 731.84s | which thankfully my girlfriend had to use because my phones are Apple, 731.84s - 733.84s | but we put Wiggle on it. 733.84s - 736.84s | I just kind of held it in my lap and we kind of flew around, 736.84s - 744.57s | largely 1,500 to 2,500 feet at roughly 150 miles an hour. 744.57s - 747.57s | And, you know, where are the access points? 747.57s - 748.57s | We don't know. 748.57s - 751.57s | We know where we started seeing them and where we stopped seeing them, 751.57s - 754.57s | so we kind of have like a blob for each one, 754.57s - 758.57s | but we can't say, oh, that's at Sean's house down there. 758.57s - 760.57s | If we can see them more than once over multiple flights, 760.57s - 764.57s | we could maybe pinpoint it a little better, but it's very inexact. 764.57s - 768.57s | So for our first flight, we took three passes down Woodward Avenue, 768.57s - 772.57s | which if you're a fan of cars, it's where they have the Woodward Dream Cruise, 772.57s - 774.57s | and, you know, we're from automotive. 774.57s - 777.57s | It's also Highway 1 in Michigan. 777.57s - 782.57s | We


chunk_text:
- 733.84s | but we put Wiggle on it. 733.84s - 736.84s | I just kind of held it in my lap and we kind of flew around, 736.84s - 744.57s | largely 1,500 to 2,500 feet at roughly 150 miles an hour. 744.57s - 747.57s | And, you know, where are the access points? 747.57s - 748.57s | We don't know. 748.57s - 751.57s | We know where we started seeing them and where we stopped seeing them, 751.57s - 754.57s | so we kind of have like a blob for each one, 754.57s - 758.57s | but we can't say, oh, that's at Sean's house down there. 758.57s - 760.57s | If we can see them more than once over multiple flights, 760.57s - 764.57s | we could maybe pinpoint it a little better, but it's very inexact. 764.57s - 768.57s | So for our first flight, we took three passes down Woodward Avenue, 768.57s - 772.57s | which if you're a fan of cars, it's where they have the Woodward Dream Cruise, 772.57s - 774.57s | and, you know, we're from automotive. 774.57s - 777.57s | It's also Highway 1 in Michigan. 777.57s - 782.57s | We did two at 2,500 feet above sea level, which is 1,500 above ground, 782.57s - 789.57s | and then one at 3,500, which is 2,500 feet with just my Android phone running. 789.57s - 792.57s | And this map doesn't make a ton of sense to me because I'm not a pilot, 792.57s - 796.57s | but you can see the various airspaces that we were operating in, 796.57s - 802.57s | and the orange-yellow squiggles are our actual flight path. 802.57s - 804.57s | But for me, this makes more sense. 804.57s - 807.57s | This is actually a road map of where we were flying. 807.57s - 810.57s | So the circles you can see on the right side, 810.57s - 813.57s | that would be our laps around Woodward. 813.57s - 816.65s | So data formats. 816.65s - 822.65s | Wiggle has their own proprietary format as a KML file, but they'll also output as CSV. 822.65s - 824.65s | We get one entry per observation out of Wiggle, 824.65s - 828.65s | so we can track how many times we saw a specific point. 828.65s - 830.65s | And it also includes altitude, which is nice


chunk_text:
did two at 2,500 feet above sea level, which is 1,500 above ground, 782.57s - 789.57s | and then one at 3,500, which is 2,500 feet with just my Android phone running. 789.57s - 792.57s | And this map doesn't make a ton of sense to me because I'm not a pilot, 792.57s - 796.57s | but you can see the various airspaces that we were operating in, 796.57s - 802.57s | and the orange-yellow squiggles are our actual flight path. 802.57s - 804.57s | But for me, this makes more sense. 804.57s - 807.57s | This is actually a road map of where we were flying. 807.57s - 810.57s | So the circles you can see on the right side, 810.57s - 813.57s | that would be our laps around Woodward. 813.57s - 816.65s | So data formats. 816.65s - 822.65s | Wiggle has their own proprietary format as a KML file, but they'll also output as CSV. 822.65s - 824.65s | We get one entry per observation out of Wiggle, 824.65s - 828.65s | so we can track how many times we saw a specific point. 828.65s - 830.65s | And it also includes altitude, which is nice for us, 830.65s - 835.65s | so we can correlate also that to our flight plan and where we were and whatnot. 835.65s - 837.65s | And then what counts as airborne detection? 837.65s - 840.65s | Because we're seeing, as soon as we fire up the phone, we're seeing things. 840.65s - 845.65s | So we capped that at 500 feet above ground level is when we're going to consider it. 845.65s - 850.43s | We caught it in the air. 850.43s - 855.43s | And then we got home, and we looked at the data, and went, oh, there's a lot. 855.43s - 857.43s | I wasn't a lot more than we were expecting. 857.43s - 864.43s | And full disclosure, we both used GPT to help us with some Python to figure this stuff out. 864.43s - 867.43s | So on our first flight, again, our maximum altitude, 3,500 feet. 867.43s - 871.43s | We were in the air for about 32 minutes above 500. 871.43s - 881.97s | And we caught 2,822 unique BSS IDs or MAC addresses while we were in the air, which is 88 per minute. 881.97s - 882.97s | How far away?


chunk_text:
for us, 830.65s - 835.65s | so we can correlate also that to our flight plan and where we were and whatnot. 835.65s - 837.65s | And then what counts as airborne detection? 837.65s - 840.65s | Because we're seeing, as soon as we fire up the phone, we're seeing things. 840.65s - 845.65s | So we capped that at 500 feet above ground level is when we're going to consider it. 845.65s - 850.43s | We caught it in the air. 850.43s - 855.43s | And then we got home, and we looked at the data, and went, oh, there's a lot. 855.43s - 857.43s | I wasn't a lot more than we were expecting. 857.43s - 864.43s | And full disclosure, we both used GPT to help us with some Python to figure this stuff out. 864.43s - 867.43s | So on our first flight, again, our maximum altitude, 3,500 feet. 867.43s - 871.43s | We were in the air for about 32 minutes above 500. 871.43s - 881.97s | And we caught 2,822 unique BSS IDs or MAC addresses while we were in the air, which is 88 per minute. 881.97s - 882.97s | How far away? 882.97s - 886.97s | We did a lot of, like, mathing, trying to calculate distance and such. 886.97s - 889.97s | And I was curious what the official spec is. 889.97s - 896.97s | The Wi-Fi Alliance doesn't really say explicitly Wi-Fi is good for this range, but it's about 150 feet. 896.97s - 901.41s | We kind of went past that quite a bit. 901.41s - 904.41s | So this was our first attempt to analyze the data. 904.41s - 913.41s | And if you look at it a little closely, you'll notice we have the same distance for every single device that we caught, right? 913.41s - 914.41s | The first sets of them. 914.41s - 917.41s | The first sets of them. 917.41s - 919.41s | So then we flew again. 919.41s - 921.41s | We took a second flight, and this was your flight, right? 921.41s - 922.41s | Yeah. 922.41s - 928.41s | So then I was asking the question, okay, is it okay to warfly safely when you're solo? 928.41s - 934.41s | And I needed to go do some takeoffs and landings, so I thought, well, hey, maybe I'll fire up the phone.


chunk_text:
882.97s - 886.97s | We did a lot of, like, mathing, trying to calculate distance and such. 886.97s - 889.97s | And I was curious what the official spec is. 889.97s - 896.97s | The Wi-Fi Alliance doesn't really say explicitly Wi-Fi is good for this range, but it's about 150 feet. 896.97s - 901.41s | We kind of went past that quite a bit. 901.41s - 904.41s | So this was our first attempt to analyze the data. 904.41s - 913.41s | And if you look at it a little closely, you'll notice we have the same distance for every single device that we caught, right? 913.41s - 914.41s | The first sets of them. 914.41s - 917.41s | The first sets of them. 917.41s - 919.41s | So then we flew again. 919.41s - 921.41s | We took a second flight, and this was your flight, right? 921.41s - 922.41s | Yeah. 922.41s - 928.41s | So then I was asking the question, okay, is it okay to warfly safely when you're solo? 928.41s - 934.41s | And I needed to go do some takeoffs and landings, so I thought, well, hey, maybe I'll fire up the phone. 934.41s - 943.41s | So what I did, my procedure was fire up the phone during preflight, before the airplane's on, start Wiggle, leave it there. 943.41s - 944.41s | Don't touch it. 944.41s - 945.41s | Don't mess with it. 945.41s - 946.41s | Don't worry about it. 946.41s - 952.41s | And then go fly, come back, shut the airplane down, get everything good, then check the Wiggle data. 952.41s - 953.41s | And that worked. 953.41s - 959.41s | So for this, I went to the ‑‑ there's kind of a northeast practice area that's over an unpopulated area. 959.41s - 962.41s | A lot of flight training activity goes on up there. 962.41s - 965.41s | So I went to see what I could collect. 965.41s - 976.41s | Went up to 2,500 feet, 54 minutes, just under 6,000 access points for a rate, which ‑‑ and I think this is a unique metric that nobody else has published. 976.41s - 977.41s | I could be wrong. 977.41s - 978.41s | I don't know. 979.41s - 983.41s | But max per minute. 983.41s - 985.41s | So got 108 max per minute. 985.41s - 989.41s |


chunk_text:
934.41s - 943.41s | So what I did, my procedure was fire up the phone during preflight, before the airplane's on, start Wiggle, leave it there. 943.41s - 944.41s | Don't touch it. 944.41s - 945.41s | Don't mess with it. 945.41s - 946.41s | Don't worry about it. 946.41s - 952.41s | And then go fly, come back, shut the airplane down, get everything good, then check the Wiggle data. 952.41s - 953.41s | And that worked. 953.41s - 959.41s | So for this, I went to the ‑‑ there's kind of a northeast practice area that's over an unpopulated area. 959.41s - 962.41s | A lot of flight training activity goes on up there. 962.41s - 965.41s | So I went to see what I could collect. 965.41s - 976.41s | Went up to 2,500 feet, 54 minutes, just under 6,000 access points for a rate, which ‑‑ and I think this is a unique metric that nobody else has published. 976.41s - 977.41s | I could be wrong. 977.41s - 978.41s | I don't know. 979.41s - 983.41s | But max per minute. 983.41s - 985.41s | So got 108 max per minute. 985.41s - 989.41s | Test three, similar exercise, just going up, flying around a little bit myself. 989.41s - 991.41s | Had the phone mounted the same way. 991.41s - 998.41s | And got ‑‑ went up 6,500 feet, about 7,000 max, 130 max per minute. 998.41s - 1011.41s | And then was working on the distance analysis and saw for that flight we had like over a dozen where we had a starting and ending range where we saw them over a range of over five kilometers. 1011.41s - 1016.41s | So we were seeing them from a couple miles away, pretty sure. 1016.41s - 1019.41s | Test four, top access points on this one. 1019.41s - 1021.41s | Top was nine kilometers. 1021.41s - 1029.41s | And then saw several of these 000D97s. 1029.41s - 1032.41s | And I don't know what they are, but it's registered to Hitachi Energy USA. 1032.41s - 1036.41s | So we're wondering if it's some kind of IoT energy distribution something. 1036.41s - 1040.41s | We did talk to the ICS village folks and they said yeah, probably. 1040.41s - 1043.41s | So test four, biennial flight review. 1043.41s - 1049.41s | The quick story on


chunk_text:
Test three, similar exercise, just going up, flying around a little bit myself. 989.41s - 991.41s | Had the phone mounted the same way. 991.41s - 998.41s | And got ‑‑ went up 6,500 feet, about 7,000 max, 130 max per minute. 998.41s - 1011.41s | And then was working on the distance analysis and saw for that flight we had like over a dozen where we had a starting and ending range where we saw them over a range of over five kilometers. 1011.41s - 1016.41s | So we were seeing them from a couple miles away, pretty sure. 1016.41s - 1019.41s | Test four, top access points on this one. 1019.41s - 1021.41s | Top was nine kilometers. 1021.41s - 1029.41s | And then saw several of these 000D97s. 1029.41s - 1032.41s | And I don't know what they are, but it's registered to Hitachi Energy USA. 1032.41s - 1036.41s | So we're wondering if it's some kind of IoT energy distribution something. 1036.41s - 1040.41s | We did talk to the ICS village folks and they said yeah, probably. 1040.41s - 1043.41s | So test four, biennial flight review. 1043.41s - 1049.41s | The quick story on that one was I was with an instructor but didn't have time to pay attention to the phone. 1049.41s - 1054.41s | Got back and I just put it in my flight bag to see what would happen. 1054.41s - 1058.41s | And got back and realized that I didn't have any data. 1058.41s - 1062.41s | So the good thing was ‑‑ or the bad thing was we lost the data. 1062.41s - 1066.41s | The good thing was I demonstrated that I was not getting distracted by the phone. 1066.41s - 1070.41s | And then ‑‑ thank you. 1070.41s - 1072.41s | Don't get distracted by the phone. 1072.41s - 1082.41s | Test flight number five, there is a path that you can take that's kind of a scenic river tour that avoids the controlled air spaces in downtown Detroit. 1082.41s - 1086.41s | So we decided to do that for our next test flight. 1086.41s - 1090.41s | And fun for flying, you get to take pictures like this. 1090.41s - 1093.41s | So we decided we're using two phones. 1093.41s - 1096.41s | Can we get data a better way or a different way? 1096.41s -


chunk_text:
that one was I was with an instructor but didn't have time to pay attention to the phone. 1049.41s - 1054.41s | Got back and I just put it in my flight bag to see what would happen. 1054.41s - 1058.41s | And got back and realized that I didn't have any data. 1058.41s - 1062.41s | So the good thing was ‑‑ or the bad thing was we lost the data. 1062.41s - 1066.41s | The good thing was I demonstrated that I was not getting distracted by the phone. 1066.41s - 1070.41s | And then ‑‑ thank you. 1070.41s - 1072.41s | Don't get distracted by the phone. 1072.41s - 1082.41s | Test flight number five, there is a path that you can take that's kind of a scenic river tour that avoids the controlled air spaces in downtown Detroit. 1082.41s - 1086.41s | So we decided to do that for our next test flight. 1086.41s - 1090.41s | And fun for flying, you get to take pictures like this. 1090.41s - 1093.41s | So we decided we're using two phones. 1093.41s - 1096.41s | Can we get data a better way or a different way? 1096.41s - 1100.41s | So I also brought along a laptop running Linux with lin SSID on it. 1100.41s - 1105.41s | Stuffed a USB Wi‑Fi card in the window. 1105.41s - 1110.41s | And then you can see, again, my pixel in the handle of the plane. 1110.41s - 1115.41s | Matt's Android was on the other side of the plane in his handle. 1115.41s - 1127.01s | And so we started counting MAC addresses at different altitudes through lin SSID and correlating that with legal as well. 1128.01s - 1134.01s | So with lin SSID, I got 10,208 unique MAC addresses. 1134.01s - 1137.01s | Wiggle on my phone was super underperforming on this flight for some reason. 1137.01s - 1140.01s | It only got 2,753. 1140.01s - 1143.01s | But Matt was able to grab, again, almost 8,000. 1143.01s - 1148.77s | And then we, again, tried to do distance analysis on it. 1148.77s - 1153.77s | So we've got, again, our topping out at almost 10 kilometers. 1153.77s - 1155.77s | But most of them, you know, five or six. 1156.77s - 1159.77s | And then I broke down the lin SSID specifically as well. 1159.77s - 1163.77s


chunk_text:
1100.41s | So I also brought along a laptop running Linux with lin SSID on it. 1100.41s - 1105.41s | Stuffed a USB Wi‑Fi card in the window. 1105.41s - 1110.41s | And then you can see, again, my pixel in the handle of the plane. 1110.41s - 1115.41s | Matt's Android was on the other side of the plane in his handle. 1115.41s - 1127.01s | And so we started counting MAC addresses at different altitudes through lin SSID and correlating that with legal as well. 1128.01s - 1134.01s | So with lin SSID, I got 10,208 unique MAC addresses. 1134.01s - 1137.01s | Wiggle on my phone was super underperforming on this flight for some reason. 1137.01s - 1140.01s | It only got 2,753. 1140.01s - 1143.01s | But Matt was able to grab, again, almost 8,000. 1143.01s - 1148.77s | And then we, again, tried to do distance analysis on it. 1148.77s - 1153.77s | So we've got, again, our topping out at almost 10 kilometers. 1153.77s - 1155.77s | But most of them, you know, five or six. 1156.77s - 1159.77s | And then I broke down the lin SSID specifically as well. 1159.77s - 1163.77s | And one thing, when I ‑‑ lin SSID, you can tune it. 1163.77s - 1165.77s | I turned it all the way down so it would sample constantly. 1165.77s - 1167.77s | That was a really bad idea. 1167.77s - 1171.77s | I had two gigabytes of data to try and wrangle. 1171.77s - 1178.77s | But here's a list of the longest duration SSIDs I was able to catch out of lin SSID. 1178.77s - 1181.77s | I still have the MAC addresses or the BSSIDs. 1182.77s - 1186.77s | But, yeah, the Krusty Krab is apparently a really long range Wi‑Fi network in Metro Detroit. 1186.77s - 1193.26s | And a minute and a half of observation is about five and a half kilometers. 1193.26s - 1196.26s | And this is that same flight plan, right? 1196.26s - 1197.26s | Yeah, so this is the flight plan. 1197.26s - 1199.26s | So we wanted to compare altitudes. 1199.26s - 1202.26s | So we basically ‑‑ so I was using ForeFlight. 1202.26s - 1206.26s | So flew kind of an S pattern over Lake Orient and Oxford, Michigan. 1206.26s - 1211.26s | Thank you to the citizens of


chunk_text:
| And one thing, when I ‑‑ lin SSID, you can tune it. 1163.77s - 1165.77s | I turned it all the way down so it would sample constantly. 1165.77s - 1167.77s | That was a really bad idea. 1167.77s - 1171.77s | I had two gigabytes of data to try and wrangle. 1171.77s - 1178.77s | But here's a list of the longest duration SSIDs I was able to catch out of lin SSID. 1178.77s - 1181.77s | I still have the MAC addresses or the BSSIDs. 1182.77s - 1186.77s | But, yeah, the Krusty Krab is apparently a really long range Wi‑Fi network in Metro Detroit. 1186.77s - 1193.26s | And a minute and a half of observation is about five and a half kilometers. 1193.26s - 1196.26s | And this is that same flight plan, right? 1196.26s - 1197.26s | Yeah, so this is the flight plan. 1197.26s - 1199.26s | So we wanted to compare altitudes. 1199.26s - 1202.26s | So we basically ‑‑ so I was using ForeFlight. 1202.26s - 1206.26s | So flew kind of an S pattern over Lake Orient and Oxford, Michigan. 1206.26s - 1211.26s | Thank you to the citizens of Lake Orient and Oxford for letting us bother your skies that day. 1211.26s - 1216.26s | So we did one path at 2,500 feet and then climbed up to 3,500 feet and tried to just follow the same path. 1216.26s - 1220.26s | And you see how well I did or did not do. 1220.26s - 1225.26s | So at 1,500, altitude of 1,500, we got 101. 1225.26s - 1227.26s | Again, max per minute. 1227.26s - 1230.26s | When we increase that by 1,000 feet, we're getting 49. 1230.26s - 1233.26s | So you can see the signals are starting to degrade the higher we're getting. 1233.26s - 1239.15s | But we're still getting some significant traffic. 1239.15s - 1240.15s | Oh, I'm sorry. 1240.15s - 1242.15s | I'm hitting the wrong button. 1242.15s - 1243.15s | Yeah, did we go too fast? 1243.15s - 1244.15s | I don't know. 1244.15s - 1248.15s | I don't think that's a thing you can do is go too fast. 1248.15s - 1253.15s | Yeah, so this was one thing that we would like to explore more is what is the speed? 1253.15s - 1257.15s | Because we were going about 220


