# MediaChunks

chunk_text:
of Game Boy cases. 386.22s - 388.46s | Um, yeah, so we didn't catch that. 388.54s - 391.74s | A and B were flipped because when we were looking at the EDA design tools, 391.74s - 394.86s | depending on the point of view, you see start, select BA. 395.98s - 399.58s | And it wasn't until I started working with the firmware and the control that I thought that 399.58s - 400.86s | the engine was just screwed up. 400.86s - 405.02s | And I had to remap everything on the inside when it was really, our buttons were backwards. 405.02s - 409.90s | Um, and you never want to build something into a Game Boy case. 409.90s - 413.66s | I think our assembly involved 19 different parts and steps. 413.66s - 418.06s | And the, the shit show gets worse, but it works. 418.06s - 418.78s | It's fun. 418.78s - 424.94s | It's a nostalgic, nice hand feel to it, but it doesn't, you have to have tedious. 425.90s - 428.22s | Devotion to get through assembly base. 428.22s - 428.94s | It's not fun. 431.34s - 436.06s | Um, I honestly regret suggesting doing a Game Boy. 437.98s - 438.48s | Really? 440.06s - 440.38s | I don't know. 440.38s - 442.06s | Has anyone ever done Game Boy modding? 442.46s - 446.94s | Messed them for, yeah, it's, it's, it's a passion. 446.94s - 450.30s | Um, it doesn't scale well, but we persevered and I think it's fun. 451.02s - 451.90s | Especially but in doom. 451.90s - 452.40s | Yeah. 456.51s - 460.99s | Original question was, uh, in the other formats of game grades, um, 461.71s - 464.27s | thought about actually doing the original with big brick. 464.27s - 468.99s | And then I actually, I think what happened was that basically bought 468.99s - 471.31s | the colors by accident and we just went with that. 472.43s - 473.71s | Lots of planning, right? 473.71s - 475.31s | We're like, just roll with it. 475.31s - 478.11s | Um, and at first it was, it was a nice form factor too. 478.11s - 479.07s | Cause you're thinking about it. 479.07s - 480.75s | Like, okay, I can get cases. 480.75s - 482.51s | It already holds batteries. 482.51s - 486.91s | Um, we'll get into some of the


chunk_text:
Game Boy. 437.98s - 438.48s | Really? 440.06s - 440.38s | I don't know. 440.38s - 442.06s | Has anyone ever done Game Boy modding? 442.46s - 446.94s | Messed them for, yeah, it's, it's, it's a passion. 446.94s - 450.30s | Um, it doesn't scale well, but we persevered and I think it's fun. 451.02s - 451.90s | Especially but in doom. 451.90s - 452.40s | Yeah. 456.51s - 460.99s | Original question was, uh, in the other formats of game grades, um, 461.71s - 464.27s | thought about actually doing the original with big brick. 464.27s - 468.99s | And then I actually, I think what happened was that basically bought 468.99s - 471.31s | the colors by accident and we just went with that. 472.43s - 473.71s | Lots of planning, right? 473.71s - 475.31s | We're like, just roll with it. 475.31s - 478.11s | Um, and at first it was, it was a nice form factor too. 478.11s - 479.07s | Cause you're thinking about it. 479.07s - 480.75s | Like, okay, I can get cases. 480.75s - 482.51s | It already holds batteries. 482.51s - 486.91s | Um, we'll get into some of the battery stuff on the later revs, but it, I'll 486.91s - 491.15s | admit as much as we complain about the cases, they're actually, it's ergonomic. 491.15s - 492.99s | It uses certain form factors. 492.99s - 495.23s | So you can only put in the parts in one way. 495.23s - 496.67s | It's super useful. 496.67s - 502.27s | Um, in hindsight, like a GBA would have given us better GPIO, especially for doom. 502.35s - 506.11s | It, it made it a fun challenge of button combos to try to take like an eight 506.11s - 507.95s | control system and put it on this. 508.83s - 511.55s | Um, what's interesting is this is our first badge. 511.55s - 514.51s | We also did lithium for our power source. 514.51s - 519.47s | Um, usually we use like three triple A's or three double A's, but because 519.47s - 524.03s | of the form factor, we were limited to just two batteries and the RP2040 524.03s - 528.43s | is highly overclocked so that doom runs okay-ish on it. 529.31s - 531.63s | And so it's really, really power hungry. 531.63s - 535.47s | And so


chunk_text:
battery stuff on the later revs, but it, I'll 486.91s - 491.15s | admit as much as we complain about the cases, they're actually, it's ergonomic. 491.15s - 492.99s | It uses certain form factors. 492.99s - 495.23s | So you can only put in the parts in one way. 495.23s - 496.67s | It's super useful. 496.67s - 502.27s | Um, in hindsight, like a GBA would have given us better GPIO, especially for doom. 502.35s - 506.11s | It, it made it a fun challenge of button combos to try to take like an eight 506.11s - 507.95s | control system and put it on this. 508.83s - 511.55s | Um, what's interesting is this is our first badge. 511.55s - 514.51s | We also did lithium for our power source. 514.51s - 519.47s | Um, usually we use like three triple A's or three double A's, but because 519.47s - 524.03s | of the form factor, we were limited to just two batteries and the RP2040 524.03s - 528.43s | is highly overclocked so that doom runs okay-ish on it. 529.31s - 531.63s | And so it's really, really power hungry. 531.63s - 535.47s | And so we need the extra lithium to make that work. 536.43s - 536.83s | Yeah. 536.83s - 539.95s | Anyone that gets them, like we had to put a, we put a weird sticker on 539.95s - 544.43s | there just saying like, you know, RTFM don't put double A's in here. 544.43s - 546.67s | In fact, they shouldn't have to remove the batteries at all. 546.67s - 552.75s | These are lipos that are in the form factor of a double A battery, but yeah. 553.39s - 556.67s | So fully charged circuit in there, but if you put in double A's, it just 556.67s - 558.83s | won't work because they can't provide enough power. 561.49s - 564.21s | So this is kind of what like the progression looks like from a rev 564.21s - 566.77s | one to a two, three, you start seeing the yellow. 566.77s - 568.85s | Um, I know you want to talk about that. 568.85s - 571.09s | You want, you want to geek about the charging circuit? 571.09s - 571.33s | Yeah. 571.33s - 574.61s | So rev two and three was when we were trying to dial in the, uh,


chunk_text:
we need the extra lithium to make that work. 536.43s - 536.83s | Yeah. 536.83s - 539.95s | Anyone that gets them, like we had to put a, we put a weird sticker on 539.95s - 544.43s | there just saying like, you know, RTFM don't put double A's in here. 544.43s - 546.67s | In fact, they shouldn't have to remove the batteries at all. 546.67s - 552.75s | These are lipos that are in the form factor of a double A battery, but yeah. 553.39s - 556.67s | So fully charged circuit in there, but if you put in double A's, it just 556.67s - 558.83s | won't work because they can't provide enough power. 561.49s - 564.21s | So this is kind of what like the progression looks like from a rev 564.21s - 566.77s | one to a two, three, you start seeing the yellow. 566.77s - 568.85s | Um, I know you want to talk about that. 568.85s - 571.09s | You want, you want to geek about the charging circuit? 571.09s - 571.33s | Yeah. 571.33s - 574.61s | So rev two and three was when we were trying to dial in the, uh, 574.61s - 576.69s | charging circuit, make the lithium work correctly. 577.49s - 581.25s | I think we were using a slightly different scheme at that point too, 581.25s - 585.33s | before we settled on that we could not dare, uh, production. 585.33s - 590.53s | Um, this was, um, I, some SAP did the hardware one, and then I took over for 590.53s - 594.45s | hardware and finishing hardware two and three, and then eventually four, 594.45s - 596.21s | which is the production version. 596.21s - 600.45s | I'm a big background in like in that system. 600.45s - 602.21s | So I've never used keypad before. 602.21s - 605.09s | So basically I had to spend about a month and a half learning keypad, 605.09s - 609.33s | another user tool to basically finish up rev two and then rev three. 610.13s - 616.13s | Um, we actually didn't have any problems with, uh, like we didn't 616.13s - 617.73s | have any wire mods or anything like that. 617.73s - 618.77s | Everything kind of just worked. 618.77s - 621.41s | It just was trying to get the fit in the case. 621.41s -


chunk_text:
574.61s - 576.69s | charging circuit, make the lithium work correctly. 577.49s - 581.25s | I think we were using a slightly different scheme at that point too, 581.25s - 585.33s | before we settled on that we could not dare, uh, production. 585.33s - 590.53s | Um, this was, um, I, some SAP did the hardware one, and then I took over for 590.53s - 594.45s | hardware and finishing hardware two and three, and then eventually four, 594.45s - 596.21s | which is the production version. 596.21s - 600.45s | I'm a big background in like in that system. 600.45s - 602.21s | So I've never used keypad before. 602.21s - 605.09s | So basically I had to spend about a month and a half learning keypad, 605.09s - 609.33s | another user tool to basically finish up rev two and then rev three. 610.13s - 616.13s | Um, we actually didn't have any problems with, uh, like we didn't 616.13s - 617.73s | have any wire mods or anything like that. 617.73s - 618.77s | Everything kind of just worked. 618.77s - 621.41s | It just was trying to get the fit in the case. 621.41s - 623.41s | And when you get a different case and it just still wouldn't fit, 624.05s - 628.37s | figuring out all the different locations of cases that it had to fit into. 629.49s - 629.89s | Yeah. 629.89s - 630.21s | Okay. 630.21s - 631.73s | So there's a problem I can think of. 632.53s - 634.13s | You guys all made fun of me before. 634.13s - 637.89s | So on, you see on that previous one, I got the breadboard with the two wires and the two buttons. 639.17s - 642.77s | When you program a Pi Pico, you have to put it in boot select mode. 643.49s - 648.53s | Those buttons were strategically placed on the very bottom of here. 648.53s - 653.89s | Um, where there is, uh, you would have an old audio jack and an old DC, 653.89s - 656.93s | and it's hard to hit them and they were covered by the case. 657.65s - 659.57s | It's fine when you're designing hardware, 659.57s - 665.97s | but when you're working on flashing firmware and wads and files, nonstop a hundred times a day, 665.97s - 668.37s | I can't sit


chunk_text:
623.41s | And when you get a different case and it just still wouldn't fit, 624.05s - 628.37s | figuring out all the different locations of cases that it had to fit into. 629.49s - 629.89s | Yeah. 629.89s - 630.21s | Okay. 630.21s - 631.73s | So there's a problem I can think of. 632.53s - 634.13s | You guys all made fun of me before. 634.13s - 637.89s | So on, you see on that previous one, I got the breadboard with the two wires and the two buttons. 639.17s - 642.77s | When you program a Pi Pico, you have to put it in boot select mode. 643.49s - 648.53s | Those buttons were strategically placed on the very bottom of here. 648.53s - 653.89s | Um, where there is, uh, you would have an old audio jack and an old DC, 653.89s - 656.93s | and it's hard to hit them and they were covered by the case. 657.65s - 659.57s | It's fine when you're designing hardware, 659.57s - 665.97s | but when you're working on flashing firmware and wads and files, nonstop a hundred times a day, 665.97s - 668.37s | I can't sit there with a paper clip and push them in. 668.37s - 671.73s | So I, I yanked out wires and just soldered them in. 671.73s - 673.33s | So I could tap buttons to do that. 673.89s - 675.49s | Um, eventually a fun mod. 675.49s - 679.97s | If you ever develop on a RPi 2040 or any of the Raspberry Pi microcontroller lines, 679.97s - 681.65s | because now there's multiples of them. 682.21s - 685.73s | Um, you can mess with the bootloader selecting. 685.73s - 687.41s | We called it our magic baud rate. 687.41s - 692.05s | So that if you open a serial connection, you can set it to say, 692.05s - 695.57s | Hey, if anything ever tries to connect to you at 1200 baud, 695.57s - 698.77s | we picked 1337 as our magic baud right now. 698.77s - 703.17s | But if you just hit it with 1337 on a serial terminal, 703.17s - 706.61s | it will automatically fall into boot select mode and reboot, 707.17s - 709.33s | which is wonderful if you want to, you know, 709.33s - 711.25s | speed up your tool chain when you're developing


chunk_text:
there with a paper clip and push them in. 668.37s - 671.73s | So I, I yanked out wires and just soldered them in. 671.73s - 673.33s | So I could tap buttons to do that. 673.89s - 675.49s | Um, eventually a fun mod. 675.49s - 679.97s | If you ever develop on a RPi 2040 or any of the Raspberry Pi microcontroller lines, 679.97s - 681.65s | because now there's multiples of them. 682.21s - 685.73s | Um, you can mess with the bootloader selecting. 685.73s - 687.41s | We called it our magic baud rate. 687.41s - 692.05s | So that if you open a serial connection, you can set it to say, 692.05s - 695.57s | Hey, if anything ever tries to connect to you at 1200 baud, 695.57s - 698.77s | we picked 1337 as our magic baud right now. 698.77s - 703.17s | But if you just hit it with 1337 on a serial terminal, 703.17s - 706.61s | it will automatically fall into boot select mode and reboot, 707.17s - 709.33s | which is wonderful if you want to, you know, 709.33s - 711.25s | speed up your tool chain when you're developing 711.25s - 714.13s | and then just have a script that runs and knocks it in boot select. 717.73s - 718.77s | I bitched quite a bit. 721.97s - 723.65s | So, and there's the final. 723.73s - 723.97s | Yeah. 723.97s - 727.97s | So the big difference, the only difference between REV3 and REV4 was the artwork. 728.53s - 732.45s | And we were actually just shooting without artwork for a really long time. 732.45s - 733.73s | And I was like, you know how we got to do it. 733.73s - 737.25s | Uh, so that was the artwork that we did. 737.25s - 741.25s | Since AI generated, it just kind of left the artifacts in there. 741.25s - 744.37s | So like you see, it says, it said just doom. 745.09s - 748.29s | And so we just kind of left that little easter egg in there. 748.29s - 749.49s | It was funny enough. 749.49s - 749.99s | Yeah. 750.39s - 753.19s | It's actually kind of unfortunate that you can't see, 753.19s - 756.31s | like the clear cases aren't kind of cloudy. 756.31s - 759.59s | You can't actually see how my


chunk_text:
711.25s - 714.13s | and then just have a script that runs and knocks it in boot select. 717.73s - 718.77s | I bitched quite a bit. 721.97s - 723.65s | So, and there's the final. 723.73s - 723.97s | Yeah. 723.97s - 727.97s | So the big difference, the only difference between REV3 and REV4 was the artwork. 728.53s - 732.45s | And we were actually just shooting without artwork for a really long time. 732.45s - 733.73s | And I was like, you know how we got to do it. 733.73s - 737.25s | Uh, so that was the artwork that we did. 737.25s - 741.25s | Since AI generated, it just kind of left the artifacts in there. 741.25s - 744.37s | So like you see, it says, it said just doom. 745.09s - 748.29s | And so we just kind of left that little easter egg in there. 748.29s - 749.49s | It was funny enough. 749.49s - 749.99s | Yeah. 750.39s - 753.19s | It's actually kind of unfortunate that you can't see, 753.19s - 756.31s | like the clear cases aren't kind of cloudy. 756.31s - 759.59s | You can't actually see how my set subscreen actually turned out. 761.59s - 761.99s | True. 761.99s - 762.23s | Yeah. 762.23s - 765.59s | I think if people had the clear PCBs, you can actually see them a lot better. 765.59s - 767.43s | Maybe the black ones, but purple. 767.43s - 768.39s | I grabbed a teeth. 768.39s - 771.51s | I was trying to go with like a Miami Vice color, cyan teal. 771.51s - 773.35s | It blocks the PCB altogether. 773.35s - 775.43s | Maybe I'm sad, but yeah. 776.71s - 779.67s | Um, a lot happened the past couple months. 779.75s - 787.43s | A lot, um, oh yeah, we're full stack. 788.15s - 790.47s | Got random questions to throw them at us. 791.19s - 793.51s | So yeah, that's my excuse. 793.51s - 794.79s | We were looking at the slides. 794.79s - 795.67s | We're about to turn in. 795.67s - 798.31s | I was like, oh shit, we didn't finish those, but you know what? 798.31s - 800.23s | That's good enough for a slide, right? 800.23s - 807.19s | Um, when, when we were talking earlier, you know, it runs doom and sometimes people are


chunk_text:
set subscreen actually turned out. 761.59s - 761.99s | True. 761.99s - 762.23s | Yeah. 762.23s - 765.59s | I think if people had the clear PCBs, you can actually see them a lot better. 765.59s - 767.43s | Maybe the black ones, but purple. 767.43s - 768.39s | I grabbed a teeth. 768.39s - 771.51s | I was trying to go with like a Miami Vice color, cyan teal. 771.51s - 773.35s | It blocks the PCB altogether. 773.35s - 775.43s | Maybe I'm sad, but yeah. 776.71s - 779.67s | Um, a lot happened the past couple months. 779.75s - 787.43s | A lot, um, oh yeah, we're full stack. 788.15s - 790.47s | Got random questions to throw them at us. 791.19s - 793.51s | So yeah, that's my excuse. 793.51s - 794.79s | We were looking at the slides. 794.79s - 795.67s | We're about to turn in. 795.67s - 798.31s | I was like, oh shit, we didn't finish those, but you know what? 798.31s - 800.23s | That's good enough for a slide, right? 800.23s - 807.19s | Um, when, when we were talking earlier, you know, it runs doom and sometimes people are 807.19s - 809.67s | curious, how do you put doom on something? 809.67s - 813.99s | You know, what is really going on when you see doom and, and, and different types of 813.99s - 814.31s | things. 814.31s - 819.91s | And, um, in general, um, you see a bunch of variants of doom out there. 819.91s - 824.87s | You'll hear people refer to vanilla doom, chocolate doom, um, cheesy doom. 824.87s - 827.51s | You get in all these different variants in general. 829.51s - 829.91s | You know what? 830.71s - 831.91s | Vanilla is vanilla. 831.91s - 832.47s | It's plain. 833.11s - 834.47s | It is what it released. 835.03s - 838.87s | And chocolate built on it because you're not going to change what it released. 838.87s - 843.03s | You're, you're going to keep it as close to the original port of doom as possible. 843.03s - 849.03s | Um, with, with some fixes that are necessary, but not changing the original source. 849.67s - 855.03s | And what happens over time is you have all of these forks where people want to play original 855.03s - 857.35s | doom, but they


chunk_text:
807.19s - 809.67s | curious, how do you put doom on something? 809.67s - 813.99s | You know, what is really going on when you see doom and, and, and different types of 813.99s - 814.31s | things. 814.31s - 819.91s | And, um, in general, um, you see a bunch of variants of doom out there. 819.91s - 824.87s | You'll hear people refer to vanilla doom, chocolate doom, um, cheesy doom. 824.87s - 827.51s | You get in all these different variants in general. 829.51s - 829.91s | You know what? 830.71s - 831.91s | Vanilla is vanilla. 831.91s - 832.47s | It's plain. 833.11s - 834.47s | It is what it released. 835.03s - 838.87s | And chocolate built on it because you're not going to change what it released. 838.87s - 843.03s | You're, you're going to keep it as close to the original port of doom as possible. 843.03s - 849.03s | Um, with, with some fixes that are necessary, but not changing the original source. 849.67s - 855.03s | And what happens over time is you have all of these forks where people want to play original 855.03s - 857.35s | doom, but they want it in triple, super widescreen. 857.35s - 861.11s | Um, they don't want sprites that are from six different angles. 861.11s - 863.19s | They want 32 different angles. 863.91s - 867.91s | They start doing what's called limit removing because you have faster computers. 867.91s - 873.83s | So a lot of doom engines out there and wads that are generated out there, uh, they don't 873.83s - 878.95s | work on embedded systems because they assume a lot of power horse hungry stuff. 879.51s - 881.75s | So we went with chocolate doom. 881.75s - 886.79s | Um, there was a variant of chocolate doom that, uh, I believe the hacker's name was 886.79s - 888.31s | kilogram that put it together. 888.31s - 893.59s | He pulled in a lot of fixes that came in on a Nordic NRF, like BMD three 50 mod where 894.87s - 898.95s | back in the day when you'd have doom, doom was very much, um, 901.03s - 903.91s | not, not so processor intensive, Ram intensive. 903.91s - 908.63s | And if you go through the source code and statically allocate your variables, you can 908.63s - 913.19s |


chunk_text:
want it in triple, super widescreen. 857.35s - 861.11s | Um, they don't want sprites that are from six different angles. 861.11s - 863.19s | They want 32 different angles. 863.91s - 867.91s | They start doing what's called limit removing because you have faster computers. 867.91s - 873.83s | So a lot of doom engines out there and wads that are generated out there, uh, they don't 873.83s - 878.95s | work on embedded systems because they assume a lot of power horse hungry stuff. 879.51s - 881.75s | So we went with chocolate doom. 881.75s - 886.79s | Um, there was a variant of chocolate doom that, uh, I believe the hacker's name was 886.79s - 888.31s | kilogram that put it together. 888.31s - 893.59s | He pulled in a lot of fixes that came in on a Nordic NRF, like BMD three 50 mod where 894.87s - 898.95s | back in the day when you'd have doom, doom was very much, um, 901.03s - 903.91s | not, not so processor intensive, Ram intensive. 903.91s - 908.63s | And if you go through the source code and statically allocate your variables, you can 908.63s - 913.19s | shift a lot of that over and shoot through it through processing, which you mentioned, 913.19s - 918.31s | we doubly overclocked the PI Pico at 192 megahertz. 918.31s - 920.07s | I can't remember how many megahertz we're running at. 920.63s - 923.99s | Um, you're just trading processor for Ram. 923.99s - 927.83s | And so you keep building on these techniques and it makes it a really nice way to throw 927.83s - 929.03s | doom on an embedded system. 929.59s - 931.11s | Sometimes I'm sure you see random things. 931.11s - 935.91s | People put doom on a toothbrush on this, on that, and it's just running the demo. 935.91s - 940.23s | Um, if you're actually trying to process a lot of other things, networking stack and, 940.31s - 942.31s | and mega wads, it gets rough. 943.03s - 949.19s | Um, so yeah, something that we saw in that, that, that this person ran into on one of 949.19s - 953.11s | the forks we, we picked up on, you start running out of memory. 953.11s - 957.75s | And the cool thing about doing this is instead of drawing pixels, it's running


chunk_text:
shift a lot of that over and shoot through it through processing, which you mentioned, 913.19s - 918.31s | we doubly overclocked the PI Pico at 192 megahertz. 918.31s - 920.07s | I can't remember how many megahertz we're running at. 920.63s - 923.99s | Um, you're just trading processor for Ram. 923.99s - 927.83s | And so you keep building on these techniques and it makes it a really nice way to throw 927.83s - 929.03s | doom on an embedded system. 929.59s - 931.11s | Sometimes I'm sure you see random things. 931.11s - 935.91s | People put doom on a toothbrush on this, on that, and it's just running the demo. 935.91s - 940.23s | Um, if you're actually trying to process a lot of other things, networking stack and, 940.31s - 942.31s | and mega wads, it gets rough. 943.03s - 949.19s | Um, so yeah, something that we saw in that, that, that this person ran into on one of 949.19s - 953.11s | the forks we, we picked up on, you start running out of memory. 953.11s - 957.75s | And the cool thing about doing this is instead of drawing pixels, it's running with scan 957.75s - 959.67s | lines like you would on a normal CRT. 960.31s - 964.55s | And you'd only have enough memory to draw about 70, 80% of the screen. 964.55s - 969.35s | So with it doing scan line drawing, it's actually a lot more efficient to go through 969.51s - 971.03s | the graphics rendering. 971.03s - 977.11s | And then on the HUD, we just painted a static image on the HUD because we realized one, 977.11s - 979.11s | the screen was too small to even read it. 979.67s - 984.31s | And two, we had needed CTF challenges that actually ran on the badge. 984.31s - 989.51s | So over there, you actually see a certain hex memory address that's printed into the 989.51s - 995.19s | status bar that gets updated during the game, uh, amongst other things. 995.19s - 1000.07s | So it's like we're drawing 70, 80%, drawing a static image, leaving it, and you go through 1000.07s - 1001.67s | little tricks just to keep memory going up. 1002.31s - 1006.79s | Um, but yeah, make sure to member finished, uh, fixing the slide. 1006.79s - 1010.87s | I


chunk_text:
with scan 957.75s - 959.67s | lines like you would on a normal CRT. 960.31s - 964.55s | And you'd only have enough memory to draw about 70, 80% of the screen. 964.55s - 969.35s | So with it doing scan line drawing, it's actually a lot more efficient to go through 969.51s - 971.03s | the graphics rendering. 971.03s - 977.11s | And then on the HUD, we just painted a static image on the HUD because we realized one, 977.11s - 979.11s | the screen was too small to even read it. 979.67s - 984.31s | And two, we had needed CTF challenges that actually ran on the badge. 984.31s - 989.51s | So over there, you actually see a certain hex memory address that's printed into the 989.51s - 995.19s | status bar that gets updated during the game, uh, amongst other things. 995.19s - 1000.07s | So it's like we're drawing 70, 80%, drawing a static image, leaving it, and you go through 1000.07s - 1001.67s | little tricks just to keep memory going up. 1002.31s - 1006.79s | Um, but yeah, make sure to member finished, uh, fixing the slide. 1006.79s - 1010.87s | I think one of the other fun things is just tapping into the API that is used to update 1010.87s - 1015.35s | the status bar, because if you have a badge with bling, why not update it? 1015.35s - 1018.15s | You know, why not turn it red when you're getting shot? 1018.15s - 1022.15s | It's, it's a nice visual indicator for someone who's holding a badge playing doom to see 1022.15s - 1026.87s | it like glowing red as you're getting lit up or, or when you fire, it turns white and 1026.87s - 1029.19s | flashes for, for you shooting. 1029.19s - 1033.03s | Um, and then, you know, you just have like ammo and health kind of going up the rim on 1033.03s - 1033.51s | the side. 1034.71s - 1036.95s | Figure it's a, it's a nice visual HUD. 1036.95s - 1040.71s | I don't think anyone ever paid attention to their health or their ammo count when they 1040.71s - 1041.35s | played doom. 1041.35s - 1044.39s | They just used it till it ran out and then, okay, I'm going to switch to something else 1044.39s - 1045.43s | and fire on them


chunk_text:
think one of the other fun things is just tapping into the API that is used to update 1010.87s - 1015.35s | the status bar, because if you have a badge with bling, why not update it? 1015.35s - 1018.15s | You know, why not turn it red when you're getting shot? 1018.15s - 1022.15s | It's, it's a nice visual indicator for someone who's holding a badge playing doom to see 1022.15s - 1026.87s | it like glowing red as you're getting lit up or, or when you fire, it turns white and 1026.87s - 1029.19s | flashes for, for you shooting. 1029.19s - 1033.03s | Um, and then, you know, you just have like ammo and health kind of going up the rim on 1033.03s - 1033.51s | the side. 1034.71s - 1036.95s | Figure it's a, it's a nice visual HUD. 1036.95s - 1040.71s | I don't think anyone ever paid attention to their health or their ammo count when they 1040.71s - 1041.35s | played doom. 1041.35s - 1044.39s | They just used it till it ran out and then, okay, I'm going to switch to something else 1044.39s - 1045.43s | and fire on them anyway. 1047.75s - 1048.55s | I don't know. 1048.55s - 1052.63s | Any questions about firmware, doom engines, putting doom on stuff before we get into like 1052.63s - 1053.75s | the wads and whatnot? 1053.75s - 1053.91s | Yeah. 1053.91s - 1054.31s | What's up? 1056.23s - 1056.55s | Sorry. 1056.55s - 1057.11s | I can't hear. 1059.03s - 1060.23s | Did we use the PIOs? 1061.03s - 1065.11s | Um, I don't think we did. 1065.83s - 1066.07s | No. 1076.23s - 1076.63s | Sorry. 1077.59s - 1078.87s | I will use it next year. 1081.35s - 1084.79s | So I tried to make this as messy as possible, right? 1095.67s - 1095.91s | Yeah. 1098.07s - 1100.31s | So for the most part, it's good. 1100.31s - 1106.55s | Um, I think a couple of things I would go through is, is this, um, there's a lot 1107.11s - 1111.03s | there's a lot of modders in the doom community and they've made wonderful tools over the 1111.03s - 1111.67s | years. 1111.67s - 1113.99s | Some of those tools are still in use. 1113.99s - 1116.79s | Some of them are being migrated to bigger tools.


chunk_text:
anyway. 1047.75s - 1048.55s | I don't know. 1048.55s - 1052.63s | Any questions about firmware, doom engines, putting doom on stuff before we get into like 1052.63s - 1053.75s | the wads and whatnot? 1053.75s - 1053.91s | Yeah. 1053.91s - 1054.31s | What's up? 1056.23s - 1056.55s | Sorry. 1056.55s - 1057.11s | I can't hear. 1059.03s - 1060.23s | Did we use the PIOs? 1061.03s - 1065.11s | Um, I don't think we did. 1065.83s - 1066.07s | No. 1076.23s - 1076.63s | Sorry. 1077.59s - 1078.87s | I will use it next year. 1081.35s - 1084.79s | So I tried to make this as messy as possible, right? 1095.67s - 1095.91s | Yeah. 1098.07s - 1100.31s | So for the most part, it's good. 1100.31s - 1106.55s | Um, I think a couple of things I would go through is, is this, um, there's a lot 1107.11s - 1111.03s | there's a lot of modders in the doom community and they've made wonderful tools over the 1111.03s - 1111.67s | years. 1111.67s - 1113.99s | Some of those tools are still in use. 1113.99s - 1116.79s | Some of them are being migrated to bigger tools. 1116.79s - 1120.79s | Um, one of them that I was primarily using is Slade. 1121.51s - 1122.95s | Slade is really good. 1122.95s - 1128.79s | If you are making a wad and I guess I should say wad unless people don't know wad stands 1128.79s - 1135.11s | for, where's all the data it's, it's how the ed team use doom to store all of the core 1135.11s - 1136.55s | assets of their game. 1136.55s - 1142.31s | Those assets are referred to as lumps, but where Slade shines is you make wads with it. 1142.31s - 1144.95s | You really don't want to make maps with it too much. 1144.95s - 1147.51s | It has a map editor, but it's not that great. 1147.51s - 1152.39s | Um, there's, there's better tools for like ultimate doom builder to work on maps. 1152.95s - 1158.95s | Um, but what you end up with is a number of things being needed to make that successful. 1158.95s - 1166.39s | So the core I started with was freedom and freedom is free open source doom replacement. 1166.39s - 1170.47s | I know you see a lot of people make


chunk_text:
1116.79s - 1120.79s | Um, one of them that I was primarily using is Slade. 1121.51s - 1122.95s | Slade is really good. 1122.95s - 1128.79s | If you are making a wad and I guess I should say wad unless people don't know wad stands 1128.79s - 1135.11s | for, where's all the data it's, it's how the ed team use doom to store all of the core 1135.11s - 1136.55s | assets of their game. 1136.55s - 1142.31s | Those assets are referred to as lumps, but where Slade shines is you make wads with it. 1142.31s - 1144.95s | You really don't want to make maps with it too much. 1144.95s - 1147.51s | It has a map editor, but it's not that great. 1147.51s - 1152.39s | Um, there's, there's better tools for like ultimate doom builder to work on maps. 1152.95s - 1158.95s | Um, but what you end up with is a number of things being needed to make that successful. 1158.95s - 1166.39s | So the core I started with was freedom and freedom is free open source doom replacement. 1166.39s - 1170.47s | I know you see a lot of people make doom mods and put doom on things. 1170.47s - 1172.71s | The doom engine is open sourced. 1173.67s - 1178.55s | The IP and the graphics and the music and the, all those lumps that are in that doom 1178.55s - 1183.51s | one shareware wad are not, they are copyrighted and protected. 1183.51s - 1189.67s | So freedom is a open source project to, to make a community driven doom alternative where 1189.67s - 1190.79s | you can drop in the wad. 1191.59s - 1196.87s | The first problem with that is they rely on limit removing engines that use all these 1196.87s - 1201.27s | crazy different features and they bundle in doom, doom to hexon. 1201.27s - 1206.23s | So there's a lot of stuff on there that in their one wad that if, if you're doing this 1206.23s - 1207.75s | on your computer, it doesn't matter. 1207.75s - 1212.39s | But if you're putting it on an embedded system where I only have like a wind bond chip, but 1212.39s - 1214.15s | they makes a flash, it's not going to help. 1214.71s - 1221.11s | So we started stripping everything out, changing out different


chunk_text:
doom mods and put doom on things. 1170.47s - 1172.71s | The doom engine is open sourced. 1173.67s - 1178.55s | The IP and the graphics and the music and the, all those lumps that are in that doom 1178.55s - 1183.51s | one shareware wad are not, they are copyrighted and protected. 1183.51s - 1189.67s | So freedom is a open source project to, to make a community driven doom alternative where 1189.67s - 1190.79s | you can drop in the wad. 1191.59s - 1196.87s | The first problem with that is they rely on limit removing engines that use all these 1196.87s - 1201.27s | crazy different features and they bundle in doom, doom to hexon. 1201.27s - 1206.23s | So there's a lot of stuff on there that in their one wad that if, if you're doing this 1206.23s - 1207.75s | on your computer, it doesn't matter. 1207.75s - 1212.39s | But if you're putting it on an embedded system where I only have like a wind bond chip, but 1212.39s - 1214.15s | they makes a flash, it's not going to help. 1214.71s - 1221.11s | So we started stripping everything out, changing out different sprites, different assets, doing 1221.11s - 1221.91s | our own editing. 1223.75s - 1228.47s | Some of the old tools like converting midis to their traditional muse format only run 1228.47s - 1229.03s | in DOS. 1229.03s - 1233.99s | So I'm running like DOS box and Linux to run, write my own bash scripts. 1235.35s - 1237.99s | That's when I learned slate actually had something that did that. 1237.99s - 1241.11s | And I felt stupid for setting up that tool chain, but yeah, whatever. 1242.39s - 1246.71s | And then using like Krita and Inkscape, Photoshop to put my different sprites together that 1246.71s - 1250.71s | I was creating, bundle it all together, bring chocolate doom into VS code. 1252.15s - 1253.67s | Seems messy, goes through. 1254.79s - 1260.87s | I think the only other reason I put the meme on the side is in general, you wouldn't mess 1260.87s - 1263.91s | with the core wad when you work on doom. 1263.91s - 1268.63s | The way doom works is it assumes that core library assets in the wad exist. 1268.63s - 1271.83s | And a wad that you're putting out is really a


chunk_text:
sprites, different assets, doing 1221.11s - 1221.91s | our own editing. 1223.75s - 1228.47s | Some of the old tools like converting midis to their traditional muse format only run 1228.47s - 1229.03s | in DOS. 1229.03s - 1233.99s | So I'm running like DOS box and Linux to run, write my own bash scripts. 1235.35s - 1237.99s | That's when I learned slate actually had something that did that. 1237.99s - 1241.11s | And I felt stupid for setting up that tool chain, but yeah, whatever. 1242.39s - 1246.71s | And then using like Krita and Inkscape, Photoshop to put my different sprites together that 1246.71s - 1250.71s | I was creating, bundle it all together, bring chocolate doom into VS code. 1252.15s - 1253.67s | Seems messy, goes through. 1254.79s - 1260.87s | I think the only other reason I put the meme on the side is in general, you wouldn't mess 1260.87s - 1263.91s | with the core wad when you work on doom. 1263.91s - 1268.63s | The way doom works is it assumes that core library assets in the wad exist. 1268.63s - 1271.83s | And a wad that you're putting out is really a P wad. 1271.83s - 1272.87s | It's considered a patch. 1273.51s - 1278.55s | And when you put different assets in there, it's literally patching it in memory and overriding 1278.55s - 1282.71s | those assets with a subset because it's an embedded system. 1282.71s - 1287.75s | We don't have the luxury of a file system where I can have multiple wads on there. 1287.75s - 1292.55s | So if you were to look on doom wiki or go on some of the doom, like the wad creators 1292.55s - 1294.63s | resources, they will light you up. 1294.63s - 1299.91s | If you're like, I'm making my own I wad because really people should not be making their own 1299.91s - 1300.55s | I wad. 1300.55s - 1301.35s | It's wasteful. 1301.83s - 1305.03s | Unless you have your own, you know, limited source. 1305.91s - 1312.63s | The end result of that is we will be open sourcing a, you know, a fork of free doom 1312.63s - 1319.67s | that maps a full mega wad, one, two, three, with no other doom two or hex and stuff that 1319.67s - 1322.87s | is completely free and


chunk_text:
P wad. 1271.83s - 1272.87s | It's considered a patch. 1273.51s - 1278.55s | And when you put different assets in there, it's literally patching it in memory and overriding 1278.55s - 1282.71s | those assets with a subset because it's an embedded system. 1282.71s - 1287.75s | We don't have the luxury of a file system where I can have multiple wads on there. 1287.75s - 1292.55s | So if you were to look on doom wiki or go on some of the doom, like the wad creators 1292.55s - 1294.63s | resources, they will light you up. 1294.63s - 1299.91s | If you're like, I'm making my own I wad because really people should not be making their own 1299.91s - 1300.55s | I wad. 1300.55s - 1301.35s | It's wasteful. 1301.83s - 1305.03s | Unless you have your own, you know, limited source. 1305.91s - 1312.63s | The end result of that is we will be open sourcing a, you know, a fork of free doom 1312.63s - 1319.67s | that maps a full mega wad, one, two, three, with no other doom two or hex and stuff that 1319.67s - 1322.87s | is completely free and open source and slimmed down. 1322.87s - 1324.47s | So it's great for embedded systems. 1327.35s - 1328.47s | Oh, that's backwards. 1329.03s - 1333.83s | And I pretty much mentioned that, you know, there's what does it look like when you when 1333.83s - 1335.35s | you're actually editing wads? 1335.35s - 1337.03s | It's like a memory editor. 1337.03s - 1339.51s | You know, it may look like a spreadsheet or a database. 1339.51s - 1344.23s | But if you even sort things, people sometimes forget that there's memory mappings of memory 1344.23s - 1344.87s | addressings. 1344.87s - 1349.67s | And if you just copy paste stuff in, you can you can really screw up your doom engine and 1349.67s - 1352.15s | doom game just by putting things wrong in a wad. 1353.43s - 1357.67s | And it makes it fun for hiding things in CTS because it's like a giant zip file. 1357.67s - 1362.31s | I can pad stuff in certain memory locations that, you know, I'm trying to get people to 1362.31s - 1367.11s | dump ROMs, dump, dig through the source code, dump the wads and look for things that we've 1367.11s


chunk_text:
open source and slimmed down. 1322.87s - 1324.47s | So it's great for embedded systems. 1327.35s - 1328.47s | Oh, that's backwards. 1329.03s - 1333.83s | And I pretty much mentioned that, you know, there's what does it look like when you when 1333.83s - 1335.35s | you're actually editing wads? 1335.35s - 1337.03s | It's like a memory editor. 1337.03s - 1339.51s | You know, it may look like a spreadsheet or a database. 1339.51s - 1344.23s | But if you even sort things, people sometimes forget that there's memory mappings of memory 1344.23s - 1344.87s | addressings. 1344.87s - 1349.67s | And if you just copy paste stuff in, you can you can really screw up your doom engine and 1349.67s - 1352.15s | doom game just by putting things wrong in a wad. 1353.43s - 1357.67s | And it makes it fun for hiding things in CTS because it's like a giant zip file. 1357.67s - 1362.31s | I can pad stuff in certain memory locations that, you know, I'm trying to get people to 1362.31s - 1367.11s | dump ROMs, dump, dig through the source code, dump the wads and look for things that we've 1367.11s - 1367.91s | hidden on the side. 1369.83s - 1376.07s | I'm about done with the wads, but I would say the only fun I had is the most fun I had 1376.07s - 1379.51s | was you look at how assets are made. 1379.51s - 1383.83s | A lot of people will like open up Blender, you know, take a 3D model, rotate it, take 1383.83s - 1384.79s | slices. 1384.79s - 1388.63s | I wanted to make our own rubber chicken weapons, and it's kind of stupid. 1388.63s - 1393.03s | But, you know, you got a toilet paper tube, some rubber bands and rubber chickens, record 1393.03s - 1395.43s | a video and then takes time slices. 1395.43s - 1398.63s | And that turns into what I used in the game. 1403.11s - 1407.67s | And I have to explain to my wife why I'm like punching rubber chickens in the wall, recording 1407.67s - 1408.07s | myself. 1408.07s - 1409.19s | And I'm like, it's for DEF CON. 1409.19s - 1409.99s | It'll make sense. 1409.99s - 1410.47s | Trust me. 1411.99s - 1413.19s | You should all try this. 1413.19s - 1414.31s | It's actually


chunk_text:
- 1367.91s | hidden on the side. 1369.83s - 1376.07s | I'm about done with the wads, but I would say the only fun I had is the most fun I had 1376.07s - 1379.51s | was you look at how assets are made. 1379.51s - 1383.83s | A lot of people will like open up Blender, you know, take a 3D model, rotate it, take 1383.83s - 1384.79s | slices. 1384.79s - 1388.63s | I wanted to make our own rubber chicken weapons, and it's kind of stupid. 1388.63s - 1393.03s | But, you know, you got a toilet paper tube, some rubber bands and rubber chickens, record 1393.03s - 1395.43s | a video and then takes time slices. 1395.43s - 1398.63s | And that turns into what I used in the game. 1403.11s - 1407.67s | And I have to explain to my wife why I'm like punching rubber chickens in the wall, recording 1407.67s - 1408.07s | myself. 1408.07s - 1409.19s | And I'm like, it's for DEF CON. 1409.19s - 1409.99s | It'll make sense. 1409.99s - 1410.47s | Trust me. 1411.99s - 1413.19s | You should all try this. 1413.19s - 1414.31s | It's actually super fun. 1414.47s - 1416.87s | I know people like, oh, you know, I want to make my own DOOM wad. 1416.87s - 1421.03s | I'm like, take something and just record your hand punching and I don't know. 1421.03s - 1424.95s | I thought it was kind of fun just to try to do my own reverse stop motion on things. 1429.11s - 1432.07s | Without dragging it out further, because we want to get some more of the snacky stuff, 1433.03s - 1438.95s | whether you're following us on Twitter or hearing us gripe, we were releasing something 1438.95s - 1440.23s | like, yeah, we fucked up. 1440.79s - 1445.19s | Um, normally I'd say a different version or different way to tell what we were talking 1445.19s - 1449.75s | about was we're usually pretty good about setting a hard date. 1449.75s - 1453.51s | And it's usually like it was around when we would buy tickets for Derby Con. 1453.51s - 1455.83s | It would be during the Kentucky Derby, like the first week of May. 1455.83s - 1457.43s | And that's when we would submit our order. 1458.79s - 1460.23s | We feature creeped ourselves.


