# MediaChunks

chunk_text:
- 598.64s | open-source software. The one that worked the best with our setup was Cesium Orbit software, 598.64s - 604.80s | and as you can see in the pictures, we were able to configure two different views. You can see from 604.80s - 612.48s | the satellite view to Earth, and you can see as it moves around the world, and whenever it would 612.48s - 619.20s | come into a range of this ground station, you'll be able to see the pre-configured GPS location that 619.20s - 624.32s | we would choose to be able to simulate that communication window opening and closing. 625.20s - 630.80s | And as that orbit would occur, that's when we would transmit messages back up and down from 630.80s - 641.79s | the ground station to the satellite. Once we had this test bed working well and functioning 641.79s - 648.27s | the way we wanted it to, we started to move towards coming up with different task scenarios 648.27s - 653.87s | and trying to come up or find different vulnerabilities that may be of interest 653.87s - 658.67s | to try and make sure that a satellite that a researcher might send up to space, you want to 658.67s - 664.43s | make sure that it doesn't happen to you, lose access to the satellite for whatever reason. 664.43s - 669.95s | So we tried a variety of different attacks, man-in-the-middle attacks, denial of service, 669.95s - 676.19s | spoofing that would interfere with the payload, as well as instructions that would send 676.19s - 681.71s | configuration messages to the satellite. We would try to mess with those. We also tried to attack 681.71s - 687.39s | the hardware itself to see if we could cause it to fail and no longer function in space. 693.44s - 697.28s | So we looked at this in a variety of different ways. We looked at the communication, 697.28s - 701.12s | the software that we were using, the hardware in the operating system. 701.68s - 706.32s | We used a variety of traditional scanners, packet sniffers, and so forth. 707.28s - 711.60s | I'm going to give you an example of one of the different scenarios that we came up with. 712.16s - 720.64s | This was a man-in-the-middle attack scenario where the malicious actor with the correct 720.64s - 728.48s


chunk_text:
might send up to space, you want to 658.67s - 664.43s | make sure that it doesn't happen to you, lose access to the satellite for whatever reason. 664.43s - 669.95s | So we tried a variety of different attacks, man-in-the-middle attacks, denial of service, 669.95s - 676.19s | spoofing that would interfere with the payload, as well as instructions that would send 676.19s - 681.71s | configuration messages to the satellite. We would try to mess with those. We also tried to attack 681.71s - 687.39s | the hardware itself to see if we could cause it to fail and no longer function in space. 693.44s - 697.28s | So we looked at this in a variety of different ways. We looked at the communication, 697.28s - 701.12s | the software that we were using, the hardware in the operating system. 701.68s - 706.32s | We used a variety of traditional scanners, packet sniffers, and so forth. 707.28s - 711.60s | I'm going to give you an example of one of the different scenarios that we came up with. 712.16s - 720.64s | This was a man-in-the-middle attack scenario where the malicious actor with the correct 720.64s - 728.48s | transmission bytes, we were able to send a configuration message to the satellite orbiting 728.48s - 734.48s | Earth to make it think that we were the ground station when we were not supposed to be. 735.12s - 741.04s | And essentially we were able to change the satellite IDs and take over on that communication. 743.34s - 751.26s | So this created a lockout scenario where the satellite orbiting Earth would ignore messages 751.26s - 758.38s | from the legitimate ground station and only listen to the hijacked ground station. And as you can see 758.38s - 766.38s | we were able to take pictures in the bottom four images. You can see those were the normal pictures. 766.38s - 771.98s | And then we were able to essentially take over and change the images being sent back to the 771.98s - 780.54s | ground station. So we were able to either modify or withhold data or even change the data being 780.54s - 789.60s | sent to the real ground station. Some other attack scenarios that the students worked on were 789.60s - 796.24s | coming up with ways to mess with the Raspberry Pi system that


chunk_text:
| transmission bytes, we were able to send a configuration message to the satellite orbiting 728.48s - 734.48s | Earth to make it think that we were the ground station when we were not supposed to be. 735.12s - 741.04s | And essentially we were able to change the satellite IDs and take over on that communication. 743.34s - 751.26s | So this created a lockout scenario where the satellite orbiting Earth would ignore messages 751.26s - 758.38s | from the legitimate ground station and only listen to the hijacked ground station. And as you can see 758.38s - 766.38s | we were able to take pictures in the bottom four images. You can see those were the normal pictures. 766.38s - 771.98s | And then we were able to essentially take over and change the images being sent back to the 771.98s - 780.54s | ground station. So we were able to either modify or withhold data or even change the data being 780.54s - 789.60s | sent to the real ground station. Some other attack scenarios that the students worked on were 789.60s - 796.24s | coming up with ways to mess with the Raspberry Pi system that ran the ground station as well as 796.24s - 804.40s | a satellite. They had a lot of fun doing this. Most of this worked pretty well and we were creating 804.40s - 812.18s | these different experiments that we might be able to in a more real world scenario. And after creating 812.18s - 818.10s | all these different attack scenarios we spent time looking at ways to try to prevent different 818.10s - 824.58s | things that we created. And we wanted to make sure that those things can't happen or it would be harder 824.58s - 830.90s | to do. One of the obvious things was to us was to come up with a way to do command validation. 831.46s - 838.66s | There were some commands that we were sending maybe with a typo or in a wrong order that 838.66s - 847.38s | would cause a satellite to get confused and actually crash. We also created timeouts to 847.38s - 852.58s | prevent the satellite from indefinitely waiting for the ground station to acknowledge messages 852.58s - 858.98s | because this is a TCP communication model that we created. We also implemented a health check


chunk_text:
ran the ground station as well as 796.24s - 804.40s | a satellite. They had a lot of fun doing this. Most of this worked pretty well and we were creating 804.40s - 812.18s | these different experiments that we might be able to in a more real world scenario. And after creating 812.18s - 818.10s | all these different attack scenarios we spent time looking at ways to try to prevent different 818.10s - 824.58s | things that we created. And we wanted to make sure that those things can't happen or it would be harder 824.58s - 830.90s | to do. One of the obvious things was to us was to come up with a way to do command validation. 831.46s - 838.66s | There were some commands that we were sending maybe with a typo or in a wrong order that 838.66s - 847.38s | would cause a satellite to get confused and actually crash. We also created timeouts to 847.38s - 852.58s | prevent the satellite from indefinitely waiting for the ground station to acknowledge messages 852.58s - 858.98s | because this is a TCP communication model that we created. We also implemented a health check 858.98s - 867.22s | where it would monitor the system and report any unusual warnings and then send that back 867.22s - 875.78s | to the ground station. So by building this model we were hoping to avoid the need for 875.78s - 882.58s | other researchers to launch satellites up to space and realize that something's vulnerable 882.58s - 889.06s | or broken and not be able to fix it without having to launch another one. We really want to reduce 889.06s - 895.86s | the chances of compromise or functionality of those satellites. And with this research we're 895.86s - 901.30s | hoping to reduce the likelihood of having to replace what you already launched. And we created 901.30s - 907.46s | this baseline testing system with this model to be able to improve the overall resource posture. 908.66s - 914.50s | We published all of our efforts with this paper, the IEEE International Conference 914.50s - 922.42s | on Cybersecurity and Resilience last year. And you can find the paper on there 922.42s - 928.02s | and talks about the model in more detail and the different parts that we put together to make 928.02s - 935.86s


chunk_text:
858.98s - 867.22s | where it would monitor the system and report any unusual warnings and then send that back 867.22s - 875.78s | to the ground station. So by building this model we were hoping to avoid the need for 875.78s - 882.58s | other researchers to launch satellites up to space and realize that something's vulnerable 882.58s - 889.06s | or broken and not be able to fix it without having to launch another one. We really want to reduce 889.06s - 895.86s | the chances of compromise or functionality of those satellites. And with this research we're 895.86s - 901.30s | hoping to reduce the likelihood of having to replace what you already launched. And we created 901.30s - 907.46s | this baseline testing system with this model to be able to improve the overall resource posture. 908.66s - 914.50s | We published all of our efforts with this paper, the IEEE International Conference 914.50s - 922.42s | on Cybersecurity and Resilience last year. And you can find the paper on there 922.42s - 928.02s | and talks about the model in more detail and the different parts that we put together to make 928.02s - 935.86s | this happen in more detail about these attack scenarios. I'm going to pivot over after we did 935.86s - 942.42s | all of this stuff creating the model. We kind of shifted our efforts after we lost some students 942.42s - 948.90s | from graduating. We got some additional students on the project. We started to focus on creating a 948.90s - 955.94s | lightweight program that can monitor and protect satellites that are orbiting Earth. We found that 955.94s - 962.74s | commercial off-the-shelf products that provide that level of security were too resource intensive. 962.74s - 969.14s | So we wanted to create this lightweight program that can run and essentially protect the satellite 969.14s - 975.78s | for potential threats. A variety of different things we incorporated including a scanner from 975.78s - 984.83s | malware, monitoring different metrics of the file system, network checks, secure configuration, and 984.83s - 994.02s | so forth. So these different attack scenarios that we came up with, we found some mitigation 994.02s - 1000.34s | strategies and we wanted to implement those on that small satellite defender to be able to protect 1000.34s - 1009.47s | the satellite from


chunk_text:
| this happen in more detail about these attack scenarios. I'm going to pivot over after we did 935.86s - 942.42s | all of this stuff creating the model. We kind of shifted our efforts after we lost some students 942.42s - 948.90s | from graduating. We got some additional students on the project. We started to focus on creating a 948.90s - 955.94s | lightweight program that can monitor and protect satellites that are orbiting Earth. We found that 955.94s - 962.74s | commercial off-the-shelf products that provide that level of security were too resource intensive. 962.74s - 969.14s | So we wanted to create this lightweight program that can run and essentially protect the satellite 969.14s - 975.78s | for potential threats. A variety of different things we incorporated including a scanner from 975.78s - 984.83s | malware, monitoring different metrics of the file system, network checks, secure configuration, and 984.83s - 994.02s | so forth. So these different attack scenarios that we came up with, we found some mitigation 994.02s - 1000.34s | strategies and we wanted to implement those on that small satellite defender to be able to protect 1000.34s - 1009.47s | the satellite from threats. I'll go in more detail about what we monitored. So we monitored all of 1009.47s - 1016.03s | these different metrics essentially creating a baseline of known good of what is normal for a 1016.03s - 1021.07s | satellite. And once you have that baseline, we would collect all this information and send it 1021.07s - 1026.27s | back to the ground station for anything that may be unusual and have the ground station 1026.27s - 1035.41s | operator to further investigate and figure out what may be going on. With that small satellite 1035.41s - 1043.81s | defender work, we submitted a app stat to the CyberVCon symposium which was run by the U.S. 1043.81s - 1050.77s | Cyber Command. And essentially they assigned us a mentor which was an Air Force colonel and he 1050.77s - 1056.21s | worked with us to help develop small satellite defender and focus on creating different 1056.21s - 1064.61s | experiments. And after that, we, the team traveled to the symposium and presented the work to the 1065.33s - 1073.65s | director of the National Security Agency, Mr. Billy Cole. With all of those efforts with a small 1073.65s - 1082.37s


chunk_text:
threats. I'll go in more detail about what we monitored. So we monitored all of 1009.47s - 1016.03s | these different metrics essentially creating a baseline of known good of what is normal for a 1016.03s - 1021.07s | satellite. And once you have that baseline, we would collect all this information and send it 1021.07s - 1026.27s | back to the ground station for anything that may be unusual and have the ground station 1026.27s - 1035.41s | operator to further investigate and figure out what may be going on. With that small satellite 1035.41s - 1043.81s | defender work, we submitted a app stat to the CyberVCon symposium which was run by the U.S. 1043.81s - 1050.77s | Cyber Command. And essentially they assigned us a mentor which was an Air Force colonel and he 1050.77s - 1056.21s | worked with us to help develop small satellite defender and focus on creating different 1056.21s - 1064.61s | experiments. And after that, we, the team traveled to the symposium and presented the work to the 1065.33s - 1073.65s | director of the National Security Agency, Mr. Billy Cole. With all of those efforts with a small 1073.65s - 1082.37s | satellite defender, we were approached by Lockheed Martin to run this software that we created on an 1082.37s - 1091.33s | actual orbiting satellite. So Lockheed Martin has this Ignite team where they essentially create 1091.33s - 1099.01s | opportunities for academia and other companies or researchers to be able to perform experiments on a 1099.01s - 1105.17s | decommissioned satellite. And we were fortunate enough to have this opportunity with Lockheed 1105.17s - 1111.73s | Martin where we were able to run the small satellite defender on an actual orbiting satellite. 1112.53s - 1121.41s | So we worked with Lockheed Martin. They had their own identical twin of the satellite orbiting Earth 1121.41s - 1127.81s | on a test bed and we worked with their engineers to run small satellite defender and we found that the 1128.21s - 1135.09s | satellite did not work on the architecture that we developed, which was Python, and they needed us to 1135.09s - 1141.09s | convert everything to Bash. So it was a challenge for the team to be able to quickly convert everything 1141.09s - 1147.65s | we created from Python to Bash, refactored all the code, and worked with


chunk_text:
| satellite defender, we were approached by Lockheed Martin to run this software that we created on an 1082.37s - 1091.33s | actual orbiting satellite. So Lockheed Martin has this Ignite team where they essentially create 1091.33s - 1099.01s | opportunities for academia and other companies or researchers to be able to perform experiments on a 1099.01s - 1105.17s | decommissioned satellite. And we were fortunate enough to have this opportunity with Lockheed 1105.17s - 1111.73s | Martin where we were able to run the small satellite defender on an actual orbiting satellite. 1112.53s - 1121.41s | So we worked with Lockheed Martin. They had their own identical twin of the satellite orbiting Earth 1121.41s - 1127.81s | on a test bed and we worked with their engineers to run small satellite defender and we found that the 1128.21s - 1135.09s | satellite did not work on the architecture that we developed, which was Python, and they needed us to 1135.09s - 1141.09s | convert everything to Bash. So it was a challenge for the team to be able to quickly convert everything 1141.09s - 1147.65s | we created from Python to Bash, refactored all the code, and worked with the test bed and Lockheed 1147.65s - 1154.13s | Martin to be able to get the code to work and quickly deploy that. I believe in a couple of 1155.09s - 1160.61s | weeks that's how quick we were working because we didn't know how long it would be until that 1160.61s - 1164.61s | decommissioned satellite would no longer be available to perform experiments with. 1166.05s - 1174.05s | And once we have a small satellite defender working with that test bed, we had a session with 1174.05s - 1182.61s | their ground control team and we deployed small satellite defender on Linus space vehicle orbiting 1182.61s - 1190.85s | Earth. We collected a system baseline and then we ran this experiment where we would introduce 1190.85s - 1196.69s | some malicious activity where we would write a bunch of random garbage to different files, 1197.33s - 1203.41s | basically clogging up the system resources in that small satellite defender would collect 1204.29s - 1210.45s | metrics of the satellite and send them back to the ground station showing that unusual activity for 1210.45s - 1218.61s | the operator to identify that something's going on. So that experiment was


chunk_text:
the test bed and Lockheed 1147.65s - 1154.13s | Martin to be able to get the code to work and quickly deploy that. I believe in a couple of 1155.09s - 1160.61s | weeks that's how quick we were working because we didn't know how long it would be until that 1160.61s - 1164.61s | decommissioned satellite would no longer be available to perform experiments with. 1166.05s - 1174.05s | And once we have a small satellite defender working with that test bed, we had a session with 1174.05s - 1182.61s | their ground control team and we deployed small satellite defender on Linus space vehicle orbiting 1182.61s - 1190.85s | Earth. We collected a system baseline and then we ran this experiment where we would introduce 1190.85s - 1196.69s | some malicious activity where we would write a bunch of random garbage to different files, 1197.33s - 1203.41s | basically clogging up the system resources in that small satellite defender would collect 1204.29s - 1210.45s | metrics of the satellite and send them back to the ground station showing that unusual activity for 1210.45s - 1218.61s | the operator to identify that something's going on. So that experiment was successful 1219.33s - 1226.77s | and we were able to showcase the success and viability of monitoring a real world satellite 1226.77s - 1233.01s | using small satellite defender within the small VM console available. 1233.97s - 1238.29s | We had an article published and we also had an additional paper published 1238.29s - 1243.65s | with Lockheed Martin where they wrote this paper talking about the process 1243.65s - 1248.37s | of working rapidly with different universities to run different experiments 1249.97s - 1252.69s | on actual space vehicles that are decommissioning. 1254.69s - 1260.37s | And in the University of Alabama we put together this list of experiments and are working on 1260.53s - 1263.89s | and are working on developing additional experiments to be able to 1264.69s - 1269.41s | perform more of them if we have additional upcoming opportunities potentially with 1270.21s - 1285.42s | the SMDC as well as Lockheed Martin moving forward. So where are we today? Right now we 1285.42s - 1293.66s | are working on interorbital system tube sats. We ordered these six to nine months ago. It's 1293.66s - 1301.02s | been a while. They've been building them and they finally


chunk_text:
successful 1219.33s - 1226.77s | and we were able to showcase the success and viability of monitoring a real world satellite 1226.77s - 1233.01s | using small satellite defender within the small VM console available. 1233.97s - 1238.29s | We had an article published and we also had an additional paper published 1238.29s - 1243.65s | with Lockheed Martin where they wrote this paper talking about the process 1243.65s - 1248.37s | of working rapidly with different universities to run different experiments 1249.97s - 1252.69s | on actual space vehicles that are decommissioning. 1254.69s - 1260.37s | And in the University of Alabama we put together this list of experiments and are working on 1260.53s - 1263.89s | and are working on developing additional experiments to be able to 1264.69s - 1269.41s | perform more of them if we have additional upcoming opportunities potentially with 1270.21s - 1285.42s | the SMDC as well as Lockheed Martin moving forward. So where are we today? Right now we 1285.42s - 1293.66s | are working on interorbital system tube sats. We ordered these six to nine months ago. It's 1293.66s - 1301.02s | been a while. They've been building them and they finally sent us the kits. The reason why 1301.02s - 1306.86s | we're now doing this is because we feel like this is the next step in our research and we're hoping 1306.86s - 1314.78s | to finish putting together these satellites and just continue these different test scenarios that 1314.78s - 1321.82s | we've developed and to do additional vulnerability research with actual real world satellites 1321.82s - 1328.86s | instead of our test bed. And these satellites were about $8,000 each. We have two of them and 1328.86s - 1337.50s | they're the small size probably like a a big can basically and it has space in there for a payload 1337.50s - 1342.14s | of whatever you like to add in there which is really cool. We haven't figured out what we're 1342.14s - 1349.34s | going to do yet with that but we are hoping to integrate small satellite defender in those tube 1349.34s - 1358.86s | sats and to further iterate improvements with small satellite defender. So this one this image 1358.86s - 1364.38s | is actually the one we put together in one of our labs and as you can see it's pretty small. You


chunk_text:
sent us the kits. The reason why 1301.02s - 1306.86s | we're now doing this is because we feel like this is the next step in our research and we're hoping 1306.86s - 1314.78s | to finish putting together these satellites and just continue these different test scenarios that 1314.78s - 1321.82s | we've developed and to do additional vulnerability research with actual real world satellites 1321.82s - 1328.86s | instead of our test bed. And these satellites were about $8,000 each. We have two of them and 1328.86s - 1337.50s | they're the small size probably like a a big can basically and it has space in there for a payload 1337.50s - 1342.14s | of whatever you like to add in there which is really cool. We haven't figured out what we're 1342.14s - 1349.34s | going to do yet with that but we are hoping to integrate small satellite defender in those tube 1349.34s - 1358.86s | sats and to further iterate improvements with small satellite defender. So this one this image 1358.86s - 1364.38s | is actually the one we put together in one of our labs and as you can see it's pretty small. You can 1364.38s - 1371.74s | see the solar panels on that and the tube sats use a different architecture than the raspberry 1371.74s - 1377.82s | pi's or linus so we're going to have to further modify the small satellite defender to work with 1377.82s - 1386.50s | that. So with small satellite defender moving forward we're hoping to come up with two different 1386.50s - 1392.34s | iterations one focusing on the ground station and one that focuses on the actual satellite 1394.74s - 1399.94s | and we're hoping to collect all these different metrics to be able to provide a level of security 1399.94s - 1404.98s | and to have that available for researchers to be able to secure their satellites when they 1407.79s - 1414.56s | launch into space. These are the different metrics that we're hoping to collect. We're 1414.88s - 1420.80s | paying attention to battery health system information and do health checks. We're going to be 1420.80s - 1426.96s | focusing on satellite specific information. We're going to try to map those out on visualizations 1426.96s - 1432.16s | for the ground station operator to be able to quickly see and identify some things


chunk_text:
can 1364.38s - 1371.74s | see the solar panels on that and the tube sats use a different architecture than the raspberry 1371.74s - 1377.82s | pi's or linus so we're going to have to further modify the small satellite defender to work with 1377.82s - 1386.50s | that. So with small satellite defender moving forward we're hoping to come up with two different 1386.50s - 1392.34s | iterations one focusing on the ground station and one that focuses on the actual satellite 1394.74s - 1399.94s | and we're hoping to collect all these different metrics to be able to provide a level of security 1399.94s - 1404.98s | and to have that available for researchers to be able to secure their satellites when they 1407.79s - 1414.56s | launch into space. These are the different metrics that we're hoping to collect. We're 1414.88s - 1420.80s | paying attention to battery health system information and do health checks. We're going to be 1420.80s - 1426.96s | focusing on satellite specific information. We're going to try to map those out on visualizations 1426.96s - 1432.16s | for the ground station operator to be able to quickly see and identify some things that may 1432.16s - 1438.72s | be going on and we're also going to obviously introduce security to this as well. Program error 1438.72s - 1446.80s | chat sums and so forth. Here are some sample graphs that we're going to do with 1446.80s - 1452.00s | Octave to be able to plot and visualize the tube sat metrics that we're going to collect. 1452.00s - 1461.41s | We're going to show the solar panel charge, bus current, and temperature. We're also going to be 1461.41s - 1466.85s | collecting information on the positioning of the satellite. If it starts to spin you'd be able to 1466.85s - 1478.11s | quickly find that on those graphs as well. That's all I have for you today.


chunk_text:
that may 1432.16s - 1438.72s | be going on and we're also going to obviously introduce security to this as well. Program error 1438.72s - 1446.80s | chat sums and so forth. Here are some sample graphs that we're going to do with 1446.80s - 1452.00s | Octave to be able to plot and visualize the tube sat metrics that we're going to collect. 1452.00s - 1461.41s | We're going to show the solar panel charge, bus current, and temperature. We're also going to be 1461.41s - 1466.85s | collecting information on the positioning of the satellite. If it starts to spin you'd be able to 1466.85s - 1478.11s | quickly find that on those graphs as well. That's all I have for you today.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=6lJ26UG9hLU", "title": "DEF CON 32 - Signature-Based Detection Using Network Timing - Josh Pyorre", "description": "Malware traffic is commonly identified using signatures based off its code, strings, and associated network infrastructure. However, it's also possible to build signatures from the timing between network transactions. This presentation will explore using network captures of known malicious network activity to find similar behavior in random traffic. The talk is technical as it involves processing packets with Python and a some data science, but will be presented in a way that anyone should be able to understand and enjoy.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2563, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.00s | This text was transcribed using whisper model: large-v2 Alright, good afternoon everyone and it is 1.30 Pacific time in beautiful Las Vegas, Nevada. Um, 9.80s - 14.80s | thank you so much for joining us today and this next talk is um, sponsored by the Packet 17.34s - 22.34s | Hacking Village and it is my absolute pleasure to introduce to you Josh Piore. Thank you. 22.90s - 30.52s | Alright, so um, that's me. I uh, work with secur- uh, Cisco Talos. Um, previously I've worked with 32.70s - 37.70s | Zscaler, um, Umbrella, OpenDNS, NASA, and Mandiant and some other places, some non-profits 38.90s - 43.90s | and what not. So, I do security research and I uh, make music and do a bunch of other stuff. 45.84s - 50.34s | So, uh, before I get into all the details I'm gonna talk about what I wanna focus on when I'm 50.40s - 54.76s | doing this kind of thing. I'm gonna talk about attribution and the infection chain real quick 54.76s - 58.66s | and uh, it's probably very familiar to you. So, hopefully I'm not gonna bore everyone but I'll 58.66s - 63.60s | just continue on. Um, so looking at attribution, when you're looking for something, I spent most 63.60s - 68.24s | of my time as a threat hunter. When you're looking for something, uh, you're following one thing 68.24s - 73.94s | that you see. So, maybe I found a- a domain or a URL. In this case I found this one at 73.94s - 79.34s | urlhouse.abuse.ch and then I um, I can see it's part of Emotet. A lot of the samples I'm using 79.34s - 83.42s | are


chunk_text:
32.70s - 37.70s | Zscaler, um, Umbrella, OpenDNS, NASA, and Mandiant and some other places, some non-profits 38.90s - 43.90s | and what not. So, I do security research and I uh, make music and do a bunch of other stuff. 45.84s - 50.34s | So, uh, before I get into all the details I'm gonna talk about what I wanna focus on when I'm 50.40s - 54.76s | doing this kind of thing. I'm gonna talk about attribution and the infection chain real quick 54.76s - 58.66s | and uh, it's probably very familiar to you. So, hopefully I'm not gonna bore everyone but I'll 58.66s - 63.60s | just continue on. Um, so looking at attribution, when you're looking for something, I spent most 63.60s - 68.24s | of my time as a threat hunter. When you're looking for something, uh, you're following one thing 68.24s - 73.94s | that you see. So, maybe I found a- a domain or a URL. In this case I found this one at 73.94s - 79.34s | urlhouse.abuse.ch and then I um, I can see it's part of Emotet. A lot of the samples I'm using 79.34s - 83.42s | are kind of some old samples for the moment. I have some newer stuff later on but uh, this is 83.42s - 88.42s | part of Emotet, part of Epoch 4. There are various epochs, various um, evolutions. Um, if I look 90.92s - 97.60s | at that in like VirusTotal, I can find a hash that's associated with this- this uh, URL and then 97.60s - 104.04s | I can follow that trail looking for more hashes. Uh, VirusTotal has- makes this very easy. Um, I 104.04s - 108.64s | can then keep on going and getting more and more attribution and finding more of this uh, 108.64s - 114.58s | particular variation of Emotet. Maybe it's today's variant or this week's variant. Um, uh, I 114.58s - 118.72s | can copy the hash for that file and I can go in multiple different directions. Take that to 118.72s - 123.72s | another interface and uh, find additional things. Uh, keep on looking, basically ending up at 127.66s - 131.60s | finding a whole bunch of different URLs. So, as a threat hunter I would do this to like find 131.60s - 137.34s | additional compromised URLs. In this case


chunk_text:
kind of some old samples for the moment. I have some newer stuff later on but uh, this is 83.42s - 88.42s | part of Emotet, part of Epoch 4. There are various epochs, various um, evolutions. Um, if I look 90.92s - 97.60s | at that in like VirusTotal, I can find a hash that's associated with this- this uh, URL and then 97.60s - 104.04s | I can follow that trail looking for more hashes. Uh, VirusTotal has- makes this very easy. Um, I 104.04s - 108.64s | can then keep on going and getting more and more attribution and finding more of this uh, 108.64s - 114.58s | particular variation of Emotet. Maybe it's today's variant or this week's variant. Um, uh, I 114.58s - 118.72s | can copy the hash for that file and I can go in multiple different directions. Take that to 118.72s - 123.72s | another interface and uh, find additional things. Uh, keep on looking, basically ending up at 127.66s - 131.60s | finding a whole bunch of different URLs. So, as a threat hunter I would do this to like find 131.60s - 137.34s | additional compromised URLs. In this case a bunch of WordPress URLs that are um, dropping uh, 137.34s - 143.88s | this- this specific version of Emotet at the time. Um, maybe I have another example, just to 143.88s - 149.74s | give you another example. Um, I go to any.run which is a- a malware sandbox that you can go to 149.74s - 155.18s | and I grab something. I see a URL that's at this IP address and I grab that IP address, go look 155.18s - 161.16s | for it in another place and get some hashes. Um, and get more information. Keep building up my 161.16s - 165.86s | thing. You have to know when to quit of course, but keep building and um, eventually you can do 165.88s - 171.48s | something like you can map it all together following host infrastructure. Uh, finding what 171.48s - 176.76s | these specific threat- threat actors are- are using to make their um, their malware do what it 176.76s - 181.60s | does. Um, but there's always patterns as we all know like when you look at binary analysis or 181.60s - 185.44s | anything like that. There's certain variable names- names that are


chunk_text:
a bunch of WordPress URLs that are um, dropping uh, 137.34s - 143.88s | this- this specific version of Emotet at the time. Um, maybe I have another example, just to 143.88s - 149.74s | give you another example. Um, I go to any.run which is a- a malware sandbox that you can go to 149.74s - 155.18s | and I grab something. I see a URL that's at this IP address and I grab that IP address, go look 155.18s - 161.16s | for it in another place and get some hashes. Um, and get more information. Keep building up my 161.16s - 165.86s | thing. You have to know when to quit of course, but keep building and um, eventually you can do 165.88s - 171.48s | something like you can map it all together following host infrastructure. Uh, finding what 171.48s - 176.76s | these specific threat- threat actors are- are using to make their um, their malware do what it 176.76s - 181.60s | does. Um, but there's always patterns as we all know like when you look at binary analysis or 181.60s - 185.44s | anything like that. There's certain variable names- names that are the same because it's- it's 185.44s - 191.74s | difficult to change your habits uh, as a- anything in the world. Um, there's a framework for 191.76s - 196.16s | this. You probably all know about it. Minor attack framework to uh, attribute various tools, 196.16s - 202.44s | tactics, procedures to things and to groups like APT29 which is a threat group and it's you 202.44s - 207.08s | know if something belongs to them because it follows these certain procedures. Um, they use 207.08s - 211.12s | certain techniques. You can track everything with this. It's- it's nice. It's a little hard to 211.12s - 216.02s | automate, but it's nice. Um, there's books about this kind of thing. This is a great book about 216.02s - 221.22s | this. I actually bought it at Defcon a few years ago. Um, but there are levels of attribution. 221.24s - 225.24s | Uh, when I worked in the government we were very interested in threat actors. Like what threat 225.24s - 230.64s | actor is responsible for this thing and APT was the word of the day every single day. So, um, we 230.64s - 235.32s | were interested


chunk_text:
the same because it's- it's 185.44s - 191.74s | difficult to change your habits uh, as a- anything in the world. Um, there's a framework for 191.76s - 196.16s | this. You probably all know about it. Minor attack framework to uh, attribute various tools, 196.16s - 202.44s | tactics, procedures to things and to groups like APT29 which is a threat group and it's you 202.44s - 207.08s | know if something belongs to them because it follows these certain procedures. Um, they use 207.08s - 211.12s | certain techniques. You can track everything with this. It's- it's nice. It's a little hard to 211.12s - 216.02s | automate, but it's nice. Um, there's books about this kind of thing. This is a great book about 216.02s - 221.22s | this. I actually bought it at Defcon a few years ago. Um, but there are levels of attribution. 221.24s - 225.24s | Uh, when I worked in the government we were very interested in threat actors. Like what threat 225.24s - 230.64s | actor is responsible for this thing and APT was the word of the day every single day. So, um, we 230.64s - 235.32s | were interested in individuals, other governments, the state sponsored stuff. Uh, in some 235.32s - 239.56s | cases, many places I'm interested in campaigns. So what is the malware campaign that I'm looking 239.56s - 245.56s | at? Uh, is it Emotet or is it something like a remote access Trojan or is it ransomware or 245.56s - 250.80s | whatever? Um, and then in most cases like small environments you just want to know what's 250.84s - 256.72s | inside your network. That's your attribution level. So let me talk briefly about the 256.72s - 261.18s | infection chain cause it doesn't change much just like the behaviors of all these things don't 261.18s - 265.86s | change much. Um, making it possible to track them. Using Emotet again, it's just so easy to 265.86s - 270.60s | use and I'd like to make fun of it. Um, it usually comes in via an email and then you get a 270.60s - 276.50s | link to something or an attachment to something. Leads to OfficeDoc with macros, PowerShell, 276.54s - 281.48s | uh, more macros, it'll install additional components than the C2 stuff back then. I mean, 281.48s - 285.28s |


chunk_text:
in individuals, other governments, the state sponsored stuff. Uh, in some 235.32s - 239.56s | cases, many places I'm interested in campaigns. So what is the malware campaign that I'm looking 239.56s - 245.56s | at? Uh, is it Emotet or is it something like a remote access Trojan or is it ransomware or 245.56s - 250.80s | whatever? Um, and then in most cases like small environments you just want to know what's 250.84s - 256.72s | inside your network. That's your attribution level. So let me talk briefly about the 256.72s - 261.18s | infection chain cause it doesn't change much just like the behaviors of all these things don't 261.18s - 265.86s | change much. Um, making it possible to track them. Using Emotet again, it's just so easy to 265.86s - 270.60s | use and I'd like to make fun of it. Um, it usually comes in via an email and then you get a 270.60s - 276.50s | link to something or an attachment to something. Leads to OfficeDoc with macros, PowerShell, 276.54s - 281.48s | uh, more macros, it'll install additional components than the C2 stuff back then. I mean, 281.48s - 285.28s | not, not so, I mean it would lead to Cobalt strike, but maybe it leads to remote access 285.28s - 290.18s | Trojan. Um, this is just Emotet, but this is kind of a pattern with, with most things. The 290.18s - 294.82s | easiest way to compromise is, you know, get the user via some kind of email dropper or a link 294.82s - 302.86s | to something or drive by download. Um, uh, usually, uh, oh, let's see. I forgot that I made 302.86s - 308.20s | this segmented, but I just went over that. So, uh, another one, QuackBot, same kind of 308.20s - 312.84s | thing, but a little bit more complex, maybe to make it seem more authentic. Um, usually they 312.84s - 318.04s | get an email which has a link, which leads to a password protected zip file. They, uh, 318.04s - 321.72s | possibly open that file and then they have an ISO and they're like, what do I do with this? 321.72s - 325.38s | They open that, there's a Windows shortcut, downloads things and then it does what it does 325.38s - 332.78s | after that. Um, and typically you


chunk_text:
not, not so, I mean it would lead to Cobalt strike, but maybe it leads to remote access 285.28s - 290.18s | Trojan. Um, this is just Emotet, but this is kind of a pattern with, with most things. The 290.18s - 294.82s | easiest way to compromise is, you know, get the user via some kind of email dropper or a link 294.82s - 302.86s | to something or drive by download. Um, uh, usually, uh, oh, let's see. I forgot that I made 302.86s - 308.20s | this segmented, but I just went over that. So, uh, another one, QuackBot, same kind of 308.20s - 312.84s | thing, but a little bit more complex, maybe to make it seem more authentic. Um, usually they 312.84s - 318.04s | get an email which has a link, which leads to a password protected zip file. They, uh, 318.04s - 321.72s | possibly open that file and then they have an ISO and they're like, what do I do with this? 321.72s - 325.38s | They open that, there's a Windows shortcut, downloads things and then it does what it does 325.38s - 332.78s | after that. Um, and typically you see that get request, uh, in, over HTTP. Maybe you see it 332.78s - 337.42s | more these days over SSL, but often you'll see it over HTTP and then SSL traffic starts after 337.42s - 342.30s | that. When you're detecting this, this kind of stuff, um, it's harder where you get to the SSL, 342.30s - 347.30s | but I'm gonna talk about that too. Uh, the problem that I'm addressing here is how do we find 347.30s - 351.60s | bad things in the network? How do we get the attribution of what's inside our environment 351.62s - 357.90s | without knowing too much? Um, so, you know, this is just my home network. I'm just capturing 357.90s - 363.54s | stuff on a, on a capture device. Um, it's not very busy, but I mean, of course networks are way 363.54s - 367.54s | busier than this, but how do you find something like this? This is just a super simple example 367.54s - 373.08s | of like a post, uh, over clear text of someone putting a username and password in, into a 373.08s - 377.26s | compromised WordPress site. How do you find that


chunk_text:
see that get request, uh, in, over HTTP. Maybe you see it 332.78s - 337.42s | more these days over SSL, but often you'll see it over HTTP and then SSL traffic starts after 337.42s - 342.30s | that. When you're detecting this, this kind of stuff, um, it's harder where you get to the SSL, 342.30s - 347.30s | but I'm gonna talk about that too. Uh, the problem that I'm addressing here is how do we find 347.30s - 351.60s | bad things in the network? How do we get the attribution of what's inside our environment 351.62s - 357.90s | without knowing too much? Um, so, you know, this is just my home network. I'm just capturing 357.90s - 363.54s | stuff on a, on a capture device. Um, it's not very busy, but I mean, of course networks are way 363.54s - 367.54s | busier than this, but how do you find something like this? This is just a super simple example 367.54s - 373.08s | of like a post, uh, over clear text of someone putting a username and password in, into a 373.08s - 377.26s | compromised WordPress site. How do you find that inside that? There are ways, obviously we 377.28s - 383.12s | know about this, I'm sure. Uh, intrusion detection and Yara, I'm gonna talk about these. Um, so 383.12s - 387.16s | IDS rules, uh, this is kind of a crazy slide, but at the very top, if you're familiar with this, 387.16s - 392.36s | is an IDS rule. I'm using Emotet and Zenempel. Uh, it would capture what you see in this PCAP. 392.36s - 396.30s | It's gonna look for things like the, the content being the post. It's gonna look for a specific 396.30s - 402.68s | kind of post content. Uh, maybe it's looking for the user agent, uh, or some other data. Um, and 402.68s - 406.68s | when I run this, like if I run a PCAP or I run that malware in my, when I ran it in my home 406.70s - 412.28s | environment, I, I triggered six alert fires, uh, through Suricata, um, reading this rule. So 412.28s - 417.68s | there's really easy detection mechanisms for certain things. Of course, as with most things, 417.68s - 421.58s | you have to know what you're looking for. You have to


chunk_text:
inside that? There are ways, obviously we 377.28s - 383.12s | know about this, I'm sure. Uh, intrusion detection and Yara, I'm gonna talk about these. Um, so 383.12s - 387.16s | IDS rules, uh, this is kind of a crazy slide, but at the very top, if you're familiar with this, 387.16s - 392.36s | is an IDS rule. I'm using Emotet and Zenempel. Uh, it would capture what you see in this PCAP. 392.36s - 396.30s | It's gonna look for things like the, the content being the post. It's gonna look for a specific 396.30s - 402.68s | kind of post content. Uh, maybe it's looking for the user agent, uh, or some other data. Um, and 402.68s - 406.68s | when I run this, like if I run a PCAP or I run that malware in my, when I ran it in my home 406.70s - 412.28s | environment, I, I triggered six alert fires, uh, through Suricata, um, reading this rule. So 412.28s - 417.68s | there's really easy detection mechanisms for certain things. Of course, as with most things, 417.68s - 421.58s | you have to know what you're looking for. You have to have already seen it in many cases. Yara 421.58s - 426.48s | rules are typically, uh, not thought of as a streaming detection mechanism. I mean, they can 426.48s - 432.40s | be used in such a way. Uh, we use them at my work like that. Um, but, uh, they're typically for 432.42s - 438.52s | finding strings or, or data in binary analysis. You can look for stuff in HTTP text and 438.52s - 443.20s | JavaScript. So it's not really thought of as a thing you can use for PCAPs or net streaming 443.20s - 448.50s | network traffic. But I did find that someone wrote a tool called Yara PCAP. I took that and I 448.50s - 453.24s | modified it. My code's gonna be at the very end of this. I have a link to it. Um, but I modified 453.24s - 457.64s | that to include it as a proof of concept if you wanna play with it. Uh, so you can upload a PCAP, 457.66s - 464.66s | um, uh, and test it. What it, how it works with the Yara PCAP thing is you write a Yara rule, um, 464.66s - 469.30s


chunk_text:
have already seen it in many cases. Yara 421.58s - 426.48s | rules are typically, uh, not thought of as a streaming detection mechanism. I mean, they can 426.48s - 432.40s | be used in such a way. Uh, we use them at my work like that. Um, but, uh, they're typically for 432.42s - 438.52s | finding strings or, or data in binary analysis. You can look for stuff in HTTP text and 438.52s - 443.20s | JavaScript. So it's not really thought of as a thing you can use for PCAPs or net streaming 443.20s - 448.50s | network traffic. But I did find that someone wrote a tool called Yara PCAP. I took that and I 448.50s - 453.24s | modified it. My code's gonna be at the very end of this. I have a link to it. Um, but I modified 453.24s - 457.64s | that to include it as a proof of concept if you wanna play with it. Uh, so you can upload a PCAP, 457.66s - 464.66s | um, uh, and test it. What it, how it works with the Yara PCAP thing is you write a Yara rule, um, 464.66s - 469.30s | just like based off this IDS rule that I had before. It becomes a really simple, much easier to 469.30s - 475.90s | read. I'm looking for a post for the, um, user agent, certain kind of content, the refer information, 475.90s - 480.14s | and then I wanna get all those things when it sees them, it triggers. So like if you look at my 480.14s - 486.78s | web app that I built, um, uh, you browse to something. It, I pull up like a test Yara. It, I 486.78s - 494.30s | can see that I get these two alerts basically. So it's possible to, to capture stuff over network 494.30s - 499.30s | with Yara as a dec, detection mechanism. Um, there's just a view of it. Uh, there are some 503.00s - 508.60s | obstacles here. I'm gonna talk about a lot of obstacles. But, um, visibility, SSL, I briefly 508.60s - 514.42s | touched on this. Um, uh, going back to that infection chain, usually you get your email and 514.42s - 518.12s | that's gonna be one endpoint detection. You're looking at your email detection. Does it 518.12s - 522.76s | hopefully


chunk_text:
| just like based off this IDS rule that I had before. It becomes a really simple, much easier to 469.30s - 475.90s | read. I'm looking for a post for the, um, user agent, certain kind of content, the refer information, 475.90s - 480.14s | and then I wanna get all those things when it sees them, it triggers. So like if you look at my 480.14s - 486.78s | web app that I built, um, uh, you browse to something. It, I pull up like a test Yara. It, I 486.78s - 494.30s | can see that I get these two alerts basically. So it's possible to, to capture stuff over network 494.30s - 499.30s | with Yara as a dec, detection mechanism. Um, there's just a view of it. Uh, there are some 503.00s - 508.60s | obstacles here. I'm gonna talk about a lot of obstacles. But, um, visibility, SSL, I briefly 508.60s - 514.42s | touched on this. Um, uh, going back to that infection chain, usually you get your email and 514.42s - 518.12s | that's gonna be one endpoint detection. You're looking at your email detection. Does it 518.12s - 522.76s | hopefully have something that's watching your email? Uh, you maybe have a, uh, going to get that 522.76s - 528.70s | link over HTTP or you have an attachment already in the email. So, I mean, you hopefully 528.70s - 533.64s | detected it in the email and then your endpoint detection is hopefully catching that office 533.64s - 539.18s | doc with all the macros and it's seeing PowerShell run and it's stopping it. Um, uh, then 539.18s - 543.22s | installing additional components is probably gonna be over SSL. You're probably not gonna know 543.22s - 548.08s | that's, uh, something weird is happening. Uh, except for the endpoint that it's con, 548.08s - 551.52s | connecting to if you're in monitoring that or if you're looking at DNS, you can also get some 551.52s - 557.22s | information from that too. Um, and the C2 is did, usually gonna be SSL as well and beyond 557.22s - 561.64s | remote access Trojan traffic, everything. And then when they drop ransomware on there, it's 561.64s - 567.60s | just like you don't have visibility into the whole thing like you did maybe 15 years ago. Um, 567.62s - 574.30s


chunk_text:
have something that's watching your email? Uh, you maybe have a, uh, going to get that 522.76s - 528.70s | link over HTTP or you have an attachment already in the email. So, I mean, you hopefully 528.70s - 533.64s | detected it in the email and then your endpoint detection is hopefully catching that office 533.64s - 539.18s | doc with all the macros and it's seeing PowerShell run and it's stopping it. Um, uh, then 539.18s - 543.22s | installing additional components is probably gonna be over SSL. You're probably not gonna know 543.22s - 548.08s | that's, uh, something weird is happening. Uh, except for the endpoint that it's con, 548.08s - 551.52s | connecting to if you're in monitoring that or if you're looking at DNS, you can also get some 551.52s - 557.22s | information from that too. Um, and the C2 is did, usually gonna be SSL as well and beyond 557.22s - 561.64s | remote access Trojan traffic, everything. And then when they drop ransomware on there, it's 561.64s - 567.60s | just like you don't have visibility into the whole thing like you did maybe 15 years ago. Um, 567.62s - 574.30s | and here's an example like a iced ID dropper. Uh, it, it was a, you get it via over HTTP and 574.30s - 579.70s | then, uh, traffic starts right afterwards with SSL. So, you can capture that HTTP and maybe 579.70s - 585.68s | the SSL with some kind of magical behavioral analysis or in some cases stuff I'm showing you 585.68s - 590.88s | kinda catches it sometimes. Uh, there are solutions for this. I, when I give talks, I don't 590.88s - 595.38s | do vendor talks usually. So, I, I try to talk about free things. Um, there, I think Proxifier 595.40s - 601.14s | has a, a fee, but you, uh, enterprises like my company and other companies offer solutions to 601.14s - 605.18s | man in the middle of your SSL traffic. You have to install something on the, the clients and so 605.18s - 610.82s | you can intercept that stuff for better detection. Um, but you can also do it for free. Uh, so 610.82s - 615.92s | is this possible, this thing I'm talking about here? Well, let's find out. Um, I had this idea 615.92s - 620.56s | from


chunk_text:
| and here's an example like a iced ID dropper. Uh, it, it was a, you get it via over HTTP and 574.30s - 579.70s | then, uh, traffic starts right afterwards with SSL. So, you can capture that HTTP and maybe 579.70s - 585.68s | the SSL with some kind of magical behavioral analysis or in some cases stuff I'm showing you 585.68s - 590.88s | kinda catches it sometimes. Uh, there are solutions for this. I, when I give talks, I don't 590.88s - 595.38s | do vendor talks usually. So, I, I try to talk about free things. Um, there, I think Proxifier 595.40s - 601.14s | has a, a fee, but you, uh, enterprises like my company and other companies offer solutions to 601.14s - 605.18s | man in the middle of your SSL traffic. You have to install something on the, the clients and so 605.18s - 610.82s | you can intercept that stuff for better detection. Um, but you can also do it for free. Uh, so 610.82s - 615.92s | is this possible, this thing I'm talking about here? Well, let's find out. Um, I had this idea 615.92s - 620.56s | from a talk I gave a long, long time ago. I was looking at, these are really old samples. Um, 620.58s - 627.52s | these are the, okay, I'm not a data scientist, so ignore the numbers on the left. Um, I, uh, was 627.52s - 631.36s | plotting the time, I was plotting when things were happening with a sample like over the 631.36s - 636.96s | network. When does it make a GET or a PORT request or when's the SYN, SYNAC, uh, etc. Um, and 636.96s - 640.54s | it's a whole bunch of samples. And I was seeing there's a relationship between these samples, 640.54s - 645.60s | but I, I don't know, maybe, maybe not. Um, then I looked at Emotet samples. I, it's different 645.62s - 650.62s | than Hansitor. Um, it's different and they're related by the way, but they're, um, the traffic 653.26s - 656.70s | stuff is different. And then we look at Trickbot, same kind of thing. They're related to each 656.70s - 660.94s | other, very different from Hansitor and Emotet. I'm not gonna show you more examples of malware, 660.94s - 665.80s | but I was like, maybe there's


chunk_text:
a talk I gave a long, long time ago. I was looking at, these are really old samples. Um, 620.58s - 627.52s | these are the, okay, I'm not a data scientist, so ignore the numbers on the left. Um, I, uh, was 627.52s - 631.36s | plotting the time, I was plotting when things were happening with a sample like over the 631.36s - 636.96s | network. When does it make a GET or a PORT request or when's the SYN, SYNAC, uh, etc. Um, and 636.96s - 640.54s | it's a whole bunch of samples. And I was seeing there's a relationship between these samples, 640.54s - 645.60s | but I, I don't know, maybe, maybe not. Um, then I looked at Emotet samples. I, it's different 645.62s - 650.62s | than Hansitor. Um, it's different and they're related by the way, but they're, um, the traffic 653.26s - 656.70s | stuff is different. And then we look at Trickbot, same kind of thing. They're related to each 656.70s - 660.94s | other, very different from Hansitor and Emotet. I'm not gonna show you more examples of malware, 660.94s - 665.80s | but I was like, maybe there's an idea here of something I could explore. Um, so let's talk 665.80s - 671.24s | about finding some patterns and show like some examples. Um, I'll use dropper downloads. So 671.26s - 675.46s | when you first get that dropper, beginning out, um, and we'll have a little bit of SSL in there 675.46s - 679.46s | and then benign versus malicious, because in many cases I'm wondering, is this just how 679.46s - 684.00s | networking works the way that I'm doing this? Or is it bandwidth that's causing issues or not 684.00s - 689.30s | causing issues? Um, looking at dropper downloads first, I'll take two separatized ID 689.30s - 694.24s | downloads. Um, I'm getting these requests. I've got almost double the transactions on the top 694.24s - 700.14s | one than the bottom one. And, uh, the download is basically the same. Um, but so these, they 700.14s - 706.76s | look different, but in terms of how many transactions happen, um, I'll, uh, look at the timing 706.76s - 710.56s | in between these. Like, so when a transaction happens, then the next transaction and what's the 710.56s - 715.40s | timing between that.


