# Media

url: https://www.youtube.com/watch?v=hnUG3hB0qVI
title: DEF CON 32 - Programming a CTS-V Gauge Cluster into an ATS-V, out of pure spite - Varjitt Jeeva
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=hnUG3hB0qVI",
  "title": "DEF CON 32 - Programming a CTS-V Gauge Cluster into an ATS-V, out of pure spite - Varjitt Jeeva",
  "description": "Some cars are over-engineered, some are too basic, and some check every box except one. I did that research over months when trying to buy a new car, and landed on a 6MT Cadillac ATS-V while only wanting and dealing with Japanese cars, specifically Lexus/Toyota. The one thing it was missing was a digital gauge cluster, and programmers were asking $350, so I set off to figure it out myself. I then dove deep into GM electronics and programming, found a smart dude who initially cracked it all for free to spite all the money-grabbing gatekeepers, then became a hyprocrite, backtracking asking thousands to reveal his learnings. This presentation will go over how I programmed that cluster, posted everything on Github, out of spite.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 916,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.32s | This text was transcribed using whisper model: large-v2

 All righty, it's about 4.30 so I'll start. Hi everyone, my name is Varjit Jiva and I'm going
6.32s - 11.20s |  to talk to you guys about how I got annoyed with a bunch of paywalls while I was trying to program
11.20s - 17.52s |  my digital gauge cluster into my Cadillac ATS-V, figured it out, put it up on GitHub and helped a
17.52s - 23.04s |  bunch of people. So I have 35 slides and 25 minutes so we're going to get going. So the
23.04s - 27.52s |  overview for this talk, I'm going to introduce myself on the project, what project points made
27.52s - 32.72s |  this possible, how the hell I figured it out, the high-level process results, and the future
32.72s - 38.72s |  of GM programming and open source. So an introduction to myself, I'm just a software
38.72s - 44.08s |  engineer but I'm into cars. I grew up in the Fast and Furious era so I was into Japanese cars for a
44.08s - 49.92s |  long time and I somehow ended up buying a Cadillac ATS-V earlier this year. It was a six-speed manual
49.92s - 54.72s |  with 400 wheel horsepower and I love that thing. I fall more in love with it every single day
54.72s - 60.56s |  but I almost didn't buy it. Why? Because it came with a gauge cluster on the left. It's needles.
60.56s - 67.12s |  2016 to 2019 this car was made and GM shipped it with needles. The rest of the fleet that they had
67.12s - 71.52s |  had digital gauge clusters with the fancy stuff you see on the right but for my car they never
71.52s - 76.96s |  made it. But I bit the bullet and bought the car because it turns out people were selling
76.96s - 82.88s |  programming services to retrofit a digital gauge cluster into my car. So when I went into that
82.88s - 88.48s |  there was one dude that was like, oh pay me 350 bucks then you can do it. And this was
88.48s - 92.72s |  the only guy doing it for a long time. Then some other dude showed up from the shadows of Facebook
92.72s - 98.48s |  marketplace. It was like $250. I was like, huh? How did this guy figure it out? And then I look
98.48s - 103.84s |  a little bit further, there's another guy on the Corvette forum that put a 2021 digital gauge
103.84s - 109.68s |  cluster into his 2019 C7 Corvette. And I was like, huh? If those two people can figure it out
109.68s - 114.00s |  then I should be able to. And then there's a couple of people selling courses and weird tools
114.00s - 118.40s |  and all these sketchy websites. I don't want to pay any of these people any money. I just want
118.40s - 123.84s |  to figure it out. I didn't want to go bankrupt in the process too. So what project points actually
123.84s - 130.56s |  made this possible? So first the 12.3 inch gauge cluster I'm talking about, the fully digital one
130.56s - 136.16s |  was available in a whole bunch of Cadillac models of the same year, but with different views and
136.16s - 140.80s |  stuff like that. They just didn't ship it with my car. On top of that, the plug that was on the
140.80s - 146.00s |  back of this thing was the same thing as my car. So that was already a good indication. Then the
146.00s - 152.48s |  view that I want to see on this 12.3 inch cluster was the same thing that was available on a Cadillac
152.48s - 158.08s |  CTS Vsport, which was the same engines, 3.6 liter twin turbo with the gauges and everything. It's
158.08s - 164.08s |  got what I needed. And then turns out that between the needle gauge cluster and the 12.3 inch digital
164.08s - 169.92s |  one, the total set of configuration flags was the exact same between the two. So basically what I'm
169.92s - 174.72s |  saying is this gauge cluster could have fit my car the whole time, but GM just decided to not
174.72s - 179.84s |  ship it. So that's why this programming became a thing. And here's how I figured it out. And here's
179.84s - 187.20s |  the funny thing. I've added a counter into these slides where people sell courses and tools on how
187.20s - 192.16s |  to do this stuff. And that total ran out to over a thousand dollars just to do this one thing.
192.16s - 196.08s |  So I'll show you through these slides, how much you get to save by just listening to the
196.08s - 202.24s |  presentation. So from the beginning, let's say you're me, you have this car and you want to
202.24s - 207.12s |  retrofit this cluster into that. So the programming advertisement, they'll tell you, get any of the
207.12s - 211.52s |  12.3 inch clusters from any of the car, any of the Cadillac cars from the same year. And then
211.52s - 216.64s |  we'll program it to show the V cluster on there and what the correct red line and all this stuff.
216.64s - 223.36s |  I was like, huh, interesting. So can I retrofit this from another car? Did they make all this
223.36s - 227.12s |  custom? No, there's no way they made the graphics and stuff like that themselves.
227.12s - 234.48s |  But was there a car that had the same basically engine and stuff that could show the right view?
234.48s - 239.52s |  It was like, yeah, it was the Cadillac CTS Vsport. So I just had to get a 12.3 inch cluster,
239.52s - 245.20s |  doesn't matter from what car, show that specific car's view and then put it into my car.
246.16s - 253.12s |  So how do I make my cluster look like the one from the target vehicle? So I ended up buying a
253.12s - 260.64s |  cluster from a 2017 Escalade and I had to make it show the view for the 2017 Cadillac CTS Vsport.
261.20s - 265.92s |  So the first thing I did with this cluster was pop the back of it. If you see the middle chip
265.92s - 270.32s |  right there, the middle to the little bit to the right, there's a silver one. That's a Texas
270.48s - 275.20s |  Instruments ARM CPU. It was Linux-based basically. So I'm looking at PNG files,
275.20s - 279.36s |  whatever, all those graphics. So it's pretty straightforward, I guess, at that point.
279.36s - 284.48s |  But the next three questions I had at this point were, one, can this cluster connect to my car?
284.48s - 288.80s |  Two, are the right files on there? Do I have to somehow patch them to get the right
289.44s - 293.60s |  gauge cluster to show up? And three, how do I configure the cluster to work with my car,
293.60s - 300.72s |  with my specific feature set and stuff? So those three questions actually relate to the
300.72s - 307.92s |  three steps of CAN bus module programming in GM. First, you have to configure authentication,
307.92s - 313.04s |  then programming for the general purpose firmware, software, whatever, and the setup
313.04s - 321.92s |  and configuration to set the config flags according to what your car has. So the first thing,
321.92s - 326.32s |  can I just plug and play this cluster? No. The first thing that you have to do is actually make
326.32s - 330.64s |  sure that the cluster can authenticate with the rest of the CAN bus. And it does that with two
330.64s - 335.28s |  specific pieces of information, which is the VIN number and the security pin, which is derived from
335.28s - 341.20s |  the VIN number. So all I had to do was program those onto the cluster. But how do you do that?
341.20s - 345.76s |  I looked in the back of the thing. And if anyone in here has ever touched a gauge cluster before,
345.76s - 350.64s |  usually this kind of information is stored on an EEPROM chip. So I already had one of the best
350.64s - 356.64s |  things, I think, in this market is a CH341A EEPROM programmer, which is like $5 on AliExpress.
356.64s - 362.24s |  And it turns out that the chip that was holding this was an I2C24C16. People were selling this
362.24s - 368.24s |  a tool that can do this programming for $100. I figured it out for $5 and I read the chip.
368.24s - 372.16s |  So what I did was I read it immediately. I didn't even have to repin it. Just read the chip,
372.16s - 378.72s |  dumped it. And it turns out that in plain text, the first 17 digits was the VIN number. And there's
378.80s - 383.36s |  a auspicious four digits right under, which is the security pin. All I did was set those to my
383.36s - 390.80s |  values for my car and immediately it worked. The first thing this picture shows is that
390.80s - 394.48s |  the cluster works with my car. It's pulling values and stuff, but it's just not showing
394.48s - 400.00s |  the right thing. And I know this worked because you could see that the mileage for the vehicle
400.00s - 405.52s |  actually showed up there. In GM, the mileage for the car is actually not stored in the gauge cluster
405.52s - 410.72s |  like other cars. It's actually stored in the body control module. And if your module face
410.72s - 415.28s |  will authenticate with that module because of the mismatch of the VIN and pin, then that mileage
415.28s - 421.60s |  will actually show up as dash, dash, dash. So I know I got this right because I got the odometer
421.60s - 426.40s |  to show up actually. So cool. I got it to connect to the car. Now, how do I make sure the right
426.40s - 430.72s |  files and the graphics are on there? So now I'll talk a little bit about how GM programming
430.72s - 436.00s |  actually works with the dealer software called SPS2. I don't exactly remember what the acronym
436.00s - 440.48s |  means, but that's basically the dealer software like any other car. You get that, you get a
440.48s - 446.56s |  subscription with the VIN number for your car, $45 for two years, not expensive. Then you get
446.56s - 452.08s |  the dealer cable, $186, not a big deal either. So the programming step, what this does is that
452.08s - 458.64s |  it loads the firmware, all the software, whatever it needs just to run the general purpose of this
458.64s - 465.12s |  module. So there's even a step before this, because in the world of GM programming, people
465.12s - 470.32s |  can actually check what files are going to be loaded by the software into the modules before,
470.32s - 475.12s |  ahead of time. And surprisingly, there was a light version of this running on the internet,
475.12s - 480.64s |  open to the public, which is called, which is hosted by Opal. Turns out that GM has been selling
480.64s - 484.96s |  their Canva system to a whole bunch of other manufacturers. One of them being Opal, Skoda,
484.96s - 490.08s |  I think. And then I think a Chinese manufacturer, I don't remember. But it turns out I used this
490.08s - 495.92s |  website just to check what programming files are going to be loaded into this module. And I did
495.92s - 501.76s |  that by taking the VIN number from my donor Escalade cluster. I took the VIN number from a
501.76s - 509.28s |  target car, which is the Cadillac CTS-V Sport. And I just ran the programming steps to just see
511.20s - 514.32s |  what VIN number was going to come out. These numbers are actually called calibration numbers.
515.20s - 520.32s |  It's a unique identifier in the GM world where they say this has this specific set of files in it.
520.32s - 525.44s |  That turns out though, that the number is the exact same in both of these cars. That means that
525.44s - 531.28s |  my Escalade cluster already had the views that I needed for a CTS-V, which is a sports car. It
531.28s - 536.56s |  was already on all these cars. I just had to be able to reveal it. And how do I do that?
536.56s - 542.88s |  That gets to step number three, the setup and configuration of GM programming. So now I have
542.88s - 547.92s |  to actually get set the configuration values according to what I need. So a couple of slides
547.92s - 553.92s |  here. This is actually some screen caps from when you actually go to get SPS-2 from ACDelco. You go
553.92s - 559.20s |  to this website here, you sign up for your VIN number, you download the thing. It's a Java-based
559.92s - 565.20s |  program. And you go into here, then you see right there, instrument cluster. You go to set up a
565.20s - 572.00s |  configuration, just run that. And it does a two-step process where it pulls the files from the
572.00s - 579.20s |  GM servers, stores it on your computer, and then programs it against your car. And turns out that
579.20s - 585.52s |  they dump all these files to your local C drive. So a couple of bonus slides here where you can
585.52s - 594.00s |  save some money. $450. This one was $450, which is ridiculous. This is how to grab any BIN file
594.00s - 600.00s |  or config files from SPS-2 for any vehicle. All you have to do is buy the VIN number for the car
600.00s - 604.72s |  that you don't have in front of you. And then you just have to connect to your car, even though it
604.72s - 609.68s |  doesn't have the right VIN number. And then just download and then run the programming for whatever
609.68s - 614.48s |  you need for whatever module. It'll save the files to your computer. And then as soon as it's done
614.48s - 619.04s |  downloading, yank the cable from your car. That's it. That's all I did to pull out these files from
619.04s - 624.96s |  the car. And the thing is, people were advertising emulators online for this. This would have costed
624.96s - 630.48s |  $450 just to do this when there was an override button right in front of you with a screen cap.
631.44s - 636.56s |  And also those emulators get you banned from the GM servers. So instead of paying $450,
636.56s - 643.04s |  you press an override button, which is ridiculous. Then another bonus slide, how to grab the security
643.04s - 650.08s |  pin for a VIN number from a car for a VIN number from GM. So what you do here is that you actually
650.08s - 655.36s |  run a dummy configuration that's just kind of safe because it only sets configuration flags in
655.36s - 661.44s |  your module. All I did was run that with a vehicle that I don't own. Well, I don't have access to it
661.44s - 666.00s |  really. And then just running against my car, it'll just fail to authenticate with the module
666.00s - 670.00s |  inside the car. So then it'll just bomb out, doesn't do anything. And then you go check
670.00s - 675.84s |  inside the C drive over here. And there's a file right here called SPS tool bridge, tool bridge
675.92s - 680.24s |  log, right? There's the VIN number that I was attempted and the security pin that was right
680.24s - 686.00s |  there. So right then and there, you get it for free. Well, almost for free. There's also VIN
686.00s - 690.16s |  to pin services that you could buy online for $50 from some random website, or you can get it from
690.16s - 697.68s |  GM directly using this method. Now, before I can explain what I did for the configuration flags,
697.68s - 704.32s |  I have to explain two things, what a build code and RPO code is. So in those local files I was
704.32s - 709.84s |  talking about earlier, there's a build code, a build record at BLD, which has your VIN number,
709.84s - 714.64s |  chassis code, and then a bunch of things called RPO codes. These are build codes or like option
714.64s - 719.04s |  codes for stuffing your car. Like, oh, if you have a digital cluster or this fancy suspension,
719.04s - 724.32s |  whatever, then there's an S3 file right there where ACDelco publishes every single RPO code
724.32s - 728.56s |  that they've ever made for GM. And you can just look it up there. And the next file that was
728.56s - 735.04s |  inside the C drive was an XML file that says something quite interesting. It turns out it is
735.04s - 743.04s |  a logical mapping of P underscore whatever flag that says, set this flag to this value based on
743.04s - 749.28s |  the existence of this RPO code and this chassis code in the car. So I look through this and I
749.28s - 756.80s |  knew that I wanted to get the gauge cluster from a CTS Vsport, which has the chassis code of 6AL69
756.80s - 764.24s |  right there and the engine code. And turns out that right here, PDDH variant gets set to the
764.24s - 773.36s |  value of 6 to get the V fancy graphic out. So all I did was edit this file to include my car,
773.36s - 780.88s |  which is a 6AE47 chassis code with an engine code of LF4. I left the UDV in there and then edited my
780.88s - 786.08s |  build record to have a UDV, which is for the 12.3 inch cluster. UDD is for the needle one,
786.08s - 790.00s |  whatever. I just changed it just so that everything that all the flights that get
790.00s - 795.52s |  enabled by this XML file will be for my car. So it fully works. And then as soon as I did that,
795.52s - 801.04s |  saw this, ran to my car. Oh yeah, by the way, this would have cost an extra $350. We're at $950
801.04s - 806.88s |  right now already. Ran to my car. Press the configuration file or press the configuration
806.88s - 811.92s |  function. Turns out that also the cache files on here are not checksum. You could just edit the
811.92s - 818.48s |  files and GM will just detect the existence of the files, not even check anything else. You click,
818.48s - 822.40s |  it'll just run with the files on your disk and then that's it. So I managed to click programs
822.40s - 827.12s |  to this thing for free without paying anyone anything, which is fucking awesome. So tying
827.12s - 831.20s |  this all together, high level process. There's a list of requirements right here. I'm not going
831.20s - 837.36s |  to read this all out to you guys. High level programming steps. It's just setting up your
837.36s - 842.64s |  windows laptop, then running a cluster configuration with your OEM cluster just to
842.64s - 849.36s |  get the RPO codes and the XML files out. Then you edit the EEPROM on the cluster, which I explained
849.36s - 853.92s |  earlier, then also edit the cache files locally and then just run the configuration again. And
853.92s - 861.92s |  that's it. So the future of GM programming in open source. I posted this right away on GitHub
861.92s - 865.68s |  and I posted it right away in the Cadillac forum. So a few people actually got to use this and fix
865.68s - 871.12s |  their own problems, which was really nice. But the crazy thing is I don't understand how I had
871.12s - 875.44s |  to spend a thousand dollars just to figure this out. And thank God I did not pay any of that money
875.44s - 880.72s |  because for how complicated this process was, it really wasn't that complicated. Most of this stuff
880.72s - 886.72s |  was just open to the public, open on your laptop, open on the internet. It didn't really make sense.
886.72s - 893.44s |  So I hope that with this, that more people get into modifying their GM cars to do cool stuff
893.44s - 898.80s |  like this without having to pay $350 and stuff like that to do this stuff. So I really hope that
898.80s - 904.72s |  this helps maybe a couple of people. A big shout out to the DEF CON conference and the Car Hacking
904.72s - 909.76s |  Village for selecting my talk. This is actually my first DEF CON ever. So being up on the stage
909.76s - 913.36s |  is crazy. So thank you guys so much. And yeah.


url: https://www.youtube.com/watch?v=b7WlUofPJpU
title: DEF CON 32 - Practical Exploitation of DoS in Bug Bounty - Roni Lupin Carta
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=b7WlUofPJpU",
  "title": "DEF CON 32 - Practical Exploitation of DoS in Bug Bounty - Roni Lupin Carta",
  "description": "The talk \"Practical Exploitation of DoS in Bug Bounty\" explains methods for identifying and exploiting Denial of Service (DoS) vulnerabilities in bug bounty programs. Starting with an overview of DoS attacks and their impact, we will highlight how these attacks disrupt services by overwhelming resources or exploiting flaws. The talk covers various DoS attack types, including N+1 errors, in-depth GraphQL crashing, and Cache Poisoning, with real-world examples demonstrating their effects.\n\nWe will then detail practical techniques for discovering DoS vulnerabilities. This includes automated scanning tools, manual testing methods, and understanding the target system's architecture.\n\nN+1 errors occur when an application makes redundant database queries, significantly impacting performance. Attackers can exploit this by triggering numerous unnecessary queries, causing severe slowdowns or crashes. GraphQL, a query language for APIs, can be vulnerable to complex queries that consume excessive resources, leading to server crashes. We will show how to craft such queries and the resulting impact. Cache Poisoning involves manipulating cached data to serve malicious or incorrect content, which can disrupt services or degrade performance. We will explore techniques to poison caches and demonstrate the potential consequences.\n\nAdditionally, the talk emphasizes the importance of responsibly reporting discovered vulnerabilities to bug bounty programs. Best practices are shared for effectively communicating findings and ensuring timely mitigation. Of course, there are some fails during this path, and those are going to be covered too.\n\nThe session wraps up by stressing the need for continuous learning and staying updated on the latest trends in DoS attack vectors and mitigation strategies",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1834,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 3.80s | This text was transcribed using whisper model: large-v2

 So, I'm happy to introduce Ronnie Carta
3.80s - 5.56s |  and talk about practical exploitation
5.56s - 8.76s |  in denial of service and bug bounties.
8.76s - 14.13s |  Ronnie, thanks.
14.13s - 14.97s |  Hi everyone.
14.97s - 17.23s |  I'm really happy to be there today.
17.23s - 20.51s |  This is the first ever Bug Bounty Village
20.51s - 23.67s |  and it's a true honor to do the first talk ever.
23.67s - 25.39s |  Well, with some technical difficulties
25.39s - 27.93s |  of not having an HDMI cable, but no worries.
27.93s - 28.83s |  We are there now.
30.25s - 32.11s |  So, the talk is about practical exploitation
32.11s - 34.65s |  of denial of service in bug bounty program.
34.65s - 36.39s |  So, first of all, my name is Ronnie.
36.39s - 37.75s |  I go by the nickname Lupin.
37.75s - 39.59s |  I'm the co-founder of Lupin Homes.
39.59s - 42.51s |  We are a security research and development company
42.51s - 46.03s |  and I'm coming from the best city in the world, Grenoble.
46.03s - 48.91s |  It's in the French Alps, lot of skiing, beautiful place.
50.47s - 52.55s |  I love denial of service.
52.55s - 55.03s |  I love denial of service because you can actually
55.03s - 57.87s |  try to slow down or considerably take down
57.87s - 59.91s |  an entire product environment.
59.95s - 62.95s |  And so, the goal of denial of service in bug bounties
62.95s - 67.03s |  is to basically try to find the most business impact.
67.03s - 69.51s |  Imagine like a website not having traffic anymore.
69.51s - 72.11s |  That will be a huge bummer for the company.
73.31s - 77.83s |  And so, denial of service and like the difference
77.83s - 79.35s |  between denial of service and DDoS
79.35s - 82.79s |  is basically denial of service is from one single machine.
82.79s - 86.87s |  But DDoS, the additional D is for distributed, of course.
86.87s - 89.25s |  So, it means that we require a series of different machine
89.25s - 91.49s |  to be able to take down our target.
91.49s - 94.01s |  This is basically all about the resource
94.01s - 96.73s |  that you have on your machine against the resources
96.73s - 99.01s |  that you have on your target.
99.01s - 102.57s |  So, if the attacker has more resources on its machine,
102.57s - 106.37s |  then it can basically take down the target.
106.37s - 109.57s |  But in a DDoS, you might have amplification
109.57s - 112.09s |  or multiplicating factor in order to be able
112.09s - 113.97s |  to completely take down the machine.
113.97s - 116.37s |  So, that's what we're going to talk about today.
117.37s - 119.81s |  A little bit of definition debates here.
121.17s - 122.65s |  Basically, there is a whole debate
122.65s - 124.89s |  about denial of service being an availability
124.89s - 126.89s |  or integrity impact.
126.89s - 130.37s |  So, basically, the impact of like the DDoS
130.37s - 132.25s |  is not a vulnerability class,
132.25s - 134.47s |  but more like an impact, I will say.
134.47s - 137.33s |  And we can say that deleting a resource
137.33s - 139.01s |  is in a sense denied.
139.01s - 141.17s |  But the CVSS documentation says
141.17s - 143.69s |  that the deletion of a resource is integrity
143.69s - 145.37s |  and not availability at all.
145.37s - 147.73s |  So, that whole blob of documentation,
147.73s - 150.53s |  if you want to read it, is what the CVSS says.
150.53s - 153.33s |  So, basically, it says that availability
153.33s - 156.37s |  is the performance and operation of the service itself
156.37s - 159.77s |  and not the availability of the data.
159.77s - 161.85s |  For those who have been doing bug bounty hunting,
161.85s - 165.53s |  you know that you are debating a lot about CVSS
165.53s - 167.17s |  and you need to read all the documentation.
167.17s - 169.61s |  So, be mindful of that if you want
169.61s - 171.79s |  to argue with CVSS programs.
172.79s - 176.07s |  So, when DDoS is relevant,
176.07s - 179.11s |  basically, it is relevant for every feature
179.11s - 181.83s |  where there is a strong dependency.
181.83s - 183.47s |  This means that it's a feature
183.47s - 185.59s |  that a lot of users are going to use
185.59s - 188.83s |  or maybe there is a dependency on the machines
188.83s - 191.19s |  that you are targeting.
191.19s - 192.15s |  For instance, if you can take
192.15s - 194.79s |  that entire EKS cluster in production,
194.79s - 196.67s |  well, that might be super impactful.
198.03s - 200.15s |  But yeah, I know what you are going to say.
200.15s - 202.31s |  The denial-of-service is totally out of scope.
202.31s - 205.31s |  Actually, on HackerOne default templates for program,
205.31s - 208.49s |  it's marked as out of scope by default.
208.49s - 209.95s |  And there's a reason for that
209.95s - 213.55s |  because companies, in usual, do not like denial-of-service.
213.55s - 215.99s |  Not because of the low impact
215.99s - 217.83s |  or because it's not security availability,
217.83s - 221.47s |  but because, actually, if you let all your bug hunters
221.47s - 223.27s |  completely take down your website,
223.27s - 226.27s |  it might be a huge problem for them.
226.27s - 230.47s |  So, basically, it's not because denial-of-service
230.47s - 231.31s |  has low impact,
231.31s - 233.91s |  but because sometimes that's too much impact.
233.91s - 236.67s |  But we can test denial-of-service responsibly
236.67s - 239.73s |  and actually make a few bucks with it.
241.41s - 243.63s |  In order to test denial-of-service responsibly,
243.63s - 246.51s |  you need to find the gadget of the problem
246.51s - 247.79s |  to fully exploit it.
247.79s - 249.63s |  So, this means that, for instance,
249.63s - 252.79s |  if you have a request that takes more than 10 seconds,
252.79s - 254.19s |  this might be a cool gadget
254.19s - 257.23s |  in order to take down the entire product environment,
257.23s - 259.35s |  but you do not need to actually take it down
259.35s - 262.31s |  to just see that one request takes more than 10 seconds.
262.31s - 264.55s |  And also, if you are allowed,
264.55s - 266.55s |  you can still try to take down
266.55s - 267.91s |  the non-production environment,
267.91s - 270.99s |  so staging, integration, sandbox, et cetera.
270.99s - 274.79s |  But if there is something to know about this entire talk,
274.79s - 277.21s |  please, always ask the programs
277.21s - 279.79s |  before even searching for denial-of-services
279.79s - 281.47s |  because programs need to be aware
281.47s - 284.27s |  of what kind of tests you are going to do
284.27s - 285.71s |  in order for them to monitor.
285.71s - 288.35s |  And if everything is going to fire,
288.35s - 290.71s |  they need to identify that you are the one doing the test
290.71s - 291.75s |  and just call you and say,
291.75s - 294.09s |  hey, I think there is a problem here.
296.03s - 299.23s |  And denial-of-service is all about program's maturity.
300.35s - 304.75s |  Some companies do not care about denial-of-service's risk
304.75s - 306.15s |  because they, I don't know,
306.15s - 310.11s |  they don't have user traffic or stuff like that.
310.11s - 312.43s |  But actually, some programs will allow you
312.43s - 315.57s |  to completely take down their prod environment.
315.57s - 318.43s |  And I'm serious, they are completely allowing
318.43s - 320.35s |  to take down their dub-dub-dub environment,
320.35s - 321.73s |  so this is amazing.
322.63s - 324.81s |  Before starting going on all the different techniques,
324.81s - 328.23s |  I need to thanks Rezo, Zach, Ixo, Snorlax,
328.23s - 330.67s |  Bifed, BonsoirD, and DoomerHunter.
330.67s - 331.75s |  Those are amazing hunter.
331.75s - 334.31s |  We did all these research together
334.31s - 335.97s |  on the span of two years,
335.97s - 338.55s |  so I needed to quickly show that to them.
338.87s - 340.39s |  Amazing people to follow, too.
341.83s - 344.99s |  Okay, let's start with a quick vulnerability.
344.99s - 346.83s |  This one is really fun.
346.83s - 349.51s |  So one evening we were hacking with Snorlax
349.51s - 353.47s |  and there was this application that was sending service,
353.47s - 355.99s |  like it was service to send chat messages.
355.99s - 358.31s |  And so with Snorlax, when we are hunting together,
358.31s - 362.33s |  we have this game where the goal is to basically
362.33s - 364.47s |  try to XSS the other one.
364.47s - 367.19s |  So we were contacting one another, sending messages,
367.19s - 370.63s |  and we were like, the first that got XSS wins it.
370.63s - 372.35s |  But at some point, we were doing a test
372.35s - 374.91s |  and my page completely goes blank.
374.91s - 377.15s |  And I was like, ah, maybe I lost internet.
377.15s - 379.19s |  But I was still hearing Snorlax on Discord
379.19s - 381.39s |  and I was like, there's something weird, right?
381.39s - 386.11s |  Until he tells me, hey Lupin, is your page blank, too?
387.47s - 391.31s |  So those are the payloads that we sent at this moment.
391.31s - 394.49s |  So try to think about which one did manage
394.49s - 396.43s |  to make the page entirely blank.
397.31s - 400.53s |  Do you have it?
400.53s - 402.05s |  Yeah, this is the one.
402.05s - 405.61s |  And so to understand why this payload
405.61s - 407.57s |  made the page completely blank,
407.57s - 410.05s |  basically you need to understand that the service
410.05s - 413.01s |  was using a library called sanitize-html.
413.01s - 416.49s |  So basically it's some kind of dump purify
416.49s - 419.61s |  that will try to sanitize every XSS
419.61s - 421.57s |  that you are going to send.
421.57s - 424.69s |  And this library actually tried to sanitize
424.69s - 427.53s |  every href attribute in your frontend.
427.53s - 430.57s |  So for instance, if you have a JavaScript schema,
430.57s - 433.25s |  it will try to remove it from the href.
434.21s - 436.81s |  However, in this payload, where is the href?
436.81s - 438.45s |  There is a problem here.
438.45s - 441.09s |  And so the library actually called the function
441.09s - 444.73s |  noti-href and take an argument href
444.73s - 446.49s |  and do a dot replace on it.
446.49s - 448.49s |  However, when it's undefined,
448.49s - 451.01s |  completely crashed the entire frontend.
451.01s - 453.69s |  Okay, that was a pretty cool one.
453.69s - 456.61s |  And so for every kind of client side
456.77s - 457.89s |  of service malformed data,
457.89s - 460.21s |  I would say that the impact is not that huge.
460.21s - 464.37s |  It's all depending on the target.
464.37s - 466.53s |  Overall, with this specific technique
466.53s - 471.25s |  of malformed data html, we did $350 bounty,
471.25s - 472.57s |  but that's just the start.
473.81s - 476.29s |  If you want to actually search for more
477.49s - 480.17s |  malformed data in the frontend,
480.17s - 482.37s |  you can, there was a cool vulnerability
482.37s - 484.77s |  where we had like a POST request
484.77s - 487.33s |  and we could send any invalid JSON
487.33s - 489.01s |  that was validated by the backend,
489.01s - 491.81s |  but it was a completely malformed JSON.
491.81s - 494.25s |  And so when the frontend was using it,
494.25s - 496.89s |  it will also completely crash.
496.89s - 500.17s |  And so the malformed JSON was like really simple.
500.17s - 505.13s |  It was using two back quotes at the same time,
505.13s - 506.21s |  two escape back quotes.
506.21s - 509.09s |  And so it was somehow accepted by the backend,
509.09s - 512.29s |  but when you were doing a JSON.parse on the frontend,
512.29s - 514.69s |  it will completely crash.
515.53s - 518.45s |  And so this technique actually worked on TikTok
518.45s - 520.41s |  and we got paid with XO for that.
520.41s - 522.53s |  So that was a cool one,
522.53s - 525.49s |  but there were some cooler techniques now.
525.49s - 529.81s |  Okay, so that guy here is one of the biggest problem
529.81s - 534.37s |  for all developers, the N plus one problem.
534.37s - 539.21s |  Basically this technique, I actually knew about it
539.21s - 542.01s |  because my brother, who is a backend developer
542.01s - 544.69s |  told me about, like we were talking about
544.69s - 547.29s |  in our services and how I was trying to exploit them.
547.29s - 549.61s |  And he was like, do you know what's an N plus one problem?
549.61s - 550.45s |  And I was like, no.
550.45s - 553.09s |  And he told me that basically an N plus one problem
553.09s - 555.53s |  is was a database anti-pattern
555.53s - 559.97s |  when one query leads to N additional queries
559.97s - 562.97s |  causing inefficient data retrieval.
562.97s - 567.41s |  So basically an attacker can exploit N plus one queries
567.41s - 569.85s |  to trigger numerous call to the database
569.97s - 572.69s |  and potentially overwhelm the system.
572.69s - 575.13s |  And the impact of an N plus one query
575.13s - 577.25s |  often scales with the data size.
577.25s - 578.81s |  So the more data that you add,
578.81s - 582.21s |  the more DOS capability you can have on your target.
583.47s - 585.81s |  So how to detect an N plus one query?
585.81s - 589.51s |  Basically you find an endpoint that creates data in the API.
589.51s - 592.43s |  You find a request that gets all the data at the same time.
592.43s - 594.05s |  So usually a get request.
594.05s - 596.69s |  And if there is pagination, try to increase the limit.
596.69s - 598.21s |  For instance, you have some get request
598.21s - 599.81s |  which is page equal 10.
599.81s - 602.85s |  Try to put 10,000 and see what's going to happen.
603.77s - 606.97s |  And if the more data you add in the backend,
606.97s - 609.59s |  the more time delay there is in the response,
609.59s - 611.29s |  then you have an N plus one error.
612.69s - 614.77s |  I also created a BURP extension
614.77s - 618.05s |  that I'm going to release right after this talk.
618.05s - 619.53s |  That's called Tridos.
619.53s - 623.53s |  And basically it's going to search in your proxy passively
623.53s - 626.57s |  all the requests that takes more than X seconds
626.57s - 629.93s |  where X is a threshold that you set yourself.
629.93s - 632.23s |  I personally put it to three seconds.
632.23s - 636.35s |  And this is a good way to actually identify queries
636.35s - 639.07s |  that might take a lot of time on the backend
639.07s - 642.89s |  and that you can actually use for your exploitation.
642.89s - 647.89s |  So let's take an example of an N plus one problem.
648.55s - 650.61s |  There was an app that could accept
650.61s - 653.65s |  to create as many objects as we wanted.
653.65s - 655.25s |  The JSON blob was something like that
655.25s - 657.17s |  where you had a list of users.
657.17s - 662.05s |  And then on each user, on each array of the list,
662.05s - 664.61s |  you can create a new user.
664.61s - 667.01s |  And then there was another sub object
667.01s - 669.41s |  with another array with new objects.
669.41s - 671.71s |  So that's basically an N plus one problem
671.71s - 673.45s |  when one request can create
673.45s - 676.09s |  as many sub objects as you want.
677.21s - 679.09s |  And so how did we exploit that?
679.09s - 682.65s |  Well, we sent the request to create all those objects
682.69s - 686.97s |  and we created approximately 10,000 objects in the backend.
686.97s - 691.39s |  And then our get request to retrieve all the objects
691.39s - 694.01s |  took 10 seconds per request.
694.01s - 696.85s |  So that's a really, really good sign
696.85s - 698.83s |  that you have an N plus one problem.
698.83s - 700.17s |  We took those requests,
700.17s - 703.29s |  we put it into an intruder on burp
703.29s - 706.77s |  and we set it with no payloads, 10 concurrent requests.
706.77s - 710.31s |  And we basically set it to run indefinitely.
710.31s - 716.36s |  And the result, complete crash.
716.36s - 718.84s |  Overall, this technique, not on a single vulnerability,
718.84s - 723.26s |  but overall, we did $46,000 in bounty.
723.26s - 724.60s |  There was an LHE this week,
724.60s - 727.84s |  so we can add 10,000 more to this slide.
727.84s - 732.40s |  I think that 30K of this was Nolak's alone
733.38s - 736.12s |  because he's so good as just taking one technique
736.12s - 737.24s |  and spread it.
737.24s - 740.16s |  I think he did 15K per vulnerability,
740.16s - 742.48s |  so in two vulnerability, 30K.
742.48s - 743.64s |  That guy is insane.
745.32s - 749.64s |  Okay, let's talk about network-based denial of services.
749.64s - 752.16s |  Have you ever been in that situation
752.16s - 753.80s |  where you have a blind SSRF
753.80s - 756.20s |  and you don't know what to do with it?
756.20s - 758.66s |  And that you are desperate for a technique
758.66s - 762.16s |  that will help you transform this sometimes informative
762.16s - 764.44s |  vulnerability into a higher crit?
764.44s - 766.62s |  Well, we have a technique for you.
767.62s - 770.90s |  Basically, do you guys know something called
770.90s - 772.62s |  like slow low-risk attack?
772.62s - 774.58s |  Well, basically, we are going to try
774.58s - 776.62s |  to do something really similar
776.62s - 780.06s |  where we are going to try to make the bucket hang
780.06s - 782.66s |  on the network level as much as possible.
782.66s - 784.90s |  We can do it with several ways.
784.90s - 788.06s |  You can make your server hang
788.06s - 790.54s |  and just time out after 10 seconds,
790.54s - 793.60s |  or you can create a request loop.
793.60s - 796.02s |  So, what do I mean by request loop?
796.42s - 798.46s |  Well, you have your server that has a path
798.46s - 801.46s |  that will reject 301 on path two,
801.46s - 804.22s |  and then the path two will reject again on path one.
804.22s - 807.70s |  So, we create like an infinite loop of redirects.
807.70s - 811.46s |  And the goal is to make the server time out
811.46s - 812.88s |  as much as possible.
812.88s - 815.96s |  So, we have that kind of schema happening.
817.94s - 819.86s |  And the goal of that technique is actually
819.86s - 822.94s |  to fill all the available sockets of the server
822.94s - 827.02s |  so it couldn't actually treat the next request
829.06s - 831.74s |  until we have this bottleneck happening
831.74s - 834.16s |  and there is no available sockets anymore.
837.36s - 839.32s |  For this technique, I think it was
839.32s - 841.24s |  on two separate vulnerabilities.
841.24s - 843.32s |  We made 15K.
843.32s - 845.00s |  So, it's actually a great technique
845.00s - 848.20s |  to transform blind SSRF into a critical.
848.20s - 850.92s |  Again, every time that we take down product environments,
850.92s - 853.16s |  we always ask for the programs.
853.16s - 854.96s |  Really be mindful of that.
855.52s - 858.42s |  That's a pretty cool one if you're ever stuck.
860.08s - 863.48s |  Okay, let's go to sign-in denial of services.
864.96s - 867.82s |  This one was really cool because we had a target
867.82s - 870.36s |  with an employee webpage.
870.36s - 872.56s |  And basically, when we see an employee webpage,
872.56s - 875.50s |  we try password stuffing or brute forcing
875.50s - 878.88s |  with simple combination, injection, et cetera, et cetera.
878.88s - 882.36s |  But why this target was particularly interesting for us
882.36s - 886.64s |  is because it was a target with more than 1,000 employees.
886.64s - 890.36s |  There was no rate limiting on the login, no 2FA at all,
890.36s - 893.40s |  and they were using first name dot last name for the user.
893.40s - 895.80s |  So, we could pull everything on LinkedIn
895.80s - 899.12s |  and we had a great world list to work with.
899.12s - 900.90s |  So, what do we do?
900.90s - 903.20s |  We managed to automate the attack,
903.20s - 906.88s |  no rate limiting at all, and then no login found.
906.88s - 908.60s |  Wait, no login found?
909.48s - 911.64s |  But we still got a crit.
911.64s - 915.84s |  Okay, guess what protection they implemented
915.84s - 917.46s |  for brute forcing attack.
917.46s - 919.72s |  Is it A, delay the next attempt?
919.72s - 921.44s |  B, capture?
921.44s - 923.40s |  C, ban the IP address?
923.40s - 930.69s |  Or D, ban the employee account?
930.69s - 933.01s |  There is actual documentation on the internet
933.01s - 936.03s |  that says that this is the right thing to do.
936.03s - 937.59s |  So, yeah.
937.59s - 938.43s |  What happened?
938.43s - 939.89s |  600 account locked.
940.77s - 943.85s |  They had LTAP integration with the AD.
943.85s - 946.83s |  So, Active Directory completely down,
946.83s - 949.29s |  no access to the VPN anymore,
949.29s - 952.69s |  completely take down of the internet environment.
952.69s - 953.71s |  So funny.
954.97s - 957.21s |  I would say that the impact of this technique
957.21s - 961.25s |  is actually like a three out of five,
961.25s - 964.97s |  but it's because the presence in the wild is also reduced.
964.97s - 966.41s |  I don't think that a lot of companies
966.41s - 969.87s |  are doing that anymore, but pretty cool bug.
970.87s - 974.75s |  Okay, let's go to another type of DOS,
974.75s - 976.41s |  disk consumption DOS.
976.41s - 977.75s |  So, this story is quite cool.
977.75s - 980.79s |  It started because I read this AssetNode research.
980.79s - 982.71s |  If you guys don't know AssetNode,
982.71s - 985.63s |  you should read every blog post of them.
985.63s - 986.69s |  It's amazing.
986.69s - 989.11s |  And there was this blog post from 2019
989.11s - 992.79s |  called Discovering a Zero Day and Getting Code Execution
992.79s - 994.63s |  on Modular AWS Network.
994.63s - 997.05s |  So, how did AssetNode achieve that?
997.05s - 1000.21s |  Basically, there was an instance called WebHTest
1000.21s - 1002.45s |  and it was completely open source.
1002.45s - 1005.05s |  So, they read the code and there was this piece of code
1005.05s - 1007.45s |  where you could extract a zip file
1007.45s - 1008.89s |  that was given by the user
1008.89s - 1012.09s |  and then with some kind of quick race condition,
1012.09s - 1015.09s |  you could actually call a PHP file.
1015.09s - 1017.57s |  And so, for this race condition to work,
1017.57s - 1019.89s |  you needed to set up an intruder
1019.89s - 1022.93s |  and just run as many requests as possible.
1024.17s - 1025.97s |  What happened when I tried it?
1027.17s - 1029.57s |  The backend didn't have enough eNodes
1029.57s - 1030.93s |  to take the charge of requests.
1030.93s - 1033.41s |  So, every time it was creating a zip file
1033.41s - 1037.17s |  and trying to extract it, it was allocating eNodes
1037.17s - 1041.67s |  and so, the disk was full in like maybe two, three seconds.
1041.67s - 1044.31s |  So, yeah, I took down the instance
1044.31s - 1047.33s |  and I thought that this instance wasn't used by anyone
1047.33s - 1050.61s |  until someone told me, hey, all the pipelines are down.
1050.61s - 1052.69s |  And so, every time they were running a pipeline,
1052.69s - 1054.51s |  they were going to that instance.
1055.53s - 1056.37s |  That's cool.
1057.37s - 1059.25s |  So, total crash of the server.
1059.25s - 1060.33s |  No access to the disk.
1060.33s - 1062.65s |  They needed to clean everything, wipe out,
1062.65s - 1064.21s |  restart the server.
1064.21s - 1065.61s |  That was a cool one.
1065.61s - 1068.77s |  I would say that, again, the impact is reduced
1068.77s - 1070.33s |  because of the presence in the world.
1070.33s - 1072.09s |  So, it's a three out of five.
1073.93s - 1075.33s |  Cache poisoning.
1075.33s - 1076.33s |  That's a good one.
1077.19s - 1080.45s |  So, one day, for this anecdote,
1080.45s - 1083.21s |  at Lupienzo Homes, we were developing a new feature
1083.21s - 1085.57s |  for our tool, Depi, in research mode.
1085.57s - 1088.77s |  Research mode, for us, is when we want to test an idea
1088.77s - 1092.01s |  and spread it to see if it should be incorporated
1092.01s - 1095.01s |  into our tool for our customers.
1095.01s - 1098.61s |  And so, the idea was, what if registries,
1098.61s - 1101.49s |  when you install a dependency and have two factories,
1101.49s - 1103.13s |  used by the clients were vulnerable
1103.13s - 1105.45s |  to cache poisoning in our service?
1105.45s - 1107.41s |  It's a good thing to try.
1107.41s - 1109.33s |  So, we developed a proof concept
1109.33s - 1112.45s |  and on the first run, we managed to get a hit
1112.45s - 1114.45s |  on registry.npmjs.org.
1114.53s - 1118.29s |  And I was like, no, that didn't happen.
1118.29s - 1119.33s |  Like, no way.
1120.93s - 1122.65s |  So, we thought it was a false positive
1122.65s - 1125.61s |  and lo and behold, it worked.
1126.91s - 1129.61s |  So, what is CPDOS?
1129.61s - 1134.61s |  CPDOS, it was a web attack technique described by Portugal.
1135.01s - 1137.69s |  Portugal actually made it really, really famous.
1137.69s - 1139.85s |  Again, if you didn't read in your life
1139.85s - 1142.81s |  a James Kettle research, you should do it.
1142.81s - 1144.05s |  This guy is amazing.
1144.57s - 1145.93s |  Always breaking the internet.
1145.93s - 1148.69s |  And basically, it involved exploiting vulnerabilities
1148.69s - 1149.97s |  in the web caching system
1149.97s - 1154.21s |  in order to deliver malicious content to the users.
1154.21s - 1157.97s |  So, the methodology is to first understand
1157.97s - 1161.49s |  how the cache keys of our target is working
1161.49s - 1165.57s |  and then understand how the output of the request
1165.57s - 1168.09s |  is linked to your HTTP input.
1168.09s - 1171.29s |  So, for instance, is the cache key inside the path,
1171.29s - 1175.17s |  the headers, or maybe some data in the POST requests?
1175.17s - 1176.81s |  Once you identify the cache key,
1176.81s - 1179.33s |  try to understand how you can manipulate it
1179.33s - 1181.65s |  in order to cache unwanted content.
1181.65s - 1184.93s |  So, it could be a malicious content like an XSS payload
1184.93s - 1189.01s |  or it could just take down the page for all the users.
1190.09s - 1194.49s |  So, the case of registry.npmjs.org was pretty cool.
1194.49s - 1196.93s |  Basically, my assumption is that the cache key
1196.93s - 1199.57s |  was actually the full path.
1199.65s - 1203.97s |  And when we added our malicious header,
1203.97s - 1207.09s |  it will create a 404 error.
1207.09s - 1210.29s |  But however, the cache key is still remaining the same,
1210.29s - 1213.81s |  and so it will just override the cache key with a 404.
1215.13s - 1219.01s |  So, at this point, we called deny packages.
1219.01s - 1223.45s |  That's a screenshot of my script running in the back
1223.45s - 1225.65s |  and I'm trying to do an npm install,
1225.65s - 1226.65s |  and then that's it.
1226.65s - 1229.49s |  We got a 404 in production environment.
1230.17s - 1231.33s |  That was kind of cool.
1231.33s - 1234.13s |  Don't worry, I did it on a package that I created myself.
1234.13s - 1236.61s |  I didn't take down anything, hopefully.
1237.77s - 1241.13s |  And so, the impact was a complete denial
1241.13s - 1243.93s |  of any npm package in the world.
1243.93s - 1247.25s |  Imagine Express has 30 million plus downloads per week.
1248.45s - 1251.21s |  Actually, there was a lot of mitigation in place
1251.21s - 1254.17s |  on GitHub and npm side,
1254.17s - 1258.09s |  but it was quite cool vulnerability.
1258.09s - 1263.09s |  And so, first, they awarded a $500 informative,
1264.05s - 1267.29s |  but then they actually did an awesome work
1267.29s - 1269.17s |  to reconsider the severity,
1269.17s - 1274.17s |  and they added a $10,000 bounty for this npm crash.
1274.89s - 1278.57s |  So, I was so happy, especially for something
1278.57s - 1280.65s |  that we didn't do on purpose again.
1282.41s - 1285.41s |  Okay, let's go to another cool attack vector
1285.41s - 1286.89s |  for denial of services.
1286.89s - 1289.29s |  Everything related to GraphQL.
1289.29s - 1291.81s |  So, why are we talking about GraphQL today?
1291.81s - 1295.85s |  Because it has a huge adoption in the last few years,
1295.85s - 1298.13s |  and there is so many denial of services
1298.13s - 1300.37s |  in the default configuration.
1300.37s - 1305.34s |  But when I say so many, I say so many.
1305.34s - 1309.26s |  First case of denial of services on GraphQL
1309.26s - 1311.26s |  is a circular definition.
1311.26s - 1313.46s |  Basically, circular definition occurs
1313.46s - 1318.46s |  when an object references itself directly or indirectly.
1319.70s - 1322.46s |  For instance, here we have a type user
1322.46s - 1324.14s |  that has a best friend user.
1324.14s - 1328.64s |  But imagine if your best friend is also best friend with you.
1328.64s - 1330.62s |  You are basically referencing yourself.
1330.62s - 1332.62s |  So, we have a circular definition here.
1333.60s - 1336.30s |  But no need to check for the introspection
1336.30s - 1339.06s |  and actually understand the structure of your target.
1339.06s - 1340.94s |  GraphQL is vulnerable by default
1340.94s - 1342.92s |  in the introspection schema.
1343.36s - 1344.68s |  So, you can just do an introspection
1344.68s - 1346.24s |  and actually DOS your target
1346.24s - 1348.80s |  without understanding their data structure.
1348.80s - 1352.31s |  That's insane.
1352.31s - 1354.91s |  And so, there's another kind of technique
1354.91s - 1357.31s |  called GraphQL batching that is pretty cool.
1357.31s - 1361.35s |  Basically, the goal is to compile a lot of different requests
1361.35s - 1363.55s |  in the same HTTP requests.
1363.55s - 1368.47s |  And again, this could be used to actually DOS your target.
1368.47s - 1371.67s |  We're going to talk about this a little bit later.
1371.67s - 1373.67s |  Something really similar to GraphQL batching,
1373.67s - 1375.27s |  there is aliases where, basically,
1375.27s - 1380.07s |  you can use different aliases for the same requests
1380.07s - 1382.19s |  but also use different arguments.
1382.19s - 1385.63s |  So, that also could be a huge attack vector
1385.63s - 1387.47s |  for the network service.
1387.47s - 1390.83s |  So, quick tip for batching and aliases
1390.83s - 1393.55s |  is to actually try to find gadget.
1393.55s - 1396.91s |  What I call gadget, if it's the right definition,
1396.91s - 1399.57s |  but what I call gadget for this specific vulnerability
1399.57s - 1403.81s |  is to find a query in the structure of your target
1403.81s - 1406.05s |  that takes already 200 milliseconds
1406.05s - 1408.13s |  up to 500 milliseconds.
1408.13s - 1412.17s |  Sometimes more when you don't optimize anything, I guess.
1413.49s - 1417.73s |  And use this specific query in every batching request
1417.73s - 1420.17s |  that you do or in every aliases.
1420.17s - 1423.05s |  And this will allow you to send a lot of requests
1423.05s - 1426.65s |  to maybe the disk operation that it does, the memory,
1427.05s - 1429.85s |  it really depends on how the backend implemented it.
1430.81s - 1433.59s |  But this could take you a batching
1433.59s - 1435.49s |  that takes five seconds per request
1435.49s - 1437.79s |  up to five minutes per request.
1437.79s - 1442.73s |  So, this is a good way to multiply and amplify your DOS.
1444.53s - 1448.17s |  And there is this one, the GraphQL directives.
1448.17s - 1450.13s |  So, what's a directive?
1450.13s - 1454.35s |  It's a way for GraphQL to decorate a part of the schema
1454.35s - 1457.63s |  and actually to do an operation on top of it
1457.63s - 1459.41s |  or additional configuration.
1460.39s - 1461.75s |  And there is a technique called
1461.75s - 1464.59s |  GraphQL directive overloading,
1464.59s - 1467.27s |  where basically you can just make that payload,
1467.27s - 1470.95s |  repeat the at a as many times as you like,
1470.95s - 1475.71s |  and it will totally crush the server somehow.
1475.71s - 1479.63s |  But we had a cool story on the Google console
1480.83s - 1482.39s |  with evolving that.
1482.39s - 1486.63s |  So, let's imagine that a directive could be used
1486.63s - 1488.67s |  for, again, our type user,
1488.67s - 1490.87s |  and you can query every user
1490.87s - 1494.43s |  with a auth role admin or auth role user.
1494.43s - 1498.95s |  So, that's the way that normally we could use a directive.
1499.83s - 1502.27s |  But then Google was using the directive
1502.27s - 1505.31s |  in a very, very strange way.
1505.31s - 1509.39s |  Basically, you add the query list operation, for instance,
1509.39s - 1512.47s |  and then you see that we have directive
1512.47s - 1515.55s |  at signature with bytes inside.
1515.55s - 1517.83s |  And what they were doing,
1517.83s - 1521.63s |  they were actually signing the body of the request
1521.63s - 1524.59s |  from within the GraphQL requests.
1525.51s - 1528.71s |  And every time that we wanted to modify any variables
1528.71s - 1532.31s |  or anything in the schema, we will get an error.
1532.31s - 1535.39s |  So, when we are trying to attack a backend,
1535.39s - 1538.51s |  we really want to modify the request in our proxy.
1538.95s - 1540.35s |  That was a huge bummer
1540.35s - 1543.67s |  because it means that everything was totally signed.
1543.67s - 1547.83s |  So, we tried to see if we could sign out our requests,
1547.83s - 1551.03s |  but the problem is that they were outcoding everything
1551.03s - 1552.03s |  in the JavaScript.
1552.03s - 1554.15s |  So, generating everything on the build
1554.15s - 1556.07s |  and putting this in the JavaScript.
1556.07s - 1557.87s |  And so, they actually told us
1557.87s - 1562.31s |  that they were using a secret that was a passphrase,
1562.31s - 1565.27s |  and it was also outcoded inside the code base,
1565.27s - 1568.23s |  so they awarded $1,000 for that.
1568.95s - 1572.11s |  That was a fun one, but nothing related to DOS.
1572.11s - 1573.83s |  But there is something interesting.
1573.83s - 1576.95s |  How they can sign the body
1576.95s - 1579.79s |  and put the signature inside the body.
1579.79s - 1583.07s |  This means that there is something in the GraphQL
1583.07s - 1585.83s |  that is not being checked correctly, right?
1585.83s - 1588.15s |  That is not inside the signature.
1588.15s - 1591.39s |  And normally, it's just the signature itself.
1591.39s - 1593.15s |  So, this means that we can add
1593.15s - 1595.87s |  as many signatures as possible.
1595.87s - 1597.39s |  And every time that we had a signature,
1597.39s - 1599.23s |  they were running the check
1599.23s - 1601.67s |  of the entire body all over again.
1602.59s - 1607.23s |  So, we wrote a script where we will add 10 directive,
1607.23s - 1609.59s |  500, 1,000, up to a million,
1609.59s - 1613.27s |  and check the requests every time.
1613.27s - 1614.35s |  What happened?
1614.35s - 1618.95s |  The first 10 directive, 0.9 seconds to answer.
1618.95s - 1621.51s |  500 directive, one second.
1621.51s - 1624.31s |  We had 5,000 directive, 2.7.
1624.31s - 1626.75s |  10,000, 2.6, don't know what happened here.
1627.83s - 1632.83s |  50,000, 6.5, and then up to 1,109,000 seconds.
1633.19s - 1638.19s |  So, we had one minute 40 per request, which is huge.
1639.67s - 1641.91s |  This vulnerability was found with Rezo,
1641.91s - 1645.43s |  and Google actually gave us a 6K bounty for that.
1645.43s - 1650.43s |  And I think that compared to the presence in the wild,
1651.27s - 1654.55s |  the impact is really high for that kind of stuff.
1654.55s - 1659.39s |  And overall, for all the GraphQL DOS that we did in the,
1659.39s - 1660.35s |  oh, I'm sorry.
1660.35s - 1661.91s |  Also, pro-tips, pro-tip.
1661.91s - 1663.31s |  Yeah, this one is important.
1664.39s - 1667.03s |  GraphQL exposes WebSockets,
1667.03s - 1669.83s |  depending on the configuration and on the backend.
1669.83s - 1674.83s |  But this WebSocket server usually do not have any WAF
1675.11s - 1678.19s |  or any check, and people often forget that it exists.
1678.19s - 1679.95s |  So, if you have rate limiting in place
1679.95s - 1683.23s |  and that you want to exploit any GraphQL DOS,
1683.23s - 1684.95s |  you can just go to the WebSocket,
1684.95s - 1686.79s |  and there is no security anymore.
1686.79s - 1691.43s |  And if you like, actually, GraphQL hunting,
1691.43s - 1694.39s |  if you go to the WebSocket,
1694.39s - 1696.07s |  you can also have introspection
1696.07s - 1698.43s |  and other GraphQL configurations.
1698.43s - 1701.75s |  So, it might actually give you a lot more attack surface.
1701.75s - 1703.91s |  So, that's another GraphQL pro-tip.
1703.91s - 1706.87s |  And overall, with all the GraphQL denial of services,
1706.87s - 1710.39s |  we made a 70K bounty.
1710.39s - 1712.43s |  So, every time you see GraphQL,
1712.47s - 1717.46s |  just say to yourself, we can take it down.
1717.46s - 1719.90s |  Okay, I had to rush a little bit this presentation
1719.90s - 1722.90s |  because we were having this HTML problem.
1722.90s - 1725.06s |  So, let's go straight to the conclusion.
1725.06s - 1726.46s |  Let's talk about the timeline
1726.46s - 1730.14s |  of this entire denial of service research.
1730.14s - 1733.58s |  The first denial of service that we found with Snorlax
1733.58s - 1738.58s |  was in 2022, and the last one that we found was last week.
1738.94s - 1743.22s |  But the main focus of the entire research
1743.66s - 1745.90s |  was during eight months last year.
1745.90s - 1747.90s |  So, most of the bounties were made
1747.90s - 1749.34s |  in a span of eight months.
1750.90s - 1753.18s |  And so, how much bounty overall
1753.18s - 1757.30s |  we made with this entire research?
1757.30s - 1762.30s |  We made almost $150,000 in bounty,
1762.98s - 1765.10s |  which is a lot, I would say,
1765.10s - 1767.54s |  for a technique that is out of scope.
1769.10s - 1771.18s |  Something that is actually quite interesting
1771.22s - 1775.02s |  is that I think that this could be a main vulnerability
1775.02s - 1776.22s |  for a lot of bug hunters,
1776.22s - 1778.14s |  but I would say it's better to use it
1778.14s - 1781.10s |  like as a side golden goose.
1781.10s - 1784.70s |  So, for instance, if you like to find a lot of vulnerabilities
1784.70s - 1787.38s |  and then at one point you have no ideas anymore,
1787.38s - 1789.58s |  just look for a DOS, you'll find one,
1789.58s - 1791.98s |  send it, make a quick bug out of it.
1791.98s - 1794.14s |  I think it's a good way to do it.
1795.18s - 1798.14s |  Before finishing this presentation,
1798.14s - 1801.30s |  I needed to do a huge shout out to Idnama.
1801.30s - 1803.58s |  She's our graphical designer.
1803.58s - 1804.82s |  When I asked her,
1804.82s - 1807.62s |  hey, can you do this entire presentation for DEF CON?
1807.62s - 1810.54s |  She was like, what do you want me to do again?
1810.54s - 1813.46s |  2,000 memes, a lot of reference, a lot of things.
1813.46s - 1815.22s |  I think she did an amazing job.
1815.22s - 1817.42s |  So, huge shout out to her.
1818.50s - 1821.38s |  Thanks a lot, everyone, for attending this presentation.
1821.38s - 1822.86s |  I hope you liked it.
1822.86s - 1825.70s |  And if you have any question later,
1825.70s - 1827.66s |  I will be happy to answer them.


