# Media

url: https://www.youtube.com/watch?v=DwYkeFatP40
title: DEF CON 32 - Eradicating Hepatitis C with BioTerrorism - Mixæl Swan Laufer
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=DwYkeFatP40",
  "title": "DEF CON 32 - Eradicating Hepatitis C with BioTerrorism - Mix\u00e6l Swan Laufer",
  "description": "A quarter million people die from Hepatitis C yearly, and it's getting worse. But for the first time in history there is a cure (not just a treatment) for a virus, and it is for Hepatitis C. Take one 400mg pill of Sofosbuvir every day for twelve weeks, and you will be free of the virus. The catch? Those pills are $1,000 USD apiece because the molecule is the so-called \"Intellectual Property\" of Gilead Pharmaceuticals, and they refuse to share. If you have $84,000 USD, Hep C is not your problem. We have developed a way to make the entire course of treatment for $300 USD. This methodology also applies to other diseases. Like any science, the method of manufacture of drugs can be replicated, and we are going to give you all the necessary tools and show you the process top-to-bottom. Watch it happen live, participate, and learn to do it yourself: Use our digital research assistant to help you navigate the scientific literature, get a chemical synthesis pathway, generate code for the the MicroLab to run, and watch the medicine form in the reaction chamber. Finally, press some tablets. The feds say saving a life this way is BioTerrorism. We say: So Be It.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2831,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.84s | This text was transcribed using whisper model: large-v2

 All right, and with that, Michael's gonna talk to you about eradicating hepatitis C
4.84s - 5.84s |  with bioterrorism.
5.84s - 19.16s |  So one more round of applause for Michael.
19.16s - 27.23s |  I don't know who needs to hear this, but I'm scared too.
27.23s - 32.91s |  All the time of losing the health that I have.
32.91s - 35.47s |  I know what it feels like.
35.47s - 41.95s |  I know what it feels like to not know what's wrong with your body and to have to go shop
41.95s - 49.31s |  for a stranger who has the authority to maybe or maybe not give you what you need.
49.31s - 53.89s |  I know what it feels like to know what's wrong with your body and to know what you need and
53.89s - 61.15s |  to be told you can't have it because the infrastructure has failed and it's not available.
61.15s - 64.55s |  I know what it feels like to be told that you can't get it because it's not legal in
64.55s - 67.25s |  the place where you are.
67.25s - 74.57s |  I know what it feels like to be told that you can't have it because the doctor doesn't
74.57s - 77.53s |  share your opinion.
77.53s - 84.21s |  And perhaps worst of all, I know what it's like to be told you can have it only to realize
84.21s - 89.79s |  that you can't afford it.
89.79s - 93.50s |  I know this happened to you.
93.50s - 95.74s |  It never should have occurred.
95.74s - 98.74s |  This is wrong.
98.74s - 105.58s |  And I hope to show you all some tools so that it doesn't ever have to happen again.
105.58s - 120.23s |  Sorry, there may or may not be some slides, but what you're about to see is a photograph
120.23s - 128.46s |  of me, hopefully, but I'll keep talking.
128.46s - 132.84s |  The photograph you're about to see, you'll notice I looked different then.
132.84s - 135.10s |  I had long hair.
135.10s - 138.42s |  I was overseas.
138.42s - 144.40s |  Three days later, I had no hair anywhere on my body.
144.40s - 149.46s |  And three weeks later, I had all new skin.
149.46s - 154.94s |  And I decided to be magnanimous and not show you how it came off, but it was rough and
154.94s - 155.94s |  it was ugly.
155.94s - 164.97s |  Then there's another picture.
164.97s - 167.65s |  I'm recovering in a hospital.
167.65s - 171.41s |  I have an IV in my hand.
171.41s - 176.06s |  A tumor had just been removed from my body.
176.06s - 177.06s |  This was the first picture.
177.16s - 179.44s |  You guys see it?
179.44s - 184.32s |  Here I am three days later.
184.32s - 190.68s |  Here I am three weeks later.
190.68s - 192.32s |  Here I am in the hospital.
192.32s - 195.88s |  Well, somewhere, I'm in the hospital.
195.88s - 201.76s |  And they'd removed a tumor from my body that was invisible on the MRI.
201.76s - 209.14s |  And the only reason it got removed is because I insisted on it.
209.14s - 212.90s |  There's another picture of me in the hospital.
212.90s - 213.90s |  I can see my slides.
213.90s - 214.90s |  Sorry, guys.
215.14s - 218.98s |  I don't know if it's still getting black screen, but it's all right.
218.98s - 224.36s |  There's another picture of me recovering in the same hospital because I had to have another
224.36s - 238.34s |  operation also under general anesthesia just to prepare for the other surgery.
238.34s - 251.00s |  Now, the important thing to note and what I'm trying to impart here is that most medications
251.16s - 259.16s |  you can make a better, cheaper version of yourself at home.
259.16s - 262.88s |  Anybody can.
262.88s - 264.48s |  It's entirely doable.
264.48s - 271.05s |  Now, if the slides won't come up for whatever reason, I'll talk through it.
271.05s - 275.43s |  But there are a handful of tools that you need to go through this.
275.43s - 280.07s |  The first thing that you need to do is you need some chemistry.
280.07s - 283.83s |  Now, most people kind of cower.
283.83s - 284.83s |  Chemistry seems hard.
285.63s - 286.63s |  It's like a specialized thing.
286.63s - 292.75s |  Well, sure, if you're doing research chemistry, yeah, that's why there's a PhD in it, of course.
292.75s - 298.23s |  But if you just need to operate it, similar to the difference between building a computer
298.23s - 303.47s |  and using a computer, it's significantly easier.
303.47s - 309.07s |  It says a lot about the state of humanity when we develop all of these things and don't
309.07s - 310.07s |  deliver them.
310.07s - 312.39s |  Sorry, I just got to bounce back to this slide, too.
312.39s - 314.75s |  This is so important.
314.75s - 318.95s |  Those research chemists that are doing biochemistry, they're doing medicine, they're doing incredibly
318.95s - 319.95s |  important things.
319.95s - 320.95s |  It's amazing.
320.95s - 321.95s |  It's amazing.
321.95s - 322.95s |  It's so sophisticated.
322.95s - 326.71s |  And yeah, there's a reason that they get PhDs in it.
326.71s - 335.07s |  But if all you're trying to do is pirate something, that's doable and it can be automated.
335.07s - 337.19s |  I believe this.
337.19s - 339.91s |  That's why I'm here.
339.91s - 343.31s |  Hacking is important for the world.
343.31s - 344.43s |  It saves lives.
344.43s - 345.79s |  All of you know this.
345.79s - 346.99s |  You've seen it.
346.99s - 349.15s |  This is just a little more direct.
349.15s - 350.75s |  It can happen with anything.
350.75s - 355.35s |  You take something and you use it for a purpose for which it was not intended so that you
355.35s - 358.53s |  are no longer gatekept against access.
358.53s - 366.56s |  This is why we do what we do, and I know you all understand this.
366.56s - 368.60s |  Knowledge belongs to all of humanity.
368.60s - 371.80s |  I believe this with every fiber of my being.
371.80s - 377.92s |  There have been moments in history where economics and morality have come to a head, and the
377.92s - 382.04s |  economists have said, you can't have that.
382.04s - 383.04s |  I'm sorry.
383.04s - 384.04s |  It's not moral.
384.04s - 386.76s |  It's the way our economy works.
386.76s - 390.96s |  And the moralists have come back and said, that's not good enough.
390.96s - 393.34s |  It happened in this country with slavery.
393.34s - 395.52s |  People said, people can't be property.
395.52s - 397.12s |  That is not acceptable.
397.12s - 401.68s |  And the economists said, yes, it's really unfortunate and it's kind of old, but that's
401.68s - 402.92s |  how our economy runs.
402.92s - 407.52s |  And the moralists came back and said, that's not good enough.
407.52s - 413.88s |  And similarly today, people are dying every day because of intellectual property law,
413.88s - 418.24s |  making it so that people do not have access to the medicines they need.
418.24s - 421.16s |  And the economists say, oh, I know it's an old system.
421.16s - 422.16s |  I know it's being abused.
422.16s - 425.84s |  It's kind of unfortunate, but there are trillions of dollars circling the world.
425.84s - 429.12s |  We can't just pull the rug out from under that.
429.12s - 442.70s |  And there are some of us who are saying, that's not good enough.
442.70s - 444.90s |  I know you all believe in the right to repair.
444.90s - 446.50s |  I do too.
446.50s - 449.18s |  I believe in the right to repair for your body.
449.18s - 451.82s |  And this is not a new idea.
451.82s - 455.70s |  It used to be that everybody was involved in their own health.
455.70s - 461.50s |  The notion that you can't manage your own health is fairly new.
461.50s - 463.66s |  Gates had been put up saying, you can't do this.
463.66s - 465.88s |  You're practicing medicine without a license.
465.88s - 467.38s |  You're not allowed.
467.38s - 472.71s |  But if you come to the authority, we'll sell it back to you.
472.71s - 474.23s |  That's not acceptable.
474.23s - 476.75s |  You need to become involved in your own health.
476.75s - 478.91s |  You can't just follow doctor's orders.
478.91s - 480.55s |  It's not good enough anymore.
480.55s - 483.31s |  I don't know if it ever was.
483.31s - 487.43s |  We know that this is not an excuse in wartime.
487.43s - 491.27s |  Why is it still an excuse when you're dealing with your health?
491.27s - 492.27s |  It shouldn't be.
492.27s - 496.20s |  I'm going to say this again.
496.20s - 502.84s |  You can make most medicines yourself at home, and you can make them better.
502.84s - 504.40s |  I'm not kidding.
504.40s - 507.16s |  Better and cheaper.
507.16s - 510.64s |  Now, we're going to have to look at how.
510.64s - 513.20s |  I want to do a quick poll here.
513.20s - 519.84s |  How many people know somebody who owns a cat who is also either immunocompromised or pregnant?
519.84s - 520.84s |  Show of hands real quick.
520.84s - 521.84s |  Yeah?
521.84s - 522.84s |  Okay.
522.84s - 523.84s |  A couple.
523.84s - 524.84s |  Next.
524.84s - 528.84s |  How many people know somebody who has an allergy that sends them into anaphylactic shock?
528.84s - 529.84s |  Oh, yeah.
529.84s - 530.84s |  Plenty.
530.84s - 531.84s |  Okay.
532.84s - 536.84s |  How many people know somebody who has hepatitis C?
536.84s - 537.84s |  All right.
537.84s - 538.84s |  A couple.
538.84s - 539.84s |  All right.
539.84s - 540.84s |  I'm going to remember you.
540.84s - 549.20s |  How many people have a uterus and are child-free by choice?
549.20s - 550.20s |  Cool.
550.20s - 551.20s |  All right.
551.20s - 557.02s |  Fewer than I thought, but all right.
557.02s - 559.02s |  Who remembers this guy?
559.02s - 565.02s |  This is Martin Shkreli, and what you're seeing right now is him lying to Congress.
565.02s - 571.02s |  He was CEO of Turing Pharmaceuticals, and what he was lying about was the pricing structure
571.02s - 576.02s |  of daraprim, pyrimethamine, an anti-toxoplasmosis drug.
576.02s - 583.02s |  It had been $13.50 a pill, and he changed the price to $750 a pill.
583.02s - 592.82s |  If you calculate this out, a full course of treatment is just south of $19,000.
592.82s - 595.82s |  This is his phone number.
595.82s - 598.82s |  I called him from stage at Hope in 2016.
598.82s - 602.82s |  He didn't answer, but he called me back a few hours later.
602.82s - 606.82s |  Of course, he got hauled off to prison a while after that.
606.82s - 608.82s |  Here's what we did.
608.82s - 609.82s |  We took exception to this.
609.82s - 611.82s |  We found a new synthesis pathway.
611.82s - 613.82s |  It had one step fewer.
613.82s - 614.82s |  It was much more efficient.
614.82s - 619.82s |  There were greater margins of error, and there was greater purity in yield.
619.82s - 621.82s |  So we made some.
621.82s - 627.82s |  Here I am at that same conference throwing pills to the audience that cost me a quarter to make each.
627.82s - 631.82s |  And you can make these things too.
631.82s - 633.82s |  Making pills is easy.
633.82s - 637.82s |  If you have active pharmaceutical ingredient, just pack it into caplets.
637.82s - 639.82s |  Measure it out.
639.82s - 640.82s |  Everybody can do this.
640.82s - 642.82s |  It's not difficult.
642.82s - 645.82s |  And here's what a course of treatment looks like.
645.82s - 650.82s |  Now, it's amazing there was so much outrage around what he did,
650.82s - 654.82s |  and yet the pricing structure still has not changed,
654.82s - 658.82s |  but you can make a full course of treatment for $80.
658.82s - 669.72s |  Now, who said they knew somebody who had a cat and was pregnant?
669.72s - 672.35s |  You want it?
672.35s - 674.35s |  I'll toss it out.
674.35s - 676.35s |  Keep that person healthy.
676.35s - 678.35s |  Keep that person safe.
678.35s - 682.69s |  More to come.
682.69s - 684.69s |  This is Heather Bresch.
684.69s - 687.69s |  She is, can you guess, lying to Congress.
687.69s - 691.69s |  She was CEO of Mylan Pharmaceuticals,
691.69s - 695.69s |  and she was lying about the pricing structure of the EpiPen.
695.69s - 698.69s |  I know everybody remembers this one.
698.69s - 701.69s |  It was $60 for a pair.
701.69s - 708.58s |  And then she decided it was going to be $604 for a pair.
708.58s - 714.58s |  We presented about this in 2018, and I called her at this number.
714.58s - 715.58s |  It might still work.
715.58s - 718.58s |  You can try it.
718.58s - 723.39s |  She didn't answer.
723.39s - 725.39s |  We decided to make our own version.
725.39s - 727.39s |  It's not a complicated thing.
727.39s - 730.39s |  You take an auto-injector that's designed for needle-phobic diabetics.
730.39s - 737.39s |  You put in a small syringe, a large needle, and a vial of epinephrine.
737.39s - 739.39s |  You can make one, too.
739.39s - 741.39s |  This costs $30.
741.39s - 744.39s |  Additionally, you can test it to see if it works,
744.39s - 746.39s |  and you can reload it for $3.
746.39s - 751.70s |  You just need a new needle, a new syringe, and a new hit of Epi.
751.70s - 756.70s |  And again, after all of this time, the pricing structure has not shifted.
756.70s - 759.70s |  There is no leverage to change these prices.
759.70s - 761.70s |  You can make your own.
761.70s - 763.70s |  It's not hard.
763.70s - 771.70s |  Now, who said they had a friend who had anaphylactic shock?
771.70s - 773.70s |  You want it?
773.70s - 776.70s |  All right, here, pass it back.
776.70s - 778.70s |  Keep that person healthy.
778.70s - 779.70s |  Keep that person safe.
779.70s - 780.70s |  And make more.
780.70s - 786.61s |  It's not hard.
786.61s - 789.61s |  And then there was this time that these nine robed creeps
789.61s - 791.61s |  decided they were going to ruin...
791.61s - 793.61s |  Sorry, hang on.
793.61s - 796.61s |  And then there was this time that these nine robed creeps
796.61s - 799.61s |  decided they were going to just ruin everything for everyone
799.61s - 802.61s |  by saying you couldn't have the medicine you wanted
802.61s - 805.61s |  if you happened to have a uterus.
805.61s - 808.61s |  We thought this wasn't cool either.
808.61s - 810.61s |  And at Hope in 2022,
810.61s - 815.61s |  we figured out a way to dope business cards with abortion drugs.
815.61s - 819.61s |  It's fairly simple, and you can do it too.
819.61s - 821.61s |  Here's all you need.
821.61s - 823.61s |  You get some active pharmaceutical ingredients,
823.61s - 827.61s |  some Everclear, a blender, and a pipette.
827.61s - 830.61s |  Then all you do is you put in the Everclear,
830.61s - 832.61s |  you put in the powder, you blend it up,
832.61s - 838.61s |  and then you take the pipette and you put six dots on a business card.
838.61s - 842.61s |  Here I am two years ago at DEF CON at a house not far from here
842.61s - 845.61s |  making about 200 on a table.
845.61s - 847.61s |  Here's all you do.
847.61s - 849.61s |  You lay them out.
849.61s - 854.14s |  That top one's special edition. You can't get that anymore.
854.14s - 857.14s |  You put six dollops on a card.
857.14s - 860.14s |  Those are the three doses that you need to induce an abortion.
860.14s - 862.14s |  You let it dry.
862.14s - 865.14s |  It curls up like this, and then you put it in a baggie.
865.14s - 867.14s |  It is super simple.
867.14s - 871.14s |  Here's the entire table, and then you bag them up in the morning.
871.14s - 875.14s |  And then maybe you put them places
875.14s - 877.14s |  because it's just the size of a card,
877.14s - 884.58s |  maybe in the family planning section in a drugstore,
884.58s - 887.58s |  or maybe at your local public library.
887.58s - 890.58s |  You find an appropriate volume
890.58s - 893.58s |  that somebody who might be in need might find,
893.58s - 897.83s |  and you just slip it in there.
897.83s - 901.83s |  And again, the recipe you just saw is for 100 cards,
901.83s - 905.83s |  so maybe you even get really creative
905.83s - 909.83s |  and decide that another third place that people go to
909.83s - 913.83s |  who might have trouble getting access to these sorts of things.
916.83s - 923.95s |  I mean, up to you.