chunk_text:
an idea here of something I could explore. Um, so let's talk 665.80s - 671.24s | about finding some patterns and show like some examples. Um, I'll use dropper downloads. So 671.26s - 675.46s | when you first get that dropper, beginning out, um, and we'll have a little bit of SSL in there 675.46s - 679.46s | and then benign versus malicious, because in many cases I'm wondering, is this just how 679.46s - 684.00s | networking works the way that I'm doing this? Or is it bandwidth that's causing issues or not 684.00s - 689.30s | causing issues? Um, looking at dropper downloads first, I'll take two separatized ID 689.30s - 694.24s | downloads. Um, I'm getting these requests. I've got almost double the transactions on the top 694.24s - 700.14s | one than the bottom one. And, uh, the download is basically the same. Um, but so these, they 700.14s - 706.76s | look different, but in terms of how many transactions happen, um, I'll, uh, look at the timing 706.76s - 710.56s | in between these. Like, so when a transaction happens, then the next transaction and what's the 710.56s - 715.40s | timing between that. And that's what I'm gonna be focusing on mostly in this talk. Um, and I, 715.40s - 718.96s | despite the difference in transactions, I'm seeing that there's a sort of a pattern just, you 718.96s - 726.70s | know, just using my meat brain. Um, I've got a big time and a small and larger, small, really 726.70s - 731.04s | big, smaller, et cetera. So I'm seeing a pattern. I'm wondering it, is this something I can work 731.04s - 738.54s | with? Um, let's look at beaconing. Um, this is over SSL Cobalt strike beaconing, two samples. Um, 738.54s - 744.12s | I, is this even, can I, am I gonna see the kind of same results or is this just how networking 744.12s - 749.22s | works? This is what I'm always asking myself. Is this just stuff I don't know about? Um, I look 749.22s - 752.86s | at it, I'm kind of seeing the same patterns where I get that big one and small one. So it's, it's 752.86s - 759.00s | still maybe, maybe it's just how it works. Um, I do emotet and trick bot beacons. Um, same kind 759.00s - 766.04s


chunk_text:
And that's what I'm gonna be focusing on mostly in this talk. Um, and I, 715.40s - 718.96s | despite the difference in transactions, I'm seeing that there's a sort of a pattern just, you 718.96s - 726.70s | know, just using my meat brain. Um, I've got a big time and a small and larger, small, really 726.70s - 731.04s | big, smaller, et cetera. So I'm seeing a pattern. I'm wondering it, is this something I can work 731.04s - 738.54s | with? Um, let's look at beaconing. Um, this is over SSL Cobalt strike beaconing, two samples. Um, 738.54s - 744.12s | I, is this even, can I, am I gonna see the kind of same results or is this just how networking 744.12s - 749.22s | works? This is what I'm always asking myself. Is this just stuff I don't know about? Um, I look 749.22s - 752.86s | at it, I'm kind of seeing the same patterns where I get that big one and small one. So it's, it's 752.86s - 759.00s | still maybe, maybe it's just how it works. Um, I do emotet and trick bot beacons. Um, same kind 759.00s - 766.04s | of thing. So I need to find something to show me a difference. I need two samples that are alike 766.04s - 769.94s | and I wanna know if they're, they behave differently. So benign versus malicious. Um, I 769.94s - 773.84s | downloaded this, uh, thing called existential.exe. I found it when I was looking for a benign 773.84s - 779.52s | exe file. It's, someone wrote it to look like a, a malicious dropper download, which is usually 779.52s - 785.76s | pretty small. Um, you can see I get it and I'm getting it from some site, a domain that I own. Um, 785.76s - 790.22s | and then I compared it with a malicious dropper download. I don't remember the malicious dropper, 790.22s - 795.50s | but I'm seeing there are some similarities, but it's starting to be different enough that I decided 795.50s - 800.70s | to explore further. So let's talk about the processes that I'm going to play with and use in 800.70s - 806.84s | this. I'm going to talk about averages, Levenstein distance, and some fuzziness. There's some 806.90s - 814.78s | challenges. Um, again, um, finding the part that


chunk_text:
| of thing. So I need to find something to show me a difference. I need two samples that are alike 766.04s - 769.94s | and I wanna know if they're, they behave differently. So benign versus malicious. Um, I 769.94s - 773.84s | downloaded this, uh, thing called existential.exe. I found it when I was looking for a benign 773.84s - 779.52s | exe file. It's, someone wrote it to look like a, a malicious dropper download, which is usually 779.52s - 785.76s | pretty small. Um, you can see I get it and I'm getting it from some site, a domain that I own. Um, 785.76s - 790.22s | and then I compared it with a malicious dropper download. I don't remember the malicious dropper, 790.22s - 795.50s | but I'm seeing there are some similarities, but it's starting to be different enough that I decided 795.50s - 800.70s | to explore further. So let's talk about the processes that I'm going to play with and use in 800.70s - 806.84s | this. I'm going to talk about averages, Levenstein distance, and some fuzziness. There's some 806.90s - 814.78s | challenges. Um, again, um, finding the part that I'm interested in. Uh, if you have, uh, network 814.78s - 819.84s | traffic, how do you find the bad stuff? I have malware, malware analysis sandboxes at home. We 819.84s - 825.12s | have them at work. We have them all available to us for free. Um, so you can find this stuff. Um, 825.12s - 830.06s | but if you have a, a PCAP full of stuff, how do you find it? And there's always, there's flows 830.06s - 833.62s | in, in a, in a huge PCAP file. You're gonna, these are the connections between all the 833.64s - 837.82s | different servers, or maybe just do one machine and all the places it connects to. So how do you 837.82s - 844.18s | separate all these flows in an efficient manner and then operate on them? Um, there are, as I 844.18s - 847.36s | mentioned, there are places we can go get stuff. I'm gonna use a lot of examples from malware 847.36s - 852.66s | traffic analysis for the awesome site. You can download, uh, an exact peak, like almost a 852.66s - 857.14s | carved PCAP. Sometimes there's extra data in there, but


chunk_text:
I'm interested in. Uh, if you have, uh, network 814.78s - 819.84s | traffic, how do you find the bad stuff? I have malware, malware analysis sandboxes at home. We 819.84s - 825.12s | have them at work. We have them all available to us for free. Um, so you can find this stuff. Um, 825.12s - 830.06s | but if you have a, a PCAP full of stuff, how do you find it? And there's always, there's flows 830.06s - 833.62s | in, in a, in a huge PCAP file. You're gonna, these are the connections between all the 833.64s - 837.82s | different servers, or maybe just do one machine and all the places it connects to. So how do you 837.82s - 844.18s | separate all these flows in an efficient manner and then operate on them? Um, there are, as I 844.18s - 847.36s | mentioned, there are places we can go get stuff. I'm gonna use a lot of examples from malware 847.36s - 852.66s | traffic analysis for the awesome site. You can download, uh, an exact peak, like almost a 852.66s - 857.14s | carved PCAP. Sometimes there's extra data in there, but of malicious stuff. And I'm going to use 857.14s - 862.24s | that for what I'm going to build signatures out of. Uh, so once I have a viable key PCAP, like I 862.26s - 868.40s | downloaded from malware traffic analysis, um, uh, like I'm gonna use this iced ID with cobalt 868.40s - 874.54s | strike. It's old, but, um, oh wait, I forget something. Oh yeah, once I have a viable PCAP, I, I 874.54s - 879.64s | can use that. So I'll play with the detection ideas. I'll play with the averages and I'm gonna 879.64s - 884.02s | look at co-integration. And, um, once again, I'm not a data scientist. I'm gonna talk about 884.02s - 887.86s | co-integration and I might mess it up a little bit, but I know how to make it work in the thing, 887.88s - 894.72s | sort of. So, um, averages first. Um, when I look at an isolated trick bot post from that viable 894.72s - 900.88s | PCAP that I download, I've got 840 queries. Um, I'll take the queries in between the 900.88s - 905.76s | transactions and I'll put them in a big list.


chunk_text:
of malicious stuff. And I'm going to use 857.14s - 862.24s | that for what I'm going to build signatures out of. Uh, so once I have a viable key PCAP, like I 862.26s - 868.40s | downloaded from malware traffic analysis, um, uh, like I'm gonna use this iced ID with cobalt 868.40s - 874.54s | strike. It's old, but, um, oh wait, I forget something. Oh yeah, once I have a viable PCAP, I, I 874.54s - 879.64s | can use that. So I'll play with the detection ideas. I'll play with the averages and I'm gonna 879.64s - 884.02s | look at co-integration. And, um, once again, I'm not a data scientist. I'm gonna talk about 884.02s - 887.86s | co-integration and I might mess it up a little bit, but I know how to make it work in the thing, 887.88s - 894.72s | sort of. So, um, averages first. Um, when I look at an isolated trick bot post from that viable 894.72s - 900.88s | PCAP that I download, I've got 840 queries. Um, I'll take the queries in between the 900.88s - 905.76s | transactions and I'll put them in a big list. And this is basically the entire PCAP in terms of 905.76s - 911.40s | time from the very beginning to the end from when it runs. And then I'll find the average. So, 911.40s - 915.54s | you know, I'll add them together and I'll divide them, um, and get the average number. So 915.56s - 921.68s | average time between is 12,748 for this one PCAP. And then, um, take another one. I've got a 921.68s - 927.76s | different set of queries, do the same thing. And I've got these, uh, averages that on their own 927.76s - 934.24s | don't look that similar. The number is 14, uh, 14, 748 and 16, 125 different, but I need to 934.24s - 938.20s | compare it to other stuff to see how related they might be to each other. So I'll compare this 938.20s - 945.00s | against some random traffic. I take a random PCAP just with stuff in it and it's got 779 945.00s - 950.26s | queries. And I'm also taking one flow from that random traffic just to add another thing, just 950.26s - 954.98s | 32 queries. So it's not that much data. And,


chunk_text:
And this is basically the entire PCAP in terms of 905.76s - 911.40s | time from the very beginning to the end from when it runs. And then I'll find the average. So, 911.40s - 915.54s | you know, I'll add them together and I'll divide them, um, and get the average number. So 915.56s - 921.68s | average time between is 12,748 for this one PCAP. And then, um, take another one. I've got a 921.68s - 927.76s | different set of queries, do the same thing. And I've got these, uh, averages that on their own 927.76s - 934.24s | don't look that similar. The number is 14, uh, 14, 748 and 16, 125 different, but I need to 934.24s - 938.20s | compare it to other stuff to see how related they might be to each other. So I'll compare this 938.20s - 945.00s | against some random traffic. I take a random PCAP just with stuff in it and it's got 779 945.00s - 950.26s | queries. And I'm also taking one flow from that random traffic just to add another thing, just 950.26s - 954.98s | 32 queries. So it's not that much data. And, um, when I look at it in this context, I'm seeing 954.98s - 959.14s | that there's a little bit more of a relationship between them. And if I scale this, I'm seeing 959.14s - 965.30s | even more of a relationship between them. I don't have that as a example, but, um, so I'm like 965.30s - 970.42s | feeling like I can continue on and explore this further. I'm going to talk about co-integration 970.44s - 976.00s | as another method. Um, so co-integration as described is usually a drunk guy and a dog are 976.00s - 979.76s | walking, they're walking together. So they're co-occurring with each other, but are they 979.76s - 985.00s | actually together? Um, so there's this model to, to run it against them. And if they start to move 985.00s - 988.76s | in a different direction, you can see that they, uh, they co-occurred, but they don't, didn't 988.76s - 992.76s | co-integrate. They're not actually together. They're just doing their own thing. Um, basically 992.76s - 998.72s | like that. And some of it's just, uh, some little parts, uh, to describe it. When I show some 998.72s - 1004.50s


chunk_text:
um, when I look at it in this context, I'm seeing 954.98s - 959.14s | that there's a little bit more of a relationship between them. And if I scale this, I'm seeing 959.14s - 965.30s | even more of a relationship between them. I don't have that as a example, but, um, so I'm like 965.30s - 970.42s | feeling like I can continue on and explore this further. I'm going to talk about co-integration 970.44s - 976.00s | as another method. Um, so co-integration as described is usually a drunk guy and a dog are 976.00s - 979.76s | walking, they're walking together. So they're co-occurring with each other, but are they 979.76s - 985.00s | actually together? Um, so there's this model to, to run it against them. And if they start to move 985.00s - 988.76s | in a different direction, you can see that they, uh, they co-occurred, but they don't, didn't 988.76s - 992.76s | co-integrate. They're not actually together. They're just doing their own thing. Um, basically 992.76s - 998.72s | like that. And some of it's just, uh, some little parts, uh, to describe it. When I show some 998.72s - 1004.50s | graphs, uh, P value, it's the probability that the relationship between those series is due to 1004.50s - 1009.54s | chance. And then there's a spread, which is the difference between the two actually co-integrated 1009.54s - 1014.38s | time series, um, to show how far they deviate from their, their long-term relationship with each 1014.38s - 1020.44s | other. Um, just some examples like Russia, Ukraine searches on Google, they, they, um, they, on 1020.44s - 1026.62s | the spread, they were together and they, they separated, um, away from the spread, but they did 1026.62s - 1030.28s | at the same time. So they're, they're co-integrated and they're, they stay together. Basically 1030.28s - 1035.16s | these are co-integrated co-occurring things happen at the same time. Um, Twitter and Elon Musk 1035.16s - 1040.08s | around that time, I think that's around when he took it over. Um, so they, they, they don't 1040.08s - 1044.88s | really, they're way off the spread. The timelines don't match up, but they come together right at 1044.88s - 1048.88s | the same time, uh, to zero on the spread right there. So there was a relationship because 1048.88s -


chunk_text:
| graphs, uh, P value, it's the probability that the relationship between those series is due to 1004.50s - 1009.54s | chance. And then there's a spread, which is the difference between the two actually co-integrated 1009.54s - 1014.38s | time series, um, to show how far they deviate from their, their long-term relationship with each 1014.38s - 1020.44s | other. Um, just some examples like Russia, Ukraine searches on Google, they, they, um, they, on 1020.44s - 1026.62s | the spread, they were together and they, they separated, um, away from the spread, but they did 1026.62s - 1030.28s | at the same time. So they're, they're co-integrated and they're, they stay together. Basically 1030.28s - 1035.16s | these are co-integrated co-occurring things happen at the same time. Um, Twitter and Elon Musk 1035.16s - 1040.08s | around that time, I think that's around when he took it over. Um, so they, they, they don't 1040.08s - 1044.88s | really, they're way off the spread. The timelines don't match up, but they come together right at 1044.88s - 1048.88s | the same time, uh, to zero on the spread right there. So there was a relationship because 1048.88s - 1052.76s | everyone's like, Oh, what's going on with this? And they're Googling it or whatever. And then, 1052.76s - 1056.30s | um, you know, 5G and COVID, I just had to put this in here because people were searching it. 1056.30s - 1060.38s | They, they matched, stayed on the spread all the time. And then they both searched the same 1060.38s - 1069.70s | time that people, whatever. Um, so two identical PCAP files. If I take the same exact ones, 1069.70s - 1074.78s | they're going to definitely co-integrate, um, uh, just as a test to see if I could do it, I 1074.78s - 1078.90s | guess, you know, and you've got, uh, I put a scatter plot here. The little numbers on the 1078.90s - 1082.84s | bottom are the times that in the milliseconds, um, and they're on top of each other. There's a 1082.84s - 1086.80s | blue value underneath the orange value. Of course, they're identical and the P value, which 1086.80s - 1092.28s | you want to be between zero and one. It's the probability value. Um, they matched exactly. So I 1092.28s - 1096.32s | want to try two different


chunk_text:
1052.76s | everyone's like, Oh, what's going on with this? And they're Googling it or whatever. And then, 1052.76s - 1056.30s | um, you know, 5G and COVID, I just had to put this in here because people were searching it. 1056.30s - 1060.38s | They, they matched, stayed on the spread all the time. And then they both searched the same 1060.38s - 1069.70s | time that people, whatever. Um, so two identical PCAP files. If I take the same exact ones, 1069.70s - 1074.78s | they're going to definitely co-integrate, um, uh, just as a test to see if I could do it, I 1074.78s - 1078.90s | guess, you know, and you've got, uh, I put a scatter plot here. The little numbers on the 1078.90s - 1082.84s | bottom are the times that in the milliseconds, um, and they're on top of each other. There's a 1082.84s - 1086.80s | blue value underneath the orange value. Of course, they're identical and the P value, which 1086.80s - 1092.28s | you want to be between zero and one. It's the probability value. Um, they matched exactly. So I 1092.28s - 1096.32s | want to try two different PCAP files. It doesn't matter what they are, if they're malware or not. 1096.32s - 1102.76s | Um, they won't co-integrate though. Uh, and, and they don't, the P value for file one is way off 1102.76s - 1107.60s | and, and the scatter plots just a mess. Um, and I'm starting to think that there may be some 1107.62s - 1113.06s | problems with co-integration, but there's maybe also a method to start finding similarities. Um, 1113.06s - 1120.10s | I'll try two different PCAP files with similar traffic. So this, these are benign, um, one to, uh, 1120.10s - 1126.18s | DigiCert and one to Windows Update, just some get requests. Um, when I map them, I've got a 1126.18s - 1130.38s | seconds marker. I'm using seconds here and most of the stuff I'm gonna use microseconds and I'll 1130.38s - 1136.72s | mention this in a second. Um, but at 48 seconds, then 50 seconds, then 53 seconds, then zero and 1136.72s - 1141.64s | that other one at 38 seconds and 46 rolling through time as we go forward. Um, and at the 1141.64s - 1146.42s | number of transactions at those seconds. Um, when


chunk_text:
PCAP files. It doesn't matter what they are, if they're malware or not. 1096.32s - 1102.76s | Um, they won't co-integrate though. Uh, and, and they don't, the P value for file one is way off 1102.76s - 1107.60s | and, and the scatter plots just a mess. Um, and I'm starting to think that there may be some 1107.62s - 1113.06s | problems with co-integration, but there's maybe also a method to start finding similarities. Um, 1113.06s - 1120.10s | I'll try two different PCAP files with similar traffic. So this, these are benign, um, one to, uh, 1120.10s - 1126.18s | DigiCert and one to Windows Update, just some get requests. Um, when I map them, I've got a 1126.18s - 1130.38s | seconds marker. I'm using seconds here and most of the stuff I'm gonna use microseconds and I'll 1130.38s - 1136.72s | mention this in a second. Um, but at 48 seconds, then 50 seconds, then 53 seconds, then zero and 1136.72s - 1141.64s | that other one at 38 seconds and 46 rolling through time as we go forward. Um, and at the 1141.64s - 1146.42s | number of transactions at those seconds. Um, when I map them, I get similar P values cause 1146.42s - 1151.36s | they're kind of similar. Um, the timing difference is a little bit off because one started later 1151.36s - 1156.66s | and one started earlier. Um, there are some problems as I mentioned with co-integration like, 1156.66s - 1161.34s | um, the time value. Uh, I've got this one and I've got this other one that has a huge one. I'm 1161.34s - 1166.54s | gonna get a scatter plot or, or data that the second one's gonna far exceed the other one. They 1166.56s - 1170.56s | aren't gonna really match up the way I want them to. Even if I'm doing just individual flows 1170.56s - 1175.76s | compared against each other. Um, as you can see, that's what I did here. I forgot that I put the 1175.76s - 1182.80s | slide here, but, um, the orange one keeps on going. The P values are different. So, um, uh, 1182.80s - 1187.92s | short sample size. In many cases, a flow will be very minimal. So, uh, I'm gonna get something 1187.92s - 1193.92s | where I, I can't do anything with it. So


chunk_text:
I map them, I get similar P values cause 1146.42s - 1151.36s | they're kind of similar. Um, the timing difference is a little bit off because one started later 1151.36s - 1156.66s | and one started earlier. Um, there are some problems as I mentioned with co-integration like, 1156.66s - 1161.34s | um, the time value. Uh, I've got this one and I've got this other one that has a huge one. I'm 1161.34s - 1166.54s | gonna get a scatter plot or, or data that the second one's gonna far exceed the other one. They 1166.56s - 1170.56s | aren't gonna really match up the way I want them to. Even if I'm doing just individual flows 1170.56s - 1175.76s | compared against each other. Um, as you can see, that's what I did here. I forgot that I put the 1175.76s - 1182.80s | slide here, but, um, the orange one keeps on going. The P values are different. So, um, uh, 1182.80s - 1187.92s | short sample size. In many cases, a flow will be very minimal. So, uh, I'm gonna get something 1187.92s - 1193.92s | where I, I can't do anything with it. So let me talk about time resolution. I just briefly 1194.00s - 1199.54s | mentioned I talk about this. Um, you have to decide where you, how much time you wanna work 1199.54s - 1204.44s | with. At the minutes resolution, you're not gonna get much data. It's gonna be spread out one per 1204.44s - 1209.54s | minute. And then, um, or all your transactions in a minute. The seconds you're gonna get some 1209.54s - 1213.02s | data, but it's not gonna be useful. Microseconds you get a lot more data. So I'm gonna work with 1213.02s - 1218.62s | microseconds. Uh, also normalization because things aren't starting at the same time. I want 1218.62s - 1223.56s | them to start at the same time. So I decided to make all PCAPs, um, or any network transactions 1223.96s - 1231.14s | throw through this to start at January 1st, 2000, just to get them to line up. Um, and, uh, this 1231.14s - 1235.34s | just sort of shows that I don't have to really describe it, but they show how they all start at 1235.34s - 1239.74s | the same time. Um, now talking about signatures and detection


chunk_text:
let me talk about time resolution. I just briefly 1194.00s - 1199.54s | mentioned I talk about this. Um, you have to decide where you, how much time you wanna work 1199.54s - 1204.44s | with. At the minutes resolution, you're not gonna get much data. It's gonna be spread out one per 1204.44s - 1209.54s | minute. And then, um, or all your transactions in a minute. The seconds you're gonna get some 1209.54s - 1213.02s | data, but it's not gonna be useful. Microseconds you get a lot more data. So I'm gonna work with 1213.02s - 1218.62s | microseconds. Uh, also normalization because things aren't starting at the same time. I want 1218.62s - 1223.56s | them to start at the same time. So I decided to make all PCAPs, um, or any network transactions 1223.96s - 1231.14s | throw through this to start at January 1st, 2000, just to get them to line up. Um, and, uh, this 1231.14s - 1235.34s | just sort of shows that I don't have to really describe it, but they show how they all start at 1235.34s - 1239.74s | the same time. Um, now talking about signatures and detection where it's getting a little more 1239.74s - 1243.42s | interesting, where I'm starting to play with actually building the signatures. Uh, I wanna 1243.42s - 1247.22s | separate the flows first. I'm gonna calculate percentages. I'm gonna do distance. I'm gonna do 1247.22s - 1251.92s | fuzziness and I'll involve, uh, Levenstein distance and other things. So first I have to 1251.92s - 1256.26s | separate these flows. As I showed before, it's a lot of flows inside network data. And if you're 1256.26s - 1261.52s | running this, uh, with like, you have Damon logger or you have TCP dump writing a packet, uh, 1261.52s - 1268.10s | capture to file on your, um, your logging systems. Um, and then you're, you're gonna have tons of 1268.10s - 1271.34s | data in there. You have to separate those flows. So I'm gonna operate against each flow 1271.34s - 1277.04s | individually. This is computationally, um, intense. So, uh, in my code I've made it so it's 1277.06s - 1281.64s | multiprocessing. At least there's that. Um, so when I run it, I, it'll just use whatever 1281.64s - 1287.40s | processing power you have. I'm using on this


chunk_text:
where it's getting a little more 1239.74s - 1243.42s | interesting, where I'm starting to play with actually building the signatures. Uh, I wanna 1243.42s - 1247.22s | separate the flows first. I'm gonna calculate percentages. I'm gonna do distance. I'm gonna do 1247.22s - 1251.92s | fuzziness and I'll involve, uh, Levenstein distance and other things. So first I have to 1251.92s - 1256.26s | separate these flows. As I showed before, it's a lot of flows inside network data. And if you're 1256.26s - 1261.52s | running this, uh, with like, you have Damon logger or you have TCP dump writing a packet, uh, 1261.52s - 1268.10s | capture to file on your, um, your logging systems. Um, and then you're, you're gonna have tons of 1268.10s - 1271.34s | data in there. You have to separate those flows. So I'm gonna operate against each flow 1271.34s - 1277.04s | individually. This is computationally, um, intense. So, uh, in my code I've made it so it's 1277.06s - 1281.64s | multiprocessing. At least there's that. Um, so when I run it, I, it'll just use whatever 1281.64s - 1287.40s | processing power you have. I'm using on this laptop and it was pretty fast for like a, um, a 1287.40s - 1292.98s | fairly large file. And so once I operate that, I get the average time between queries and the 1292.98s - 1297.12s | total queries. And I also get some other data. I added more after this point. Uh, and then I'm 1297.12s - 1303.36s | gonna calculate percentages because I'm ending up with these times and these averages and, uh, 1303.38s - 1307.56s | it's kind of messy. I want it to be smaller. I'm, I'm, I'm ultimately working towards a goal of 1307.56s - 1313.46s | building a small list of numbers that I can make into a signature. So when I take those 1313.46s - 1318.70s | frequencies, so I started off, I'm getting ahead of myself, those, um, numbers and the times in 1318.70s - 1323.60s | between. And I say, this time is what percentage of the entire PCAP. I do that for the whole 1323.60s - 1328.04s | thing. And I ended up with, there's a lot of zeros. And then there's a lot of times where it 1328.06s - 1333.24s | doesn't. Theoretically this whole list should equal a


chunk_text:
laptop and it was pretty fast for like a, um, a 1287.40s - 1292.98s | fairly large file. And so once I operate that, I get the average time between queries and the 1292.98s - 1297.12s | total queries. And I also get some other data. I added more after this point. Uh, and then I'm 1297.12s - 1303.36s | gonna calculate percentages because I'm ending up with these times and these averages and, uh, 1303.38s - 1307.56s | it's kind of messy. I want it to be smaller. I'm, I'm, I'm ultimately working towards a goal of 1307.56s - 1313.46s | building a small list of numbers that I can make into a signature. So when I take those 1313.46s - 1318.70s | frequencies, so I started off, I'm getting ahead of myself, those, um, numbers and the times in 1318.70s - 1323.60s | between. And I say, this time is what percentage of the entire PCAP. I do that for the whole 1323.60s - 1328.04s | thing. And I ended up with, there's a lot of zeros. And then there's a lot of times where it 1328.06s - 1333.24s | doesn't. Theoretically this whole list should equal a hundred. Um, I do some stuff to it and, uh, 1333.24s - 1337.30s | it doesn't quite equal a hundred after I get, after I deal with it. But if I look at just a quick 1337.30s - 1342.60s | look at just this raw percentage data, I'm kind of seeing the same traffic patterns between 1342.60s - 1347.88s | PCAPs. Uh, I had a little chaos. Like I said, I do some stuff to it. I take away those zeros, I 1347.88s - 1353.76s | round things. Um, uh, this, you add it up, it won't equal a hundred, but it's because I did 1353.78s - 1359.68s | stuff to it. But, um, it's all in my code, which you can see. Um, basically what I'm ending up 1359.68s - 1363.42s | with is something like this, where I have this list of numbers and I'm thinking, well, this is, 1363.42s - 1368.70s | okay, this is something. It represents the time of a transaction. Uh, so we can find exact 1368.70s - 1374.00s | matches, like the exact same thing and other PCAP data. And that's nice, but I'm looking for 1374.00s - 1381.60s | variations of malware.


chunk_text:
hundred. Um, I do some stuff to it and, uh, 1333.24s - 1337.30s | it doesn't quite equal a hundred after I get, after I deal with it. But if I look at just a quick 1337.30s - 1342.60s | look at just this raw percentage data, I'm kind of seeing the same traffic patterns between 1342.60s - 1347.88s | PCAPs. Uh, I had a little chaos. Like I said, I do some stuff to it. I take away those zeros, I 1347.88s - 1353.76s | round things. Um, uh, this, you add it up, it won't equal a hundred, but it's because I did 1353.78s - 1359.68s | stuff to it. But, um, it's all in my code, which you can see. Um, basically what I'm ending up 1359.68s - 1363.42s | with is something like this, where I have this list of numbers and I'm thinking, well, this is, 1363.42s - 1368.70s | okay, this is something. It represents the time of a transaction. Uh, so we can find exact 1368.70s - 1374.00s | matches, like the exact same thing and other PCAP data. And that's nice, but I'm looking for 1374.00s - 1381.60s | variations of malware. Like, um, when the new variant of today's hot malware drops, uh, because 1381.62s - 1388.66s | the last one was burned, um, how do we find it? Uh, so I look at percentages and distances. I've 1388.66s - 1392.70s | talked about Levenstein distance. And, um, let me go into that a little bit more. Uh, 1392.70s - 1398.70s | Levenstein distance, if you don't know, it's, uh, usually used on string data. And, um, uh, if 1398.70s - 1403.14s | you want to know like how far away the word kitten is from sitting, you replace that K with an S 1403.14s - 1407.44s | that's one distance. You place the E with an I that's a second distance. You add a G that's a 1407.44s - 1413.76s | third distance. So it's three, uh, distance from each other. And I was thinking maybe I could use 1413.76s - 1418.86s | this even on small bits of data and treat those numbers, not like integers, but, uh, like 1418.86s - 1427.00s | strings. So, uh, if we remember, I want to find this behavior, this little bad thing in this 1427.00s - 1433.60s | whatever thing. So I'll


chunk_text:
Like, um, when the new variant of today's hot malware drops, uh, because 1381.62s - 1388.66s | the last one was burned, um, how do we find it? Uh, so I look at percentages and distances. I've 1388.66s - 1392.70s | talked about Levenstein distance. And, um, let me go into that a little bit more. Uh, 1392.70s - 1398.70s | Levenstein distance, if you don't know, it's, uh, usually used on string data. And, um, uh, if 1398.70s - 1403.14s | you want to know like how far away the word kitten is from sitting, you replace that K with an S 1403.14s - 1407.44s | that's one distance. You place the E with an I that's a second distance. You add a G that's a 1407.44s - 1413.76s | third distance. So it's three, uh, distance from each other. And I was thinking maybe I could use 1413.76s - 1418.86s | this even on small bits of data and treat those numbers, not like integers, but, uh, like 1418.86s - 1427.00s | strings. So, uh, if we remember, I want to find this behavior, this little bad thing in this 1427.00s - 1433.60s | whatever thing. So I'll create my signature, um, which looks like this and it doesn't look that 1433.62s - 1442.34s | valuable. It's a bunch of ones and twos and that one. Um, and when I run it, uh, uh, on something 1442.36s - 1446.82s | using Levenstein distance, I get a number at the very end. That number are going up to a hundred 1446.82s - 1453.00s | equals the probability that I'm finding inside of flow is something that matches. Um, um, but I 1453.00s - 1457.12s | like, I can see if there's a lot of like 58, 67, there's one that's a hundred. That's the one I 1457.12s - 1463.04s | made my signature from. So of course it matches cause it's exactly identical. Um, so I'm starting 1463.04s - 1469.12s | to get somewhere where I can maybe be a little looser in my searching. Um, I'm just looking at 1469.20s - 1473.56s | that PCAP and seeing this, the thing I made a signature from. Um, but I need to be fuzzier with 1473.56s - 1478.64s | it. I needed to get a little bit looser. Um, there was something that was called fuzzy, was he, 1478.64s -


chunk_text:
create my signature, um, which looks like this and it doesn't look that 1433.62s - 1442.34s | valuable. It's a bunch of ones and twos and that one. Um, and when I run it, uh, uh, on something 1442.36s - 1446.82s | using Levenstein distance, I get a number at the very end. That number are going up to a hundred 1446.82s - 1453.00s | equals the probability that I'm finding inside of flow is something that matches. Um, um, but I 1453.00s - 1457.12s | like, I can see if there's a lot of like 58, 67, there's one that's a hundred. That's the one I 1457.12s - 1463.04s | made my signature from. So of course it matches cause it's exactly identical. Um, so I'm starting 1463.04s - 1469.12s | to get somewhere where I can maybe be a little looser in my searching. Um, I'm just looking at 1469.20s - 1473.56s | that PCAP and seeing this, the thing I made a signature from. Um, but I need to be fuzzier with 1473.56s - 1478.64s | it. I needed to get a little bit looser. Um, there was something that was called fuzzy, was he, 1478.64s - 1484.68s | which is so cool, but it's the fuzz now. Um, uh, so I'm using this to apply a different 1484.68s - 1490.24s | threshold, um, based on the Levenstein distance. When I run this, I'm going to get another number 1490.24s - 1495.36s | that's been modified. It still has the hundred for the signature match, but it has other numbers 1495.36s - 1501.24s | that I'm interested in, like the 75, uh, 67. Um, what are these numbers and what do they 1501.24s - 1510.72s | represent? So, um, can't remember if I opened the PCAP in this one. Let's see. I did not. So 1510.72s - 1514.68s | the signature made from this flow, as pointed out before, got these two other ones I'm interested 1514.68s - 1519.96s | in. Um, if I look at one of them, I get an exact match. Um, if I look at another one, it's exact 1519.96s - 1526.44s | match. Um, so that's interesting. I have no match on 67. So maybe there's a number I can pick 1526.44s - 1531.32s | that is my magical number. That's going to find this all the time. Um, there's some tuning


chunk_text:
1484.68s | which is so cool, but it's the fuzz now. Um, uh, so I'm using this to apply a different 1484.68s - 1490.24s | threshold, um, based on the Levenstein distance. When I run this, I'm going to get another number 1490.24s - 1495.36s | that's been modified. It still has the hundred for the signature match, but it has other numbers 1495.36s - 1501.24s | that I'm interested in, like the 75, uh, 67. Um, what are these numbers and what do they 1501.24s - 1510.72s | represent? So, um, can't remember if I opened the PCAP in this one. Let's see. I did not. So 1510.72s - 1514.68s | the signature made from this flow, as pointed out before, got these two other ones I'm interested 1514.68s - 1519.96s | in. Um, if I look at one of them, I get an exact match. Um, if I look at another one, it's exact 1519.96s - 1526.44s | match. Um, so that's interesting. I have no match on 67. So maybe there's a number I can pick 1526.44s - 1531.32s | that is my magical number. That's going to find this all the time. Um, there's some tuning 1531.32s - 1535.72s | involved because different malware campaigns are different with each other. And this is, um, 1535.72s - 1539.88s | I'll talk about this in the future work I'm going to work on, but just showing tuning. Um, I'm 1539.88s - 1545.96s | sorry to show you code. Um, but basically I'm looking as kind of described already. Um, the 1545.96s - 1551.08s | partial ratio is greater than my threshold. That's that partial ratio is from the fuzz thing. 1551.08s - 1554.52s | And Levenstein distance is less than my Levenstein threshold. So I'm working with these two 1554.52s - 1560.72s | variables. Um, and I just have to tune them depending on what I'm working with. Um, and I can 1560.72s - 1566.20s | set that, you know, at the very top of my code. And this is all in the read me on the GitHub. Uh, 1566.20s - 1574.28s | so if I go get two things, um, dark gate activity, I downloaded one from 1130, uh, 2023 and 12, 1574.28s - 1579.32s | seven, 2023, I don't think I could find, I wasn't able to find newer stuff than that. Um, just like 1579.32s


chunk_text:
1531.32s - 1535.72s | involved because different malware campaigns are different with each other. And this is, um, 1535.72s - 1539.88s | I'll talk about this in the future work I'm going to work on, but just showing tuning. Um, I'm 1539.88s - 1545.96s | sorry to show you code. Um, but basically I'm looking as kind of described already. Um, the 1545.96s - 1551.08s | partial ratio is greater than my threshold. That's that partial ratio is from the fuzz thing. 1551.08s - 1554.52s | And Levenstein distance is less than my Levenstein threshold. So I'm working with these two 1554.52s - 1560.72s | variables. Um, and I just have to tune them depending on what I'm working with. Um, and I can 1560.72s - 1566.20s | set that, you know, at the very top of my code. And this is all in the read me on the GitHub. Uh, 1566.20s - 1574.28s | so if I go get two things, um, dark gate activity, I downloaded one from 1130, uh, 2023 and 12, 1574.28s - 1579.32s | seven, 2023, I don't think I could find, I wasn't able to find newer stuff than that. Um, just like 1579.32s - 1588.89s | last week. But, um, uh, what I'm going to do is I'm going to carve out the bit I'm interested in 1588.89s - 1599.69s | from the 1130 one first. Uh, let me scroll down here to a post. So I'm finding, uh, this 1599.69s - 1606.41s | information here, this post that's a suspicious and we know it's bad. And I'm going to save this 1606.41s - 1611.53s | to create a signature out of it. So I'm just, I'm exporting just the displayed packets, 1611.53s - 1619.05s | saving it as dark gate post. And then, um, just showing you where it looks like this. It has no 1619.05s - 1623.93s | other flows in it. Just this one flow between these two servers. And then I'm going to upload 1623.93s - 1630.20s | this to create a signature. And when I uploaded it, it creates a really simple, like there's three, 1631.16s - 1635.40s | there's three numbers. It doesn't seem like I can do much with that, but I'll show you. 1637.16s - 1644.04s | And then when I go and I, um, upload the same file, I want to see the, I


chunk_text:
- 1588.89s | last week. But, um, uh, what I'm going to do is I'm going to carve out the bit I'm interested in 1588.89s - 1599.69s | from the 1130 one first. Uh, let me scroll down here to a post. So I'm finding, uh, this 1599.69s - 1606.41s | information here, this post that's a suspicious and we know it's bad. And I'm going to save this 1606.41s - 1611.53s | to create a signature out of it. So I'm just, I'm exporting just the displayed packets, 1611.53s - 1619.05s | saving it as dark gate post. And then, um, just showing you where it looks like this. It has no 1619.05s - 1623.93s | other flows in it. Just this one flow between these two servers. And then I'm going to upload 1623.93s - 1630.20s | this to create a signature. And when I uploaded it, it creates a really simple, like there's three, 1631.16s - 1635.40s | there's three numbers. It doesn't seem like I can do much with that, but I'll show you. 1637.16s - 1644.04s | And then when I go and I, um, upload the same file, I want to see the, I want to, 1644.04s - 1648.52s | I'm tuning it right now. So I'm getting a match, of course, on my exact match. Um, 1651.80s - 1656.04s | but if I look at some of the other ones below it there, um, I'm going to see some other 1656.04s - 1660.60s | additional matches here. So it's not quite tuned yet. I've got 11 sign distance of four, 1660.68s - 1665.72s | a ratio of 75%. I click on the very top one, which is the most matchy that didn't match. 1665.72s - 1675.08s | It's the same one. Um, I continue down the list and maybe go to 67%, um, uh, distance of four 1675.08s - 1681.40s | on 11 Stein. And I've got another match here. So I I'm, I've obviously got to fix the thresholds 1681.40s - 1689.61s | I'm working with. I look at 64%. Let's see what this is. And, uh, in this case, I'm not getting 1689.61s - 1699.53s | a match. So I'm starting to define the numbers I can work with. Now, um, uh, I look at this one, 1699.53s - 1707.53s | the 67%, it's a match. And so between 67 and