url: https://www.youtube.com/watch?v=RyuDq0cjap0
title: DEF CON 32 - Porn & Privacy - ET
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=RyuDq0cjap0",
  "title": "DEF CON 32 - Porn & Privacy - ET",
  "description": "As our social lives are highly intertwined with our online lives, people share a lot of information and create pictures and content that needs to be secured. In this talk I cover obscenity laws, revenge porn (nonconsensual distribution of intimate images), stalking, catfishing and sextortion and how people can prevent information being leaked as well as how to recover from it.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1269,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.46s | This text was transcribed using whisper model: large-v2

 Good morning, everyone. Welcome, DEF CON.
4.46s - 9.16s |  Thank you all for being here so early in the morning with me.
9.16s - 10.86s |  This talk is Porn and Privacy.
10.86s - 14.06s |  Hopefully, you're in the right room.
14.06s - 18.26s |  I do have to start because my time has already started,
18.26s - 21.26s |  and I have to be done by a certain time.
21.26s - 24.50s |  So I know some of you are still joining in,
24.50s - 30.60s |  and I have to get started.
30.60s - 33.40s |  Who am I? My name is Edna Johnson.
33.40s - 34.74s |  I also go by ET.
34.74s - 37.00s |  I use they, them pronouns.
37.00s - 39.00s |  I'm a cybersecurity professional
39.00s - 42.20s |  as well as a master's degree student.
42.20s - 46.06s |  I compete in OSINT CTF competitions,
46.06s - 50.04s |  and I advise my friends on digital safety.
50.04s - 53.40s |  I do want to give a content warning for this talk.
53.44s - 56.70s |  I'm going to be talking about subjects that may be triggering,
56.70s - 61.00s |  and if you do have any triggers regarding these issues,
61.00s - 63.04s |  I will happily share this information
63.04s - 64.80s |  with you at a later time.
64.80s - 66.86s |  But I'm going to be talking about nonconsensual
66.86s - 70.16s |  intimate image abuse or revenge porn,
70.16s - 75.45s |  deep fakes, and sextortion.
75.45s - 77.05s |  And I want to give a disclaimer
77.05s - 79.13s |  that as a cybersecurity professional,
79.13s - 82.15s |  I am here sharing my technical knowledge
82.15s - 83.93s |  to make your digital life safer,
83.93s - 85.19s |  and it is important to note
85.19s - 87.53s |  that I'm not a mental health professional.
87.53s - 89.59s |  While I'm here to provide guidance
89.59s - 92.47s |  on matters that affect your personal lives,
92.47s - 95.27s |  I am not equipped to offer mental health assistance.
95.27s - 98.73s |  So if needed, I do encourage you to seek help
98.73s - 103.47s |  from an appropriately trained mental health profession.
103.47s - 105.73s |  Our roadmap today is I'm going to be going over
105.73s - 109.69s |  some obscenity laws that are being passed in states.
109.69s - 113.15s |  I'm going to cover NCIIA,
113.15s - 117.03s |  nonconsensual intimate image abuse or revenge porn.
117.03s - 120.49s |  We're going to go over some deep fake,
120.49s - 123.09s |  and then we're going to go over how to minimize the risk
123.09s - 125.39s |  of images being abused online.
125.39s - 127.73s |  And if they have been abused,
127.73s - 135.70s |  how to recover from those images when they've been leaked.
135.70s - 138.90s |  So the first thing is the obscenity laws.
138.94s - 144.14s |  States all have been passing laws
144.14s - 150.34s |  where they're requiring you to upload your government ID
150.34s - 152.40s |  to be able to access adult content
152.40s - 154.84s |  or pornographic material.
154.84s - 161.26s |  And so Pornhub, for example, has been blocking states
161.26s - 165.14s |  from being able to access their website
165.14s - 168.54s |  because of these laws, because of the privacy implications
168.54s - 170.08s |  that it contains.
170.08s - 174.98s |  So if you're coming from any of these eight states currently,
174.98s - 180.04s |  that is Utah, North Carolina, Texas, and others,
180.04s - 181.90s |  you'll get a message from Pornhub showing you
181.90s - 186.90s |  that says basically, dear user,
186.90s - 189.74s |  if you're visiting from these states,
189.74s - 193.58s |  your government officials have this requirement
193.58s - 195.38s |  to show your ID.
195.38s - 202.24s |  And that is tying your porn habits to your actual identity.
202.24s - 207.64s |  And thank you.
207.64s - 210.52s |  So that is a privacy concern.
210.52s - 214.92s |  Okay. Yeah, that works.
214.92s - 216.12s |  Okay, thank you.
216.12s - 218.78s |  Sorry about that.
218.78s - 223.78s |  All right, so these eight states have already passed these laws,
223.82s - 225.68s |  and they're in effect currently.
225.68s - 229.98s |  And so when people are accessing porn from these sites,
229.98s - 232.18s |  they're either needing to use a VPN
232.18s - 240.19s |  to access porn providers that are blocking the site
240.19s - 245.79s |  or they have providers that aren't as,
245.79s - 247.39s |  you know, compliant with laws.
247.39s - 251.55s |  And so those might be a little more sketchy websites.
251.55s - 253.43s |  More states are currently passing these laws,
253.43s - 258.63s |  such as Florida just had this law go in effect on July 1st.
258.63s - 260.67s |  And these laws are typically packaged
260.67s - 264.79s |  with some kind of a child protection,
264.79s - 267.79s |  internet protection bill.
267.79s - 272.37s |  So, for example, in Florida, they have now provided a law
272.37s - 277.29s |  that gives a minimum age for kids to use social media.
277.29s - 289.86s |  And so they tied that in with this adult material block.
289.86s - 292.32s |  Thank you.
292.32s - 294.20s |  So I'm going to go over some basics
294.20s - 296.32s |  regarding interdigital privacy.
296.32s - 299.10s |  And a lot of you, most of you probably already know this,
299.10s - 300.26s |  but I want to make sure we all have
300.26s - 302.72s |  the same fundamental knowledge.
302.72s - 305.60s |  So digital privacy refers to the protection
305.60s - 309.36s |  of private citizens' online information.
309.36s - 312.96s |  So that can be companies collecting information on users,
312.96s - 314.46s |  visiting websites,
314.46s - 319.60s |  or it can be you're sharing information on social media.
319.60s - 321.00s |  All of our activities online
321.00s - 322.76s |  are going to leave a digital footprint,
322.76s - 327.40s |  and that information can be used to help identify us.
327.40s - 331.16s |  Personal Identifiable Information, PII,
331.16s - 335.12s |  is information connected to a specific individual
335.12s - 338.16s |  that can be used to uncover their individual identity,
338.16s - 340.30s |  such as social security number,
340.30s - 345.40s |  full name, email address, and phone number.
345.40s - 348.50s |  Make sure you're using strong account security basics.
348.50s - 351.76s |  So the basics are necessary.
351.76s - 355.30s |  And first, make sure you have strong passwords
355.30s - 360.00s |  so you can accomplish that by using passphrases,
360.00s - 365.62s |  using at least 10 or more characters in your password.
365.66s - 368.86s |  Use multiple character types, such as numbers,
368.86s - 372.22s |  special characters, upper and lowercase letters.
372.22s - 374.42s |  And then use a password manager
374.42s - 376.52s |  to manage all of those passwords,
376.52s - 379.06s |  and examples include bit warning,
379.06s - 382.66s |  key pass, and one password.
382.66s - 386.16s |  Additionally, I recommend using a two-factor authentication
386.16s - 389.02s |  or a multi-factor application,
389.02s - 392.66s |  and those could be SMS or text messages,
392.66s - 395.46s |  applications such as Google Authenticator,
395.46s - 398.66s |  Microsoft Authenticator, Duo, and more.
398.66s - 404.02s |  Or you can use a hardware token such as YubiKey
404.02s - 405.42s |  for your security hygiene.
405.42s - 410.94s |  So if you're creating accounts on adult websites,
410.94s - 412.98s |  try to limit the personal information
412.98s - 417.48s |  and keep personal information off of those spicy websites.
417.48s - 419.34s |  Limit the information that you share
419.34s - 421.82s |  that could be used to identify you,
421.82s - 425.44s |  and I recommend using separate email addresses for activities
425.50s - 429.20s |  so you could have an email account
429.20s - 430.94s |  for your personal accounts.
430.94s - 434.64s |  So if you're emailing your dad and things like that,
434.64s - 437.00s |  a different email address for your banking,
437.00s - 441.34s |  and then an email account for your spicy websites,
441.34s - 443.70s |  your adult content websites.
443.70s - 446.70s |  That way, if any of those are compromised,
446.70s - 455.74s |  you're limiting the scope of damage that can happen.
455.78s - 458.60s |  OSINT or open-source intelligence,
458.60s - 462.34s |  that is the searching for and analyzing information
462.34s - 463.64s |  that is publicly available
463.64s - 467.30s |  and meant to produce actionable intelligence,
467.30s - 470.10s |  and that can be found using public records,
470.10s - 475.14s |  images or videos online by finding it on websites
475.14s - 479.14s |  or social media platforms or more.
479.14s - 484.98s |  All right, nonconsensual intimate image abuse, NCIIA.
484.98s - 487.72s |  Also known as revenge porn.
487.72s - 490.02s |  So nonconsensual intimate image abuse
490.02s - 494.92s |  is the distribution of sexually graphic images
494.92s - 498.08s |  of individuals without their consent.
498.08s - 503.42s |  This includes images originally obtained without consent
503.42s - 506.68s |  as well as images originally obtained with consent,
506.68s - 510.38s |  and this is usually in the context of a private
510.38s - 512.48s |  or a confidential relationship.
515.44s - 517.44s |  When you've been compromised
517.44s - 520.44s |  or your images have been leaked online,
520.44s - 523.18s |  you might feel like something is off.
523.18s - 527.42s |  You could have an influx of friend requests on Facebook
527.42s - 530.28s |  or lots of new followers on Twitter
530.28s - 535.22s |  or your inboxes are overflowing all of a sudden.
535.22s - 539.08s |  So when you are finding yourself in that situation,
539.08s - 542.92s |  the first step is to do OSINT on yourself.
542.92s - 546.26s |  You may want to find a friend to help you with this
546.26s - 551.36s |  because it could be an emotional experience to go through.
551.36s - 553.32s |  When you do find information,
553.32s - 556.56s |  you want to make sure to do online hygiene
556.56s - 560.62s |  and do checkups to make sure that you don't have information
560.62s - 564.46s |  that could make things worse.
564.46s - 568.96s |  So you want to limit the information shared online,
568.96s - 570.86s |  and you got to know what's out there
570.86s - 577.27s |  before you can start to clean it up.
577.27s - 580.91s |  Some of you may know of Caitlin Bowden.
580.91s - 586.85s |  Caitlin had her images leaked online,
586.85s - 591.67s |  and those images were from...
591.67s - 594.05s |  She had been in a relationship,
594.05s - 597.41s |  and the images were on her ex's phone,
597.41s - 599.97s |  and it wasn't her ex that shared them out.
600.03s - 602.27s |  It was...
602.27s - 604.27s |  The phone got stolen,
604.27s - 609.61s |  and the phone did not have any passcode on it.
609.61s - 612.51s |  So some stranger shared out her images,
612.51s - 615.97s |  and she wanted me to let you know that offline access
615.97s - 619.47s |  is only as secure as the device it is on
619.47s - 622.17s |  and that these are very special pictures,
622.17s - 625.13s |  and so conversations matter.
625.13s - 627.41s |  So make sure you have conversations with the people
627.41s - 632.08s |  that you're sharing ahead of time.
632.14s - 634.48s |  So when you're sharing your intimate images,
634.48s - 637.94s |  have those conversations with your partner
637.94s - 642.02s |  or your spicy friend about the expectations of those images,
642.02s - 644.44s |  where they can store those images,
644.44s - 650.64s |  such as on the phone or computer, any other place,
650.64s - 652.52s |  even on the cloud.
652.52s - 657.44s |  Are they able to show those pictures to other people?
657.44s - 661.32s |  Is it something that they can send to anyone else,
661.32s - 665.06s |  and do you expect them to be deleted at any certain point,
665.06s - 666.98s |  such as when you break up,
666.98s - 673.22s |  so that they are no longer in your possession?
673.22s - 674.52s |  When you're sharing images,
674.52s - 677.66s |  you want to make sure that you're watermarking them,
677.66s - 683.12s |  and that is to put a word across the image,
683.12s - 686.66s |  and you can do that both by putting the location
686.66s - 688.32s |  where those images were shared,
688.32s - 691.32s |  such as OnlyFans or Discord.
691.36s - 695.26s |  You can also put their name or handle,
695.26s - 697.96s |  such as TooHotToHandle or Dave,
697.96s - 701.92s |  and you can hide those watermarks within the image
701.92s - 705.92s |  in dark spots, like in shadows, and make them small
705.92s - 707.92s |  so that they're not really visible,
707.92s - 710.22s |  but then if they are leaked later on,
710.22s - 713.46s |  you're able to find out who was the source of the leak
713.46s - 717.02s |  or what was the source of that leak.
717.02s - 719.92s |  A lot of platforms already remove EXIF data,
719.92s - 723.72s |  but it is a good idea to remove EXIF data from your images
723.72s - 728.02s |  so that they don't contain, for example, your geolocation,
728.02s - 732.16s |  and you can create an inventory of a list of images
732.16s - 738.32s |  that you do share out so that you can easily reference
738.32s - 740.78s |  where those images were shared from
740.78s - 742.38s |  and who they were shared to.
742.38s - 751.88s |  So when you do have an incident with images being shared out,
751.88s - 757.68s |  there is a website called StopNCII.org,
757.68s - 761.88s |  and with the images that have been leaked,
761.88s - 765.08s |  you can upload and create a case on that website,
765.08s - 768.74s |  and they will go through all the major platforms,
768.74s - 773.94s |  such as Facebook, Instagram, Pornhub, OnlyFans,
773.94s - 782.65s |  and they will help you to remove the images from those platforms.
782.65s - 786.15s |  You're also able to remove those images from Google searches.
786.15s - 790.65s |  So a lot of times when images have been released,
790.65s - 793.25s |  they will contain your personal information.
793.25s - 799.45s |  It gets added to the images,
799.55s - 803.55s |  and they'll include whatever personal information they have about you,
803.55s - 808.35s |  and so you can request Google to remove from the Google search results.
808.35s - 810.35s |  So if you're searching your name,
810.35s - 815.95s |  your images that are your personal, explicit, intimate images
815.95s - 821.80s |  are removed from the Google search results.
821.80s - 825.80s |  Another process that you can do is a DMCA request.
825.80s - 831.20s |  This is using copyright law to have images that belong to you
831.20s - 833.50s |  removed from websites.
833.50s - 837.40s |  The DMCA.com website does have a section
837.40s - 840.90s |  that helps you go through the steps
840.90s - 845.10s |  of removing revenge porn from the web,
845.10s - 850.06s |  and you can find that on their website.
850.06s - 851.76s |  All right, so AI.
851.76s - 857.86s |  So recently, AI has been exploding in popularity,
857.86s - 865.96s |  and they're being created tools to abuse images,
865.96s - 871.06s |  and so AI is going to be used to change the world
871.06s - 874.16s |  as a tool to make the world better, right?
874.16s - 877.86s |  As a tool to make the world better, right?
877.86s - 883.06s |  So there's been a lot of new apps
883.06s - 887.56s |  that are mostly targeting young men,
887.56s - 895.06s |  where you can change images to either put somebody into a bikini
895.06s - 897.26s |  or remove all of their clothing
897.26s - 902.06s |  or put somebody's face onto other images,
902.06s - 905.56s |  and these are being advertised on Instagram.
905.56s - 910.76s |  They're not in some dark corner, dark web marketplace.
910.76s - 914.26s |  They're out there,
914.26s - 917.96s |  and so new laws are needed to be passed.
917.96s - 920.36s |  There's states that have passed laws against this,
920.36s - 927.60s |  but more comprehensive laws are needed.
927.60s - 929.60s |  Five minutes? Okay.
929.60s - 933.10s |  All right, so tips for using OnlyFans.
933.10s - 936.80s |  When you create an account, set up a monthly charge.
936.80s - 938.20s |  Use a fake name.
938.20s - 941.00s |  Do not use your real name.
941.00s - 944.40s |  Create new social media accounts for advertising it.
944.40s - 946.80s |  Don't tie it to your existing accounts,
946.80s - 952.00s |  and fake publicly available location.
952.00s - 956.20s |  To lower the risk of foreign, regionally block your state.
956.20s - 958.90s |  So if you're from Florida, block Florida.
958.90s - 960.80s |  That way you don't have people from high school
960.80s - 963.40s |  finding your OnlyFans account.
963.40s - 966.30s |  Make sure to watermark your photos.
966.30s - 968.90s |  OnlyFans does have an easy block feature
968.90s - 971.10s |  that allows you to delete their content
971.10s - 974.90s |  after they've been downloaded,
974.90s - 978.10s |  and if there is a leak, OnlyFans actually owns the content
978.10s - 980.10s |  that you publish on their website,
980.10s - 985.90s |  so they will send their lawyers to do the DMCA notices for you.
985.90s - 988.90s |  Make sure that you enable two-factor authentication.
988.90s - 991.40s |  There's a huge problem with accounts
991.40s - 994.90s |  that have been taken over on OnlyFans
994.90s - 998.10s |  where they set up two-factor for you,
998.10s - 1002.30s |  but they do have a support for getting control of it.
1002.30s - 1006.40s |  You have to contact OnlyFans to be able to get your account back
1006.40s - 1011.60s |  after it's been taken over by somebody else.
1011.60s - 1013.90s |  Catfishing tips.
1013.90s - 1016.20s |  So if you think you've been catfished,
1016.20s - 1021.00s |  use reverse image search to look up the pictures.
1021.00s - 1023.70s |  You may find that there's loads of other accounts
1023.70s - 1026.20s |  with many different names.
1026.20s - 1029.00s |  You can use Canary tokens or Grabify
1029.00s - 1032.00s |  to find out what their IP address is.
1032.00s - 1035.30s |  Try to verify the identity early on.
1035.30s - 1039.00s |  You can do that by doing a video call
1039.00s - 1041.00s |  or getting them to take a photo
1041.00s - 1045.40s |  with a specific sign or symbol that you request,
1045.40s - 1048.30s |  and make sure to take things slow in an online relationship
1048.30s - 1052.40s |  and don't send money to somebody you've never met.
1052.40s - 1054.90s |  Sextortion is a form of blackmail
1054.90s - 1058.50s |  where someone threatens to share a nude or sexual image
1058.50s - 1061.70s |  or video of you unless you give in to their demands.
1061.70s - 1065.40s |  It is illegal in most states, and if you pay a scammer once,
1065.40s - 1071.10s |  they will never leave you alone.
1071.10s - 1075.40s |  If you are being sextorted, do not give in to their demands
1075.40s - 1078.50s |  and all contact with the extorter immediately.
1078.50s - 1081.90s |  Turn off your social media accounts and LinkedIn accounts
1081.90s - 1085.60s |  and serve the blackmailer with a cease and desist notice,
1085.60s - 1091.50s |  and make sure to file a police report against the extorter.
1091.60s - 1095.10s |  Currently, states that have NCIA laws
1095.10s - 1099.60s |  are almost all of the states except for two.
1099.60s - 1103.60s |  States that have laws against extortion
1103.60s - 1107.50s |  is about half of the states in the United States currently,
1107.50s - 1112.40s |  and deepfake laws are in some of the states,
1112.40s - 1115.50s |  but it definitely needs to be improved on.
1115.50s - 1120.70s |  There is a new law going through Congress right now
1120.70s - 1125.80s |  regarding deepfakes, and we'll see how that goes through.
1125.80s - 1129.30s |  It's, yeah.
1129.30s - 1132.30s |  Okay, so resources.
1132.30s - 1136.00s |  There is an organization called Operation Safescape.
1136.00s - 1138.10s |  They are a great organization
1138.10s - 1142.10s |  with support from cybersecurity professionals.
1142.10s - 1144.30s |  If you have an interest in helping out
1144.30s - 1146.60s |  with people in these situations
1146.60s - 1149.90s |  and also with stalking and domestic violence,
1149.90s - 1153.10s |  this is a great organization
1153.10s - 1157.90s |  that does need help from cybersecurity professionals,
1157.90s - 1162.50s |  so they are accepting volunteers.
1162.50s - 1165.70s |  If you or somebody you know is needing assistance
1165.70s - 1168.90s |  with any of the kinds of issues that I mentioned,
1168.90s - 1171.60s |  lockdown your life,
1171.60s - 1177.60s |  she has quick, easy learning bits that you can sign up for
1177.60s - 1180.10s |  and also has consultations,
1180.10s - 1183.50s |  and then there's a platform called Operation Privacy,
1183.50s - 1188.00s |  and it's a free platform,
1188.00s - 1191.50s |  and it has basically like checklists that you go through
1191.50s - 1198.80s |  to improve your online privacy.
1198.80s - 1203.30s |  I do want to remind you that this is tough to go through,
1203.30s - 1208.00s |  so if you are experiencing any kinds of these situations,
1208.00s - 1210.20s |  there's a phone number 988
1210.20s - 1213.50s |  as well as the website 988lifeline.org
1213.50s - 1216.60s |  that does provide assistance
1216.60s - 1219.10s |  if you're needing to talk to somebody,
1219.10s - 1221.30s |  and I definitely recommend
1221.30s - 1226.00s |  if you are experiencing any of the situations
1226.00s - 1228.00s |  that I've talked about to talk with someone,
1228.00s - 1231.40s |  whether that's a friend, family member, or a therapist.
1231.50s - 1234.70s |  You don't have to keep it to yourself.
1234.70s - 1237.30s |  I want to give a huge shout-out to Caitlin Bowden.
1237.30s - 1242.40s |  She has done so much great work for this,
1242.40s - 1246.40s |  for Orange Porn, and I really look up to her,
1246.40s - 1251.60s |  and I appreciate her help in preparing this presentation.
1251.60s - 1253.50s |  My name is Edna Johnson.
1253.50s - 1257.30s |  You can email me at edna at edna.tech.
1257.30s - 1261.00s |  You can find me on Twitter and BlueSky at Edna's.
1261.00s - 1262.90s |  Thank you all so much for being here today.
1262.90s - 1264.60s |  I appreciate you.


url: https://www.youtube.com/watch?v=TqLRpUmpBWY
title: DEF CON 32 - Open Source Hacker V. Government Lawyer - Rebecca Lively, Eddie Zaneski
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=TqLRpUmpBWY",
  "title": "DEF CON 32 - Open Source Hacker V.  Government Lawyer - Rebecca Lively, Eddie Zaneski",
  "description": "Join a recovering government attorney and an open-source hacker for a fiery debate that dives into the world of DoD cybersecurity inefficiencies. Rebecca, a former DoD lawyer, pairs her intricate understanding of perplexing government policies with Eddie\u2019s fresh, critical (and dare we say naive?) insights from the private sector. This session will explore the frustrating \u201chow\u201d behind the government\u2019s \u201cwhy,\u201d from slow booting government laptops to the realities of \u201cmilitary-grade technology.\u201d Together, they will challenge the status quo, proposing innovative, open-source inspired solutions to streamline and secure DoD operations. Expect a dynamic exchange filled with real-world frustrations, enlightening explanations, and a hacker\u2019s touch on how to fix what\u2019s broken.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2087,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.12s | This text was transcribed using whisper model: large-v2