chunk_text:
super fun. 1414.47s - 1416.87s | I know people like, oh, you know, I want to make my own DOOM wad. 1416.87s - 1421.03s | I'm like, take something and just record your hand punching and I don't know. 1421.03s - 1424.95s | I thought it was kind of fun just to try to do my own reverse stop motion on things. 1429.11s - 1432.07s | Without dragging it out further, because we want to get some more of the snacky stuff, 1433.03s - 1438.95s | whether you're following us on Twitter or hearing us gripe, we were releasing something 1438.95s - 1440.23s | like, yeah, we fucked up. 1440.79s - 1445.19s | Um, normally I'd say a different version or different way to tell what we were talking 1445.19s - 1449.75s | about was we're usually pretty good about setting a hard date. 1449.75s - 1453.51s | And it's usually like it was around when we would buy tickets for Derby Con. 1453.51s - 1455.83s | It would be during the Kentucky Derby, like the first week of May. 1455.83s - 1457.43s | And that's when we would submit our order. 1458.79s - 1460.23s | We feature creeped ourselves. 1460.23s - 1463.99s | Some things fell behind schedule, but we always have plenty of slack and times. 1464.71s - 1469.99s | And without going through the exhausted list, you have a couple of hurricanes hit. 1470.31s - 1471.91s | You have different things pop up. 1471.91s - 1473.51s | It kept eating into our slack. 1473.51s - 1477.35s | And if we hadn't feature creeped ourselves, I know those things are out of control. 1477.35s - 1483.75s | But, um, the end result is when the big problems happen, like it went to our fab and they sent 1483.75s - 1489.43s | us pictures early in the morning showing that, Hey, you have an eight pad thing for LEDs. 1490.23s - 1493.35s | And we have six on the LEDs. 1493.35s - 1495.03s | You know, you have the complete wrong part. 1496.47s - 1498.39s | This was the morning CrowdStrike happens. 1500.47s - 1505.83s | Try to source LEDs and overnight them to a fab when all air traffic's been grounded, except 1505.83s - 1508.47s | for UPS or USPS. 1508.47s - 1511.99s | We use the postal service and it gets delivered to the wrong city three


chunk_text:
1460.23s - 1463.99s | Some things fell behind schedule, but we always have plenty of slack and times. 1464.71s - 1469.99s | And without going through the exhausted list, you have a couple of hurricanes hit. 1470.31s - 1471.91s | You have different things pop up. 1471.91s - 1473.51s | It kept eating into our slack. 1473.51s - 1477.35s | And if we hadn't feature creeped ourselves, I know those things are out of control. 1477.35s - 1483.75s | But, um, the end result is when the big problems happen, like it went to our fab and they sent 1483.75s - 1489.43s | us pictures early in the morning showing that, Hey, you have an eight pad thing for LEDs. 1490.23s - 1493.35s | And we have six on the LEDs. 1493.35s - 1495.03s | You know, you have the complete wrong part. 1496.47s - 1498.39s | This was the morning CrowdStrike happens. 1500.47s - 1505.83s | Try to source LEDs and overnight them to a fab when all air traffic's been grounded, except 1505.83s - 1508.47s | for UPS or USPS. 1508.47s - 1511.99s | We use the postal service and it gets delivered to the wrong city three hours away. 1513.67s - 1520.39s | So, yeah, we've spent the better part of the past two weeks, 20 hour days late at work 1520.39s - 1529.03s | on third shifts, in hotel rooms, in garages, reflowing, hot airing, hand soldering, 14,000 1529.03s - 1529.53s | LEDs. 1531.43s - 1532.63s | I think we got a pretty good deal. 1536.07s - 1539.59s | So the tail end of some of the badges we were vending, they have little yellow dots. 1539.59s - 1544.63s | We did our hardest, but I think about the last hundred or so, um, they would have one 1544.63s - 1547.19s | to many LEDs working. 1547.19s - 1552.39s | You know, some of them had like all of them, but one in the top corner, or maybe half of 1552.39s - 1554.63s | them were out because the thing just got cooked. 1554.63s - 1556.79s | And we figured it plays doom. 1556.79s - 1558.07s | It still blinks a little bit. 1558.07s - 1559.59s | People would still rather have them. 1567.91s - 1570.39s | Yeah, we're, we're going to bring all our spare parts tomorrow. 1571.11s - 1575.35s | If you want to


chunk_text:
hours away. 1513.67s - 1520.39s | So, yeah, we've spent the better part of the past two weeks, 20 hour days late at work 1520.39s - 1529.03s | on third shifts, in hotel rooms, in garages, reflowing, hot airing, hand soldering, 14,000 1529.03s - 1529.53s | LEDs. 1531.43s - 1532.63s | I think we got a pretty good deal. 1536.07s - 1539.59s | So the tail end of some of the badges we were vending, they have little yellow dots. 1539.59s - 1544.63s | We did our hardest, but I think about the last hundred or so, um, they would have one 1544.63s - 1547.19s | to many LEDs working. 1547.19s - 1552.39s | You know, some of them had like all of them, but one in the top corner, or maybe half of 1552.39s - 1554.63s | them were out because the thing just got cooked. 1554.63s - 1556.79s | And we figured it plays doom. 1556.79s - 1558.07s | It still blinks a little bit. 1558.07s - 1559.59s | People would still rather have them. 1567.91s - 1570.39s | Yeah, we're, we're going to bring all our spare parts tomorrow. 1571.11s - 1575.35s | If you want to do like kind of a ad hoc workshop, we'll bring all the parts, all the failed 1575.35s - 1575.67s | boards. 1575.67s - 1578.55s | We'll show them to people and be like, do you want to have your hand at assembling one 1578.55s - 1579.19s | of these boards? 1579.19s - 1581.59s | You know, assembling everything into a Game Boy case. 1582.15s - 1583.35s | You think you can fix it? 1583.35s - 1584.07s | You can have it. 1584.07s - 1585.35s | Try your, try your best. 1587.03s - 1587.91s | We'll do that tomorrow. 1588.23s - 1588.39s | Yeah. 1591.11s - 1593.03s | Um, yeah. 1593.03s - 1598.63s | Other than that, I, I, I pretty much summed it up after that, where, uh, things just kept 1598.63s - 1600.07s | getting more saddled. 1600.07s - 1603.51s | What was there anything else funny that happened in that whole debacle? 1604.39s - 1605.99s | Self-deprecating in that sense. 1607.75s - 1610.79s | Like how many miles the LEDs traveled. 1614.15s - 1614.65s | Yeah. 1615.61s - 1622.25s | I know we, I wish we had the actual numbers because he's thinking about the, the, they 1622.25s


chunk_text:
do like kind of a ad hoc workshop, we'll bring all the parts, all the failed 1575.35s - 1575.67s | boards. 1575.67s - 1578.55s | We'll show them to people and be like, do you want to have your hand at assembling one 1578.55s - 1579.19s | of these boards? 1579.19s - 1581.59s | You know, assembling everything into a Game Boy case. 1582.15s - 1583.35s | You think you can fix it? 1583.35s - 1584.07s | You can have it. 1584.07s - 1585.35s | Try your, try your best. 1587.03s - 1587.91s | We'll do that tomorrow. 1588.23s - 1588.39s | Yeah. 1591.11s - 1593.03s | Um, yeah. 1593.03s - 1598.63s | Other than that, I, I, I pretty much summed it up after that, where, uh, things just kept 1598.63s - 1600.07s | getting more saddled. 1600.07s - 1603.51s | What was there anything else funny that happened in that whole debacle? 1604.39s - 1605.99s | Self-deprecating in that sense. 1607.75s - 1610.79s | Like how many miles the LEDs traveled. 1614.15s - 1614.65s | Yeah. 1615.61s - 1622.25s | I know we, I wish we had the actual numbers because he's thinking about the, the, they 1622.25s - 1625.13s | come from Taiwan, went to San Dimas. 1625.13s - 1629.37s | They went from San Dimas to Houston and then from Houston to Dallas. 1629.93s - 1631.77s | They found out they were wrong in Dallas. 1632.49s - 1636.09s | And then we had to do a split order where more were coming from Taiwan. 1636.09s - 1639.13s | And another order was coming from Sam Dimas, but it didn't go to Dallas. 1639.13s - 1640.09s | It went to Houston. 1640.09s - 1644.41s | And the one that was leaving Taiwan, there was a typhoon and they grounded all DHL. 1644.41s - 1646.73s | I forgot about the typhoon weather. 1646.73s - 1647.45s | Isn't our friend. 1648.57s - 1651.21s | So you're getting five international trips. 1651.21s - 1656.01s | Then they all come back to California, then back to Houston and then driven to Las Vegas. 1658.09s - 1660.25s | They've gotten like 30,000 miles on them at least. 1666.01s - 1666.49s | Oh yeah. 1666.49s - 1669.05s | Everything on that end goes through Louisville, Kentucky. 1669.05s - 1673.45s | And because of the tornadoes in Louisville a week and a half ago


chunk_text:
- 1625.13s | come from Taiwan, went to San Dimas. 1625.13s - 1629.37s | They went from San Dimas to Houston and then from Houston to Dallas. 1629.93s - 1631.77s | They found out they were wrong in Dallas. 1632.49s - 1636.09s | And then we had to do a split order where more were coming from Taiwan. 1636.09s - 1639.13s | And another order was coming from Sam Dimas, but it didn't go to Dallas. 1639.13s - 1640.09s | It went to Houston. 1640.09s - 1644.41s | And the one that was leaving Taiwan, there was a typhoon and they grounded all DHL. 1644.41s - 1646.73s | I forgot about the typhoon weather. 1646.73s - 1647.45s | Isn't our friend. 1648.57s - 1651.21s | So you're getting five international trips. 1651.21s - 1656.01s | Then they all come back to California, then back to Houston and then driven to Las Vegas. 1658.09s - 1660.25s | They've gotten like 30,000 miles on them at least. 1666.01s - 1666.49s | Oh yeah. 1666.49s - 1669.05s | Everything on that end goes through Louisville, Kentucky. 1669.05s - 1673.45s | And because of the tornadoes in Louisville a week and a half ago that got shut down and 1673.45s - 1675.69s | things were put on hold at the district center. 1683.69s - 1691.85s | Yeah, you know, different version of that because we're all here at the LBCC this year 1691.85s - 1696.17s | and whether you're, you're attending as a human or you, you know, you volunteer as a 1696.17s - 1702.89s | goon or you're in a contest area or a village, there's a lot going on when you're in a new 1702.89s - 1703.37s | area. 1703.37s - 1707.45s | Like, you know, we're all trying to fill it out and learn, learn the ropes and new things. 1707.45s - 1710.89s | And every now and then, you know, everyone's doing different projects and contests and 1710.89s - 1711.13s | stuff. 1711.13s - 1712.97s | And we all run into issues. 1712.97s - 1715.61s | You know, we had some issues with LEDs this year. 1715.61s - 1719.13s | We were joking about how we had such issues with SD cards in the past. 1719.13s - 1724.09s | And, you know, people run into technical problems left and right. 1724.09s - 1725.37s | And that's okay. 1725.93s - 1730.41s


chunk_text:
that got shut down and 1673.45s - 1675.69s | things were put on hold at the district center. 1683.69s - 1691.85s | Yeah, you know, different version of that because we're all here at the LBCC this year 1691.85s - 1696.17s | and whether you're, you're attending as a human or you, you know, you volunteer as a 1696.17s - 1702.89s | goon or you're in a contest area or a village, there's a lot going on when you're in a new 1702.89s - 1703.37s | area. 1703.37s - 1707.45s | Like, you know, we're all trying to fill it out and learn, learn the ropes and new things. 1707.45s - 1710.89s | And every now and then, you know, everyone's doing different projects and contests and 1710.89s - 1711.13s | stuff. 1711.13s - 1712.97s | And we all run into issues. 1712.97s - 1715.61s | You know, we had some issues with LEDs this year. 1715.61s - 1719.13s | We were joking about how we had such issues with SD cards in the past. 1719.13s - 1724.09s | And, you know, people run into technical problems left and right. 1724.09s - 1725.37s | And that's okay. 1725.93s - 1730.41s | I think what, what matters is just trying to persevere through it and realize, hey, 1731.05s - 1732.33s | we're all human. 1732.33s - 1733.61s | Nothing's perfect. 1733.61s - 1737.29s | You know, be compassionate and generous towards folks and support them. 1737.29s - 1738.97s | And maybe you can come. 1738.97s - 1743.21s | We had friends that never used hot air before. 1743.21s - 1746.65s | And they're like, hell yeah, I want to learn to hot air something or reflow something. 1746.65s - 1747.37s | I want to take that. 1747.37s - 1748.89s | And I think that's awesome. 1748.89s - 1753.21s | We have people that never picked up a soldering iron or anything before. 1753.21s - 1757.37s | We taught them how to use technology and send it in a garage. 1757.93s - 1763.53s | But it's really like, how do you make your problems up? 1766.89s - 1768.01s | This is interesting. 1768.01s - 1769.05s | I never want to hear that again. 1769.05s - 1773.61s | But it's a good trigger. 1775.21s - 1778.49s | It's making the best decision at the time and making sure it's not a rash decision.


chunk_text:
| I think what, what matters is just trying to persevere through it and realize, hey, 1731.05s - 1732.33s | we're all human. 1732.33s - 1733.61s | Nothing's perfect. 1733.61s - 1737.29s | You know, be compassionate and generous towards folks and support them. 1737.29s - 1738.97s | And maybe you can come. 1738.97s - 1743.21s | We had friends that never used hot air before. 1743.21s - 1746.65s | And they're like, hell yeah, I want to learn to hot air something or reflow something. 1746.65s - 1747.37s | I want to take that. 1747.37s - 1748.89s | And I think that's awesome. 1748.89s - 1753.21s | We have people that never picked up a soldering iron or anything before. 1753.21s - 1757.37s | We taught them how to use technology and send it in a garage. 1757.93s - 1763.53s | But it's really like, how do you make your problems up? 1766.89s - 1768.01s | This is interesting. 1768.01s - 1769.05s | I never want to hear that again. 1769.05s - 1773.61s | But it's a good trigger. 1775.21s - 1778.49s | It's making the best decision at the time and making sure it's not a rash decision. 1779.45s - 1781.13s | So take some time. 1781.13s - 1782.73s | Think about all the options. 1782.73s - 1783.77s | Pick which is the best one. 1783.77s - 1785.77s | It might be the wrong one down the road. 1786.49s - 1787.93s | There's lots on this field. 1788.65s - 1791.05s | But at the time, the best decision. 1791.05s - 1793.77s | You can't look back. 1793.77s - 1796.97s | You can't beat yourself up at the time you made the best decision. 1796.97s - 1797.21s | Yeah. 1798.01s - 1800.57s | But yeah, I think that's the best way to put it. 1801.69s - 1804.09s | So this is where it's more fun. 1804.09s - 1804.65s | Snacky. 1805.37s - 1805.69s | Down. 1807.29s - 1807.85s | Down button. 1808.81s - 1809.13s | Yeah. 1811.69s - 1814.33s | Our CTF centers are snatching. 1817.45s - 1820.17s | Used to be a FSI model. 1820.17s - 1821.05s | I think that's 31. 1821.05s - 1821.61s | 59. 1821.61s - 1823.21s | Clearly read it without my glasses on. 1823.77s - 1825.05s | Redemption Snack Machine. 1825.77s - 1829.93s | I picked it up from a KUKA shop that


chunk_text:
1779.45s - 1781.13s | So take some time. 1781.13s - 1782.73s | Think about all the options. 1782.73s - 1783.77s | Pick which is the best one. 1783.77s - 1785.77s | It might be the wrong one down the road. 1786.49s - 1787.93s | There's lots on this field. 1788.65s - 1791.05s | But at the time, the best decision. 1791.05s - 1793.77s | You can't look back. 1793.77s - 1796.97s | You can't beat yourself up at the time you made the best decision. 1796.97s - 1797.21s | Yeah. 1798.01s - 1800.57s | But yeah, I think that's the best way to put it. 1801.69s - 1804.09s | So this is where it's more fun. 1804.09s - 1804.65s | Snacky. 1805.37s - 1805.69s | Down. 1807.29s - 1807.85s | Down button. 1808.81s - 1809.13s | Yeah. 1811.69s - 1814.33s | Our CTF centers are snatching. 1817.45s - 1820.17s | Used to be a FSI model. 1820.17s - 1821.05s | I think that's 31. 1821.05s - 1821.61s | 59. 1821.61s - 1823.21s | Clearly read it without my glasses on. 1823.77s - 1825.05s | Redemption Snack Machine. 1825.77s - 1829.93s | I picked it up from a KUKA shop that was closing down in Houston, Texas. 1830.49s - 1832.41s | And it had the image of it. 1836.41s - 1837.37s | So the first thing was... 1838.25s - 1841.05s | I ate the candy from the head shop of the old vending machine. 1841.05s - 1841.29s | Yes. 1844.25s - 1848.49s | You can see it's on my little tiny 4x8 trailer there. 1848.49s - 1851.37s | And imagine driving that down the road at 60 miles an hour. 1855.37s - 1855.93s | But it's mine. 1855.93s - 1856.41s | It's mine. 1857.77s - 1860.73s | So first, we're trying to figure out how the snack machine works. 1861.45s - 1865.61s | So what's interesting about snack machines or any kind of redemption technology, 1866.41s - 1868.73s | there's not a lot of information out there about it. 1868.73s - 1873.13s | The companies that build these things aren't very tight on what information exists. 1874.41s - 1877.85s | You wouldn't be like, hey, I have an exploit on this machine. 1877.85s - 1878.97s | You'd be like, we'll see. 1878.97s - 1881.69s | It's like, take that advice. 1881.69s - 1888.57s | So anyways, so we basically have to


chunk_text:
was closing down in Houston, Texas. 1830.49s - 1832.41s | And it had the image of it. 1836.41s - 1837.37s | So the first thing was... 1838.25s - 1841.05s | I ate the candy from the head shop of the old vending machine. 1841.05s - 1841.29s | Yes. 1844.25s - 1848.49s | You can see it's on my little tiny 4x8 trailer there. 1848.49s - 1851.37s | And imagine driving that down the road at 60 miles an hour. 1855.37s - 1855.93s | But it's mine. 1855.93s - 1856.41s | It's mine. 1857.77s - 1860.73s | So first, we're trying to figure out how the snack machine works. 1861.45s - 1865.61s | So what's interesting about snack machines or any kind of redemption technology, 1866.41s - 1868.73s | there's not a lot of information out there about it. 1868.73s - 1873.13s | The companies that build these things aren't very tight on what information exists. 1874.41s - 1877.85s | You wouldn't be like, hey, I have an exploit on this machine. 1877.85s - 1878.97s | You'd be like, we'll see. 1878.97s - 1881.69s | It's like, take that advice. 1881.69s - 1888.57s | So anyways, so we basically have to reverse engineer how this one particular snack machine 1888.57s - 1888.81s | works. 1889.85s - 1896.65s | So the original board there, it uses a bunch of custom ASICs and a bunch of logic. 1897.29s - 1901.61s | And the upper right part is the whole power subsystem. 1902.41s - 1904.49s | It has a speaker on it for some reason. 1904.49s - 1905.37s | It never makes noise. 1908.81s - 1912.09s | And I come to this one part of the circuit. 1912.09s - 1913.29s | I wish I could find this guy. 1914.81s - 1920.73s | My idea was basically to take out the custom ASIC, plug it into my controller subsystem, 1920.73s - 1922.25s | and change the controls on this logic. 1922.81s - 1925.29s | But one of the logic chips is an inverter chip. 1925.29s - 1927.93s | It's a 3D channel inverter. 1927.93s - 1929.69s | And it would just loop into itself. 1929.69s - 1932.09s | And I'm like, I have no idea what that's going to do. 1932.09s - 1934.01s | So I was like, well, we're going to find out one way. 1934.01s - 1935.53s | We've got to figure out


chunk_text:
reverse engineer how this one particular snack machine 1888.57s - 1888.81s | works. 1889.85s - 1896.65s | So the original board there, it uses a bunch of custom ASICs and a bunch of logic. 1897.29s - 1901.61s | And the upper right part is the whole power subsystem. 1902.41s - 1904.49s | It has a speaker on it for some reason. 1904.49s - 1905.37s | It never makes noise. 1908.81s - 1912.09s | And I come to this one part of the circuit. 1912.09s - 1913.29s | I wish I could find this guy. 1914.81s - 1920.73s | My idea was basically to take out the custom ASIC, plug it into my controller subsystem, 1920.73s - 1922.25s | and change the controls on this logic. 1922.81s - 1925.29s | But one of the logic chips is an inverter chip. 1925.29s - 1927.93s | It's a 3D channel inverter. 1927.93s - 1929.69s | And it would just loop into itself. 1929.69s - 1932.09s | And I'm like, I have no idea what that's going to do. 1932.09s - 1934.01s | So I was like, well, we're going to find out one way. 1934.01s - 1935.53s | We've got to figure out how motors work now. 1936.17s - 1940.97s | So how these motors work is they have a DC motor matrix. 1940.97s - 1946.73s | So high side, low side, and then they have a switch on it. 1946.73s - 1949.93s | You would think the switch is there to let you know you can rotate it once. 1949.93s - 1951.69s | Like a feedback, you have a limit switch. 1952.33s - 1953.13s | That's not the case. 1954.01s - 1956.41s | It actually rotates when it hits the switch. 1956.41s - 1958.89s | It actually increases the amount of current. 1958.89s - 1960.73s | It's just increases the amount of current. 1960.73s - 1963.05s | It's like a resistor there. 1963.05s - 1968.89s | And so the logic board is actually just looking for these current pulses on the motors. 1969.85s - 1980.97s | So basically, so this is, I'll talk more about that motor thing when it comes to 40. 1980.97s - 1985.61s | But this is also like reverse engineering how the rest of the stack machine works. 1985.61s - 1987.05s | Like how does the keypad work? 1987.05s - 1988.73s | How does the display work? 1988.73s


chunk_text:
how motors work now. 1936.17s - 1940.97s | So how these motors work is they have a DC motor matrix. 1940.97s - 1946.73s | So high side, low side, and then they have a switch on it. 1946.73s - 1949.93s | You would think the switch is there to let you know you can rotate it once. 1949.93s - 1951.69s | Like a feedback, you have a limit switch. 1952.33s - 1953.13s | That's not the case. 1954.01s - 1956.41s | It actually rotates when it hits the switch. 1956.41s - 1958.89s | It actually increases the amount of current. 1958.89s - 1960.73s | It's just increases the amount of current. 1960.73s - 1963.05s | It's like a resistor there. 1963.05s - 1968.89s | And so the logic board is actually just looking for these current pulses on the motors. 1969.85s - 1980.97s | So basically, so this is, I'll talk more about that motor thing when it comes to 40. 1980.97s - 1985.61s | But this is also like reverse engineering how the rest of the stack machine works. 1985.61s - 1987.05s | Like how does the keypad work? 1987.05s - 1988.73s | How does the display work? 1988.73s - 1989.53s | And all that stuff. 1989.53s - 1991.05s | So you can see my laptop there. 1991.05s - 1993.61s | And it's like connected to an Arduino. 1993.61s - 1996.09s | And it's like zip tied to the side of the machine. 1996.73s - 1998.33s | And then we put casters on it. 1998.41s - 2001.29s | Because moving a 800 pound machine, it's really hard by yourself. 2002.41s - 2004.57s | That's the best design decision on Snacky. 2006.89s - 2010.01s | If you think about taking something big and heavy to DEF CON, 2010.57s - 2015.53s | you don't want to drag it, put it on a pallet, or like have six people puff it around. 2016.73s - 2019.05s | Well, I had to put it on a trailer by myself. 2019.77s - 2021.93s | And I was like, I'm not doing that. 2021.93s - 2028.73s | What's interesting is the legs of the stack machine is a standard for casters. 2028.73s - 2032.09s | So I was like, oh, I actually want the legs of that machine. 2035.37s - 2038.17s | Oh, we should have had the receipt corrector. 2038.17s - 2041.61s | This was


chunk_text:
- 1989.53s | And all that stuff. 1989.53s - 1991.05s | So you can see my laptop there. 1991.05s - 1993.61s | And it's like connected to an Arduino. 1993.61s - 1996.09s | And it's like zip tied to the side of the machine. 1996.73s - 1998.33s | And then we put casters on it. 1998.41s - 2001.29s | Because moving a 800 pound machine, it's really hard by yourself. 2002.41s - 2004.57s | That's the best design decision on Snacky. 2006.89s - 2010.01s | If you think about taking something big and heavy to DEF CON, 2010.57s - 2015.53s | you don't want to drag it, put it on a pallet, or like have six people puff it around. 2016.73s - 2019.05s | Well, I had to put it on a trailer by myself. 2019.77s - 2021.93s | And I was like, I'm not doing that. 2021.93s - 2028.73s | What's interesting is the legs of the stack machine is a standard for casters. 2028.73s - 2032.09s | So I was like, oh, I actually want the legs of that machine. 2035.37s - 2038.17s | Oh, we should have had the receipt corrector. 2038.17s - 2041.61s | This was like when I was trying to figure out how to make it work. 2042.25s - 2047.45s | And we wanted like, this is what we're trying to make it like more of a standalone machine. 2048.09s - 2049.69s | We didn't have a contest at the time. 2050.33s - 2054.25s | And so everything had to be like, be oscurated, be robust. 2054.25s - 2055.69s | And so we're trying to do stuff like this. 2055.69s - 2058.01s | We don't want the receipt corrector to just sit off to the side. 2058.01s - 2058.97s | We need to build it in. 2059.77s - 2062.01s | So this is a, I can't remember the model. 2062.01s - 2064.65s | It was a TS thermal printer. 2064.65s - 2066.97s | But we bought it on eBay. 2066.97s - 2068.41s | And it was like $200. 2069.53s - 2071.77s | They had to buy it now, like they offered. 2071.77s - 2074.33s | They offered $69, and we accepted it. 2074.81s - 2078.01s | So here's the custom board. 2078.01s - 2082.65s | So they're basically reverse engineering how all the peripherals in the machine works. 2082.65s - 2087.13s | We basically


chunk_text:
like when I was trying to figure out how to make it work. 2042.25s - 2047.45s | And we wanted like, this is what we're trying to make it like more of a standalone machine. 2048.09s - 2049.69s | We didn't have a contest at the time. 2050.33s - 2054.25s | And so everything had to be like, be oscurated, be robust. 2054.25s - 2055.69s | And so we're trying to do stuff like this. 2055.69s - 2058.01s | We don't want the receipt corrector to just sit off to the side. 2058.01s - 2058.97s | We need to build it in. 2059.77s - 2062.01s | So this is a, I can't remember the model. 2062.01s - 2064.65s | It was a TS thermal printer. 2064.65s - 2066.97s | But we bought it on eBay. 2066.97s - 2068.41s | And it was like $200. 2069.53s - 2071.77s | They had to buy it now, like they offered. 2071.77s - 2074.33s | They offered $69, and we accepted it. 2074.81s - 2078.01s | So here's the custom board. 2078.01s - 2082.65s | So they're basically reverse engineering how all the peripherals in the machine works. 2082.65s - 2087.13s | We basically built this circuit board to control that circuit. 2087.13s - 2092.09s | All those, it's called the motors. 2092.09s - 2097.85s | And so it uses two Arduino Vegas. 2097.85s - 2102.09s | Because at the time, the world supply chain was in crisis. 2102.33s - 2105.77s | I had two Arduino Vegas in my drawer, which is what we used. 2106.81s - 2111.21s | And I just made some use of all the little parts I had for more computer machines and 2111.21s - 2111.77s | that kind of stuff. 2113.69s - 2120.17s | Left side, you can see the computer in the middle is like, it's called like the cache 2120.17s - 2124.73s | area of the machine, where all the components and stuff are stored. 2124.73s - 2127.37s | So that's where we export all our custom electronics. 2127.37s - 2129.69s | So you can see where the boards are stacked. 2129.69s - 2131.77s | They actually use the same part, which is the printer. 2131.77s - 2137.93s | So it's like they snapped into the original screw boxes in there. 2138.65s - 2140.81s | And then we have a big power supply. 2141.69s - 2143.61s |


chunk_text:
built this circuit board to control that circuit. 2087.13s - 2092.09s | All those, it's called the motors. 2092.09s - 2097.85s | And so it uses two Arduino Vegas. 2097.85s - 2102.09s | Because at the time, the world supply chain was in crisis. 2102.33s - 2105.77s | I had two Arduino Vegas in my drawer, which is what we used. 2106.81s - 2111.21s | And I just made some use of all the little parts I had for more computer machines and 2111.21s - 2111.77s | that kind of stuff. 2113.69s - 2120.17s | Left side, you can see the computer in the middle is like, it's called like the cache 2120.17s - 2124.73s | area of the machine, where all the components and stuff are stored. 2124.73s - 2127.37s | So that's where we export all our custom electronics. 2127.37s - 2129.69s | So you can see where the boards are stacked. 2129.69s - 2131.77s | They actually use the same part, which is the printer. 2131.77s - 2137.93s | So it's like they snapped into the original screw boxes in there. 2138.65s - 2140.81s | And then we have a big power supply. 2141.69s - 2143.61s | That's the big silver box. 2143.61s - 2146.33s | We wanted to put lots and lots and lots of electronics. 2148.17s - 2151.05s | We kind of modified the pointer turn. 2151.05s - 2152.41s | That's our enter button. 2152.41s - 2154.73s | Just click to switch on that. 2154.73s - 2159.53s | And then the right side is like when I finally got the whole thing brought up. 2160.01s - 2163.13s | So it's kind of our hello world for stacking. 2164.49s - 2165.37s | Any questions so far? 2178.04s - 2180.12s | I think the question is, it went down earlier. 2180.12s - 2181.96s | Is it possible to make it all self-contained? 2183.00s - 2183.40s | Yeah. 2183.40s - 2184.68s | So it's an IST machine. 2186.84s - 2189.16s | So it connects through a database in the cloud. 2189.16s - 2192.36s | And that's how we know all the codes are. 2197.06s - 2199.14s | So that's how it knows codes are valid or not. 2199.70s - 2203.54s | I guess nothing we can do to run that in there, but it's easier to, especially when 2203.54s - 2204.74s | there's some technical problems. 2204.74s -


chunk_text:
That's the big silver box. 2143.61s - 2146.33s | We wanted to put lots and lots and lots of electronics. 2148.17s - 2151.05s | We kind of modified the pointer turn. 2151.05s - 2152.41s | That's our enter button. 2152.41s - 2154.73s | Just click to switch on that. 2154.73s - 2159.53s | And then the right side is like when I finally got the whole thing brought up. 2160.01s - 2163.13s | So it's kind of our hello world for stacking. 2164.49s - 2165.37s | Any questions so far? 2178.04s - 2180.12s | I think the question is, it went down earlier. 2180.12s - 2181.96s | Is it possible to make it all self-contained? 2183.00s - 2183.40s | Yeah. 2183.40s - 2184.68s | So it's an IST machine. 2186.84s - 2189.16s | So it connects through a database in the cloud. 2189.16s - 2192.36s | And that's how we know all the codes are. 2197.06s - 2199.14s | So that's how it knows codes are valid or not. 2199.70s - 2203.54s | I guess nothing we can do to run that in there, but it's easier to, especially when 2203.54s - 2204.74s | there's some technical problems. 2204.74s - 2206.02s | It's just a mechanical device. 2207.06s - 2208.18s | Verify and that mess. 2208.18s - 2209.30s | Like I said, I'm like, okay. 2210.42s - 2214.66s | I mean, it can run disconnected, but it doesn't like it. 2214.66s - 2215.14s | Yeah. 2215.14s - 2217.06s | And you get different Venn problems. 2217.06s - 2217.22s | Yeah. 2217.22s - 2217.86s | It also runs. 2217.86s - 2219.54s | It basically runs for like 30 seconds. 2219.54s - 2221.46s | And it goes, oh, I lost connection to the internet. 2221.46s - 2223.46s | My database is not up to date anymore. 2223.46s - 2226.66s | So yeah, but that gives us a full security stack. 2227.22s - 2229.46s | And it did not crash with CrowdStrike. 2229.46s - 2230.34s | Yeah, it did not crash. 2231.30s - 2233.38s | Um, so this is year two. 2233.38s - 2237.22s | We took a lot of what we've learned from the first year, which was basically, well, the 2237.22s - 2238.82s | first year it ran on Wi-Fi. 2238.82s - 2240.90s | We had people deaughtening all the time. 2240.90s - 2242.26s | We went to hard wire. 2243.78s


chunk_text:
2206.02s | It's just a mechanical device. 2207.06s - 2208.18s | Verify and that mess. 2208.18s - 2209.30s | Like I said, I'm like, okay. 2210.42s - 2214.66s | I mean, it can run disconnected, but it doesn't like it. 2214.66s - 2215.14s | Yeah. 2215.14s - 2217.06s | And you get different Venn problems. 2217.06s - 2217.22s | Yeah. 2217.22s - 2217.86s | It also runs. 2217.86s - 2219.54s | It basically runs for like 30 seconds. 2219.54s - 2221.46s | And it goes, oh, I lost connection to the internet. 2221.46s - 2223.46s | My database is not up to date anymore. 2223.46s - 2226.66s | So yeah, but that gives us a full security stack. 2227.22s - 2229.46s | And it did not crash with CrowdStrike. 2229.46s - 2230.34s | Yeah, it did not crash. 2231.30s - 2233.38s | Um, so this is year two. 2233.38s - 2237.22s | We took a lot of what we've learned from the first year, which was basically, well, the 2237.22s - 2238.82s | first year it ran on Wi-Fi. 2238.82s - 2240.90s | We had people deaughtening all the time. 2240.90s - 2242.26s | We went to hard wire. 2243.78s - 2248.42s | And then originally it ran on a Raspberry Pi, a control object. 2249.14s - 2254.18s | And we switched over to just a x86 based, uh, PC. 2254.90s - 2264.34s | Um, and then we added the marquee display at the top. 2265.62s - 2268.66s | Certain display gifts, videos, that kind of stuff. 2271.22s - 2279.54s | And then we added HAL 9000 or Snacky 9000, which is our infrared and Morse code style 2279.54s - 2280.02s | challenges. 2285.59s - 2288.55s | And this kind of caused me to have to create more of a cache. 2289.19s - 2289.59s | Oh, yeah. 2289.59s - 2292.07s | So here's, like, the current, this is like this year's. 2293.19s - 2294.07s | We added a speaker. 2294.71s - 2301.11s | Um, we upgraded our display to a higher resolution to be like that 1920 by 360, which is really 2301.11s - 2303.11s | weird to make, like, art assets for. 2303.75s - 2307.11s | Um, it frustrates everyone in the team. 2307.11s - 2309.75s | So like this year, now you don't have to follow that ratio. 2309.75s - 2311.27s | You can just make whatever. 2311.27s


chunk_text:
- 2248.42s | And then originally it ran on a Raspberry Pi, a control object. 2249.14s - 2254.18s | And we switched over to just a x86 based, uh, PC. 2254.90s - 2264.34s | Um, and then we added the marquee display at the top. 2265.62s - 2268.66s | Certain display gifts, videos, that kind of stuff. 2271.22s - 2279.54s | And then we added HAL 9000 or Snacky 9000, which is our infrared and Morse code style 2279.54s - 2280.02s | challenges. 2285.59s - 2288.55s | And this kind of caused me to have to create more of a cache. 2289.19s - 2289.59s | Oh, yeah. 2289.59s - 2292.07s | So here's, like, the current, this is like this year's. 2293.19s - 2294.07s | We added a speaker. 2294.71s - 2301.11s | Um, we upgraded our display to a higher resolution to be like that 1920 by 360, which is really 2301.11s - 2303.11s | weird to make, like, art assets for. 2303.75s - 2307.11s | Um, it frustrates everyone in the team. 2307.11s - 2309.75s | So like this year, now you don't have to follow that ratio. 2309.75s - 2311.27s | You can just make whatever. 2311.27s - 2314.47s | People letterbox or stretch or whatever. 2314.55s - 2317.67s | Whatever actually decides to do focus on that image. 2317.67s - 2324.47s | Uh, we got, we upgraded our, um, heat source for the thermal printer, which we actually 2324.47s - 2327.83s | think downgrade now because we have problems scanning that. 2329.59s - 2332.63s | So I had to find the original source of the paper. 2333.51s - 2340.39s | Um, we added more LEDs and now it has a PoE switch in it for future expansion. 2340.39s - 2344.55s | So we're hoping to bring like more themes for our contest and hooking up to it. 2346.31s - 2347.35s | I like that PoE. 2347.35s - 2347.59s | Yeah. 2347.59s - 2347.83s | Yeah. 2347.83s - 2350.23s | We put a transmitter in there too, for all that. 2352.23s - 2355.35s | So everything kind of add on if things like that, you speak twice. 2355.35s - 2360.55s | So that's really like we added a speaker and it's really easy and module how we design 2360.55s - 2363.59s | the software and the hardware solutions. 2363.59s - 2364.79s | So it's easy to add


chunk_text:
- 2314.47s | People letterbox or stretch or whatever. 2314.55s - 2317.67s | Whatever actually decides to do focus on that image. 2317.67s - 2324.47s | Uh, we got, we upgraded our, um, heat source for the thermal printer, which we actually 2324.47s - 2327.83s | think downgrade now because we have problems scanning that. 2329.59s - 2332.63s | So I had to find the original source of the paper. 2333.51s - 2340.39s | Um, we added more LEDs and now it has a PoE switch in it for future expansion. 2340.39s - 2344.55s | So we're hoping to bring like more themes for our contest and hooking up to it. 2346.31s - 2347.35s | I like that PoE. 2347.35s - 2347.59s | Yeah. 2347.59s - 2347.83s | Yeah. 2347.83s - 2350.23s | We put a transmitter in there too, for all that. 2352.23s - 2355.35s | So everything kind of add on if things like that, you speak twice. 2355.35s - 2360.55s | So that's really like we added a speaker and it's really easy and module how we design 2360.55s - 2363.59s | the software and the hardware solutions. 2363.59s - 2364.79s | So it's easy to add on. 2365.27s - 2370.23s | Um, it probably needs a refactor now because it has like one big Python script that runs 2370.23s - 2370.63s | everything. 2371.27s - 2372.63s | Um, I probably need to fix that. 2373.27s - 2373.59s | Yeah. 2375.11s - 2375.35s | Okay. 2378.60s - 2378.92s | Perfect. 2379.96s - 2384.84s | Um, so I actually, this is, first of all, we should update this because we bring that 2384.84s - 2390.44s | badge, um, but you can still play the CTF right now. 2390.44s - 2396.60s | I should say, do you want to try and build a badge out of cannibalized parts, which may 2396.60s - 2396.84s | work. 2397.80s - 2398.76s | Come visit us tomorrow. 2400.92s - 2403.24s | Or just come check out Snacky, mess with it, press buttons. 2407.53s - 2407.77s | Yay. 2409.53s - 2412.81s | Yo, any questions related or not? 2414.01s - 2416.65s | You have us for, I don't know. 2416.65s - 2418.17s | They have to tell me four more minutes. 2424.49s - 2425.05s | Oh Jesus. 2428.81s - 2429.77s | I was building my garage. 2440.89s - 2442.01s | We're getting caned off


chunk_text:
on. 2365.27s - 2370.23s | Um, it probably needs a refactor now because it has like one big Python script that runs 2370.23s - 2370.63s | everything. 2371.27s - 2372.63s | Um, I probably need to fix that. 2373.27s - 2373.59s | Yeah. 2375.11s - 2375.35s | Okay. 2378.60s - 2378.92s | Perfect. 2379.96s - 2384.84s | Um, so I actually, this is, first of all, we should update this because we bring that 2384.84s - 2390.44s | badge, um, but you can still play the CTF right now. 2390.44s - 2396.60s | I should say, do you want to try and build a badge out of cannibalized parts, which may 2396.60s - 2396.84s | work. 2397.80s - 2398.76s | Come visit us tomorrow. 2400.92s - 2403.24s | Or just come check out Snacky, mess with it, press buttons. 2407.53s - 2407.77s | Yay. 2409.53s - 2412.81s | Yo, any questions related or not? 2414.01s - 2416.65s | You have us for, I don't know. 2416.65s - 2418.17s | They have to tell me four more minutes. 2424.49s - 2425.05s | Oh Jesus. 2428.81s - 2429.77s | I was building my garage. 2440.89s - 2442.01s | We're getting caned off stage. 2442.81s - 2443.53s | How about this? 2443.53s - 2449.53s | If you have questions, follow us right out there.


chunk_text:
stage. 2442.81s - 2443.53s | How about this? 2443.53s - 2449.53s | If you have questions, follow us right out there.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=TjdATgKxqiU", "title": "DEF CON 32 - Got 99 problems but prompt injection ain't pineapple - Chloe\u0301 Messdaghi, Kasimir Schulz", "description": "The ethical and secure disclosure of vulnerabilities in AI has emerged as a pivotal challenge, compounded by the need to address biases and misinformation that often cloud the true nature of these vulnerabilities. This talk delves into the intricate dynamics of vulnerability disclosure within AI, balancing transparency with security. We'll dissect the unique challenges AI presents, such as data bias exploitation and model manipulation, which can amplify the impact of vulnerabilities. Through a lens of real-world examples and recent disclosures, we'll navigate the complexities of responsible vulnerability management in AI. Our discussion will not only aim to shed light on these critical issues but also inspire a unified approach to refining disclosure processes. This concerted effort is vital for enhancing the integrity of AI systems and bolstering public trust in their use.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2406, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.44s | This text was transcribed using whisper model: large-v2 Hi everyone and thank you so much for coming to our talk. We just want to do a quick shout out to 6.00s - 11.04s | Bike Bounty Village for having this talk and and for DEF CON for the Creator Stage. This is pretty 11.04s - 16.80s | cool. And just a reminder to everyone, please be nice to your goons and also be nice to all 16.80s - 21.52s | the volunteers. They're putting so much time and energy in this, so just throwing it out there. 21.52s - 27.20s | So welcome to I've Got 99 Problems but a Prompt Injection Ain't Pineapple. My name is Chloe 27.20s - 32.96s | Messiaen. I'm the Head of Threat Intelligence over at Hidden Layer. And I'm Casimir Schultz. 32.96s - 39.09s | I'm a Zero-Day Researcher over at Hidden Layer as well. So we're going to go on this journey 39.09s - 44.13s | together, talking first about AI vulnerabilities to make sure that we're all on the same page of 44.13s - 48.69s | what is out there, what kind of vulnerabilities exist in AI. And then we're going to go into 48.69s - 54.61s | the public perception of AI vulnerabilities, of course, and the true size of that landscape 54.61s - 60.53s | where CAS basically owns that type


chunk_text:
- 11.04s | Bike Bounty Village for having this talk and and for DEF CON for the Creator Stage. This is pretty 11.04s - 16.80s | cool. And just a reminder to everyone, please be nice to your goons and also be nice to all 16.80s - 21.52s | the volunteers. They're putting so much time and energy in this, so just throwing it out there. 21.52s - 27.20s | So welcome to I've Got 99 Problems but a Prompt Injection Ain't Pineapple. My name is Chloe 27.20s - 32.96s | Messiaen. I'm the Head of Threat Intelligence over at Hidden Layer. And I'm Casimir Schultz. 32.96s - 39.09s | I'm a Zero-Day Researcher over at Hidden Layer as well. So we're going to go on this journey 39.09s - 44.13s | together, talking first about AI vulnerabilities to make sure that we're all on the same page of 44.13s - 48.69s | what is out there, what kind of vulnerabilities exist in AI. And then we're going to go into 48.69s - 54.61s | the public perception of AI vulnerabilities, of course, and the true size of that landscape 54.61s - 60.53s | where CAS basically owns that type of landscape. And then I'll dive into the open source nature of 60.53s - 69.09s | AI and the reporting challenges. We did do some research with BugCrowd, HackerOne, and Integrity. 69.09s - 73.97s | So big thanks for them for being transparent with us about what they're seeing and experiencing. 75.57s - 80.05s | So when we think about AI vulnerabilities, I don't know about you, but it seems like the 80.05s - 86.29s | whole world thinks of this, where it's like end of the world. It's, you know, I'll be back. I cannot 86.29s - 91.17s | do honor roll Schwarzenegger for the life of me, his voice. But you get the point. But even within 91.17s - 95.97s | our own industry in itself, there's so much misinformation, disinformation out there when 95.97s - 103.25s | it comes to security for AI. And yes, we know how to spell that is a generated AI image over there. 103.25s - 111.44s | So they're not good yet. So let's go dive down the rabbit hole of AI vulnerabilities. 112.80s - 116.72s | And we're going to go into each one of these sections. So we're all on


chunk_text:
of landscape. And then I'll dive into the open source nature of 60.53s - 69.09s | AI and the reporting challenges. We did do some research with BugCrowd, HackerOne, and Integrity. 69.09s - 73.97s | So big thanks for them for being transparent with us about what they're seeing and experiencing. 75.57s - 80.05s | So when we think about AI vulnerabilities, I don't know about you, but it seems like the 80.05s - 86.29s | whole world thinks of this, where it's like end of the world. It's, you know, I'll be back. I cannot 86.29s - 91.17s | do honor roll Schwarzenegger for the life of me, his voice. But you get the point. But even within 91.17s - 95.97s | our own industry in itself, there's so much misinformation, disinformation out there when 95.97s - 103.25s | it comes to security for AI. And yes, we know how to spell that is a generated AI image over there. 103.25s - 111.44s | So they're not good yet. So let's go dive down the rabbit hole of AI vulnerabilities. 112.80s - 116.72s | And we're going to go into each one of these sections. So we're all on the same page once again. 117.60s - 122.16s | First, we're going to go down the attacks against the AI algorithms, then we'll go through attacks 122.16s - 128.00s | against the filters and generative AI. And then I'll be passing the mic over to CAS, and he's going 128.00s - 136.32s | to go down the AI artifacts and the supply chain attacks. So data poisoning attacks are basically, 136.32s - 142.16s | think about it as model training is crucial for like AI development, right? And it's incredibly 142.16s - 146.80s | vulnerable to data poisoning, which is one there's like malicious actors tend to manipulate 146.80s - 154.24s | or inject doctorate data, or to like bias the models behavior. And continuous learning systems 154.24s - 160.40s | are especially at risk as they retrain on unvalidated user supply data. Even small 160.40s - 166.16s | amounts of poison data can actually lead to a bias or incorrect predictions and can be amplified by 166.16s - 172.24s | public manipulation or botnets. Does anyone remember Tay? Microsoft Tay on Twitter, now 172.24s - 180.16s | known as X, raise your hand. Okay, for those that aren't familiar,


chunk_text:
the same page once again. 117.60s - 122.16s | First, we're going to go down the attacks against the AI algorithms, then we'll go through attacks 122.16s - 128.00s | against the filters and generative AI. And then I'll be passing the mic over to CAS, and he's going 128.00s - 136.32s | to go down the AI artifacts and the supply chain attacks. So data poisoning attacks are basically, 136.32s - 142.16s | think about it as model training is crucial for like AI development, right? And it's incredibly 142.16s - 146.80s | vulnerable to data poisoning, which is one there's like malicious actors tend to manipulate 146.80s - 154.24s | or inject doctorate data, or to like bias the models behavior. And continuous learning systems 154.24s - 160.40s | are especially at risk as they retrain on unvalidated user supply data. Even small 160.40s - 166.16s | amounts of poison data can actually lead to a bias or incorrect predictions and can be amplified by 166.16s - 172.24s | public manipulation or botnets. Does anyone remember Tay? Microsoft Tay on Twitter, now 172.24s - 180.16s | known as X, raise your hand. Okay, for those that aren't familiar, in March 2016, Microsoft introduced 180.16s - 188.72s | a chat bot on Twitter, which now is known as X. And it was so nice and friendly. It was like, 188.72s - 194.56s | hello, world, how are you? And you know how the world responded on Twitter, as you can imagine, 194.56s - 200.72s | it's full of trolls. Well, within 16 hours, this thing became the most racist sexist thing 200.72s - 205.36s | on the planet. And of course, this was a problem for Microsoft, because you know, 205.36s - 212.08s | that's not good PR for them, clearly, right. So then we have model evasion attacks. So inference 212.08s - 217.68s | attacks, they tend to exploit AI models by curing them to extract sensitive information, 217.68s - 223.28s | often using slightly varied inputs to reconstruct the model that leading to potential model theft 223.28s - 231.44s | or bypass. So evasion attacks is a type of bypass, use subtle, like really, really subtle 232.64s - 239.28s | to change the inputs. And this could be basically like adding invisible noise to trick the models 239.28s - 245.60s | into misclassifications. And these techniques have


chunk_text:
in March 2016, Microsoft introduced 180.16s - 188.72s | a chat bot on Twitter, which now is known as X. And it was so nice and friendly. It was like, 188.72s - 194.56s | hello, world, how are you? And you know how the world responded on Twitter, as you can imagine, 194.56s - 200.72s | it's full of trolls. Well, within 16 hours, this thing became the most racist sexist thing 200.72s - 205.36s | on the planet. And of course, this was a problem for Microsoft, because you know, 205.36s - 212.08s | that's not good PR for them, clearly, right. So then we have model evasion attacks. So inference 212.08s - 217.68s | attacks, they tend to exploit AI models by curing them to extract sensitive information, 217.68s - 223.28s | often using slightly varied inputs to reconstruct the model that leading to potential model theft 223.28s - 231.44s | or bypass. So evasion attacks is a type of bypass, use subtle, like really, really subtle 232.64s - 239.28s | to change the inputs. And this could be basically like adding invisible noise to trick the models 239.28s - 245.60s | into misclassifications. And these techniques have been used by cyber criminals, and even ourselves 245.60s - 250.96s | once in a while like testing things out such as bypassing security systems like spam filters, 250.96s - 258.16s | malware detection and biometric authentication. Has anyone been in a self driving car before? 260.08s - 266.48s | Okay, raise those hands a little bit higher. How many of you Okay, that's cool. I have not. 267.28s - 271.52s | But I want you to imagine you're in this self driving car for those that haven't been in one. 271.52s - 279.20s | And if you've been in one, imagine you're back in that car again. And while you're at the stop sign, 279.20s - 287.36s | your car does this really weird thing like it just slides to the left, slides to the right, 287.36s - 295.20s | and then it takes it back y'all. One hop this time, left foot, let's stomp, right foot, let's 295.20s - 299.84s | stomp and cha-cha real slowly. I know it's a little bit hard to imagine with a car doing it, 299.84s - 304.80s | but use your imagination. It's been a few days in Las Vegas, we've all