chunk_text:
want to, 1644.04s - 1648.52s | I'm tuning it right now. So I'm getting a match, of course, on my exact match. Um, 1651.80s - 1656.04s | but if I look at some of the other ones below it there, um, I'm going to see some other 1656.04s - 1660.60s | additional matches here. So it's not quite tuned yet. I've got 11 sign distance of four, 1660.68s - 1665.72s | a ratio of 75%. I click on the very top one, which is the most matchy that didn't match. 1665.72s - 1675.08s | It's the same one. Um, I continue down the list and maybe go to 67%, um, uh, distance of four 1675.08s - 1681.40s | on 11 Stein. And I've got another match here. So I I'm, I've obviously got to fix the thresholds 1681.40s - 1689.61s | I'm working with. I look at 64%. Let's see what this is. And, uh, in this case, I'm not getting 1689.61s - 1699.53s | a match. So I'm starting to define the numbers I can work with. Now, um, uh, I look at this one, 1699.53s - 1707.53s | the 67%, it's a match. And so between 67 and 64 is where I want to be 11 Stein five or four 1707.53s - 1712.25s | somewhere on there. And so I just want to adjust those values and play with it. Then we'll try this 1712.25s - 1716.41s | again. So I've, uh, unfortunately you've got to see me carve out that part again. I'm going to 1716.41s - 1719.45s | carve out a little bit different parts. So it's going to create a slightly different signature. 1719.45s - 1727.77s | Um, and, um, I think I ran it on, um, Oh, I, I think I ran it on the same one. Sorry. 1728.33s - 1733.21s | And I'm seeing my math, my don't matches, um, don't match and my matches match. So I've got 1733.21s - 1737.85s | this tuned and I can start applying it to other things. So now I want, now I'm going to upload 1737.85s - 1743.77s | the newest signature from 12 seven. This is a later PCAP different version, basically. And 1743.77s - 1748.41s | I'm looking at my matches and I'm getting, um, similar, but they're different things happening 1748.41s - 1755.13s | in there. It's the same kind of posts


chunk_text:
64 is where I want to be 11 Stein five or four 1707.53s - 1712.25s | somewhere on there. And so I just want to adjust those values and play with it. Then we'll try this 1712.25s - 1716.41s | again. So I've, uh, unfortunately you've got to see me carve out that part again. I'm going to 1716.41s - 1719.45s | carve out a little bit different parts. So it's going to create a slightly different signature. 1719.45s - 1727.77s | Um, and, um, I think I ran it on, um, Oh, I, I think I ran it on the same one. Sorry. 1728.33s - 1733.21s | And I'm seeing my math, my don't matches, um, don't match and my matches match. So I've got 1733.21s - 1737.85s | this tuned and I can start applying it to other things. So now I want, now I'm going to upload 1737.85s - 1743.77s | the newest signature from 12 seven. This is a later PCAP different version, basically. And 1743.77s - 1748.41s | I'm looking at my matches and I'm getting, um, similar, but they're different things happening 1748.41s - 1755.13s | in there. It's the same kind of posts to a different server. Um, basically, and the, 1755.69s - 1763.61s | I think if I show you two of them and then the, um, the ones that are in the not matching will 1763.61s - 1768.89s | show that they don't match. So I'm feeling a lot more confident about what I'm seeing here. 1768.89s - 1773.37s | Um, and I can apply it to other things. So I want to try an older signature, newer variant. This is 1773.37s - 1777.21s | the part I was saying, you have to watch me carve out the same thing again, but I'm going to carve 1777.21s - 1784.25s | it out from the 1130 and make a signature out of it. And then I'm going to, um, uh, I'll, 1784.25s - 1790.17s | I'll talk you through it. So I opened that up. I'll isolate the flow that I'm interested in. 1791.61s - 1797.53s | Uh, I keep on selecting that same get request, but basically I want to follow this post here 1800.94s - 1813.77s | and I'll save this and then, um, upload that to create my signature. And this is where I'm going 1813.77s - 1817.05s |


chunk_text:
to a different server. Um, basically, and the, 1755.69s - 1763.61s | I think if I show you two of them and then the, um, the ones that are in the not matching will 1763.61s - 1768.89s | show that they don't match. So I'm feeling a lot more confident about what I'm seeing here. 1768.89s - 1773.37s | Um, and I can apply it to other things. So I want to try an older signature, newer variant. This is 1773.37s - 1777.21s | the part I was saying, you have to watch me carve out the same thing again, but I'm going to carve 1777.21s - 1784.25s | it out from the 1130 and make a signature out of it. And then I'm going to, um, uh, I'll, 1784.25s - 1790.17s | I'll talk you through it. So I opened that up. I'll isolate the flow that I'm interested in. 1791.61s - 1797.53s | Uh, I keep on selecting that same get request, but basically I want to follow this post here 1800.94s - 1813.77s | and I'll save this and then, um, upload that to create my signature. And this is where I'm going 1813.77s - 1817.05s | to have some different numbers from the last one, because it's a slightly different transaction. 1818.33s - 1824.25s | And, um, I want to analyze against one, um, from six months later, uh, dark gate. So I was 1824.25s - 1829.29s | actually able to find a newer one. Um, and I'm getting a whole bunch of matches. So I can review 1829.29s - 1835.26s | those and I can go to the very bottom, which is the least matchy of the matches. And, um, 1836.38s - 1841.10s | Oh, actually, I guess I'm gonna look at the top one first. Um, no matter how many times I 1841.10s - 1845.98s | build these videos, I always forget what I did, but the very top one matches of course. 1845.98s - 1851.66s | And I can put this, throw this in the last search. If I want to, I'll get all those matches, 169 hits. 1851.66s - 1857.18s | Um, when I look at the signature, the signature is based off this, this visit to trans one, 1857.18s - 1862.86s | translate Google dot Google com.com misspelled type of squatting. And the bottom one is this 1862.86s - 1867.58s |


chunk_text:
to have some different numbers from the last one, because it's a slightly different transaction. 1818.33s - 1824.25s | And, um, I want to analyze against one, um, from six months later, uh, dark gate. So I was 1824.25s - 1829.29s | actually able to find a newer one. Um, and I'm getting a whole bunch of matches. So I can review 1829.29s - 1835.26s | those and I can go to the very bottom, which is the least matchy of the matches. And, um, 1836.38s - 1841.10s | Oh, actually, I guess I'm gonna look at the top one first. Um, no matter how many times I 1841.10s - 1845.98s | build these videos, I always forget what I did, but the very top one matches of course. 1845.98s - 1851.66s | And I can put this, throw this in the last search. If I want to, I'll get all those matches, 169 hits. 1851.66s - 1857.18s | Um, when I look at the signature, the signature is based off this, this visit to trans one, 1857.18s - 1862.86s | translate Google dot Google com.com misspelled type of squatting. And the bottom one is this 1862.86s - 1867.58s | same kind of post to a different place. Um, and I'm getting 169 matches. So that's pretty cool. 1868.22s - 1872.22s | Um, I've thought it'd be cool to add a map cause we all love maps or management loves maps. 1872.22s - 1880.46s | Um, and so it's thought to be cool that, um, red skulls are the bad locations. The unmapped 1880.46s - 1887.18s | things are black because you can't, I couldn't put a internal IP address on a map, but I put, 1887.18s - 1890.78s | I try to put them in the middle of the Pacific ocean when they're unmapped, but there are some 1890.78s - 1896.46s | other ones that actually get unmapped. So I'm working on that. Uh, production use. This is cool 1896.46s - 1900.70s | that you can use. You have a web app. If you're, I've been a stock analyst and I, um, pulled 1900.70s - 1905.58s | PCAPs down and I'm like, I open it up and I see what actually happened once the ideas rule fired. 1905.58s - 1910.86s | Um, but I'd be cool to have something like this where I could upload it, see what's happening,


chunk_text:
same kind of post to a different place. Um, and I'm getting 169 matches. So that's pretty cool. 1868.22s - 1872.22s | Um, I've thought it'd be cool to add a map cause we all love maps or management loves maps. 1872.22s - 1880.46s | Um, and so it's thought to be cool that, um, red skulls are the bad locations. The unmapped 1880.46s - 1887.18s | things are black because you can't, I couldn't put a internal IP address on a map, but I put, 1887.18s - 1890.78s | I try to put them in the middle of the Pacific ocean when they're unmapped, but there are some 1890.78s - 1896.46s | other ones that actually get unmapped. So I'm working on that. Uh, production use. This is cool 1896.46s - 1900.70s | that you can use. You have a web app. If you're, I've been a stock analyst and I, um, pulled 1900.70s - 1905.58s | PCAPs down and I'm like, I open it up and I see what actually happened once the ideas rule fired. 1905.58s - 1910.86s | Um, but I'd be cool to have something like this where I could upload it, see what's happening, 1910.86s - 1915.90s | see if it compares with anything in my database of signatures. Um, but there's other ways to do it. 1915.90s - 1920.14s | For example, I was talking about the Damon logger or TCP dump. If you're writing packets to, 1920.78s - 1929.82s | to your disc, how do you run this on a rolling basis? Um, so, uh, I wrote this as a fast API 1930.94s - 1936.30s | thing with, um, with flask running on top of it. Uh, so if I start this over on the left, 1936.30s - 1942.46s | I'm running my fast API app. And then on the right, I have a Python script, um, sending a 1942.46s - 1948.54s | PCAP and it sends it and gets back Jason data. And then I can, uh, refresh my, my, whatever my 1948.54s - 1953.58s | SIM is, it can be elastic search or anything else that you use or want to use and get those matches. 1953.58s - 1959.02s | So that's nice, at least for, um, for rolling PCAP. Uh, it, of course, as mentioned before, 1959.02s - 1963.10s | the multiprocessing happens when the flows are separated. So


chunk_text:
1910.86s - 1915.90s | see if it compares with anything in my database of signatures. Um, but there's other ways to do it. 1915.90s - 1920.14s | For example, I was talking about the Damon logger or TCP dump. If you're writing packets to, 1920.78s - 1929.82s | to your disc, how do you run this on a rolling basis? Um, so, uh, I wrote this as a fast API 1930.94s - 1936.30s | thing with, um, with flask running on top of it. Uh, so if I start this over on the left, 1936.30s - 1942.46s | I'm running my fast API app. And then on the right, I have a Python script, um, sending a 1942.46s - 1948.54s | PCAP and it sends it and gets back Jason data. And then I can, uh, refresh my, my, whatever my 1948.54s - 1953.58s | SIM is, it can be elastic search or anything else that you use or want to use and get those matches. 1953.58s - 1959.02s | So that's nice, at least for, um, for rolling PCAP. Uh, it, of course, as mentioned before, 1959.02s - 1963.10s | the multiprocessing happens when the flows are separated. So you want to do it on a fast machine, 1963.10s - 1968.22s | but generally machines that are doing, um, um, like, uh, packet capture are going to be fast. 1969.82s - 1973.66s | Additionally, just cause I thought it'd be fun. I, um, the, you can use notify, 1973.66s - 1980.54s | which is NTFI to like notify you. So when I run this again, I can get like a notification on my 1980.54s - 1987.42s | phone, which is kind of cool. Um, kind of cool. It could also be kind of terrible. For example, 1987.42s - 1993.10s | like you can get analyst fatigue when I did this and got a whole bunch of stuff. So I turned, 1993.10s - 2001.10s | I have that off on my system, but you can run it if you want to. Um, uh, because this, 2001.10s - 2005.02s | I'm gonna talk about something completely impractical. I love doing research because, 2005.02s - 2011.10s | um, uh, opens my mind to new things. I get to create and build things. I feel like this is a 2011.10s - 2017.18s | security research is a creative process and it, it fuels


chunk_text:
you want to do it on a fast machine, 1963.10s - 1968.22s | but generally machines that are doing, um, um, like, uh, packet capture are going to be fast. 1969.82s - 1973.66s | Additionally, just cause I thought it'd be fun. I, um, the, you can use notify, 1973.66s - 1980.54s | which is NTFI to like notify you. So when I run this again, I can get like a notification on my 1980.54s - 1987.42s | phone, which is kind of cool. Um, kind of cool. It could also be kind of terrible. For example, 1987.42s - 1993.10s | like you can get analyst fatigue when I did this and got a whole bunch of stuff. So I turned, 1993.10s - 2001.10s | I have that off on my system, but you can run it if you want to. Um, uh, because this, 2001.10s - 2005.02s | I'm gonna talk about something completely impractical. I love doing research because, 2005.02s - 2011.10s | um, uh, opens my mind to new things. I get to create and build things. I feel like this is a 2011.10s - 2017.18s | security research is a creative process and it, it fuels my other creative passions like music. 2017.18s - 2021.58s | Um, so I just wanted to play around with this and see if I could do something with audio. I don't 2021.58s - 2027.42s | know. It's not practical, but let's just see what happens. So I like this quote a lot. Art is how 2027.42s - 2032.22s | we decorate space. Music is how we decorate time. And I, I painted before I made things, 2032.22s - 2037.58s | built things to fill up the space we live in. I also make music and music is all based on time. 2037.58s - 2041.50s | You change the beat. It's completely different. You change a note and the length of the note 2041.50s - 2049.02s | is different. Um, so, uh, they're powerful things in their own areas. Um, and I was thinking, well, 2049.02s - 2053.10s | I'm playing with time. Let's see if I can make something musical with this. So, you know, 2053.10s - 2056.78s | although about Shazam, I'm sure I use it. I'm always in the, if I'm at a club, I'm in the 2056.78s - 2063.82s | corner like Shazamming. So, um, uh, you,


chunk_text:
my other creative passions like music. 2017.18s - 2021.58s | Um, so I just wanted to play around with this and see if I could do something with audio. I don't 2021.58s - 2027.42s | know. It's not practical, but let's just see what happens. So I like this quote a lot. Art is how 2027.42s - 2032.22s | we decorate space. Music is how we decorate time. And I, I painted before I made things, 2032.22s - 2037.58s | built things to fill up the space we live in. I also make music and music is all based on time. 2037.58s - 2041.50s | You change the beat. It's completely different. You change a note and the length of the note 2041.50s - 2049.02s | is different. Um, so, uh, they're powerful things in their own areas. Um, and I was thinking, well, 2049.02s - 2053.10s | I'm playing with time. Let's see if I can make something musical with this. So, you know, 2053.10s - 2056.78s | although about Shazam, I'm sure I use it. I'm always in the, if I'm at a club, I'm in the 2056.78s - 2063.82s | corner like Shazamming. So, um, uh, you, here's basically, you know, if you don't know how it 2063.82s - 2071.68s | works, this is what it looks like. Oh, that's not what it looks like. So you press Shazam, 2071.68s - 2076.24s | you hear a song you want to hear, and then, um, it tells you what it is. Add it to your Spotify 2076.24s - 2081.20s | playlist. You can listen to it over and over again. It's great. Sorry to rickroll you. Um, 2081.92s - 2087.52s | so I was researching this. I was like, could I do this with Python and, and, and NumPys? I found 2087.52s - 2091.92s | this article. I also found something called Deja Vu that someone wrote, um, that they wanted to 2091.92s - 2097.20s | make a, their own personal Shazam server where they could store their music. And if they had, 2097.20s - 2101.60s | they heard a sample of something, it would play that, it would listen for the sample, or you, 2101.60s - 2107.60s | you send it to Deja Vu and it would, um, uh, go, oh yeah, that's the song. Oh, I thought, 2107.60s - 2112.40s | oh, I can probably do


chunk_text:
here's basically, you know, if you don't know how it 2063.82s - 2071.68s | works, this is what it looks like. Oh, that's not what it looks like. So you press Shazam, 2071.68s - 2076.24s | you hear a song you want to hear, and then, um, it tells you what it is. Add it to your Spotify 2076.24s - 2081.20s | playlist. You can listen to it over and over again. It's great. Sorry to rickroll you. Um, 2081.92s - 2087.52s | so I was researching this. I was like, could I do this with Python and, and, and NumPys? I found 2087.52s - 2091.92s | this article. I also found something called Deja Vu that someone wrote, um, that they wanted to 2091.92s - 2097.20s | make a, their own personal Shazam server where they could store their music. And if they had, 2097.20s - 2101.60s | they heard a sample of something, it would play that, it would listen for the sample, or you, 2101.60s - 2107.60s | you send it to Deja Vu and it would, um, uh, go, oh yeah, that's the song. Oh, I thought, 2107.60s - 2112.40s | oh, I can probably do this. So I am back to my, my transactions, not the percentages, 2112.40s - 2117.12s | but the actual, the times in between the microseconds or milliseconds, or whatever 2117.12s - 2123.68s | time I was using or want to use. Um, and, uh, I'm looking at this and thinking about pitch. 2123.68s - 2130.24s | Frequency is the number. So zero would be a low, like a low sound and up high would be a high 2130.24s - 2134.56s | number is a high sound. So like I can make audio out of this. It's not going to be beautiful. I 2134.56s - 2140.64s | mean, um, you're going to hear it right now, what it sounds like when you listen to a PCAP file, 2141.60s - 2146.32s | but there's patterns in there. It's all, like I said, this is not practical, 2147.12s - 2151.04s | but let's play with this. Let's go same, same malware sample, different environments. 2151.04s - 2157.84s | Um, I'm gonna grab my malware. I grabbed from Malware Bazaar, uh, agent Tesla and old. Um, 2157.84s - 2162.96s | I ran it in any run, downloaded this, uh, the sample, just, I don't


chunk_text:
this. So I am back to my, my transactions, not the percentages, 2112.40s - 2117.12s | but the actual, the times in between the microseconds or milliseconds, or whatever 2117.12s - 2123.68s | time I was using or want to use. Um, and, uh, I'm looking at this and thinking about pitch. 2123.68s - 2130.24s | Frequency is the number. So zero would be a low, like a low sound and up high would be a high 2130.24s - 2134.56s | number is a high sound. So like I can make audio out of this. It's not going to be beautiful. I 2134.56s - 2140.64s | mean, um, you're going to hear it right now, what it sounds like when you listen to a PCAP file, 2141.60s - 2146.32s | but there's patterns in there. It's all, like I said, this is not practical, 2147.12s - 2151.04s | but let's play with this. Let's go same, same malware sample, different environments. 2151.04s - 2157.84s | Um, I'm gonna grab my malware. I grabbed from Malware Bazaar, uh, agent Tesla and old. Um, 2157.84s - 2162.96s | I ran it in any run, downloaded this, uh, the sample, just, I don't know why download sample. 2162.96s - 2169.20s | I always do. Um, and I get the PCAP and then, um, I can see that it's like doing a post. 2169.20s - 2172.88s | And in this case, I'm not going to be applying my Levenstein stuff. I'm just playing with audio. 2172.88s - 2178.48s | Um, but I, I see there's a post here and I also want to address the idea of bandwidth. 2178.48s - 2181.60s | That's why I'm running this any run. Then I'm also going to run at my own very busy network 2181.60s - 2187.68s | environment at home. Um, I run it on my system. This is just a picture of one of my malware VMs 2187.68s - 2191.92s | and I've got the same kind of post happening. I'm going to have different times, transaction 2191.92s - 2198.00s | times because of bandwidth, but, um, and I'm going to just say that. So there's a little bit of 2198.00s - 2202.16s | stuff here. I have to reverse it. I'm instead going to be making a signature out of the entire 2202.16s - 2208.00s | PCAP, not the little bit. So like I


chunk_text:
know why download sample. 2162.96s - 2169.20s | I always do. Um, and I get the PCAP and then, um, I can see that it's like doing a post. 2169.20s - 2172.88s | And in this case, I'm not going to be applying my Levenstein stuff. I'm just playing with audio. 2172.88s - 2178.48s | Um, but I, I see there's a post here and I also want to address the idea of bandwidth. 2178.48s - 2181.60s | That's why I'm running this any run. Then I'm also going to run at my own very busy network 2181.60s - 2187.68s | environment at home. Um, I run it on my system. This is just a picture of one of my malware VMs 2187.68s - 2191.92s | and I've got the same kind of post happening. I'm going to have different times, transaction 2191.92s - 2198.00s | times because of bandwidth, but, um, and I'm going to just say that. So there's a little bit of 2198.00s - 2202.16s | stuff here. I have to reverse it. I'm instead going to be making a signature out of the entire 2202.16s - 2208.00s | PCAP, not the little bit. So like I said, not practical, but, um, and then I'm going to play 2208.00s - 2214.64s | my little bit and see if it finds it. Um, uh, if I open up this PCAP, let's see here. 2215.52s - 2224.08s | And we're looking at that post. Um, I've got to create an audio file from it. So I have a little 2224.08s - 2230.48s | Python script I wrote to convert those frequencies into different pitches, um, using Fourier transform 2230.48s - 2234.56s | and some other stuff. Um, and in the back you can see there's a bunch of MP3s being made, 2234.56s - 2237.60s | then they'll all disappear. Those are all the flows individually. And then they get combined 2237.60s - 2246.72s | into one big PCAP MP3. And then I'm left with that thing. And then I've got, um, a carved one. 2246.72s - 2251.44s | This is the little tiny bit that I want to identify in my Shazam. Um, I'm going to do the 2251.44s - 2258.08s | same thing with that. Um, I've got that MP3 file, which is huge by the way, compared to the PCAP, 2258.08s - 2262.96s | which is like


chunk_text:
said, not practical, but, um, and then I'm going to play 2208.00s - 2214.64s | my little bit and see if it finds it. Um, uh, if I open up this PCAP, let's see here. 2215.52s - 2224.08s | And we're looking at that post. Um, I've got to create an audio file from it. So I have a little 2224.08s - 2230.48s | Python script I wrote to convert those frequencies into different pitches, um, using Fourier transform 2230.48s - 2234.56s | and some other stuff. Um, and in the back you can see there's a bunch of MP3s being made, 2234.56s - 2237.60s | then they'll all disappear. Those are all the flows individually. And then they get combined 2237.60s - 2246.72s | into one big PCAP MP3. And then I'm left with that thing. And then I've got, um, a carved one. 2246.72s - 2251.44s | This is the little tiny bit that I want to identify in my Shazam. Um, I'm going to do the 2251.44s - 2258.08s | same thing with that. Um, I've got that MP3 file, which is huge by the way, compared to the PCAP, 2258.08s - 2262.96s | which is like 500 K or something. Uh, it's not that huge, but I've got others that are huger. 2262.96s - 2266.96s | Um, same kind of, so I've got my carved one here. I'm going to make the signature from this one 2269.56s - 2272.52s | and you see a bunch of it's card, but those flows in there, 2273.64s - 2277.24s | cause I didn't carve it all the way. And I've got these two MP3 files. 2278.20s - 2286.41s | Let's see. Uh, so now I'm going to try to identify it. Um, initially when I, uh, try to identify, 2286.41s - 2290.17s | it's not going to see it. Cause I have to add it to a database, a deja vu database. It's not like 2290.17s - 2295.29s | a clean like app, like Shazam. It's just a program you can run. So I try to recognize it. It's not 2295.29s - 2298.81s | going to recognize my file yet, but that's because I haven't added it. So what I'm going to do is 2298.81s - 2303.77s | I'm about to add it. I got to drop it into the signatures folder, um, which I'm going to do right


chunk_text:
500 K or something. Uh, it's not that huge, but I've got others that are huger. 2262.96s - 2266.96s | Um, same kind of, so I've got my carved one here. I'm going to make the signature from this one 2269.56s - 2272.52s | and you see a bunch of it's card, but those flows in there, 2273.64s - 2277.24s | cause I didn't carve it all the way. And I've got these two MP3 files. 2278.20s - 2286.41s | Let's see. Uh, so now I'm going to try to identify it. Um, initially when I, uh, try to identify, 2286.41s - 2290.17s | it's not going to see it. Cause I have to add it to a database, a deja vu database. It's not like 2290.17s - 2295.29s | a clean like app, like Shazam. It's just a program you can run. So I try to recognize it. It's not 2295.29s - 2298.81s | going to recognize my file yet, but that's because I haven't added it. So what I'm going to do is 2298.81s - 2303.77s | I'm about to add it. I got to drop it into the signatures folder, um, which I'm going to do right 2304.73s - 2317.07s | now, slowly drop it in there. I'm going to run a script to, um, have it identify that. So it 2317.07s - 2321.39s | sees it. It's like, now there's a signature for this, this audio file, this song of yours. 2322.59s - 2328.59s | And then, um, I want to recognize the file, the just my, just my part. And it's seeing, 2328.59s - 2335.63s | there's a song ID recognized, um, this, uh, this traffic pattern that we're seeing. 2335.63s - 2338.75s | And if I apply Levenstein to it, which I didn't do in this example, because I don't want to bore 2338.75s - 2345.95s | you with like more of this, um, running commands, but, um, it gets even more interesting. But of 2345.95s - 2350.43s | course, like I said, many times it's not practical because those, those P gap files can grow to huge 2350.43s - 2356.75s | sizes where they're empty threes and who wants to run their network and three mode. So maybe I do, 2356.75s - 2361.95s | but I guess I kind of talked fast. I'm kind of getting towards the end here. It's supposed to


chunk_text:
2304.73s - 2317.07s | now, slowly drop it in there. I'm going to run a script to, um, have it identify that. So it 2317.07s - 2321.39s | sees it. It's like, now there's a signature for this, this audio file, this song of yours. 2322.59s - 2328.59s | And then, um, I want to recognize the file, the just my, just my part. And it's seeing, 2328.59s - 2335.63s | there's a song ID recognized, um, this, uh, this traffic pattern that we're seeing. 2335.63s - 2338.75s | And if I apply Levenstein to it, which I didn't do in this example, because I don't want to bore 2338.75s - 2345.95s | you with like more of this, um, running commands, but, um, it gets even more interesting. But of 2345.95s - 2350.43s | course, like I said, many times it's not practical because those, those P gap files can grow to huge 2350.43s - 2356.75s | sizes where they're empty threes and who wants to run their network and three mode. So maybe I do, 2356.75s - 2361.95s | but I guess I kind of talked fast. I'm kind of getting towards the end here. It's supposed to go 2361.95s - 2367.71s | for, uh, 50 minutes or 55 minutes, but you can go get some coffee. But so going further, 2367.71s - 2371.63s | I've been working on some third party API APIs. Like I said, I like to, when I release stuff 2371.63s - 2375.63s | personally and whether that's not a work talk, I, um, I want people to be able to try it and 2375.63s - 2380.35s | play with it if you want to. Um, so you can, you can add stuff if you want integrations with virus 2380.35s - 2385.87s | total with my company's product, investigate or other things like that. Um, uh, I didn't add it. 2385.87s - 2391.23s | It's very easy to add. Um, then you can look at things like domain IP reputation relationships. 2391.23s - 2394.59s | If you have a sinkhole in your environment, you can pull that data in. You could play with 2394.59s - 2400.99s | anything you have. And, um, to, to add more things with conviction. Um, and I'll analyze 2400.99s - 2405.39s | various components of the P caps so I can add that in the future. And I should


chunk_text:
go 2361.95s - 2367.71s | for, uh, 50 minutes or 55 minutes, but you can go get some coffee. But so going further, 2367.71s - 2371.63s | I've been working on some third party API APIs. Like I said, I like to, when I release stuff 2371.63s - 2375.63s | personally and whether that's not a work talk, I, um, I want people to be able to try it and 2375.63s - 2380.35s | play with it if you want to. Um, so you can, you can add stuff if you want integrations with virus 2380.35s - 2385.87s | total with my company's product, investigate or other things like that. Um, uh, I didn't add it. 2385.87s - 2391.23s | It's very easy to add. Um, then you can look at things like domain IP reputation relationships. 2391.23s - 2394.59s | If you have a sinkhole in your environment, you can pull that data in. You could play with 2394.59s - 2400.99s | anything you have. And, um, to, to add more things with conviction. Um, and I'll analyze 2400.99s - 2405.39s | various components of the P caps so I can add that in the future. And I should probably learn rust. 2405.39s - 2409.63s | I should learn something. So it's fast. Like, you know, how snort is a C binary or I think it's a C 2409.63s - 2415.15s | binary and it uses its rules. It runs very fast streaming. I'd love to do that. Um, the code is 2415.15s - 2420.43s | available. It's a long name, but, um, if you want, I just uploaded it about two days ago. 2420.43s - 2424.35s | So hopefully it's okay. There's a couple of things you have to do if you want to play with it. 2424.35s - 2431.47s | But I, um, uh, I was very, uh, very verbose in my documentation on the read me. Um, and there's a 2431.47s - 2436.67s | couple of utilities too. I added a malware traffic analysis unzipper file cause the, as a password 2436.67s - 2441.23s | scheme. So if you want to unzip malware traffic analysis, P caps, you can do that. Um, you can 2441.23s - 2446.75s | reach me at my website, my personal site, which is pyrosec.com. And, um, not a Twitter because I 2446.75s - 2451.55s | just don't post, don't even really


chunk_text:
probably learn rust. 2405.39s - 2409.63s | I should learn something. So it's fast. Like, you know, how snort is a C binary or I think it's a C 2409.63s - 2415.15s | binary and it uses its rules. It runs very fast streaming. I'd love to do that. Um, the code is 2415.15s - 2420.43s | available. It's a long name, but, um, if you want, I just uploaded it about two days ago. 2420.43s - 2424.35s | So hopefully it's okay. There's a couple of things you have to do if you want to play with it. 2424.35s - 2431.47s | But I, um, uh, I was very, uh, very verbose in my documentation on the read me. Um, and there's a 2431.47s - 2436.67s | couple of utilities too. I added a malware traffic analysis unzipper file cause the, as a password 2436.67s - 2441.23s | scheme. So if you want to unzip malware traffic analysis, P caps, you can do that. Um, you can 2441.23s - 2446.75s | reach me at my website, my personal site, which is pyrosec.com. And, um, not a Twitter because I 2446.75s - 2451.55s | just don't post, don't even really look at it anymore. And I'll probably rewrite all my posts 2451.55s - 2456.35s | with nonsense. Um, and bastard on, I don't even have the app installed, but I should cause it's 2456.35s - 2470.19s | kind of cool. But anyways, that's my talk and thank you for coming. There's time for questions. 2470.19s - 2491.76s | If you have questions. Well, um, I was a lot, a lot of the time I was working in a clean 2491.76s - 2497.76s | environment for the most part. Um, but I did run stuff over my network at home, which I know 2497.76s - 2504.64s | that's crazy, but I would, I do it. And, um, I didn't see negative results, but my, my network 2504.64s - 2510.72s | is busy. It's not a corporate environment. I have, I have like 20 VMs and three or four servers. 2510.72s - 2516.96s | And so it's busy, but yeah, I have, I have a family Spotify, you know, the whole Netflix, 2516.96s - 2526.35s | YouTube. What's that? Yeah. Yeah. It shows promise. I want to keep exploring it. 2527.23s - 2542.19s | Yeah. Oh, sorry. Say again. No, but that's


chunk_text:
look at it anymore. And I'll probably rewrite all my posts 2451.55s - 2456.35s | with nonsense. Um, and bastard on, I don't even have the app installed, but I should cause it's 2456.35s - 2470.19s | kind of cool. But anyways, that's my talk and thank you for coming. There's time for questions. 2470.19s - 2491.76s | If you have questions. Well, um, I was a lot, a lot of the time I was working in a clean 2491.76s - 2497.76s | environment for the most part. Um, but I did run stuff over my network at home, which I know 2497.76s - 2504.64s | that's crazy, but I would, I do it. And, um, I didn't see negative results, but my, my network 2504.64s - 2510.72s | is busy. It's not a corporate environment. I have, I have like 20 VMs and three or four servers. 2510.72s - 2516.96s | And so it's busy, but yeah, I have, I have a family Spotify, you know, the whole Netflix, 2516.96s - 2526.35s | YouTube. What's that? Yeah. Yeah. It shows promise. I want to keep exploring it. 2527.23s - 2542.19s | Yeah. Oh, sorry. Say again. No, but that's what I mentioned in like that stuff. I want to explore 2542.19s - 2547.15s | future stuff and that's easy enough to do a direction. That's also good to play with. I 2547.15s - 2551.71s | started to play with it with a mapping, like making the source changes constantly. So, 2553.95s - 2562.27s | oh yeah. Oh, that's really cool. I'd love to talk. Yeah. All right. Thank you very much.


chunk_text:
what I mentioned in like that stuff. I want to explore 2542.19s - 2547.15s | future stuff and that's easy enough to do a direction. That's also good to play with. I 2547.15s - 2551.71s | started to play with it with a mapping, like making the source changes constantly. So, 2553.95s - 2562.27s | oh yeah. Oh, that's really cool. I'd love to talk. Yeah. All right. Thank you very much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=0Zn5nj0NZVo", "title": "DEF CON 32 - RFID 101 - Ege Feyzioglu & Andrew M", "description": "You know the sound of beep... Click when using a badge to enter a door to a building, but how does this work and how can you hack it? This talk will explain the basics of what\u2019s inside the readers and the badges, and how they communicate wirelessly. You will learn about the common tools available (Proxmark, Flipper, Keysy), how to get one and how to use it. We\u2019ll talk about techniques to clone badges, and brute force systems to get access you never had in the first place.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1256, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.00s | This text was transcribed using whisper model: large-v2 Alright everyone, thank you so much for coming to the RFID talk. 3.00s - 7.00s | This is going to be a quick introduction to how RFID works 7.00s - 11.00s | and what you can do to, you know, play around with it, 11.00s - 14.00s | have a little fun and 14.00s - 18.00s | hopefully we will end with some 18.00s - 23.00s | suggestions on how we can make RFID a little bit safer 23.00s - 26.00s | and what the common problems are. 26.00s - 29.00s | And then we're going to end with a quick demonstration on 29.00s - 32.00s | how to use the Flipper Zero. I'm sure 32.00s - 36.00s | y'all are very familiar with that. If not, we're going to introduce you to that as well. 36.00s - 40.34s | So, oh yeah, before that, introductions. 40.34s - 43.34s | My name is Ege, that's spelled like that, 43.34s - 46.34s | the top name that you see over there. 46.34s - 48.34s | We're from the physical security village. 48.34s - 52.34s | If you like what you see here and would like to see more of the 52.34s - 56.34s | physical side of, like physical security side of DEF CON, 56.34s - 59.34s | please be sure to come by the village. 59.34s - 62.34s | It's going to be in the map and also we're going to be, 62.34s - 66.34s | you can just walk around and look for people wearing weirdly green shirts. 66.34s - 69.34s | Thank you. I'm Andrew Marchment. 69.34s - 71.34s


chunk_text:
can make RFID a little bit safer 23.00s - 26.00s | and what the common problems are. 26.00s - 29.00s | And then we're going to end with a quick demonstration on 29.00s - 32.00s | how to use the Flipper Zero. I'm sure 32.00s - 36.00s | y'all are very familiar with that. If not, we're going to introduce you to that as well. 36.00s - 40.34s | So, oh yeah, before that, introductions. 40.34s - 43.34s | My name is Ege, that's spelled like that, 43.34s - 46.34s | the top name that you see over there. 46.34s - 48.34s | We're from the physical security village. 48.34s - 52.34s | If you like what you see here and would like to see more of the 52.34s - 56.34s | physical side of, like physical security side of DEF CON, 56.34s - 59.34s | please be sure to come by the village. 59.34s - 62.34s | It's going to be in the map and also we're going to be, 62.34s - 66.34s | you can just walk around and look for people wearing weirdly green shirts. 66.34s - 69.34s | Thank you. I'm Andrew Marchment. 69.34s - 71.34s | I'm the second name on there. 71.34s - 75.34s | I work in the store of the physical security village in the vendor area. 75.34s - 78.34s | We're very happy to have partnered with 78.34s - 81.34s | the Keyport guys this year to offer a discount 81.34s - 84.34s | for people buying Keyport key organizers. 84.34s - 88.34s | And we're also partnered with Covert Instruments to offer some of their inventory at our store. 89.34s - 92.34s | So if you've seen Lockpicking Lawyer or McNally 92.34s - 96.34s | and you want some of those tools, we are retailing them at our store. 96.34s - 98.34s | So come by later. 98.34s - 102.34s | My background is in satellite telecom, so I'm more of a high frequency RF guy. 102.34s - 107.34s | But I'm doing this talk today on how to use the Flipper Zero 107.34s - 112.34s | and other RFID cloning tools and how RFID works. 112.34s - 115.34s | So we'll get started. 115.34s - 118.34s | All right. So yeah, RFID. Sorry about that false start there. 118.34s - 120.34s | RFID, we see it all around us.


chunk_text:
| I'm the second name on there. 71.34s - 75.34s | I work in the store of the physical security village in the vendor area. 75.34s - 78.34s | We're very happy to have partnered with 78.34s - 81.34s | the Keyport guys this year to offer a discount 81.34s - 84.34s | for people buying Keyport key organizers. 84.34s - 88.34s | And we're also partnered with Covert Instruments to offer some of their inventory at our store. 89.34s - 92.34s | So if you've seen Lockpicking Lawyer or McNally 92.34s - 96.34s | and you want some of those tools, we are retailing them at our store. 96.34s - 98.34s | So come by later. 98.34s - 102.34s | My background is in satellite telecom, so I'm more of a high frequency RF guy. 102.34s - 107.34s | But I'm doing this talk today on how to use the Flipper Zero 107.34s - 112.34s | and other RFID cloning tools and how RFID works. 112.34s - 115.34s | So we'll get started. 115.34s - 118.34s | All right. So yeah, RFID. Sorry about that false start there. 118.34s - 120.34s | RFID, we see it all around us. 120.34s - 125.34s | We see it whenever we tap our key fob to get into our building at work. 125.34s - 128.34s | When we tap our badge, whenever we go on transit 128.34s - 130.34s | and we use one of those contactless cards 130.34s - 134.34s | or even when we pay with either, you know, tap with your card 134.34s - 137.34s | or Apple Pay or Google Wallet or whatever. 137.34s - 141.34s | But something that we don't necessarily always think about 141.34s - 143.34s | is how these darn things work. 143.34s - 146.34s | So you want to run us through it? Sure. 146.34s - 150.34s | All right. So it's basically a transformer that you're making 150.34s - 153.34s | when you bring your card up to a reader. 153.34s - 156.34s | So the reader has a coil of wire 156.34s - 160.34s | and we're passing an electrical current through that coil at all times. 160.34s - 163.34s | As that card approaches, we're completing the circuit 163.34s - 168.34s | and the magnetic field that comes around that original coil 168.34s - 172.34s | induces a current in


chunk_text:
120.34s - 125.34s | We see it whenever we tap our key fob to get into our building at work. 125.34s - 128.34s | When we tap our badge, whenever we go on transit 128.34s - 130.34s | and we use one of those contactless cards 130.34s - 134.34s | or even when we pay with either, you know, tap with your card 134.34s - 137.34s | or Apple Pay or Google Wallet or whatever. 137.34s - 141.34s | But something that we don't necessarily always think about 141.34s - 143.34s | is how these darn things work. 143.34s - 146.34s | So you want to run us through it? Sure. 146.34s - 150.34s | All right. So it's basically a transformer that you're making 150.34s - 153.34s | when you bring your card up to a reader. 153.34s - 156.34s | So the reader has a coil of wire 156.34s - 160.34s | and we're passing an electrical current through that coil at all times. 160.34s - 163.34s | As that card approaches, we're completing the circuit 163.34s - 168.34s | and the magnetic field that comes around that original coil 168.34s - 172.34s | induces a current in the coil inside of your card 172.34s - 175.34s | and that powers a little chip in there 175.34s - 182.34s | that actually allows it to respond to the reader with its ID. 182.34s - 186.34s | Yeah. So this is kind of a simplified view 186.34s - 192.34s | of what the inside of one of those tags looks like. 192.34s - 196.34s | What it basically does is it draws more or less current 196.34s - 198.34s | to send a one or a zero. 198.34s - 201.34s | There are other ways as well. It gets a little bit more complicated. 201.34s - 204.34s | But on the very basic end of it, this is what it looks like inside. 204.34s - 206.34s | And what that looks like, 206.34s - 210.34s | if you were to measure the magnetic field around it, 210.34s - 213.34s | is the magnetic field is either high, 213.34s - 216.34s | like you see how those pulses, 216.34s - 219.34s | or it's a lower magnetic field measured 219.34s - 223.34s | because the chip is loading that magnetic field, 223.34s - 225.34s | drawing energy out of it,


chunk_text:
the coil inside of your card 172.34s - 175.34s | and that powers a little chip in there 175.34s - 182.34s | that actually allows it to respond to the reader with its ID. 182.34s - 186.34s | Yeah. So this is kind of a simplified view 186.34s - 192.34s | of what the inside of one of those tags looks like. 192.34s - 196.34s | What it basically does is it draws more or less current 196.34s - 198.34s | to send a one or a zero. 198.34s - 201.34s | There are other ways as well. It gets a little bit more complicated. 201.34s - 204.34s | But on the very basic end of it, this is what it looks like inside. 204.34s - 206.34s | And what that looks like, 206.34s - 210.34s | if you were to measure the magnetic field around it, 210.34s - 213.34s | is the magnetic field is either high, 213.34s - 216.34s | like you see how those pulses, 216.34s - 219.34s | or it's a lower magnetic field measured 219.34s - 223.34s | because the chip is loading that magnetic field, 223.34s - 225.34s | drawing energy out of it, 225.34s - 228.34s | and that is it's talking to the transmitter. 228.34s - 231.34s | So something obvious that you might realize 231.34s - 235.34s | is this is very easy to mess with. 235.34s - 238.34s | If I bring my own loop of wire around it, 238.34s - 240.34s | and that's actually how I capture that image 240.34s - 243.34s | that you just saw before, 243.34s - 245.34s | I'm able to just read that communication. 245.34s - 248.34s | It's literally just a breadboard jumper wire 248.34s - 250.34s | that I looped around a bunch of times, 250.34s - 253.34s | and then I put that near the transmitter and the fob, 253.34s - 255.34s | and I was able to pick up that communication. 255.34s - 259.34s | There's no encryption because you can't encrypt physics. 259.34s - 262.34s | It's either more or less magnetic field, 262.34s - 266.34s | and it's incredibly trivial to sniff. 266.34s - 271.34s | Something else is, again, because you can't encrypt physics, 271.34s - 275.34s | and the moment the tag sees the reader, 275.34s - 277.34s | it starts blaring out its ID


chunk_text:
225.34s - 228.34s | and that is it's talking to the transmitter. 228.34s - 231.34s | So something obvious that you might realize 231.34s - 235.34s | is this is very easy to mess with. 235.34s - 238.34s | If I bring my own loop of wire around it, 238.34s - 240.34s | and that's actually how I capture that image 240.34s - 243.34s | that you just saw before, 243.34s - 245.34s | I'm able to just read that communication. 245.34s - 248.34s | It's literally just a breadboard jumper wire 248.34s - 250.34s | that I looped around a bunch of times, 250.34s - 253.34s | and then I put that near the transmitter and the fob, 253.34s - 255.34s | and I was able to pick up that communication. 255.34s - 259.34s | There's no encryption because you can't encrypt physics. 259.34s - 262.34s | It's either more or less magnetic field, 262.34s - 266.34s | and it's incredibly trivial to sniff. 266.34s - 271.34s | Something else is, again, because you can't encrypt physics, 271.34s - 275.34s | and the moment the tag sees the reader, 275.34s - 277.34s | it starts blaring out its ID number. 277.34s - 280.34s | As Andrew said, I can come around with my own reader. 280.34s - 283.34s | Maybe you might have seen this. 283.34s - 287.34s | This is a photo from Physical Security Village last year. 287.34s - 289.34s | We have a similar setup this year. 289.34s - 293.34s | If you go near the entrance or the exit of the village, 293.34s - 297.34s | you might see a long-range reader 297.34s - 299.34s | idly sitting by, sniffing your badges 299.34s - 303.34s | and putting them on the wall of sheep. 303.34s - 307.62s | So how can we solve this problem? 307.62s - 309.62s | Does anyone have any ideas? 309.62s - 316.07s | Shout them out. 316.07s - 319.07s | Lasers, I heard. 319.07s - 322.07s | It's probably going to be a little more difficult to target that, 322.07s - 324.07s | but yeah, I heard someone say encryption. 324.07s - 327.07s | Yeah, we solve it using encryption. 327.07s - 332.07s | So this is how an encrypted communication looks like. 332.07s - 336.07s | Before everything happens, there has to be a pre-shared key. 336.07s - 339.07s


chunk_text:
number. 277.34s - 280.34s | As Andrew said, I can come around with my own reader. 280.34s - 283.34s | Maybe you might have seen this. 283.34s - 287.34s | This is a photo from Physical Security Village last year. 287.34s - 289.34s | We have a similar setup this year. 289.34s - 293.34s | If you go near the entrance or the exit of the village, 293.34s - 297.34s | you might see a long-range reader 297.34s - 299.34s | idly sitting by, sniffing your badges 299.34s - 303.34s | and putting them on the wall of sheep. 303.34s - 307.62s | So how can we solve this problem? 307.62s - 309.62s | Does anyone have any ideas? 309.62s - 316.07s | Shout them out. 316.07s - 319.07s | Lasers, I heard. 319.07s - 322.07s | It's probably going to be a little more difficult to target that, 322.07s - 324.07s | but yeah, I heard someone say encryption. 324.07s - 327.07s | Yeah, we solve it using encryption. 327.07s - 332.07s | So this is how an encrypted communication looks like. 332.07s - 336.07s | Before everything happens, there has to be a pre-shared key. 336.07s - 339.07s | So basically the reader and the card or the fob or whatever 339.07s - 343.07s | and the badge need to have an agreed-upon key 343.07s - 346.07s | that the manufacturer puts on there. 346.07s - 348.07s | And there's a challenge and response 348.07s - 351.07s | between the reader and the fob. 351.07s - 355.07s | And once they have both proven 355.07s - 358.07s | that they both know what the key is 358.07s - 360.07s | without ever saying the key, 360.07s - 363.07s | then they can just use that key to communicate encrypted. 363.07s - 367.07s | But this communication is obviously a little bit more complicated 367.07s - 370.07s | than just the raw, okay, I'm loading the field. 370.07s - 373.07s | I'm not loading the field communication that we saw earlier. 373.07s - 378.07s | And because of that and other bandwidth limitations, 378.07s - 381.07s | this is usually seen in high frequency, 381.07s - 384.07s | so 13.56 MHz RFID. 384.07s - 390.07s | So this, at least in principle, seems pretty perfect, right? 390.07s - 393.07s | This seems like a mathematically secure system 393.07s -