 Thank you for joining us for Open Source Hacker vs. Government Lawyer, Clashing Views on Fixing
5.12s - 6.88s |  Tech and the DoD.
6.88s - 9.84s |  My name is Eddie, and I am an open source hacker.
9.84s - 18.42s |  And I'm Rebecca Lively, I'm a government attorney.
18.42s - 25.38s |  We met at the Bravo 11 collaborative software development event.
25.38s - 30.10s |  I'm told that that's actually Bravo 3, which is some sort of weird hacker code.
30.10s - 31.10s |  It's binary.
31.10s - 32.10s |  Oh.
32.10s - 33.10s |  Binary.
33.10s - 34.10s |  Okay.
34.10s - 42.26s |  So, anyway, we met at this science fair, where a bunch of software developers got together,
42.26s - 48.14s |  and the dude running it, he had some sort of compromising material, I think, on the
48.14s - 54.90s |  general counsel, because he was able to convince all of these completely unclear, random civilians.
54.90s - 57.98s |  He was able to convince his general counsel that it was fine to bring them onto a military
57.98s - 63.20s |  base and give them access to some of the most sensitive government data.
63.20s - 66.50s |  And so, that's where I met this random civilian.
66.50s - 68.82s |  It was a hackathon, Rebecca.
68.82s - 71.42s |  And I think Stuart's here somewhere.
71.42s - 72.90s |  Hey!
72.90s - 76.26s |  So, that's awkward.
76.26s - 81.10s |  But anyway, so we were at this collaborative software development event, and we basically,
81.10s - 86.84s |  because there were these random, uncleared, unvetted people, we had to have a special
86.84s - 89.88s |  environment set up so that they couldn't screw anything up.
89.88s - 92.08s |  But good news, we had, like, literally everything y'all needed.
92.08s - 93.08s |  So, you showed up.
93.08s - 94.08s |  Yeah.
94.08s - 95.08s |  About that.
95.08s - 98.80s |  It was my first time on a military base, and I had no idea what to expect.
98.80s - 102.52s |  I showed up with my laptop, and they told me I couldn't bring it in.
102.52s - 103.72s |  Of course you could not bring that in.
103.72s - 105.84s |  Like, why did you think that you could bring that in?
105.84s - 111.36s |  Well, I said, okay, let me just get my little USB YubiKey out so I can log into GitHub.
111.36s - 113.56s |  We do not do USBs in the Department of Defense.
113.56s - 114.56s |  That is not a thing.
114.56s - 116.72s |  And also, GitHub, is that where the open source software is stored?
116.72s - 117.72s |  Yep.
117.72s - 118.72s |  Okay.
118.72s - 119.72s |  Yeah.
119.72s - 120.72s |  That's also not going to be a thing.
120.72s - 121.72s |  Well, there was no internet, so it actually didn't matter.
121.72s - 122.72s |  Correct.
122.72s - 125.40s |  There was no internet, because you were there to exfiltrate, I mean, you could have been
125.40s - 128.40s |  there to exfiltrate data, and there would have been no way of knowing that.
128.40s - 129.40s |  Yep.
129.40s - 130.40s |  Well, you built this environment.
130.40s - 132.32s |  It was a great environment.
132.32s - 135.88s |  It had literally all of the tools that developers need to do their jobs.
135.88s - 141.00s |  They had VS Code installed without any of the language plugins.
141.00s - 143.64s |  And to be clear, I'm not sure why you would need language plugins.
143.64s - 146.08s |  This is America, and we speak English.
147.08s - 151.68s |  What wound up happening was we kind of went out to the car and tethered from our phones
151.68s - 154.40s |  to get anything done at all.
154.40s - 158.16s |  I don't know if you know, that is both probably illegal, definitely unethical, and a very
158.16s - 159.16s |  bad security practice.
159.16s - 162.20s |  Well, you shouldn't have brought us there if you didn't want us to get things done.
162.20s - 164.64s |  I didn't actually care if you got anything done.
164.64s - 167.28s |  Well, it was a good time.
167.28s - 168.48s |  Anyway, time out.
168.48s - 171.40s |  We don't actually hate each other, if you couldn't tell.
171.40s - 173.56s |  I mean, we do now.
173.56s - 179.88s |  Well, Rebecca is dressed stereotypically like chat GPT thinks all women lawyers look like.
179.88s - 180.88s |  I was, anyway.
180.88s - 182.60s |  I was seconds ago.
182.60s - 186.96s |  But Stuart and his team did a great job when they put on the Bravo 3 Hackathon, so shout
186.96s - 187.96s |  out to them.
187.96s - 190.16s |  If you ever get a chance to check out the Bravo Hackathons, they're rad.
190.16s - 194.48s |  They invite civilians and U.S. citizens to come work with controlled and classified data.
194.48s - 195.48s |  Really cool time.
195.48s - 196.48s |  So they're open to the U.S. public.
196.48s - 197.48s |  So...
197.48s - 198.48s |  Go ahead.
198.48s - 202.64s |  One more thing about the Bravo Hackathon, it is literally the basis for this entire
202.72s - 205.16s |  talk, because that is actually where we met.
205.16s - 208.96s |  And he was actually having no prior government experience, and he kept asking me questions
208.96s - 212.08s |  like why the fuck are we doing this, Rebecca?
212.08s - 216.16s |  And I would provide the most reasonable explanation that I could imagine based on 13 years of
216.16s - 217.16s |  Stockholm Syndrome.
217.16s - 218.16s |  Yeah.
218.16s - 220.40s |  So, rewinding real quick.
220.40s - 221.40s |  I'm Eddie Zaneski.
221.40s - 225.96s |  I'm an open source staff engineer at a company called Defense Unicorns.
225.96s - 229.36s |  I'm a maintainer for the Kubernetes project, which is what I spend most of my time working
229.36s - 230.36s |  on.
230.36s - 231.36s |  And I don't go here.
231.36s - 232.92s |  I'm not a security person at all.
232.92s - 234.40s |  I'm just an open source maintainer.
234.40s - 237.40s |  And I definitely am very new to the government and the policy world.
237.40s - 241.56s |  So I'm about eight months into that world.
241.56s - 242.56s |  And I'm Rebecca.
242.56s - 244.56s |  I was actually a government attorney.
244.56s - 245.56s |  I am still...
245.56s - 248.56s |  Every time I tell people I'm not an attorney anymore, they think I got disbarred, and that
248.56s - 250.20s |  did not happen.
250.20s - 253.72s |  But I did stop practicing law about four years ago.
253.72s - 258.16s |  And I went to, for three years, the coolest squadron in the entire Air Force.
258.16s - 261.56s |  The 90th Cyber Ops Squadron.
261.60s - 264.04s |  And built malware.
264.04s - 266.04s |  Which was really freaking cool.
266.04s - 267.40s |  And then I escaped there, too.
267.40s - 269.66s |  Because apparently all good things must end.
269.66s - 272.32s |  And I also joined the same company that Eddie's at, which is Defense Unicorns.
272.32s - 273.32s |  Yeah.
273.32s - 274.32s |  So we mentioned Defense Unicorns.
274.32s - 275.50s |  We don't want to shill or plug too much.
275.50s - 277.72s |  But we build open source software for the US military.
277.72s - 278.72s |  It's kind of rad.
278.72s - 283.16s |  And their goal is to kind of get people like me out of industry and private sector to come
283.16s - 284.52s |  work on stuff for the public.
284.52s - 286.08s |  So check out what they're doing.
286.08s - 287.96s |  They're pretty cool.
287.96s - 290.68s |  We want to quickly define that when we talk about the term hacker here, we're talking
290.68s - 292.00s |  about the traditional sense of the word.
292.00s - 294.44s |  Again, I'm not a security person.
294.44s - 297.20s |  Building cool shit, subverting the rules, doing that type of stuff.
297.20s - 299.72s |  So that's our definition here.
299.72s - 304.08s |  And so basically we organized this talk around, like, six questions that Eddie asked me over
304.08s - 305.80s |  the last three months.
305.80s - 309.08s |  All of which, at the moment, I was like, what do you mean you don't understand why that
309.08s - 310.52s |  would happen?
310.52s - 313.32s |  And actually spurred, like, really great conversations.
313.32s - 318.24s |  But what we kind of realized is that the root of all of it is just competing priorities
318.24s - 320.52s |  within, like, the hacker community and the government community.
320.52s - 323.72s |  So we're going to start with what those competing priorities are.
323.72s - 327.88s |  In the government, and I put at the bottom, both because I'm a recovering attorney and
327.88s - 330.56s |  because I thought it was funny, terms and conditions apply.
330.56s - 335.28s |  The government, it turns out, is not a monolith that acts completely deliberately and with
335.28s - 338.00s |  one singular direction and intention.
338.00s - 343.48s |  And so how exactly these various things are rated in terms of importance to any given
343.48s - 345.48s |  piece of the federal government depends.
345.48s - 347.76s |  But we've got compliance.
347.76s - 352.94s |  So that is, like, the checking the box and validating that you meet all of the various
352.94s - 356.72s |  requirements from all of the various different parts of government and law.
356.72s - 357.72s |  There's scale.
357.72s - 361.48s |  So literally every time I had a great idea when I worked in the government, no matter
361.48s - 364.40s |  how, like, hey, I just want to try this and see if it works, like, can we just string
364.40s - 366.96s |  a couple of raspberry pies together and try this thing?
366.96s - 370.44s |  The first question I would almost always get from my leadership was, okay, but do you think
370.44s - 375.28s |  that would scale across the entire Department of the Air Force?
375.28s - 380.24s |  And I'm, like, really, like, I just I want $32 to know whether or not this would work.
380.24s - 381.92s |  Like, can I do that?
381.92s - 386.44s |  And often, like, entire projects would be killed because I couldn't articulate a couldn't
386.44s - 390.14s |  quickly articulate an easy idea of how this would scale or whether it would make sense
390.14s - 391.14s |  for it to scale.
391.14s - 392.14s |  And that wasn't just tech.
392.14s - 393.14s |  That was also policy.
393.14s - 396.20s |  So I was, like, hey, it would be cool if for these 16 people we could try this special
396.20s - 397.84s |  authority that actually already exists.
397.84s - 401.44s |  They'd be, like, ah, it would be really unfair to the other people.
401.44s - 403.20s |  So scale is a big thing.
403.20s - 407.56s |  Documentation, the ability to prove to each echelon of authority that you have done all
407.56s - 410.80s |  of the things that you're supposed to do is often, to be completely honest, more important
410.80s - 416.48s |  than anything else to the bureaucratic assholes in the government, of which they are not all.
416.48s - 421.08s |  Fairness, that's within the acquisition process, but then in general, like, making sure and
421.08s - 424.88s |  a lot of that comes from, look, I don't want to be a country where, like, if I as a contractor
424.88s - 427.44s |  install a pool in your backyard, I'm going to get the next contract.
427.44s - 430.80s |  Like, that is not how I want our country to operate as a taxpayer.
430.80s - 436.36s |  So there's a lot that's baked into avoiding, like, graft and, like, bad things and crime
436.36s - 437.36s |  and stuff.
437.36s - 438.36s |  And the last one is mission.
438.36s - 441.36s |  And I put it last because honestly a lot of times when I was in the government, it felt
441.36s - 442.76s |  like it was last.
442.76s - 446.36s |  It felt like it was the last thing in the level of importance.
446.36s - 451.52s |  But it is the most important thing to me and I think to a lot of the people in the government,
451.52s - 455.72s |  which is the other piece I'd love to touch on really quick, which is this idea of, like,
455.72s - 457.36s |  the stereotypical government employee.
457.36s - 460.44s |  So if you are not a government employee and you're in this room, you may have some idea
460.48s - 465.32s |  of, like, a suit wearing, like, kind of stodgy person who doesn't understand that 11 is actually
465.32s - 466.68s |  three and binary.
466.68s - 472.96s |  And, like, that is, in my experience, a really unhelpful stereotype for actually getting
472.96s - 473.96s |  things done.
473.96s - 474.96s |  The other part is the mission.
474.96s - 476.52s |  Like, national security.
476.52s - 478.04s |  That sounds boring.
478.04s - 479.04s |  Exactly.
479.04s - 480.60s |  Except for it's not.
480.60s - 483.04s |  Because I run my mouth, like, nonstop all the time.
483.04s - 485.52s |  I talk so much shit and I complain about the government.
485.52s - 487.16s |  And I haven't gotten shot yet.
487.16s - 488.68s |  And that is because of national security.
488.68s - 489.68s |  Because we have freedom of speech.
489.68s - 493.84s |  Because we have rights that, like, actually, it turns out, like, matter and we are willing
493.84s - 494.84s |  to defend.
494.84s - 496.84s |  So that's the government.
496.84s - 500.56s |  So the hacker side of this, obviously, as an engineer coming in to solve a problem,
500.56s - 504.16s |  a technical problem, the first thing I would care about is, is there technology out there
504.16s - 505.16s |  and does it work?
505.16s - 506.16s |  Right?
506.16s - 509.04s |  Is there something that someone built ahead of me that I can use, repurpose?
509.04s - 512.72s |  As an open source maintainer, obviously, I wish there to be an open source solution.
512.72s - 516.20s |  We all know the value of open source so I can audit the code myself, make changes, that
516.20s - 517.20s |  sort of stuff.
517.68s - 519.52s |  But I'm not a zealot when it comes to open source.
519.52s - 524.72s |  So if there is a good proprietary solution out there, I'm willing to pay for it to make
524.72s - 525.72s |  the job better.
525.72s - 529.16s |  Does it need to scale is a great question.
529.16s - 532.34s |  It's a lot of engineers when they're first going to build an architect systems, they're
532.34s - 537.08s |  worried about reaching Google scale of hundreds of thousands of requests per second, right?
537.08s - 541.24s |  I have a great friend who works for the U.S. forest department and he builds an app that
541.24s - 548.20s |  the firefighting pilots use to fight forest fires and dispatch planes and he's got three
548.20s - 553.08s |  users for his app and it is massively important to national health, right?
553.08s - 556.40s |  But it does not need to scale to a massive audience.
556.40s - 560.04s |  And then obviously I want to iterate quickly and over and over again, right?
560.04s - 563.92s |  I don't want to stick to a traditional waterfall model where I'm talking about requirements
563.92s - 565.80s |  and shipping stuff very slowly.
565.80s - 568.88s |  I want to throw shit at the wall and see if it's the right thing to solve the problem
568.88s - 572.04s |  and get feedback real quickly.
572.04s - 577.04s |  So basically as I listened to Eddie's naive questions and then answered them and realized
577.04s - 580.40s |  they were actually profound, we figured there were three main categories of questions that
580.40s - 583.92s |  he asked and so these are kind of how we organized our talk.
583.92s - 586.08s |  The first one is technical challenges in the government.
586.08s - 591.88s |  If you heard General Nakasone speak this morning, I was so delighted that he talked about buckshot
591.88s - 594.48s |  Yankee because I was like I have a slide for that.
594.48s - 596.80s |  So technical challenges in the government.
596.80s - 600.64s |  We're specifically talking about the actual technical challenges, like things that make
600.64s - 603.72s |  ‑‑ you said this better than me.
603.72s - 604.72s |  What are we talking about?
604.72s - 605.72s |  Yeah.
605.72s - 608.28s |  This is how the actual technology that we solve problems for.
608.28s - 613.28s |  So what goes into using and choosing that technology?
613.28s - 617.02s |  So one of the first things I noticed at this Bravo hackathon we went to was my partner
617.02s - 620.32s |  for the hackathon worked in a secure facility normally.
620.32s - 623.76s |  This was kind of his normal environment and he kept getting up and leaving and coming
623.76s - 626.12s |  back and he had this notebook with him.
626.12s - 629.20s |  Turns out what he was doing was he was going out to the parking lot, looking shit up on
629.20s - 634.20s |  Stack Overflow, copying code out of Stack Overflow into his notebook to bring back into
634.20s - 639.04s |  the secure room to type it into the editor to see if it worked or not and that was mind
639.04s - 643.08s |  blowing to me that this was ‑‑ sure, like we were making do with what we had, but
643.08s - 645.96s |  this was a normal thing for him to do.
645.96s - 648.92s |  Granted a lot of those facilities do have internet pipes and separate computers that
648.92s - 653.52s |  you can use, but from what he was telling me, this is his normal everyday thing and
653.52s - 654.52s |  that's mind blowing.
655.32s - 657.04s |  It's also super inefficient.
657.04s - 660.60s |  One of the questions I asked was actually, so I've worked in a lot of secure facilities
660.60s - 664.04s |  where they take all of the fun things that you have and make you do actual work because
664.04s - 666.56s |  you can't play Candy Crush on your phone anymore.
666.56s - 670.32s |  Good news, I don't work in that kind of facility anymore, but they'd never taken my
670.32s - 674.80s |  key fob before and so I was ‑‑ I kind of went down stereotype land and I was like
674.80s - 678.44s |  these people don't understand what it is they're actually screening for because my key
678.44s - 683.68s |  fob from the rental car company is not dangerous, it does not emit Bluetooth and I
683.72s - 687.12s |  almost told them that they were wrong and then I decided to shut my mouth because
687.12s - 691.00s |  usually when I feel that strongly it's actually me who's wrong and then I started
691.00s - 694.84s |  thinking like what could they be worried about and I realized a key fob comes from a
694.84s - 696.60s |  rental car company.
696.60s - 701.44s |  It is assigned to me based on random things like that you could probably Google too or
701.44s - 704.72s |  search me on LinkedIn and know what kind of things I'm there for or what kind of things
704.72s - 708.80s |  I might be there for and then at the end of my time I give it back and so if you let
708.80s - 713.36s |  that into a secure facility, you're potentially letting some sort of battery operated
713.36s - 716.72s |  device that's then going to be returned to somebody else into a facility, so like again
716.72s - 720.32s |  this is one of those examples of things that seem completely asinine that might actually
720.32s - 723.60s |  have legitimate reasons.
723.60s - 727.20s |  When I think of like the root cause of tech challenges in the government, the first one
727.20s - 734.36s |  is people, like we often lack true technical talent on the keyboard in the government.
734.36s - 738.00s |  When we're successful at recruiting them, we are not successful at retaining them, largely
738.00s - 742.32s |  because what happens is we promote them out of their technical competence areas.
742.32s - 743.32s |  People don't like that.
743.32s - 746.40s |  If you're really good at tech, it definitely doesn't mean that you want to lead a thousand
746.40s - 749.08s |  people and that like you'll also be good at that.
749.08s - 751.12s |  The next is law policy and inertia.
751.12s - 753.76s |  So law specifically, like there's all sorts of laws out there.
753.76s - 755.46s |  They're implemented by policy.
755.46s - 760.08s |  If you are at an organization at the bottom of the organizational chart, then you have
760.08s - 765.88s |  potentially like ten layers of policy between you and the law and it turns out usually most
765.88s - 768.56s |  of them get more restrictive, not less.
768.56s - 769.88s |  And then inertia is the last one.
769.88s - 775.32s |  So when I was in the legal office, I wanted to buy a fridge with government money for
775.32s - 776.60s |  $1,000.
776.60s - 778.24s |  I thought it was a reasonable purchase.
778.24s - 781.32s |  I looked up the rules and I determined that, yes, we could buy a fridge.
781.32s - 784.12s |  And so I went to the comptroller and I said, we would like to buy a fridge.
784.12s - 785.12s |  Can I have $1,000?
785.12s - 789.00s |  And he said, you cannot use government funds to buy kitchen appliances.
789.00s - 791.36s |  And I was like, can you help me understand like where you got that from?
791.36s - 795.88s |  And he pulled out a binder where he'd printed all of the regulations ten years previously
795.88s - 799.12s |  when he started his job and he had a thing highlighted in that binder.
799.12s - 802.24s |  And sure enough, ten years ago, you couldn't buy a fridge, but now you can.
802.24s - 806.08s |  So that is the inertia that an organization like the government can have.
806.08s - 808.08s |  And the last one is incentives.
808.08s - 812.08s |  There are a lot of leaders who say the right things and it feels really good to hear them.
812.08s - 815.76s |  They don't then also go and align the incentives to prioritize those things.
815.76s - 820.08s |  And so if all of the incentives are risk averse and you're saying, take risk, fail fast, but
820.08s - 825.96s |  also you might get fired if you fail, people aren't going to take risks and fail fast.
826.00s - 831.12s |  And so some of the things that I noticed coming into this world, anyone familiar with ATOs,
831.12s - 835.08s |  this concept of authority to operate, anytime you want to sell, build, or use software to
835.08s - 839.48s |  the U.S. government or inside the government, you have to do this ATO process.
839.48s - 844.00s |  It's basically a sense like hundreds of pages of NIST controls and how you implement them.
844.00s - 848.44s |  And there's an authorizing official who's responsible, and I mean responsible, for signing
848.44s - 849.44s |  off on that.
849.44s - 853.64s |  So what that means is that you have sometimes non-technical people that have to make a decision
853.64s - 857.28s |  about if the right technology is being proposed for a job.
857.28s - 862.12s |  And it kind of leads to this really painful process that some people don't want to take
862.12s - 866.94s |  on the risk because they don't understand the technology that's being proposed.
866.94s - 870.60s |  Another thing is there's lots of checkboxes all throughout the government that I've noticed.
870.60s - 873.52s |  A big one is software bill of materials or SBOMs.
873.52s - 878.24s |  FedRAMP requires that you provide an SBOM to the government if you're selling them software.
878.24s - 883.12s |  The reality is that you can provide them a blank SBOM.json file or a handwritten Microsoft
883.12s - 885.32s |  Word file, and it will check the box.
885.32s - 888.76s |  And it's not a problem, it's not like the fault of the serviceman who's responsible
888.76s - 889.76s |  for checking that box.
889.76s - 891.48s |  They're doing what they were trained to do.
891.48s - 895.48s |  It's just that that is a requirement, and that's kind of where the technical requirement
895.48s - 896.48s |  stops.
896.48s - 902.16s |  Legacy and proprietary software, you don't even know where to begin to unwind and upgrade
902.16s - 903.72s |  some of these systems.
903.72s - 905.72s |  That's how complicated it is.
905.72s - 908.90s |  And then I mentioned these NIST controls.
908.90s - 915.78s |  Hundreds and hundreds of pages of NIST controls that you don't want to have to write and think
915.78s - 919.86s |  through these controls by hand and explain how your application implements NIST 300,
919.86s - 922.06s |  1, 2, 3, 4, whatever.
922.06s - 926.10s |  And it gets real frustrating when you are brought on to write code and not documentation
926.10s - 928.46s |  like this.
928.46s - 930.14s |  So how do we fix it?
930.14s - 934.10s |  First one is prioritizing technical depth.
934.10s - 938.98s |  There is a world where you can have no technical skills whatsoever and promote and promote
938.98s - 943.62s |  and promote and be the technically best in the world at something and literally not get
943.62s - 946.86s |  promoted within the government because you don't meet whatever leadership criteria or
946.86s - 949.06s |  whatever other things that they think that you need.
949.06s - 950.06s |  Yeah.
950.06s - 952.74s |  And the other part of this I've learned is that there is no actual career track to being
952.74s - 959.30s |  a software engineer in the military, and that frustrates lots of people from what I've heard.
959.30s - 961.30s |  Next is improving hiring and firing speed.
961.30s - 966.78s |  It turns out it's hard to fire people in the federal government.
966.78s - 970.46s |  And that makes people really uncomfortable about hiring people because you want to make
970.46s - 974.74s |  sure that you don't get the wrong person and they get stuck with them for the rest of time.
974.74s - 979.26s |  There are things that can be done both within existing law and policy, but also by potentially
979.26s - 983.54s |  modifying some existing law and policy to make both of those processes faster, and I
983.54s - 988.58s |  think it is essential to compete for tech because I have not met a single outstanding
988.66s - 992.90s |  software developer type who is really comfortable with the idea of waiting six to eight months for
992.90s - 993.78s |  their final job offer.
995.38s - 996.98s |  Oh, and I'm supposed to do the next one, too.
996.98s - 1000.26s |  Aligning and setting priorities, that just comes back to, look, if you say that failing
1000.26s - 1004.10s |  fast and iterating and all of those things is important, then you need to also make that
1004.90s - 1008.66s |  what gets you promoted, not something that is a risk that you take that actually affects
1008.66s - 1009.46s |  your career.
1009.46s - 1009.78s |  Yeah.
1009.78s - 1013.38s |  And in automating a lot of that compliance documentation, we need to find ways to produce
1013.38s - 1018.98s |  that with policy code, with actual software policy, where people aren't sitting there
1018.98s - 1023.38s |  reading NIST manuals forever and then having to write up their implementation by hand every
1023.38s - 1023.94s |  time.
1023.94s - 1024.66s |  Super frustrating.
1024.66s - 1026.18s |  So we need to find ways to automate that.
1027.46s - 1032.18s |  Budget and organizational inefficiencies, we kind of think about this as the money and
1032.18s - 1036.58s |  the people side of it, and this is a lovely org chart of DoD stuff.
1037.54s - 1042.34s |  This is an org chart of DoD cyber, and it illustrates why I think it's so effective.
1042.98s - 1047.78s |  So one of the things I learned is I went to an Air Force conference, and the Air Force
1047.78s - 1052.42s |  PKI office had a table there in the vendor hall, and I quickly learned that every single
1052.42s - 1058.50s |  branch of the DoD has their own PKI audit, I mean, login, authentication, DNS.
1058.50s - 1061.38s |  They're providing all of these things, and they're not building them themselves.
1061.38s - 1062.66s |  A contractor is building that.
1062.66s - 1066.90s |  So some contractor is getting paid to build the same thing six times, the same way to
1066.90s - 1071.46s |  solve the same requirements from scratch, and as a taxpayer, that's frustrating.
1072.34s - 1076.10s |  I always thought that this was all provided at the DoD service level, and everyone used
1076.10s - 1079.14s |  this like any other sort of business organization out there.
1081.06s - 1086.26s |  The next one is, so everyone I know who's left the government has a handful of stories
1086.26s - 1089.70s |  that they will tell when someone asks them, like, what was your moment when you decided
1089.70s - 1091.14s |  that it was time for you to leave the government?
1092.18s - 1096.18s |  I have a few, and this is one of mine, and essentially, I like how you're looking at
1096.18s - 1097.62s |  me right now, because you know this story.
1098.58s - 1102.98s |  Essentially, we tried to do an experiment where we took money that would normally go
1102.98s - 1107.38s |  to an acquisition organization, instead we gave it to an operational organization, and
1107.38s - 1113.30s |  we got $2 million, we met the customer requirement in six months instead of a year, and we spent
1113.30s - 1117.06s |  only $500,000 instead of $2 million, and I was super stoked about this.
1117.06s - 1123.62s |  I thought we had made, I thought it was like an unmitigated success, and so we're talking
1123.70s - 1127.86s |  about, like, we're trying to use this as an example, and the acquisition people got
1127.86s - 1133.38s |  to talk first, and they said, yeah, that experiment was a total failure, and I was, my face did
1133.38s - 1136.74s |  this thing in the meeting where it made everyone kind of look at me, because apparently it
1136.74s - 1140.82s |  was a facial expression that you're not supposed to make, and I was like, I don't understand,
1140.82s - 1145.06s |  like, help me out here, and it was a complete failure, because we had not spent all of the
1145.06s - 1150.10s |  money within the timeline expected, and I was pissed, so in case you were wondering,
1150.10s - 1150.82s |  I was pissed.
1150.82s - 1153.70s |  So what causes it?
1153.70s - 1155.78s |  One of the things I heard, are there any lawyers in the room?
1158.06s - 1161.58s |  Okay, and you don't have to, oh, perfect, yeah, the lawyers in the room are afraid,
1161.58s - 1165.10s |  and I understand that, like, don't actually raise your hand, but just listen carefully
1165.10s - 1166.22s |  and let this resonate with you.
1166.94s - 1169.74s |  One of the things that my clients would say to me that made me want to punch them in the
1169.74s - 1173.98s |  face was I do not look good in orange, basically, Rebecca, don't let me go to jail, and when
1173.98s - 1177.18s |  they meant it earnestly, I did not want to punch them in the face, but often, like, they
1177.18s - 1181.74s |  thought it was funny, and they didn't realize I'd heard it 6,000 times that same day, but
1181.74s - 1185.58s |  it is an interesting concept, because there aren't a lot of jobs in the private sector
1185.58s - 1189.50s |  where you can literally go to jail if you do your job wrong, but also in good faith.
1190.30s - 1192.70s |  That being said, a lot of people don't go to jail for this sort of stuff, but there
1192.70s - 1195.90s |  are rules, so the Anti-Deficiency Act is a great example, it is a federal law, it is
1195.90s - 1200.62s |  a criminal statute, and it basically says if you accidentally spend money wrong, you
1200.62s - 1204.70s |  go to jail, or you could, at least, or be fined, or, like, all sorts of other things,
1204.70s - 1209.50s |  so the federal government is full of really scary things that can happen to you if you
1209.50s - 1212.94s |  screw up your job, and also it usually doesn't pay enough to take on that level of risk.
1213.82s - 1218.06s |  Not invented here, I think this is a pervasive problem, not just in the government, but also
1218.06s - 1221.58s |  it's definitely a problem in the government, so it's this idea that, like, look, I don't,
1221.58s - 1225.58s |  maybe this other organization is doing it so much better, I don't really care, I don't
1225.58s - 1229.18s |  really want to go down that path, we built this, we know what it is, we know how it works,
1229.18s - 1231.50s |  we've been using it for ten years, we're going to keep doing it.
1232.14s - 1233.98s |  The next one is no one ever asks for less.
1233.98s - 1236.46s |  This is another thing when I was listening to General Nakastony this morning, he was
1236.46s - 1241.18s |  talking about how, like, we need more people, we need more funds, and I felt like he set
1241.18s - 1241.90s |  me up for this.
1241.90s - 1246.62s |  We actually don't necessarily need more, but also no one's ever going to ask for less,
1246.62s - 1249.10s |  so, like, when the Congress rolls through, like, what can we do to help?
1249.10s - 1252.06s |  Well, we're going to need more people and more funds, and so we add, and we add, and
1252.06s - 1256.14s |  we add, and the government gets bigger and more complex, and then the last one is the
1256.14s - 1259.58s |  appropriations bills each year are getting passed later and later and later, which means
1259.58s - 1264.86s |  you end up in this situation where the money actually shows up, this is just a weird government
1264.86s - 1267.42s |  thing because money is weird in the government.
1267.42s - 1271.10s |  Like, so the money shows up, and you have three months to spend it because you need
1271.10s - 1274.22s |  to spend it three months in advance of the end of the fiscal year, and it's a nightmare
1275.42s - 1277.58s |  for so many reasons that you can probably figure out on your own.
1279.34s - 1282.14s |  Time is valuable, I think we've got to start speed running this.
1282.86s - 1285.74s |  Time is valuable, yes, we're going to move on.
1286.70s - 1292.38s |  It took three months to get a three-month contract signed and started, that's the story
1292.38s - 1293.26s |  I have there, it was awful.
1294.14s - 1297.66s |  Tech talent is expensive, it's real hard to get people to go from making a ton of money
1297.66s - 1301.58s |  at a Google or an Amazon and ask them to take a pay cut to come do civil service and work
1301.58s - 1305.26s |  for the DOD, they just can't compete.
1305.26s - 1309.66s |  Selling to the government is absolutely a pain, you know, there's a lot of requirements
1309.66s - 1314.06s |  that you have to fill out, it's kind of like a decision you have to make as a company where
1314.06s - 1319.26s |  once you've kind of had a bigger adoption from the consumer world, and you're like,
1319.26s - 1322.54s |  okay, we can turn to the government, and then someone tells you that, oh, you can sell the
1322.54s - 1325.82s |  same thing to the government six different times, you can make a lot of money doing that,
1325.82s - 1327.66s |  and then you kind of prioritize that, right?
1328.94s - 1333.26s |  So some of the suggestions we have, we want to be able to create incentives for technical
1333.26s - 1334.54s |  experts to join and stay.
1334.54s - 1338.78s |  And the answer there is not necessarily more money, it's probably one of the most trite
1338.78s - 1342.14s |  examples I've heard people say, oh, we can't pay enough, so we're never going to succeed,
1343.02s - 1346.94s |  especially once you've successfully recruited someone, you're already paying enough, so
1346.94s - 1350.22s |  then there's other ways to get them to stay, and it's not usually money, I'm not saying
1350.22s - 1353.98s |  money doesn't help, and some organizations like CISA, for example, have done incredible
1353.98s - 1358.46s |  things at raising the actual pay for technical contributors, and also the 90th has done a
1358.46s - 1359.02s |  great job too.
1359.02s - 1363.66s |  Yeah, this use it or lose it financial policy is really frustrating to hear, that if you
1363.66s - 1367.74s |  don't spend all of your money, you don't get the same amount or more next year, so you're
1367.74s - 1371.74s |  incentivized to just blow money towards the end of the year, so you can say, oh, we spent
1371.74s - 1374.70s |  it all, we need more money next year, and that's ridiculous, and that's not just a thing
1374.70s - 1378.54s |  for the government, that happens in corporate too, but those are policies that absolutely
1378.54s - 1379.98s |  do not lead to the right incentives.
1380.78s - 1384.86s |  The next one is delete, delete, delete, so the idea of as you are creating more things,
1384.86s - 1389.50s |  you also need to be uncreating other things, if you set up a task force to make sure that
1389.50s - 1393.10s |  all of the asbestos was out of the building, you don't need to keep the task force when
1393.10s - 1394.78s |  the asbestos is out of the building.
1394.78s - 1397.58s |  Yeah, and then prioritize quality over quantity.
1399.18s - 1403.66s |  One staff engineer can't be replaced with ten junior engineers, it doesn't work that
1403.66s - 1407.74s |  way, right, you need to bring in technical talent and expertise from a leadership level
1407.74s - 1411.58s |  and keep those folks around, and you need to prioritize having that quality.
1413.58s - 1418.30s |  All right, so the next one, private partnerships are challenging.
1418.30s - 1420.62s |  Public private partnerships are challenging, there we go.
1421.74s - 1426.46s |  So we were at this conference, and this colonel I was talking to, he said he led some research
1426.46s - 1430.14s |  and training facility for the Air Force and how they taught people how to come in and
1430.14s - 1434.54s |  learn how to code and use Kubernetes and some other modern stuff, and my face lit up, I'm
1434.54s - 1438.30s |  like, cool, I'd love to come talk to your students and teach them about some of the
1438.30s - 1441.26s |  cool stuff we're working in Kubernetes, and the guy stonewalled me and didn't want to
1441.26s - 1444.70s |  talk to me because he thought I was trying to sell him services and stuff.
1444.70s - 1448.86s |  And I was just genuinely excited as a lead for an open source project to come talk about
1448.86s - 1452.62s |  the cool things that we were building, and so once Rebecca actually explained that to
1452.62s - 1455.74s |  him, his whole demeanor changed and he was much more open to a conversation.
1457.58s - 1460.86s |  This one's funny, so if you've ever worked in the government, you show up to a conference
1460.86s - 1465.26s |  and you ask for your landing fee because you're going to need to have snacks and somebody
1465.26s - 1466.14s |  went and bought those.
1466.78s - 1470.78s |  So we get to the Bravo hackathon and we're asked for a landing fee and Eddie says, what
1470.78s - 1472.78s |  the fuck is a landing fee?
1472.78s - 1475.66s |  I'm like, well, it's for the snacks, and to me, again, this is one of those things that's
1475.66s - 1479.10s |  so obvious, he says, well, why didn't someone just go buy the snacks?
1479.10s - 1482.94s |  Well, somebody did, we've got to pay them back, and so then he says, well, can't Defense
1482.94s - 1484.94s |  Unicorns, our company, just sponsor them?
1484.94s - 1488.30s |  I can just go swipe my company card and buy some snacks and then we don't have to do this
1488.30s - 1494.06s |  landing fee garbage, and I was like, so we could, but the paperwork that would be required
1494.06s - 1499.58s |  by the government to accept our donation of snacks would not be worth it.
1499.58s - 1503.18s |  This is simpler, I promise, just pay 20 bucks, have some Cheetos.
1505.02s - 1506.14s |  So what makes it hard?
1506.14s - 1510.86s |  Ethics requirements, that whole thing of like, look, if you look at how Russia and China
1510.86s - 1516.78s |  do business when it comes to contracting, there is a favored set of contractors who
1516.78s - 1523.74s |  get all of the work from food service to, I don't know, running newspapers, and that
1523.74s - 1526.86s |  is not how this country should be, and we don't want it to be.
1526.86s - 1531.74s |  So instead, we put together these really complicated, complex ethics requirements that make it almost
1531.74s - 1534.06s |  impossible to even have lunch with your friend who's a contractor.
1534.70s - 1538.06s |  I'm not saying that's necessarily the right answer either, and there's probably somewhere
1538.06s - 1539.42s |  in between we need to be.
1539.42s - 1543.50s |  They also tend to make people really, really gun-shy about things that they're not sure
1543.50s - 1547.58s |  whether or not are an ethical issue, and so they'll just default to like, hey, I'm not
1547.58s - 1552.14s |  going to talk to you, look at you, or ever speak to you again, Rebecca, now that you've
1552.14s - 1554.22s |  left the government because pretty much you're dead to me.
1555.26s - 1557.50s |  Next is accidentally screwing up active acquisitions.
1557.50s - 1559.18s |  They take a really freaking long time.
1559.18s - 1565.10s |  If you screw it up and have to start over, that sucks, and so if you have an active acquisition
1565.74s - 1569.58s |  in the pipeline, you're not going to speak to anyone about it because you're terrified,
1569.58s - 1571.34s |  and I almost understand that.
1571.34s - 1572.86s |  The next one, stop trying to sell me stuff.
1573.42s - 1578.22s |  When I was in the government, I had an email black box that as soon as you as a contractor
1578.22s - 1581.90s |  sent me a single email that was anything other than like directly related to current
1581.90s - 1585.18s |  existing work, you went to the black box, and I never saw your emails again or thought
1585.18s - 1586.30s |  about you ever.
1587.10s - 1593.58s |  This was not probably the best choice in retrospect, but also like Eddie absolutely would have
1593.58s - 1597.50s |  been in my black box the minute he was like, hey, I want to tell your people about some
1597.50s - 1597.82s |  stuff.
1597.82s - 1598.94s |  Can I come eat a lunch and learn?
1598.94s - 1600.70s |  I'd be like, hell no, and also black box.
1601.50s - 1604.86s |  The last one is just this unwillingness to articulate what it is that you need, this
1604.94s - 1608.46s |  I'll know it when I see it mentality that I've seen in a lot of government employees,
1608.46s - 1612.54s |  which like I'm not going to even collaborate with you on developing a requirement.
1612.54s - 1616.30s |  I'm just going to wait until something comes along and like a beacon of light, it inspires
1616.30s - 1620.46s |  me, and that's what I'm going to buy, and when I'm trying to decide how to spend internal
1620.46s - 1625.02s |  research and development funds, that is not going to be an effective mechanism for prioritizing
1625.02s - 1625.18s |  them.
1625.98s - 1626.22s |  Yeah.
1627.34s - 1629.90s |  As an open source lead, we have different foundations.
1629.90s - 1633.90s |  We have so many working groups with empty seats at the table, and government folks,
1633.90s - 1635.66s |  we want you to come join us.
1635.66s - 1636.78s |  We don't know how to reach out to you.
1636.78s - 1640.14s |  We don't know how to invite you to these working groups, but there's too many empty seats that
1640.14s - 1641.98s |  we need filled from people in the public sector.
1642.54s - 1644.94s |  We can't solve your problems if we don't know about them.
1644.94s - 1649.18s |  Someone told me the other day, I work on kubectl, a command line tool for Kubernetes, and they
1649.18s - 1653.74s |  said if you made this one small change, it would make my day-to-day life 100 times better,
1653.74s - 1657.98s |  and I was like, cool, let's go fix that right now, and their mind was blown that that was
1657.98s - 1660.62s |  just something like you can file these feature requests.
1660.62s - 1664.30s |  This is something you're allowed to do, but we don't know what your priorities are, and
1664.30s - 1666.30s |  we can't prioritize this work unless you tell us.
1667.34s - 1670.86s |  There's this stigma in the open source community, too, that a lot of folks that are building
1670.86s - 1674.06s |  open source software don't want their software used by the military.
1675.02s - 1676.14s |  It's kind of a double-edged sword.
1676.14s - 1680.70s |  That's the beauty of open source is open source allows anyone to take, modify, and use that
1680.70s - 1686.78s |  software, so it's kind of a balance we need to work through, but it's, you know, the idea
1686.78s - 1691.10s |  that the software is open source, we don't want certain groups to use it, it doesn't
1691.10s - 1695.82s |  meet the spirit of open source, and I legit just want to help, just like with that kernel.
1695.82s - 1699.42s |  A lot of open source maintainers, we're building cool things that we care about and are super
1699.42s - 1700.30s |  passionate about.
1700.30s - 1701.50s |  We really want to help.
1701.50s - 1703.26s |  We don't care about selling you things.
1703.26s - 1707.02s |  Hopefully a lot of us that work on large projects are funded by an employer to do this work
1707.02s - 1709.42s |  in open source, so engage with us.
1709.42s - 1710.54s |  Make feature requests.
1710.54s - 1711.66s |  That is what we want you to do.
1713.02s - 1714.06s |  How do we fix it?
1714.06s - 1715.02s |  I don't know.
1715.02s - 1715.82s |  I'm done.
1715.82s - 1716.22s |  Just kidding.
1717.10s - 1721.34s |  One of the things actually I love are these no-cost agreements called Cooperative Research
1721.34s - 1722.46s |  and Development Agreements.
1722.46s - 1728.06s |  They let the government share information and vice versa with academia, industry, and
1728.06s - 1731.18s |  it's a really great opportunity to, one, make it clear you're not trying to sell something,
1731.18s - 1735.18s |  you're legit trying to collaborate, but also kind of break down some of the barriers that
1735.18s - 1738.86s |  would make you maybe more resistant to sharing information within the government.
1738.86s - 1742.46s |  Yeah, and one of the things I've learned about this is that there's kind of two steps to
1742.46s - 1745.58s |  building an implementation for a government solution.
1745.58s - 1750.94s |  There's the design phase, the proposal piece, and then there's the implementation piece,
1750.94s - 1755.34s |  and if you do the first one, you're ineligible to bid and do the second one, so obviously
1755.34s - 1759.58s |  there's more money and ongoing support fees in the second one, so most groups want to
1759.58s - 1763.66s |  do that type of work and not the first group, so what you wind up with is people who are
1763.66s - 1769.82s |  technically competent implementing and building things that might not be designed the best
1769.82s - 1771.58s |  possible way, and that's not good either.
1772.54s - 1775.42s |  I think it's just finding ways to engage and learn from industry and the tech community,
1775.42s - 1778.86s |  so if you are in this room, you are doing that because you showed up, if you're a government
1778.86s - 1781.74s |  person in this room anyway, you showed up to DEF CON, so good start.
1781.74s - 1785.74s |  If you're not a government person and you're playing spot the Fed, you have for sure come
1785.74s - 1787.42s |  to the right room, and I'm really proud of you.
1789.18s - 1789.74s |  Go ahead.
1792.79s - 1794.07s |  Oh, that's a fair point.
1794.07s - 1797.03s |  Everyone's a Fed, but go ahead, look to your left, look to your right.
1797.03s - 1797.67s |  They're both Feds.
1797.67s - 1800.71s |  Talk to them, and then the last one is talk to Eddie.
1801.11s - 1805.27s |  Don't have just an email black box where you put all contractors and never speak to them.
1805.91s - 1807.43s |  Not just Eddie, but people like him.
1808.39s - 1810.15s |  Go and talk and engage with those communities.
1810.15s - 1812.07s |  I think there's a lot to be gained from that.
1812.07s - 1814.15s |  Yeah, and we mentioned open source foundations.
1814.15s - 1819.03s |  There's CNCF, Cloud Native Compute Foundation, Open Source Security Foundation.
1819.03s - 1822.39s |  There's all sorts of working groups in there, like I mentioned before, so come find us,
1822.39s - 1824.23s |  come join with us on a neutral ground.
1825.19s - 1827.11s |  So that means everything is fucked.
1827.83s - 1828.47s |  Or maybe not.
1830.34s - 1832.66s |  Here's our last kind of what you can do to help.
1833.22s - 1836.26s |  Have you ever considered a career in public service?
1836.90s - 1838.66s |  And this isn't just a meme.
1838.66s - 1842.26s |  There's ways that you can work in this space without working directly for the government.
1843.22s - 1846.26s |  Like myself, I joined a defense contractor to work in open source software,
1846.98s - 1853.38s |  but there's other methods out there, like 18F from GSA is doing a great job to cut the hiring
1853.38s - 1856.66s |  speed and kind of like up salary caps for folks.
1856.74s - 1861.22s |  CISA is also doing a great job in this space to bring people in from external talent.
1861.22s - 1864.02s |  So it's something that you should absolutely consider for your next job.
1865.38s - 1868.82s |  The next one is actually like reading law and policy.
1868.82s - 1872.50s |  I used to joke that the only thing I had going for me as an attorney was literacy,
1873.06s - 1875.46s |  because there were tons of times where people are like, oh, you can't do this.
1875.46s - 1879.54s |  And I would literally just open the policy that they were citing and read it,
1879.54s - 1882.50s |  sometimes to them, and they would go, oh, I guess you could do that.
1882.50s - 1886.74s |  It's like they could have done that step first without coming to me.
1886.74s - 1888.18s |  Like that did not take a lawyer.
1888.18s - 1891.94s |  So read it yourself, especially if you're going to bitch about it.
1891.94s - 1894.90s |  You have a lot more credibility if you've actually read it.
1894.90s - 1897.78s |  And then when you read it, if you identify things that like, look, no kidding,
1897.78s - 1902.50s |  impede your ability to get something done, there are ways to change that
1903.30s - 1906.18s |  from within the government and from outside of the government,
1906.18s - 1907.70s |  specifically from within the government.
1907.70s - 1910.90s |  I was able to change the law five different times before I left the federal government.
1911.46s - 1914.50s |  Sometimes surprisingly quickly, other times after literally,
1914.50s - 1918.66s |  literally a decade of bitching about the same thing consistently,
1918.66s - 1920.42s |  like, but it can actually happen.
1920.42s - 1921.78s |  There are ways to do it.
1921.78s - 1922.74s |  It might not be worth it.
1922.74s - 1923.30s |  It might suck.
1923.30s - 1925.54s |  But there's also other foundations that can help you do that too.
1925.54s - 1925.70s |  Yeah.
1925.70s - 1928.74s |  And if you don't want to take that initiative on your own, work with the EFF,
1928.74s - 1932.10s |  work with the ACLU, there's groups out there that this is what they are designed to do,
1932.10s - 1934.74s |  is do the right thing and fight for the right policy change.
1934.74s - 1939.86s |  And a lot of this space is if we don't get well-designed technical policy in place,
1939.86s - 1944.74s |  some random government contractor or some senator can propose something they have no idea about.
1944.74s - 1948.66s |  So we need to get ahead of regulating and legislating a lot of this technology.
1949.78s - 1952.26s |  And then the last one is, it kind of goes hand in hand with the others.
1952.26s - 1954.66s |  Like, if something seems completely stupid,
1955.46s - 1960.42s |  give it like a hot second before you just assume that everyone involved is completely dumb.
1960.42s - 1963.78s |  And like, actually see if you can dig in and see what's driving it.
1963.78s - 1967.62s |  Because if you can identify the reason for a very stupid policy,
1967.62s - 1975.30s |  then maybe you can more articulately offer something new that meets that underlying intent.
1975.30s - 1975.54s |  Yeah.
1975.54s - 1978.50s |  And you have to assume positive intent on a lot of this stuff, right?
1978.50s - 1982.74s |  Like, no one is out there to kind of do bad things that make people's lives terrible in this space.
1984.02s - 1984.66s |  I'm naive.
1985.70s - 1987.54s |  But you have to think about that, right?
1987.54s - 1991.46s |  Like, it might just be a bad implementation of a good idea originally.
1991.46s - 1995.06s |  And last but not least, invite government folks to participate in the things that you're doing.
1995.06s - 1996.10s |  Invite them to the table.
1996.10s - 1997.22s |  They do exist.
1997.38s - 2001.22s |  When I went to the Army base, I expected to see everyone walking around in fatigues
2001.22s - 2003.06s |  and holding guns and rifles.
2003.06s - 2006.50s |  And I think I saw one gun the entire time I was at the base at the front gate.
2007.06s - 2010.18s |  And everyone else was just kind of chilling as normal people in a town.
2010.18s - 2012.98s |  So I had a lot of misconceptions that I worked through.
2012.98s - 2015.54s |  And these folks are awesome and super smart.
2015.54s - 2018.34s |  So with that, I think we're definitely out of time.
2018.34s - 2020.58s |  We'll probably be out in the hallway to answer questions until...
2020.58s - 2021.86s |  Oh, I'm getting a four-minute warning.
2022.50s - 2023.30s |  Three-minute warning.
2023.30s - 2025.06s |  We could probably take one question.
2026.02s - 2026.52s |  Yes.
2045.64s - 2046.04s |  Yeah.
2046.04s - 2048.04s |  There's a lot of that going on.
2048.04s - 2053.80s |  We have an open SSF policy day in DC on September 9th or whatever that Monday is.
2053.80s - 2055.88s |  We're hoping to do a lot of good out of that.
2055.88s - 2060.76s |  Ava, if you're in the room, Ava works for CISA doing some cool policy in that front.
2061.64s - 2062.36s |  I don't see Ava.
2062.36s - 2065.40s |  But yeah, there's a lot of efforts to try and make that better.
2066.12s - 2067.96s |  And especially, like we said, the foundation work.
2067.96s - 2071.00s |  Because if we can set up those agreements with the foundation and the DoD,
2071.08s - 2074.44s |  then it no longer becomes a place of trying to sell people stuff.
2074.44s - 2078.84s |  It becomes a place of how can we collaborate and actually make technical decisions that make sense.
2079.96s - 2081.32s |  And with that, we really are out of time.
2081.32s - 2082.44s |  Thank you guys so much.
2082.44s - 2083.96s |  We will stand in the hallway.
2083.96s - 2086.76s |  Thank you.


url: https://www.youtube.com/watch?v=BiBMsw0N_mQ
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Detecting persistent threats on Draytek  devices - Octavio Gianatiempo,  Gastón Aznarez

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=BiBMsw0N_mQ",
  "title": "DEF CON 32 - Detecting persistent threats on Draytek  devices - Octavio Gianatiempo,  Gast\u00f3n Aznarez",
  "description": "Advanced attackers are increasingly choosing edge devices as targets, many of which are security appliances such as VPNs and Firewalls. They run closed-source firmware, and defenders and researchers must understand it to assess its security and integrity. We faced this firsthand when a client that used Draytek equipment was compromised. With at least 500k Draytek routers exposed to the Internet globally, no working tools exist to extract their firmware and assist researchers and defenders working with them.\n\nWe reverse-engineered Draytek's firmware format, developed tools to extract it, and discovered that its RTOS kernel can load code modules dynamically. These stored modules remain active even after firmware upgrades, inadvertently facilitating persistent threats. We crafted and uploaded malicious modules using our tools and newly found vulnerabilities to achieve persistence.\n\nEnd-users lack straightforward means to detect such compromises. In response to this threat, we developed our own module to assess the integrity of other modules loaded in memory, mitigating its impact. In our pursuit of a more secure internet, we are sharing our knowledge and opening our tools to the community, enabling observability, hardening, transparency, and vulnerability research on Draytek edge devices.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2142,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 1.60s | This text was transcribed using whisper model: large-v2