chunk_text:
Lake Orient and Oxford for letting us bother your skies that day. 1211.26s - 1216.26s | So we did one path at 2,500 feet and then climbed up to 3,500 feet and tried to just follow the same path. 1216.26s - 1220.26s | And you see how well I did or did not do. 1220.26s - 1225.26s | So at 1,500, altitude of 1,500, we got 101. 1225.26s - 1227.26s | Again, max per minute. 1227.26s - 1230.26s | When we increase that by 1,000 feet, we're getting 49. 1230.26s - 1233.26s | So you can see the signals are starting to degrade the higher we're getting. 1233.26s - 1239.15s | But we're still getting some significant traffic. 1239.15s - 1240.15s | Oh, I'm sorry. 1240.15s - 1242.15s | I'm hitting the wrong button. 1242.15s - 1243.15s | Yeah, did we go too fast? 1243.15s - 1244.15s | I don't know. 1244.15s - 1248.15s | I don't think that's a thing you can do is go too fast. 1248.15s - 1253.15s | Yeah, so this was one thing that we would like to explore more is what is the speed? 1253.15s - 1257.15s | Because we were going about 220 feet per second horizontally. 1257.15s - 1260.15s | Wiggles seemed to be taking samples about every five seconds. 1260.15s - 1264.15s | So that's about 1,100 feet per sample. 1264.15s - 1268.15s | So that may have impacted our ability to scan. 1268.15s - 1272.53s | And then we still had this kind of nagging question. 1272.53s - 1273.53s | Are we seeing a lot of data? 1273.53s - 1274.53s | Are we seeing more than we should be? 1274.53s - 1276.53s | Are we seeing less than we should be? 1276.53s - 1278.53s | So we decided to do some more driving. 1278.53s - 1285.53s | And since we love Woodward Avenue, decided to go do a war drive from 11-mile road to Square Lake Road on Woodward, 1285.53s - 1288.53s | which is a distance of 9.8 miles. 1288.53s - 1290.53s | And you see the results there. 1290.53s - 1295.53s | War driving, we took 14 minutes to cover that path, speed of 42 miles an hour. 1295.53s - 1301.53s | And we observed 2,210 MAC addresses for a rate of 157 MACs per minute. 1301.53s - 1308.53s | War flying, we went a lot faster, covered


chunk_text:
feet per second horizontally. 1257.15s - 1260.15s | Wiggles seemed to be taking samples about every five seconds. 1260.15s - 1264.15s | So that's about 1,100 feet per sample. 1264.15s - 1268.15s | So that may have impacted our ability to scan. 1268.15s - 1272.53s | And then we still had this kind of nagging question. 1272.53s - 1273.53s | Are we seeing a lot of data? 1273.53s - 1274.53s | Are we seeing more than we should be? 1274.53s - 1276.53s | Are we seeing less than we should be? 1276.53s - 1278.53s | So we decided to do some more driving. 1278.53s - 1285.53s | And since we love Woodward Avenue, decided to go do a war drive from 11-mile road to Square Lake Road on Woodward, 1285.53s - 1288.53s | which is a distance of 9.8 miles. 1288.53s - 1290.53s | And you see the results there. 1290.53s - 1295.53s | War driving, we took 14 minutes to cover that path, speed of 42 miles an hour. 1295.53s - 1301.53s | And we observed 2,210 MAC addresses for a rate of 157 MACs per minute. 1301.53s - 1308.53s | War flying, we went a lot faster, covered the distance in 4 minutes at 148 miles an hour, got about a third the number of MACs. 1308.53s - 1314.53s | We got a lot less MACs, 783, but we collected them a lot faster at 197 MACs per minute. 1314.53s - 1323.53s | So our conclusion from that is that, at least in this case, war driving collects more MACs, but war flying collects them faster. 1323.53s - 1324.53s | Right. 1324.53s - 1326.53s | So take your pick. 1326.53s - 1328.53s | I would say flying is probably more fun. 1329.53s - 1331.53s | So, yeah, a little more distance analysis. 1331.53s - 1338.53s | This is on the stretch down Woodward Avenue, which we had a discrete starting and stopping distance without any overlap, 1338.53s - 1347.53s | so we could get a clear measure of how long we could see a signal without worrying about, oh, was it looping around and whatnot. 1347.53s - 1352.53s | So, again, our maximum distance here is about 4 kilometers. 1352.53s - 1359.53s | One of the things I find really interesting, again, we got a car and then Uconnect based on a past thing I used to do.


chunk_text:
the distance in 4 minutes at 148 miles an hour, got about a third the number of MACs. 1308.53s - 1314.53s | We got a lot less MACs, 783, but we collected them a lot faster at 197 MACs per minute. 1314.53s - 1323.53s | So our conclusion from that is that, at least in this case, war driving collects more MACs, but war flying collects them faster. 1323.53s - 1324.53s | Right. 1324.53s - 1326.53s | So take your pick. 1326.53s - 1328.53s | I would say flying is probably more fun. 1329.53s - 1331.53s | So, yeah, a little more distance analysis. 1331.53s - 1338.53s | This is on the stretch down Woodward Avenue, which we had a discrete starting and stopping distance without any overlap, 1338.53s - 1347.53s | so we could get a clear measure of how long we could see a signal without worrying about, oh, was it looping around and whatnot. 1347.53s - 1352.53s | So, again, our maximum distance here is about 4 kilometers. 1352.53s - 1359.53s | One of the things I find really interesting, again, we got a car and then Uconnect based on a past thing I used to do. 1359.53s - 1360.53s | I know that's awful. 1360.53s - 1361.53s | We love Uconnect. 1361.53s - 1362.53s | Right, I love Uconnect. 1362.53s - 1363.53s | Yes, yes. 1363.53s - 1367.53s | But so we were able to catch cars from the air while we were flying down Woodward. 1367.53s - 1369.53s | Sorry, this was the war drive. 1369.53s - 1370.53s | Oh, was that the war drive one? 1370.53s - 1371.53s | Yeah, this was the war drive one. 1371.53s - 1381.53s | And so what we see from here is the distance, because our top distances on the war flying were like 9 kilometers, 5 kilometers. 1381.53s - 1385.53s | These are down to like 4, so we're pretty sure we were just tracking cars. 1385.53s - 1393.53s | And then our old friend 000D97 shows up again, something fairly visible from wherever, 1393.53s - 1397.53s | but we were getting a lot less distance clearly with the war driving versus the war flying. 1397.53s - 1399.87s | And then? 1399.87s - 1404.87s | And then when you fly, you have to take a cockpit selfie because it's cool. 1404.87s - 1405.87s | Right. 1405.87s -


chunk_text:
1359.53s - 1360.53s | I know that's awful. 1360.53s - 1361.53s | We love Uconnect. 1361.53s - 1362.53s | Right, I love Uconnect. 1362.53s - 1363.53s | Yes, yes. 1363.53s - 1367.53s | But so we were able to catch cars from the air while we were flying down Woodward. 1367.53s - 1369.53s | Sorry, this was the war drive. 1369.53s - 1370.53s | Oh, was that the war drive one? 1370.53s - 1371.53s | Yeah, this was the war drive one. 1371.53s - 1381.53s | And so what we see from here is the distance, because our top distances on the war flying were like 9 kilometers, 5 kilometers. 1381.53s - 1385.53s | These are down to like 4, so we're pretty sure we were just tracking cars. 1385.53s - 1393.53s | And then our old friend 000D97 shows up again, something fairly visible from wherever, 1393.53s - 1397.53s | but we were getting a lot less distance clearly with the war driving versus the war flying. 1397.53s - 1399.87s | And then? 1399.87s - 1404.87s | And then when you fly, you have to take a cockpit selfie because it's cool. 1404.87s - 1405.87s | Right. 1405.87s - 1406.87s | I can be like. 1406.87s - 1407.87s | It's so cool. 1407.87s - 1408.87s | I was flying. 1408.87s - 1409.87s | You got to do it twice. 1409.87s - 1410.87s | Way to do it again. 1410.87s - 1418.98s | So, yeah, further investigation, you know, different speeds and altitudes. 1418.98s - 1421.98s | I would really love to just, you know, every 500 feet, same route and all that. 1421.98s - 1424.98s | But that takes a lot of time, uses a lot of fuel. 1424.98s - 1425.98s | Aircraft construction. 1425.98s - 1430.98s | Do we get better results if we're in a composite aircraft without metal wrapping around us? 1430.98s - 1435.98s | And if somebody wants to donate a Cirrus for further research, please also see me afterwards. 1435.98s - 1442.98s | Hardware platforms, maybe using some drones that could carry a payload, antenna placement, additional radios. 1442.98s - 1447.98s | And then directional antennas, et cetera. 1447.98s - 1448.98s | Yeah. 1448.98s - 1450.98s | So that's what we got. 1450.98s - 1451.98s | So thank you. 1451.98s - 1452.98s | Thank you all for coming out. 1452.98s - 1454.98s | Thanks


chunk_text:
1406.87s | I can be like. 1406.87s - 1407.87s | It's so cool. 1407.87s - 1408.87s | I was flying. 1408.87s - 1409.87s | You got to do it twice. 1409.87s - 1410.87s | Way to do it again. 1410.87s - 1418.98s | So, yeah, further investigation, you know, different speeds and altitudes. 1418.98s - 1421.98s | I would really love to just, you know, every 500 feet, same route and all that. 1421.98s - 1424.98s | But that takes a lot of time, uses a lot of fuel. 1424.98s - 1425.98s | Aircraft construction. 1425.98s - 1430.98s | Do we get better results if we're in a composite aircraft without metal wrapping around us? 1430.98s - 1435.98s | And if somebody wants to donate a Cirrus for further research, please also see me afterwards. 1435.98s - 1442.98s | Hardware platforms, maybe using some drones that could carry a payload, antenna placement, additional radios. 1442.98s - 1447.98s | And then directional antennas, et cetera. 1447.98s - 1448.98s | Yeah. 1448.98s - 1450.98s | So that's what we got. 1450.98s - 1451.98s | So thank you. 1451.98s - 1452.98s | Thank you all for coming out. 1452.98s - 1454.98s | Thanks to Pontiac Tower and Detroit Approach for working with us, 1454.98s - 1457.98s | even though they had no idea what we were doing up there. 1457.98s - 1458.98s | Thanks to all the mats. 1458.98s - 1460.98s | There were more of them. 1460.98s - 1461.98s | Yes. 1461.98s - 1464.98s | Their mats at the Aerospace Village were all over the place. 1464.98s - 1465.98s | All right. 1465.98s - 1466.98s | Thank you all.


chunk_text:
to Pontiac Tower and Detroit Approach for working with us, 1454.98s - 1457.98s | even though they had no idea what we were doing up there. 1457.98s - 1458.98s | Thanks to all the mats. 1458.98s - 1460.98s | There were more of them. 1460.98s - 1461.98s | Yes. 1461.98s - 1464.98s | Their mats at the Aerospace Village were all over the place. 1464.98s - 1465.98s | All right. 1465.98s - 1466.98s | Thank you all.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=Ui2etjRyrUE", "title": "DEF CON 32 - V2GEvil: Ghost in the Wires - Pavel Khunt & Thomas Sermpinis aka Cr0wTom", "description": "This research aims to enhance electric vehicle cybersecurity by uncovering vulnerabilities in the Electric Vehicle Communication Controller (EVCC), crucial for charging communication. We've developed a specialized security tool after examining electric vehicle charging ports and On-Board Charging (OBC) protocols, with a focus on ISO 15118 standards.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1459, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.00s | This text was transcribed using whisper model: large-v2 Hello. Hello, everyone. First of all, thank you for joining us today. 5.00s - 9.00s | And our topic is V2G will ghost in the wires. 9.00s - 16.00s | Where will we talk about the V2G and the cybersecurity issues that come with it? 16.00s - 22.89s | First of all, let me introduce us. I am Pavel Kuhn, cybersecurity researcher, 22.89s - 29.89s | and I'm currently working at Auxilium Pentest Lab with Tom. 29.89s - 32.89s | Hello from myself, too. I'm Thomas Rampinis. 32.89s - 35.89s | I'm the technical director of Auxilium Pentest Labs. 35.89s - 38.89s | And yeah, let's start. 38.89s - 43.89s | Our main goal today is to analyze the state of cybersecurity in the automotive industry 43.89s - 49.89s | and get an in-depth look on the EV architecture and this undeniably emerging attack vector. 49.89s - 55.89s | We want to explore and understand the communication protocols used in EV charging today 55.89s - 63.89s | and introduce you to our security tool, V2G Evil, that we built with Pavel during his university thesis 63.89s - 68.89s | and finally create a reference point for EV security research and evaluation, 68.89s - 72.89s | something that we feel our industry is lacking, basically, 72.89s - 77.89s | alongside other vectors in the automotive security landscape. 77.89s - 81.89s | So let's start with the introduction to vehicle cybersecurity. 82.89s - 86.89s | Basically, it goes without question that the automotive industry cannot be considered something new. 86.89s - 91.89s | We are basically talking about 100-plus-year-old mechanical engineering industries, 91.89s - 93.89s | and nothing is new about this. 93.89s - 97.89s | The constant need for connectivity and technological aspects of it 97.89s - 104.89s | push those companies to make restructuring and start implementing technologies 104.89s


chunk_text:
43.89s | Our main goal today is to analyze the state of cybersecurity in the automotive industry 43.89s - 49.89s | and get an in-depth look on the EV architecture and this undeniably emerging attack vector. 49.89s - 55.89s | We want to explore and understand the communication protocols used in EV charging today 55.89s - 63.89s | and introduce you to our security tool, V2G Evil, that we built with Pavel during his university thesis 63.89s - 68.89s | and finally create a reference point for EV security research and evaluation, 68.89s - 72.89s | something that we feel our industry is lacking, basically, 72.89s - 77.89s | alongside other vectors in the automotive security landscape. 77.89s - 81.89s | So let's start with the introduction to vehicle cybersecurity. 82.89s - 86.89s | Basically, it goes without question that the automotive industry cannot be considered something new. 86.89s - 91.89s | We are basically talking about 100-plus-year-old mechanical engineering industries, 91.89s - 93.89s | and nothing is new about this. 93.89s - 97.89s | The constant need for connectivity and technological aspects of it 97.89s - 104.89s | push those companies to make restructuring and start implementing technologies 104.89s - 110.89s | that didn't have the know-how or the capacity to do so before, which is good for us. 110.89s - 112.89s | That's why we are here in the end, 112.89s - 116.89s | but really bad for the security and safety of the affected vehicles that we're testing. 116.89s - 122.89s | On the other hand, you have all these startups that started as technology companies first, 122.89s - 127.89s | which have a way better security posture and culture, 127.89s - 131.89s | but the industry as a whole struggles for the last decade. 131.89s - 137.87s | And to be honest, I cannot see a clear light in this path. 137.87s - 141.87s | Isolating the part we will focus on in this talk, 141.87s - 145.87s | we have the emerging industry of electric and hybrid vehicles, 145.87s - 150.87s | mainly developed to decentralize pollution and make better use of clean energy solutions. 150.87s - 157.87s | And additionally, you have several advantages in comparison to internal combustion engine vehicles, 157.87s - 161.87s | for example, heavy gains in speed and efficiency. 161.87s - 164.87s | And while early models used basic charging,


chunk_text:
- 110.89s | that didn't have the know-how or the capacity to do so before, which is good for us. 110.89s - 112.89s | That's why we are here in the end, 112.89s - 116.89s | but really bad for the security and safety of the affected vehicles that we're testing. 116.89s - 122.89s | On the other hand, you have all these startups that started as technology companies first, 122.89s - 127.89s | which have a way better security posture and culture, 127.89s - 131.89s | but the industry as a whole struggles for the last decade. 131.89s - 137.87s | And to be honest, I cannot see a clear light in this path. 137.87s - 141.87s | Isolating the part we will focus on in this talk, 141.87s - 145.87s | we have the emerging industry of electric and hybrid vehicles, 145.87s - 150.87s | mainly developed to decentralize pollution and make better use of clean energy solutions. 150.87s - 157.87s | And additionally, you have several advantages in comparison to internal combustion engine vehicles, 157.87s - 161.87s | for example, heavy gains in speed and efficiency. 161.87s - 164.87s | And while early models used basic charging, 164.87s - 170.87s | the last decade charging standards are applied and enforced in many ways, 170.87s - 175.87s | which led to the standardization of the ports, protocols and underlying data 175.87s - 180.87s | in a wide range of applicability for different continents and standards. 180.87s - 185.87s | And this is, of course, in addition to the digital communication needed during charging, 185.87s - 190.87s | which expanded the attack surface of the vehicles as we knew from them before 190.87s - 196.87s | and created new attack vectors that we can start playing with. 196.87s - 203.87s | What I'm saying here is that it's not something new or groundbreaking by any means, 203.87s - 207.87s | but the state of EV charging security is a barely touched topic by researchers. 214.30s - 218.30s | And here we have a really simple representation of a modern vehicle, 218.30s - 221.30s | which normally includes a bunch of interconnected ECUs 221.30s - 224.30s | responsible for different functionality in the vehicle. 224.30s - 230.30s | This can be from single headlight ECUs to huge DC-DC converters. 230.30s - 237.30s | And what we see, though, is that


chunk_text:
164.87s - 170.87s | the last decade charging standards are applied and enforced in many ways, 170.87s - 175.87s | which led to the standardization of the ports, protocols and underlying data 175.87s - 180.87s | in a wide range of applicability for different continents and standards. 180.87s - 185.87s | And this is, of course, in addition to the digital communication needed during charging, 185.87s - 190.87s | which expanded the attack surface of the vehicles as we knew from them before 190.87s - 196.87s | and created new attack vectors that we can start playing with. 196.87s - 203.87s | What I'm saying here is that it's not something new or groundbreaking by any means, 203.87s - 207.87s | but the state of EV charging security is a barely touched topic by researchers. 214.30s - 218.30s | And here we have a really simple representation of a modern vehicle, 218.30s - 221.30s | which normally includes a bunch of interconnected ECUs 221.30s - 224.30s | responsible for different functionality in the vehicle. 224.30s - 230.30s | This can be from single headlight ECUs to huge DC-DC converters. 230.30s - 237.30s | And what we see, though, is that while this vehicle till now was reasonably isolated by the outside world, 237.30s - 243.30s | now we have a new externally accessible port which connects to a charging station. 243.30s - 245.30s | And this leaves a big room for error. 245.30s - 250.30s | And if not properly implemented and designed, several unexpected instances can occur. 251.30s - 257.30s | And while architecture and vehicle design of interconnected vehicles might not seem as important, 257.30s - 264.30s | there are numerous instances that they played a big part of how severe our findings are during a pen test 264.30s - 270.30s | and how, in the end, can or cannot affect the safety of the driver, passengers, or even pedestrians. 271.30s - 278.30s | And as we keep digging deeper, let's discuss a bit about charging in terms of vehicles and the automotive industry. 278.30s - 285.30s | So first of all, there are several charging methods, including conductive, wireless, and some exotic ones 285.30s - 290.30s | that we only see in some manufacturers, like battery swaps and bidirectional charging. 290.30s - 295.30s | And on top of that, there are different types depending on the needs


chunk_text:
while this vehicle till now was reasonably isolated by the outside world, 237.30s - 243.30s | now we have a new externally accessible port which connects to a charging station. 243.30s - 245.30s | And this leaves a big room for error. 245.30s - 250.30s | And if not properly implemented and designed, several unexpected instances can occur. 251.30s - 257.30s | And while architecture and vehicle design of interconnected vehicles might not seem as important, 257.30s - 264.30s | there are numerous instances that they played a big part of how severe our findings are during a pen test 264.30s - 270.30s | and how, in the end, can or cannot affect the safety of the driver, passengers, or even pedestrians. 271.30s - 278.30s | And as we keep digging deeper, let's discuss a bit about charging in terms of vehicles and the automotive industry. 278.30s - 285.30s | So first of all, there are several charging methods, including conductive, wireless, and some exotic ones 285.30s - 290.30s | that we only see in some manufacturers, like battery swaps and bidirectional charging. 290.30s - 295.30s | And on top of that, there are different types depending on the needs of the user 295.30s - 301.30s | and the capabilities of the vehicle, including AC and DC charging, 301.30s - 305.30s | supplying different advantages and disadvantages, as we will see later. 305.30s - 309.30s | And finally, during charging, there are also different modes of charging, 309.30s - 315.30s | where basically the first three modes are focused to AC and the fourth one in DC charging. 316.30s - 321.30s | Talking about some boring stuff here, there are a lot of different available standards, 321.30s - 329.30s | and as our main focus is the Combined Charging Standard, or CCS, basically for Europe. 329.30s - 336.30s | And we just have this undeniably big list of standards for different levels of this full implementation, 336.30s - 343.30s | ranging from the connector itself to the high-level communication needed between the EV and the charger. 343.30s - 350.30s | And this CCS standard is basically an effort towards a single unified for electric vehicle charging, 350.30s - 354.30s | which, considering where we are today, you might disagree. 355.30s - 362.30s | And the reason I said this is because there are a number of different standards out there