chunk_text:
| So basically the reader and the card or the fob or whatever 339.07s - 343.07s | and the badge need to have an agreed-upon key 343.07s - 346.07s | that the manufacturer puts on there. 346.07s - 348.07s | And there's a challenge and response 348.07s - 351.07s | between the reader and the fob. 351.07s - 355.07s | And once they have both proven 355.07s - 358.07s | that they both know what the key is 358.07s - 360.07s | without ever saying the key, 360.07s - 363.07s | then they can just use that key to communicate encrypted. 363.07s - 367.07s | But this communication is obviously a little bit more complicated 367.07s - 370.07s | than just the raw, okay, I'm loading the field. 370.07s - 373.07s | I'm not loading the field communication that we saw earlier. 373.07s - 378.07s | And because of that and other bandwidth limitations, 378.07s - 381.07s | this is usually seen in high frequency, 381.07s - 384.07s | so 13.56 MHz RFID. 384.07s - 390.07s | So this, at least in principle, seems pretty perfect, right? 390.07s - 393.07s | This seems like a mathematically secure system 393.07s - 395.07s | and as long as it's properly implemented 395.07s - 398.07s | and as long as no one does this inconceivable thing 398.07s - 401.07s | of just putting the same key everywhere, 401.07s - 403.07s | you know, like if there was a theoretical, 403.07s - 406.07s | you know where I'm going, right? 406.07s - 409.07s | This is what HID did. 409.07s - 415.07s | They apparently sold and until pretty recently 415.07s - 420.07s | continued to sell RFID systems 420.07s - 426.07s | that use the same key on every single standard security 426.07s - 430.80s | reader and fob that they sold. 430.80s - 433.80s | The authors of this paper did them a solid 433.80s - 435.80s | by not releasing the key, 435.80s - 438.80s | so they had some amount of time to respond, 438.80s - 445.88s | but obviously did not take that long for the key to appear on GitHub. 445.88s - 453.48s | But as long as you don't, you know, do stuff like that, 453.48s - 455.48s | and also there are other vulnerabilities that we've seen 455.48s - 460.48s | just because of time limitations,


chunk_text:
395.07s | and as long as it's properly implemented 395.07s - 398.07s | and as long as no one does this inconceivable thing 398.07s - 401.07s | of just putting the same key everywhere, 401.07s - 403.07s | you know, like if there was a theoretical, 403.07s - 406.07s | you know where I'm going, right? 406.07s - 409.07s | This is what HID did. 409.07s - 415.07s | They apparently sold and until pretty recently 415.07s - 420.07s | continued to sell RFID systems 420.07s - 426.07s | that use the same key on every single standard security 426.07s - 430.80s | reader and fob that they sold. 430.80s - 433.80s | The authors of this paper did them a solid 433.80s - 435.80s | by not releasing the key, 435.80s - 438.80s | so they had some amount of time to respond, 438.80s - 445.88s | but obviously did not take that long for the key to appear on GitHub. 445.88s - 453.48s | But as long as you don't, you know, do stuff like that, 453.48s - 455.48s | and also there are other vulnerabilities that we've seen 455.48s - 460.48s | just because of time limitations, we can't go too much into it. 460.48s - 465.48s | There are, yeah, as long as you implement your security correctly, 465.48s - 467.48s | as long as you pick your random numbers actually, 467.48s - 470.48s | you know, in a decently random way, 470.48s - 474.48s | you can do high security, high frequency RFID 474.48s - 477.48s | in a vaguely secure way. 477.48s - 480.48s | What happens if you don't do that 480.48s - 482.48s | is what Andrew's going to show next. 482.48s - 484.48s | So yeah, with a demo. 484.48s - 488.02s | All right. Thank you. 488.02s - 490.02s | Let's get this set up. 490.02s - 493.02s | Here is everyone's favorite dolphin. 495.02s - 504.18s | All right. 504.18s - 507.18s | So this is the interface for the Flipper Zero, 507.18s - 509.18s | which is what I'm holding in my hand here. 509.18s - 513.18s | And it has a lovely little interface here with some animations. 513.18s - 517.18s | And it's very convenient for copying your hotel room keys 517.18s - 520.18s | so that you can share them with your friends. 520.18s -


chunk_text:
we can't go too much into it. 460.48s - 465.48s | There are, yeah, as long as you implement your security correctly, 465.48s - 467.48s | as long as you pick your random numbers actually, 467.48s - 470.48s | you know, in a decently random way, 470.48s - 474.48s | you can do high security, high frequency RFID 474.48s - 477.48s | in a vaguely secure way. 477.48s - 480.48s | What happens if you don't do that 480.48s - 482.48s | is what Andrew's going to show next. 482.48s - 484.48s | So yeah, with a demo. 484.48s - 488.02s | All right. Thank you. 488.02s - 490.02s | Let's get this set up. 490.02s - 493.02s | Here is everyone's favorite dolphin. 495.02s - 504.18s | All right. 504.18s - 507.18s | So this is the interface for the Flipper Zero, 507.18s - 509.18s | which is what I'm holding in my hand here. 509.18s - 513.18s | And it has a lovely little interface here with some animations. 513.18s - 517.18s | And it's very convenient for copying your hotel room keys 517.18s - 520.18s | so that you can share them with your friends. 520.18s - 523.18s | But I'm going to go into low frequency here 523.18s - 525.18s | because that's what the badges I'm holding are. 525.18s - 528.18s | And I'm going to read the orange badge. 530.18s - 533.18s | And we'll see if this is going to work for me. 533.18s - 534.18s | There we go. 534.18s - 536.18s | We have the orange badge. 536.18s - 541.18s | And we are now going to attempt to write this to the blue badge, 541.18s - 543.18s | which already has information stored on it. 543.18s - 547.18s | So I'm not 100% sure if this is going to work. 548.18s - 553.40s | And there we go. 553.40s - 557.40s | So now our blue badge has the same information as our orange badge 557.40s - 559.40s | and will open the same doors. 559.40s - 561.40s | And it can be this simple. 565.40s - 567.40s | Yeah, just to show that it worked. 567.40s - 569.40s | Yeah, if we go to read again, 569.40s - 571.40s | and this time we wrote to the blue badge, 571.40s - 573.40s | or the blue fob. 573.40s -


chunk_text:
523.18s | But I'm going to go into low frequency here 523.18s - 525.18s | because that's what the badges I'm holding are. 525.18s - 528.18s | And I'm going to read the orange badge. 530.18s - 533.18s | And we'll see if this is going to work for me. 533.18s - 534.18s | There we go. 534.18s - 536.18s | We have the orange badge. 536.18s - 541.18s | And we are now going to attempt to write this to the blue badge, 541.18s - 543.18s | which already has information stored on it. 543.18s - 547.18s | So I'm not 100% sure if this is going to work. 548.18s - 553.40s | And there we go. 553.40s - 557.40s | So now our blue badge has the same information as our orange badge 557.40s - 559.40s | and will open the same doors. 559.40s - 561.40s | And it can be this simple. 565.40s - 567.40s | Yeah, just to show that it worked. 567.40s - 569.40s | Yeah, if we go to read again, 569.40s - 571.40s | and this time we wrote to the blue badge, 571.40s - 573.40s | or the blue fob. 573.40s - 576.40s | So if we read the blue fob, it's going to have the same information. 576.40s - 581.40s | So when Andrew said it's just saying its ID number, 581.40s - 582.40s | this is what we mean. 582.40s - 584.40s | So you see here there's a facility code. 584.40s - 586.40s | So that's the 25 there. 586.40s - 588.40s | And a card number. 588.40s - 591.40s | So in this case it's 15686, right? 591.40s - 594.40s | So this is just one of our... 597.40s - 600.40s | You don't have to write that down and try to figure out where I live. 601.40s - 605.40s | That's one of the test doors that we have at the village. 605.40s - 608.40s | If you want to come by and you want to plug that into your flipper, 608.40s - 612.40s | you're probably going to be able to open one of the two test doors that we have. 612.40s - 614.40s | So yeah, that's what we mean. 614.40s - 618.40s | It's literally just a four-byte number. 619.40s - 621.40s | So something else you can do, 621.40s - 623.40s | the


chunk_text:
576.40s | So if we read the blue fob, it's going to have the same information. 576.40s - 581.40s | So when Andrew said it's just saying its ID number, 581.40s - 582.40s | this is what we mean. 582.40s - 584.40s | So you see here there's a facility code. 584.40s - 586.40s | So that's the 25 there. 586.40s - 588.40s | And a card number. 588.40s - 591.40s | So in this case it's 15686, right? 591.40s - 594.40s | So this is just one of our... 597.40s - 600.40s | You don't have to write that down and try to figure out where I live. 601.40s - 605.40s | That's one of the test doors that we have at the village. 605.40s - 608.40s | If you want to come by and you want to plug that into your flipper, 608.40s - 612.40s | you're probably going to be able to open one of the two test doors that we have. 612.40s - 614.40s | So yeah, that's what we mean. 614.40s - 618.40s | It's literally just a four-byte number. 619.40s - 621.40s | So something else you can do, 621.40s - 623.40s | the flippers don't support this on the stock firmware, 623.40s - 626.40s | but something else that you can do with it is... 628.40s - 631.40s | Does anyone want to say, just yell it out loud, 631.40s - 634.40s | is four bytes a very large keyset? 635.40s - 637.40s | No, it's a tiny keyset. 637.40s - 639.40s | A keyspace rather. 639.40s - 642.40s | So yeah, you can also brute force this. 643.40s - 645.40s | Oh yeah, there we go. Andrew has... 648.40s - 650.40s | So this is the HIDproc. 650.40s - 653.40s | So this will run through the entire dictionary for HIDproc's devices. 653.40s - 656.40s | Another common one is the EM4100. 657.40s - 660.40s | And again, it's a very short dictionary, 660.40s - 663.40s | and you can run through this in about 15 to 30 seconds. 664.40s - 667.40s | Yeah, so the main thing that's limiting us here is... 668.40s - 670.40s | Again, remember, it's a very passive system, 670.40s - 672.40s | especially for low frequency. 672.40s - 675.40s | The reader has to ask us what our ID is, 675.40s - 676.40s | and then


chunk_text:
flippers don't support this on the stock firmware, 623.40s - 626.40s | but something else that you can do with it is... 628.40s - 631.40s | Does anyone want to say, just yell it out loud, 631.40s - 634.40s | is four bytes a very large keyset? 635.40s - 637.40s | No, it's a tiny keyset. 637.40s - 639.40s | A keyspace rather. 639.40s - 642.40s | So yeah, you can also brute force this. 643.40s - 645.40s | Oh yeah, there we go. Andrew has... 648.40s - 650.40s | So this is the HIDproc. 650.40s - 653.40s | So this will run through the entire dictionary for HIDproc's devices. 653.40s - 656.40s | Another common one is the EM4100. 657.40s - 660.40s | And again, it's a very short dictionary, 660.40s - 663.40s | and you can run through this in about 15 to 30 seconds. 664.40s - 667.40s | Yeah, so the main thing that's limiting us here is... 668.40s - 670.40s | Again, remember, it's a very passive system, 670.40s - 672.40s | especially for low frequency. 672.40s - 675.40s | The reader has to ask us what our ID is, 675.40s - 676.40s | and then we can reply. 676.40s - 679.40s | So we're limited by the number of times the reader is willing to ask us, 679.40s - 682.40s | but that's usually either one or two per second. 682.40s - 686.40s | So even though that sounds like 0.5 hertz or one hertz, 686.40s - 689.40s | sounds like a very low speed attack, 689.40s - 691.40s | or like very limited, 691.40s - 693.40s | because if you were trying to break a hash, 693.40s - 694.40s | that would be basically impossible, 694.40s - 696.40s | but because it's just four bytes, 696.40s - 699.40s | if you can just leave something on there, 699.40s - 700.40s | maybe overnight, 701.40s - 704.40s | like after work hours, 704.40s - 707.40s | you just go put your device on the reader, 707.40s - 708.40s | you'll leave for a couple hours, 708.40s - 709.40s | you come back, you pick it up, 709.40s - 715.40s | and it'll give you what the correct code is. 715.40s - 720.40s | So with kind of a conclusion to this is... 722.40s - 725.40s | When we tap our cards, when we tap our


chunk_text:
we can reply. 676.40s - 679.40s | So we're limited by the number of times the reader is willing to ask us, 679.40s - 682.40s | but that's usually either one or two per second. 682.40s - 686.40s | So even though that sounds like 0.5 hertz or one hertz, 686.40s - 689.40s | sounds like a very low speed attack, 689.40s - 691.40s | or like very limited, 691.40s - 693.40s | because if you were trying to break a hash, 693.40s - 694.40s | that would be basically impossible, 694.40s - 696.40s | but because it's just four bytes, 696.40s - 699.40s | if you can just leave something on there, 699.40s - 700.40s | maybe overnight, 701.40s - 704.40s | like after work hours, 704.40s - 707.40s | you just go put your device on the reader, 707.40s - 708.40s | you'll leave for a couple hours, 708.40s - 709.40s | you come back, you pick it up, 709.40s - 715.40s | and it'll give you what the correct code is. 715.40s - 720.40s | So with kind of a conclusion to this is... 722.40s - 725.40s | When we tap our cards, when we tap our badges, 725.40s - 727.40s | or when we tap to pay, 727.40s - 728.40s | it all seems very magical. 728.40s - 733.40s | It feels like we're not limited by the same things we are 733.40s - 735.40s | when it comes to keys. 735.40s - 739.40s | A lot of people talk about how if you take a photo of a key, 739.40s - 740.40s | you can duplicate it. 740.40s - 744.40s | If you leave your key, it can be measured, decoded. 744.40s - 747.40s | And it feels like whenever we're using RFID cards 747.40s - 749.40s | or key fobs, badges, 749.40s - 753.40s | they feel like they are somehow magically more secure. 753.40s - 757.40s | And in some cases, for specific use cases it is, 757.40s - 762.40s | but it's good to remember that it's not a silver bullet. 762.40s - 765.40s | We should be treating our RFID cards 765.40s - 769.40s | the same way we treat keys. 769.40s - 774.40s | So if we lose a fob, 774.40s - 776.40s | we should do the exact same things that we would do 776.40s - 777.40s | if


chunk_text:
badges, 725.40s - 727.40s | or when we tap to pay, 727.40s - 728.40s | it all seems very magical. 728.40s - 733.40s | It feels like we're not limited by the same things we are 733.40s - 735.40s | when it comes to keys. 735.40s - 739.40s | A lot of people talk about how if you take a photo of a key, 739.40s - 740.40s | you can duplicate it. 740.40s - 744.40s | If you leave your key, it can be measured, decoded. 744.40s - 747.40s | And it feels like whenever we're using RFID cards 747.40s - 749.40s | or key fobs, badges, 749.40s - 753.40s | they feel like they are somehow magically more secure. 753.40s - 757.40s | And in some cases, for specific use cases it is, 757.40s - 762.40s | but it's good to remember that it's not a silver bullet. 762.40s - 765.40s | We should be treating our RFID cards 765.40s - 769.40s | the same way we treat keys. 769.40s - 774.40s | So if we lose a fob, 774.40s - 776.40s | we should do the exact same things that we would do 776.40s - 777.40s | if we were to lose a key. 777.40s - 778.40s | Sorry, were you going to say something? 778.40s - 781.40s | Yes, I was going to say treat it like any secret. 781.40s - 785.40s | So like your passwords or your door keys to your house, 785.40s - 787.40s | it's exactly the same thing. 787.40s - 790.40s | If you have the secret, you have access. 790.40s - 795.40s | So there needs to be a good maintenance of your secret. 795.40s - 797.40s | So if you have a building 797.40s - 799.40s | and you have employees who are terminated, 799.40s - 802.40s | you need to deactivate that card. 802.40s - 806.40s | If you have a building that is using an HID card system, 806.40s - 808.40s | you need to upgrade that to one 808.40s - 812.40s | that does a proper job encrypting the secret 812.40s - 814.40s | when it transmits it. 815.40s - 820.40s | Wygand and other formats after the reader 820.40s - 824.40s | transmit the secret unencrypted over the wires 824.40s - 826.40s | to the central server, 826.40s - 828.40s | which controls the building access


chunk_text:
we were to lose a key. 777.40s - 778.40s | Sorry, were you going to say something? 778.40s - 781.40s | Yes, I was going to say treat it like any secret. 781.40s - 785.40s | So like your passwords or your door keys to your house, 785.40s - 787.40s | it's exactly the same thing. 787.40s - 790.40s | If you have the secret, you have access. 790.40s - 795.40s | So there needs to be a good maintenance of your secret. 795.40s - 797.40s | So if you have a building 797.40s - 799.40s | and you have employees who are terminated, 799.40s - 802.40s | you need to deactivate that card. 802.40s - 806.40s | If you have a building that is using an HID card system, 806.40s - 808.40s | you need to upgrade that to one 808.40s - 812.40s | that does a proper job encrypting the secret 812.40s - 814.40s | when it transmits it. 815.40s - 820.40s | Wygand and other formats after the reader 820.40s - 824.40s | transmit the secret unencrypted over the wires 824.40s - 826.40s | to the central server, 826.40s - 828.40s | which controls the building access system. 828.40s - 833.40s | So again, even if it's a proper four-way shake 833.40s - 837.40s | between the reader and the badge, 837.40s - 839.40s | someone can tamper with one of the readers 839.40s - 843.40s | and actually tap the wires and intercept the secret there 843.40s - 849.40s | and replay it at will to gain access later. 849.40s - 852.40s | Yeah, so just to sum up what Ender said there, 852.40s - 854.40s | hook up your darn tamper wires. 854.40s - 859.40s | If you own a building or if you have a security job 859.40s - 862.40s | or something like that at a building, 862.40s - 864.40s | you can just test this, right? 864.40s - 867.40s | Go up to your FOB reader, 867.40s - 869.40s | unscrew the thing off the wall, 869.40s - 872.40s | and if you don't receive a call from your security center, 872.40s - 874.40s | your tamper wire is not hooked up. 874.40s - 876.40s | You can work with security companies. 876.40s - 878.40s | You can just come to talks like this. 878.40s - 880.40s | You can come to


chunk_text:
system. 828.40s - 833.40s | So again, even if it's a proper four-way shake 833.40s - 837.40s | between the reader and the badge, 837.40s - 839.40s | someone can tamper with one of the readers 839.40s - 843.40s | and actually tap the wires and intercept the secret there 843.40s - 849.40s | and replay it at will to gain access later. 849.40s - 852.40s | Yeah, so just to sum up what Ender said there, 852.40s - 854.40s | hook up your darn tamper wires. 854.40s - 859.40s | If you own a building or if you have a security job 859.40s - 862.40s | or something like that at a building, 862.40s - 864.40s | you can just test this, right? 864.40s - 867.40s | Go up to your FOB reader, 867.40s - 869.40s | unscrew the thing off the wall, 869.40s - 872.40s | and if you don't receive a call from your security center, 872.40s - 874.40s | your tamper wire is not hooked up. 874.40s - 876.40s | You can work with security companies. 876.40s - 878.40s | You can just come to talks like this. 878.40s - 880.40s | You can come to the physical security village, 880.40s - 882.40s | and we will be more than happy to show you 882.40s - 885.40s | what those tamper wires do and how they're hooked up. 885.40s - 893.40s | But yeah, so basically there's more to RFID access control 893.40s - 898.40s | than what people seem to see on an initial look. 898.40s - 901.40s | So that's kind of why we do this talk. 901.40s - 903.40s | Also, it's fun to play around with. 903.40s - 905.40s | All right, with that being said... 905.40s - 907.40s | There we go, yeah. 907.40s - 911.40s | If anyone has any questions, please ask us now, 911.40s - 914.40s | or you can find us at the village afterwards. 914.40s - 917.40s | Oh, also, we didn't talk much about the Proxmark, 917.40s - 919.40s | but if you are interested in getting a Proxmark, 919.40s - 920.40s | you can buy it from Dangerous Things. 920.40s - 923.40s | Not affiliated, not sponsored, anything like that. 923.40s - 924.40s | Also... 924.40s - 926.40s | Oh, yeah, Hacker Warehouse here has them. 926.40s - 929.40s | Again, not affiliated, not


chunk_text:
the physical security village, 880.40s - 882.40s | and we will be more than happy to show you 882.40s - 885.40s | what those tamper wires do and how they're hooked up. 885.40s - 893.40s | But yeah, so basically there's more to RFID access control 893.40s - 898.40s | than what people seem to see on an initial look. 898.40s - 901.40s | So that's kind of why we do this talk. 901.40s - 903.40s | Also, it's fun to play around with. 903.40s - 905.40s | All right, with that being said... 905.40s - 907.40s | There we go, yeah. 907.40s - 911.40s | If anyone has any questions, please ask us now, 911.40s - 914.40s | or you can find us at the village afterwards. 914.40s - 917.40s | Oh, also, we didn't talk much about the Proxmark, 917.40s - 919.40s | but if you are interested in getting a Proxmark, 919.40s - 920.40s | you can buy it from Dangerous Things. 920.40s - 923.40s | Not affiliated, not sponsored, anything like that. 923.40s - 924.40s | Also... 924.40s - 926.40s | Oh, yeah, Hacker Warehouse here has them. 926.40s - 929.40s | Again, not affiliated, not sponsored. 930.40s - 934.40s | And you can go to proxmarkbuilds.org 934.40s - 939.40s | to get the good firmware written by Iceman, 939.40s - 941.40s | and he also has a channel on YouTube 941.40s - 944.40s | if you want to learn more about how to play around with RFID, 944.40s - 945.40s | not just using the flipper, 945.40s - 950.94s | but using more research-oriented tools. 950.94s - 952.94s | Oh, also, yeah, we sell those, sorry. 952.94s - 954.94s | Yes, I just want to plug our store. 954.94s - 956.94s | We're selling the tags, both high frequency and low frequency. 956.94s - 960.94s | If you need a spare hotel room key, that's where you go. 960.94s - 964.94s | Yeah, for the high frequency ones, yeah. 964.94s - 969.70s | Yeah, any questions? 969.70s - 970.70s | Do we have a... 970.70s - 972.70s | Okay, I don't think we have a speaker... 972.70s - 974.70s | Sorry, a microphone for the audience, 974.70s - 976.70s | so you got to yell it out. 976.70s - 993.95s | Yeah, so the question was, 993.95s - 1002.95s | how easy it is to


chunk_text:
sponsored. 930.40s - 934.40s | And you can go to proxmarkbuilds.org 934.40s - 939.40s | to get the good firmware written by Iceman, 939.40s - 941.40s | and he also has a channel on YouTube 941.40s - 944.40s | if you want to learn more about how to play around with RFID, 944.40s - 945.40s | not just using the flipper, 945.40s - 950.94s | but using more research-oriented tools. 950.94s - 952.94s | Oh, also, yeah, we sell those, sorry. 952.94s - 954.94s | Yes, I just want to plug our store. 954.94s - 956.94s | We're selling the tags, both high frequency and low frequency. 956.94s - 960.94s | If you need a spare hotel room key, that's where you go. 960.94s - 964.94s | Yeah, for the high frequency ones, yeah. 964.94s - 969.70s | Yeah, any questions? 969.70s - 970.70s | Do we have a... 970.70s - 972.70s | Okay, I don't think we have a speaker... 972.70s - 974.70s | Sorry, a microphone for the audience, 974.70s - 976.70s | so you got to yell it out. 976.70s - 993.95s | Yeah, so the question was, 993.95s - 1002.95s | how easy it is to bypass tamper protections on the readers? 1002.95s - 1008.95s | And it usually depends on the manufacturing of the actual reader. 1008.95s - 1021.95s | So we did trash their standard security RFID protocol earlier, 1021.95s - 1025.95s | but HID actually does a pretty decent job at building their readers, 1025.95s - 1030.95s | and it's kind of really difficult to get a tool in there 1030.95s - 1033.95s | to keep that tamper sensor from triggering, 1033.95s - 1036.95s | but it really depends on the reader. 1036.95s - 1039.95s | I would just play around with it, honestly. 1039.95s - 1040.95s | Another question? 1040.95s - 1055.72s | So the question was, 1055.72s - 1060.72s | so we said that if I have a long-range RFID reader, 1060.72s - 1065.72s | how does Blue Team defense against that? 1065.72s - 1067.72s | Two general ways. 1067.72s - 1069.72s | One is if you have... 1069.72s - 1078.16s | They make RFID-blocking badge holders. 1078.16s - 1082.16s | Also, yeah, there are RFID-blocking, 1082.16s - 1085.16s | you know, like, wallet stuff that you can use. 1085.16s - 1087.16s | So yeah, this is an example. 1087.16s -


chunk_text:
bypass tamper protections on the readers? 1002.95s - 1008.95s | And it usually depends on the manufacturing of the actual reader. 1008.95s - 1021.95s | So we did trash their standard security RFID protocol earlier, 1021.95s - 1025.95s | but HID actually does a pretty decent job at building their readers, 1025.95s - 1030.95s | and it's kind of really difficult to get a tool in there 1030.95s - 1033.95s | to keep that tamper sensor from triggering, 1033.95s - 1036.95s | but it really depends on the reader. 1036.95s - 1039.95s | I would just play around with it, honestly. 1039.95s - 1040.95s | Another question? 1040.95s - 1055.72s | So the question was, 1055.72s - 1060.72s | so we said that if I have a long-range RFID reader, 1060.72s - 1065.72s | how does Blue Team defense against that? 1065.72s - 1067.72s | Two general ways. 1067.72s - 1069.72s | One is if you have... 1069.72s - 1078.16s | They make RFID-blocking badge holders. 1078.16s - 1082.16s | Also, yeah, there are RFID-blocking, 1082.16s - 1085.16s | you know, like, wallet stuff that you can use. 1085.16s - 1087.16s | So yeah, this is an example. 1087.16s - 1090.16s | Not sponsored, just a random manufacturer. 1090.16s - 1091.16s | Yeah, Amazon. 1091.16s - 1093.16s | Yeah, from Amazon, apparently. 1093.16s - 1096.16s | Honestly, any conductive block of thing will do. 1096.16s - 1098.16s | It'll drain that energy. 1099.16s - 1104.16s | Or ideally, in conjunction with that, 1104.16s - 1109.16s | you can use systems that are not vulnerable to just being read by any random. 1109.16s - 1114.16s | So, for example, a lot of high-frequency protocols 1114.16s - 1119.16s | will require that handshake before any data is communicated. 1119.16s - 1123.16s | So if the reader doesn't know the key, then you can't talk to each other. 1123.16s - 1125.16s | Any other questions? 1125.16s - 1138.10s | So, for example, if I were to tamper with it in my building, 1138.10s - 1140.10s | and I don't gain access, 1140.10s - 1145.10s | is there an alarm and or notification associated? 1145.10s - 1150.10s | So the question was, if the tamper wire is hooked up, 1150.10s - 1153.10s | you know, if the tamper system is set up correctly, 1153.10s - 1155.10s | what happens if someone tampers with the


chunk_text:
1090.16s | Not sponsored, just a random manufacturer. 1090.16s - 1091.16s | Yeah, Amazon. 1091.16s - 1093.16s | Yeah, from Amazon, apparently. 1093.16s - 1096.16s | Honestly, any conductive block of thing will do. 1096.16s - 1098.16s | It'll drain that energy. 1099.16s - 1104.16s | Or ideally, in conjunction with that, 1104.16s - 1109.16s | you can use systems that are not vulnerable to just being read by any random. 1109.16s - 1114.16s | So, for example, a lot of high-frequency protocols 1114.16s - 1119.16s | will require that handshake before any data is communicated. 1119.16s - 1123.16s | So if the reader doesn't know the key, then you can't talk to each other. 1123.16s - 1125.16s | Any other questions? 1125.16s - 1138.10s | So, for example, if I were to tamper with it in my building, 1138.10s - 1140.10s | and I don't gain access, 1140.10s - 1145.10s | is there an alarm and or notification associated? 1145.10s - 1150.10s | So the question was, if the tamper wire is hooked up, 1150.10s - 1153.10s | you know, if the tamper system is set up correctly, 1153.10s - 1155.10s | what happens if someone tampers with the reader? 1155.10s - 1156.10s | Is that... Yeah. 1156.10s - 1160.10s | So, honestly, it depends on the system. 1160.10s - 1162.10s | If you set it up so that you get a special notification, 1162.10s - 1167.10s | say, because it's, you know, if someone just holds the door open 1167.10s - 1170.10s | or forces a door open or something like that, 1170.10s - 1171.10s | you're facing... 1171.10s - 1174.10s | Obviously, if someone is actually tampering with the device, 1174.10s - 1177.10s | you're facing a more high-skill attacker. 1177.10s - 1182.10s | So you might want to, you know, like, work with your alarm company 1182.10s - 1184.10s | and make sure that you get a special notification 1184.10s - 1186.10s | or a special alarm condition for that. 1186.10s - 1188.10s | But it just depends on the system. 1188.10s - 1189.10s | Do you want to add to that? 1189.10s - 1192.10s | I just want to add to that. 1192.10s - 1195.10s | You know, if the alarm system is correctly installed, 1195.10s - 1197.10s | yes, you will get an alarm. 1197.10s - 1199.10s | However, alarm fatigue is a thing,


chunk_text:
reader? 1155.10s - 1156.10s | Is that... Yeah. 1156.10s - 1160.10s | So, honestly, it depends on the system. 1160.10s - 1162.10s | If you set it up so that you get a special notification, 1162.10s - 1167.10s | say, because it's, you know, if someone just holds the door open 1167.10s - 1170.10s | or forces a door open or something like that, 1170.10s - 1171.10s | you're facing... 1171.10s - 1174.10s | Obviously, if someone is actually tampering with the device, 1174.10s - 1177.10s | you're facing a more high-skill attacker. 1177.10s - 1182.10s | So you might want to, you know, like, work with your alarm company 1182.10s - 1184.10s | and make sure that you get a special notification 1184.10s - 1186.10s | or a special alarm condition for that. 1186.10s - 1188.10s | But it just depends on the system. 1188.10s - 1189.10s | Do you want to add to that? 1189.10s - 1192.10s | I just want to add to that. 1192.10s - 1195.10s | You know, if the alarm system is correctly installed, 1195.10s - 1197.10s | yes, you will get an alarm. 1197.10s - 1199.10s | However, alarm fatigue is a thing, 1199.10s - 1203.10s | and if you tamper with it and then set it off and leave 1203.10s - 1205.10s | and they come around and look at it, 1205.10s - 1207.10s | and then you come and mess with it some more and leave 1207.10s - 1208.10s | and they come and look at it, 1208.10s - 1211.10s | and then you leave and come back, 1211.10s - 1213.10s | they are going to stop checking 1213.10s - 1215.10s | and going to turn off that alarm 1215.10s - 1218.10s | and you are then free to do your thing 1218.10s - 1220.10s | and, you know, red team it up. 1220.10s - 1223.10s | So just wanted to add that. 1223.10s - 1225.10s | Yeah, I've, for obvious reasons, 1225.10s - 1226.10s | not going to go too much into details, 1226.10s - 1228.10s | but I have used an actual engagement 1228.10s - 1232.10s | where I would just show up, prop a door open, leave, 1232.10s - 1234.10s | show back up, prop a door open, leave again, 1234.10s - 1239.10s | and then eventually security stopped responding. 1239.10s - 1242.10s | Oh, okay, yeah, I


chunk_text:
1199.10s - 1203.10s | and if you tamper with it and then set it off and leave 1203.10s - 1205.10s | and they come around and look at it, 1205.10s - 1207.10s | and then you come and mess with it some more and leave 1207.10s - 1208.10s | and they come and look at it, 1208.10s - 1211.10s | and then you leave and come back, 1211.10s - 1213.10s | they are going to stop checking 1213.10s - 1215.10s | and going to turn off that alarm 1215.10s - 1218.10s | and you are then free to do your thing 1218.10s - 1220.10s | and, you know, red team it up. 1220.10s - 1223.10s | So just wanted to add that. 1223.10s - 1225.10s | Yeah, I've, for obvious reasons, 1225.10s - 1226.10s | not going to go too much into details, 1226.10s - 1228.10s | but I have used an actual engagement 1228.10s - 1232.10s | where I would just show up, prop a door open, leave, 1232.10s - 1234.10s | show back up, prop a door open, leave again, 1234.10s - 1239.10s | and then eventually security stopped responding. 1239.10s - 1242.10s | Oh, okay, yeah, I think that's our time. 1242.10s - 1243.10s | Yeah, okay, all right. 1243.10s - 1244.10s | Thank you so much for coming. 1244.10s - 1245.10s | If you have any other questions, 1245.10s - 1247.10s | please do shout to us by email 1247.10s - 1251.10s | or swing by the village to try out some of these 1251.10s - 1254.10s | and also some more physical hands-on stuff. 1254.10s - 1255.10s | Thanks.


chunk_text:
think that's our time. 1242.10s - 1243.10s | Yeah, okay, all right. 1243.10s - 1244.10s | Thank you so much for coming. 1244.10s - 1245.10s | If you have any other questions, 1245.10s - 1247.10s | please do shout to us by email 1247.10s - 1251.10s | or swing by the village to try out some of these 1251.10s - 1254.10s | and also some more physical hands-on stuff. 1254.10s - 1255.10s | Thanks.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=qY0Yb8_R3a0", "title": "DEF CON 32 - Bypass 101- Bill Graydon", "description": "There are loads of ways to get through a door without actually attacking the lock itself, including using the egress hardware, access control hardware, and countless other techniques to gain entry. Learn how to do these attacks in this talk!", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1348, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.94s | This text was transcribed using whisper model: large-v2 Welcome. Can everyone hear me alright? Everyone see the screen except for what is not 3.94s - 10.58s | loading. So, now is the part of the talk where you wholeheartedly boo the speaker for not 10.58s - 15.78s | downloading his own slides locally before relying on the Defcon wifi to give the talk. So 15.78s - 22.61s | let's let's hear it. Big ol' big ol' boo for my lack of preparedness. I fucked it up 22.61s - 27.61s | already. So, this is actually a little bit appropriate though given a lot of what I'm 27.61s - 33.31s | going to talk about. Because what you, if you were here for the talk an hour ago when we 33.31s - 37.71s | with Physical Security Village gave the Bypass 101 talk, we were talking about all the 37.71s - 44.23s | elite hacks that you can do to hack into physical systems and get them to behave in ways 44.23s - 49.77s | that they're not supposed to. A lot of what this talk is gonna end up converging on is not 49.77s - 54.37s | doing advanced elite hacks yourself, but just systems that don't work the way they're 54.37s - 61.71s | supposed to in the first place. And wifi as we're seeing is one of them. So, we'll we'll get 61.71s - 66.77s | the vis- visuals that we can and I'll talk you through the rest. But um, every time you 66.77s - 71.81s | see one of these images that doesn't load, keep in mind that is the exact same failure mode 71.81s - 77.85s | as a lot of physical security systems that don't operate as intended and that's some of the 77.87s - 84.86s | things that we're gonna focus on in this talk. So, we're gonna go over a bunch of very high 87.66s - 93.74s | level of the type of bypasses,


chunk_text:
| with Physical Security Village gave the Bypass 101 talk, we were talking about all the 37.71s - 44.23s | elite hacks that you can do to hack into physical systems and get them to behave in ways 44.23s - 49.77s | that they're not supposed to. A lot of what this talk is gonna end up converging on is not 49.77s - 54.37s | doing advanced elite hacks yourself, but just systems that don't work the way they're 54.37s - 61.71s | supposed to in the first place. And wifi as we're seeing is one of them. So, we'll we'll get 61.71s - 66.77s | the vis- visuals that we can and I'll talk you through the rest. But um, every time you 66.77s - 71.81s | see one of these images that doesn't load, keep in mind that is the exact same failure mode 71.81s - 77.85s | as a lot of physical security systems that don't operate as intended and that's some of the 77.87s - 84.86s | things that we're gonna focus on in this talk. So, we're gonna go over a bunch of very high 87.66s - 93.74s | level of the type of bypasses, type of security that we need to concern about. So, bypass, lock 93.74s - 98.04s | picking, forcible entry, we'll talk about that a little bit. Alarm and detection and then 98.04s - 102.92s | surveillance. We'll have to focus on how to bring it up and how to get action. All of this in 102.92s - 109.32s | the context of an internal employee where your main job description is not auditing the 109.34s - 112.78s | company's physical security. So, there's a lot of people and we get a lot of questions at the 112.78s - 118.58s | village about this. People that notice flaws in their employer's physical security wonder how 118.58s - 124.62s | to bring it up, what's important and so that's what we're gonna talk about here. And I'm gonna 124.62s - 131.06s | hammer this through throughout the talk. A lot of what is most critical to bring up is stupid 131.06s - 138.11s | shit. So, let's watch some videos of stupid shit. If we can. Alright, so the door is locked. 138.89s - 143.89s | Doesn't open. Hit the uh, hit the accessibility button. And it pops right open. So this


chunk_text:
type of security that we need to concern about. So, bypass, lock 93.74s - 98.04s | picking, forcible entry, we'll talk about that a little bit. Alarm and detection and then 98.04s - 102.92s | surveillance. We'll have to focus on how to bring it up and how to get action. All of this in 102.92s - 109.32s | the context of an internal employee where your main job description is not auditing the 109.34s - 112.78s | company's physical security. So, there's a lot of people and we get a lot of questions at the 112.78s - 118.58s | village about this. People that notice flaws in their employer's physical security wonder how 118.58s - 124.62s | to bring it up, what's important and so that's what we're gonna talk about here. And I'm gonna 124.62s - 131.06s | hammer this through throughout the talk. A lot of what is most critical to bring up is stupid 131.06s - 138.11s | shit. So, let's watch some videos of stupid shit. If we can. Alright, so the door is locked. 138.89s - 143.89s | Doesn't open. Hit the uh, hit the accessibility button. And it pops right open. So this is a 149.69s - 154.47s | surprisingly common failure mode. It is a simple misconfiguration in the programming 154.47s - 160.97s | software or in the wiring. When it's a wiring problem, it is just, it thinks this is the 160.97s - 165.91s | accessibility button on the inside, the secure side of the door and it causes that system to 165.91s - 172.89s | unlock the door and cause it to open up. So stupid shit, misconfigurations like that. You 172.89s - 177.89s | also get stupid shit like this. Lock cage. Reach around. Slam the bar and you're through. 184.82s - 191.06s | There's a couple reasons that stupid shit like this is so relevant to security in general but 191.06s - 197.16s | also to internal employees bringing it up. Number one from security in general is a threat 197.16s - 201.70s | modeling perspective. Hitting the accessibility button, reaching around, that's 201.70s - 206.70s | something that any idiot can look at and see, this is something that might work and they can 206.70s - 212.74s | try it. It takes no skill whatsoever. When you're bringing up flaws to particularly your own 212.74s - 218.12s


chunk_text:
is a 149.69s - 154.47s | surprisingly common failure mode. It is a simple misconfiguration in the programming 154.47s - 160.97s | software or in the wiring. When it's a wiring problem, it is just, it thinks this is the 160.97s - 165.91s | accessibility button on the inside, the secure side of the door and it causes that system to 165.91s - 172.89s | unlock the door and cause it to open up. So stupid shit, misconfigurations like that. You 172.89s - 177.89s | also get stupid shit like this. Lock cage. Reach around. Slam the bar and you're through. 184.82s - 191.06s | There's a couple reasons that stupid shit like this is so relevant to security in general but 191.06s - 197.16s | also to internal employees bringing it up. Number one from security in general is a threat 197.16s - 201.70s | modeling perspective. Hitting the accessibility button, reaching around, that's 201.70s - 206.70s | something that any idiot can look at and see, this is something that might work and they can 206.70s - 212.74s | try it. It takes no skill whatsoever. When you're bringing up flaws to particularly your own 212.74s - 218.12s | employer, the less skill it takes, the better in terms of them understanding the 218.12s - 224.48s | criticality of that problem. If it's a, an advanced, high skilled, high barrier to entry 224.48s - 229.72s | attack that you're demonstrating, the more it shows off your skills as an attacker, the less 229.72s - 236.76s | relevant it is from a threat modeling perspective. And so that is why systems that just plain 236.76s - 241.76s | old don't work, like wifi sometimes, is, is something that uh, is most relevant for this. So 245.76s - 251.94s | I'm gonna switch off of the presenter mode here and we'll see what we can see. So latch 251.94s - 257.14s | targeted bypass is something that we talk about in bypass 101. And the physical security 257.14s - 263.22s | village right across the hall here, quick show of hands, who has uh, checked us out so far? Lot 263.22s - 266.98s | of people. For those who haven't, I highly recommend it. Everything I'm gonna talk about in 266.98s - 273.46s | this talk you can try it for yourself in the village. These latches allow self-closing doors


chunk_text:
| employer, the less skill it takes, the better in terms of them understanding the 218.12s - 224.48s | criticality of that problem. If it's a, an advanced, high skilled, high barrier to entry 224.48s - 229.72s | attack that you're demonstrating, the more it shows off your skills as an attacker, the less 229.72s - 236.76s | relevant it is from a threat modeling perspective. And so that is why systems that just plain 236.76s - 241.76s | old don't work, like wifi sometimes, is, is something that uh, is most relevant for this. So 245.76s - 251.94s | I'm gonna switch off of the presenter mode here and we'll see what we can see. So latch 251.94s - 257.14s | targeted bypass is something that we talk about in bypass 101. And the physical security 257.14s - 263.22s | village right across the hall here, quick show of hands, who has uh, checked us out so far? Lot 263.22s - 266.98s | of people. For those who haven't, I highly recommend it. Everything I'm gonna talk about in 266.98s - 273.46s | this talk you can try it for yourself in the village. These latches allow self-closing doors 273.46s - 279.10s | to self-latch and self-lock afterwards. You can often stick a tool in just like we're showing 279.10s - 285.10s | in this picture here and retract that latch, pull the door open. So again, really low 285.10s - 291.18s | skilled, easy to demonstrate, easy to show to someone at your workplace of anyone with a bent 291.18s - 297.02s | wire can do this and open this locked door. And that's something that really gets, gets 297.02s - 303.92s | results there. This dead latch is what's meant to prevent that. That little half moon there. 303.92s - 308.56s | Those half moon designs by the way are terrible because if that dead latch is retracted it 308.56s - 313.00s | will prevent you from pushing it in. You can try that out in the village. When it falls into 313.00s - 318.00s | the strike plate hole, that allows you to do that latch targeted bypass. So bypasses that are 320.80s - 327.80s | easy, quick to demonstrate are by far the best ones to bring up in that context. Lock picking 327.80s - 332.98s | is somewhat relevant. If you're a skilled enough


chunk_text:
273.46s - 279.10s | to self-latch and self-lock afterwards. You can often stick a tool in just like we're showing 279.10s - 285.10s | in this picture here and retract that latch, pull the door open. So again, really low 285.10s - 291.18s | skilled, easy to demonstrate, easy to show to someone at your workplace of anyone with a bent 291.18s - 297.02s | wire can do this and open this locked door. And that's something that really gets, gets 297.02s - 303.92s | results there. This dead latch is what's meant to prevent that. That little half moon there. 303.92s - 308.56s | Those half moon designs by the way are terrible because if that dead latch is retracted it 308.56s - 313.00s | will prevent you from pushing it in. You can try that out in the village. When it falls into 313.00s - 318.00s | the strike plate hole, that allows you to do that latch targeted bypass. So bypasses that are 320.80s - 327.80s | easy, quick to demonstrate are by far the best ones to bring up in that context. Lock picking 327.80s - 332.98s | is somewhat relevant. If you're a skilled enough lock picker, this is something that you can 333.00s - 339.74s | bring up. If you see a critical installation behind a poorly done lock, that might be 339.74s - 345.98s | something you want to do. As with all lock picking, ask permission before you attempt to pick 345.98s - 351.06s | any locks. Right? With, with that stupid shit before we reach around and hit the thing, it's 351.06s - 356.50s | like, that's something that any idiot can see and do. As soon as you stick a pick into a 356.52s - 361.46s | keyway, you now run afoul of possibly the law, depending on your jurisdiction, possibly 361.46s - 366.46s | ethics, and very likely your employer's code of conduct. So ask permission there. But when 369.64s - 374.34s | you have permission and if you see a lock that you know, I can pick that, that's very easy. It 374.34s - 379.34s | should not be protecting all of our inventory. Or all of our PII. Or whatever it is that you 379.34s - 383.94s | have behind that, that lock door, in that lock cabinet, whatever it is. You can either ask 383.96s -


chunk_text:
lock picker, this is something that you can 333.00s - 339.74s | bring up. If you see a critical installation behind a poorly done lock, that might be 339.74s - 345.98s | something you want to do. As with all lock picking, ask permission before you attempt to pick 345.98s - 351.06s | any locks. Right? With, with that stupid shit before we reach around and hit the thing, it's 351.06s - 356.50s | like, that's something that any idiot can see and do. As soon as you stick a pick into a 356.52s - 361.46s | keyway, you now run afoul of possibly the law, depending on your jurisdiction, possibly 361.46s - 366.46s | ethics, and very likely your employer's code of conduct. So ask permission there. But when 369.64s - 374.34s | you have permission and if you see a lock that you know, I can pick that, that's very easy. It 374.34s - 379.34s | should not be protecting all of our inventory. Or all of our PII. Or whatever it is that you 379.34s - 383.94s | have behind that, that lock door, in that lock cabinet, whatever it is. You can either ask 383.96s - 388.72s | permission and half the time, you don't even need to demonstrate. You can just tell them, I 388.72s - 396.47s | know a lot about this. This lock is not well suited for the job. I will call attention to 396.47s - 402.55s | leashy tools briefly. Who has heard about these before? A good chunk of people in the room. 402.55s - 407.31s | These are a game changer when it comes to threat modeling. And I suspect that in the next 407.31s - 413.95s | five or ten years, we're going to see more and more criminals on a lower level using them. 413.95s - 421.03s | Because they are so damn easy to pick. So next time you're at work or even at home, if your 421.03s - 426.97s | keyway looks like this, with the little Z shape at the bottom, that Schlage C keyway, if it 426.97s - 432.45s | says Schlage on top, you're okay. Schlage locks are well made, they have security pins, 432.45s - 436.59s | they're tight tolerances. They're still very pickable with these leashes, but it takes at 436.59s - 441.69s | least a little bit of skill.