 Hi, everyone.
1.60s - 4.92s |  There is more people than I expect at 10 AM.
4.92s - 9.08s |  Thank you very much for being here.
9.08s - 12.84s |  You are the ones who survived until the last day in DEFCON.
12.84s - 15.04s |  Awesome.
15.04s - 18.12s |  Welcome to Taking Off the Blindfold,
18.12s - 24.20s |  Detecting Persistent Threats on Drytech Edge Devices.
24.20s - 26.72s |  We are part of the Faraday Research Team.
26.72s - 29.60s |  My partner here is Octavio Geno-Tiempo.
29.60s - 31.52s |  I am Gaston Asnares.
31.52s - 36.20s |  And we have some experience working with firmware.
36.20s - 40.16s |  We have a foundation on computer science.
40.16s - 42.72s |  And we like to play CDF.
42.72s - 49.33s |  As a resume, we would like to break things and do research.
49.33s - 51.93s |  So what we are going to see today.
51.93s - 54.77s |  First, we are going to see a motivation for this research
54.77s - 56.69s |  and this talk.
56.69s - 58.49s |  We are going to see some reverse engineering
58.49s - 60.85s |  on drytech firmwares.
60.85s - 63.97s |  We are going to talk about vulnerabilities and attack
63.97s - 65.93s |  vectors.
65.93s - 68.45s |  We are going to see mitigation strategies.
68.45s - 70.73s |  And at least, we are going to see
70.73s - 74.82s |  some conclusions and takeaways.
74.82s - 78.38s |  OK, how this started.
78.38s - 82.70s |  We had a call of a client saying that it was compromised.
82.70s - 85.66s |  And when we came to the scene, we
85.66s - 90.34s |  see a lot of outdated drytech equipment
90.34s - 92.42s |  in the edge of the network.
92.42s - 99.26s |  Most of them were SOHO models that runs our RTOS.
99.26s - 100.98s |  And we started making some analysis.
100.98s - 104.26s |  We found previous vulnerabilities
104.26s - 110.26s |  with proven exploits on high-end models of the drytech routers
110.26s - 113.74s |  that runs Linux.
113.74s - 116.78s |  And we started making some questions about it.
116.78s - 120.34s |  Like, are these vulnerabilities exploitable
120.34s - 122.78s |  on the SOHO routers?
122.78s - 126.02s |  There is other vulnerabilities that are unknown.
126.02s - 129.58s |  And the principal question was, were these routers
129.58s - 134.02s |  the entry point of the attackers?
134.02s - 135.90s |  OK, we know that there is an increasing
135.90s - 140.10s |  threat of advanced attack targeting edge devices.
140.10s - 144.18s |  We could name some examples, like the sewer rat that
144.18s - 148.14s |  was a sophisticated malware targeting SOHO routers.
148.18s - 150.70s |  We also could name the hiatus rat
150.70s - 153.46s |  that was a malware targeting drytech routers,
153.46s - 157.98s |  but the high-end models.
157.98s - 161.46s |  And at least we could name Benin Sartine
161.46s - 168.46s |  that was an NSA tool targeting Cisco routers that was leaked
168.46s - 173.36s |  by the shadow brokers group.
173.36s - 178.68s |  OK, so what is the attack surface of these routers?
178.68s - 186.96s |  We found over 5,100 exposed devices, mostly in the UK.
186.96s - 189.64s |  And we found a lot of vulnerabilities,
189.64s - 193.16s |  from an information disclosure to an authenticated
193.16s - 194.52s |  remote code execution.
194.52s - 198.57s |  So there is a lot of stuff.
198.57s - 204.17s |  OK, so we had a Vigor 2925 in our office,
204.17s - 209.05s |  running MIPS 32 RTOS.
209.05s - 213.05s |  And we wanted to start making some research on that,
213.05s - 215.09s |  but we have a problem.
215.09s - 217.81s |  The code is closed source.
217.81s - 222.41s |  So first, we had to reverse engineer the firmware format.
222.41s - 225.37s |  We had to extract the firmwares, understand
225.37s - 229.81s |  previous vulnerabilities, and then look for new ones.
229.81s - 238.12s |  And finally, determine if this was the attack vector or not.
238.12s - 240.32s |  So the first thing we did was trying
240.32s - 242.48s |  to extract this firmware using a minwalk,
242.68s - 243.32s |  but it failed.
243.32s - 244.96s |  It produced no results.
244.96s - 247.28s |  So we tried to look for some specialized tools,
247.28s - 249.36s |  and we found this one, DRYTOOLS.
249.36s - 251.56s |  So this didn't work with new firmwares.
251.56s - 255.04s |  The last commit was 12 years ago, and that's why.
255.04s - 258.08s |  So luckily for us, we found a talk
258.08s - 261.36s |  by Philippe Loret at Hexagon 2022,
261.36s - 264.72s |  where he described that by emulating DRYTEXT bootloader,
264.72s - 268.96s |  we can extract, we can make it extract the RTOS kernel.
268.96s - 270.88s |  The disadvantage of this approach
270.88s - 272.44s |  is that this is a manual process,
272.44s - 274.80s |  and you have to tweak the addresses for each firmware
274.80s - 276.60s |  version.
276.60s - 278.24s |  And the other problem that it has
278.24s - 280.56s |  is that these firmware images have
280.56s - 284.36s |  other executable components apart from the RTOS kernel
284.36s - 288.88s |  and file systems that you cannot extract this way.
288.88s - 292.12s |  So our approach was to reverse engineer the format
292.12s - 295.64s |  and to try to write a tool that can extract all firmware
295.64s - 299.28s |  versions from different models, extracting all file systems,
299.28s - 303.68s |  and extracting all the executable components.
303.68s - 305.84s |  We named our tool DRYTEXT Arsenal.
305.84s - 307.40s |  It's a collection of tools.
307.40s - 309.48s |  We wrote this in Python.
309.48s - 310.24s |  It's open source.
310.24s - 313.88s |  You can check it out at that repository.
313.88s - 317.20s |  And the idea is to support for all these new firmware
317.20s - 319.96s |  versions, and we will be showing,
319.96s - 322.28s |  along these presentations, all the features
322.28s - 326.05s |  that we implemented.
326.05s - 328.77s |  So let's talk about the firmware format.
328.77s - 331.09s |  It has two main sections.
331.09s - 332.69s |  One is called the binary section,
332.69s - 334.77s |  and the other one, the web section.
334.77s - 337.93s |  Both start with a header that contains
337.93s - 340.85s |  the size and a pointer to the following section.
340.85s - 343.21s |  But in the first one, we also have information
343.21s - 347.45s |  about the firmware version and some metadata.
347.45s - 352.49s |  So the web section has a file system that is compressed
352.49s - 354.61s |  and contains all the static files
354.61s - 358.21s |  that the router serves for the web UI.
358.21s - 360.73s |  In the first section, the binary section,
360.73s - 364.61s |  we have the boot loader that is raw MIPS 32 code.
364.61s - 367.53s |  This is the part that Philippe emulated.
367.53s - 372.41s |  And then this is followed by the compressed RTOS kernel.
372.41s - 375.37s |  And after that, we have a very interesting part of firmware
375.37s - 377.09s |  that is the DLM code.
377.09s - 381.37s |  This is also a file system, but it's compressed and encrypted.
381.37s - 384.77s |  And we will talk a lot about it.
384.77s - 389.09s |  So to work with this, we made a specification
389.09s - 391.73s |  of the structure of the firmware using KTI structs.
391.73s - 393.61s |  And the advantage of using this is
393.61s - 396.69s |  that you can manipulate the firmware images with any
396.69s - 398.33s |  language that you want from this list.
398.33s - 400.73s |  We used Python, but you can find this in the repo
400.73s - 404.97s |  and use the language that you prefer.
404.97s - 407.45s |  Well, by knowing all this, we started
407.45s - 409.09s |  to tackle the reverse engineering
409.09s - 411.13s |  of the compression algorithm.
411.13s - 415.17s |  So during boot, the RTOS is decompressed
415.17s - 418.49s |  to the same memory space as the boot loader.
418.49s - 421.13s |  We did this following the steps described
421.13s - 423.29s |  by Philippe in his talk.
423.29s - 425.69s |  But when we started reverse engineering this,
425.69s - 430.09s |  we mapped all this in memory, the boot loader and then
430.09s - 431.89s |  the RTOS after that.
431.89s - 435.29s |  And that allowed us to discover that the decompression
435.29s - 438.69s |  function is used during runtime to decompress other things,
438.69s - 440.93s |  for example, the file systems.
440.93s - 443.37s |  And we also discovered some interesting strings,
443.37s - 446.33s |  like the one that you can see down to the right, that
446.33s - 449.09s |  says lc4 decompression failed.
449.09s - 452.37s |  But if it was lc4 decompression algorithm,
452.37s - 456.25s |  why we couldn't start it with linwalk?
456.25s - 459.13s |  And the reason for this is that while they
459.13s - 463.53s |  use a standard lc4 compression block format,
463.53s - 468.61s |  they have written a custom frame format.
468.61s - 472.65s |  So it's just a custom magic that is
472.65s - 475.29s |  followed by a succession of block size and block
475.29s - 477.49s |  data multiple times.
477.49s - 482.57s |  So we wrote a decompressor and a compressor for that format.
482.57s - 485.93s |  And then we moved on to the most interesting part
485.93s - 488.69s |  that is the DLM section.
488.69s - 492.53s |  So it turns out that the DLM stands
492.53s - 494.17s |  for Dynamic Kernel Modules.
494.17s - 496.77s |  So this real-time operating system
496.77s - 501.01s |  has the ability to load code modules during runtime
501.01s - 502.17s |  dynamically.
502.17s - 506.57s |  And this feature works independently
506.57s - 508.49s |  from the firmware.
508.49s - 514.33s |  So during boot, we can see that the modules that
514.33s - 517.37s |  come with the firmware image are loaded.
517.37s - 518.89s |  There are three modules.
518.89s - 523.13s |  And they are called vr9-geo-ip, vr9-app-e.
523.13s - 527.49s |  We will talk a lot about this one, and vr9-ssh.
527.49s - 530.13s |  So the first one contains information
530.13s - 532.53s |  about the geolocation of IPs.
532.53s - 536.61s |  The second one is used to block traffic from the users that
536.61s - 538.93s |  are in the LAN.
538.93s - 542.97s |  And the last one contains the implementation of SSH server.
542.97s - 545.85s |  And this is really interesting because this implementation
545.85s - 550.28s |  is separate from the firmware.
550.28s - 554.40s |  So these modules can be updated during runtime.
554.40s - 559.40s |  And if you install a new version of App Enforcement Module
559.40s - 563.72s |  or SSH, these are loaded first and prevent
563.72s - 567.36s |  the modules that come with the firmware to be loaded.
567.36s - 571.04s |  You can see down to the right that, for example,
571.04s - 574.36s |  in this case, the vr9-app-e module was loaded first.
574.36s - 579.32s |  And then when the router tries to load
579.32s - 584.28s |  the version that comes in the firmware image, it will fail.
584.28s - 587.16s |  So doing some more reverse engineering,
587.16s - 589.04s |  we found out that the modules are compressed
589.04s - 594.76s |  using the same algorithm that is used for the RTOS,
594.76s - 596.76s |  but they are also encrypted.
596.76s - 599.20s |  So we recognize that the algorithm used
599.20s - 602.44s |  was a modified version of XDA.
602.44s - 605.40s |  And this is a symmetric encryption algorithm.
605.40s - 608.44s |  And what this means is that the keys for decrypting these DLMs
608.44s - 610.32s |  are present in the firmware.
610.32s - 613.74s |  So we looked for them, and we wrote a decryptor and encryptor
613.74s - 615.16s |  for the modules.
615.16s - 618.48s |  So if you take a DLM, you decrypt it using this,
618.48s - 622.52s |  and you decompress it using the modified version of LC4,
622.52s - 625.16s |  then what you get is a relocatable ELF.
625.16s - 627.48s |  And this is very interesting, because all these terminal
627.48s - 630.80s |  functions that this ELF uses, they
630.80s - 632.60s |  have to have their symbol names.
632.60s - 637.37s |  So they are really easy to reverse engineer.
637.37s - 639.65s |  And this also means that the firmware
639.65s - 641.37s |  must have an ELF loader.
641.37s - 643.89s |  So we looked for that code, and we found
643.89s - 646.65s |  that there is also a symbol table.
646.65s - 649.65s |  This symbol table was described before by Philippe Loret,
649.65s - 653.29s |  but only as an aid for reverse engineering,
653.29s - 655.33s |  because imagine that you have a table where
655.33s - 658.89s |  you have function names followed by function pointers.
658.89s - 661.65s |  But now we know that this table is actually
661.65s - 667.01s |  used by the ELF loader to link these modules to the kernel.
667.01s - 671.57s |  So the advantage that this gives to us
671.57s - 674.21s |  is that if we manage to write our own modules,
674.21s - 676.37s |  we can use all these functions without knowing
676.37s - 679.92s |  their actual addresses.
679.92s - 684.56s |  So we implemented all these in our tool.
684.56s - 688.04s |  We have two functions, one called
688.04s - 690.32s |  parse firmware that will print a lot of information
690.32s - 692.52s |  about the firmware image, and the other one
692.52s - 696.48s |  called extract that will extract all these pieces of the image.
696.48s - 699.84s |  It will decrypt and decompress all the modules.
699.84s - 704.44s |  It will extract all the file systems for the web server,
704.44s - 708.00s |  and it will generate a binary image that
708.00s - 711.04s |  contains the bootloader followed by the RTOS kernel,
711.04s - 713.72s |  but decompressed.
713.72s - 716.88s |  So if you want to start reverse engineering this,
716.88s - 719.00s |  you must know the loading address.
719.00s - 722.96s |  And what we realize is that all Drytech bootloaders
722.96s - 725.72s |  start by calling the decompression function.
725.72s - 727.52s |  So this function is always located
727.52s - 729.48s |  near the start of the image.
729.48s - 733.92s |  And since all this has to be loaded aligned to the page,
733.92s - 737.44s |  then we can search for the address of this compression
737.44s - 738.44s |  function.
738.44s - 741.00s |  And if we remove the last three numbers,
741.00s - 743.28s |  what we get is the address, the loading
743.28s - 744.72s |  address of the whole image.
744.72s - 749.48s |  So with that, you can start your reverse engineering process.
749.48s - 752.36s |  We also implemented this in a functionality
752.36s - 754.88s |  called find loading address.
754.88s - 757.92s |  And when we had all that, we moved on
757.92s - 760.68s |  to try to find some vulnerabilities and attack
760.68s - 769.18s |  vectors.
769.18s - 772.94s |  OK, so let's talk something about vulnerabilities.
772.94s - 776.54s |  We are going to show some of them.
776.54s - 779.06s |  Starting with the basics, we found
779.06s - 782.02s |  that they had an insecure password storage.
782.02s - 785.18s |  That means they stored the passwords and the credentials
785.18s - 787.38s |  in plain text in memory.
787.38s - 790.42s |  So if someone had access to the memory,
790.42s - 795.26s |  they could read the credentials or maybe change another exploit
795.26s - 798.62s |  to leak them.
798.62s - 802.26s |  We also found non-constant time comparison
802.26s - 805.66s |  on the credential.
805.66s - 810.86s |  So they use a function that takes different amounts of time
810.86s - 813.58s |  to compare different passwords, depending
813.58s - 819.42s |  on how much correct characters are in the string.
819.42s - 825.73s |  And that leads to a side attack channel, a timing attack.
825.73s - 830.29s |  OK, so DirectX implements a second step authentication
830.29s - 832.41s |  that's really nice.
832.41s - 837.13s |  But that was predictable, because the code generation
837.13s - 840.81s |  was done using a self-random function.
840.81s - 848.57s |  But with the seed, they use the time elapsed since boot.
848.57s - 853.09s |  So if you know for how long the router is running,
853.09s - 858.81s |  you could predict the second factor authentication codes.
858.81s - 864.09s |  We also found an older reference in the HCP server
864.09s - 868.77s |  that leads to the native service attack.
868.77s - 872.49s |  But the interesting in that is that it was exposed to one.
872.49s - 875.41s |  So if the router was exposed to internet,
875.41s - 880.17s |  you could trigger that non-reference.
880.17s - 883.37s |  And if we combine both vulnerabilities,
883.37s - 887.37s |  we could predict the second step authentication codes,
887.37s - 891.25s |  because we could make the router crash.
891.25s - 895.29s |  And then we know the time elapsed since boot,
895.29s - 898.89s |  and we predict the codes.
898.89s - 903.05s |  And that's what we are going to see in the next demo.
903.05s - 905.53s |  We could see on the right the serial communication
905.53s - 906.21s |  with the router.
909.89s - 912.09s |  No, that's on the left.
912.09s - 915.09s |  On the right top is the script that we run.
915.09s - 922.65s |  It triggers the non-reference, and the router is rebooting.
922.65s - 925.77s |  It will take two or three reboots,
925.77s - 929.81s |  because it crashed hard.
929.81s - 934.53s |  And on the right bottom, we have the web UI,
934.53s - 940.86s |  where we are going to try to log in.
940.86s - 943.50s |  So now it boots.
943.50s - 949.77s |  We are going to wait until the router initializes itself.
950.61s - 960.61s |  And now we are trying some different codes.
960.61s - 969.51s |  And we were able to predict the code, and we are logged in.
969.51s - 973.59s |  So Octavio talked something about the APP enforcement
973.59s - 975.47s |  signature feature.
975.47s - 977.31s |  It's really great.
977.31s - 980.11s |  If you have an enterprise and you
980.11s - 985.23s |  want to block to your employees on web or I don't know,
985.23s - 991.19s |  you will update the signatures in order to block that traffic.
991.19s - 996.31s |  And how this process is made, there are two ways.
996.31s - 997.75s |  The first one is the manual.
997.75s - 1002.43s |  We will see on the right bottom that says Import.
1002.43s - 1006.43s |  If we click there, we could upload any file
1006.43s - 1008.99s |  with some checks.
1008.99s - 1013.79s |  And the second way is the automatic way,
1013.79s - 1018.47s |  in which we have to select the update server
1018.47s - 1022.83s |  or select the default one.
1022.83s - 1025.23s |  And we have to schedule the updates.
1025.23s - 1030.03s |  So for example, every day at some point of the day,
1030.03s - 1035.39s |  it will check if there is some update for the signatures.
1035.39s - 1041.11s |  And how they implement this, the signatures,
1041.11s - 1046.63s |  you could think on JSON formats or YAML or something like that.
1046.63s - 1051.71s |  But Drytech has the idea to implement this as a module.
1051.71s - 1054.39s |  So to update the signatures, they
1054.39s - 1061.63s |  upload an L file with code and everything.
1061.63s - 1064.47s |  OK, let's talk about some vulnerabilities
1064.47s - 1066.47s |  related to the modules.
1066.47s - 1073.35s |  The first one is they not also update certificates with code,
1073.35s - 1076.63s |  but they don't check for certificates
1076.63s - 1079.11s |  or have SSL enforcement.
1079.11s - 1083.43s |  So if someone manipulates the configuration of the router
1083.43s - 1086.47s |  or the DNAs, maybe DNS hijacking,
1086.47s - 1091.59s |  they could upload a module to all the Drytech routers
1091.59s - 1094.63s |  that has this feature.
1094.63s - 1099.71s |  And we have found two post-authentication endpoints.
1099.71s - 1103.63s |  The first one is the one that I told in the last slide.
1103.63s - 1107.19s |  And the second one is that we found an endpoint
1107.19s - 1112.39s |  to upload configurations files that doesn't have some checks.
1112.39s - 1116.19s |  So they allow us to upload an arbitrary DLM.
1116.19s - 1119.75s |  Now it's not only the APPA module,
1119.75s - 1123.43s |  but we could upload any modules that we want.
1123.43s - 1129.75s |  Maybe we could, I don't know, upload another SSH module.
1129.79s - 1132.91s |  So we have three ways for an attacker
1132.91s - 1134.63s |  to install malicious modules.
1134.63s - 1136.83s |  The first one is the post-authentication endpoints
1136.83s - 1141.19s |  that we talked about in the last slide.
1141.19s - 1143.95s |  We have the module upload process
1143.95s - 1147.59s |  that is hijacking the configuration or the DNS.
1147.59s - 1149.71s |  And the last one is the supply chain,
1149.71s - 1152.75s |  because the modules are very easy to craft.
1152.75s - 1158.07s |  So they are easily appended to the firmware.
1158.07s - 1160.99s |  And anyone with physical access or, I don't know,
1160.99s - 1163.63s |  exploiting some vulnerability, they
1163.63s - 1171.94s |  could upload the module before selling it.
1171.94s - 1173.94s |  OK, so knowing all of this, we could
1173.94s - 1176.02s |  start making some modules.
1176.02s - 1177.82s |  We implemented two commands.
1177.82s - 1179.42s |  The first one is the MIPS compile
1179.42s - 1186.94s |  that is going to make a compilation of source code
1186.94s - 1193.86s |  into a relocatable ELF of the architecture of MIPS32.
1193.86s - 1198.14s |  And we also have another command that is up to DLM.
1198.14s - 1200.82s |  As the name said, it will convert an ELF
1200.82s - 1203.46s |  to a DLM, compressing and encrypting
1203.46s - 1205.30s |  with the provided keys.
1205.30s - 1209.22s |  So we could append some web headers
1209.22s - 1215.37s |  so we could upload them through the web UI.
1215.37s - 1217.69s |  So we are going to see a demo.
1217.69s - 1225.73s |  We could see on the left the version of the APPA module.
1225.73s - 1227.45s |  On the right, in the middle, we are
1227.45s - 1232.01s |  going to run a server, a custom server that
1232.01s - 1242.70s |  is pointing the configuration of the auto-updates.
1242.70s - 1248.54s |  So on the top right, we could see the serial interface
1248.54s - 1250.86s |  with the router.
1250.86s - 1255.58s |  OK, so once the server is up, we are going to send,
1255.58s - 1259.42s |  we are going to trigger a new DLM.
1259.42s - 1260.14s |  So it's triggered.
1260.14s - 1263.58s |  We could see the router has fetched
1263.58s - 1265.62s |  the new module in our server.
1265.62s - 1268.66s |  We could see the Faraday logo because it's our module.
1268.66s - 1272.66s |  And if we log in again, we could see
1272.66s - 1275.34s |  that the version of the module has changed.
1275.34s - 1284.86s |  And we have some logs that said that it don't allow this.
1284.86s - 1289.10s |  OK, let's make something more funnier.
1289.10s - 1291.50s |  We are going to make a SSH backdoor.
1291.50s - 1292.62s |  Why not?
1292.62s - 1295.86s |  Because we have the module.
1295.86s - 1301.46s |  So the original behavior of the SSH module is the top one.
1301.46s - 1303.78s |  When we have a new connection, it's
1303.78s - 1306.42s |  going to call the authentication function.
1306.42s - 1308.42s |  And the authentication function will
1308.42s - 1312.70s |  say that it fails or it authenticates.
1312.70s - 1318.58s |  But what we are going to do is when a new connection enters,
1318.58s - 1321.54s |  when a new connection is open, that
1321.54s - 1323.62s |  is going to call our hook.
1323.62s - 1326.62s |  And it's going to check our credentials.
1326.62s - 1329.90s |  So if they are right, it authenticates.
1329.90s - 1332.94s |  If not, it's going to call the original function
1332.94s - 1334.78s |  because we don't want to change all
1334.78s - 1339.40s |  the behavior of the SSH module.
1339.40s - 1341.12s |  How is the roadmap for this?
1341.12s - 1344.60s |  First, we have to do a reverse engineer of the SSH module
1344.60s - 1347.76s |  to find that function that makes the authentication.
1347.76s - 1349.16s |  We are going to skip that part.
1349.16s - 1351.72s |  And we are going to say that the target function is the SSH
1351.72s - 1356.40s |  account and LDAP auth function.
1356.40s - 1360.24s |  After that, we have to write and compile the hook.
1360.24s - 1365.68s |  We have to merge the hook with the original module.
1365.68s - 1371.52s |  And we have to modify all the relocations in the entry table.
1371.52s - 1377.23s |  And last, we have to upload the DLM.
1377.23s - 1379.07s |  So on the right, we could see the source
1379.07s - 1384.55s |  code of our hook function that takes the same arguments
1384.55s - 1390.83s |  as the target function, an SSH instance, and a packet.
1390.83s - 1394.23s |  And it will check for our credentials.
1394.23s - 1396.47s |  If they are right, it will return one
1396.47s - 1398.43s |  that says it authenticates.
1398.43s - 1401.55s |  And if not, it will call the target function.
1404.59s - 1407.71s |  OK, in order to compile this, we use
1407.71s - 1412.58s |  our command MIPS compile.
1412.58s - 1415.42s |  And then we have to merge both binaries,
1415.42s - 1418.90s |  both relocatable ELFs.
1418.90s - 1424.66s |  So as I said, a relocatable ELF has all the symbols
1424.66s - 1426.70s |  with no fixed address.
1426.70s - 1429.98s |  So they had a relocation table that
1429.98s - 1438.42s |  will set everything that uses a symbol has to be modified
1438.42s - 1442.62s |  to point to that symbol after linking.
1442.62s - 1444.82s |  So we have all the symbols there.
1444.82s - 1451.78s |  And once we merge it, we have the symbols of both modules.
1451.78s - 1457.30s |  We wrote a command to do this that
1457.30s - 1463.06s |  is with the name of MIPS merge that takes two ELF files
1463.06s - 1468.70s |  and as an output has one file.
1468.70s - 1472.86s |  OK, now we have to modify the relocations table.
1472.86s - 1476.58s |  So first, we find all the relocation
1476.58s - 1479.98s |  that talks about the target function.
1479.98s - 1484.06s |  We could see on the top right the two examples.
1484.06s - 1487.34s |  We are going to use the first one.
1487.34s - 1494.26s |  If we print the code that is on that address on the bottom
1494.26s - 1498.38s |  left, we could see that the jump is a jump instruction.
1498.38s - 1503.34s |  But the jump instruction only has his opcode
1503.34s - 1506.10s |  but doesn't have an address where to jump.
1506.10s - 1508.18s |  That is because the relocation entry
1508.18s - 1510.70s |  will set which one is going to be
1510.70s - 1512.90s |  that address on link in time.
1512.90s - 1516.02s |  And we could see there that is the target function.
1516.02s - 1520.42s |  So we modify that entry to give us
1520.42s - 1529.19s |  a result the right that points to the hack function.
1529.19s - 1533.50s |  So time to hack.
1533.50s - 1536.54s |  OK, so on the top right, we are trying
1536.54s - 1539.18s |  to log in with our credentials.
1539.18s - 1541.42s |  But we could see that it fails.
1541.42s - 1549.51s |  So on the bottom left, we upload our backdoor module.
1549.51s - 1552.51s |  And once it's uploaded, we could see that the file
1552.51s - 1554.55s |  was written successfully.
1554.55s - 1561.42s |  But we have to reboot the router.
1561.42s - 1563.66s |  And once it reboots, we are going
1563.66s - 1567.78s |  to try again with our credentials.
1567.78s - 1577.65s |  We could see that the module was loaded.
1577.65s - 1579.73s |  OK, so we tried to log in.
1579.73s - 1582.29s |  And we could see that we were in.
1582.29s - 1594.54s |  And we could see some loss in the serial communication.
1594.54s - 1598.62s |  So this attack that Gaston showed is really dangerous.
1598.62s - 1602.70s |  Imagine that an attacker can craft a modified SSH module,
1602.70s - 1605.70s |  upload it to your dry-tech router,
1605.70s - 1608.46s |  and you have no way of detecting this.
1608.46s - 1611.58s |  Moreover, if you update the firmware,
1611.58s - 1613.38s |  the module will be still there.
1613.38s - 1615.82s |  It will persist, and even will persist
1615.82s - 1617.70s |  if you reset the configuration of the router,
1617.70s - 1619.58s |  because it's stored in a separate file
1619.58s - 1621.82s |  system in the flash.
1621.82s - 1626.30s |  So we started to think about some mitigation strategies.
1626.30s - 1629.62s |  The first one, the obvious that we thought about,
1629.62s - 1631.14s |  was just to remove the feature.
1631.14s - 1633.42s |  Because who wants to have dynamic modules
1633.42s - 1634.86s |  on their router?
1634.86s - 1638.58s |  But there might be some users that use this feature.
1638.58s - 1642.70s |  So well, instead of noping all the calls
1642.70s - 1648.30s |  to module loading during boot and during the update process,
1648.30s - 1651.14s |  we decided to think for a better solution.
1651.14s - 1657.10s |  And we devised a mechanism for checking
1657.10s - 1661.22s |  in-memory integrity of the other modules that are loaded.
1661.22s - 1664.26s |  These mechanisms should fetch signatures from a server,
1664.26s - 1665.94s |  because the modules will get updates.
1665.94s - 1668.38s |  So you have to update the signatures.
1668.38s - 1672.90s |  But this time, you have to check the certificates.
1672.90s - 1675.70s |  So once you've got those signatures,
1675.70s - 1679.10s |  you have to find the loaded modules in memory,
1679.10s - 1682.94s |  calculate the actual signatures, and compare them.
1682.94s - 1684.98s |  And if there is a mismatch, then you
1684.98s - 1687.46s |  have to notify the user somehow.
1687.46s - 1689.46s |  And all this functionality should
1689.46s - 1692.18s |  be included with the firmware.
1692.18s - 1696.02s |  So what we did, as a proof of concept,
1696.02s - 1698.22s |  was to use the open source module
1699.06s - 1701.38s |  to introduce this code to the router.
1701.38s - 1703.78s |  Because it's much easier to write a module
1703.78s - 1705.50s |  than to patch the firmware, because you
1705.50s - 1709.14s |  have all these functions from the symbol table
1709.14s - 1710.94s |  that you can use.
1710.94s - 1715.82s |  So there are two things that we have to solve.
1715.82s - 1717.82s |  The first one is how to calculate
1717.82s - 1721.26s |  a signature for a valid DLM.
1721.26s - 1724.78s |  And the second one is to find the actual DLMs in memory
1724.78s - 1726.86s |  and do the comparison.
1726.86s - 1732.18s |  So we focused on that, and we accepted some limitations.
1732.18s - 1735.86s |  We will not check the signatures every time a module is
1735.86s - 1737.78s |  loaded, as it should be.
1737.78s - 1739.22s |  We will only check signatures when
1739.22s - 1741.38s |  our defensive module is loaded.
1741.38s - 1746.62s |  And we will not try to notify users for now.
1746.62s - 1749.06s |  So the first problem that we have to solve
1749.06s - 1752.50s |  is how to calculate a hash or a signature for a DLM.
1752.50s - 1756.74s |  We'll hash each signature with md5,
1756.74s - 1761.06s |  because md5 was available on this symbol table.
1761.06s - 1763.66s |  And we will hash only the static sections,
1763.66s - 1767.10s |  because the dynamic sections will change once loaded.
1767.10s - 1769.38s |  If the static section contains data,
1769.38s - 1771.26s |  we'll hash it right away.
1771.26s - 1774.62s |  But if it contains code, then, as Gaston
1774.62s - 1778.18s |  explained during the module installation when it's linked,
1778.18s - 1780.34s |  all the jams and the function calls
1780.34s - 1785.90s |  will get the actual addresses of the functions written to them.
1785.90s - 1789.22s |  So we will hash only the opcodes for these sections.
1789.22s - 1793.90s |  And the opcodes in MIPS are the first six bits.
1793.90s - 1798.10s |  So once we got that, we have to find all the modules that
1798.10s - 1799.54s |  are loaded.
1799.54s - 1803.50s |  When the ELF loader installs a module,
1803.50s - 1806.42s |  it creates an object to represent the module.
1806.42s - 1808.66s |  And the space for this module is allocated
1808.66s - 1811.70s |  using the linear allocator of the router.
1811.70s - 1814.98s |  So this allocator maintains a list
1814.98s - 1819.34s |  of all the chunks that it has assigned.
1819.34s - 1823.06s |  If we manage to find this object that represents the DLM,
1823.06s - 1825.78s |  we'll get the DLM name, a pointer
1825.78s - 1828.50s |  to the text section of that module,
1828.50s - 1830.32s |  and a pointer to the main section
1830.32s - 1834.14s |  that will get executed after the module is loaded.
1834.14s - 1839.06s |  So the loader copies all the sections
1839.06s - 1841.58s |  in a predefined order, one after the other,
1841.58s - 1843.14s |  after the text section.
1843.14s - 1845.62s |  This order is usually defined by the compiler.
1845.62s - 1850.54s |  And we will assume that this order doesn't change.
1850.54s - 1853.62s |  So on the bottom, you can see a little bit
1853.62s - 1856.50s |  of the code of this defensive module, the part where
1856.50s - 1861.18s |  we traverse the list of chunks from this allocator.
1861.18s - 1866.70s |  And we will check if each chunk corresponds to a module object.
1866.70s - 1868.58s |  If the chunk corresponds to a module object,
1868.58s - 1870.30s |  we will print some information.
1870.30s - 1873.54s |  And if this module happens to be the SSH one,
1873.54s - 1878.06s |  then we will calculate the hashes and compare them.
1878.06s - 1879.58s |  So here's the demonstration.
1879.58s - 1883.18s |  This router is the one that has been backdoored
1883.18s - 1886.02s |  and has a modified version of the SSH.
1886.02s - 1890.38s |  Then we upload our defensive module using the UI on the left.
1890.38s - 1895.78s |  And you can see right there that once it's uploaded,
1895.78s - 1897.46s |  it will try to find all the modules,
1897.46s - 1898.86s |  printing their information.
1898.86s - 1901.26s |  And when it reaches the SSH module,
1901.26s - 1904.18s |  it will start comparing the hashes for each section.
1904.18s - 1908.58s |  And it will find that there is a mismatch between the hashes
1908.58s - 1912.38s |  on the second section.
1912.38s - 1916.98s |  So to wrap this up, some conclusions and takeaways.
1916.98s - 1919.50s |  All these vulnerabilities were found
1919.50s - 1923.70s |  by us analyzing only the bigger 2925 router.
1923.70s - 1925.50s |  But they are present in several models
1925.50s - 1929.06s |  because all the SOHO routers use this real-time operating
1929.06s - 1930.06s |  system.
1930.06s - 1935.46s |  And even some of the higher-end routers that run Linux
1935.46s - 1939.14s |  emulate the same real-time operating system.
1939.14s - 1942.02s |  So we found all these vulnerabilities and some more
1942.02s - 1943.38s |  that we didn't show.
1943.38s - 1944.90s |  And they are all patched by now.
1944.90s - 1949.78s |  But we don't have CBA IDs yet.
1949.78s - 1953.54s |  And well, some conclusions on the offensive side.
1953.54s - 1956.58s |  The code for this real-time operating system is huge.
1956.58s - 1958.42s |  It's really complex.
1958.82s - 1961.62s |  We only analyzed a little bit of it.
1961.62s - 1965.02s |  Imagine that the functions that are present in the symbol table
1965.02s - 1968.66s |  are maybe not up to 5% of all the functions
1968.66s - 1970.02s |  in this firmware.
1970.02s - 1972.10s |  So there are probably more vulnerabilities here
1972.10s - 1973.34s |  to be found.
1973.34s - 1976.54s |  And that is why we are open sourcing our tool.
1976.54s - 1978.70s |  And we would love for you to try it.
1978.70s - 1981.06s |  And we would love to know if it's useful
1981.06s - 1982.62s |  and if you find something.
1982.62s - 1986.70s |  So there's the repository if you want to check it out.
1986.70s - 1990.26s |  And now some conclusions on the defensive side.
1990.26s - 1993.02s |  We show that it's possible to create a defensive module
1993.02s - 1995.66s |  to check the integrity of other modules in memory.
1995.66s - 1998.10s |  But in an ideal situation, this feature
1998.10s - 2000.22s |  should be implemented by the vendor.
2000.22s - 2002.82s |  It should fetch these updated signatures
2002.82s - 2006.54s |  from a trusted server, verifying the certificates.
2006.54s - 2008.54s |  And for all this to work, if this feature
2008.54s - 2011.14s |  is included in the firmware, also
2011.14s - 2014.46s |  we must have a secure blockchain to trust
2014.46s - 2017.76s |  that this is working right.
2018.04s - 2019.80s |  To close, some takeaways.
2019.80s - 2023.24s |  We think that closed source firmware, as this example,
2023.24s - 2026.60s |  is just another case of security by security.
2026.60s - 2028.76s |  All these vulnerabilities that we have found
2028.76s - 2033.00s |  are really simple, and they would
2033.00s - 2035.72s |  have been reported sooner by the community
2035.72s - 2040.12s |  if it were easier to reverse engineer these routers.
2040.12s - 2043.60s |  So some things as plain text password storage,
2043.60s - 2047.16s |  the use of insecure functions to compare sensitive data,
2047.16s - 2050.04s |  predictable random number generation,
2050.04s - 2053.28s |  and even the lack of SSL certificate validation.
2053.28s - 2056.92s |  So given all the increase in attacks
2056.92s - 2059.24s |  that we are seeing to edge devices,
2059.24s - 2061.18s |  it would be really important for vendors
2061.18s - 2064.40s |  to include features that facilitate observability,
2064.40s - 2066.76s |  vulnerability research by the community,
2066.76s - 2070.52s |  and to implement threat detection solutions.
2070.52s - 2071.80s |  So this is it.
2071.80s - 2074.36s |  Thank you for your time, first for coming so early.
2074.36s - 2078.04s |  And if you have any questions, please ask us.
2078.04s - 2080.00s |  There's a mic here if you want to ask.
2083.08s - 2089.75s |  First question gets a share.
2089.75s - 2112.44s |  Well, thank you, guys.
2112.44s - 2114.76s |  OK, the question was if there is memory protection
2114.76s - 2117.20s |  between the modules and the RTOS, and there's not.
2117.20s - 2118.96s |  All these runs on the same memory space.
2118.96s - 2122.28s |  So from a module, you could modify the RTOS code
2122.28s - 2135.26s |  and vice versa.
2135.26s - 2137.78s |  Well, thanks again for coming.


url: https://www.youtube.com/watch?v=AS_bSDxTU4w
title: DEF CON 32 - Sneaky Extensions The MV3 Escape Artists - Vivek Ramachandran, Shourya Pratap Singh
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=AS_bSDxTU4w",
  "title": "DEF CON 32 - Sneaky Extensions  The MV3 Escape Artists - Vivek Ramachandran, Shourya Pratap Singh",
  "description": "Ever since the pandemic and the rising popularity of work-from-home and hybrid models, there has been an increase in the usage of browsers, particularly video conferencing and collaboration applications. While some extensions enhance the user experience, some can gravely affect users' privacy and security.\n\nOver the past few years, extensions have gained recognition for nefarious activities, from simple color picker extensions to productivity-first AI extensions. And now more than ever, attackers are leveraging malicious extensions to steal user data, promote ads, affiliate marketing, and more. Realizing the abuse, Google pivoted from the MV2 model to the latest MV3, providing better security and locking down the extension from running rampant. While some security measures have been introduced in MV3, it is far from safe. In this talk, we will be demonstrating a suite of attacks, while requiring the least amount of permissions, which 95% of extensions on the Chrome store have. We will showcase stealth stealing of webcam feed, audio streams, clipboard data, and stealing credentials from other extensions like password managers.\n\nMV3 also introduced security measures to block the usage of functions like eval and new Function that allowed arbitrary code execution. We\u2019ll showcase how an extension can still do arbitrary code execution effectively bypassing the MV3 restrictions.\n\nIn this talk, we will also propose changes to the extension security model to prevent the lurking loopholes. We will also be demonstrating how malicious extensions can interfere with other extensions and steal sensitive information such as Credit card, passwords, OTP, etc, from other extensions.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1231,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.52s | This text was transcribed using whisper model: large-v2

 Morning everyone. Thank you so much for coming. I mean I know this is the very
5.52s - 9.64s |  first talk happening literally in every single screen out there. So really
9.64s - 15.28s |  appreciate you making it out to ours. I'm Vivek Ramachandran. I have Shaurya with me.
15.28s - 19.92s |  And we're going to talk about something very interesting. Sneaky extensions. The
19.92s - 25.44s |  MV3 escape artists. Little bit about me. I've been in cyber security 20 years.
25.44s - 32.00s |  Very first Defcon 2007 when I spoke. Found multiple vulnerabilities. Started
32.00s - 36.48s |  multiple cyber security companies. Now we run Squarex, a browser native security
36.48s - 43.14s |  company. Hello everyone. I'm Shaurya. I work as a principal software engineer at
43.14s - 47.80s |  Squarex. My work mainly involves researching extensions, malicious
47.80s - 54.81s |  extensions and working on methods to actually tackle them. And we have Sasha
54.93s - 61.05s |  from the speaker ops team. Okay so browser extensions. I think almost
61.05s - 65.77s |  everyone uses it. Anyone here doesn't use browser extensions? I'm guessing maybe in
65.77s - 71.05s |  this audience a few people are skeptical. But overall I guess everybody uses
71.05s - 76.01s |  browser extensions. Good convenience feature. And that is really where I think
76.01s - 82.29s |  our talk is about how easy it is for a browser extension to cause backdoors, a
82.29s - 87.45s |  lot of attacks within your organization. And the grand finale is we'll actually
87.45s - 93.09s |  show you a browser extension which we've written. Which can steal live calls on
93.09s - 97.69s |  you know Google Meet, Zoom and all of that while the call is happening. Without
97.69s - 104.01s |  having any indication that that MITM interception is going on. So as I said
104.01s - 107.53s |  everybody uses extensions. Grammarly, 1password, you know some of the more
107.61s - 113.33s |  common ones. And now because of AI, every second day you keep hearing about
113.33s - 118.57s |  somebody offering a free extension which gives you access to chat GPT premium.
118.57s - 122.85s |  Right? And then people just go about installing it thinking they're getting
122.85s - 129.54s |  free access. But many of those extensions are backdoored. Now this
129.54s - 134.26s |  problem is starting to compound. So you know some statistics from Forbes where
134.26s - 140.10s |  over 280 million installs of extensions containing malware in just three years.
140.10s - 147.39s |  Just 32 of them managed to go ahead and have a download count of over 75 million.
147.39s - 152.67s |  I think a lot of folks think that the Chrome store does a lot of analysis but
152.67s - 156.63s |  it doesn't. It's very high level, very basic sanity checks and nothing more
156.63s - 161.59s |  than that. And that's why this problem is starting to compound more and more year
161.59s - 170.91s |  over year. So give it to Shaurya to continue. So how many of you have ever
170.91s - 176.83s |  written an extension before? Can you raise your hand? Okay. So I'll just tell
176.83s - 181.51s |  you all a little bit about how an extension code structure looks like. This
181.51s - 184.63s |  will actually help us understand how the whole permission model is
184.63s - 190.43s |  and how exactly people can leverage that against. So typically any extension has
190.51s - 194.23s |  these four things. So they have a manifest file, then they have a service
194.23s - 197.83s |  worker which runs on the background and then they have a content script. So
197.83s - 203.35s |  content script is basically injected on whatever web page you're opening. Now
203.35s - 207.51s |  what all pages it is allowed to be present is specified in the manifest
207.51s - 213.55s |  file. Lastly some extensions also have an HTML page. So let's say you go ahead and
213.55s - 216.99s |  click on an icon, you can see like a small pop-up will appear. So there's
216.99s - 221.35s |  actually an HTML page. Similarly some extensions can also have like a separate
221.35s - 226.59s |  page which you can access through your address bar by chrome hyphen extension
226.59s - 232.23s |  colon slash slash and specifying the extension ID. So this is what a typical
232.23s - 237.15s |  extension structure look like. Now to understand how the whole permission
237.15s - 243.03s |  model works, it's important to note two things. The first one is that you know in
243.11s - 247.51s |  the extension the very best thing that has been done is that you have to
247.51s - 252.55s |  specify what all permissions are required you know upfront. So your
252.55s - 256.99s |  manifest or JSON file itself specifies that what kind of permissions your
256.99s - 262.95s |  extension is going to ask for. And this actually helps a lot as well. Now after
262.95s - 268.11s |  this we also have this a small you know a snippet. This snippet is actually a
268.11s - 271.55s |  manifest file. So this is how it typically looks like. If you see on the
271.55s - 276.11s |  top this is where you specify the manifest version. So the current latest
276.11s - 282.07s |  version is version 3. Now you know this has been actually a very I would say
282.07s - 286.67s |  important transition as extensions are moving from version 2 to version 3.
286.67s - 291.35s |  Because as you can see here you know earlier in the permissions we had to
291.35s - 295.67s |  specify a URL. Like you know on this particular URL you have access to. But
295.67s - 299.75s |  now it's much more clearer. So it's been broken up into further keys to bring
299.75s - 304.67s |  much more clarity on how the permission is being handled. Now if we look at the
304.67s - 308.07s |  kind of permissions most of the extensions are asking for here are some
308.07s - 313.35s |  stats. So you can see that the third most is actually all URLs which is quite I
313.35s - 318.15s |  would say dangerous because most of your extension actually have access to
318.15s - 324.13s |  modify any page if they want. Most people don't even read what the permission you
324.13s - 329.03s |  know the prompt is saying to you. Now the second important thing to know is how
329.03s - 334.43s |  the whole process architecture inside the Chromium works like. So in Chromium
334.43s - 340.23s |  we have a multi process architecture. So we have separate processes for doing
340.23s - 345.43s |  separate things. For example you know if you have like a particular tab so
345.43s - 348.59s |  whatever you're seeing on the page is being done through a renderer process.
348.59s - 352.39s |  Similarly if there's a network call it will actually happen through an entirely
352.39s - 357.79s |  different process. So by having all these processes separated you know it really
357.83s - 363.75s |  helps out in a security kind of point. The reason being that all these are
363.75s - 368.87s |  basically isolated from the operating system point of view
368.87s - 374.55s |  because these cannot really you know interact at much other than the IPCs. Now
374.55s - 380.15s |  there is one more thing which is quite interesting. So every tab that you see is
380.15s - 385.67s |  actually having a different renderer process which actually further isolates
385.71s - 390.11s |  them from interacting with each other. Now you must be wondering you know what
390.11s - 395.21s |  happens if there's an iframe on the page right. So if a page has an iframe it is
395.21s - 399.63s |  further put in a different process. It's actually I would say a very big
399.63s - 403.83s |  engineering milestone because if you simply go to a web page and type you
403.83s - 408.07s |  know a command F to find a text it's actually searching that text across
408.07s - 413.31s |  multiple processes. So it's quite an engineering feat I would say. There are
413.31s - 417.99s |  different terms for this called a site isolation or site fission. Now we'll come
417.99s - 421.71s |  back to how the whole you know this architecture fits in. So this diagram
421.71s - 425.27s |  basically shows it pretty well. So all the components which I showed you
425.27s - 428.55s |  earlier like extension pages, your content script, this is how the whole
428.55s - 434.51s |  structure looks like. Now content script are I would say the very first thing
434.51s - 439.43s |  that we all should you know be careful about because content scripts are
439.43s - 444.91s |  injected on the web pages. Now to see it in action I'll actually show you a live
444.91s - 449.35s |  code right now to see how exactly content script can modify a given page.
449.35s - 456.63s |  So it's actually pretty straightforward. This is a typical extension. You can see
456.63s - 461.59s |  like there's a manifest file. I'm just naming it test extension for now and in
461.59s - 466.51s |  this I'm inserting a content.js file. So if you see here there's a JS file
466.51s - 472.27s |  here which is simply just gonna write a text on the page. So you know if I go
472.27s - 475.99s |  back to my browser and let's say you know I try to load this specific
475.99s - 485.51s |  extension and if I disable it now if I try to access a website let's say
485.51s - 490.99s |  google.com it loads normally but the moment I basically enable this test
490.99s - 496.31s |  extension and I try to open google.com it will get overwritten by whatever I
496.31s - 500.83s |  have specified on the extension. Now this is how basically content script works
500.83s - 505.99s |  like you know you have a way to inject something on the web page. Now if you see
505.99s - 511.71s |  this specific extension there is no permission key here and that's what
511.71s - 515.55s |  makes it more dangerous because you know I was able to modify a page but I'm not
515.55s - 520.35s |  actually asking for any explicit permission other than like in what pages
520.35s - 524.43s |  I'm actually inserting the content script. So it's important not just to
524.43s - 527.39s |  look at the permissions key but also to look at you know in what particular
527.59s - 533.55s |  pages the content script is being injected to. Now coming back one of the
533.55s - 537.83s |  biggest problems that arise with this is actually remote code execution. So let's
537.83s - 541.91s |  say you know I allow any of the extension to be installed on your
541.91s - 547.03s |  browser and later on I'm sending some code from my server which is definitely
547.03s - 552.07s |  unmonitored and I'm sending that code to execute on any random web page. Now this
552.07s - 556.67s |  is quite dangerous so to avoid this lot of changes were done in the mv3 version
556.71s - 560.75s |  itself. So we have these functions like eval where you know you can specify like
560.75s - 565.51s |  any kind of JavaScript code and it executes on a given page. So all these
565.51s - 570.23s |  things were banned in the mv3 at the same time also enforced to be blocked
570.23s - 575.63s |  using the content security policy that is CSP. However there are ways to bypass
575.63s - 582.15s |  this as well. So you know just to give a small example of this if I go back and
582.35s - 587.35s |  look at the very same extension which I just showed you and if I try this with
587.35s - 591.79s |  you know just an eval. Now this is how eval looks like you know you're sending
591.79s - 596.11s |  a string and this string is going to execute on the page. If I go back to my
596.11s - 602.07s |  browser and I try to you know reload my extension and if I refresh now the page
602.07s - 607.15s |  will load normally. Reason being that it has been blocked because of
607.15s - 613.51s |  a CSP policy. However JavaScript is a funny language so you can actually
613.51s - 618.95s |  access the object the functions like normal arrays or objects as well. So if I
618.95s - 622.71s |  go down and I write simply something like this like you know so I specify my
622.71s - 628.47s |  right within the square brackets and the argument in a simple string then it
628.47s - 633.27s |  actually work as well. So if I go back and I you know basically try to refresh
633.27s - 638.03s |  my extension and if I go back this will again show me back hello from extension.
638.03s - 643.27s |  Now as you can see all these two things were simple strings and this can
643.27s - 647.39s |  actually be leveraged to further send those strings from an external
647.39s - 652.53s |  server as well. And this can also be used to in fact you know change the URL as
652.53s - 656.79s |  well. So if you see the snippet here this will simply change the location of a
656.79s - 663.07s |  given page. Now you know the same thing can be extended by connecting this to a
663.07s - 668.55s |  server as well. So if you see here I have a simple Flask server which just
668.55s - 672.29s |  returns two things. One is a function name and the other one is just an
672.29s - 680.25s |  argument. So if I run this server right now so I have my Flask server running
680.25s - 687.01s |  and I'll simply go back and I will load the other extension which has an
687.01s - 701.50s |  integration with this API. Now if I try to access the page it still works and
701.50s - 705.70s |  you can see a hello from server is written there. Reason being that if you
705.70s - 710.70s |  look at the code of this extension it is making an API call, getting what the
710.70s - 715.00s |  function name is, getting what the argument is and simply using it to
715.00s - 720.48s |  change the content of the page.
720.48s - 725.84s |  Okay so I think you know given the talk time is limited we'll start with some
725.84s - 731.16s |  demo videos as well. I think we have 10 minutes on the clock. 10 minutes? Okay yeah
731.20s - 736.12s |  So the very first demo you want to show is I mean there are a bunch of them is
736.12s - 740.92s |  social engineering where you could literally once you install an extension
740.92s - 745.40s |  it could pretend to go ahead and let's say drop a zoom update right because
745.40s - 749.40s |  it's so common that you try to access zoom and it says go update and Shoury
749.40s - 756.74s |  will show you that. So we can see here that you know I'm simply opening the
756.74s - 761.10s |  zoom website and it looks like you know a normal zoom website how it's supposed
761.10s - 765.78s |  to be. If I go ahead and enable this malicious extension it's simply using a
765.78s - 770.50s |  content script to add another object on that specific page which says hey there's
770.50s - 775.14s |  an update now. At the moment you click on this you download a file and if you see
775.14s - 779.46s |  here the download we are triggering is actually a blog based download. So even
779.46s - 783.02s |  if you go to the downloads and you look at the URL you will see it as you know
783.02s - 789.77s |  it's coming from zoom.us but actually it was shipped with the extension. Now if we
789.77s - 794.49s |  simply open that executable it might affect your computer. The the key thing
794.49s - 798.77s |  to realize over here is extensions have the power to run in the context of
798.77s - 802.81s |  whichever page that they're injecting into. So if you install a random
802.81s - 807.65s |  extension which says it's a color picker and then you open zoom.us at that point
807.65s - 812.81s |  it can actually inject into that page and anything which happens from the
812.81s - 817.01s |  browser's perspective is in the context of the page. So if a file download is
817.01s - 822.65s |  triggered you feel it's probably from you know the actual zoom website. Now one
822.65s - 827.85s |  interesting demo he'll actually show you is something live. Yeah. Okay and while
827.85s - 833.45s |  he's he's getting that ready. Imagine you have an extension and now you're doing a
833.45s - 838.09s |  video call right. How many of you end up using the browser version of zoom and
838.09s - 843.29s |  Google Meets and whatnot. Now you might actually imagine that when a Google Meet
843.41s - 848.21s |  call is actually happening nothing else can monitor. So we'll show you a demo of
848.21s - 854.05s |  an extension which we've created which while a live call is happening it can go
854.05s - 859.73s |  ahead do a side monitoring and literally get the entire feed of the call live and
859.73s - 864.41s |  send it wherever. With zero indication in the Google Meet session that something
864.41s - 870.21s |  is intercepting or monitoring this. So as you can see here you know I'm basically
870.33s - 883.30s |  gonna open Google Meet. We hope the internet connection works or else we'll
883.30s - 886.10s |  show you a very quick video. Okay we have five minutes on the clock while he's
886.10s - 892.22s |  getting it. The key thing to realize is you can actually host a Chromium
892.22s - 897.66s |  extension or an Edge extension. Much of the times there is barely any security
897.66s - 902.26s |  checks which are really happening. So if you see a featured extension it isn't
902.26s - 905.82s |  that you know Google's team has looked at the code run a bunch of tests
905.82s - 910.54s |  unbelievably even in the enterprise version some of the basic stuff that
910.54s - 916.18s |  they end up showing doesn't really look at what that code could do. Now here's
916.18s - 921.18s |  the worst part. We all fear download and execs right because you run the stub get
921.18s - 925.30s |  something that's something extensions can do right off the box. Is the
925.30s - 929.26s |  extension just loads looks innocent but it can actually bring back foreign code
929.26s - 937.77s |  and run it. So if you see here we are starting a new Google Meet session. Now
937.77s - 942.65s |  the malicious extension is installed. So we're gonna simply open you know another
942.65s - 946.49s |  window and open an extension page to see what's actually seeing and you can see
946.49s - 950.49s |  like you know the live feed from that particular meet page is being transferred
950.49s - 955.17s |  to the other page. And that shows a lot because you know having a simple a
955.17s - 959.49s |  simple host permission it was not even a specified permission you were actually
959.49s - 965.69s |  able to steal a live stream from a given meet page. So the key thing to realize is
965.69s - 970.61s |  you know extensions have superpowers just like you know an endpoint security
970.61s - 974.05s |  you end up installing something in kernel mode and that has one privilege
974.05s - 978.93s |  level above what user space processes have. Similarly extensions are sitting
978.93s - 983.77s |  one level above you know the page itself. Yeah we'll also look at just two quick
983.77s - 989.13s |  demos right now. Another one is called silent account hijacking. So in this what
989.13s - 993.57s |  I'm gonna do is I'll simply have a malicious extension installed and what
993.57s - 997.53s |  it's gonna do is that in the background it's gonna log into your GitHub account
997.53s - 1001.69s |  because extensions have a highly privileged so they have access to all
1001.69s - 1006.49s |  HTTP only cookies as well. And if you're doing it from your service worker that
1006.49s - 1010.29s |  is from your background you don't even have to ask for explicit permission for
1010.29s - 1013.85s |  accessing cookie as well. If you're simply making a fetch call instead of
1013.85s - 1019.89s |  you know just getting the cookie value. So in this demo we can see that we have
1019.89s - 1027.00s |  a demo GitHub account and I have a private repo here. In this private repo
1027.00s - 1032.56s |  if we go to the settings and look at the collaborators right now there are no
1032.56s - 1037.60s |  additional collaborators in this repo. Now what I'll do is I'll simply go and
1037.60s - 1045.21s |  start the malicious extension. Now if you see nothing really happened and for a
1045.21s - 1050.33s |  very small moment a small tab just open and closed automatically. Now if I go
1050.33s - 1057.42s |  back and check that specific repo back again go to the settings and see
1057.42s - 1063.04s |  who all are the collaborators. Then I will see that there's one more
1063.04s - 1068.64s |  collaborator added here now. So this just shows you know how how sneaky they can
1068.64s - 1073.76s |  be and they can actually also take over your private repos. And and the best way
1073.76s - 1077.20s |  to think about it is think about any form of browser automation with things
1077.20s - 1081.44s |  like Selenium which some of you may have done. With an extension it can just do
1081.44s - 1085.76s |  literally everything in the background, act on your behalf, go through complex
1085.76s - 1090.60s |  workflows, anything the you know author would have probably baked into it. And
1090.60s - 1095.16s |  some of these can just download at payloads and happen at runtime. Doesn't
1095.16s - 1101.20s |  need to be at you know extension compile or upload time to the Chrome store. Yeah
1101.20s - 1105.16s |  now we look at one more which is interference with password managers. So
1105.16s - 1109.32s |  many people often use extensions for you know using saving their password and
1109.32s - 1113.28s |  using them. So actually other malicious extension can interfere with that as
1113.28s - 1119.60s |  well. So in this example we can see that a user is using one of the password
1119.60s - 1124.28s |  manager vendors. And if you go to let's say a random SaaS application where you
1124.28s - 1128.96s |  were already using that specific password manager. We can see that the
1128.96s - 1133.60s |  password manager works and a person is you know able to log in normally how
1133.60s - 1140.08s |  it's supposed to be. However the moment if we go back and enable the malicious
1140.08s - 1144.96s |  extension, what this extension will do is that it will override what the default
1144.96s - 1149.60s |  action of clicking on that icon was. So if we can see here it's still the
1149.60s - 1154.44s |  password managers icon but the moment I click on this it will take me to another
1154.44s - 1159.48s |  login page. So for the test purpose and for demonstration we have just named our
1159.48s - 1163.96s |  extension with a malware word so that you know that this page is actually you
1163.96s - 1168.36s |  know a fake one. But you know looking at the URL you can't really figure that out.
1168.36s - 1172.62s |  So here a person will then you know saying that they might have logged out
1172.62s - 1176.76s |  of their password manager and they will end up ending the credentials. And the
1176.76s - 1182.92s |  moment they do that they will get phished. So you run out of time. I think
1182.92s - 1186.56s |  if you're interested all the source code everything we have here you can go to
1186.56s - 1192.08s |  sqrx.com. We put all of that up. We also put up a much more detailed video. We
1192.08s - 1198.28s |  only got 20 minutes. We have a lot of research. Now the key summary is even
1198.28s - 1202.08s |  known extensions on the Chrome store get bought out all the time. And what
1202.08s - 1205.16s |  attackers have started doing is if an extension has a hundred thousand
1205.16s - 1209.20s |  installs they just offer ten thousand dollars to the author and they can
1209.20s - 1214.96s |  transfer over ownership. And that means you know extensions you trusted could
1214.96s - 1219.08s |  now automatically be untrusted. And a bunch of other supply chain attacks
1219.08s - 1222.56s |  which can kind of happen in the context of the Chrome store right. Thank you so
1222.56s - 1228.64s |  much and yeah please visit sqrx.com for more. Thank you.


url: https://www.youtube.com/watch?v=Cxrwpij2MSQ
title: DEF CON 32 - SBOMs the Hard Way Hacking Bob the Minion - Larry Pesce
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=Cxrwpij2MSQ",
  "title": "DEF CON 32 - SBOMs the Hard Way  Hacking Bob the Minion - Larry Pesce",
  "description": "This presentation delves into the intricate process of generating a Software Bill of Materials (SBOM) for the Bob the Minions WiFi router by Davolink\u2014a device whose firmware isn't publicly available. Traditional SBOM creation methods rely on readily accessible firmware, but Davolink's restricted release policies necessitated an unconventional approach. This talk covers the step-by-step journey of hardware disassembly, firmware extraction via SPI flash and JTAG/SWD interfaces, and the tools and techniques employed. Finally, we'll demonstrate how the recovered firmware is used to generate a comprehensive SBOM, highlighting any security vulnerabilities discovered and reported to the vendor. This session aims to provide attendees with practical insights into overcoming SBOM generation challenges in the IoT domain through hands-on hardware hacking, and leveraging the firmware and SBOMs for vulnerability discovery, as well as security improvement.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1254,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.08s | This text was transcribed using whisper model: large-v2