chunk_text:
of the user 295.30s - 301.30s | and the capabilities of the vehicle, including AC and DC charging, 301.30s - 305.30s | supplying different advantages and disadvantages, as we will see later. 305.30s - 309.30s | And finally, during charging, there are also different modes of charging, 309.30s - 315.30s | where basically the first three modes are focused to AC and the fourth one in DC charging. 316.30s - 321.30s | Talking about some boring stuff here, there are a lot of different available standards, 321.30s - 329.30s | and as our main focus is the Combined Charging Standard, or CCS, basically for Europe. 329.30s - 336.30s | And we just have this undeniably big list of standards for different levels of this full implementation, 336.30s - 343.30s | ranging from the connector itself to the high-level communication needed between the EV and the charger. 343.30s - 350.30s | And this CCS standard is basically an effort towards a single unified for electric vehicle charging, 350.30s - 354.30s | which, considering where we are today, you might disagree. 355.30s - 362.30s | And the reason I said this is because there are a number of different standards out there in the wild, 362.30s - 366.30s | mostly divided to the different continents, 366.30s - 371.30s | but lately several manufacturers have decided to move into the Tesla standard, 371.30s - 374.30s | the supercharger standard, mainly in the USA, 374.30s - 378.30s | and mainly because of the heavily invested charging network in the US roads. 378.30s - 382.30s | And of course that does not affect Europe, at least for now, 382.30s - 387.30s | but the opportunity for a unified standard, in my opinion, is kind of lost at this point. 388.30s - 394.30s | And, yeah, as we look at this circle of this CCS AC type 2 connector, 394.30s - 396.30s | we can distinguish several pins. 396.30s - 402.30s | Some of them is the CP pin, which is crucial for communication between the car and the charging station, 402.30s - 407.30s | and the pin with the highest interest for us as cybersecurity researchers. 408.30s - 413.30s | It basically allows the station to check the vehicle status and ensure it's safe to charge. 413.30s - 418.30s | And then the PP pin ensures that the correct connector is used 418.30s - 424.30s


chunk_text:
in the wild, 362.30s - 366.30s | mostly divided to the different continents, 366.30s - 371.30s | but lately several manufacturers have decided to move into the Tesla standard, 371.30s - 374.30s | the supercharger standard, mainly in the USA, 374.30s - 378.30s | and mainly because of the heavily invested charging network in the US roads. 378.30s - 382.30s | And of course that does not affect Europe, at least for now, 382.30s - 387.30s | but the opportunity for a unified standard, in my opinion, is kind of lost at this point. 388.30s - 394.30s | And, yeah, as we look at this circle of this CCS AC type 2 connector, 394.30s - 396.30s | we can distinguish several pins. 396.30s - 402.30s | Some of them is the CP pin, which is crucial for communication between the car and the charging station, 402.30s - 407.30s | and the pin with the highest interest for us as cybersecurity researchers. 408.30s - 413.30s | It basically allows the station to check the vehicle status and ensure it's safe to charge. 413.30s - 418.30s | And then the PP pin ensures that the correct connector is used 418.30s - 424.30s | and provides information on the current carrying capacity of the cable that we're using. 424.30s - 429.30s | The AC type 2 connector supports charging at various power levels, 429.30s - 433.30s | from household outlets to high power public chargers. 434.30s - 437.30s | And here we have the DC CCS type 2 connector, 437.30s - 443.30s | an extension of the AC type 2 connector designed to support direct current fast charging. 443.30s - 448.30s | And this connector, also known as combo 2, basically incorporates the same pins 448.30s - 451.30s | as the AC type 2 connector for AC charging, 451.30s - 455.30s | but adds two additional pins specifically for DC charging. 455.30s - 461.30s | And the combination of these pins in a single connector is what gives this combined charging name. 462.30s - 466.30s | And it provides the flexibility of using either AC or DC, 466.30s - 469.30s | depending on the charging station and the vehicle capabilities. 470.30s - 474.30s | Here we can basically get an understanding of how this works internally 474.30s - 478.30s | in the different implementations of DC or AC charging. 478.30s - 482.30s |


chunk_text:
| and provides information on the current carrying capacity of the cable that we're using. 424.30s - 429.30s | The AC type 2 connector supports charging at various power levels, 429.30s - 433.30s | from household outlets to high power public chargers. 434.30s - 437.30s | And here we have the DC CCS type 2 connector, 437.30s - 443.30s | an extension of the AC type 2 connector designed to support direct current fast charging. 443.30s - 448.30s | And this connector, also known as combo 2, basically incorporates the same pins 448.30s - 451.30s | as the AC type 2 connector for AC charging, 451.30s - 455.30s | but adds two additional pins specifically for DC charging. 455.30s - 461.30s | And the combination of these pins in a single connector is what gives this combined charging name. 462.30s - 466.30s | And it provides the flexibility of using either AC or DC, 466.30s - 469.30s | depending on the charging station and the vehicle capabilities. 470.30s - 474.30s | Here we can basically get an understanding of how this works internally 474.30s - 478.30s | in the different implementations of DC or AC charging. 478.30s - 482.30s | And on the other hand, we have the DC charging where the power electronics 482.30s - 486.30s | for the conversion of the current exists in the EVSC side. 486.30s - 491.30s | So the charger, while when you want to use the slower solution of AC charging, 491.30s - 496.30s | the conversion is still happening inside the vehicle itself by the onboard charger. 496.30s - 500.30s | Additionally, we can get an understanding of the communication channel 500.30s - 504.30s | that exists in those scenarios, really important as we will see later, 504.30s - 510.30s | especially in safety critical cases where the current needs to be negotiated. 511.30s - 516.30s | From this, we clearly understand that charging is not only simple power transfer 516.30s - 519.30s | and data exchange is also happening under the hood, 519.30s - 523.30s | many times with important information like payment details, voltage, 523.30s - 527.30s | current requirements, time of charging and others. 527.30s - 531.30s | And to get a better understanding of how this communication is structured, 531.30s - 532.30s | I will pass it to Pavel. 533.30s - 541.50s | So let's have a look


chunk_text:
And on the other hand, we have the DC charging where the power electronics 482.30s - 486.30s | for the conversion of the current exists in the EVSC side. 486.30s - 491.30s | So the charger, while when you want to use the slower solution of AC charging, 491.30s - 496.30s | the conversion is still happening inside the vehicle itself by the onboard charger. 496.30s - 500.30s | Additionally, we can get an understanding of the communication channel 500.30s - 504.30s | that exists in those scenarios, really important as we will see later, 504.30s - 510.30s | especially in safety critical cases where the current needs to be negotiated. 511.30s - 516.30s | From this, we clearly understand that charging is not only simple power transfer 516.30s - 519.30s | and data exchange is also happening under the hood, 519.30s - 523.30s | many times with important information like payment details, voltage, 523.30s - 527.30s | current requirements, time of charging and others. 527.30s - 531.30s | And to get a better understanding of how this communication is structured, 531.30s - 532.30s | I will pass it to Pavel. 533.30s - 541.50s | So let's have a look at the charging flow, its high-level overview. 541.50s - 549.50s | So first, the user plugs the CCS connector to his car and then the low-level communication starts. 550.50s - 555.50s | If the EV is in the state B and the signal has the 5% duty cycle, 555.50s - 561.50s | it can change to the high-level communication and during the high-level communication, 561.50s - 564.50s | they are exchanged to digital information about the charging. 565.50s - 571.77s | And that's how my journey and master thesis started. 571.77s - 573.77s | So it's just a meme. 576.77s - 579.77s | So let's have a look at the low-level communication at first. 583.30s - 588.30s | Low-level communication in the charging process is also called basic signaling 588.30s - 604.16s | and it offers basic control of the charging process between the EV and EVSE. 605.16s - 612.16s | The EV controls the voltage value by adding or removing the resistors in the pilot signal 612.16s - 618.16s | and based on the measured voltage, the EVSE can recognize the EV's state. 620.16s - 625.16s | The most important is the state B and state C, as you


chunk_text:
at the charging flow, its high-level overview. 541.50s - 549.50s | So first, the user plugs the CCS connector to his car and then the low-level communication starts. 550.50s - 555.50s | If the EV is in the state B and the signal has the 5% duty cycle, 555.50s - 561.50s | it can change to the high-level communication and during the high-level communication, 561.50s - 564.50s | they are exchanged to digital information about the charging. 565.50s - 571.77s | And that's how my journey and master thesis started. 571.77s - 573.77s | So it's just a meme. 576.77s - 579.77s | So let's have a look at the low-level communication at first. 583.30s - 588.30s | Low-level communication in the charging process is also called basic signaling 588.30s - 604.16s | and it offers basic control of the charging process between the EV and EVSE. 605.16s - 612.16s | The EV controls the voltage value by adding or removing the resistors in the pilot signal 612.16s - 618.16s | and based on the measured voltage, the EVSE can recognize the EV's state. 620.16s - 625.16s | The most important is the state B and state C, as you can see in the table. 628.21s - 633.21s | Depending on the given state resulting from the measured voltage value, 633.21s - 639.21s | the EVSE generates a pulsed modulation signal with a specific duty cycle. 647.09s - 651.09s | The duty cycle value is controlled by the charging station and measured in the vehicle. 652.09s - 656.09s | And the simplified outcome from the low-level communication is that 656.09s - 662.09s | the state B means that EV is connected but not charging 662.09s - 666.09s | and the state C is EV is connected and ready for charge. 666.09s - 671.09s | And as I said, 5% duty cycle affords the high-level communication. 674.09s - 678.09s | So as you could see, the low-level communication is not so interesting 678.09s - 684.09s | from the cybersecurity perspective because it only involves physical signaling. 685.09s - 689.09s | However, low-level communication is important in the sense that 689.09s - 694.09s | it enforces high-level communication for the specific state and the duty cycle. 695.09s - 698.09s | So let's explore the high-level communication. 699.09s - 702.09s | First of all, why do we need the high-level communication? 702.09s -


chunk_text:
can see in the table. 628.21s - 633.21s | Depending on the given state resulting from the measured voltage value, 633.21s - 639.21s | the EVSE generates a pulsed modulation signal with a specific duty cycle. 647.09s - 651.09s | The duty cycle value is controlled by the charging station and measured in the vehicle. 652.09s - 656.09s | And the simplified outcome from the low-level communication is that 656.09s - 662.09s | the state B means that EV is connected but not charging 662.09s - 666.09s | and the state C is EV is connected and ready for charge. 666.09s - 671.09s | And as I said, 5% duty cycle affords the high-level communication. 674.09s - 678.09s | So as you could see, the low-level communication is not so interesting 678.09s - 684.09s | from the cybersecurity perspective because it only involves physical signaling. 685.09s - 689.09s | However, low-level communication is important in the sense that 689.09s - 694.09s | it enforces high-level communication for the specific state and the duty cycle. 695.09s - 698.09s | So let's explore the high-level communication. 699.09s - 702.09s | First of all, why do we need the high-level communication? 702.09s - 705.09s | Why the low-level communication is not sufficient enough? 706.09s - 711.09s | In the beginning, EV charging relied on the basic signaling methods only, 711.09s - 715.09s | which are sufficient for simple on-off commands to start or stop. 716.09s - 721.09s | But after some time, with the growing number of the electric vehicles 721.09s - 725.09s | and the complexity of our energy ecosystem, 725.09s - 730.09s | this basic form of the communication is no longer sufficient. 731.09s - 735.09s | High-level communication provides the optimized charging process. 735.09s - 742.77s | As we already described before, the precondition for high-level communication 742.77s - 746.77s | is the low-level communication with specific state and the duty cycle 746.77s - 752.77s | and the high-level communication is only applicable for charging modes 3 and 4. 753.77s - 758.77s | And the high-level communication is mandatory for the mode 4, which is the DC charging, 759.77s - 763.77s | because there is a need to exchange some additional information 763.77s - 765.77s | to avoid the damage to the battery. 766.77s - 775.62s | The ISO 15118 defines all the high-level communication 776.62s - 779.62s | and


chunk_text:
705.09s | Why the low-level communication is not sufficient enough? 706.09s - 711.09s | In the beginning, EV charging relied on the basic signaling methods only, 711.09s - 715.09s | which are sufficient for simple on-off commands to start or stop. 716.09s - 721.09s | But after some time, with the growing number of the electric vehicles 721.09s - 725.09s | and the complexity of our energy ecosystem, 725.09s - 730.09s | this basic form of the communication is no longer sufficient. 731.09s - 735.09s | High-level communication provides the optimized charging process. 735.09s - 742.77s | As we already described before, the precondition for high-level communication 742.77s - 746.77s | is the low-level communication with specific state and the duty cycle 746.77s - 752.77s | and the high-level communication is only applicable for charging modes 3 and 4. 753.77s - 758.77s | And the high-level communication is mandatory for the mode 4, which is the DC charging, 759.77s - 763.77s | because there is a need to exchange some additional information 763.77s - 765.77s | to avoid the damage to the battery. 766.77s - 775.62s | The ISO 15118 defines all the high-level communication 776.62s - 779.62s | and the full name is Vehicle-to-Grid Communication Interface. 780.62s - 783.62s | And the part Vehicle-to-Grid has an acronym V2G. 784.62s - 787.62s | That's the reason why we named our tool V2GEvil, 787.62s - 791.62s | because it stands for the evaluation of the V2G communication. 792.62s - 800.57s | There is the comparison of the ISO and the IEC. 801.57s - 805.57s | As you can see, the ISO implements all of the OSI layers 806.57s - 810.57s | and the new protocol is V2G Transfer Protocol, 811.57s - 814.57s | which I will explain in the following slides. 816.57s - 824.57s | We are aiming from the third network layer and above up to the application layer. 828.57s - 833.57s | The high-level communication is more complex, so there is bigger space for mistakes 833.57s - 835.57s | and we are aiming for this. 837.57s - 840.57s | Here you can see the V2G communication flow, 840.57s - 844.57s | which is basically changing from one state to another 844.57s - 848.57s | and there is also exchange of the V2G messages. 851.26s - 856.26s | And after this is done, the charging is completed. 857.26s - 860.26s


chunk_text:
the full name is Vehicle-to-Grid Communication Interface. 780.62s - 783.62s | And the part Vehicle-to-Grid has an acronym V2G. 784.62s - 787.62s | That's the reason why we named our tool V2GEvil, 787.62s - 791.62s | because it stands for the evaluation of the V2G communication. 792.62s - 800.57s | There is the comparison of the ISO and the IEC. 801.57s - 805.57s | As you can see, the ISO implements all of the OSI layers 806.57s - 810.57s | and the new protocol is V2G Transfer Protocol, 811.57s - 814.57s | which I will explain in the following slides. 816.57s - 824.57s | We are aiming from the third network layer and above up to the application layer. 828.57s - 833.57s | The high-level communication is more complex, so there is bigger space for mistakes 833.57s - 835.57s | and we are aiming for this. 837.57s - 840.57s | Here you can see the V2G communication flow, 840.57s - 844.57s | which is basically changing from one state to another 844.57s - 848.57s | and there is also exchange of the V2G messages. 851.26s - 856.26s | And after this is done, the charging is completed. 857.26s - 860.26s | Here you can see the V2G message, the header, 861.26s - 863.26s | the structure of the V2G message. 864.26s - 868.26s | I have to be really fast, because we have only a few minutes. 870.26s - 872.26s | This is the structure of the header. 873.26s - 876.26s | We have a different payload type, as you can see on the slide. 877.26s - 881.26s | The first of the V2G messages is the SDP request. 882.26s - 886.26s | There is some exchange for the Security and Transfer Protocol for this. 887.26s - 889.26s | We have also the structure of the SDP request. 890.26s - 894.26s | Then the station will respond with the SDP response 895.26s - 901.26s | with the information of IP address and the port for the communication over TCP protocol. 903.26s - 905.26s | And then the V2G communication can start. 906.26s - 910.86s | Here you can see the V2G message structure. 911.86s - 915.69s | It is divided into two different types. 916.69s - 924.69s | And the concept that we are aiming is to cause some issues in this part, 925.69s - 927.69s | which is the


chunk_text:
| Here you can see the V2G message, the header, 861.26s - 863.26s | the structure of the V2G message. 864.26s - 868.26s | I have to be really fast, because we have only a few minutes. 870.26s - 872.26s | This is the structure of the header. 873.26s - 876.26s | We have a different payload type, as you can see on the slide. 877.26s - 881.26s | The first of the V2G messages is the SDP request. 882.26s - 886.26s | There is some exchange for the Security and Transfer Protocol for this. 887.26s - 889.26s | We have also the structure of the SDP request. 890.26s - 894.26s | Then the station will respond with the SDP response 895.26s - 901.26s | with the information of IP address and the port for the communication over TCP protocol. 903.26s - 905.26s | And then the V2G communication can start. 906.26s - 910.86s | Here you can see the V2G message structure. 911.86s - 915.69s | It is divided into two different types. 916.69s - 924.69s | And the concept that we are aiming is to cause some issues in this part, 925.69s - 927.69s | which is the decoding from EXI to XML 928.69s - 935.69s | and also to this part, which is from this content and structure to the data structures. 937.69s - 946.50s | Here you can see just a simple representation of the message in XML format, 946.50s - 949.50s | which is later encoded to EXI. 953.50s - 956.50s | I think we have to skip this. 959.94s - 962.94s | Some words about the testing environment, 963.94s - 966.94s | because we need some specified testing environment 967.94s - 971.94s | where we use the DLAN Green PHY eval board and the DLAN Green PHY module. 972.94s - 975.94s | Basically, it has PLC support and PLC to Ethernet bridging support, 975.94s - 978.94s | which helps us with everything that was described in theory before. 979.94s - 983.94s | And we use this QCA 7000 Green PHY firmware, 984.94s - 989.94s | which allows us to configure a module as an EMOB charger or EMOB vehicle. 990.94s - 994.94s | So we potentially have the ability to act both as a charger and a vehicle. 995.94s - 999.94s | And it has implicit support for the Slack, EVSC and the ACCC


chunk_text:
decoding from EXI to XML 928.69s - 935.69s | and also to this part, which is from this content and structure to the data structures. 937.69s - 946.50s | Here you can see just a simple representation of the message in XML format, 946.50s - 949.50s | which is later encoded to EXI. 953.50s - 956.50s | I think we have to skip this. 959.94s - 962.94s | Some words about the testing environment, 963.94s - 966.94s | because we need some specified testing environment 967.94s - 971.94s | where we use the DLAN Green PHY eval board and the DLAN Green PHY module. 972.94s - 975.94s | Basically, it has PLC support and PLC to Ethernet bridging support, 975.94s - 978.94s | which helps us with everything that was described in theory before. 979.94s - 983.94s | And we use this QCA 7000 Green PHY firmware, 984.94s - 989.94s | which allows us to configure a module as an EMOB charger or EMOB vehicle. 990.94s - 994.94s | So we potentially have the ability to act both as a charger and a vehicle. 995.94s - 999.94s | And it has implicit support for the Slack, EVSC and the ACCC side, 1000.94s - 1002.94s | so the charger and the vehicle in this case. 1002.94s - 1005.94s | Here we have a sort of our complete development setup, 1006.94s - 1011.94s | where one board acts as the vehicle and one as the charger or the EVSC. 1012.94s - 1015.94s | And there are several ways that we can perform the PLC communication as you see, 1016.94s - 1020.94s | but we chose to use a coax cable as it will also be more appropriate 1021.94s - 1025.94s | for using the real world scenario to avoid interferences from other cables. 1026.94s - 1028.94s | And to conclude, you will be surprised if I tell you that 1028.94s - 1032.94s | many of the cheap Chinese controllers for Ethernet over power line 1033.94s - 1035.94s | use the same exact Qualcomm chip that we are also using. 1036.94s - 1039.94s | And if you are in one tight budget, let's say in most cases, 1040.94s - 1043.94s | you can reflash this chip with the appropriate firmware 1044.94s - 1046.94s | and run our tool with a budget of around 20 euros 1047.94s - 1050.94s | comparing to a couple