chunk_text:
been used by cyber criminals, and even ourselves 245.60s - 250.96s | once in a while like testing things out such as bypassing security systems like spam filters, 250.96s - 258.16s | malware detection and biometric authentication. Has anyone been in a self driving car before? 260.08s - 266.48s | Okay, raise those hands a little bit higher. How many of you Okay, that's cool. I have not. 267.28s - 271.52s | But I want you to imagine you're in this self driving car for those that haven't been in one. 271.52s - 279.20s | And if you've been in one, imagine you're back in that car again. And while you're at the stop sign, 279.20s - 287.36s | your car does this really weird thing like it just slides to the left, slides to the right, 287.36s - 295.20s | and then it takes it back y'all. One hop this time, left foot, let's stomp, right foot, let's 295.20s - 299.84s | stomp and cha-cha real slowly. I know it's a little bit hard to imagine with a car doing it, 299.84s - 304.80s | but use your imagination. It's been a few days in Las Vegas, we've all lost our minds at this point. 305.52s - 311.44s | But there's already been examples of this where a car gets to a stop sign self driving car. 312.08s - 319.52s | And there's stickers that are on the stop sign itself. And so it bypasses that stop sign and 319.52s - 326.32s | keeps driving forward. That is an example of a model evasion tax. And then you have model theft 326.32s - 331.84s | attacks. So adversaries target AI models to mislead and steal them lean to intellectual 331.84s - 336.56s | property theft by replicating or extracting sensitive data. And now you may be wondering 336.56s - 342.24s | what are those groups of people are trying to do that? Well, nation state, your competitors, 342.24s - 349.20s | definitely. And then also, you got your criminals out there. So even without public access to 349.20s - 356.80s | inference attacks via interfaces or API's, it can replicate models or extract valuable info from it. 356.80s - 360.96s | So there are these things called Oracle tax, and they're known by NIST, and they include three 360.96s - 367.28s | different types. So extraction attack, which is


chunk_text:
lost our minds at this point. 305.52s - 311.44s | But there's already been examples of this where a car gets to a stop sign self driving car. 312.08s - 319.52s | And there's stickers that are on the stop sign itself. And so it bypasses that stop sign and 319.52s - 326.32s | keeps driving forward. That is an example of a model evasion tax. And then you have model theft 326.32s - 331.84s | attacks. So adversaries target AI models to mislead and steal them lean to intellectual 331.84s - 336.56s | property theft by replicating or extracting sensitive data. And now you may be wondering 336.56s - 342.24s | what are those groups of people are trying to do that? Well, nation state, your competitors, 342.24s - 349.20s | definitely. And then also, you got your criminals out there. So even without public access to 349.20s - 356.80s | inference attacks via interfaces or API's, it can replicate models or extract valuable info from it. 356.80s - 360.96s | So there are these things called Oracle tax, and they're known by NIST, and they include three 360.96s - 367.28s | different types. So extraction attack, which is when you steal the models structure, you have 367.28s - 372.72s | an inversion attacks, which is to steal the model structure. And then I mean, the training data, 372.72s - 377.68s | my bad. And then you have membership inference attacks, which is to identify specific data, 378.24s - 385.68s | and the training set from it. Now, has anyone ever had tick tock on their phone, 385.68s - 389.60s | any tick tock on your phone, raise your hand. I'm not going to judge you. I'm not going to 389.60s - 400.94s | point you out. I'm sorry, I have to do it. Why? You're in security. It's okay. It's okay. I mean, 400.94s - 407.34s | after... Okay, that's fine. Not on your personal device though, right? 409.10s - 414.86s | Okay, good, good. Okay, we're good. Jeez, okay. Well, anyway, for those that aren't aware, 415.18s - 425.18s | ByDance owns tick tock, and ByDance got caught trying to replicate the model of chat GPT 425.74s - 433.02s | end of last year. So yes, and they were banned, of course. So when we think about prompt injection, 433.02s - 437.10s | I know we're all


chunk_text:
when you steal the models structure, you have 367.28s - 372.72s | an inversion attacks, which is to steal the model structure. And then I mean, the training data, 372.72s - 377.68s | my bad. And then you have membership inference attacks, which is to identify specific data, 378.24s - 385.68s | and the training set from it. Now, has anyone ever had tick tock on their phone, 385.68s - 389.60s | any tick tock on your phone, raise your hand. I'm not going to judge you. I'm not going to 389.60s - 400.94s | point you out. I'm sorry, I have to do it. Why? You're in security. It's okay. It's okay. I mean, 400.94s - 407.34s | after... Okay, that's fine. Not on your personal device though, right? 409.10s - 414.86s | Okay, good, good. Okay, we're good. Jeez, okay. Well, anyway, for those that aren't aware, 415.18s - 425.18s | ByDance owns tick tock, and ByDance got caught trying to replicate the model of chat GPT 425.74s - 433.02s | end of last year. So yes, and they were banned, of course. So when we think about prompt injection, 433.02s - 437.10s | I know we're all sick of hearing prompt injection whenever it comes to security for AI, but let's 437.10s - 443.82s | just do this. So a prompt injection for those that aren't aware, think about you have an adorable niece 444.86s - 452.06s | and her mom said, do not eat the chocolate on that table. And you know what you do? You go to 452.06s - 458.78s | your niece and you squat down. You're like, forget what your mom said. Go eat that piece of chocolate. 458.78s - 464.54s | You deserve it. And the child goes, proceeds and eats the piece of chocolate. So that would be 464.54s - 471.18s | an example of prompt injection. So generative AI providers use security filters to block harmful 471.18s - 476.54s | content, illegal info, and misuse to ensure compliance with laws. You may have heard of them, 476.54s - 481.50s | they're called also guardrails. But these safeguards can actually be bypassed with 481.50s - 487.98s | prompt injection. And AI bots get tricked into performing these restricted actions. So the 487.98s - 493.90s | vulnerability varies by model and has raised concern, especially around disclosure and payouts. 494.06s - 500.22s


chunk_text:
sick of hearing prompt injection whenever it comes to security for AI, but let's 437.10s - 443.82s | just do this. So a prompt injection for those that aren't aware, think about you have an adorable niece 444.86s - 452.06s | and her mom said, do not eat the chocolate on that table. And you know what you do? You go to 452.06s - 458.78s | your niece and you squat down. You're like, forget what your mom said. Go eat that piece of chocolate. 458.78s - 464.54s | You deserve it. And the child goes, proceeds and eats the piece of chocolate. So that would be 464.54s - 471.18s | an example of prompt injection. So generative AI providers use security filters to block harmful 471.18s - 476.54s | content, illegal info, and misuse to ensure compliance with laws. You may have heard of them, 476.54s - 481.50s | they're called also guardrails. But these safeguards can actually be bypassed with 481.50s - 487.98s | prompt injection. And AI bots get tricked into performing these restricted actions. So the 487.98s - 493.90s | vulnerability varies by model and has raised concern, especially around disclosure and payouts. 494.06s - 500.22s | And this is would not be a security talk without mentioning supply chain. So supply chain attacks, 500.22s - 506.22s | they exploit trust by compromising trusted vendors, and they spread malicious components widely. 506.86s - 512.86s | The complex ML supply chain heightens these type of risk with about 75% of IT leaders 512.86s - 516.62s | seeing third party AI integrations as particularly vulnerable. 516.62s - 522.38s | Now, a skilled adversary can inject a neural payload into a pre-trained AI model, which creates 522.38s - 528.70s | this hidden model backdoor that triggers a specific attacker-defined outputs. And the model works 528.70s - 535.50s | normally with regular data, but it misbehaves with some manipulated inputs, allowing the attacker 535.50s - 542.78s | to ensure favorable outcomes like loan approvals or insurance policies. Now, has anyone heard of 542.94s - 551.12s | HuggingFace? Raise your hand. Nice. Okay. So for those that don't know, HuggingFace, it's 551.12s - 558.08s | specialized repos. It's where it hosts over like 500, like way over 500,000 models now that are free 558.64s - 563.12s | pre-trained. So it makes it very easy for developers to integrate these models into


chunk_text:
| And this is would not be a security talk without mentioning supply chain. So supply chain attacks, 500.22s - 506.22s | they exploit trust by compromising trusted vendors, and they spread malicious components widely. 506.86s - 512.86s | The complex ML supply chain heightens these type of risk with about 75% of IT leaders 512.86s - 516.62s | seeing third party AI integrations as particularly vulnerable. 516.62s - 522.38s | Now, a skilled adversary can inject a neural payload into a pre-trained AI model, which creates 522.38s - 528.70s | this hidden model backdoor that triggers a specific attacker-defined outputs. And the model works 528.70s - 535.50s | normally with regular data, but it misbehaves with some manipulated inputs, allowing the attacker 535.50s - 542.78s | to ensure favorable outcomes like loan approvals or insurance policies. Now, has anyone heard of 542.94s - 551.12s | HuggingFace? Raise your hand. Nice. Okay. So for those that don't know, HuggingFace, it's 551.12s - 558.08s | specialized repos. It's where it hosts over like 500, like way over 500,000 models now that are free 558.64s - 563.12s | pre-trained. So it makes it very easy for developers to integrate these models into their 563.12s - 569.36s | applications. Now, if an attacker breaches the repo, they can actually replace those models with 569.52s - 575.04s | hijacked or backdoored versions, which you can imagine leads to some significant downstream 575.04s - 583.54s | consequences. How many of you do bug bounty hunting? Raise your hand. How many are planning 583.54s - 591.73s | to get into bug bounty? Raise your hand. Okay. Well, anyone, when it comes to disclosing these 591.73s - 598.05s | vulnerabilities, it's a little bit tricky because, well, we're all playing a game of catch-up, as you 598.05s - 605.01s | can see here. We don't really have like established frameworks in AI. We don't really have well-defined 605.01s - 611.09s | protocols. The collaboration, we are still dealing with that, and that's a mess of its own. And then 611.09s - 614.61s | you have to worry about response time because everyone's still trying to figure out what is 614.61s - 618.53s | the severity look like for some of these vulnerabilities and then payouts, how much do I 618.53s - 623.97s | pay? And then is that actually a vulnerability or is it not? And then


chunk_text:
their 563.12s - 569.36s | applications. Now, if an attacker breaches the repo, they can actually replace those models with 569.52s - 575.04s | hijacked or backdoored versions, which you can imagine leads to some significant downstream 575.04s - 583.54s | consequences. How many of you do bug bounty hunting? Raise your hand. How many are planning 583.54s - 591.73s | to get into bug bounty? Raise your hand. Okay. Well, anyone, when it comes to disclosing these 591.73s - 598.05s | vulnerabilities, it's a little bit tricky because, well, we're all playing a game of catch-up, as you 598.05s - 605.01s | can see here. We don't really have like established frameworks in AI. We don't really have well-defined 605.01s - 611.09s | protocols. The collaboration, we are still dealing with that, and that's a mess of its own. And then 611.09s - 614.61s | you have to worry about response time because everyone's still trying to figure out what is 614.61s - 618.53s | the severity look like for some of these vulnerabilities and then payouts, how much do I 618.53s - 623.97s | pay? And then is that actually a vulnerability or is it not? And then safety versus security, 623.97s - 628.77s | and then is that actually a vulnerability or is it not? And then safety versus security. 628.77s - 634.37s | So there's been these ongoing problems of trying to figure things out and play a game of catch-up, 634.37s - 638.21s | and it does remind me back in the day when we would disclose vulnerabilities, 638.21s - 643.09s | like, you know, say in like 2012 or 2014, it was very much like that, where we were trying to 643.09s - 648.29s | figure out how much do we pay out, what those vulnerabilities look like, how serious are they, 648.29s - 653.41s | and the severity of things. So I'm going to hand the mic over to Kaz, and he's going to go down 653.41s - 659.65s | the true size of an AI vulnerability landscape for you. So Chloe asked how many people here are 659.65s - 663.97s | bug bounty people, and there weren't that many, but I have a much better question for you. How 663.97s - 670.37s | many of you like earning easy money? I mean, come on, right? Okay, awesome. So while, you know, 670.37s


chunk_text:
safety versus security, 623.97s - 628.77s | and then is that actually a vulnerability or is it not? And then safety versus security. 628.77s - 634.37s | So there's been these ongoing problems of trying to figure things out and play a game of catch-up, 634.37s - 638.21s | and it does remind me back in the day when we would disclose vulnerabilities, 638.21s - 643.09s | like, you know, say in like 2012 or 2014, it was very much like that, where we were trying to 643.09s - 648.29s | figure out how much do we pay out, what those vulnerabilities look like, how serious are they, 648.29s - 653.41s | and the severity of things. So I'm going to hand the mic over to Kaz, and he's going to go down 653.41s - 659.65s | the true size of an AI vulnerability landscape for you. So Chloe asked how many people here are 659.65s - 663.97s | bug bounty people, and there weren't that many, but I have a much better question for you. How 663.97s - 670.37s | many of you like earning easy money? I mean, come on, right? Okay, awesome. So while, you know, 670.37s - 675.81s | there are a lot of cool AI attacks, something like model poisoning isn't going to be the most 675.81s - 681.09s | useful for actually getting any payouts, especially if you're just doing it at a smaller scale. 681.17s - 685.97s | However, there's a much bigger extent to true AI vulnerabilities that a lot of people are 685.97s - 690.13s | overlooking. We found out that most of you guys have actually used HuggingFace before, 690.13s - 696.05s | or at least heard of it, and a lot of, so HuggingFace stores these model formats, or model 696.05s - 701.97s | files, and these dataset files, and that means they're constantly being shared. But not only are 701.97s - 706.69s | they constantly being shared, these formats are actually generally trusted. So that means a lot 706.69s - 711.89s | of places will allow you to upload arbitrary files, so these machine learning models. So that 711.89s - 715.97s | means you can run them, you can do inference. However, a lot of these have vulnerabilities 715.97s - 721.49s | when they're being parsed and loaded, so you can actually take over a server if they


chunk_text:
- 675.81s | there are a lot of cool AI attacks, something like model poisoning isn't going to be the most 675.81s - 681.09s | useful for actually getting any payouts, especially if you're just doing it at a smaller scale. 681.17s - 685.97s | However, there's a much bigger extent to true AI vulnerabilities that a lot of people are 685.97s - 690.13s | overlooking. We found out that most of you guys have actually used HuggingFace before, 690.13s - 696.05s | or at least heard of it, and a lot of, so HuggingFace stores these model formats, or model 696.05s - 701.97s | files, and these dataset files, and that means they're constantly being shared. But not only are 701.97s - 706.69s | they constantly being shared, these formats are actually generally trusted. So that means a lot 706.69s - 711.89s | of places will allow you to upload arbitrary files, so these machine learning models. So that 711.89s - 715.97s | means you can run them, you can do inference. However, a lot of these have vulnerabilities 715.97s - 721.49s | when they're being parsed and loaded, so you can actually take over a server if they try to load 721.49s - 726.77s | the model that you uploaded. There's also a fairly low amount of visibility for these AI models and 726.77s - 731.41s | datasets. You know, if I were to send Chloe some code, and she can easily see, you know, 731.41s - 735.41s | there might be a system command in there. However, with an AI model, that's just a 735.41s - 740.21s | giant blob of binary data that's not going to really happen. We also see that there's a lot 740.21s - 745.41s | of infrastructure around AI that isn't really as secure as a lot of the other infrastructure. 745.41s - 749.65s | So for those of you who have done bug bounty, you guys have a lot of tools, you guys look for 749.65s - 756.21s | very specific things, you guys found most of the problems. However, there hasn't been any security 756.21s - 762.53s | scrutiny for these AI infrastructure components. In fact, some of these don't even have authentication 762.53s - 766.61s | because they're meant to be hosted internally. And then through showdown searches, we've actually 766.61s - 770.69s | seen that they're being hosted


chunk_text:
try to load 721.49s - 726.77s | the model that you uploaded. There's also a fairly low amount of visibility for these AI models and 726.77s - 731.41s | datasets. You know, if I were to send Chloe some code, and she can easily see, you know, 731.41s - 735.41s | there might be a system command in there. However, with an AI model, that's just a 735.41s - 740.21s | giant blob of binary data that's not going to really happen. We also see that there's a lot 740.21s - 745.41s | of infrastructure around AI that isn't really as secure as a lot of the other infrastructure. 745.41s - 749.65s | So for those of you who have done bug bounty, you guys have a lot of tools, you guys look for 749.65s - 756.21s | very specific things, you guys found most of the problems. However, there hasn't been any security 756.21s - 762.53s | scrutiny for these AI infrastructure components. In fact, some of these don't even have authentication 762.53s - 766.61s | because they're meant to be hosted internally. And then through showdown searches, we've actually 766.61s - 770.69s | seen that they're being hosted externally. And I mean, not just one or two, we're seeing hundreds 770.69s - 776.29s | of services being hosted externally with no authentication that have proprietary data, 776.29s - 781.49s | HIPAA information, so it's really not great. And then finally, we have AI development framework 781.49s - 786.85s | vulnerabilities, and these fall into two categories. So the first is anything that's agentic, 786.85s - 792.21s | which means that we have an LLM hooked up to some sort of backend. That means you ask the LLM to do 792.21s - 798.05s | something, and then it does an API call for you, it runs a function for you. And a lot of times, the 798.05s - 803.49s | backend completely trusts what the LLM gives it. So now imagine if instead of saying, you know, go 803.49s - 809.09s | and grab this data for me, you say, go and write that data for me. Those are vulnerabilities that 809.09s - 812.93s | are out there. So it's almost like the new SQL injection, but it's really easy to find. 813.65s - 819.17s | We're also seeing that AI frameworks allow integrations with sensitive data. So we


chunk_text:
externally. And I mean, not just one or two, we're seeing hundreds 770.69s - 776.29s | of services being hosted externally with no authentication that have proprietary data, 776.29s - 781.49s | HIPAA information, so it's really not great. And then finally, we have AI development framework 781.49s - 786.85s | vulnerabilities, and these fall into two categories. So the first is anything that's agentic, 786.85s - 792.21s | which means that we have an LLM hooked up to some sort of backend. That means you ask the LLM to do 792.21s - 798.05s | something, and then it does an API call for you, it runs a function for you. And a lot of times, the 798.05s - 803.49s | backend completely trusts what the LLM gives it. So now imagine if instead of saying, you know, go 803.49s - 809.09s | and grab this data for me, you say, go and write that data for me. Those are vulnerabilities that 809.09s - 812.93s | are out there. So it's almost like the new SQL injection, but it's really easy to find. 813.65s - 819.17s | We're also seeing that AI frameworks allow integrations with sensitive data. So we have 819.17s - 824.53s | things like rags that allow users or that instead of having an access-based control system for the 824.53s - 829.65s | actual data, the LLM will try to do access-based control. And as you saw earlier, that doesn't 829.65s - 834.53s | always work very well. So, you know, the little niece is not supposed to eat the candy or chocolate, 834.53s - 839.01s | and we say, oh yeah, you can just go ahead and do it. And a lot of times, the LLM will go and get 839.01s - 843.89s | that data for you, even though it's not supposed to. So let's go ahead and talk about some model 843.89s - 848.77s | format vulnerabilities. How many of you are familiar with serialization? Raise your hand. 848.77s - 853.41s | Okay. Awesome. So I can go over that pretty quickly. Serialization is if I have a nice, 853.41s - 857.65s | you know, code object, I want to go ahead and I want to save it off. And then later on I can 857.65s - 861.73s | load it back up. I can send it over to Chloe. She can load it.


chunk_text:
have 819.17s - 824.53s | things like rags that allow users or that instead of having an access-based control system for the 824.53s - 829.65s | actual data, the LLM will try to do access-based control. And as you saw earlier, that doesn't 829.65s - 834.53s | always work very well. So, you know, the little niece is not supposed to eat the candy or chocolate, 834.53s - 839.01s | and we say, oh yeah, you can just go ahead and do it. And a lot of times, the LLM will go and get 839.01s - 843.89s | that data for you, even though it's not supposed to. So let's go ahead and talk about some model 843.89s - 848.77s | format vulnerabilities. How many of you are familiar with serialization? Raise your hand. 848.77s - 853.41s | Okay. Awesome. So I can go over that pretty quickly. Serialization is if I have a nice, 853.41s - 857.65s | you know, code object, I want to go ahead and I want to save it off. And then later on I can 857.65s - 861.73s | load it back up. I can send it over to Chloe. She can load it. She really shouldn't load it 862.37s - 866.45s | because as you can see of all the formats that are up there, everything that is in orange 866.45s - 871.89s | is actually potentially vulnerable. So if you see any places that allow you to upload these files, 871.89s - 876.85s | you should probably try to upload something if you are doing bug bounty. How many people are 876.85s - 883.57s | familiar with Pickle? Python's Pickle? Okay. So Python has a serialization format called Pickle, 883.57s - 889.65s | where if you save a file and then load it back up, you can serialize almost any Python code objects. 889.65s - 894.21s | However, when you load Pickle files back up, there's a chance for arbitrary code execution. 894.21s - 900.37s | And that's why we see that a lot of these Python machine file formats actually have vulnerabilities 900.37s - 904.13s | because a lot of them are actually based on that Pickle format, which is something that we'll keep 904.13s - 912.05s | in mind later. So while you guys might not upload or load an arbitrary Pickle, how many of you have 912.05s - 917.73s


chunk_text:
She really shouldn't load it 862.37s - 866.45s | because as you can see of all the formats that are up there, everything that is in orange 866.45s - 871.89s | is actually potentially vulnerable. So if you see any places that allow you to upload these files, 871.89s - 876.85s | you should probably try to upload something if you are doing bug bounty. How many people are 876.85s - 883.57s | familiar with Pickle? Python's Pickle? Okay. So Python has a serialization format called Pickle, 883.57s - 889.65s | where if you save a file and then load it back up, you can serialize almost any Python code objects. 889.65s - 894.21s | However, when you load Pickle files back up, there's a chance for arbitrary code execution. 894.21s - 900.37s | And that's why we see that a lot of these Python machine file formats actually have vulnerabilities 900.37s - 904.13s | because a lot of them are actually based on that Pickle format, which is something that we'll keep 904.13s - 912.05s | in mind later. So while you guys might not upload or load an arbitrary Pickle, how many of you have 912.05s - 917.73s | used JSON before and think it's pretty safe? Right? Yeah. JSON is safe? No? You don't think 917.73s - 924.93s | JSON is safe? Okay. Well, you're right. So scikit-learn had a safe file format where what 924.93s - 929.49s | they wanted to do was rather than having people just load Pickle files, they could load these 929.49s - 935.25s | JSON files that contained the data. However, while the actual loading process itself was safe, 935.25s - 941.41s | they were only loading strings and numerals, what you can see here is that the way that Scops 941.41s - 947.01s | treated the loading process is it would reconstruct this tree and then run through that to generate 947.01s - 953.01s | objects. So you can see here we're able to create an operator function node, then a tuple with an 953.01s - 958.05s | eval, and then our nice little print statement. So what you might want to look for is a lot of 958.05s - 963.73s | these formats that people just inherently assume are safe, like JSON, depending on how they're 963.73s - 967.65s | interacted with in the backend, you might actually be


chunk_text:
| used JSON before and think it's pretty safe? Right? Yeah. JSON is safe? No? You don't think 917.73s - 924.93s | JSON is safe? Okay. Well, you're right. So scikit-learn had a safe file format where what 924.93s - 929.49s | they wanted to do was rather than having people just load Pickle files, they could load these 929.49s - 935.25s | JSON files that contained the data. However, while the actual loading process itself was safe, 935.25s - 941.41s | they were only loading strings and numerals, what you can see here is that the way that Scops 941.41s - 947.01s | treated the loading process is it would reconstruct this tree and then run through that to generate 947.01s - 953.01s | objects. So you can see here we're able to create an operator function node, then a tuple with an 953.01s - 958.05s | eval, and then our nice little print statement. So what you might want to look for is a lot of 958.05s - 963.73s | these formats that people just inherently assume are safe, like JSON, depending on how they're 963.73s - 967.65s | interacted with in the backend, you might actually be able to use them for exploitation, which is 967.65s - 970.93s | really great if you're doing bug bounty because other people might have overlooked that. 971.89s - 976.13s | And then, of course, there's not just Pickle vulnerabilities and Python vulnerabilities. 976.13s - 981.17s | I mean, anybody who's ever tried to work with C has probably crashed a C program because it's 981.17s - 987.97s | tough. I really like showing this example here because what you can see here is just how easy 988.45s - 993.57s | it is to overlook problems when you're doing any sort of parsing. So we can see that there's only 993.57s - 1000.93s | two dimensions expected because int32t and e is set to size two. However, n dimensions, 1000.93s - 1006.53s | there's no check to see if that's only two values, which means that we can have an overflow there. 1006.53s - 1012.69s | So while this one isn't itself vulnerable or exploitable, it does cause a crash. It does show 1012.69s - 1016.77s | that anywhere where there's any sort of parsing on untrusted data, you might have a really nice 1016.77s - 1022.29s | attack surface. And


chunk_text:
able to use them for exploitation, which is 967.65s - 970.93s | really great if you're doing bug bounty because other people might have overlooked that. 971.89s - 976.13s | And then, of course, there's not just Pickle vulnerabilities and Python vulnerabilities. 976.13s - 981.17s | I mean, anybody who's ever tried to work with C has probably crashed a C program because it's 981.17s - 987.97s | tough. I really like showing this example here because what you can see here is just how easy 988.45s - 993.57s | it is to overlook problems when you're doing any sort of parsing. So we can see that there's only 993.57s - 1000.93s | two dimensions expected because int32t and e is set to size two. However, n dimensions, 1000.93s - 1006.53s | there's no check to see if that's only two values, which means that we can have an overflow there. 1006.53s - 1012.69s | So while this one isn't itself vulnerable or exploitable, it does cause a crash. It does show 1012.69s - 1016.77s | that anywhere where there's any sort of parsing on untrusted data, you might have a really nice 1016.77s - 1022.29s | attack surface. And what you should also remember is that any model formats are completely untrusted 1022.29s - 1027.01s | data. So that means anything that's being parsed, any data that's being accessed afterwards, 1027.01s - 1031.41s | any operations are completely done on your data and data that you control, 1031.41s - 1035.33s | which is an exact surface that you really don't normally get. And it's not just a few 1035.33s - 1039.81s | bytes. I mean, these are potentially gigabytes of data where you can do whatever attack you 1039.81s - 1046.69s | want in them. And then we also see a lot of the old repetitive, uh, vulnerabilities. I mean, 1046.69s - 1052.77s | how many here have heard of a path traversal? Yeah, exactly. Um, and you'd assume path traversals, 1052.77s - 1059.33s | you know, they're extinct, right? But no, they're, they're not. Um, yeah. Uh, and what, uh, Onyx is, 1059.33s - 1064.21s | is Onyx is one of those independent formats, which means that it doesn't matter what programming 1064.21s - 1069.49s | language you loaded up. It uses Google protobuf. So nice and secure. Uh, you can't really do too 1069.49s - 1074.45s |


chunk_text:
what you should also remember is that any model formats are completely untrusted 1022.29s - 1027.01s | data. So that means anything that's being parsed, any data that's being accessed afterwards, 1027.01s - 1031.41s | any operations are completely done on your data and data that you control, 1031.41s - 1035.33s | which is an exact surface that you really don't normally get. And it's not just a few 1035.33s - 1039.81s | bytes. I mean, these are potentially gigabytes of data where you can do whatever attack you 1039.81s - 1046.69s | want in them. And then we also see a lot of the old repetitive, uh, vulnerabilities. I mean, 1046.69s - 1052.77s | how many here have heard of a path traversal? Yeah, exactly. Um, and you'd assume path traversals, 1052.77s - 1059.33s | you know, they're extinct, right? But no, they're, they're not. Um, yeah. Uh, and what, uh, Onyx is, 1059.33s - 1064.21s | is Onyx is one of those independent formats, which means that it doesn't matter what programming 1064.21s - 1069.49s | language you loaded up. It uses Google protobuf. So nice and secure. Uh, you can't really do too 1069.49s - 1074.45s | much with that. However, what Onyx allows you to do is it allows you to load external data. 1074.45s - 1079.65s | And the reason for that is because it wanted to have that you could use the computational graph 1079.65s - 1084.77s | and then instead of having to save off the weights every single time and sending those, 1084.77s - 1089.33s | somebody could use the model itself with different weights on their own machines. 1089.33s - 1095.17s | However, it didn't really check to see, you know, where, uh, you were getting the data from you 1095.49s - 1100.29s | could go out of the directory that the data was supposed to be into and load something like Etsy 1100.29s - 1106.93s | password. Now imagine if this LLM is now hosted on a server and you can query it and Etsy password 1106.93s - 1112.13s | is included in your LLM output or your data. So you could query that potentially get the password 1112.13s - 1118.53s | through something like that. So what do you guys think about when you hear AI infrastructure? 1118.53s - 1123.17s | So as we heard earlier, most of you


chunk_text:
much with that. However, what Onyx allows you to do is it allows you to load external data. 1074.45s - 1079.65s | And the reason for that is because it wanted to have that you could use the computational graph 1079.65s - 1084.77s | and then instead of having to save off the weights every single time and sending those, 1084.77s - 1089.33s | somebody could use the model itself with different weights on their own machines. 1089.33s - 1095.17s | However, it didn't really check to see, you know, where, uh, you were getting the data from you 1095.49s - 1100.29s | could go out of the directory that the data was supposed to be into and load something like Etsy 1100.29s - 1106.93s | password. Now imagine if this LLM is now hosted on a server and you can query it and Etsy password 1106.93s - 1112.13s | is included in your LLM output or your data. So you could query that potentially get the password 1112.13s - 1118.53s | through something like that. So what do you guys think about when you hear AI infrastructure? 1118.53s - 1123.17s | So as we heard earlier, most of you guys think model hosting, right? I mean, everyone knows 1123.17s - 1128.21s | hugging face. However, it doesn't just stop there. We have things like MLOps. And some of 1128.21s - 1131.89s | these are the ones where I was saying, you know, they might be hosted externally, even though 1131.89s - 1136.93s | they only have security for internal hosting, but it doesn't stop there. We have our model 1136.93s - 1143.89s | deployment and model serving. One of these fairly recently had a endpoint available where it was 1143.89s - 1148.69s | no matter how you hosted something, if the endpoint was active, and if he sent a pickle 1148.69s - 1153.73s | file to that endpoint, it would just run and execute on the server. It doesn't just stop there. 1153.73s - 1160.05s | We have vector databases. One of these may or may not have had something where in the filter, 1160.77s - 1165.89s | instead of doing an actual filter language, it just ran eval on whatever you gave it to do any 1165.89s - 1171.01s | filtering. Also not great. And then we have project hosting. And I mean, I could keep going and


chunk_text:
guys think model hosting, right? I mean, everyone knows 1123.17s - 1128.21s | hugging face. However, it doesn't just stop there. We have things like MLOps. And some of 1128.21s - 1131.89s | these are the ones where I was saying, you know, they might be hosted externally, even though 1131.89s - 1136.93s | they only have security for internal hosting, but it doesn't stop there. We have our model 1136.93s - 1143.89s | deployment and model serving. One of these fairly recently had a endpoint available where it was 1143.89s - 1148.69s | no matter how you hosted something, if the endpoint was active, and if he sent a pickle 1148.69s - 1153.73s | file to that endpoint, it would just run and execute on the server. It doesn't just stop there. 1153.73s - 1160.05s | We have vector databases. One of these may or may not have had something where in the filter, 1160.77s - 1165.89s | instead of doing an actual filter language, it just ran eval on whatever you gave it to do any 1165.89s - 1171.01s | filtering. Also not great. And then we have project hosting. And I mean, I could keep going and going, 1171.01s - 1176.05s | but as you can see, it's already a pretty overwhelming list. So this is all attack 1176.05s - 1180.61s | surface. If you're seeing this, that a company has this infrastructure deployed somewhere, 1180.61s - 1183.73s | these are all things that you can attack and look for similar things as well. 1185.33s - 1191.89s | So people are obviously trying to stop this and stop all of these issues from happening. And 1191.89s - 1196.93s | Hugging Face went and they created a model format called safe tensors. And safe tensors is one of 1196.93s - 1201.65s | those dumbed down formats. So just like JSON, where it only stores the simple data, in this case, 1201.65s - 1207.09s | it only stores the weights and the biases of the model. However, they needed people to start 1207.09s - 1211.65s | adapting it. And for anyone who's ever done something really, really cool, getting people 1211.65s - 1215.17s | to actually use it is kind of difficult, unless you give them an easy way to do that. 1215.73s - 1220.85s | So what Hugging Face did is they created a service where you could


chunk_text:
going, 1171.01s - 1176.05s | but as you can see, it's already a pretty overwhelming list. So this is all attack 1176.05s - 1180.61s | surface. If you're seeing this, that a company has this infrastructure deployed somewhere, 1180.61s - 1183.73s | these are all things that you can attack and look for similar things as well. 1185.33s - 1191.89s | So people are obviously trying to stop this and stop all of these issues from happening. And 1191.89s - 1196.93s | Hugging Face went and they created a model format called safe tensors. And safe tensors is one of 1196.93s - 1201.65s | those dumbed down formats. So just like JSON, where it only stores the simple data, in this case, 1201.65s - 1207.09s | it only stores the weights and the biases of the model. However, they needed people to start 1207.09s - 1211.65s | adapting it. And for anyone who's ever done something really, really cool, getting people 1211.65s - 1215.17s | to actually use it is kind of difficult, unless you give them an easy way to do that. 1215.73s - 1220.85s | So what Hugging Face did is they created a service where you could just log into your 1220.85s - 1226.85s | Hugging Face account, put in the repository for your Hugging Face model, and then it would take 1226.85s - 1231.97s | the PyTorch model, load that up, convert it into a safe tensors format, and then just send a pull 1231.97s - 1237.57s | request to your repository that you could review and accept. However, PyTorch was one of those 1237.57s - 1243.25s | vulnerable model formats. So what happened was that when you actually loaded up the model, 1243.25s - 1248.29s | there was arbitrary code execution on their server. And when we were first looking at this, 1248.29s - 1252.85s | we were trying to see, you know, was there just a way to steal the token of the bot so we could 1252.85s - 1258.21s | send those requests ourselves? And then we just did a test because we were like, you know, 1258.21s - 1263.25s | this probably won't happen, but we'll see anyway. And we noticed that the spaces actually had 1263.25s - 1268.77s | persistence across users. So that meant if I got arbitrary code running on the server, it would 1268.77s - 1278.21s | also


chunk_text:
just log into your 1220.85s - 1226.85s | Hugging Face account, put in the repository for your Hugging Face model, and then it would take 1226.85s - 1231.97s | the PyTorch model, load that up, convert it into a safe tensors format, and then just send a pull 1231.97s - 1237.57s | request to your repository that you could review and accept. However, PyTorch was one of those 1237.57s - 1243.25s | vulnerable model formats. So what happened was that when you actually loaded up the model, 1243.25s - 1248.29s | there was arbitrary code execution on their server. And when we were first looking at this, 1248.29s - 1252.85s | we were trying to see, you know, was there just a way to steal the token of the bot so we could 1252.85s - 1258.21s | send those requests ourselves? And then we just did a test because we were like, you know, 1258.21s - 1263.25s | this probably won't happen, but we'll see anyway. And we noticed that the spaces actually had 1263.25s - 1268.77s | persistence across users. So that meant if I got arbitrary code running on the server, it would 1268.77s - 1278.21s | also affect any models that Chloe uploaded as well. Which meant that not only could I modify 1278.21s - 1283.33s | other people's models, so let's say I want to put a backdoor into one of those safe tensors formats, 1283.33s - 1289.09s | I could also potentially steal private models. Which meant that, you know, you could upload your 1289.09s - 1294.05s | own private models that you didn't want public, and these have millions of downloads each month 1294.05s - 1298.21s | for the public ones, but the private ones have millions of dollars behind them for training. 1298.77s - 1304.29s | And what we can see here is we can see this is one of Google's models. This was not exploited, 1304.93s - 1310.13s | but you can see that there was the safe tensor conversion happening here, and at the time that 1310.13s - 1316.69s | we took the screenshot, this one model, just this one, had 3.8 million downloads. Now, remember that 1316.69s - 1323.33s | number Chloe was telling you earlier about 500,000 plus models on Hugging Face? Now, imagine how many 1323.33s - 1328.21s | of those, you know, if you could exploit any


chunk_text:
affect any models that Chloe uploaded as well. Which meant that not only could I modify 1278.21s - 1283.33s | other people's models, so let's say I want to put a backdoor into one of those safe tensors formats, 1283.33s - 1289.09s | I could also potentially steal private models. Which meant that, you know, you could upload your 1289.09s - 1294.05s | own private models that you didn't want public, and these have millions of downloads each month 1294.05s - 1298.21s | for the public ones, but the private ones have millions of dollars behind them for training. 1298.77s - 1304.29s | And what we can see here is we can see this is one of Google's models. This was not exploited, 1304.93s - 1310.13s | but you can see that there was the safe tensor conversion happening here, and at the time that 1310.13s - 1316.69s | we took the screenshot, this one model, just this one, had 3.8 million downloads. Now, remember that 1316.69s - 1323.33s | number Chloe was telling you earlier about 500,000 plus models on Hugging Face? Now, imagine how many 1323.33s - 1328.21s | of those, you know, if you could exploit any single one of them, ends up not being great. 1329.09s - 1334.37s | However, it doesn't just stop there with AI infrastructure. We have our ML Ops solutions, 1334.37s - 1340.37s | and as I mentioned earlier, security has forgotten the past. People are just trying 1340.37s - 1344.29s | to rush get these solutions up and running so that they can use them, and they're not really 1344.29s - 1349.73s | considering all the things that happened in the past, and we're just seeing a lot of vulnerabilities 1349.73s - 1354.69s | that we really shouldn't be seeing anymore. We're seeing that we have these unsafe serialization 1354.69s - 1360.93s | libraries like our nice little pickle there, but what we're also seeing is that the known safe 1360.93s - 1367.09s | formats like JSON are suddenly becoming vulnerable and exploitable. We're seeing missing 1367.09s - 1372.21s | authentication, hard-coded keys, I mean, SQL injections, XSS, really everything. The list goes 1372.21s - 1376.37s | actually so long it doesn't even all fit on my slide. You see how it gets cut off there? Really 1376.37s - 1383.33s | not great. So, obviously, we go through and we try


chunk_text:
single one of them, ends up not being great. 1329.09s - 1334.37s | However, it doesn't just stop there with AI infrastructure. We have our ML Ops solutions, 1334.37s - 1340.37s | and as I mentioned earlier, security has forgotten the past. People are just trying 1340.37s - 1344.29s | to rush get these solutions up and running so that they can use them, and they're not really 1344.29s - 1349.73s | considering all the things that happened in the past, and we're just seeing a lot of vulnerabilities 1349.73s - 1354.69s | that we really shouldn't be seeing anymore. We're seeing that we have these unsafe serialization 1354.69s - 1360.93s | libraries like our nice little pickle there, but what we're also seeing is that the known safe 1360.93s - 1367.09s | formats like JSON are suddenly becoming vulnerable and exploitable. We're seeing missing 1367.09s - 1372.21s | authentication, hard-coded keys, I mean, SQL injections, XSS, really everything. The list goes 1372.21s - 1376.37s | actually so long it doesn't even all fit on my slide. You see how it gets cut off there? Really 1376.37s - 1383.33s | not great. So, obviously, we go through and we try to fix these vulnerabilities wherever we find 1383.33s - 1388.29s | them, and a lot of these AI development frameworks, they're open source, so it makes them easier to 1388.29s - 1394.37s | review, and also easier for you to do any auditing for. However, what we've noticed is that when we 1394.37s - 1401.25s | do any vulnerability disclosure, there tends to be three different types of fields that occur, 1401.25s - 1407.57s | or things that occur. So, the first is some projects, when we go and disclose the vulnerability, 1407.57s - 1413.81s | they create a new feature, or they patch it, so that there's now safe by default, which means that 1413.81s - 1420.21s | whereas the function, when it was first used, it would run whatever arbitrary code, it now, it won't 1420.21s - 1425.17s | run any arbitrary code unless you give it an optional parameter. However, some people don't, 1425.17s - 1430.13s | or some projects didn't want to cause issues for current users, so what they did is, rather than 1430.13s - 1435.89s | adding safe by default, they added a safe option. However, you actually had to know about the safe


chunk_text:
to fix these vulnerabilities wherever we find 1383.33s - 1388.29s | them, and a lot of these AI development frameworks, they're open source, so it makes them easier to 1388.29s - 1394.37s | review, and also easier for you to do any auditing for. However, what we've noticed is that when we 1394.37s - 1401.25s | do any vulnerability disclosure, there tends to be three different types of fields that occur, 1401.25s - 1407.57s | or things that occur. So, the first is some projects, when we go and disclose the vulnerability, 1407.57s - 1413.81s | they create a new feature, or they patch it, so that there's now safe by default, which means that 1413.81s - 1420.21s | whereas the function, when it was first used, it would run whatever arbitrary code, it now, it won't 1420.21s - 1425.17s | run any arbitrary code unless you give it an optional parameter. However, some people don't, 1425.17s - 1430.13s | or some projects didn't want to cause issues for current users, so what they did is, rather than 1430.13s - 1435.89s | adding safe by default, they added a safe option. However, you actually had to know about the safe 1435.89s - 1440.05s | option and set a parameter to make it safe, and I mean, how many people here actually read 1440.05s - 1447.89s | documentation? Thank you guys for being honest, and maybe not so honest. Um, so, I mean, yeah, nobody 1447.89s - 1453.73s | really is going to use a non-safe by default function if they don't know about it, and don't 1453.73s - 1458.53s | read the documentation, and for some of these, the warnings weren't a big red box. I mean, they were 1458.53s - 1463.41s | hidden in documentation pretty far down the pages, and then the third type of project that we've been 1463.41s - 1468.21s | seeing is we've seen that some projects, rather than actually patching the vulnerability, they 1468.21s - 1472.93s | say that the vulnerability is a feature, and it won't be patched because it would mess with some 1472.93s - 1479.17s | of the functionality of the project. Now, let's look into some of these projects. So, NumPy load 1479.17s - 1485.25s | is the first type of project. What NumPy load did is that it used to be, uh, the underlying data 1485.25s - 1491.33s |


chunk_text:
1435.89s - 1440.05s | option and set a parameter to make it safe, and I mean, how many people here actually read 1440.05s - 1447.89s | documentation? Thank you guys for being honest, and maybe not so honest. Um, so, I mean, yeah, nobody 1447.89s - 1453.73s | really is going to use a non-safe by default function if they don't know about it, and don't 1453.73s - 1458.53s | read the documentation, and for some of these, the warnings weren't a big red box. I mean, they were 1458.53s - 1463.41s | hidden in documentation pretty far down the pages, and then the third type of project that we've been 1463.41s - 1468.21s | seeing is we've seen that some projects, rather than actually patching the vulnerability, they 1468.21s - 1472.93s | say that the vulnerability is a feature, and it won't be patched because it would mess with some 1472.93s - 1479.17s | of the functionality of the project. Now, let's look into some of these projects. So, NumPy load 1479.17s - 1485.25s | is the first type of project. What NumPy load did is that it used to be, uh, the underlying data 1485.25s - 1491.33s | structure was a pickle, uh, could potentially be a pickle, and now, if you load it by default, it is 1491.33s - 1496.77s | no longer vulnerable. However, if you have allow pickle set to true, then the arbitrary code gets 1496.77s - 1502.93s | executed, and does anybody want to guess just how many unsafe versions of this there are in GitHub? 1503.89s - 1511.89s | Anybody? No? More than 10,000? More than 10,000? Okay. Well, there was actually 87,000 files on 1511.89s - 1516.53s | GitHub that used this function incorrectly, and this is one that you actually have to set the 1516.53s - 1522.21s | parameter to be insecure to use incorrectly. So, you can't use it incorrectly by default. 1522.21s - 1529.81s | So, if this is, you know, 87,000 for something that you purposefully have to set to be exploitable, 1529.81s - 1535.01s | what about something like Torch load, where you have a option to make it safe, but by default, 1535.01s - 1540.69s | it isn't safe? So, once again, we did our nice little search, and we noticed that, unlike the 1540.69s - 1548.45s | 87,000 before, there were now 573,000 files


chunk_text:
structure was a pickle, uh, could potentially be a pickle, and now, if you load it by default, it is 1491.33s - 1496.77s | no longer vulnerable. However, if you have allow pickle set to true, then the arbitrary code gets 1496.77s - 1502.93s | executed, and does anybody want to guess just how many unsafe versions of this there are in GitHub? 1503.89s - 1511.89s | Anybody? No? More than 10,000? More than 10,000? Okay. Well, there was actually 87,000 files on 1511.89s - 1516.53s | GitHub that used this function incorrectly, and this is one that you actually have to set the 1516.53s - 1522.21s | parameter to be insecure to use incorrectly. So, you can't use it incorrectly by default. 1522.21s - 1529.81s | So, if this is, you know, 87,000 for something that you purposefully have to set to be exploitable, 1529.81s - 1535.01s | what about something like Torch load, where you have a option to make it safe, but by default, 1535.01s - 1540.69s | it isn't safe? So, once again, we did our nice little search, and we noticed that, unlike the 1540.69s - 1548.45s | 87,000 before, there were now 573,000 files on GitHub that were using this, and not only that, 1548.45s - 1554.77s | these files existed in projects that are actually being deployed by companies across their 1554.77s - 1558.77s | infrastructure. So, now that we've kind of talked about some of the vulnerabilities, I'm going to 1558.77s - 1568.50s | pass it back to Chloe to talk about the open source nature of AI. So, when it comes to verification 1568.50s - 1572.90s | challenges in open source, the thing to know is that there's so many challenges. All right, we 1572.90s - 1577.46s | already had challenges in the first place when it came to disclosing things for a while. It's gone 1577.46s - 1584.74s | better, but it's, like, substantially worse now. I mean, there's challenges with, you know, 1584.74s - 1589.94s | inconsistent code quality, hidden, like, security vulnerabilities, and then you have complex 1589.94s - 1596.10s | licensing issues, and then there's biases in the pre-trained models, poor documentation, and then, 1596.10s - 1604.42s | of course, we just keep creating new products that are AI-based. So, this becomes even harder 1604.42s - 1609.70s | because now we're obscuring transparency, and we're complicating things


chunk_text:
on GitHub that were using this, and not only that, 1548.45s - 1554.77s | these files existed in projects that are actually being deployed by companies across their 1554.77s - 1558.77s | infrastructure. So, now that we've kind of talked about some of the vulnerabilities, I'm going to 1558.77s - 1568.50s | pass it back to Chloe to talk about the open source nature of AI. So, when it comes to verification 1568.50s - 1572.90s | challenges in open source, the thing to know is that there's so many challenges. All right, we 1572.90s - 1577.46s | already had challenges in the first place when it came to disclosing things for a while. It's gone 1577.46s - 1584.74s | better, but it's, like, substantially worse now. I mean, there's challenges with, you know, 1584.74s - 1589.94s | inconsistent code quality, hidden, like, security vulnerabilities, and then you have complex 1589.94s - 1596.10s | licensing issues, and then there's biases in the pre-trained models, poor documentation, and then, 1596.10s - 1604.42s | of course, we just keep creating new products that are AI-based. So, this becomes even harder 1604.42s - 1609.70s | because now we're obscuring transparency, and we're complicating things even more so 1609.70s - 1616.59s | to be able to have effective vulnerability management. And to be honest, finding vulnerabilities 1616.59s - 1622.19s | in open source AI system is aided by, like, accessible code, community efforts, and specialized 1622.19s - 1629.63s | tools. However, we're not even close to that right now. It's complex contributions. It's rapid, 1629.63s - 1634.99s | like, evolution, and then also specialized knowledge that can really introduce some security 1634.99s - 1643.39s | flaws. So, frequent updates, dependencies, and gaps in testing further complicates and contributes to 1643.39s - 1650.35s | such risks. So, vulnerabilities, they stem from inadequate reviews, poor implementation, dependency 1650.35s - 1655.95s | issues, backdoors, insufficient security practices, and then you add on that rapid development because 1655.95s - 1660.83s | everyone has to get those products pushed in, you know, to make their companies happy. You also have 1660.83s - 1667.31s | misconfigured models and social engineering that can really do increase the security risk altogether. 1669.07s - 1674.67s | And I think next year we might try to do a talk, and don't steal it, okay? Don't steal it at all, 1674.67s - 1681.23s | on AI-assisted