 Alright, let's get started. We're running a little late. So I'm going to try not to talk too fast.
4.72s - 11.44s |  But I got to make up some time here. So welcome to s bombs the hard way. For my adventures in
11.44s - 17.28s |  hacking Bob the Minion. I am the product security research and analysis director and services team
17.28s - 24.24s |  lead at a fun company called finite state. And we do all sorts of fun stuff with s bombs, and a
24.24s - 27.84s |  whole bunch of other stuff. But I'm not here to talk to you about our product or any of that I'm
27.84s - 36.96s |  talking about my adventure with Bob. Alright, so who am I? I am a reformed penetration tester
36.96s - 43.36s |  and reformed crossed out. I left doing penetration testing to go do some thought leadership and some
43.36s - 48.72s |  other hardware hacking and IoT bunch of stuff. And three months into the job, my boss came to
48.72s - 51.84s |  me and said, Hey, we have a customer that wants to throw a lot of money at us to do pen tests.
51.84s - 57.28s |  Can you do it? Are you signing my paycheck? Yes, I can do that. So I am a reformed penetration
57.28s - 65.12s |  tester back doing penetration testing back in ot ICS, IoT, and lots of hardware. I'm also the
65.12s - 71.36s |  co host of Paul's security weekly. We're in our 19th year soon to go into our 20th year of a
71.36s - 78.64s |  weekly security podcast. How many of your listeners? Go listen. Right. Awesome. Thank you.
79.76s - 86.48s |  I do a lot of work with sans. I'm both an instructor and a course author around wireless
86.48s - 93.60s |  hacking and IoT hacking irony, the ironically, I'm a recent convert to the Oxford comma, because
93.60s - 99.44s |  commas save lives, folks. Okay. And someone said, Why are you been using that Oxford comma for a
99.44s - 103.68s |  really long time? So you're really not a recent convert. So but I'm going to keep it. So I'll add
103.68s - 110.40s |  that. I also enjoy long walks on the beach weighed down by my ham radio. Yeah, prepping for the
110.40s - 116.16s |  zombie apocalypse. Okay. Alright, so let's get into some fun, fun bits here. So we're going to
116.16s - 125.12s |  hack Bob the minion. So on every one of my slides, except this one features AI generated art
126.00s - 133.36s |  with minions. So let's get into character a little bit here. And I took this image of my headshot
133.36s - 141.28s |  and fed fed it to mid journey so that I could become an evil, despicable me villain. So
142.24s - 149.20s |  here we go. This is some of this art is terrifying. And I kept the ones that were insane just because
149.20s - 156.48s |  insanity. I didn't know yesterday that there was an AI generated art competition. My I would have
156.48s - 163.28s |  been good at that. Maybe. So I had lots of fun. I think I put more time into the art than the actual
163.28s - 167.20s |  words on this on these slides. Don't get me wrong this. I think the presentation is really good.
167.20s - 173.12s |  You're going to get something from it. Alright, so a little bit of background. I work for company,
173.12s - 179.04s |  we do s bombs and a whole bunch of other stuff. But I really think that s bombs are fun. And that
179.04s - 186.08s |  was sort of my end goal was to get a software bill of materials for Bob the minion. So a little bit
186.08s - 191.52s |  of background. software bill of materials is an inventory of all your software, their versions,
191.68s - 195.68s |  and who wrote it, where it came from, as part of your product security,
196.56s - 202.08s |  sorry, your software supply chain, and can help you do some security. And we're going to start
202.08s - 208.32s |  seeing somewhere around 2025, that every product that connected product that you buy, either at
208.32s - 213.60s |  your company or for your personal consumption, will have an s mom associated with it, and will
213.60s - 217.76s |  be available as part of some of its certification process and being able to be sold into the
217.76s - 223.76s |  marketplace. Specifically, addressing some of those here in the United States are executive
223.76s - 232.56s |  order 14 208. For a lot of stuff going into government and into consumer stuff. 524 B for
232.56s - 239.36s |  the FDA. So any medical device that is being submitted to the FDA for use on humans requires
239.36s - 244.56s |  that an s bomb as part of their submission process and a plan for securing their devices over time
244.56s - 250.32s |  and managing vulnerabilities. And a voluntary program managed by the FCC here in the US,
250.32s - 256.56s |  the cyber Trustmark program, it's kind of like a consumer protection thing so that as a voluntary
256.56s - 262.56s |  program, that companies can submit their devices to the cyber Trustmark program, they can get a
262.56s - 267.76s |  stamp on the box, and that a consumer can have a high degree of confidence that there is some
267.76s - 273.04s |  security in this product baked in, and that they are monitoring for vulnerabilities over time and
273.04s - 277.12s |  issuing some updates with a little barcode that links to a website that gives them an overall
277.12s - 282.08s |  security store score. So while you're standing at Best Buy, you can scan this barcode and go,
282.08s - 287.76s |  oh, this routers got a three for security, and that one's got a nine, nine being better. Yeah,
287.76s - 294.24s |  I'm going to buy the one that's a nine. Cool. The one that is absolutely both fascinating and
294.24s - 303.12s |  terrifying, in my opinion, is the EU Cyber Resiliency Act, or the EU CRA. EU CRA, their
303.12s - 308.72s |  intent in the EU is that they do not want any connected products being sold into the marketplace
308.72s - 314.96s |  that has any vulnerabilities. And they also need to have a process for managing vulnerabilities
314.96s - 319.44s |  and patching and monitoring and all this type of stuff. And an s bomb will be included as part of
319.44s - 325.60s |  that process. And they are significantly more stringent, and this is not a voluntary program.
326.32s - 330.96s |  It's mandatory if you want to sell into Europe, and companies that sell into the US also sell
330.96s - 338.00s |  into Europe, same device. So many manufacturers are going to have to submit to EU CRA, which means
338.80s - 344.56s |  everywhere on the planet will largely benefit from those regulations. Overall, some general
344.56s - 350.08s |  benefits outside of any of the regulatory stuff for software bill materials, they give us that
350.08s - 356.08s |  software inventory list for both both first and third party stuff that you're developing and stuff
356.08s - 361.12s |  that you've pulled in as part of your development process, and even into potential final firmware
361.12s - 366.72s |  that you're delivering to your customers or you are consuming. With that list of those components
366.72s - 372.56s |  and their versions, you can perform some enrichment on those find out whether there are vulnerabilities
372.56s - 378.16s |  associated with those products so that you can then attempt to perform some risk mitigation and
378.16s - 383.44s |  observe that some of that risk exists and take appropriate actions. And I'll also argue that
383.44s - 389.20s |  you should be operationalizing your s bombs as either a consumer or a manufacturer, that you
389.20s - 394.80s |  should take the software bill of materials and use them as part of your security process and your
394.80s - 400.24s |  penetration testing process. Because knowing the components may give you an opportunity
400.88s - 405.44s |  to improve that security knowing that their vulnerabilities exist. And that was the subject
405.44s - 411.20s |  of my talk that I did at RSA entitled s bombs for evil. So you can go check that out as well. So we
411.20s - 418.72s |  won't go too far into that. So as part of my day job, and as part of being a reformed unreformed
418.72s - 425.28s |  penetration tester, I really love software bill of materials. And some of the fun stuff that I get to
425.28s - 434.80s |  do at work is go find some random device, get the firmware and bacon, get an s bomb for it just to
434.80s - 439.04s |  see what they're see if we can do some accurate detection helps build build some of the things
439.04s - 443.52s |  that we're detecting for helps improve our product. And quite honestly, I think it's really fun and
443.52s - 449.52s |  find all sorts of sort of scary things. So getting that firmware doing some extraction, verifying that
449.52s - 454.96s |  the extraction is accurate for our product, figuring out all new things, going back and
454.96s - 461.12s |  reinverse engineering some binaries to figure out the type of code and the code vulnerables.
461.92s - 466.08s |  And as a result of that s bomb being able to discover that there's a product with a firmware
466.08s - 472.16s |  that has some known vulnerabilities and known is here in air quotes, and that it's known to the
472.16s - 477.28s |  community that these components have vulnerabilities, but maybe as a consumer, or maybe even
477.28s - 481.68s |  as a manufacturer, you may not realize that these components have vulnerabilities, and they're using
481.68s - 487.52s |  them in your, your products. So occasionally, we get to find some some oday and some other
487.52s - 493.92s |  occasional hackery and discovering some surprises. And we may have some surprises here with Bob the
493.92s - 500.88s |  minion. And arguably, it might not be all that surprising. After all, ultimately, I think the end
500.88s - 507.12s |  result is so much fun, and arguably, I get to come talk to you about it at DEF CON. So finding all of
507.12s - 517.68s |  those weird products, suddenly, a wild Bob appears. And yes, AI generated Bob in a dystopian future,
518.40s - 522.88s |  and hasn't shaved in a little bit. He might look a little bit like me, I'm kind of disturbed about
522.88s - 531.60s |  that. So suddenly, a wild Bob appears. So what is this Bob? This Bob is a wireless home router,
531.60s - 540.24s |  the DavoLink AX1800. And it has been licensed by Universal for DavoLink to produce these
540.24s - 547.20s |  wireless routers that are in the shape of Bob. It's a nice plastic fun looking case around a
547.20s - 552.64s |  wireless router for your home. It's like that's pretty cool. Pretty darn good features for the
552.64s - 561.84s |  price. Bob has Wi Fi six has some easy mesh support and supports WPA3. So some of our latest
561.84s - 568.32s |  Wi Fi standards for for your home. Now I've been doing some hardware hacking around consumer
568.32s - 575.04s |  routers for a really, really long time. And it was typical that we were seeing devices with flash
575.04s - 581.12s |  and RAM of somewhere between four and eight megs, maybe 16. Yeah, we've come a long way. This
581.12s - 590.40s |  particular one has, according to the box, and Amazon 128 megs of flash, and 256 megs of RAM.
590.40s - 596.88s |  That's pretty darn robust and compared to some of the stuff that I've seen in the past. But it gets
596.88s - 602.88s |  better. It's not 128 megs of flash, we'll see that in a little bit here. Currently, there's no open
602.88s - 608.48s |  word support. So it is their own custom firmware, big thumbs down from Mick down front here. And
608.48s - 614.08s |  they run about $70 on Amazon. So I didn't feel too bad about buying one of these things and
614.08s - 621.12s |  ripping Bob's head off to see what was inside. I did not purchase the Kevin variety, the Kevin
621.12s - 627.20s |  variety is a little bit taller. And one of the upgrades there is it does have Wi Fi 6E. So into
627.20s - 632.48s |  the six gigahertz range, but they're about double the price. And well, this is coming out of my own
632.48s - 637.68s |  personal budget. So I went for the cheap one, right? I figured that many of the challenges will
637.68s - 645.04s |  probably be the same here. Alright, so, hey, I want firmware, right for these devices. So I can
645.04s - 652.00s |  generate some as moms. Let's go get the firmware. But you tip my hat a little bit here. What
652.00s - 659.84s |  firmware? All right. Unfortunately, I wasn't able to easily locate firmware for the devil. Inc. x
659.84s - 667.04s |  1800. We powered the device up, used it figured out what all the interface was about logged in.
667.68s - 671.28s |  Take a look at the web interface. And sure enough, in the web interface, there is a button that says
671.28s - 676.24s |  check for updates. And as of two weeks ago, when I press the check for updates button,
677.44s - 682.72s |  there were no updates. There is one version of firmware for this device, the one that came on it
682.72s - 688.80s |  from the factory, which will be terrifying when we see this a little bit later. So there's one
688.80s - 693.92s |  version firmware, it is what it is, there's no updates, which means if I click the update button,
693.92s - 699.84s |  there's no firmware, which means I can't capture anything off the wire. They can't get anything
699.84s - 704.08s |  via web inspection or TCP dump or any of that type of stuff to try to recover the firmware
704.08s - 712.24s |  from network traffic. Oh, I'll go to the website. Nope, nothing on their website, you go to their
712.24s - 718.00s |  support forums, you go to their support pages. Absolutely no firmware for the x 1800 available
718.00s - 724.72s |  for download, there's manuals and stuff. But no firmware. So what happens if I break it by
724.72s - 728.80s |  accident, I'd have no way to upload firmware to this because the manufacturer doesn't even make
728.80s - 733.76s |  it available. I checked the support forums to see if I could find links somewhere in the support
733.76s - 740.64s |  forums. And that was a mess. It's dabbling is a Korean company, they have two different support
740.64s - 747.84s |  forums. One is in Korean, one is in English. The English has a little bit more population to it.
748.48s - 753.44s |  In that more folks have asked some questions. The Korean version of the support forums,
754.16s - 759.68s |  there's like three posts, and that's it. Clearly, Korea was not their intended market for these
759.68s - 765.60s |  devices. And Google Translate had a really easy time trying to go through and translate that stuff
765.60s - 771.60s |  because there wasn't a wasn't a lot there. search through all of the support forum posts, there are
771.60s - 776.08s |  no links to firmware, there's nobody even asking, Hey, I bricked my router, can I get a copy of the
776.08s - 781.36s |  firmware? So that I could reach out to them and try to ask them for it or try that same guys.
782.64s - 788.72s |  And no, so nobody was asking and nobody was offering. Unfortunately, now that means with
788.72s - 795.20s |  no ready access to the firmware, we've got to go do this the hard way. And no access ready access
795.20s - 801.84s |  to firmware. That means no wrong way. That means no, no S bomb, no enrichment, no ability for me
801.84s - 806.08s |  to figure out if there are vulnerabilities in this really easily, based on software components,
806.08s - 814.72s |  and so forth. So but no s bombs means no fun. Right? I love some of this stuff. I really want
814.72s - 822.80s |  I tried to make this image like the dystopian future dark gray. And the training for the AI
822.80s - 827.36s |  models at mid journey was not picking up that I wanted this to be dirty and gritty, no matter how
827.36s - 833.36s |  many times I told it and it came out really happy and bright and green and very cartoony for all
833.36s - 840.72s |  these dogs. No, I wanted like, like wolves that were gonna tear Bob's head off. And now there's
840.72s - 848.08s |  some nice puppies here. So I did the best I could. All right. But so if we can't get ready access to
848.08s - 854.00s |  it, we got to go about this do this hard way. And while brain surgery is fun, right? Yeah, just ask
854.72s - 858.32s |  buckaroo bonsai adventures of buckaroo bonsai in the eighth dimension.
858.88s - 864.72s |  Hey, this was how some of this AI prompt ended up. I told mid journey that I wanted Bob the
864.72s - 870.64s |  minion to go undergo brain surgery by buckaroo bonsai. Have the surgeon be buckaroo bonsai.
871.20s - 878.24s |  Unfortunately, it actually crossed Peter Weller with a minion and came up with this abomination.
878.88s - 885.84s |  It's quite amazing. Like this is the best of them. The other ones were just downright terrible.
887.04s - 892.32s |  Also, if you've never seen buckaroo, the adventures of buckaroo bonsai in the eighth dimension,
892.32s - 898.00s |  I highly recommend that you do so it is a 1980s very campy film with some really amazing stars.
899.04s - 905.28s |  Peter Weller, John Lithgow, a whole host of folks and it's it's amazingly campy and maybe one for
905.28s - 911.84s |  Jeff Moss to send a hacker movie night because it's it's hilarious and it's great. It's on the
911.84s - 919.12s |  what the top 1000 movies you should see before you die and like number 43 in some of the campy
919.12s - 927.36s |  sci fi movies, top lists and so forth. So my plug and note that Bob doesn't even have yellow ears
927.36s - 931.76s |  in this one. They're apparently Peter Weller's ears. Not only did they do a brain transplant,
931.76s - 935.92s |  they didn't hear transplant to. Alright, so let's get to this brain surgery.
937.28s - 942.56s |  Alright, take this thing apart. We do this the hard way. Pull the boards out, do an inventory,
942.56s - 949.12s |  take pictures of all the chips. Let's do some some analysis and figure out some of the spec
949.12s - 953.44s |  sheets, go download those and then start figuring out how we can get access to that firmware.
954.32s - 958.56s |  Are there serial ports available on the board? Yes, yes. In this case, there is I did not go
958.56s - 965.84s |  that route. However, can we use JTAG or SWD to dump firmware from from the device from that bus?
966.64s - 970.72s |  I fortunately did not have to go down that road either, because that is arguably the harder.
971.92s - 979.60s |  But what about SPI? And being able to grab that from there? The first question was looking at
979.60s - 987.04s |  the processor. It's an RTL 8198 D featured here in this slide. And I figured I was probably going
987.04s - 992.16s |  to have to go use JTAG have the processor with internal memory and have to dump it from internal
992.16s - 1003.84s |  memory and so forth, but not so much. But what I did find on the board was a Winbond W25N01GV,
1004.64s - 1016.88s |  which is a three volt one gigabit flash chip. But they said 128 Meg. No one gigabit available on
1016.88s - 1021.60s |  this board. And they're only using 128 megabit according to what they're saying. Yeah, so there's
1021.60s - 1028.48s |  a lot more room on this. Yeah, why? I don't know. Because they're cheap. Honestly. Ask me how I know
1028.48s - 1036.64s |  this. We'll see this in a little bit here. So SPI, and it is NAND. So alright, this will be
1036.64s - 1043.68s |  interesting. And apparently Bob is really hungry for some chips. Alright, so I had to go now get
1043.68s - 1050.64s |  this flash off of this Winbond SPI flash chip. And there was very much of progression of frustration
1050.64s - 1057.20s |  going through going through this. So this is what society thinks I do when I remove firmware from a
1057.20s - 1065.44s |  chip. Credit to Wired and IBM here, sorry, Intel, in some of their photographs about doing some
1065.44s - 1069.44s |  really great work with a microscope and all sorts of fun stuff. And you'll note, I'm sort of
1069.44s - 1074.24s |  featured down here in the right hand corner, looking very studious and doing a really great
1074.24s - 1081.84s |  job of removing firmware and what society thinks I do. This is what my friends think I do using the
1081.84s - 1087.84s |  PC bytes. And I'm starting to look a lot worse and maybe a little bit nerdier and geekier. And
1087.84s - 1093.04s |  yes, this is my disaster of a desk and home office. And you get to see also other other fun
1093.04s - 1097.76s |  stuff in the background. So this is what my friends think I do. Right, Mick? Yeah. All right.
1098.72s - 1104.48s |  This is what I think I do. This is also one of my attempts, soldering wires directly to the
1104.56s - 1113.20s |  flash chip and then holding it down with some tape. This didn't work either. Okay. So I'm
1113.20s - 1119.36s |  getting worse and worse in my my studiousness here. And ultimately, this is what I really did.
1120.64s - 1125.60s |  I now look like a really big goober. And I actually had to remove the chip from the board
1125.60s - 1132.72s |  and put it in like a $3 adapter from Amazon and use some some DuPont wires and attach it to a
1132.72s - 1140.56s |  Raspberry Pi and use that IO on the board for the Raspberry Pi. Yeah, and just reuse the PC bytes
1140.56s - 1145.28s |  thing to hold my Raspberry Pi because I was too lazy to take it off my desk. So yeah, I actually
1145.28s - 1149.60s |  had to do take the chip off of the board because I couldn't get any of the other stuff to work
1149.60s - 1154.24s |  right. And it may not have been the fact that there was anything wrong with my PC bytes or
1154.24s - 1162.00s |  with my solder job. But I do know that I bricked the one that I did the solder job to no longer
1162.00s - 1169.12s |  functions. And we'll see why that maybe it wasn't actually the PC bytes or my solder job that
1169.12s - 1177.60s |  wasn't allowing me to get access to the stuff. I see I thought I had an hour. Okay, I will I'll
1177.60s - 1182.00s |  get out of your head here. What's a I'm going to do these slides real quick here what I really did.
1183.52s - 1188.56s |  Not a lot of flash ROM or support found some stuff. I got a dump found some treasure,
1188.56s - 1193.92s |  lots of exploits, lots of exploit intelligence, lots of remote code vulnerabilities,
1195.52s - 1201.36s |  passwords, username, Bob password, Bob, other stuff in Korean language, some key material,
1202.40s - 1207.76s |  a horrible web app that they wrote their own web server with some possible command injection via
1207.76s - 1215.04s |  the password reset function, a bunch of scripts going to IP in China, all sorts of other fun
1215.04s - 1219.76s |  stuff. And I really want to do the brain transplant to fix the one that I broke. And I've
1219.76s - 1224.72s |  had no luck. I spent a week on the struggle bus with that, because the Nan support that I needed
1224.72s - 1232.08s |  has no right support. So coming soon. All right. I'm out of here. I'm gonna if you want to catch
1232.08s - 1236.64s |  me in the back or over in the IT village, I'm happy to do some more. But I want to say thank
1236.64s - 1241.92s |  you and a big thank you to my co worker Edwin shuttleworth, who is all now so now a minion as
1241.92s - 1246.88s |  well. So thank you very much. And apologies for taking an extra moment of your time. And I'll see
1246.88s - 1249.92s |  you over at the IoT village. We'll be right up front here. If you've got any questions,
1249.92s - 1253.44s |  and you want to see some more of these slides and some of the URLs.


url: https://www.youtube.com/watch?v=PZfM1ehcfmU
title: DEF CON 32 - Pick Your Poison: Navigating a secure clean energy transition - Emma Stewart
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=PZfM1ehcfmU",
  "title": "DEF CON 32 - Pick Your Poison: Navigating a secure clean energy transition - Emma Stewart",
  "description": "Clean Energy technology, while essential for the energy transition, often utilizes components sourced from adversarial countries, potentially increasing cyber vulnerabilities, especially in systems managed by smaller utilities with limited cybersecurity expertise. The previous approaches of 'rip and replace' to eliminate foreign components have proved inadequate and if applied to clean energy, may be economically and technically destabilizing.\n\nThis policy session will also delve into the broader implications of a digitalized supply chain, where simplistic views of cybersecurity do not suffice. Instead, a nuanced understanding of the operational and physical realities of energy systems is essential. By discussing how to balance immediate economic pressures against long-term sustainability and security, the session aims to foster a more informed and effective policy discourse.\n\nIn summary, as the energy sector evolves to include diverse infrastructure systems\u2014ranging from hospitals to military installations\u2014the need for a robust, informed, and agile policy approach to cybersecurity becomes increasingly critical. This session will provide a platform for critical discourse to ensure that the transition to renewable energy is both secure and sustainable, aligning climate goals with national security imperatives",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1845,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.24s | This text was transcribed using whisper model: large-v2

 Hi everybody, thanks for joining me today.
2.24s - 4.12s |  Oh, that was loud, I'm sorry.
4.12s - 5.52s |  Thanks for joining me today.
6.52s - 7.44s |  My name's Emma Stewart.
7.44s - 9.28s |  I'm a Chief Power Grid Scientist
9.28s - 11.48s |  at Idaho National Laboratory.
11.48s - 13.36s |  I've spent about the last 20 years
13.36s - 16.76s |  working on power grid narrowed stuff effectively.
16.76s - 19.44s |  I've done everything from essentially
19.44s - 23.32s |  working on poles and wires about 20 something years ago
23.32s - 26.20s |  up to now where I like to be called Doctor
26.20s - 29.84s |  and it's kind of cool, but I do all sorts of things.
29.84s - 33.00s |  I've worked as a Chief Scientist for 900 utilities.
33.00s - 37.64s |  I built a cyber program for all of the small
37.64s - 40.40s |  rural co-ops in the country.
40.40s - 42.40s |  But the last few years I've been working
42.40s - 43.76s |  mostly on renewable security
43.76s - 45.68s |  and that's what I'm gonna talk about today.
45.68s - 48.80s |  So just very briefly, I'll start here.
48.80s - 52.04s |  We are in the middle of various different crises.
52.04s - 54.72s |  Essentially the climate has been changing
54.72s - 56.76s |  and in the last few years we've had,
56.76s - 59.72s |  I believe a number of now $10 billion weather
60.60s - 61.64s |  events that are causing all sorts of havoc
61.64s - 64.56s |  around the country, especially in our power grid
64.56s - 66.76s |  in particular because things fall down in weather.
66.76s - 68.52s |  As much as everyone wants to think cyber
68.52s - 69.96s |  is probably the worst problem we have,
69.96s - 71.32s |  it's not, it's weather.
71.32s - 74.60s |  It knocks things down far more often than any of you do.
74.60s - 78.96s |  So yeah, that's the world.
78.96s - 80.60s |  But this isn't great.
80.60s - 82.08s |  We do need to change this.
82.08s - 84.28s |  The energy sector essentially provides
84.28s - 88.20s |  about 28% of emissions into our atmosphere.
88.24s - 90.04s |  That's helping with this climate change problem.
90.04s - 91.88s |  So we're trying to change that by installing
91.88s - 93.12s |  lots and lots of renewable energy
93.12s - 95.24s |  and transitioning to this more clean,
95.24s - 97.92s |  digital, affordable system also.
97.92s - 100.28s |  But just, I am a power grid person,
100.28s - 101.84s |  so in all of these talks I give a
101.84s - 103.44s |  what is the power grid to everyone.
103.44s - 105.20s |  If you come to one of my power grid talks
105.20s - 108.04s |  at a power conference, you won't hear this part.
108.04s - 111.08s |  But how does the system work and how has it worked?
111.08s - 112.88s |  We've essentially for a very long time
112.88s - 115.56s |  had power that flows from large spinning generators
115.56s - 117.76s |  around the country all the way down
118.24s - 121.76s |  through our large power lines down to small customers,
121.76s - 124.72s |  sub-transmission, primary customers, your houses.
124.72s - 126.92s |  That's been the way it's been for a very long time.
126.92s - 129.16s |  Since the beginning of all power grid time,
129.16s - 130.76s |  it has looked this way.
130.76s - 131.60s |  And that's changing.
131.60s - 133.80s |  We have massive amounts of things happening
133.80s - 136.04s |  to do with energy storage, which is the primary focus
136.04s - 138.08s |  of this discussion today.
138.08s - 140.64s |  We have electric vehicles plugging in everywhere.
140.64s - 142.64s |  We also have things like the cloud.
142.64s - 144.20s |  A lot of the small utilities are trying
144.20s - 146.64s |  to modernize at the moment and their only option
146.68s - 149.72s |  for modernization is actually using cloud-based applications
149.72s - 151.08s |  in lots of places.
151.08s - 154.16s |  They can't install data centers in tiny utilities.
154.16s - 156.20s |  I will say I've seen the convergence
156.20s - 157.20s |  of these things recently.
157.20s - 158.72s |  I was working with a small utility
158.72s - 162.48s |  and they had had a massive tornado come through
162.48s - 164.44s |  that took out one of their operations center
164.44s - 168.44s |  and their data center was effectively Dorothied into a river.
168.44s - 172.08s |  So there's a lot happening together in the power grid
172.08s - 174.60s |  and things there are there, so.
174.60s - 176.44s |  But what does energy transition mean to me
176.44s - 178.60s |  and to a lot of people?
178.60s - 179.96s |  I said big spinning machines
179.96s - 183.00s |  as in these big rotating generators that are there.
183.00s - 184.56s |  They've been there forever.
184.56s - 185.88s |  They're very reliable.
185.88s - 187.44s |  They've been around a long time.
187.44s - 189.84s |  Big spinning metal, effectively.
189.84s - 191.92s |  They've been traditionally manufactured around the country
191.92s - 194.72s |  and most of that has a decent sized U.S. base
194.72s - 196.24s |  for manufacture.
196.24s - 197.92s |  I'll use the spoiler alert here.
197.92s - 200.32s |  As we transition to things like solar storage,
200.32s - 202.68s |  lots of distributed systems,
202.72s - 204.60s |  it's gonna be massive distributed connected
204.60s - 206.76s |  solid state devices all over the place
206.76s - 208.20s |  with lots of numbers of them
208.20s - 209.76s |  where there was one big generator
209.76s - 212.12s |  that now might be 10,000 smaller devices
212.12s - 215.24s |  connected together, providing power to our grid.
215.24s - 218.04s |  And the spoiler alert is with largely Chinese manufacturers.
218.04s - 220.76s |  So most of this is manufactured in China
220.76s - 222.08s |  and that's why I'm talking today.
222.08s - 224.32s |  But if you like the light's been on today,
224.32s - 227.36s |  this is just what this means to you in the room.
227.36s - 229.60s |  The MGM is the biggest solar rooftop
229.60s - 231.24s |  in the world at the moment.
231.24s - 233.52s |  If you can see on top of the MGM,
233.52s - 235.72s |  that's apparently the largest owner of solar
235.72s - 237.36s |  in this area on a rooftop.
237.36s - 239.00s |  It's kind of amazing actually
239.00s - 240.64s |  when you look at the rooftops of Vegas,
240.64s - 242.92s |  you start to see this solar stuff everywhere.
243.88s - 246.32s |  The energy storage is actually wildly useful
246.32s - 247.68s |  just now for us.
247.68s - 250.88s |  Both Texas and California have had major events
250.88s - 253.32s |  that required them to ramp up fast generators
253.32s - 255.08s |  to provide power really quickly.
256.12s - 258.40s |  Both of them, I think it's been around 17 emergency
258.44s - 262.48s |  dispatches of storage generation in California,
262.48s - 264.52s |  I believe in the last couple of years,
264.52s - 266.68s |  meaning a grid operator sitting there going,
266.68s - 268.64s |  we need power really fast,
268.64s - 270.80s |  asking them to do an immediate control action
270.80s - 272.96s |  to discharge all of their power.
272.96s - 274.08s |  That's kind of a big deal.
274.08s - 275.68s |  It's an immediate action that needs to be taken
275.68s - 277.00s |  to stop the lights going off.
277.00s - 279.56s |  So this energy storage has been doing it.
279.56s - 281.68s |  That picture on the right was in Texas,
281.68s - 285.68s |  I believe January this year when a gigawatt of batteries
285.68s - 287.96s |  ramped up to sort of save the day.
288.48s - 289.76s |  And that was a good thing.
290.60s - 293.72s |  But current state of supply, this is a weird graph,
293.72s - 296.84s |  but last year after this conference,
296.84s - 299.32s |  I was at another renewable energy conference
299.32s - 300.16s |  in the same place.
300.16s - 301.88s |  It's the biggest renewable energy conference,
301.88s - 303.12s |  I believe, in the world.
304.24s - 306.16s |  I've worked in renewable energy for a long time
306.16s - 309.56s |  and sort of watched the change of the supply chain here.
309.56s - 312.00s |  Me and one of my other cyber colleagues,
312.00s - 313.84s |  there was only about three of us there,
313.84s - 316.20s |  were walking around the shop floor,
316.20s - 317.48s |  the expo floor as you do,
318.00s - 319.04s |  trying to look at all the gear
319.04s - 321.16s |  and realized that almost everything we were looking at
321.16s - 322.40s |  was a Chinese company.
322.40s - 325.16s |  It wasn't hidden, it wasn't covert,
325.16s - 327.40s |  it wasn't a mysterious component we were finding
327.40s - 329.68s |  in a device in critical infrastructure.
329.68s - 331.52s |  It was straight up people that are,
331.52s - 334.60s |  everyone is from China essentially was at this conference.
334.60s - 336.08s |  And it was kind of a moment of change
336.08s - 337.80s |  where before I would have said,
337.80s - 339.88s |  we've got US manufacturer, we're building this.
339.88s - 341.08s |  And I was kind of looking at it like,
341.08s - 344.64s |  ah, I'm not sure we do and we're not hiding it.
344.64s - 346.24s |  So this is a big challenge.
346.92s - 349.60s |  I used this example here of,
349.60s - 351.84s |  this was what the conference expo floor looked like.
351.84s - 354.16s |  Orange is everything is from China
355.08s - 357.68s |  and every other color is anywhere else.
357.68s - 359.60s |  I think green I'd put in was Germany
359.60s - 362.60s |  and blue is the US manufacturer as well.
362.60s - 366.24s |  So about 95 to 100% of our digital components available
366.24s - 369.96s |  right now have a Chinese made, owned or derived
369.96s - 372.32s |  control or software component in it as well.
372.32s - 374.84s |  So that is where we're at.
374.84s - 377.92s |  But another sort of supply chain event that happened
377.92s - 381.24s |  has been my life for the past two years actually.
381.24s - 386.24s |  In April, 2023, a large military base
386.52s - 389.76s |  announced they were installing and I think commissioning,
389.76s - 392.12s |  the picture on the bottom left is that one,
392.12s - 395.96s |  commissioning their giant new battery on Camp Lejeune.
395.96s - 398.20s |  And basically they took a nice picture
398.20s - 400.12s |  with the command cutting the ribbon
400.12s - 402.40s |  with cattle written behind their head,
402.40s - 405.12s |  which is one of the largest battery manufacturers
405.12s - 407.92s |  in the world who is a Chinese company.
407.92s - 410.40s |  And so given the defense posture that we look at
410.40s - 412.64s |  from components that we're using,
412.64s - 414.80s |  this was definitely a moment of us all looking at the TV
414.80s - 416.68s |  going, why'd you take that selfie?
416.68s - 417.80s |  Come on.
417.80s - 420.12s |  So everyone sort of started to catch on
420.12s - 422.16s |  that this was where we were at.
422.16s - 423.88s |  Again, this led to a series of events
423.88s - 425.76s |  that have been the rest of my life,
425.76s - 428.52s |  which was dealing with there being various,
428.52s - 430.16s |  like we're saying that Chinese hackers
430.16s - 432.44s |  are preparing to attack our infrastructure.
432.44s - 433.28s |  That is known.
434.20s - 437.52s |  Following that, about a year later, this was in December,
437.52s - 439.24s |  the large utility announced
439.24s - 440.92s |  that they were disconnecting that battery
440.92s - 444.20s |  that had been put on Camp Lejeune,
444.20s - 446.28s |  citing there was security concerns with it.
446.28s - 447.52s |  Okay.
447.52s - 451.40s |  But this led to about 10 or 20 utilities in the country
451.40s - 456.28s |  starting to call and say, wait, don't we have those as well?
456.28s - 457.32s |  Are we meant to do something?
457.32s - 459.20s |  And we're like, ah, okay.
459.60s - 460.56s |  I was like, first of all,
460.56s - 462.16s |  can I get that battery for a minute?
462.16s - 463.56s |  And then second, they were like,
463.56s - 465.48s |  everyone was just panicking at this point
465.48s - 467.28s |  that both their boards were yelling at them
467.28s - 470.00s |  and they were concerned from a security perspective
470.00s - 473.48s |  and asking for resources for how are they going to secure
473.48s - 476.12s |  this because they can't get rid of it.
476.12s - 479.40s |  They can't afford to ditch their $10 million investment
479.40s - 481.32s |  and just buy something else.
481.32s - 483.68s |  And even then there wasn't anything else for them to buy.
483.68s - 486.24s |  So a lot of people were calling and panicking
486.24s - 488.32s |  and various things going on.
488.36s - 491.24s |  Then I will say we move on to now.
491.24s - 494.24s |  I believe the largest solar plus storage project
494.24s - 498.40s |  in the world came online about a couple months ago.
498.40s - 501.16s |  It is connected to another military base also.
501.16s - 502.68s |  When they announced this, they were saying,
502.68s - 504.56s |  great, we've got our new batteries here.
504.56s - 506.96s |  And then it was another one of the battery companies
506.96s - 509.72s |  that's listed just now on the banned battery list
509.72s - 512.32s |  on the National Defense Authorization Act.
512.32s - 514.08s |  They announced it in the news though.
514.08s - 516.08s |  So every time I read one of these news stories,
516.08s - 518.00s |  I'm like, but there's a list
518.68s - 519.88s |  and it's written and we're okay.
519.88s - 521.20s |  And then they announced it on the news
521.20s - 522.84s |  and more calls start.
522.84s - 524.00s |  So that's been my life.
524.88s - 527.48s |  The other thing that happened a few years ago,
527.48s - 529.40s |  we obviously banned Huawei.
529.40s - 530.96s |  That was a big deal.
530.96s - 531.96s |  They actually had the market
531.96s - 534.04s |  for various things of equipment.
534.04s - 537.24s |  And about, I think four days ago,
537.24s - 538.76s |  Pentagon officials were announcing
538.76s - 542.20s |  that they would like a waiver from the Huawei ban now
542.20s - 544.40s |  because they can't get rid of the equipment.
544.40s - 547.12s |  So if the Pentagon's asking for the waiver,
547.16s - 550.12s |  rip and replace probably hasn't worked that well for Huawei.
550.12s - 552.68s |  So going the same approach with the batteries
552.68s - 555.88s |  is essentially the policy topic of my talk.
556.92s - 558.36s |  So how'd we get here?
558.36s - 560.20s |  Why did we end up this way?
560.20s - 561.64s |  If you read any news stories,
561.64s - 565.36s |  they try and blame whoever is in leadership right now.
565.36s - 567.40s |  It's always the latest leader's problem
567.40s - 568.88s |  that this has happened.
568.88s - 572.20s |  But we started this probably 10 or 12 years ago.
572.20s - 574.16s |  We prioritized low cost and volume
574.16s - 576.44s |  for solar storage and renewable energy.
576.44s - 577.28s |  It's great.
577.28s - 579.28s |  We needed cheaper products for this to actually happen
579.28s - 580.92s |  because we do need renewable energy.
580.92s - 584.56s |  That's the sort of theme here is we need this to happen.
584.56s - 587.92s |  But how we got there, we prioritized low cost.
587.92s - 589.84s |  That meant we shift a lot of this offshore.
589.84s - 591.08s |  That's just how it happens.
591.08s - 593.64s |  We've started to manufacture it in China.
593.64s - 595.24s |  And then we did get that low cost.
595.24s - 597.92s |  We reached a dollar a watt in 2015, I believe.
597.92s - 600.20s |  And then it's gone down from there.
600.20s - 601.04s |  But now we're at this point,
601.04s - 604.28s |  we just don't really build a lot of this in the US.
604.28s - 605.92s |  We might soon.
605.92s - 608.80s |  But investors need a demand signal.
608.80s - 610.88s |  If we said we're gonna get rid of all the batteries
610.88s - 612.92s |  and we're not gonna do this anymore,
612.92s - 616.04s |  the investors aren't going to invest in new batteries
616.04s - 618.20s |  being built here for another five years.
618.20s - 620.44s |  So what will we do in the interim?
620.44s - 622.00s |  I use this picture on the right.
622.00s - 626.64s |  It was from Bloomberg a few, about four years ago.
626.64s - 627.48s |  It was actually, again,
627.48s - 629.96s |  I love to use media stories as being funny.
629.96s - 631.92s |  But it said basically,
631.92s - 635.36s |  the US is number two in the world on battery manufacture.
635.88s - 638.12s |  They are not that big line, so we're clear.
638.12s - 641.48s |  We are not the large line, that was China.
641.48s - 642.60s |  So we are number two,
642.60s - 645.52s |  but we also lost by about eight laps of this.
645.52s - 647.12s |  So we've got a lot of making up to do
647.12s - 649.56s |  if we want to be competing in here.
649.56s - 652.24s |  Just some quick facts and figures quickly.
652.24s - 654.64s |  Huawei is still the number one inverter
654.64s - 658.36s |  or power conversion manufacturer in the world.
658.36s - 660.60s |  When they exited the market from the US,
660.60s - 661.72s |  they went from number two
661.72s - 664.20s |  to number one in the world somehow.
664.20s - 666.16s |  So that didn't necessarily work.
666.16s - 667.12s |  What makes it different?
667.12s - 669.12s |  Volume and regulation.
669.12s - 672.12s |  There's about 73 named inverter manufacturers.
672.12s - 675.80s |  So when I said we have large spinning generators,
675.80s - 677.44s |  those are generally made by probably
677.44s - 679.88s |  about three or four companies at this point.
679.88s - 681.84s |  When we look at inverters and more particularly
681.84s - 684.40s |  look at vulnerability analysis of inverters,
684.40s - 685.84s |  you've got 73 companies
685.84s - 688.28s |  and about 1,500 different models to look at
688.28s - 691.12s |  that we haven't done that type of analysis on yet.
691.12s - 692.80s |  And that's just now.
692.80s - 694.36s |  If you look at battery vendors as well,
694.36s - 695.84s |  we're in the same place.
695.84s - 697.88s |  There's integrators of these equipment.
697.88s - 699.80s |  A lot of the equipment is actually same hardware,
699.80s - 701.24s |  different label.
701.24s - 703.68s |  Still, we need to do a lot of that analysis.
703.68s - 707.00s |  But the hardware is often similar.
707.00s - 708.44s |  And then we also have features
708.44s - 710.84s |  like remote communication and access as necessary
710.84s - 713.24s |  because if you have lots and lots and lots of devices,
713.24s - 715.48s |  you kind of need them to get updated as well
715.48s - 717.56s |  with all those nice patches that we need all the time.
717.56s - 719.52s |  So remote comms is a big deal.
720.52s - 723.28s |  There are some common challenges we have
723.28s - 725.92s |  in renewable control systems in particular.
725.92s - 727.64s |  They work pretty well just now.
727.64s - 729.56s |  But again, inverters and power electronics,
729.56s - 733.20s |  we see spinning generators last 40, 50 years.
733.20s - 735.16s |  They're mostly older than all of us.
736.16s - 738.68s |  Well, some of us, not looking at anyone else.
738.68s - 741.76s |  But they're mostly older than all of us.
741.76s - 745.48s |  But inverters tend to fail about every 15 years.
745.48s - 747.96s |  So we actually have opportunity to get rid of them
747.96s - 749.56s |  and get new ones eventually.
749.56s - 751.92s |  But they do fail about every 15 years.
751.92s - 753.80s |  Things that cause challenges with them.
753.80s - 754.68s |  Failing chips.
754.68s - 756.76s |  We have chipsets that just don't work very well
756.76s - 758.64s |  in lots of cheap systems.
758.64s - 760.08s |  Persistent communications.
760.08s - 762.08s |  We have to communicate with these devices
762.08s - 762.92s |  for them to work,
762.92s - 765.72s |  but that's obviously a threat or a risk.
765.72s - 768.68s |  Hard-coded passwords are freaking everywhere.
768.68s - 771.64s |  Like, absolutely everywhere.
771.64s - 773.04s |  And we can't, I'll talk why,
773.04s - 775.72s |  but we can't do a ton about that right now.
775.76s - 778.68s |  Operations and maintenance is a fourth-party person
778.68s - 780.04s |  that will come in and do things.
780.04s - 781.96s |  There's white-labeled products.
781.96s - 783.48s |  Insecure applications.
783.48s - 786.20s |  Some of the primary vulnerabilities we've had
786.20s - 788.80s |  in these devices have been app-based.
788.80s - 790.48s |  It's the cool little app you use
790.48s - 792.56s |  to log on to your solar power.
792.56s - 793.88s |  Most of them are kind of junk.
793.88s - 795.96s |  So here we are.
795.96s - 798.00s |  There's not really any software bill of materials
798.00s - 799.08s |  that comes with these things.
799.08s - 799.96s |  And even if it did,
799.96s - 802.56s |  we probably wouldn't trust it at this point.
802.56s - 805.80s |  And again, there's really no vulnerability disclosure
805.80s - 807.52s |  for the devices that are not made
807.52s - 808.84s |  either in the US or Germany.
808.84s - 811.04s |  We just don't have it because they're made in China.
811.04s - 815.80s |  So what's more common in the Chinese-manufactured products?
815.80s - 819.88s |  In particular, apart from the white-labeled products
819.88s - 821.52s |  are not necessarily there.
821.52s - 823.72s |  But these are things that are very, very common
823.72s - 826.56s |  in the products that we're seeing being imported as well.
826.56s - 828.48s |  And that's a challenge.
828.48s - 830.72s |  These things are difficult to fix as well
830.72s - 832.32s |  because a lot of those vulnerabilities,
833.08s - 835.16s |  even if we find them, who's gonna fix them?
835.16s - 837.84s |  So we're kind of in this interesting point.
837.84s - 840.68s |  The hard-coded password thing has been coming up a lot
840.68s - 843.00s |  and it's something we really need to fix.
843.00s - 845.56s |  But the models are a big challenge.
846.52s - 849.20s |  We like to say there have been no events
849.20s - 850.80s |  on renewable energy infrastructure
850.80s - 852.76s |  that have caused the power to go out.
852.76s - 854.40s |  So there have been no cyber events
854.40s - 855.64s |  that have caused a power outage.
855.64s - 856.48s |  There have been events
856.48s - 858.20s |  that have caused a communications outage
858.20s - 861.44s |  or denial of service on communications
861.44s - 863.52s |  or loss of visibility.
863.52s - 865.80s |  There's also been a number of ransomware events
865.80s - 868.56s |  starting all the way back in 2014.
868.56s - 871.60s |  There's been a number of sort of ransomware,
871.60s - 874.40s |  different wind turbine events also.
874.40s - 876.24s |  Again, ransomware is bad,
876.24s - 878.60s |  but it's not necessarily turned the power off.
878.60s - 881.08s |  Nobody hit the big red button.
881.08s - 883.16s |  Some of the more interesting ones in the US,
883.16s - 886.08s |  there was a company that had a denial of service attack
886.08s - 888.60s |  in 2019 there in Utah.
888.60s - 891.20s |  Very, very large manufacturer
891.20s - 893.48s |  or sort of very large owner of wind power.
893.48s - 895.12s |  They had a denial of service attack
895.12s - 896.68s |  that essentially took down comms.
896.68s - 898.44s |  They couldn't see it.
898.44s - 899.96s |  When you lose comms to renewable energy,
899.96s - 901.96s |  most things will stay online.
901.96s - 903.64s |  They won't necessarily fail,
903.64s - 905.12s |  but over time they will start to fail.
905.12s - 907.20s |  So you do still need to get that back.
907.20s - 908.66s |  These things are happening.
908.66s - 909.90s |  We do have challenges.
911.36s - 914.08s |  But some key points from a policy perspective,
914.08s - 915.68s |  we've put a lot of responsibility
915.68s - 918.60s |  for securing these devices on the average consumer.
918.60s - 920.24s |  So if you have an inverter
920.24s - 922.00s |  or solar installation in your house
922.00s - 923.70s |  or battery installation,
923.70s - 924.88s |  generally you're the consumer
924.88s - 927.68s |  or you're the one responsible for updating the system.
927.68s - 929.80s |  We're also putting them everywhere.
929.80s - 931.84s |  The example here, we are putting them on
931.84s - 935.04s |  lots of low income and disadvantaged community locations,
935.04s - 937.08s |  multifamily housing.
937.08s - 937.92s |  That's a challenge.
937.92s - 938.88s |  Who's gonna update that?
938.88s - 940.04s |  Who's in charge of it?
940.04s - 940.88s |  Who's doing that?
940.88s - 943.16s |  We're saying this is to help people with their energy bills,
943.16s - 944.94s |  but we're also then giving them products
944.98s - 947.26s |  that potentially have security vulnerabilities
947.26s - 949.10s |  that cause them more challenges.
949.10s - 951.44s |  But we put the responsibility on the consumer,
951.44s - 955.18s |  whether these devices have one or 92 vulnerabilities in them,
955.18s - 956.46s |  the person that's updating it
956.46s - 958.74s |  is the person standing beside it that owns it,
958.74s - 961.66s |  not necessarily the company connecting to it,
961.66s - 963.90s |  but they're responsible for securing these devices
963.90s - 966.38s |  because when there was an end phase
966.38s - 970.70s |  had a pretty bad vulnerability that came out
970.70s - 973.10s |  and in the instructions of how to fix it,
973.10s - 974.78s |  it was essentially the consumers need to go
975.62s - 976.46s |  and do something and reboot it.
976.46s - 978.10s |  So it was a very long list of things
978.10s - 980.46s |  that we were expecting, say, Joe down the road to do.
980.46s - 981.84s |  No offense, Joe's in the room.
981.84s - 983.78s |  There's like 14 of them.
983.78s - 985.30s |  But we're expecting someone down the road
985.30s - 986.30s |  to go and fix all of that.
986.30s - 988.06s |  And reading the analysis that came out,
988.06s - 990.98s |  I was like, eh, I'm not sure anyone's gonna touch that.
990.98s - 992.26s |  I think that's just gonna go
992.26s - 994.10s |  and everyone's gonna leave it alone.
995.30s - 996.98s |  But I talked a lot about
996.98s - 999.04s |  sort of what the IT level attacks look like,
999.04s - 1001.24s |  but the industrial control system landscape
1001.24s - 1002.94s |  for a supply chain style attack
1002.98s - 1005.66s |  looks a lot more like what happened with SolarWinds.
1005.66s - 1008.46s |  I made these slides before CrowdStrike, so we're clear.
1008.46s - 1013.22s |  But it looks a lot like what happened with SolarWinds.
1013.22s - 1016.50s |  Like pushing out mass firmware to these devices
1016.50s - 1018.46s |  is actually a pretty useful feature.
1018.46s - 1020.88s |  I mentioned the customer's responsible.
1020.88s - 1022.46s |  Pushing it out to millions of devices
1022.46s - 1023.94s |  is actually pretty useful.
1023.94s - 1025.58s |  It's had problems.
1025.58s - 1028.74s |  There was a mass push out to an island
1028.74s - 1030.70s |  of a lot of inverters that came out.
1030.70s - 1032.02s |  They pushed a firmware device out
1032.02s - 1034.02s |  and everything stopped working for a minute.
1034.02s - 1035.10s |  That wasn't great.
1036.06s - 1038.62s |  But software events have happened.
1038.62s - 1041.70s |  When there was an event in California recently,
1041.70s - 1043.54s |  the batteries weren't working properly
1043.54s - 1045.86s |  during a heat event, effectively.
1045.86s - 1047.26s |  One of the things they did to fix it
1047.26s - 1048.50s |  was a hot software fix,
1048.50s - 1050.10s |  where they pushed out a new software
1050.10s - 1051.14s |  to the device immediately
1051.14s - 1052.94s |  and got it to start responding properly
1052.94s - 1054.46s |  and start working again.
1054.46s - 1057.66s |  Great, but that is also a potential vector
1057.66s - 1060.06s |  for problems to come, as we all now know.
1061.06s - 1062.66s |  But like I said, technically,
1062.66s - 1064.86s |  what makes them a risk is a benefit.
1064.86s - 1068.42s |  The other issue on our battery and inverter supply chain
1068.42s - 1072.34s |  is that the batteries are actually getting better over time.
1072.34s - 1075.74s |  So we don't really make them here, like I've said,
1075.74s - 1077.14s |  but they're getting better.
1077.14s - 1078.26s |  That's the problem.
1078.26s - 1080.66s |  If we look at quality of the batteries over time,
1080.66s - 1082.78s |  if we look at the fires that have happened,
1082.78s - 1084.10s |  they're pretty well-published.
1084.10s - 1086.06s |  There's a number of fires,
1086.06s - 1087.70s |  thermal runaways when batteries
1087.70s - 1089.54s |  just go out of control and fire,
1089.94s - 1092.54s |  potentially, is an electrochemical reaction.
1092.54s - 1094.50s |  There's been less, if we look at all the data
1094.50s - 1095.94s |  that's been collected.
1095.94s - 1097.62s |  I think it's since 2018
1097.62s - 1099.86s |  that's decreased drastically, actually.
1099.86s - 1101.34s |  Partially, that's because,
1101.34s - 1104.38s |  and there's been some news on this recently,
1104.38s - 1106.78s |  Chinese companies have put lots and lots of money
1106.78s - 1109.06s |  into improving the quality of their products.
1109.06s - 1111.56s |  People are being educated in doing that.
1111.56s - 1113.64s |  They also collect data from all of these.
1113.64s - 1116.10s |  We like to say that you shouldn't be communicating
1116.10s - 1117.74s |  with that, but they do collect data
1117.78s - 1119.70s |  from all of the devices
1119.70s - 1121.38s |  and look at the quality over time.
1121.38s - 1122.38s |  What that actually means is
1122.38s - 1124.98s |  there's a secondary communication device, for one,
1124.98s - 1127.90s |  but also that they are improving their product.
1127.90s - 1129.50s |  If we were actually looking to get rid
1129.50s - 1131.36s |  of these batteries entirely,
1131.36s - 1132.94s |  the only thing that's really gonna happen
1132.94s - 1135.50s |  is these companies will go to a cheaper
1135.50s - 1138.22s |  battery manufacturer or somebody else
1138.22s - 1139.28s |  that's not on this list
1139.28s - 1141.38s |  and end up potentially with more fires
1141.38s - 1144.34s |  because they've not put as much money into it.
1144.34s - 1145.86s |  We're kind of in this catch-22,
1145.86s - 1147.10s |  just now of damned if we do,
1147.10s - 1148.70s |  damned if we don't, one way or the other,
1148.70s - 1150.38s |  and that's today.
1150.38s - 1152.34s |  So what, who cares?
1152.34s - 1154.28s |  We are dependent on these.
1154.28s - 1157.38s |  There's some bad, bad, there's bad communications,
1157.38s - 1161.90s |  hard-coded passwords, and questionable software
1161.90s - 1164.10s |  used to update things.
1164.10s - 1166.66s |  There's an over-concentration of Chinese products.
1166.66s - 1168.14s |  It's a global issue.
1168.14s - 1170.26s |  I don't necessarily think if anyone was targeting
1170.26s - 1171.54s |  one particular supply chain,
1171.54s - 1173.34s |  it would just affect this country.
1173.34s - 1174.60s |  It would affect many countries
1174.64s - 1177.72s |  because those products are global at this point.
1177.72s - 1181.00s |  And we have fairly minimal control over the supply chain.
1181.00s - 1183.92s |  Even if we do actually ban a number of products,
1183.92s - 1185.12s |  it's not necessarily,
1185.12s - 1186.72s |  you can't necessarily tell private industry,
1186.72s - 1187.76s |  you will never buy this.
1187.76s - 1189.62s |  That didn't work with some of the other products.
1189.62s - 1191.76s |  So we don't necessarily have a ton of control
1191.76s - 1192.76s |  over what people buy
1192.76s - 1194.88s |  because we do have a free market here.
1194.88s - 1197.84s |  So we've got minimal control over that, really.
1198.64s - 1200.76s |  Again, I'm a failure mode person.
1200.76s - 1202.48s |  I've done a lot of work on setting things on fire,
1202.48s - 1204.54s |  so I have to talk about that for a minute.
1204.88s - 1206.10s |  What would actually happen
1206.10s - 1208.98s |  if there were a major attack on a battery?
1208.98s - 1211.30s |  Well, I mentioned loss of visibility.
1211.30s - 1213.74s |  This is the first thing that's probably the easiest
1213.74s - 1214.96s |  and has happened.
1214.96s - 1217.30s |  So essentially, if I was looking at difficulty,
1217.30s - 1219.22s |  loss of communication and loss of visibility
1219.22s - 1222.68s |  is kind of the biggest, easiest thing that can happen.
1222.68s - 1224.14s |  Again, that's when they lose status
1224.14s - 1226.02s |  monitoring our physical access alarms,
1226.02s - 1227.96s |  which can be a bigger challenge.
1227.96s - 1230.04s |  Like I said, there have been examples of this happening.
1230.04s - 1232.46s |  The attack against the Viasat network
1232.46s - 1237.18s |  during the Ukraine invasion in northern Europe
1237.18s - 1238.30s |  actually resulted in the loss
1238.30s - 1241.26s |  of about 6,000 wind turbines communication,
1241.26s - 1244.24s |  which, you know, okay, they've lost comms,
1244.24s - 1245.38s |  but they actually had to go out
1245.38s - 1247.66s |  and fix each one of these individually in the end.
1247.66s - 1251.18s |  So that was quite a big device problem, actually.
1252.38s - 1254.74s |  Other types of potential attacks.
1254.74s - 1256.86s |  If you look at a site, I mentioned fire.
1256.86s - 1258.36s |  They are an electrochemical device.
1258.36s - 1259.30s |  They do get hot.
1259.30s - 1261.74s |  Please don't open them up to take a look at that.
1262.66s - 1265.30s |  They might lose their preventive or proactive disconnect.
1265.30s - 1266.52s |  Potentially, they stay online
1266.52s - 1268.50s |  when you're trying to take them offline.
1268.50s - 1270.50s |  There could be damage to site capacity
1270.50s - 1271.66s |  and environmental discharge.
1271.66s - 1272.50s |  These things burn.
1272.50s - 1274.18s |  If anyone was around here recently
1274.18s - 1277.38s |  or tried to drive from California to LA,
1277.38s - 1279.68s |  sorry, LA to Las Vegas,
1279.68s - 1281.74s |  there was a huge lithium ion battery fire
1281.74s - 1283.90s |  in the middle of this that shut down the road.
1283.90s - 1286.02s |  And the plume from that was terrible.
1286.02s - 1287.94s |  So chemicals are bad.
1287.94s - 1290.02s |  Lastly, the most difficult style of these things
1290.02s - 1291.10s |  is electric grid impact.
1291.10s - 1292.54s |  It's the one we talk about most,
1292.54s - 1294.30s |  but it's probably the most difficult.
1294.30s - 1296.58s |  Again, to actually coordinate a massive event
1296.58s - 1298.50s |  where the lights would go out everywhere,
1298.50s - 1299.90s |  it would take a lot.
1299.90s - 1301.26s |  It would take a lot of coordination
1301.26s - 1302.90s |  with more expensive power electronics
1302.90s - 1305.50s |  than we actually have, for one, which is good.
1305.50s - 1307.22s |  But it's still a challenge.
1307.22s - 1309.82s |  We can't have these things misbehaving over the system.
1309.82s - 1311.14s |  It's a bit of a problem.
1311.14s - 1313.18s |  Okay, this is a policy talk, though.
1313.18s - 1315.30s |  So how do we fix it?
1315.30s - 1316.56s |  There are technical solutions.
1316.56s - 1318.30s |  I'm not talking about those today.
1318.30s - 1320.46s |  I'm mostly talking about, from a policy standpoint,
1320.82s - 1323.22s |  what we really need to do to help fix these problems.
1323.22s - 1326.10s |  I'd came up with four options of the direction we're going
1326.10s - 1328.34s |  and the direction I think we should go.
1328.34s - 1331.02s |  But so I was gonna talk about that a little bit.
1331.02s - 1332.46s |  Option one and option two
1332.46s - 1334.86s |  are really ban the companies, rip and replace.
1334.86s - 1336.24s |  I mentioned before we've tried this.
1336.24s - 1338.06s |  We are going down this path.
1338.06s - 1339.60s |  We've already started the process.
1339.60s - 1341.86s |  There's been 10 companies that have been banned
1341.86s - 1344.66s |  in the latest National Defense Authorization Act.
1344.66s - 1345.78s |  That's gonna increase.
1345.78s - 1348.06s |  We're looking at more and more.
1348.06s - 1349.82s |  Fair enough, that's the direction we're going,
1350.18s - 1351.66s |  but it doesn't mean we're gonna have a solution
1351.66s - 1353.82s |  that works there because people might just go buy
1353.82s - 1356.06s |  another cheaper one from the 70 list,
1356.06s - 1358.26s |  so it might just get worse.
1358.26s - 1360.94s |  But second option we're really looking at,
1360.94s - 1362.96s |  rip and replace, that's came up.
1362.96s - 1364.02s |  What does that mean?
1364.90s - 1367.50s |  Around a couple, maybe three, four years ago
1367.50s - 1370.58s |  when they banned Huawei from our networks,
1370.58s - 1374.58s |  they also put funding in place for a bunch of small utilities
1374.58s - 1376.74s |  to actually go replace all their Huawei equipment.
1376.74s - 1378.50s |  It was an order that came through,
1378.50s - 1381.10s |  and then they said, well, we're gonna put $4 billion
1381.10s - 1383.94s |  towards small utilities taking out this equipment,
1383.94s - 1386.46s |  buying new equipment, not buying Huawei.
1386.46s - 1389.62s |  That was great except we underfunded it by $3 billion.
1389.62s - 1392.74s |  So we ended up with, I believe a couple months ago,
1392.74s - 1395.22s |  $1 billion is spent out on doing this.
1395.22s - 1396.80s |  Most of the utilities have not been able
1396.80s - 1399.26s |  to actually replace the Huawei equipment
1399.26s - 1401.06s |  because they can't buy it,
1401.06s - 1403.14s |  and the funding isn't there for them to do it.
1403.14s - 1405.48s |  So that didn't work.
1405.48s - 1407.82s |  The other part is when we banned Huawei,
1407.82s - 1409.58s |  they just went from being number two
1409.58s - 1410.92s |  to number one in the world.
1410.92s - 1414.74s |  That was the strangest part of this is when we banned them,
1414.74s - 1417.34s |  and they actually did the market in 2019 in the US.
1417.34s - 1421.18s |  In 2022, they were the top number one globally
1421.18s - 1422.78s |  of inverter shipments in the world.
1422.78s - 1425.30s |  So again, rip and replace is not really,
1425.30s - 1428.54s |  or even banning them is not necessarily the best beginning.
1429.94s - 1432.18s |  Well, but now, again, if I only did the math
1432.18s - 1434.34s |  on what we actually need to do
1434.34s - 1437.06s |  to replace all the batteries in the system,
1437.06s - 1439.82s |  at least in one state, it would be around $4 billion.
1439.82s - 1441.08s |  So look at previous number
1441.08s - 1443.30s |  for what we didn't fund the first time.
1443.30s - 1445.46s |  I believe, I think in the US, I did the math,
1445.46s - 1448.26s |  it was around $15 billion in the US
1448.26s - 1450.66s |  to replace what we have currently installed or in line.
1450.66s - 1452.94s |  So I don't think that's gonna happen.
1452.94s - 1454.46s |  I don't know who's gonna push that bill,
1454.46s - 1456.18s |  but it's not gonna.
1456.18s - 1458.82s |  There's about 70 options, as it are 80 now.
1458.82s - 1461.14s |  Again, they pop up from launched integration
1461.14s - 1462.18s |  in about one year.
1462.18s - 1464.06s |  That's just material.
1464.06s - 1465.86s |  We'll end up playing whack-a-mole just forever.
1465.86s - 1467.86s |  If you keep banning one, the next one will come up.
1467.86s - 1468.98s |  We'll have to ban them.
1468.98s - 1469.86s |  We'll just keep going
1469.86s - 1471.82s |  until we have a really confused supply chain
1471.82s - 1473.58s |  and no one knows who to buy it from.
1473.58s - 1475.94s |  It'll also stop what we're doing currently.
1475.94s - 1477.98s |  We will not be able to transition the grid
1477.98s - 1480.42s |  if we keep going down this path.
1480.42s - 1482.14s |  They do have a fire issue, like I said,
1482.14s - 1484.46s |  but the ones that have caused more of the fires
1484.46s - 1486.70s |  have not actually been on the ban list.
1486.70s - 1489.12s |  So despite the fact they've had a natural physical impact
1489.12s - 1492.18s |  of a piece of device or a fire,
1492.18s - 1494.58s |  they're just not on a ban list yet for some reason.
1495.38s - 1497.78s |  We're kind of stuck in these two worlds.
1497.78s - 1500.54s |  Again, I try not to be super negative,
1500.54s - 1503.14s |  but there is progress, there is investment in the country.
1503.14s - 1504.26s |  The Chips for America Act
1504.26s - 1506.14s |  is bringing in a lot of the manufacture of chips,
1506.14s - 1509.58s |  which will help solve some of our power electronics problems
1509.58s - 1512.78s |  in a few years, probably not right now.
1512.78s - 1514.10s |  Also, there is investment
1514.10s - 1516.50s |  in battery cell material being built,
1516.50s - 1518.06s |  which is all over the country.
1518.06s - 1520.34s |  But again, we have five to 10 years
1520.34s - 1521.66s |  before that's a reality.
1521.66s - 1523.54s |  So we have to keep going,
1523.54s - 1524.78s |  and that's not necessarily gonna work.
1524.78s - 1527.02s |  We also, again, still need the demand signal.
1527.94s - 1529.38s |  The other problem we have
1529.38s - 1532.10s |  is actually inspecting the equipment.
1532.10s - 1534.14s |  There's a lot of vulnerability analysis programs,
1534.14s - 1536.38s |  that's great, but if I look at the list
1536.38s - 1538.66s |  of the inverters that have been analyzed,
1538.66s - 1543.66s |  most of them aren't really reported through any US entity.
1544.50s - 1545.62s |  We aren't necessarily saying
1545.62s - 1547.22s |  that this is on the vulnerability list,
1547.22s - 1549.18s |  here's what you need to fix.
1549.18s - 1551.22s |  It's something from a policy perspective,
1551.22s - 1552.94s |  I would love to see change.
1552.98s - 1555.14s |  I believe that when we bring in products
1555.14s - 1557.74s |  to this country to use on our critical infrastructure,
1557.74s - 1559.34s |  we should be able to analyze it,
1559.34s - 1560.58s |  we should be able to look inside it,
1560.58s - 1562.66s |  and we should be able to push that out
1562.66s - 1564.18s |  for other people to fix.
1564.18s - 1566.06s |  It's a contract teeth issue
1566.06s - 1567.38s |  that we kind of need at the moment.
1567.38s - 1569.26s |  And I think I believe it needs to be pushed
1569.26s - 1570.22s |  from the national level,
1570.22s - 1572.14s |  so people can actually change their contracts,
1572.14s - 1574.50s |  so we can start doing this kind of work.
1574.50s - 1575.38s |  But it's a huge challenge.
1575.38s - 1578.18s |  We have the technology and we have the capability.
1578.18s - 1580.66s |  We could keep these inverters and just analyze them,
1580.66s - 1582.18s |  but we need to actually push back
1582.18s - 1583.62s |  on the rules that we have in place
1583.62s - 1585.58s |  for us not really looking at these devices
1585.58s - 1587.38s |  or reporting it.
1587.38s - 1588.98s |  Just, it'd be a deterrence,
1588.98s - 1589.94s |  it'd be really good to actually say
1589.94s - 1591.14s |  we're gonna analyze this equipment
1591.14s - 1593.10s |  and we're gonna report vulnerabilities.
1593.10s - 1595.62s |  But there's a trade-off there also.
1595.62s - 1596.46s |  I'm speeding up,
1596.46s - 1598.34s |  because I'm probably running out of time.
1598.34s - 1601.46s |  But like I said, we have had analysis done
1601.46s - 1603.18s |  on many of the common products,
1603.18s - 1604.42s |  and that's happening.
1604.42s - 1606.18s |  We need this for all of them, though.
1606.18s - 1608.54s |  If we're gonna use all of these devices,
1608.54s - 1610.90s |  we need the ability to analyze what's inside them
1610.90s - 1611.98s |  and keep doing that.
1613.26s - 1614.90s |  Just on the last part,
1614.90s - 1617.90s |  we need to have better contract requirements for people.
1617.90s - 1619.30s |  Again, this is policy talk,
1619.30s - 1622.50s |  but contracts are one of our bigger problems.
1622.50s - 1623.98s |  People write contracts
1623.98s - 1625.90s |  that don't necessarily put into there,
1625.90s - 1626.94s |  we're gonna look at your equipment,
1626.94s - 1631.42s |  or we need to have particular TMZs for your firmware.
1631.42s - 1632.62s |  We don't put in monitoring.
1632.62s - 1634.86s |  We have to fix our contracting.
1634.86s - 1636.02s |  But just lastly,
1636.02s - 1638.78s |  the last one that keeps coming up is regulation.
1639.74s - 1640.58s |  We're saying,
1640.58s - 1642.18s |  oh, we're gonna regulate clean energy security.
1642.18s - 1644.42s |  These companies will be under NRCSIP,
1644.42s - 1646.54s |  which is the critical infrastructure protection rules
1646.54s - 1647.78s |  in this country.
1647.78s - 1649.34s |  I'm not sure who we're gonna regulate.
1649.34s - 1651.34s |  So just in the last piece,
1651.34s - 1653.30s |  or who is going to regulate them.
1654.94s - 1656.50s |  There's one site I was looking at
1656.50s - 1659.06s |  that had one developer and owner,
1659.06s - 1662.26s |  they sold those site rights to somebody else
1662.26s - 1663.62s |  who are finance bros.
1663.62s - 1664.82s |  Sorry, that's my running joke,
1664.82s - 1666.10s |  that they keep selling these sites
1666.10s - 1667.38s |  to finance bro companies,
1667.38s - 1669.26s |  which isn't necessarily the greatest idea
1669.26s - 1671.58s |  when they own a gigawatt of generation.
1671.58s - 1672.42s |  I don't know how many of them
1672.42s - 1674.14s |  you want in charge of a gigawatt of generation,
1674.14s - 1675.66s |  so we're clear.
1675.66s - 1676.98s |  That site was developed.
1676.98s - 1680.02s |  That owner then sold that again to another French company.
1680.02s - 1681.70s |  So now we have a site
1681.70s - 1684.10s |  that owns a gigawatt of generation in one state
1684.10s - 1687.38s |  that is owned by a French company.
1687.38s - 1688.50s |  Okay, fair enough.
1688.50s - 1690.38s |  It's physically connected to our grid though.
1690.38s - 1691.78s |  So there's a utility over here
1691.78s - 1694.06s |  that has the electrons flowing to it.
1694.06s - 1695.50s |  And then there's the components
1695.50s - 1696.84s |  that are manufactured in China.
1697.24s - 1698.96s |  There's the third party operations and maintenance
1698.96s - 1700.04s |  that's somewhere else.
1700.04s - 1701.80s |  Then there's this fourth party operator
1701.80s - 1705.68s |  somewhere over here doing something else, which is weird.
1705.68s - 1707.36s |  And then they bid into the market.
1707.36s - 1708.64s |  This one was in Texas,
1708.64s - 1710.56s |  but they're still bidding into the market.
1710.56s - 1711.68s |  So they have this connection
1711.68s - 1714.52s |  to the operator for the state also.
1714.52s - 1716.12s |  So I've been trying to work out for a while,
1716.12s - 1718.48s |  which person is the regulated one?
1718.48s - 1720.60s |  Who's registering as the generator here?
1720.60s - 1722.40s |  Who's the one that follows the rules?
1722.40s - 1724.32s |  I'm not sure which one it is at this point.
1724.32s - 1726.20s |  So we need to work that out
1726.56s - 1729.16s |  if we're gonna do anything from enforcing different things.
1729.16s - 1730.00s |  I'll leave this up here.
1730.00s - 1730.84s |  It was my last slide,
1730.84s - 1732.96s |  but we will not have time to cover it.
1732.96s - 1734.92s |  A while ago, we did run an exercise
1734.92s - 1737.24s |  on the case I just said,
1737.24s - 1739.40s |  but running an exercise of what if we essentially
1739.40s - 1741.36s |  did an emergency mass push of firmware
1741.36s - 1744.36s |  to millions of inverter devices at the same time
1744.36s - 1746.84s |  and brick them all with a lot of people in the room
1746.84s - 1749.40s |  trying to, not that that ever happens,
1749.40s - 1753.32s |  but we ran this exercise trying to get some good answers
1753.32s - 1755.12s |  from all of those people that have ownership
1755.12s - 1757.72s |  to work out whose problem this really would be.
1757.72s - 1759.24s |  And it was one of the more confusing things
1759.24s - 1760.64s |  we've ever had to do because everyone
1760.64s - 1762.84s |  was just kind of staring at me with a,
1762.84s - 1764.68s |  that doesn't seem good, that's not good.
1764.68s - 1766.00s |  I was like, okay, great.
1766.00s - 1768.00s |  So we won't have time to cover it,
1768.00s - 1770.00s |  but these are the sort of questions we were asking
1770.00s - 1773.56s |  and things we were thinking about here on what if we did,
1773.56s - 1775.16s |  we called it the sun splat exercise,
1775.16s - 1776.76s |  which I'm still pretty proud of,
1776.76s - 1779.64s |  but it was essentially if what if we happened
1779.64s - 1782.28s |  to mass push things and brick everything
1782.28s - 1783.56s |  and who would fix it?
1783.56s - 1785.12s |  With the idea that someone would actually have
1785.12s - 1788.26s |  to manually go fix millions of devices at the same time.
1788.26s - 1789.56s |  Again, that never happens.
1790.88s - 1794.00s |  Well, that's my summary, but again, we need to do this.
1794.00s - 1795.28s |  We're stuck between two worlds,
1795.28s - 1797.04s |  but we have to get renewable energy
1797.04s - 1797.96s |  and clean energy out there.
1797.96s - 1800.72s |  It's just a fact, we do not want to keep going
1800.72s - 1802.44s |  with climate change the way it is.
1802.44s - 1804.76s |  We've got to fix this, it's a thing.
1804.76s - 1806.20s |  Whether you believe in it or not,
1806.20s - 1808.24s |  this is one of the solutions that should be happening
1808.24s - 1809.88s |  and is going to happen.
1809.88s - 1813.24s |  We do have adversarial entities in the supply chain.
1813.92s - 1814.96s |  We need to somehow fix that also,
1814.96s - 1816.84s |  but we have technology solutions that we can do.
1816.84s - 1818.88s |  We just need a number of policy changes
1818.88s - 1822.48s |  for us to be able to do the technology pieces that we have.
1822.48s - 1825.76s |  We can fix it, but we've got to actually do the things
1825.76s - 1828.00s |  and actually start doing the installations the right way
1828.00s - 1830.52s |  and do the connections the right way for future.
1830.52s - 1833.68s |  But that's my summary for today.
1833.68s - 1836.40s |  Thank you for listening and if there's any questions,
1836.40s - 1837.34s |  I don't know if I have time,
1837.34s - 1839.40s |  but I can answer at the end as well.