chunk_text:
388.72s | permission and half the time, you don't even need to demonstrate. You can just tell them, I 388.72s - 396.47s | know a lot about this. This lock is not well suited for the job. I will call attention to 396.47s - 402.55s | leashy tools briefly. Who has heard about these before? A good chunk of people in the room. 402.55s - 407.31s | These are a game changer when it comes to threat modeling. And I suspect that in the next 407.31s - 413.95s | five or ten years, we're going to see more and more criminals on a lower level using them. 413.95s - 421.03s | Because they are so damn easy to pick. So next time you're at work or even at home, if your 421.03s - 426.97s | keyway looks like this, with the little Z shape at the bottom, that Schlage C keyway, if it 426.97s - 432.45s | says Schlage on top, you're okay. Schlage locks are well made, they have security pins, 432.45s - 436.59s | they're tight tolerances. They're still very pickable with these leashes, but it takes at 436.59s - 441.69s | least a little bit of skill. If it says nothing on top, that means it's a Chinese clone of a 441.69s - 447.47s | Schlage C keyway. Picking is very easy, just raking, but with these leashes it makes it 447.47s - 453.71s | trivial. No skill required whatsoever. And so that's that's a tool you can look up and if you 453.71s - 460.85s | use those in your workplace, particularly for higher security, higher criticality doors, at 460.85s - 464.55s | the very least you want to use a proper Schlage, but ideally switch it out for a higher 464.55s - 469.49s | security lock that this tool does not exist for. The last thing that leashes are capable of is 469.49s - 473.77s | these numbers along the back here. Once you pick the lock, you can actually read off the 473.77s - 478.87s | number and make a key for that lock based on picking it once and the information that tool 478.87s - 484.43s | pulls out for you. So again, something that if your employer doesn't want someone with 30 484.43s - 488.57s | seconds of access to the lock to be able to then make a key that works


chunk_text:
If it says nothing on top, that means it's a Chinese clone of a 441.69s - 447.47s | Schlage C keyway. Picking is very easy, just raking, but with these leashes it makes it 447.47s - 453.71s | trivial. No skill required whatsoever. And so that's that's a tool you can look up and if you 453.71s - 460.85s | use those in your workplace, particularly for higher security, higher criticality doors, at 460.85s - 464.55s | the very least you want to use a proper Schlage, but ideally switch it out for a higher 464.55s - 469.49s | security lock that this tool does not exist for. The last thing that leashes are capable of is 469.49s - 473.77s | these numbers along the back here. Once you pick the lock, you can actually read off the 473.77s - 478.87s | number and make a key for that lock based on picking it once and the information that tool 478.87s - 484.43s | pulls out for you. So again, something that if your employer doesn't want someone with 30 484.43s - 488.57s | seconds of access to the lock to be able to then make a key that works forevermore, it's worth 488.57s - 496.40s | bringing up. Forcible entry is worth talking about even though in the PhysSec village we 496.40s - 501.54s | talk about lock bypass a lot and covert entry, how you can get in without damaging stuff, your 501.54s - 506.78s | threat model in the real world is usually forcible entry. And so that's something that what 506.78s - 511.58s | that's why I've taglined this, why hackers often get physical security wrong. You need to 511.58s - 518.62s | think about what's actually going to be done. No door is invulnerable. Any door can be 518.62s - 524.16s | breached with sufficient force, skill, time, money and motivation. And forcible entry is 524.16s - 529.66s | usually the way to do that. So this image here is a halogen tool. It is what firefighters 529.66s - 534.00s | use. There is a full science to this that has been developed over the past 80 years that 534.00s - 539.70s | firefighters use to get into burning buildings as fast as possible. Criminals are not quite 539.70s - 543.88s | so fast. They're a little bit louder. They have a different set of


chunk_text:
forevermore, it's worth 488.57s - 496.40s | bringing up. Forcible entry is worth talking about even though in the PhysSec village we 496.40s - 501.54s | talk about lock bypass a lot and covert entry, how you can get in without damaging stuff, your 501.54s - 506.78s | threat model in the real world is usually forcible entry. And so that's something that what 506.78s - 511.58s | that's why I've taglined this, why hackers often get physical security wrong. You need to 511.58s - 518.62s | think about what's actually going to be done. No door is invulnerable. Any door can be 518.62s - 524.16s | breached with sufficient force, skill, time, money and motivation. And forcible entry is 524.16s - 529.66s | usually the way to do that. So this image here is a halogen tool. It is what firefighters 529.66s - 534.00s | use. There is a full science to this that has been developed over the past 80 years that 534.00s - 539.70s | firefighters use to get into burning buildings as fast as possible. Criminals are not quite 539.70s - 543.88s | so fast. They're a little bit louder. They have a different set of tools and techniques that 543.88s - 549.72s | they use. But any door can be forced with sufficient time. The defense against that is 549.72s - 557.40s | detection and response. And we're going to drill that into this talk as well. You need to 557.40s - 561.70s | think about your threat modeling when talking about forcible entry. So if say you you look 561.70s - 565.34s | this up a bit, you'll you'll learn about thermal lances and various advanced forcible entry 565.34s - 569.72s | tools. That's usually not within the threat model for most employers and most most 569.72s - 577.22s | facilities. Um you uh or UFC 402001 has a good taxonomy of that. So if you want a nice 578.20s - 584.72s | science based way to explain what the forcible entry resistance of a door is going to be 584.72s - 594.78s | without actually forcing it and damaging it, this is a great reference doc for you. So we'll 594.78s - 599.78s | switch back into slide mode, see if videos load. And you want to look at the full set of 599.78s - 605.26s | hardware as well. So this is


chunk_text:
tools and techniques that 543.88s - 549.72s | they use. But any door can be forced with sufficient time. The defense against that is 549.72s - 557.40s | detection and response. And we're going to drill that into this talk as well. You need to 557.40s - 561.70s | think about your threat modeling when talking about forcible entry. So if say you you look 561.70s - 565.34s | this up a bit, you'll you'll learn about thermal lances and various advanced forcible entry 565.34s - 569.72s | tools. That's usually not within the threat model for most employers and most most 569.72s - 577.22s | facilities. Um you uh or UFC 402001 has a good taxonomy of that. So if you want a nice 578.20s - 584.72s | science based way to explain what the forcible entry resistance of a door is going to be 584.72s - 594.78s | without actually forcing it and damaging it, this is a great reference doc for you. So we'll 594.78s - 599.78s | switch back into slide mode, see if videos load. And you want to look at the full set of 599.78s - 605.26s | hardware as well. So this is an Abloy lock. Abloy Protek. It is not going to be picked. The 605.26s - 610.12s | locking hardware itself has not given in the forced entry. This hollow wooden door has just 610.14s - 615.14s | splintered like a toothpick. And so even just knocking on a door, pushing it with your palm, 618.02s - 623.96s | giving it a prod with your knee, you can feel where that door gives. And you can get a feel 623.96s - 629.60s | for if I were to hit this with a battering ram with my shoulder, give it a good kick, where is 629.60s - 634.46s | that door going to give? Is it going to give? And that's something that is relevant if you 634.48s - 640.32s | have items of value or that would be a great problem to your company from a secrecy 640.32s - 645.32s | perspective for instance, if it got out. So I talked about the um, the science that 648.96s - 657.54s | firefighters use to lever doors open. What often happens is something like this. So we see 662.44s - 666.48s | burglar walking along carrying a gym bag full of tools.


chunk_text:
an Abloy lock. Abloy Protek. It is not going to be picked. The 605.26s - 610.12s | locking hardware itself has not given in the forced entry. This hollow wooden door has just 610.14s - 615.14s | splintered like a toothpick. And so even just knocking on a door, pushing it with your palm, 618.02s - 623.96s | giving it a prod with your knee, you can feel where that door gives. And you can get a feel 623.96s - 629.60s | for if I were to hit this with a battering ram with my shoulder, give it a good kick, where is 629.60s - 634.46s | that door going to give? Is it going to give? And that's something that is relevant if you 634.48s - 640.32s | have items of value or that would be a great problem to your company from a secrecy 640.32s - 645.32s | perspective for instance, if it got out. So I talked about the um, the science that 648.96s - 657.54s | firefighters use to lever doors open. What often happens is something like this. So we see 662.44s - 666.48s | burglar walking along carrying a gym bag full of tools. Gym bags full of tools by the way are 666.50s - 671.50s | one of their biggest uh, carrying cases of choice. And so we're going to see how he uses this 674.16s - 678.88s | crowbar to actually lever that door open. So there's lots of places you can get purchase 678.88s - 683.88s | around the jam here. And we'll take a look at his advanced uh, technique that he uses. Nope, 685.72s - 693.74s | right through the window. Right, so a big ol' window like that, it's good for people to see 693.78s - 699.22s | in and to merchandise the store during open hours, but that's just a little door for him at 699.22s - 703.80s | that point. Right, so again depending on the money you want to spend to harden that door, 703.80s - 708.16s | detection and response is your ideal situation there. What happens in real life in situations 708.16s - 712.44s | like this by the way, is he walks the block and he cases it out. And he's going to look for 712.44s - 717.20s | stores that have a vulnerability like that. And so it's like the old


chunk_text:
Gym bags full of tools by the way are 666.50s - 671.50s | one of their biggest uh, carrying cases of choice. And so we're going to see how he uses this 674.16s - 678.88s | crowbar to actually lever that door open. So there's lots of places you can get purchase 678.88s - 683.88s | around the jam here. And we'll take a look at his advanced uh, technique that he uses. Nope, 685.72s - 693.74s | right through the window. Right, so a big ol' window like that, it's good for people to see 693.78s - 699.22s | in and to merchandise the store during open hours, but that's just a little door for him at 699.22s - 703.80s | that point. Right, so again depending on the money you want to spend to harden that door, 703.80s - 708.16s | detection and response is your ideal situation there. What happens in real life in situations 708.16s - 712.44s | like this by the way, is he walks the block and he cases it out. And he's going to look for 712.44s - 717.20s | stores that have a vulnerability like that. And so it's like the old joke about you just have 717.20s - 721.74s | to outrun your friend, not the bear. You just have to be more secure than your neighbor and 721.74s - 726.18s | that's going to cause low level attackers like this to go somewhere else. And that applies in a 726.18s - 730.22s | threat model where you're just protecting money, you're just protecting assets of a relatively 730.22s - 736.22s | low value. He's going to go in and he knows to be in and out in five minutes. Right, he's 736.22s - 740.70s | going to grab, the till should be empty but anything of value there, any merchandise of 740.70s - 745.70s | value, smash, literally a smash and grab in and out in five minutes. So if you see a jam like 745.84s - 750.84s | this, thin wood veneer, one and a half inch screws holding these metal strike plates in, that's 754.94s - 760.78s | going to survive one kick and someone's through. So forcible entry is worth considering. To 760.78s - 765.66s | secure a site you need detectors on the entire perimeter or the interior, delay the intruder 765.66s - 773.09s | and


chunk_text:
joke about you just have 717.20s - 721.74s | to outrun your friend, not the bear. You just have to be more secure than your neighbor and 721.74s - 726.18s | that's going to cause low level attackers like this to go somewhere else. And that applies in a 726.18s - 730.22s | threat model where you're just protecting money, you're just protecting assets of a relatively 730.22s - 736.22s | low value. He's going to go in and he knows to be in and out in five minutes. Right, he's 736.22s - 740.70s | going to grab, the till should be empty but anything of value there, any merchandise of 740.70s - 745.70s | value, smash, literally a smash and grab in and out in five minutes. So if you see a jam like 745.84s - 750.84s | this, thin wood veneer, one and a half inch screws holding these metal strike plates in, that's 754.94s - 760.78s | going to survive one kick and someone's through. So forcible entry is worth considering. To 760.78s - 765.66s | secure a site you need detectors on the entire perimeter or the interior, delay the intruder 765.66s - 773.09s | and respond fast enough with greater force to stop someone who has forced their way in. In 773.09s - 778.19s | just a time we'll skip through a few. There are some alarm bypasses that we talk about in 778.19s - 783.77s | the village. So if you have detection that's a magnetic contact sensor and that magnet can 783.77s - 789.37s | be bypassed by holding a surrogate magnet up to it. That's something that is a whole lot 789.37s - 793.87s | less common to see and is not in many threat models of someone that's just smashing the window 793.87s - 798.11s | open. But you know what, if they smash that window open and walk through the window, at no 798.11s - 802.85s | point does the door open, at no point does that contact sensor trip and that person is inside 802.85s - 807.79s | without tripping the alarm. And so that's why something like an internal areas detector is 807.79s - 814.05s | worth considering. We also have PIR sensors in the village and a cool little corridor you 814.05s - 819.19s | can walk back and try to evade those. And so that's something


chunk_text:
respond fast enough with greater force to stop someone who has forced their way in. In 773.09s - 778.19s | just a time we'll skip through a few. There are some alarm bypasses that we talk about in 778.19s - 783.77s | the village. So if you have detection that's a magnetic contact sensor and that magnet can 783.77s - 789.37s | be bypassed by holding a surrogate magnet up to it. That's something that is a whole lot 789.37s - 793.87s | less common to see and is not in many threat models of someone that's just smashing the window 793.87s - 798.11s | open. But you know what, if they smash that window open and walk through the window, at no 798.11s - 802.85s | point does the door open, at no point does that contact sensor trip and that person is inside 802.85s - 807.79s | without tripping the alarm. And so that's why something like an internal areas detector is 807.79s - 814.05s | worth considering. We also have PIR sensors in the village and a cool little corridor you 814.05s - 819.19s | can walk back and try to evade those. And so that's something you can practice, get hands on 819.19s - 824.33s | with it and go back to your workplace and be like, I successfully evaded this at DEFCON, 824.33s - 829.97s | here's how I did it. And assess whether it's in your threat model for an attacker to actually 829.99s - 839.27s | try that. So we'll skip through a bunch in the interest of time. This is probably the most 839.27s - 845.95s | important diagram to understand for most workplaces. This is a standard setup for an 845.95s - 850.95s | electronic access control door. So you tap your fob, the door opens and you enter. What's 853.45s - 858.33s | important to consider now is what happens when you exit and what happens when someone forces 858.35s - 863.35s | in. When you exit, you tap or you don't tap the fob, you just approach the door on the secure 866.49s - 872.67s | side and this request to exit sensor, it uses passive infrared technology, detects that 872.67s - 877.07s | someone is exiting, it's gonna tell the alarm controller, someone's on the inside, someone's 877.07s - 882.21s | exiting, when the door opens and it's


chunk_text:
you can practice, get hands on 819.19s - 824.33s | with it and go back to your workplace and be like, I successfully evaded this at DEFCON, 824.33s - 829.97s | here's how I did it. And assess whether it's in your threat model for an attacker to actually 829.99s - 839.27s | try that. So we'll skip through a bunch in the interest of time. This is probably the most 839.27s - 845.95s | important diagram to understand for most workplaces. This is a standard setup for an 845.95s - 850.95s | electronic access control door. So you tap your fob, the door opens and you enter. What's 853.45s - 858.33s | important to consider now is what happens when you exit and what happens when someone forces 858.35s - 863.35s | in. When you exit, you tap or you don't tap the fob, you just approach the door on the secure 866.49s - 872.67s | side and this request to exit sensor, it uses passive infrared technology, detects that 872.67s - 877.07s | someone is exiting, it's gonna tell the alarm controller, someone's on the inside, someone's 877.07s - 882.21s | exiting, when the door opens and it's detected by this magnetic contact sensor, it says 882.23s - 889.71s | suppress the alarm, someone's exiting. When someone enters, they tap their badge here and 889.71s - 894.05s | then it detects door open, someone's entered, normal entry, no problem. If that door gets 894.05s - 899.05s | forced open, we have contact sensor breached, no exit detected here, no card swipe, that's 901.29s - 906.83s | when it's gonna send a door forced alarm. What happens with these door forced alarms, 80% 906.83s - 912.61s | of the time is nothing. They get logged somewhere, sometimes they don't even get logged, there 912.63s - 918.53s | is no response. And so we're not talking about hacking a functional system, we're talking 918.53s - 923.67s | about a system that was not functional from the start. Stupid shit. And that's the type of 923.67s - 928.37s | thing that is really gonna get employer's attentions and is worth bringing up before you 928.37s - 933.77s | start talking about hacks and bypasses and how you can cause a functional system to not 933.77s - 941.68s | work as intended. This is one of those things that's worth bringing up


chunk_text:
detected by this magnetic contact sensor, it says 882.23s - 889.71s | suppress the alarm, someone's exiting. When someone enters, they tap their badge here and 889.71s - 894.05s | then it detects door open, someone's entered, normal entry, no problem. If that door gets 894.05s - 899.05s | forced open, we have contact sensor breached, no exit detected here, no card swipe, that's 901.29s - 906.83s | when it's gonna send a door forced alarm. What happens with these door forced alarms, 80% 906.83s - 912.61s | of the time is nothing. They get logged somewhere, sometimes they don't even get logged, there 912.63s - 918.53s | is no response. And so we're not talking about hacking a functional system, we're talking 918.53s - 923.67s | about a system that was not functional from the start. Stupid shit. And that's the type of 923.67s - 928.37s | thing that is really gonna get employer's attentions and is worth bringing up before you 928.37s - 933.77s | start talking about hacks and bypasses and how you can cause a functional system to not 933.77s - 941.68s | work as intended. This is one of those things that's worth bringing up as well. Quick show 941.68s - 946.26s | of hands, who has seen or heard of the canned air attack? Where you trip those requests to 946.26s - 952.74s | exit sensors. So for those who haven't, it's where you spray canned air upside down under the 952.74s - 957.88s | door or through the door and it hits this request to exit sensor, it finds a thermal 957.88s - 963.38s | signature different than ambient, the door thinks someone is then leaving, and half the time 963.38s - 967.52s | it'll actually unlock the door at the mag strike here, or at the very least it will disable that 967.52s - 972.26s | door forced alarm and let you force your way through without setting off an alarm. That's 972.26s - 976.90s | something that's worth trying. And if that succeeds at your workplace, it is worth bringing 976.90s - 981.90s | that up. Uh going through events in the interest of time we'll we'll skip that. So a quick 984.58s - 991.02s | checklist to follow. Of just does your access control system function as intended? Does it 991.02s - 995.66s | allow entry to the correct card?


chunk_text:
as well. Quick show 941.68s - 946.26s | of hands, who has seen or heard of the canned air attack? Where you trip those requests to 946.26s - 952.74s | exit sensors. So for those who haven't, it's where you spray canned air upside down under the 952.74s - 957.88s | door or through the door and it hits this request to exit sensor, it finds a thermal 957.88s - 963.38s | signature different than ambient, the door thinks someone is then leaving, and half the time 963.38s - 967.52s | it'll actually unlock the door at the mag strike here, or at the very least it will disable that 967.52s - 972.26s | door forced alarm and let you force your way through without setting off an alarm. That's 972.26s - 976.90s | something that's worth trying. And if that succeeds at your workplace, it is worth bringing 976.90s - 981.90s | that up. Uh going through events in the interest of time we'll we'll skip that. So a quick 984.58s - 991.02s | checklist to follow. Of just does your access control system function as intended? Does it 991.02s - 995.66s | allow entry to the correct card? Deny entry to the wrong card? You would be surprised how 995.66s - 1000.66s | often that is misconfigured. Does it reliably allow egress without false alarming? Often 1002.84s - 1008.44s | these things are tuned too narrowly or the timing is set up wrong so that it doesn't 1008.44s - 1014.12s | correctly associate the two events of request to exit trip and contact sensor open. False 1014.12s - 1019.08s | alarms too much. What do facilities managers do when they get too many false alarms? They 1019.08s - 1024.52s | just turn off the damn alarm. And now you've got no detection, people can freely bypass 1024.52s - 1030.26s | forcible entry etc. Prop the door open for five minutes. Does it alarm? There should be 1030.26s - 1035.60s | door held detection on these things. If there is not, simply propping open the door, coming in 1035.60s - 1040.74s | open hours, propping it coming back later, let someone in, no detection whatsoever, and the 1040.74s - 1045.40s | door of course is propped and unlocked. And then simulate a forced entry. Test that that 1045.40s - 1050.24s | alarm system works, that it goes somewhere that


chunk_text:
Deny entry to the wrong card? You would be surprised how 995.66s - 1000.66s | often that is misconfigured. Does it reliably allow egress without false alarming? Often 1002.84s - 1008.44s | these things are tuned too narrowly or the timing is set up wrong so that it doesn't 1008.44s - 1014.12s | correctly associate the two events of request to exit trip and contact sensor open. False 1014.12s - 1019.08s | alarms too much. What do facilities managers do when they get too many false alarms? They 1019.08s - 1024.52s | just turn off the damn alarm. And now you've got no detection, people can freely bypass 1024.52s - 1030.26s | forcible entry etc. Prop the door open for five minutes. Does it alarm? There should be 1030.26s - 1035.60s | door held detection on these things. If there is not, simply propping open the door, coming in 1035.60s - 1040.74s | open hours, propping it coming back later, let someone in, no detection whatsoever, and the 1040.74s - 1045.40s | door of course is propped and unlocked. And then simulate a forced entry. Test that that 1045.40s - 1050.24s | alarm system works, that it goes somewhere that someone actually responds. How do you 1050.24s - 1058.49s | simulate a forced entry? So we'll pop back to the diagram here. You stand at the door, you 1058.49s - 1063.77s | wait for this detector to click back off, so it thinks it's been too long since someone's been 1063.77s - 1070.11s | at the door, and then you carefully open that door without tripping the request to exit 1070.11s - 1076.41s | sensor. Alternatively, you can do a bypass from the unsecure side, under door tool, poke the 1076.43s - 1082.51s | latch etc. Simulating a forced entry to- and testing whether that alarm actually gets set 1082.51s - 1089.11s | off. Cameras are also worth looking at. It is worth simply asking your employer, can I look at 1089.11s - 1093.15s | the camera feed? Once you've established that you know something about this field, and see if 1093.15s - 1097.89s | it would actually be useful. If there's some sort of crime or malfeasance here, is this gonna 1097.89s - 1103.49s | give us any value whatsoever? Absolutely not. It is far too far, far too grainy to see 1103.51s - 1110.05s | license plates, to


chunk_text:
someone actually responds. How do you 1050.24s - 1058.49s | simulate a forced entry? So we'll pop back to the diagram here. You stand at the door, you 1058.49s - 1063.77s | wait for this detector to click back off, so it thinks it's been too long since someone's been 1063.77s - 1070.11s | at the door, and then you carefully open that door without tripping the request to exit 1070.11s - 1076.41s | sensor. Alternatively, you can do a bypass from the unsecure side, under door tool, poke the 1076.43s - 1082.51s | latch etc. Simulating a forced entry to- and testing whether that alarm actually gets set 1082.51s - 1089.11s | off. Cameras are also worth looking at. It is worth simply asking your employer, can I look at 1089.11s - 1093.15s | the camera feed? Once you've established that you know something about this field, and see if 1093.15s - 1097.89s | it would actually be useful. If there's some sort of crime or malfeasance here, is this gonna 1097.89s - 1103.49s | give us any value whatsoever? Absolutely not. It is far too far, far too grainy to see 1103.51s - 1110.05s | license plates, to see faces, and we've got major washing out of the light contrast here. So 1110.05s - 1114.85s | lighting and cameras go hand in hand. If you have a camera that's directly illuminated, you can 1114.85s - 1117.85s | just look at it and see there's, there's a floodlight on this camera, well that's what it's 1117.85s - 1125.67s | gonna look like here. IR glare, cameras directly create the infrared light for night vision. When 1125.67s - 1131.67s | you see that with an object too close, it washes out the whole rest of the field of view. In this 1131.69s - 1135.73s | case it might have been a camera setup that was fine when it was installed, and then this tree 1135.73s - 1140.83s | grew over the, the subsequent years. So something worth looking at there as well. And then of 1140.83s - 1146.87s | course just resolution as well. A 360 degree camera gives you absolutely nothing to go off in 1146.87s - 1150.51s | terms of faces, license plates, the sort of thing that's actually gonna be useful for 1150.51s - 1163.12s | investigating if something happens down the road. And again, stupid shit.


chunk_text:
see faces, and we've got major washing out of the light contrast here. So 1110.05s - 1114.85s | lighting and cameras go hand in hand. If you have a camera that's directly illuminated, you can 1114.85s - 1117.85s | just look at it and see there's, there's a floodlight on this camera, well that's what it's 1117.85s - 1125.67s | gonna look like here. IR glare, cameras directly create the infrared light for night vision. When 1125.67s - 1131.67s | you see that with an object too close, it washes out the whole rest of the field of view. In this 1131.69s - 1135.73s | case it might have been a camera setup that was fine when it was installed, and then this tree 1135.73s - 1140.83s | grew over the, the subsequent years. So something worth looking at there as well. And then of 1140.83s - 1146.87s | course just resolution as well. A 360 degree camera gives you absolutely nothing to go off in 1146.87s - 1150.51s | terms of faces, license plates, the sort of thing that's actually gonna be useful for 1150.51s - 1163.12s | investigating if something happens down the road. And again, stupid shit. Tampering, blocking, 1163.14s - 1169.10s | and repositioning. Reach up this camera, point it at the sky. Stuff like this. Think about the 1169.10s - 1176.34s | third dimension. Someone coming in from the top and, and accessing those. A nice ladder is 1176.34s - 1182.32s | provided here to get access to that camera up there, and we see all the time cameras that, that 1182.32s - 1187.32s | get vandalized, repositioned, et cetera, in order to, to bypass that detection there. So quick 1188.00s - 1193.00s | test your camera coverage that you can do once you've established a bit of, of rapport with 1195.56s - 1201.04s | your facility's team. Do a walkthrough of your facility, entrances, exits, sensitive areas to 1201.04s - 1205.88s | be protected, and then check the footage after of that walkthrough. Can you see identifying 1205.88s - 1211.28s | per- details of the person on tape? Read license plates on vehicles? When is the person not in 1211.28s - 1217.02s | view? Can you tell what the person is doing? And then try in situations like at night, 1217.02s - 1223.36s | shutting off power, inclement weather. In all of these cases,


chunk_text:
Tampering, blocking, 1163.14s - 1169.10s | and repositioning. Reach up this camera, point it at the sky. Stuff like this. Think about the 1169.10s - 1176.34s | third dimension. Someone coming in from the top and, and accessing those. A nice ladder is 1176.34s - 1182.32s | provided here to get access to that camera up there, and we see all the time cameras that, that 1182.32s - 1187.32s | get vandalized, repositioned, et cetera, in order to, to bypass that detection there. So quick 1188.00s - 1193.00s | test your camera coverage that you can do once you've established a bit of, of rapport with 1195.56s - 1201.04s | your facility's team. Do a walkthrough of your facility, entrances, exits, sensitive areas to 1201.04s - 1205.88s | be protected, and then check the footage after of that walkthrough. Can you see identifying 1205.88s - 1211.28s | per- details of the person on tape? Read license plates on vehicles? When is the person not in 1211.28s - 1217.02s | view? Can you tell what the person is doing? And then try in situations like at night, 1217.02s - 1223.36s | shutting off power, inclement weather. In all of these cases, do you still have useful 1223.36s - 1232.24s | information, and if not, that's something that's worth bringing up. And of course, when dealing 1232.24s - 1237.28s | with any business, and we do this all the time, but particularly your own employer as an 1237.28s - 1241.98s | internal employee, you need to understand their threat model, what they're protecting, and the 1241.98s - 1246.98s | risks involved. So if the probability's very low, it takes a lot of skill, effort, et cetera, to 1249.42s - 1255.46s | do it, and the impact is not catastrophic to the business, the dollar value associated with 1255.46s - 1260.86s | fixing it that would make it worth it has to be very low. If it's gonna be an expensive fix, 1260.86s - 1265.90s | that's not worth it to do. And so applying everything over to this risk matrix here helps you 1265.90s - 1270.34s | prioritize in your mind what is worth bringing up. Cause if you bring up a whole bunch of low 1270.34s - 1276.18s | criticality items, they're gonna stop taking you seriously. So bring up the most, most 1276.20s - 1281.22s | critical, the easiest to


chunk_text:
do you still have useful 1223.36s - 1232.24s | information, and if not, that's something that's worth bringing up. And of course, when dealing 1232.24s - 1237.28s | with any business, and we do this all the time, but particularly your own employer as an 1237.28s - 1241.98s | internal employee, you need to understand their threat model, what they're protecting, and the 1241.98s - 1246.98s | risks involved. So if the probability's very low, it takes a lot of skill, effort, et cetera, to 1249.42s - 1255.46s | do it, and the impact is not catastrophic to the business, the dollar value associated with 1255.46s - 1260.86s | fixing it that would make it worth it has to be very low. If it's gonna be an expensive fix, 1260.86s - 1265.90s | that's not worth it to do. And so applying everything over to this risk matrix here helps you 1265.90s - 1270.34s | prioritize in your mind what is worth bringing up. Cause if you bring up a whole bunch of low 1270.34s - 1276.18s | criticality items, they're gonna stop taking you seriously. So bring up the most, most 1276.20s - 1281.22s | critical, the easiest to demonstrate. Again, that stupid shit, that reaching around and 1281.22s - 1286.22s | hitting the um, the crash bar, that hitting the button on the other side, misconfiguration, 1290.52s - 1295.06s | systems that don't work correctly in the first place, and then once you've got the system 1295.06s - 1300.56s | working correctly, then you can start hardening against bypasses where it matches your threat 1300.58s - 1306.22s | model correctly. So make a note of all findings, bring up the most critical to underscore 1306.22s - 1311.62s | importance, and get connected with your internal facilities team if there is one. If it's a 1311.62s - 1316.06s | small employer and there isn't, maybe that's gonna become part of your job. And that's 1316.06s - 1319.66s | something to think about if you want that to be the case. If you're here at this talk, if you're 1319.66s - 1324.80s | interested in this, you probably would love that to be the case. Uh, and don't be a pedant about 1324.80s - 1329.78s | low probability, low impact findings, prioritize things, and again, focus on getting systems 1329.80s - 1335.56s | working as intended before worrying about the


chunk_text:
demonstrate. Again, that stupid shit, that reaching around and 1281.22s - 1286.22s | hitting the um, the crash bar, that hitting the button on the other side, misconfiguration, 1290.52s - 1295.06s | systems that don't work correctly in the first place, and then once you've got the system 1295.06s - 1300.56s | working correctly, then you can start hardening against bypasses where it matches your threat 1300.58s - 1306.22s | model correctly. So make a note of all findings, bring up the most critical to underscore 1306.22s - 1311.62s | importance, and get connected with your internal facilities team if there is one. If it's a 1311.62s - 1316.06s | small employer and there isn't, maybe that's gonna become part of your job. And that's 1316.06s - 1319.66s | something to think about if you want that to be the case. If you're here at this talk, if you're 1319.66s - 1324.80s | interested in this, you probably would love that to be the case. Uh, and don't be a pedant about 1324.80s - 1329.78s | low probability, low impact findings, prioritize things, and again, focus on getting systems 1329.80s - 1335.56s | working as intended before worrying about the bypasses. So everything I've talked about 1335.56s - 1339.44s | today and a whole lot more, you can try in the physical security village just across the 1339.44s - 1344.44s | hall. I'll be beside the stage after this to take any questions, and thank you very much.


chunk_text:
bypasses. So everything I've talked about 1335.56s - 1339.44s | today and a whole lot more, you can try in the physical security village just across the 1339.44s - 1344.44s | hall. I'll be beside the stage after this to take any questions, and thank you very much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=zqGB07UaI6A", "title": "DEF CON 32 - Breaking Boundaries: Popping Shells in the Airgap w $10 & Arduino Magic - Daniel Beard", "description": "Many medical devices are \u201cnot connected to a network\u201d, so let\u2019s bring our own! This talk will teach you how to create a BadUSB device that can wirelessly execute payloads on \u201cairgapped\u201d systems like medical devices that aren\u2019t connected to the internet. With only $10 of off-the-shelf hardware and some basic Arduino code you too can start popping shells in the device lab.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1458, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.80s | This text was transcribed using whisper model: large-v2 All right. Welcome, everyone, to Popping Shells with $10 and a Bit of Arduino Magic, 4.80s - 13.20s | or aka Let's Redefine Physical Access. First off, who am I? I'm Dan Beard. I'm a software 13.20s - 18.40s | engineer at MedCrypt, used to direct MedISO, previously CTO of Promenade Software, where we 18.96s - 22.32s | worked on medical devices as a contractor, so worked with a lot of different companies. 23.12s - 26.80s | I personally coded on at least 10 different medical devices and collaborated on 26.80s - 31.84s | so many more, mostly in vitro diagnostic instruments, so that's like lab equipment, 32.72s - 37.92s | some implantables, some therapeutic devices, infusion pumps, you name it. The IVD and 37.92s - 41.04s | therapeutic are bolded because that's mainly what this attack is going to be against, 41.92s - 47.76s | not so much implantables. All views expressed are my own. My company is making me say this. 47.76s - 51.28s | It does not reflect the opinions of current or past employers. I did this all in my own time. 51.28s - 58.00s | It's all open source. Don't get mad at them. Okay. So medical device design 101, 58.00s - 62.08s | especially on those bolded ones, IVD or therapeutic devices in a hospital setting 62.08s - 69.52s | or lab environment, typically you're going to have the embedded board that is going to be doing the 69.52s - 74.00s | medical thing, whatever it is with the actual medicine. That's going to be running on something 74.00s - 78.56s | very important, like an RTOS. It's going to be bare metal. You're going to have a custom FPGA 78.56s - 82.24s |


chunk_text:
26.80s - 31.84s | so many more, mostly in vitro diagnostic instruments, so that's like lab equipment, 32.72s - 37.92s | some implantables, some therapeutic devices, infusion pumps, you name it. The IVD and 37.92s - 41.04s | therapeutic are bolded because that's mainly what this attack is going to be against, 41.92s - 47.76s | not so much implantables. All views expressed are my own. My company is making me say this. 47.76s - 51.28s | It does not reflect the opinions of current or past employers. I did this all in my own time. 51.28s - 58.00s | It's all open source. Don't get mad at them. Okay. So medical device design 101, 58.00s - 62.08s | especially on those bolded ones, IVD or therapeutic devices in a hospital setting 62.08s - 69.52s | or lab environment, typically you're going to have the embedded board that is going to be doing the 69.52s - 74.00s | medical thing, whatever it is with the actual medicine. That's going to be running on something 74.00s - 78.56s | very important, like an RTOS. It's going to be bare metal. You're going to have a custom FPGA 78.56s - 82.24s | because it needs to be time critical. You're not going to be running an operating system on that. 82.24s - 86.80s | However, for anything that has a user interface more complicated than maybe a couple buttons, 86.80s - 90.96s | you're going to have a main board or user interface board that's typically running 90.96s - 95.92s | Windows or Linux. Good old-fashioned Windows or unless you're doing something with Yocto, 95.92s - 102.16s | even good old-fashioned Linux, right? These are PCs that are connected via CAN bus, CAT6, RS232 102.16s - 106.24s | to the thing that's actually doing the medical thing. If you can own them, you can pretty much 106.24s - 112.48s | own the device. That's what we're going to be attacking through this vector. Some more definitions 112.48s - 116.72s | just to make sure we're all on the same page. What is bad USB? A lot of you probably know what that 116.72s - 122.64s | is, but let's catch some people up. It's, what, two decades old at this point? It's when a USB dongle 122.64s - 128.32s | announces itself as a human interface device. It says, I'm a mouse.


chunk_text:
because it needs to be time critical. You're not going to be running an operating system on that. 82.24s - 86.80s | However, for anything that has a user interface more complicated than maybe a couple buttons, 86.80s - 90.96s | you're going to have a main board or user interface board that's typically running 90.96s - 95.92s | Windows or Linux. Good old-fashioned Windows or unless you're doing something with Yocto, 95.92s - 102.16s | even good old-fashioned Linux, right? These are PCs that are connected via CAN bus, CAT6, RS232 102.16s - 106.24s | to the thing that's actually doing the medical thing. If you can own them, you can pretty much 106.24s - 112.48s | own the device. That's what we're going to be attacking through this vector. Some more definitions 112.48s - 116.72s | just to make sure we're all on the same page. What is bad USB? A lot of you probably know what that 116.72s - 122.64s | is, but let's catch some people up. It's, what, two decades old at this point? It's when a USB dongle 122.64s - 128.32s | announces itself as a human interface device. It says, I'm a mouse. I'm a keyboard. I'm a USB 128.32s - 133.04s | Ethernet controller. I'm a USB COM port, right? Operating system, there's no signature checks on 133.04s - 137.60s | that. There's no validation that you are what you say you are. It just believes you and goes, 137.60s - 141.52s | okay, cool, you're a keyboard. Give me some keys. Oh, you're a mouse? All right, give me some mouse 141.52s - 148.40s | events. COM port? Sure, why not? Here's input and output, right? Some examples of this are from our 148.40s - 154.32s | friends at Hack5 and OMG. You got the rubber ducky. You got the OMG elite cable. These are things you 154.32s - 163.92s | can buy right now. So bad USB in my med device? It's not that bad. You know, to, to exploit it, 163.92s - 169.52s | you'd need physical access for an extended period of time. You'd probably need an internet connection 169.52s - 173.28s | for persistence and, you know, we're air gapped or we do, we have a network connection, but it 173.28s - 177.12s | can't reach out to the internet. So you can't download payloads and you'd


chunk_text:
I'm a keyboard. I'm a USB 128.32s - 133.04s | Ethernet controller. I'm a USB COM port, right? Operating system, there's no signature checks on 133.04s - 137.60s | that. There's no validation that you are what you say you are. It just believes you and goes, 137.60s - 141.52s | okay, cool, you're a keyboard. Give me some keys. Oh, you're a mouse? All right, give me some mouse 141.52s - 148.40s | events. COM port? Sure, why not? Here's input and output, right? Some examples of this are from our 148.40s - 154.32s | friends at Hack5 and OMG. You got the rubber ducky. You got the OMG elite cable. These are things you 154.32s - 163.92s | can buy right now. So bad USB in my med device? It's not that bad. You know, to, to exploit it, 163.92s - 169.52s | you'd need physical access for an extended period of time. You'd probably need an internet connection 169.52s - 173.28s | for persistence and, you know, we're air gapped or we do, we have a network connection, but it 173.28s - 177.12s | can't reach out to the internet. So you can't download payloads and you'd have to do it to a 177.12s - 181.52s | logged in session. And we make people log in and out all the time. So it, it's really not, not that 181.52s - 186.08s | big a deal. And you may be looking at this and rolling your eyes, but having been in the industry 186.08s - 190.96s | for 10 years, I saw this on threat models. I heard it at the biohacking village when I was able to 190.96s - 194.64s | like pop a shell by hooking up a keyboard and typing on it. These are things that people say, 194.64s - 201.04s | and it's kind of been industry standard for a while now. So last year, after I got told it again, 201.04s - 204.80s | and I got tired of hearing it, I'm like, no, I'm going to prove you guys wrong. These, these 204.80s - 209.52s | assumptions, they don't hold. To exploit it does not require physical access for an extended period 209.52s - 214.00s | of time, only for a very short amount of time. It does not require an internet connection for 214.00s - 218.48s | persistence, but we can


chunk_text:
have to do it to a 177.12s - 181.52s | logged in session. And we make people log in and out all the time. So it, it's really not, not that 181.52s - 186.08s | big a deal. And you may be looking at this and rolling your eyes, but having been in the industry 186.08s - 190.96s | for 10 years, I saw this on threat models. I heard it at the biohacking village when I was able to 190.96s - 194.64s | like pop a shell by hooking up a keyboard and typing on it. These are things that people say, 194.64s - 201.04s | and it's kind of been industry standard for a while now. So last year, after I got told it again, 201.04s - 204.80s | and I got tired of hearing it, I'm like, no, I'm going to prove you guys wrong. These, these 204.80s - 209.52s | assumptions, they don't hold. To exploit it does not require physical access for an extended period 209.52s - 214.00s | of time, only for a very short amount of time. It does not require an internet connection for 214.00s - 218.48s | persistence, but we can bring our own internet connection and we can wait and deploy payloads 218.48s - 222.08s | whenever we want. We don't have to do it right, right when we plug it in, right? We can wait until 222.08s - 226.24s | it's nighttime and we can wait until we see someone log in or, or something, or using the device. 227.84s - 231.68s | Um, so to prove that wrong, to build a device that would do that, we kind of want three things. 231.68s - 237.60s | We want something that's wireless, so it has a wifi radio. We want something that's cheap, 237.60s - 241.28s | so we can leave it in there and walk away and don't care that we never get it back. 241.28s - 246.16s | And we need something that can actually emulate a USB hit device. So these, these are kind of the 246.16s - 252.32s | three requirements. Our friends at LilyGo have us covered on all three of those fronts. This is the 252.32s - 259.84s | T-Dongle S3. It's a $10, $10 and 50 cents, thanks inflation, out of China, uh, $15 out of their US 259.84s - 263.92s |


chunk_text:
bring our own internet connection and we can wait and deploy payloads 218.48s - 222.08s | whenever we want. We don't have to do it right, right when we plug it in, right? We can wait until 222.08s - 226.24s | it's nighttime and we can wait until we see someone log in or, or something, or using the device. 227.84s - 231.68s | Um, so to prove that wrong, to build a device that would do that, we kind of want three things. 231.68s - 237.60s | We want something that's wireless, so it has a wifi radio. We want something that's cheap, 237.60s - 241.28s | so we can leave it in there and walk away and don't care that we never get it back. 241.28s - 246.16s | And we need something that can actually emulate a USB hit device. So these, these are kind of the 246.16s - 252.32s | three requirements. Our friends at LilyGo have us covered on all three of those fronts. This is the 252.32s - 259.84s | T-Dongle S3. It's a $10, $10 and 50 cents, thanks inflation, out of China, uh, $15 out of their US 259.84s - 263.92s | warehouse. So if you want to get it just that little bit faster, uh, it's only $5 more. It 263.92s - 269.44s | looks like a USB device. It's got a fancy color screen. It has wifi and Bluetooth if you want to 269.44s - 274.48s | use Bluetooth and you can program it in insert language here, C++, MicroPython, Arduino, anything 274.48s - 281.92s | the ESP32 can do that you can program it with. Um, so introducing, drum roll please, the software 281.92s - 292.48s | to do it, RadioJack, hence the red, the red shirt. Yeah. All right. Um, so on the T-Dongle S3, I have 292.48s - 298.72s | a whole bag here flashed, uh, with this open source software. It's open source at RadioJack.io. 298.72s - 304.16s | It emulates a keyboard and mouse. It hosts its own wifi server. You can telnet to it. You can drop 304.16s - 308.72s | payloads. Right now there's pre-programmed a Windows payload for having a PowerShell, a prompt, 308.72s - 312.80s | and I'll go over how that exactly how that works, but nothing says it couldn't work on Linux. I was 312.80s - 316.48s | just