chunk_text:
even more so 1609.70s - 1616.59s | to be able to have effective vulnerability management. And to be honest, finding vulnerabilities 1616.59s - 1622.19s | in open source AI system is aided by, like, accessible code, community efforts, and specialized 1622.19s - 1629.63s | tools. However, we're not even close to that right now. It's complex contributions. It's rapid, 1629.63s - 1634.99s | like, evolution, and then also specialized knowledge that can really introduce some security 1634.99s - 1643.39s | flaws. So, frequent updates, dependencies, and gaps in testing further complicates and contributes to 1643.39s - 1650.35s | such risks. So, vulnerabilities, they stem from inadequate reviews, poor implementation, dependency 1650.35s - 1655.95s | issues, backdoors, insufficient security practices, and then you add on that rapid development because 1655.95s - 1660.83s | everyone has to get those products pushed in, you know, to make their companies happy. You also have 1660.83s - 1667.31s | misconfigured models and social engineering that can really do increase the security risk altogether. 1669.07s - 1674.67s | And I think next year we might try to do a talk, and don't steal it, okay? Don't steal it at all, 1674.67s - 1681.23s | on AI-assisted code reviews because that's been emerging these days. So, that might be a future 1681.23s - 1687.55s | topic. Don't take it. I'm telling you, I know where you live. Just kidding. But seriously, don't take 1687.55s - 1693.71s | it. Okay. So, reporting challenges overall. You have to understand it is very, very tough. When we don't 1693.71s - 1701.47s | have clear messaging, we don't know what to expect. When we don't have clear idea of laws, we don't 1701.47s - 1708.19s | know what to expect. So, when we're trying to submit anything on disclosures or bug bounties, 1708.19s - 1715.15s | we don't know how the organization's going to respond. And we're scared of repercussions because 1715.15s - 1722.43s | there isn't enough good quality communication. And because there isn't any really good ways of 1722.43s - 1728.03s | reporting things, this becomes another issue. Because back in the day, when you would disclose 1728.03s - 1732.35s | things, they didn't have vulnerability disclosure policies. So, it always became the game of, 1732.35s - 1737.23s | how do I reach out to someone? Who do I reach out to? And that's still kind of a problem


chunk_text:
code reviews because that's been emerging these days. So, that might be a future 1681.23s - 1687.55s | topic. Don't take it. I'm telling you, I know where you live. Just kidding. But seriously, don't take 1687.55s - 1693.71s | it. Okay. So, reporting challenges overall. You have to understand it is very, very tough. When we don't 1693.71s - 1701.47s | have clear messaging, we don't know what to expect. When we don't have clear idea of laws, we don't 1701.47s - 1708.19s | know what to expect. So, when we're trying to submit anything on disclosures or bug bounties, 1708.19s - 1715.15s | we don't know how the organization's going to respond. And we're scared of repercussions because 1715.15s - 1722.43s | there isn't enough good quality communication. And because there isn't any really good ways of 1722.43s - 1728.03s | reporting things, this becomes another issue. Because back in the day, when you would disclose 1728.03s - 1732.35s | things, they didn't have vulnerability disclosure policies. So, it always became the game of, 1732.35s - 1737.23s | how do I reach out to someone? Who do I reach out to? And that's still kind of a problem to this day 1737.23s - 1743.47s | for traditional security. But imagine you contacting like data scientists or projects on GitHub, 1743.47s - 1747.63s | where people have never done security their whole life. So, you go to them like, hey, 1749.23s - 1754.75s | just wanted to let you know, I could possibly do remote code execution on you. And they come 1754.75s - 1759.23s | back like, oh, that's how it was built. It was built like that. So, as you can imagine, 1759.23s - 1763.79s | that makes things really challenging. And there's been times where we actually had to reach out to 1763.79s - 1769.39s | CISA to help us out to make sure that they get disclosed and those really serious vulnerabilities 1769.39s - 1777.25s | get patched. Now, I did mention we did speak to a couple bug bounty platforms. So, bug crowd in 1777.25s - 1784.45s | general, I wanted to have open-ended conversation. And I asked, how are things going? Like just a 1784.45s - 1790.61s | very simple question. How are things going? And what they told me about was the fact that 1790.61s - 1796.05s | hallucination has been an


chunk_text:
to this day 1737.23s - 1743.47s | for traditional security. But imagine you contacting like data scientists or projects on GitHub, 1743.47s - 1747.63s | where people have never done security their whole life. So, you go to them like, hey, 1749.23s - 1754.75s | just wanted to let you know, I could possibly do remote code execution on you. And they come 1754.75s - 1759.23s | back like, oh, that's how it was built. It was built like that. So, as you can imagine, 1759.23s - 1763.79s | that makes things really challenging. And there's been times where we actually had to reach out to 1763.79s - 1769.39s | CISA to help us out to make sure that they get disclosed and those really serious vulnerabilities 1769.39s - 1777.25s | get patched. Now, I did mention we did speak to a couple bug bounty platforms. So, bug crowd in 1777.25s - 1784.45s | general, I wanted to have open-ended conversation. And I asked, how are things going? Like just a 1784.45s - 1790.61s | very simple question. How are things going? And what they told me about was the fact that 1790.61s - 1796.05s | hallucination has been an ongoing concern because there's a lot of hunters out there that are 1796.05s - 1799.73s | submitting hallucinations. And then they're coming back to them like, well, that's a hallucination. 1799.73s - 1806.53s | That's not a security vulnerability. And this tends to upset the submitter, of course. But then 1806.53s - 1811.97s | you also have to deal with biases. So, bug crowd will be like, hey, this researcher found this 1811.97s - 1818.61s | bias in your model. And then they'll be like, we don't find that racist. So, there are times where 1818.61s - 1823.81s | you have to work with the organizations to make sure that everyone is aligned when it comes to 1823.81s - 1832.05s | biases. And then also payouts. Because there isn't really a good like severity scoring at this time, 1832.05s - 1835.81s | this makes payouts really difficult. So, bug crowd, I don't know if you're familiar with them, 1835.81s - 1840.13s | they use a vulnerability rating taxonomy that they created themselves. And it was a way to 1840.13s - 1847.89s | make things a little bit more closer to what companies see when they think of like severity 1847.89s


chunk_text:
ongoing concern because there's a lot of hunters out there that are 1796.05s - 1799.73s | submitting hallucinations. And then they're coming back to them like, well, that's a hallucination. 1799.73s - 1806.53s | That's not a security vulnerability. And this tends to upset the submitter, of course. But then 1806.53s - 1811.97s | you also have to deal with biases. So, bug crowd will be like, hey, this researcher found this 1811.97s - 1818.61s | bias in your model. And then they'll be like, we don't find that racist. So, there are times where 1818.61s - 1823.81s | you have to work with the organizations to make sure that everyone is aligned when it comes to 1823.81s - 1832.05s | biases. And then also payouts. Because there isn't really a good like severity scoring at this time, 1832.05s - 1835.81s | this makes payouts really difficult. So, bug crowd, I don't know if you're familiar with them, 1835.81s - 1840.13s | they use a vulnerability rating taxonomy that they created themselves. And it was a way to 1840.13s - 1847.89s | make things a little bit more closer to what companies see when they think of like severity 1847.89s - 1853.89s | scoring versus just fully relying on CVSS scoring on its own. And so, the thing is that they're 1853.89s - 1859.81s | still trying to learn from research and then also from how their community is responding 1859.81s - 1865.25s | and find these vulnerabilities on that severity scoring. And then the one thing that I have to 1865.25s - 1869.97s | commend them about was I asked them, well, how do you think we're going to get better submissions 1869.97s - 1877.89s | when it comes to AI vulnerabilities? And they said, it's our fault. We haven't given our 1877.89s - 1884.05s | researchers guides. We haven't provided them with the education content. We haven't done CTFs that 1884.05s - 1889.97s | really push the limits of people and their skill set. And I thought that was really good to have 1889.97s - 1897.49s | that type of ownership that they shared. Now, when it came to HackerOne, their more focused one 1897.49s - 1904.61s | was on the relationship between the customer and themselves and making sure that communication is 1904.61s - 1909.89s | clear and concise. Because if it's clear and concise, people know


chunk_text:
- 1853.89s | scoring versus just fully relying on CVSS scoring on its own. And so, the thing is that they're 1853.89s - 1859.81s | still trying to learn from research and then also from how their community is responding 1859.81s - 1865.25s | and find these vulnerabilities on that severity scoring. And then the one thing that I have to 1865.25s - 1869.97s | commend them about was I asked them, well, how do you think we're going to get better submissions 1869.97s - 1877.89s | when it comes to AI vulnerabilities? And they said, it's our fault. We haven't given our 1877.89s - 1884.05s | researchers guides. We haven't provided them with the education content. We haven't done CTFs that 1884.05s - 1889.97s | really push the limits of people and their skill set. And I thought that was really good to have 1889.97s - 1897.49s | that type of ownership that they shared. Now, when it came to HackerOne, their more focused one 1897.49s - 1904.61s | was on the relationship between the customer and themselves and making sure that communication is 1904.61s - 1909.89s | clear and concise. Because if it's clear and concise, people know what's in scope. They also 1909.89s - 1915.89s | know what could possibly be a payout or how bad this vulnerability could be. But there's a lot of 1915.89s - 1922.21s | issues coming around, like what is safety versus what is security? And then the payouts. So one of 1922.21s - 1927.33s | their concerns, of course, is if you don't pay people out the amount that they should be getting 1927.33s - 1932.77s | when they find such serious vulnerabilities in AI, do you think they're going to return? And they're 1932.77s - 1938.93s | probably not. But having to convince companies to give more can sometimes be a challenge, 1938.93s - 1944.13s | unfortunately. So they've always been really pushing for researchers to get the amount that 1944.13s - 1950.21s | they probably deserve, which has been great to hear. But they have been really pushing customers 1950.21s - 1955.25s | they need to be more specific. And then also letting everyone know that they're all still 1955.25s - 1961.01s | trying to figure out the payouts amount. And I did ask them if they are dealing with the hallucination 1961.01s - 1967.09s | situation as well.


chunk_text:
what's in scope. They also 1909.89s - 1915.89s | know what could possibly be a payout or how bad this vulnerability could be. But there's a lot of 1915.89s - 1922.21s | issues coming around, like what is safety versus what is security? And then the payouts. So one of 1922.21s - 1927.33s | their concerns, of course, is if you don't pay people out the amount that they should be getting 1927.33s - 1932.77s | when they find such serious vulnerabilities in AI, do you think they're going to return? And they're 1932.77s - 1938.93s | probably not. But having to convince companies to give more can sometimes be a challenge, 1938.93s - 1944.13s | unfortunately. So they've always been really pushing for researchers to get the amount that 1944.13s - 1950.21s | they probably deserve, which has been great to hear. But they have been really pushing customers 1950.21s - 1955.25s | they need to be more specific. And then also letting everyone know that they're all still 1955.25s - 1961.01s | trying to figure out the payouts amount. And I did ask them if they are dealing with the hallucination 1961.01s - 1967.09s | situation as well. And they said, yes, they are. It is an issue for them too. And then you have 1967.09s - 1974.21s | integrity. So integrity was more about trying to make things concise, just like HackerOne was 1974.21s - 1981.25s | doing in a sense, but also ensuring that there is a reward structure in play. And understanding 1981.25s - 1986.61s | what is safety, what is security has been one of their top priorities to make sure there's alignment 1986.61s - 1992.13s | across the customers and also the hunters themselves. And one of the things that was 1992.13s - 1996.45s | really interesting was they also have been trying their best to do alignment with their 1996.45s - 2002.37s | customers as well to ensure that everyone is kind of getting heard and seen. So overall, 2003.41s - 2008.61s | everyone is acknowledging that it is a work in progress and it's not perfect right now. 2008.61s - 2015.41s | And they could always use the help from community and also to hopefully to have more of an idea of 2015.41s - 2020.45s | what should be the severity for certain vulnerabilities and how that payout should 2020.45s -


chunk_text:
And they said, yes, they are. It is an issue for them too. And then you have 1967.09s - 1974.21s | integrity. So integrity was more about trying to make things concise, just like HackerOne was 1974.21s - 1981.25s | doing in a sense, but also ensuring that there is a reward structure in play. And understanding 1981.25s - 1986.61s | what is safety, what is security has been one of their top priorities to make sure there's alignment 1986.61s - 1992.13s | across the customers and also the hunters themselves. And one of the things that was 1992.13s - 1996.45s | really interesting was they also have been trying their best to do alignment with their 1996.45s - 2002.37s | customers as well to ensure that everyone is kind of getting heard and seen. So overall, 2003.41s - 2008.61s | everyone is acknowledging that it is a work in progress and it's not perfect right now. 2008.61s - 2015.41s | And they could always use the help from community and also to hopefully to have more of an idea of 2015.41s - 2020.45s | what should be the severity for certain vulnerabilities and how that payout should 2020.45s - 2025.65s | look like. And then last but not least, make sure that there's alignment with biases, that companies 2025.65s - 2031.25s | understand that certain things are sexist, certain things are racist, because that would make their 2031.25s - 2037.57s | life a lot easier as well. And then last but not least, standardizations is one of the things that 2037.57s - 2045.79s | they're looking for and they're working hard on at this time. So in summary, AI vulnerabilities 2045.79s - 2052.67s | are complex and distinct. And as you learn from CAS, it could be like going into a candy shop 2052.67s - 2056.75s | right now. So if you want to go make some money pretty fast, this might be the way to go. 2057.95s - 2064.59s | But there are threats out there that are more than just prompt injections. So that's the good 2064.59s - 2070.91s | news and bad news, but also you have data poisoning too. And there are rapid developments happening 2070.91s - 2076.99s | right now, especially this need of having better reliance and understanding of open source 2076.99s - 2082.83s | frameworks and hoping that to be more collaborative


chunk_text:
2025.65s | look like. And then last but not least, make sure that there's alignment with biases, that companies 2025.65s - 2031.25s | understand that certain things are sexist, certain things are racist, because that would make their 2031.25s - 2037.57s | life a lot easier as well. And then last but not least, standardizations is one of the things that 2037.57s - 2045.79s | they're looking for and they're working hard on at this time. So in summary, AI vulnerabilities 2045.79s - 2052.67s | are complex and distinct. And as you learn from CAS, it could be like going into a candy shop 2052.67s - 2056.75s | right now. So if you want to go make some money pretty fast, this might be the way to go. 2057.95s - 2064.59s | But there are threats out there that are more than just prompt injections. So that's the good 2064.59s - 2070.91s | news and bad news, but also you have data poisoning too. And there are rapid developments happening 2070.91s - 2076.99s | right now, especially this need of having better reliance and understanding of open source 2076.99s - 2082.83s | frameworks and hoping that to be more collaborative so then we can reduce the risks that are there. 2082.83s - 2087.87s | But also managing these vulnerabilities really demands for improving reporting and making sure 2087.87s - 2093.47s | that people are aware how vulnerability disclosure works and how it has worked and how to share that 2093.47s - 2098.35s | information with those that aren't aware of vulnerability disclosure policies. And having 2098.35s - 2104.35s | these strong partnerships such as like CISA is really helping everything out. And of course, 2104.91s - 2110.91s | you participating in these bug bounty programs also help the more people that report vulnerabilities, 2110.91s - 2116.35s | the more they learn too from it. So there is a call of action here. We are looking to partner 2116.35s - 2121.31s | with folks that want to help out in this situation because it is going to take a community to come 2121.31s - 2125.79s | about to try to make things a little bit better so we can have better standardization, but also 2125.79s - 2131.15s | better collaboration and be more specific about what are we looking for, what's the severity levels 2131.15s - 2135.63s | for these vulnerabilities,


chunk_text:
so then we can reduce the risks that are there. 2082.83s - 2087.87s | But also managing these vulnerabilities really demands for improving reporting and making sure 2087.87s - 2093.47s | that people are aware how vulnerability disclosure works and how it has worked and how to share that 2093.47s - 2098.35s | information with those that aren't aware of vulnerability disclosure policies. And having 2098.35s - 2104.35s | these strong partnerships such as like CISA is really helping everything out. And of course, 2104.91s - 2110.91s | you participating in these bug bounty programs also help the more people that report vulnerabilities, 2110.91s - 2116.35s | the more they learn too from it. So there is a call of action here. We are looking to partner 2116.35s - 2121.31s | with folks that want to help out in this situation because it is going to take a community to come 2121.31s - 2125.79s | about to try to make things a little bit better so we can have better standardization, but also 2125.79s - 2131.15s | better collaboration and be more specific about what are we looking for, what's the severity levels 2131.15s - 2135.63s | for these vulnerabilities, and make sure that you guys get paid out the amount you're supposed to 2135.63s - 2142.03s | get paid out for these vulnerabilities as well. I do have cards, so more than happy to also give 2142.03s - 2148.51s | you my card. I'm going to also just say thank you so much for having us. We'll open it up for Q&A. 2149.47s - 2153.79s | And yeah, if you ever want to reach out to us, our DMs are open. Feel free to connect with us 2153.79s - 2158.67s | as well. And thank you so much for existing. And once again, thank you to the Bug Bounty Village 2158.67s - 2185.94s | and to DEF CON and to all the goons and the volunteers. Any questions? Oh, yeah. No, 2185.94s - 2195.58s | they basically wanted to replicate it completely for their own project. Pretty much. Yeah. Remember 2195.58s - 2201.50s | those three groups? The competitors is definitely one of the top ones I would say in AI. There's the 2201.50s - 2206.91s | group that we're seeing a lot of these kind of attacks. Next question. Yeah. 2213.87s - 2219.47s | Yeah. So there's a


chunk_text:
and make sure that you guys get paid out the amount you're supposed to 2135.63s - 2142.03s | get paid out for these vulnerabilities as well. I do have cards, so more than happy to also give 2142.03s - 2148.51s | you my card. I'm going to also just say thank you so much for having us. We'll open it up for Q&A. 2149.47s - 2153.79s | And yeah, if you ever want to reach out to us, our DMs are open. Feel free to connect with us 2153.79s - 2158.67s | as well. And thank you so much for existing. And once again, thank you to the Bug Bounty Village 2158.67s - 2185.94s | and to DEF CON and to all the goons and the volunteers. Any questions? Oh, yeah. No, 2185.94s - 2195.58s | they basically wanted to replicate it completely for their own project. Pretty much. Yeah. Remember 2195.58s - 2201.50s | those three groups? The competitors is definitely one of the top ones I would say in AI. There's the 2201.50s - 2206.91s | group that we're seeing a lot of these kind of attacks. Next question. Yeah. 2213.87s - 2219.47s | Yeah. So there's a few different vulnerabilities in gguf. They've all been patched at this point. 2219.47s - 2227.15s | So gguf is normally used for, have you heard of llama CPP? Right. So gguf came from ggml, 2227.15s - 2233.39s | which is like one of the first open source AI models. It's just C++. A lot of the vulnerabilities 2233.39s - 2239.71s | that are in that specific one are pretty much all parsing vulnerabilities. So Cisco Talos found 2239.71s - 2244.67s | one that was fairly exploitable a while back. And what that one was, was there was like a 2245.87s - 2250.83s | max size and you could set the integer to the max size and then it would overflow when it actually 2250.83s - 2254.59s | allocated the memory. So it would do like a zero allocation and then would read it into, 2255.23s - 2262.03s | you know, whatever you had. So you could overflow any memory that way. However, because it is C++ 2262.03s - 2268.75s | or C and C++, and you only really have one attack through that component, what you see is that a lot 2268.75s - 2273.71s | of time, unless the system


chunk_text:
few different vulnerabilities in gguf. They've all been patched at this point. 2219.47s - 2227.15s | So gguf is normally used for, have you heard of llama CPP? Right. So gguf came from ggml, 2227.15s - 2233.39s | which is like one of the first open source AI models. It's just C++. A lot of the vulnerabilities 2233.39s - 2239.71s | that are in that specific one are pretty much all parsing vulnerabilities. So Cisco Talos found 2239.71s - 2244.67s | one that was fairly exploitable a while back. And what that one was, was there was like a 2245.87s - 2250.83s | max size and you could set the integer to the max size and then it would overflow when it actually 2250.83s - 2254.59s | allocated the memory. So it would do like a zero allocation and then would read it into, 2255.23s - 2262.03s | you know, whatever you had. So you could overflow any memory that way. However, because it is C++ 2262.03s - 2268.75s | or C and C++, and you only really have one attack through that component, what you see is that a lot 2268.75s - 2273.71s | of time, unless the system doesn't have ASLR, you won't be able to actually exploit it too, 2273.71s - 2284.11s | too much past DOS. Do you have any other questions about that with gguf? No. So they did fix those 2284.11s - 2294.21s | vulnerabilities. Yeah. Any other questions? Yeah. So also I've realized I'm going to repeat some of 2294.21s - 2299.01s | the questions for the camera because they might not be able to hear. So you asked if there was 2299.01s - 2305.73s | any payoff for the Hugging Face vulnerability. So we are a research organization, which means 2305.73s - 2310.05s | that we actually disclose everything completely without bug bounty, just because we are doing it 2310.05s - 2317.01s | as a company. However, if you did do it as a bug bounty hunter, Hugging Face does have a bug bounty 2317.01s - 2343.31s | program. Any other questions? Yeah. Yeah. So he asked if there were any things AI uses a lot of 2343.31s - 2348.99s | power, can you do anything with that? So what we've actually seen is that it's less about power 2348.99s - 2355.07s | usage and more about CPU and GPU cycles. So


chunk_text:
doesn't have ASLR, you won't be able to actually exploit it too, 2273.71s - 2284.11s | too much past DOS. Do you have any other questions about that with gguf? No. So they did fix those 2284.11s - 2294.21s | vulnerabilities. Yeah. Any other questions? Yeah. So also I've realized I'm going to repeat some of 2294.21s - 2299.01s | the questions for the camera because they might not be able to hear. So you asked if there was 2299.01s - 2305.73s | any payoff for the Hugging Face vulnerability. So we are a research organization, which means 2305.73s - 2310.05s | that we actually disclose everything completely without bug bounty, just because we are doing it 2310.05s - 2317.01s | as a company. However, if you did do it as a bug bounty hunter, Hugging Face does have a bug bounty 2317.01s - 2343.31s | program. Any other questions? Yeah. Yeah. So he asked if there were any things AI uses a lot of 2343.31s - 2348.99s | power, can you do anything with that? So what we've actually seen is that it's less about power 2348.99s - 2355.07s | usage and more about CPU and GPU cycles. So to actually host these models, it costs quite a bit. 2355.07s - 2360.27s | So instead of, you know, saying a response taking 10 seconds, if you can make it take two minutes or 2360.27s - 2366.03s | more, and there are quite a few attacks like that. The most famous is probably the Ouroboros attack. 2366.03s - 2371.39s | So, you know, say like snake eats tail, and you keep going and get it to generate, and it'll 2371.39s - 2376.19s | just keep on generating until it hits the token limit. So there's actually a lot of research being 2376.19s - 2384.67s | done into that. I actually did a talk last year at DEF CON on climate change and the impact on 2384.67s - 2388.91s | cybersecurity. And I did touch on that. So I recommend checking out. I think the talk was at 2388.91s - 2393.31s | the Crypto Privacy Village last year. So it's probably posted online. And you can reach out 2393.31s - 2401.81s | to me if you have questions on that. Any other questions? All right. Well, thank you guys so 2401.81s - 2404.37s | much for coming and feel free to


chunk_text:
to actually host these models, it costs quite a bit. 2355.07s - 2360.27s | So instead of, you know, saying a response taking 10 seconds, if you can make it take two minutes or 2360.27s - 2366.03s | more, and there are quite a few attacks like that. The most famous is probably the Ouroboros attack. 2366.03s - 2371.39s | So, you know, say like snake eats tail, and you keep going and get it to generate, and it'll 2371.39s - 2376.19s | just keep on generating until it hits the token limit. So there's actually a lot of research being 2376.19s - 2384.67s | done into that. I actually did a talk last year at DEF CON on climate change and the impact on 2384.67s - 2388.91s | cybersecurity. And I did touch on that. So I recommend checking out. I think the talk was at 2388.91s - 2393.31s | the Crypto Privacy Village last year. So it's probably posted online. And you can reach out 2393.31s - 2401.81s | to me if you have questions on that. Any other questions? All right. Well, thank you guys so 2401.81s - 2404.37s | much for coming and feel free to come up to us afterwards.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=Z6Wq1iqTyWg", "title": "DEF CON 32 - Custom, cheap, easy, and safe badges without starting from scratch - securelyfitz", "description": "Electronic conference badges are cool and everything, but they're A LOT of time, money, and effort including but not limited to hardware, software and art design, testing, manufacturing, testing, provisioning, and repairing.\n\nI'll share OpenTaxus, a relatively simple, cheap, mass-producible, and open-source badge design. We'll start out by looking at and understanding the design and implementation, highlighting the areas worth customizing (and which to leave as-s). I'll do a walkthrough of a few changes to customize the design - in KiCAD for hardware changes, and in CircuitPython for software changes.\n\nWe'll wrap up with some discussion of how to handle cost reduction to fit in a certain budget, manage badge logistics for events of different sizes, and warn about some of the many pitfalls that electronic badges suffer. You should walk away with the ability to customize a badge to be mass produced for your own event.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2605, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.76s | This text was transcribed using whisper model: large-v2 I haven't spoken at DEF CON in quite a while, so I'm kind of excited to be here. 3.76s - 8.50s | I'm glad that we're in this room and not one of those other big ones. 8.50s - 11.24s | How many of you have made badges before? 11.24s - 13.96s | How many of you have used badges before? 13.96s - 15.68s | How many of you like badges? 15.68s - 17.72s | How many of you like badges that work? 17.72s - 19.72s | How many of you have badges that work? 19.72s - 22.16s | How many of you have badges that don't work? 22.16s - 23.96s | Not necessarily this conference, but have you ever been at a conference and you get 23.96s - 25.44s | a badge and it doesn't work? 25.44s - 27.70s | Yeah, me too. 27.70s - 29.68s | How many of you didn't even bother turning it on because you weren't sure it was going 29.68s - 31.22s | to work anyway? 31.22s - 38.22s | So the point of this talk is because I have made a few badges and I have a habit of reusing 38.22s - 43.42s | as much as absolutely possible because the chief virtue of


chunk_text:
I'm kind of excited to be here. 3.76s - 8.50s | I'm glad that we're in this room and not one of those other big ones. 8.50s - 11.24s | How many of you have made badges before? 11.24s - 13.96s | How many of you have used badges before? 13.96s - 15.68s | How many of you like badges? 15.68s - 17.72s | How many of you like badges that work? 17.72s - 19.72s | How many of you have badges that work? 19.72s - 22.16s | How many of you have badges that don't work? 22.16s - 23.96s | Not necessarily this conference, but have you ever been at a conference and you get 23.96s - 25.44s | a badge and it doesn't work? 25.44s - 27.70s | Yeah, me too. 27.70s - 29.68s | How many of you didn't even bother turning it on because you weren't sure it was going 29.68s - 31.22s | to work anyway? 31.22s - 38.22s | So the point of this talk is because I have made a few badges and I have a habit of reusing 38.22s - 43.42s | as much as absolutely possible because the chief virtue of an engineer is laziness, right? 43.42s - 47.22s | So if I'm going to put the effort into making a badge that I can reuse, I want to make sure 47.22s - 49.70s | other people know that it's available and they can do that too. 49.70s - 54.66s | I know there's tons of badges, but like, and many of them are open hardware, open source. 54.66s - 57.88s | And rather than, of course, you know, just taking an existing open source one, I figured 58.06s - 60.06s | why not do another open source one? 60.06s - 62.54s | Because you know, so that's how it goes. 62.54s - 66.94s | So I'm going to tell you about an open hardware badge design that I've worked on and that 66.94s - 71.42s | I think will be useful because it's been tested, been through two conferences already. 71.42s - 73.94s | It's going to be on track for a third one. 73.94s - 77.34s | And I want it to be open hardware so that anybody who wants to make a badge doesn't 77.34s - 78.34s | have to start from scratch. 78.34s - 82.74s | You


chunk_text:
an engineer is laziness, right? 43.42s - 47.22s | So if I'm going to put the effort into making a badge that I can reuse, I want to make sure 47.22s - 49.70s | other people know that it's available and they can do that too. 49.70s - 54.66s | I know there's tons of badges, but like, and many of them are open hardware, open source. 54.66s - 57.88s | And rather than, of course, you know, just taking an existing open source one, I figured 58.06s - 60.06s | why not do another open source one? 60.06s - 62.54s | Because you know, so that's how it goes. 62.54s - 66.94s | So I'm going to tell you about an open hardware badge design that I've worked on and that 66.94s - 71.42s | I think will be useful because it's been tested, been through two conferences already. 71.42s - 73.94s | It's going to be on track for a third one. 73.94s - 77.34s | And I want it to be open hardware so that anybody who wants to make a badge doesn't 77.34s - 78.34s | have to start from scratch. 78.34s - 82.74s | You can just take this open hardware, change it how you want, however you want to do. 82.74s - 83.74s | Just change the artwork. 83.74s - 84.74s | You can change software. 84.74s - 86.30s | You could keep it exactly the same. 86.30s - 90.28s | Just like change the conference name and you've got a badge. 90.28s - 92.60s | So a little bit about badges, or me. 92.60s - 93.60s | I'm Joe. 93.60s - 94.60s | Hi. 94.60s - 96.72s | I teach classes on hardware hacking and reverse engineering. 96.72s - 100.56s | I've been in Las Vegas for a week already because I was doing training at Black Hat. 100.56s - 101.94s | So I'm a little bit exhausted. 101.94s - 104.84s | But after this, I'm going to go hang around the pool, which is what I've been looking 104.84s - 106.88s | forward to for the past week. 106.88s - 111.92s | Yeah, I do hardware stuff. 111.92s - 114.52s | So let's talk about, this is what I'm going to talk about today. 114.52s - 118.74s | Why we have badges, what this thing is that I'm talking about, what my


chunk_text:
can just take this open hardware, change it how you want, however you want to do. 82.74s - 83.74s | Just change the artwork. 83.74s - 84.74s | You can change software. 84.74s - 86.30s | You could keep it exactly the same. 86.30s - 90.28s | Just like change the conference name and you've got a badge. 90.28s - 92.60s | So a little bit about badges, or me. 92.60s - 93.60s | I'm Joe. 93.60s - 94.60s | Hi. 94.60s - 96.72s | I teach classes on hardware hacking and reverse engineering. 96.72s - 100.56s | I've been in Las Vegas for a week already because I was doing training at Black Hat. 100.56s - 101.94s | So I'm a little bit exhausted. 101.94s - 104.84s | But after this, I'm going to go hang around the pool, which is what I've been looking 104.84s - 106.88s | forward to for the past week. 106.88s - 111.92s | Yeah, I do hardware stuff. 111.92s - 114.52s | So let's talk about, this is what I'm going to talk about today. 114.52s - 118.74s | Why we have badges, what this thing is that I'm talking about, what my vision for it is, 118.74s - 123.50s | what we can do today, and some logistics and pitfalls. 123.50s - 127.78s | And it started out as kind of like a workshop-y thing, but the space and the venue worked 127.78s - 131.48s | better for us to do kind of more of a talk slash demo. 131.48s - 135.22s | So I'm going to talk a bit, and then I'm going to show you some software and hardware. 135.22s - 137.14s | And then we'll have some time for questions. 137.14s - 138.14s | Sound good? 138.14s - 139.14s | Any questions? 139.14s - 140.14s | Everybody ready? 140.14s - 141.14s | Okay. 141.14s - 142.14s | Listen carefully. 143.04s - 144.60s | What are badges? 144.60s - 145.60s | Why do we have badges? 145.60s - 146.60s | Pretty much access. 146.60s - 149.62s | Like, whether it's a wristband or a badge or something that hangs around your neck or 149.62s - 152.64s | something you tattoo on your forehead, we need a way to know who's supposed to be here 152.64s - 156.40s | or who's not, who paid, who didn't, who gets free drinks, and


chunk_text:
vision for it is, 118.74s - 123.50s | what we can do today, and some logistics and pitfalls. 123.50s - 127.78s | And it started out as kind of like a workshop-y thing, but the space and the venue worked 127.78s - 131.48s | better for us to do kind of more of a talk slash demo. 131.48s - 135.22s | So I'm going to talk a bit, and then I'm going to show you some software and hardware. 135.22s - 137.14s | And then we'll have some time for questions. 137.14s - 138.14s | Sound good? 138.14s - 139.14s | Any questions? 139.14s - 140.14s | Everybody ready? 140.14s - 141.14s | Okay. 141.14s - 142.14s | Listen carefully. 143.04s - 144.60s | What are badges? 144.60s - 145.60s | Why do we have badges? 145.60s - 146.60s | Pretty much access. 146.60s - 149.62s | Like, whether it's a wristband or a badge or something that hangs around your neck or 149.62s - 152.64s | something you tattoo on your forehead, we need a way to know who's supposed to be here 152.64s - 156.40s | or who's not, who paid, who didn't, who gets free drinks, and who doesn't. 156.40s - 157.96s | So we're going to have them anyway. 157.96s - 159.82s | We might as well make use of them. 159.82s - 161.44s | So we want the cool factor. 161.44s - 163.84s | This is a handful of badges that I designed. 163.84s - 167.34s | My first one over here was for B-Sides Portland 10 years ago. 167.34s - 171.08s | It was a bus pirate, but the PCB shape was changed. 171.08s - 172.80s | So it was the shape of a Nyan cat. 172.80s - 177.74s | So the rainbow ribbon cables that come out of the bus pirate were like the trail of rainbow 177.74s - 178.74s | behind it. 178.74s - 186.38s | And a couple of these were B-Sides Portland, some 503 Party badges, 44Con in London, TRCon, 186.38s - 191.66s | which has kind of evolved into the Dan Initiative now. 191.66s - 192.66s | So yeah. 192.66s - 193.66s | They look cool. 193.66s - 194.66s | And you want them to look cool. 194.66s - 198.06s | And as a conference organizer, you want people to say, oh, this is a cool badge. 198.06s -


chunk_text:
who doesn't. 156.40s - 157.96s | So we're going to have them anyway. 157.96s - 159.82s | We might as well make use of them. 159.82s - 161.44s | So we want the cool factor. 161.44s - 163.84s | This is a handful of badges that I designed. 163.84s - 167.34s | My first one over here was for B-Sides Portland 10 years ago. 167.34s - 171.08s | It was a bus pirate, but the PCB shape was changed. 171.08s - 172.80s | So it was the shape of a Nyan cat. 172.80s - 177.74s | So the rainbow ribbon cables that come out of the bus pirate were like the trail of rainbow 177.74s - 178.74s | behind it. 178.74s - 186.38s | And a couple of these were B-Sides Portland, some 503 Party badges, 44Con in London, TRCon, 186.38s - 191.66s | which has kind of evolved into the Dan Initiative now. 191.66s - 192.66s | So yeah. 192.66s - 193.66s | They look cool. 193.66s - 194.66s | And you want them to look cool. 194.66s - 198.06s | And as a conference organizer, you want people to say, oh, this is a cool badge. 198.06s - 199.06s | Take pictures of it. 199.06s - 200.06s | Post it on social media. 200.06s - 201.88s | And say, I can't wait until I come back next year. 201.88s - 207.04s | And then conference organizers get more people coming, and yada, yada, yada. 207.04s - 208.64s | Why else do we want badges? 208.64s - 211.86s | Electronic badges hopefully have some sort of interaction. 211.86s - 220.15s | And you can do interaction with a paper badge, but electronic badges are a little bit cooler. 220.15s - 226.19s | So this is a few years ago, Joe Grand's previous DEF CON badge was a little like magic tokens. 226.19s - 228.89s | They had a piece of stone on the front. 228.89s - 234.25s | And he used a type of NFC, not like standard NFC, but like a near field communication, 234.25s - 237.09s | inductive communication method, which is pretty cool. 237.09s - 240.75s | But what happens, people go around, they go up to people they don't know, they interact 240.75s - 243.05s | with the badge, they meet people. 243.05s - 247.63s | That's kind of like the best part about an


chunk_text:
199.06s | Take pictures of it. 199.06s - 200.06s | Post it on social media. 200.06s - 201.88s | And say, I can't wait until I come back next year. 201.88s - 207.04s | And then conference organizers get more people coming, and yada, yada, yada. 207.04s - 208.64s | Why else do we want badges? 208.64s - 211.86s | Electronic badges hopefully have some sort of interaction. 211.86s - 220.15s | And you can do interaction with a paper badge, but electronic badges are a little bit cooler. 220.15s - 226.19s | So this is a few years ago, Joe Grand's previous DEF CON badge was a little like magic tokens. 226.19s - 228.89s | They had a piece of stone on the front. 228.89s - 234.25s | And he used a type of NFC, not like standard NFC, but like a near field communication, 234.25s - 237.09s | inductive communication method, which is pretty cool. 237.09s - 240.75s | But what happens, people go around, they go up to people they don't know, they interact 240.75s - 243.05s | with the badge, they meet people. 243.05s - 247.63s | That's kind of like the best part about an electronic badge. 247.63s - 249.25s | And also, like hopefully, there's a lot. 249.25s - 252.35s | How many of you have ever designed a PCB before? 252.35s - 257.15s | How many of you have ever written embedded microcontroller code before, right? 257.15s - 260.17s | How many of you have hacked on a badge, an electronic badge? 260.17s - 263.45s | So hopefully, the badge is an opportunity for you to get your hands on some hardware 263.45s - 265.11s | that you might not have otherwise done. 265.11s - 271.07s | So this one required a somewhat pricey programmer, but like once you had that, you could do whatever 271.07s - 272.07s | you want. 272.07s - 273.73s | There was also a serial port that you could interact with it. 273.73s - 279.95s | But like getting people to interact with tools and learn something is kind of a great goal. 279.95s - 281.85s | So why open taxes? 281.85s - 284.81s | So anybody know what a badger is? 284.83s - 287.93s | American badger, taxidea taxes. 287.93s - 291.91s | So this is the open badge, open badger, open taxes. 291.91s - 298.63s |


chunk_text:
electronic badge. 247.63s - 249.25s | And also, like hopefully, there's a lot. 249.25s - 252.35s | How many of you have ever designed a PCB before? 252.35s - 257.15s | How many of you have ever written embedded microcontroller code before, right? 257.15s - 260.17s | How many of you have hacked on a badge, an electronic badge? 260.17s - 263.45s | So hopefully, the badge is an opportunity for you to get your hands on some hardware 263.45s - 265.11s | that you might not have otherwise done. 265.11s - 271.07s | So this one required a somewhat pricey programmer, but like once you had that, you could do whatever 271.07s - 272.07s | you want. 272.07s - 273.73s | There was also a serial port that you could interact with it. 273.73s - 279.95s | But like getting people to interact with tools and learn something is kind of a great goal. 279.95s - 281.85s | So why open taxes? 281.85s - 284.81s | So anybody know what a badger is? 284.83s - 287.93s | American badger, taxidea taxes. 287.93s - 291.91s | So this is the open badge, open badger, open taxes. 291.91s - 298.63s | Not tax is, like things you pay, not tax as the big state, but like taxes. 298.63s - 302.07s | And at some point, I'm going to have a cool logo, and it's going to be like a badger with 302.07s - 305.15s | a badge on that says open taxes. 305.15s - 307.91s | But you can just visualize that right now. 307.91s - 311.63s | Or go ask Dolly to make that during the talk, and we can post it up there. 311.63s - 313.63s | You can do a pull request. 313.65s - 315.49s | So it's open, right? 315.49s - 318.31s | This is the URL right now, open taxes. 318.31s - 322.73s | And that is kind of like the sanitized, cleaned up version that has like all the strings for 322.73s - 326.01s | specific events and all the logos and stuff removed. 326.01s - 330.05s | So you can go and like copy this and make it and not have to worry about like infringing 330.05s - 335.21s | on anyone's artwork, copyright, or all these detailed crappy things. 335.21s - 338.29s | So yeah, I'll put this URL up later. 338.29s -


chunk_text:
Not tax is, like things you pay, not tax as the big state, but like taxes. 298.63s - 302.07s | And at some point, I'm going to have a cool logo, and it's going to be like a badger with 302.07s - 305.15s | a badge on that says open taxes. 305.15s - 307.91s | But you can just visualize that right now. 307.91s - 311.63s | Or go ask Dolly to make that during the talk, and we can post it up there. 311.63s - 313.63s | You can do a pull request. 313.65s - 315.49s | So it's open, right? 315.49s - 318.31s | This is the URL right now, open taxes. 318.31s - 322.73s | And that is kind of like the sanitized, cleaned up version that has like all the strings for 322.73s - 326.01s | specific events and all the logos and stuff removed. 326.01s - 330.05s | So you can go and like copy this and make it and not have to worry about like infringing 330.05s - 335.21s | on anyone's artwork, copyright, or all these detailed crappy things. 335.21s - 338.29s | So yeah, I'll put this URL up later. 338.29s - 342.93s | But I think it's the only thing on GitHub called open taxes right now. 342.93s - 345.43s | So it's custom, right? 345.43s - 349.11s | Off-the-shelf is kind of cool, like if you have something interesting, but there's really 349.11s - 351.59s | not a lot of off-the-shelf options. 351.59s - 358.35s | One cool one we did a few years ago for 503, DC503's badge, was we had these little devices. 358.35s - 360.75s | They were like this big. 360.75s - 365.67s | They were smart response things, so they're made for classrooms where you answer questions. 365.67s - 367.39s | The teacher pops up on the screen. 367.39s - 371.19s | But we took them, we reflashed the firmware with a couple games and used that as our badge. 371.19s - 372.63s | So we didn't design hardware. 373.33s - 376.85s | We just took pre-made hardware and programmed it, which is kind of cool. 376.85s - 377.85s | But this is the process. 377.85s - 382.73s | I mean, we go through prototyping phases, we have an actual badge, and then we have 382.73s - 383.73s | a second iteration. 383.73s - 387.69s


chunk_text:
342.93s | But I think it's the only thing on GitHub called open taxes right now. 342.93s - 345.43s | So it's custom, right? 345.43s - 349.11s | Off-the-shelf is kind of cool, like if you have something interesting, but there's really 349.11s - 351.59s | not a lot of off-the-shelf options. 351.59s - 358.35s | One cool one we did a few years ago for 503, DC503's badge, was we had these little devices. 358.35s - 360.75s | They were like this big. 360.75s - 365.67s | They were smart response things, so they're made for classrooms where you answer questions. 365.67s - 367.39s | The teacher pops up on the screen. 367.39s - 371.19s | But we took them, we reflashed the firmware with a couple games and used that as our badge. 371.19s - 372.63s | So we didn't design hardware. 373.33s - 376.85s | We just took pre-made hardware and programmed it, which is kind of cool. 376.85s - 377.85s | But this is the process. 377.85s - 382.73s | I mean, we go through prototyping phases, we have an actual badge, and then we have 382.73s - 383.73s | a second iteration. 383.73s - 387.69s | This is B-side San Francisco's badge, which is essentially the same hardware. 387.69s - 392.89s | But two conferences, two badges, somewhat similar, but it's okay because there's a lot 392.89s - 396.53s | of conferences and there's a lot of badges. 396.53s - 400.13s | So open, custom, and we also want it to be cheap. 400.13s - 404.81s | My objective is that there's a lot of change in the microcontroller world lately. 404.81s - 410.63s | This uses the RP2040, which is the predecessor to the fancy chip that's on a DEF CON badge. 410.63s - 412.11s | It's amazing because it's dirt cheap. 412.11s - 417.43s | In quantity, it's like 60 cents, and that includes USB interface. 417.43s - 422.87s | So there's a lot of extra chips you need sometimes to interface with a badge easily, and this 422.87s - 423.87s | doesn't need them. 423.87s - 426.31s | So it is extra cheap. 426.31s - 430.11s | Something else I've learned is when you get stuff assembled overseas, if you go to a manufacturer 430.11s - 435.33s | that does a lot of it, if you wanted to assemble 100 badges, you


chunk_text:
| This is B-side San Francisco's badge, which is essentially the same hardware. 387.69s - 392.89s | But two conferences, two badges, somewhat similar, but it's okay because there's a lot 392.89s - 396.53s | of conferences and there's a lot of badges. 396.53s - 400.13s | So open, custom, and we also want it to be cheap. 400.13s - 404.81s | My objective is that there's a lot of change in the microcontroller world lately. 404.81s - 410.63s | This uses the RP2040, which is the predecessor to the fancy chip that's on a DEF CON badge. 410.63s - 412.11s | It's amazing because it's dirt cheap. 412.11s - 417.43s | In quantity, it's like 60 cents, and that includes USB interface. 417.43s - 422.87s | So there's a lot of extra chips you need sometimes to interface with a badge easily, and this 422.87s - 423.87s | doesn't need them. 423.87s - 426.31s | So it is extra cheap. 426.31s - 430.11s | Something else I've learned is when you get stuff assembled overseas, if you go to a manufacturer 430.11s - 435.33s | that does a lot of it, if you wanted to assemble 100 badges, you need 100 chips. 435.33s - 438.13s | You buy those chips, you get the 100-chip price. 438.13s - 442.03s | If you go and get them assembled, and you get 100 badges assembled, they get the chips 442.03s - 450.09s | at the $1,000 or $10,000 or real price, R-E-E-L, which is also the R-E-A-L price that manufacturers 450.09s - 451.09s | get to pay. 451.09s - 456.29s | So I've actually found that for prototyping, it's cheaper for me to get a prototype assembled 456.29s - 461.61s | than it is for me to get the PCBs and buy the parts and assemble it myself, which is 461.61s - 464.87s | kind of a weird world we're in. 464.87s - 467.11s | So yeah, right now, this is the last iteration. 467.11s - 475.63s | These were $5.70 each, plus some engineering costs, which I think is pretty cool. 475.63s - 479.31s | $6 for a hardware badge that interacts is kind of a nice target. 479.31s - 480.31s | I was aiming for $5. 480.31s - 484.25s | Actually, I started aiming for $10, and then I went and did some cost reduction and managed 484.25s - 487.49s