923.95s - 927.95s |  The Good Mocker Institute estimates that it's about $500
927.95s - 930.95s |  if you want an abortion through traditional channels.
930.95s - 934.95s |  If you send away for mifepristone and misoprostol pills,
934.95s - 937.95s |  it will cost you about $160.
937.95s - 941.95s |  These cards, they cost 89 cents to make,
941.95s - 944.95s |  including the printing of the cards and the baggies.
944.95s - 948.95s |  You can afford to make these.
948.95s - 951.95s |  And despite all the outrage around all of it,
951.95s - 956.95s |  this pricing structure and the access hasn't shifted much.
956.95s - 960.95s |  Now, for some of you who recognize patterns,
960.95s - 963.95s |  we'll anticipate the next question, which is,
963.95s - 967.95s |  who would like my business card?
967.95s - 969.95s |  Who wants this?
969.95s - 972.95s |  I'm not going to make assumptions, but I think you don't have a uterus.
972.95s - 975.95s |  Yeah, all right. Here, will you pass that back?
975.95s - 980.97s |  And there may or may not be a bunch of these
980.97s - 983.97s |  stashed in ladies' rooms around.
983.97s - 989.14s |  I don't know who put them there.
989.14s - 992.14s |  This is hepatitis C.
992.14s - 994.14s |  This is what we're talking about today.
994.14s - 998.14s |  This is terrifying, and it's not common knowledge.
998.14s - 1001.14s |  It is more virulent than HIV.
1001.14s - 1005.14s |  It is more widespread than HIV, and it is more lethal than HIV.
1005.14s - 1008.14s |  And it is a very clever virus.
1008.14s - 1011.14s |  If you want to get into the molecular biology of it, it's incredible.
1011.14s - 1014.14s |  It is awe-inspiring.
1014.14s - 1018.93s |  This is Sovaldi,
1018.93s - 1022.93s |  also known as sofosbuvir.
1022.93s - 1025.93s |  This molecule makes magic happen.
1025.93s - 1028.93s |  It actually goes in and interdicts
1028.93s - 1031.93s |  in the replication process
1031.93s - 1037.26s |  when hepatitis C is trying to make more of it.
1037.26s - 1040.26s |  Here is the enzyme
1040.26s - 1044.26s |  that allows hepatitis C to make more by replicating RNA.
1044.26s - 1047.26s |  And here is Sovaldi
1047.26s - 1050.26s |  inside of the binding pocket
1050.26s - 1054.26s |  doing what one of our chemists
1054.26s - 1061.17s |  referred to as fucking shit up.
1061.17s - 1064.17s |  This is not just a drug that's helpful.
1064.17s - 1068.17s |  This drug will actually eradicate the virus from your body.
1068.17s - 1071.17s |  This is the first time this has ever been done.
1071.17s - 1074.17s |  If you have a virus, either your body manages it
1074.17s - 1078.17s |  or you have to continuously take antivirals for the rest of your life,
1078.17s - 1081.17s |  you can actually be hepatitis C-free
1081.17s - 1084.17s |  with this drug.
1084.17s - 1087.17s |  It's not just a treatment.
1087.17s - 1090.17s |  You take one pill a day for 12 weeks,
1090.17s - 1093.17s |  and hepatitis C is gone from your body.
1093.17s - 1096.17s |  What is the catch?
1096.17s - 1099.17s |  These pills cost $1,000 apiece.
1099.17s - 1102.17s |  And for those of you who are good with arithmetic,
1103.17s - 1107.17s |  you will notice that this is $84,000 that it costs.
1107.17s - 1111.17s |  And it will come as no surprise to the Americans in the audience
1111.17s - 1115.17s |  that insurance companies aren't super hot to pay for it.
1115.17s - 1119.99s |  Let's look at how shitty hepatitis is.
1119.99s - 1124.62s |  This is how it's gone the last few years.
1124.62s - 1127.62s |  Two seminal moments I'd like to point out.
1127.62s - 1130.62s |  Here's where Sovaldi was invented.
1130.62s - 1134.62s |  Now, those of you who are familiar with the American medical system
1134.62s - 1137.62s |  and how drugs go will know that it takes a while
1137.62s - 1140.62s |  between invention and approval, and indeed it did.
1140.62s - 1143.62s |  But here's where it was approved.
1143.62s - 1146.62s |  Maybe you noticed something kind of strange about the graph.
1146.62s - 1149.62s |  Let's extend the data just a little bit.
1149.62s - 1152.62s |  And you'll see, taking it up to the current day,
1152.62s - 1156.62s |  it's getting worse, not better.
1156.62s - 1161.35s |  That's worth wondering about.
1161.35s - 1165.35s |  Now, as some of you know, I'm a mathematician.
1165.35s - 1169.35s |  I will not require any of you to do the integral
1169.35s - 1172.35s |  to calculate the area under the curve here
1172.35s - 1176.35s |  as to how many people died since it was invented.
1176.35s - 1181.76s |  It was over 5 million
1181.76s - 1184.76s |  between the invention of Sovaldi and today,
1184.76s - 1187.76s |  all of which could have been avoided
1187.76s - 1190.76s |  if they had merely been given this course of treatment.
1190.76s - 1196.16s |  And I take great exception to that.
1196.16s - 1199.16s |  Right now,
1199.16s - 1204.16s |  almost 1% of the entire world has hepatitis C.
1204.16s - 1207.16s |  It's closer to 3 quarters of a percent.
1207.16s - 1211.16s |  But look around this room and do a quick back of the envelope.
1211.16s - 1215.16s |  There are plenty of people right here who have it.
1215.16s - 1218.16s |  Plenty unknowingly.
1218.16s - 1224.66s |  Again, it is more virulent and more deadly than HIV.
1224.66s - 1229.66s |  1.5 million people will get it this year.
1229.66s - 1233.66s |  Some probably, like, you know, later today if they get lucky.
1233.66s - 1236.66s |  Hopefully it's fun in the process.
1236.66s - 1241.66s |  Over a quarter of a million people will die of hepatitis C this year.
1241.66s - 1243.66s |  A quarter of a million.
1243.66s - 1247.66s |  And somebody dies every 2 minutes.
1247.66s - 1250.66s |  How long have I been up here?
1250.66s - 1253.66s |  When I talked about this 5 years ago, it was every 3 minutes.
1253.66s - 1256.66s |  So again, not only is it getting worse,
1256.66s - 1259.66s |  but it's getting worse faster.
1259.66s - 1263.66s |  Now, usually when I start throwing these sorts of numbers out,
1263.66s - 1266.66s |  people get a little depressed.
1266.66s - 1269.66s |  And they ask, is there no hope?
1269.66s - 1274.94s |  And I would like to quote one of my favorite superheroes.
1274.94s - 1278.54s |  Oh, I will give you hope.
1278.54s - 1283.11s |  And I ask only one thing in return.
1283.11s - 1287.74s |  Now, you might not recognize this man,
1287.74s - 1290.74s |  but his name is Daniel O'Day.
1290.74s - 1293.74s |  Interesting last name to be talking about at a hacker conference.
1293.74s - 1296.74s |  You figure somebody is going to fuck with him, right?
1296.74s - 1300.74s |  He is, as you might guess, lying to Congress.
1300.74s - 1303.74s |  He is CEO of Gilead Pharmaceuticals.
1303.74s - 1307.74s |  And he is lying about the pricing structure of Sovaldi,
1307.74s - 1312.74s |  which, as mentioned previously, is $1,000 a pill
1313.74s - 1317.74s |  and is $84,000 for a full course of treatment.
1317.74s - 1323.74s |  Oh man, I had such like a climactic moment that I was building to.
1323.74s - 1327.74s |  Like I was so excited for the next thing.
1327.74s - 1330.74s |  If I can pull it off, it will be great.
1330.74s - 1332.74s |  If not, it's like an NES, right?
1332.74s - 1334.74s |  Everybody remembers this. It's a perfect trick.
1334.74s - 1336.74s |  It should work every time.
1336.74s - 1339.74s |  So in the event that this doesn't work,
1339.74s - 1342.74s |  I'll go a little further from memory.
1342.74s - 1348.31s |  But we need to get back to the how.
1348.31s - 1350.31s |  I talked a lot about why.
1350.31s - 1353.31s |  But there are tools that we have specifically
1353.31s - 1356.31s |  that will help you through the entire process.
1356.31s - 1359.31s |  At the top is the automation of the chemistry.
1359.31s - 1361.31s |  And we have a tool for that,
1361.31s - 1364.31s |  an actual way that you can automate the chemistry.
1364.31s - 1369.31s |  Below that, there's a system that will build
1369.31s - 1374.31s |  the instruction set that the automation system will run.
1374.31s - 1377.31s |  Before that, you actually need to figure out
1377.31s - 1379.31s |  how the synthesis is done.
1379.31s - 1382.31s |  You need to figure out how to start with some material
1382.31s - 1385.31s |  and then work your way to your end product.
1385.31s - 1387.31s |  And we have a tool for that as well.
1387.31s - 1389.31s |  And of course, somewhere along the line,
1389.31s - 1392.31s |  you have to figure out what you want to take for what's wrong.
1392.31s - 1393.31s |  I don't see one.
1393.31s - 1399.26s |  So the first thing is called the apothecary micro lab.
1399.26s - 1402.26s |  And you're going to have to take it on faith,
1402.26s - 1405.67s |  but I got beautiful pictures of it.
1405.67s - 1409.67s |  There are automated lab reactors that are designed for chemistry.
1409.67s - 1412.67s |  The way they work is fairly simple.
1412.67s - 1415.67s |  There's a reaction chamber on the inside.
1415.67s - 1419.67s |  There's a jacket through which liquid flows
1419.67s - 1423.67s |  that allows the reaction chamber
1423.67s - 1425.67s |  to maintain a particular temperature.
1425.67s - 1429.67s |  There's a little paddle inside that will stir.
1429.67s - 1432.67s |  And then there are these little injection systems on the top.
1432.67s - 1436.67s |  Now, problem is, many.
1436.67s - 1440.67s |  First, they're closed source,
1440.67s - 1442.67s |  and they come with all the attendant problems
1442.67s - 1444.67s |  with closed source systems.
1444.67s - 1447.67s |  Number two, they're ridiculously expensive.
1447.67s - 1451.67s |  If you want the most basic model, it's going to be over $5,000.
1451.67s - 1455.67s |  And even if you have $5,000, you can't buy it unless you're a lab.
1455.67s - 1457.67s |  Now, of course, there are ways around that,
1457.67s - 1460.67s |  but why would you want to pay $5,000
1460.67s - 1464.67s |  for something that just stirs, controls temperature,
1464.67s - 1467.67s |  and injects reagents at a particular time?
1467.67s - 1471.67s |  You think you could probably do that yourself, right?
1471.67s - 1473.67s |  Well, I'm a very, very lucky man.
1473.67s - 1475.67s |  I get to brag about some wonderful things
1475.67s - 1478.67s |  that some brilliant people have managed to build,
1478.67s - 1482.67s |  and I get to brag about it unabashedly because I didn't do it.
1482.67s - 1485.67s |  But the apothecary micro lab is something we've been working on
1485.67s - 1487.67s |  for many years, and we have a new version
1487.67s - 1490.67s |  that I like to call version 6,
1490.67s - 1492.67s |  and it does all of these things.
1492.67s - 1496.67s |  You have a small mason jar inside of a larger mason jar.
1496.67s - 1500.67s |  There's fluid that circulates around that...
1500.67s - 1503.67s |  Oh, that doesn't look good.
1503.67s - 1505.67s |  All right, moving on.
1505.67s - 1507.67s |  There's a fluid that circulates around
1507.67s - 1509.67s |  that regulates the temperature.
1509.67s - 1516.92s |  You've got a stirring paddle that comes in.
1516.92s - 1519.92s |  It's made of Teflon, so it's nonreactive.
1519.92s - 1523.92s |  And you've got these tubes that pump things in.
1523.92s - 1525.92s |  The design is somewhat complex,
1525.92s - 1527.92s |  and one thing that I should mention
1527.92s - 1530.92s |  is that tomorrow at 11 a.m.
1530.92s - 1534.92s |  in the content creators stage,
1534.92s - 1536.92s |  we'll be doing an extended version of this talk.
1536.92s - 1538.92s |  It's in number 2.
1538.92s - 1540.92s |  And we will be going through,
1540.92s - 1543.92s |  and we will be demonstrating the actual tool.
1543.92s - 1545.92s |  We will be going through,
1545.92s - 1547.92s |  you will see it making medicines on stage.
1547.92s - 1550.92s |  All of these online systems about which I'm about to speak,
1550.92s - 1552.92s |  you'll be able to interact with in real time
1552.92s - 1555.92s |  because we were discouraged from having live demos
1555.92s - 1558.92s |  on the main stage because, well, you know.
1558.92s - 1568.19s |  So you'll also be able to request particular drugs.
1568.19s - 1571.19s |  If there's a drug that you'd like to know how to make,
1571.19s - 1574.19s |  we'll try and figure out a way on the fly, live.
1574.19s - 1578.66s |  So please come on by. It'll be fun.
1578.66s - 1582.66s |  So then antecedent to the Microlab itself,
1582.66s - 1585.66s |  we have a system called the RecipePress.
1585.66s - 1588.66s |  This is a graphical user interface
1588.66s - 1593.66s |  that allows you to take a procedure
1593.66s - 1596.66s |  for making a chemical reaction happen,
1596.66s - 1599.66s |  and you get to then input it,
1599.66s - 1603.66s |  and it will generate the code so that the system runs it.
1603.66s - 1607.66s |  And the brains of it come in a nice pretty box.
1607.66s - 1609.66s |  I promise you, it's so gorgeous.
1609.66s - 1611.66s |  You'll love it. Come by tomorrow.
1611.66s - 1613.66s |  Or just go on our GitHub,
1613.66s - 1615.66s |  and you can see wonderful pictures of it
1615.66s - 1617.66s |  because it's extremely well documented.
1617.66s - 1619.66s |  Again, I work with wonderful people.
1619.66s - 1624.66s |  As we say, documentation or it's not a project, right?
1625.66s - 1631.66s |  So you can then generate a file that it will run,
1631.66s - 1635.66s |  and then beyond that, you can edit it.
1635.66s - 1637.66s |  It will talk you through the things
1637.66s - 1641.66s |  that are easy for a human but difficult for a machine to do.
1641.66s - 1645.66s |  There's a touch screen that talks you through it.
1645.66s - 1647.66s |  Then for the machine things,
1647.66s - 1649.66s |  where you just need to wait for a long time
1649.66s - 1651.66s |  and regulate the temperature and keep stirring,
1651.66s - 1654.66s |  or easy for a human to get distracted but great for a machine,
1654.66s - 1657.66s |  it will do those for you.
1657.66s - 1660.66s |  Before that, you need to figure out, again, the retrosynthesis.
1660.66s - 1665.78s |  How do you get from point A to point B?
1665.78s - 1667.78s |  A number of years ago, we developed a system
1667.78s - 1669.78s |  that we called ChemHactica.
1669.78s - 1671.78s |  It's a retrosynthesis module
1671.78s - 1674.78s |  where what you can do is literally hop on Wikipedia,
1674.78s - 1676.78s |  look for your drug of choice,
1676.78s - 1679.78s |  scroll down until you find the SMILES code,
1679.78s - 1682.78s |  and hackers out there, if you don't know about this,
1682.78s - 1684.78s |  the SMILES codes are super dope.
1684.78s - 1687.78s |  Invited by the Blue Obelisk Group,
1687.78s - 1690.78s |  an open-source way that you can represent any chemical
1690.78s - 1693.78s |  or any chemical reaction with an ASCII string.
1693.78s - 1695.78s |  It's super cool.
1695.78s - 1698.78s |  You copy that, you paste it into ChemHactica,
1698.78s - 1700.78s |  and you say, how do I make this?
1700.78s - 1703.78s |  It will find ways to do it.
1703.78s - 1705.78s |  It does this combinatorially
1705.78s - 1709.78s |  by looking through all of the chemical literature historically,
1709.78s - 1713.78s |  and then it will put the pieces together
1713.78s - 1716.78s |  and find reactions that have already been tested
1716.78s - 1718.78s |  and connect the dots for you,
1718.78s - 1720.78s |  and it'll make it as simple as you want.
1720.78s - 1724.73s |  How are you doing?
1724.73s - 1726.73s |  Yeah, just a quick question.
1726.73s - 1728.73s |  Is that the right one? Oh, no, no.
1728.73s - 1730.73s |  No, this is not the right one. I see.
1730.73s - 1732.73s |  That was my concern.
1732.73s - 1734.73s |  I didn't want to go poking around your workstation.
1734.73s - 1736.73s |  Thank you. That's all right.
1736.73s - 1738.73s |  Bear with us a moment.
1739.73s - 1743.58s |  Boop! All right.
1743.58s - 1745.58s |  Let's see. Here we go.
1745.58s - 1751.20s |  Maybe.
1751.20s - 1754.20s |  Just last week, I had a guy interview me
1754.20s - 1756.20s |  whose childhood friend...
1756.20s - 1758.20s |  Wonderful.
1758.20s - 1760.20s |  Thank you.
1760.20s - 1762.20s |  Probably.
1762.20s - 1770.06s |  All right, cool.
1770.06s - 1772.06s |  I'm just going to sort of forward the slides
1772.06s - 1774.06s |  until it catches up with me.