chunk_text:
side, 1000.94s - 1002.94s | so the charger and the vehicle in this case. 1002.94s - 1005.94s | Here we have a sort of our complete development setup, 1006.94s - 1011.94s | where one board acts as the vehicle and one as the charger or the EVSC. 1012.94s - 1015.94s | And there are several ways that we can perform the PLC communication as you see, 1016.94s - 1020.94s | but we chose to use a coax cable as it will also be more appropriate 1021.94s - 1025.94s | for using the real world scenario to avoid interferences from other cables. 1026.94s - 1028.94s | And to conclude, you will be surprised if I tell you that 1028.94s - 1032.94s | many of the cheap Chinese controllers for Ethernet over power line 1033.94s - 1035.94s | use the same exact Qualcomm chip that we are also using. 1036.94s - 1039.94s | And if you are in one tight budget, let's say in most cases, 1040.94s - 1043.94s | you can reflash this chip with the appropriate firmware 1044.94s - 1046.94s | and run our tool with a budget of around 20 euros 1047.94s - 1050.94s | comparing to a couple of hundred euros on the boards that I showed you before. 1051.94s - 1054.94s | And as always, we're referring to the first two layers. 1055.94s - 1057.94s | For the rest of the layers, we used as a reference 1058.94s - 1061.94s | the joint operating system for EV chargers. 1062.94s - 1066.94s | In the start, we used both for the EVSC and the SECC parts 1067.94s - 1069.94s | in order to properly implement all the parts of the communication. 1070.94s - 1073.94s | But later on, we developed our own malicious SECC part 1074.94s - 1078.94s | to test against the Joseph EVSC reference implementation. 1080.94s - 1083.94s | And yeah, now let's go to our tool. 1084.94s - 1088.94s | So here you can see the architecture of our tool, 1089.94s - 1091.94s | and it's modular, so you have different modules. 1092.94s - 1096.94s | And we will explain the most important modules in the next slides. 1097.94s - 1101.94s | So first of all, we have the implementation of V2G transfer protocol, 1102.94s - 1106.94s | which is basically the module V2GTP 1107.94s - 1110.94s | is basically the implementation of that transfer


chunk_text:
of hundred euros on the boards that I showed you before. 1051.94s - 1054.94s | And as always, we're referring to the first two layers. 1055.94s - 1057.94s | For the rest of the layers, we used as a reference 1058.94s - 1061.94s | the joint operating system for EV chargers. 1062.94s - 1066.94s | In the start, we used both for the EVSC and the SECC parts 1067.94s - 1069.94s | in order to properly implement all the parts of the communication. 1070.94s - 1073.94s | But later on, we developed our own malicious SECC part 1074.94s - 1078.94s | to test against the Joseph EVSC reference implementation. 1080.94s - 1083.94s | And yeah, now let's go to our tool. 1084.94s - 1088.94s | So here you can see the architecture of our tool, 1089.94s - 1091.94s | and it's modular, so you have different modules. 1092.94s - 1096.94s | And we will explain the most important modules in the next slides. 1097.94s - 1101.94s | So first of all, we have the implementation of V2G transfer protocol, 1102.94s - 1106.94s | which is basically the module V2GTP 1107.94s - 1110.94s | is basically the implementation of that transfer protocol. 1110.94s - 1115.94s | So this module is responsible for the V2G packet parsing, 1116.94s - 1118.94s | decoding, and creating V2GTP packets. 1119.94s - 1122.94s | And the next module is the sniffer. 1123.94s - 1125.94s | The initial reason for developing the sniffer was 1126.94s - 1132.94s | to capture the V2G communication between the EV and EVSC 1133.94s - 1136.94s | and verify the correctness of our implementation 1137.94s - 1139.94s | of the V2G transfer protocol. 1141.94s - 1144.94s | So let's take a look at the demo. 1149.98s - 1154.98s | So first of all, we start the station reference implementation, 1155.98s - 1159.45s | which is waiting for connection. 1160.45s - 1164.45s | Then we start our sniffer module with option V2GTP, 1165.45s - 1172.45s | which decodes the TCP raw data to V2G transfer protocol packet. 1173.45s - 1176.45s | Then we start the EVCC module, 1177.45s - 1179.45s | which is connecting, like the car is connecting to the station, 1180.45s - 1183.45s | and then you can see the message exchange. 1184.45s - 1188.45s | And this is the output of the sniffer module 1189.45s - 1193.45s | that you


chunk_text:
protocol. 1110.94s - 1115.94s | So this module is responsible for the V2G packet parsing, 1116.94s - 1118.94s | decoding, and creating V2GTP packets. 1119.94s - 1122.94s | And the next module is the sniffer. 1123.94s - 1125.94s | The initial reason for developing the sniffer was 1126.94s - 1132.94s | to capture the V2G communication between the EV and EVSC 1133.94s - 1136.94s | and verify the correctness of our implementation 1137.94s - 1139.94s | of the V2G transfer protocol. 1141.94s - 1144.94s | So let's take a look at the demo. 1149.98s - 1154.98s | So first of all, we start the station reference implementation, 1155.98s - 1159.45s | which is waiting for connection. 1160.45s - 1164.45s | Then we start our sniffer module with option V2GTP, 1165.45s - 1172.45s | which decodes the TCP raw data to V2G transfer protocol packet. 1173.45s - 1176.45s | Then we start the EVCC module, 1177.45s - 1179.45s | which is connecting, like the car is connecting to the station, 1180.45s - 1183.45s | and then you can see the message exchange. 1184.45s - 1188.45s | And this is the output of the sniffer module 1189.45s - 1193.45s | that you can see that there's the V2GTP header and V2GTP payload. 1194.45s - 1196.45s | These are the SDP requests and the response. 1197.45s - 1203.89s | The next slide, you can also see that our sniffer module 1204.89s - 1207.89s | can also decode the EXI data, which are this payload 1208.89s - 1213.89s | that it's decoded to the XML document. 1214.89s - 1217.89s | The next two modules are the messages and the station. 1218.89s - 1220.89s | Messages are responsible for creating the messages 1221.89s - 1224.89s | and the conversion between the EXI and XML. 1224.89s - 1229.89s | And the station module is our implementation of the SECC, 1230.89s - 1234.89s | which is the Supply Equipment Communication Controller. 1235.89s - 1239.89s | And the station module is the core for the security modules. 1242.84s - 1246.84s | Let's start with the modules that are dedicated to the security testing. 1247.84s - 1249.84s | First of all, we have the enumerator module, 1250.84s - 1252.84s | which can help to enumerate the EV. 1253.84s - 1255.84s | For example, if the TLS is required or not, 1256.84s - 1257.84s | what is the TLS version?


chunk_text:
can see that there's the V2GTP header and V2GTP payload. 1194.45s - 1196.45s | These are the SDP requests and the response. 1197.45s - 1203.89s | The next slide, you can also see that our sniffer module 1204.89s - 1207.89s | can also decode the EXI data, which are this payload 1208.89s - 1213.89s | that it's decoded to the XML document. 1214.89s - 1217.89s | The next two modules are the messages and the station. 1218.89s - 1220.89s | Messages are responsible for creating the messages 1221.89s - 1224.89s | and the conversion between the EXI and XML. 1224.89s - 1229.89s | And the station module is our implementation of the SECC, 1230.89s - 1234.89s | which is the Supply Equipment Communication Controller. 1235.89s - 1239.89s | And the station module is the core for the security modules. 1242.84s - 1246.84s | Let's start with the modules that are dedicated to the security testing. 1247.84s - 1249.84s | First of all, we have the enumerator module, 1250.84s - 1252.84s | which can help to enumerate the EV. 1253.84s - 1255.84s | For example, if the TLS is required or not, 1256.84s - 1257.84s | what is the TLS version? 1258.84s - 1260.84s | What are the supported cipher suites? 1261.84s - 1266.84s | And what is the application protocol required by the EV? 1267.84s - 1269.84s | So here you can see the demo 1270.84s - 1273.84s | that we start our station in enumerate mode. 1274.84s - 1276.84s | We enumerate all of the possible information. 1277.84s - 1280.84s | Then we start the EVCC to connect to our station. 1280.84s - 1286.84s | And then you can see the outcome of the enumerator. 1287.84s - 1288.84s | Here you can see the result. 1289.84s - 1291.84s | As I said, you can see the supported protocols, 1292.84s - 1295.84s | the TLS version and ciphers. 1298.28s - 1300.28s | And the last module is the FASER module, 1301.28s - 1303.28s | which is the most important module for the security testing. 1304.28s - 1305.28s | And using the FASER module, 1306.28s - 1308.28s | we can test the resilience of the EV 1308.28s - 1312.28s | to the invalid or malformed parameter values 1313.28s - 1315.28s | in the V2G response messages. 1316.28s - 1320.28s | So basically the FASER is sending malicious and invalid values 1321.28s


chunk_text:
1258.84s - 1260.84s | What are the supported cipher suites? 1261.84s - 1266.84s | And what is the application protocol required by the EV? 1267.84s - 1269.84s | So here you can see the demo 1270.84s - 1273.84s | that we start our station in enumerate mode. 1274.84s - 1276.84s | We enumerate all of the possible information. 1277.84s - 1280.84s | Then we start the EVCC to connect to our station. 1280.84s - 1286.84s | And then you can see the outcome of the enumerator. 1287.84s - 1288.84s | Here you can see the result. 1289.84s - 1291.84s | As I said, you can see the supported protocols, 1292.84s - 1295.84s | the TLS version and ciphers. 1298.28s - 1300.28s | And the last module is the FASER module, 1301.28s - 1303.28s | which is the most important module for the security testing. 1304.28s - 1305.28s | And using the FASER module, 1306.28s - 1308.28s | we can test the resilience of the EV 1308.28s - 1312.28s | to the invalid or malformed parameter values 1313.28s - 1315.28s | in the V2G response messages. 1316.28s - 1320.28s | So basically the FASER is sending malicious and invalid values 1321.28s - 1324.28s | for the parameters and it aims to 1325.28s - 1328.28s | the process of decoding the EXI to XML. 1329.28s - 1330.28s | So let's have a look at the demo. 1331.28s - 1340.06s | We start the FASER and waiting again for the EVCC to connect. 1341.06s - 1347.06s | And after the EVCC connects, there is some message exchange 1348.06s - 1351.06s | and in some of the messages we supply the invalid data. 1352.06s - 1355.06s | And here you can see the invalid data of some parameters. 1356.06s - 1360.06s | And the result is that we can cause some errors on the EVCC side. 1361.06s - 1364.06s | The FASER module also can FAS only one message 1364.06s - 1370.06s | and the result is that we can cause some decoding error 1371.06s - 1374.06s | in the unmarshal binary, 1375.06s - 1377.06s | which has some handful unmarshal method 1378.06s - 1380.06s | that reads a source of the XML data 1381.06s - 1384.06s | and binds its values to a new instance of Java object. 1385.06s - 1386.06s | And as we know from some articles, 1387.06s - 1392.06s |


chunk_text:
- 1324.28s | for the parameters and it aims to 1325.28s - 1328.28s | the process of decoding the EXI to XML. 1329.28s - 1330.28s | So let's have a look at the demo. 1331.28s - 1340.06s | We start the FASER and waiting again for the EVCC to connect. 1341.06s - 1347.06s | And after the EVCC connects, there is some message exchange 1348.06s - 1351.06s | and in some of the messages we supply the invalid data. 1352.06s - 1355.06s | And here you can see the invalid data of some parameters. 1356.06s - 1360.06s | And the result is that we can cause some errors on the EVCC side. 1361.06s - 1364.06s | The FASER module also can FAS only one message 1364.06s - 1370.06s | and the result is that we can cause some decoding error 1371.06s - 1374.06s | in the unmarshal binary, 1375.06s - 1377.06s | which has some handful unmarshal method 1378.06s - 1380.06s | that reads a source of the XML data 1381.06s - 1384.06s | and binds its values to a new instance of Java object. 1385.06s - 1386.06s | And as we know from some articles, 1387.06s - 1392.06s | the unmarshal can be vulnerable to XML external entity injection attacks. 1392.06s - 1398.06s | So there is the space to implement the exploitation modules 1399.06s - 1402.06s | and exploit this further. 1403.06s - 1407.94s | So let's finish. 1408.94s - 1411.94s | Basically, there are a lot of enhancements that we can do on the tool. 1412.94s - 1413.94s | We will not go through them. We don't have time. 1414.94s - 1417.94s | But to conclude, communication in electric vehicles 1418.94s - 1420.94s | has assumed potential from our point of view 1421.94s - 1422.94s | with bigger needs in the future, more sensitive data. 1423.94s - 1427.94s | Will start to flow and subsequently passed by EVs and EVSCs. 1428.94s - 1430.94s | And there are no open source tools available 1431.94s - 1432.94s | to cover this emerging attack vectors. 1433.94s - 1435.94s | That's why we build this and we hope that you will start using it 1436.94s - 1439.94s | and you will start getting to research vehicles in this way 1440.94s - 1441.94s | that it's uncovered till now. 1442.94s - 1444.94s | We want our tool to act as an easy


chunk_text:
the unmarshal can be vulnerable to XML external entity injection attacks. 1392.06s - 1398.06s | So there is the space to implement the exploitation modules 1399.06s - 1402.06s | and exploit this further. 1403.06s - 1407.94s | So let's finish. 1408.94s - 1411.94s | Basically, there are a lot of enhancements that we can do on the tool. 1412.94s - 1413.94s | We will not go through them. We don't have time. 1414.94s - 1417.94s | But to conclude, communication in electric vehicles 1418.94s - 1420.94s | has assumed potential from our point of view 1421.94s - 1422.94s | with bigger needs in the future, more sensitive data. 1423.94s - 1427.94s | Will start to flow and subsequently passed by EVs and EVSCs. 1428.94s - 1430.94s | And there are no open source tools available 1431.94s - 1432.94s | to cover this emerging attack vectors. 1433.94s - 1435.94s | That's why we build this and we hope that you will start using it 1436.94s - 1439.94s | and you will start getting to research vehicles in this way 1440.94s - 1441.94s | that it's uncovered till now. 1442.94s - 1444.94s | We want our tool to act as an easy way for people to get introduced 1445.94s - 1447.94s | and start researching both EVs and chargers 1448.94s - 1450.94s | in an efficient and modular way. 1450.94s - 1454.94s | Thank you and our tool will be released after DEF CON 32.


chunk_text:
way for people to get introduced 1445.94s - 1447.94s | and start researching both EVs and chargers 1448.94s - 1450.94s | in an efficient and modular way. 1450.94s - 1454.94s | Thank you and our tool will be released after DEF CON 32.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=Utz4o7CJmAU", "title": "DEF CON 32 - War Games Red Team for OT Based on Real World Case Studies- Shishir Gupta", "description": "In this talk, Shishir will share some critical insights from performing a decade worth of Red Team (attack simulation) exercises for large-scale industrial operations across the globe.\n\nThe presentation will also cover real-world examples of attack vectors leveraged by Google's Mandiant Red Team while performing offensive security exercises for operational technology and control system environments.\n\nThis talk will cover:\n\nInsights into common TTPs and attack vectors for large-scale industrial networks\nNetwork propagation and mission execution across ICS-OT attack life-cycle\nExamples from real-world case studies of penetrating cyber-physical systems", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1388, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.00s | This text was transcribed using whisper model: large-v2 Hi, everyone. It's really hard to see everyone with this slide. 7.00s - 10.00s | So if you cannot hear me, just shout out, and I'll try to 10.00s - 14.00s | adjust the microphone. Can everybody hear me? 14.00s - 17.00s | Good afternoon, everyone. My name is Shishir, and I'm 17.00s - 20.00s | here to talk about red team and attack vectors for 20.00s - 23.00s | operation technology. My objective here is to go 23.00s - 26.00s | beyond the hypothetical, and I'm here to talk about red 26.00s - 30.00s | team and attack vectors or real-world examples for some 30.00s - 33.00s | of our red team exercises for critical infrastructure. 33.00s - 35.00s | However, before I start, a quick disclaimer. 35.00s - 38.00s | Even though everything that I present here is based on 38.00s - 41.00s | real-world case studies, the content itself is highly 41.00s - 46.00s | redacted to remove any and all identifying information. 46.00s - 48.00s | Now, we're not here to talk about it myself, but it's 48.00s - 50.00s | still customary to do a quick introduction. 50.00s - 52.00s | My name is Shishir. I'm a technical manager at 52.00s - 55.00s | Mandiant slash Google. I'm part of a dedicated team 55.00s - 58.00s | at Mandiant that specializes in security services for 58.00s - 61.00s | operational technology and control systems. 61.00s - 65.00s | Personally, I've had more than 12 years of experience 65.00s - 68.00s | performing offensive security work for industrial control 68.00s - 71.00s | and cyber-physical systems, and


chunk_text:
technology. My objective here is to go 23.00s - 26.00s | beyond the hypothetical, and I'm here to talk about red 26.00s - 30.00s | team and attack vectors or real-world examples for some 30.00s - 33.00s | of our red team exercises for critical infrastructure. 33.00s - 35.00s | However, before I start, a quick disclaimer. 35.00s - 38.00s | Even though everything that I present here is based on 38.00s - 41.00s | real-world case studies, the content itself is highly 41.00s - 46.00s | redacted to remove any and all identifying information. 46.00s - 48.00s | Now, we're not here to talk about it myself, but it's 48.00s - 50.00s | still customary to do a quick introduction. 50.00s - 52.00s | My name is Shishir. I'm a technical manager at 52.00s - 55.00s | Mandiant slash Google. I'm part of a dedicated team 55.00s - 58.00s | at Mandiant that specializes in security services for 58.00s - 61.00s | operational technology and control systems. 61.00s - 65.00s | Personally, I've had more than 12 years of experience 65.00s - 68.00s | performing offensive security work for industrial control 68.00s - 71.00s | and cyber-physical systems, and in that time, I have been 71.00s - 75.00s | fortunate to basically dabble with almost every critical 75.00s - 79.00s | infrastructure sector on the planet, including power, 79.00s - 83.00s | transport, rail, air traffic control, manufacturing, 83.00s - 87.00s | wastewater, telco, and even building management systems. 87.00s - 90.00s | Now, I believe everyone here would already understand 90.00s - 92.00s | what we mean by operational technology. 92.00s - 95.00s | That said, I still wanted to take a minute and remind 95.00s - 98.00s | that operational technology basically deals with systems 98.00s - 102.00s | and platforms that are used to control and automate 102.00s - 104.00s | industrial-scale physical processes. 104.00s - 107.00s | People often tend to silo OT into a specific sector 107.00s - 111.00s | or industry, but I'd like to remind that OT covers 111.00s - 114.00s | a wide range of infrastructure, and my talk here 114.00s - 116.00s | is industry-agnostic. 116.00s - 118.00s | I'll be covering examples from different verticals, 118.00s - 121.00s | including power, utilities, transportation, manufacturing, 121.00s - 126.27s | and even telecommunications. 126.27s - 129.27s | I would also like


chunk_text:
in that time, I have been 71.00s - 75.00s | fortunate to basically dabble with almost every critical 75.00s - 79.00s | infrastructure sector on the planet, including power, 79.00s - 83.00s | transport, rail, air traffic control, manufacturing, 83.00s - 87.00s | wastewater, telco, and even building management systems. 87.00s - 90.00s | Now, I believe everyone here would already understand 90.00s - 92.00s | what we mean by operational technology. 92.00s - 95.00s | That said, I still wanted to take a minute and remind 95.00s - 98.00s | that operational technology basically deals with systems 98.00s - 102.00s | and platforms that are used to control and automate 102.00s - 104.00s | industrial-scale physical processes. 104.00s - 107.00s | People often tend to silo OT into a specific sector 107.00s - 111.00s | or industry, but I'd like to remind that OT covers 111.00s - 114.00s | a wide range of infrastructure, and my talk here 114.00s - 116.00s | is industry-agnostic. 116.00s - 118.00s | I'll be covering examples from different verticals, 118.00s - 121.00s | including power, utilities, transportation, manufacturing, 121.00s - 126.27s | and even telecommunications. 126.27s - 129.27s | I would also like to call out that real-world attack 129.27s - 133.27s | simulations against industrial networks do not involve 133.27s - 137.27s | just HMIs or PLCs, but in fact, involve the entire 137.27s - 140.27s | ecosystem, ranging from the enterprise network that 140.27s - 143.27s | supports OT to level-one devices that control the 143.27s - 145.27s | physical processes in the field. 145.27s - 148.27s | One more disclaimer here, offensive security exercises, 148.27s - 150.27s | such as red teaming and penetration testing, 150.27s - 153.27s | essentially involve adversarial testing against 153.27s - 156.27s | cyber-physical systems that can pretty much blow and burn. 156.27s - 160.27s | Thus, any kind of offensive security testing for OT 160.27s - 163.27s | should only be performed by trained individuals 163.27s - 167.27s | after careful consideration of scenarios, hazards, 167.27s - 170.27s | risks, and pre-approved rules of control engagement. 170.27s - 173.78s | Now, before we move into the crux of this talk 173.78s - 176.78s | and talk about attack vectors and case studies for OT, 176.78s - 179.78s | I'd like to quickly touch upon one more topic, 179.78s - 182.78s | that is the