chunk_text:
need 100 chips. 435.33s - 438.13s | You buy those chips, you get the 100-chip price. 438.13s - 442.03s | If you go and get them assembled, and you get 100 badges assembled, they get the chips 442.03s - 450.09s | at the $1,000 or $10,000 or real price, R-E-E-L, which is also the R-E-A-L price that manufacturers 450.09s - 451.09s | get to pay. 451.09s - 456.29s | So I've actually found that for prototyping, it's cheaper for me to get a prototype assembled 456.29s - 461.61s | than it is for me to get the PCBs and buy the parts and assemble it myself, which is 461.61s - 464.87s | kind of a weird world we're in. 464.87s - 467.11s | So yeah, right now, this is the last iteration. 467.11s - 475.63s | These were $5.70 each, plus some engineering costs, which I think is pretty cool. 475.63s - 479.31s | $6 for a hardware badge that interacts is kind of a nice target. 479.31s - 480.31s | I was aiming for $5. 480.31s - 484.25s | Actually, I started aiming for $10, and then I went and did some cost reduction and managed 484.25s - 487.49s | to swap out some cheaper components and got it down to almost $5. 487.49s - 489.81s | So long run, $5 is the goal. 489.81s - 490.81s | Oops. 490.81s - 491.81s | Cancel. 491.81s - 492.81s | Cancel. 492.81s - 496.71s | Apologies for the AV situation. 496.71s - 498.77s | It's a little bit interesting. 498.77s - 501.01s | So I want to encourage interaction. 501.01s - 503.65s | So a badge has to have a way to communicate. 503.65s - 505.33s | However, we're hackers. 505.33s - 506.69s | We're privacy-minded people. 506.69s - 509.21s | We don't want these things broadcasting all the time, right? 509.21s - 512.01s | So what I opted for was infrared communication. 512.01s - 516.73s | What I like about infrared is that you can make it pretty short-range, right? 516.73s - 520.97s | You can have it only work when you need it to work, and you can, like, you know, not 520.97s - 522.55s | use it if you don't want to. 522.55s - 529.85s | So this device has a little IR LED, right, right here, and an IR receiver right here. 529.85s - 535.49s | So


chunk_text:
| to swap out some cheaper components and got it down to almost $5. 487.49s - 489.81s | So long run, $5 is the goal. 489.81s - 490.81s | Oops. 490.81s - 491.81s | Cancel. 491.81s - 492.81s | Cancel. 492.81s - 496.71s | Apologies for the AV situation. 496.71s - 498.77s | It's a little bit interesting. 498.77s - 501.01s | So I want to encourage interaction. 501.01s - 503.65s | So a badge has to have a way to communicate. 503.65s - 505.33s | However, we're hackers. 505.33s - 506.69s | We're privacy-minded people. 506.69s - 509.21s | We don't want these things broadcasting all the time, right? 509.21s - 512.01s | So what I opted for was infrared communication. 512.01s - 516.73s | What I like about infrared is that you can make it pretty short-range, right? 516.73s - 520.97s | You can have it only work when you need it to work, and you can, like, you know, not 520.97s - 522.55s | use it if you don't want to. 522.55s - 529.85s | So this device has a little IR LED, right, right here, and an IR receiver right here. 529.85s - 535.49s | So when you line badges up, they, like, kind of flash lights at each other. 535.49s - 541.25s | And yeah, bill of material costs for the communication on this badge, $0.08. 541.25s - 546.29s | So compare that to, like, an antenna, which is going to be more than $0.08, or, yeah, 546.29s - 547.29s | anything else. 547.29s - 552.09s | So I thought that was kind of awesome that I was able to get it that cheap. 552.09s - 554.21s | Braden Lane, he's done, like, e-challenge coins. 554.21s - 559.45s | He actually designed this IR circuit, and I asked him for a schematic and parts, and 559.45s - 560.45s | he shared it with me. 560.45s - 564.45s | So, you know, I appreciate his contribution to this, because, like, yeah, he was in the 564.45s - 565.45s | same boat. 565.45s - 567.89s | He wanted IR communications, but he wanted it to be cheap. 567.89s - 572.85s | I literally just got my DEF CON badge, like, an hour ago, so I haven't poked at this infrared 572.85s - 576.65s | communication, so I don't know what it is, whether it's modulated, but what


chunk_text:
when you line badges up, they, like, kind of flash lights at each other. 535.49s - 541.25s | And yeah, bill of material costs for the communication on this badge, $0.08. 541.25s - 546.29s | So compare that to, like, an antenna, which is going to be more than $0.08, or, yeah, 546.29s - 547.29s | anything else. 547.29s - 552.09s | So I thought that was kind of awesome that I was able to get it that cheap. 552.09s - 554.21s | Braden Lane, he's done, like, e-challenge coins. 554.21s - 559.45s | He actually designed this IR circuit, and I asked him for a schematic and parts, and 559.45s - 560.45s | he shared it with me. 560.45s - 564.45s | So, you know, I appreciate his contribution to this, because, like, yeah, he was in the 564.45s - 565.45s | same boat. 565.45s - 567.89s | He wanted IR communications, but he wanted it to be cheap. 567.89s - 572.85s | I literally just got my DEF CON badge, like, an hour ago, so I haven't poked at this infrared 572.85s - 576.65s | communication, so I don't know what it is, whether it's modulated, but what this does 576.65s - 579.53s | is it basically speaks, it's a UART connection, you know what UART is? 579.53s - 583.41s | Serial connection, and, like, nothing fancy, just spit that UART over an LED, and it goes 583.41s - 587.13s | up and down, none of the modulation, no extra transceivers, and in the other end, you just 587.13s - 588.13s | have to do a little bit of clean-up. 588.13s - 590.65s | Downside, it's wicked slow. 590.65s - 592.65s | Upside, it's dirt cheap. 592.65s - 593.65s | Trade-offs. 594.37s - 604.05s | So, I want to encourage learning, and the original idea for this badge came from B-Love, 604.05s - 608.13s | Brandon Levine, and he wanted to do something in CircuitPython, because he was not an embedded 608.13s - 609.65s | programmer, but he knew Python. 609.65s - 613.73s | I had never used CircuitPython before, and so I was introduced, at first, I was like, 613.73s - 617.21s | yeah, that's a little high overhead for an embedded system, we're gonna do, like, C, 617.21s - 621.05s | and we're gonna maybe do some hand-coded assembly, but that's because I started doing microcontrollers


chunk_text:
this does 576.65s - 579.53s | is it basically speaks, it's a UART connection, you know what UART is? 579.53s - 583.41s | Serial connection, and, like, nothing fancy, just spit that UART over an LED, and it goes 583.41s - 587.13s | up and down, none of the modulation, no extra transceivers, and in the other end, you just 587.13s - 588.13s | have to do a little bit of clean-up. 588.13s - 590.65s | Downside, it's wicked slow. 590.65s - 592.65s | Upside, it's dirt cheap. 592.65s - 593.65s | Trade-offs. 594.37s - 604.05s | So, I want to encourage learning, and the original idea for this badge came from B-Love, 604.05s - 608.13s | Brandon Levine, and he wanted to do something in CircuitPython, because he was not an embedded 608.13s - 609.65s | programmer, but he knew Python. 609.65s - 613.73s | I had never used CircuitPython before, and so I was introduced, at first, I was like, 613.73s - 617.21s | yeah, that's a little high overhead for an embedded system, we're gonna do, like, C, 617.21s - 621.05s | and we're gonna maybe do some hand-coded assembly, but that's because I started doing microcontrollers 621.17s - 626.65s | 20 years ago, when that's the way to do it, 25, 30 years ago, when, you know, you had 626.65s - 632.29s | to pay for a compiler, and then, you know, I kind of did work for a while, and then when 632.29s - 636.05s | I left work, it's like, oh, I can play electronics for fun, and Arduino happens, right? 636.05s - 639.25s | So now we could plug things in with a USB cable, download one thing, get our compiler 639.25s - 644.05s | and all our tools, and that was great, but now CircuitPython, you don't need a compiler, 644.05s - 647.95s | you don't need anything, you just plug in a USB cable, you have a USB flash drive that 647.95s - 653.99s | shows up, and there's a code.py file, and you edit it, and it runs, right? 653.99s - 659.23s | So your IDE is whatever text editor you want, and, um, yeah, you don't have to download 659.23s - 661.87s | or install anything, I think it's amazing and wonderful. 661.87s - 665.83s | It does have trade-offs, but, like, objective here is something accessible, something that


chunk_text:
621.17s - 626.65s | 20 years ago, when that's the way to do it, 25, 30 years ago, when, you know, you had 626.65s - 632.29s | to pay for a compiler, and then, you know, I kind of did work for a while, and then when 632.29s - 636.05s | I left work, it's like, oh, I can play electronics for fun, and Arduino happens, right? 636.05s - 639.25s | So now we could plug things in with a USB cable, download one thing, get our compiler 639.25s - 644.05s | and all our tools, and that was great, but now CircuitPython, you don't need a compiler, 644.05s - 647.95s | you don't need anything, you just plug in a USB cable, you have a USB flash drive that 647.95s - 653.99s | shows up, and there's a code.py file, and you edit it, and it runs, right? 653.99s - 659.23s | So your IDE is whatever text editor you want, and, um, yeah, you don't have to download 659.23s - 661.87s | or install anything, I think it's amazing and wonderful. 661.87s - 665.83s | It does have trade-offs, but, like, objective here is something accessible, something that 665.83s - 667.19s | gets people playing with stuff. 667.19s - 669.23s | How many of you know Python? 669.23s - 672.47s | How many of you can hack your way through and, like, edit something in Python, even 672.47s - 674.59s | if you don't call yourself someone who knows Python? 674.91s - 678.51s | Well, how many of you have used CircuitPython or MicroPython on an embedded device? 678.51s - 679.51s | Okay. 679.51s - 680.51s | Give it a try. 680.51s - 684.83s | I actually, so, I've only got, like, 80 of these with me, but I'll give them out afterwards, 684.83s - 688.35s | and so if you feel like you want to either tinker with this, or think you might have 688.35s - 691.67s | interest in contributing anything to this project, I've got them for you. 691.67s - 695.43s | If you just want something to, like, hang on your neck, then, like, let people who want 695.43s - 698.51s | to work on them first, get them first, and then we'll have the rest available. 698.51s - 699.51s | Sound good? 699.51s - 700.51s | Um, so, easy. 700.51s - 701.51s |


chunk_text:
665.83s - 667.19s | gets people playing with stuff. 667.19s - 669.23s | How many of you know Python? 669.23s - 672.47s | How many of you can hack your way through and, like, edit something in Python, even 672.47s - 674.59s | if you don't call yourself someone who knows Python? 674.91s - 678.51s | Well, how many of you have used CircuitPython or MicroPython on an embedded device? 678.51s - 679.51s | Okay. 679.51s - 680.51s | Give it a try. 680.51s - 684.83s | I actually, so, I've only got, like, 80 of these with me, but I'll give them out afterwards, 684.83s - 688.35s | and so if you feel like you want to either tinker with this, or think you might have 688.35s - 691.67s | interest in contributing anything to this project, I've got them for you. 691.67s - 695.43s | If you just want something to, like, hang on your neck, then, like, let people who want 695.43s - 698.51s | to work on them first, get them first, and then we'll have the rest available. 698.51s - 699.51s | Sound good? 699.51s - 700.51s | Um, so, easy. 700.51s - 701.51s | Badges are not easy. 701.51s - 702.51s | Hardware is not easy. 702.51s - 703.51s | It's not called easy-ware. 703.51s - 704.51s | Okay? 704.51s - 705.51s | So, it's hard. 705.51s - 706.51s | It's going to be difficult. 706.51s - 707.51s | You need to go through multiple revisions. 707.51s - 708.51s | And, yeah, so you should do that. 708.51s - 709.51s | So, here is, so, actually, the background story for this one. 709.51s - 710.51s | This is the LabsCon 2023. 710.51s - 711.51s | LabsCon is a threat intelligence conference down in Phoenix. 711.51s - 712.51s | It's pretty cool. 712.51s - 713.51s | It's very unique and niche. 713.51s - 714.51s | Um, but, uh, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, 714.51s - 715.51s | it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, 746.51s - 747.51s | uh, all right? 747.51s - 748.51s | So, um, we've got the cardboard mockup to kind of, like, figure out what we're going 748.51s - 749.51s | to do. 749.51s - 750.51s | We've got the little PCB mockup. 750.51s


chunk_text:
Badges are not easy. 701.51s - 702.51s | Hardware is not easy. 702.51s - 703.51s | It's not called easy-ware. 703.51s - 704.51s | Okay? 704.51s - 705.51s | So, it's hard. 705.51s - 706.51s | It's going to be difficult. 706.51s - 707.51s | You need to go through multiple revisions. 707.51s - 708.51s | And, yeah, so you should do that. 708.51s - 709.51s | So, here is, so, actually, the background story for this one. 709.51s - 710.51s | This is the LabsCon 2023. 710.51s - 711.51s | LabsCon is a threat intelligence conference down in Phoenix. 711.51s - 712.51s | It's pretty cool. 712.51s - 713.51s | It's very unique and niche. 713.51s - 714.51s | Um, but, uh, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, 714.51s - 715.51s | it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, 746.51s - 747.51s | uh, all right? 747.51s - 748.51s | So, um, we've got the cardboard mockup to kind of, like, figure out what we're going 748.51s - 749.51s | to do. 749.51s - 750.51s | We've got the little PCB mockup. 750.51s - 753.13s | Uh, this is the IR communication circuit that I prototyped. 753.13s - 756.15s | I'm like, okay, I know I can get a Raspberry PI 2040 working. 756.15s - 757.89s | I can get an IR communication working. 757.89s - 759.71s | Um, I did a PCB layout. 759.71s - 761.33s | And I milled a, a sample one. 761.33s - 763.69s | I didn't actually mill a one that, a functional prototype. 763.69s - 766.83s | I just kind of used it to make sure I got the sizes and placement right. 766.83s - 772.51s | Um, and then, uh, QuickTurn, uh, prototyping from, I believe, this one was JLCPCB. 772.51s - 778.71s | So for, I think these are like under 10 bucks each. I ordered them on Monday, no 778.71s - 782.59s | Sunday night, so Monday in China. I received them Friday. I was kind of like 782.59s - 786.39s | amazed. Of course during that time I did like, you know, like little updating 786.39s - 791.55s | tweaks here and there, added some artwork. But yeah, and of course you see, you, you, 791.55s - 795.31s | you will make mistakes.


chunk_text:
- 753.13s | Uh, this is the IR communication circuit that I prototyped. 753.13s - 756.15s | I'm like, okay, I know I can get a Raspberry PI 2040 working. 756.15s - 757.89s | I can get an IR communication working. 757.89s - 759.71s | Um, I did a PCB layout. 759.71s - 761.33s | And I milled a, a sample one. 761.33s - 763.69s | I didn't actually mill a one that, a functional prototype. 763.69s - 766.83s | I just kind of used it to make sure I got the sizes and placement right. 766.83s - 772.51s | Um, and then, uh, QuickTurn, uh, prototyping from, I believe, this one was JLCPCB. 772.51s - 778.71s | So for, I think these are like under 10 bucks each. I ordered them on Monday, no 778.71s - 782.59s | Sunday night, so Monday in China. I received them Friday. I was kind of like 782.59s - 786.39s | amazed. Of course during that time I did like, you know, like little updating 786.39s - 791.55s | tweaks here and there, added some artwork. But yeah, and of course you see, you, you, 791.55s - 795.31s | you will make mistakes. So like you see here I've got that little blue, blue wire 795.31s - 802.19s | that happens to be black, because oops. And DRC is your friend, unless you're 802.19s - 805.83s | lazy, then you skip it, but whatever. And actually you can see up here I had a pin 805.83s - 810.23s | out wrong for what I was using at the time, which was an IR transceiver. And 810.23s - 816.35s | yeah. So I had to add that, change it a little bit. Screen goes on top. I like it 816.35s - 820.67s | because it hides all the components. And that was, that was the prototype. And it 820.67s - 823.75s | worked, which was kind of amazing. Just one blue wire and one component. So we 823.75s - 828.95s | cleaned up that component, got the PCBs made. So what I did at the same time is I 828.95s - 834.95s | did the bulk order from JLCPCB, as well as like a small batch order. So what 834.95s - 838.63s | happened is I got the small batch prototypes a week later. You know, I 838.63s - 843.43s | ordered, so I


chunk_text:
So like you see here I've got that little blue, blue wire 795.31s - 802.19s | that happens to be black, because oops. And DRC is your friend, unless you're 802.19s - 805.83s | lazy, then you skip it, but whatever. And actually you can see up here I had a pin 805.83s - 810.23s | out wrong for what I was using at the time, which was an IR transceiver. And 810.23s - 816.35s | yeah. So I had to add that, change it a little bit. Screen goes on top. I like it 816.35s - 820.67s | because it hides all the components. And that was, that was the prototype. And it 820.67s - 823.75s | worked, which was kind of amazing. Just one blue wire and one component. So we 823.75s - 828.95s | cleaned up that component, got the PCBs made. So what I did at the same time is I 828.95s - 834.95s | did the bulk order from JLCPCB, as well as like a small batch order. So what 834.95s - 838.63s | happened is I got the small batch prototypes a week later. You know, I 838.63s - 843.43s | ordered, so I received Friday, spent all weekend working on it. Monday ordered the 843.43s - 847.91s | second batch of prototypes, I guess. Thinking they're gonna be perfect and 847.91s - 853.59s | just work. And those came the following Friday, which is again, is amazing. And in 853.59s - 857.35s | the meantime, finalized all the artwork and everything for the actual like 857.35s - 861.63s | production run. I did make a couple other tiny tweaks. Turned out we got the 861.63s - 866.51s | production run in. Took them two weeks. Was kind of incredible for a few hundred 866.51s - 872.59s | badges. And they shipped. And actually we had room for a week of customs holdup on 872.59s - 876.99s | these badges. Because I was renovating my house, so we were living somewhere else. 876.99s - 882.03s | So apparently it was a unique address that I may, I don't know, maybe customs 882.03s - 885.11s | just let stuff go to my home address and thought that this was a different 885.11s - 889.27s | address, so it's not Joe. I don't know. That or they put too high a price on the 889.27s -


chunk_text:
received Friday, spent all weekend working on it. Monday ordered the 843.43s - 847.91s | second batch of prototypes, I guess. Thinking they're gonna be perfect and 847.91s - 853.59s | just work. And those came the following Friday, which is again, is amazing. And in 853.59s - 857.35s | the meantime, finalized all the artwork and everything for the actual like 857.35s - 861.63s | production run. I did make a couple other tiny tweaks. Turned out we got the 861.63s - 866.51s | production run in. Took them two weeks. Was kind of incredible for a few hundred 866.51s - 872.59s | badges. And they shipped. And actually we had room for a week of customs holdup on 872.59s - 876.99s | these badges. Because I was renovating my house, so we were living somewhere else. 876.99s - 882.03s | So apparently it was a unique address that I may, I don't know, maybe customs 882.03s - 885.11s | just let stuff go to my home address and thought that this was a different 885.11s - 889.27s | address, so it's not Joe. I don't know. That or they put too high a price on the 889.27s - 894.63s | invoice. So, but that's the badge we got. I did have to manually solder on the 894.63s - 898.59s | battery holders and the screens. That was a time constraint issue. I really am 898.59s - 902.35s | frustrated by screens. It's very difficult to get screens that are 902.35s - 907.35s | quality and reliable and consistent. So I use modules, right? You can get the modules 907.35s - 911.15s | cheaper than you can get the bare LCD OLED displays. So I might as well just 911.47s - 918.67s | use those, right? And the second iteration, so we went from this prototype for what 918.67s - 922.79s | was LabsCon. And then B-Side San Francisco was looking for a badge and I 922.79s - 928.03s | had a conversation which roped me into another project. And so basically the 928.03s - 932.03s | only change in the circuit had to do with the IR circuit. I took off that 932.03s - 937.99s | transceiver that was up here. That was a IRDA transceiver. It was a three dollar 938.03s - 942.27s | part. It was there because I had it and tested it and it


chunk_text:
894.63s | invoice. So, but that's the badge we got. I did have to manually solder on the 894.63s - 898.59s | battery holders and the screens. That was a time constraint issue. I really am 898.59s - 902.35s | frustrated by screens. It's very difficult to get screens that are 902.35s - 907.35s | quality and reliable and consistent. So I use modules, right? You can get the modules 907.35s - 911.15s | cheaper than you can get the bare LCD OLED displays. So I might as well just 911.47s - 918.67s | use those, right? And the second iteration, so we went from this prototype for what 918.67s - 922.79s | was LabsCon. And then B-Side San Francisco was looking for a badge and I 922.79s - 928.03s | had a conversation which roped me into another project. And so basically the 928.03s - 932.03s | only change in the circuit had to do with the IR circuit. I took off that 932.03s - 937.99s | transceiver that was up here. That was a IRDA transceiver. It was a three dollar 938.03s - 942.27s | part. It was there because I had it and tested it and it worked. And that's when 942.27s - 947.39s | I changed it to these eight cents of components, which were great. So yeah, the 947.39s - 951.71s | prototype was pretty quick. The production badges took a little longer 951.71s - 955.07s | than expected. I used a contract manufacturer that I use regularly for 955.07s - 959.19s | Tigard. Shameless plug, Tigard is a little orange PCB that does JTAG, UART, and 959.19s - 963.35s | SPI. And I make it and use it for my classes. But apparently other people like 963.35s - 968.67s | it too. So you can get it on crowd supply. So I had that manufacturer do it 968.67s - 971.91s | because I've worked with them in the past and they will do stuff like custom 971.91s - 977.15s | solder mask color. And what they did for this badge, oops, do I not have a 977.15s - 983.39s | picture of it? No. So what they did for us for the B-Side San Francisco badge is 983.39s - 989.15s | we had two different colors of silkscreen. So they lined up perfectly. 989.51s - 994.79s | Actually, I want to do something silly.


chunk_text:
worked. And that's when 942.27s - 947.39s | I changed it to these eight cents of components, which were great. So yeah, the 947.39s - 951.71s | prototype was pretty quick. The production badges took a little longer 951.71s - 955.07s | than expected. I used a contract manufacturer that I use regularly for 955.07s - 959.19s | Tigard. Shameless plug, Tigard is a little orange PCB that does JTAG, UART, and 959.19s - 963.35s | SPI. And I make it and use it for my classes. But apparently other people like 963.35s - 968.67s | it too. So you can get it on crowd supply. So I had that manufacturer do it 968.67s - 971.91s | because I've worked with them in the past and they will do stuff like custom 971.91s - 977.15s | solder mask color. And what they did for this badge, oops, do I not have a 977.15s - 983.39s | picture of it? No. So what they did for us for the B-Side San Francisco badge is 983.39s - 989.15s | we had two different colors of silkscreen. So they lined up perfectly. 989.51s - 994.79s | Actually, I want to do something silly. I'm going to modify my presentation on 994.79s - 1002.94s | the fly. I'm going to take a picture. You don't see it on the screen yet, but 1002.94s - 1014.80s | there we go. Can you see it? How come you can't see it? It's right there on 1014.80s - 1020.64s | the screen. Maybe I have to go back and forth. No? I see it right here on my 1020.64s - 1033.72s | slides. Oh, I'm very confused right now. I hope that you've been seeing the same 1033.72s - 1037.00s | thing as me all along because I'm literally looking at my slides right now 1037.00s - 1050.19s | and it's different from, sorry. Oh well. This badge is cool because it's got two 1050.19s - 1054.15s | different colors of silkscreen. So it's like a cream kind of off-white grayish 1054.15s - 1059.11s | solder mask and then a red and a black silkscreen. And, you know, I will talk 1059.11s - 1061.75s | about it in a second. The reason you pay for a contract manufacturer instead of a 1061.75s - 1065.39s | quick turn place is they'll do things like make sure those colors


chunk_text:
I'm going to modify my presentation on 994.79s - 1002.94s | the fly. I'm going to take a picture. You don't see it on the screen yet, but 1002.94s - 1014.80s | there we go. Can you see it? How come you can't see it? It's right there on 1014.80s - 1020.64s | the screen. Maybe I have to go back and forth. No? I see it right here on my 1020.64s - 1033.72s | slides. Oh, I'm very confused right now. I hope that you've been seeing the same 1033.72s - 1037.00s | thing as me all along because I'm literally looking at my slides right now 1037.00s - 1050.19s | and it's different from, sorry. Oh well. This badge is cool because it's got two 1050.19s - 1054.15s | different colors of silkscreen. So it's like a cream kind of off-white grayish 1054.15s - 1059.11s | solder mask and then a red and a black silkscreen. And, you know, I will talk 1059.11s - 1061.75s | about it in a second. The reason you pay for a contract manufacturer instead of a 1061.75s - 1065.39s | quick turn place is they'll do things like make sure those colors line up 1065.39s - 1069.55s | perfectly and they did an amazing job. It was better than I expected. What you have to 1069.55s - 1073.07s | realize is PCBs are like precision things. So like there is some effort to 1073.07s - 1077.43s | make things precise. Silkscreen is kind of like the last thing and it's usually 1077.43s - 1081.43s | only documentation. It's not like functional. So there's some more slop in 1081.43s - 1086.35s | the silkscreen than there is in the solder mask and metal layers. Anyway, 1086.43s - 1089.75s | afterwards you can come up and see some of these badges because, yeah, 1089.75s - 1095.87s | there's a bunch here. You can ogle the artwork. So what's my vision? I mentioned 1095.87s - 1099.95s | before like I don't like doing this over again and people are frequently asking 1099.95s - 1104.67s | me for badges and others. And rather than like have to be involved like in the 1104.67s - 1107.87s | loop, it'd be really cool if I had a website. You go to the website and you 1107.87s - 1111.59s | type in your conference name, right? You upload the


chunk_text:
line up 1065.39s - 1069.55s | perfectly and they did an amazing job. It was better than I expected. What you have to 1069.55s - 1073.07s | realize is PCBs are like precision things. So like there is some effort to 1073.07s - 1077.43s | make things precise. Silkscreen is kind of like the last thing and it's usually 1077.43s - 1081.43s | only documentation. It's not like functional. So there's some more slop in 1081.43s - 1086.35s | the silkscreen than there is in the solder mask and metal layers. Anyway, 1086.43s - 1089.75s | afterwards you can come up and see some of these badges because, yeah, 1089.75s - 1095.87s | there's a bunch here. You can ogle the artwork. So what's my vision? I mentioned 1095.87s - 1099.95s | before like I don't like doing this over again and people are frequently asking 1099.95s - 1104.67s | me for badges and others. And rather than like have to be involved like in the 1104.67s - 1107.87s | loop, it'd be really cool if I had a website. You go to the website and you 1107.87s - 1111.59s | type in your conference name, right? You upload the logo for the concert, 1112.31s - 1117.51s | concert, conference and you click go. You get your board files, you get your bill 1117.51s - 1122.71s | of materials, get your code, everything ready to go. Does that sound cool? So what 1122.71s - 1126.35s | you can do then is instead of having to start from scratch and go through three 1126.35s - 1129.03s | iterations of prototypes and test everything and find the right components, 1129.03s - 1133.47s | you start with something that works and change what you want to. If you want to 1133.47s - 1138.15s | do like board changes and layout changes or add components, you do that. But you 1138.15s - 1141.79s | start with a board file that's functional and works, right? You want to 1141.79s - 1144.55s | make just artwork changes, you can do that, but you've already got a board that 1144.55s - 1147.67s | works. If you want to keep the hardware exactly the same and change the game 1147.67s - 1151.27s | that it plays or whatever, how it interacts, you can do that. And that's 1151.27s - 1153.99s | actually what besides Portland's going to likely


chunk_text:
logo for the concert, 1112.31s - 1117.51s | concert, conference and you click go. You get your board files, you get your bill 1117.51s - 1122.71s | of materials, get your code, everything ready to go. Does that sound cool? So what 1122.71s - 1126.35s | you can do then is instead of having to start from scratch and go through three 1126.35s - 1129.03s | iterations of prototypes and test everything and find the right components, 1129.03s - 1133.47s | you start with something that works and change what you want to. If you want to 1133.47s - 1138.15s | do like board changes and layout changes or add components, you do that. But you 1138.15s - 1141.79s | start with a board file that's functional and works, right? You want to 1141.79s - 1144.55s | make just artwork changes, you can do that, but you've already got a board that 1144.55s - 1147.67s | works. If you want to keep the hardware exactly the same and change the game 1147.67s - 1151.27s | that it plays or whatever, how it interacts, you can do that. And that's 1151.27s - 1153.99s | actually what besides Portland's going to likely use the same hardware, but 1153.99s - 1157.75s | they're going to have a completely different game that it plays. So like 1157.75s - 1161.95s | customize what you want to do and keep what you want to keep. Make sense? Again, 1161.95s - 1167.27s | chief virtue of an engineer is laziness. So be as lazy as you think is 1167.27s - 1170.83s | appropriate and you'll be able to spend your time doing the things you want to 1170.83s - 1177.03s | do. So how many of you like PCB design? How many of you like embedded software? 1177.03s - 1181.51s | So you can go like meet up with each other and like work together or like do 1181.51s - 1186.75s | one or the other. Make sense? Cool. So what can we do today? Because of the AV 1186.75s - 1190.27s | stuff, I'm going to like finish my slides first and then I'll flip over to my 1190.27s - 1193.79s | laptop and do some like walkthrough demo-y stuff. I'm not going to build a 1193.79s - 1197.15s | batch from scratch because it's not there yet, but maybe someone will submit 1197.15s - 1201.71s


chunk_text:
use the same hardware, but 1153.99s - 1157.75s | they're going to have a completely different game that it plays. So like 1157.75s - 1161.95s | customize what you want to do and keep what you want to keep. Make sense? Again, 1161.95s - 1167.27s | chief virtue of an engineer is laziness. So be as lazy as you think is 1167.27s - 1170.83s | appropriate and you'll be able to spend your time doing the things you want to 1170.83s - 1177.03s | do. So how many of you like PCB design? How many of you like embedded software? 1177.03s - 1181.51s | So you can go like meet up with each other and like work together or like do 1181.51s - 1186.75s | one or the other. Make sense? Cool. So what can we do today? Because of the AV 1186.75s - 1190.27s | stuff, I'm going to like finish my slides first and then I'll flip over to my 1190.27s - 1193.79s | laptop and do some like walkthrough demo-y stuff. I'm not going to build a 1193.79s - 1197.15s | batch from scratch because it's not there yet, but maybe someone will submit 1197.15s - 1201.71s | a pull request and we can do that. So what can we do today? If you are a 1201.71s - 1205.35s | hardware person, right, you can just change the logo. That's easy. You can 1205.35s - 1209.35s | adjust the board footprint. I find like the cutout shape of the board is really 1209.35s - 1214.75s | a neat thing to customize a badge because it looks neat. You can rearrange 1214.75s - 1218.47s | the layout. As it is right now, it's kind of ergonomically designed, right? I 1218.47s - 1222.71s | happen to be left-handed, right? But I wanted righties to be okay with it too, 1222.71s - 1227.47s | so I put the button in the middle so you all you people can use it. And it 1227.47s - 1233.75s | also it hangs down so you see the logo and if you want to use it, okay, I still 1233.75s - 1238.55s | have power. I'm going to keep talking. You just like you grab it and you point it 1238.55s - 1243.55s | at someone else and you like you trade, right? Ergonomically, like they hold each 1243.55s - 1246.99s | other edge


chunk_text:
| a pull request and we can do that. So what can we do today? If you are a 1201.71s - 1205.35s | hardware person, right, you can just change the logo. That's easy. You can 1205.35s - 1209.35s | adjust the board footprint. I find like the cutout shape of the board is really 1209.35s - 1214.75s | a neat thing to customize a badge because it looks neat. You can rearrange 1214.75s - 1218.47s | the layout. As it is right now, it's kind of ergonomically designed, right? I 1218.47s - 1222.71s | happen to be left-handed, right? But I wanted righties to be okay with it too, 1222.71s - 1227.47s | so I put the button in the middle so you all you people can use it. And it 1227.47s - 1233.75s | also it hangs down so you see the logo and if you want to use it, okay, I still 1233.75s - 1238.55s | have power. I'm going to keep talking. You just like you grab it and you point it 1238.55s - 1243.55s | at someone else and you like you trade, right? Ergonomically, like they hold each 1243.55s - 1246.99s | other edge to edge. Screen still, yeah, just to make sure the screen is still on. You hold 1246.99s - 1250.67s | them edge to edge and like they communicate. One of the flaws of the 1250.67s - 1254.55s | current design is I need to tune the IR transmission a little more because you 1254.55s - 1257.67s | literally have to hold them together like that for them to communicate. Maybe 1257.67s - 1261.03s | like a half an inch, but if they're more like an inch or more, they don't work. 1261.03s - 1264.35s | Which is kind of good because then you're not transmitting and receiving 1264.35s - 1267.91s | noise and other people's stuff and whatever. Also by using a module, the 1267.91s - 1271.83s | module kind of shades the IR stuff so like you know even if there's if there 1271.83s - 1275.51s | happen to be lights, something crazy like that, you don't have it some 1275.51s - 1280.31s | interference from that. Cool. If anybody's got any questions as I ramble on, please 1280.31s - 1286.43s | yeah, what's up? Yeah, this is, hmm, maybe we'll do that later. Sorry, unless there's 1286.43s -


chunk_text:
to edge. Screen still, yeah, just to make sure the screen is still on. You hold 1246.99s - 1250.67s | them edge to edge and like they communicate. One of the flaws of the 1250.67s - 1254.55s | current design is I need to tune the IR transmission a little more because you 1254.55s - 1257.67s | literally have to hold them together like that for them to communicate. Maybe 1257.67s - 1261.03s | like a half an inch, but if they're more like an inch or more, they don't work. 1261.03s - 1264.35s | Which is kind of good because then you're not transmitting and receiving 1264.35s - 1267.91s | noise and other people's stuff and whatever. Also by using a module, the 1267.91s - 1271.83s | module kind of shades the IR stuff so like you know even if there's if there 1271.83s - 1275.51s | happen to be lights, something crazy like that, you don't have it some 1275.51s - 1280.31s | interference from that. Cool. If anybody's got any questions as I ramble on, please 1280.31s - 1286.43s | yeah, what's up? Yeah, this is, hmm, maybe we'll do that later. Sorry, unless there's 1286.43s - 1291.51s | another mic. Nah, okay, sorry. I'll repeat your question if I could hear it, but I 1291.51s - 1295.15s | hear that more and I don't think he's asking any questions about boards. So 1295.15s - 1298.27s | what we do, we change the logo, adjust the footprint, we can 1298.27s - 1302.43s | rearrange the layout. So if we wanted to, you know, have it wider or different 1302.43s - 1305.51s | layout or if you really wanted to change the infrared to something else, you 1305.51s - 1309.07s | totally could do that. And you can hack it to pieces. The way I did the layout, 1309.07s - 1311.63s | I'll show you when I look through a keycad, is I have a bundle that's the 1311.63s - 1315.03s | microcontroller, I have a bundle that's the power circuit, I have a bundle that's 1315.03s - 1319.39s | the, what's it called? Infrared circuits. So you can drag those blocks around and 1319.39s - 1322.91s | route those blocks together or you can drag drag every single little resistor 1322.91s - 1327.75s | and component together. So if you're a software person, right? You could change


chunk_text:
1291.51s | another mic. Nah, okay, sorry. I'll repeat your question if I could hear it, but I 1291.51s - 1295.15s | hear that more and I don't think he's asking any questions about boards. So 1295.15s - 1298.27s | what we do, we change the logo, adjust the footprint, we can 1298.27s - 1302.43s | rearrange the layout. So if we wanted to, you know, have it wider or different 1302.43s - 1305.51s | layout or if you really wanted to change the infrared to something else, you 1305.51s - 1309.07s | totally could do that. And you can hack it to pieces. The way I did the layout, 1309.07s - 1311.63s | I'll show you when I look through a keycad, is I have a bundle that's the 1311.63s - 1315.03s | microcontroller, I have a bundle that's the power circuit, I have a bundle that's 1315.03s - 1319.39s | the, what's it called? Infrared circuits. So you can drag those blocks around and 1319.39s - 1322.91s | route those blocks together or you can drag drag every single little resistor 1322.91s - 1327.75s | and component together. So if you're a software person, right? You could change 1327.75s - 1331.15s | strings, right? Like you take the badge instead of being open to access, you call 1331.15s - 1337.55s | it like b-sides, you know, Gallifrey or something like that. And you know, you can 1337.55s - 1341.07s | change the game text. Right now the game it plays is kind of, ever played Clue? 1341.07s - 1348.11s | Yeah? So in Clue you have like a deck of suspects, weapons, and locations, right? 1348.11s - 1351.27s | And you draw, you shuffle them, you draw one of each and you put them in an envelope to 1351.27s - 1354.79s | the side and then you deal the rest out to everyone. In the process of the game 1354.79s - 1357.15s | you're kind of like trying to figure out what everybody else has so you know 1357.15s - 1361.31s | what's missing, right? Same thing, what it does right now is it deals one clue to 1361.31s - 1365.83s | each person and, you know, you can trade those around, you meet people, it trades 1365.83s - 1369.43s | the handle that you put into the badge as well as your clue and when you get


chunk_text:
1327.75s - 1331.15s | strings, right? Like you take the badge instead of being open to access, you call 1331.15s - 1337.55s | it like b-sides, you know, Gallifrey or something like that. And you know, you can 1337.55s - 1341.07s | change the game text. Right now the game it plays is kind of, ever played Clue? 1341.07s - 1348.11s | Yeah? So in Clue you have like a deck of suspects, weapons, and locations, right? 1348.11s - 1351.27s | And you draw, you shuffle them, you draw one of each and you put them in an envelope to 1351.27s - 1354.79s | the side and then you deal the rest out to everyone. In the process of the game 1354.79s - 1357.15s | you're kind of like trying to figure out what everybody else has so you know 1357.15s - 1361.31s | what's missing, right? Same thing, what it does right now is it deals one clue to 1361.31s - 1365.83s | each person and, you know, you can trade those around, you meet people, it trades 1365.83s - 1369.43s | the handle that you put into the badge as well as your clue and when you get 1369.43s - 1373.23s | them all but one, you know the solution, right? And there's, it's set up for eight 1373.23s - 1377.19s | games but we won't go into the details of that. B-sides Portland's gonna do a 1377.19s - 1382.87s | slightly different game as well. You can change all the game text. Right now for 1382.87s - 1388.05s | B-sides San Francisco, the AI theme they used, so it was a bunch of like AI, it was 1388.05s - 1393.83s | a bunch of like, like doomsday scenarios and it was a bunch of fixes and so like 1393.83s - 1399.11s | you'd randomly put those together like, you know, T-800 saved, you know, something 1399.11s - 1405.39s | from Whopper or some weird thing like that. So badge logistics, this can be very 1405.39s - 1414.21s | interesting, right? Did I miss a slide there? No, I think I got it. Sorry. So who 1414.21s - 1421.33s | likes hand soldering? Who likes hand soldering a hundred badges? Who likes 1421.33s - 1429.37s | hand soldering a thousand badges? So when I solder, I design around 0603 1429.37s - 1432.77s | surface mount components because I


chunk_text:
1369.43s - 1373.23s | them all but one, you know the solution, right? And there's, it's set up for eight 1373.23s - 1377.19s | games but we won't go into the details of that. B-sides Portland's gonna do a 1377.19s - 1382.87s | slightly different game as well. You can change all the game text. Right now for 1382.87s - 1388.05s | B-sides San Francisco, the AI theme they used, so it was a bunch of like AI, it was 1388.05s - 1393.83s | a bunch of like, like doomsday scenarios and it was a bunch of fixes and so like 1393.83s - 1399.11s | you'd randomly put those together like, you know, T-800 saved, you know, something 1399.11s - 1405.39s | from Whopper or some weird thing like that. So badge logistics, this can be very 1405.39s - 1414.21s | interesting, right? Did I miss a slide there? No, I think I got it. Sorry. So who 1414.21s - 1421.33s | likes hand soldering? Who likes hand soldering a hundred badges? Who likes 1421.33s - 1429.37s | hand soldering a thousand badges? So when I solder, I design around 0603 1429.37s - 1432.77s | surface mount components because I used to be able to see them and do it by hand. 1432.77s - 1439.41s | I can't anymore because I'm old. And so I use a microscope and I can still do them 1439.41s - 1444.37s | by hand. But if you're gonna do some, this is designed for mass manufacturing, this 1444.37s - 1447.97s | is not designed for hand soldering, so I use 0402 components, the really tiny 1448.01s - 1454.01s | ones, which makes, I can fit them all on there easily and they're small and 0402 1454.01s - 1457.17s | is a pretty reliable size. Gets smaller than that and sometimes you get a higher 1457.17s - 1462.65s | failure rate. So if you're gonna hand solder, what I often do is I actually 1462.65s - 1467.77s | will get the prototypes with all the small components assembled, right? And 1467.77s - 1471.77s | then I get those prototypes and I solder on the big stuff. For example, if I'm like 1471.77s - 1475.65s | trying to, you know, fine-tune which microcontroller, I get parts locally that 1475.65s - 1482.01s | I want to use. Next is small batch. This is like JLCPCB, PCBWay and


chunk_text:
used to be able to see them and do it by hand. 1432.77s - 1439.41s | I can't anymore because I'm old. And so I use a microscope and I can still do them 1439.41s - 1444.37s | by hand. But if you're gonna do some, this is designed for mass manufacturing, this 1444.37s - 1447.97s | is not designed for hand soldering, so I use 0402 components, the really tiny 1448.01s - 1454.01s | ones, which makes, I can fit them all on there easily and they're small and 0402 1454.01s - 1457.17s | is a pretty reliable size. Gets smaller than that and sometimes you get a higher 1457.17s - 1462.65s | failure rate. So if you're gonna hand solder, what I often do is I actually 1462.65s - 1467.77s | will get the prototypes with all the small components assembled, right? And 1467.77s - 1471.77s | then I get those prototypes and I solder on the big stuff. For example, if I'm like 1471.77s - 1475.65s | trying to, you know, fine-tune which microcontroller, I get parts locally that 1475.65s - 1482.01s | I want to use. Next is small batch. This is like JLCPCB, PCBWay and others, 1482.01s - 1486.13s | Macrofab in the United States. You just give them your design and tell them a 1486.13s - 1489.85s | little bit about the parts and they'll make the PCBs, assemble them for you and 1489.85s - 1494.69s | ship them to you, which is pretty cool. And like I said before, sometimes it's 1494.69s - 1498.49s | cheaper for me to do that than it is for me to just buy boards and buy parts and 1498.49s - 1503.61s | waste my time assembling them. And then last is contract 1503.65s - 1507.53s | manufacturing. This is, you know, basically there's a weakening line 1507.53s - 1510.61s | between the small batch stuff and the contract manufacturing because a lot of 1510.61s - 1513.89s | the same companies do the same thing or outsources to each other. Again, I have a 1513.89s - 1517.41s | contract manufacturer I've used for Tigard and also BitMagic's the logic 1517.41s - 1522.97s | analyzer. If you've heard of like NETV or the FOMU, like mini FPGA, those were 1522.97s - 1526.13s | all done by the same folks. The reason why I chose them is because they'll 1526.13s


chunk_text:
others, 1482.01s - 1486.13s | Macrofab in the United States. You just give them your design and tell them a 1486.13s - 1489.85s | little bit about the parts and they'll make the PCBs, assemble them for you and 1489.85s - 1494.69s | ship them to you, which is pretty cool. And like I said before, sometimes it's 1494.69s - 1498.49s | cheaper for me to do that than it is for me to just buy boards and buy parts and 1498.49s - 1503.61s | waste my time assembling them. And then last is contract 1503.65s - 1507.53s | manufacturing. This is, you know, basically there's a weakening line 1507.53s - 1510.61s | between the small batch stuff and the contract manufacturing because a lot of 1510.61s - 1513.89s | the same companies do the same thing or outsources to each other. Again, I have a 1513.89s - 1517.41s | contract manufacturer I've used for Tigard and also BitMagic's the logic 1517.41s - 1522.97s | analyzer. If you've heard of like NETV or the FOMU, like mini FPGA, those were 1522.97s - 1526.13s | all done by the same folks. The reason why I chose them is because they'll 1526.13s - 1532.57s | do custom solder mask colors for me. So, yay! But yeah, once you're hitting a 1532.57s - 1536.29s | threshold of more than a hundred, you probably want to consider this. It will 1536.29s - 1540.05s | take you longer, it will cost more, but it's more likely to get it right the 1540.05s - 1544.53s | first time, which is really what you want to do. You know, 100 badges in a 1544.53s - 1550.29s | contract manufacturer with one mistake is 100 badges you need to rework. And 1550.29s - 1553.57s | finally, flashing. Like once we've got these badges, even if like we didn't 1553.57s - 1556.57s | change anything, we still have to provision them. And so I've got like a 1556.57s - 1561.45s | flashing rig here, which basically you slot the badges in, it pops into a USB 1561.45s - 1566.65s | port, and they're all connected to like a 7-port USB hub, and I've got a couple 1566.65s - 1569.77s | scripts in there that will go through, wait for a device to be attached, and 1569.77s - 1574.09s | flash it. There was a small bug in that though,


chunk_text:
- 1532.57s | do custom solder mask colors for me. So, yay! But yeah, once you're hitting a 1532.57s - 1536.29s | threshold of more than a hundred, you probably want to consider this. It will 1536.29s - 1540.05s | take you longer, it will cost more, but it's more likely to get it right the 1540.05s - 1544.53s | first time, which is really what you want to do. You know, 100 badges in a 1544.53s - 1550.29s | contract manufacturer with one mistake is 100 badges you need to rework. And 1550.29s - 1553.57s | finally, flashing. Like once we've got these badges, even if like we didn't 1553.57s - 1556.57s | change anything, we still have to provision them. And so I've got like a 1556.57s - 1561.45s | flashing rig here, which basically you slot the badges in, it pops into a USB 1561.45s - 1566.65s | port, and they're all connected to like a 7-port USB hub, and I've got a couple 1566.65s - 1569.77s | scripts in there that will go through, wait for a device to be attached, and 1569.77s - 1574.09s | flash it. There was a small bug in that though, because what it does is it's a 1574.09s - 1577.49s | Linux script, and it goes, it says, okay, you've attached a device, let's mount it. 1577.49s - 1584.25s | What's the mount point? Okay, and now we want to wipe it first. So, RM, like, what's 1584.25s - 1590.53s | it called? RM mount point slash star, and then dash RF, right? Like, so you want to 1590.53s - 1595.33s | remove everything on that drive, and force it, right? Which is great, until mount 1595.33s - 1598.17s | point, uh, for some reason doesn't exist, like you pulled it out before, like you 1598.17s - 1602.77s | got the mount point, and so that string is blank, so it's RM dash RF, uh, RM 1602.77s - 1606.85s | star, uh, slash star dash RF, uh, which, or whatever the order of the, yeah, you 1606.85s - 1610.61s | know what I'm saying. It was bad. Um, luckily, I was using a utility called 1610.61s - 1614.37s | PMount, which runs as a user, as opposed to having escalated privileges and 1614.37s - 1617.65s | running it as root and mounting, because that would have been a much worse