chunk_text:
warehouse. So if you want to get it just that little bit faster, uh, it's only $5 more. It 263.92s - 269.44s | looks like a USB device. It's got a fancy color screen. It has wifi and Bluetooth if you want to 269.44s - 274.48s | use Bluetooth and you can program it in insert language here, C++, MicroPython, Arduino, anything 274.48s - 281.92s | the ESP32 can do that you can program it with. Um, so introducing, drum roll please, the software 281.92s - 292.48s | to do it, RadioJack, hence the red, the red shirt. Yeah. All right. Um, so on the T-Dongle S3, I have 292.48s - 298.72s | a whole bag here flashed, uh, with this open source software. It's open source at RadioJack.io. 298.72s - 304.16s | It emulates a keyboard and mouse. It hosts its own wifi server. You can telnet to it. You can drop 304.16s - 308.72s | payloads. Right now there's pre-programmed a Windows payload for having a PowerShell, a prompt, 308.72s - 312.80s | and I'll go over how that exactly how that works, but nothing says it couldn't work on Linux. I was 312.80s - 316.48s | just too lazy to put it together. Okay. I didn't have enough time. You can do it too. I await your 316.48s - 321.52s | pull requests. Please issue pull requests. Uh, it's reflashable so you can change it over and 321.52s - 325.36s | over. And of course it has a laughing skull animation. What hacker tool would be complete 325.36s - 344.03s | without a laughing skull animation? Um, anyone want this one? All right. All right. So, uh, 344.03s - 349.31s | it's programmed in Arduino. Why Arduino? First and foremost, most importantly, the drivers just 349.31s - 353.71s | kind of worked and I didn't have to mess around with them the first try. Um, and again, I'm lazy. 353.71s - 357.95s | So I just went with it. Uh, both the hit and wifi libraries worked out of the box. There was, 357.95s - 362.99s | there was no mucking around. It's real easy, but secondarily to prove how, how easy I'm not doing 362.99s - 367.07s | some complicated thing up here. I'm not releasing an O day that took a PhD six months of like 367.07s - 372.83s | intense genius work. High schoolers


chunk_text:
too lazy to put it together. Okay. I didn't have enough time. You can do it too. I await your 316.48s - 321.52s | pull requests. Please issue pull requests. Uh, it's reflashable so you can change it over and 321.52s - 325.36s | over. And of course it has a laughing skull animation. What hacker tool would be complete 325.36s - 344.03s | without a laughing skull animation? Um, anyone want this one? All right. All right. So, uh, 344.03s - 349.31s | it's programmed in Arduino. Why Arduino? First and foremost, most importantly, the drivers just 349.31s - 353.71s | kind of worked and I didn't have to mess around with them the first try. Um, and again, I'm lazy. 353.71s - 357.95s | So I just went with it. Uh, both the hit and wifi libraries worked out of the box. There was, 357.95s - 362.99s | there was no mucking around. It's real easy, but secondarily to prove how, how easy I'm not doing 362.99s - 367.07s | some complicated thing up here. I'm not releasing an O day that took a PhD six months of like 367.07s - 372.83s | intense genius work. High schoolers learn this crap, right? I am dumb. If I can do this, anyone 372.83s - 380.11s | can do this. This is not, this is not, you know, some out there like government level attack. Um, 380.11s - 385.15s | so how to use that one that you just got, you plug it into the target, you connect to the SSID 385.15s - 390.19s | that's displayed on the screen. Each one is using the, um, the serial number of the device. So it 390.19s - 394.51s | has a different SSID. So if you want to go over to the biohacking village right now and connect 394.51s - 399.31s | it up to a medical device, each user should have a different SSID so that you're not connecting to 399.31s - 402.91s | the wrong one. You don't know which one you're connecting to. The passwords are all the same 402.91s - 407.87s | in the base firmware. The password is the password, all lowercase, real easy to remember. 408.43s - 413.55s | You tell net to the IP that's shown on the screen and you follow the good command line interface. 413.55s - 418.19s | Um, some of


chunk_text:
learn this crap, right? I am dumb. If I can do this, anyone 372.83s - 380.11s | can do this. This is not, this is not, you know, some out there like government level attack. Um, 380.11s - 385.15s | so how to use that one that you just got, you plug it into the target, you connect to the SSID 385.15s - 390.19s | that's displayed on the screen. Each one is using the, um, the serial number of the device. So it 390.19s - 394.51s | has a different SSID. So if you want to go over to the biohacking village right now and connect 394.51s - 399.31s | it up to a medical device, each user should have a different SSID so that you're not connecting to 399.31s - 402.91s | the wrong one. You don't know which one you're connecting to. The passwords are all the same 402.91s - 407.87s | in the base firmware. The password is the password, all lowercase, real easy to remember. 408.43s - 413.55s | You tell net to the IP that's shown on the screen and you follow the good command line interface. 413.55s - 418.19s | Um, some of the features that has out of the box are drop the payload, open a remote PowerShell 418.19s - 421.47s | prompt, uh, type as a keyboard, you can type whatever you want. It'll emulate the keyboard 421.47s - 424.51s | and just type it out. So if you need to do like a password prompt or something before you drop 424.51s - 428.75s | the payload and you know the password, you can do it that way. Um, and as a comport, that's how 428.75s - 435.76s | the payload communicates with you. Uh, when you get a shell is through a virtual comport. Uh, 435.76s - 440.80s | here's, you know, kind of to visualize what's going on here. Step zero not shown is actually 440.80s - 447.12s | plug it into the device. So walk by and just knock it in. Step one is connect to the wifi, 447.12s - 451.84s | drop the payload. The payload opens up a PowerShell prompt very quickly types up a whole 451.84s - 457.12s | bunch of PowerShell code, minimizes itself. And what that PowerShell code does is it waits for 457.12s - 462.96s | a connection on the comport, the


chunk_text:
the features that has out of the box are drop the payload, open a remote PowerShell 418.19s - 421.47s | prompt, uh, type as a keyboard, you can type whatever you want. It'll emulate the keyboard 421.47s - 424.51s | and just type it out. So if you need to do like a password prompt or something before you drop 424.51s - 428.75s | the payload and you know the password, you can do it that way. Um, and as a comport, that's how 428.75s - 435.76s | the payload communicates with you. Uh, when you get a shell is through a virtual comport. Uh, 435.76s - 440.80s | here's, you know, kind of to visualize what's going on here. Step zero not shown is actually 440.80s - 447.12s | plug it into the device. So walk by and just knock it in. Step one is connect to the wifi, 447.12s - 451.84s | drop the payload. The payload opens up a PowerShell prompt very quickly types up a whole 451.84s - 457.12s | bunch of PowerShell code, minimizes itself. And what that PowerShell code does is it waits for 457.12s - 462.96s | a connection on the comport, the virtual USB comport and just pipes text back and forth. 462.96s - 466.56s | So anything you type goes to PowerShell. Anything it types goes back to you over telnet. 467.52s - 472.00s | Remember this is wifi. So you can be the one room over, right? You can, you don't have to be at the 472.00s - 476.80s | device. You can look like you're really innocent over there with your, your phone on your SSH. 476.80s - 483.92s | You're just texting, but really you're typing on a, a shell. Um, let's see if my internet access 483.92s - 493.02s | is going to break this. So proof of concept, I know everyone POC or GTFO. Let's see if this launches. 493.50s - 506.83s | There we go. So here's an example plugged into my windows, a gaming PC, say drop the payload. 506.83s - 521.41s | It just dropped it. I entered into serial mode and now the PowerShell prompt, I can do whatever 521.41s - 531.23s | I want on that computer as the current user. Uh, and if anyone's thinking windows on my medical, 531.23s - 547.73s | yes, windows is everywhere in medical trust


chunk_text:
virtual USB comport and just pipes text back and forth. 462.96s - 466.56s | So anything you type goes to PowerShell. Anything it types goes back to you over telnet. 467.52s - 472.00s | Remember this is wifi. So you can be the one room over, right? You can, you don't have to be at the 472.00s - 476.80s | device. You can look like you're really innocent over there with your, your phone on your SSH. 476.80s - 483.92s | You're just texting, but really you're typing on a, a shell. Um, let's see if my internet access 483.92s - 493.02s | is going to break this. So proof of concept, I know everyone POC or GTFO. Let's see if this launches. 493.50s - 506.83s | There we go. So here's an example plugged into my windows, a gaming PC, say drop the payload. 506.83s - 521.41s | It just dropped it. I entered into serial mode and now the PowerShell prompt, I can do whatever 521.41s - 531.23s | I want on that computer as the current user. Uh, and if anyone's thinking windows on my medical, 531.23s - 547.73s | yes, windows is everywhere in medical trust me. So I did this about October. I was, I was high 547.73s - 550.69s | off Defcon. I was like, I'm going to code this thing and approve these people wrong. I'm going 550.85s - 557.01s | to be so cool. Maybe I'll get a talk out of it at biohacking village. Like, yeah, all right. I'm 557.01s - 564.37s | stoked. And, uh, not even a week after my first to get hub commit for the, for the POC, um, OMG 564.37s - 572.85s | cable released this into their firmware wasted. Oh, they did it better than me. Oh no. The stealth 572.85s - 578.77s | link cable overhead X, I hit X still think. So it looks like a USB cable. It's the OMG cable. 578.77s - 583.57s | It looks amazing. It uses the same kind of backdoor thing where it drops a payload and you 583.57s - 589.57s | can do a backdoor. Um, it, it does it over the hit packets instead of a comport, which is more 589.57s - 594.61s | elegant. Honestly, it's a great way of doing it. It's got sexy marketing. It's ready to buy today. 594.61s - 598.69s


chunk_text:
me. So I did this about October. I was, I was high 547.73s - 550.69s | off Defcon. I was like, I'm going to code this thing and approve these people wrong. I'm going 550.85s - 557.01s | to be so cool. Maybe I'll get a talk out of it at biohacking village. Like, yeah, all right. I'm 557.01s - 564.37s | stoked. And, uh, not even a week after my first to get hub commit for the, for the POC, um, OMG 564.37s - 572.85s | cable released this into their firmware wasted. Oh, they did it better than me. Oh no. The stealth 572.85s - 578.77s | link cable overhead X, I hit X still think. So it looks like a USB cable. It's the OMG cable. 578.77s - 583.57s | It looks amazing. It uses the same kind of backdoor thing where it drops a payload and you 583.57s - 589.57s | can do a backdoor. Um, it, it does it over the hit packets instead of a comport, which is more 589.57s - 594.61s | elegant. Honestly, it's a great way of doing it. It's got sexy marketing. It's ready to buy today. 594.61s - 598.69s | And, uh, it's just kind of way better than my hobby project. I, I still stand by though, 598.69s - 603.25s | that radio jack is a better name than hit X stealth link. So hack five, if you want to like 603.25s - 609.82s | buy the URL off me, call me, you know? Uh, so I'm like, I'm going to one up them. What can I do on 609.82s - 613.42s | my hobby project? It's going to be better than this like sexy polished thing that costs a lot 613.42s - 619.34s | of money and they put a lot of work into, right? Enter LoRa. So LilyGo, same company, makes an 619.34s - 625.10s | almost as cheap, right? $15 to $20, depending on which warehouse you buy it from. The LoRa S3. So 625.10s - 629.10s | it, it's still cheap. It kind of has a screen. It's not color, but it's still a cool screen. 629.90s - 635.18s | Still has wifi and Bluetooth, still programming Arduino, but it's got LoRa, which means we can do 635.18s - 641.82s | things a lot longer range. If you don't know what LoRa is, it's


chunk_text:
| And, uh, it's just kind of way better than my hobby project. I, I still stand by though, 598.69s - 603.25s | that radio jack is a better name than hit X stealth link. So hack five, if you want to like 603.25s - 609.82s | buy the URL off me, call me, you know? Uh, so I'm like, I'm going to one up them. What can I do on 609.82s - 613.42s | my hobby project? It's going to be better than this like sexy polished thing that costs a lot 613.42s - 619.34s | of money and they put a lot of work into, right? Enter LoRa. So LilyGo, same company, makes an 619.34s - 625.10s | almost as cheap, right? $15 to $20, depending on which warehouse you buy it from. The LoRa S3. So 625.10s - 629.10s | it, it's still cheap. It kind of has a screen. It's not color, but it's still a cool screen. 629.90s - 635.18s | Still has wifi and Bluetooth, still programming Arduino, but it's got LoRa, which means we can do 635.18s - 641.82s | things a lot longer range. If you don't know what LoRa is, it's a long distance radio. You don't 641.82s - 644.46s | need to have a license. You can go out and use it right now. It's on the consumer bands. 645.18s - 649.26s | Theoretical range of three plus miles. Uh, realistically, I, I could only test it to a 649.26s - 653.90s | mile and a half before I run into line of sight issues. So I don't know. Um, but theoretically 653.90s - 658.78s | more than pretty much my three plus miles. Um, and it does kind of sort of require line of sight. 658.78s - 663.50s | Like if it's, if it's on a device and you have like close to a window, you can, you can still 663.50s - 667.50s | kind of get in. It'll reflect off the walls and it works. You don't need to be in the window, 667.50s - 672.62s | but if you were in, let's say a, you know, an MRI lab or radiology lab without any windows in the 672.62s - 680.75s | basement, you're not going to get out. So how to use it on literally this, this device, exactly 680.75s - 686.03s | the same, same SSID,


chunk_text:
a long distance radio. You don't 641.82s - 644.46s | need to have a license. You can go out and use it right now. It's on the consumer bands. 645.18s - 649.26s | Theoretical range of three plus miles. Uh, realistically, I, I could only test it to a 649.26s - 653.90s | mile and a half before I run into line of sight issues. So I don't know. Um, but theoretically 653.90s - 658.78s | more than pretty much my three plus miles. Um, and it does kind of sort of require line of sight. 658.78s - 663.50s | Like if it's, if it's on a device and you have like close to a window, you can, you can still 663.50s - 667.50s | kind of get in. It'll reflect off the walls and it works. You don't need to be in the window, 667.50s - 672.62s | but if you were in, let's say a, you know, an MRI lab or radiology lab without any windows in the 672.62s - 680.75s | basement, you're not going to get out. So how to use it on literally this, this device, exactly 680.75s - 686.03s | the same, same SSID, same password, follow the same prompts. Uh, you drop it, you drop the 686.03s - 692.83s | payload and it's just over LoRa instead of wifi. Got the same visualization here. Only difference 692.91s - 698.91s | is that, uh, if you, if you look, you have to have a LoRa board on the other side talking miles 698.91s - 705.55s | away and then it does the same, it's the same interface. Um, I live in Chicago. I'm lucky 705.55s - 708.91s | enough to live in the loop right here. I'm not going to tell you which building, but one of 708.91s - 715.71s | those. Um, and with a directional antenna, I was able to use a shell from 1.2 miles away. 715.71s - 722.62s | Yeah. How's that for physical access? So I kind of open it up to you again, open source, 722.70s - 727.98s | welcome all pull requests. Can we take it further? Can we do a multi-hop, uh, mesh-tastic network, 727.98s - 732.86s | right? Like in, in SoCal, they have a mesh-tastic network that goes from LA all the way down to 732.86s - 739.02s | Tijuana. Like, could you be


chunk_text:
same password, follow the same prompts. Uh, you drop it, you drop the 686.03s - 692.83s | payload and it's just over LoRa instead of wifi. Got the same visualization here. Only difference 692.91s - 698.91s | is that, uh, if you, if you look, you have to have a LoRa board on the other side talking miles 698.91s - 705.55s | away and then it does the same, it's the same interface. Um, I live in Chicago. I'm lucky 705.55s - 708.91s | enough to live in the loop right here. I'm not going to tell you which building, but one of 708.91s - 715.71s | those. Um, and with a directional antenna, I was able to use a shell from 1.2 miles away. 715.71s - 722.62s | Yeah. How's that for physical access? So I kind of open it up to you again, open source, 722.70s - 727.98s | welcome all pull requests. Can we take it further? Can we do a multi-hop, uh, mesh-tastic network, 727.98s - 732.86s | right? Like in, in SoCal, they have a mesh-tastic network that goes from LA all the way down to 732.86s - 739.02s | Tijuana. Like, could you be in another country and execute shell commands over just this, like 739.02s - 743.82s | hopping over a mesh-tastic network, right? Can we do a wifi bridge where it hops on, you know, 743.82s - 747.50s | a Starbucks wifi and now you could be anywhere in the world. You just got to know the IP address. 747.74s - 753.42s | What ideas do you have to make this attack better? Um, the, the takeaway for anyone who's 753.42s - 757.74s | building a device that's running on like a consumer Linux or windows is you only need a 757.74s - 762.30s | few minutes and a few dollars and you can exploit bad USB. You don't need an internet connection. 762.30s - 769.66s | You don't need extended physical access. Mitigations for anyone building a device. 769.66s - 774.46s | One, cover your USB ports. Like if you're not using them, cover them. If I need to take a 774.46s - 779.34s | Dremel to your device, then maybe I'll buy, you'd need extended physical access. Someone's 779.34s - 785.82s | going to notice that you were there, right? Okay. Someone might notice that if you, if you do


chunk_text:
in another country and execute shell commands over just this, like 739.02s - 743.82s | hopping over a mesh-tastic network, right? Can we do a wifi bridge where it hops on, you know, 743.82s - 747.50s | a Starbucks wifi and now you could be anywhere in the world. You just got to know the IP address. 747.74s - 753.42s | What ideas do you have to make this attack better? Um, the, the takeaway for anyone who's 753.42s - 757.74s | building a device that's running on like a consumer Linux or windows is you only need a 757.74s - 762.30s | few minutes and a few dollars and you can exploit bad USB. You don't need an internet connection. 762.30s - 769.66s | You don't need extended physical access. Mitigations for anyone building a device. 769.66s - 774.46s | One, cover your USB ports. Like if you're not using them, cover them. If I need to take a 774.46s - 779.34s | Dremel to your device, then maybe I'll buy, you'd need extended physical access. Someone's 779.34s - 785.82s | going to notice that you were there, right? Okay. Someone might notice that if you, if you do need 785.82s - 791.26s | them for maybe service or something like that, then disable the USB stack until the user does 791.26s - 796.94s | something explicit until they want to export a report until they say, Hey, I need a flash new 796.94s - 800.46s | firmware on the device, or Hey, I'm a service tech and I've logged in with my special service 800.46s - 806.62s | tech password, right? Don't just have it open all the time. Only have it open when you need it. 806.62s - 810.94s | And that's, um, that's a much smaller attack surface than just someone able to plug it in 810.94s - 818.08s | whenever they want. So that's it. Thank you. Anyone have any questions? And, uh, to encourage 818.08s - 827.30s | questions, I will be throwing out more of these to anyone who asks one. And I talked really fast. 827.30s - 831.46s | So I'm a little bit, a little bit, uh, soon. So I have lots of time for questions. 839.97s - 846.29s | The question was, what have I tested it on so far? So, so far, um, a couple of different 846.29s -


chunk_text:
need 785.82s - 791.26s | them for maybe service or something like that, then disable the USB stack until the user does 791.26s - 796.94s | something explicit until they want to export a report until they say, Hey, I need a flash new 796.94s - 800.46s | firmware on the device, or Hey, I'm a service tech and I've logged in with my special service 800.46s - 806.62s | tech password, right? Don't just have it open all the time. Only have it open when you need it. 806.62s - 810.94s | And that's, um, that's a much smaller attack surface than just someone able to plug it in 810.94s - 818.08s | whenever they want. So that's it. Thank you. Anyone have any questions? And, uh, to encourage 818.08s - 827.30s | questions, I will be throwing out more of these to anyone who asks one. And I talked really fast. 827.30s - 831.46s | So I'm a little bit, a little bit, uh, soon. So I have lots of time for questions. 839.97s - 846.29s | The question was, what have I tested it on so far? So, so far, um, a couple of different 846.29s - 852.05s | windows devices, um, mostly PCs. Um, there is one currently plugged into a medical device 852.05s - 856.29s | in the biohacking village that happens to be running a windows front end. So go ahead and 856.29s - 874.29s | check it out. It's already there. See if I can hit you with it. Ready? So the question was, 874.37s - 879.33s | can I access the machine or the boards to do something that do I need to access the machine? 879.33s - 893.54s | Ah, yeah. So here, let me throw you one. So typically, and this is typically, there are 893.54s - 899.14s | exceptions on most medical devices. They kind of assume that the physical connection is secure by 899.14s - 905.54s | itself. So if you, if you have like control of that main user interface board running windows, 905.54s - 909.94s | you can issue whatever commands it could issue to the RTOS. So there may be, 910.82s - 915.46s | there may be safety, uh, bounds. Like if you try and do something that's obviously not safe, 915.46s - 919.38s | it'll say no, but you got a lot of control


chunk_text:
852.05s | windows devices, um, mostly PCs. Um, there is one currently plugged into a medical device 852.05s - 856.29s | in the biohacking village that happens to be running a windows front end. So go ahead and 856.29s - 874.29s | check it out. It's already there. See if I can hit you with it. Ready? So the question was, 874.37s - 879.33s | can I access the machine or the boards to do something that do I need to access the machine? 879.33s - 893.54s | Ah, yeah. So here, let me throw you one. So typically, and this is typically, there are 893.54s - 899.14s | exceptions on most medical devices. They kind of assume that the physical connection is secure by 899.14s - 905.54s | itself. So if you, if you have like control of that main user interface board running windows, 905.54s - 909.94s | you can issue whatever commands it could issue to the RTOS. So there may be, 910.82s - 915.46s | there may be safety, uh, bounds. Like if you try and do something that's obviously not safe, 915.46s - 919.38s | it'll say no, but you got a lot of control that you really shouldn't have. You could 919.38s - 923.54s | dispense more medication than you should. You could raise temperatures higher than you should. 929.01s - 931.89s | Yeah. They assume that we're physically controlled. The only thing that can 931.89s - 935.49s | talk to us is our windows front end. And, and, and let's just secure that. 946.56s - 951.20s | So I didn't measure latency specifically. Uh, the wifi one is near imperceptible. 951.20s - 958.24s | The Laura one, um, the latency wasn't, wasn't bad, but the throughput was like a 28.8 K modem. 958.24s - 961.52s | So like you're, you're going back to the eighties, but Hey, for a shell, 961.52s - 978.19s | that's kind of all you need, right? You can still issue commands. Oh, it's like kind of, 978.19s - 982.99s | so the question was, have I set up the ESP 32 to like be a repeater almost and repeat 983.71s - 992.30s | the messages or so that w that was one of the things I wanted to do. Like that said, Hey, what, 992.30s - 996.30s | what else can we do with this right now? It's


chunk_text:
that you really shouldn't have. You could 919.38s - 923.54s | dispense more medication than you should. You could raise temperatures higher than you should. 929.01s - 931.89s | Yeah. They assume that we're physically controlled. The only thing that can 931.89s - 935.49s | talk to us is our windows front end. And, and, and let's just secure that. 946.56s - 951.20s | So I didn't measure latency specifically. Uh, the wifi one is near imperceptible. 951.20s - 958.24s | The Laura one, um, the latency wasn't, wasn't bad, but the throughput was like a 28.8 K modem. 958.24s - 961.52s | So like you're, you're going back to the eighties, but Hey, for a shell, 961.52s - 978.19s | that's kind of all you need, right? You can still issue commands. Oh, it's like kind of, 978.19s - 982.99s | so the question was, have I set up the ESP 32 to like be a repeater almost and repeat 983.71s - 992.30s | the messages or so that w that was one of the things I wanted to do. Like that said, Hey, what, 992.30s - 996.30s | what else can we do with this right now? It's just point to point, but there's no reason you 996.30s - 1004.54s | couldn't do that. Right. All right. Let's see if I can hit you. Did I get you that? Sorry. Okay. 1009.22s - 1022.30s | Sorry. Can you ask a little louder? Can I, Oh, can Laura go through windows? Absolutely can. 1022.30s - 1028.46s | It does affect the, um, the signal strength, but it absolutely can go through windows. And 1028.46s - 1034.46s | when I was testing it on my PC, I was just within visual range of a window and I was still able to 1034.46s - 1050.46s | access it. Have I tried doing it with the Mac? I haven't, but it would absolutely work. Uh, 1050.46s - 1055.74s | it would, the USB stack would be, it's a hid device. You would just need to change the, um, 1055.74s - 1059.34s | the payload. So instead of dropping into a PowerShell, you're dropping into a, whatever 1059.34s - 1073.95s | Mac is using these Z shell or whatever. Yeah. The question is, let's go to this side. I haven't just 1073.95s - 1077.79s | cause I have a medical background, but I


chunk_text:
just point to point, but there's no reason you 996.30s - 1004.54s | couldn't do that. Right. All right. Let's see if I can hit you. Did I get you that? Sorry. Okay. 1009.22s - 1022.30s | Sorry. Can you ask a little louder? Can I, Oh, can Laura go through windows? Absolutely can. 1022.30s - 1028.46s | It does affect the, um, the signal strength, but it absolutely can go through windows. And 1028.46s - 1034.46s | when I was testing it on my PC, I was just within visual range of a window and I was still able to 1034.46s - 1050.46s | access it. Have I tried doing it with the Mac? I haven't, but it would absolutely work. Uh, 1050.46s - 1055.74s | it would, the USB stack would be, it's a hid device. You would just need to change the, um, 1055.74s - 1059.34s | the payload. So instead of dropping into a PowerShell, you're dropping into a, whatever 1059.34s - 1073.95s | Mac is using these Z shell or whatever. Yeah. The question is, let's go to this side. I haven't just 1073.95s - 1077.79s | cause I have a medical background, but I mean, if they're running windows, Linux, or Mac, 1077.79s - 1104.26s | it's some sort of consumer operating system. It's going to work. So the question is if the, 1104.26s - 1111.70s | if the windows machine requires authentication, is there a bypass? So, so no, there's no bypass, 1111.70s - 1115.54s | but because you can wait, you can wait until someone logs in to drop the payload. It's not 1115.54s - 1119.30s | just plug it in. And then like, it starts doing the payload automatically. You can wait until you 1119.30s - 1122.34s | from across the room, see them log in and then go, ah, I'm going to, I dropped it. 1127.04s - 1131.84s | Okay. Let's see, let's get someone real far away. Let's that's where they're with the blue 1131.84s - 1142.96s | blinky badge. Yeah. What's the oldest OS I found in the wild windows XP. Okay. I'm going to, 1142.96s - 1152.66s | I'm going to check this. No, no guarantees it gets to you. Nice. All right. Uh, you there in 1152.66s - 1168.42s | the white shirt. So right now it's, it's manual, but once you're connected, you could script,


chunk_text:
mean, if they're running windows, Linux, or Mac, 1077.79s - 1104.26s | it's some sort of consumer operating system. It's going to work. So the question is if the, 1104.26s - 1111.70s | if the windows machine requires authentication, is there a bypass? So, so no, there's no bypass, 1111.70s - 1115.54s | but because you can wait, you can wait until someone logs in to drop the payload. It's not 1115.54s - 1119.30s | just plug it in. And then like, it starts doing the payload automatically. You can wait until you 1119.30s - 1122.34s | from across the room, see them log in and then go, ah, I'm going to, I dropped it. 1127.04s - 1131.84s | Okay. Let's see, let's get someone real far away. Let's that's where they're with the blue 1131.84s - 1142.96s | blinky badge. Yeah. What's the oldest OS I found in the wild windows XP. Okay. I'm going to, 1142.96s - 1152.66s | I'm going to check this. No, no guarantees it gets to you. Nice. All right. Uh, you there in 1152.66s - 1168.42s | the white shirt. So right now it's, it's manual, but once you're connected, you could script, 1168.42s - 1171.70s | I mean, it's over telnet. So like you could make a Python script to wait until something happens. 1174.90s - 1221.57s | All right. So the question was once, once you're connected to it, you can use it as a point to get 1221.57s - 1226.85s | into the rest, excuse me, of the network because you're right. You do have access as whoever the 1226.85s - 1233.33s | current user is. Um, I, I haven't done that, but that's, that's the beyond just hacking into a 1233.33s - 1238.29s | medical device. That's one of the reasons you want to protect against this is that now you have a 1238.29s - 1244.05s | point where you're, you're in the air gapped network. Right. And you are somewhat trusted 1244.05s - 1254.35s | probably. So yeah, you have, you could use that absolutely as a jumping off point. All right. Uh, 1254.35s - 1264.35s | in the orange shirt, I can't hear you from this far away. Sorry. 1274.06s - 1277.42s | So the, the question was, wouldn't someone notice you going up to a medical device and 1277.42s - 1288.13s | sticking the USB stick


chunk_text:
1168.42s - 1171.70s | I mean, it's over telnet. So like you could make a Python script to wait until something happens. 1174.90s - 1221.57s | All right. So the question was once, once you're connected to it, you can use it as a point to get 1221.57s - 1226.85s | into the rest, excuse me, of the network because you're right. You do have access as whoever the 1226.85s - 1233.33s | current user is. Um, I, I haven't done that, but that's, that's the beyond just hacking into a 1233.33s - 1238.29s | medical device. That's one of the reasons you want to protect against this is that now you have a 1238.29s - 1244.05s | point where you're, you're in the air gapped network. Right. And you are somewhat trusted 1244.05s - 1254.35s | probably. So yeah, you have, you could use that absolutely as a jumping off point. All right. Uh, 1254.35s - 1264.35s | in the orange shirt, I can't hear you from this far away. Sorry. 1274.06s - 1277.42s | So the, the question was, wouldn't someone notice you going up to a medical device and 1277.42s - 1288.13s | sticking the USB stick in? You have a lot of confidence. Sorry. So the question was, 1288.13s - 1291.81s | wouldn't someone notice the, uh, the USB stick sticking out of the medical device? 1292.85s - 1297.89s | I mean, from my opinion, no, you'd, you'd have to have a lot of confidence in, in, you know, 1297.89s - 1302.69s | nurses and doctors noticing things to, to notice this little teeny thing sticking out. There's a 1302.69s - 1306.29s | lot of things that do plug in, you know, in and out of devices. I don't think they're going to 1306.29s - 1310.85s | notice something small. That being said, this specific device with the firmware that's flashed 1310.85s - 1317.33s | on it has a big skull on it. And the reason is, you know, I don't want people using this for evil, 1317.33s - 1322.05s | right? Like use this where, you know, when you have permission and if anyone sees it and has 1322.05s - 1326.21s | a skull on it, yeah, then they might ask some questions, but you know, you could change that 1326.21s - 1336.45s | in the firmware to not display a literal skull on a


chunk_text:
in? You have a lot of confidence. Sorry. So the question was, 1288.13s - 1291.81s | wouldn't someone notice the, uh, the USB stick sticking out of the medical device? 1292.85s - 1297.89s | I mean, from my opinion, no, you'd, you'd have to have a lot of confidence in, in, you know, 1297.89s - 1302.69s | nurses and doctors noticing things to, to notice this little teeny thing sticking out. There's a 1302.69s - 1306.29s | lot of things that do plug in, you know, in and out of devices. I don't think they're going to 1306.29s - 1310.85s | notice something small. That being said, this specific device with the firmware that's flashed 1310.85s - 1317.33s | on it has a big skull on it. And the reason is, you know, I don't want people using this for evil, 1317.33s - 1322.05s | right? Like use this where, you know, when you have permission and if anyone sees it and has 1322.05s - 1326.21s | a skull on it, yeah, then they might ask some questions, but you know, you could change that 1326.21s - 1336.45s | in the firmware to not display a literal skull on a screen. Right. Let's do it. Someone over here. 1341.36s - 1347.76s | I think this is USB 3.0. Oh, USB-C version. They don't have a USB-C version. No, 1347.76s - 1352.16s | but honestly email Lily go and say, Hey, I want a USB-C version. They might make it. 1357.57s - 1359.89s | Nope. That was a bad one. Sorry. All right. All the way over here. 1364.83s - 1369.79s | What got me interested? So the question was, what got me interested in developing this? It was 1369.79s - 1374.03s | one that I heard that, that quote that I was saying, right? Well, it's not that big a deal. 1374.03s - 1378.27s | Someone would notice and you were air gap. So it doesn't really matter, or we are connected 1378.27s - 1381.79s | to a network, but you know, it's, it's the network's protected. You don't actually have 1381.79s - 1386.75s | internet access. Right. Hearing that over and over and over again, and kind of scratching my head 1386.75s - 1390.75s | and going, that doesn't, that doesn't seem right. It seems like someone could bring their own wifi 1390.75s - 1397.23s | network. Right. And


chunk_text:
screen. Right. Let's do it. Someone over here. 1341.36s - 1347.76s | I think this is USB 3.0. Oh, USB-C version. They don't have a USB-C version. No, 1347.76s - 1352.16s | but honestly email Lily go and say, Hey, I want a USB-C version. They might make it. 1357.57s - 1359.89s | Nope. That was a bad one. Sorry. All right. All the way over here. 1364.83s - 1369.79s | What got me interested? So the question was, what got me interested in developing this? It was 1369.79s - 1374.03s | one that I heard that, that quote that I was saying, right? Well, it's not that big a deal. 1374.03s - 1378.27s | Someone would notice and you were air gap. So it doesn't really matter, or we are connected 1378.27s - 1381.79s | to a network, but you know, it's, it's the network's protected. You don't actually have 1381.79s - 1386.75s | internet access. Right. Hearing that over and over and over again, and kind of scratching my head 1386.75s - 1390.75s | and going, that doesn't, that doesn't seem right. It seems like someone could bring their own wifi 1390.75s - 1397.23s | network. Right. And then searching around and before the OMG cable released a HIDAC stealth 1397.23s - 1402.43s | link, there was, there was nothing that I could find that had that. So, okay, I'll build it. And, 1402.43s - 1413.78s | and now you can't say that to me anymore. Right. How are we doing on time? Okay. I got one more 1413.78s - 1425.30s | minute. So I can answer one more question. You there. Are there any limitations on the device? 1429.63s - 1437.44s | I can't hear you over the person talking behind me. Ah, the only limitation is the memory on 1437.44s - 1450.38s | the device itself. Oh, 128 Meg. So yeah, you can have a pretty big payload. All right. Thanks, 1450.38s - 1454.54s | everyone. I'll be, I'll be dropping these off to other people later. So I still have about like 10 1454.54s - 1458.14s | and then I can, I can give out.


chunk_text:
then searching around and before the OMG cable released a HIDAC stealth 1397.23s - 1402.43s | link, there was, there was nothing that I could find that had that. So, okay, I'll build it. And, 1402.43s - 1413.78s | and now you can't say that to me anymore. Right. How are we doing on time? Okay. I got one more 1413.78s - 1425.30s | minute. So I can answer one more question. You there. Are there any limitations on the device? 1429.63s - 1437.44s | I can't hear you over the person talking behind me. Ah, the only limitation is the memory on 1437.44s - 1450.38s | the device itself. Oh, 128 Meg. So yeah, you can have a pretty big payload. All right. Thanks, 1450.38s - 1454.54s | everyone. I'll be, I'll be dropping these off to other people later. So I still have about like 10 1454.54s - 1458.14s | and then I can, I can give out.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=wCt-93lEIME", "title": "DEF CON 32 - Exposing the Occultations in Large Off-Grid Solar Systems - Dan Berte & Alexandru Lazar", "description": "This talk reveals stunning vulnerability findings in leading solar manufacturers that, when exploited, the stake is the grid. We'll explore three massive vulns in the management platform and discuss how they can be weaponized to become chilling nation security risks.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1085, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.00s | This text was transcribed using whisper model: large-v2 It didn't warn me it was gonna be bright, so 3.16s - 5.80s | We still got people coming in but so this is 6.88s - 12.64s | Gonna start doing a little bit of the intro we're talking about. So while everybody comes in we'll get to the meat of it 12.64s - 13.64s | so 13.64s - 20.16s | Welcome. Oh, everybody's having a great great convention. Thanks for showing up. This is fantastic. We're really excited to talk about 21.20s - 25.16s | Some of this stuff because it's fresh off the presses. So we're gonna be talking about 27.12s - 29.12s | Photovoltaics 29.12s - 34.64s | And some of the findings that are recent for us so I have here with me 35.32s - 37.32s | Alexander Losser as one of a 38.52s - 44.56s | Scenarios query researchers. We both work for a company called Bitdefender. You may have heard of I 45.68s - 51.42s | Added a link here to our work so you can refer to it later some of the 53.24s - 55.24s | Vulnerability research that we do so 55.40s - 57.36s | We've been doing 57.36s - 62.12s | Among other things we've been doing IOT vulnerability research for the last 10 plus years 62.96s - 64.36s | on 64.36s - 69.72s | Normally and typically consumer grade devices that are popular or interesting or something that we find 70.44s - 74.24s | Just yeah interesting to look at so during this time. We've 75.08s - 82.76s | Published over 25 high-profile cases and findings and we have dozens of white papers that came out of that research 83.40s - 85.60s | this is a pretty small team, but 86.56s - 91.22s | It's been it's been really lucrative and and exciting on our academic and 91.92s - 95.12s | Educational side so


chunk_text:
the findings that are recent for us so I have here with me 35.32s - 37.32s | Alexander Losser as one of a 38.52s - 44.56s | Scenarios query researchers. We both work for a company called Bitdefender. You may have heard of I 45.68s - 51.42s | Added a link here to our work so you can refer to it later some of the 53.24s - 55.24s | Vulnerability research that we do so 55.40s - 57.36s | We've been doing 57.36s - 62.12s | Among other things we've been doing IOT vulnerability research for the last 10 plus years 62.96s - 64.36s | on 64.36s - 69.72s | Normally and typically consumer grade devices that are popular or interesting or something that we find 70.44s - 74.24s | Just yeah interesting to look at so during this time. We've 75.08s - 82.76s | Published over 25 high-profile cases and findings and we have dozens of white papers that came out of that research 83.40s - 85.60s | this is a pretty small team, but 86.56s - 91.22s | It's been it's been really lucrative and and exciting on our academic and 91.92s - 95.12s | Educational side so I want to quote a couple of a couple of 95.88s - 102.24s | High-profile cases that we we covered findings that we had so I'll say ring doorbell for example edge LG TVs 102.24s - 108.70s | This is something that's as fresh as a month old. Maybe you know the fire stick from Amazon. Maybe the August August lock ring a bell 110.04s - 111.56s | wise 111.80s - 114.48s | Outlet you fight ease of his cameras and more 115.84s - 118.68s | What's interesting that through our research and what we found? 119.24s - 121.24s | obviously beside vulnerabilities 121.28s - 127.90s | Is that more than 30% of the vendors never reply or they don't reply timely? 128.56s - 129.84s | and 129.84s - 132.40s | To our contact and we try to reach out to them and it takes 133.64s - 139.52s | Often it takes them more than 180 days to do so and what's even more concerning is that? 140.52s - 147.52s | 20% of these people take more than a year to fix the vulnerabilities that we are trying to communicate to them or never actually patch 147.52s - 151.92s |


chunk_text:
I want to quote a couple of a couple of 95.88s - 102.24s | High-profile cases that we we covered findings that we had so I'll say ring doorbell for example edge LG TVs 102.24s - 108.70s | This is something that's as fresh as a month old. Maybe you know the fire stick from Amazon. Maybe the August August lock ring a bell 110.04s - 111.56s | wise 111.80s - 114.48s | Outlet you fight ease of his cameras and more 115.84s - 118.68s | What's interesting that through our research and what we found? 119.24s - 121.24s | obviously beside vulnerabilities 121.28s - 127.90s | Is that more than 30% of the vendors never reply or they don't reply timely? 128.56s - 129.84s | and 129.84s - 132.40s | To our contact and we try to reach out to them and it takes 133.64s - 139.52s | Often it takes them more than 180 days to do so and what's even more concerning is that? 140.52s - 147.52s | 20% of these people take more than a year to fix the vulnerabilities that we are trying to communicate to them or never actually patch 147.52s - 151.92s | These sometimes or most of the times exceeding the end-of-life cycle of that product 151.92s - 157.44s | So here's a PSA to all the vendors if you could pass on the word 158.04s - 163.28s | Appoint a permanent contact set up a vulnerability disclosure program and a you're all for it 163.64s - 168.96s | Put a PGP PGP key on it and monitor that inbox can't stress that enough so 169.80s - 171.80s | and 171.84s - 174.52s | This is the has been for the last 175.48s - 182.44s | Decade and a half or more the most haunted terrorist in the United States and abroad when it comes to the power grid 183.24s - 185.24s | the squirrel 185.24s - 189.32s | And it's called squirrel terrorism. There is a squirrel index 189.84s - 194.12s | On Wikipedia and we have a couple of quotes here. For example, we have 194.84s - 195.92s | a 195.92s - 200.48s | Former deputy director of the NSA that said frankly the number one 201.52s - 204.44s | threat today to the grid is squirrels and 205.12s - 206.60s | then 206.60s - 211.56s | The threat to


chunk_text:
These sometimes or most of the times exceeding the end-of-life cycle of that product 151.92s - 157.44s | So here's a PSA to all the vendors if you could pass on the word 158.04s - 163.28s | Appoint a permanent contact set up a vulnerability disclosure program and a you're all for it 163.64s - 168.96s | Put a PGP PGP key on it and monitor that inbox can't stress that enough so 169.80s - 171.80s | and 171.84s - 174.52s | This is the has been for the last 175.48s - 182.44s | Decade and a half or more the most haunted terrorist in the United States and abroad when it comes to the power grid 183.24s - 185.24s | the squirrel 185.24s - 189.32s | And it's called squirrel terrorism. There is a squirrel index 189.84s - 194.12s | On Wikipedia and we have a couple of quotes here. For example, we have 194.84s - 195.92s | a 195.92s - 200.48s | Former deputy director of the NSA that said frankly the number one 201.52s - 204.44s | threat today to the grid is squirrels and 205.12s - 206.60s | then 206.60s - 211.56s | The threat to the Internet infrastructure services post by squirrels may exceed the one 212.36s - 216.72s | Post by cyber attacks and so on so on. So basically the narrative here is in general 217.60s - 220.84s | That cyber security is not really potential 221.48s - 226.20s | Straight-up concern when it comes to the power grid because most of the actual 227.64s - 229.64s | attacks were of natural causes 230.56s - 232.56s | Squirrels fires, whatever have you in general? 232.60s - 236.76s | The grid is really highly regulated and protected and secured 236.76s - 241.56s | So a lot of the cyber attack woes don't really apply even though we have you know 241.56s - 244.56s | Warnings from CIA with examples and NSA and all this stuff. So 245.32s - 246.76s | to that 246.76s - 248.76s | enter solar 249.12s - 251.60s | And this is what we're gonna talk quickly about today 251.60s - 257.60s | So obviously green energy is the forefront of everything that we do. So as it's transforming the global landscape 257.60s - 259.92s | We're seeing just you know last year 260.80s - 262.80s | over 500 gigawatts of


chunk_text:
the Internet infrastructure services post by squirrels may exceed the one 212.36s - 216.72s | Post by cyber attacks and so on so on. So basically the narrative here is in general 217.60s - 220.84s | That cyber security is not really potential 221.48s - 226.20s | Straight-up concern when it comes to the power grid because most of the actual 227.64s - 229.64s | attacks were of natural causes 230.56s - 232.56s | Squirrels fires, whatever have you in general? 232.60s - 236.76s | The grid is really highly regulated and protected and secured 236.76s - 241.56s | So a lot of the cyber attack woes don't really apply even though we have you know 241.56s - 244.56s | Warnings from CIA with examples and NSA and all this stuff. So 245.32s - 246.76s | to that 246.76s - 248.76s | enter solar 249.12s - 251.60s | And this is what we're gonna talk quickly about today 251.60s - 257.60s | So obviously green energy is the forefront of everything that we do. So as it's transforming the global landscape 257.60s - 259.92s | We're seeing just you know last year 260.80s - 262.80s | over 500 gigawatts of 263.40s - 265.64s | Of capacity added by solar 266.52s - 269.00s | Just last year, which is three-quarters 270.12s - 276.32s | It's a it's an explosive growth, which obviously is fantastic for us. But at the same but at the same time brings 277.32s - 279.16s | You know 279.16s - 286.76s | They you know, the growing number of systems obviously brings more interest and more focus to the to them to potential attackers 286.76s - 291.82s | So as the capacity increases, the question is, you know is security keeping up? 292.88s - 295.60s | As both businesses and consumers are starting to add 296.72s - 299.48s | solar panels to their to their portfolios now 300.32s - 306.52s | Again this space a solar is less hurdle hardened and regulated by as legacy 307.32s - 308.92s | power generation 308.92s - 315.32s | So to that point we investigated a manufacturer called day and a measurement platform called Solomon to find out 316.52s - 317.68s | Why? 317.68s - 322.20s | It's because these are smart systems and they can be obviously controlled remotely 323.32s - 325.32s | someone in our office noted something that