chunk_text:
to call out that real-world attack 129.27s - 133.27s | simulations against industrial networks do not involve 133.27s - 137.27s | just HMIs or PLCs, but in fact, involve the entire 137.27s - 140.27s | ecosystem, ranging from the enterprise network that 140.27s - 143.27s | supports OT to level-one devices that control the 143.27s - 145.27s | physical processes in the field. 145.27s - 148.27s | One more disclaimer here, offensive security exercises, 148.27s - 150.27s | such as red teaming and penetration testing, 150.27s - 153.27s | essentially involve adversarial testing against 153.27s - 156.27s | cyber-physical systems that can pretty much blow and burn. 156.27s - 160.27s | Thus, any kind of offensive security testing for OT 160.27s - 163.27s | should only be performed by trained individuals 163.27s - 167.27s | after careful consideration of scenarios, hazards, 167.27s - 170.27s | risks, and pre-approved rules of control engagement. 170.27s - 173.78s | Now, before we move into the crux of this talk 173.78s - 176.78s | and talk about attack vectors and case studies for OT, 176.78s - 179.78s | I'd like to quickly touch upon one more topic, 179.78s - 182.78s | that is the ICS OT attack life cycle. 182.78s - 186.78s | Most people in cyber are already aware of attack life cycles, 186.78s - 189.78s | but when we talk about hacking OT, people often tend 189.78s - 192.78s | to assume that we are talking about some cool exploit 192.78s - 195.78s | against an isolated ICS or a control system device, 195.78s - 198.78s | so I'd like to call out that there is a difference 198.78s - 200.78s | between hacking an individual control system 200.78s - 204.78s | and hacking a large-scale industrial OT operation. 204.78s - 208.78s | Real-world OT attacks are rarely single-step compromises, 208.78s - 211.78s | often involve a multi-step attack life cycle 211.78s - 213.78s | covering multiple phases. 213.78s - 217.78s | From an attacker's perspective, this typically translates 217.78s - 220.78s | to information gathering, perimeter breach, 220.78s - 222.78s | privilege escalation, internal reconnaissance, 222.78s - 226.78s | network propagation, and finally, a precise execution 226.78s - 230.78s | to achieve a predetermined objective in an OT environment. 230.78s - 233.78s | The basic idea here is to obtain prior information 233.78s - 234.78s | about the target system, 234.78s


chunk_text:
ICS OT attack life cycle. 182.78s - 186.78s | Most people in cyber are already aware of attack life cycles, 186.78s - 189.78s | but when we talk about hacking OT, people often tend 189.78s - 192.78s | to assume that we are talking about some cool exploit 192.78s - 195.78s | against an isolated ICS or a control system device, 195.78s - 198.78s | so I'd like to call out that there is a difference 198.78s - 200.78s | between hacking an individual control system 200.78s - 204.78s | and hacking a large-scale industrial OT operation. 204.78s - 208.78s | Real-world OT attacks are rarely single-step compromises, 208.78s - 211.78s | often involve a multi-step attack life cycle 211.78s - 213.78s | covering multiple phases. 213.78s - 217.78s | From an attacker's perspective, this typically translates 217.78s - 220.78s | to information gathering, perimeter breach, 220.78s - 222.78s | privilege escalation, internal reconnaissance, 222.78s - 226.78s | network propagation, and finally, a precise execution 226.78s - 230.78s | to achieve a predetermined objective in an OT environment. 230.78s - 233.78s | The basic idea here is to obtain prior information 233.78s - 234.78s | about the target system, 234.78s - 237.78s | breach the protected perimeter of the OT environment, 237.78s - 239.78s | remain undetected while operating 239.78s - 241.78s | within the target environment, 241.78s - 243.78s | and then finally launch a precise attack 243.78s - 245.78s | to achieve the target objective. 245.78s - 247.78s | Consequently, if you think about it 247.78s - 248.78s | from the defender's perspective, 248.78s - 250.78s | each phase of this attack life cycle presents 250.78s - 253.78s | an opportunity for detection and mitigation. 253.78s - 254.78s | Thus, it's important to understand 254.78s - 256.78s | the ICS OT attack life cycle, 256.78s - 258.78s | identify security issues before an attacker 258.78s - 260.78s | has a chance to exploit them, 260.78s - 263.78s | develop preventive or detective controls for known TTPs, 263.78s - 266.78s | and mitigate attack vectors across multiple phases 266.78s - 268.78s | of the attack life cycle. 268.78s - 269.78s | Now, I don't believe I have the time 269.78s - 271.78s | to go through each phase of the attack life cycle 271.78s - 272.78s | in the next 20 minutes, 272.78s - 273.78s | so for the


chunk_text:
- 237.78s | breach the protected perimeter of the OT environment, 237.78s - 239.78s | remain undetected while operating 239.78s - 241.78s | within the target environment, 241.78s - 243.78s | and then finally launch a precise attack 243.78s - 245.78s | to achieve the target objective. 245.78s - 247.78s | Consequently, if you think about it 247.78s - 248.78s | from the defender's perspective, 248.78s - 250.78s | each phase of this attack life cycle presents 250.78s - 253.78s | an opportunity for detection and mitigation. 253.78s - 254.78s | Thus, it's important to understand 254.78s - 256.78s | the ICS OT attack life cycle, 256.78s - 258.78s | identify security issues before an attacker 258.78s - 260.78s | has a chance to exploit them, 260.78s - 263.78s | develop preventive or detective controls for known TTPs, 263.78s - 266.78s | and mitigate attack vectors across multiple phases 266.78s - 268.78s | of the attack life cycle. 268.78s - 269.78s | Now, I don't believe I have the time 269.78s - 271.78s | to go through each phase of the attack life cycle 271.78s - 272.78s | in the next 20 minutes, 272.78s - 273.78s | so for the remaining session, 273.78s - 276.78s | I'd like to distill the life cycle into four key phases 276.78s - 279.78s | listed on the lower side of the slide here, 279.78s - 281.78s | and walk through some real world examples 281.78s - 284.78s | and case studies for common attack vectors 284.78s - 285.78s | across the four phases. 287.78s - 289.78s | The first phase I'd like to cover is initial compromise. 289.78s - 292.78s | As the name suggests, the objective of this phase 292.78s - 295.78s | is to gain an initial foothold in the target environment. 295.78s - 297.78s | In most real world scenarios, 297.78s - 300.78s | this typically translates to using a social engineering 300.78s - 301.78s | or spear phishing campaign 301.78s - 304.78s | to compromise the enterprise side of the organization. 304.78s - 307.78s | In fact, the majority of the red team exercises for OT 307.78s - 310.78s | that we perform begin with some form of attempt 310.78s - 312.78s | to gain access or foothold 312.78s - 314.78s | on the corporate side of the network. 314.78s - 317.78s | That said, the initial compromise phase


chunk_text:
remaining session, 273.78s - 276.78s | I'd like to distill the life cycle into four key phases 276.78s - 279.78s | listed on the lower side of the slide here, 279.78s - 281.78s | and walk through some real world examples 281.78s - 284.78s | and case studies for common attack vectors 284.78s - 285.78s | across the four phases. 287.78s - 289.78s | The first phase I'd like to cover is initial compromise. 289.78s - 292.78s | As the name suggests, the objective of this phase 292.78s - 295.78s | is to gain an initial foothold in the target environment. 295.78s - 297.78s | In most real world scenarios, 297.78s - 300.78s | this typically translates to using a social engineering 300.78s - 301.78s | or spear phishing campaign 301.78s - 304.78s | to compromise the enterprise side of the organization. 304.78s - 307.78s | In fact, the majority of the red team exercises for OT 307.78s - 310.78s | that we perform begin with some form of attempt 310.78s - 312.78s | to gain access or foothold 312.78s - 314.78s | on the corporate side of the network. 314.78s - 317.78s | That said, the initial compromise phase 317.78s - 320.78s | could also entail other more direct attack vectors 320.78s - 323.78s | to gain a direct foothold in the OT network. 323.78s - 326.78s | The list on the slide here lists some examples 326.78s - 328.78s | like direct connection to ICS on the internet, 328.78s - 330.78s | supply chain compromise, third party compromise, 330.78s - 333.78s | hardware implants, and last but not the least, 334.78s - 337.78s | physical or wireless access to OT systems in the field. 337.78s - 339.78s | Industrial environments often have 339.78s - 342.78s | a geographically dispersed field network, 342.78s - 344.78s | often connected using wireless networks 344.78s - 347.78s | and thus present a large attack surface for attackers 347.78s - 350.78s | to gain direct access to OT devices. 350.78s - 352.78s | The simplest example of such a system here 352.78s - 354.78s | would be residential smart meters 354.78s - 356.78s | in advanced metering infrastructure. 356.78s - 359.78s | So if an attacker, let's say, is able to gain 359.78s - 361.78s | or manipulate the communication traffic 361.78s - 363.78s | between the residential smart meter 363.78s - 365.78s


chunk_text:
317.78s - 320.78s | could also entail other more direct attack vectors 320.78s - 323.78s | to gain a direct foothold in the OT network. 323.78s - 326.78s | The list on the slide here lists some examples 326.78s - 328.78s | like direct connection to ICS on the internet, 328.78s - 330.78s | supply chain compromise, third party compromise, 330.78s - 333.78s | hardware implants, and last but not the least, 334.78s - 337.78s | physical or wireless access to OT systems in the field. 337.78s - 339.78s | Industrial environments often have 339.78s - 342.78s | a geographically dispersed field network, 342.78s - 344.78s | often connected using wireless networks 344.78s - 347.78s | and thus present a large attack surface for attackers 347.78s - 350.78s | to gain direct access to OT devices. 350.78s - 352.78s | The simplest example of such a system here 352.78s - 354.78s | would be residential smart meters 354.78s - 356.78s | in advanced metering infrastructure. 356.78s - 359.78s | So if an attacker, let's say, is able to gain 359.78s - 361.78s | or manipulate the communication traffic 361.78s - 363.78s | between the residential smart meter 363.78s - 365.78s | and a back-office collector, 365.78s - 367.78s | they could potentially use that as an entry point 367.78s - 370.78s | into the back-office, back-inherent system. 370.78s - 375.59s | The first example I have here 375.59s - 377.59s | is for a communication-based train control system. 377.59s - 380.59s | In a CVDC network, onboard ECUs in the train 380.59s - 382.59s | typically connect to the back-office network 382.59s - 384.59s | through radio-based communications 384.59s - 387.59s | such as wireless network or cellular network. 387.59s - 390.59s | In this specific case, we found that a CVDC radio network 390.59s - 392.59s | was implemented using a hidden 392.59s - 394.59s | but essentially open SSID, 394.59s - 396.59s | thus providing an unauthenticated access 396.59s - 399.59s | to the onboard embedded network on the trains. 399.59s - 401.59s | The right side of the screen here shows us 401.59s - 403.59s | using the open wireless network 403.59s - 405.59s | to connect to a VNC session 405.59s - 408.59s | on one of the operator displays in the local cab. 408.59s - 410.59s | Insecure wireless networks are probably 410.59s - 412.59s


chunk_text:
| and a back-office collector, 365.78s - 367.78s | they could potentially use that as an entry point 367.78s - 370.78s | into the back-office, back-inherent system. 370.78s - 375.59s | The first example I have here 375.59s - 377.59s | is for a communication-based train control system. 377.59s - 380.59s | In a CVDC network, onboard ECUs in the train 380.59s - 382.59s | typically connect to the back-office network 382.59s - 384.59s | through radio-based communications 384.59s - 387.59s | such as wireless network or cellular network. 387.59s - 390.59s | In this specific case, we found that a CVDC radio network 390.59s - 392.59s | was implemented using a hidden 392.59s - 394.59s | but essentially open SSID, 394.59s - 396.59s | thus providing an unauthenticated access 396.59s - 399.59s | to the onboard embedded network on the trains. 399.59s - 401.59s | The right side of the screen here shows us 401.59s - 403.59s | using the open wireless network 403.59s - 405.59s | to connect to a VNC session 405.59s - 408.59s | on one of the operator displays in the local cab. 408.59s - 410.59s | Insecure wireless networks are probably 410.59s - 412.59s | not as common as in the recent past, 412.59s - 415.59s | but we still find examples of unencrypted protocols 415.59s - 418.59s | or legacy encryption in older networks. 418.59s - 423.41s | The next example I have here 423.41s - 425.41s | is for an unprotected cellular network 425.41s - 427.41s | for a public transport operator. 427.41s - 429.41s | In this case, our team was able to use 429.41s - 431.41s | an arbitrary personal SIM 431.41s - 433.41s | to connect to the private APN 433.41s - 436.41s | for the field network and gain direct access 436.41s - 439.41s | to traffic monitoring cameras across the metropolitan region. 439.41s - 442.41s | To be clear, this is probably an exception and not the norm 442.41s - 446.41s | to have an unauthenticated private APN, 446.41s - 448.41s | but such was the case here, 448.41s - 450.41s | and it does show an interesting example 450.41s - 453.41s | of an initial entry point into an OT environment 453.41s - 457.41s | through an insecure cellular network. 457.41s - 460.41s | The last example I have here for initial foothold 460.41s - 465.41s


chunk_text:
| not as common as in the recent past, 412.59s - 415.59s | but we still find examples of unencrypted protocols 415.59s - 418.59s | or legacy encryption in older networks. 418.59s - 423.41s | The next example I have here 423.41s - 425.41s | is for an unprotected cellular network 425.41s - 427.41s | for a public transport operator. 427.41s - 429.41s | In this case, our team was able to use 429.41s - 431.41s | an arbitrary personal SIM 431.41s - 433.41s | to connect to the private APN 433.41s - 436.41s | for the field network and gain direct access 436.41s - 439.41s | to traffic monitoring cameras across the metropolitan region. 439.41s - 442.41s | To be clear, this is probably an exception and not the norm 442.41s - 446.41s | to have an unauthenticated private APN, 446.41s - 448.41s | but such was the case here, 448.41s - 450.41s | and it does show an interesting example 450.41s - 453.41s | of an initial entry point into an OT environment 453.41s - 457.41s | through an insecure cellular network. 457.41s - 460.41s | The last example I have here for initial foothold 460.41s - 465.41s | is an initial compromise point into a telco network. 465.41s - 468.41s | Modern telco networks are essentially IP-based 468.41s - 471.41s | and involve an IP-based tunnel between the mobile device 471.41s - 474.41s | and a gateway node in the core network. 474.41s - 476.41s | The gateway node forwards the traffic 476.41s - 478.41s | to the intended destination 478.41s - 480.41s | through a backbone network, 480.41s - 483.41s | and it's best practice to basically 483.41s - 485.41s | have the gateway node 485.41s - 487.41s | allow only access to the intended networks 487.41s - 489.41s | and block any or all attempts 489.41s - 492.41s | to access the private nodes in the operated network. 492.41s - 494.41s | However, in this case, we found 494.41s - 496.41s | that we were able to actually use a commercial 496.41s - 499.41s | off-the-shop SIM for the said operator 499.41s - 502.41s | to connect to the core nodes in the telco network. 502.41s - 504.41s | Long story short, we were able to compromise 504.41s - 507.41s | the core nodes, such as session border controller, 507.41s - 509.41s | and intercept


chunk_text:
| is an initial compromise point into a telco network. 465.41s - 468.41s | Modern telco networks are essentially IP-based 468.41s - 471.41s | and involve an IP-based tunnel between the mobile device 471.41s - 474.41s | and a gateway node in the core network. 474.41s - 476.41s | The gateway node forwards the traffic 476.41s - 478.41s | to the intended destination 478.41s - 480.41s | through a backbone network, 480.41s - 483.41s | and it's best practice to basically 483.41s - 485.41s | have the gateway node 485.41s - 487.41s | allow only access to the intended networks 487.41s - 489.41s | and block any or all attempts 489.41s - 492.41s | to access the private nodes in the operated network. 492.41s - 494.41s | However, in this case, we found 494.41s - 496.41s | that we were able to actually use a commercial 496.41s - 499.41s | off-the-shop SIM for the said operator 499.41s - 502.41s | to connect to the core nodes in the telco network. 502.41s - 504.41s | Long story short, we were able to compromise 504.41s - 507.41s | the core nodes, such as session border controller, 507.41s - 509.41s | and intercept user traffic, 509.41s - 512.41s | including SMS and voice call data. 512.41s - 514.41s | Now, I realize that it's probably not as obvious 514.41s - 515.41s | from a single screenshot here, 515.41s - 517.41s | but the picture here on the right-hand side 517.41s - 519.41s | shows us intercepting an SMS message 519.41s - 523.41s | from the traffic captured on an SPC controller. 523.41s - 525.41s | Think about using your personal mobile phone 525.41s - 528.41s | as an entry point into your telco operator's network 528.41s - 530.41s | and compromising lawful interception 530.41s - 532.41s | across the national network. 532.41s - 534.41s | To be clear, this is also very rare, 534.41s - 536.41s | but still, it does provide another interesting example 536.41s - 538.41s | of an initial entry point 538.41s - 542.41s | into what is essentially an operational network. 542.41s - 545.41s | The next phase I'd like to cover is internal reconnaissance. 545.41s - 547.41s | The objective of this phase 547.41s - 550.41s | is to leverage the foothold gained in the previous phase 550.41s - 553.41s | to extract specific information about the target


chunk_text:
user traffic, 509.41s - 512.41s | including SMS and voice call data. 512.41s - 514.41s | Now, I realize that it's probably not as obvious 514.41s - 515.41s | from a single screenshot here, 515.41s - 517.41s | but the picture here on the right-hand side 517.41s - 519.41s | shows us intercepting an SMS message 519.41s - 523.41s | from the traffic captured on an SPC controller. 523.41s - 525.41s | Think about using your personal mobile phone 525.41s - 528.41s | as an entry point into your telco operator's network 528.41s - 530.41s | and compromising lawful interception 530.41s - 532.41s | across the national network. 532.41s - 534.41s | To be clear, this is also very rare, 534.41s - 536.41s | but still, it does provide another interesting example 536.41s - 538.41s | of an initial entry point 538.41s - 542.41s | into what is essentially an operational network. 542.41s - 545.41s | The next phase I'd like to cover is internal reconnaissance. 545.41s - 547.41s | The objective of this phase 547.41s - 550.41s | is to leverage the foothold gained in the previous phase 550.41s - 553.41s | to extract specific information about the target system. 553.41s - 555.41s | This is especially relevant in the context 555.41s - 558.41s | of initial compromise in the enterprise IT environment. 558.41s - 560.41s | The enterprise network is important 560.41s - 564.41s | not only from the perspective of IT-OT network segmentation, 564.41s - 566.41s | but it is also important 566.41s - 568.41s | from the perspective of data segmentation. 568.41s - 571.41s | A typical enterprise network often hosts multiple sources 571.41s - 573.41s | that can provide an attacker 573.41s - 575.41s | with critical information about the target asset. 575.41s - 579.41s | Some examples on the slide here include documentation, 579.41s - 582.41s | department of file shares, email communications, 582.41s - 584.41s | development resources, management consoles, 584.41s - 587.41s | and even key logging and screen monitoring. 587.41s - 589.41s | Some examples of target information 589.41s - 592.41s | that an attacker would typically like to retrieve 592.41s - 593.41s | at this phase of the exercise 593.41s - 596.41s | include network diagrams, host names, IP addresses, 596.41s - 599.41s | process documentation, operator manuals, 599.41s - 603.41s | and even potentially plaintiff's credentials. 603.41s - 607.41s