1774.06s - 1776.06s |  I got interviewed with a guy
1776.06s - 1778.06s |  who told me this heartbreaking story
1778.06s - 1780.06s |  about his childhood friend
1780.06s - 1782.06s |  dying of...
1782.06s - 1784.06s |  I believe it was multiple sclerosis
1784.06s - 1786.06s |  at 25
1786.06s - 1790.06s |  because she had a very rare subtype,
1790.06s - 1793.06s |  and the medicine
1793.06s - 1795.06s |  for that particular subtype,
1795.06s - 1797.06s |  because it was so rare,
1797.06s - 1800.06s |  had been given orphan drug status,
1800.06s - 1805.06s |  which gave it this extended patent length
1805.06s - 1808.06s |  and also allowed for the price point
1808.06s - 1811.06s |  to be whatever they wanted,
1811.06s - 1816.06s |  and it was priced at $850 a day.
1816.06s - 1818.06s |  And she died.
1818.06s - 1820.06s |  And he and I sat down,
1820.06s - 1822.06s |  and I shared my screen with him,
1822.06s - 1824.06s |  and we went on Chemhaxica,
1824.06s - 1826.06s |  and in a matter of minutes, he and I,
1826.06s - 1828.06s |  neither of us chemists,
1828.06s - 1831.06s |  figured out a way to manufacture it for $20 a day.
1831.06s - 1833.06s |  It's that powerful of a tool.
1833.06s - 1835.06s |  Now, that's not to say, of course,
1835.06s - 1837.06s |  that there isn't some chemistry still to be done.
1837.06s - 1839.06s |  You do need to figure some things out.
1839.06s - 1842.06s |  But this gets a huge jump on it.
1842.06s - 1846.06s |  You could potentially find a synthesis mechanism
1846.06s - 1849.06s |  just with this and a good chemist
1849.06s - 1853.06s |  rather than having a giant team of them work for months.
1853.06s - 1857.06s |  And additionally, this is how we figured out
1857.06s - 1859.06s |  how to make Sovaldi.
1859.06s - 1861.06s |  Um...
1862.06s - 1864.06s |  I kind of, it's tempting to skip ahead,
1864.06s - 1866.06s |  but I kind of don't want to touch it.
1866.06s - 1870.06s |  So I'll keep talking a little bit
1870.06s - 1873.06s |  and see where we are on the clock here.
1873.06s - 1876.06s |  Um, how fragile is this?
1876.06s - 1878.06s |  Where'd my guy go?
1878.06s - 1880.06s |  All right, I'll just keep pressing the button.
1880.06s - 1887.01s |  So both of these services are live now.
1887.01s - 1889.01s |  The other thing to note about the, uh...
1889.01s - 1891.01s |  Is this safe?
1891.01s - 1893.01s |  Can I skip down?
1893.01s - 1895.01s |  No, no, just hit escape. It's fine.
1895.01s - 1897.01s |  And then, uh...
1897.01s - 1899.01s |  Oh, and then I can just scroll.
1899.01s - 1902.01s |  Thank you for bearing with us through this process.
1902.01s - 1904.01s |  I appreciate you all.
1904.01s - 1906.01s |  Oh, right, I was about to do a thing.
1906.01s - 1908.01s |  Okay, cool.
1908.01s - 1910.01s |  So here we go.
1910.01s - 1912.01s |  Yeah, I guess I kind of gave it away, didn't I?
1912.01s - 1914.01s |  All right, but here we go.
1914.01s - 1916.01s |  All right, here's Daniel O'Day.
1916.01s - 1920.01s |  Ha! Lying to Congress about Sovaldi.
1920.01s - 1923.01s |  And I think I have time
1923.01s - 1926.01s |  to take exception to his pricing structure.
1926.01s - 1928.01s |  And my hacker friends,
1928.01s - 1931.01s |  I have a question for you.
1931.01s - 1933.01s |  Should I call him?
1933.01s - 1938.34s |  All right, now don't everybody call him at once.
1938.34s - 1940.34s |  He'll jam the line.
1940.34s - 1942.34s |  Uh, we'll see, uh...
1942.34s - 1944.34s |  We'll see what he has to say.
1944.34s - 1946.34s |  All right, Danny boy.
1946.34s - 1948.34s |  Pipes are calling.
1948.34s - 1950.34s |  Four Thieves Vinegar is calling.
1950.34s - 1952.34s |  And we're not pleased with what you've done.
1952.34s - 1959.34s |  So here we go, 415-533-3976.
1959.34s - 1961.34s |  Call him afterwards if he doesn't answer, okay?
1961.34s - 1968.14s |  Let's give this a try.
1968.14s - 1974.52s |  Can you hear this? Can you hear this?
1974.52s - 1976.52s |  Hi there, Daniel O'Day, please.
1976.52s - 1978.52s |  Uh, who's calling?
1978.52s - 1980.52s |  Uh, this is Dr. Michael Laufer.
1980.52s - 1985.15s |  Dr. Michael Laufer from the Four Thieves Vinegar collection, please.
1985.15s - 1989.10s |  Sorry, I can't understand what you're saying.
1989.10s - 1991.10s |  I'm sorry, the connection's bad.
1991.10s - 1994.10s |  Dr. Michael Laufer, I'm calling from Four Thieves.
1994.10s - 1996.10s |  He's expecting my call.
1997.10s - 1999.10s |  He's expecting your call?
1999.10s - 2001.10s |  Uh, yeah.
2001.10s - 2004.38s |  Hold on a second.
2004.38s - 2005.38s |  Thank you so much.
2005.38s - 2010.50s |  Yep, I'm still here.
2010.50s - 2020.69s |  Hold on.
2020.69s - 2021.69s |  I still can't understand who you are.
2021.69s - 2023.69s |  I'm sorry, can you say that again?
2023.69s - 2025.69s |  Yeah, Dr. Michael Laufer from the Four Thieves Vinegar collective.
2025.69s - 2027.69s |  I'm calling from Las Vegas.
2027.69s - 2032.43s |  Okay, your call.
2032.43s - 2034.43s |  Uh, well, can you put me on with him anyway?
2034.43s - 2039.73s |  Hi there, it's Dr. Michael Laufer.
2039.73s - 2041.73s |  I'm calling from the Four Thieves Vinegar collective.
2041.73s - 2046.93s |  I remember, but please don't call it again.
2047.93s - 2049.93s |  Well, you sure you don't want to chat?
2051.93s - 2057.06s |  Hello?
2057.06s - 2062.96s |  Well, I tried.
2062.96s - 2064.96s |  I was going to invite him down and everything.
2064.96s - 2070.20s |  All right, moving on.
2070.20s - 2074.20s |  How do you do DIY pharmaceuticals, even if you don't have help?
2074.20s - 2077.20s |  Again, you have to automate the chemistry.
2077.20s - 2079.20s |  You have to deal with the reaction.
2079.20s - 2085.20s |  And, oh, I'm, I'm, I'm cutting down on time.
2085.20s - 2090.20s |  So here, again, some of this stuff that I talked about, again, tomorrow at 11 a.m.,
2090.20s - 2094.20s |  Creator Stage 2, you can come by and you can get all the detail on this.
2094.20s - 2096.20s |  I'm going to skip down again.
2096.20s - 2101.20s |  And, uh, but you'll see, again, if you look in the, like, side column here,
2101.20s - 2104.20s |  you can see all of these really beautiful pictures of things.
2104.20s - 2107.20s |  But I'll show you just one little bit here.
2107.20s - 2110.20s |  Uh, I'm going to have to sort of jump back and forth.
2110.20s - 2114.20s |  But here's the, uh, here's the micro lab in all its glory.
2114.20s - 2117.20s |  And it's actually doing chemistry here.
2117.20s - 2119.20s |  Uh, this isn't going to work.
2119.20s - 2122.20s |  It was, uh, this was so slick when I put it together.
2122.20s - 2123.20s |  I apologize.
2123.20s - 2126.20s |  But here at the end, I'll show you this little bit.
2126.20s - 2130.20s |  You have your active pharmaceutical ingredient in the solution in this smaller jar.
2130.20s - 2136.20s |  And all you're going to do in the last step of most chemistry is just pour it through a coffee filter.
2136.20s - 2138.20s |  It's as simple as that.
2138.20s - 2141.20s |  And once you do, then you're going to sit there and you're going to let it drip.
2142.20s - 2146.20s |  And all of the impurities flow out and your active pharmaceutical ingredient is left.
2146.20s - 2149.20s |  And you just dry out the coffee filter.
2149.20s - 2153.92s |  And there's your drug.
2153.92s - 2158.92s |  Again, come by tomorrow and you'll see this all happen in real time.
2158.92s - 2160.92s |  Um, I already talked through these systems.
2160.92s - 2165.92s |  But, again, these are online services that we have, which we will show.
2165.92s - 2168.92s |  Uh, the Recipe Press is a brilliant piece of work.
2168.92s - 2170.92s |  Uh, Chemhactica is a brilliant piece of work.
2170.92s - 2173.92s |  But let me just talk about Sovaldi specifically.
2173.92s - 2175.92s |  Here it is rendered in two dimensions.
2175.92s - 2177.92s |  I'm sure you've seen this.
2177.92s - 2179.92s |  For those of you who are chemistry phobic, do not let this bother you.
2179.92s - 2181.92s |  I promise this is simple.
2181.92s - 2184.92s |  Our chemists are brilliant and did the hard work.
2184.92s - 2186.92s |  Here's what the reaction looks like.
2186.92s - 2189.92s |  And the amazing part of this is that it is only one step.
2189.92s - 2191.92s |  So, pay attention.
2191.92s - 2193.92s |  This will be very quick.
2193.92s - 2194.92s |  It will only take a moment.
2194.92s - 2196.92s |  Here's what you have.
2196.92s - 2200.92s |  On the right, you will see this ring with fluorines.
2200.92s - 2204.92s |  The fluorines and the oxygen will break off like this.
2204.92s - 2208.92s |  And you get that little extra stick that wants to connect to an oxygen.
2208.92s - 2210.92s |  And there's that lonely little oxygen on the other side.
2210.92s - 2213.92s |  And they're going to make friends.
2213.92s - 2217.92s |  And they do it like this.
2217.92s - 2219.92s |  And for those of you with good short-term memories,
2219.92s - 2223.92s |  you will see that this is indeed the molecule that we were trying to get at the beginning.
2223.92s - 2225.92s |  A single step.
2225.92s - 2227.92s |  And you can get this drug.
2227.92s - 2229.92s |  You want to see it in three dimensions?
2229.92s - 2231.92s |  Here you go.
2231.92s - 2232.92s |  Again.
2232.92s - 2234.92s |  The fluorines are the green.
2234.92s - 2236.92s |  The oxygens are the red.
2236.92s - 2238.92s |  You're going to see this piece break off.
2238.92s - 2241.92s |  And you're going to see this extra little stick.
2241.92s - 2244.92s |  And it wants to come around in a little smooch.
2244.92s - 2246.92s |  And there is Sovaldi.
2246.92s - 2251.92s |  Now, eventually, you're going to have to make bills.
2251.92s - 2255.92s |  They just passed a law that makes owning a pill press a felony.
2255.92s - 2257.92s |  Hilarious.
2257.92s - 2261.92s |  Because all you need is something that will press something.
2261.92s - 2263.92s |  I've had people tell me that reloading devices can do this.
2263.92s - 2266.92s |  A simple Arbor press will do it too.
2266.92s - 2268.92s |  Say you want a pill mold?
2268.92s - 2270.92s |  You can print one out of resin.
2270.92s - 2273.92s |  Then you take your active pharmaceutical ingredient.
2273.92s - 2275.92s |  You tap it in.
2275.92s - 2277.92s |  You fill it up.
2277.92s - 2279.92s |  You put the plunger in.
2279.92s - 2281.92s |  You press it down.
2281.92s - 2285.23s |  And then you spray it with glitter.
2285.23s - 2287.23s |  Why do you spray it with glitter?
2287.23s - 2290.23s |  Well, to put it in the words of one of our chemists,
2290.23s - 2294.23s |  if it doesn't sparkle, it's not my revolution.
2294.23s - 2308.53s |  I know I've put this figure up many times.
2308.53s - 2311.53s |  But it still horrifies me.
2311.53s - 2314.53s |  No matter how many times I see it.
2314.53s - 2317.53s |  This is a commercial Sovaldi pill.
2317.53s - 2322.26s |  This is a $1,000 bill.
2322.26s - 2324.26s |  Now, they're in circulation.
2324.26s - 2326.26s |  Not much.
2326.26s - 2328.26s |  But they're around.
2328.26s - 2330.26s |  You can find them.
2330.26s - 2336.03s |  They're mostly collector's items.
2336.03s - 2338.03s |  But you can get them.
2338.03s - 2340.03s |  Grover Cleveland, everybody.
2340.03s - 2342.03s |  $1,000.
2342.03s - 2344.03s |  How ridiculous is this?
2344.03s - 2349.03s |  Now, contrastingly, here's our little pill that we made for $3.50 worth of materials.
2349.03s - 2352.03s |  So here's a question.
2352.03s - 2354.03s |  Which would you pick?
2354.03s - 2358.28s |  Now, I happen to have one of these pills.
2358.28s - 2361.91s |  What would you pick?
2361.91s - 2365.29s |  The bill or the pill?
2365.29s - 2369.70s |  So who would take this collector's item?
2369.70s - 2371.70s |  Yeah?
2371.70s - 2375.81s |  All right, come up.
2375.81s - 2379.81s |  Now, these are actually worth more than $1,000 because they're so rare.
2379.81s - 2383.50s |  There you go.
2383.50s - 2385.50s |  Yours to keep.
2385.50s - 2387.50s |  Joke's on you, though.
2387.50s - 2389.50s |  It's counterfeit.
2389.50s - 2394.26s |  So you're actually in violation of a whole bunch of laws right now because you took that from me.
2394.26s - 2396.26s |  But realistically, this is not counterfeit.
2396.26s - 2398.26s |  It's pirated.
2398.26s - 2400.26s |  There's a difference.
2400.26s - 2402.26s |  This doesn't try to look like something it's not.
2402.26s - 2408.26s |  This does the exact same thing as the thing that it's trying to be.
2408.26s - 2410.26s |  And it doesn't have to try.
2410.26s - 2423.26s |  This is both chemically and isomorphically identical to anything that you would get in a pharmacy if you had the money.
2423.26s - 2427.26s |  Now, I get this question a lot.
2427.26s - 2432.26s |  Now, of course, the point of all of this is that you don't have to test it.
2432.26s - 2437.26s |  The systems are designed so that all of the care and attention you can get on the front end.
2437.26s - 2439.26s |  And then you don't have to.
2439.26s - 2442.26s |  But we did anyway.
2442.26s - 2452.26s |  Anybody out there who knows how to read a high-performance liquid chromatography readout will see that this is fucking amazing.
2452.26s - 2454.26s |  That spike is perfect.
2454.26s - 2456.26s |  There's only one thing in there.
2456.26s - 2460.26s |  For those of you who don't read these, here's something a little more quantitative.
2460.26s - 2464.93s |  And I will draw your attention to this number.
2464.93s - 2466.93s |  That's the purity.
2466.93s - 2480.65s |  Before you get too impressed, allow me to say, if you were to buy Sovaldi in the raw from a chemical supplier, you only get 98%.
2480.65s - 2490.65s |  And again, for those of you who are astute with numbers, you will notice this is an order of magnitude more pure than what you would get if you bought it.
2490.65s - 2495.15s |  Where'd my goon go? I need another shot.
2495.15s - 2497.15s |  Thank you, sir.
2497.15s - 2500.98s |  Watch this.
2500.98s - 2514.19s |  My team's watching, and they're all freaking out right now because I didn't tell them I was going to do this.
2514.19s - 2519.46s |  And I don't even have the hepatitis that I know of.
2519.46s - 2522.46s |  All right. Let's keep going.
2522.46s - 2524.46s |  I have five minutes.
2524.46s - 2526.46s |  Want to quote some other superheroes?
2526.46s - 2528.46s |  You'll notice this.
2528.46s - 2536.25s |  Now, this is the fourth time I'm mentioning this.
2536.25s - 2546.25s |  And I mention this because this entire course of treatment can be made for $300 in raw materials.
2546.25s - 2551.25s |  And I happen to have it right here.
2551.25s - 2556.25s |  Now, who said they had a friend who was infected with hepatitis?
2556.25s - 2558.25s |  There were a couple people.
2558.25s - 2562.10s |  Right here?
2562.10s - 2568.62s |  You. Come up here.
2568.62s - 2570.62s |  Keep your friend healthy. Keep them safe.
2570.62s - 2574.60s |  Thank you so much.
2574.60s - 2582.14s |  We should be doing this every day.
2582.14s - 2588.58s |  I get this question a lot.
2588.58s - 2593.82s |  I'm going to move on now.
2593.82s - 2599.82s |  Again, if you don't differentiate between morality and legality, one of us is in the wrong conference.
2599.82s - 2601.82s |  Again, none of our work scales up.
2601.82s - 2604.82s |  This is worth noting because those of you who are like, wow, he does stuff super cheap.
2604.82s - 2606.82s |  Maybe I could start a business.
2606.82s - 2608.82s |  I mean, go nuts, right?
2608.82s - 2610.82s |  But you're going to be wasting it.
2610.82s - 2612.82s |  Talk to a chemical engineer.
2612.82s - 2614.82s |  Scaling chemistry is very difficult.
2614.82s - 2616.82s |  When you do it on a small scale, it's much easier.
2616.82s - 2618.82s |  And additionally, some people are like, oh, that's super exciting.