chunk_text:
263.40s - 265.64s | Of capacity added by solar 266.52s - 269.00s | Just last year, which is three-quarters 270.12s - 276.32s | It's a it's an explosive growth, which obviously is fantastic for us. But at the same but at the same time brings 277.32s - 279.16s | You know 279.16s - 286.76s | They you know, the growing number of systems obviously brings more interest and more focus to the to them to potential attackers 286.76s - 291.82s | So as the capacity increases, the question is, you know is security keeping up? 292.88s - 295.60s | As both businesses and consumers are starting to add 296.72s - 299.48s | solar panels to their to their portfolios now 300.32s - 306.52s | Again this space a solar is less hurdle hardened and regulated by as legacy 307.32s - 308.92s | power generation 308.92s - 315.32s | So to that point we investigated a manufacturer called day and a measurement platform called Solomon to find out 316.52s - 317.68s | Why? 317.68s - 322.20s | It's because these are smart systems and they can be obviously controlled remotely 323.32s - 325.32s | someone in our office noted something that was 326.08s - 332.96s | Interesting after installation, so we decided to keep digging an inverter and I'll show you I'll show you a 335.48s - 340.24s | Sketch just to see how the how the stuff works out could be added on both these platforms 341.24s - 346.36s | Using their apps. You just needed the serial number. So it was interesting enough 346.68s - 351.24s | So here's a diagram of a system and trying to understand how it works. This applies for both 352.36s - 354.36s | residential customers, but also 354.96s - 356.96s | Larger platforms as well. So you have 357.60s - 361.48s | You have the solar panels. Let's say you have solar panels on top 361.48s - 362.64s | You know on your home 362.64s - 369.32s | These connect to an inverter that feeds the grid the grid is connected to the inverters connected to a data logger 369.64s - 371.32s | that's a bridge between 371.32s - 372.92s | all these systems 372.92s - 379.28s | And the data logger sends information to a cloud platform that feeds into various application and management 379.76s - 382.64s | Systems as well. So


chunk_text:
was 326.08s - 332.96s | Interesting after installation, so we decided to keep digging an inverter and I'll show you I'll show you a 335.48s - 340.24s | Sketch just to see how the how the stuff works out could be added on both these platforms 341.24s - 346.36s | Using their apps. You just needed the serial number. So it was interesting enough 346.68s - 351.24s | So here's a diagram of a system and trying to understand how it works. This applies for both 352.36s - 354.36s | residential customers, but also 354.96s - 356.96s | Larger platforms as well. So you have 357.60s - 361.48s | You have the solar panels. Let's say you have solar panels on top 361.48s - 362.64s | You know on your home 362.64s - 369.32s | These connect to an inverter that feeds the grid the grid is connected to the inverters connected to a data logger 369.64s - 371.32s | that's a bridge between 371.32s - 372.92s | all these systems 372.92s - 379.28s | And the data logger sends information to a cloud platform that feeds into various application and management 379.76s - 382.64s | Systems as well. So again the logger the 383.56s - 387.32s | Is the conduit that connects everything to the internet and isn't, you know 387.32s - 391.64s | Responsible for the settings on the data collection and updates of the whole system 393.52s - 397.64s | In general it's these will be connected and they won't be 398.08s - 400.68s | Because they wouldn't work. Otherwise with a grant with a grid 400.88s - 406.56s | So obviously end users can control the system from the internet from their phones or just another platform 406.56s - 409.90s | and they can talk directly to the platform and I'm gonna invite Alex to 410.66s - 413.46s | Discuss and walk us through how we investigated the platform 416.94s - 421.58s | Okay, so we started with a man-in-the-middle attack on the day cloud app 422.22s - 426.30s | We only use the user certificate no need to patch the application 427.10s - 431.82s | Among the traffic we found a suspicion login request using hard-coded credentials 431.82s - 438.42s | I don't know if you can see them, but it is smart configurator at solarmanpv.com and the password 439.02s - 441.02s | 1 2


chunk_text:
again the logger the 383.56s - 387.32s | Is the conduit that connects everything to the internet and isn't, you know 387.32s - 391.64s | Responsible for the settings on the data collection and updates of the whole system 393.52s - 397.64s | In general it's these will be connected and they won't be 398.08s - 400.68s | Because they wouldn't work. Otherwise with a grant with a grid 400.88s - 406.56s | So obviously end users can control the system from the internet from their phones or just another platform 406.56s - 409.90s | and they can talk directly to the platform and I'm gonna invite Alex to 410.66s - 413.46s | Discuss and walk us through how we investigated the platform 416.94s - 421.58s | Okay, so we started with a man-in-the-middle attack on the day cloud app 422.22s - 426.30s | We only use the user certificate no need to patch the application 427.10s - 431.82s | Among the traffic we found a suspicion login request using hard-coded credentials 431.82s - 438.42s | I don't know if you can see them, but it is smart configurator at solarmanpv.com and the password 439.02s - 441.02s | 1 2 3 4 5 6 441.22s - 443.22s | First place on the rocky list 444.95s - 450.03s | Okay, what is the account used for it gets information about a user's device? 450.35s - 453.99s | For example the model the version and a password 454.75s - 461.11s | This account is not linked to any user account. So it works for any device no matter who owns them 461.91s - 468.11s | Now I mentioned the password a logger while it is running has an access point active 468.63s - 474.23s | The SSID of the access point has a convenient naming scheme it starts with a P 474.87s - 481.15s | Underscore serial number. So if you have the serial number of the logger we can get into the access point 481.75s - 483.75s | Let's see how an attack would look 484.39s - 488.39s | First we find an access point that corresponds to the naming scheme 489.03s - 492.43s | Then we get the serial number. We use the hard-coded account 493.47s - 495.47s | To make the request and get the password 496.03s - 498.79s | Connect to the access point and just profit 499.31s


chunk_text:
3 4 5 6 441.22s - 443.22s | First place on the rocky list 444.95s - 450.03s | Okay, what is the account used for it gets information about a user's device? 450.35s - 453.99s | For example the model the version and a password 454.75s - 461.11s | This account is not linked to any user account. So it works for any device no matter who owns them 461.91s - 468.11s | Now I mentioned the password a logger while it is running has an access point active 468.63s - 474.23s | The SSID of the access point has a convenient naming scheme it starts with a P 474.87s - 481.15s | Underscore serial number. So if you have the serial number of the logger we can get into the access point 481.75s - 483.75s | Let's see how an attack would look 484.39s - 488.39s | First we find an access point that corresponds to the naming scheme 489.03s - 492.43s | Then we get the serial number. We use the hard-coded account 493.47s - 495.47s | To make the request and get the password 496.03s - 498.79s | Connect to the access point and just profit 499.31s - 502.43s | Okay, those question marks do some heavy lifting 502.43s - 508.79s | But it basically boils down to sending 80 commands to the logger to get access to the user interface 509.43s - 513.55s | To get access to the user's Wi-Fi network and just send 514.51s - 516.51s | commands to 516.51s - 517.83s | the logger 517.83s - 522.51s | Now there are some downsides to this attack. First of all, you need physical proximity 523.23s - 526.39s | Then you need to maintain said physical proximity 526.99s - 533.19s | You also only get one device at a time and as much fun as war driving is it's not very efficient 533.19s - 535.19s | I think we can do better 536.07s - 539.51s | Now we looked at other platform features and 540.87s - 545.07s | We saw that users can only view statistics and information about their system 545.83s - 550.55s | To make changes they require to add a business account as a guest 551.31s - 554.23s | How is this done? Well, there is a search API 554.91s - 558.83s | That returns data about all users and organizations 559.35s


chunk_text:
- 502.43s | Okay, those question marks do some heavy lifting 502.43s - 508.79s | But it basically boils down to sending 80 commands to the logger to get access to the user interface 509.43s - 513.55s | To get access to the user's Wi-Fi network and just send 514.51s - 516.51s | commands to 516.51s - 517.83s | the logger 517.83s - 522.51s | Now there are some downsides to this attack. First of all, you need physical proximity 523.23s - 526.39s | Then you need to maintain said physical proximity 526.99s - 533.19s | You also only get one device at a time and as much fun as war driving is it's not very efficient 533.19s - 535.19s | I think we can do better 536.07s - 539.51s | Now we looked at other platform features and 540.87s - 545.07s | We saw that users can only view statistics and information about their system 545.83s - 550.55s | To make changes they require to add a business account as a guest 551.31s - 554.23s | How is this done? Well, there is a search API 554.91s - 558.83s | That returns data about all users and organizations 559.35s - 563.59s | In the front end, we only see the name of the business when we search for them 564.11s - 569.07s | But in the back end, we have emails, phone numbers, addresses, user IDs 570.19s - 576.11s | For example, we have a vote, an endpoint for a business. We have the administration name, the 577.07s - 583.75s | Admin's phone number and for the users, we get the last login IP. We get their address if they put it there 585.47s - 589.51s | By itself, it's not really exploitable at most being a privacy issue 590.27s - 593.43s | But it gives us a ballpark for the total number of users 593.91s - 597.79s | About three and a half millions and the total number of businesses 598.43s - 600.43s | over 300,000 600.79s - 603.99s | We'll keep this in mind as it might be useful later 606.11s - 608.11s | Now I talked about 608.39s - 615.59s | SolrMan and Dey and that's because until recently Dey was using the SolrMan infrastructure to run his code 616.59s - 621.55s | But recently they built its own datacenter and migrated its user to a


chunk_text:
- 563.59s | In the front end, we only see the name of the business when we search for them 564.11s - 569.07s | But in the back end, we have emails, phone numbers, addresses, user IDs 570.19s - 576.11s | For example, we have a vote, an endpoint for a business. We have the administration name, the 577.07s - 583.75s | Admin's phone number and for the users, we get the last login IP. We get their address if they put it there 585.47s - 589.51s | By itself, it's not really exploitable at most being a privacy issue 590.27s - 593.43s | But it gives us a ballpark for the total number of users 593.91s - 597.79s | About three and a half millions and the total number of businesses 598.43s - 600.43s | over 300,000 600.79s - 603.99s | We'll keep this in mind as it might be useful later 606.11s - 608.11s | Now I talked about 608.39s - 615.59s | SolrMan and Dey and that's because until recently Dey was using the SolrMan infrastructure to run his code 616.59s - 621.55s | But recently they built its own datacenter and migrated its user to a new database 622.03s - 629.91s | The code also runs on their new datacenter, but we wondered maybe the code is still pretty similar 630.91s - 632.11s | and 632.11s - 636.27s | It turns out it's very similar. A token from Dey 636.83s - 644.39s | will work on SolrMan. It gives access to an account that has the same user ID, but the users were migrated so now a 645.11s - 650.11s | User from Dey has a different user ID from the one on SolrMan 651.19s - 659.07s | So the user IDs are also incremental. A new account gets an ID of about 14 million on SolrMan and at about 659.55s - 661.55s | 13 million on Dey 661.59s - 667.51s | This means that by creating new accounts on Dey you could take over over 1 million accounts 668.39s - 670.95s | That's good, but I think we can do even better 672.55s - 677.03s | Now I keep talking about the JVT tokens and let's see how they are obtained 677.63s - 679.63s | For a normal user is pretty straightforward 680.67s - 689.59s | You send the email address, the password, the hash


chunk_text:
new database 622.03s - 629.91s | The code also runs on their new datacenter, but we wondered maybe the code is still pretty similar 630.91s - 632.11s | and 632.11s - 636.27s | It turns out it's very similar. A token from Dey 636.83s - 644.39s | will work on SolrMan. It gives access to an account that has the same user ID, but the users were migrated so now a 645.11s - 650.11s | User from Dey has a different user ID from the one on SolrMan 651.19s - 659.07s | So the user IDs are also incremental. A new account gets an ID of about 14 million on SolrMan and at about 659.55s - 661.55s | 13 million on Dey 661.59s - 667.51s | This means that by creating new accounts on Dey you could take over over 1 million accounts 668.39s - 670.95s | That's good, but I think we can do even better 672.55s - 677.03s | Now I keep talking about the JVT tokens and let's see how they are obtained 677.63s - 679.63s | For a normal user is pretty straightforward 680.67s - 689.59s | You send the email address, the password, the hash password and you get back a JVT token containing your email and your user ID 689.75s - 691.03s | A 691.03s - 693.03s | business account is a bit different 693.83s - 700.95s | One account can manage multiple organizations and when logging in an admin will choose which business to manage 701.35s - 706.11s | The server creates a token that specifies the organization's ID 707.91s - 710.27s | Let's see the steps. The first step is 711.39s - 718.95s | basically identical to a normal user and I highlighted in the decoded token the fields that pertain to the organization 719.03s - 721.03s | the organization ID and the group ID 722.19s - 725.27s | At the second step using the token from the first one 725.87s - 731.83s | we get a list of organizations that an admin can manage and 732.95s - 737.07s | In the third step, we have another login request 737.67s - 744.75s | to the same endpoint, but this time it's it uses an authorization header with the barrier token we got from the first step and 745.75s - 750.71s | In the post body, we also have the same token together


chunk_text:
password and you get back a JVT token containing your email and your user ID 689.75s - 691.03s | A 691.03s - 693.03s | business account is a bit different 693.83s - 700.95s | One account can manage multiple organizations and when logging in an admin will choose which business to manage 701.35s - 706.11s | The server creates a token that specifies the organization's ID 707.91s - 710.27s | Let's see the steps. The first step is 711.39s - 718.95s | basically identical to a normal user and I highlighted in the decoded token the fields that pertain to the organization 719.03s - 721.03s | the organization ID and the group ID 722.19s - 725.27s | At the second step using the token from the first one 725.87s - 731.83s | we get a list of organizations that an admin can manage and 732.95s - 737.07s | In the third step, we have another login request 737.67s - 744.75s | to the same endpoint, but this time it's it uses an authorization header with the barrier token we got from the first step and 745.75s - 750.71s | In the post body, we also have the same token together with the organization ID 751.47s - 753.47s | the server responds and 753.99s - 759.35s | completes the fields that I highlighted earlier and pertain to the user organization 760.23s - 765.07s | Now, what is the issue? In the third step, the endpoint uses data 765.71s - 771.91s | From the token we sent in the post body and creates the new token that has access to the organization 772.27s - 778.39s | So we thought let's just change the user ID and email and the token we sent and it just worked 779.03s - 781.43s | No signature checks. No errors 782.35s - 789.28s | Didn't even need alg none. The endpoint didn't even need the authorization header. We could use it 790.84s - 798.24s | Just like that. This is a request with a manufactured token that we sent and the one we received 799.24s - 804.44s | The tokens here look pretty similar the one on the left is the one we manufactured and 804.96s - 809.80s | The difference between them is that the one on the left has a bad signature because obviously we don't know the key 810.16s - 813.96s | to sign


chunk_text:
with the organization ID 751.47s - 753.47s | the server responds and 753.99s - 759.35s | completes the fields that I highlighted earlier and pertain to the user organization 760.23s - 765.07s | Now, what is the issue? In the third step, the endpoint uses data 765.71s - 771.91s | From the token we sent in the post body and creates the new token that has access to the organization 772.27s - 778.39s | So we thought let's just change the user ID and email and the token we sent and it just worked 779.03s - 781.43s | No signature checks. No errors 782.35s - 789.28s | Didn't even need alg none. The endpoint didn't even need the authorization header. We could use it 790.84s - 798.24s | Just like that. This is a request with a manufactured token that we sent and the one we received 799.24s - 804.44s | The tokens here look pretty similar the one on the left is the one we manufactured and 804.96s - 809.80s | The difference between them is that the one on the left has a bad signature because obviously we don't know the key 810.16s - 813.96s | to sign the token, but the one on the right is signed by the server and 814.60s - 817.88s | It gives us access to any account we want. I 819.40s - 825.80s | Mentioned that we need the ID and email to create this token. But if you remember earlier we have some 826.68s - 830.28s | Endpoint which gives us this information for all accounts 830.76s - 835.68s | So this time all three and a half million accounts were risking takeover 837.36s - 841.32s | Kudos to them they fixed this in 24 hours since we contacted them 842.60s - 846.32s | Now I'll let Dan talk about the impact 849.09s - 851.09s | Thanks Alex. So 851.61s - 857.65s | This context I'll show this more in the timeline. So this is very fresh. We published the findings 857.81s - 859.81s | just a couple of days ago, so 861.49s - 862.89s | Take this 862.89s - 869.97s | List of vendors with a little bit of a grain of salt. It's mostly inferred, but it's a highly let's just say highly informed 870.65s - 874.97s | Chance that these vendors were also impacted because they do share


chunk_text:
the token, but the one on the right is signed by the server and 814.60s - 817.88s | It gives us access to any account we want. I 819.40s - 825.80s | Mentioned that we need the ID and email to create this token. But if you remember earlier we have some 826.68s - 830.28s | Endpoint which gives us this information for all accounts 830.76s - 835.68s | So this time all three and a half million accounts were risking takeover 837.36s - 841.32s | Kudos to them they fixed this in 24 hours since we contacted them 842.60s - 846.32s | Now I'll let Dan talk about the impact 849.09s - 851.09s | Thanks Alex. So 851.61s - 857.65s | This context I'll show this more in the timeline. So this is very fresh. We published the findings 857.81s - 859.81s | just a couple of days ago, so 861.49s - 862.89s | Take this 862.89s - 869.97s | List of vendors with a little bit of a grain of salt. It's mostly inferred, but it's a highly let's just say highly informed 870.65s - 874.97s | Chance that these vendors were also impacted because they do share the solar moon 875.69s - 877.17s | platform and 877.17s - 881.09s | Potentially is the same database and we can additionally infer 882.21s - 885.85s | their potential impact by the fact that we were seeing 887.93s - 895.05s | Stuff like this popping up around the same time we informed the vendors of the findings so 895.97s - 901.45s | Some of these vendors also patched right away and informed the users about the existing patches now 903.05s - 905.05s | Let's talk a little bit about 906.21s - 911.37s | The actual impact in terms of you know users so we were seeing 912.33s - 916.57s | You were estimated about three and a half million users could have been impacted by the vulnerabilities 917.57s - 921.81s | Exemplified here and more than three hundred thirty thousand businesses 922.69s - 924.69s | All these control multiple systems 925.85s - 932.53s | Of course, there's a PII component. So having access to the platform could enable a malicious actor to 933.37s - 935.37s | obtain information 936.37s - 943.15s | About the users and location and so on so forth. So that's bad in itself bad enough in


chunk_text:
the solar moon 875.69s - 877.17s | platform and 877.17s - 881.09s | Potentially is the same database and we can additionally infer 882.21s - 885.85s | their potential impact by the fact that we were seeing 887.93s - 895.05s | Stuff like this popping up around the same time we informed the vendors of the findings so 895.97s - 901.45s | Some of these vendors also patched right away and informed the users about the existing patches now 903.05s - 905.05s | Let's talk a little bit about 906.21s - 911.37s | The actual impact in terms of you know users so we were seeing 912.33s - 916.57s | You were estimated about three and a half million users could have been impacted by the vulnerabilities 917.57s - 921.81s | Exemplified here and more than three hundred thirty thousand businesses 922.69s - 924.69s | All these control multiple systems 925.85s - 932.53s | Of course, there's a PII component. So having access to the platform could enable a malicious actor to 933.37s - 935.37s | obtain information 936.37s - 943.15s | About the users and location and so on so forth. So that's bad in itself bad enough in itself, but but at the same time 943.75s - 947.07s | Having access and controlling being able to control the inverters 948.43s - 954.99s | Through the management platform could also either overload or under load the grid. So basically user imagination 955.67s - 960.79s | Of what could it be done here? Also, it's worth mentioning that the platform 961.55s - 963.91s | serves about a fifth of 964.55s - 969.75s | World's total solar generation capacity. So it's quite a quite an impressive number 970.67s - 975.07s | Kind of put that into perspective it's larger than what the U.S. 975.75s - 978.91s | Generates through photovoltaics alone. So 980.03s - 983.31s | The question is does this finally beat the squirrels now? 985.27s - 989.75s | Because and of course the echoes of national security 991.39s - 993.39s | Follow the idea here being that 994.47s - 995.95s | the 995.95s - 1002.15s | Conversation generally around the grid is that as I said earlier, it's either the squirrels or natural or natural causes 1002.35s - 1004.71s | We're not here to place FUD around 1006.47s - 1007.83s | About 1007.83s - 1012.83s | Solar but kind


chunk_text:
itself, but but at the same time 943.75s - 947.07s | Having access and controlling being able to control the inverters 948.43s - 954.99s | Through the management platform could also either overload or under load the grid. So basically user imagination 955.67s - 960.79s | Of what could it be done here? Also, it's worth mentioning that the platform 961.55s - 963.91s | serves about a fifth of 964.55s - 969.75s | World's total solar generation capacity. So it's quite a quite an impressive number 970.67s - 975.07s | Kind of put that into perspective it's larger than what the U.S. 975.75s - 978.91s | Generates through photovoltaics alone. So 980.03s - 983.31s | The question is does this finally beat the squirrels now? 985.27s - 989.75s | Because and of course the echoes of national security 991.39s - 993.39s | Follow the idea here being that 994.47s - 995.95s | the 995.95s - 1002.15s | Conversation generally around the grid is that as I said earlier, it's either the squirrels or natural or natural causes 1002.35s - 1004.71s | We're not here to place FUD around 1006.47s - 1007.83s | About 1007.83s - 1012.83s | Solar but kind of trying to shine a light that the situation might be changing for the future 1012.83s - 1014.83s | And I think it warrants a little more attention 1015.55s - 1020.91s | I have the timeline here. We contacted the companies sometime in mid-may 1021.23s - 1025.23s | They've been fairly responsive at both acknowledging and 1026.47s - 1028.47s | fixing the vulnerabilities 1028.47s - 1033.31s | And we actually closed disclosure to the to these findings just a few days ago 1034.23s - 1038.39s | With that said I'm inviting you to ask whatever questions there might be 1038.83s - 1045.35s | You can also find us at the IT village. We have a we have a little table there and we have a challenge 1046.11s - 1048.11s | to Hacker TV 1048.19s - 1052.59s | And please do not forget if you know a vendor 1054.31s - 1058.23s | Remind them to appoint a permanent contract a contact for a vulnerability 1060.15s - 1066.67s | Findings to set up a program for vulnerabilities a URL for it put a PGP key on it and monitor that inbox, please 1066.67s - 1069.91s | So with that said thank you


chunk_text:
of trying to shine a light that the situation might be changing for the future 1012.83s - 1014.83s | And I think it warrants a little more attention 1015.55s - 1020.91s | I have the timeline here. We contacted the companies sometime in mid-may 1021.23s - 1025.23s | They've been fairly responsive at both acknowledging and 1026.47s - 1028.47s | fixing the vulnerabilities 1028.47s - 1033.31s | And we actually closed disclosure to the to these findings just a few days ago 1034.23s - 1038.39s | With that said I'm inviting you to ask whatever questions there might be 1038.83s - 1045.35s | You can also find us at the IT village. We have a we have a little table there and we have a challenge 1046.11s - 1048.11s | to Hacker TV 1048.19s - 1052.59s | And please do not forget if you know a vendor 1054.31s - 1058.23s | Remind them to appoint a permanent contract a contact for a vulnerability 1060.15s - 1066.67s | Findings to set up a program for vulnerabilities a URL for it put a PGP key on it and monitor that inbox, please 1066.67s - 1069.91s | So with that said thank you for coming. We're open for questions 1070.47s - 1078.26s | And if there's no questions just come by 1078.78s - 1083.30s | Come by the village and we can talk more. So thanks so much for your time. I'll see you guys there. Thank you 1083.90s - 1086.30s | You


chunk_text:
for coming. We're open for questions 1070.47s - 1078.26s | And if there's no questions just come by 1078.78s - 1083.30s | Come by the village and we can talk more. So thanks so much for your time. I'll see you guys there. Thank you 1083.90s - 1086.30s | You


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=vJWzTt2ANAQ", "title": "DEF CON 32 - Analyzing the Security of Satellite Based Air Traffic Control -Martin Strohmeier", "description": "Automatic Dependent Surveillance \u2013 Contract (ADS-C) is a satellite-based aviation datalink application used to monitor aircraft in remote regions. It is a crucial method for air traffic control to track aircraft where other protocols such as ADS-B lack connectivity. Even though it has been conceived more than 30 years ago, and other legacy communication protocols in aviation have shown to be vulnerable, ADS-C\u2019s security has not been investigated so far in the literature. We conduct a first investigation to close this gap. First, we compile a comprehensive overview of the history, impact, and technical details of ADS-C and its lower layers. Second, we build two software-defined radio receivers in order to analyze over 120\u2019000 real-world ADS-C messages. We further illustrate ADS-C\u2019s lack of authentication by implementing an ADS-C transmitter, which is capable of generating and sending arbitrary ADS-C messages. Finally, we use the channel control offered through a software-defined ADS-C receiver and transmitter as a basis for an in-depth analysis of the protocol weaknesses of the ADS-C system. The found vulnerabilities range from passively tracking aircraft to actively altering the position of actual aircraft through attacks on the downlink and the uplink. We assess the difficulty and impact of these attacks and discuss potential countermeasures.\n\nWe will further look at satellite-based ADS-B receivers and discuss their security and how they relate to ADS-C.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1445, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.36s | This text was transcribed using whisper model: large-v2 Thanks, and welcome to my talk on analyzing the security of satellite-based air traffic control. 7.36s - 13.36s | My name is Martin Strohmeyer. I work at the cyber defense campus, which is part of the 14.08s - 16.96s | procurement agency and part of the Swiss Department of Defense. 18.88s - 27.36s | So DEF CON and other conferences have a long range of talks about attacks on air traffic control. 28.08s - 31.84s | It's obviously an interesting critical infrastructure. 34.16s - 38.72s | If you are able to attack something, it could have potentially catastrophic consequences. 39.44s - 46.40s | This is an overview of typical technologies, communications protocols that are being used by 47.60s - 51.84s | commercial aircraft and other aircraft in flight. 51.84s - 62.08s | And basically, since


chunk_text:
position of actual aircraft through attacks on the downlink and the uplink. We assess the difficulty and impact of these attacks and discuss potential countermeasures.\n\nWe will further look at satellite-based ADS-B receivers and discuss their security and how they relate to ADS-C.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1445, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.36s | This text was transcribed using whisper model: large-v2 Thanks, and welcome to my talk on analyzing the security of satellite-based air traffic control. 7.36s - 13.36s | My name is Martin Strohmeyer. I work at the cyber defense campus, which is part of the 14.08s - 16.96s | procurement agency and part of the Swiss Department of Defense. 18.88s - 27.36s | So DEF CON and other conferences have a long range of talks about attacks on air traffic control. 28.08s - 31.84s | It's obviously an interesting critical infrastructure. 34.16s - 38.72s | If you are able to attack something, it could have potentially catastrophic consequences. 39.44s - 46.40s | This is an overview of typical technologies, communications protocols that are being used by 47.60s - 51.84s | commercial aircraft and other aircraft in flight. 51.84s - 62.08s | And basically, since around the early 2010s, a lot of practical attacks on pretty much all of 62.08s - 70.16s | these communication technologies in aviation have been shown and demonstrated. The principle 70.16s - 75.44s | is always the same. You examine these standards, aviation standards, they are known, they're 75.44s - 83.60s | available. There's no security, no authentication in them. You implement them, you build a receiver. 83.60s - 91.28s | These might also be useful for enthusiasts, plane spotters, that stuff powers flight radar or flight 91.28s - 97.84s | aware. But from a security perspective, if you have a receiver, it's also not difficult to 97.84s - 102.88s | implement a sender or transmitter using software-defined radios. And when you do that, 102.88s - 108.24s | you can do security analysis and you profit. And that's something that has been done for all of 108.24s - 115.92s | these technologies, whether it's aircraft-aircraft, aircraft-ground, or also GPS is well known. 116.88s - 122.32s | And since they all have no security built in, it's not difficult to attack them. It's quite obvious. 123.92s - 132.24s | But a few technologies nicely fitting in with the aerospace topic have


chunk_text:
around the early 2010s, a lot of practical attacks on pretty much all of 62.08s - 70.16s | these communication technologies in aviation have been shown and demonstrated. The principle 70.16s - 75.44s | is always the same. You examine these standards, aviation standards, they are known, they're 75.44s - 83.60s | available. There's no security, no authentication in them. You implement them, you build a receiver. 83.60s - 91.28s | These might also be useful for enthusiasts, plane spotters, that stuff powers flight radar or flight 91.28s - 97.84s | aware. But from a security perspective, if you have a receiver, it's also not difficult to 97.84s - 102.88s | implement a sender or transmitter using software-defined radios. And when you do that, 102.88s - 108.24s | you can do security analysis and you profit. And that's something that has been done for all of 108.24s - 115.92s | these technologies, whether it's aircraft-aircraft, aircraft-ground, or also GPS is well known. 116.88s - 122.32s | And since they all have no security built in, it's not difficult to attack them. It's quite obvious. 123.92s - 132.24s | But a few technologies nicely fitting in with the aerospace topic have come up over the past 132.96s - 139.36s | decade or so, where aircraft are talking to satellites and kind of trying to replace some 139.36s - 143.28s | of these technologies or at least enhance them. So that's what this talk will be about. 144.48s - 152.80s | Just a quick teaser. My colleagues will have a talk tomorrow on creative stage two, attacking 152.80s - 158.32s | the collision avoidance system. So that was one of the last technologies that hadn't been 158.32s - 167.84s | demonstrated from this whole overview. So tomorrow, 1415, that's your opportunity to 167.84s - 174.32s | see a real attack on this as well. But this talk is about space-based air traffic control. So what 174.32s - 181.12s | do we understand under that? There's two different technologies actually. One I'll touch on briefly 181.12s - 188.24s | and one more in detail. First one is satellite ADS-B. And the second one is the so-called ADS 189.12s - 199.84s | contract. So let's look at that. Satellite ADS-B. You all probably have heard of these ADS-B attacks. 199.84s - 206.08s | There have been talks since 2010. People like RenderMan have had


chunk_text:
come up over the past 132.96s - 139.36s | decade or so, where aircraft are talking to satellites and kind of trying to replace some 139.36s - 143.28s | of these technologies or at least enhance them. So that's what this talk will be about. 144.48s - 152.80s | Just a quick teaser. My colleagues will have a talk tomorrow on creative stage two, attacking 152.80s - 158.32s | the collision avoidance system. So that was one of the last technologies that hadn't been 158.32s - 167.84s | demonstrated from this whole overview. So tomorrow, 1415, that's your opportunity to 167.84s - 174.32s | see a real attack on this as well. But this talk is about space-based air traffic control. So what 174.32s - 181.12s | do we understand under that? There's two different technologies actually. One I'll touch on briefly 181.12s - 188.24s | and one more in detail. First one is satellite ADS-B. And the second one is the so-called ADS 189.12s - 199.84s | contract. So let's look at that. Satellite ADS-B. You all probably have heard of these ADS-B attacks. 199.84s - 206.08s | There have been talks since 2010. People like RenderMan have had main stage talks 206.80s - 212.24s | demonstrating the problem here. It's well known to be vulnerable. The terrestrial 212.96s - 219.68s | transponder technology, aircraft sending data to the ground, trivial to receive, 220.24s - 227.84s | send ghost aircraft, everything is possible. The problem is space-based ADS-B is essentially just 227.84s - 234.48s | the same. Some companies have built constellations in low Earth orbit, and they're simply picking up 234.48s - 242.72s | these same terrestrial signals and then giving them to air navigation service providers to 242.72s - 247.36s | air traffic control. That is obviously helpful where you don't have terrestrial receivers, 247.36s - 253.84s | so over the oceans or in mountainous areas. One of these providers, Aerion, also on the 253.84s - 261.20s | homepage, they say, yeah, it's just ADS-B. There's nothing else here. What they however also said 261.68s - 275.12s | when they went widely public with it, said, okay, we're 485 miles up in space. So you can't attack 275.12s - 280.48s | that. It's not like somebody is attacking that signal. They could attack GPS, which they can, 280.48s - 284.24s | and obviously is a widespread problem,


chunk_text:
main stage talks 206.80s - 212.24s | demonstrating the problem here. It's well known to be vulnerable. The terrestrial 212.96s - 219.68s | transponder technology, aircraft sending data to the ground, trivial to receive, 220.24s - 227.84s | send ghost aircraft, everything is possible. The problem is space-based ADS-B is essentially just 227.84s - 234.48s | the same. Some companies have built constellations in low Earth orbit, and they're simply picking up 234.48s - 242.72s | these same terrestrial signals and then giving them to air navigation service providers to 242.72s - 247.36s | air traffic control. That is obviously helpful where you don't have terrestrial receivers, 247.36s - 253.84s | so over the oceans or in mountainous areas. One of these providers, Aerion, also on the 253.84s - 261.20s | homepage, they say, yeah, it's just ADS-B. There's nothing else here. What they however also said 261.68s - 275.12s | when they went widely public with it, said, okay, we're 485 miles up in space. So you can't attack 275.12s - 280.48s | that. It's not like somebody is attacking that signal. They could attack GPS, which they can, 280.48s - 284.24s | and obviously is a widespread problem, and particularly over the past year now. 284.24s - 287.92s | But they're not going to attack the actual terrestrial ADS-B signal. 288.88s - 295.36s | 500 miles up in space, too far away. At the time, we already thought, honestly, 295.36s - 300.48s | there's bullshit. It's just an engineering problem. You need more power. You can do just the same. 301.28s - 306.64s | They pick up the signals from aircraft flying 30,000 feet, 10 kilometers. 308.88s - 314.88s | They pick that up in space, right? So what's 10 kilometers more sending from the ground? It's not 314.88s - 322.00s | a problem, quite obviously. And yes, space is quite obviously not inherently secure. 322.00s - 328.48s | We've seen this last year, latest last year here at Hackersat. Of course, you can communicate 328.48s - 335.12s | with satellites in two way and attack them. I think there's no doubt about this. 338.13s - 345.09s | And yeah, back then, at least we postulated a theoretic attack. We didn't actually send to their 345.09s - 353.01s | satellites. Would not be legal. But we said, hey, here, these are kind of the requirements 353.01s - 360.13s


chunk_text:
and particularly over the past year now. 284.24s - 287.92s | But they're not going to attack the actual terrestrial ADS-B signal. 288.88s - 295.36s | 500 miles up in space, too far away. At the time, we already thought, honestly, 295.36s - 300.48s | there's bullshit. It's just an engineering problem. You need more power. You can do just the same. 301.28s - 306.64s | They pick up the signals from aircraft flying 30,000 feet, 10 kilometers. 308.88s - 314.88s | They pick that up in space, right? So what's 10 kilometers more sending from the ground? It's not 314.88s - 322.00s | a problem, quite obviously. And yes, space is quite obviously not inherently secure. 322.00s - 328.48s | We've seen this last year, latest last year here at Hackersat. Of course, you can communicate 328.48s - 335.12s | with satellites in two way and attack them. I think there's no doubt about this. 338.13s - 345.09s | And yeah, back then, at least we postulated a theoretic attack. We didn't actually send to their 345.09s - 353.01s | satellites. Would not be legal. But we said, hey, here, these are kind of the requirements 353.01s - 360.13s | that you have to think about relation, position relation to the aircraft and the satellites. 360.13s - 366.37s | And then you can simply send ghost aircraft also to these satellites. Not a problem. 368.62s - 374.30s | So very much possible. We haven't done it in practice for regulatory reasons, but 376.46s - 382.22s | it's certainly not secure. There's no reason to believe so. That brings me to the second 382.22s - 389.74s | technology, ADS-C, which is much less well known, I would say. It's been developed 390.94s - 397.90s | already late 90s, but only become quite popular over the past five or 10 years. Also in the wake 397.90s - 405.74s | of the MH-370 incident, tracking aircraft over oceans has become quite a popular topic. 407.26s - 413.10s | So what does ADS-C or full name Automatic Dependent Surveillance contract actually do? 414.06s - 421.26s | Well, it picks up aircraft information and sends it to air traffic service units, they call it, 421.26s - 426.06s | which is basically ground stations. There are dozens or even hundreds around the world. 426.62s - 432.54s | And this information includes aircraft position, altitude, speed,


chunk_text:
| that you have to think about relation, position relation to the aircraft and the satellites. 360.13s - 366.37s | And then you can simply send ghost aircraft also to these satellites. Not a problem. 368.62s - 374.30s | So very much possible. We haven't done it in practice for regulatory reasons, but 376.46s - 382.22s | it's certainly not secure. There's no reason to believe so. That brings me to the second 382.22s - 389.74s | technology, ADS-C, which is much less well known, I would say. It's been developed 390.94s - 397.90s | already late 90s, but only become quite popular over the past five or 10 years. Also in the wake 397.90s - 405.74s | of the MH-370 incident, tracking aircraft over oceans has become quite a popular topic. 407.26s - 413.10s | So what does ADS-C or full name Automatic Dependent Surveillance contract actually do? 414.06s - 421.26s | Well, it picks up aircraft information and sends it to air traffic service units, they call it, 421.26s - 426.06s | which is basically ground stations. There are dozens or even hundreds around the world. 426.62s - 432.54s | And this information includes aircraft position, altitude, speed, navigational intent, 433.18s - 438.30s | metrological data. Of course, this is all very useful for air traffic control, air traffic 438.30s - 443.42s | surveillance, route monitoring, in particular, if you're over the Atlantic or Pacific 443.42s - 450.75s | and have no updates from your aircraft and where they are. This is roughly the setup. 452.91s - 460.35s | Aircraft gets their position, of course, also from GNSS, GPS services. It then connects to 461.15s - 466.67s | different types of satellites, typically geostationary satellites from Enmasat. But it 466.67s - 473.31s | can also be actually LEO Constellations also offer these services. And then the satellites 473.31s - 479.87s | forward the data to the ground, and there it's being routed to the air navigation service 479.87s - 489.55s | provider who require that content. There's also VHF, HF version of all of this, but that's not 490.11s - 499.82s | what we're looking at here. What's the purpose? I think I alluded to it. The goal is really to 499.82s - 506.06s | enable aircraft monitoring in very remote areas. We don't have terrestrial surveillance of aircraft. 507.18s - 513.42s | If you do that, if


chunk_text:
navigational intent, 433.18s - 438.30s | metrological data. Of course, this is all very useful for air traffic control, air traffic 438.30s - 443.42s | surveillance, route monitoring, in particular, if you're over the Atlantic or Pacific 443.42s - 450.75s | and have no updates from your aircraft and where they are. This is roughly the setup. 452.91s - 460.35s | Aircraft gets their position, of course, also from GNSS, GPS services. It then connects to 461.15s - 466.67s | different types of satellites, typically geostationary satellites from Enmasat. But it 466.67s - 473.31s | can also be actually LEO Constellations also offer these services. And then the satellites 473.31s - 479.87s | forward the data to the ground, and there it's being routed to the air navigation service 479.87s - 489.55s | provider who require that content. There's also VHF, HF version of all of this, but that's not 490.11s - 499.82s | what we're looking at here. What's the purpose? I think I alluded to it. The goal is really to 499.82s - 506.06s | enable aircraft monitoring in very remote areas. We don't have terrestrial surveillance of aircraft. 507.18s - 513.42s | If you do that, if you know where the aircraft are, rather than just roughly estimating from, 513.42s - 519.98s | you know, leaving US mainland towards Europe, after two hours, you might not really know where 519.98s - 525.74s | they are anymore. If you know where they are, you can more efficiently utilize the airspace 525.74s - 531.10s | because you can minimize separation between different aircraft. And the second effect, 532.70s - 537.34s | you reduce the reliance on traditional voice communication between pilots and controllers. 537.98s - 543.90s | These channels are quite congested, quite busy. And you can like this, if you put a lot of the 543.90s - 550.22s | data on these digital satellite channels, you can use these for more urgent correspondence. 551.82s - 560.22s | There's roughly comparison. This is a image from ASB exchange. And it shows roughly where you can 560.22s - 570.54s | have crowdsourced terrestrial reception of aircraft signals. So by and large, that's 571.50s - 579.74s | where a lot of people live. And also, a lot of, let's say, more wealthy people live who can put 579.74s - 586.70s | up receivers on the ground and feed it to the


chunk_text:
you know where the aircraft are, rather than just roughly estimating from, 513.42s - 519.98s | you know, leaving US mainland towards Europe, after two hours, you might not really know where 519.98s - 525.74s | they are anymore. If you know where they are, you can more efficiently utilize the airspace 525.74s - 531.10s | because you can minimize separation between different aircraft. And the second effect, 532.70s - 537.34s | you reduce the reliance on traditional voice communication between pilots and controllers. 537.98s - 543.90s | These channels are quite congested, quite busy. And you can like this, if you put a lot of the 543.90s - 550.22s | data on these digital satellite channels, you can use these for more urgent correspondence. 551.82s - 560.22s | There's roughly comparison. This is a image from ASB exchange. And it shows roughly where you can 560.22s - 570.54s | have crowdsourced terrestrial reception of aircraft signals. So by and large, that's 571.50s - 579.74s | where a lot of people live. And also, a lot of, let's say, more wealthy people live who can put 579.74s - 586.70s | up receivers on the ground and feed it to the systems. All of the red areas, you will never 586.70s - 595.74s | have any, any reception, any surveillance of aircraft. So if we overlay this with ADC coverage, 595.74s - 603.02s | we can see that this sort of satellite coverage fills in a lot of the red gaps, certainly 603.02s - 610.86s | Pacific, Atlantic, even Indian Ocean, and also partly you can see over Africa and some other 611.90s - 616.54s | terrestrial areas. So how does ADC actually work? 616.54s - 623.02s | Let's look first at uplink and then downlink messages. 624.78s - 631.50s | Basically, ADC, they initiate the connection always. So they request a certain aircraft 631.50s - 638.62s | that's flying to provide them with a so-called contract that can either be periodic. 639.90s - 644.86s | With that sort of periodic contract, you maybe get regular updates every 10 minutes or so 645.42s - 650.06s | of position, altitude, and the other information they want, or they can ask for certain events. 651.02s - 658.86s | So for example, when they want a waypoint change, so when aircraft is flying towards 658.86s - 663.90s | a certain waypoint, and they know


chunk_text:
systems. All of the red areas, you will never 586.70s - 595.74s | have any, any reception, any surveillance of aircraft. So if we overlay this with ADC coverage, 595.74s - 603.02s | we can see that this sort of satellite coverage fills in a lot of the red gaps, certainly 603.02s - 610.86s | Pacific, Atlantic, even Indian Ocean, and also partly you can see over Africa and some other 611.90s - 616.54s | terrestrial areas. So how does ADC actually work? 616.54s - 623.02s | Let's look first at uplink and then downlink messages. 624.78s - 631.50s | Basically, ADC, they initiate the connection always. So they request a certain aircraft 631.50s - 638.62s | that's flying to provide them with a so-called contract that can either be periodic. 639.90s - 644.86s | With that sort of periodic contract, you maybe get regular updates every 10 minutes or so 645.42s - 650.06s | of position, altitude, and the other information they want, or they can ask for certain events. 651.02s - 658.86s | So for example, when they want a waypoint change, so when aircraft is flying towards 658.86s - 663.90s | a certain waypoint, and they know that, and they can request a change of that waypoint 663.90s - 673.50s | through these contracts. That's roughly how the message is looking, but I won't get into detail 673.50s - 679.02s | here. And then we have the probably more interesting downlink part. So this is where 679.02s - 687.42s | the aircraft answers with ADC reports, which go to the air traffic control service provider. 688.06s - 693.82s | The aircraft sends, as I said, for example, periodic updates, position everything every 10 693.82s - 703.34s | minutes, or in these events, if change events, cases, it sends certain reports regarding that. 704.38s - 709.26s | Again, that's what the messages look like. They will include position, latitude, longitude, 709.26s - 715.26s | altitude, some timestamp, and then depending on the type of the report, it will include some more 715.26s - 723.66s | information. So why is all that important? I slightly alluded to this already. If we don't 723.66s - 729.66s | have this kind of new modern technology, the air traffic controllers will have to rely on 729.66s - 737.02s | pre-computed aircraft trajectories, roughly guesstimating where the aircraft is, which is 737.02s -