chunk_text:
system. 553.41s - 555.41s | This is especially relevant in the context 555.41s - 558.41s | of initial compromise in the enterprise IT environment. 558.41s - 560.41s | The enterprise network is important 560.41s - 564.41s | not only from the perspective of IT-OT network segmentation, 564.41s - 566.41s | but it is also important 566.41s - 568.41s | from the perspective of data segmentation. 568.41s - 571.41s | A typical enterprise network often hosts multiple sources 571.41s - 573.41s | that can provide an attacker 573.41s - 575.41s | with critical information about the target asset. 575.41s - 579.41s | Some examples on the slide here include documentation, 579.41s - 582.41s | department of file shares, email communications, 582.41s - 584.41s | development resources, management consoles, 584.41s - 587.41s | and even key logging and screen monitoring. 587.41s - 589.41s | Some examples of target information 589.41s - 592.41s | that an attacker would typically like to retrieve 592.41s - 593.41s | at this phase of the exercise 593.41s - 596.41s | include network diagrams, host names, IP addresses, 596.41s - 599.41s | process documentation, operator manuals, 599.41s - 603.41s | and even potentially plaintiff's credentials. 603.41s - 607.41s | This is probably the most boring stage of an attack lifecycle 607.41s - 608.41s | from an attacker's perspective, 608.41s - 611.41s | but in my experience, an attacker will spend 611.41s - 614.41s | the maximum time operating within this stage 614.41s - 617.41s | because the more information that I can obtain at this stage, 617.41s - 619.41s | the higher my chances of success 619.41s - 623.41s | and precise execution in the subsequent stages. 623.41s - 625.41s | Internal reconnaissance often comes down 625.41s - 627.41s | to strategic targeting information sources 627.41s - 629.41s | and key employees that are responsible 629.41s - 633.41s | for the administration and maintenance of the OT environment. 633.41s - 636.41s | I realize that the screenshots here on the slide 636.41s - 637.41s | are highly redacted. 637.41s - 639.41s | However, they still provide a snippet 639.41s - 642.41s | of the kind of information that an attacker might target 642.41s - 644.41s | during internal reconnaissance phase. 644.41s - 647.41s | Firewall rules, operation guides, department shares, 647.41s - 649.41s | plaintiff's credentials, password managers, 649.41s - 652.41s | are all critical information that are


chunk_text:
| This is probably the most boring stage of an attack lifecycle 607.41s - 608.41s | from an attacker's perspective, 608.41s - 611.41s | but in my experience, an attacker will spend 611.41s - 614.41s | the maximum time operating within this stage 614.41s - 617.41s | because the more information that I can obtain at this stage, 617.41s - 619.41s | the higher my chances of success 619.41s - 623.41s | and precise execution in the subsequent stages. 623.41s - 625.41s | Internal reconnaissance often comes down 625.41s - 627.41s | to strategic targeting information sources 627.41s - 629.41s | and key employees that are responsible 629.41s - 633.41s | for the administration and maintenance of the OT environment. 633.41s - 636.41s | I realize that the screenshots here on the slide 636.41s - 637.41s | are highly redacted. 637.41s - 639.41s | However, they still provide a snippet 639.41s - 642.41s | of the kind of information that an attacker might target 642.41s - 644.41s | during internal reconnaissance phase. 644.41s - 647.41s | Firewall rules, operation guides, department shares, 647.41s - 649.41s | plaintiff's credentials, password managers, 649.41s - 652.41s | are all critical information that are typically hosted 652.41s - 654.41s | in the enterprise side of the environment 654.41s - 657.41s | but provide invaluable resources of information 657.41s - 659.41s | for attackers targeting OT networks. 659.41s - 661.41s | Now, from a defender's perspective, 661.41s - 663.41s | it is easy to underestimate the value 663.41s - 665.41s | of the information exfiltrated 665.41s - 667.41s | during this phase of the attack lifecycle, 667.41s - 669.41s | and security teams, in my opinion, 669.41s - 671.41s | often ignore the importance of this phase 671.41s - 674.41s | from a detection perspective. 674.41s - 677.41s | In fact, I would argue that this phase 677.41s - 680.41s | provides the maximum opportunity for detection. 680.41s - 683.41s | If I, as a defender, can flag indicators of compromise 683.41s - 686.41s | for internal reconnaissance in my enterprise environment, 686.41s - 688.41s | I could potentially detect an attacker 692.41s - 695.41s | before they even have a chance to reach the OT environment. 695.41s - 698.41s | Now, I'm not going to go into specific case studies 698.41s - 699.41s | for this phase. 699.41s - 701.41s | Almost every exercise


chunk_text:
typically hosted 652.41s - 654.41s | in the enterprise side of the environment 654.41s - 657.41s | but provide invaluable resources of information 657.41s - 659.41s | for attackers targeting OT networks. 659.41s - 661.41s | Now, from a defender's perspective, 661.41s - 663.41s | it is easy to underestimate the value 663.41s - 665.41s | of the information exfiltrated 665.41s - 667.41s | during this phase of the attack lifecycle, 667.41s - 669.41s | and security teams, in my opinion, 669.41s - 671.41s | often ignore the importance of this phase 671.41s - 674.41s | from a detection perspective. 674.41s - 677.41s | In fact, I would argue that this phase 677.41s - 680.41s | provides the maximum opportunity for detection. 680.41s - 683.41s | If I, as a defender, can flag indicators of compromise 683.41s - 686.41s | for internal reconnaissance in my enterprise environment, 686.41s - 688.41s | I could potentially detect an attacker 692.41s - 695.41s | before they even have a chance to reach the OT environment. 695.41s - 698.41s | Now, I'm not going to go into specific case studies 698.41s - 699.41s | for this phase. 699.41s - 701.41s | Almost every exercise that we perform 701.41s - 703.41s | involves some kind of internal reconnaissance, 703.41s - 705.41s | but I still wanted to cover some examples 705.41s - 708.41s | of target sources and information sources. 708.41s - 714.84s | Moving on, initial compromise in internal reconnaissance 714.84s - 716.84s | is often followed by network propagation. 716.84s - 718.84s | In the context of a typical attack lifecycle, 718.84s - 720.84s | this often translates to network propagation 720.84s - 723.84s | from an initial foothold in the IT network 723.84s - 725.84s | to the target system in the OT network. 725.84s - 728.84s | Now, I know that we all expect our OT systems 728.84s - 730.84s | to be completely isolated in air gap, 730.84s - 731.84s | using nothing but space. 731.84s - 734.84s | However, in practice, that is rarely the case 734.84s - 736.84s | for modern industrial environments. 736.84s - 739.84s | In an ideal world, I would probably love to see 739.84s - 742.84s | perfect segmentation using unidirectional gateways. 742.84s - 744.84s | However, the reality is that we still continue 744.84s - 748.84s | to find OT environments that lack


chunk_text:
that we perform 701.41s - 703.41s | involves some kind of internal reconnaissance, 703.41s - 705.41s | but I still wanted to cover some examples 705.41s - 708.41s | of target sources and information sources. 708.41s - 714.84s | Moving on, initial compromise in internal reconnaissance 714.84s - 716.84s | is often followed by network propagation. 716.84s - 718.84s | In the context of a typical attack lifecycle, 718.84s - 720.84s | this often translates to network propagation 720.84s - 723.84s | from an initial foothold in the IT network 723.84s - 725.84s | to the target system in the OT network. 725.84s - 728.84s | Now, I know that we all expect our OT systems 728.84s - 730.84s | to be completely isolated in air gap, 730.84s - 731.84s | using nothing but space. 731.84s - 734.84s | However, in practice, that is rarely the case 734.84s - 736.84s | for modern industrial environments. 736.84s - 739.84s | In an ideal world, I would probably love to see 739.84s - 742.84s | perfect segmentation using unidirectional gateways. 742.84s - 744.84s | However, the reality is that we still continue 744.84s - 748.84s | to find OT environments that lack basic segmentation. 748.84s - 750.84s | Now, there are probably a million different ways 750.84s - 752.84s | to hose up segmentation, but some common examples 752.84s - 755.84s | of insecure segmentation between IT and OT 755.84s - 757.84s | include lack of properly secure authentication 757.84s - 759.84s | for remote access, dual home servers 759.84s - 761.84s | with one leg in IT, one leg in OT, 761.84s - 763.84s | shared active directory domains 763.84s - 765.84s | or domain trust between IT and OT, 765.84s - 768.84s | and exploitable services in OT DMZ. 768.84s - 771.84s | That said, the most fundamental issue 771.84s - 773.84s | around IT-OT segmentation is the use 773.84s - 776.84s | of shared infrastructure and management platforms. 776.84s - 778.84s | A classic example of that would be 778.84s - 780.84s | a hypervisor server hosted in the IT environment, 780.84s - 783.84s | which hosts guest machines for OT network. 783.84s - 785.84s | So potentially, if I can compromise 785.84s - 787.84s | the hypervisor server in the IT environment 787.84s - 790.84s | using active credentials, I could pretty much gain access 790.84s - 792.84s


chunk_text:
basic segmentation. 748.84s - 750.84s | Now, there are probably a million different ways 750.84s - 752.84s | to hose up segmentation, but some common examples 752.84s - 755.84s | of insecure segmentation between IT and OT 755.84s - 757.84s | include lack of properly secure authentication 757.84s - 759.84s | for remote access, dual home servers 759.84s - 761.84s | with one leg in IT, one leg in OT, 761.84s - 763.84s | shared active directory domains 763.84s - 765.84s | or domain trust between IT and OT, 765.84s - 768.84s | and exploitable services in OT DMZ. 768.84s - 771.84s | That said, the most fundamental issue 771.84s - 773.84s | around IT-OT segmentation is the use 773.84s - 776.84s | of shared infrastructure and management platforms. 776.84s - 778.84s | A classic example of that would be 778.84s - 780.84s | a hypervisor server hosted in the IT environment, 780.84s - 783.84s | which hosts guest machines for OT network. 783.84s - 785.84s | So potentially, if I can compromise 785.84s - 787.84s | the hypervisor server in the IT environment 787.84s - 790.84s | using active credentials, I could pretty much gain access 790.84s - 792.84s | to the OT consoles, thus bypassing 792.84s - 794.84s | the firewall rules between IT and OT. 794.84s - 796.84s | Like I said, unfortunately, it is very common 796.84s - 798.84s | to find both physical and logical flaws 798.84s - 800.84s | in segmentation between IT and OT, 800.84s - 802.84s | and such issues can often be used 802.84s - 806.84s | to propagate from the IT network to the OT network. 810.84s - 812.84s | This slide here shows an example 812.84s - 814.84s | of installing a key logger 814.84s - 816.84s | on a compromised engineer desktop 816.84s - 819.84s | in the IT network to basically obtain 819.84s - 821.84s | the single-factor authentication credentials 821.84s - 823.84s | for a remote access point 823.84s - 825.84s | or a jump-host server in the OT network. 825.84s - 827.84s | The screenshot on the right-hand side here 827.84s - 831.84s | shows us basically connecting 831.84s - 833.84s | to a successful remote desktop connection 833.84s - 836.84s | to an HMI interface for a subway line 836.84s - 838.84s | or a subway over line. 838.84s - 845.94s | This is


chunk_text:
| to the OT consoles, thus bypassing 792.84s - 794.84s | the firewall rules between IT and OT. 794.84s - 796.84s | Like I said, unfortunately, it is very common 796.84s - 798.84s | to find both physical and logical flaws 798.84s - 800.84s | in segmentation between IT and OT, 800.84s - 802.84s | and such issues can often be used 802.84s - 806.84s | to propagate from the IT network to the OT network. 810.84s - 812.84s | This slide here shows an example 812.84s - 814.84s | of installing a key logger 814.84s - 816.84s | on a compromised engineer desktop 816.84s - 819.84s | in the IT network to basically obtain 819.84s - 821.84s | the single-factor authentication credentials 821.84s - 823.84s | for a remote access point 823.84s - 825.84s | or a jump-host server in the OT network. 825.84s - 827.84s | The screenshot on the right-hand side here 827.84s - 831.84s | shows us basically connecting 831.84s - 833.84s | to a successful remote desktop connection 833.84s - 836.84s | to an HMI interface for a subway line 836.84s - 838.84s | or a subway over line. 838.84s - 845.94s | This is another interesting example 845.94s - 848.94s | of compromising remote access credentials 848.94s - 849.94s | in the corporate network. 849.94s - 852.94s | However, this time, through direct compromise 852.94s - 854.94s | of an enterprise password manager 854.94s - 856.94s | or an enterprise password vault, 856.94s - 858.94s | which basically stored OT credentials. 858.94s - 860.94s | Enterprise password management systems 860.94s - 862.94s | often authenticate to a corporate domain, 862.94s - 864.94s | so if an attacker is able to compromise 864.94s - 866.94s | the password, say, for example, 866.94s - 869.94s | engineering teams, the attacker could gain 869.94s - 871.94s | credentials for remote access to OT systems. 871.94s - 873.94s | The screenshot on the right again here 873.94s - 876.94s | shows a successful remote desktop connection 876.94s - 878.94s | to an ITS server for a traffic control 878.94s - 880.94s | or a traffic light monitoring system. 880.94s - 885.02s | This slide here shows an example 886.02s - 888.02s | of a segmentation flaw, like I said, 888.02s - 891.02s | using domain trust between IT and OT. 891.02s - 894.02s | It is probably not


chunk_text:
another interesting example 845.94s - 848.94s | of compromising remote access credentials 848.94s - 849.94s | in the corporate network. 849.94s - 852.94s | However, this time, through direct compromise 852.94s - 854.94s | of an enterprise password manager 854.94s - 856.94s | or an enterprise password vault, 856.94s - 858.94s | which basically stored OT credentials. 858.94s - 860.94s | Enterprise password management systems 860.94s - 862.94s | often authenticate to a corporate domain, 862.94s - 864.94s | so if an attacker is able to compromise 864.94s - 866.94s | the password, say, for example, 866.94s - 869.94s | engineering teams, the attacker could gain 869.94s - 871.94s | credentials for remote access to OT systems. 871.94s - 873.94s | The screenshot on the right again here 873.94s - 876.94s | shows a successful remote desktop connection 876.94s - 878.94s | to an ITS server for a traffic control 878.94s - 880.94s | or a traffic light monitoring system. 880.94s - 885.02s | This slide here shows an example 886.02s - 888.02s | of a segmentation flaw, like I said, 888.02s - 891.02s | using domain trust between IT and OT. 891.02s - 894.02s | It is probably not as clear from the screenshot 894.02s - 897.02s | that I have on the slide here, 897.02s - 900.02s | but you will find that the IT domain here 900.02s - 903.02s | is actually superseded as the root domain 903.02s - 905.02s | for OT domains across multiple DCS. 905.02s - 908.02s | The end result is that my team was basically 908.02s - 910.02s | able to use compromised credentials 910.02s - 912.02s | in the root IT domain to gain access 912.02s - 914.02s | to child domains for multiple plants 914.02s - 917.02s | across the globe. 917.02s - 920.02s | Finally, this is a real world example 920.02s - 922.02s | of the issue of shared infrastructure 922.02s - 923.02s | between IT and OT. 923.02s - 926.02s | The virtualization platform on the left 926.02s - 929.02s | authenticates to an IT domain, 929.02s - 931.02s | but hosts guest machines for both 931.02s - 933.02s | IT and OT environments. 933.02s - 936.02s | Our team was able to gain administrative access 936.02s - 938.02s | to the hypervisor management interface 938.02s - 940.02s | using credentials compromised in the IT domain 940.02s


chunk_text:
as clear from the screenshot 894.02s - 897.02s | that I have on the slide here, 897.02s - 900.02s | but you will find that the IT domain here 900.02s - 903.02s | is actually superseded as the root domain 903.02s - 905.02s | for OT domains across multiple DCS. 905.02s - 908.02s | The end result is that my team was basically 908.02s - 910.02s | able to use compromised credentials 910.02s - 912.02s | in the root IT domain to gain access 912.02s - 914.02s | to child domains for multiple plants 914.02s - 917.02s | across the globe. 917.02s - 920.02s | Finally, this is a real world example 920.02s - 922.02s | of the issue of shared infrastructure 922.02s - 923.02s | between IT and OT. 923.02s - 926.02s | The virtualization platform on the left 926.02s - 929.02s | authenticates to an IT domain, 929.02s - 931.02s | but hosts guest machines for both 931.02s - 933.02s | IT and OT environments. 933.02s - 936.02s | Our team was able to gain administrative access 936.02s - 938.02s | to the hypervisor management interface 938.02s - 940.02s | using credentials compromised in the IT domain 940.02s - 943.02s | and leverage the same to gain access 943.02s - 946.02s | to the local console on the guest virtual machines 946.02s - 948.02s | in the OT environment. 948.02s - 950.02s | The screenshot on the right-hand side here 950.02s - 953.02s | shows an example of direct console access 953.02s - 955.02s | to the guest VM for a WSIS server 955.02s - 958.02s | in the OT network, which hosts software updates 958.02s - 960.02s | for engineering workstations 960.02s - 964.02s | in the PCN plant network. 964.02s - 966.02s | The final attack phase I'd like to cover 966.02s - 968.02s | is mission execution in OT. 969.02s - 971.02s | As the name suggests, this is the phase 971.02s - 973.02s | where we are dealing with core OT 973.02s - 976.02s | and the attacker will either attempt 976.02s - 978.02s | to leverage the access that they've already obtained 978.02s - 980.02s | or launch a pre-built exploit 980.02s - 983.02s | to achieve the final objective. 983.02s - 985.02s | As you can imagine, the tactics, techniques, 985.02s - 987.02s | and procedures that an attacker might use 987.02s


chunk_text:
- 943.02s | and leverage the same to gain access 943.02s - 946.02s | to the local console on the guest virtual machines 946.02s - 948.02s | in the OT environment. 948.02s - 950.02s | The screenshot on the right-hand side here 950.02s - 953.02s | shows an example of direct console access 953.02s - 955.02s | to the guest VM for a WSIS server 955.02s - 958.02s | in the OT network, which hosts software updates 958.02s - 960.02s | for engineering workstations 960.02s - 964.02s | in the PCN plant network. 964.02s - 966.02s | The final attack phase I'd like to cover 966.02s - 968.02s | is mission execution in OT. 969.02s - 971.02s | As the name suggests, this is the phase 971.02s - 973.02s | where we are dealing with core OT 973.02s - 976.02s | and the attacker will either attempt 976.02s - 978.02s | to leverage the access that they've already obtained 978.02s - 980.02s | or launch a pre-built exploit 980.02s - 983.02s | to achieve the final objective. 983.02s - 985.02s | As you can imagine, the tactics, techniques, 985.02s - 987.02s | and procedures that an attacker might use 987.02s - 989.02s | in this phase would highly depend 989.02s - 991.02s | on the specific OT system in question 991.02s - 994.02s | and more importantly, the attacker objective. 994.02s - 997.02s | For example, there are attacker objectives 997.02s - 1001.02s | that could potentially be achieved 1001.02s - 1003.02s | through direct access and direct control 1003.02s - 1007.02s | of an HMI or simply abusing the built-in features 1007.02s - 1009.02s | of the target system. 1009.02s - 1012.02s | While there are some other attack vectors 1012.02s - 1015.02s | or attacker objectives which might require 1015.02s - 1017.02s | manipulation of the control logic 1017.02s - 1019.02s | and input-output signals on the lower-level 1019.02s - 1021.02s | embedded systems. 1021.02s - 1023.02s | To be honest, I think we could spend an entire session 1023.02s - 1026.02s | talking about attack vectors for mission execution in OT, 1026.02s - 1028.02s | but some common examples in the slide here 1028.02s - 1030.02s | include remote command execution through HMI interface, 1030.02s - 1032.02s | manipulation of configuration data 1032.02s - 1034.02s | for a remote terminal or a PLC, 1034.02s - 1037.02s |


chunk_text:
- 989.02s | in this phase would highly depend 989.02s - 991.02s | on the specific OT system in question 991.02s - 994.02s | and more importantly, the attacker objective. 994.02s - 997.02s | For example, there are attacker objectives 997.02s - 1001.02s | that could potentially be achieved 1001.02s - 1003.02s | through direct access and direct control 1003.02s - 1007.02s | of an HMI or simply abusing the built-in features 1007.02s - 1009.02s | of the target system. 1009.02s - 1012.02s | While there are some other attack vectors 1012.02s - 1015.02s | or attacker objectives which might require 1015.02s - 1017.02s | manipulation of the control logic 1017.02s - 1019.02s | and input-output signals on the lower-level 1019.02s - 1021.02s | embedded systems. 1021.02s - 1023.02s | To be honest, I think we could spend an entire session 1023.02s - 1026.02s | talking about attack vectors for mission execution in OT, 1026.02s - 1028.02s | but some common examples in the slide here 1028.02s - 1030.02s | include remote command execution through HMI interface, 1030.02s - 1032.02s | manipulation of configuration data 1032.02s - 1034.02s | for a remote terminal or a PLC, 1034.02s - 1037.02s | spoof communication for an ICS protocol, 1037.02s - 1039.02s | and last but not the least, a pre-built exploit 1039.02s - 1041.02s | to manipulate the process control logic 1041.02s - 1043.02s | or the process memory and an embedded controller 1043.02s - 1046.02s | in the OT network. 1046.02s - 1049.02s | As a general term of rule, it is relatively easier 1049.02s - 1051.02s | to cause process disruption 1051.02s - 1054.02s | as compared to process manipulation. 1054.02s - 1057.02s | ICS systems are built with redundancy, safety, 1057.02s - 1059.02s | risks, and hazards in mind, 1059.02s - 1062.02s | and thus high-consequence manipulation 1062.02s - 1065.02s | often requires prior reverse engineering 1065.02s - 1067.02s | and exploit development. 1067.02s - 1069.02s | Some common examples of security issues 1069.02s - 1071.02s | that we typically find while assessing 1071.02s - 1075.02s | and building exploits for embedded ICS systems 1075.02s - 1078.02s | include insecure firmware updates, 1078.02s - 1080.02s | unpopulated interfaces, 1080.02s - 1082.02s | hidden backdoors, shared SSH keys 1082.02s - 1084.02s | between different customers, 1084.02s - 1086.02s | obviously buffer overflows, 1086.02s - 1088.02s | and then leftover debug