url: https://www.youtube.com/watch?v=6qTLxglm2fs
title: DEF CON 32 - Safecracking for Everyone - Jared Dygert
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=6qTLxglm2fs",
  "title": "DEF CON 32 - Safecracking for Everyone  - Jared Dygert",
  "description": "Learn the inner workings and vulnerabilities of mechanical combination safe locks! Safe manipulation is an underrated aspect of locksport and this talk will guide you through the ins and outs of how to do it.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1761,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.14s - 2.14s | This text was transcribed using whisper model: large-v2

 All right, sorry for the delays
3.10s - 7.14s |  So this is safe cracking for everyone. My name is Jared
13.63s - 15.95s |  Okay, so a little bit about me. I
17.07s - 20.23s |  Am a lock sport enthusiast. I have been picking locks
20.75s - 26.87s |  For close to 20 years now and I got into safe manipulation shortly after
26.87s - 29.63s |  I've been doing that for about 15 years. I
30.59s - 32.59s |  game a bunch
32.59s - 37.99s |  And I'm a professional rock climber. That's like my main source of income at the moment
38.39s - 43.63s |  so this talk this talk will cover how
44.49s - 47.73s |  specifically group two mechanical safe locks work
47.85s - 54.97s |  so there's different classifications, which I will go over and group two is sort of just the standard sort of
55.37s - 57.45s |  security classification for safe locks
58.81s - 62.57s |  Whatever safe you buy essentially if it has a mechanical lock on it
63.09s - 66.69s |  Vast majority of the time it will be a group two safe lock
66.69s - 72.45s |  I will cover the flaws in this design and how we can exploit them as well as
72.73s - 74.93s |  variations on the techniques that we use
76.69s - 80.41s |  And then I will also cover differences between group two safe locks
80.85s - 86.49s |  They all operate on the same principles, but there are some slight differences that set them apart from each other
87.09s - 94.90s |  so the security classification starts with group two as the lowest security classification and
95.22s - 100.06s |  There is absolutely nothing preventing anyone from figuring out the combination
100.90s - 108.66s |  and then group 2m there are some small improvements to where they make it a lot harder to manipulate and
109.22s - 116.26s |  then group one is the high security classification where they add in a lot of extra features and
117.70s - 122.14s |  Supposedly they're supposed to withstand manipulation for about 20 hours minimum
123.02s - 125.02s |  However, that is completely
125.74s - 127.74s |  false and I
127.98s - 133.14s |  Don't actually understand why they have different groups because they all kind of suck at the moment
133.38s - 138.62s |  and then group 1r is the same as group 1, but the R stands for
140.18s - 144.58s |  Radiologically resistant so a common attack could be
145.14s - 148.34s |  using x-rays to view the inside of the lock and
148.54s - 155.82s |  So they make the parts inside out of plastic usually Delrin a low-density plastic and it makes it really hard to x-ray it
156.26s - 160.40s |  So I will cover the parts of a lock here
163.32s - 165.32s |  normally, I would go up to the screen and
166.40s - 169.04s |  Point, but however, I don't think that's possible
170.08s - 172.24s |  So you should see a large
172.92s - 180.08s |  Brass circle in the center and it's got a bit of a cutout on it. That is called the drive cam
187.09s - 189.09s |  All
207.64s - 210.52s |  Right, cool. So here this is the drive cam
210.88s - 217.48s |  This is connected directly with a dial. So as you turn the dial this drive cam will turn as well
218.56s - 222.76s |  We have this arm. This arm is we just call it the the lever
223.64s - 230.08s |  But this protrusion is called the nose and that nose as you can see rests on top of the drive cam
231.16s - 233.16s |  Behind the drive cam we have wheels
235.08s - 249.45s |  All right, so when you dial the combination on one of these locks what happens is these wheels
249.61s - 255.89s |  They have a cutout called a gate in them. Okay, there's one gate per wheel and dialing the correct combination
256.77s - 259.21s |  Lines up each of these gates with each other
259.81s - 264.85s |  Now behind the lever you can see a bar. That bar is a fence. That's what we call it
264.85s - 270.45s |  And when you dial the correct combination all of the gates will be lined up under the fence
270.45s - 273.93s |  And that is so that the fence can fall into the gates
274.61s - 281.91s |  so here we can see the correct combination has been dialed and
283.99s - 291.63s |  When you turn the drive cam so that this cutout is underneath the nose that allows everything to fall down and what that does is
291.91s - 297.43s |  Turning the dial further here pulls on the nose and allows the bolt to be retracted
297.83s - 310.22s |  If I can get this camera to show at least somewhat I can show a little
310.62s - 312.02s |  example here
312.02s - 319.35s |  so we are looking at the top of the lock and you can see and
320.59s - 324.43s |  You can see there is a bar and that is the fence
325.63s - 327.63s |  Behind it underneath it are the wheels
328.75s - 330.75s |  When you dial the combination
331.43s - 333.15s |  Here we go
333.15s - 335.91s |  Okay, it will line up each of the gates
336.99s - 338.11s |  underneath
338.11s - 344.17s |  that fence
344.17s - 346.69s |  Sorry, it's a little hard to keep this in view
352.16s - 354.16s |  Okay, so I
354.32s - 357.16s |  Am lining up the gates underneath the fence
372.66s - 387.50s |  Sorry for the technical difficulties here. Not sure how visible that is
388.50s - 393.36s |  All right. Well, we'll just go back to the slides
394.20s - 407.18s |  So essentially the way that it works is each of the wheels
407.86s - 409.50s |  to in turn
409.50s - 415.06s |  Grab the wheels behind it. So that drive cam which is directly connected to the dial
416.58s - 420.18s |  Has a protrusion much like this wheel does here and
420.86s - 426.50s |  That protrusion will ride in a groove on top of the wheel behind it
427.26s - 434.94s |  until it hits the the protrusion on that wheel and so essentially it can freely ride around and
435.42s - 440.14s |  Once it makes contact it will grab that wheel and it will turn with the dial
440.90s - 444.58s |  That wheel on the bottom also has a protrusion
444.58s - 452.18s |  This is called a drive pin that drive pin will ride in a groove on the wheel behind it until it hits
452.94s - 457.82s |  That wheel and picks it up. So it takes one rotation
458.62s - 461.82s |  To ensure that you have picked up the next wheel
461.98s - 468.34s |  That's because if you are moving the wheel in one direction and you reverse rotation
468.34s - 472.70s |  You have to go all the way around until they can pick it up again
475.43s - 477.43s |  Here's an example
477.43s - 478.47s |  I
478.47s - 480.47s |  Put this here in case the camera didn't work
480.79s - 485.87s |  I would like to show this more visually, but this is the best I have at the moment
485.99s - 492.39s |  So we can imagine this black piece at the back being the drive cam and each of these wheels being one of the wheels in
492.39s - 500.83s |  The lock so what happens is this this drive cam will spin around and here it's making contact with the drive pin of this
500.91s - 507.35s |  Third wheel the wheel closest to the drive cam is called the third wheel then the second and then the first and
507.67s - 511.67s |  So if we wanted to spin this wheel and the other direction
512.23s - 518.55s |  this drive cam would turn all the way around one full rotation until it can hit this drive pin and
519.43s - 524.39s |  Same thing for this third wheel if we want the third wheel to pick up the second wheel
524.39s - 529.47s |  It has to go all the way around until it hits the drive pin and so on and so forth
529.47s - 536.19s |  And so this is how all the wheels are able to move together, but also be able to be set separately
536.83s - 541.78s |  so vulnerabilities
542.38s - 545.22s |  So here we have a close-up of the drive cam
545.78s - 550.14s |  Now the nose normally rests on top of the drive drive cam
550.14s - 555.66s |  It will rest and ride along the whole outer edge of the drive cam as the drive cam spins
556.66s - 563.54s |  But when we get to this drop-in area the nose will drop in ever so slightly and
564.94s - 570.38s |  The vulnerability here is this is not symmetrical this drop-in point is
571.38s - 575.46s |  Asymmetrical and on one side we have a great curve to it
575.46s - 580.98s |  And so you can see the further down we go in this drop-in point
581.22s - 586.94s |  There is less wiggle room from one side to the other is significantly less than up high
586.94s - 589.58s |  There's much more wiggle room up there
589.58s - 596.06s |  And the thing about this is because that nose will go a little bit into the drop-in point
596.62s - 603.12s |  When we turn the drive cam we can feel it hit the wall of that drop-in area
604.30s - 607.98s |  We can actually feel that on the dial as a bit of resistance
608.26s - 615.30s |  So we spin the dial so that this drop-in point is centered below the nose that nose is not touching the drive cam at all
615.30s - 619.78s |  and if we turn a little further than the nose will hit the edge as
620.22s - 627.06s |  In this picture right here, and we can feel when that happens, so if that nose is up high in
627.62s - 629.62s |  this contact or this
629.66s - 630.78s |  drop-in area
630.78s - 637.94s |  Then there will be a significant distance between the two points of contact on the walls of that drop-in area
637.94s - 639.94s |  And if the nose is lower
640.62s - 642.46s |  There will be less
642.46s - 644.46s |  distance between feeling those points of contact
646.91s - 653.55s |  Now the thing that determines how high or low that nose is in that area is the fence
653.77s - 657.61s |  The fence here you can see is resting above the wheels
657.73s - 660.93s |  So we have the nose that is on the drive cam right now
660.93s - 667.89s |  And that is what's keeping that fence up, but when we turn the dial so the nose is over that drop-in area
668.85s - 672.09s |  Then the fence will fall down and rest on the wheel pack
672.29s - 678.53s |  That is essentially testing for if the combination is correct or not if the gates were all aligned
678.61s - 684.87s |  Then the fence would not rest on top of the wheel pack it would simply fall in and that would allow the lock to open
685.71s - 692.83s |  So here you can see the wheels are all different sizes, that's because we are not able to manufacture
693.63s - 698.21s |  Multiple wheels to be exactly the same size or to be perfectly circular
698.71s - 704.19s |  So here we will always have one wheel that's larger than the others as you can see here
704.19s - 711.67s |  It is the first wheel all the way to the left furthest from the drive cam. There's space here on the second and third wheel
712.31s - 718.23s |  So if we were to turn the dial so that the nose is over that drop-in point this fence
718.67s - 725.39s |  Will hit and rest only on this first wheel because it sticks up above the rest
726.39s - 731.75s |  Now this is where the previous slide comes in handy with the narrower
732.15s - 736.67s |  Space the further down you go because if we were to feel
737.23s - 742.39s |  Those contact points that point at which the nose hits the wall of the drop-in area
742.79s - 747.75s |  Those are hard contact points and we measure how far apart those are
748.59s - 753.63s |  We would get a certain number a certain reading. Let's say on the dial that is six increments
754.47s - 758.91s |  But if we were to turn this first wheel and only this first wheel
759.19s - 765.11s |  So that the gate is underneath the fence this fence will not be resting up as high anymore
765.11s - 767.91s |  It will drop on to the next largest wheel
768.55s - 772.11s |  Causing the nose to be further down in that contact area
773.03s - 780.23s |  Which means that our points of contact are now going to be closer together instead of having a range of six
780.59s - 784.79s |  Sorry six numbers on the dial apart. Maybe we can feel those points of resistance
785.75s - 792.91s |  Five and a half numbers apart and that tells us that we have the largest wheel in the correct position
793.35s - 796.83s |  So if we had let's say dialed a test combination and
797.27s - 802.11s |  This is what we have and we measure the contact points to be six numbers apart
802.11s - 805.99s |  And then we dial the same exact test combination again
806.43s - 812.39s |  but with a different number for the first number in the combination which corresponds to the first wheel and that
812.71s - 817.71s |  Places the gate underneath the fence and we see that decrease in the contact area
818.23s - 823.39s |  Then we know whatever we just changed for that first number is the correct number
824.75s - 830.59s |  So you can see here it is resting on top of the first wheel and first wheel only this fence is not
830.75s - 832.63s |  Touching the second or third wheel
832.63s - 836.91s |  So if that first wheel does rotate so that the gate is underneath it
836.91s - 841.93s |  the fence will drop lower and we can feel that difference in the dial with how the
842.39s - 845.63s |  Nose touches the sides of that contact area
846.15s - 854.00s |  So essentially we have our plan of attack what we can do is we can find what's called a common low point and
856.20s - 862.48s |  That's because the wheels are not necessarily larger or smaller than the other wheels they can be
863.28s - 868.52s |  Bumpy or irregularly shaped. So if we have the wheels in the correct position
869.20s - 871.80s |  Maybe there is a bump on another wheel
872.36s - 875.18s |  Preventing that fence from falling down completely
875.36s - 882.20s |  So we want to find a point where across every wheel is a common low point where there are no extra
882.48s - 889.68s |  bumps or ridges on any of the wheels and we have that nose as far down in that contact area as we can and
890.76s - 895.12s |  We do something called wheel isolation. We will isolate the third wheel
895.36s - 901.14s |  So essentially if we are only moving one wheel at a time and we get a reading
901.38s - 906.90s |  That the nose is lower in that contact area so we can feel that point of resistance
907.70s - 912.26s |  where we feel the nose hitting the sides of that of that drive cam and
913.46s - 917.58s |  We feel that decrease and only one wheel is moving
917.78s - 922.52s |  We know exactly what number and what wheel is in the combination
922.52s - 927.42s |  So if we're only moving the third wheel and we move it from 10 to 12
927.42s - 934.06s |  And we have a drop in that in that reading that means 12 is a third number in the combination and makes things
934.62s - 936.62s |  really simple and
936.90s - 941.34s |  Then we have to look for gate signatures, which is that drop that I have been talking about
941.86s - 946.70s |  Feeling the drop in the range of the of the two contact points
947.74s - 950.90s |  Once we find that we can find the center of the gate
950.90s - 957.18s |  We want to be precise because there there is a range at which the lock will open
957.42s - 962.42s |  That is not the correct combination. If you set your combination to be 10 20 and 30
962.94s - 965.46s |  Then you can open it with 9
966.38s - 967.38s |  21
967.38s - 974.46s |  29 that is a valid combination. Most locks will open plus or minus one and a quarter numbers on either side
975.42s - 979.90s |  So we want to find the center as close to the true combination as we can
980.14s - 984.90s |  In case we made a mistake along the way and we can repeat these steps for the second wheel
985.10s - 989.26s |  So essentially we can move only the second wheel in the lock by itself
989.26s - 994.54s |  And so if we find a gate signature if we find a decrease in that contact area
994.98s - 1001.18s |  Then we know what our second number in the combination is and there is no need to do this for the first wheel
1001.18s - 1006.26s |  And that's because if you have two numbers in a combination that has three numbers
1006.90s - 1011.22s |  you just brute force the last one you just dial every two increments and
1011.62s - 1016.22s |  Then you don't have to worry about trying to manipulate the lock and get a reading
1017.38s - 1024.98s |  Now there's a reason we go from three to one and that's because the wheel that is closest to the drive cam is
1024.98s - 1026.66s |  wheel three and
1026.66s - 1031.10s |  That lever is spring-loaded. It has a spring pressing down on it
1031.66s - 1037.94s |  That spring is only on one half. So it causes it to tilt. So when you are
1038.86s - 1045.06s |  So when you are turning the dial so the nose is over that that drop-in point
1045.90s - 1053.10s |  The fence will hit the wheels and it will actually tilt and cause it to only make contact with wheel three
1053.10s - 1060.42s |  I want to say 90% of the time and I say 90% because it's not always the same due to tolerances
1060.62s - 1067.06s |  But that is also why we find the common low point. That is why we find an area across all the wheels
1067.94s - 1071.62s |  That don't interfere with each other that there are no bumps is that it will help us
1071.86s - 1076.18s |  Ensure that wheel three will be the first wheel that the fence touches
1076.70s - 1082.64s |  so the way we find this common low point is we can spin every wheel together and
1083.60s - 1085.20s |  We can take
1085.20s - 1092.38s |  Contact point readings, which means you go to the place at which you can feel that resistance which you can feel that nose
1092.84s - 1096.40s |  hitting the side of that drive drive cam in that in that
1097.36s - 1105.16s |  Contact area when you feel that resistance whatever number that is on the dial that is your contact point reading
1107.36s - 1108.64s |  after that
1108.64s - 1114.04s |  So so we pick up all the wheels and we take contact point readings every ten increments
1114.04s - 1118.96s |  What that means is we will move every wheel together and on the dial
1118.96s - 1125.08s |  We will stop at zero then we will turn to that contact area and get our contact point
1125.12s - 1131.92s |  We will then turn all the wheels to ten and then twenty and then thirty so every ten increments
1132.04s - 1139.68s |  We take a contact point reading and we find the lowest reading we find the reading at which the wheels
1140.88s - 1145.68s |  Read the lowest so that is when the nose will be furthest down in that drive cam
1146.80s - 1154.02s |  We can leave the first and second wheels there so we can turn the dial until only the first two wheels are moving
1155.40s - 1158.64s |  and leave them there actually the third one moves too, but
1159.40s - 1166.44s |  we can it this gets the first and second wheels out of the way and we can then proceed to move the third wheel as
1166.56s - 1171.84s |  We see fit that third wheel is closest to the drive cam. So it is the first to move
1171.96s - 1174.68s |  So if we have our first and second wheels
1175.44s - 1179.52s |  Somewhere we can move the third wheel without interrupting them
1179.92s - 1183.40s |  So with the third wheel
1183.40s - 1189.84s |  we can then spin and pick up the third wheel after we drop the first two off where they need to be and
1190.36s - 1196.16s |  We can move it every two increments so we can take that third wheel and let's say we can start on zero
1196.44s - 1203.32s |  okay, and then we take a contact point reading so we just turn to that drop-in point and feel for the bit of resistance and
1203.32s - 1208.12s |  See what numbers on the dial and then we can go back to where we left the third wheel from zero
1208.12s - 1210.12s |  We can then turn to two
1210.20s - 1215.52s |  Go take a contact point reading and then go turn our wheel to four take a contact point reading
1215.52s - 1218.28s |  so we do this 50 times around the dial and
1219.04s - 1224.70s |  Because we're only moving one wheel whenever we see a drop in our contact point reading
1225.44s - 1232.34s |  We know that number we just turned the third wheel to is our third number in the combination. There is no ambiguity about it
1233.34s - 1239.98s |  From there we can actually go back and just move the wheel through that area again
1239.98s - 1246.20s |  So if we find a drop in that contact point when the third wheel is at 30 or let's say 32
1246.58s - 1249.50s |  We can go back and because we went every two increments
1249.50s - 1255.58s |  we can hit all the odd numbers and we can find the exact center of where it needs to be if
1256.66s - 1258.62s |  We do not have a gate indication
1258.62s - 1265.30s |  that's actually fine with this method because we can use the lowest point and pretend that is our actual number and
1265.46s - 1272.20s |  Simply repeating these steps with the lowest points will actually give us the real the real number in the combinations
1272.76s - 1276.43s |  The second wheel is a little more
1276.89s - 1283.13s |  Difficult. Um, I am kind of skimming through this because my camera is not working. Unfortunately. I can't show this visually
1283.97s - 1290.77s |  But the second wheel is just you you turn different number of times, but we're doing the same process
1291.13s - 1296.69s |  We are finding a way to move only the second wheel by itself inside the lock
1296.85s - 1299.97s |  So when we get an indication from the dial
1300.85s - 1310.46s |  We know it is the second number in the combination and for the first wheel if we had two good
1311.30s - 1312.26s |  Indications
1312.26s - 1314.50s |  Then we can brute force the first wheel
1315.10s - 1319.86s |  Dialing zero then the second number and third number and then to second number third number
1319.86s - 1321.98s |  We're just dialing full combinations
1321.98s - 1327.86s |  And what that does is allow us to cut down on the amount of time we need we spend dialing
1327.94s - 1331.42s |  Since going by every two numbers will open the lock
1333.06s - 1340.22s |  We can also keep track of the lowest point still just in case we were wrong earlier if we just keep
1340.46s - 1346.50s |  Intending that the lowest contact point readings we get is the real number in the combination
1346.50s - 1349.22s |  we can keep on repeating this process and
1350.18s - 1360.22s |  Eventually those low points will become the real numbers. So there are different types of group two locks
1361.68s - 1363.68s |  One second. Oh
1369.65s - 1371.85s |  Sorry, just trying to make sure I don't go over time here
1373.33s - 1375.41s |  So there are different types of group two locks
1375.77s - 1378.49s |  Legar 3330 is a very common one
1378.49s - 1384.73s |  It is not one I suggest starting out with the wheels are more oval. And what that means is
1385.45s - 1391.57s |  We want our gates to be of each wheel under the fence and the lock. That is what tells us
1391.57s - 1395.01s |  What is the right number or not with over wheels?
1395.53s - 1397.53s |  One wheel may shadow
1398.01s - 1402.57s |  Another wheel meaning when we have a gate underneath the fence
1402.57s - 1408.01s |  Another wheel could have a large bump on it because it's oval and might be
1408.57s - 1411.05s |  Keeping the fence from falling into that gate
1412.81s - 1415.21s |  We also have die bolt it's a very common
1416.33s - 1424.73s |  Lock for ATMs banks their drive cam is u-shaped. It is more symmetrical than what you have seen and
1425.29s - 1428.01s |  So in that case we can actually take
1428.05s - 1434.29s |  And so in that case we can actually take both contact points very carefully and
1434.89s - 1436.89s |  That will give us
1436.93s - 1438.93s |  the same results
1439.37s - 1444.01s |  Here it's a little off-screen, but this is the most common model that you will see
1444.85s - 1446.69s |  sergeant in Greenleaf
1446.69s - 1449.69s |  6730 or 6741 they are virtually identical
1450.45s - 1456.61s |  One can just be opened with one and a half numbers on either side. So a little easier to open
1457.21s - 1461.43s |  But then essentially they're the same and this is what I suggest everyone to start with
1462.61s - 1467.97s |  After this talk, I will have a table with a bunch of these set up in the lock picking village
1468.81s - 1470.81s |  And you can try hands-on
1471.53s - 1475.72s |  so
1475.72s - 1482.88s |  These are really important tips. Okay. These are not just tips if you don't succeed. These are things you have to go in
1483.56s - 1489.36s |  Knowing and the most important is being precise in everything not just dialing
1489.68s - 1496.44s |  But reading the dial from the same angle every time if you look at it from the side that will change what you see on
1496.44s - 1498.44s |  the dial
1498.56s - 1502.76s |  You want to read the contact point with the same amount of force so we can feel
1503.24s - 1506.32s |  When that nose hits the drive cam and that's our contact point
1506.80s - 1514.04s |  However, we have to feel that with the same amount of force every time or we will get a different number on the dial
1515.16s - 1517.96s |  we can also try with a known combination and
1518.80s - 1520.80s |  What that means is
1521.12s - 1524.48s |  Knowing the combination. So if I know the combination is 10 20 30
1524.48s - 1533.16s |  I can only test from 0 to 40 for instance, and I know I should have an indication in that area
1533.16s - 1535.16s |  So I do not have to waste my time
1535.36s - 1539.48s |  With numbers that I know are not in the combination. And so that helps
1540.20s - 1544.24s |  Helps with getting a feel for what you are looking for
1545.24s - 1550.56s |  You can also remove the back cover and look at inside the lock while you do it
1550.56s - 1553.52s |  And I have removed all the back covers on the locks
1553.64s - 1558.96s |  That will be for demonstration in the lock picking village so you can look inside and see what's happening. I
1559.80s - 1562.32s |  Apologize. I had some technical difficulties
1562.52s - 1567.32s |  So I understand that things are a little little complex with how I'm describing it
1567.32s - 1571.40s |  But we do have in-person demonstrations at the lock picking village
1572.36s - 1574.56s |  And if all else fails I do have a book
1575.96s - 1580.80s |  So the book is safe cracking for everyone on Amazon, but you don't need to buy it
1580.80s - 1584.12s |  That is only if you want the hardcopy version
1584.40s - 1591.00s |  There is a free PDF if you search the title of the book on YouTube safe cracking for everyone
1591.48s - 1593.96s |  There is it's like nine parts
1593.96s - 1600.72s |  But the first video in that series part one will have a link to the PDF of the book for free
1601.68s - 1605.68s |  other great resources are also the lock picking subreddit and
1606.92s - 1612.16s |  LPU lock pickers United discord. There should be a link to that discord in the subreddit
1612.48s - 1616.44s |  There's also a game called Sophie safe cracking simulator
1616.44s - 1618.32s |  I I don't know who Sophie is
1618.32s - 1623.48s |  But this is the best safe cracking game as that's all it is
1623.48s - 1627.56s |  it is just a lock and you can turn the dial and
1628.08s - 1635.08s |  There's different tools in this game where you can have x-ray vision, you know, you can practice with all these different
1636.08s - 1639.40s |  Variables that you can set up that you can't do in real life
1640.08s - 1643.76s |  and of course the best resource is practice, um, I
1644.80s - 1646.80s |  teach at a locksmithing
1647.48s - 1653.92s |  University and I have my safe manipulation course is about 18 hours long
1654.92s - 1659.24s |  That is not enough time for someone to be proficient with
1659.68s - 1663.72s |  guidance someone can open their first lock in that time, but I
1664.12s - 1668.60s |  Mean, I recommend at least 50 hours before you are even
1669.36s - 1675.80s |  Proficient in in this field. The hardest part is learning once you know and understand how a lock works
1676.48s - 1682.00s |  Then it's easy. It's just understanding that and getting the information that takes time
1684.32s - 1686.80s |  Here is the direct link to the book
1687.36s - 1689.36s |  I just hosted on Google Drive
1689.84s - 1693.76s |  Hopefully this QR code shows up well enough, but this should take you directly
1694.48s - 1697.60s |  To the PDF and you can download it and read it. I
1698.48s - 1703.48s |  Do include information on high security safe manipulation
1703.68s - 1709.00s |  This book as far as I know is the only place of that information
1709.00s - 1714.12s |  You cannot find that anywhere else and by high security safe manipulation
1714.12s - 1717.48s |  I mean there are locks in the group one category
1718.04s - 1722.44s |  that have been around this these designs have been around for a while and
1723.08s - 1726.24s |  Their methods of opening them are not new
1727.60s - 1731.32s |  And they are very insecure and they are not publicly available
1731.80s - 1738.00s |  so I decided to make that publicly available and this is the only place that I know of at which you can get that information and
1742.22s - 1746.34s |  That is that is it. Thank you for coming. Um, I
1747.02s - 1751.66s |  Really apologize for the technical difficulties and the convoluted explanations
1751.98s - 1759.54s |  But we will have in-person demonstrations. You can try yourself at the lock-picking village immediately after this. Thank you


url: https://www.youtube.com/watch?v=42OjQtrJQ5s
title: DEF CON 32 - Small Satellite Modeling and Defender Software - Kyle Murbach
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=42OjQtrJQ5s",
  "title": "DEF CON 32 - Small Satellite Modeling and Defender Software - Kyle Murbach",
  "description": "The proliferation of ride-share rocket launches and decrease in the overall cost of sending payloads to space due to recent successes in the private space industry has made small satellite systems a cost effective and time-efficient method to put research vehicles in space.\n\nThe University of Alabama in Huntsville\u2019s Center for Cybersecurity Research and Education (CCRE) has been funded by the U.S. Army Space and Missile Defense Command (SMDC) over the last several years to investigate the overall cybersecurity posture of small satellite systems. Numerous iterations of student teams led by CCRE and SMDC staff members have managed to accomplish notable research milestones.\n\nThis talk is meant to inform the next generation in aerospace cybersecurity by discussing our major research milestones, relevant findings, lessons learned, and areas of concern relating to the overall cybersecurity posture of small satellite systems.\n\nRelevant items to be covered in this talk include what it took to build a working small satellite system model as close to real-world as possible (Raspberry Pis vs PyCubed boards vs other contenders), implementation of small satellite functions (payload camera, radio communications, positioning/sensor array, orbital simulation, battery/solar charging, etc.), performing vulnerability analysis against the implemented model, creating different attack scenarios (MitM, DoS, spoofing, hardware attacks), implementing defensive mitigations (hardening scripts, command validation, health checks), and the development of a lightweight software solution named \u201cSmall Satellite Defender\u201d (SSD) designed to protect satellites from potential threat vectors.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1480,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.88s | This text was transcribed using whisper model: large-v2