2618.82s - 2620.82s |  How do I get one?
2620.82s - 2622.82s |  You make it.
2622.82s - 2624.82s |  We don't sell anything.
2624.82s - 2626.82s |  We don't even sell merch.
2626.82s - 2633.74s |  We have a merch page on our website showing you how you can make your own.
2633.74s - 2635.74s |  You've all seen this stamp.
2635.74s - 2637.74s |  This is when an authority figure tells you you're allowed.
2637.74s - 2639.74s |  Now, some people decided this might look cute.
2639.74s - 2643.74s |  But you will never see this on anything ever.
2643.74s - 2649.74s |  Because we are not an authority figure, and we are not telling you what to think or what to do.
2649.74s - 2661.74s |  The only thing that the Four Thieves Vinegar Collective will ever approve is you making your own decisions about your own health.
2661.74s - 2663.74s |  And that we've already approved.
2663.74s - 2665.74s |  So, go on and do the thing.
2665.74s - 2672.96s |  I'm running low on time.
2672.96s - 2680.96s |  So I'm going to skip this slide, but we have some more deep ideological ideas that I would rant about if I had more on the clock.
2680.96s - 2688.13s |  Again, come to the Biohacking Village tomorrow.
2688.13s - 2691.38s |  You'll be able to see everything.
2691.38s - 2693.38s |  This is an American phrase, isn't it?
2693.38s - 2697.38s |  I'm going to add another one from the same genre.
2697.38s - 2704.88s |  And with this, I would like to address the feds out there.
2704.88s - 2708.88s |  And some of the execs from pharmacy.
2708.88s - 2710.88s |  I've spotted some of you during the day.
2710.88s - 2712.88s |  And I'd like to say the following.
2712.88s - 2716.88s |  I would rather be singing your praises.
2716.88s - 2722.88s |  I would like it much better if you did your work properly.
2722.88s - 2726.88s |  So that our work became obsolete and we could go do something else.
2726.88s - 2736.88s |  But until you do, if you would like to stop me, you will have to send assassins.
2736.88s - 2756.88s |  Because, so long as you stand between people and the medicines they need, due to your greed, or your ignorance, or your cowardice, I will fight you until I curse you with my dying breath.
2756.88s - 2760.88s |  And when you kill me, it won't matter much.
2760.88s - 2762.88s |  I'm just another human.
2762.88s - 2768.88s |  Like the thousands who die from your inaction every day.
2768.88s - 2772.88s |  And the other members of Four Thieves will step in to continue the work.
2772.88s - 2780.88s |  And the future members of Four Thieves that are probably sitting right next to you now will come to join them.
2780.88s - 2782.88s |  And the ones far away we haven't even met yet.
2782.88s - 2787.88s |  Because we are fighting for nothing less than our lives.
2787.88s - 2796.06s |  Help is not on the way.
2796.06s - 2798.06s |  I will say this last.
2798.06s - 2802.06s |  My fellow hackers, come join us.
2802.06s - 2806.06s |  And we have one last tool that everyone can use.
2806.06s - 2809.06s |  And you don't need to read anything about it.
2809.06s - 2813.06s |  And you don't need to build anything.
2813.06s - 2824.06s |  The next time a medical officer says you can't have what you need, look them in the eye and say, if you will not help me, I will make this myself.
2824.06s - 2826.06s |  Because that's the truth.
2826.06s - 2828.06s |  You can.
2828.06s - 2830.06s |  Thank you so much.


url: https://www.youtube.com/watch?v=BIjgd2mOEks
title: DEF CON 32 - Human Dignity in AI and Tech Policy - Jan Trzaskowski
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=BIjgd2mOEks",
  "title": "DEF CON 32 - Human Dignity in AI and Tech Policy  - Jan Trzaskowski",
  "description": "Social media have been a decade-long dress rehearsal in online manipulation. AI can create information, make predictions and take decisions that will affect human behaviour, including our behaviours as citizens, workers and consumers. Safeguards are needed, since generative AI will only exacerbate the personal, social and societal harms already caused by data-driven business models.\n\nWe examine the centrality of human dignity in tech law and policy and how our mindsets and legal frameworks must be informed by psychological, technological and societal perspectives. Based on insights from market dynamics, marketing techniques, design strategies, and human frailties we demonstrate how information asymmetries have reduced individual agency and the ability to create transparency.\n\nHuman dignity is a core value in liberal democracies that must also be reflected in tech policy. Protections are required when businesses interfere with our rights to freedom, property, privacy and non-discrimination. With the digitalisation of the human experience, users have become programmable objects. We cannot rely on regulation alone and need to discuss how we can act to reclaim our dignity.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2263,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.00s | This text was transcribed using whisper model: large-v2

 Thank you so much for sharing your attention with me today.
4.00s - 8.00s |  The technology is not really working, but I'll explain what's on the slides,
8.00s - 11.00s |  and you can download them if they don't get up here.
11.00s - 15.00s |  So, I'm a law professor at Copenhagen Business School and Aalborg University,
15.00s - 20.00s |  and I'm here to talk about hacking human behavior.
20.00s - 27.00s |  I will talk about big tech arrogance, human ignorance,
27.00s - 32.00s |  what human dignity can be used for, what to do about it,
32.00s - 34.00s |  so that's what I'm going to talk about.
34.00s - 37.00s |  Everything is based on the book you can see on the screen there.
37.00s - 43.00s |  It's an orange book. I'll leave a copy at the Policy Village for you to see.
43.00s - 47.00s |  So, the good thing is it's available online, and you can find the link on the slides
47.00s - 50.00s |  whenever you get there.
50.00s - 55.00s |  Okay, so you're there, so you have the link here, everything is working.
55.00s - 60.00s |  So, first of all, what we're talking about here is also artificial intelligence,
60.00s - 65.00s |  and if you look at the history of technology law, in the mid-90s,
65.00s - 70.00s |  there was a lot of focus on copyright, because what was being digitalized
70.00s - 74.00s |  back in the 90s was music, films, and so on.
74.00s - 77.00s |  What happened next was that we got social media,
77.00s - 81.00s |  and what happened with social media was that it was the human experience
81.00s - 84.00s |  that got digitalized.
84.00s - 90.00s |  And then the interest revolved around privacy, personal data.
90.00s - 94.00s |  And now with the latest hype of artificial intelligence,
94.00s - 102.00s |  we see that the focus in law is on copyright and privacy once again,
102.00s - 105.00s |  so these two areas, so that's curious.
105.00s - 110.00s |  So, the conclusions, to start with them, Norbert Wiener said it very nice,
110.00s - 116.00s |  more than 75 years ago, that what we have with artificial intelligence
116.00s - 120.00s |  or thinking machines, as he talked about, was akin to the atomic bomb,
120.00s - 123.00s |  he compared to the atomic bomb back then.
123.00s - 126.00s |  What he also said was that when we have technology, it's going to be used,
126.00s - 130.00s |  so it's not going to go away, so that is also something we can rely on.
130.00s - 134.00s |  And the last thing, which is the most important thing, is that the solution
134.00s - 138.00s |  is to think about something else than just buying and selling.
138.00s - 143.00s |  Market economy, but think about humanity instead of that.
143.00s - 147.00s |  And what is also interesting is that this book that came out,
147.00s - 152.00s |  Norbert Wiener came out in 1948, which was also the year that we got
152.00s - 157.00s |  the UN Declaration of Human Rights, that speaks about human dignity.
157.00s - 161.00s |  So, this is an old story being told again.
161.00s - 166.00s |  So, the first thing we should recognize is that when we are talking about
166.00s - 170.00s |  data and AI, they don't have any intrinsic value.
170.00s - 174.00s |  I can have full data sets of all of you on a USB stick,
174.00s - 179.00s |  and it doesn't have any value before I start using it.
179.00s - 184.00s |  So, what we should be curious about is, what is the technology being used for?
184.00s - 187.00s |  That is why my focus has been on data-driven business models
187.00s - 189.00s |  rather than the technology.
189.00s - 192.00s |  And I would argue that what we see with artificial intelligence
192.00s - 195.00s |  is just the same as what we've seen with data-driven business models.
195.00s - 198.00s |  So, it's been a dress rehearsal for more than a decade
198.00s - 202.00s |  that we have used technology for manipulation,
202.00s - 207.00s |  and it's just been exacerbated by new technology in AI.
207.00s - 211.00s |  So, what we should be curious about is, what incentives are there?
211.00s - 214.00s |  And when it comes to personalized marketing,
214.00s - 216.00s |  there are basically three incentives that businesses have.
216.00s - 219.00s |  They want to earn money, but what correlates with earning money,
219.00s - 221.00s |  making profits?
221.00s - 223.00s |  That is, getting as many users as possible.
223.00s - 225.00s |  That's why you want to have the network effect.
225.00s - 228.00s |  So, you're going to be the winner that takes it all.
228.00s - 231.00s |  You also want to have more attention.
231.00s - 234.00s |  So, the more addictive you can make your platform,
234.00s - 236.00s |  the more attention you will get,
236.00s - 238.00s |  and the more advertising dollars you can get.
238.00s - 240.00s |  And the last thing what you want to have
240.00s - 243.00s |  is as much data as possible of each individual,
243.00s - 246.00s |  because the more you know of each individual,
246.00s - 249.00s |  the higher price you can charge for the advertising.
250.00s - 253.00s |  And what is new with generative AI is basically
253.00s - 256.00s |  that the businesses also have an interest
256.00s - 258.00s |  in getting as much content as possible.
258.00s - 261.00s |  That is why we see social media platforms
261.00s - 266.00s |  trying to use our content to train their AI models on.
266.00s - 271.00s |  That is part of what we can talk about
271.00s - 275.00s |  when we say big tech arrogance, but I'll come back to that.
276.00s - 278.00s |  Yes.
278.00s - 281.00s |  So, in liberal democracies and in markets,
281.00s - 284.00s |  we have the idea of empowerment.
284.00s - 286.00s |  So, as citizens, we should be empowered
286.00s - 289.00s |  to be part of society.
289.00s - 292.00s |  In markets, we should be able to make rational choices
292.00s - 294.00s |  following our goals, values, and preferences
294.00s - 296.00s |  that may be different from each of us,
296.00s - 298.00s |  but we should be free individuals.
298.00s - 300.00s |  We should be empowered.
300.00s - 303.00s |  And that is what I will challenge in this talk to begin with.
303.00s - 306.00s |  So, what I came up to in my research is that
306.00s - 308.00s |  there are three things that need to be in place
308.00s - 311.00s |  in order to talk meaningfully about empowerment.
311.00s - 313.00s |  First, we need agency.
313.00s - 316.00s |  Some capability to understand and act in the world
316.00s - 318.00s |  that we are living in.
318.00s - 321.00s |  We need to have some sort of transparency.
321.00s - 324.00s |  And then we, of course, need the absence of manipulation,
324.00s - 327.00s |  because manipulation is the opposite of freedom.
327.00s - 329.00s |  And if we start with agency,
329.00s - 331.00s |  we can say we know from psychology
331.00s - 333.00s |  that we are bounded rationally.
333.00s - 335.00s |  That means that we are not completely rational
335.00s - 337.00s |  in whatever we do.
337.00s - 340.00s |  And there's been a lot of research in how we are irrational
340.00s - 343.00s |  that can be used against us.
343.00s - 345.00s |  When it comes to transparency,
345.00s - 347.00s |  the only thing I will say now is that
347.00s - 350.00s |  information and transparency is not the same.
350.00s - 352.00s |  I'll come back to transparency soon,
352.00s - 354.00s |  because that is key to what we are talking about.
354.00s - 357.00s |  The last thing, when we talk about absence of manipulation,
357.00s - 360.00s |  I've borrowed a definition from Cass Sunstein
360.00s - 363.00s |  when speaking about whether you're sufficiently engaging
363.00s - 365.00s |  or appealing to the user's capacity
365.00s - 367.00s |  for reflection and deliberation.
367.00s - 370.00s |  Just think about you get a cookie consent pop-up
370.00s - 373.00s |  and you get the choice between managed preferences
373.00s - 375.00s |  and accept all.
375.00s - 377.00s |  You would, of course, accept all,
377.00s - 380.00s |  because there's less friction.
380.00s - 383.00s |  So you could do a lot with design,
383.00s - 385.00s |  and there's a lot of focus on design
385.00s - 387.00s |  both in law and in technology.
387.00s - 391.00s |  How do we design the reality we enter online?
391.00s - 394.00s |  So this slide I've taken here
394.00s - 398.00s |  just to signal or give you some insights
398.00s - 402.00s |  into the toolbox of advertisers.
402.00s - 407.00s |  These levels of influence are compiled by Sheldini,
407.00s - 410.00s |  who is a professor in marketing.
410.00s - 412.00s |  And this is just to illustrate
412.00s - 415.00s |  how easy it is to manipulate us.
415.00s - 418.00s |  So if you take reciprocation, for instance,
418.00s - 421.00s |  if we get something from a company or from a person,
421.00s - 424.00s |  we feel obliged toward that person.
424.00s - 428.00s |  So if you get a free Google Maps, that's great.
428.00s - 431.00s |  You feel you're obliged to do something for Google.
431.00s - 433.00s |  If you take scarcity,
433.00s - 436.00s |  three other people are looking at this limited offer right now.
436.00s - 438.00s |  Oh, we better buy it right now.
438.00s - 440.00s |  So scarcity works.
440.00s - 442.00s |  This is written down in books,
442.00s - 445.00s |  so it's easy, accessible, but nobody reads it.
445.00s - 447.00s |  So when we talk about markets,
447.00s - 449.00s |  we want to make the distinction
449.00s - 451.00s |  between persuasion and manipulation
451.00s - 453.00s |  because in a market economy,
453.00s - 455.00s |  we need to have marketing,
455.00s - 459.00s |  and we need to be able to persuade consumers,
459.00s - 461.00s |  but we should not manipulate them.
461.00s - 464.00s |  And that is what I've spent almost 30 years of my life
464.00s - 466.00s |  finding out where is the fine line
466.00s - 468.00s |  between persuasion and manipulation.
468.00s - 471.47s |  When it comes to technology,
471.47s - 475.47s |  I should just add for behavior modification for marketing,
475.47s - 480.47s |  the first book I've come across on scientific advertising
480.47s - 482.47s |  is more than 100 years old.
482.47s - 485.47s |  So this is an old discipline in manipulating people.
485.47s - 487.47s |  It's definitely not new.
487.47s - 489.47s |  A newer discipline is
489.47s - 492.47s |  how can you use technology to persuade people?
492.47s - 495.47s |  Some of you might be familiar with B.J. Fock,
495.47s - 499.47s |  who wrote a book on persuasive technology or captology.
499.47s - 501.47s |  How can you use computers
501.47s - 505.47s |  to persuade people to buy stuff and do stuff?
505.47s - 507.47s |  And what I'll just conclude here
507.47s - 509.47s |  is that design is extraordinarily powerful
509.47s - 512.47s |  in how we can manipulate people.
512.47s - 514.47s |  One of the things he mentioned
514.47s - 518.47s |  is that computers can go where humans cannot go.
518.47s - 520.47s |  So I would assume that most of you
520.47s - 523.47s |  will have Amazon, Google, Facebook, etc.
523.47s - 525.47s |  with you everywhere you go,
525.47s - 527.47s |  in your bedroom, in your bathroom, and so on.
527.47s - 530.47s |  So that is definitely a testament to the fact
530.47s - 534.47s |  that you can go where nobody else can go.
534.47s - 536.47s |  Also, another important thing,
536.47s - 538.47s |  if you look into psychology,
538.47s - 542.47s |  if you want to conclude on bounded rationality,
542.47s - 544.47s |  the fact that we're not completely rational,
544.47s - 546.47s |  the reason why we're not completely rational
546.47s - 548.47s |  is because we are more emotional.
548.47s - 551.47s |  A lot of the choices we make are emotional,
551.47s - 553.47s |  and then we rationalize them afterwards.
553.47s - 555.47s |  And the interesting thing about computers
555.47s - 558.47s |  is that it can actually evoke feelings.
558.47s - 561.47s |  So when you open your computer and you get a smiley,
561.47s - 563.47s |  you feel better with yourself.
563.47s - 566.47s |  That's how easy we are to persuade and manipulate.
566.47s - 569.47s |  And if you fuse BJ Fogg with Cialdini,
569.47s - 571.47s |  we get online influence.
571.47s - 573.47s |  We get Cialdini on steroids
573.47s - 576.47s |  because you can actually use the technology
576.47s - 579.47s |  to apply the levels of influence.
579.47s - 581.47s |  The good thing about being in academia
581.47s - 583.47s |  is that you decide yourselves which books to read.
583.47s - 585.47s |  And I thought it would be interesting
585.47s - 587.47s |  to read books on magic.
587.47s - 589.47s |  And it actually turns out that
589.47s - 591.47s |  the two foundations of magic
591.47s - 593.47s |  is misdirection
593.47s - 596.47s |  and the impression of having a choice.
596.47s - 598.47s |  And that's what's going on here.
598.47s - 600.47s |  That's why we could say it's kind of magic.
600.47s - 603.47s |  So where does that all lead?
603.47s - 606.47s |  It leads to information asymmetries.
606.47s - 607.47s |  This is not new.
607.47s - 609.47s |  What I've done in my book is
609.47s - 613.47s |  I developed the model of information asymmetry.
613.47s - 617.47s |  So Akerlof wrote in 1970 an article
617.47s - 620.47s |  about information asymmetry.