chunk_text:
spoof communication for an ICS protocol, 1037.02s - 1039.02s | and last but not the least, a pre-built exploit 1039.02s - 1041.02s | to manipulate the process control logic 1041.02s - 1043.02s | or the process memory and an embedded controller 1043.02s - 1046.02s | in the OT network. 1046.02s - 1049.02s | As a general term of rule, it is relatively easier 1049.02s - 1051.02s | to cause process disruption 1051.02s - 1054.02s | as compared to process manipulation. 1054.02s - 1057.02s | ICS systems are built with redundancy, safety, 1057.02s - 1059.02s | risks, and hazards in mind, 1059.02s - 1062.02s | and thus high-consequence manipulation 1062.02s - 1065.02s | often requires prior reverse engineering 1065.02s - 1067.02s | and exploit development. 1067.02s - 1069.02s | Some common examples of security issues 1069.02s - 1071.02s | that we typically find while assessing 1071.02s - 1075.02s | and building exploits for embedded ICS systems 1075.02s - 1078.02s | include insecure firmware updates, 1078.02s - 1080.02s | unpopulated interfaces, 1080.02s - 1082.02s | hidden backdoors, shared SSH keys 1082.02s - 1084.02s | between different customers, 1084.02s - 1086.02s | obviously buffer overflows, 1086.02s - 1088.02s | and then leftover debug functions 1088.02s - 1090.02s | from development and testing 1090.02s - 1094.02s | that have carried over to the production systems. 1094.02s - 1096.02s | Here I'd like to once more stress 1096.02s - 1099.02s | that we are essentially dealing with cyber-physical systems 1099.02s - 1102.02s | and thus any kind of offensive security testing 1102.02s - 1104.02s | for lower-level ICS devices 1104.02s - 1106.02s | should only be performed in a non-production 1106.02s - 1111.02s | or a laboratory environment under controlled conditions. 1111.02s - 1113.02s | The first example I have here 1113.02s - 1117.02s | is for a Red Team exercise for a power utility 1117.02s - 1120.02s | with advanced metering infrastructure. 1120.02s - 1124.02s | This shows an example of simply using an HMI command 1124.02s - 1126.02s | to achieve the final objective, 1126.02s - 1129.02s | that is, remote disconnect of a target smart meter 1129.02s - 1131.02s | at a specific location. 1131.02s - 1134.02s | A team was effectively able to breach the external perimeter, 1134.02s - 1136.02s | gain remote access to the command and control interface 1136.02s - 1138.02s | for the head-end system, 1138.02s - 1140.02s


chunk_text:
functions 1088.02s - 1090.02s | from development and testing 1090.02s - 1094.02s | that have carried over to the production systems. 1094.02s - 1096.02s | Here I'd like to once more stress 1096.02s - 1099.02s | that we are essentially dealing with cyber-physical systems 1099.02s - 1102.02s | and thus any kind of offensive security testing 1102.02s - 1104.02s | for lower-level ICS devices 1104.02s - 1106.02s | should only be performed in a non-production 1106.02s - 1111.02s | or a laboratory environment under controlled conditions. 1111.02s - 1113.02s | The first example I have here 1113.02s - 1117.02s | is for a Red Team exercise for a power utility 1117.02s - 1120.02s | with advanced metering infrastructure. 1120.02s - 1124.02s | This shows an example of simply using an HMI command 1124.02s - 1126.02s | to achieve the final objective, 1126.02s - 1129.02s | that is, remote disconnect of a target smart meter 1129.02s - 1131.02s | at a specific location. 1131.02s - 1134.02s | A team was effectively able to breach the external perimeter, 1134.02s - 1136.02s | gain remote access to the command and control interface 1136.02s - 1138.02s | for the head-end system, 1138.02s - 1140.02s | and initiate remote disconnect command 1140.02s - 1143.02s | for the endpoint mirrors. 1143.02s - 1146.02s | This slide is another example of mission execution 1146.02s - 1148.02s | through direct control of HMI. 1148.02s - 1151.02s | A team was able to gain remote access 1151.02s - 1153.02s | to the physical access control interface 1153.02s - 1155.02s | for a building management system, 1155.02s - 1158.02s | thus obtaining the ability to open doors and turnstiles 1158.02s - 1160.02s | through a simple click of a button. 1160.02s - 1163.02s | Unfortunately, I cannot show you the actual pictures here, 1163.02s - 1165.02s | but effectively we were able to use 1165.02s - 1167.02s | the command and control interface for the BMS 1167.02s - 1170.02s | to walk into an operations control center 1170.02s - 1172.02s | while one of us was actually operating 1172.02s - 1177.02s | and controlling the doors and turnstiles remotely. 1177.02s - 1180.02s | This slide shows an example 1180.02s - 1183.02s | of basically spoofing ICS traffic 1183.02s - 1185.02s | for a locomotive control system. 1185.02s - 1188.02s | The screenshot shows us plugging into an onboard Ethernet switch


chunk_text:
| and initiate remote disconnect command 1140.02s - 1143.02s | for the endpoint mirrors. 1143.02s - 1146.02s | This slide is another example of mission execution 1146.02s - 1148.02s | through direct control of HMI. 1148.02s - 1151.02s | A team was able to gain remote access 1151.02s - 1153.02s | to the physical access control interface 1153.02s - 1155.02s | for a building management system, 1155.02s - 1158.02s | thus obtaining the ability to open doors and turnstiles 1158.02s - 1160.02s | through a simple click of a button. 1160.02s - 1163.02s | Unfortunately, I cannot show you the actual pictures here, 1163.02s - 1165.02s | but effectively we were able to use 1165.02s - 1167.02s | the command and control interface for the BMS 1167.02s - 1170.02s | to walk into an operations control center 1170.02s - 1172.02s | while one of us was actually operating 1172.02s - 1177.02s | and controlling the doors and turnstiles remotely. 1177.02s - 1180.02s | This slide shows an example 1180.02s - 1183.02s | of basically spoofing ICS traffic 1183.02s - 1185.02s | for a locomotive control system. 1185.02s - 1188.02s | The screenshot shows us plugging into an onboard Ethernet switch 1188.02s - 1189.02s | in the locomotive cab 1189.02s - 1192.02s | and manipulating the speed sensor reading 1192.02s - 1194.02s | on the operator's screen. 1194.02s - 1197.02s | The train here obviously is not moving at 80 miles per hour. 1197.02s - 1200.02s | This is essentially the effect of spoofing canvas traffic 1200.02s - 1202.02s | to an existing binary on one of the ECUs 1202.02s - 1204.02s | on the embedded network on the train. 1204.02s - 1207.81s | Last but not the least, 1207.81s - 1211.81s | I have here an example of using debug features 1211.81s - 1213.81s | to manipulate the input-output signals 1213.81s - 1216.81s | for a light-trail vehicle control system. 1216.81s - 1218.81s | It's actually quite surprising how many times 1218.81s - 1220.81s | one might find a debug console 1220.81s - 1222.81s | enabled in a production environment, 1222.81s - 1224.81s | and this can often be used to manipulate 1224.81s - 1226.81s | control signals and input-output signals 1226.81s - 1228.81s | beyond the intended. 1228.81s - 1230.81s | The screenshot there on the left 1230.81s - 1232.81s | basically shows us using a vendor IDE, 1232.81s


chunk_text:
1188.02s - 1189.02s | in the locomotive cab 1189.02s - 1192.02s | and manipulating the speed sensor reading 1192.02s - 1194.02s | on the operator's screen. 1194.02s - 1197.02s | The train here obviously is not moving at 80 miles per hour. 1197.02s - 1200.02s | This is essentially the effect of spoofing canvas traffic 1200.02s - 1202.02s | to an existing binary on one of the ECUs 1202.02s - 1204.02s | on the embedded network on the train. 1204.02s - 1207.81s | Last but not the least, 1207.81s - 1211.81s | I have here an example of using debug features 1211.81s - 1213.81s | to manipulate the input-output signals 1213.81s - 1216.81s | for a light-trail vehicle control system. 1216.81s - 1218.81s | It's actually quite surprising how many times 1218.81s - 1220.81s | one might find a debug console 1220.81s - 1222.81s | enabled in a production environment, 1222.81s - 1224.81s | and this can often be used to manipulate 1224.81s - 1226.81s | control signals and input-output signals 1226.81s - 1228.81s | beyond the intended. 1228.81s - 1230.81s | The screenshot there on the left 1230.81s - 1232.81s | basically shows us using a vendor IDE, 1232.81s - 1234.81s | which I'm not going to name, 1234.81s - 1237.81s | to basically connect to a live unit on an LRV 1237.81s - 1239.81s | and using force tables 1239.81s - 1241.81s | to override input-output signal tags 1241.81s - 1244.81s | for the vehicle control system. 1244.81s - 1246.81s | Again, unfortunately, I cannot show the video here, 1246.81s - 1249.81s | but essentially we were able to access 1249.81s - 1253.81s | or gain access to an IP-based Ethernet network on the LRV, 1253.81s - 1255.81s | connect to the vehicle control ECU, 1255.81s - 1257.81s | and override operator input 1257.81s - 1259.81s | for doors, throttle, direction, 1259.81s - 1261.81s | and even emergency braking. 1261.81s - 1263.81s | Have you ever seen a movie 1263.81s - 1265.81s | where you see a hacker 1265.81s - 1267.81s | scribbling on a laptop trying to stop a train? 1267.81s - 1269.81s | This is exactly that, but much worse, 1269.81s - 1271.81s | because we were actually able to 1271.81s - 1273.81s | control the throttle, 1273.81s - 1276.81s | basically override the dead-man switch, 1276.81s - 1278.81s | move the train, and disable 1278.81s


chunk_text:
- 1234.81s | which I'm not going to name, 1234.81s - 1237.81s | to basically connect to a live unit on an LRV 1237.81s - 1239.81s | and using force tables 1239.81s - 1241.81s | to override input-output signal tags 1241.81s - 1244.81s | for the vehicle control system. 1244.81s - 1246.81s | Again, unfortunately, I cannot show the video here, 1246.81s - 1249.81s | but essentially we were able to access 1249.81s - 1253.81s | or gain access to an IP-based Ethernet network on the LRV, 1253.81s - 1255.81s | connect to the vehicle control ECU, 1255.81s - 1257.81s | and override operator input 1257.81s - 1259.81s | for doors, throttle, direction, 1259.81s - 1261.81s | and even emergency braking. 1261.81s - 1263.81s | Have you ever seen a movie 1263.81s - 1265.81s | where you see a hacker 1265.81s - 1267.81s | scribbling on a laptop trying to stop a train? 1267.81s - 1269.81s | This is exactly that, but much worse, 1269.81s - 1271.81s | because we were actually able to 1271.81s - 1273.81s | control the throttle, 1273.81s - 1276.81s | basically override the dead-man switch, 1276.81s - 1278.81s | move the train, and disable 1278.81s - 1282.81s | all and every operator input. 1282.81s - 1284.81s | I think I've run through 25 minutes, 1284.81s - 1286.81s | so I realize that I pretty much 1286.81s - 1288.81s | run through my slides, 1288.81s - 1290.81s | but I only have 30 minutes, 1290.81s - 1292.81s | so I hope that I have been able to provide 1292.81s - 1294.81s | some practical real-world experience 1294.81s - 1296.81s | or perspective on some common attack vectors 1296.81s - 1298.81s | that an attacker might use 1298.81s - 1300.81s | to hack operational technology. 1300.81s - 1302.81s | But if nothing else, 1302.81s - 1304.81s | I would like to conclude with four key takeaways 1304.81s - 1306.81s | from my talk. 1306.81s - 1308.81s | It is possible to conduct offensive security testing for OT, 1308.81s - 1310.81s | but such testing should only be performed 1310.81s - 1312.81s | after careful consideration of 1312.81s - 1314.81s | risks, hazards, controls, 1314.81s - 1316.81s | and pre-approved rules of engagement. 1316.81s - 1318.81s | Real-world OT attacks 1318.81s - 1320.81s | are rarely single-step compromises 1320.81s - 1322.81s | and often involve a multi-step attack


chunk_text:
- 1282.81s | all and every operator input. 1282.81s - 1284.81s | I think I've run through 25 minutes, 1284.81s - 1286.81s | so I realize that I pretty much 1286.81s - 1288.81s | run through my slides, 1288.81s - 1290.81s | but I only have 30 minutes, 1290.81s - 1292.81s | so I hope that I have been able to provide 1292.81s - 1294.81s | some practical real-world experience 1294.81s - 1296.81s | or perspective on some common attack vectors 1296.81s - 1298.81s | that an attacker might use 1298.81s - 1300.81s | to hack operational technology. 1300.81s - 1302.81s | But if nothing else, 1302.81s - 1304.81s | I would like to conclude with four key takeaways 1304.81s - 1306.81s | from my talk. 1306.81s - 1308.81s | It is possible to conduct offensive security testing for OT, 1308.81s - 1310.81s | but such testing should only be performed 1310.81s - 1312.81s | after careful consideration of 1312.81s - 1314.81s | risks, hazards, controls, 1314.81s - 1316.81s | and pre-approved rules of engagement. 1316.81s - 1318.81s | Real-world OT attacks 1318.81s - 1320.81s | are rarely single-step compromises 1320.81s - 1322.81s | and often involve a multi-step attack lifecycle 1322.81s - 1324.81s | covering multiple phases. 1324.81s - 1326.81s | It's relatively easier 1326.81s - 1328.81s | to cause a process disruption 1328.81s - 1330.81s | as compared to process manipulation. 1330.81s - 1332.81s | Process disruption can often be achieved 1332.81s - 1334.81s | through direct abuse of pre-built features 1334.81s - 1336.81s | of the system, 1336.81s - 1338.81s | whereas high-consequence manipulation 1338.81s - 1340.81s | often requires prior reverse engineering 1340.81s - 1342.81s | and exploit development. 1342.81s - 1344.81s | Lastly, from a defender's 1344.81s - 1346.81s | perspective, it is important 1346.81s - 1348.81s | to understand the ICS-OT attack lifecycle, 1348.81s - 1350.81s | develop preventive or 1350.81s - 1352.81s | detective controls for known TTPs, 1352.81s - 1354.81s | and mitigate attack vectors 1354.81s - 1356.81s | across different phases of 1356.81s - 1358.81s | the attack lifecycle. 1358.81s - 1360.81s | Cool, that's it. 1360.81s - 1362.81s | That's all I have for you today. 1362.81s - 1364.81s | I realize it's 3 p.m. 1364.81s - 1366.81s | on Saturday afternoon in Vegas, 1366.81s - 1368.81s | so thanks everybody for joining in 1368.81s - 1370.81s | and listening


chunk_text:
lifecycle 1322.81s - 1324.81s | covering multiple phases. 1324.81s - 1326.81s | It's relatively easier 1326.81s - 1328.81s | to cause a process disruption 1328.81s - 1330.81s | as compared to process manipulation. 1330.81s - 1332.81s | Process disruption can often be achieved 1332.81s - 1334.81s | through direct abuse of pre-built features 1334.81s - 1336.81s | of the system, 1336.81s - 1338.81s | whereas high-consequence manipulation 1338.81s - 1340.81s | often requires prior reverse engineering 1340.81s - 1342.81s | and exploit development. 1342.81s - 1344.81s | Lastly, from a defender's 1344.81s - 1346.81s | perspective, it is important 1346.81s - 1348.81s | to understand the ICS-OT attack lifecycle, 1348.81s - 1350.81s | develop preventive or 1350.81s - 1352.81s | detective controls for known TTPs, 1352.81s - 1354.81s | and mitigate attack vectors 1354.81s - 1356.81s | across different phases of 1356.81s - 1358.81s | the attack lifecycle. 1358.81s - 1360.81s | Cool, that's it. 1360.81s - 1362.81s | That's all I have for you today. 1362.81s - 1364.81s | I realize it's 3 p.m. 1364.81s - 1366.81s | on Saturday afternoon in Vegas, 1366.81s - 1368.81s | so thanks everybody for joining in 1368.81s - 1370.81s | and listening in. 1370.81s - 1372.81s | If you have any questions, 1372.81s - 1374.81s | although I cannot see anybody here, 1374.81s - 1376.81s | but if you have any questions, 1376.81s - 1378.81s | you can hit me up face-to-face. 1378.81s - 1380.81s | If you want to reach out and discuss in more detail, 1380.81s - 1382.81s | you can reach out to us 1382.81s - 1384.81s | over email or LinkedIn.


chunk_text:
in. 1370.81s - 1372.81s | If you have any questions, 1372.81s - 1374.81s | although I cannot see anybody here, 1374.81s - 1376.81s | but if you have any questions, 1376.81s - 1378.81s | you can hit me up face-to-face. 1378.81s - 1380.81s | If you want to reach out and discuss in more detail, 1380.81s - 1382.81s | you can reach out to us 1382.81s - 1384.81s | over email or LinkedIn.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=A5SefnQPyn0", "title": "DEF CON 32 - An adversarial approach to Airline Revenue Management Proving Ground - Craig Lester", "description": "Richard Branson is oft quoted with the quip that the quickest way to become a millionaire in the Airline Industry is to start as a billionaire. An Industry constrained by high fixed capital costs, bi-lateral capacity treaties, airport slots and curfews, labour etc; Airlines use the practice of revenue management to fill planes, maximise earnings and keep competitors at bay. But you\u2019re not interested in an economics talk \u2013 this is a hacker con. I\u2019m here to provide a birds-eye view and introduction into how fares and ticketing work, debunking some myths while outlining system constraints and limitations that introduce vulnerabilities. As an outcome, attendees should gain an introductory understanding of airline industry pricing, published fares and terminology. With most blogged 'deals' patched quicker than RCEs, the deeper understanding of not what but how, facilitates a progression for those interested to interact on more specialised discussion forums.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2556, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.14s - 7.84s | This text was transcribed using whisper model: large-v2 Good morning. Ah, there we go. Good morning everyone. I am a Lillian Ashbaker. I represent the aerospace village 7.84s - 15.78s | I do the speaker CFP process the aerospace village is in conjunction with the creator stage team is pleased to introduce Craig 16.06s - 23.10s | He is presenting on an adversarial approach to airline revenue management. So please welcome Craig to the stage 30.14s - 32.14s | Well, hey everyone 37.50s - 39.98s | I'm Craig a little about me. I 42.38s - 45.54s | First moved interstate for work about 15 years ago and 46.34s - 48.34s | started flying a lot since then 48.50s - 53.28s | by trade, I'm I work with Splunk and Simtools now, but my 54.06s - 57.18s | Background was Cisco and carrier sort of networking stuff 57.94s - 59.94s | But yeah 60.02s - 63.86s | So firstly what what's this talk not about so it's I'm not all about 65.74s - 72.50s | These big clickbait, you know sort of travel articles where when really when you break them down at the end of the day 72.66s - 75.80s | It's like sign up for this credit card get a sign on bonus 76.90s - 80.86s