 All right, good afternoon, everyone. I'm going to go ahead and get started.
3.84s - 8.96s |  So I'm here today to talk to you about small satellite modeling and defender software.
8.96s - 14.80s |  My name is Dr. Kyle Merbach, and I'm from the University of Alabama in Huntsville Center for
14.80s - 20.08s |  Cybersecurity Research and Education. And this project has been in partnership with the U.S.
20.08s - 24.16s |  Army Space and Missile Defense Command, and we're excited to share with you what we've been doing
24.16s - 32.40s |  the last few years. So a little bit about myself. I'm a principal research engineer at UAH CCRE.
32.40s - 38.88s |  I've been there since 2020. I've been a PI and SME on various research projects at a variety
38.88s - 44.48s |  of different topics, ranging from malware analysis, tool development, reverse engineering,
44.48s - 51.04s |  and vulnerability analysis. That can be in various topic areas, including satellites.
51.76s - 55.76s |  I have nine years of prior experience as a cybersecurity researcher and software
55.76s - 61.52s |  reverse engineer. I got my Ph.D. in cyber operations at Dakota State University,
61.52s - 67.28s |  and my B.S. and M.S. in computer security at Rochester Institute of Technology. I'm the
67.28s - 73.68s |  technical director of the space testing and resiliency simulation team at CCRE, where
74.48s - 80.64s |  we did a satellite project. So a little bit about the project itself. It's been going on
80.64s - 87.52s |  since fall of 2019. We have had a wide variety of student teams coming in and out throughout the
87.52s - 95.20s |  last five years. So as they come in, they work on various parts of the project, and then they may
95.20s - 101.12s |  either move on to other projects or they graduate, and then we hire on additional students and try
101.12s - 107.36s |  to continue the work. So as a director, I've been the continuee throughout that to make sure that
107.36s - 114.56s |  we continue to make meaningful progress. Here is a brief list of major project milestones that we've
114.56s - 120.80s |  achieved over the last five years, and we'll go over each of most of these in the slides coming
120.80s - 128.16s |  ahead. We'll talk about how we identified and acquired hardware and software to configure
128.16s - 134.00s |  a small satellite testbed to model a real-world functioning satellite system,
134.96s - 141.20s |  how we try to test for vulnerabilities and create different test scenarios, and come
141.20s - 146.16s |  up with ways to harden satellite systems to protect from cybersecurity threats.
147.36s - 152.32s |  We developed Small Satellite Defender, which is a software. We'll talk more about that later.
153.04s - 160.64s |  And we were able to go to the U.S. Cyber Command Cyber Recon Symposium in Dreamport, Maryland,
161.28s - 168.40s |  and we also were able to experiment this Small Satellite Defender software on an actual satellite
168.40s - 174.80s |  orbiting Earth with Lockheed Martin, and we are currently working on assembling and experimenting
174.80s - 182.16s |  with TubeSat kits, and we're hoping to continue our efforts there with Small Satellite Defender
182.16s - 196.82s |  on those TubeSats. So the purpose of this research project was to come up with a
198.42s - 205.38s |  testbed of a small satellite system to be able to perform different research experiments to inform
205.38s - 212.02s |  how to better defend satellites from potential cybersecurity threats. As you may know,
212.82s - 219.70s |  launching satellites to space has become much more affordable these days with SpaceX launching
219.70s - 223.38s |  constantly all these rockets, which is great for our industry. We're able to
223.94s - 232.26s |  affordably launch a satellite, and that leads to the need of being able to ensure we harden
232.26s - 238.98s |  those satellites from potential threats. So in this testbed that we were developing,
238.98s - 246.26s |  we wanted to make it as real-world as possible. So our goal was to be able to operate
246.26s - 252.66s |  a payload of some sort. It could be either imagery, GPS, or communications, and then to
252.66s - 258.98s |  have the underlying critical infrastructure to support ground station communication, orbit
258.98s - 265.94s |  movement and positioning, as well as data processing and battery charging and pointing
265.94s - 271.38s |  towards the solar panels to get that charge. And by developing that, we would be able to
271.38s - 279.22s |  replicate a real-world system. So in the very beginning of this project, we spent time
279.22s - 286.34s |  researching, trying to figure out what the best avenue was to build this testbed. And we were
286.34s - 293.70s |  looking at the Raspberry Pi 4 as well as the Pi3 version 4 as well. We found that the Raspberry
293.70s - 300.42s |  Pis were relatively easy to acquire, obviously everyone's badges. It's fairly inexpensive,
301.62s - 307.70s |  simple to modify payloads and add payloads. There's a lot of pre-existing libraries already
307.70s - 313.14s |  configured. There's been a lot of research done out there in the community. Whereas the PiQ boards,
313.78s - 321.86s |  they were developed to be nanosatellites, and we found it very difficult to be able to write to
321.86s - 328.18s |  the boards. There was very little documentation available, and unfortunately when we acquired
328.18s - 335.22s |  that hardware, it was end of support. So we shifted back to the Raspberry Pi platform moving forward.
337.14s - 342.34s |  So this is an illustration of what we were trying to achieve with these Raspberry Pis.
342.34s - 348.34s |  We would have a satellite and the ground station. With the satellite, we have a payload, which in
348.34s - 353.62s |  this case we went with a camera where we can take pictures. We have antennas on both the satellite
353.62s - 359.54s |  and ground station. We're able to communicate to each other, send commands. And as you can see,
359.54s - 364.74s |  we had an encasement and some ports to be able to connect with it with a laptop, be able to
365.94s - 374.10s |  upload code, configure things, and so forth. And this is the real world image of what we created
374.10s - 380.10s |  in the lab. We were able to replicate that diagram. And essentially the camera, the radios,
380.10s - 386.58s |  and everything we ordered and put together pre-loaded libraries. So for the camera, we went
386.58s - 394.18s |  with the Aokin Raspberry Pi cameras capable of taking very low quality images, but just for the
394.18s - 399.94s |  purposes of showing that you can use payloads with the system we were setting up. And that uses
399.94s - 412.74s |  pre-existing Raspberry Pi libraries. We also used the RFM69ACW radios that attach directly to the
412.74s - 420.02s |  GPIO header on the Raspberry Pis that function at two different frequencies. It had a decent range.
420.02s - 424.66s |  We were able to go as far as 100 meters without any problems. We never had any need to go any
424.66s - 432.29s |  further than that for the purposes of this project. And for the communication with these
432.29s - 439.49s |  radios that we had in place, we set up a TCP style communication between the ground station and
439.49s - 445.97s |  satellite. The satellite would interface with cesium. We'll talk more about that later. And then
445.97s - 451.97s |  we would simulate this orbit window. And then when it would be in the communication window,
452.85s - 459.25s |  the satellite would send data to the ground station based on its previous tasking. And then
459.25s - 465.09s |  they would listen for additional tasking from the ground station. And we would control different
465.09s - 477.12s |  states for the satellite with the first byte of the data transmitted as an identifier. So in this
477.12s - 484.32s |  custom communication setup that we had, we had various bytes. We would let the satellite know
484.32s - 488.96s |  this is the end of the stream, or this is the start of a specific stream for pictures,
488.96s - 499.79s |  or it was a task, or it was for a configuration on the satellite. We also acquired the SenseHat
499.79s - 506.03s |  add-on board. This was originally developed for the International Space Station by the Raspberry
506.03s - 513.71s |  Pi Foundation. This allowed us to have an array of sensors with a variety of different temperature
513.71s - 520.11s |  communities. And the big thing for us was the gyroscope being able to position the satellite
520.11s - 526.11s |  to be able to figure out which way it's facing, which is really important for yaw and axis,
526.11s - 531.79s |  making sure the satellite doesn't spin out, and make sure that it's orienting the solar panels
531.79s - 538.51s |  in the right direction to get the energy to charge the batteries. With this add-on board,
538.51s - 542.11s |  there are a wide variety of different functions available with those sensors.
543.63s - 548.59s |  We would want to position the payload in the right direction to be able to take pictures
548.59s - 554.51s |  of Earth, and we would also want to protect the camera from not facing the sun, which can burn
554.51s - 561.87s |  the image sensor. We would orient the solar arrays using those positions, and we were able to measure
561.87s - 567.63s |  the orbit speed and g-force using the accelerometer built on the SenseHat board.
572.24s - 578.24s |  With all of these different components that we put together, we also had to keep track of
579.12s - 583.92s |  the satellite orbiting Earth. Obviously, it's in a lab just sitting on a table,
583.92s - 590.16s |  so we had to simulate the actual orbital movement. So we tried a variety of different
590.16s - 598.64s |  open-source software. The one that worked the best with our setup was Cesium Orbit software,
598.64s - 604.80s |  and as you can see in the pictures, we were able to configure two different views. You can see from
604.80s - 612.48s |  the satellite view to Earth, and you can see as it moves around the world, and whenever it would
612.48s - 619.20s |  come into a range of this ground station, you'll be able to see the pre-configured GPS location that
619.20s - 624.32s |  we would choose to be able to simulate that communication window opening and closing.
625.20s - 630.80s |  And as that orbit would occur, that's when we would transmit messages back up and down from
630.80s - 641.79s |  the ground station to the satellite. Once we had this test bed working well and functioning
641.79s - 648.27s |  the way we wanted it to, we started to move towards coming up with different task scenarios
648.27s - 653.87s |  and trying to come up or find different vulnerabilities that may be of interest
653.87s - 658.67s |  to try and make sure that a satellite that a researcher might send up to space, you want to
658.67s - 664.43s |  make sure that it doesn't happen to you, lose access to the satellite for whatever reason.
664.43s - 669.95s |  So we tried a variety of different attacks, man-in-the-middle attacks, denial of service,
669.95s - 676.19s |  spoofing that would interfere with the payload, as well as instructions that would send
676.19s - 681.71s |  configuration messages to the satellite. We would try to mess with those. We also tried to attack
681.71s - 687.39s |  the hardware itself to see if we could cause it to fail and no longer function in space.
693.44s - 697.28s |  So we looked at this in a variety of different ways. We looked at the communication,
697.28s - 701.12s |  the software that we were using, the hardware in the operating system.
701.68s - 706.32s |  We used a variety of traditional scanners, packet sniffers, and so forth.
707.28s - 711.60s |  I'm going to give you an example of one of the different scenarios that we came up with.
712.16s - 720.64s |  This was a man-in-the-middle attack scenario where the malicious actor with the correct
720.64s - 728.48s |  transmission bytes, we were able to send a configuration message to the satellite orbiting
728.48s - 734.48s |  Earth to make it think that we were the ground station when we were not supposed to be.
735.12s - 741.04s |  And essentially we were able to change the satellite IDs and take over on that communication.
743.34s - 751.26s |  So this created a lockout scenario where the satellite orbiting Earth would ignore messages
751.26s - 758.38s |  from the legitimate ground station and only listen to the hijacked ground station. And as you can see
758.38s - 766.38s |  we were able to take pictures in the bottom four images. You can see those were the normal pictures.
766.38s - 771.98s |  And then we were able to essentially take over and change the images being sent back to the
771.98s - 780.54s |  ground station. So we were able to either modify or withhold data or even change the data being
780.54s - 789.60s |  sent to the real ground station. Some other attack scenarios that the students worked on were
789.60s - 796.24s |  coming up with ways to mess with the Raspberry Pi system that ran the ground station as well as
796.24s - 804.40s |  a satellite. They had a lot of fun doing this. Most of this worked pretty well and we were creating
804.40s - 812.18s |  these different experiments that we might be able to in a more real world scenario. And after creating
812.18s - 818.10s |  all these different attack scenarios we spent time looking at ways to try to prevent different
818.10s - 824.58s |  things that we created. And we wanted to make sure that those things can't happen or it would be harder
824.58s - 830.90s |  to do. One of the obvious things was to us was to come up with a way to do command validation.
831.46s - 838.66s |  There were some commands that we were sending maybe with a typo or in a wrong order that
838.66s - 847.38s |  would cause a satellite to get confused and actually crash. We also created timeouts to
847.38s - 852.58s |  prevent the satellite from indefinitely waiting for the ground station to acknowledge messages
852.58s - 858.98s |  because this is a TCP communication model that we created. We also implemented a health check
858.98s - 867.22s |  where it would monitor the system and report any unusual warnings and then send that back
867.22s - 875.78s |  to the ground station. So by building this model we were hoping to avoid the need for
875.78s - 882.58s |  other researchers to launch satellites up to space and realize that something's vulnerable
882.58s - 889.06s |  or broken and not be able to fix it without having to launch another one. We really want to reduce
889.06s - 895.86s |  the chances of compromise or functionality of those satellites. And with this research we're
895.86s - 901.30s |  hoping to reduce the likelihood of having to replace what you already launched. And we created
901.30s - 907.46s |  this baseline testing system with this model to be able to improve the overall resource posture.
908.66s - 914.50s |  We published all of our efforts with this paper, the IEEE International Conference
914.50s - 922.42s |  on Cybersecurity and Resilience last year. And you can find the paper on there
922.42s - 928.02s |  and talks about the model in more detail and the different parts that we put together to make
928.02s - 935.86s |  this happen in more detail about these attack scenarios. I'm going to pivot over after we did
935.86s - 942.42s |  all of this stuff creating the model. We kind of shifted our efforts after we lost some students
942.42s - 948.90s |  from graduating. We got some additional students on the project. We started to focus on creating a
948.90s - 955.94s |  lightweight program that can monitor and protect satellites that are orbiting Earth. We found that
955.94s - 962.74s |  commercial off-the-shelf products that provide that level of security were too resource intensive.
962.74s - 969.14s |  So we wanted to create this lightweight program that can run and essentially protect the satellite
969.14s - 975.78s |  for potential threats. A variety of different things we incorporated including a scanner from
975.78s - 984.83s |  malware, monitoring different metrics of the file system, network checks, secure configuration, and
984.83s - 994.02s |  so forth. So these different attack scenarios that we came up with, we found some mitigation
994.02s - 1000.34s |  strategies and we wanted to implement those on that small satellite defender to be able to protect
1000.34s - 1009.47s |  the satellite from threats. I'll go in more detail about what we monitored. So we monitored all of
1009.47s - 1016.03s |  these different metrics essentially creating a baseline of known good of what is normal for a
1016.03s - 1021.07s |  satellite. And once you have that baseline, we would collect all this information and send it
1021.07s - 1026.27s |  back to the ground station for anything that may be unusual and have the ground station
1026.27s - 1035.41s |  operator to further investigate and figure out what may be going on. With that small satellite
1035.41s - 1043.81s |  defender work, we submitted a app stat to the CyberVCon symposium which was run by the U.S.
1043.81s - 1050.77s |  Cyber Command. And essentially they assigned us a mentor which was an Air Force colonel and he
1050.77s - 1056.21s |  worked with us to help develop small satellite defender and focus on creating different
1056.21s - 1064.61s |  experiments. And after that, we, the team traveled to the symposium and presented the work to the
1065.33s - 1073.65s |  director of the National Security Agency, Mr. Billy Cole. With all of those efforts with a small
1073.65s - 1082.37s |  satellite defender, we were approached by Lockheed Martin to run this software that we created on an
1082.37s - 1091.33s |  actual orbiting satellite. So Lockheed Martin has this Ignite team where they essentially create
1091.33s - 1099.01s |  opportunities for academia and other companies or researchers to be able to perform experiments on a
1099.01s - 1105.17s |  decommissioned satellite. And we were fortunate enough to have this opportunity with Lockheed
1105.17s - 1111.73s |  Martin where we were able to run the small satellite defender on an actual orbiting satellite.
1112.53s - 1121.41s |  So we worked with Lockheed Martin. They had their own identical twin of the satellite orbiting Earth
1121.41s - 1127.81s |  on a test bed and we worked with their engineers to run small satellite defender and we found that the
1128.21s - 1135.09s |  satellite did not work on the architecture that we developed, which was Python, and they needed us to
1135.09s - 1141.09s |  convert everything to Bash. So it was a challenge for the team to be able to quickly convert everything
1141.09s - 1147.65s |  we created from Python to Bash, refactored all the code, and worked with the test bed and Lockheed
1147.65s - 1154.13s |  Martin to be able to get the code to work and quickly deploy that. I believe in a couple of
1155.09s - 1160.61s |  weeks that's how quick we were working because we didn't know how long it would be until that
1160.61s - 1164.61s |  decommissioned satellite would no longer be available to perform experiments with.
1166.05s - 1174.05s |  And once we have a small satellite defender working with that test bed, we had a session with
1174.05s - 1182.61s |  their ground control team and we deployed small satellite defender on Linus space vehicle orbiting
1182.61s - 1190.85s |  Earth. We collected a system baseline and then we ran this experiment where we would introduce
1190.85s - 1196.69s |  some malicious activity where we would write a bunch of random garbage to different files,
1197.33s - 1203.41s |  basically clogging up the system resources in that small satellite defender would collect
1204.29s - 1210.45s |  metrics of the satellite and send them back to the ground station showing that unusual activity for
1210.45s - 1218.61s |  the operator to identify that something's going on. So that experiment was successful
1219.33s - 1226.77s |  and we were able to showcase the success and viability of monitoring a real world satellite
1226.77s - 1233.01s |  using small satellite defender within the small VM console available.
1233.97s - 1238.29s |  We had an article published and we also had an additional paper published
1238.29s - 1243.65s |  with Lockheed Martin where they wrote this paper talking about the process
1243.65s - 1248.37s |  of working rapidly with different universities to run different experiments
1249.97s - 1252.69s |  on actual space vehicles that are decommissioning.
1254.69s - 1260.37s |  And in the University of Alabama we put together this list of experiments and are working on
1260.53s - 1263.89s |  and are working on developing additional experiments to be able to
1264.69s - 1269.41s |  perform more of them if we have additional upcoming opportunities potentially with
1270.21s - 1285.42s |  the SMDC as well as Lockheed Martin moving forward. So where are we today? Right now we
1285.42s - 1293.66s |  are working on interorbital system tube sats. We ordered these six to nine months ago. It's
1293.66s - 1301.02s |  been a while. They've been building them and they finally sent us the kits. The reason why
1301.02s - 1306.86s |  we're now doing this is because we feel like this is the next step in our research and we're hoping
1306.86s - 1314.78s |  to finish putting together these satellites and just continue these different test scenarios that
1314.78s - 1321.82s |  we've developed and to do additional vulnerability research with actual real world satellites
1321.82s - 1328.86s |  instead of our test bed. And these satellites were about $8,000 each. We have two of them and
1328.86s - 1337.50s |  they're the small size probably like a a big can basically and it has space in there for a payload
1337.50s - 1342.14s |  of whatever you like to add in there which is really cool. We haven't figured out what we're
1342.14s - 1349.34s |  going to do yet with that but we are hoping to integrate small satellite defender in those tube
1349.34s - 1358.86s |  sats and to further iterate improvements with small satellite defender. So this one this image
1358.86s - 1364.38s |  is actually the one we put together in one of our labs and as you can see it's pretty small. You can
1364.38s - 1371.74s |  see the solar panels on that and the tube sats use a different architecture than the raspberry
1371.74s - 1377.82s |  pi's or linus so we're going to have to further modify the small satellite defender to work with
1377.82s - 1386.50s |  that. So with small satellite defender moving forward we're hoping to come up with two different
1386.50s - 1392.34s |  iterations one focusing on the ground station and one that focuses on the actual satellite
1394.74s - 1399.94s |  and we're hoping to collect all these different metrics to be able to provide a level of security
1399.94s - 1404.98s |  and to have that available for researchers to be able to secure their satellites when they
1407.79s - 1414.56s |  launch into space. These are the different metrics that we're hoping to collect. We're
1414.88s - 1420.80s |  paying attention to battery health system information and do health checks. We're going to be
1420.80s - 1426.96s |  focusing on satellite specific information. We're going to try to map those out on visualizations
1426.96s - 1432.16s |  for the ground station operator to be able to quickly see and identify some things that may
1432.16s - 1438.72s |  be going on and we're also going to obviously introduce security to this as well. Program error
1438.72s - 1446.80s |  chat sums and so forth. Here are some sample graphs that we're going to do with
1446.80s - 1452.00s |  Octave to be able to plot and visualize the tube sat metrics that we're going to collect.
1452.00s - 1461.41s |  We're going to show the solar panel charge, bus current, and temperature. We're also going to be
1461.41s - 1466.85s |  collecting information on the positioning of the satellite. If it starts to spin you'd be able to
1466.85s - 1478.11s |  quickly find that on those graphs as well. That's all I have for you today.


url: https://www.youtube.com/watch?v=6lJ26UG9hLU
title: DEF CON 32 - Signature-Based Detection Using Network Timing - Josh Pyorre
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=6lJ26UG9hLU",
  "title": "DEF CON 32 - Signature-Based Detection Using Network Timing - Josh Pyorre",
  "description": "Malware traffic is commonly identified using signatures based off its code, strings, and associated network infrastructure. However, it's also possible to build signatures from the timing between network transactions. This presentation will explore using network captures of known malicious network activity to find similar behavior in random traffic. The talk is technical as it involves processing packets with Python and a some data science, but will be presented in a way that anyone should be able to understand and enjoy.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2563,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.00s | This text was transcribed using whisper model: large-v2

 Alright, good afternoon everyone and it is 1.30 Pacific time in beautiful Las Vegas, Nevada. Um,
9.80s - 14.80s |  thank you so much for joining us today and this next talk is um, sponsored by the Packet
17.34s - 22.34s |  Hacking Village and it is my absolute pleasure to introduce to you Josh Piore. Thank you.
22.90s - 30.52s |  Alright, so um, that's me. I uh, work with secur- uh, Cisco Talos. Um, previously I've worked with
32.70s - 37.70s |  Zscaler, um, Umbrella, OpenDNS, NASA, and Mandiant and some other places, some non-profits
38.90s - 43.90s |  and what not. So, I do security research and I uh, make music and do a bunch of other stuff.
45.84s - 50.34s |  So, uh, before I get into all the details I'm gonna talk about what I wanna focus on when I'm
50.40s - 54.76s |  doing this kind of thing. I'm gonna talk about attribution and the infection chain real quick
54.76s - 58.66s |  and uh, it's probably very familiar to you. So, hopefully I'm not gonna bore everyone but I'll
58.66s - 63.60s |  just continue on. Um, so looking at attribution, when you're looking for something, I spent most
63.60s - 68.24s |  of my time as a threat hunter. When you're looking for something, uh, you're following one thing
68.24s - 73.94s |  that you see. So, maybe I found a- a domain or a URL. In this case I found this one at
73.94s - 79.34s |  urlhouse.abuse.ch and then I um, I can see it's part of Emotet. A lot of the samples I'm using
79.34s - 83.42s |  are kind of some old samples for the moment. I have some newer stuff later on but uh, this is
83.42s - 88.42s |  part of Emotet, part of Epoch 4. There are various epochs, various um, evolutions. Um, if I look
90.92s - 97.60s |  at that in like VirusTotal, I can find a hash that's associated with this- this uh, URL and then
97.60s - 104.04s |  I can follow that trail looking for more hashes. Uh, VirusTotal has- makes this very easy. Um, I
104.04s - 108.64s |  can then keep on going and getting more and more attribution and finding more of this uh,
108.64s - 114.58s |  particular variation of Emotet. Maybe it's today's variant or this week's variant. Um, uh, I
114.58s - 118.72s |  can copy the hash for that file and I can go in multiple different directions. Take that to
118.72s - 123.72s |  another interface and uh, find additional things. Uh, keep on looking, basically ending up at
127.66s - 131.60s |  finding a whole bunch of different URLs. So, as a threat hunter I would do this to like find
131.60s - 137.34s |  additional compromised URLs. In this case a bunch of WordPress URLs that are um, dropping uh,
137.34s - 143.88s |  this- this specific version of Emotet at the time. Um, maybe I have another example, just to
143.88s - 149.74s |  give you another example. Um, I go to any.run which is a- a malware sandbox that you can go to
149.74s - 155.18s |  and I grab something. I see a URL that's at this IP address and I grab that IP address, go look
155.18s - 161.16s |  for it in another place and get some hashes. Um, and get more information. Keep building up my
161.16s - 165.86s |  thing. You have to know when to quit of course, but keep building and um, eventually you can do
165.88s - 171.48s |  something like you can map it all together following host infrastructure. Uh, finding what
171.48s - 176.76s |  these specific threat- threat actors are- are using to make their um, their malware do what it
176.76s - 181.60s |  does. Um, but there's always patterns as we all know like when you look at binary analysis or
181.60s - 185.44s |  anything like that. There's certain variable names- names that are the same because it's- it's
185.44s - 191.74s |  difficult to change your habits uh, as a- anything in the world. Um, there's a framework for
191.76s - 196.16s |  this. You probably all know about it. Minor attack framework to uh, attribute various tools,
196.16s - 202.44s |  tactics, procedures to things and to groups like APT29 which is a threat group and it's you
202.44s - 207.08s |  know if something belongs to them because it follows these certain procedures. Um, they use
207.08s - 211.12s |  certain techniques. You can track everything with this. It's- it's nice. It's a little hard to
211.12s - 216.02s |  automate, but it's nice. Um, there's books about this kind of thing. This is a great book about
216.02s - 221.22s |  this. I actually bought it at Defcon a few years ago. Um, but there are levels of attribution.
221.24s - 225.24s |  Uh, when I worked in the government we were very interested in threat actors. Like what threat
225.24s - 230.64s |  actor is responsible for this thing and APT was the word of the day every single day. So, um, we
230.64s - 235.32s |  were interested in individuals, other governments, the state sponsored stuff. Uh, in some
235.32s - 239.56s |  cases, many places I'm interested in campaigns. So what is the malware campaign that I'm looking
239.56s - 245.56s |  at? Uh, is it Emotet or is it something like a remote access Trojan or is it ransomware or
245.56s - 250.80s |  whatever? Um, and then in most cases like small environments you just want to know what's
250.84s - 256.72s |  inside your network. That's your attribution level. So let me talk briefly about the
256.72s - 261.18s |  infection chain cause it doesn't change much just like the behaviors of all these things don't
261.18s - 265.86s |  change much. Um, making it possible to track them. Using Emotet again, it's just so easy to
265.86s - 270.60s |  use and I'd like to make fun of it. Um, it usually comes in via an email and then you get a
270.60s - 276.50s |  link to something or an attachment to something. Leads to OfficeDoc with macros, PowerShell,
276.54s - 281.48s |  uh, more macros, it'll install additional components than the C2 stuff back then. I mean,
281.48s - 285.28s |  not, not so, I mean it would lead to Cobalt strike, but maybe it leads to remote access
285.28s - 290.18s |  Trojan. Um, this is just Emotet, but this is kind of a pattern with, with most things. The
290.18s - 294.82s |  easiest way to compromise is, you know, get the user via some kind of email dropper or a link
294.82s - 302.86s |  to something or drive by download. Um, uh, usually, uh, oh, let's see. I forgot that I made
302.86s - 308.20s |  this segmented, but I just went over that. So, uh, another one, QuackBot, same kind of
308.20s - 312.84s |  thing, but a little bit more complex, maybe to make it seem more authentic. Um, usually they
312.84s - 318.04s |  get an email which has a link, which leads to a password protected zip file. They, uh,
318.04s - 321.72s |  possibly open that file and then they have an ISO and they're like, what do I do with this?
321.72s - 325.38s |  They open that, there's a Windows shortcut, downloads things and then it does what it does
325.38s - 332.78s |  after that. Um, and typically you see that get request, uh, in, over HTTP. Maybe you see it
332.78s - 337.42s |  more these days over SSL, but often you'll see it over HTTP and then SSL traffic starts after
337.42s - 342.30s |  that. When you're detecting this, this kind of stuff, um, it's harder where you get to the SSL,
342.30s - 347.30s |  but I'm gonna talk about that too. Uh, the problem that I'm addressing here is how do we find
347.30s - 351.60s |  bad things in the network? How do we get the attribution of what's inside our environment
351.62s - 357.90s |  without knowing too much? Um, so, you know, this is just my home network. I'm just capturing
357.90s - 363.54s |  stuff on a, on a capture device. Um, it's not very busy, but I mean, of course networks are way
363.54s - 367.54s |  busier than this, but how do you find something like this? This is just a super simple example
367.54s - 373.08s |  of like a post, uh, over clear text of someone putting a username and password in, into a
373.08s - 377.26s |  compromised WordPress site. How do you find that inside that? There are ways, obviously we
377.28s - 383.12s |  know about this, I'm sure. Uh, intrusion detection and Yara, I'm gonna talk about these. Um, so
383.12s - 387.16s |  IDS rules, uh, this is kind of a crazy slide, but at the very top, if you're familiar with this,
387.16s - 392.36s |  is an IDS rule. I'm using Emotet and Zenempel. Uh, it would capture what you see in this PCAP.
392.36s - 396.30s |  It's gonna look for things like the, the content being the post. It's gonna look for a specific
396.30s - 402.68s |  kind of post content. Uh, maybe it's looking for the user agent, uh, or some other data. Um, and
402.68s - 406.68s |  when I run this, like if I run a PCAP or I run that malware in my, when I ran it in my home
406.70s - 412.28s |  environment, I, I triggered six alert fires, uh, through Suricata, um, reading this rule. So
412.28s - 417.68s |  there's really easy detection mechanisms for certain things. Of course, as with most things,
417.68s - 421.58s |  you have to know what you're looking for. You have to have already seen it in many cases. Yara
421.58s - 426.48s |  rules are typically, uh, not thought of as a streaming detection mechanism. I mean, they can
426.48s - 432.40s |  be used in such a way. Uh, we use them at my work like that. Um, but, uh, they're typically for
432.42s - 438.52s |  finding strings or, or data in binary analysis. You can look for stuff in HTTP text and
438.52s - 443.20s |  JavaScript. So it's not really thought of as a thing you can use for PCAPs or net streaming
443.20s - 448.50s |  network traffic. But I did find that someone wrote a tool called Yara PCAP. I took that and I
448.50s - 453.24s |  modified it. My code's gonna be at the very end of this. I have a link to it. Um, but I modified
453.24s - 457.64s |  that to include it as a proof of concept if you wanna play with it. Uh, so you can upload a PCAP,
457.66s - 464.66s |  um, uh, and test it. What it, how it works with the Yara PCAP thing is you write a Yara rule, um,
464.66s - 469.30s |  just like based off this IDS rule that I had before. It becomes a really simple, much easier to
469.30s - 475.90s |  read. I'm looking for a post for the, um, user agent, certain kind of content, the refer information,
475.90s - 480.14s |  and then I wanna get all those things when it sees them, it triggers. So like if you look at my
480.14s - 486.78s |  web app that I built, um, uh, you browse to something. It, I pull up like a test Yara. It, I
486.78s - 494.30s |  can see that I get these two alerts basically. So it's possible to, to capture stuff over network
494.30s - 499.30s |  with Yara as a dec, detection mechanism. Um, there's just a view of it. Uh, there are some
503.00s - 508.60s |  obstacles here. I'm gonna talk about a lot of obstacles. But, um, visibility, SSL, I briefly
508.60s - 514.42s |  touched on this. Um, uh, going back to that infection chain, usually you get your email and
514.42s - 518.12s |  that's gonna be one endpoint detection. You're looking at your email detection. Does it
518.12s - 522.76s |  hopefully have something that's watching your email? Uh, you maybe have a, uh, going to get that
522.76s - 528.70s |  link over HTTP or you have an attachment already in the email. So, I mean, you hopefully
528.70s - 533.64s |  detected it in the email and then your endpoint detection is hopefully catching that office
533.64s - 539.18s |  doc with all the macros and it's seeing PowerShell run and it's stopping it. Um, uh, then
539.18s - 543.22s |  installing additional components is probably gonna be over SSL. You're probably not gonna know
543.22s - 548.08s |  that's, uh, something weird is happening. Uh, except for the endpoint that it's con,
548.08s - 551.52s |  connecting to if you're in monitoring that or if you're looking at DNS, you can also get some
551.52s - 557.22s |  information from that too. Um, and the C2 is did, usually gonna be SSL as well and beyond
557.22s - 561.64s |  remote access Trojan traffic, everything. And then when they drop ransomware on there, it's
561.64s - 567.60s |  just like you don't have visibility into the whole thing like you did maybe 15 years ago. Um,
567.62s - 574.30s |  and here's an example like a iced ID dropper. Uh, it, it was a, you get it via over HTTP and
574.30s - 579.70s |  then, uh, traffic starts right afterwards with SSL. So, you can capture that HTTP and maybe
579.70s - 585.68s |  the SSL with some kind of magical behavioral analysis or in some cases stuff I'm showing you
585.68s - 590.88s |  kinda catches it sometimes. Uh, there are solutions for this. I, when I give talks, I don't
590.88s - 595.38s |  do vendor talks usually. So, I, I try to talk about free things. Um, there, I think Proxifier
595.40s - 601.14s |  has a, a fee, but you, uh, enterprises like my company and other companies offer solutions to
601.14s - 605.18s |  man in the middle of your SSL traffic. You have to install something on the, the clients and so
605.18s - 610.82s |  you can intercept that stuff for better detection. Um, but you can also do it for free. Uh, so
610.82s - 615.92s |  is this possible, this thing I'm talking about here? Well, let's find out. Um, I had this idea
615.92s - 620.56s |  from a talk I gave a long, long time ago. I was looking at, these are really old samples. Um,
620.58s - 627.52s |  these are the, okay, I'm not a data scientist, so ignore the numbers on the left. Um, I, uh, was
627.52s - 631.36s |  plotting the time, I was plotting when things were happening with a sample like over the
631.36s - 636.96s |  network. When does it make a GET or a PORT request or when's the SYN, SYNAC, uh, etc. Um, and
636.96s - 640.54s |  it's a whole bunch of samples. And I was seeing there's a relationship between these samples,
640.54s - 645.60s |  but I, I don't know, maybe, maybe not. Um, then I looked at Emotet samples. I, it's different
645.62s - 650.62s |  than Hansitor. Um, it's different and they're related by the way, but they're, um, the traffic
653.26s - 656.70s |  stuff is different. And then we look at Trickbot, same kind of thing. They're related to each
656.70s - 660.94s |  other, very different from Hansitor and Emotet. I'm not gonna show you more examples of malware,
660.94s - 665.80s |  but I was like, maybe there's an idea here of something I could explore. Um, so let's talk
665.80s - 671.24s |  about finding some patterns and show like some examples. Um, I'll use dropper downloads. So
671.26s - 675.46s |  when you first get that dropper, beginning out, um, and we'll have a little bit of SSL in there
675.46s - 679.46s |  and then benign versus malicious, because in many cases I'm wondering, is this just how
679.46s - 684.00s |  networking works the way that I'm doing this? Or is it bandwidth that's causing issues or not
684.00s - 689.30s |  causing issues? Um, looking at dropper downloads first, I'll take two separatized ID
689.30s - 694.24s |  downloads. Um, I'm getting these requests. I've got almost double the transactions on the top
694.24s - 700.14s |  one than the bottom one. And, uh, the download is basically the same. Um, but so these, they
700.14s - 706.76s |  look different, but in terms of how many transactions happen, um, I'll, uh, look at the timing
706.76s - 710.56s |  in between these. Like, so when a transaction happens, then the next transaction and what's the
710.56s - 715.40s |  timing between that. And that's what I'm gonna be focusing on mostly in this talk. Um, and I,
715.40s - 718.96s |  despite the difference in transactions, I'm seeing that there's a sort of a pattern just, you
718.96s - 726.70s |  know, just using my meat brain. Um, I've got a big time and a small and larger, small, really
726.70s - 731.04s |  big, smaller, et cetera. So I'm seeing a pattern. I'm wondering it, is this something I can work
731.04s - 738.54s |  with? Um, let's look at beaconing. Um, this is over SSL Cobalt strike beaconing, two samples. Um,
738.54s - 744.12s |  I, is this even, can I, am I gonna see the kind of same results or is this just how networking
744.12s - 749.22s |  works? This is what I'm always asking myself. Is this just stuff I don't know about? Um, I look
749.22s - 752.86s |  at it, I'm kind of seeing the same patterns where I get that big one and small one. So it's, it's
752.86s - 759.00s |  still maybe, maybe it's just how it works. Um, I do emotet and trick bot beacons. Um, same kind
759.00s - 766.04s |  of thing. So I need to find something to show me a difference. I need two samples that are alike
766.04s - 769.94s |  and I wanna know if they're, they behave differently. So benign versus malicious. Um, I
769.94s - 773.84s |  downloaded this, uh, thing called existential.exe. I found it when I was looking for a benign
773.84s - 779.52s |  exe file. It's, someone wrote it to look like a, a malicious dropper download, which is usually
779.52s - 785.76s |  pretty small. Um, you can see I get it and I'm getting it from some site, a domain that I own. Um,
785.76s - 790.22s |  and then I compared it with a malicious dropper download. I don't remember the malicious dropper,
790.22s - 795.50s |  but I'm seeing there are some similarities, but it's starting to be different enough that I decided
795.50s - 800.70s |  to explore further. So let's talk about the processes that I'm going to play with and use in
800.70s - 806.84s |  this. I'm going to talk about averages, Levenstein distance, and some fuzziness. There's some
806.90s - 814.78s |  challenges. Um, again, um, finding the part that I'm interested in. Uh, if you have, uh, network
814.78s - 819.84s |  traffic, how do you find the bad stuff? I have malware, malware analysis sandboxes at home. We
819.84s - 825.12s |  have them at work. We have them all available to us for free. Um, so you can find this stuff. Um,
825.12s - 830.06s |  but if you have a, a PCAP full of stuff, how do you find it? And there's always, there's flows
830.06s - 833.62s |  in, in a, in a huge PCAP file. You're gonna, these are the connections between all the
833.64s - 837.82s |  different servers, or maybe just do one machine and all the places it connects to. So how do you
837.82s - 844.18s |  separate all these flows in an efficient manner and then operate on them? Um, there are, as I
844.18s - 847.36s |  mentioned, there are places we can go get stuff. I'm gonna use a lot of examples from malware
847.36s - 852.66s |  traffic analysis for the awesome site. You can download, uh, an exact peak, like almost a
852.66s - 857.14s |  carved PCAP. Sometimes there's extra data in there, but of malicious stuff. And I'm going to use
857.14s - 862.24s |  that for what I'm going to build signatures out of. Uh, so once I have a viable key PCAP, like I
862.26s - 868.40s |  downloaded from malware traffic analysis, um, uh, like I'm gonna use this iced ID with cobalt
868.40s - 874.54s |  strike. It's old, but, um, oh wait, I forget something. Oh yeah, once I have a viable PCAP, I, I
874.54s - 879.64s |  can use that. So I'll play with the detection ideas. I'll play with the averages and I'm gonna
879.64s - 884.02s |  look at co-integration. And, um, once again, I'm not a data scientist. I'm gonna talk about
884.02s - 887.86s |  co-integration and I might mess it up a little bit, but I know how to make it work in the thing,
887.88s - 894.72s |  sort of. So, um, averages first. Um, when I look at an isolated trick bot post from that viable
894.72s - 900.88s |  PCAP that I download, I've got 840 queries. Um, I'll take the queries in between the
900.88s - 905.76s |  transactions and I'll put them in a big list. And this is basically the entire PCAP in terms of
905.76s - 911.40s |  time from the very beginning to the end from when it runs. And then I'll find the average. So,
911.40s - 915.54s |  you know, I'll add them together and I'll divide them, um, and get the average number. So
915.56s - 921.68s |  average time between is 12,748 for this one PCAP. And then, um, take another one. I've got a
921.68s - 927.76s |  different set of queries, do the same thing. And I've got these, uh, averages that on their own
927.76s - 934.24s |  don't look that similar. The number is 14, uh, 14, 748 and 16, 125 different, but I need to
934.24s - 938.20s |  compare it to other stuff to see how related they might be to each other. So I'll compare this
938.20s - 945.00s |  against some random traffic. I take a random PCAP just with stuff in it and it's got 779
945.00s - 950.26s |  queries. And I'm also taking one flow from that random traffic just to add another thing, just
950.26s - 954.98s |  32 queries. So it's not that much data. And, um, when I look at it in this context, I'm seeing
954.98s - 959.14s |  that there's a little bit more of a relationship between them. And if I scale this, I'm seeing
959.14s - 965.30s |  even more of a relationship between them. I don't have that as a example, but, um, so I'm like
965.30s - 970.42s |  feeling like I can continue on and explore this further. I'm going to talk about co-integration
970.44s - 976.00s |  as another method. Um, so co-integration as described is usually a drunk guy and a dog are
976.00s - 979.76s |  walking, they're walking together. So they're co-occurring with each other, but are they
979.76s - 985.00s |  actually together? Um, so there's this model to, to run it against them. And if they start to move
985.00s - 988.76s |  in a different direction, you can see that they, uh, they co-occurred, but they don't, didn't
988.76s - 992.76s |  co-integrate. They're not actually together. They're just doing their own thing. Um, basically
992.76s - 998.72s |  like that. And some of it's just, uh, some little parts, uh, to describe it. When I show some
998.72s - 1004.50s |  graphs, uh, P value, it's the probability that the relationship between those series is due to
1004.50s - 1009.54s |  chance. And then there's a spread, which is the difference between the two actually co-integrated
1009.54s - 1014.38s |  time series, um, to show how far they deviate from their, their long-term relationship with each
1014.38s - 1020.44s |  other. Um, just some examples like Russia, Ukraine searches on Google, they, they, um, they, on
1020.44s - 1026.62s |  the spread, they were together and they, they separated, um, away from the spread, but they did
1026.62s - 1030.28s |  at the same time. So they're, they're co-integrated and they're, they stay together. Basically
1030.28s - 1035.16s |  these are co-integrated co-occurring things happen at the same time. Um, Twitter and Elon Musk
1035.16s - 1040.08s |  around that time, I think that's around when he took it over. Um, so they, they, they don't
1040.08s - 1044.88s |  really, they're way off the spread. The timelines don't match up, but they come together right at
1044.88s - 1048.88s |  the same time, uh, to zero on the spread right there. So there was a relationship because
1048.88s - 1052.76s |  everyone's like, Oh, what's going on with this? And they're Googling it or whatever. And then,
1052.76s - 1056.30s |  um, you know, 5G and COVID, I just had to put this in here because people were searching it.
1056.30s - 1060.38s |  They, they matched, stayed on the spread all the time. And then they both searched the same
1060.38s - 1069.70s |  time that people, whatever. Um, so two identical PCAP files. If I take the same exact ones,
1069.70s - 1074.78s |  they're going to definitely co-integrate, um, uh, just as a test to see if I could do it, I
1074.78s - 1078.90s |  guess, you know, and you've got, uh, I put a scatter plot here. The little numbers on the
1078.90s - 1082.84s |  bottom are the times that in the milliseconds, um, and they're on top of each other. There's a
1082.84s - 1086.80s |  blue value underneath the orange value. Of course, they're identical and the P value, which
1086.80s - 1092.28s |  you want to be between zero and one. It's the probability value. Um, they matched exactly. So I
1092.28s - 1096.32s |  want to try two different PCAP files. It doesn't matter what they are, if they're malware or not.
1096.32s - 1102.76s |  Um, they won't co-integrate though. Uh, and, and they don't, the P value for file one is way off
1102.76s - 1107.60s |  and, and the scatter plots just a mess. Um, and I'm starting to think that there may be some
1107.62s - 1113.06s |  problems with co-integration, but there's maybe also a method to start finding similarities. Um,
1113.06s - 1120.10s |  I'll try two different PCAP files with similar traffic. So this, these are benign, um, one to, uh,
1120.10s - 1126.18s |  DigiCert and one to Windows Update, just some get requests. Um, when I map them, I've got a
1126.18s - 1130.38s |  seconds marker. I'm using seconds here and most of the stuff I'm gonna use microseconds and I'll
1130.38s - 1136.72s |  mention this in a second. Um, but at 48 seconds, then 50 seconds, then 53 seconds, then zero and
1136.72s - 1141.64s |  that other one at 38 seconds and 46 rolling through time as we go forward. Um, and at the
1141.64s - 1146.42s |  number of transactions at those seconds. Um, when I map them, I get similar P values cause
1146.42s - 1151.36s |  they're kind of similar. Um, the timing difference is a little bit off because one started later
1151.36s - 1156.66s |  and one started earlier. Um, there are some problems as I mentioned with co-integration like,
1156.66s - 1161.34s |  um, the time value. Uh, I've got this one and I've got this other one that has a huge one. I'm
1161.34s - 1166.54s |  gonna get a scatter plot or, or data that the second one's gonna far exceed the other one. They
1166.56s - 1170.56s |  aren't gonna really match up the way I want them to. Even if I'm doing just individual flows
1170.56s - 1175.76s |  compared against each other. Um, as you can see, that's what I did here. I forgot that I put the
1175.76s - 1182.80s |  slide here, but, um, the orange one keeps on going. The P values are different. So, um, uh,
1182.80s - 1187.92s |  short sample size. In many cases, a flow will be very minimal. So, uh, I'm gonna get something
1187.92s - 1193.92s |  where I, I can't do anything with it. So let me talk about time resolution. I just briefly
1194.00s - 1199.54s |  mentioned I talk about this. Um, you have to decide where you, how much time you wanna work
1199.54s - 1204.44s |  with. At the minutes resolution, you're not gonna get much data. It's gonna be spread out one per
1204.44s - 1209.54s |  minute. And then, um, or all your transactions in a minute. The seconds you're gonna get some
1209.54s - 1213.02s |  data, but it's not gonna be useful. Microseconds you get a lot more data. So I'm gonna work with
1213.02s - 1218.62s |  microseconds. Uh, also normalization because things aren't starting at the same time. I want
1218.62s - 1223.56s |  them to start at the same time. So I decided to make all PCAPs, um, or any network transactions
1223.96s - 1231.14s |  throw through this to start at January 1st, 2000, just to get them to line up. Um, and, uh, this
1231.14s - 1235.34s |  just sort of shows that I don't have to really describe it, but they show how they all start at
1235.34s - 1239.74s |  the same time. Um, now talking about signatures and detection where it's getting a little more
1239.74s - 1243.42s |  interesting, where I'm starting to play with actually building the signatures. Uh, I wanna
1243.42s - 1247.22s |  separate the flows first. I'm gonna calculate percentages. I'm gonna do distance. I'm gonna do
1247.22s - 1251.92s |  fuzziness and I'll involve, uh, Levenstein distance and other things. So first I have to
1251.92s - 1256.26s |  separate these flows. As I showed before, it's a lot of flows inside network data. And if you're
1256.26s - 1261.52s |  running this, uh, with like, you have Damon logger or you have TCP dump writing a packet, uh,
1261.52s - 1268.10s |  capture to file on your, um, your logging systems. Um, and then you're, you're gonna have tons of
1268.10s - 1271.34s |  data in there. You have to separate those flows. So I'm gonna operate against each flow
1271.34s - 1277.04s |  individually. This is computationally, um, intense. So, uh, in my code I've made it so it's
1277.06s - 1281.64s |  multiprocessing. At least there's that. Um, so when I run it, I, it'll just use whatever
1281.64s - 1287.40s |  processing power you have. I'm using on this laptop and it was pretty fast for like a, um, a
1287.40s - 1292.98s |  fairly large file. And so once I operate that, I get the average time between queries and the
1292.98s - 1297.12s |  total queries. And I also get some other data. I added more after this point. Uh, and then I'm
1297.12s - 1303.36s |  gonna calculate percentages because I'm ending up with these times and these averages and, uh,
1303.38s - 1307.56s |  it's kind of messy. I want it to be smaller. I'm, I'm, I'm ultimately working towards a goal of
1307.56s - 1313.46s |  building a small list of numbers that I can make into a signature. So when I take those
1313.46s - 1318.70s |  frequencies, so I started off, I'm getting ahead of myself, those, um, numbers and the times in
1318.70s - 1323.60s |  between. And I say, this time is what percentage of the entire PCAP. I do that for the whole
1323.60s - 1328.04s |  thing. And I ended up with, there's a lot of zeros. And then there's a lot of times where it
1328.06s - 1333.24s |  doesn't. Theoretically this whole list should equal a hundred. Um, I do some stuff to it and, uh,
1333.24s - 1337.30s |  it doesn't quite equal a hundred after I get, after I deal with it. But if I look at just a quick
1337.30s - 1342.60s |  look at just this raw percentage data, I'm kind of seeing the same traffic patterns between
1342.60s - 1347.88s |  PCAPs. Uh, I had a little chaos. Like I said, I do some stuff to it. I take away those zeros, I
1347.88s - 1353.76s |  round things. Um, uh, this, you add it up, it won't equal a hundred, but it's because I did
1353.78s - 1359.68s |  stuff to it. But, um, it's all in my code, which you can see. Um, basically what I'm ending up
1359.68s - 1363.42s |  with is something like this, where I have this list of numbers and I'm thinking, well, this is,
1363.42s - 1368.70s |  okay, this is something. It represents the time of a transaction. Uh, so we can find exact
1368.70s - 1374.00s |  matches, like the exact same thing and other PCAP data. And that's nice, but I'm looking for
1374.00s - 1381.60s |  variations of malware. Like, um, when the new variant of today's hot malware drops, uh, because
1381.62s - 1388.66s |  the last one was burned, um, how do we find it? Uh, so I look at percentages and distances. I've
1388.66s - 1392.70s |  talked about Levenstein distance. And, um, let me go into that a little bit more. Uh,
1392.70s - 1398.70s |  Levenstein distance, if you don't know, it's, uh, usually used on string data. And, um, uh, if
1398.70s - 1403.14s |  you want to know like how far away the word kitten is from sitting, you replace that K with an S
1403.14s - 1407.44s |  that's one distance. You place the E with an I that's a second distance. You add a G that's a
1407.44s - 1413.76s |  third distance. So it's three, uh, distance from each other. And I was thinking maybe I could use
1413.76s - 1418.86s |  this even on small bits of data and treat those numbers, not like integers, but, uh, like
1418.86s - 1427.00s |  strings. So, uh, if we remember, I want to find this behavior, this little bad thing in this
1427.00s - 1433.60s |  whatever thing. So I'll create my signature, um, which looks like this and it doesn't look that
1433.62s - 1442.34s |  valuable. It's a bunch of ones and twos and that one. Um, and when I run it, uh, uh, on something
1442.36s - 1446.82s |  using Levenstein distance, I get a number at the very end. That number are going up to a hundred
1446.82s - 1453.00s |  equals the probability that I'm finding inside of flow is something that matches. Um, um, but I
1453.00s - 1457.12s |  like, I can see if there's a lot of like 58, 67, there's one that's a hundred. That's the one I
1457.12s - 1463.04s |  made my signature from. So of course it matches cause it's exactly identical. Um, so I'm starting
1463.04s - 1469.12s |  to get somewhere where I can maybe be a little looser in my searching. Um, I'm just looking at
1469.20s - 1473.56s |  that PCAP and seeing this, the thing I made a signature from. Um, but I need to be fuzzier with
1473.56s - 1478.64s |  it. I needed to get a little bit looser. Um, there was something that was called fuzzy, was he,
1478.64s - 1484.68s |  which is so cool, but it's the fuzz now. Um, uh, so I'm using this to apply a different
1484.68s - 1490.24s |  threshold, um, based on the Levenstein distance. When I run this, I'm going to get another number
1490.24s - 1495.36s |  that's been modified. It still has the hundred for the signature match, but it has other numbers
1495.36s - 1501.24s |  that I'm interested in, like the 75, uh, 67. Um, what are these numbers and what do they
1501.24s - 1510.72s |  represent? So, um, can't remember if I opened the PCAP in this one. Let's see. I did not. So
1510.72s - 1514.68s |  the signature made from this flow, as pointed out before, got these two other ones I'm interested
1514.68s - 1519.96s |  in. Um, if I look at one of them, I get an exact match. Um, if I look at another one, it's exact
1519.96s - 1526.44s |  match. Um, so that's interesting. I have no match on 67. So maybe there's a number I can pick
1526.44s - 1531.32s |  that is my magical number. That's going to find this all the time. Um, there's some tuning
1531.32s - 1535.72s |  involved because different malware campaigns are different with each other. And this is, um,
1535.72s - 1539.88s |  I'll talk about this in the future work I'm going to work on, but just showing tuning. Um, I'm
1539.88s - 1545.96s |  sorry to show you code. Um, but basically I'm looking as kind of described already. Um, the
1545.96s - 1551.08s |  partial ratio is greater than my threshold. That's that partial ratio is from the fuzz thing.
1551.08s - 1554.52s |  And Levenstein distance is less than my Levenstein threshold. So I'm working with these two
1554.52s - 1560.72s |  variables. Um, and I just have to tune them depending on what I'm working with. Um, and I can
1560.72s - 1566.20s |  set that, you know, at the very top of my code. And this is all in the read me on the GitHub. Uh,
1566.20s - 1574.28s |  so if I go get two things, um, dark gate activity, I downloaded one from 1130, uh, 2023 and 12,
1574.28s - 1579.32s |  seven, 2023, I don't think I could find, I wasn't able to find newer stuff than that. Um, just like
1579.32s - 1588.89s |  last week. But, um, uh, what I'm going to do is I'm going to carve out the bit I'm interested in
1588.89s - 1599.69s |  from the 1130 one first. Uh, let me scroll down here to a post. So I'm finding, uh, this
1599.69s - 1606.41s |  information here, this post that's a suspicious and we know it's bad. And I'm going to save this
1606.41s - 1611.53s |  to create a signature out of it. So I'm just, I'm exporting just the displayed packets,
1611.53s - 1619.05s |  saving it as dark gate post. And then, um, just showing you where it looks like this. It has no
1619.05s - 1623.93s |  other flows in it. Just this one flow between these two servers. And then I'm going to upload
1623.93s - 1630.20s |  this to create a signature. And when I uploaded it, it creates a really simple, like there's three,
1631.16s - 1635.40s |  there's three numbers. It doesn't seem like I can do much with that, but I'll show you.
1637.16s - 1644.04s |  And then when I go and I, um, upload the same file, I want to see the, I want to,
1644.04s - 1648.52s |  I'm tuning it right now. So I'm getting a match, of course, on my exact match. Um,
1651.80s - 1656.04s |  but if I look at some of the other ones below it there, um, I'm going to see some other
1656.04s - 1660.60s |  additional matches here. So it's not quite tuned yet. I've got 11 sign distance of four,
1660.68s - 1665.72s |  a ratio of 75%. I click on the very top one, which is the most matchy that didn't match.
1665.72s - 1675.08s |  It's the same one. Um, I continue down the list and maybe go to 67%, um, uh, distance of four
1675.08s - 1681.40s |  on 11 Stein. And I've got another match here. So I I'm, I've obviously got to fix the thresholds
1681.40s - 1689.61s |  I'm working with. I look at 64%. Let's see what this is. And, uh, in this case, I'm not getting
1689.61s - 1699.53s |  a match. So I'm starting to define the numbers I can work with. Now, um, uh, I look at this one,
1699.53s - 1707.53s |  the 67%, it's a match. And so between 67 and 64 is where I want to be 11 Stein five or four
1707.53s - 1712.25s |  somewhere on there. And so I just want to adjust those values and play with it. Then we'll try this
1712.25s - 1716.41s |  again. So I've, uh, unfortunately you've got to see me carve out that part again. I'm going to
1716.41s - 1719.45s |  carve out a little bit different parts. So it's going to create a slightly different signature.
1719.45s - 1727.77s |  Um, and, um, I think I ran it on, um, Oh, I, I think I ran it on the same one. Sorry.
1728.33s - 1733.21s |  And I'm seeing my math, my don't matches, um, don't match and my matches match. So I've got
1733.21s - 1737.85s |  this tuned and I can start applying it to other things. So now I want, now I'm going to upload
1737.85s - 1743.77s |  the newest signature from 12 seven. This is a later PCAP different version, basically. And
1743.77s - 1748.41s |  I'm looking at my matches and I'm getting, um, similar, but they're different things happening
1748.41s - 1755.13s |  in there. It's the same kind of posts to a different server. Um, basically, and the,
1755.69s - 1763.61s |  I think if I show you two of them and then the, um, the ones that are in the not matching will
1763.61s - 1768.89s |  show that they don't match. So I'm feeling a lot more confident about what I'm seeing here.
1768.89s - 1773.37s |  Um, and I can apply it to other things. So I want to try an older signature, newer variant. This is
1773.37s - 1777.21s |  the part I was saying, you have to watch me carve out the same thing again, but I'm going to carve
1777.21s - 1784.25s |  it out from the 1130 and make a signature out of it. And then I'm going to, um, uh, I'll,
1784.25s - 1790.17s |  I'll talk you through it. So I opened that up. I'll isolate the flow that I'm interested in.
1791.61s - 1797.53s |  Uh, I keep on selecting that same get request, but basically I want to follow this post here
1800.94s - 1813.77s |  and I'll save this and then, um, upload that to create my signature. And this is where I'm going
1813.77s - 1817.05s |  to have some different numbers from the last one, because it's a slightly different transaction.
1818.33s - 1824.25s |  And, um, I want to analyze against one, um, from six months later, uh, dark gate. So I was
1824.25s - 1829.29s |  actually able to find a newer one. Um, and I'm getting a whole bunch of matches. So I can review
1829.29s - 1835.26s |  those and I can go to the very bottom, which is the least matchy of the matches. And, um,
1836.38s - 1841.10s |  Oh, actually, I guess I'm gonna look at the top one first. Um, no matter how many times I
1841.10s - 1845.98s |  build these videos, I always forget what I did, but the very top one matches of course.
1845.98s - 1851.66s |  And I can put this, throw this in the last search. If I want to, I'll get all those matches, 169 hits.
1851.66s - 1857.18s |  Um, when I look at the signature, the signature is based off this, this visit to trans one,
1857.18s - 1862.86s |  translate Google dot Google com.com misspelled type of squatting. And the bottom one is this
1862.86s - 1867.58s |  same kind of post to a different place. Um, and I'm getting 169 matches. So that's pretty cool.
1868.22s - 1872.22s |  Um, I've thought it'd be cool to add a map cause we all love maps or management loves maps.
1872.22s - 1880.46s |  Um, and so it's thought to be cool that, um, red skulls are the bad locations. The unmapped
1880.46s - 1887.18s |  things are black because you can't, I couldn't put a internal IP address on a map, but I put,
1887.18s - 1890.78s |  I try to put them in the middle of the Pacific ocean when they're unmapped, but there are some
1890.78s - 1896.46s |  other ones that actually get unmapped. So I'm working on that. Uh, production use. This is cool
1896.46s - 1900.70s |  that you can use. You have a web app. If you're, I've been a stock analyst and I, um, pulled
1900.70s - 1905.58s |  PCAPs down and I'm like, I open it up and I see what actually happened once the ideas rule fired.
1905.58s - 1910.86s |  Um, but I'd be cool to have something like this where I could upload it, see what's happening,
1910.86s - 1915.90s |  see if it compares with anything in my database of signatures. Um, but there's other ways to do it.
1915.90s - 1920.14s |  For example, I was talking about the Damon logger or TCP dump. If you're writing packets to,
1920.78s - 1929.82s |  to your disc, how do you run this on a rolling basis? Um, so, uh, I wrote this as a fast API
1930.94s - 1936.30s |  thing with, um, with flask running on top of it. Uh, so if I start this over on the left,
1936.30s - 1942.46s |  I'm running my fast API app. And then on the right, I have a Python script, um, sending a
1942.46s - 1948.54s |  PCAP and it sends it and gets back Jason data. And then I can, uh, refresh my, my, whatever my
1948.54s - 1953.58s |  SIM is, it can be elastic search or anything else that you use or want to use and get those matches.
1953.58s - 1959.02s |  So that's nice, at least for, um, for rolling PCAP. Uh, it, of course, as mentioned before,
1959.02s - 1963.10s |  the multiprocessing happens when the flows are separated. So you want to do it on a fast machine,
1963.10s - 1968.22s |  but generally machines that are doing, um, um, like, uh, packet capture are going to be fast.
1969.82s - 1973.66s |  Additionally, just cause I thought it'd be fun. I, um, the, you can use notify,
1973.66s - 1980.54s |  which is NTFI to like notify you. So when I run this again, I can get like a notification on my
1980.54s - 1987.42s |  phone, which is kind of cool. Um, kind of cool. It could also be kind of terrible. For example,
1987.42s - 1993.10s |  like you can get analyst fatigue when I did this and got a whole bunch of stuff. So I turned,
1993.10s - 2001.10s |  I have that off on my system, but you can run it if you want to. Um, uh, because this,
2001.10s - 2005.02s |  I'm gonna talk about something completely impractical. I love doing research because,
2005.02s - 2011.10s |  um, uh, opens my mind to new things. I get to create and build things. I feel like this is a
2011.10s - 2017.18s |  security research is a creative process and it, it fuels my other creative passions like music.
2017.18s - 2021.58s |  Um, so I just wanted to play around with this and see if I could do something with audio. I don't
2021.58s - 2027.42s |  know. It's not practical, but let's just see what happens. So I like this quote a lot. Art is how
2027.42s - 2032.22s |  we decorate space. Music is how we decorate time. And I, I painted before I made things,
2032.22s - 2037.58s |  built things to fill up the space we live in. I also make music and music is all based on time.
2037.58s - 2041.50s |  You change the beat. It's completely different. You change a note and the length of the note
2041.50s - 2049.02s |  is different. Um, so, uh, they're powerful things in their own areas. Um, and I was thinking, well,
2049.02s - 2053.10s |  I'm playing with time. Let's see if I can make something musical with this. So, you know,
2053.10s - 2056.78s |  although about Shazam, I'm sure I use it. I'm always in the, if I'm at a club, I'm in the
2056.78s - 2063.82s |  corner like Shazamming. So, um, uh, you, here's basically, you know, if you don't know how it
2063.82s - 2071.68s |  works, this is what it looks like. Oh, that's not what it looks like. So you press Shazam,
2071.68s - 2076.24s |  you hear a song you want to hear, and then, um, it tells you what it is. Add it to your Spotify
2076.24s - 2081.20s |  playlist. You can listen to it over and over again. It's great. Sorry to rickroll you. Um,
2081.92s - 2087.52s |  so I was researching this. I was like, could I do this with Python and, and, and NumPys? I found
2087.52s - 2091.92s |  this article. I also found something called Deja Vu that someone wrote, um, that they wanted to
2091.92s - 2097.20s |  make a, their own personal Shazam server where they could store their music. And if they had,
2097.20s - 2101.60s |  they heard a sample of something, it would play that, it would listen for the sample, or you,
2101.60s - 2107.60s |  you send it to Deja Vu and it would, um, uh, go, oh yeah, that's the song. Oh, I thought,
2107.60s - 2112.40s |  oh, I can probably do this. So I am back to my, my transactions, not the percentages,
2112.40s - 2117.12s |  but the actual, the times in between the microseconds or milliseconds, or whatever
2117.12s - 2123.68s |  time I was using or want to use. Um, and, uh, I'm looking at this and thinking about pitch.
2123.68s - 2130.24s |  Frequency is the number. So zero would be a low, like a low sound and up high would be a high
2130.24s - 2134.56s |  number is a high sound. So like I can make audio out of this. It's not going to be beautiful. I
2134.56s - 2140.64s |  mean, um, you're going to hear it right now, what it sounds like when you listen to a PCAP file,
2141.60s - 2146.32s |  but there's patterns in there. It's all, like I said, this is not practical,
2147.12s - 2151.04s |  but let's play with this. Let's go same, same malware sample, different environments.
2151.04s - 2157.84s |  Um, I'm gonna grab my malware. I grabbed from Malware Bazaar, uh, agent Tesla and old. Um,
2157.84s - 2162.96s |  I ran it in any run, downloaded this, uh, the sample, just, I don't know why download sample.
2162.96s - 2169.20s |  I always do. Um, and I get the PCAP and then, um, I can see that it's like doing a post.
2169.20s - 2172.88s |  And in this case, I'm not going to be applying my Levenstein stuff. I'm just playing with audio.
2172.88s - 2178.48s |  Um, but I, I see there's a post here and I also want to address the idea of bandwidth.
2178.48s - 2181.60s |  That's why I'm running this any run. Then I'm also going to run at my own very busy network
2181.60s - 2187.68s |  environment at home. Um, I run it on my system. This is just a picture of one of my malware VMs
2187.68s - 2191.92s |  and I've got the same kind of post happening. I'm going to have different times, transaction
2191.92s - 2198.00s |  times because of bandwidth, but, um, and I'm going to just say that. So there's a little bit of
2198.00s - 2202.16s |  stuff here. I have to reverse it. I'm instead going to be making a signature out of the entire
2202.16s - 2208.00s |  PCAP, not the little bit. So like I said, not practical, but, um, and then I'm going to play
2208.00s - 2214.64s |  my little bit and see if it finds it. Um, uh, if I open up this PCAP, let's see here.
2215.52s - 2224.08s |  And we're looking at that post. Um, I've got to create an audio file from it. So I have a little
2224.08s - 2230.48s |  Python script I wrote to convert those frequencies into different pitches, um, using Fourier transform
2230.48s - 2234.56s |  and some other stuff. Um, and in the back you can see there's a bunch of MP3s being made,
2234.56s - 2237.60s |  then they'll all disappear. Those are all the flows individually. And then they get combined
2237.60s - 2246.72s |  into one big PCAP MP3. And then I'm left with that thing. And then I've got, um, a carved one.
2246.72s - 2251.44s |  This is the little tiny bit that I want to identify in my Shazam. Um, I'm going to do the
2251.44s - 2258.08s |  same thing with that. Um, I've got that MP3 file, which is huge by the way, compared to the PCAP,
2258.08s - 2262.96s |  which is like 500 K or something. Uh, it's not that huge, but I've got others that are huger.
2262.96s - 2266.96s |  Um, same kind of, so I've got my carved one here. I'm going to make the signature from this one
2269.56s - 2272.52s |  and you see a bunch of it's card, but those flows in there,
2273.64s - 2277.24s |  cause I didn't carve it all the way. And I've got these two MP3 files.
2278.20s - 2286.41s |  Let's see. Uh, so now I'm going to try to identify it. Um, initially when I, uh, try to identify,
2286.41s - 2290.17s |  it's not going to see it. Cause I have to add it to a database, a deja vu database. It's not like
2290.17s - 2295.29s |  a clean like app, like Shazam. It's just a program you can run. So I try to recognize it. It's not
2295.29s - 2298.81s |  going to recognize my file yet, but that's because I haven't added it. So what I'm going to do is
2298.81s - 2303.77s |  I'm about to add it. I got to drop it into the signatures folder, um, which I'm going to do right
2304.73s - 2317.07s |  now, slowly drop it in there. I'm going to run a script to, um, have it identify that. So it
2317.07s - 2321.39s |  sees it. It's like, now there's a signature for this, this audio file, this song of yours.
2322.59s - 2328.59s |  And then, um, I want to recognize the file, the just my, just my part. And it's seeing,
2328.59s - 2335.63s |  there's a song ID recognized, um, this, uh, this traffic pattern that we're seeing.
2335.63s - 2338.75s |  And if I apply Levenstein to it, which I didn't do in this example, because I don't want to bore
2338.75s - 2345.95s |  you with like more of this, um, running commands, but, um, it gets even more interesting. But of
2345.95s - 2350.43s |  course, like I said, many times it's not practical because those, those P gap files can grow to huge
2350.43s - 2356.75s |  sizes where they're empty threes and who wants to run their network and three mode. So maybe I do,
2356.75s - 2361.95s |  but I guess I kind of talked fast. I'm kind of getting towards the end here. It's supposed to go
2361.95s - 2367.71s |  for, uh, 50 minutes or 55 minutes, but you can go get some coffee. But so going further,
2367.71s - 2371.63s |  I've been working on some third party API APIs. Like I said, I like to, when I release stuff
2371.63s - 2375.63s |  personally and whether that's not a work talk, I, um, I want people to be able to try it and
2375.63s - 2380.35s |  play with it if you want to. Um, so you can, you can add stuff if you want integrations with virus
2380.35s - 2385.87s |  total with my company's product, investigate or other things like that. Um, uh, I didn't add it.
2385.87s - 2391.23s |  It's very easy to add. Um, then you can look at things like domain IP reputation relationships.
2391.23s - 2394.59s |  If you have a sinkhole in your environment, you can pull that data in. You could play with
2394.59s - 2400.99s |  anything you have. And, um, to, to add more things with conviction. Um, and I'll analyze
2400.99s - 2405.39s |  various components of the P caps so I can add that in the future. And I should probably learn rust.
2405.39s - 2409.63s |  I should learn something. So it's fast. Like, you know, how snort is a C binary or I think it's a C
2409.63s - 2415.15s |  binary and it uses its rules. It runs very fast streaming. I'd love to do that. Um, the code is
2415.15s - 2420.43s |  available. It's a long name, but, um, if you want, I just uploaded it about two days ago.
2420.43s - 2424.35s |  So hopefully it's okay. There's a couple of things you have to do if you want to play with it.
2424.35s - 2431.47s |  But I, um, uh, I was very, uh, very verbose in my documentation on the read me. Um, and there's a
2431.47s - 2436.67s |  couple of utilities too. I added a malware traffic analysis unzipper file cause the, as a password
2436.67s - 2441.23s |  scheme. So if you want to unzip malware traffic analysis, P caps, you can do that. Um, you can
2441.23s - 2446.75s |  reach me at my website, my personal site, which is pyrosec.com. And, um, not a Twitter because I
2446.75s - 2451.55s |  just don't post, don't even really look at it anymore. And I'll probably rewrite all my posts
2451.55s - 2456.35s |  with nonsense. Um, and bastard on, I don't even have the app installed, but I should cause it's
2456.35s - 2470.19s |  kind of cool. But anyways, that's my talk and thank you for coming. There's time for questions.
2470.19s - 2491.76s |  If you have questions. Well, um, I was a lot, a lot of the time I was working in a clean
2491.76s - 2497.76s |  environment for the most part. Um, but I did run stuff over my network at home, which I know
2497.76s - 2504.64s |  that's crazy, but I would, I do it. And, um, I didn't see negative results, but my, my network
2504.64s - 2510.72s |  is busy. It's not a corporate environment. I have, I have like 20 VMs and three or four servers.
2510.72s - 2516.96s |  And so it's busy, but yeah, I have, I have a family Spotify, you know, the whole Netflix,
2516.96s - 2526.35s |  YouTube. What's that? Yeah. Yeah. It shows promise. I want to keep exploring it.
2527.23s - 2542.19s |  Yeah. Oh, sorry. Say again. No, but that's what I mentioned in like that stuff. I want to explore
2542.19s - 2547.15s |  future stuff and that's easy enough to do a direction. That's also good to play with. I
2547.15s - 2551.71s |  started to play with it with a mapping, like making the source changes constantly. So,
2553.95s - 2562.27s |  oh yeah. Oh, that's really cool. I'd love to talk. Yeah. All right. Thank you very much.