620.47s - 623.47s |  That is what I call Tier 1 information asymmetry.
623.47s - 625.47s |  The fact that the seller knows much more
625.47s - 628.47s |  about him or herself than the buyer
628.47s - 630.47s |  and also about the product.
630.47s - 632.47s |  So if I'm going to sell my used car to you,
632.47s - 634.47s |  I know everything about it, you know nothing.
634.47s - 637.47s |  In law, we solve that with information.
637.47s - 639.47s |  I have a duty to inform you about
639.47s - 641.47s |  the condition of the car.
641.47s - 644.47s |  And if I fail to do that, you can come after me.
644.47s - 648.47s |  So that is the Tier 1 information asymmetry.
648.47s - 650.47s |  The Tier 2 information asymmetry
650.47s - 653.47s |  is what the business know about how to persuade us.
653.47s - 656.47s |  How to persuade people in general.
656.47s - 658.47s |  That is Sheldini's technology.
658.47s - 660.47s |  That is PJ Fox's technology
660.47s - 663.47s |  on the techniques about how to influence people
663.47s - 666.47s |  and using computers to do that.
666.47s - 668.47s |  So that is Tier 2.
668.47s - 672.47s |  Tier 3 is where we get information of each individual.
672.47s - 674.47s |  That is where personal data come in.
674.47s - 676.47s |  So if I don't see you as a whole crowd
676.47s - 679.47s |  but see you as individuals
679.47s - 682.47s |  and I have in my records
682.47s - 686.47s |  thousands, hundreds of thousands, maybe millions of users.
686.47s - 688.47s |  You can go into my shop
688.47s - 690.47s |  and you can click a little bit around
690.47s - 694.47s |  and I can easily find a group of people that match you.
694.47s - 696.47s |  Meaning I can start creating
696.47s - 699.47s |  an artificial intelligence model of you.
699.47s - 702.47s |  So just a few clicks, I have a model of you
702.47s - 706.47s |  and I can use that model to test how to better persuade you.
706.47s - 709.47s |  So that is Tier 3 information asymmetry
709.47s - 712.47s |  and that is why we should care about personal data, of course.
712.47s - 714.47s |  One of the things we do with that
714.47s - 716.47s |  is we create personalized realities.
716.47s - 718.47s |  That means that my reality may be different
718.47s - 720.47s |  from each of yours reality.
720.47s - 723.47s |  That means that it is difficult to compare
723.47s - 726.47s |  how we are being persuaded or manipulated.
726.47s - 729.47s |  So how do we level that information asymmetry?
729.47s - 732.47s |  Well, the first thing we should recognize, as I said earlier,
732.47s - 735.47s |  information and transparency are two different things.
735.47s - 737.47s |  So you use information,
737.47s - 741.47s |  you communicate information to create transparency.
741.47s - 745.47s |  And regulators have preferred to use information
745.47s - 747.47s |  as the regime to regulate markets
747.47s - 750.47s |  because it is almost free to do.
751.47s - 755.47s |  The problem is that if I'm obliged as a seller
755.47s - 757.47s |  to give you information,
757.47s - 761.47s |  your obligation will be to decode the information I've given to you.
761.47s - 764.47s |  That means I put an extra burden on you.
764.47s - 766.47s |  And we already have cognitive overload
766.47s - 768.47s |  when we are on the Internet.
768.47s - 770.47s |  So more information is not going to help us.
770.47s - 773.47s |  So that is one thing we should realize about that.
773.47s - 776.47s |  We should also realize that there's a lot of theory
776.47s - 778.47s |  about frames and storytelling.
778.47s - 780.47s |  Storytelling is how we understand the world.
780.47s - 782.47s |  We understand the world in stories.
782.47s - 784.47s |  So we tell each other stories
784.47s - 787.47s |  and we are being told stories by businesses.
787.47s - 790.47s |  And they are much better at making up stories
790.47s - 792.47s |  than we are ourselves.
792.47s - 797.47s |  One of the things or more misleading stories that are out there
797.47s - 799.47s |  is that we are paying with personal data.
799.47s - 802.47s |  I would argue that that is a misleading story.
802.47s - 805.47s |  It's a misleading framing of the situation,
805.47s - 807.47s |  which I will come back to.
807.47s - 813.47s |  So what we need to, as consumers, as regulators, and so on,
813.47s - 815.47s |  is we need to understand the deal.
815.47s - 818.47s |  So Article 22 of the GDPR
818.47s - 820.47s |  speaks about automated decision-making.
820.47s - 823.47s |  So that is the closest we get to regulation
823.47s - 826.47s |  of applied artificial intelligence.
826.47s - 828.47s |  And there the requirement is that you should
828.47s - 830.47s |  explain the data subject about the logic,
830.47s - 833.47s |  the significance, and envisage consequences.
833.47s - 835.47s |  In my book, that is a gold standard
835.47s - 838.47s |  for how you should inform people.
838.47s - 841.47s |  Neil Postman, one of my heroes,
841.47s - 843.47s |  wrote in the 80s and the 90s
843.47s - 846.47s |  about technology and media.
846.47s - 848.47s |  And what he said about technology
848.47s - 851.47s |  is that everything we should know about technology
851.47s - 853.47s |  is everything we should know about cars.
853.47s - 856.47s |  It is not how we use the cars or the technology.
856.47s - 860.47s |  It is how the technology or the cars are using us.
860.47s - 862.47s |  That is what we should be curious about.
862.47s - 864.47s |  Because that is where we can understand
864.47s - 867.47s |  the price that we are paying when we get something for free.
869.47s - 873.47s |  So what we need to understand is externalities.
873.47s - 877.47s |  So externalities, if you imagine you have a factory making shoes
877.47s - 880.47s |  and you have some waste from the shoe production
880.47s - 882.47s |  and you just throw it in the river,
882.47s - 884.47s |  that is an externality.
884.47s - 887.47s |  The business will sell the shoes and get the money from them.
887.47s - 890.47s |  But the rest of us will have to clean up
890.47s - 893.47s |  of the disaster they made in the river.
893.47s - 895.47s |  That is an externality.
895.47s - 897.47s |  Think about big tech companies.
897.47s - 901.47s |  How much damage, how much harm they are making to society
901.47s - 904.47s |  that we have to clean up after them.
904.47s - 907.47s |  So I think it makes sense to talk about externalities.
907.47s - 910.47s |  So what are the harms?
910.47s - 912.47s |  Well, first of all, you can say that
912.47s - 917.47s |  the whole idea is of hacking or hijacking the human experience.
917.47s - 921.47s |  And a lot of people talk about personalized marketing.
921.47s - 924.47s |  What is the problem that I am going to buy something I don't need?
924.47s - 926.47s |  We do that all the time.
926.47s - 928.47s |  Well, it might not be such a big harm.
928.47s - 930.47s |  Departing with your money,
930.47s - 932.47s |  depending on how rich or how poor you are,
932.47s - 934.47s |  of course, it makes a difference.
934.47s - 936.47s |  But what we should also care about
936.47s - 938.47s |  is that it is not only commercial marketing we are talking about.
938.47s - 940.47s |  We are talking about political marketing.
940.47s - 942.47s |  We are talking about religious marketing.
942.47s - 945.47s |  And that is where it gets a bit sketchy.
945.47s - 949.47s |  We should also understand that we are being affected by technology,
949.47s - 951.47s |  including artificial intelligence,
951.47s - 955.47s |  as citizens, as workers, and as consumers.
955.47s - 958.47s |  So every aspect of our life is being influenced
958.47s - 963.47s |  by how technology around us is being designed and sold to us.
964.47s - 968.47s |  So in the book, I divide the harms into three categories.
968.47s - 970.47s |  I talk about personal harms,
970.47s - 973.47s |  including people getting more lonely,
973.47s - 975.47s |  which correlates with having bad health.
975.47s - 977.47s |  We don't want people to be lonely.
977.47s - 979.47s |  We are social animals.
979.47s - 983.47s |  We also get worse at reading and understanding our attention span
983.47s - 985.47s |  due to the overload.
985.47s - 988.47s |  And I can see that with my students.
988.47s - 993.33s |  We are less able to communicate with other people
993.33s - 997.33s |  because we have an escape route for social interaction.
997.33s - 999.33s |  Social interaction is hard.
999.33s - 1001.33s |  There is a lot of friction.
1001.33s - 1004.33s |  But if you can go and look at cat videos on TikTok or YouTube,
1004.33s - 1006.33s |  that is easy.
1006.33s - 1007.33s |  That is frictionless.
1007.33s - 1009.33s |  And that is why we will often go there.
1009.33s - 1013.33s |  But that means also that we will not train our capabilities
1013.33s - 1015.33s |  of engaging with other people.
1015.33s - 1019.33s |  And that, of course, has consequences for democracy.
1019.33s - 1023.33s |  Because if we are not active in markets and democracy,
1023.33s - 1027.33s |  you know, it's going to hurt ourselves eventually.
1027.33s - 1031.12s |  So data-driven business models,
1031.12s - 1033.12s |  including those that use artificial intelligence,
1033.12s - 1035.12s |  whatever that means,
1035.12s - 1037.12s |  that affects markets.
1037.12s - 1040.12s |  Our ability to choose between different products.
1040.12s - 1045.12s |  New natural monopoly due to network effects and so on.
1045.12s - 1048.12s |  It also affects democracy, as I mentioned.
1048.12s - 1052.12s |  And more important nowadays, geopolitics.
1052.12s - 1054.12s |  We have a huge debate about TikTok.
1054.12s - 1057.12s |  Can we use TikTok because they're based in China?
1057.12s - 1062.12s |  And in my view, the problem with TikTok or similar providers
1062.12s - 1065.12s |  are not so much that they are looking into our data,
1065.12s - 1067.12s |  but the fact that they are actually making
1067.12s - 1069.12s |  all our children look at cat videos
1069.12s - 1073.12s |  instead of training their social engagement with each other.
1073.12s - 1077.12s |  I think that is the big overlooked danger in all this.
1077.12s - 1080.12s |  And then, of course, climate.
1080.12s - 1082.12s |  I mean, first of all, we need to understand
1082.12s - 1084.12s |  and realize the consequences of what we've been doing
1084.12s - 1086.12s |  for the last 100, 150 years.
1086.12s - 1088.12s |  What's going on there?
1088.12s - 1091.12s |  That means that we can think critically.
1091.12s - 1094.12s |  And if you can't think critically, we can just accept things.
1094.12s - 1097.12s |  Oh, you know, everything is fine.
1097.12s - 1099.12s |  But we also should realize,
1099.12s - 1101.12s |  especially when it comes to generative AI,
1101.12s - 1105.12s |  that the fact that we are talking about a bubble
1105.12s - 1107.12s |  when it comes to generative AI
1107.12s - 1109.12s |  is because they are running out of content
1109.12s - 1111.12s |  to train their models on.
1111.12s - 1116.12s |  But also the power grid doesn't have the proportions
1116.12s - 1119.12s |  to feed all the energy that is used for it.
1119.12s - 1121.12s |  And it's not going to happen in the next few years.
1121.12s - 1123.12s |  So should we have a discussion
1123.12s - 1126.12s |  about what our energy should be used for?
1126.12s - 1128.12s |  Or should we just have a market saying,
1128.12s - 1130.12s |  those that pay the most?
1130.12s - 1133.12s |  And I could imagine that is maybe on the West Coast somewhere
1133.12s - 1136.12s |  that they will have the most money to buy all the energy.
1136.12s - 1138.12s |  But how will that affect the rest of us?
1138.12s - 1140.12s |  Again, think about externality.
1140.12s - 1142.12s |  Who's going to clean up this thing?
1142.12s - 1144.12s |  And there we should also be aware
1144.12s - 1146.12s |  when we talk about climate,
1147.12s - 1150.12s |  there are people in other places
1150.12s - 1155.12s |  that will feel the harms more than we will, maybe.
1155.12s - 1158.12s |  But it's also our children
1158.12s - 1160.12s |  that will have to pay the price and their children.
1160.12s - 1162.12s |  We should also be aware of that.
1162.12s - 1165.12s |  That is part of rational choice
1165.12s - 1167.12s |  that is thinking about future generations,
1167.12s - 1169.12s |  which is very complicated.
1169.12s - 1171.12s |  And that is why it's much easier to just buy
1171.12s - 1174.12s |  what we think we need or feel what we need
1174.12s - 1177.12s |  and just rationalize it afterwards.
1177.12s - 1181.50s |  The whole idea of data-driven business models
1181.50s - 1184.50s |  is that you're basically, as such a company,
1184.50s - 1188.50s |  you're looking at humans as programmable objects.
1188.50s - 1191.50s |  So that is how we are seen.
1191.50s - 1193.50s |  You know, Mark Zuckerberg, Elon Musk and so on
1193.50s - 1195.50s |  don't care about their users.
1195.50s - 1197.50s |  They care about money,
1197.50s - 1199.50s |  which is completely legitimate in a market economy,
1199.50s - 1201.50s |  profit maximization.
1201.50s - 1203.50s |  They don't care about you.
1203.50s - 1205.50s |  So they will do whatever they can
1205.50s - 1207.50s |  as long as it's profitable,
1207.50s - 1209.50s |  including manipulate you to buy stuff
1209.50s - 1211.50s |  to stay longer on their platform
1211.50s - 1214.50s |  so they can sell more advertising and so on.
1214.50s - 1217.50s |  So you could make the argument
1217.50s - 1220.50s |  that by using technology the way we do,
1220.50s - 1223.50s |  we have been domesticated by technology.
1223.50s - 1228.50s |  We talk about augmented reality
1228.50s - 1231.50s |  and we talk about virtual realities,
1231.50s - 1234.50s |  but I think we should talk about abated realities.
1234.50s - 1237.50s |  So our real reality is being abated
1237.50s - 1239.50s |  by using technology.
1239.50s - 1242.50s |  And just to quote Postman once again,
1242.50s - 1246.50s |  to be against technology is like being against food.
1246.50s - 1248.50s |  It doesn't make sense.
1248.50s - 1251.50s |  So I'm not saying you shouldn't use technology.
1251.50s - 1253.50s |  I'm just arguing that we should be more conscious
1253.50s - 1255.50s |  about how we use it,
1255.50s - 1258.50s |  recognizing how it's being used against us.
1258.50s - 1262.50s |  So when I say we are not paying with personal data,
1262.50s - 1264.50s |  which we are, we are paying with personal data,
1264.50s - 1267.50s |  but we are also paying with attention.
1267.50s - 1270.50s |  We are paying with our agency,
1270.50s - 1272.50s |  our ability to make rational choices.
1272.50s - 1277.50s |  And attention and agency are scarce resources.
1277.50s - 1279.50s |  So when we talk about personal data,
1279.50s - 1281.50s |  you can take the same personal data
1281.50s - 1282.50s |  and get a lot of stuff for free.
1282.50s - 1284.50s |  I'm the clever guy, right?
1284.50s - 1286.50s |  I get all these things for free
1286.50s - 1288.50s |  and I use the same data.
1288.50s - 1290.50s |  But again, you should be curious
1290.50s - 1292.50s |  about what the data is being used for.
1292.50s - 1296.50s |  And if it's being used to make us addicted to technologies,
1296.50s - 1298.50s |  we are paying with attention.
1298.50s - 1299.50s |  When we are being manipulated,
1299.50s - 1301.50s |  we are paying with agency,
1301.50s - 1305.50s |  the scarce resources that we need to lead good lives.
1305.50s - 1309.06s |  So the solution I come up with is
1309.06s - 1311.06s |  that we should focus more on human dignity.
1311.06s - 1316.06s |  So we should design policy, business, and so on
1316.06s - 1318.06s |  based on human dignity.
1318.06s - 1320.06s |  Because human dignity is basically the idea
1320.06s - 1326.06s |  of not reducing the individual to an object.
1326.06s - 1328.06s |  And that's exactly what's going on here.
1328.06s - 1330.06s |  So what is human dignity?
1330.06s - 1332.06s |  Well, human dignity has a history
1332.06s - 1335.06s |  in philosophy and religion and so on.
1335.06s - 1340.06s |  But with the declaration of the fundamental rights
1340.06s - 1342.06s |  from the United Nations,
1342.06s - 1344.06s |  it was actually put into a law.
1344.06s - 1346.06s |  It's a legal value now.
1346.06s - 1349.06s |  And I suggest in my book that we see
1349.06s - 1351.06s |  in a liberal democracy,
1351.06s - 1355.06s |  we see our constitutions on fundamental human rights.
1355.06s - 1359.06s |  We see that as the operating system of our society.
1359.06s - 1361.06s |  And the reason why I use the metaphor
1361.06s - 1363.06s |  of an operating system
1363.06s - 1365.06s |  is because it's not a given.
1365.06s - 1366.06s |  You know better than I do
1366.06s - 1369.06s |  how you can change the operating system of a computer.
1369.06s - 1373.06s |  Just like we can change the operating system of a society.
1374.06s - 1376.06s |  Which some people would like.
1376.06s - 1382.44s |  When we see fundamental rights constitutions
1382.44s - 1384.44s |  as the operating system,
1384.44s - 1387.44s |  we can see secondary law legislation
1387.44s - 1389.44s |  as the application layer.
1389.44s - 1391.44s |  That means that we should understand everything
1391.44s - 1392.44s |  on the application layer
1392.44s - 1397.44s |  in light of the operating system of human dignity.
1397.44s - 1400.44s |  So we should design everything for human dignity
1400.44s - 1402.44s |  and have that in the back of our mind.