chunk_text:
I am a Lillian Ashbaker. I represent the aerospace village 7.84s - 15.78s | I do the speaker CFP process the aerospace village is in conjunction with the creator stage team is pleased to introduce Craig 16.06s - 23.10s | He is presenting on an adversarial approach to airline revenue management. So please welcome Craig to the stage 30.14s - 32.14s | Well, hey everyone 37.50s - 39.98s | I'm Craig a little about me. I 42.38s - 45.54s | First moved interstate for work about 15 years ago and 46.34s - 48.34s | started flying a lot since then 48.50s - 53.28s | by trade, I'm I work with Splunk and Simtools now, but my 54.06s - 57.18s | Background was Cisco and carrier sort of networking stuff 57.94s - 59.94s | But yeah 60.02s - 63.86s | So firstly what what's this talk not about so it's I'm not all about 65.74s - 72.50s | These big clickbait, you know sort of travel articles where when really when you break them down at the end of the day 72.66s - 75.80s | It's like sign up for this credit card get a sign on bonus 76.90s - 80.86s | and you know pick the most expensive fare out there to 81.98s - 83.82s | To advertise it through 83.82s - 85.82s | So with that just a little disclaimer 86.82s - 89.74s | That already intended audience, so 96.61s - 99.41s | Okay, it's just a little disclaimer I guess 99.93s - 103.25s | The intended audience for this talk is supposed to be I guess people that 103.77s - 106.77s | Airlines or whatever so they can defend their systems better, right? It's ethically 108.45s - 111.45s | But yeah, and with that just caveats 113.29s - 117.05s | Look I'm just a dude. This is an interest topic to me. I haven't been trained 117.05s - 122.29s | I just sort of you know black box as it got along and learn stuff. So I'm sharing that with you 122.69s - 126.77s | There's a lot of information to cover. So I've got it probably will be a bit high-level 127.81s - 130.97s | Come see me later. I'll get us copy the slides if you like, but 133.29s - 135.29s | Yeah 135.89s - 139.65s | So firstly why is the airline and travel industry


chunk_text:
| and you know pick the most expensive fare out there to 81.98s - 83.82s | To advertise it through 83.82s - 85.82s | So with that just a little disclaimer 86.82s - 89.74s | That already intended audience, so 96.61s - 99.41s | Okay, it's just a little disclaimer I guess 99.93s - 103.25s | The intended audience for this talk is supposed to be I guess people that 103.77s - 106.77s | Airlines or whatever so they can defend their systems better, right? It's ethically 108.45s - 111.45s | But yeah, and with that just caveats 113.29s - 117.05s | Look I'm just a dude. This is an interest topic to me. I haven't been trained 117.05s - 122.29s | I just sort of you know black box as it got along and learn stuff. So I'm sharing that with you 122.69s - 126.77s | There's a lot of information to cover. So I've got it probably will be a bit high-level 127.81s - 130.97s | Come see me later. I'll get us copy the slides if you like, but 133.29s - 135.29s | Yeah 135.89s - 139.65s | So firstly why is the airline and travel industry the way it is 140.53s - 143.13s | It's high fixed costs. It's very regulated 143.85s - 147.77s | You know not only do airlines have to get approval from you know 147.77s - 150.65s | Both governments to operate fair flights between two countries 150.69s - 155.49s | They actually have to you know apply for slots and so these slots sometimes like, you know 155.49s - 161.29s | I'd be for addresses where it's pretty congested at some of the airports like London and JFK and whatnot 161.37s - 163.33s | so in fact, in fact 163.33s - 169.85s | you see things like a big Malaysian is flying almost empty planes to London just to keep their slots because if they don't use them they 170.57s - 172.57s | They lose them right and that 172.73s - 178.97s | They do your trades and it you know, it's a 75 billion once for one of the slots recently sold for so with that 178.97s - 181.57s | There's also these concept of fortress hubs 181.69s - 186.29s | Which are like the big hubs of certain airlines that they have such a dominant hold on the market


chunk_text:
the way it is 140.53s - 143.13s | It's high fixed costs. It's very regulated 143.85s - 147.77s | You know not only do airlines have to get approval from you know 147.77s - 150.65s | Both governments to operate fair flights between two countries 150.69s - 155.49s | They actually have to you know apply for slots and so these slots sometimes like, you know 155.49s - 161.29s | I'd be for addresses where it's pretty congested at some of the airports like London and JFK and whatnot 161.37s - 163.33s | so in fact, in fact 163.33s - 169.85s | you see things like a big Malaysian is flying almost empty planes to London just to keep their slots because if they don't use them they 170.57s - 172.57s | They lose them right and that 172.73s - 178.97s | They do your trades and it you know, it's a 75 billion once for one of the slots recently sold for so with that 178.97s - 181.57s | There's also these concept of fortress hubs 181.69s - 186.29s | Which are like the big hubs of certain airlines that they have such a dominant hold on the market 189.21s - 195.61s | So with that, what does the revenue management team do and what they do is basically try and maximize the return they can get on 196.21s - 199.05s | By filling an aircraft and what they're concerned about is either 199.97s - 202.09s | If we if you boil it down, so this is a 202.85s - 206.09s | Bit of an academic science. This is quite a good is a few general art 206.09s - 208.09s | There's quite a lot of general articles and research on this 208.13s - 213.53s | but for our purposes if you boil it down really what they're trying to look out for is 214.45s - 219.17s | Making sure the sit they get the highest price for every seat not letting it go empty or selling it out too cheap 220.33s - 222.53s | So thinking about that, how can they? 223.41s - 227.57s | How can they be disrupted? We're not going to really talk about any of these today 228.09s - 229.89s | But 229.89s - 233.49s | Just wanted to just wanted to highlight the fact that it ranges straight from 234.01s - 241.13s |


chunk_text:
189.21s - 195.61s | So with that, what does the revenue management team do and what they do is basically try and maximize the return they can get on 196.21s - 199.05s | By filling an aircraft and what they're concerned about is either 199.97s - 202.09s | If we if you boil it down, so this is a 202.85s - 206.09s | Bit of an academic science. This is quite a good is a few general art 206.09s - 208.09s | There's quite a lot of general articles and research on this 208.13s - 213.53s | but for our purposes if you boil it down really what they're trying to look out for is 214.45s - 219.17s | Making sure the sit they get the highest price for every seat not letting it go empty or selling it out too cheap 220.33s - 222.53s | So thinking about that, how can they? 223.41s - 227.57s | How can they be disrupted? We're not going to really talk about any of these today 228.09s - 229.89s | But 229.89s - 233.49s | Just wanted to just wanted to highlight the fact that it ranges straight from 234.01s - 241.13s | I guess using a same-day flight change or some of your actual benefits that they offer in some ways can you know produce the 241.77s - 246.61s | Return they would get but you know and other things actually become more related 246.61s - 251.73s | You know like fraud where it's credit card abuse and that sort of stuff or by cashing out things for gift cards 251.73s - 258.17s | So with that how do fares exist in the world like so when you when you go to an airline website or 258.17s - 262.01s | You know your Expedia or whatever. What do you actually see? Why why does it come up that way? 263.13s - 267.09s | I've often overheard people go all the price went up because of my cookies or whatever 267.09s - 271.81s | But generally you find there are things like there are things called rules attached to them. There might be 272.37s - 278.53s | Days of the week or where the publish it there is published and the other the other concern is the dynamic inventory that's involved 278.65s - 283.61s | It's extremely it's extremely complex computationally and there


chunk_text:
I guess using a same-day flight change or some of your actual benefits that they offer in some ways can you know produce the 241.77s - 246.61s | Return they would get but you know and other things actually become more related 246.61s - 251.73s | You know like fraud where it's credit card abuse and that sort of stuff or by cashing out things for gift cards 251.73s - 258.17s | So with that how do fares exist in the world like so when you when you go to an airline website or 258.17s - 262.01s | You know your Expedia or whatever. What do you actually see? Why why does it come up that way? 263.13s - 267.09s | I've often overheard people go all the price went up because of my cookies or whatever 267.09s - 271.81s | But generally you find there are things like there are things called rules attached to them. There might be 272.37s - 278.53s | Days of the week or where the publish it there is published and the other the other concern is the dynamic inventory that's involved 278.65s - 283.61s | It's extremely it's extremely complex computationally and there is 287.53s - 289.53s | Written a very great 291.17s - 295.65s | Very great presentation on the computer complexity of actually calculating these things because 296.53s - 299.13s | Most international trips or where there's multiple connections 299.81s - 304.53s | Actually, it can be tens of millions of possible connections of fares in the world 304.73s - 310.31s | Actually, it can be tens of millions of possible connections of fares and flights and whatnot 310.57s - 316.69s | So that's why sometimes when you go to book it might say this price is expired because actually you've sort of looking at case 317.09s - 319.09s | availability 319.37s - 321.01s | So what affairs look like 321.01s - 327.49s | this is the example from probably one of the tools that you can sort of buy closer access to these the actual 327.89s - 330.65s | Like border travel agent would say it's not the same system 330.65s - 334.01s | But it's like a it's like a read-only one that consumers can subscribe to 334.89s - 338.11s | but this is what you this is sort of what they look like so they all have like


chunk_text:
is 287.53s - 289.53s | Written a very great 291.17s - 295.65s | Very great presentation on the computer complexity of actually calculating these things because 296.53s - 299.13s | Most international trips or where there's multiple connections 299.81s - 304.53s | Actually, it can be tens of millions of possible connections of fares in the world 304.73s - 310.31s | Actually, it can be tens of millions of possible connections of fares and flights and whatnot 310.57s - 316.69s | So that's why sometimes when you go to book it might say this price is expired because actually you've sort of looking at case 317.09s - 319.09s | availability 319.37s - 321.01s | So what affairs look like 321.01s - 327.49s | this is the example from probably one of the tools that you can sort of buy closer access to these the actual 327.89s - 330.65s | Like border travel agent would say it's not the same system 330.65s - 334.01s | But it's like a it's like a read-only one that consumers can subscribe to 334.89s - 338.11s | but this is what you this is sort of what they look like so they all have like a 340.17s - 343.69s | Basis or an identifier code and now this code is a bunch of numbers 343.69s - 345.05s | But I mean so a bunch of letters 345.05s - 352.29s | but usually these letters indicate the first one is the inventory code and the others depending on the airline might indicate the seasonality or other 352.29s - 357.97s | Sorts of you know restrictions for a family affairs. So this is some here. It's just example for 358.45s - 364.61s | London to New York, you can see the round-trip that those prices are actually the base fare before you add taxes and surcharges 365.25s - 369.75s | And you can also see there things like the minimum maximum stay that they have 369.75s - 374.05s | So the SU is a Sunday stay and it's an old sort of traditional 374.37s - 378.65s | concept that they used to catch business travelers with because if you forced a 379.05s - 384.61s | You know leisure travelers are more likely to stay over a weekend. Whereas business travelers, you don't want to go home on Friday or whatever 384.89s - 389.49s | So as we


chunk_text:
a 340.17s - 343.69s | Basis or an identifier code and now this code is a bunch of numbers 343.69s - 345.05s | But I mean so a bunch of letters 345.05s - 352.29s | but usually these letters indicate the first one is the inventory code and the others depending on the airline might indicate the seasonality or other 352.29s - 357.97s | Sorts of you know restrictions for a family affairs. So this is some here. It's just example for 358.45s - 364.61s | London to New York, you can see the round-trip that those prices are actually the base fare before you add taxes and surcharges 365.25s - 369.75s | And you can also see there things like the minimum maximum stay that they have 369.75s - 374.05s | So the SU is a Sunday stay and it's an old sort of traditional 374.37s - 378.65s | concept that they used to catch business travelers with because if you forced a 379.05s - 384.61s | You know leisure travelers are more likely to stay over a weekend. Whereas business travelers, you don't want to go home on Friday or whatever 384.89s - 389.49s | So as we as I talked about that they're published on two sort of basis's generally the 390.37s - 394.53s | the routing spaces where it's explicitly show you which which which 395.13s - 398.97s | transit points and you can book with that particular fare and 399.49s - 401.49s | The other way is the the mileage 402.13s - 404.13s | Or an NPM basis now 404.53s - 409.41s | I've got a little calculation there if you can see on the screen of how an NPM sort of works, but essentially 409.73s - 412.49s | It's using the great circle distance the 413.17s - 416.33s | That you it's something you may have seen with like impossible travel and whatnot 417.41s - 419.89s | alerts and your seems and then 422.13s - 427.01s | So they can make it work through their particular hubs often you they have a concept of a ticketed point deduction 427.25s - 430.73s | where basically you can get extra miles to finish the trip because they 432.37s - 435.73s | Because say for instance this one they allow you to fly through the city 436.65s - 439.97s | Because say for instance this one they


chunk_text:
as I talked about that they're published on two sort of basis's generally the 390.37s - 394.53s | the routing spaces where it's explicitly show you which which which 395.13s - 398.97s | transit points and you can book with that particular fare and 399.49s - 401.49s | The other way is the the mileage 402.13s - 404.13s | Or an NPM basis now 404.53s - 409.41s | I've got a little calculation there if you can see on the screen of how an NPM sort of works, but essentially 409.73s - 412.49s | It's using the great circle distance the 413.17s - 416.33s | That you it's something you may have seen with like impossible travel and whatnot 417.41s - 419.89s | alerts and your seems and then 422.13s - 427.01s | So they can make it work through their particular hubs often you they have a concept of a ticketed point deduction 427.25s - 430.73s | where basically you can get extra miles to finish the trip because they 432.37s - 435.73s | Because say for instance this one they allow you to fly through the city 436.65s - 439.97s | Because say for instance this one they allow you to fly through Chicago 441.05s - 443.05s | So just a brief thing 443.05s - 445.45s | When you combining these fares and looking at stuff 445.45s - 448.97s | There's quite a number of rules that are involved and we just sort of looked at the routing 448.97s - 455.25s | But as you can see there did speak about that Sunday stay, but yeah, there's there's all these other things to take into account 457.17s - 460.53s | So behind the scenes when you actually buy a ticket it kind of looks like this 460.65s - 464.53s | So how did I did have a picture earlier of a Qatar ticket on there? 464.85s - 469.81s | But this just shows a more complex sort of ticket where all these leases my understanding anyway 470.49s - 475.01s | But the important thing to know is that when you get your reservation your P&R 475.01s - 480.09s | Yes, you know your six-letter identifier just because it says confirmed or on request or whatever in there 480.09s - 484.89s | It doesn't actually mean you can board the flight. You need a you actually need that valid


chunk_text:
allow you to fly through Chicago 441.05s - 443.05s | So just a brief thing 443.05s - 445.45s | When you combining these fares and looking at stuff 445.45s - 448.97s | There's quite a number of rules that are involved and we just sort of looked at the routing 448.97s - 455.25s | But as you can see there did speak about that Sunday stay, but yeah, there's there's all these other things to take into account 457.17s - 460.53s | So behind the scenes when you actually buy a ticket it kind of looks like this 460.65s - 464.53s | So how did I did have a picture earlier of a Qatar ticket on there? 464.85s - 469.81s | But this just shows a more complex sort of ticket where all these leases my understanding anyway 470.49s - 475.01s | But the important thing to know is that when you get your reservation your P&R 475.01s - 480.09s | Yes, you know your six-letter identifier just because it says confirmed or on request or whatever in there 480.09s - 484.89s | It doesn't actually mean you can board the flight. You need a you actually need that valid e-ticket 485.53s - 487.29s | in there and 487.29s - 491.33s | Then when you check in that's what actually marks the basically coupon 491.33s - 492.89s | It's similar to the old paper tickets 492.89s - 498.17s | But marks that is used and these have to be used in order or basically your rest of your flights are cancelled 499.37s - 500.97s | Just going back to that last one 500.97s - 506.57s | we can sort of see there an example of where there is an issue with the e-ticket even though you have a valid reservation and 506.57s - 508.57s | You can't can't check in on that one yet 509.85s - 511.85s | so moving across to the 513.05s - 519.45s | The dynamic how they manage dynamic inventory you might have seen things like five seats less or whatnot 519.93s - 522.49s | But essentially they use what they use is 523.37s - 526.25s | his buckets which are given letters and they 526.77s - 531.81s | And the different fans will attach to different buckets and that that's how they sort of manage the pricing 533.05s - 535.05s | So if you look


chunk_text:
e-ticket 485.53s - 487.29s | in there and 487.29s - 491.33s | Then when you check in that's what actually marks the basically coupon 491.33s - 492.89s | It's similar to the old paper tickets 492.89s - 498.17s | But marks that is used and these have to be used in order or basically your rest of your flights are cancelled 499.37s - 500.97s | Just going back to that last one 500.97s - 506.57s | we can sort of see there an example of where there is an issue with the e-ticket even though you have a valid reservation and 506.57s - 508.57s | You can't can't check in on that one yet 509.85s - 511.85s | so moving across to the 513.05s - 519.45s | The dynamic how they manage dynamic inventory you might have seen things like five seats less or whatnot 519.93s - 522.49s | But essentially they use what they use is 523.37s - 526.25s | his buckets which are given letters and they 526.77s - 531.81s | And the different fans will attach to different buckets and that that's how they sort of manage the pricing 533.05s - 535.05s | So if you look in if you look at that 535.09s - 539.85s | Here's an example of a is example in what would it what a travel agent would see in what they call as G 540.25s - 546.05s | Distribution systems that shows the availability for a particular flight. This is a flight from Dubai to London 546.89s - 548.69s | And what you can actually see on this one 548.69s - 554.01s | That's quite interesting is that because the the why is the highest price or fully flex economy 554.01s - 556.93s | It's the highest I have and also the generic term for that class 557.17s - 561.61s | but what you can see because it's zero it means is it's like completely no seats to sail and 563.21s - 565.13s | Generally, we know that they 565.13s - 570.13s | Oversell by about 10 or 20 percent most flights if they can so with it being zero and closed 570.13s - 571.85s | They weren't not taking any more bookings 571.85s - 578.29s | But the other interesting thing is we're seeing nine which is the maximum for any one time that if there are any single digits


chunk_text:
in if you look at that 535.09s - 539.85s | Here's an example of a is example in what would it what a travel agent would see in what they call as G 540.25s - 546.05s | Distribution systems that shows the availability for a particular flight. This is a flight from Dubai to London 546.89s - 548.69s | And what you can actually see on this one 548.69s - 554.01s | That's quite interesting is that because the the why is the highest price or fully flex economy 554.01s - 556.93s | It's the highest I have and also the generic term for that class 557.17s - 561.61s | but what you can see because it's zero it means is it's like completely no seats to sail and 563.21s - 565.13s | Generally, we know that they 565.13s - 570.13s | Oversell by about 10 or 20 percent most flights if they can so with it being zero and closed 570.13s - 571.85s | They weren't not taking any more bookings 571.85s - 578.29s | But the other interesting thing is we're seeing nine which is the maximum for any one time that if there are any single digits 579.21s - 583.09s | So the actual business and first cabin on this particular flight is quite empty 583.09s - 588.85s | So there's probably a chance that people will get there be a bit of a cabin roll and to feel to sell more seats and 588.85s - 590.85s | to fill it up the some of the 590.93s - 594.93s | More frequent flyers or people traveling alone might actually get or you know 595.29s - 598.17s | When they go to the gate might be given a new seat upgraded 600.42s - 602.42s | So 602.62s - 605.74s | Moving on how do we handle connections now with connections? 605.78s - 607.10s | It's the same sort of thing 607.10s - 613.58s | But what you need to keep in mind is your fare class or your availability needs to match for all segments 613.58s - 616.54s | And not only that you also need it for every person 616.54s - 623.22s | So if you search for one person on this you would get you you would see the cheaper like our fare for business 623.38s - 629.14s | But if you had two people if


chunk_text:
579.21s - 583.09s | So the actual business and first cabin on this particular flight is quite empty 583.09s - 588.85s | So there's probably a chance that people will get there be a bit of a cabin roll and to feel to sell more seats and 588.85s - 590.85s | to fill it up the some of the 590.93s - 594.93s | More frequent flyers or people traveling alone might actually get or you know 595.29s - 598.17s | When they go to the gate might be given a new seat upgraded 600.42s - 602.42s | So 602.62s - 605.74s | Moving on how do we handle connections now with connections? 605.78s - 607.10s | It's the same sort of thing 607.10s - 613.58s | But what you need to keep in mind is your fare class or your availability needs to match for all segments 613.58s - 616.54s | And not only that you also need it for every person 616.54s - 623.22s | So if you search for one person on this you would get you you would see the cheaper like our fare for business 623.38s - 629.14s | But if you had two people if you going it it would show a higher price when you actually search 629.14s - 631.02s | That's not like a cookie because you already search 631.02s - 635.74s | It's because it's because this second connecting flight only has one seat available in that our class 636.14s - 638.14s | So learning some of this can help you 639.02s - 643.82s | Piece together and understand like I found a good fare. I want to book this which days can actually go 644.46s - 646.46s | And net really narrow it down 648.30s - 650.38s | So following the money where it all goes 651.94s - 657.30s | Basically, there's a thing called a valid validating carrier and that's the one that issues the ticket and that's the e-ticket database 657.30s - 663.38s | They use interesting factors American Airlines has all their serial numbers start with double zero one 663.38s - 666.78s | But every because they were the first computerized airline 666.78s - 674.02s | But all of all of the airlines basically have one of these three digit identifiers that for identifying which stock that is 675.06s - 677.70s | You also have a concept of