chunk_text:
that, and they can request a change of that waypoint 663.90s - 673.50s | through these contracts. That's roughly how the message is looking, but I won't get into detail 673.50s - 679.02s | here. And then we have the probably more interesting downlink part. So this is where 679.02s - 687.42s | the aircraft answers with ADC reports, which go to the air traffic control service provider. 688.06s - 693.82s | The aircraft sends, as I said, for example, periodic updates, position everything every 10 693.82s - 703.34s | minutes, or in these events, if change events, cases, it sends certain reports regarding that. 704.38s - 709.26s | Again, that's what the messages look like. They will include position, latitude, longitude, 709.26s - 715.26s | altitude, some timestamp, and then depending on the type of the report, it will include some more 715.26s - 723.66s | information. So why is all that important? I slightly alluded to this already. If we don't 723.66s - 729.66s | have this kind of new modern technology, the air traffic controllers will have to rely on 729.66s - 737.02s | pre-computed aircraft trajectories, roughly guesstimating where the aircraft is, which is 737.02s - 742.38s | not so great for surveillance. And they will use voice communication, just the same finding out 742.38s - 748.70s | where the aircraft is and what they're doing, in particular in remote areas, using HF and the 748.70s - 756.54s | likes. And that's not the most precise technology or the most available one. So in short, ADC is 756.54s - 763.10s | very crucial for aircraft monitoring these areas. It's being rolled out, as we've seen on the map, 763.10s - 770.38s | quite a lot of commercial aircraft have it now and use it. And in contrast to many of the other 770.38s - 776.30s | technologies that were in the earlier slides, this hasn't been studied at all. Not in terms 776.30s - 783.66s | of use cases, really, in the scientific community, but also in the security community in terms of, 783.66s - 791.15s | well, what can we do with it? What can we do against it? So what about security? 792.43s - 797.55s | There's a paper on this, on what I'm going to say. So we talked about this at this year's 798.43s - 804.91s | SpaceX workshop already. But if


chunk_text:
742.38s | not so great for surveillance. And they will use voice communication, just the same finding out 742.38s - 748.70s | where the aircraft is and what they're doing, in particular in remote areas, using HF and the 748.70s - 756.54s | likes. And that's not the most precise technology or the most available one. So in short, ADC is 756.54s - 763.10s | very crucial for aircraft monitoring these areas. It's being rolled out, as we've seen on the map, 763.10s - 770.38s | quite a lot of commercial aircraft have it now and use it. And in contrast to many of the other 770.38s - 776.30s | technologies that were in the earlier slides, this hasn't been studied at all. Not in terms 776.30s - 783.66s | of use cases, really, in the scientific community, but also in the security community in terms of, 783.66s - 791.15s | well, what can we do with it? What can we do against it? So what about security? 792.43s - 797.55s | There's a paper on this, on what I'm going to say. So we talked about this at this year's 798.43s - 804.91s | SpaceX workshop already. But if you prefer it in written form, you can look it up. 805.55s - 812.67s | But I cover most of this in the following slides. So that's our system model and our 812.67s - 819.39s | threat model. Basically, we have the satellite in the middle, we have the ground earth station, 819.39s - 825.79s | as they call it, and we have the aircraft earth station, which might sound a bit weird, but 825.79s - 830.43s | you know, aircraft is still on the earth while a satellite is not. So that's why they call it 831.47s - 836.11s | that way. Different frequencies that we have to look at. So the aircraft 837.23s - 842.11s | uses the 1.6 gigahertz frequency to talk to the satellite. And then there's a different up and 842.11s - 847.87s | down in frequency from the satellite to the ground station, 3.6 gigahertz and 6.5 gigahertz. 848.59s - 853.87s | And we have three different types of attackers that we consider. First one is a passive attacker, 853.87s - 860.91s | you could also call it an eavesdropper. The eavesdropper simply needs to be in range of the 860.91s - 867.07s |


chunk_text:
you prefer it in written form, you can look it up. 805.55s - 812.67s | But I cover most of this in the following slides. So that's our system model and our 812.67s - 819.39s | threat model. Basically, we have the satellite in the middle, we have the ground earth station, 819.39s - 825.79s | as they call it, and we have the aircraft earth station, which might sound a bit weird, but 825.79s - 830.43s | you know, aircraft is still on the earth while a satellite is not. So that's why they call it 831.47s - 836.11s | that way. Different frequencies that we have to look at. So the aircraft 837.23s - 842.11s | uses the 1.6 gigahertz frequency to talk to the satellite. And then there's a different up and 842.11s - 847.87s | down in frequency from the satellite to the ground station, 3.6 gigahertz and 6.5 gigahertz. 848.59s - 853.87s | And we have three different types of attackers that we consider. First one is a passive attacker, 853.87s - 860.91s | you could also call it an eavesdropper. The eavesdropper simply needs to be in range of the 860.91s - 867.07s | whole satellite beam of the geostationary satellite. So that's not very complicated. 867.63s - 875.07s | But we have realized that at least in Europe, you need to be in a 5g free zone to listen to 875.07s - 882.43s | the downlink because the 3.6 gigahertz area frequency is exactly at least in Europe, the 5g 882.43s - 889.39s | frequency or one of the 5g frequencies. And if you have one of these transmitters, ground stations 889.39s - 895.87s | nearby, you will not be able to receive the very weak satellite signals. So that was an issue that 895.87s - 902.67s | we had to contend with. Then we have two active attackers. One is attacking the downlink. So 902.67s - 910.43s | basically, transmitting the same data as we see on the downlink towards the earth station. And 910.43s - 916.51s | an uplink attacker. So somebody who sends to the satellite, which is more complicated, absolutely, 916.51s - 923.79s | you need more power. And we've been speaking to some experts, depending on the satellite setup, 924.75s - 931.63s | there may be some beam forming going on. So you might, it might not be


chunk_text:
whole satellite beam of the geostationary satellite. So that's not very complicated. 867.63s - 875.07s | But we have realized that at least in Europe, you need to be in a 5g free zone to listen to 875.07s - 882.43s | the downlink because the 3.6 gigahertz area frequency is exactly at least in Europe, the 5g 882.43s - 889.39s | frequency or one of the 5g frequencies. And if you have one of these transmitters, ground stations 889.39s - 895.87s | nearby, you will not be able to receive the very weak satellite signals. So that was an issue that 895.87s - 902.67s | we had to contend with. Then we have two active attackers. One is attacking the downlink. So 902.67s - 910.43s | basically, transmitting the same data as we see on the downlink towards the earth station. And 910.43s - 916.51s | an uplink attacker. So somebody who sends to the satellite, which is more complicated, absolutely, 916.51s - 923.79s | you need more power. And we've been speaking to some experts, depending on the satellite setup, 924.75s - 931.63s | there may be some beam forming going on. So you might, it might not be sufficient to stay in 932.75s - 937.47s | just anywhere in the satellite beam, you may also need to be close to a ground station, 937.47s - 944.83s | depending on the satellite setup. So let's go through it one by one. What can we do with 944.83s - 950.75s | eavesdropping on ADC messages, the content we've seen is mostly position waypoints. 951.55s - 957.71s | And there's some meta information such as the aircraft ID, some identifiers. And 958.99s - 966.67s | mostly this is useful for reconnaissance on aircraft. So you know where they are, 966.67s - 973.39s | you know what they sent, you know where they're going, that is quite nice. Can be used for 974.43s - 979.95s | attacks on aircraft, also on other protocols, or for active attacks on ADC itself. 980.83s - 987.79s | We can link these identifiers to databases that are available online. And then from there, 988.67s - 994.11s | you may imagine a lot of privacy violations. I'm sure you've seen all the kerfuffle about people 994.67s - 1002.03s | tracking Elon Musk or Taylor Swift's aircraft, right? If you haven't, then I can recommend my 1002.03s -


chunk_text:
sufficient to stay in 932.75s - 937.47s | just anywhere in the satellite beam, you may also need to be close to a ground station, 937.47s - 944.83s | depending on the satellite setup. So let's go through it one by one. What can we do with 944.83s - 950.75s | eavesdropping on ADC messages, the content we've seen is mostly position waypoints. 951.55s - 957.71s | And there's some meta information such as the aircraft ID, some identifiers. And 958.99s - 966.67s | mostly this is useful for reconnaissance on aircraft. So you know where they are, 966.67s - 973.39s | you know what they sent, you know where they're going, that is quite nice. Can be used for 974.43s - 979.95s | attacks on aircraft, also on other protocols, or for active attacks on ADC itself. 980.83s - 987.79s | We can link these identifiers to databases that are available online. And then from there, 988.67s - 994.11s | you may imagine a lot of privacy violations. I'm sure you've seen all the kerfuffle about people 994.67s - 1002.03s | tracking Elon Musk or Taylor Swift's aircraft, right? If you haven't, then I can recommend my 1002.03s - 1008.83s | talk, the village last year. I think it's just been put online last week. So you can find it 1008.83s - 1020.90s | on YouTube. Let's move on towards the active attacks first on the uplink. And here, mostly 1020.90s - 1026.58s | what you can do is different sorts of denial of service attacks. So if we look at the protocol 1026.58s - 1034.34s | here, the aircraft locks on, it will be confirmed, it will be acknowledged. And of course, if you 1034.34s - 1042.98s | attack this handshake, then you might simply be able to prevent the lock on. And then there's no 1042.98s - 1051.62s | ADC connection. That's, yeah, it's a denial of service of ADC. You have other technologies 1051.62s - 1058.58s | available, of course. So it's not immediately safety relevant at all. But it's certainly an 1058.58s - 1065.86s | attack. And there are several places in the protocol where you can do this. On the downlink 1065.86s - 1073.86s | end, it gets a bit more interesting. Here, you can do spoofing of aircraft positions towards the, 1074.58s - 1082.50s | or yeah, towards the air traffic control provider.


chunk_text:
1008.83s | talk, the village last year. I think it's just been put online last week. So you can find it 1008.83s - 1020.90s | on YouTube. Let's move on towards the active attacks first on the uplink. And here, mostly 1020.90s - 1026.58s | what you can do is different sorts of denial of service attacks. So if we look at the protocol 1026.58s - 1034.34s | here, the aircraft locks on, it will be confirmed, it will be acknowledged. And of course, if you 1034.34s - 1042.98s | attack this handshake, then you might simply be able to prevent the lock on. And then there's no 1042.98s - 1051.62s | ADC connection. That's, yeah, it's a denial of service of ADC. You have other technologies 1051.62s - 1058.58s | available, of course. So it's not immediately safety relevant at all. But it's certainly an 1058.58s - 1065.86s | attack. And there are several places in the protocol where you can do this. On the downlink 1065.86s - 1073.86s | end, it gets a bit more interesting. Here, you can do spoofing of aircraft positions towards the, 1074.58s - 1082.50s | or yeah, towards the air traffic control provider. What you can't do, just to preface this, 1083.30s - 1090.90s | is to inject ghost aircraft. Why? Because as we've seen earlier, the air traffic controller 1090.90s - 1097.46s | always initiates the connection to an aircraft. So they will do that towards an aircraft they 1097.46s - 1105.54s | know is already flying. And if they get a response, okay, great. But if they get a response from an 1105.54s - 1110.10s | aircraft they haven't initiated a connection with, it will just be discarded and ignored. 1110.90s - 1115.78s | If, however, they already have a connection, then it's absolutely possible to send different 1115.78s - 1121.06s | positions than the one from the aircraft. And we've illustrated this here with our own setups. 1121.06s - 1129.14s | So on the left, we have real aircraft positions that we received. And you can just send, you know, 1129.14s - 1134.26s | for the same aircraft, 10 positions clustering together, and it would be displayed this way. 1135.06s - 1141.30s | Likewise, you can flood ground stations with emergency mode messages from basically all the 1141.30s - 1146.82s | existing aircraft that they have a contract with. That's


chunk_text:
What you can't do, just to preface this, 1083.30s - 1090.90s | is to inject ghost aircraft. Why? Because as we've seen earlier, the air traffic controller 1090.90s - 1097.46s | always initiates the connection to an aircraft. So they will do that towards an aircraft they 1097.46s - 1105.54s | know is already flying. And if they get a response, okay, great. But if they get a response from an 1105.54s - 1110.10s | aircraft they haven't initiated a connection with, it will just be discarded and ignored. 1110.90s - 1115.78s | If, however, they already have a connection, then it's absolutely possible to send different 1115.78s - 1121.06s | positions than the one from the aircraft. And we've illustrated this here with our own setups. 1121.06s - 1129.14s | So on the left, we have real aircraft positions that we received. And you can just send, you know, 1129.14s - 1134.26s | for the same aircraft, 10 positions clustering together, and it would be displayed this way. 1135.06s - 1141.30s | Likewise, you can flood ground stations with emergency mode messages from basically all the 1141.30s - 1146.82s | existing aircraft that they have a contract with. That's the picture of the flight management system 1146.82s - 1152.18s | here. That's where the pilot can put this on. And then, of course, they will be flagged with 1152.18s - 1160.18s | the air traffic controller and get priority, get certain routines set up. And here, you can 1161.14s - 1167.22s | basically do this for all the aircraft at the same time, which would again be causing some chaos and 1167.22s - 1175.78s | some denial of service. We've done some real world evaluation as far as that is legally possible. 1177.30s - 1182.74s | That's our receiver setup. So we've both set up downlink and uplink receivers. 1184.90s - 1189.46s | The pipelines for the receivers are available online on GitHub, 1190.90s - 1197.46s | having a later slide. But mostly, you can download it, put it together with your software 1197.46s - 1202.90s | defined radios and antennas. Then you have to look, follow tutorials, look at the channels, 1202.90s - 1208.82s | and you can receive the data. You have to look, check also which satellite is in your area. 1208.82s - 1217.30s | So this is the InMarsat coverage of the geo satellites. So


chunk_text:
the picture of the flight management system 1146.82s - 1152.18s | here. That's where the pilot can put this on. And then, of course, they will be flagged with 1152.18s - 1160.18s | the air traffic controller and get priority, get certain routines set up. And here, you can 1161.14s - 1167.22s | basically do this for all the aircraft at the same time, which would again be causing some chaos and 1167.22s - 1175.78s | some denial of service. We've done some real world evaluation as far as that is legally possible. 1177.30s - 1182.74s | That's our receiver setup. So we've both set up downlink and uplink receivers. 1184.90s - 1189.46s | The pipelines for the receivers are available online on GitHub, 1190.90s - 1197.46s | having a later slide. But mostly, you can download it, put it together with your software 1197.46s - 1202.90s | defined radios and antennas. Then you have to look, follow tutorials, look at the channels, 1202.90s - 1208.82s | and you can receive the data. You have to look, check also which satellite is in your area. 1208.82s - 1217.30s | So this is the InMarsat coverage of the geo satellites. So for us, it would be the AlphaSat. 1217.30s - 1223.14s | If we look at it in Europe, in the US, you would get different satellites and their aircraft 1223.14s - 1230.50s | connections. That's the pipeline, the setup. Definitely credit to all these people who 1230.50s - 1238.02s | have written the super interesting, super useful receiver software, SDR receiver, 1238.02s - 1244.34s | Jero, and a lot of tutorials. You set the whole thing up, save the data, and analyze it. That's 1244.34s - 1251.38s | what we did. That's how these setups look like. The uplink, much easier, as you see, can be a 1251.38s - 1259.78s | super small antenna on the left. For the downlink, you need something in the eight feet dish size. 1259.78s - 1266.90s | So your house might be, you might have to have a decent sized garden for this. 1268.42s - 1274.18s | Some data insights. We just looked at this for a few weeks, collected a lot of messages. You see 1274.18s - 1282.34s | the black points, which are the positions here, 2,500 aircraft, communicating with 50, 60 ground 1282.34s - 1288.26s | stations. If you want to


chunk_text:
for us, it would be the AlphaSat. 1217.30s - 1223.14s | If we look at it in Europe, in the US, you would get different satellites and their aircraft 1223.14s - 1230.50s | connections. That's the pipeline, the setup. Definitely credit to all these people who 1230.50s - 1238.02s | have written the super interesting, super useful receiver software, SDR receiver, 1238.02s - 1244.34s | Jero, and a lot of tutorials. You set the whole thing up, save the data, and analyze it. That's 1244.34s - 1251.38s | what we did. That's how these setups look like. The uplink, much easier, as you see, can be a 1251.38s - 1259.78s | super small antenna on the left. For the downlink, you need something in the eight feet dish size. 1259.78s - 1266.90s | So your house might be, you might have to have a decent sized garden for this. 1268.42s - 1274.18s | Some data insights. We just looked at this for a few weeks, collected a lot of messages. You see 1274.18s - 1282.34s | the black points, which are the positions here, 2,500 aircraft, communicating with 50, 60 ground 1282.34s - 1288.26s | stations. If you want to see more on this, other people are collecting the data as well. So tbg 1288.26s - 1298.50s | airframes.io, you always get the last two days. These are typical routes that you can follow with 1298.50s - 1307.30s | that setup. Then, as I've mentioned, we arrested, we built a transmitter. And it works. It's a 1307.30s - 1312.10s | straightforward student work, building a transmitter from a receiver from all of these 1312.82s - 1321.78s | existing SDR implementations. We tested it. It's fairly binary. We set up our own ground station. 1322.34s - 1329.94s | We tested the transmitter, can generate arbitrary messages on ADC, including all of the sub layers. 1330.66s - 1335.06s | So we injected these messages into our dish, into our ground stations. 1335.70s - 1343.22s | And lo and behold, it works. So if you have a receiver software ADC, you can simply inject 1344.02s - 1349.86s | any legitimately looking message and you cannot tell it apart from the messages that we get from 1349.86s - 1358.48s | an aircraft. That brings me to the conclusion of my talk today. I hope I could explain that 1358.48s - 1364.16s | satellite edge


chunk_text:
see more on this, other people are collecting the data as well. So tbg 1288.26s - 1298.50s | airframes.io, you always get the last two days. These are typical routes that you can follow with 1298.50s - 1307.30s | that setup. Then, as I've mentioned, we arrested, we built a transmitter. And it works. It's a 1307.30s - 1312.10s | straightforward student work, building a transmitter from a receiver from all of these 1312.82s - 1321.78s | existing SDR implementations. We tested it. It's fairly binary. We set up our own ground station. 1322.34s - 1329.94s | We tested the transmitter, can generate arbitrary messages on ADC, including all of the sub layers. 1330.66s - 1335.06s | So we injected these messages into our dish, into our ground stations. 1335.70s - 1343.22s | And lo and behold, it works. So if you have a receiver software ADC, you can simply inject 1344.02s - 1349.86s | any legitimately looking message and you cannot tell it apart from the messages that we get from 1349.86s - 1358.48s | an aircraft. That brings me to the conclusion of my talk today. I hope I could explain that 1358.48s - 1364.16s | satellite edge of control certainly helps increase airspace efficiency in many areas. 1364.72s - 1371.36s | Unfortunately, security was never a concern. There's no authentication, which is as problematic 1371.36s - 1379.76s | in space as on the ground. Passive attackers can eavesdrop and follow aircraft, do whatever 1380.64s - 1385.92s | what may they might find interesting with it. And you can follow a lot of aircraft just with 1385.92s - 1391.92s | a single receiver, which is nice. Active attackers can inject signals and disrupt 1391.92s - 1400.00s | air traffic control to a certain extent. And the resources certainly are quite straightforward or 1400.00s - 1407.92s | trivial. So it's basically a master thesis here. Student can do this and set up costs for 1408.80s - 1416.88s | the transmitters are a few hundred euros. So not a problem. That's it for me. Just another teaser. 1417.52s - 1425.44s | We have some, if you're interested in injection of signals into satellite dishes, 1426.32s - 1432.88s | there's also a talk on the DEFCON main stage tomorrow, track three, breaking the beam at 2.15. 1433.60s - 1438.56s | And next week at USENIX security, the paper is online under


chunk_text:
of control certainly helps increase airspace efficiency in many areas. 1364.72s - 1371.36s | Unfortunately, security was never a concern. There's no authentication, which is as problematic 1371.36s - 1379.76s | in space as on the ground. Passive attackers can eavesdrop and follow aircraft, do whatever 1380.64s - 1385.92s | what may they might find interesting with it. And you can follow a lot of aircraft just with 1385.92s - 1391.92s | a single receiver, which is nice. Active attackers can inject signals and disrupt 1391.92s - 1400.00s | air traffic control to a certain extent. And the resources certainly are quite straightforward or 1400.00s - 1407.92s | trivial. So it's basically a master thesis here. Student can do this and set up costs for 1408.80s - 1416.88s | the transmitters are a few hundred euros. So not a problem. That's it for me. Just another teaser. 1417.52s - 1425.44s | We have some, if you're interested in injection of signals into satellite dishes, 1426.32s - 1432.88s | there's also a talk on the DEFCON main stage tomorrow, track three, breaking the beam at 2.15. 1433.60s - 1438.56s | And next week at USENIX security, the paper is online under this link. So 1439.12s - 1441.84s | just I hope I could do this as well. Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=sjd5LrzHus0", "title": "DEF CON 32 - A dive into world of Aircraft PKI - Matt Gaffney", "description": "From protecting Aircraft Software Parts to authenticating aircraft to ground networks, aircraft use PKI in their day-to-day operations. In this talk we will cover the typical use cases, technologies, and regulations in play and touch upon the emerging threat of the Post-Quantum world and what it could mean for the protection of embedded software we find on aircraft.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1506, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.68s | This text was transcribed using whisper model: large-v2 So I'm Matt Gaffney also known as Gaffers. I'm a principal engineer at United 7.68s - 14.36s | Airlines. I'm also a village lead at the Aerospace Village so a big shout out to 14.36s - 20.88s | those guys put on a great show this year. I'm going to do a shallow dive into 20.88s - 24.80s | aircraft PKI and I've got a few caveats to start with. Like I said this is a 24.80s - 30.52s | shallow dive into the topic. I see a few operators that I recognize in the room 30.52s - 35.56s | and at least one expert who will know this topic several times better than I 35.56s - 39.76s | ever will and you'll understand when I say this this is something you can 39.76s - 46.00s | easily spend three days talking about. It is so complex. So there are some 46.00s - 50.16s | simplifications and there are some generalizations and I'm also only going 50.16s - 55.00s | to speak to what I'm authorized to speak to. And through the village our 55.00s - 58.96s | ethos is to bring light and not heat to the topic of cyber in aerospace. So this 58.96s - 62.28s | will be supplier agnostic and there are some industry challenges that we're 62.28s - 69.16s | working together to fix which I cannot cover. All right that's what we'll go 69.16s - 76.80s | through today. The importance, some use cases, methods A, B and C, a bit of it on 76.80s - 83.04s | ATA spec 42 and then some about post-quantum world PKI for aircraft. I've 83.04s - 85.92s | included a slide of acronyms because I know the slides are going to be 85.92s - 91.68s | available


chunk_text:
and at least one expert who will know this topic several times better than I 35.56s - 39.76s | ever will and you'll understand when I say this this is something you can 39.76s - 46.00s | easily spend three days talking about. It is so complex. So there are some 46.00s - 50.16s | simplifications and there are some generalizations and I'm also only going 50.16s - 55.00s | to speak to what I'm authorized to speak to. And through the village our 55.00s - 58.96s | ethos is to bring light and not heat to the topic of cyber in aerospace. So this 58.96s - 62.28s | will be supplier agnostic and there are some industry challenges that we're 62.28s - 69.16s | working together to fix which I cannot cover. All right that's what we'll go 69.16s - 76.80s | through today. The importance, some use cases, methods A, B and C, a bit of it on 76.80s - 83.04s | ATA spec 42 and then some about post-quantum world PKI for aircraft. I've 83.04s - 85.92s | included a slide of acronyms because I know the slides are going to be 85.92s - 91.68s | available later through DEFCON but like I said those you who work in aerospace 91.68s - 95.56s | will know what I'm talking about. I will try to name them out every time I 95.56s - 101.80s | mention the first time around. If I don't just throw something at me. So why is it 101.80s - 105.16s | important? Well in aviation with this thing called field loadable software or 105.20s - 110.60s | FLS and in modern commercial aircraft FLS is everywhere and don't just think 110.60s - 115.24s | about your IFE right. You know it's like you're in flight entertainment sorry 115.24s - 120.20s | with your films or movies. We have sensors which generate logs for 120.20s - 123.44s | maintenance and preventive maintenance, communication systems, 123.44s - 128.32s | control surfaces and navigation databases. And then for legacy and in 128.32s - 134.32s | most cases on next-gen aircraft if you wanted to update the firmware in a line 134.36s - 139.48s | replaceable unit or an LRU you'd have to take it out and put a new one in. 139.48s - 145.32s | Whereas with the enabled aircraft there are certain LRUs to which


chunk_text:
later through DEFCON but like I said those you who work in aerospace 91.68s - 95.56s | will know what I'm talking about. I will try to name them out every time I 95.56s - 101.80s | mention the first time around. If I don't just throw something at me. So why is it 101.80s - 105.16s | important? Well in aviation with this thing called field loadable software or 105.20s - 110.60s | FLS and in modern commercial aircraft FLS is everywhere and don't just think 110.60s - 115.24s | about your IFE right. You know it's like you're in flight entertainment sorry 115.24s - 120.20s | with your films or movies. We have sensors which generate logs for 120.20s - 123.44s | maintenance and preventive maintenance, communication systems, 123.44s - 128.32s | control surfaces and navigation databases. And then for legacy and in 128.32s - 134.32s | most cases on next-gen aircraft if you wanted to update the firmware in a line 134.36s - 139.48s | replaceable unit or an LRU you'd have to take it out and put a new one in. 139.48s - 145.32s | Whereas with the enabled aircraft there are certain LRUs to which you can just 145.32s - 150.04s | push new FLS to activate new features or just to update the functionality to fix 150.04s - 155.68s | any bugs. And if you saw my talk on DEFCON 28 on the aircraft information 155.68s - 160.24s | systems domain you might remember my favorite factoid and that's that 160.24s - 165.88s | there are about 1,400 different software parts on a 787 and to control 165.88s - 174.64s | the bathrooms. So these are the typical use cases. It's not an exhaustive list 174.64s - 179.28s | but it covers the main use cases in commercial aviation and those which I 179.28s - 186.40s | generally have time for today. So aircraft operators receive FLS from 186.40s - 190.84s | multiple sources. They can be manufacturers, OEMs, suppliers and even 190.84s - 196.80s | from internal teams who can build a subtype of FLS called UMI or user 196.80s - 202.16s | modifiable information. A good example of UMI is a configuration load for the 202.16s - 205.84s | aircraft information systems domain on certain aircraft which will define 205.84s - 210.84s | things like connectivity to the ground, enabling and disabling


chunk_text:
you can just 145.32s - 150.04s | push new FLS to activate new features or just to update the functionality to fix 150.04s - 155.68s | any bugs. And if you saw my talk on DEFCON 28 on the aircraft information 155.68s - 160.24s | systems domain you might remember my favorite factoid and that's that 160.24s - 165.88s | there are about 1,400 different software parts on a 787 and to control 165.88s - 174.64s | the bathrooms. So these are the typical use cases. It's not an exhaustive list 174.64s - 179.28s | but it covers the main use cases in commercial aviation and those which I 179.28s - 186.40s | generally have time for today. So aircraft operators receive FLS from 186.40s - 190.84s | multiple sources. They can be manufacturers, OEMs, suppliers and even 190.84s - 196.80s | from internal teams who can build a subtype of FLS called UMI or user 196.80s - 202.16s | modifiable information. A good example of UMI is a configuration load for the 202.16s - 205.84s | aircraft information systems domain on certain aircraft which will define 205.84s - 210.84s | things like connectivity to the ground, enabling and disabling features or 210.84s - 214.72s | systems. And that is a part we would create and sign before we can put it on 214.72s - 219.48s | the aircraft. And when we receive an FLS from an external source we are required 219.48s - 224.08s | by regulation to verify its authenticity. For handling FLS the 224.08s - 227.40s | manufacturers provide operators with the software to which we configure them 227.40s - 231.44s | with the verified suppliers trust chains and that allows us to verify it's been 231.44s - 238.38s | signed by the trusted entity. As important as verifying its 238.38s - 243.06s | authenticity it's vital we check the FLS integrity as well and we're also 243.06s - 248.74s | required by regulation to do that as well. In fact through various standards 248.74s - 251.30s | we're mandated to do this before uploading to the aircraft and there's a 251.30s - 254.18s | new requirement and I'm sure I'm gonna get some eye rolls from somebody in the 254.18s - 260.38s | front row here about the recent implementation or basically new rules 260.38s - 267.02s | around using ARINC 645-1 portable data loaders or


chunk_text:
features or 210.84s - 214.72s | systems. And that is a part we would create and sign before we can put it on 214.72s - 219.48s | the aircraft. And when we receive an FLS from an external source we are required 219.48s - 224.08s | by regulation to verify its authenticity. For handling FLS the 224.08s - 227.40s | manufacturers provide operators with the software to which we configure them 227.40s - 231.44s | with the verified suppliers trust chains and that allows us to verify it's been 231.44s - 238.38s | signed by the trusted entity. As important as verifying its 238.38s - 243.06s | authenticity it's vital we check the FLS integrity as well and we're also 243.06s - 248.74s | required by regulation to do that as well. In fact through various standards 248.74s - 251.30s | we're mandated to do this before uploading to the aircraft and there's a 251.30s - 254.18s | new requirement and I'm sure I'm gonna get some eye rolls from somebody in the 254.18s - 260.38s | front row here about the recent implementation or basically new rules 260.38s - 267.02s | around using ARINC 645-1 portable data loaders or PDLs. It's been a bit of a 267.02s - 273.94s | thing for us but these enforce signature checking of the FLS prior to loading 273.94s - 277.86s | onto the aircraft for in a technical sense so we're not relying on the on the 277.86s - 281.62s | mechanic or the technician to do those checks you actually can't physically put 281.62s - 287.20s | it on the aircraft until that signature has been checked which is great. And it 287.20s - 290.60s | may or may not surprise you when I say that an aircraft can generate 290.60s - 294.88s | hundreds of megabytes if not several gigabytes of data per flight length. 294.88s - 299.38s | We've come a long way from the days of OOE messages over A cars although they 299.38s - 305.76s | do still exist. The vast majority of data comes from the engines or certain 305.76s - 309.68s | aircraft if you have a Navy pilot and he slams it on a landing some F you know 309.68s - 315.40s | the carbon fiber aircraft they also generate stress data and as soon as the 315.40s - 318.36s | aircraft touches down


chunk_text:
PDLs. It's been a bit of a 267.02s - 273.94s | thing for us but these enforce signature checking of the FLS prior to loading 273.94s - 277.86s | onto the aircraft for in a technical sense so we're not relying on the on the 277.86s - 281.62s | mechanic or the technician to do those checks you actually can't physically put 281.62s - 287.20s | it on the aircraft until that signature has been checked which is great. And it 287.20s - 290.60s | may or may not surprise you when I say that an aircraft can generate 290.60s - 294.88s | hundreds of megabytes if not several gigabytes of data per flight length. 294.88s - 299.38s | We've come a long way from the days of OOE messages over A cars although they 299.38s - 305.76s | do still exist. The vast majority of data comes from the engines or certain 305.76s - 309.68s | aircraft if you have a Navy pilot and he slams it on a landing some F you know 309.68s - 315.40s | the carbon fiber aircraft they also generate stress data and as soon as the 315.40s - 318.36s | aircraft touches down you get that infamous weight on wheels signal to the 318.36s - 321.40s | avionics it will start trying to establish a link to the ground systems 321.40s - 328.41s | and sometimes even before the aircraft reaches the gate. These connections are 328.41s - 333.17s | typically 4G and Wi-Fi and most airport gates have an access point for a service 333.17s - 338.97s | called gate link which can best be described as a common use network 339.05s - 343.29s | dedicated for aircraft traffic and for that reason many operators also 343.29s - 347.77s | implemented VPN through gate link to their network boundary and depending on 347.77s - 352.01s | the aircraft each VPN can require between one and three certificates just 352.01s - 358.09s | for that connection and that's per aircraft. It's also worth noting the logs 358.09s - 363.15s | are digitally signed and verified before being ingested by the operator in the 363.15s - 370.30s | relevant tools or sent on to third parties for analysis. Certificates can 370.30s - 376.18s | also be used to enforce boundary server and even application authentication. It 376.18s - 382.18s | does require mapping these


chunk_text:
you get that infamous weight on wheels signal to the 318.36s - 321.40s | avionics it will start trying to establish a link to the ground systems 321.40s - 328.41s | and sometimes even before the aircraft reaches the gate. These connections are 328.41s - 333.17s | typically 4G and Wi-Fi and most airport gates have an access point for a service 333.17s - 338.97s | called gate link which can best be described as a common use network 339.05s - 343.29s | dedicated for aircraft traffic and for that reason many operators also 343.29s - 347.77s | implemented VPN through gate link to their network boundary and depending on 347.77s - 352.01s | the aircraft each VPN can require between one and three certificates just 352.01s - 358.09s | for that connection and that's per aircraft. It's also worth noting the logs 358.09s - 363.15s | are digitally signed and verified before being ingested by the operator in the 363.15s - 370.30s | relevant tools or sent on to third parties for analysis. Certificates can 370.30s - 376.18s | also be used to enforce boundary server and even application authentication. It 376.18s - 382.18s | does require mapping these certificates to AD identities which is fun especially 382.18s - 386.02s | if you operate a large number of enabled aircraft and it's no secret that you 386.02s - 390.98s | know at United we're trying to upgrade our fleet I think when I started with a 390.98s - 395.26s | hundred and fifty enabled aircraft in our fleet which was a minority by the 395.26s - 398.62s | time we finished updating it we'll have over a thousand enabled aircraft and 398.90s - 403.58s | that's gonna mean a lot of work in terms of this PKI and the connectivity piece 403.58s - 411.30s | and the final use case I'd like to cover today touches a little bit on ETA spec 411.30s - 415.70s | 42 which I'm going to cover a bit later on but suffice to say there are some 415.70s - 421.54s | real wins possible using certificates in smart cards for user authentication. Not 421.54s - 425.74s | only does it provide two-factor without a mobile device but it has advantages 425.74s - 430.86s | from a user experience perspective as well. If you're in a public facing role 431.22s - 436.42s | would


chunk_text:
certificates to AD identities which is fun especially 382.18s - 386.02s | if you operate a large number of enabled aircraft and it's no secret that you 386.02s - 390.98s | know at United we're trying to upgrade our fleet I think when I started with a 390.98s - 395.26s | hundred and fifty enabled aircraft in our fleet which was a minority by the 395.26s - 398.62s | time we finished updating it we'll have over a thousand enabled aircraft and 398.90s - 403.58s | that's gonna mean a lot of work in terms of this PKI and the connectivity piece 403.58s - 411.30s | and the final use case I'd like to cover today touches a little bit on ETA spec 411.30s - 415.70s | 42 which I'm going to cover a bit later on but suffice to say there are some 415.70s - 421.54s | real wins possible using certificates in smart cards for user authentication. Not 421.54s - 425.74s | only does it provide two-factor without a mobile device but it has advantages 425.74s - 430.86s | from a user experience perspective as well. If you're in a public facing role 431.22s - 436.42s | would you rather a password with 15 plus characters which is rotated every three 436.42s - 449.09s | to 12 months or would you prefer a smart card with a pin code instead and every 449.09s - 454.25s | time you log in you type in a pin code and when you pull the smart card out it 454.25s - 458.57s | locks the screen automatically. So you get great security you also get a great 458.57s - 463.57s | user experience as well and if you're a gate agent working in a public area that 463.61s - 470.60s | could be a real win. We're working on it but going back to signing FLS so ETA 470.60s - 475.96s | spec 42 requires all PKI subscribers to authenticate to the PKI management 475.96s - 480.92s | platform using those smart card based hardware certificates like I just showed 480.92s - 488.94s | you my hand there. The spec puts a huge emphasis on identity verification, dual 488.94s - 494.50s | controls and audit of all activities. Without strong authentication mechanisms 494.62s - 499.50s | all of that would be for naught. In some scenarios and depending on the method 499.50s


chunk_text:
you rather a password with 15 plus characters which is rotated every three 436.42s - 449.09s | to 12 months or would you prefer a smart card with a pin code instead and every 449.09s - 454.25s | time you log in you type in a pin code and when you pull the smart card out it 454.25s - 458.57s | locks the screen automatically. So you get great security you also get a great 458.57s - 463.57s | user experience as well and if you're a gate agent working in a public area that 463.61s - 470.60s | could be a real win. We're working on it but going back to signing FLS so ETA 470.60s - 475.96s | spec 42 requires all PKI subscribers to authenticate to the PKI management 475.96s - 480.92s | platform using those smart card based hardware certificates like I just showed 480.92s - 488.94s | you my hand there. The spec puts a huge emphasis on identity verification, dual 488.94s - 494.50s | controls and audit of all activities. Without strong authentication mechanisms 494.62s - 499.50s | all of that would be for naught. In some scenarios and depending on the method 499.50s - 503.30s | used to sign the FLS the signing certificate can be held on the smart 503.30s - 508.58s | card of those specific authorized sorry those specific subscribers who are 508.58s - 514.93s | authorized to sign the software. So coming on to the signing then so signing 514.93s - 523.01s | FLS method A on the left there we're receiving the receiving the software or 523.01s - 528.77s | it's coming from that internal team and in method A it's typically in this 528.77s - 535.41s | scenario it's typically unsigned. If it was signed it would just be verified and 535.41s - 543.37s | then put into the storage or the repository. But in method A you get 543.37s - 549.77s | your data your software part here which is an ARINC 665 load. Basically it's 549.77s - 554.41s | an ARINC standard of zip file structures and the header files and 554.41s - 563.21s | then using the manufacturer provided tools the device sponsor here will use 563.21s - 570.05s | their smart card and they will the software will then verify that 570.05s - 575.73s | certificate on his smart card with an OCSP


chunk_text:
- 503.30s | used to sign the FLS the signing certificate can be held on the smart 503.30s - 508.58s | card of those specific authorized sorry those specific subscribers who are 508.58s - 514.93s | authorized to sign the software. So coming on to the signing then so signing 514.93s - 523.01s | FLS method A on the left there we're receiving the receiving the software or 523.01s - 528.77s | it's coming from that internal team and in method A it's typically in this 528.77s - 535.41s | scenario it's typically unsigned. If it was signed it would just be verified and 535.41s - 543.37s | then put into the storage or the repository. But in method A you get 543.37s - 549.77s | your data your software part here which is an ARINC 665 load. Basically it's 549.77s - 554.41s | an ARINC standard of zip file structures and the header files and 554.41s - 563.21s | then using the manufacturer provided tools the device sponsor here will use 563.21s - 570.05s | their smart card and they will the software will then verify that 570.05s - 575.73s | certificate on his smart card with an OCSP response and if it's valid the 575.73s - 579.25s | software will go ahead and sign that software using that device sponsors 579.25s - 585.25s | private key and it creates a load with a signed OCSP response along with the 585.25s - 589.97s | data and the encrypted hash or the signature. And this is great it's got a 589.97s - 595.17s | bunch of advantages. So once an FLS has been signed with a valid certificate it 595.17s - 599.85s | never needs to be signed again unless that software is modified. So it doesn't 599.85s - 605.53s | matter if that certificate is revoked later or it expires we know that at the 605.53s - 612.79s | time of signing that that certificate was valid. And also in this situation the 612.79s - 616.75s | aircraft does not need to an access a CRL or a certificate revocation list it 616.75s - 622.15s | just needs to be configured with a trust chain. The disadvantages are you don't 622.15s - 626.75s | control the PKI and you have to pay for it and also you know these ground system 626.75s - 630.35s | environments often use virtual


chunk_text:
response and if it's valid the 575.73s - 579.25s | software will go ahead and sign that software using that device sponsors 579.25s - 585.25s | private key and it creates a load with a signed OCSP response along with the 585.25s - 589.97s | data and the encrypted hash or the signature. And this is great it's got a 589.97s - 595.17s | bunch of advantages. So once an FLS has been signed with a valid certificate it 595.17s - 599.85s | never needs to be signed again unless that software is modified. So it doesn't 599.85s - 605.53s | matter if that certificate is revoked later or it expires we know that at the 605.53s - 612.79s | time of signing that that certificate was valid. And also in this situation the 612.79s - 616.75s | aircraft does not need to an access a CRL or a certificate revocation list it 616.75s - 622.15s | just needs to be configured with a trust chain. The disadvantages are you don't 622.15s - 626.75s | control the PKI and you have to pay for it and also you know these ground system 626.75s - 630.35s | environments often use virtual machines and if you can imagine here I've 630.35s - 635.31s | oversimplified it here but this device sponsors probably on it on a laptop going 635.31s - 639.71s | to a jump box to go into a high secure zone and you've got to get that smart 639.71s - 643.43s | card that he's got his laptop read by the software that's on a VM through a 643.43s - 647.43s | jump box. That can be tricky to set up and I'm probably getting some nods in 647.43s - 656.63s | the front row I can't see for the lights. Method B a little bit more simplistic so 656.63s - 663.63s | we will receive data signed or unsigned if it's signed we verify the signature 663.63s - 671.31s | and then strip it off and then we keep our signing signature or signing 671.31s - 678.67s | certificate sorry in a HSM which is used by that software checks on this is 678.67s - 683.67s | checked by the CRL of course and then goes a much more simple structure here 683.67s - 687.71s | and then goes into repository. From the repository I didn't cover that in


chunk_text:
machines and if you can imagine here I've 630.35s - 635.31s | oversimplified it here but this device sponsors probably on it on a laptop going 635.31s - 639.71s | to a jump box to go into a high secure zone and you've got to get that smart 639.71s - 643.43s | card that he's got his laptop read by the software that's on a VM through a 643.43s - 647.43s | jump box. That can be tricky to set up and I'm probably getting some nods in 647.43s - 656.63s | the front row I can't see for the lights. Method B a little bit more simplistic so 656.63s - 663.63s | we will receive data signed or unsigned if it's signed we verify the signature 663.63s - 671.31s | and then strip it off and then we keep our signing signature or signing 671.31s - 678.67s | certificate sorry in a HSM which is used by that software checks on this is 678.67s - 683.67s | checked by the CRL of course and then goes a much more simple structure here 683.67s - 687.71s | and then goes into repository. From the repository I didn't cover that in the 687.71s - 691.27s | last slide sorry there are multiple ways to get that from the repository to the 691.27s - 697.43s | aircraft. There is this over-the-air technique which some aircraft enable us 697.43s - 701.63s | to do. It still requires a mechanic or a technician to go into the cockpit and 701.63s - 705.47s | press some buttons and there's some other conditions which have to be true 705.47s - 710.23s | as well so all this science fiction you read about changing software in flight 710.23s - 714.15s | yeah I'm going to tell you what those conditions are but there are conditions 714.15s - 718.51s | which stop that kind of thing. We can also use USBs and these are not your 718.51s - 724.75s | typical USBs you keep at home these are actually assigned as tools and they are 724.75s - 727.79s | treated as such they're signed in and out the tool store they go through 727.79s - 732.59s | procedures to wipe and clean them or at least they should anyway and then the 732.59s - 737.11s | one in the middle there is a PDL or a portable data


chunk_text:
the 687.71s - 691.27s | last slide sorry there are multiple ways to get that from the repository to the 691.27s - 697.43s | aircraft. There is this over-the-air technique which some aircraft enable us 697.43s - 701.63s | to do. It still requires a mechanic or a technician to go into the cockpit and 701.63s - 705.47s | press some buttons and there's some other conditions which have to be true 705.47s - 710.23s | as well so all this science fiction you read about changing software in flight 710.23s - 714.15s | yeah I'm going to tell you what those conditions are but there are conditions 714.15s - 718.51s | which stop that kind of thing. We can also use USBs and these are not your 718.51s - 724.75s | typical USBs you keep at home these are actually assigned as tools and they are 724.75s - 727.79s | treated as such they're signed in and out the tool store they go through 727.79s - 732.59s | procedures to wipe and clean them or at least they should anyway and then the 732.59s - 737.11s | one in the middle there is a PDL or a portable data loader that's what I was 737.11s - 745.39s | talking about earlier there at 6451 and they will connect to the network pull 745.39s - 748.39s | the software into the PDL you walk to the aircraft and plug the PDL into the 748.39s - 754.46s | aircraft and do it that way and then there's method C which is very similar 754.46s - 762.50s | to method A but it also includes a signed SCDP response as well okay and as 762.50s - 768.26s | far as I'm aware and correct me if I'm wrong but I'm not aware of this method 768.26s - 773.02s | in use for commercial aircraft today may well happen in the future but today it's 773.02s - 777.82s | not currently in operation for commercial aircraft but it does have 777.82s - 784.70s | practical uses where FLS is designed to be kept for a long term because while I 784.70s - 787.86s | said earlier in method A the FLS doesn't need to be reassigned that's only as 787.86s - 793.42s | long as the CA it was issued for from remains valid so that could be a few 793.42s - 798.10s