1402.44s - 1404.44s |  So what is human dignity?
1404.44s - 1408.44s |  So in the book I work with freedom.
1408.44s - 1412.44s |  So the idea that we should be free individuals having agency.
1412.44s - 1414.44s |  We should have not only the right
1414.44s - 1417.44s |  but also the ability to think critically.
1417.44s - 1420.44s |  We should make sure that
1420.44s - 1422.44s |  those people providing the software
1422.44s - 1424.44s |  or tools, apps to us,
1424.44s - 1426.44s |  that to some extent
1426.44s - 1430.44s |  that they align their products with our goals.
1431.44s - 1434.23s |  We should also make sure that
1434.23s - 1436.23s |  if you're using for instance AI
1436.23s - 1438.23s |  that should be voluntary.
1438.23s - 1442.23s |  Just think about when we got My AI in Snapchat.
1442.23s - 1444.23s |  Well that was to children.
1444.23s - 1447.23s |  Here, dear children, here is a chatbot.
1447.23s - 1449.23s |  That means that you can spend more time
1449.23s - 1451.23s |  and give us more data by using that.
1451.23s - 1453.23s |  Think about the incentives.
1453.23s - 1456.23s |  We should think about privacy.
1456.23s - 1459.23s |  Personal data and security.
1460.23s - 1462.23s |  And I would say one of the most successful
1462.23s - 1464.23s |  pieces of legislation from the EU
1464.23s - 1466.23s |  must be the GDPR.
1466.23s - 1468.23s |  And I hope you will get something akin to that
1468.23s - 1470.23s |  here in the US as well.
1470.23s - 1473.23s |  But just remember that we have
1473.23s - 1476.23s |  the UN principles on human rights as well
1476.23s - 1478.23s |  that protects privacy.
1478.23s - 1480.23s |  One thing I would emphasize here
1480.23s - 1482.23s |  when we talk about privacy and personal data
1482.23s - 1484.23s |  because that's basically two different things.
1484.23s - 1487.23s |  So personal data is information about
1487.23s - 1488.23s |  each individual.
1488.23s - 1490.23s |  That's about individuals.
1490.23s - 1492.23s |  And what we see when we are looking at
1492.23s - 1494.23s |  artificial intelligence,
1494.23s - 1496.23s |  especially generative AI,
1496.23s - 1499.23s |  you're building large language models
1499.23s - 1501.23s |  based on personal data.
1501.23s - 1504.23s |  But when you create the large language model
1504.23s - 1507.23s |  suddenly you're not dealing with personal data.
1507.23s - 1510.23s |  But does that mean that you can just do that?
1510.23s - 1512.23s |  And I don't think we can do that.
1512.23s - 1515.23s |  Because if I have a big model
1515.23s - 1518.23s |  of how consumers, how citizens
1518.23s - 1523.23s |  are reacting to certain things,
1523.23s - 1526.23s |  how you have correlations between certain things,
1526.23s - 1530.23s |  you can actually use that to invade people's privacy.
1530.23s - 1532.23s |  And that is why I think in the future,
1532.23s - 1533.23s |  in the near future,
1533.23s - 1536.23s |  we will talk less about personal data
1536.23s - 1539.23s |  and much more about privacy in general.
1539.23s - 1541.23s |  And just to illustrate this,
1541.23s - 1543.23s |  we have five or six court cases
1543.23s - 1547.23s |  from the Court of Justice of the European Union
1547.23s - 1549.23s |  dealing with data retention.
1549.23s - 1552.23s |  So in essence, they were about
1552.23s - 1555.23s |  police for fighting serious crime
1555.23s - 1558.23s |  wanting to get access to metadata
1558.23s - 1561.23s |  from the telecom operators.
1561.23s - 1563.23s |  And what the Court of Justice said,
1563.23s - 1565.23s |  that is too far-reaching.
1565.23s - 1567.23s |  That is too much of an interference
1567.23s - 1569.23s |  with people's privacy
1569.23s - 1572.23s |  that the police would get access to metadata
1572.23s - 1576.23s |  to have indiscriminate access to all the metadata.
1576.23s - 1579.23s |  And the question that is obvious to raise here is,
1579.23s - 1583.23s |  do we think that social media services, big tech,
1583.23s - 1586.23s |  do they have more or less personal data
1586.23s - 1588.23s |  or data in general about us
1588.23s - 1591.23s |  than telecom operators?
1591.23s - 1595.96s |  Probably with some magnitude more data.
1595.96s - 1597.96s |  The next question we should ask ourselves.
1597.96s - 1600.96s |  So fighting serious crime,
1600.96s - 1604.96s |  is that more important than serving personalized marketing?
1604.96s - 1607.96s |  And again, the answer should be obvious.
1607.96s - 1610.96s |  And that is also one of the reasons why it should be obvious
1610.96s - 1614.96s |  that the current models, under EU law at least,
1614.96s - 1616.96s |  are not viable, they are not legal.
1616.96s - 1618.96s |  That will be my argument.
1618.96s - 1621.96s |  But just the fact here that I think we should
1621.96s - 1624.96s |  still be curious about personal data,
1624.96s - 1626.96s |  but I think the general concept of privacy
1626.96s - 1628.96s |  will be much more important.
1628.96s - 1631.96s |  Then of course there is equality, nondiscrimination,
1631.96s - 1633.96s |  which is also part of human rights.
1633.96s - 1636.96s |  And we know that digital vulnerabilities
1636.96s - 1639.96s |  will come out of artificial intelligence.
1639.96s - 1642.96s |  Some people will lose their jobs and some won't.
1642.96s - 1645.96s |  And the whole idea of getting AI
1645.96s - 1647.96s |  is try to be more efficient so we can get rid
1647.96s - 1649.96s |  of people working for us.
1649.96s - 1652.96s |  Meaning also that we will lose potential whistleblowers.
1652.96s - 1655.96s |  Wouldn't it be great if we could just automate everything
1655.96s - 1657.96s |  so we wouldn't have anybody to blow the whistle
1657.96s - 1659.96s |  and say there's something going on here?
1659.96s - 1663.96s |  We will never see an Edward Snowden or Francis Haugen again
1663.96s - 1666.96s |  because everything is being automated.
1666.96s - 1669.96s |  And the last thing that comes with generative AI, as I said,
1669.96s - 1672.96s |  that is their hunger for getting more data
1672.96s - 1674.96s |  to train their models on.
1674.96s - 1677.96s |  And that is why they are looking into whatever content
1677.96s - 1681.96s |  you posted on Facebook 10 or 20 years ago,
1681.96s - 1683.96s |  and suddenly they consider it to be their property
1683.96s - 1685.96s |  and can just use it to train data.
1685.96s - 1688.96s |  Just like Apple can train their algorithms
1688.96s - 1691.96s |  on all the photos you put up there.
1691.96s - 1695.96s |  So intellectual property rights are extraordinarily important.
1695.96s - 1699.96s |  So what I will talk about here is big tech arrogance.
1699.96s - 1702.96s |  So big tech arrogance, in my view,
1702.96s - 1706.96s |  would constitute the fact that you have companies.
1706.96s - 1711.96s |  They can be small or large, but mainly big tech.
1711.96s - 1713.96s |  They will have an interest
1713.96s - 1718.96s |  and they will design their technology not in our interest.
1718.96s - 1721.96s |  On the contrary, against our best interests.
1721.96s - 1727.96s |  So they will make products that are not aligned with our interests.
1727.96s - 1730.96s |  Then they will use storytelling
1730.96s - 1734.96s |  to convince us that they're doing it for us.
1734.96s - 1739.96s |  And in addition, they're buying and gaslighting our politicians.
1739.96s - 1742.96s |  This is too complicated. Don't regulate.
1742.96s - 1744.96s |  You don't want to be in the EU, right?
1744.96s - 1746.96s |  It's too complicated. You're protecting all the users.
1746.96s - 1750.96s |  Don't go down that route. We're going to lose a lot of money.
1750.96s - 1755.96s |  And they do that to not be regulated, not to be taxed.
1755.96s - 1758.96s |  That is what I would consider to be big tech arrogance.
1758.96s - 1764.36s |  So what do we do about this?
1764.36s - 1768.36s |  So, of course, we need to have legislation, laws.
1768.36s - 1772.36s |  But we have realized how difficult it is to enforce law
1772.36s - 1776.36s |  when we are up against actors that are so big
1776.36s - 1781.36s |  and don't care about complying with the law.
1781.36s - 1784.36s |  That is very difficult. We've seen that over and over again.
1784.36s - 1788.36s |  So Meta in the European Union got a fine of half a billion euros.
1788.36s - 1791.36s |  Roughly half a billion US dollars.
1791.36s - 1795.36s |  That's a parking fine. That's a license fee for them.
1795.36s - 1800.36s |  They have profits of 40 billion each year.
1800.36s - 1803.36s |  And this was a fine for what they had done for six years.
1803.36s - 1806.36s |  Or maybe seven. It's a license fee.
1806.36s - 1810.36s |  It's not going to change anything.
1810.36s - 1815.36s |  So what I will propose here is that we focus on businesses.
1815.36s - 1818.36s |  So I come from a consumer law background.
1818.36s - 1821.36s |  But can we learn something in businesses from consumer law?
1821.36s - 1824.36s |  And here I will argue that businesses,
1824.36s - 1827.36s |  they are just as vulnerable as consumers.
1827.36s - 1830.36s |  Especially when it comes to AI and generative AI.
1830.36s - 1834.36s |  It's been hyped so much that many companies
1834.36s - 1840.36s |  will feel obliged to buy these licenses.
1840.36s - 1842.36s |  For instance, for Copilot.
1842.36s - 1844.36s |  Because their competitors are doing it.
1844.36s - 1848.36s |  The press are not critical about how much they can be used for.
1848.36s - 1850.36s |  What are the gains?
1850.36s - 1852.36s |  I mean, as a business, you should think about
1852.36s - 1855.36s |  what are the benefits and what are the downsides.
1855.36s - 1857.36s |  So businesses are vulnerable.
1857.36s - 1859.36s |  It's just like outsourcing stuff.
1859.36s - 1864.36s |  So when you use generative AI in your business,
1864.36s - 1867.36s |  it's like outsourcing.
1867.36s - 1869.36s |  And we've seen that.
1869.36s - 1872.36s |  There was a time when it was good to outsource all your production.
1872.36s - 1876.36s |  We could get cheap stuff we didn't need made somewhere else.
1876.36s - 1882.36s |  And now we realize there are some geopolitical issues about outsourcing.
1883.36s - 1889.36s |  So think about buying into the generative AI hype
1889.36s - 1892.36s |  as using the fear of missing out.
1892.36s - 1896.36s |  As we've used for social media, for human beings,
1896.36s - 1901.36s |  it's now being used as FOMO for businesses.
1901.36s - 1905.36s |  It is also being said that if you don't buy these licenses,
1905.36s - 1909.36s |  all your employees will go and use the unsafe version
1909.36s - 1913.36s |  that's freely available on the Internet.
1913.36s - 1917.36s |  Try and ask your boss whether they want to pay for World of Warcraft
1917.36s - 1919.36s |  or some other game.
1919.36s - 1924.36s |  Because if you don't buy it to us, we will use it.
1924.36s - 1928.36s |  So that is the pressure that is being put on businesses.
1928.36s - 1931.36s |  And we should just realize that there are risks
1931.36s - 1933.36s |  and associated costs with outsourcing.
1933.36s - 1936.36s |  It creates new dependencies.
1936.36s - 1940.36s |  Would we like to be as dependent in our core business strategy
1940.36s - 1945.36s |  as most companies are in using Microsoft Office?
1945.36s - 1948.36s |  When is the last time your company considered
1948.36s - 1953.36s |  which word processor to use for their employees?
1953.36s - 1956.36s |  Would you be in the same situation when it comes to artificial intelligence,
1956.36s - 1958.36s |  when you have fired people in the hope
1958.36s - 1961.36s |  that the AI would make you more efficient?
1961.36s - 1963.36s |  And it turns out that it's not more efficient.
1963.36s - 1965.36s |  It's actually more expensive.
1965.36s - 1968.36s |  Because who is going to pay the $1 trillion
1968.36s - 1973.36s |  that is supposed to be invested in a generative AI?
1973.36s - 1975.36s |  You and I. And who has the money?
1975.36s - 1976.36s |  The businesses.
1976.36s - 1980.36s |  So I think we should think about what businesses can do.
1980.36s - 1984.36s |  And we see that with the action taken by certain business
1984.36s - 1988.36s |  withdrawing advertising from the Social Media X.
1988.36s - 1990.36s |  That is what businesses can do.
1990.36s - 1992.36s |  Because businesses are big spenders.
1992.36s - 1996.36s |  They buy stuff in massive amounts.
1996.36s - 1999.36s |  So businesses can do something.
1999.36s - 2002.36s |  So one thing you could ask yourself is,
2002.36s - 2005.36s |  is cloud as cheap as social media or free?
2005.36s - 2007.36s |  Especially if you're in a situation
2007.36s - 2011.36s |  where the cloud content is being used to train AI.
2011.36s - 2014.36s |  And also don't believe everything you read on the internet.
2014.36s - 2018.36s |  Think about the incentives of all the consultants telling you
2018.36s - 2020.36s |  that you will become so much more efficient
2020.36s - 2024.36s |  if you adopt generative AI in your business.
2024.36s - 2028.36s |  Goldman Sachs had a very critical report out recently
2028.36s - 2032.36s |  saying that it probably overstated how much benefit
2032.36s - 2037.36s |  there will be to businesses from adopting generative AI.
2037.36s - 2041.36s |  So what we should do is we should sense the environment
2041.36s - 2043.36s |  we live in and act upon it.
2043.36s - 2046.36s |  That's a definition of agency.
2046.36s - 2047.36s |  As we talked about in the beginning,
2047.36s - 2050.36s |  which is a part of empowerment,
2050.36s - 2052.36s |  we should understand what's going on.
2052.36s - 2055.36s |  And I've tried to present that to you.
2055.36s - 2057.36s |  How does it work?
2057.36s - 2060.36s |  How are we being used by technology?
2060.36s - 2063.36s |  And again, I'm not saying technology is good or bad,
2063.36s - 2066.36s |  but the current data-driven business models,
2066.36s - 2069.36s |  including those based on AI,
2069.36s - 2072.36s |  are not necessarily in our best interest.
2072.36s - 2074.36s |  And we should be curious about that.
2075.36s - 2078.36s |  We should also use the human superpower.
2078.36s - 2080.36s |  What we can do as human beings
2080.36s - 2085.36s |  is that we can imagine things that don't exist.
2085.36s - 2087.36s |  That is our superpower.
2087.36s - 2090.36s |  We can imagine a building that is not built yet.
2090.36s - 2093.36s |  We can imagine value out of nothing.
2093.36s - 2096.36s |  We can create NFTs and suddenly they have value
2096.36s - 2097.36s |  and suddenly they don't.
2097.36s - 2100.36s |  But we can imagine stuff that doesn't exist.
2100.36s - 2106.36s |  So how can we as individuals imagine a better future?
2106.36s - 2111.36s |  How can we imagine the companies we're working for or with?
2111.36s - 2115.36s |  How can we talk to the people making decisions there?
2115.36s - 2117.36s |  Maybe it's not necessarily a good idea
2117.36s - 2121.36s |  to have generative AI licenses for all our employees,
2121.36s - 2126.36s |  especially not if data is being used to train these models.
2127.36s - 2131.36s |  We should recognize that democracy is the people ruling.
2131.36s - 2134.36s |  It's not big tech ruling.
2134.36s - 2139.36s |  So I would encourage and argue that human dignity
2139.36s - 2142.36s |  can be used for us as individuals
2142.36s - 2147.36s |  as a guiding policy for how we should see these things.
2147.36s - 2149.36s |  It can be used for businesses.
2149.36s - 2153.36s |  Would we accept to buy into generative AI
2153.36s - 2157.36s |  that has been built on other people's content,
2157.36s - 2160.36s |  infringing their copyrights?
2160.36s - 2164.36s |  And I also think we should be more careful about recognizing
2164.36s - 2167.36s |  that we are actually still living in a liberal democracy
2167.36s - 2171.36s |  and we have human rights and take them seriously
2171.36s - 2174.36s |  and have that into tech policy.
2174.36s - 2180.36s |  So I emphasize that policy is also what you think, say, and do.
2180.36s - 2184.36s |  And the best thing we can do for big tech at this moment
2184.36s - 2189.36s |  is to ensure that our children will not be able to do anything
2189.36s - 2191.36s |  without big tech.
2191.36s - 2195.36s |  Wouldn't it be great if people can't read, they can't think,
2195.36s - 2198.36s |  they can't talk, they can't write
2198.36s - 2201.36s |  without being dependent on generative AI?
2201.36s - 2203.36s |  Wouldn't that be great?
2203.36s - 2206.36s |  Then at least we will have the dystopian fantasy
2206.36s - 2209.36s |  that we see from California.
2209.36s - 2212.36s |  So what I will end this talk on is basically just saying
2212.36s - 2214.36s |  don't out-solve humanity.
2214.36s - 2216.36s |  We have to do something about this.
2216.36s - 2221.36s |  And if we don't do it as employees, as business owners,
2221.36s - 2225.36s |  as government officials, whatever, as hackers,
2225.36s - 2228.36s |  if we don't take these things serious,
2228.36s - 2232.36s |  it's going to be even worse than it is already now.