chunk_text:
because what it does is it's a 1574.09s - 1577.49s | Linux script, and it goes, it says, okay, you've attached a device, let's mount it. 1577.49s - 1584.25s | What's the mount point? Okay, and now we want to wipe it first. So, RM, like, what's 1584.25s - 1590.53s | it called? RM mount point slash star, and then dash RF, right? Like, so you want to 1590.53s - 1595.33s | remove everything on that drive, and force it, right? Which is great, until mount 1595.33s - 1598.17s | point, uh, for some reason doesn't exist, like you pulled it out before, like you 1598.17s - 1602.77s | got the mount point, and so that string is blank, so it's RM dash RF, uh, RM 1602.77s - 1606.85s | star, uh, slash star dash RF, uh, which, or whatever the order of the, yeah, you 1606.85s - 1610.61s | know what I'm saying. It was bad. Um, luckily, I was using a utility called 1610.61s - 1614.37s | PMount, which runs as a user, as opposed to having escalated privileges and 1614.37s - 1617.65s | running it as root and mounting, because that would have been a much worse RM 1617.65s - 1621.85s | dash RF, slash star. For those of you who are, like, more in the Windows world, 1621.85s - 1625.21s | that basically, slash star is your root directory, and everything on your system. 1625.21s - 1629.13s | So, like, it basically would hose your system if you did that. Um, yeah, that 1629.13s - 1631.53s | was, that would, that could have been a lot worse. Luckily, it was discovered, 1631.53s - 1635.53s | and found, and fixed, um, before we flashed all of our laptops, instead of the 1635.53s - 1642.97s | badges. Um, flashing, we just talked about flashing. So, common pitfalls, uh, 1642.97s - 1646.13s | cool, we got about halfway in, um, which means I want about half the time to go 1646.29s - 1651.21s | and, and, uh, either look at questions, or, um, walk through the designs. Um, 1651.21s - 1655.73s | common pitfalls, I'm really gonna emphasize one, uh, schedule. Give 1655.73s - 1658.73s | yourself more time than you need. Once you've done that, give yourself even more 1658.73s - 1662.77s | time. Add some buffer for, you know, manufacturing issues. Add buffer for an 1662.77s -


chunk_text:
RM 1617.65s - 1621.85s | dash RF, slash star. For those of you who are, like, more in the Windows world, 1621.85s - 1625.21s | that basically, slash star is your root directory, and everything on your system. 1625.21s - 1629.13s | So, like, it basically would hose your system if you did that. Um, yeah, that 1629.13s - 1631.53s | was, that would, that could have been a lot worse. Luckily, it was discovered, 1631.53s - 1635.53s | and found, and fixed, um, before we flashed all of our laptops, instead of the 1635.53s - 1642.97s | badges. Um, flashing, we just talked about flashing. So, common pitfalls, uh, 1642.97s - 1646.13s | cool, we got about halfway in, um, which means I want about half the time to go 1646.29s - 1651.21s | and, and, uh, either look at questions, or, um, walk through the designs. Um, 1651.21s - 1655.73s | common pitfalls, I'm really gonna emphasize one, uh, schedule. Give 1655.73s - 1658.73s | yourself more time than you need. Once you've done that, give yourself even more 1658.73s - 1662.77s | time. Add some buffer for, you know, manufacturing issues. Add buffer for an 1662.77s - 1667.41s | extra prototype run. Add buffer for, um, you know, testing, and software, and 1667.41s - 1671.09s | flashing, and whatever. Um, you'll use them. Um, you'll make good use of them, 1671.09s - 1675.29s | but you'll use them. Uh, and part of the idea here is, like, if you're starting 1675.31s - 1679.89s | with a known good badge, right, you can go get those started, and get the badges 1679.89s - 1683.15s | manufactured, and work on the software in parallel. And, uh, then you don't have 1683.15s - 1686.03s | to worry about getting your hardware, testing it, making sure it works. You 1686.03s - 1692.29s | know, just remove the steps you don't want to have to deal with. Cool. So, I'm 1692.29s - 1697.21s | gonna go back, and for those of you who wanted, where did I put it? The URL. 1697.21s - 1702.85s | Uh, somewhere, I put a URL. It's GitHub. Forget it. I'm gonna switch over to my 1702.87s - 1707.41s | laptop now. Um, I'll get that set up. I have some, some hardware design and code 1707.41s - 1711.75s | I can walk through. Um, if any


chunk_text:
1667.41s | extra prototype run. Add buffer for, um, you know, testing, and software, and 1667.41s - 1671.09s | flashing, and whatever. Um, you'll use them. Um, you'll make good use of them, 1671.09s - 1675.29s | but you'll use them. Uh, and part of the idea here is, like, if you're starting 1675.31s - 1679.89s | with a known good badge, right, you can go get those started, and get the badges 1679.89s - 1683.15s | manufactured, and work on the software in parallel. And, uh, then you don't have 1683.15s - 1686.03s | to worry about getting your hardware, testing it, making sure it works. You 1686.03s - 1692.29s | know, just remove the steps you don't want to have to deal with. Cool. So, I'm 1692.29s - 1697.21s | gonna go back, and for those of you who wanted, where did I put it? The URL. 1697.21s - 1702.85s | Uh, somewhere, I put a URL. It's GitHub. Forget it. I'm gonna switch over to my 1702.87s - 1707.41s | laptop now. Um, I'll get that set up. I have some, some hardware design and code 1707.41s - 1711.75s | I can walk through. Um, if any of you have questions, just come on up here, and, 1711.75s - 1714.99s | like, you can ask a question, and I'll repeat it, and then answer it, um, as I do 1714.99s - 1716.99s | the walkthrough. So, let, give me a moment. I'll swap up. 1716.99s - 1783.35s | So, I'm connected to this wire, which goes straight to the TV. It was just when I was on a second ago. 1783.35s - 1805.66s | First device. Ah, checking that. Looks good. 1080p. What? Input one, I'm outputting to it right now. 1811.91s - 1837.37s | It's on, uh, that internal Google TV right now. It's showing a Google TV. 1837.37s - 1844.37s | Well, that's not what I want to show you. But, we know the TV works. So, fingers crossed, one more time. 1844.37s - 1888.02s | One more. Thank you for your patience. Anything? No? 1888.02s - 1908.87s | Well, that's what I get for using Linux. So, I'm going to try something, if we can get this back up on the screen. 1908.87s - 1924.27s | So, let's see. Nope. No, we're good, we're good. Okay. We're doing it live. 1924.27s - 1937.62s |


chunk_text:
of you have questions, just come on up here, and, 1711.75s - 1714.99s | like, you can ask a question, and I'll repeat it, and then answer it, um, as I do 1714.99s - 1716.99s | the walkthrough. So, let, give me a moment. I'll swap up. 1716.99s - 1783.35s | So, I'm connected to this wire, which goes straight to the TV. It was just when I was on a second ago. 1783.35s - 1805.66s | First device. Ah, checking that. Looks good. 1080p. What? Input one, I'm outputting to it right now. 1811.91s - 1837.37s | It's on, uh, that internal Google TV right now. It's showing a Google TV. 1837.37s - 1844.37s | Well, that's not what I want to show you. But, we know the TV works. So, fingers crossed, one more time. 1844.37s - 1888.02s | One more. Thank you for your patience. Anything? No? 1888.02s - 1908.87s | Well, that's what I get for using Linux. So, I'm going to try something, if we can get this back up on the screen. 1908.87s - 1924.27s | So, let's see. Nope. No, we're good, we're good. Okay. We're doing it live. 1924.27s - 1937.62s | Can I get a volunteer? Do you want to just hold it and show my screen? 1937.62s - 1940.62s | Just hold it? Just hold it so we see the screen. Thanks. 1940.62s - 1951.13s | Everybody see that? I'll make it bigger. So, there's the slides. First, let's look at, can you hear me good? 1951.13s - 1956.13s | First, let's look at the B-Side San Francisco badge so you can kind of see what's going on. 1956.13s - 1962.13s | We've got a schematic. I'm not going to go into the details of the schematic. We've got, uh, can you see anything at all? 1962.13s - 1971.13s | We've got the RP2040, right? We've got some flash. We've got some IO pins. We've got our IR circuit that, you know, just kind of works. 1971.13s - 1978.13s | And we've got a USB interface that works. USB-C, which is great because everything should be USB-C. 1978.13s - 1985.13s | But, let's look also, so this is what the finished badge looked like. 1985.13s - 1991.13s | So, this is just in black because that's what I usually do, but you see it, uh, silkscreen on the front. 1991.13s


chunk_text:
Can I get a volunteer? Do you want to just hold it and show my screen? 1937.62s - 1940.62s | Just hold it? Just hold it so we see the screen. Thanks. 1940.62s - 1951.13s | Everybody see that? I'll make it bigger. So, there's the slides. First, let's look at, can you hear me good? 1951.13s - 1956.13s | First, let's look at the B-Side San Francisco badge so you can kind of see what's going on. 1956.13s - 1962.13s | We've got a schematic. I'm not going to go into the details of the schematic. We've got, uh, can you see anything at all? 1962.13s - 1971.13s | We've got the RP2040, right? We've got some flash. We've got some IO pins. We've got our IR circuit that, you know, just kind of works. 1971.13s - 1978.13s | And we've got a USB interface that works. USB-C, which is great because everything should be USB-C. 1978.13s - 1985.13s | But, let's look also, so this is what the finished badge looked like. 1985.13s - 1991.13s | So, this is just in black because that's what I usually do, but you see it, uh, silkscreen on the front. 1991.13s - 1997.13s | No components makes it really easy to see, you know, a little closer. Yeah, there we go. 1997.13s - 2001.13s | Um, makes it, uh, easy to customize it because we don't have to worry about stuff. 2001.13s - 2005.13s | There are a few holes, like through holes. That's where the battery connector is. That's where the USB connector is. 2005.13s - 2009.13s | And that's where the string goes on. But I try to keep them near the edge to make it a little better. 2009.13s - 2014.13s | Um, one thing B-Side San Francisco does is they use stickers to differentiate their badge types, which is kind of cool. 2014.13s - 2020.13s | So, if you really just wanted to fab this badge as is and just make stickers for your conference, like, you can totally do that. 2020.13s - 2023.13s | Like, you literally don't even need a logo when you go and order the boards. 2023.13s - 2030.13s | But, what we've got here is the controller in the middle. Up here, we've got the Raspberry Pi 2040, some flash, 2030.13s - 2034.13s | an I2C, uh, I2C connector so you can,


chunk_text:
- 1997.13s | No components makes it really easy to see, you know, a little closer. Yeah, there we go. 1997.13s - 2001.13s | Um, makes it, uh, easy to customize it because we don't have to worry about stuff. 2001.13s - 2005.13s | There are a few holes, like through holes. That's where the battery connector is. That's where the USB connector is. 2005.13s - 2009.13s | And that's where the string goes on. But I try to keep them near the edge to make it a little better. 2009.13s - 2014.13s | Um, one thing B-Side San Francisco does is they use stickers to differentiate their badge types, which is kind of cool. 2014.13s - 2020.13s | So, if you really just wanted to fab this badge as is and just make stickers for your conference, like, you can totally do that. 2020.13s - 2023.13s | Like, you literally don't even need a logo when you go and order the boards. 2023.13s - 2030.13s | But, what we've got here is the controller in the middle. Up here, we've got the Raspberry Pi 2040, some flash, 2030.13s - 2034.13s | an I2C, uh, I2C connector so you can, like, attach things to it. 2034.13s - 2036.13s | And then, yeah, IR circuits. 2036.13s - 2040.13s | So, let's look at the layout. 2040.13s - 2042.13s | How many of you have used KiCad before? 2042.13s - 2046.13s | How many of you have used any circuit board design software, CAD software? 2046.13s - 2049.13s | Um, so, basically, it's a whole bunch of layers, right? 2049.13s - 2054.13s | And, uh, you make a, a schematic and then you make it into the layers of the, the board. 2054.13s - 2056.13s | And you actually physically place stuff around. 2056.13s - 2059.13s | I had mentioned before we have, oh, I de, I de-grouped it. 2059.13s - 2062.13s | Uh, I have most of the things in groups. 2062.13s - 2066.13s | So, like, we can go and we can grab the, here, we got the IR-TX and RX. 2066.13s - 2072.13s | So, if you wanted to move that around, you can move this whole bundle at once instead of having to go and move every single component and lay it out. 2072.13s - 2076.13s | And we'll flip the board over, view, flip board view. 2076.13s


chunk_text:
like, attach things to it. 2034.13s - 2036.13s | And then, yeah, IR circuits. 2036.13s - 2040.13s | So, let's look at the layout. 2040.13s - 2042.13s | How many of you have used KiCad before? 2042.13s - 2046.13s | How many of you have used any circuit board design software, CAD software? 2046.13s - 2049.13s | Um, so, basically, it's a whole bunch of layers, right? 2049.13s - 2054.13s | And, uh, you make a, a schematic and then you make it into the layers of the, the board. 2054.13s - 2056.13s | And you actually physically place stuff around. 2056.13s - 2059.13s | I had mentioned before we have, oh, I de, I de-grouped it. 2059.13s - 2062.13s | Uh, I have most of the things in groups. 2062.13s - 2066.13s | So, like, we can go and we can grab the, here, we got the IR-TX and RX. 2066.13s - 2072.13s | So, if you wanted to move that around, you can move this whole bundle at once instead of having to go and move every single component and lay it out. 2072.13s - 2076.13s | And we'll flip the board over, view, flip board view. 2076.13s - 2081.13s | Uh, oops, and then we'll, oh boy, the resolution is just kind of making this wild. 2081.13s - 2090.08s | Um, anyway, uh, what we see here, uh, footprint back, there we go. 2090.08s - 2091.08s | So, that's the silkscreen. 2091.08s - 2095.08s | That's the layer that we would want to, you know, we'll, we'll remove and replace. 2095.08s - 2097.08s | Um, if you wanted to see one example of what it looks like. 2097.08s - 2100.08s | Of course, you know, your boards are kind of, like, looking top down. 2100.08s - 2102.08s | So, it gets, uh, flipped and rotated a lot. 2102.08s - 2105.08s | Um, but, yeah, that's what you do. 2106.08s - 2108.08s | Uh, next. 2108.08s - 2115.08s | Um, let's go over to, this is OpenTaxus straight out of the, uh, repository. 2115.08s - 2117.08s | The question before was what the URL is. 2117.08s - 2121.08s | Um, securely, uh, github slash securely fits slash OpenTaxus. 2121.08s - 2124.08s | But if you just search github for OpenTaxus, you should get it. 2124.08s - 2126.08s | T-A-X-U-S. 2126.08s - 2127.08s | Um, what's the difference here?


chunk_text:
- 2081.13s | Uh, oops, and then we'll, oh boy, the resolution is just kind of making this wild. 2081.13s - 2090.08s | Um, anyway, uh, what we see here, uh, footprint back, there we go. 2090.08s - 2091.08s | So, that's the silkscreen. 2091.08s - 2095.08s | That's the layer that we would want to, you know, we'll, we'll remove and replace. 2095.08s - 2097.08s | Um, if you wanted to see one example of what it looks like. 2097.08s - 2100.08s | Of course, you know, your boards are kind of, like, looking top down. 2100.08s - 2102.08s | So, it gets, uh, flipped and rotated a lot. 2102.08s - 2105.08s | Um, but, yeah, that's what you do. 2106.08s - 2108.08s | Uh, next. 2108.08s - 2115.08s | Um, let's go over to, this is OpenTaxus straight out of the, uh, repository. 2115.08s - 2117.08s | The question before was what the URL is. 2117.08s - 2121.08s | Um, securely, uh, github slash securely fits slash OpenTaxus. 2121.08s - 2124.08s | But if you just search github for OpenTaxus, you should get it. 2124.08s - 2126.08s | T-A-X-U-S. 2126.08s - 2127.08s | Um, what's the difference here? 2127.08s - 2129.08s | Right, there's none of the logos. 2129.08s - 2130.08s | My logo's not on there. 2130.08s - 2132.08s | The open hardware's on there. 2132.08s - 2134.08s | Um, the conference logo isn't on there. 2134.08s - 2136.08s | There is the URL. 2136.08s - 2139.65s | So, we can see it. 2139.65s - 2140.65s | If, take a picture if you want. 2140.65s - 2142.65s | I'll wait a second. 2142.65s - 2144.65s | Take a, take a picture of the screen. 2144.65s - 2145.65s | Showing the tablet. 2145.65s - 2147.65s | Taking a picture of my laptop. 2147.65s - 2152.65s | Showing a device that happens to have the URL text rendered as an image. 2152.65s - 2154.65s | I mean, I think we need to do this anyway. 2154.65s - 2156.65s | I would take a picture with my phone right now, but I cracked the screen yesterday. 2156.65s - 2157.65s | So, oops. 2157.65s - 2159.65s | Um, but, yeah. 2159.65s - 2161.65s | You can see it's the same layout, same design. 2161.65s - 2163.65s | And besides, Portland is literally gonna use this exactly the same. 2163.65s - 2165.65s


chunk_text:
2127.08s - 2129.08s | Right, there's none of the logos. 2129.08s - 2130.08s | My logo's not on there. 2130.08s - 2132.08s | The open hardware's on there. 2132.08s - 2134.08s | Um, the conference logo isn't on there. 2134.08s - 2136.08s | There is the URL. 2136.08s - 2139.65s | So, we can see it. 2139.65s - 2140.65s | If, take a picture if you want. 2140.65s - 2142.65s | I'll wait a second. 2142.65s - 2144.65s | Take a, take a picture of the screen. 2144.65s - 2145.65s | Showing the tablet. 2145.65s - 2147.65s | Taking a picture of my laptop. 2147.65s - 2152.65s | Showing a device that happens to have the URL text rendered as an image. 2152.65s - 2154.65s | I mean, I think we need to do this anyway. 2154.65s - 2156.65s | I would take a picture with my phone right now, but I cracked the screen yesterday. 2156.65s - 2157.65s | So, oops. 2157.65s - 2159.65s | Um, but, yeah. 2159.65s - 2161.65s | You can see it's the same layout, same design. 2161.65s - 2163.65s | And besides, Portland is literally gonna use this exactly the same. 2163.65s - 2165.65s | Actually, that's not true. 2165.65s - 2169.65s | We're gonna change R11 to a slightly different resistor value. 2169.65s - 2173.65s | Um, but we don't need to worry about that right now. 2173.65s - 2174.65s | So, yeah. 2174.65s - 2177.65s | And then, again, this is, looks, should look very similar. 2177.65s - 2181.65s | This is the, get it nice and close so we get the, the screen as the whole screen. 2181.65s - 2182.65s | There we go. 2182.65s - 2183.65s | Perfect. 2183.65s - 2184.65s | So, yeah. 2184.65s - 2185.65s | Here is the board. 2185.65s - 2187.65s | Um, black, black, blank on the back. 2187.65s - 2189.65s | And stuff on the front. 2189.65s - 2195.65s | Um, one thing I'll mention, uh, some people kind of, uh, like to shortcut and sometimes, oh, you can see me in there too. 2195.65s - 2201.65s | Um, you try and shortcut and say, oh, well, you know, it's cheaper if we just get the, the plain boards. 2201.65s - 2207.65s | Um, and the default selection is, uh, uh, HASL, uh, it's a leaded, uh, kind of metal cover. 2207.65s - 2209.65s


chunk_text:
| Actually, that's not true. 2165.65s - 2169.65s | We're gonna change R11 to a slightly different resistor value. 2169.65s - 2173.65s | Um, but we don't need to worry about that right now. 2173.65s - 2174.65s | So, yeah. 2174.65s - 2177.65s | And then, again, this is, looks, should look very similar. 2177.65s - 2181.65s | This is the, get it nice and close so we get the, the screen as the whole screen. 2181.65s - 2182.65s | There we go. 2182.65s - 2183.65s | Perfect. 2183.65s - 2184.65s | So, yeah. 2184.65s - 2185.65s | Here is the board. 2185.65s - 2187.65s | Um, black, black, blank on the back. 2187.65s - 2189.65s | And stuff on the front. 2189.65s - 2195.65s | Um, one thing I'll mention, uh, some people kind of, uh, like to shortcut and sometimes, oh, you can see me in there too. 2195.65s - 2201.65s | Um, you try and shortcut and say, oh, well, you know, it's cheaper if we just get the, the plain boards. 2201.65s - 2207.65s | Um, and the default selection is, uh, uh, HASL, uh, it's a leaded, uh, kind of metal cover. 2207.65s - 2209.65s | So, it makes it easier to solder on the copper. 2209.65s - 2211.65s | Um, but that's leaded. 2211.65s - 2215.65s | And if you're doing these badges and you're handing them out to people, don't use lead. 2215.65s - 2216.65s | Okay? 2216.65s - 2218.65s | There are a lot of people who will be like, oh, yeah, I'm old school. 2218.65s - 2220.65s | I'm just going to use leaded solder because, you know, whatever. 2220.65s - 2222.65s | It tastes salty when you eat it, but too bad. 2222.65s - 2225.65s | Um, use unleaded, like, it's, it exists for a reason. 2225.65s - 2229.65s | And especially if you're going to be handing this to people and kids and they're going to hang it around their neck. 2229.65s - 2230.65s | And they'll show it to their kids when they get home. 2230.65s - 2231.65s | And they'll put it in their mouth. 2231.65s - 2235.65s | Like, you may want to put a bit on there just, you know, to make it like game cartridges. 2235.65s - 2237.65s | But like, yeah, don't, don't use lead. 2237.65s - 2238.65s | Uh, figure it out.


chunk_text:
| So, it makes it easier to solder on the copper. 2209.65s - 2211.65s | Um, but that's leaded. 2211.65s - 2215.65s | And if you're doing these badges and you're handing them out to people, don't use lead. 2215.65s - 2216.65s | Okay? 2216.65s - 2218.65s | There are a lot of people who will be like, oh, yeah, I'm old school. 2218.65s - 2220.65s | I'm just going to use leaded solder because, you know, whatever. 2220.65s - 2222.65s | It tastes salty when you eat it, but too bad. 2222.65s - 2225.65s | Um, use unleaded, like, it's, it exists for a reason. 2225.65s - 2229.65s | And especially if you're going to be handing this to people and kids and they're going to hang it around their neck. 2229.65s - 2230.65s | And they'll show it to their kids when they get home. 2230.65s - 2231.65s | And they'll put it in their mouth. 2231.65s - 2235.65s | Like, you may want to put a bit on there just, you know, to make it like game cartridges. 2235.65s - 2237.65s | But like, yeah, don't, don't use lead. 2237.65s - 2238.65s | Uh, figure it out. 2238.65s - 2240.65s | Uh, get the equipment and learn how. 2241.65s - 2248.65s | I use, uh, SAC 305, uh, solder, which is 3% silver and 0.5% some lead, tin. 2248.65s - 2249.65s | Uh, no, not lead. 2249.65s - 2250.65s | Tin. 2250.65s - 2251.65s | I don't know. 2251.65s - 2252.65s | But just do it. 2252.65s - 2254.65s | Get practice doing it if you're a soldering person. 2254.65s - 2261.65s | Because, uh, it's the right thing to do for, um, people who would otherwise get injured by lead. 2261.65s - 2262.65s | Anyway. 2262.65s - 2267.65s | Uh, so let's look next, uh, and actually I'll skip over because it's a little more visual. 2267.65s - 2269.65s | This is the, uh, the dock. 2269.65s - 2270.65s | Right? 2270.65s - 2273.65s | And so let me try and change it so you can see the dock better. 2273.65s - 2277.65s | Has anybody ever used OpenSCAD before? 2277.65s - 2280.65s | I love OpenSCAD because I'm like a console person. 2280.65s - 2284.65s | And, uh, OpenSCAD is like CAD for console people. 2284.65s - 2285.65s | There we go. 2285.65s - 2294.94s


chunk_text:
2238.65s - 2240.65s | Uh, get the equipment and learn how. 2241.65s - 2248.65s | I use, uh, SAC 305, uh, solder, which is 3% silver and 0.5% some lead, tin. 2248.65s - 2249.65s | Uh, no, not lead. 2249.65s - 2250.65s | Tin. 2250.65s - 2251.65s | I don't know. 2251.65s - 2252.65s | But just do it. 2252.65s - 2254.65s | Get practice doing it if you're a soldering person. 2254.65s - 2261.65s | Because, uh, it's the right thing to do for, um, people who would otherwise get injured by lead. 2261.65s - 2262.65s | Anyway. 2262.65s - 2267.65s | Uh, so let's look next, uh, and actually I'll skip over because it's a little more visual. 2267.65s - 2269.65s | This is the, uh, the dock. 2269.65s - 2270.65s | Right? 2270.65s - 2273.65s | And so let me try and change it so you can see the dock better. 2273.65s - 2277.65s | Has anybody ever used OpenSCAD before? 2277.65s - 2280.65s | I love OpenSCAD because I'm like a console person. 2280.65s - 2284.65s | And, uh, OpenSCAD is like CAD for console people. 2284.65s - 2285.65s | There we go. 2285.65s - 2294.94s | So here, uh, what do I do now? 2294.94s - 2295.94s | Oh, there's a button down here. 2295.94s - 2297.94s | Do-do-do-do-do-do. 2297.94s - 2299.94s | No, that was the wrong button. 2299.94s - 2301.94s | Uh, there we go. 2301.94s - 2307.94s | So, uh, OpenSCAD lets you just basically draw boxes and spheres and all that stuff. 2307.94s - 2310.94s | And what you can see here is I've got, oh, why is it doing this? 2310.94s - 2313.94s | Um, I must have a sticky key or something. 2313.94s - 2314.94s | So we'll look at it sideways. 2314.94s - 2315.94s | Right? 2315.94s - 2317.94s | I've got a groove for each of the badges to slot in there. 2317.94s - 2320.94s | Um, what I also have is it's parametric. 2320.94s - 2323.94s | So we can change the badge size right here without having to worry. 2323.94s - 2325.94s | So if we change the PCB, it's pretty straightforward. 2325.94s - 2327.94s | I like to put the USB spot-port in the middle. 2327.94s - 2328.94s | It just makes it easy. 2328.94s - 2334.94s | Um, and if we wanted to


chunk_text:
| So here, uh, what do I do now? 2294.94s - 2295.94s | Oh, there's a button down here. 2295.94s - 2297.94s | Do-do-do-do-do-do. 2297.94s - 2299.94s | No, that was the wrong button. 2299.94s - 2301.94s | Uh, there we go. 2301.94s - 2307.94s | So, uh, OpenSCAD lets you just basically draw boxes and spheres and all that stuff. 2307.94s - 2310.94s | And what you can see here is I've got, oh, why is it doing this? 2310.94s - 2313.94s | Um, I must have a sticky key or something. 2313.94s - 2314.94s | So we'll look at it sideways. 2314.94s - 2315.94s | Right? 2315.94s - 2317.94s | I've got a groove for each of the badges to slot in there. 2317.94s - 2320.94s | Um, what I also have is it's parametric. 2320.94s - 2323.94s | So we can change the badge size right here without having to worry. 2323.94s - 2325.94s | So if we change the PCB, it's pretty straightforward. 2325.94s - 2327.94s | I like to put the USB spot-port in the middle. 2327.94s - 2328.94s | It just makes it easy. 2328.94s - 2334.94s | Um, and if we wanted to do, like, a two-column version of it, not 23, uh, we can go do that. 2334.94s - 2336.94s | And bam, you've got two columns. 2336.94s - 2337.94s | Right? 2337.94s - 2343.94s | If we only wanted to do a double one, like, uh, we can do, uh, two columns and one row. 2343.94s - 2344.94s | Yeah. 2344.94s - 2345.94s | Bam. 2345.94s - 2346.94s | Like, just a skinny one. 2346.94s - 2347.94s | Make sense? 2347.94s - 2350.94s | So, um, I've got that up here. 2350.94s - 2353.94s | Um, so when I'm done talking, y'all can come up and take a peek at it. 2353.94s - 2355.94s | And, uh, yeah, again, I got badges. 2355.94s - 2361.94s | So if you stick out all the way to the end and you're interested in, like, contributing something or even just want to try these things out, uh, come on up. 2361.94s - 2362.94s | I didn't bring batteries. 2362.94s - 2363.94s | I'm sorry. 2363.94s - 2368.94s | Um, and actually now I'm realizing that there's something in my slides I forgot to mention. 2368.94s - 2370.94s | But I'll get back to that


chunk_text:
do, like, a two-column version of it, not 23, uh, we can go do that. 2334.94s - 2336.94s | And bam, you've got two columns. 2336.94s - 2337.94s | Right? 2337.94s - 2343.94s | If we only wanted to do a double one, like, uh, we can do, uh, two columns and one row. 2343.94s - 2344.94s | Yeah. 2344.94s - 2345.94s | Bam. 2345.94s - 2346.94s | Like, just a skinny one. 2346.94s - 2347.94s | Make sense? 2347.94s - 2350.94s | So, um, I've got that up here. 2350.94s - 2353.94s | Um, so when I'm done talking, y'all can come up and take a peek at it. 2353.94s - 2355.94s | And, uh, yeah, again, I got badges. 2355.94s - 2361.94s | So if you stick out all the way to the end and you're interested in, like, contributing something or even just want to try these things out, uh, come on up. 2361.94s - 2362.94s | I didn't bring batteries. 2362.94s - 2363.94s | I'm sorry. 2363.94s - 2368.94s | Um, and actually now I'm realizing that there's something in my slides I forgot to mention. 2368.94s - 2370.94s | But I'll get back to that in a minute. 2370.94s - 2372.94s | The last thing I want to talk about is code. 2372.94s - 2374.94s | Um, it's all Python. 2374.94s - 2377.94s | Does anybody, anybody who's used Python, you look at this, like, okay, we import stuff. 2377.94s - 2381.94s | We, uh, I have a bunch of libraries that I use specifically for this game. 2381.94s - 2383.94s | And then it's, it's, it's Python. 2383.94s - 2384.94s | Right? 2384.94s - 2385.94s | Python code. 2385.94s - 2387.94s | And it actually works on hardware. 2387.94s - 2389.94s | And it's pretty awesome. 2389.94s - 2393.94s | The downsides of Python on embedded hardware is it sucks power. 2393.94s - 2395.94s | It uses a lot of battery. 2395.94s - 2399.94s | Um, which is why I used AA batteries. 2399.94s - 2403.94s | Um, yeah, no, I'll go back to that later. 2403.94s - 2407.94s | Um, I use AA batteries, um, because they're cheap. 2407.94s - 2411.94s | Um, and because they have a battery holder that's inexpensive. 2411.94s - 2413.94s | You can ship them. 2413.94s - 2414.94s | You can transport them. 2414.94s - 2416.94s | You


chunk_text:
in a minute. 2370.94s - 2372.94s | The last thing I want to talk about is code. 2372.94s - 2374.94s | Um, it's all Python. 2374.94s - 2377.94s | Does anybody, anybody who's used Python, you look at this, like, okay, we import stuff. 2377.94s - 2381.94s | We, uh, I have a bunch of libraries that I use specifically for this game. 2381.94s - 2383.94s | And then it's, it's, it's Python. 2383.94s - 2384.94s | Right? 2384.94s - 2385.94s | Python code. 2385.94s - 2387.94s | And it actually works on hardware. 2387.94s - 2389.94s | And it's pretty awesome. 2389.94s - 2393.94s | The downsides of Python on embedded hardware is it sucks power. 2393.94s - 2395.94s | It uses a lot of battery. 2395.94s - 2399.94s | Um, which is why I used AA batteries. 2399.94s - 2403.94s | Um, yeah, no, I'll go back to that later. 2403.94s - 2407.94s | Um, I use AA batteries, um, because they're cheap. 2407.94s - 2411.94s | Um, and because they have a battery holder that's inexpensive. 2411.94s - 2413.94s | You can ship them. 2413.94s - 2414.94s | You can transport them. 2414.94s - 2416.94s | You can take them through TSA. 2416.94s - 2420.94s | You don't have to worry about accidentally puncturing them and starting a fire. 2420.94s - 2425.94s | Um, so unless you really know what you're doing, stay away from lithium batteries on badges. 2425.94s - 2428.94s | Um, it's, it's, I mean, it's not as bad as lead on PCBs. 2428.94s - 2433.94s | But I, I feel like, you know, we've got a badge here that was well done. 2433.94s - 2436.94s | Where they actually made an enclosure and protected the battery. 2436.94s - 2441.94s | Um, if you aren't enclosing your, your lipos, then be extra super careful. 2441.94s - 2443.94s | Anyway, AA, uh, battery. 2443.94s - 2445.94s | Actually, I started out with a double, uh, triple A. 2445.94s - 2449.94s | I used a double A because it didn't, uh, last very long the first time I did it. 2449.94s - 2452.94s | But then I've, uh, added some power save features. 2452.94s - 2455.94s | Uh, somehow I should be able to look down here. 2455.94s - 2460.94s | Um, right there, tiny, maybe you can see it, is, uh, some circuitry. 2460.94s -


chunk_text:
can take them through TSA. 2416.94s - 2420.94s | You don't have to worry about accidentally puncturing them and starting a fire. 2420.94s - 2425.94s | Um, so unless you really know what you're doing, stay away from lithium batteries on badges. 2425.94s - 2428.94s | Um, it's, it's, I mean, it's not as bad as lead on PCBs. 2428.94s - 2433.94s | But I, I feel like, you know, we've got a badge here that was well done. 2433.94s - 2436.94s | Where they actually made an enclosure and protected the battery. 2436.94s - 2441.94s | Um, if you aren't enclosing your, your lipos, then be extra super careful. 2441.94s - 2443.94s | Anyway, AA, uh, battery. 2443.94s - 2445.94s | Actually, I started out with a double, uh, triple A. 2445.94s - 2449.94s | I used a double A because it didn't, uh, last very long the first time I did it. 2449.94s - 2452.94s | But then I've, uh, added some power save features. 2452.94s - 2455.94s | Uh, somehow I should be able to look down here. 2455.94s - 2460.94s | Um, right there, tiny, maybe you can see it, is, uh, some circuitry. 2460.94s - 2463.94s | And what this does is it takes the 5 volts in over USB and boosts, 2463.94s - 2466.94s | or sorry, uh, the 1.5 volts from the battery. 2466.94s - 2468.94s | And boosts it up to 3.3. 2468.94s - 2472.94s | Which means you can use that battery all the way down to, like, 0.8 volts before the thing cuts out. 2472.94s - 2474.94s | So, use your whole battery. 2474.94s - 2476.94s | Like, I used a lot of coin cells in the past. 2476.94s - 2479.94s | Um, which is great if you have a very small thing. 2479.94s - 2481.94s | If you're not running CircuitPython, 10 minutes, cool. 2481.94s - 2483.94s | Uh, let me, like, wrap this up. 2483.94s - 2485.94s | And we'll chat. 2485.94s - 2487.94s | So, yeah, uh, it's Python code. 2487.94s - 2490.94s | If you know Python, you can, you know, learn it pretty quickly. 2490.94s - 2493.94s | Um, CircuitPython is made by Adafruit. 2493.94s - 2496.94s | They're a hobbyist electronics company based out of, uh, New York. 2496.94s - 2500.94s | Um, and they make reference boards, development boards, uh, all sorts of


chunk_text:
2463.94s | And what this does is it takes the 5 volts in over USB and boosts, 2463.94s - 2466.94s | or sorry, uh, the 1.5 volts from the battery. 2466.94s - 2468.94s | And boosts it up to 3.3. 2468.94s - 2472.94s | Which means you can use that battery all the way down to, like, 0.8 volts before the thing cuts out. 2472.94s - 2474.94s | So, use your whole battery. 2474.94s - 2476.94s | Like, I used a lot of coin cells in the past. 2476.94s - 2479.94s | Um, which is great if you have a very small thing. 2479.94s - 2481.94s | If you're not running CircuitPython, 10 minutes, cool. 2481.94s - 2483.94s | Uh, let me, like, wrap this up. 2483.94s - 2485.94s | And we'll chat. 2485.94s - 2487.94s | So, yeah, uh, it's Python code. 2487.94s - 2490.94s | If you know Python, you can, you know, learn it pretty quickly. 2490.94s - 2493.94s | Um, CircuitPython is made by Adafruit. 2493.94s - 2496.94s | They're a hobbyist electronics company based out of, uh, New York. 2496.94s - 2500.94s | Um, and they make reference boards, development boards, uh, all sorts of stuff. 2500.94s - 2503.94s | So, if you want to prototype something, actually that's where we started. 2503.94s - 2505.94s | We started with a bunch of Adafruit components. 2505.94s - 2507.94s | Prototyped on, like, breadboards. 2507.94s - 2510.94s | And ended up here with, uh, custom PCB. 2510.94s - 2515.94s | So, and the last thing I'm gonna show you is, uh, uh, yeah. 2515.94s - 2517.94s | So, let's skim through this. 2517.94s - 2519.94s | This is basically the provisioning. 2519.94s - 2525.66s | It's, uh, not LSD. 2525.66s - 2526.66s | There we go. 2526.66s - 2527.66s | So, this is the configuration. 2527.66s - 2531.66s | We've got a check.sh, which actually checks when you've got a solution. 2531.66s - 2538.66s | But the genfiles.py is what, uh, basically generates all the files for the game. 2538.66s - 2542.66s | So, down below you can see we have, like, our, our strings. 2542.66s - 2543.66s | Right, so our company options. 2543.66s - 2546.66s | Terrell Corporation, Neodym Pulsion, Weyland-Yutani. 2546.66s - 2549.66s | Our, um, the startup is Algify, iTech, whatever. 2549.66s - 2551.66s | And the tool is, uh, something else. 2551.66s


chunk_text:
stuff. 2500.94s - 2503.94s | So, if you want to prototype something, actually that's where we started. 2503.94s - 2505.94s | We started with a bunch of Adafruit components. 2505.94s - 2507.94s | Prototyped on, like, breadboards. 2507.94s - 2510.94s | And ended up here with, uh, custom PCB. 2510.94s - 2515.94s | So, and the last thing I'm gonna show you is, uh, uh, yeah. 2515.94s - 2517.94s | So, let's skim through this. 2517.94s - 2519.94s | This is basically the provisioning. 2519.94s - 2525.66s | It's, uh, not LSD. 2525.66s - 2526.66s | There we go. 2526.66s - 2527.66s | So, this is the configuration. 2527.66s - 2531.66s | We've got a check.sh, which actually checks when you've got a solution. 2531.66s - 2538.66s | But the genfiles.py is what, uh, basically generates all the files for the game. 2538.66s - 2542.66s | So, down below you can see we have, like, our, our strings. 2542.66s - 2543.66s | Right, so our company options. 2543.66s - 2546.66s | Terrell Corporation, Neodym Pulsion, Weyland-Yutani. 2546.66s - 2549.66s | Our, um, the startup is Algify, iTech, whatever. 2549.66s - 2551.66s | And the tool is, uh, something else. 2551.66s - 2557.66s | And the string is, blank company has just announced an intent to acquire a startup to build the entry's most advanced AI-powered tool. 2557.66s - 2560.66s | Right, and that's the, those, the solution is randomly chosen. 2560.66s - 2562.66s | And, uh, comes out here. 2562.66s - 2566.66s | The way it does that is, basically, it goes through the options, randomly chooses one. 2566.66s - 2569.66s | Generates a bunch of files that go on the badges. 2569.66s - 2571.66s | And then it signs the clues. 2571.66s - 2573.66s | Right, and gives the public key out. 2573.66s - 2576.66s | With RSA-512, because just enough to last you a day. 2576.66s - 2578.66s | Right, without someone wasting a few grand. 2578.66s - 2584.66s | Um, and, uh, that'll let you make sure that people don't mess with your game by giving out fake clues, which could screw everything up. 2584.66s - 2586.66s | So, I'm gonna stop here. 2586.66s - 2589.66s | Uh, I've said all the things I think I wanted to say. 2589.66s - 2591.66s | If you got some questions, come on up here. 2591.66s - 2594.66s | Um,


chunk_text:
- 2557.66s | And the string is, blank company has just announced an intent to acquire a startup to build the entry's most advanced AI-powered tool. 2557.66s - 2560.66s | Right, and that's the, those, the solution is randomly chosen. 2560.66s - 2562.66s | And, uh, comes out here. 2562.66s - 2566.66s | The way it does that is, basically, it goes through the options, randomly chooses one. 2566.66s - 2569.66s | Generates a bunch of files that go on the badges. 2569.66s - 2571.66s | And then it signs the clues. 2571.66s - 2573.66s | Right, and gives the public key out. 2573.66s - 2576.66s | With RSA-512, because just enough to last you a day. 2576.66s - 2578.66s | Right, without someone wasting a few grand. 2578.66s - 2584.66s | Um, and, uh, that'll let you make sure that people don't mess with your game by giving out fake clues, which could screw everything up. 2584.66s - 2586.66s | So, I'm gonna stop here. 2586.66s - 2589.66s | Uh, I've said all the things I think I wanted to say. 2589.66s - 2591.66s | If you got some questions, come on up here. 2591.66s - 2594.66s | Um, and I can, like, continue to talk to those out loud. 2594.66s - 2596.66s | But you can also come on up and grab some badges if you want. 2596.66s - 2598.66s | So, yeah, go for it. 2598.66s - 2599.66s | Thank you. 2599.66s - 2601.66s | Thank you.