url: https://www.youtube.com/watch?v=0Zn5nj0NZVo
title: DEF CON 32 - RFID 101 - Ege Feyzioglu & Andrew M
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=0Zn5nj0NZVo",
  "title": "DEF CON 32 - RFID 101 - Ege Feyzioglu & Andrew M",
  "description": "You know the sound of beep... Click when using a badge to enter a door to a building, but how does this work and how can you hack it? This talk will explain the basics of what\u2019s inside the readers and the badges, and how they communicate wirelessly. You will learn about the common tools available (Proxmark, Flipper, Keysy), how to get one and how to use it. We\u2019ll talk about techniques to clone badges, and brute force systems to get access you never had in the first place.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1256,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 3.00s | This text was transcribed using whisper model: large-v2

 Alright everyone, thank you so much for coming to the RFID talk.
3.00s - 7.00s |  This is going to be a quick introduction to how RFID works
7.00s - 11.00s |  and what you can do to, you know, play around with it,
11.00s - 14.00s |  have a little fun and
14.00s - 18.00s |  hopefully we will end with some
18.00s - 23.00s |  suggestions on how we can make RFID a little bit safer
23.00s - 26.00s |  and what the common problems are.
26.00s - 29.00s |  And then we're going to end with a quick demonstration on
29.00s - 32.00s |  how to use the Flipper Zero. I'm sure
32.00s - 36.00s |  y'all are very familiar with that. If not, we're going to introduce you to that as well.
36.00s - 40.34s |  So, oh yeah, before that, introductions.
40.34s - 43.34s |  My name is Ege, that's spelled like that,
43.34s - 46.34s |  the top name that you see over there.
46.34s - 48.34s |  We're from the physical security village.
48.34s - 52.34s |  If you like what you see here and would like to see more of the
52.34s - 56.34s |  physical side of, like physical security side of DEF CON,
56.34s - 59.34s |  please be sure to come by the village.
59.34s - 62.34s |  It's going to be in the map and also we're going to be,
62.34s - 66.34s |  you can just walk around and look for people wearing weirdly green shirts.
66.34s - 69.34s |  Thank you. I'm Andrew Marchment.
69.34s - 71.34s |  I'm the second name on there.
71.34s - 75.34s |  I work in the store of the physical security village in the vendor area.
75.34s - 78.34s |  We're very happy to have partnered with
78.34s - 81.34s |  the Keyport guys this year to offer a discount
81.34s - 84.34s |  for people buying Keyport key organizers.
84.34s - 88.34s |  And we're also partnered with Covert Instruments to offer some of their inventory at our store.
89.34s - 92.34s |  So if you've seen Lockpicking Lawyer or McNally
92.34s - 96.34s |  and you want some of those tools, we are retailing them at our store.
96.34s - 98.34s |  So come by later.
98.34s - 102.34s |  My background is in satellite telecom, so I'm more of a high frequency RF guy.
102.34s - 107.34s |  But I'm doing this talk today on how to use the Flipper Zero
107.34s - 112.34s |  and other RFID cloning tools and how RFID works.
112.34s - 115.34s |  So we'll get started.
115.34s - 118.34s |  All right. So yeah, RFID. Sorry about that false start there.
118.34s - 120.34s |  RFID, we see it all around us.
120.34s - 125.34s |  We see it whenever we tap our key fob to get into our building at work.
125.34s - 128.34s |  When we tap our badge, whenever we go on transit
128.34s - 130.34s |  and we use one of those contactless cards
130.34s - 134.34s |  or even when we pay with either, you know, tap with your card
134.34s - 137.34s |  or Apple Pay or Google Wallet or whatever.
137.34s - 141.34s |  But something that we don't necessarily always think about
141.34s - 143.34s |  is how these darn things work.
143.34s - 146.34s |  So you want to run us through it? Sure.
146.34s - 150.34s |  All right. So it's basically a transformer that you're making
150.34s - 153.34s |  when you bring your card up to a reader.
153.34s - 156.34s |  So the reader has a coil of wire
156.34s - 160.34s |  and we're passing an electrical current through that coil at all times.
160.34s - 163.34s |  As that card approaches, we're completing the circuit
163.34s - 168.34s |  and the magnetic field that comes around that original coil
168.34s - 172.34s |  induces a current in the coil inside of your card
172.34s - 175.34s |  and that powers a little chip in there
175.34s - 182.34s |  that actually allows it to respond to the reader with its ID.
182.34s - 186.34s |  Yeah. So this is kind of a simplified view
186.34s - 192.34s |  of what the inside of one of those tags looks like.
192.34s - 196.34s |  What it basically does is it draws more or less current
196.34s - 198.34s |  to send a one or a zero.
198.34s - 201.34s |  There are other ways as well. It gets a little bit more complicated.
201.34s - 204.34s |  But on the very basic end of it, this is what it looks like inside.
204.34s - 206.34s |  And what that looks like,
206.34s - 210.34s |  if you were to measure the magnetic field around it,
210.34s - 213.34s |  is the magnetic field is either high,
213.34s - 216.34s |  like you see how those pulses,
216.34s - 219.34s |  or it's a lower magnetic field measured
219.34s - 223.34s |  because the chip is loading that magnetic field,
223.34s - 225.34s |  drawing energy out of it,
225.34s - 228.34s |  and that is it's talking to the transmitter.
228.34s - 231.34s |  So something obvious that you might realize
231.34s - 235.34s |  is this is very easy to mess with.
235.34s - 238.34s |  If I bring my own loop of wire around it,
238.34s - 240.34s |  and that's actually how I capture that image
240.34s - 243.34s |  that you just saw before,
243.34s - 245.34s |  I'm able to just read that communication.
245.34s - 248.34s |  It's literally just a breadboard jumper wire
248.34s - 250.34s |  that I looped around a bunch of times,
250.34s - 253.34s |  and then I put that near the transmitter and the fob,
253.34s - 255.34s |  and I was able to pick up that communication.
255.34s - 259.34s |  There's no encryption because you can't encrypt physics.
259.34s - 262.34s |  It's either more or less magnetic field,
262.34s - 266.34s |  and it's incredibly trivial to sniff.
266.34s - 271.34s |  Something else is, again, because you can't encrypt physics,
271.34s - 275.34s |  and the moment the tag sees the reader,
275.34s - 277.34s |  it starts blaring out its ID number.
277.34s - 280.34s |  As Andrew said, I can come around with my own reader.
280.34s - 283.34s |  Maybe you might have seen this.
283.34s - 287.34s |  This is a photo from Physical Security Village last year.
287.34s - 289.34s |  We have a similar setup this year.
289.34s - 293.34s |  If you go near the entrance or the exit of the village,
293.34s - 297.34s |  you might see a long-range reader
297.34s - 299.34s |  idly sitting by, sniffing your badges
299.34s - 303.34s |  and putting them on the wall of sheep.
303.34s - 307.62s |  So how can we solve this problem?
307.62s - 309.62s |  Does anyone have any ideas?
309.62s - 316.07s |  Shout them out.
316.07s - 319.07s |  Lasers, I heard.
319.07s - 322.07s |  It's probably going to be a little more difficult to target that,
322.07s - 324.07s |  but yeah, I heard someone say encryption.
324.07s - 327.07s |  Yeah, we solve it using encryption.
327.07s - 332.07s |  So this is how an encrypted communication looks like.
332.07s - 336.07s |  Before everything happens, there has to be a pre-shared key.
336.07s - 339.07s |  So basically the reader and the card or the fob or whatever
339.07s - 343.07s |  and the badge need to have an agreed-upon key
343.07s - 346.07s |  that the manufacturer puts on there.
346.07s - 348.07s |  And there's a challenge and response
348.07s - 351.07s |  between the reader and the fob.
351.07s - 355.07s |  And once they have both proven
355.07s - 358.07s |  that they both know what the key is
358.07s - 360.07s |  without ever saying the key,
360.07s - 363.07s |  then they can just use that key to communicate encrypted.
363.07s - 367.07s |  But this communication is obviously a little bit more complicated
367.07s - 370.07s |  than just the raw, okay, I'm loading the field.
370.07s - 373.07s |  I'm not loading the field communication that we saw earlier.
373.07s - 378.07s |  And because of that and other bandwidth limitations,
378.07s - 381.07s |  this is usually seen in high frequency,
381.07s - 384.07s |  so 13.56 MHz RFID.
384.07s - 390.07s |  So this, at least in principle, seems pretty perfect, right?
390.07s - 393.07s |  This seems like a mathematically secure system
393.07s - 395.07s |  and as long as it's properly implemented
395.07s - 398.07s |  and as long as no one does this inconceivable thing
398.07s - 401.07s |  of just putting the same key everywhere,
401.07s - 403.07s |  you know, like if there was a theoretical,
403.07s - 406.07s |  you know where I'm going, right?
406.07s - 409.07s |  This is what HID did.
409.07s - 415.07s |  They apparently sold and until pretty recently
415.07s - 420.07s |  continued to sell RFID systems
420.07s - 426.07s |  that use the same key on every single standard security
426.07s - 430.80s |  reader and fob that they sold.
430.80s - 433.80s |  The authors of this paper did them a solid
433.80s - 435.80s |  by not releasing the key,
435.80s - 438.80s |  so they had some amount of time to respond,
438.80s - 445.88s |  but obviously did not take that long for the key to appear on GitHub.
445.88s - 453.48s |  But as long as you don't, you know, do stuff like that,
453.48s - 455.48s |  and also there are other vulnerabilities that we've seen
455.48s - 460.48s |  just because of time limitations, we can't go too much into it.
460.48s - 465.48s |  There are, yeah, as long as you implement your security correctly,
465.48s - 467.48s |  as long as you pick your random numbers actually,
467.48s - 470.48s |  you know, in a decently random way,
470.48s - 474.48s |  you can do high security, high frequency RFID
474.48s - 477.48s |  in a vaguely secure way.
477.48s - 480.48s |  What happens if you don't do that
480.48s - 482.48s |  is what Andrew's going to show next.
482.48s - 484.48s |  So yeah, with a demo.
484.48s - 488.02s |  All right. Thank you.
488.02s - 490.02s |  Let's get this set up.
490.02s - 493.02s |  Here is everyone's favorite dolphin.
495.02s - 504.18s |  All right.
504.18s - 507.18s |  So this is the interface for the Flipper Zero,
507.18s - 509.18s |  which is what I'm holding in my hand here.
509.18s - 513.18s |  And it has a lovely little interface here with some animations.
513.18s - 517.18s |  And it's very convenient for copying your hotel room keys
517.18s - 520.18s |  so that you can share them with your friends.
520.18s - 523.18s |  But I'm going to go into low frequency here
523.18s - 525.18s |  because that's what the badges I'm holding are.
525.18s - 528.18s |  And I'm going to read the orange badge.
530.18s - 533.18s |  And we'll see if this is going to work for me.
533.18s - 534.18s |  There we go.
534.18s - 536.18s |  We have the orange badge.
536.18s - 541.18s |  And we are now going to attempt to write this to the blue badge,
541.18s - 543.18s |  which already has information stored on it.
543.18s - 547.18s |  So I'm not 100% sure if this is going to work.
548.18s - 553.40s |  And there we go.
553.40s - 557.40s |  So now our blue badge has the same information as our orange badge
557.40s - 559.40s |  and will open the same doors.
559.40s - 561.40s |  And it can be this simple.
565.40s - 567.40s |  Yeah, just to show that it worked.
567.40s - 569.40s |  Yeah, if we go to read again,
569.40s - 571.40s |  and this time we wrote to the blue badge,
571.40s - 573.40s |  or the blue fob.
573.40s - 576.40s |  So if we read the blue fob, it's going to have the same information.
576.40s - 581.40s |  So when Andrew said it's just saying its ID number,
581.40s - 582.40s |  this is what we mean.
582.40s - 584.40s |  So you see here there's a facility code.
584.40s - 586.40s |  So that's the 25 there.
586.40s - 588.40s |  And a card number.
588.40s - 591.40s |  So in this case it's 15686, right?
591.40s - 594.40s |  So this is just one of our...
597.40s - 600.40s |  You don't have to write that down and try to figure out where I live.
601.40s - 605.40s |  That's one of the test doors that we have at the village.
605.40s - 608.40s |  If you want to come by and you want to plug that into your flipper,
608.40s - 612.40s |  you're probably going to be able to open one of the two test doors that we have.
612.40s - 614.40s |  So yeah, that's what we mean.
614.40s - 618.40s |  It's literally just a four-byte number.
619.40s - 621.40s |  So something else you can do,
621.40s - 623.40s |  the flippers don't support this on the stock firmware,
623.40s - 626.40s |  but something else that you can do with it is...
628.40s - 631.40s |  Does anyone want to say, just yell it out loud,
631.40s - 634.40s |  is four bytes a very large keyset?
635.40s - 637.40s |  No, it's a tiny keyset.
637.40s - 639.40s |  A keyspace rather.
639.40s - 642.40s |  So yeah, you can also brute force this.
643.40s - 645.40s |  Oh yeah, there we go. Andrew has...
648.40s - 650.40s |  So this is the HIDproc.
650.40s - 653.40s |  So this will run through the entire dictionary for HIDproc's devices.
653.40s - 656.40s |  Another common one is the EM4100.
657.40s - 660.40s |  And again, it's a very short dictionary,
660.40s - 663.40s |  and you can run through this in about 15 to 30 seconds.
664.40s - 667.40s |  Yeah, so the main thing that's limiting us here is...
668.40s - 670.40s |  Again, remember, it's a very passive system,
670.40s - 672.40s |  especially for low frequency.
672.40s - 675.40s |  The reader has to ask us what our ID is,
675.40s - 676.40s |  and then we can reply.
676.40s - 679.40s |  So we're limited by the number of times the reader is willing to ask us,
679.40s - 682.40s |  but that's usually either one or two per second.
682.40s - 686.40s |  So even though that sounds like 0.5 hertz or one hertz,
686.40s - 689.40s |  sounds like a very low speed attack,
689.40s - 691.40s |  or like very limited,
691.40s - 693.40s |  because if you were trying to break a hash,
693.40s - 694.40s |  that would be basically impossible,
694.40s - 696.40s |  but because it's just four bytes,
696.40s - 699.40s |  if you can just leave something on there,
699.40s - 700.40s |  maybe overnight,
701.40s - 704.40s |  like after work hours,
704.40s - 707.40s |  you just go put your device on the reader,
707.40s - 708.40s |  you'll leave for a couple hours,
708.40s - 709.40s |  you come back, you pick it up,
709.40s - 715.40s |  and it'll give you what the correct code is.
715.40s - 720.40s |  So with kind of a conclusion to this is...
722.40s - 725.40s |  When we tap our cards, when we tap our badges,
725.40s - 727.40s |  or when we tap to pay,
727.40s - 728.40s |  it all seems very magical.
728.40s - 733.40s |  It feels like we're not limited by the same things we are
733.40s - 735.40s |  when it comes to keys.
735.40s - 739.40s |  A lot of people talk about how if you take a photo of a key,
739.40s - 740.40s |  you can duplicate it.
740.40s - 744.40s |  If you leave your key, it can be measured, decoded.
744.40s - 747.40s |  And it feels like whenever we're using RFID cards
747.40s - 749.40s |  or key fobs, badges,
749.40s - 753.40s |  they feel like they are somehow magically more secure.
753.40s - 757.40s |  And in some cases, for specific use cases it is,
757.40s - 762.40s |  but it's good to remember that it's not a silver bullet.
762.40s - 765.40s |  We should be treating our RFID cards
765.40s - 769.40s |  the same way we treat keys.
769.40s - 774.40s |  So if we lose a fob,
774.40s - 776.40s |  we should do the exact same things that we would do
776.40s - 777.40s |  if we were to lose a key.
777.40s - 778.40s |  Sorry, were you going to say something?
778.40s - 781.40s |  Yes, I was going to say treat it like any secret.
781.40s - 785.40s |  So like your passwords or your door keys to your house,
785.40s - 787.40s |  it's exactly the same thing.
787.40s - 790.40s |  If you have the secret, you have access.
790.40s - 795.40s |  So there needs to be a good maintenance of your secret.
795.40s - 797.40s |  So if you have a building
797.40s - 799.40s |  and you have employees who are terminated,
799.40s - 802.40s |  you need to deactivate that card.
802.40s - 806.40s |  If you have a building that is using an HID card system,
806.40s - 808.40s |  you need to upgrade that to one
808.40s - 812.40s |  that does a proper job encrypting the secret
812.40s - 814.40s |  when it transmits it.
815.40s - 820.40s |  Wygand and other formats after the reader
820.40s - 824.40s |  transmit the secret unencrypted over the wires
824.40s - 826.40s |  to the central server,
826.40s - 828.40s |  which controls the building access system.
828.40s - 833.40s |  So again, even if it's a proper four-way shake
833.40s - 837.40s |  between the reader and the badge,
837.40s - 839.40s |  someone can tamper with one of the readers
839.40s - 843.40s |  and actually tap the wires and intercept the secret there
843.40s - 849.40s |  and replay it at will to gain access later.
849.40s - 852.40s |  Yeah, so just to sum up what Ender said there,
852.40s - 854.40s |  hook up your darn tamper wires.
854.40s - 859.40s |  If you own a building or if you have a security job
859.40s - 862.40s |  or something like that at a building,
862.40s - 864.40s |  you can just test this, right?
864.40s - 867.40s |  Go up to your FOB reader,
867.40s - 869.40s |  unscrew the thing off the wall,
869.40s - 872.40s |  and if you don't receive a call from your security center,
872.40s - 874.40s |  your tamper wire is not hooked up.
874.40s - 876.40s |  You can work with security companies.
876.40s - 878.40s |  You can just come to talks like this.
878.40s - 880.40s |  You can come to the physical security village,
880.40s - 882.40s |  and we will be more than happy to show you
882.40s - 885.40s |  what those tamper wires do and how they're hooked up.
885.40s - 893.40s |  But yeah, so basically there's more to RFID access control
893.40s - 898.40s |  than what people seem to see on an initial look.
898.40s - 901.40s |  So that's kind of why we do this talk.
901.40s - 903.40s |  Also, it's fun to play around with.
903.40s - 905.40s |  All right, with that being said...
905.40s - 907.40s |  There we go, yeah.
907.40s - 911.40s |  If anyone has any questions, please ask us now,
911.40s - 914.40s |  or you can find us at the village afterwards.
914.40s - 917.40s |  Oh, also, we didn't talk much about the Proxmark,
917.40s - 919.40s |  but if you are interested in getting a Proxmark,
919.40s - 920.40s |  you can buy it from Dangerous Things.
920.40s - 923.40s |  Not affiliated, not sponsored, anything like that.
923.40s - 924.40s |  Also...
924.40s - 926.40s |  Oh, yeah, Hacker Warehouse here has them.
926.40s - 929.40s |  Again, not affiliated, not sponsored.
930.40s - 934.40s |  And you can go to proxmarkbuilds.org
934.40s - 939.40s |  to get the good firmware written by Iceman,
939.40s - 941.40s |  and he also has a channel on YouTube
941.40s - 944.40s |  if you want to learn more about how to play around with RFID,
944.40s - 945.40s |  not just using the flipper,
945.40s - 950.94s |  but using more research-oriented tools.
950.94s - 952.94s |  Oh, also, yeah, we sell those, sorry.
952.94s - 954.94s |  Yes, I just want to plug our store.
954.94s - 956.94s |  We're selling the tags, both high frequency and low frequency.
956.94s - 960.94s |  If you need a spare hotel room key, that's where you go.
960.94s - 964.94s |  Yeah, for the high frequency ones, yeah.
964.94s - 969.70s |  Yeah, any questions?
969.70s - 970.70s |  Do we have a...
970.70s - 972.70s |  Okay, I don't think we have a speaker...
972.70s - 974.70s |  Sorry, a microphone for the audience,
974.70s - 976.70s |  so you got to yell it out.
976.70s - 993.95s |  Yeah, so the question was,
993.95s - 1002.95s |  how easy it is to bypass tamper protections on the readers?
1002.95s - 1008.95s |  And it usually depends on the manufacturing of the actual reader.
1008.95s - 1021.95s |  So we did trash their standard security RFID protocol earlier,
1021.95s - 1025.95s |  but HID actually does a pretty decent job at building their readers,
1025.95s - 1030.95s |  and it's kind of really difficult to get a tool in there
1030.95s - 1033.95s |  to keep that tamper sensor from triggering,
1033.95s - 1036.95s |  but it really depends on the reader.
1036.95s - 1039.95s |  I would just play around with it, honestly.
1039.95s - 1040.95s |  Another question?
1040.95s - 1055.72s |  So the question was,
1055.72s - 1060.72s |  so we said that if I have a long-range RFID reader,
1060.72s - 1065.72s |  how does Blue Team defense against that?
1065.72s - 1067.72s |  Two general ways.
1067.72s - 1069.72s |  One is if you have...
1069.72s - 1078.16s |  They make RFID-blocking badge holders.
1078.16s - 1082.16s |  Also, yeah, there are RFID-blocking,
1082.16s - 1085.16s |  you know, like, wallet stuff that you can use.
1085.16s - 1087.16s |  So yeah, this is an example.
1087.16s - 1090.16s |  Not sponsored, just a random manufacturer.
1090.16s - 1091.16s |  Yeah, Amazon.
1091.16s - 1093.16s |  Yeah, from Amazon, apparently.
1093.16s - 1096.16s |  Honestly, any conductive block of thing will do.
1096.16s - 1098.16s |  It'll drain that energy.
1099.16s - 1104.16s |  Or ideally, in conjunction with that,
1104.16s - 1109.16s |  you can use systems that are not vulnerable to just being read by any random.
1109.16s - 1114.16s |  So, for example, a lot of high-frequency protocols
1114.16s - 1119.16s |  will require that handshake before any data is communicated.
1119.16s - 1123.16s |  So if the reader doesn't know the key, then you can't talk to each other.
1123.16s - 1125.16s |  Any other questions?
1125.16s - 1138.10s |  So, for example, if I were to tamper with it in my building,
1138.10s - 1140.10s |  and I don't gain access,
1140.10s - 1145.10s |  is there an alarm and or notification associated?
1145.10s - 1150.10s |  So the question was, if the tamper wire is hooked up,
1150.10s - 1153.10s |  you know, if the tamper system is set up correctly,
1153.10s - 1155.10s |  what happens if someone tampers with the reader?
1155.10s - 1156.10s |  Is that... Yeah.
1156.10s - 1160.10s |  So, honestly, it depends on the system.
1160.10s - 1162.10s |  If you set it up so that you get a special notification,
1162.10s - 1167.10s |  say, because it's, you know, if someone just holds the door open
1167.10s - 1170.10s |  or forces a door open or something like that,
1170.10s - 1171.10s |  you're facing...
1171.10s - 1174.10s |  Obviously, if someone is actually tampering with the device,
1174.10s - 1177.10s |  you're facing a more high-skill attacker.
1177.10s - 1182.10s |  So you might want to, you know, like, work with your alarm company
1182.10s - 1184.10s |  and make sure that you get a special notification
1184.10s - 1186.10s |  or a special alarm condition for that.
1186.10s - 1188.10s |  But it just depends on the system.
1188.10s - 1189.10s |  Do you want to add to that?
1189.10s - 1192.10s |  I just want to add to that.
1192.10s - 1195.10s |  You know, if the alarm system is correctly installed,
1195.10s - 1197.10s |  yes, you will get an alarm.
1197.10s - 1199.10s |  However, alarm fatigue is a thing,
1199.10s - 1203.10s |  and if you tamper with it and then set it off and leave
1203.10s - 1205.10s |  and they come around and look at it,
1205.10s - 1207.10s |  and then you come and mess with it some more and leave
1207.10s - 1208.10s |  and they come and look at it,
1208.10s - 1211.10s |  and then you leave and come back,
1211.10s - 1213.10s |  they are going to stop checking
1213.10s - 1215.10s |  and going to turn off that alarm
1215.10s - 1218.10s |  and you are then free to do your thing
1218.10s - 1220.10s |  and, you know, red team it up.
1220.10s - 1223.10s |  So just wanted to add that.
1223.10s - 1225.10s |  Yeah, I've, for obvious reasons,
1225.10s - 1226.10s |  not going to go too much into details,
1226.10s - 1228.10s |  but I have used an actual engagement
1228.10s - 1232.10s |  where I would just show up, prop a door open, leave,
1232.10s - 1234.10s |  show back up, prop a door open, leave again,
1234.10s - 1239.10s |  and then eventually security stopped responding.
1239.10s - 1242.10s |  Oh, okay, yeah, I think that's our time.
1242.10s - 1243.10s |  Yeah, okay, all right.
1243.10s - 1244.10s |  Thank you so much for coming.
1244.10s - 1245.10s |  If you have any other questions,
1245.10s - 1247.10s |  please do shout to us by email
1247.10s - 1251.10s |  or swing by the village to try out some of these
1251.10s - 1254.10s |  and also some more physical hands-on stuff.
1254.10s - 1255.10s |  Thanks.