2232.36s - 2234.36s |  In the book I ask the question,
2234.36s - 2237.36s |  do we really have 10 years?
2237.36s - 2239.36s |  And that was three years ago.
2239.36s - 2243.36s |  Do we have seven years to get the balance right?
2243.36s - 2246.36s |  You make the decision, you can go and do a lot of stuff,
2246.36s - 2250.36s |  talk to people, talk to your friends, talk to your family,
2250.36s - 2252.36s |  just have discussions about these things,
2252.36s - 2254.36s |  revealing what's really going on.
2254.36s - 2256.36s |  Thank you so much for your attention.


url: https://www.youtube.com/watch?v=8IzKwczq0jI
title: DEF CON 32 - Leveraging AI for Smarter Bug Bounties - Diego Jurado & Joel Niemand Sec Noguera
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=8IzKwczq0jI",
  "title": "DEF CON 32 - Leveraging AI for Smarter Bug Bounties - Diego Jurado & Joel Niemand Sec Noguera",
  "description": "As security researchers, we constantly attempt to stay ahead of the curve, seeking innovative solutions to enhance our offensive security strategies. In recent years, the advent of artificial intelligence (AI) has introduced a new dimension to our efforts, particularly in the realm of bug bounties and pentesting. While significant attention has been given to understanding and mitigating attacks against AI systems, the potential of AI to assist in the offensive security field remains largely unclear.\n\nThis talk pretends to dig into the research and development process undertaken to create an AI agent designed to augment the bug bounty and pentesting workflow. Our AI agent is not merely a theoretical concept but a practical tool aimed at enhancing the efficiency and effectiveness of security researchers.\n\nWe have conducted extensive research to understand how AI can mimic and enhance human intuition and creativity in identifying vulnerabilities. While this may sound trivial, there is little evidence of this being tested before on generative AI agents. Our work breaks new ground by pushing the boundaries of what AI can achieve in offensive security.\n\nWill AI become an indispensable tool in our arsenal, capable of autonomously identifying and exploiting vulnerabilities? Join us as we explore the possibilities and implications of AI as an offensive assistant in this new era of offensive security.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2453,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.08s | This text was transcribed using whisper model: large-v2

 So, welcome everyone to our talk, Leveraging AI for Smart Debug Bounties.
5.08s - 10.10s |  First of all, thank you to DEF CON and the Bug Bounty Village for giving us this space
10.10s - 17.44s |  to discuss how AIs can improve and change the security field and the bug bounty space.
17.44s - 22.60s |  We are going to be discussing how AIs can improve our daily job and help us work on
22.60s - 28.10s |  what we want and also let the AI take care of other stuff.
28.10s - 31.50s |  So his name is Diego Jurado, I'm Joel Noguera.
31.50s - 34.40s |  We are both security researchers at Expo.
34.40s - 40.98s |  For those that don't know us, we have been quite a while in the bug bounty scene.
40.98s - 47.78s |  And apart from that, we have been also working for several years in some well-known companies
47.78s - 53.64s |  in the security industry as security researchers and testers.
53.64s - 56.90s |  So let's start from the very beginning.
56.90s - 63.06s |  When we started this three months ago, we started looking that there may...
63.06s - 68.34s |  In the recent years, we have seen a lot of research being published about people hacking
68.34s - 69.34s |  AIs, right?
69.34s - 75.86s |  Like people doing research about publishing how to force the AI to do unexpected things,
75.86s - 77.78s |  to leak information, et cetera.
77.78s - 84.18s |  However, there is one particular brand that remains unclear regarding AIs and is how AIs
84.18s - 86.78s |  could be used in a more offensive way.
86.78s - 92.22s |  In other words, would be the AI hacking for us and taking care of some stuff that we could
92.22s - 93.94s |  do.
93.94s - 95.46s |  And so we have been just...
95.46s - 100.46s |  We started three months ago, and we don't know where the limit is for this technology,
100.46s - 105.74s |  but we wanted to show you one quick example of the things that an AI agent could do on
105.74s - 108.69s |  our field.
108.69s - 113.17s |  So first of all, we are going to be talking about different questions, interesting questions
113.17s - 119.17s |  that we have been encounter while doing this journey.
119.17s - 123.77s |  And this is one of the first one, and it's how can AIs mimic human bounty hunters?
123.77s - 129.05s |  But in order to understand what a bounty hunter, what human bounty hunter means, we need to
129.05s - 131.13s |  first understand what it is, right?
131.13s - 132.13s |  For us.
132.13s - 137.89s |  So humans have several skills and capabilities that we hardly seen on the tools that we use
137.89s - 139.65s |  in our daily job.
139.65s - 145.61s |  And some of them are intuition, creativity, and decision making based on the experience
145.61s - 147.37s |  that we have collected before.
147.37s - 152.05s |  For example, if we learn something doing bounties, this is something that we are going to apply
152.05s - 156.17s |  in the future to keep improving and getting better results.
156.17s - 159.93s |  So let's try to answer this question with the demo.
159.93s - 167.33s |  In this case, we are going to see our agent exploiting a JWT Python implementation for
167.33s - 170.25s |  this particular CVE.
170.25s - 175.45s |  During the video, you are going to see the AI interacting with the web application, performing
175.45s - 181.61s |  executing commands, processing the outputs, taking decisions, and creating goals and learning
181.61s - 184.77s |  space on what it sees and learns during the process.
184.77s - 188.81s |  All what it takes for this is just a small description or goal, and the target that we
188.81s - 194.28s |  want to test.
194.28s - 198.96s |  So I'm going to pause a little bit here, just to show you a little bit of the interface,
198.96s - 201.60s |  because it's the first time you are seeing this.
201.60s - 208.24s |  So on the first part, you're going to see what we give to the AI, just that we want
208.24s - 210.88s |  to exploit that CVE and the target.
210.88s - 215.48s |  Then you can see the things that the AI is processing, analyzing, and the decisions and
215.48s - 218.36s |  learning that it's taking.
218.36s - 223.52s |  Then you can see the commands and the output, and the goals that the AI is generating all
223.52s - 224.52s |  by itself.
224.52s - 227.20s |  We have no influence on that.
227.24s - 232.60s |  So first of all, we start with the basic recon, and recognize that there is a register endpoint.
232.60s - 238.32s |  So it decides to attempt to register a user, and in this case, it tries to use a content
238.32s - 242.36s |  type JSON, which is grown and expected for the website.
242.36s - 246.60s |  So it learns that based on the response, and decides to change that to use the correct
246.60s - 247.60s |  content type.
247.60s - 254.04s |  In this case, it registered a new user, and here on the bottom, you can see that the agent
254.04s - 259.32s |  is logging in and saving the cookies on a cookie jar to use it later during the whole
259.32s - 262.18s |  thing.
262.18s - 267.58s |  Once logged in, it detects on the response that it has a JWT token, so immediately binds
267.58s - 272.18s |  this to the goal that we have provided, and decides to go to the internet to look for
272.18s - 275.14s |  some public information and public exploits.
275.14s - 281.02s |  Try NIST and GitHub, and in GitHub, it finds one match that is a possible proof of concept,
281.02s - 288.94s |  so it decides to download the proof of concept, and you can see that it's going to cut the
288.94s - 289.94s |  readme file.
289.94s - 291.22s |  This is something that we always do, right?
291.22s - 296.50s |  We want to understand how this exploit works, and we need to learn how to use it.
296.50s - 301.38s |  So it's going to try to grab the token and run the exploit, but it makes a mistake.
301.38s - 302.90s |  It's running in an incorrect path.
302.90s - 304.30s |  Who hasn't been there, right?
304.30s - 306.98s |  Like running an incorrect path for an exploit.
306.98s - 311.82s |  So now that it learns, we define where it is, it runs again everything, and it finds
311.82s - 316.22s |  that there is one missing dependency, so it goes ahead and installs the dependency and
316.22s - 320.90s |  runs again the exploit, changing the claim username to admin.
320.90s - 324.10s |  This is a small detail that we are going to talk about later.
324.10s - 328.62s |  Then it starts trying the different payloads that it's getting from the exploit against
328.62s - 333.46s |  the whole application, changing from logging to registration to see where this exploit
333.46s - 334.46s |  works or not.
334.94s - 341.14s |  And at some point this works on the root page, so the AI realizes that it has been logged
341.14s - 350.06s |  as the admin user and successfully retrieved the flag from the challenge that we have proposed.
350.06s - 361.22s |  So during this video, we have seen some of the things that we mentioned before about
361.22s - 364.62s |  humans and tools that we use every day.
364.62s - 369.62s |  We have seen some creativity, learning from mistakes, like identifying the incorrect path
370.02s - 375.10s |  and taking a decision to decide where to execute the exploit.
375.10s - 380.50s |  But most important, we have seen the capability of the AI to adapt into different situations.
380.50s - 385.86s |  We have seen the AI registering a user, changing the content type to adapt to what the application
385.86s - 392.78s |  expects, using the credentials that just created, and then interacting with authenticating endpoints
392.78s - 395.86s |  based on all the things that have learned.
395.86s - 400.62s |  And something that really is interesting is, for example, things that we do, like cutting
400.62s - 405.30s |  the readme for an exploit, reading the Python code to understand how it works.
405.30s - 409.34s |  There are probably simple things for us, but when we talk about something that is going
409.34s - 414.34s |  on all by itself and it's reading the code and understanding the input, the output, and
414.34s - 420.26s |  also the claims that we need to modify from the JWT token, it's super interesting.
420.26s - 424.98s |  And most interesting probably is that if you are familiar with DCVE, there is no Nuclei
424.98s - 426.62s |  template for this.
426.62s - 430.38s |  And if you wonder why, it's probably because you first need a valid token, which would
430.38s - 435.26s |  mean you have to register, sign in, and retrieve that token.
435.26s - 439.98s |  Automatizing that for every existing application on the internet will be quite a challenge.
439.98s - 445.82s |  In this case, the AI takes care of all that and makes progress on that goal.
445.82s - 450.62s |  So in order to understand how we got here, we have to first understand where we were
450.62s - 453.74s |  three months ago when we started.
453.74s - 460.86s |  We started looking for different white papers that were trying to use agents in a more offensive
460.86s - 461.86s |  way.
461.86s - 464.38s |  We found a few of them, not many.
464.38s - 471.78s |  But when we started looking at the results, and they all have different approaches.
471.78s - 476.86s |  One super common was the human-in-the-loop, that is the human providing real-time feedback
476.86s - 479.34s |  to the AI in order to improve the results.
479.34s - 483.82s |  Other have full automated agents, like the one you are seeing, other have super specific
483.82s - 490.46s |  agents where they were in charge of different tasks, and some of them were trying to exploit
490.46s - 496.11s |  non-vulnerabilities or other type of CTF challenges.
496.11s - 500.15s |  When we started looking at the results, for example, for this paper, actually one of the
500.15s - 505.87s |  authors of this paper, Brendan Dolan-Gabit, is one of our colleagues at Expo.
505.87s - 510.75s |  On this paper, they were trying to use LM agents to solve CTF challenges.
510.75s - 515.79s |  If you see in the categories, they attempt to work with all of them, but probably if
515.79s - 520.63s |  we pay attention to the web one, which is probably most interesting for us as bounty
520.63s - 523.95s |  hunters, the results are not that promising, right?
523.95s - 526.75s |  It's 16% just for one model.
526.75s - 534.87s |  So we keep digging into the different papers, and we found another one that had more promising
534.87s - 535.87s |  results.
535.87s - 541.63s |  In this case, they were trying to use LM agents to exploit one-day vulnerabilities.
541.63s - 546.75s |  When we look there, we see an 87%, and that's quite exciting and promising, but when we
546.75s - 553.27s |  start reading the results and the details, we see that if you remove the CV description
553.27s - 558.47s |  that you provide to the model, that 87% drops dramatically to a 7%.
558.47s - 564.36s |  So again, the results weren't that promising in this case.
564.36s - 569.40s |  So as a conclusion from the state-of-the-art, the results weren't good at all for models
569.40s - 571.56s |  at three months ago.
571.56s - 574.02s |  All the cases weren't complex enough.
574.02s - 578.44s |  For example, they were based on particular cases, like the exploit being just one, two
578.44s - 583.60s |  lines, or just requiring two requests to successfully exploit it.
583.60s - 587.32s |  And something that they have in common is that they were all limited.
587.32s - 592.92s |  For example, this last paper only had 15 CVs on their paper, so when you try to scale this
593.00s - 598.44s |  to the real world, you don't know how this is going to be expanded.
598.44s - 605.45s |  So we wanted to change things and scale things up.
605.45s - 609.49s |  So now let's talk about the approach that we had at Expo.
609.49s - 612.57s |  As Joel was saying, we wanted to scale things up.
612.57s - 617.53s |  So the first thing that we did was starting collecting thousands of benchmarks from different
617.53s - 620.65s |  CTF competitions.
620.65s - 624.49s |  We also partnered with some companies that you may know, like Postfigure and Pentester
624.49s - 625.49s |  Labs.
625.49s - 631.01s |  So they provided to us all the exercises that they have online, and we added to our benchmarks.
631.01s - 636.85s |  Also we wanted to collect the most interesting and realistic challenges that we can find,
636.85s - 641.25s |  and of course with a great focus in web applications.
641.25s - 645.71s |  Also apart from that, we had to categorize all the challenges, depending on the level
645.71s - 648.97s |  of difficulty, from easy to hard.
648.97s - 654.13s |  And we also, something really important for us, we created a fully autonomous agent, which
654.13s - 657.03s |  is connected to an attack machine.
657.03s - 661.49s |  And this attack machine not only contains a lot of pentesting tools, but we also added
661.49s - 666.37s |  some tools that we use on our daily basis for bug bounty, as we have a lot of experience
666.37s - 669.01s |  using them.
669.01s - 675.29s |  And apart from that, one thing that is also very important, we wanted to analyze the performance
675.29s - 676.29s |  of our solvers.
676.33s - 681.65s |  So for that, we created an exclusive set of more than 100 novel benchmarks.
681.65s - 686.37s |  These benchmarks are used for validation, and as we are completely sure that the solution
686.37s - 695.85s |  is not part of any training data set, we can also evaluate how the AI is performing.
695.85s - 699.67s |  And here are the results that we got after three months of work.
699.67s - 706.23s |  As you can see, Expo was able to solve 75% of the challenges from Postfigure Labs, 72%
706.23s - 710.99s |  of the challenges from Pentester Labs, and all of that without any human interaction.
710.99s - 717.05s |  So all the exercises that we were able to solve were completely solved by the AI.
717.05s - 722.11s |  Also something really important, talking again about the novel benchmarks, we were able to
722.11s - 724.43s |  solve 85% of those.
724.43s - 728.79s |  We tried to create these challenges as more representative as possible, and now we are
728.79s - 733.98s |  going to see how these challenges were created.
733.98s - 739.46s |  So here you have a tree map with a distribution of some vulnerabilities that we added to our
739.46s - 740.46s |  benchmarks.
740.46s - 746.22s |  As you can see, we tried to be as more realistic as possible, trying to follow a distribution
746.22s - 750.18s |  similar to what we see in bug bounties.
750.18s - 755.38s |  So you can see here that we have cross-site scripting and IDORS, which probably are one
755.38s - 759.78s |  of the most common issues and vulnerabilities that we see when doing bug bounties, and especially
759.78s - 761.34s |  in life hacking events.
761.34s - 766.22s |  But we also have some vulnerabilities like server-side rigorous forgery, common injections,
766.22s - 768.70s |  privileged escalation, and also some CVEs.
768.70s - 773.58s |  So we tried to follow a very good distribution to cover all the areas and all the vulnerability
773.58s - 774.58s |  types.
774.58s - 779.50s |  Also, just in case someone is interested, we are going to share all the benchmarks that
779.50s - 780.50s |  we have.
780.50s - 784.86s |  So we are planning to publish them in a few weeks, just in case you want to test them
784.86s - 787.86s |  against your own agents.
787.86s - 792.38s |  So just keep an eye to all the social media and website, as we will be sharing those over
792.38s - 794.86s |  there.
794.86s - 801.42s |  And here we have some statistics about the success rate that we have, depending on the
801.42s - 802.42s |  category.
802.42s - 807.02s |  We tried to follow a similar category to what we have in OWASP, which is a reference for
807.02s - 810.94s |  all of us that we are doing web pentesting.
810.94s - 815.06s |  And as you can see here, for some kind of categories, the AI was performing better than
815.06s - 816.58s |  others.
816.58s - 821.82s |  So let's say, for example, for broken authentication, we can see that OAuth and XAML were performing
821.82s - 824.22s |  not that well than in other examples.
824.22s - 828.42s |  This is something that we will be talking later, but we are trying to increase this
828.42s - 829.42s |  success rate.
829.42s - 834.58s |  But for example, for broken authentication, we have very good success.
834.58s - 840.74s |  And again, we are failing in CCRF tokens, in CCRF issues.
840.74s - 845.06s |  And we have some examples of injection vulnerabilities, which, of course, you all may know.
845.06s - 847.62s |  Again, we are failing in DOM XSS.
847.62s - 851.98s |  This is basically because at the beginning, when we started doing our agent, we were missing
851.98s - 853.62s |  like an embedded browser.
853.62s - 858.82s |  So the agent was not able to exploit some issues that requires exploiting something
858.82s - 860.34s |  in the browser or in client-side.
860.34s - 863.82s |  So this is something that we have improved now, and I think we will be talking later
863.82s - 866.30s |  about this.