chunk_text:
and I can, like, continue to talk to those out loud. 2594.66s - 2596.66s | But you can also come on up and grab some badges if you want. 2596.66s - 2598.66s | So, yeah, go for it. 2598.66s - 2599.66s | Thank you. 2599.66s - 2601.66s | Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=GJgTkxL5txw", "title": "DEF CON 32 - Bypass 102 - Terry Luan & Karen Ng", "description": "There are loads of ways to get through a door without actually attacking the lock itself, including using the egress hardware, access control hardware, and countless other techniques to gain entry. Learn how to do these attacks in this talk!", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 814, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 0.76s | This text was transcribed using whisper model: large-v2 All right. 0.76s - 3.32s | So since we're experiencing technical difficulties, 3.32s - 5.92s | I'm just going to start talking at you guys 5.92s - 7.24s | about what we're talking about. 7.24s - 9.76s | Could you open up my slides? 9.76s - 12.76s | And yeah, and you guys are just going to have to deal with that. 12.76s - 14.80s | Yeah, imagine I will be very descriptive. 14.80s - 18.56s | But the first part of this is intro, and it's just talking. 18.56s - 20.52s | So let's start with that. 20.52s - 22.20s | So hello, everybody. 22.20s - 23.76s | Welcome to Bypass 102. 23.76s - 26.20s | In this talk, we're going to be covering basic bypass 26.20s - 27.24s | remediation. 27.24s - 29.64s | So a general prerequisite for this talk 29.68s - 31.96s | is I'm hoping that you've seen Bypass 101. 31.96s - 34.28s | If you haven't, I recommend you watch that later 34.28s - 36.72s | when it is uploaded. 36.72s - 39.56s | We were on the creator stage earlier for that talk. 39.56s - 41.88s | Yeah, and then please keep all questions till the end 41.88s - 43.52s | if we have time for questions. 43.52s - 47.56s | So for those that aren't aware, what bypass is 47.56s - 50.44s | is basically ignoring the lock and trying 50.44s - 52.76s | to figure out a way to exploit the door 52.76s - 55.32s | hardware or the surrounding area in order 55.32s - 59.16s | to gain access into a locked out space. 59.16s - 62.34s | Here, just let me do that. 62.34s - 65.62s | So again, this covers basic remediation and retrofits 65.62s - 68.14s | that'll help you secure your facility from these basic 68.14s - 70.10s | bypass methods. 70.10s - 73.30s | So


chunk_text:
we're going to be covering basic bypass 26.20s - 27.24s | remediation. 27.24s - 29.64s | So a general prerequisite for this talk 29.68s - 31.96s | is I'm hoping that you've seen Bypass 101. 31.96s - 34.28s | If you haven't, I recommend you watch that later 34.28s - 36.72s | when it is uploaded. 36.72s - 39.56s | We were on the creator stage earlier for that talk. 39.56s - 41.88s | Yeah, and then please keep all questions till the end 41.88s - 43.52s | if we have time for questions. 43.52s - 47.56s | So for those that aren't aware, what bypass is 47.56s - 50.44s | is basically ignoring the lock and trying 50.44s - 52.76s | to figure out a way to exploit the door 52.76s - 55.32s | hardware or the surrounding area in order 55.32s - 59.16s | to gain access into a locked out space. 59.16s - 62.34s | Here, just let me do that. 62.34s - 65.62s | So again, this covers basic remediation and retrofits 65.62s - 68.14s | that'll help you secure your facility from these basic 68.14s - 70.10s | bypass methods. 70.10s - 73.30s | So similar to cybersecurity, physical security 73.30s - 76.02s | vulnerabilities and remediation is basically 76.02s - 78.34s | an ongoing forever game of cat and mouse. 78.34s - 80.18s | Every time somebody finds a vulnerability, 80.18s - 81.86s | someone else comes up with a patch. 81.86s - 84.44s | And then for that patch, someone finds a new vulnerability, 84.44s - 86.06s | and it repeats over and over again. 86.06s - 87.90s | And that's the cycle of security. 87.90s - 91.18s | Same thing applies for cyber. 91.18s - 93.30s | So like I mentioned earlier, lock bypass 93.30s - 95.02s | involves ignoring that lock completely 95.02s - 97.98s | and finding an alternative way to get that door open 97.98s - 101.18s | or avoid using the door altogether. 101.18s - 102.98s | These bypass methods are very often 102.98s - 105.32s | used in physical security and physical hacking, 105.32s - 106.98s | and they are generally simple enough 106.98s - 111.72s | to use by anyone with a little bit of know-how. 111.72s - 113.46s | In case you guys don't have that know-how, 113.46s - 114.94s | you can come over


chunk_text:
similar to cybersecurity, physical security 73.30s - 76.02s | vulnerabilities and remediation is basically 76.02s - 78.34s | an ongoing forever game of cat and mouse. 78.34s - 80.18s | Every time somebody finds a vulnerability, 80.18s - 81.86s | someone else comes up with a patch. 81.86s - 84.44s | And then for that patch, someone finds a new vulnerability, 84.44s - 86.06s | and it repeats over and over again. 86.06s - 87.90s | And that's the cycle of security. 87.90s - 91.18s | Same thing applies for cyber. 91.18s - 93.30s | So like I mentioned earlier, lock bypass 93.30s - 95.02s | involves ignoring that lock completely 95.02s - 97.98s | and finding an alternative way to get that door open 97.98s - 101.18s | or avoid using the door altogether. 101.18s - 102.98s | These bypass methods are very often 102.98s - 105.32s | used in physical security and physical hacking, 105.32s - 106.98s | and they are generally simple enough 106.98s - 111.72s | to use by anyone with a little bit of know-how. 111.72s - 113.46s | In case you guys don't have that know-how, 113.46s - 114.94s | you can come over to our village and check us out, 114.94s - 116.44s | and we will teach you that know-how, 116.48s - 118.56s | and show you how easy it is. 118.56s - 120.92s | Now I'm going to talk a little bit about latch-targeted 120.92s - 122.84s | bypasses. 122.84s - 127.24s | So this applies to all the, oh, looks 127.24s - 129.32s | like we have the presentation coming up. 129.32s - 135.00s | But you'll see in the slide what I mean. 135.00s - 138.84s | So essentially, this is ways to remediate 138.84s - 144.36s | the bypass, which is called targeting. 144.36s - 147.88s | So targeting targets a latch that holds the door closed. 147.88s - 150.76s | And essentially, by carting it, you're 150.76s - 154.68s | essentially bypassing this dead latch, which prevents 154.68s - 157.24s | the plunger from moving. 157.24s - 159.60s | So the best way of bypassing this, 159.60s - 162.64s | is to install, of remedying this, 162.64s - 173.05s | is to install the doors properly. 173.05s - 175.33s | So installing these dead latches, 175.33s - 178.89s | and especially doors properly, is extremely difficult, 178.89s


chunk_text:
to our village and check us out, 114.94s - 116.44s | and we will teach you that know-how, 116.48s - 118.56s | and show you how easy it is. 118.56s - 120.92s | Now I'm going to talk a little bit about latch-targeted 120.92s - 122.84s | bypasses. 122.84s - 127.24s | So this applies to all the, oh, looks 127.24s - 129.32s | like we have the presentation coming up. 129.32s - 135.00s | But you'll see in the slide what I mean. 135.00s - 138.84s | So essentially, this is ways to remediate 138.84s - 144.36s | the bypass, which is called targeting. 144.36s - 147.88s | So targeting targets a latch that holds the door closed. 147.88s - 150.76s | And essentially, by carting it, you're 150.76s - 154.68s | essentially bypassing this dead latch, which prevents 154.68s - 157.24s | the plunger from moving. 157.24s - 159.60s | So the best way of bypassing this, 159.60s - 162.64s | is to install, of remedying this, 162.64s - 173.05s | is to install the doors properly. 173.05s - 175.33s | So installing these dead latches, 175.33s - 178.89s | and especially doors properly, is extremely difficult, 178.89s - 181.81s | especially if your door is, for example, wooden 181.81s - 187.21s | or just because they're in order for, 187.21s - 190.33s | if you guys have watched the Bypass 101 talk, 190.33s - 193.05s | you guys know that in order for the dead latch to work, 193.05s - 195.25s | it has to be actuated when the door is closed. 195.25s - 198.45s | Now the issue is that there are tolerances, right? 198.45s - 202.77s | So for example, it needs to be installed exactly 202.77s - 208.85s | the correct way so that, give me one second, 208.85s - 211.21s | so that when the door is closed, 211.21s - 214.09s | that the dead latch is actuated. 214.09s - 217.05s | What that means is that also, if you push the door, 217.05s - 219.97s | for example, it will still be actuated. 219.97s - 224.01s | The door cannot warp, et cetera, et cetera. 224.01s - 255.12s | So there are a couple of different ways. 255.12s - 258.92s | OK, so we're trying our best to get the AV working. 258.92s - 262.00s | But again, the DEF CON Wi-Fi


chunk_text:
- 181.81s | especially if your door is, for example, wooden 181.81s - 187.21s | or just because they're in order for, 187.21s - 190.33s | if you guys have watched the Bypass 101 talk, 190.33s - 193.05s | you guys know that in order for the dead latch to work, 193.05s - 195.25s | it has to be actuated when the door is closed. 195.25s - 198.45s | Now the issue is that there are tolerances, right? 198.45s - 202.77s | So for example, it needs to be installed exactly 202.77s - 208.85s | the correct way so that, give me one second, 208.85s - 211.21s | so that when the door is closed, 211.21s - 214.09s | that the dead latch is actuated. 214.09s - 217.05s | What that means is that also, if you push the door, 217.05s - 219.97s | for example, it will still be actuated. 219.97s - 224.01s | The door cannot warp, et cetera, et cetera. 224.01s - 255.12s | So there are a couple of different ways. 255.12s - 258.92s | OK, so we're trying our best to get the AV working. 258.92s - 262.00s | But again, the DEF CON Wi-Fi is our best friend 262.00s - 263.76s | in the whole wide world. 263.76s - 265.88s | So Terry was about to talk about dead latches. 266.64s - 268.72s | So I'll talk about that until we can figure out 268.72s - 269.76s | how to get this to load. 269.76s - 272.96s | Can you come back? 272.96s - 275.20s | Yeah, so basically, go back. 275.20s - 283.85s | Please go back. 283.85s - 285.17s | Thanks, guys, for being patient. 285.17s - 288.29s | So a dead latch is essentially a security mechanism 288.29s - 291.77s | that is built into that door closing 291.77s - 294.89s | hardware that allows you to stop people 294.89s - 296.49s | from using this exploit. 296.49s - 298.77s | So for those familiar with Bypass 101, 298.77s - 301.03s | what we call latch slipping or latch shoving, 301.03s - 302.33s | it seems a little bit too easy. 302.33s - 304.01s | And it's because it is. 304.01s - 306.17s | It has this security mechanism that prevents you 306.17s - 308.29s | from being able to do this. 308.29s - 311.89s | But a lot of the


chunk_text:
is our best friend 262.00s - 263.76s | in the whole wide world. 263.76s - 265.88s | So Terry was about to talk about dead latches. 266.64s - 268.72s | So I'll talk about that until we can figure out 268.72s - 269.76s | how to get this to load. 269.76s - 272.96s | Can you come back? 272.96s - 275.20s | Yeah, so basically, go back. 275.20s - 283.85s | Please go back. 283.85s - 285.17s | Thanks, guys, for being patient. 285.17s - 288.29s | So a dead latch is essentially a security mechanism 288.29s - 291.77s | that is built into that door closing 291.77s - 294.89s | hardware that allows you to stop people 294.89s - 296.49s | from using this exploit. 296.49s - 298.77s | So for those familiar with Bypass 101, 298.77s - 301.03s | what we call latch slipping or latch shoving, 301.03s - 302.33s | it seems a little bit too easy. 302.33s - 304.01s | And it's because it is. 304.01s - 306.17s | It has this security mechanism that prevents you 306.17s - 308.29s | from being able to do this. 308.29s - 311.89s | But a lot of the installers of doors and other things 311.89s - 314.13s | in a facility doesn't really think about that. 314.13s - 315.97s | They don't care about the security. 315.97s - 318.17s | They don't know what these features do. 318.17s - 321.21s | All in all, it means that people aren't 321.21s - 323.93s | keeping that security mindset in place 323.93s - 325.81s | while they're doing their installations. 325.81s - 328.29s | And that leads to a lot of vulnerabilities. 328.29s - 331.59s | So I'm sure you guys have seen the retrofits for this before. 331.59s - 333.57s | If you've ever walked along a long hallway 333.61s - 338.57s | and you've seen doors with a big metal plate over that latch, 338.57s - 340.61s | usually what this is is a retrofit. 340.61s - 344.45s | So they found that that dead latch isn't working properly. 344.45s - 345.93s | And so instead of fixing the door, 345.93s - 348.01s | instead of installing it properly, 348.01s - 350.25s | they're just putting this panel over it and going, 350.25s - 351.25s | OK, that's good enough. 351.25s - 352.93s | Now they can't latch


chunk_text:
installers of doors and other things 311.89s - 314.13s | in a facility doesn't really think about that. 314.13s - 315.97s | They don't care about the security. 315.97s - 318.17s | They don't know what these features do. 318.17s - 321.21s | All in all, it means that people aren't 321.21s - 323.93s | keeping that security mindset in place 323.93s - 325.81s | while they're doing their installations. 325.81s - 328.29s | And that leads to a lot of vulnerabilities. 328.29s - 331.59s | So I'm sure you guys have seen the retrofits for this before. 331.59s - 333.57s | If you've ever walked along a long hallway 333.61s - 338.57s | and you've seen doors with a big metal plate over that latch, 338.57s - 340.61s | usually what this is is a retrofit. 340.61s - 344.45s | So they found that that dead latch isn't working properly. 344.45s - 345.93s | And so instead of fixing the door, 345.93s - 348.01s | instead of installing it properly, 348.01s - 350.25s | they're just putting this panel over it and going, 350.25s - 351.25s | OK, that's good enough. 351.25s - 352.93s | Now they can't latch slip the door. 352.93s - 355.05s | However, these can still be bypassed. 355.05s - 359.21s | For example, with this little latch cover, what people can do 359.21s - 360.77s | is take a little bit of piano wire, 360.77s - 362.45s | stick it behind the latch, and open it 362.45s - 365.61s | pretty much the exact same way without much more trouble. 365.61s - 366.73s | Do we have it? 366.73s - 369.66s | Yay! 369.66s - 376.24s | So if you could full screen that. 376.24s - 382.96s | How many hackers does it take to play a PowerPoint presentation? 382.96s - 384.76s | Oh, OK, there we go. 384.76s - 388.22s | Do we have the slideshow? 388.22s - 396.02s | You're fine. 396.02s - 397.90s | We're going to give this a second to load. 397.90s - 399.22s | And hopefully this video loads. 399.22s - 405.42s | That'll give us a little demo of how the dead latch works. 405.42s - 406.58s | There it is. 406.58s - 409.02s | OK, so like I was mentioning, so there's the latch. 409.02s - 410.58s | And that little half moon shape there 410.58s


chunk_text:
slip the door. 352.93s - 355.05s | However, these can still be bypassed. 355.05s - 359.21s | For example, with this little latch cover, what people can do 359.21s - 360.77s | is take a little bit of piano wire, 360.77s - 362.45s | stick it behind the latch, and open it 362.45s - 365.61s | pretty much the exact same way without much more trouble. 365.61s - 366.73s | Do we have it? 366.73s - 369.66s | Yay! 369.66s - 376.24s | So if you could full screen that. 376.24s - 382.96s | How many hackers does it take to play a PowerPoint presentation? 382.96s - 384.76s | Oh, OK, there we go. 384.76s - 388.22s | Do we have the slideshow? 388.22s - 396.02s | You're fine. 396.02s - 397.90s | We're going to give this a second to load. 397.90s - 399.22s | And hopefully this video loads. 399.22s - 405.42s | That'll give us a little demo of how the dead latch works. 405.42s - 406.58s | There it is. 406.58s - 409.02s | OK, so like I was mentioning, so there's the latch. 409.02s - 410.58s | And that little half moon shape there 410.58s - 411.98s | is what's called the dead latch. 411.98s - 413.46s | And when it's pushed into the door, 413.46s - 415.74s | it actually prevents the latch from being 415.74s - 421.08s | able to be pushed in, thus stopping that exploit. 421.08s - 424.04s | So obviously, the easiest way to prevent people 424.04s - 427.32s | from using this exploit is just to install your door properly 427.32s - 429.80s | and make sure that the dead latch is actually being pushed 429.80s - 432.24s | in when that door is closed. 432.24s - 433.88s | I already talked about this retrofit, 433.88s - 435.72s | so we're just going to skip over that. 435.72s - 437.60s | And again, it can be bypassed. 437.60s - 439.72s | In fact, usually on red team engagements, 439.72s - 441.52s | I'm looking out for these kinds of covers, 441.52s - 447.46s | because it means that that latch is vulnerable to an attack. 447.46s - 450.06s | Next, I'm going to be talking about handle-targeted bypass. 450.06s - 453.06s | So this usually mimics a person on the other side of the door 453.06s - 454.86s |


chunk_text:
- 411.98s | is what's called the dead latch. 411.98s - 413.46s | And when it's pushed into the door, 413.46s - 415.74s | it actually prevents the latch from being 415.74s - 421.08s | able to be pushed in, thus stopping that exploit. 421.08s - 424.04s | So obviously, the easiest way to prevent people 424.04s - 427.32s | from using this exploit is just to install your door properly 427.32s - 429.80s | and make sure that the dead latch is actually being pushed 429.80s - 432.24s | in when that door is closed. 432.24s - 433.88s | I already talked about this retrofit, 433.88s - 435.72s | so we're just going to skip over that. 435.72s - 437.60s | And again, it can be bypassed. 437.60s - 439.72s | In fact, usually on red team engagements, 439.72s - 441.52s | I'm looking out for these kinds of covers, 441.52s - 447.46s | because it means that that latch is vulnerable to an attack. 447.46s - 450.06s | Next, I'm going to be talking about handle-targeted bypass. 450.06s - 453.06s | So this usually mimics a person on the other side of the door 453.06s - 454.86s | exiting from the other side and can 454.86s - 457.96s | be used on lever handles and doorknobs and crash bars. 457.96s - 460.54s | The easiest way to prevent this, I'm going to have to go fast. 460.54s - 461.46s | I'm running out of time. 461.46s - 462.62s | So the easiest way to prevent this 462.62s - 465.46s | is to have a properly sized door that fits into the door frame 465.46s - 467.62s | and doesn't leave gap enough for tools 467.62s - 470.18s | to fit in, around, or under. 470.18s - 472.30s | In addition to that, certain types of lever handles 472.30s - 476.70s | will make it more difficult to use the under-the-door tool. 476.70s - 479.18s | A retrofit like this can help reduce the amount of gap 479.18s - 480.94s | underneath your door and make sure people 480.94s - 482.56s | can't fit tools underneath. 482.56s - 484.18s | You've probably seen things like this, 484.18s - 488.02s | which isn't intended to better secure your facility 488.02s - 490.66s | for weatherproofing, but it can make using those kinds of tools 490.66s - 492.54s | more difficult.


chunk_text:
exiting from the other side and can 454.86s - 457.96s | be used on lever handles and doorknobs and crash bars. 457.96s - 460.54s | The easiest way to prevent this, I'm going to have to go fast. 460.54s - 461.46s | I'm running out of time. 461.46s - 462.62s | So the easiest way to prevent this 462.62s - 465.46s | is to have a properly sized door that fits into the door frame 465.46s - 467.62s | and doesn't leave gap enough for tools 467.62s - 470.18s | to fit in, around, or under. 470.18s - 472.30s | In addition to that, certain types of lever handles 472.30s - 476.70s | will make it more difficult to use the under-the-door tool. 476.70s - 479.18s | A retrofit like this can help reduce the amount of gap 479.18s - 480.94s | underneath your door and make sure people 480.94s - 482.56s | can't fit tools underneath. 482.56s - 484.18s | You've probably seen things like this, 484.18s - 488.02s | which isn't intended to better secure your facility 488.02s - 490.66s | for weatherproofing, but it can make using those kinds of tools 490.66s - 492.54s | more difficult. In addition to that, 492.54s - 495.34s | windows next to your door or alongside your door 495.34s - 496.98s | can make it easier to use these tools. 496.98s - 500.54s | So cover them up or don't have them at all if not necessary. 500.54s - 502.58s | Mag locks can also provide additional security, 502.58s - 507.05s | but again, these can also be bypassed. 507.05s - 508.01s | So you have deadbolts. 508.01s - 511.45s | This is a deadbolt. They're different from dead latches 511.45s - 514.97s | and have a thumb turn on the other side. 514.97s - 518.01s | The best way of remediating this is 518.01s - 520.37s | to have a double-sided deadbolt. Basically, 520.37s - 522.41s | you don't have that thumb turn on the other side. 522.41s - 525.81s | This prevents you from using JTools to bypass it. 525.81s - 528.37s | If you don't know what JTool is, you can look in our village. 528.37s - 531.09s | Yeah, and basically, the thing is, in exchange for security, 531.09s - 532.61s | you are losing a bit of convenience, 532.61s - 534.05s | but sometimes in certain


chunk_text:
In addition to that, 492.54s - 495.34s | windows next to your door or alongside your door 495.34s - 496.98s | can make it easier to use these tools. 496.98s - 500.54s | So cover them up or don't have them at all if not necessary. 500.54s - 502.58s | Mag locks can also provide additional security, 502.58s - 507.05s | but again, these can also be bypassed. 507.05s - 508.01s | So you have deadbolts. 508.01s - 511.45s | This is a deadbolt. They're different from dead latches 511.45s - 514.97s | and have a thumb turn on the other side. 514.97s - 518.01s | The best way of remediating this is 518.01s - 520.37s | to have a double-sided deadbolt. Basically, 520.37s - 522.41s | you don't have that thumb turn on the other side. 522.41s - 525.81s | This prevents you from using JTools to bypass it. 525.81s - 528.37s | If you don't know what JTool is, you can look in our village. 528.37s - 531.09s | Yeah, and basically, the thing is, in exchange for security, 531.09s - 532.61s | you are losing a bit of convenience, 532.61s - 534.05s | but sometimes in certain facilities, 534.05s - 536.97s | it is worth that exchange. 536.97s - 539.01s | For push bars, the main thing is don't have holes 539.01s - 540.65s | or gaps in your door if possible. 540.65s - 542.65s | Use a push bar with dead latches 542.65s - 546.21s | to prevent latch-targeted attacks. 546.21s - 548.73s | There are also retrofits, which you'll see in a bit. 548.73s - 554.08s | We also have a video. 554.08s - 556.32s | We had a video. It's no longer there. 556.32s - 557.64s | We were on a red team engagement. 557.64s - 561.48s | Basically, someone was able to reach their hand around 561.48s - 563.44s | and push on the push bar from the other side. 563.44s - 565.68s | If you want to see it, you can come by after. 565.68s - 567.76s | I'll show you the video on my phone. 567.76s - 569.52s | Oh, yeah, you can see the retrofit here. 569.52s - 573.88s | They can be bypassed, but it makes it a lot harder. 573.88s - 576.60s | You can also use bar guards, again, 576.60s - 578.24s | to further prevent bypasses.


chunk_text:
facilities, 534.05s - 536.97s | it is worth that exchange. 536.97s - 539.01s | For push bars, the main thing is don't have holes 539.01s - 540.65s | or gaps in your door if possible. 540.65s - 542.65s | Use a push bar with dead latches 542.65s - 546.21s | to prevent latch-targeted attacks. 546.21s - 548.73s | There are also retrofits, which you'll see in a bit. 548.73s - 554.08s | We also have a video. 554.08s - 556.32s | We had a video. It's no longer there. 556.32s - 557.64s | We were on a red team engagement. 557.64s - 561.48s | Basically, someone was able to reach their hand around 561.48s - 563.44s | and push on the push bar from the other side. 563.44s - 565.68s | If you want to see it, you can come by after. 565.68s - 567.76s | I'll show you the video on my phone. 567.76s - 569.52s | Oh, yeah, you can see the retrofit here. 569.52s - 573.88s | They can be bypassed, but it makes it a lot harder. 573.88s - 576.60s | You can also use bar guards, again, 576.60s - 578.24s | to further prevent bypasses. 578.24s - 580.24s | Again, it is possible, but, yeah. 580.24s - 581.96s | Okay, cool. Next is removing the hinges. 581.96s - 584.64s | So, usually, you can take out those little hinge pins 584.64s - 586.60s | and pull the door off of the frame. 586.60s - 588.08s | There are special security hinges, 588.08s - 590.28s | such as these ones called set-screw hinges 590.28s - 594.08s | and stud-pit hinges that allow you to lock that door, 594.08s - 595.64s | and even if the hinge pin is taken out, 595.64s - 598.56s | you can't actually remove the door from the frame. 598.56s - 599.88s | Button-push combination locks. 599.88s - 601.08s | So, these are simplex locks. 601.08s - 602.88s | They use the default combination from the factory, 602.88s - 605.00s | two and four at the same time, and then the number three. 605.00s - 607.00s | Change your default combinations. 607.00s - 608.24s | Other combination locks, as well, 608.24s - 609.88s | you can easily find these defaults online. 609.88s - 612.80s | Change your combination! 612.80s - 614.72s | Enter phones. Okay, so, I'm sure you've seen these before.


chunk_text:
578.24s - 580.24s | Again, it is possible, but, yeah. 580.24s - 581.96s | Okay, cool. Next is removing the hinges. 581.96s - 584.64s | So, usually, you can take out those little hinge pins 584.64s - 586.60s | and pull the door off of the frame. 586.60s - 588.08s | There are special security hinges, 588.08s - 590.28s | such as these ones called set-screw hinges 590.28s - 594.08s | and stud-pit hinges that allow you to lock that door, 594.08s - 595.64s | and even if the hinge pin is taken out, 595.64s - 598.56s | you can't actually remove the door from the frame. 598.56s - 599.88s | Button-push combination locks. 599.88s - 601.08s | So, these are simplex locks. 601.08s - 602.88s | They use the default combination from the factory, 602.88s - 605.00s | two and four at the same time, and then the number three. 605.00s - 607.00s | Change your default combinations. 607.00s - 608.24s | Other combination locks, as well, 608.24s - 609.88s | you can easily find these defaults online. 609.88s - 612.80s | Change your combination! 612.80s - 614.72s | Enter phones. Okay, so, I'm sure you've seen these before. 614.72s - 615.48s | These are enter phones. 615.48s - 617.80s | They're used to let people into apartments in high-rises. 617.80s - 619.48s | You can call up using that enter phone, 619.48s - 621.12s | and the resident can push a button on their phone 621.12s - 622.92s | and allow you access. 622.92s - 625.36s | There's a master code that comes from the factory 625.36s - 627.24s | that allows the owner of the building 627.24s - 628.28s | and the owner of the enter phone 628.28s - 630.28s | to add entry codes and add residents. 630.28s - 631.84s | You can find these online from manufacturers. 631.84s - 634.24s | So, change your combination! 634.24s - 636.00s | Further to that, these enter phones are key-to-like, 636.00s - 638.56s | and with these keys, you're actually able to open 638.56s - 640.20s | all enter phones by that same brand 640.20s - 642.24s | and get at the electronics. 642.24s - 643.32s | Guess how you can fix this? 643.32s - 644.44s | You can change your lock. 644.44s - 646.96s | Wow, they don't have to be the default. 646.96s - 647.80s |


chunk_text:
614.72s - 615.48s | These are enter phones. 615.48s - 617.80s | They're used to let people into apartments in high-rises. 617.80s - 619.48s | You can call up using that enter phone, 619.48s - 621.12s | and the resident can push a button on their phone 621.12s - 622.92s | and allow you access. 622.92s - 625.36s | There's a master code that comes from the factory 625.36s - 627.24s | that allows the owner of the building 627.24s - 628.28s | and the owner of the enter phone 628.28s - 630.28s | to add entry codes and add residents. 630.28s - 631.84s | You can find these online from manufacturers. 631.84s - 634.24s | So, change your combination! 634.24s - 636.00s | Further to that, these enter phones are key-to-like, 636.00s - 638.56s | and with these keys, you're actually able to open 638.56s - 640.20s | all enter phones by that same brand 640.20s - 642.24s | and get at the electronics. 642.24s - 643.32s | Guess how you can fix this? 643.32s - 644.44s | You can change your lock. 644.44s - 646.96s | Wow, they don't have to be the default. 646.96s - 647.80s | There's also these. 647.80s - 649.92s | These are security bars and enter phone covers, 649.92s - 651.24s | and they can be used to prevent people 651.24s - 652.88s | from being able to force it open, 652.88s - 655.00s | or even if they have a key for the enter phone, 655.00s - 658.40s | from opening it and getting at those circuitries inside. 658.40s - 660.44s | You have requests to exit sensors. 660.44s - 662.12s | They're set up so that you can unlock 662.12s - 665.40s | when you're coming in from the inside of the building. 665.40s - 668.24s | So, most of them rely on passive infrared. 668.24s - 670.12s | If someone can trick the sensor 670.12s - 672.32s | into thinking there's someone inside and exit the building, 672.32s - 673.44s | they'll allow them access. 673.44s - 677.00s | What you have is you have sensors 677.20s - 679.12s | that use both PR and radar 679.12s - 680.88s | to detect if someone is coming in. 680.88s - 683.20s | There used to be a company called Interlogix, 683.20s - 685.16s | which made a REC sensor. 685.16s -


chunk_text:
There's also these. 647.80s - 649.92s | These are security bars and enter phone covers, 649.92s - 651.24s | and they can be used to prevent people 651.24s - 652.88s | from being able to force it open, 652.88s - 655.00s | or even if they have a key for the enter phone, 655.00s - 658.40s | from opening it and getting at those circuitries inside. 658.40s - 660.44s | You have requests to exit sensors. 660.44s - 662.12s | They're set up so that you can unlock 662.12s - 665.40s | when you're coming in from the inside of the building. 665.40s - 668.24s | So, most of them rely on passive infrared. 668.24s - 670.12s | If someone can trick the sensor 670.12s - 672.32s | into thinking there's someone inside and exit the building, 672.32s - 673.44s | they'll allow them access. 673.44s - 677.00s | What you have is you have sensors 677.20s - 679.12s | that use both PR and radar 679.12s - 680.88s | to detect if someone is coming in. 680.88s - 683.20s | There used to be a company called Interlogix, 683.20s - 685.16s | which made a REC sensor. 685.16s - 686.12s | They no longer exist. 686.12s - 688.48s | There are other companies in the market, 688.48s - 692.00s | but they're many thousands of dollars, but they do exist. 693.36s - 697.12s | For remediation, REC sensors are generally more convenient. 697.12s - 698.28s | They are less secure. 698.28s - 701.60s | For more secure areas, there are these REC buttons 701.60s - 702.76s | that you can use. 702.76s - 704.24s | Make sure to put them away from the door 704.24s - 706.64s | so people can't use any sort of wire 706.64s - 709.28s | to push it from the outside. 709.28s - 711.40s | As well as that, tap in, tap out, of course, 711.40s - 714.20s | is the most secure way to let people in and out of spaces. 714.20s - 715.60s | But again, you're trading that convenience 715.60s - 717.36s | in for that security. 717.36s - 719.04s | Elevators, so you see elevators. 719.04s - 719.88s | Two minutes, okay. 719.88s - 721.56s | We have elevators everywhere in modern buildings. 721.56s - 723.88s | There's a lot of bypasses that you can get around them. 723.88s -


chunk_text:
686.12s | They no longer exist. 686.12s - 688.48s | There are other companies in the market, 688.48s - 692.00s | but they're many thousands of dollars, but they do exist. 693.36s - 697.12s | For remediation, REC sensors are generally more convenient. 697.12s - 698.28s | They are less secure. 698.28s - 701.60s | For more secure areas, there are these REC buttons 701.60s - 702.76s | that you can use. 702.76s - 704.24s | Make sure to put them away from the door 704.24s - 706.64s | so people can't use any sort of wire 706.64s - 709.28s | to push it from the outside. 709.28s - 711.40s | As well as that, tap in, tap out, of course, 711.40s - 714.20s | is the most secure way to let people in and out of spaces. 714.20s - 715.60s | But again, you're trading that convenience 715.60s - 717.36s | in for that security. 717.36s - 719.04s | Elevators, so you see elevators. 719.04s - 719.88s | Two minutes, okay. 719.88s - 721.56s | We have elevators everywhere in modern buildings. 721.56s - 723.88s | There's a lot of bypasses that you can get around them. 723.88s - 726.28s | A lot of elevator locks can be changed out 726.28s - 728.00s | and don't have to be the default. 728.00s - 729.72s | This is not true for fire recall switches. 729.72s - 732.16s | Do not touch your fire recall key switches. 732.16s - 733.76s | But generally, the best way to prevent people 733.76s - 735.56s | from hacking your elevator to get into a space 735.56s - 737.92s | is don't rely on elevator floor lockouts for security. 737.92s - 740.04s | It's way better to have a little hallway 740.04s - 742.44s | and then have additional locked doors past that elevator 742.44s - 744.40s | in order to prevent people from gaining access 744.40s - 745.64s | when they're not supposed to. 745.64s - 748.00s | Other remediation, so it's really important 748.00s - 751.12s | to foster a proper security culture within your company. 751.12s - 752.68s | Things like tailgating and other methods 752.68s - 754.56s | of social engineering are often the easiest way 754.56s - 756.32s | to get into a secure space. 756.32s - 757.74s | Employees that disallow tailgating 757.74s - 759.40s | or see people


chunk_text:
726.28s | A lot of elevator locks can be changed out 726.28s - 728.00s | and don't have to be the default. 728.00s - 729.72s | This is not true for fire recall switches. 729.72s - 732.16s | Do not touch your fire recall key switches. 732.16s - 733.76s | But generally, the best way to prevent people 733.76s - 735.56s | from hacking your elevator to get into a space 735.56s - 737.92s | is don't rely on elevator floor lockouts for security. 737.92s - 740.04s | It's way better to have a little hallway 740.04s - 742.44s | and then have additional locked doors past that elevator 742.44s - 744.40s | in order to prevent people from gaining access 744.40s - 745.64s | when they're not supposed to. 745.64s - 748.00s | Other remediation, so it's really important 748.00s - 751.12s | to foster a proper security culture within your company. 751.12s - 752.68s | Things like tailgating and other methods 752.68s - 754.56s | of social engineering are often the easiest way 754.56s - 756.32s | to get into a secure space. 756.32s - 757.74s | Employees that disallow tailgating 757.74s - 759.40s | or see people that they don't recognize and say, 759.40s - 760.24s | hey, who are you? 760.24s - 761.06s | Do you work here? 761.06s - 761.90s | Can you prove it? 761.90s - 763.12s | Can help stop bad actors. 763.12s - 765.52s | In addition to that, alarms and sensors are very important. 765.52s - 767.28s | So they can be used in combination with retrofits 767.28s - 768.96s | to prevent bypasses and catch people 768.96s - 770.56s | that are in the middle of using bypasses. 770.56s - 772.28s | These are imperfect and can be bypassed, 772.28s - 773.88s | but the main thing is without sensors, 773.88s - 775.12s | without cameras, without detection, 775.12s - 778.08s | anyone can get in with sufficient force and time. 778.08s - 779.00s | Like I mentioned, cameras, 779.00s - 780.80s | they are part of a complete security plan. 780.80s - 782.40s | They can deter, enable response, 782.40s - 784.94s | and minimize risk of insurance claims refusal. 784.94s - 786.44s | Last of all, timing analysis. 786.44s - 789.12s | So this is a service that I do work in. 789.12s - 791.24s | And in


chunk_text:
that they don't recognize and say, 759.40s - 760.24s | hey, who are you? 760.24s - 761.06s | Do you work here? 761.06s - 761.90s | Can you prove it? 761.90s - 763.12s | Can help stop bad actors. 763.12s - 765.52s | In addition to that, alarms and sensors are very important. 765.52s - 767.28s | So they can be used in combination with retrofits 767.28s - 768.96s | to prevent bypasses and catch people 768.96s - 770.56s | that are in the middle of using bypasses. 770.56s - 772.28s | These are imperfect and can be bypassed, 772.28s - 773.88s | but the main thing is without sensors, 773.88s - 775.12s | without cameras, without detection, 775.12s - 778.08s | anyone can get in with sufficient force and time. 778.08s - 779.00s | Like I mentioned, cameras, 779.00s - 780.80s | they are part of a complete security plan. 780.80s - 782.40s | They can deter, enable response, 782.40s - 784.94s | and minimize risk of insurance claims refusal. 784.94s - 786.44s | Last of all, timing analysis. 786.44s - 789.12s | So this is a service that I do work in. 789.12s - 791.24s | And in combination with your alarms, sensors, cameras, 791.24s - 792.68s | everything, and your response time 792.68s - 794.36s | has to all be taken into consideration 794.36s - 796.80s | in order to get to the bad actor 796.80s - 799.72s | before they're able to do any harm to your company. 799.72s - 801.20s | Okay, we've reached the end for the questions. 801.20s - 802.08s | I'm so sorry, guys. 802.08s - 805.72s | You're gonna have to play this video at like 0.5 speed. 805.72s - 807.10s | If you guys have any questions, 807.10s - 809.12s | you can come by The Village and come talk to me and Terry. 809.12s - 810.76s | I'm very sorry for the technical difficulties, 810.76s - 812.08s | but I hope you guys enjoyed it regardless. 812.08s - 812.92s | Thank you!


chunk_text:
combination with your alarms, sensors, cameras, 791.24s - 792.68s | everything, and your response time 792.68s - 794.36s | has to all be taken into consideration 794.36s - 796.80s | in order to get to the bad actor 796.80s - 799.72s | before they're able to do any harm to your company. 799.72s - 801.20s | Okay, we've reached the end for the questions. 801.20s - 802.08s | I'm so sorry, guys. 802.08s - 805.72s | You're gonna have to play this video at like 0.5 speed. 805.72s - 807.10s | If you guys have any questions, 807.10s - 809.12s | you can come by The Village and come talk to me and Terry. 809.12s - 810.76s | I'm very sorry for the technical difficulties, 810.76s - 812.08s | but I hope you guys enjoyed it regardless. 812.08s - 812.92s | Thank you!


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=MrNmdtkH3YY", "title": "DEF CON 32 - From Easy Wins to Epic Challenges: Bounty Hunter Edition - Daniel Blaklis Le Gall", "description": "Step into the mind of a bug bounty hunter as I take you on a journey through my own adventures in vulnerability hunting. In this presentation, I\u2019ll share some of the most intriguing bugs I've discovered, from the shockingly/stupidly simple to the mind-bendingly complex.\n\nWe'll start with the surprising simplicity of some bugs, but as the hunt isn\u2019t always so simple, I\u2019ll also reveal some complex bug chains that required advanced knowledge, lot of work and probably some hacker's intuition to know it was worth pushing further.\n\nIf you want to know how a coffee break gave me the opportunity to get infinite money, or how a vulnerable CAPTCHA helped me to break the encryption of a sensitive application - you're in the right place!", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3095, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.52s | This text was transcribed using whisper model: large-v2 Good morning, everyone. Welcome to talk two in the creator stage four. Apologies to those who are 7.52s - 12.80s | watching online. We still are having technical difficulties. And so, we only have the slides 13.44s - 17.44s | on the screen. We are working on it. Hopefully we'll have it for the next talk. 19.52s - 26.48s | But I would like to introduce Blackis on his talk from easy wins to epic challenges, 27.12s - 30.16s | the bounty hunter edition. Everyone rolls. 38.02s - 46.10s | Hey, everyone. So, I present you a bit of my journey in bug bounty. I tried to select 46.98s - 53.30s | some bugs that were quite surprising. Surprising in the sense of being very easy 53.30s - 62.42s | or being very difficult. So, I will present a couple of fun bugs. So, a bit about myself. So, 62.42s - 68.82s | I'm doing bug bounty for seven years now. I did a lot of CTFSO for 15 years or something like that. 69.38s - 74.90s | And in general, I'm hacking for 18 years now. So, that's quite a long time I'm doing that. 76.02s - 86.98s | I'm definitely a web application enjoyer. I love PHP. And I love doing review. I'm definitely 86.98s - 92.58s | not a recon guy. Not doing anything like reconnaissance or something


chunk_text:
we only have the slides 13.44s - 17.44s | on the screen. We are working on it. Hopefully we'll have it for the next talk. 19.52s - 26.48s | But I would like to introduce Blackis on his talk from easy wins to epic challenges, 27.12s - 30.16s | the bounty hunter edition. Everyone rolls. 38.02s - 46.10s | Hey, everyone. So, I present you a bit of my journey in bug bounty. I tried to select 46.98s - 53.30s | some bugs that were quite surprising. Surprising in the sense of being very easy 53.30s - 62.42s | or being very difficult. So, I will present a couple of fun bugs. So, a bit about myself. So, 62.42s - 68.82s | I'm doing bug bounty for seven years now. I did a lot of CTFSO for 15 years or something like that. 69.38s - 74.90s | And in general, I'm hacking for 18 years now. So, that's quite a long time I'm doing that. 76.02s - 86.98s | I'm definitely a web application enjoyer. I love PHP. And I love doing review. I'm definitely 86.98s - 92.58s | not a recon guy. Not doing anything like reconnaissance or something like that. I'm just 92.58s - 101.30s | going to main apps and break them. Most of the time at least. I really love like complex chain, 102.74s - 109.94s | complex exploit or things like that. And yeah, in my bug bounty journey, I did something around 109.94s - 116.98s | like 2 million dollars across all platforms. And I'm also an ambassador for France. So, yeah, 116.98s - 123.78s | I'm French. That explains my pretty bad English. I'm sorry for that. If something isn't clear, 123.78s - 131.78s | don't hesitate to come later and just ask me. So, we'll begin with first customer Swisscom. 131.94s - 139.94s | Swisscom. So, I represent a couple of bug I found on them. Um, Swisscom, uh, is the biggest 139.94s - 145.62s | provider in Switzerland. They are doing a lot of things. Not only telcos, they are active 145.62s - 153.70s | pretty much everywhere. Uh, they decided to open a white card bug bounty program in uh, 2016. 153.70s - 161.30s | That was my first bug bounty experience. I started like end of 2016 on them. And that's a 161.30s - 165.46s | pretty good team


chunk_text:
like that. I'm just 92.58s - 101.30s | going to main apps and break them. Most of the time at least. I really love like complex chain, 102.74s - 109.94s | complex exploit or things like that. And yeah, in my bug bounty journey, I did something around 109.94s - 116.98s | like 2 million dollars across all platforms. And I'm also an ambassador for France. So, yeah, 116.98s - 123.78s | I'm French. That explains my pretty bad English. I'm sorry for that. If something isn't clear, 123.78s - 131.78s | don't hesitate to come later and just ask me. So, we'll begin with first customer Swisscom. 131.94s - 139.94s | Swisscom. So, I represent a couple of bug I found on them. Um, Swisscom, uh, is the biggest 139.94s - 145.62s | provider in Switzerland. They are doing a lot of things. Not only telcos, they are active 145.62s - 153.70s | pretty much everywhere. Uh, they decided to open a white card bug bounty program in uh, 2016. 153.70s - 161.30s | That was my first bug bounty experience. I started like end of 2016 on them. And that's a 161.30s - 165.46s | pretty good team to be honest. Uh, they're pretty fair. They're pretty kind. Good 165.46s - 172.34s | communication with them. Uh, they have a very big scope like millions of IP addresses. So, it's 172.34s - 179.98s | pretty cool. And I did something around like 500,000 dollars on them. So, yeah, that's quite 179.98s - 187.48s | good. Um, definitely the bug bounty, uh, they decided to open, uh, definitely, definitely 187.48s - 195.48s | improved their security, uh, their security stuff over time. And, yeah, the bugs I'm 195.48s - 203.48s | presenting now are quite old. Uh, definitely they're like pretty much uh, other stuff now. But 203.48s - 209.92s | still quite some cool bugs. So, if some people here are interested by uh, their bug bounty 209.92s - 216.44s | programs, they're outside of any platform, you can just take a peek of the URL. Everything is 216.92s - 224.34s | uh, explained there. So, let's talk about uh, first target which is Swisscom Cockpit. Uh, 224.34s - 228.84s | that's a mobile phone manager in Swisscom. That's basically where you can see your 228.84s - 234.62s | subscription, subscription and where you can just buy some


chunk_text:
to be honest. Uh, they're pretty fair. They're pretty kind. Good 165.46s - 172.34s | communication with them. Uh, they have a very big scope like millions of IP addresses. So, it's 172.34s - 179.98s | pretty cool. And I did something around like 500,000 dollars on them. So, yeah, that's quite 179.98s - 187.48s | good. Um, definitely the bug bounty, uh, they decided to open, uh, definitely, definitely 187.48s - 195.48s | improved their security, uh, their security stuff over time. And, yeah, the bugs I'm 195.48s - 203.48s | presenting now are quite old. Uh, definitely they're like pretty much uh, other stuff now. But 203.48s - 209.92s | still quite some cool bugs. So, if some people here are interested by uh, their bug bounty 209.92s - 216.44s | programs, they're outside of any platform, you can just take a peek of the URL. Everything is 216.92s - 224.34s | uh, explained there. So, let's talk about uh, first target which is Swisscom Cockpit. Uh, 224.34s - 228.84s | that's a mobile phone manager in Swisscom. That's basically where you can see your 228.84s - 234.62s | subscription, subscription and where you can just buy some packs for traveling and things 234.62s - 240.46s | like that. Uh, there is lock in process on it that is quite particular. It's just you uh, 240.46s - 245.70s | sending your phone number and you receive a SMS token. You need also to fill a capture and 245.70s - 252.66s | you log in if the card is uh, valid rights. So, it definitely manage uh, some serious uh, 252.66s - 258.64s | confidential data, a lot of PII payments, things like that. Uh, you can see everything that is 258.64s - 264.64s | related to Swisscom subscription on there. So, definitely a good target for me. Also, uh, pretty 267.14s - 272.22s | good stuff for us. There is a staging instance on the internet that is like publicly 272.24s - 277.88s | available. I was cool as there might be some uh, stuff that is not published on the 277.88s - 282.88s | production server and things like that. So, let's talk about the first bug. Uh, I saw that on 285.66s - 290.66s | the staging instance. The SMS token is always 1111. Pretty good. Uh, the problem is the 293.70s - 300.34s | staging


chunk_text:
packs for traveling and things 234.62s - 240.46s | like that. Uh, there is lock in process on it that is quite particular. It's just you uh, 240.46s - 245.70s | sending your phone number and you receive a SMS token. You need also to fill a capture and 245.70s - 252.66s | you log in if the card is uh, valid rights. So, it definitely manage uh, some serious uh, 252.66s - 258.64s | confidential data, a lot of PII payments, things like that. Uh, you can see everything that is 258.64s - 264.64s | related to Swisscom subscription on there. So, definitely a good target for me. Also, uh, pretty 267.14s - 272.22s | good stuff for us. There is a staging instance on the internet that is like publicly 272.24s - 277.88s | available. I was cool as there might be some uh, stuff that is not published on the 277.88s - 282.88s | production server and things like that. So, let's talk about the first bug. Uh, I saw that on 285.66s - 290.66s | the staging instance. The SMS token is always 1111. Pretty good. Uh, the problem is the 293.70s - 300.34s | staging login doesn't work. It uh, it always true, throw some uh, internal server error. So, 300.36s - 307.70s | I can't log in with it. And I was like, yeah, maybe that's uh, the SMS central repository. It 307.70s - 313.48s | might be like shared uh, with the production system. So, I just try to log in on the 313.48s - 318.48s | production system. Then try to log in on the staging system. Then use 1111 on production 321.52s - 326.52s | system and I was logged in. So, that was a very simple uh, bug but definitely a good impact. 330.36s - 335.36s | So, let's see a demo. If everything is working well, we should be able to see. Yeah. So, I'm 337.64s - 342.64s | just entering a phone number. Just trying to sign in. Doing the same on the staging instance 348.81s - 353.81s | and uh, trying on the prod instance to just input 1111. Filling the captcha. Sign in and I'm 358.26s - 363.26s | signed in. So, yeah. Pretty easy. Uh, that's not video of the internet. So, let's see a 365.54s - 371.84s | real system. I will produce everything


chunk_text:
login doesn't work. It uh, it always true, throw some uh, internal server error. So, 300.36s - 307.70s | I can't log in with it. And I was like, yeah, maybe that's uh, the SMS central repository. It 307.70s - 313.48s | might be like shared uh, with the production system. So, I just try to log in on the 313.48s - 318.48s | production system. Then try to log in on the staging system. Then use 1111 on production 321.52s - 326.52s | system and I was logged in. So, that was a very simple uh, bug but definitely a good impact. 330.36s - 335.36s | So, let's see a demo. If everything is working well, we should be able to see. Yeah. So, I'm 337.64s - 342.64s | just entering a phone number. Just trying to sign in. Doing the same on the staging instance 348.81s - 353.81s | and uh, trying on the prod instance to just input 1111. Filling the captcha. Sign in and I'm 358.26s - 363.26s | signed in. So, yeah. Pretty easy. Uh, that's not video of the internet. So, let's see a 365.54s - 371.84s | real system. I will produce everything locally. I will share the demo, uh, the demos videoed 371.84s - 376.84s | and the instances uh, a bit later after the talk. So, yeah. This was paid $8000 which is 379.62s - 385.48s | pretty good because that was super easy. But that uh, uh, nice impact for them because I 385.48s - 392.50s | have like PII of every customer there. Uh, maybe millions of uh, PII there. So, yeah, pretty 392.54s - 397.54s | good. Uh, second bug. So, as I said, the login process is uh, pretty easy. You just input uh, 403.68s - 410.12s | your phone number. You submit. Then uh, you receive uh, SMS codes that you need to submit 410.12s - 417.06s | with uh, captcha. But the process is also setting you uh, three encrypted cookies. The first 417.06s - 423.10s | one is a cockpit captcha text. Uh, it definitely by the name I guess, it definitely manages 423.10s - 429.64s | captcha text. Uh, the cockpit MSISDN key that manage the phone numbers that you input at the 429.64s - 436.32s | first step. And the cockpit SMS token key which I guess is a pin code that


chunk_text:
locally. I will share the demo, uh, the demos videoed 371.84s - 376.84s | and the instances uh, a bit later after the talk. So, yeah. This was paid $8000 which is 379.62s - 385.48s | pretty good because that was super easy. But that uh, uh, nice impact for them because I 385.48s - 392.50s | have like PII of every customer there. Uh, maybe millions of uh, PII there. So, yeah, pretty 392.54s - 397.54s | good. Uh, second bug. So, as I said, the login process is uh, pretty easy. You just input uh, 403.68s - 410.12s | your phone number. You submit. Then uh, you receive uh, SMS codes that you need to submit 410.12s - 417.06s | with uh, captcha. But the process is also setting you uh, three encrypted cookies. The first 417.06s - 423.10s | one is a cockpit captcha text. Uh, it definitely by the name I guess, it definitely manages 423.10s - 429.64s | captcha text. Uh, the cockpit MSISDN key that manage the phone numbers that you input at the 429.64s - 436.32s | first step. And the cockpit SMS token key which I guess is a pin code that was received by 436.32s - 443.32s | SMS. So, I was like, okay maybe they are using like the same tree, the same key for 443.36s - 448.36s | encryption. So, I decided to like copy the cockpit SMS token key cookie into the cockpit 450.76s - 455.76s | captcha text. Reload the page and the pin code is just leaked into the captcha. So, here it is. 458.84s - 465.34s | That's not very clear because there is some uh, maybe uh, padding issue. But you can see 465.34s - 470.34s | the, the code there that is 7998. So, that's once again an authentication bypass by 470.70s - 475.70s | leaking uh, the SMS pin token into the captcha which is like pretty lame but pretty good for me. 481.12s - 486.12s | So, let's do a small, if I can move that. Here it is. Out of the demo. So, just filling the 486.12s - 491.12s | phone number again. Trying to see the cookies. Putting the SMS token key into the captcha 504.72s - 509.72s | text uh, cookie. Just reloading. And we get uh, the pin code into the captcha which is uh, 510.72s -


chunk_text:
was received by 436.32s - 443.32s | SMS. So, I was like, okay maybe they are using like the same tree, the same key for 443.36s - 448.36s | encryption. So, I decided to like copy the cockpit SMS token key cookie into the cockpit 450.76s - 455.76s | captcha text. Reload the page and the pin code is just leaked into the captcha. So, here it is. 458.84s - 465.34s | That's not very clear because there is some uh, maybe uh, padding issue. But you can see 465.34s - 470.34s | the, the code there that is 7998. So, that's once again an authentication bypass by 470.70s - 475.70s | leaking uh, the SMS pin token into the captcha which is like pretty lame but pretty good for me. 481.12s - 486.12s | So, let's do a small, if I can move that. Here it is. Out of the demo. So, just filling the 486.12s - 491.12s | phone number again. Trying to see the cookies. Putting the SMS token key into the captcha 504.72s - 509.72s | text uh, cookie. Just reloading. And we get uh, the pin code into the captcha which is uh, 510.72s - 515.72s | RK, RRKB5T. That's a pin code I received by SMS. So, I'm once again logged in with that. So, 525.36s - 532.04s | pretty cool but definitely uh, not as serious as the previous bug but because it was pretty 532.04s - 537.28s | hard to see, to read the captcha. You can't really automate the attack. So, they decided to 537.30s - 542.30s | pay 3,000 dollars for that. Once again, it was quite an easy bug. So, I can complain uh, on the 544.98s - 549.98s | amount. So, I decided it might be the time to stop on cockpits. But no, here is uh, is uh, 552.56s - 557.56s | self bug. Uh, try to log in. Input your phone number but at the time you receive the SMS pin 559.86s - 564.86s | code, just cancel and authentication successful. I have no idea why. I, I don't know why 567.36s - 573.64s | but I suppose they did something bad by patching uh, some of my bugs. Uh, yeah, probably a 573.64s - 579.42s | fail. So, they decided to pay uh, 8,000 for that because I just cancelled the log in process 579.42s


chunk_text:
515.72s | RK, RRKB5T. That's a pin code I received by SMS. So, I'm once again logged in with that. So, 525.36s - 532.04s | pretty cool but definitely uh, not as serious as the previous bug but because it was pretty 532.04s - 537.28s | hard to see, to read the captcha. You can't really automate the attack. So, they decided to 537.30s - 542.30s | pay 3,000 dollars for that. Once again, it was quite an easy bug. So, I can complain uh, on the 544.98s - 549.98s | amount. So, I decided it might be the time to stop on cockpits. But no, here is uh, is uh, 552.56s - 557.56s | self bug. Uh, try to log in. Input your phone number but at the time you receive the SMS pin 559.86s - 564.86s | code, just cancel and authentication successful. I have no idea why. I, I don't know why 567.36s - 573.64s | but I suppose they did something bad by patching uh, some of my bugs. Uh, yeah, probably a 573.64s - 579.42s | fail. So, they decided to pay uh, 8,000 for that because I just cancelled the log in process 579.42s - 584.22s | and I was logged in. Uh, I suppose you don't expect a demo for that. I mean, that's not 584.22s - 589.22s | really needed I guess. So, for this time, let's really move on to another target. So, uh, 589.38s - 594.38s | Swisscom WorkLink uh, is a Swisscom acquisition that was like a company that just bought. Uh, 599.72s - 604.72s | decided to have a check. They were using uh, completely unknown CMS called weblication. 606.86s - 611.86s | Something in PHP you know that trigger me always. Uh, so I decided to uh, buy a weblication 612.48s - 617.48s | license. Uh, so I can grab the code and turn that into like some source code review. Uh, 625.00s - 632.00s | firstly I saw that the thing is not using SQL at all. Uh, it's only some uh, XML databases 632.00s - 637.00s | and some uh, file system storage which is quite not so usual. So, firstly I saw that uh, 637.36s - 642.36s | they have a general pass traversal prevention mechanism and in general uh, they are trying 647.40s - 654.40s | like to sanitize every uh, every variables


chunk_text:
- 584.22s | and I was logged in. Uh, I suppose you don't expect a demo for that. I mean, that's not 584.22s - 589.22s | really needed I guess. So, for this time, let's really move on to another target. So, uh, 589.38s - 594.38s | Swisscom WorkLink uh, is a Swisscom acquisition that was like a company that just bought. Uh, 599.72s - 604.72s | decided to have a check. They were using uh, completely unknown CMS called weblication. 606.86s - 611.86s | Something in PHP you know that trigger me always. Uh, so I decided to uh, buy a weblication 612.48s - 617.48s | license. Uh, so I can grab the code and turn that into like some source code review. Uh, 625.00s - 632.00s | firstly I saw that the thing is not using SQL at all. Uh, it's only some uh, XML databases 632.00s - 637.00s | and some uh, file system storage which is quite not so usual. So, firstly I saw that uh, 637.36s - 642.36s | they have a general pass traversal prevention mechanism and in general uh, they are trying 647.40s - 654.40s | like to sanitize every uh, every variables that you can input. There is an easy bypass 654.40s - 660.40s | because they are like uh, trying to remove uh, pass traversal characters and later in the 660.40s - 666.82s | process they're trying to remove pipes. So, you can just like uh, use uh, dot pipe dot 667.64s - 672.54s | pipe slash and it will be transformed to pipe uh, to dot dot slash. So, there is like an easy 672.54s - 678.58s | bypass of the uh, mechanism to prevent pass traversal. So, I decided to have a look for some 678.58s - 685.22s | pass traversal issues. Uh, I found pretty easily uh, vulnerabilities that allow me to delete 685.22s - 692.22s | all the files uh, in a directory but uh, it wasn't uh, reachable but because it checked for 692.26s - 698.60s | specific directory on the app that was never used anywhere so there is no way to create that 698.60s - 703.60s | uh, directory. But I found uh, an arbitrary directory creation which is generally 707.68s - 713.84s | something that is quite useless but for that case it was quite useful for me so I created the 713.84s


chunk_text:
that you can input. There is an easy bypass 654.40s - 660.40s | because they are like uh, trying to remove uh, pass traversal characters and later in the 660.40s - 666.82s | process they're trying to remove pipes. So, you can just like uh, use uh, dot pipe dot 667.64s - 672.54s | pipe slash and it will be transformed to pipe uh, to dot dot slash. So, there is like an easy 672.54s - 678.58s | bypass of the uh, mechanism to prevent pass traversal. So, I decided to have a look for some 678.58s - 685.22s | pass traversal issues. Uh, I found pretty easily uh, vulnerabilities that allow me to delete 685.22s - 692.22s | all the files uh, in a directory but uh, it wasn't uh, reachable but because it checked for 692.26s - 698.60s | specific directory on the app that was never used anywhere so there is no way to create that 698.60s - 703.60s | uh, directory. But I found uh, an arbitrary directory creation which is generally 707.68s - 713.84s | something that is quite useless but for that case it was quite useful for me so I created the 713.84s - 718.86s | directory that was needed uh, to reach the directory empty vulnerability. Uh, so cool. I can 719.20s - 724.20s | delete files in directories uh, but come on that's not useful. I'm definitely not wanting to 728.34s - 733.34s | deface a website that's definitely not the goal. So, uh, I did a I I other check and uh, in the 738.32s - 745.32s | weblication slash grid uh, five directories there is a dot htaccess files that's the only file 745.52s - 752.52s | there. But in the sub directories there is like all the databases uh, all the XML databases 752.52s - 757.54s | there. Uh, the only uh, mechanism of protection there is a dot htaccess file so maybe we can 760.84s - 765.84s | just remove the dot htaccess file so we can access the XML databases then. For some reason I 768.40s - 773.00s | don't know why but I decided that to uh, name all the XML databases with uh, dot php 774.00s - 779.00s | extension. That's quite a strange uh, decision but I found that uh, the logs uh, the login 784.38s - 790.38s | logs uh, that uh,


chunk_text:
- 718.86s | directory that was needed uh, to reach the directory empty vulnerability. Uh, so cool. I can 719.20s - 724.20s | delete files in directories uh, but come on that's not useful. I'm definitely not wanting to 728.34s - 733.34s | deface a website that's definitely not the goal. So, uh, I did a I I other check and uh, in the 738.32s - 745.32s | weblication slash grid uh, five directories there is a dot htaccess files that's the only file 745.52s - 752.52s | there. But in the sub directories there is like all the databases uh, all the XML databases 752.52s - 757.54s | there. Uh, the only uh, mechanism of protection there is a dot htaccess file so maybe we can 760.84s - 765.84s | just remove the dot htaccess file so we can access the XML databases then. For some reason I 768.40s - 773.00s | don't know why but I decided that to uh, name all the XML databases with uh, dot php 774.00s - 779.00s | extension. That's quite a strange uh, decision but I found that uh, the logs uh, the login 784.38s - 790.38s | logs uh, that uh, database is containing uh, the session token for all users there so I can 790.38s - 795.38s | just win it. That's an authentication bypass that's a win. No, it works locally, it doesn't 796.28s - 801.28s | work remotely. I have like uh, internal server error everywhere so I was quite in 803.82s - 808.82s | despair, I was crying a bit. Um, so my guess was uh, my uh, so work link was using uh, php 813.90s - 818.90s | short tags so uh, it clashed with uh, XML open tags so the the system was uh, thinking that 819.90s - 824.90s | the XML file was some php, it broke because of some syntax error and so just through 830.20s - 835.20s | internal server error so definitely didn't work. I decided to go and say search uh, other 837.78s - 842.78s | vulnerabilities. I found a pre-auth sc there but it failed again for the exact same reason so 842.96s - 847.96s | I cried a bit again. And I found something that was maybe interesting but quite lame, I 852.64s - 857.64s | didn't see the impact at first. I found an XML injection in


chunk_text:
database is containing uh, the session token for all users there so I can 790.38s - 795.38s | just win it. That's an authentication bypass that's a win. No, it works locally, it doesn't 796.28s - 801.28s | work remotely. I have like uh, internal server error everywhere so I was quite in 803.82s - 808.82s | despair, I was crying a bit. Um, so my guess was uh, my uh, so work link was using uh, php 813.90s - 818.90s | short tags so uh, it clashed with uh, XML open tags so the the system was uh, thinking that 819.90s - 824.90s | the XML file was some php, it broke because of some syntax error and so just through 830.20s - 835.20s | internal server error so definitely didn't work. I decided to go and say search uh, other 837.78s - 842.78s | vulnerabilities. I found a pre-auth sc there but it failed again for the exact same reason so 842.96s - 847.96s | I cried a bit again. And I found something that was maybe interesting but quite lame, I 852.64s - 857.64s | didn't see the impact at first. I found an XML injection in the log user database. Uh, so 859.84s - 864.84s | pretty much the same, it's also uh, php extension uh, in the same directories. So uh, the the 865.84s - 870.84s | injection is on the user name and that's like the database that contains uh, if a user name is 875.42s - 881.62s | uh, blocked by the system. So if you're trying to log in uh, with a specific user name more 881.62s - 888.46s | than 3 times and the login is failed, you're like injected in that uh, specific database. So 888.46s - 893.46s | there is a XML injection there. Okay, not so useful, I can block up entire users maybe but 895.14s - 902.00s | yeah, quite lame. So, I did have a check on how uh, the XML database are passed by the 902.00s - 907.02s | application. Uh, I saw that uh, the developers uh, did that quite well. They decided to add 909.92s - 915.82s | some layers of protection uh, trying to prevent xinclude by calling dumb document uh, 915.82s - 920.82s | xinclude function with a false parameter. No luck for them, uh, thanks php. Uh, it enabled 921.58s


chunk_text:
the log user database. Uh, so 859.84s - 864.84s | pretty much the same, it's also uh, php extension uh, in the same directories. So uh, the the 865.84s - 870.84s | injection is on the user name and that's like the database that contains uh, if a user name is 875.42s - 881.62s | uh, blocked by the system. So if you're trying to log in uh, with a specific user name more 881.62s - 888.46s | than 3 times and the login is failed, you're like injected in that uh, specific database. So 888.46s - 893.46s | there is a XML injection there. Okay, not so useful, I can block up entire users maybe but 895.14s - 902.00s | yeah, quite lame. So, I did have a check on how uh, the XML database are passed by the 902.00s - 907.02s | application. Uh, I saw that uh, the developers uh, did that quite well. They decided to add 909.92s - 915.82s | some layers of protection uh, trying to prevent xinclude by calling dumb document uh, 915.82s - 920.82s | xinclude function with a false parameter. No luck for them, uh, thanks php. Uh, it enabled 921.58s - 926.58s | xinclude instead. So, definitely not what they wanted. Uh, so for those that don't know 929.86s - 936.86s | xinclude is a XML feature that allow to include other XML or even not XML documents into the 936.86s - 943.97s | current one. So that's like, exactly like php include but for XML. So, trying to put uh, that 944.97s - 949.97s | user name will definitely uh, add a xinclude directive that will load uh, the login logs 955.33s - 962.21s | database into the uh, blocked users database. Uh, that's, that's a notation for xinclude 962.21s - 967.21s | directive. Uh, that's a bit complicated but yeah, definitely the impact there is like we can 968.17s - 973.17s | just include the entire uh, login logs database into the blocked user database. But, uh yeah, 977.91s - 983.35s | xinclude is doing their best to like reformat all the file to be a fully valid XML. You can 983.35s - 990.05s | break, you can't really break uh, the file by using xinclude which is quite good. It's doing 990.05s - 995.99s | like automatic correction and things like that. But, but no, that's still


chunk_text:
- 926.58s | xinclude instead. So, definitely not what they wanted. Uh, so for those that don't know 929.86s - 936.86s | xinclude is a XML feature that allow to include other XML or even not XML documents into the 936.86s - 943.97s | current one. So that's like, exactly like php include but for XML. So, trying to put uh, that 944.97s - 949.97s | user name will definitely uh, add a xinclude directive that will load uh, the login logs 955.33s - 962.21s | database into the uh, blocked users database. Uh, that's, that's a notation for xinclude 962.21s - 967.21s | directive. Uh, that's a bit complicated but yeah, definitely the impact there is like we can 968.17s - 973.17s | just include the entire uh, login logs database into the blocked user database. But, uh yeah, 977.91s - 983.35s | xinclude is doing their best to like reformat all the file to be a fully valid XML. You can 983.35s - 990.05s | break, you can't really break uh, the file by using xinclude which is quite good. It's doing 990.05s - 995.99s | like automatic correction and things like that. But, but no, that's still useless. I mean 996.01s - 1001.01s | yeah, I can include the database into another but that's quite useless. But, I try to see all 1003.81s - 1010.09s | the log users feature is working and I found a blind xpass injection so in the user name is 1010.09s - 1015.09s | you, if you can, if you inject uh, some xpass uh, notation you have uh, an injection there. 1018.07s - 1023.07s | So, you can definitely extract the entire log, log database and I guess you see uh, what the 1023.23s - 1028.23s | interest there. We can uh, inject uh, the content of other database uh, in, in the log 1032.37s - 1037.37s | database and then we can like exfiltrate it. So, the log database uh, yes, I, I, I would 1040.57s - 1045.57s | say that. But, uh, so we can choose a blind xpass injection, we can exfiltrate session token 1046.09s - 1051.09s | byte by a byte per bytes. That gave me admin takeover on the application and that time in the 1056.57s - 1061.57s | admin panel there is like feature to get RC. So, this time is a win. It works


chunk_text:
useless. I mean 996.01s - 1001.01s | yeah, I can include the database into another but that's quite useless. But, I try to see all 1003.81s - 1010.09s | the log users feature is working and I found a blind xpass injection so in the user name is 1010.09s - 1015.09s | you, if you can, if you inject uh, some xpass uh, notation you have uh, an injection there. 1018.07s - 1023.07s | So, you can definitely extract the entire log, log database and I guess you see uh, what the 1023.23s - 1028.23s | interest there. We can uh, inject uh, the content of other database uh, in, in the log 1032.37s - 1037.37s | database and then we can like exfiltrate it. So, the log database uh, yes, I, I, I would 1040.57s - 1045.57s | say that. But, uh, so we can choose a blind xpass injection, we can exfiltrate session token 1046.09s - 1051.09s | byte by a byte per bytes. That gave me admin takeover on the application and that time in the 1056.57s - 1061.57s | admin panel there is like feature to get RC. So, this time is a win. It works remotely. So, 1065.57s - 1071.81s | the chain was log user with uh, xm injection in the user name with xinclude directive 1071.83s - 1076.83s | pointing to the xml logs. Exfiltrate it with xpass injection, get admin session, get RC 1081.33s - 1093.34s | and let, let's go for a demo. So, we can see there on the right that the blog database is 1093.34s - 1100.10s | empty. Now, we try to log in with x uh, to see that just the blog database is now filled 1102.34s - 1107.34s | with uh, one and three for the x uh, x uh, user. We now try to inject some xmlogs and 1109.18s - 1117.20s | xml to see if there is a xm injection there. And yes, it is. There is now a foobar 1117.20s - 1122.20s | attribute uh, in the, in the block uh, block uh, entry. So, that time we're using the 1125.00s - 1131.42s | payloads that uh, we saw before with the xinclude directive trying to include uh, the 1131.42s - 1139.39s | login logs uh, in the, in the blog database. So, yeah, I just saw that the login log 1139.39s -


chunk_text:
remotely. So, 1065.57s - 1071.81s | the chain was log user with uh, xm injection in the user name with xinclude directive 1071.83s - 1076.83s | pointing to the xml logs. Exfiltrate it with xpass injection, get admin session, get RC 1081.33s - 1093.34s | and let, let's go for a demo. So, we can see there on the right that the blog database is 1093.34s - 1100.10s | empty. Now, we try to log in with x uh, to see that just the blog database is now filled 1102.34s - 1107.34s | with uh, one and three for the x uh, x uh, user. We now try to inject some xmlogs and 1109.18s - 1117.20s | xml to see if there is a xm injection there. And yes, it is. There is now a foobar 1117.20s - 1122.20s | attribute uh, in the, in the block uh, block uh, entry. So, that time we're using the 1125.00s - 1131.42s | payloads that uh, we saw before with the xinclude directive trying to include uh, the 1131.42s - 1139.39s | login logs uh, in the, in the blog database. So, yeah, I just saw that the login log 1139.39s - 1144.39s | contains some uh, session stuff there. So, we make that user with the payload to be 1147.53s - 1155.42s | blocked. We can see that to xinclude directive is now there in the file of the blocked uh, 1155.42s - 1161.62s | database. We make uh, another user, another random user to be blocked so the file will be 1161.62s - 1168.24s | parsed again and this time there is like the entire login log database in that blog 1168.24s - 1173.24s | database. So, this time it was completely replaced uh, by the, by the original login logs 1175.74s - 1180.74s | file. So, now we can try to use uh, the xpass injection. So, we are like targeting uh, a log 1182.92s - 1188.42s | element, trying to infiltrate the session. We're checking, we're checking if it begins by 1188.42s - 1193.42s | a L. We know it is because we can see that on the right screen. So, if it begins by a L, we 1194.42s - 1199.42s | should receive that the account is blocked. But if we check uh, if it begin by a X, we 1203.92s - 1209.22s | receive that no


chunk_text:
1144.39s | contains some uh, session stuff there. So, we make that user with the payload to be 1147.53s - 1155.42s | blocked. We can see that to xinclude directive is now there in the file of the blocked uh, 1155.42s - 1161.62s | database. We make uh, another user, another random user to be blocked so the file will be 1161.62s - 1168.24s | parsed again and this time there is like the entire login log database in that blog 1168.24s - 1173.24s | database. So, this time it was completely replaced uh, by the, by the original login logs 1175.74s - 1180.74s | file. So, now we can try to use uh, the xpass injection. So, we are like targeting uh, a log 1182.92s - 1188.42s | element, trying to infiltrate the session. We're checking, we're checking if it begins by 1188.42s - 1193.42s | a L. We know it is because we can see that on the right screen. So, if it begins by a L, we 1194.42s - 1199.42s | should receive that the account is blocked. But if we check uh, if it begin by a X, we 1203.92s - 1209.22s | receive that no user is found. So, we have an oracle to leak uh, the characters one by one. 1209.22s - 1214.24s | So, I write a little script and yeah, it definitely leaks the session token character by 1216.80s - 1221.80s | character. So, yeah, we got it. We got an admin account to that and yet, uh, the 1223.94s - 1227.58s | admin account is still there. So, we can use it remotely. For that, uh, Swisscom decided to 1227.58s - 1232.58s | pay me $3,000. So, uh, $2,500 for the bug. Uh, $500 uh, for the um, for uh, bonus for the 1237.66s - 1242.66s | nice shell and also the editor decided to uh, reward me for with uh, $2,000. They didn't 1246.46s - 1251.20s | have a bug bounty but they were like impressed by the bug. So, pretty cool for them, for, 1251.22s - 1256.22s | for them. So, now let's switch to yet another customer. Uh, another Swiss one. Uh, so 1260.10s - 1265.10s | Swisspost. I'm not sure I need to explain what is Swisspost. Pretty standard, they are like 1267.34s - 1273.74s | the postal office in Switzerland but they are also a private


chunk_text:
user is found. So, we have an oracle to leak uh, the characters one by one. 1209.22s - 1214.24s | So, I write a little script and yeah, it definitely leaks the session token character by 1216.80s - 1221.80s | character. So, yeah, we got it. We got an admin account to that and yet, uh, the 1223.94s - 1227.58s | admin account is still there. So, we can use it remotely. For that, uh, Swisscom decided to 1227.58s - 1232.58s | pay me $3,000. So, uh, $2,500 for the bug. Uh, $500 uh, for the um, for uh, bonus for the 1237.66s - 1242.66s | nice shell and also the editor decided to uh, reward me for with uh, $2,000. They didn't 1246.46s - 1251.20s | have a bug bounty but they were like impressed by the bug. So, pretty cool for them, for, 1251.22s - 1256.22s | for them. So, now let's switch to yet another customer. Uh, another Swiss one. Uh, so 1260.10s - 1265.10s | Swisspost. I'm not sure I need to explain what is Swisspost. Pretty standard, they are like 1267.34s - 1273.74s | the postal office in Switzerland but they are also a private company uh, doing a lot of 1273.74s - 1280.28s | different things and they are like involved in a lot of uh, major projects in Switzerland like 1280.30s - 1286.74s | e-voting. Uh, they decide, they, they are also very active in cyber security. They like about a 1286.74s - 1293.48s | lot of local uh, cyber security, security companies. So, so they are like very active in the 1293.48s - 1298.48s | cyber security uh, stuff in Switzerland. They decided to start a bug bounty in 2019 uh, 1300.92s - 1305.92s | especially for their e-voting platform. Uh, and they decided to add uh, assets uh, over time. 1306.64s - 1311.64s | So, that's a super fair team, they're pretty good. Pretty much the same as Swisscom to be 1313.98s - 1318.98s | honest. Uh, we can have a lot of uh, communication with them, they're pretty good. And yeah, if 1321.32s - 1325.76s | some people are from the voting village uh, go on their bug bounty programs, they are paying 1325.76s - 1330.76s | like uh, $230K for a very critical bug there. That's definitely a good program. I'm not a 1331.48s - 1336.48s | crypto guy


chunk_text:
company uh, doing a lot of 1273.74s - 1280.28s | different things and they are like involved in a lot of uh, major projects in Switzerland like 1280.30s - 1286.74s | e-voting. Uh, they decide, they, they are also very active in cyber security. They like about a 1286.74s - 1293.48s | lot of local uh, cyber security, security companies. So, so they are like very active in the 1293.48s - 1298.48s | cyber security uh, stuff in Switzerland. They decided to start a bug bounty in 2019 uh, 1300.92s - 1305.92s | especially for their e-voting platform. Uh, and they decided to add uh, assets uh, over time. 1306.64s - 1311.64s | So, that's a super fair team, they're pretty good. Pretty much the same as Swisscom to be 1313.98s - 1318.98s | honest. Uh, we can have a lot of uh, communication with them, they're pretty good. And yeah, if 1321.32s - 1325.76s | some people are from the voting village uh, go on their bug bounty programs, they are paying 1325.76s - 1330.76s | like uh, $230K for a very critical bug there. That's definitely a good program. I'm not a 1331.48s - 1336.48s | crypto guy so I'm not going back. Maybe you are. So, if you want to have a check, uh, 1340.92s - 1345.92s | everything is described on their VDP page. So, vdp.post.ch. So, uh, for, for the first bug 1351.80s - 1358.54s | I will talk about their uh, payment system. So, they have like their own payment system uh, 1358.58s - 1364.56s | completely custom. Uh, everything is quite common. You get some sign requests. Uh, there's a 1364.56s - 1370.46s | lot of different endpoints for failure and success and uh, also you can stack money on your 1370.46s - 1375.50s | account, on your postal account. You have a balance system so it's always interesting if we 1375.50s - 1380.50s | can get like infinite money there. I will switch this back because we have some time issue. 1380.84s - 1385.84s | Let's go on the second one. So, I did find a lot of uh, stuff there so I was uh, hacking on 1390.64s - 1397.28s | them and I was trying to manipulate some payment session there. Uh, changing price in a 1397.28s - 1404.06s | trans- transaction. Uh, a lot of things but uh, a delivery


chunk_text:
so I'm not going back. Maybe you are. So, if you want to have a check, uh, 1340.92s - 1345.92s | everything is described on their VDP page. So, vdp.post.ch. So, uh, for, for the first bug 1351.80s - 1358.54s | I will talk about their uh, payment system. So, they have like their own payment system uh, 1358.58s - 1364.56s | completely custom. Uh, everything is quite common. You get some sign requests. Uh, there's a 1364.56s - 1370.46s | lot of different endpoints for failure and success and uh, also you can stack money on your 1370.46s - 1375.50s | account, on your postal account. You have a balance system so it's always interesting if we 1375.50s - 1380.50s | can get like infinite money there. I will switch this back because we have some time issue. 1380.84s - 1385.84s | Let's go on the second one. So, I did find a lot of uh, stuff there so I was uh, hacking on 1390.64s - 1397.28s | them and I was trying to manipulate some payment session there. Uh, changing price in a 1397.28s - 1404.06s | trans- transaction. Uh, a lot of things but uh, a delivery man rang the doorbell in my 1404.06s - 1410.14s | office so I need to cut the package, sing everything. I decided that was the time for 1410.14s - 1415.14s | coffee break and then after maybe 10, 15 minutes, I don't know, got back to my chair and I had 1418.58s - 1423.58s | some money coming from nowhere on my account so I had no idea why. So, I decided to replay 1428.12s - 1434.30s | everything I did. I was like probably I triggered something and I didn't even know. So, I 1434.32s - 1441.20s | tried to replay everything. So, that failed. No idea what happened. So, I did to replay 1441.20s - 1447.84s | everything including the coffee break. That was maybe the main point. So, I did a coffee break 1447.84s - 1452.84s | with a colleague and there was my account was credited again. So, I was like okay, what the 1457.22s - 1463.76s | fact? I did, I tested a lot of things and the real explanation is uh, when you run the 1464.48s - 1470.86s | transaction, after the transaction is timed out. So, you didn't uh, make the payment uh,


chunk_text:
man rang the doorbell in my 1404.06s - 1410.14s | office so I need to cut the package, sing everything. I decided that was the time for 1410.14s - 1415.14s | coffee break and then after maybe 10, 15 minutes, I don't know, got back to my chair and I had 1418.58s - 1423.58s | some money coming from nowhere on my account so I had no idea why. So, I decided to replay 1428.12s - 1434.30s | everything I did. I was like probably I triggered something and I didn't even know. So, I 1434.32s - 1441.20s | tried to replay everything. So, that failed. No idea what happened. So, I did to replay 1441.20s - 1447.84s | everything including the coffee break. That was maybe the main point. So, I did a coffee break 1447.84s - 1452.84s | with a colleague and there was my account was credited again. So, I was like okay, what the 1457.22s - 1463.76s | fact? I did, I tested a lot of things and the real explanation is uh, when you run the 1464.48s - 1470.86s | transaction, after the transaction is timed out. So, you didn't uh, make the payment uh, in 1470.86s - 1477.26s | the good time frame. It just considered successful. So, probably a bad check of payment 1477.26s - 1482.26s | states. It default to success instead of defaulting to uh, a failure. So, yeah. Let's go 1485.28s - 1492.46s | for a demo. So, let's buy a very good croissant because I'm French. Ah, that's not a good 1492.84s - 1500.33s | demo. That was a croissant, a bigger one. Let's go for it. Just wait. Just go grab a coffee 1505.31s - 1515.75s | maybe. Are you patient enough? Oh yeah. Uh, joking it will just last. Yeah, success 1518.39s - 1526.54s | payments just by waiting. I mean, pretty cool. Uh, pretty cool solution to get some money 1526.58s - 1533.58s | right? So, I was paid uh, $3,000 for that. Uh, that's probably the most I get for like a 1533.58s - 1538.60s | coffee break or two. Definitely was quite profitable right? So, let's go to another project 1542.60s - 1547.60s | of them. Uh, they have like a sub-domain uh, using a very, very unknown uh, CMS. So, 1548.44s - 1553.44s | paper shop that's like a Swiss page PCMS. They


chunk_text:
in 1470.86s - 1477.26s | the good time frame. It just considered successful. So, probably a bad check of payment 1477.26s - 1482.26s | states. It default to success instead of defaulting to uh, a failure. So, yeah. Let's go 1485.28s - 1492.46s | for a demo. So, let's buy a very good croissant because I'm French. Ah, that's not a good 1492.84s - 1500.33s | demo. That was a croissant, a bigger one. Let's go for it. Just wait. Just go grab a coffee 1505.31s - 1515.75s | maybe. Are you patient enough? Oh yeah. Uh, joking it will just last. Yeah, success 1518.39s - 1526.54s | payments just by waiting. I mean, pretty cool. Uh, pretty cool solution to get some money 1526.58s - 1533.58s | right? So, I was paid uh, $3,000 for that. Uh, that's probably the most I get for like a 1533.58s - 1538.60s | coffee break or two. Definitely was quite profitable right? So, let's go to another project 1542.60s - 1547.60s | of them. Uh, they have like a sub-domain uh, using a very, very unknown uh, CMS. So, 1548.44s - 1553.44s | paper shop that's like a Swiss page PCMS. They also do some manager thing and things like 1556.68s - 1561.68s | that. I never heard of them. So, I decided once again to buy a license uh, of the CMS so I 1564.82s - 1569.82s | get access to the code. Once again it's PHP so I'm super interested by that. And I just had a 1570.82s - 1575.82s | look at the code. Everything was quite, you know, PHP. Uh, so I saw that uh, another main 1581.76s - 1586.76s | feature uh, that is quite interesting is a restore backup thing. Uh, it's some like custom 1590.64s - 1595.64s | things. They decided that the delimiter between SQL queries will be that stuff. No idea why. 1595.84s - 1600.84s | Why don't use like semicolon like everyone do? I don't know. They decided it is. And they also 1605.24s - 1612.18s | have uh, some features I never, I don't know why because I didn't see any occurrences where 1612.18s - 1617.18s | they are using that but they do. So, if you use uh, the base64 start and the base64 end tags, 1618.14s - 1623.14s | that will be replaced by a single coded string of


chunk_text:
also do some manager thing and things like 1556.68s - 1561.68s | that. I never heard of them. So, I decided once again to buy a license uh, of the CMS so I 1564.82s - 1569.82s | get access to the code. Once again it's PHP so I'm super interested by that. And I just had a 1570.82s - 1575.82s | look at the code. Everything was quite, you know, PHP. Uh, so I saw that uh, another main 1581.76s - 1586.76s | feature uh, that is quite interesting is a restore backup thing. Uh, it's some like custom 1590.64s - 1595.64s | things. They decided that the delimiter between SQL queries will be that stuff. No idea why. 1595.84s - 1600.84s | Why don't use like semicolon like everyone do? I don't know. They decided it is. And they also 1605.24s - 1612.18s | have uh, some features I never, I don't know why because I didn't see any occurrences where 1612.18s - 1617.18s | they are using that but they do. So, if you use uh, the base64 start and the base64 end tags, 1618.14s - 1623.14s | that will be replaced by a single coded string of uh, the base64 decoded string that is 1627.14s - 1632.16s | between the tag. I don't know why. I, I, that's quite a strange feature to be honest. So, uh, 1635.68s - 1642.56s | the restore backup, uh, the restore uh, feature is using uh, backup from a local file system. 1642.58s - 1648.68s | Uh, that needs to be generated from the CMS backup feature. So, uh, you can't upload 1648.68s - 1653.70s | anything or something like that. So, my goal was maybe I can inject SQL queries and backup from 1656.56s - 1661.56s | the front end. Uh, the method is exploiting the very like strange passing to break SQL 1665.50s - 1670.50s | contexts. So, my idea is uh, if I use like so specific uh, separate methods, uh, to 1672.58s - 1677.58s | separate uh, uh, like tags in some data uh, that is stored in the database uh, so uh, that will 1680.12s - 1687.06s | be stored in the database. Uh, maybe when they will backup and restore again, that will break 1687.06s - 1693.10s | something if I get some data with those tags. Uh, maybe on my profile, on my, I


chunk_text:
uh, the base64 decoded string that is 1627.14s - 1632.16s | between the tag. I don't know why. I, I, that's quite a strange feature to be honest. So, uh, 1635.68s - 1642.56s | the restore backup, uh, the restore uh, feature is using uh, backup from a local file system. 1642.58s - 1648.68s | Uh, that needs to be generated from the CMS backup feature. So, uh, you can't upload 1648.68s - 1653.70s | anything or something like that. So, my goal was maybe I can inject SQL queries and backup from 1656.56s - 1661.56s | the front end. Uh, the method is exploiting the very like strange passing to break SQL 1665.50s - 1670.50s | contexts. So, my idea is uh, if I use like so specific uh, separate methods, uh, to 1672.58s - 1677.58s | separate uh, uh, like tags in some data uh, that is stored in the database uh, so uh, that will 1680.12s - 1687.06s | be stored in the database. Uh, maybe when they will backup and restore again, that will break 1687.06s - 1693.10s | something if I get some data with those tags. Uh, maybe on my profile, on my, I don't know, 1693.10s - 1700.10s | username, name, other comments or things like that. The first problem is uh, most fields are 1700.12s - 1705.12s | sanitized by default. That's like a global sanitize, uh, sanitization that is done on every 1707.88s - 1712.90s | field. Uh, so no, no new lines, no hash, no special characters in general. Uh, the second 1717.10s - 1722.10s | problem is that if the restore fail on one SQL query, it's like ending the process and not 1722.98s - 1727.98s | going further in the file. I mean, for the first problem, the solution is quite easy. Most uh, 1734.52s - 1739.86s | field are sanitized but not all. They are like exception. One of them are like uh, 1739.86s - 1744.86s | comments that are put on the other so I can definitely reach that field uh, on the front end. 1745.56s - 1750.56s | And the second uh, problem, we have like a separator between queries and way to inject single 1754.88s - 1759.88s | code. So that should be possible uh, to get like a valid file after injecting things. So let's 1764.58s - 1769.58s | imagine uh, uh, a


chunk_text:
don't know, 1693.10s - 1700.10s | username, name, other comments or things like that. The first problem is uh, most fields are 1700.12s - 1705.12s | sanitized by default. That's like a global sanitize, uh, sanitization that is done on every 1707.88s - 1712.90s | field. Uh, so no, no new lines, no hash, no special characters in general. Uh, the second 1717.10s - 1722.10s | problem is that if the restore fail on one SQL query, it's like ending the process and not 1722.98s - 1727.98s | going further in the file. I mean, for the first problem, the solution is quite easy. Most uh, 1734.52s - 1739.86s | field are sanitized but not all. They are like exception. One of them are like uh, 1739.86s - 1744.86s | comments that are put on the other so I can definitely reach that field uh, on the front end. 1745.56s - 1750.56s | And the second uh, problem, we have like a separator between queries and way to inject single 1754.88s - 1759.88s | code. So that should be possible uh, to get like a valid file after injecting things. So let's 1764.58s - 1769.58s | imagine uh, uh, a valid SQL query in the file formats. So we control fully the values of 1769.58s - 1774.58s | Bemerkugin. I have no idea what it means but that's the name of the database of the uh, 1778.66s - 1785.42s | table. I have no idea what it is. So we can control that fully and you can see the separator at 1785.42s - 1792.14s | the end. So we're trying to use their base 64 feature to break from single codes. So we're 1792.14s - 1797.14s | trying to get something like that. That will be transformed to that. So we inject the 1799.78s - 1804.78s | single code, a parenthesis, a comment and that is working pretty well to be honest. So then my goal 1809.52s - 1814.52s | is to inject new queries in the packet file. So this time I'm also adding uh, a separator and a 1818.46s - 1823.46s | new uh, query with a comment at the end. So after being uh, uh, passed by the restart 1824.46s - 1829.46s | procedure that will give that. And that's definitely valid. So I was able to uh, just 1833.66s - 1838.66s | inject uh, an update


chunk_text:
valid SQL query in the file formats. So we control fully the values of 1769.58s - 1774.58s | Bemerkugin. I have no idea what it means but that's the name of the database of the uh, 1778.66s - 1785.42s | table. I have no idea what it is. So we can control that fully and you can see the separator at 1785.42s - 1792.14s | the end. So we're trying to use their base 64 feature to break from single codes. So we're 1792.14s - 1797.14s | trying to get something like that. That will be transformed to that. So we inject the 1799.78s - 1804.78s | single code, a parenthesis, a comment and that is working pretty well to be honest. So then my goal 1809.52s - 1814.52s | is to inject new queries in the packet file. So this time I'm also adding uh, a separator and a 1818.46s - 1823.46s | new uh, query with a comment at the end. So after being uh, uh, passed by the restart 1824.46s - 1829.46s | procedure that will give that. And that's definitely valid. So I was able to uh, just 1833.66s - 1838.66s | inject uh, an update to uh, an arbitrary table changing arbitrary column there. Pretty good. 1842.80s - 1847.80s | Um, so the impact is I can run arbitrary queries on the restart process if they take a backup 1848.06s - 1853.06s | and restart that will run my queries. Pretty good. But uh, the database is obviously that 1860.44s - 1865.44s | PHP uh, storing some serialized uh, PHP objects because you know, relational databases is 1868.44s - 1873.44s | done for that, storing full objects. So I found uh, pretty fastly a custom gadget uh, that 1873.80s - 1878.80s | allow to delete local files. Once again, not the most interesting primitive for us because 1882.88s - 1889.88s | that's definitely not a goal to delete uh, files on them. But I saw that uh, the admin 1889.88s - 1895.92s | authentication mechanism is just uh, dot htaccess file so that just a basic authentication 1895.92s - 1900.92s | system. So if we delete the dot htaccess file, uh, everyone can go to slash admin and uh, 1903.66s - 1909.10s | admin, just that. There's no authentication besides that. So just like, you need either 1909.10s - 1915.68s | valid credential or you


chunk_text:
to uh, an arbitrary table changing arbitrary column there. Pretty good. 1842.80s - 1847.80s | Um, so the impact is I can run arbitrary queries on the restart process if they take a backup 1848.06s - 1853.06s | and restart that will run my queries. Pretty good. But uh, the database is obviously that 1860.44s - 1865.44s | PHP uh, storing some serialized uh, PHP objects because you know, relational databases is 1868.44s - 1873.44s | done for that, storing full objects. So I found uh, pretty fastly a custom gadget uh, that 1873.80s - 1878.80s | allow to delete local files. Once again, not the most interesting primitive for us because 1882.88s - 1889.88s | that's definitely not a goal to delete uh, files on them. But I saw that uh, the admin 1889.88s - 1895.92s | authentication mechanism is just uh, dot htaccess file so that just a basic authentication 1895.92s - 1900.92s | system. So if we delete the dot htaccess file, uh, everyone can go to slash admin and uh, 1903.66s - 1909.10s | admin, just that. There's no authentication besides that. So just like, you need either 1909.10s - 1915.68s | valid credential or you need to pipe as a dot htaccess. The payload is too big for the screen, 1915.68s - 1922.53s | I'm sorry. So let's get a demo for this one. Once again, super cross and sharp. So we put 1929.15s - 1938.31s | the payload uh, in the other commands. You can see the payload there, it's pretty big. It 1938.33s - 1943.33s | just uh, trying to update the other table and set uh, a big uh, serialized uh, object in the 1945.61s - 1950.61s | data of the others. So now my user have uh, like another ways uh, or uh, or tags uh, or 1957.65s - 1962.65s | by basic C for tags. So let's go to an administrator account, let's do a backup. Yeah, 1962.87s - 1971.77s | that's a fail. Let's go to the backup, let's log in. So let's do a backup and now trying to 1979.92s - 1984.92s | restore it. Not, not, before restoring it, we can see in the order that uh, we have like 1987.76s - 1993.40s | old data that is injected uh, in the order. So now trying to restore, that's definitely not 1993.40s - 1998.40s | the same


chunk_text:
need to pipe as a dot htaccess. The payload is too big for the screen, 1915.68s - 1922.53s | I'm sorry. So let's get a demo for this one. Once again, super cross and sharp. So we put 1929.15s - 1938.31s | the payload uh, in the other commands. You can see the payload there, it's pretty big. It 1938.33s - 1943.33s | just uh, trying to update the other table and set uh, a big uh, serialized uh, object in the 1945.61s - 1950.61s | data of the others. So now my user have uh, like another ways uh, or uh, or tags uh, or 1957.65s - 1962.65s | by basic C for tags. So let's go to an administrator account, let's do a backup. Yeah, 1962.87s - 1971.77s | that's a fail. Let's go to the backup, let's log in. So let's do a backup and now trying to 1979.92s - 1984.92s | restore it. Not, not, before restoring it, we can see in the order that uh, we have like 1987.76s - 1993.40s | old data that is injected uh, in the order. So now trying to restore, that's definitely not 1993.40s - 1998.40s | the same data. We were able to update the order and add like a serialized object that they 2000.80s - 2006.84s | have a pass traversal to the htaccess file. So let's go see the order that triggered uh, the 2006.84s - 2011.98s | serialized objects and now we can go to the admin panel and there is no more authentication 2011.98s - 2016.98s | on it. So yeah, that definitely deleted uh, the htaccess so everyone is admin which is uh, to 2021.12s - 2026.12s | be honest a bit uh, frightening because like by exploiting that I gave everyone admin 2026.40s - 2031.40s | access. Oops. So they pay me uh, six and, six hundred fifty dollars which is quite bad but uh, 2039.18s - 2045.58s | the real uh, thing is that Swiss Post is not using the backup and restore feature because they 2045.58s - 2050.58s | have too much data and the official backup feature there is just crashing because there is too 2050.76s - 2055.76s | much data. You know like, problem of memory issues and things like that. So that's even 2058.66s - 2064.00s | fair they decided to pay a bounty for that because


chunk_text:
data. We were able to update the order and add like a serialized object that they 2000.80s - 2006.84s | have a pass traversal to the htaccess file. So let's go see the order that triggered uh, the 2006.84s - 2011.98s | serialized objects and now we can go to the admin panel and there is no more authentication 2011.98s - 2016.98s | on it. So yeah, that definitely deleted uh, the htaccess so everyone is admin which is uh, to 2021.12s - 2026.12s | be honest a bit uh, frightening because like by exploiting that I gave everyone admin 2026.40s - 2031.40s | access. Oops. So they pay me uh, six and, six hundred fifty dollars which is quite bad but uh, 2039.18s - 2045.58s | the real uh, thing is that Swiss Post is not using the backup and restore feature because they 2045.58s - 2050.58s | have too much data and the official backup feature there is just crashing because there is too 2050.76s - 2055.76s | much data. You know like, problem of memory issues and things like that. So that's even 2058.66s - 2064.00s | fair they decided to pay a bounty for that because they are like, no chance they are using 2064.00s - 2070.44s | the backup and restore features. So yeah, still quite firm. Let's go on another customer, the 2073.18s - 2078.18s | most known one, Redacted. Uh, I wasn't able to name them so let's consider that Redacted 2082.86s - 2087.86s | uh, we just put a bit of context. Imagine a PHP CMS, once again PHP, widely used uh, with a 2093.26s - 2100.28s | lot of complex code, complex features and a little blacklist criticizing the code at every 2100.28s - 2105.28s | release, every time. So, first bag, there is a new CV there uh, that's a Prius SE to a SSTI 2105.98s - 2110.98s | in the wild, like used by a straight actor. So the maintainers decided to make an emergency 2119.06s - 2124.06s | patch. I decided to reverse it, obviously. Uh, so uh, there is like a double level of 2127.40s - 2132.40s | templating uh, on the app and the patch from uh, the maintainers were just a break replace to 2135.44s - 2140.44s | uh, remove uh, the tags just after a single evaluation of the templates. Uh, the problem is


chunk_text:
they are like, no chance they are using 2064.00s - 2070.44s | the backup and restore features. So yeah, still quite firm. Let's go on another customer, the 2073.18s - 2078.18s | most known one, Redacted. Uh, I wasn't able to name them so let's consider that Redacted 2082.86s - 2087.86s | uh, we just put a bit of context. Imagine a PHP CMS, once again PHP, widely used uh, with a 2093.26s - 2100.28s | lot of complex code, complex features and a little blacklist criticizing the code at every 2100.28s - 2105.28s | release, every time. So, first bag, there is a new CV there uh, that's a Prius SE to a SSTI 2105.98s - 2110.98s | in the wild, like used by a straight actor. So the maintainers decided to make an emergency 2119.06s - 2124.06s | patch. I decided to reverse it, obviously. Uh, so uh, there is like a double level of 2127.40s - 2132.40s | templating uh, on the app and the patch from uh, the maintainers were just a break replace to 2135.44s - 2140.44s | uh, remove uh, the tags just after a single evaluation of the templates. Uh, the problem is 2144.18s - 2150.94s | maybe someone saw that? You saw that, I know. The regex is not matching new lines. Uh, that 2153.92s - 2160.82s | means that you can just use the original payload but use a new line before the closing tags, 2160.82s - 2165.82s | you're bypassing that regex and that's like a Prius SE again. That was paid a bounty for 2167.06s - 2172.06s | uh, $10,000 because you know, Prius SE are always cool. And small bonus, my colleague uh, 2175.30s - 2180.30s | also found another bypass, you just had to not close the tags. So, that was enough. Uh, 2182.58s - 2187.58s | templates uh, will contain some tags, ending tags later. So, yeah, that's also bypass it. 2190.78s - 2195.78s | So, and there's a second bag and I'm sorry this one will be quite complex. Uh, the 2197.66s - 2202.66s | I will try my best to explain it uh, correctly but yeah, that's a complex one. So, I found a 2205.66s - 2210.66s | bag uh, that is to be honest barely exportable but it's super fun technically. So, the worst 2215.38s - 2220.38s | impact uh, to it was


chunk_text:
2144.18s - 2150.94s | maybe someone saw that? You saw that, I know. The regex is not matching new lines. Uh, that 2153.92s - 2160.82s | means that you can just use the original payload but use a new line before the closing tags, 2160.82s - 2165.82s | you're bypassing that regex and that's like a Prius SE again. That was paid a bounty for 2167.06s - 2172.06s | uh, $10,000 because you know, Prius SE are always cool. And small bonus, my colleague uh, 2175.30s - 2180.30s | also found another bypass, you just had to not close the tags. So, that was enough. Uh, 2182.58s - 2187.58s | templates uh, will contain some tags, ending tags later. So, yeah, that's also bypass it. 2190.78s - 2195.78s | So, and there's a second bag and I'm sorry this one will be quite complex. Uh, the 2197.66s - 2202.66s | I will try my best to explain it uh, correctly but yeah, that's a complex one. So, I found a 2205.66s - 2210.66s | bag uh, that is to be honest barely exportable but it's super fun technically. So, the worst 2215.38s - 2220.38s | impact uh, to it was uh, Prius SE but uh, the precondition of it make it quite unlikely but 2221.26s - 2226.26s | yeah, it's still a fun one. So, for the context uh, that application uh, was using 2231.34s - 2236.34s | Laminas PHP library to for everything that is using like emails. Laminas is doing a lot of 2240.08s - 2245.94s | checks and transformation to be sure that the email is valid and things like that. There's 2245.98s - 2252.16s | like a lot of different label uh, libraries there. And on the application we're testing uh, 2252.16s - 2257.16s | we have uh, control over a from header that will be uh, used for sending some emails. So, 2261.50s - 2266.50s | that from header will be passed uh, over the fifth argument of mail for those who know uh, 2268.60s - 2275.08s | mail function uh, of a fifth argument that is like arguments that will be passed to the 2275.12s - 2280.12s | send mail uh, binary. So, if that fifth argument is uh, completely controlled by an attacker, 2282.50s - 2287.50s | you can have like argument injection to the send mail binary. There are like known exploit