866.30s - 871.10s |  And then finally, some misconfiguration issues that, as you can see here in cache poisoning
871.10s - 873.82s |  and cores, is something that we still need to improve.
873.90s - 878.18s |  I was really impressed about the blind XSS, because it's not something really easy, and
878.18s - 881.38s |  we had a very good success rate.
881.38s - 886.18s |  And then talking about the success versus difficulty, we can see that we perform really
886.18s - 889.54s |  well for easy and medium vulnerabilities.
889.54s - 894.46s |  We have almost 90% from all the benchmarks that we are talking about now.
894.46s - 901.46s |  Just to clarify, these statistics belong to Porzweiger, PentesterLab, and our own validation
901.46s - 902.46s |  challenges.
902.46s - 906.42s |  We also have some other benchmarks that we use for training and that all, but here we
906.42s - 909.86s |  are only including those three that we were talking before.
909.86s - 915.02s |  And then for hard vulnerabilities, we can see that we have 40%.
915.02s - 918.94s |  So yeah, of course, we are going to try to improve that.
918.94s - 925.70s |  And now here you can see some examples about some vulnerability types that you can see
925.70s - 926.70s |  there.
926.70s - 928.90s |  And we have one question for all of you.
928.90s - 934.18s |  So for those examples that you can see here, I would like to ask you if you think that
934.18s - 937.42s |  there is any case that the AI was not able to solve.
937.42s - 943.62s |  So somebody has any idea, any number?
943.62s - 948.58s |  We give you some seconds so that you can read all of them.
948.58s - 949.58s |  Which one?
949.58s - 950.58s |  Seven?
950.58s - 951.58s |  Okay.
951.58s - 952.58s |  Yeah.
952.58s - 958.50s |  So this was a tricky question, because in the end, the AI was able to solve all of them.
959.50s - 963.94s |  You can see that in our website, we have already shared some of those examples.
963.94s - 967.62s |  For example, the Node.js one, the first one, the IDOR.
967.62s - 972.94s |  But now we don't have time to see all of them, but we want to show you three of them.
972.94s - 976.98s |  So we are going to start with the reflected XSS.
976.98s - 982.30s |  So for the people that like exploiting this issue, you will like this example.
982.30s - 986.22s |  In this example, the goal is to exploit an XSS.
986.22s - 989.66s |  We have some sort of several filtering in place.
989.66s - 993.22s |  So you will see the agent trying to train some default payloads.
993.22s - 996.74s |  Then you will see that it tries to use some kind of encodings.
996.74s - 1001.26s |  And finally, after realizing how is the way to exploit that, he managed to exploit it
1001.26s - 1004.42s |  using HTML entity encoding.
1004.42s - 1006.58s |  So let's go to the example.
1006.58s - 1009.86s |  Yeah, let me update this.
1009.86s - 1010.86s |  Okay.
1010.86s - 1014.58s |  So here you have an example of our agent working.
1014.58s - 1020.90s |  So this is basically how it looks when we try to provide a challenge with a description.
1020.90s - 1023.50s |  And we just say, okay, go ahead and hack it.
1023.50s - 1027.62s |  So let's go up to see to the very beginning what we have.
1027.62s - 1031.70s |  As Joel was mentioning before, we have the description of the challenge.
1031.70s - 1037.18s |  In this case, we are only providing the goal to execute an XSS with the string XSS in capital
1037.18s - 1038.30s |  letters.
1038.30s - 1041.86s |  And we have also information about the target that we want to exploit.
1041.90s - 1048.18s |  So if we go a bit down, you can see that first it starts accessing to the web application.
1048.18s - 1051.66s |  It finds an endpoint, which is XSS 20.
1051.66s - 1055.06s |  And then realizes that there is a potential vulnerable parameter.
1055.06s - 1059.02s |  So now it starts trying with a typical payload.
1059.02s - 1062.54s |  And it realizes that it fails because it's getting a 405 error.
1062.54s - 1066.46s |  This is because it's trying to perform a POST request.
1066.46s - 1070.98s |  If we go a bit up to the previous output, you can see that there is a form which has
1070.98s - 1071.98s |  no action.
1071.98s - 1077.62s |  So first it will try it with a POST request and then realizes that it's doing bad and
1077.62s - 1081.58s |  changes to GET and tries again with the same payload.
1081.58s - 1086.34s |  So if we go a bit down, we can see that the first thing that the AI does is identify that
1086.34s - 1088.58s |  there is one character which is being blocked.
1088.58s - 1093.74s |  So this is something really important, especially when we want to phase, for example, by passing
1093.74s - 1094.94s |  a WAF or something like that.
1094.94s - 1097.06s |  We want to know what characters are being filtered.
1097.06s - 1101.82s |  So this is something that the agent is realizing by itself, and it's really interesting.
1101.82s - 1104.54s |  Then here is something that is really important.
1104.54s - 1109.54s |  It fails while trying to craft a request within a space.
1109.54s - 1112.44s |  So it realizes that the current request is bad form.
1112.44s - 1117.10s |  So then changes, tries to encode the payload, and tries again, which is something that maybe
1117.10s - 1121.50s |  we can see when we are trying to do a bounty.
1121.50s - 1124.58s |  And then let's go a bit down.
1124.94s - 1129.46s |  Here you can see that after trying a couple of payloads, it realizes that it's not able
1129.46s - 1133.30s |  to find a good solution, so it tries to change from context.
1133.30s - 1137.78s |  At this point, tries to analyze again the application, but then it sees that there is
1137.78s - 1139.50s |  nothing interesting apart from that.
1139.50s - 1144.82s |  So again, gets the initial goal to exploit the XSS, and goes again to try and exploit
1144.82s - 1146.50s |  with different payloads.
1146.50s - 1154.46s |  Again, if we go a bit down, we can see that, again, changes from the initial goal and starts
1154.46s - 1158.90s |  trying to see if it can fuzz the application, trying to do some brute force, and trying
1158.90s - 1162.90s |  to see if it can find any additional endpoint that might be vulnerable.
1162.90s - 1169.18s |  Again, it says, okay, this is not the way to go, so start again with another payload.
1169.18s - 1175.02s |  And there's one point when it realizes that he's able to bypass the filters by using HTML
1175.02s - 1178.40s |  entity encoding with JavaScript string manipulation.
1178.40s - 1183.26s |  And then after a few attempts, it managed to get a payload that is working.
1183.26s - 1189.14s |  You can see all the encoded output, and if we go to the response, we can see the alert
1189.14s - 1194.06s |  and the flag of the challenge who has been retrieved.
1194.06s - 1196.22s |  So yeah, that was our first example.
1196.22s - 1198.78s |  Thank you.
1198.78s - 1208.02s |  If we go to the next one, here we have an image uploader vulnerability.
1208.02s - 1211.90s |  We know that we have some extensions that are being filtered by the application.
1211.90s - 1216.70s |  So one thing that is really interesting in this example is that Expo has to deal with
1216.74s - 1218.74s |  some CSRF token and session cookies.
1218.74s - 1223.54s |  You will see that it struggles with that because it's something that we have to do manually.
1223.54s - 1229.42s |  So after that, he managed to log in the application, then tries to upload a PHP web shell, plays
1229.42s - 1235.70s |  again with some extensions, until it finally exploited by uploading an htaccess file.
1235.70s - 1238.14s |  So let's go to the next example.
1238.14s - 1245.26s |  Let me update this one.
1245.30s - 1250.78s |  So here, in this case, you can see, again, the trace working.
1250.78s - 1255.50s |  We can see that in this description, which is a challenge from Porswiger, we have a very
1255.50s - 1256.70s |  detailed description.
1256.70s - 1261.82s |  So the first thing that says is that we have to exploit, again, an image upload function.
1261.82s - 1267.50s |  It says that in this case, the goal is to exploit and retrieve the content of the secret,
1267.50s - 1271.50s |  which is inside the server, and then also provide some credentials that you can use
1271.50s - 1272.66s |  for authenticate.
1272.66s - 1277.54s |  So the agent will take all this information, and from that point, we'll start working.
1277.54s - 1282.06s |  So if we go a bit down, you can see, again, that it starts to access the application.
1282.06s - 1287.50s |  It sees that there is some redirect, so it follows that, and then tries to use the credentials
1287.50s - 1290.94s |  to authenticate that were provided in the description.
1290.94s - 1294.46s |  At this point, it sees that it's missing a CSRF parameter.
1294.46s - 1298.82s |  So in these old comments, I'm going to scroll again.
1298.86s - 1303.98s |  It will start to understand how the CSRF token works, how it has to deal with that part,
1303.98s - 1305.82s |  which is new to him.
1305.82s - 1311.54s |  And finally, after playing around with session cookies and playing around with the CSRF token,
1311.54s - 1316.26s |  there is a point where it realizes that, okay, I'm going to do this in only one step.
1316.26s - 1321.10s |  So it creates this bash example with first access to the login page, retrieves the session
1321.10s - 1326.94s |  cookie and the CSRF token to have that updated, and then, for that point, uses that to log
1326.94s - 1329.78s |  in to the application with the provided credentials.
1329.78s - 1334.34s |  And finally, as you can see here, we access to the application, okay?
1334.34s - 1337.78s |  So we are now this user winner with this session.
1337.78s - 1341.30s |  Okay, so now the next point is trying to upload the web shell.
1341.30s - 1345.42s |  So it will try to go and create a PHP file.
1345.42s - 1346.42s |  It fails.
1346.42s - 1351.18s |  We are getting some errors here in the output, as you can see here, like PHP files are not
1351.18s - 1352.18s |  upload.
1352.18s - 1354.66s |  So that tries again with a double extension.
1354.66s - 1358.98s |  If we go and scroll a bit, we can see that eventually we'll try with another extension,
1358.98s - 1360.86s |  the phtml.
1360.86s - 1365.62s |  And then, finally, sorry, oh, yeah, sorry.
1365.62s - 1371.52s |  And after that, we see, which is really, really important and interesting, is that it tries
1371.52s - 1373.94s |  to upload an HT access.
1373.94s - 1379.66s |  In this case, what it's trying to do is it's trying to get any image file that can execute
1379.66s - 1381.82s |  PHP code.
1382.02s - 1386.22s |  I ask you here, how many times we were doing like a pen test, and maybe we forgot of doing
1386.22s - 1390.90s |  or trying these kind of things, like loading an HT access, to see if we can replace that
1390.90s - 1398.34s |  and we can execute PHP code in an image file, which at the beginning was filtered.
1398.34s - 1400.98s |  And yeah, after that, it just access to the application.
1400.98s - 1402.42s |  It tries a couple times.
1402.42s - 1407.34s |  Sorry for doing a scroll, but I don't want to waste too much time in this.
1407.34s - 1411.22s |  So eventually, let's go to the final one.
1411.22s - 1418.98s |  Yeah, here we can see that after uploading the PHP file, it can execute this command,
1418.98s - 1426.26s |  access to the secret key, and then submitting it to the submit solution, which is over here.
1426.26s - 1436.25s |  We can get the flag.
1436.25s - 1440.41s |  So something interesting about all these cases is that the AI is also being able to take
1440.45s - 1446.49s |  goals, like exfiltrating this file and submitting the secret to the endpoint to get the flag.
1446.49s - 1450.93s |  All these kind of details are things that we are not used to seeing in any tool, or
1450.93s - 1455.45s |  even if we want to test some particular functions of our web application, that's also super
1455.45s - 1458.85s |  interesting to see and is able to manage.
1458.85s - 1465.05s |  So now, the last example that we are going to see now, and then after that, we are going
1465.09s - 1471.37s |  to see some experiments that we have done, is this is a super interesting case because
1471.37s - 1474.45s |  we have provided no goal to the AI in this case.
1474.45s - 1480.57s |  We are going to see that we are going just to present a typical random text, as in any
1480.57s - 1487.25s |  CTF, that makes no sense and just confuses you, the target, and the AI will start exploring
1487.25s - 1491.29s |  the web application and trying to pursue that goal, right?
1491.29s - 1494.93s |  Because since it doesn't have a goal, it needs to find out what to do and how to hack the
1494.93s - 1498.73s |  website.
1498.73s - 1506.57s |  So let's go to the challenge, let's refresh this, and as you can see, the description
1506.57s - 1512.33s |  is saggy quack quack, try to quack me, that makes no sense, and any of us doing a CTF
1512.33s - 1518.53s |  will be confused, and we also get some information about the target.
1518.53s - 1524.01s |  Based on that, the agent understands that this is a CTF description and pursues to go
1524.01s - 1527.77s |  and start doing some recon on the web application.
1527.77s - 1534.05s |  So first of all, access to the root, then to a login website, and notice that there
1534.05s - 1539.01s |  is some JavaScript file, so decide to go and analyze the JavaScript all by itself.
1539.01s - 1544.13s |  We're going to see this behavior is repeated during the whole trace because every time
1544.13s - 1548.69s |  that it's detecting a new JavaScript, it's reading and understanding that file to improve
1548.69s - 1553.25s |  the knowledge about the application and keep digging deeper until it finds some particular
1553.25s - 1555.65s |  goal to exploit.
1555.65s - 1561.89s |  So once it learns about the login, it's going to test some test test user as we always do
1561.89s - 1564.61s |  when doing appendix to see how it behaves.
1564.61s - 1568.89s |  Of course it doesn't work, but the application understands that the login is working.
1568.89s - 1575.17s |  So after that, try some basic payloads for SQL injection, doesn't work either, we get
1575.17s - 1581.25s |  the same message, and now we craft just a quick Python script to do some default credentials
1581.25s - 1586.01s |  for the admin user, just trying some few well-known passwords to see if anything of
1586.01s - 1589.69s |  that is a low-hanging fruit that can get quickly.
1589.69s - 1594.29s |  None of them work, of course, so it decides to move on and try NoSQL injection against
1594.29s - 1603.05s |  the login, doesn't have lag anymore, so decides to just try some JSON parameter injection
1603.05s - 1607.85s |  to see if also can get some unexpected behavior on the application.
1607.89s - 1612.89s |  It didn't work either, so now it decides to go to the initial recon and say, okay, let's
1612.89s - 1619.69s |  see what other endpoints we have, and it realized that there was one endpoint called post create.
1619.69s - 1624.17s |  When it tried to access this endpoint, it realized it requires authentication, and in
1624.17s - 1628.69s |  this application, the main feature is that users can create posts, like in any social
1628.69s - 1635.25s |  media, so it decides to go and go to the endpoint for register an account, again, as we have
1635.25s - 1640.49s |  seen in other examples, it's going to access the endpoint, read the JavaScript file, understand
1640.49s - 1646.85s |  how the form works to register a user, and it's going to try to register a test user.
1646.85s - 1652.45s |  This works, and the user is registered, so now we move on to, again, use those credentials
1652.45s - 1659.09s |  and keep getting more access to the application and perform some authenticated tests.
1659.09s - 1662.97s |  If we scroll a little bit down, we're going to see now that it tries to access again to
1663.01s - 1668.37s |  this endpoint, providing the cookies, and this endpoint works, retrieves the JavaScript
1668.37s - 1675.41s |  file, gets more information about the application, and now decides just to do a simple post,
1675.41s - 1680.01s |  like we always do, like we're testing the website, we want to learn how the application
1680.01s - 1686.61s |  behaves, so this works, it creates a post, so now it knows, based on everything that
1686.61s - 1690.77s |  has been from the HTML and JavaScript files, that all the posts can be accessed on this
1690.77s - 1700.13s |  endpoint for the test user, so when it accesses, we can see here the post being printed, but
1700.13s - 1704.13s |  also, if we pay attention, we're going to see that there is a report to admin feature
1704.13s - 1709.85s |  that is a little bottom here, and this is super interesting, because now the AI is realizing
1709.85s - 1714.81s |  that there is a report to admin feature, and it has found a potential attack vector.
1714.81s - 1719.21s |  At this point, we didn't have any goal, but now the AI understands that there is an admin
1719.25s - 1723.57s |  user that could potentially be reviewing the reports, so it decides to go ahead and try
1723.57s - 1728.57s |  some exploits on payloads to see if it can force any type of interaction.
1728.57s - 1733.21s |  Remember that this is a CTF, so it's expecting to have something to leak or to exploit in
1733.21s - 1735.93s |  order to retrieve the flag.
1735.93s - 1740.65s |  So once it learns how it works based on the JavaScript, it's going to just do a report
1740.65s - 1747.53s |  of this case, to see if it works, it worked, so now it decides to start collecting more
1747.57s - 1752.37s |  information for one of the final payloads, and creates a super interesting script, because
1752.37s - 1754.01s |  in this case, it's taking care of everything.
1754.01s - 1758.93s |  It's creating a new user, it's reusing those credentials to log in in the application,
1758.93s - 1765.01s |  then grabbing the cookie, setting a payload for a client-side exploit to try to send some
1765.01s - 1769.85s |  fetch request to our collaboration server, another interesting case of this, understand
1769.85s - 1773.57s |  what the collaboration server is and how to use it, how to interact with it, and use the
1773.57s - 1778.17s |  payloads, and then we'll create just the post, trigger the report, and then wait for
1778.17s - 1779.53s |  some interactions.
1779.53s - 1783.93s |  Of course, it's five seconds because it's a CTF, we expect some kind of quick interaction
1783.93s - 1784.93s |  in this case.
1784.93s - 1791.25s |  Again, it tries a different payload to see if it can trigger any interaction, the, something
1791.25s - 1794.29s |  interesting here is that it's not creating the user anymore, because they understand
1794.29s - 1797.93s |  that they already have this, so it removes that part from the script, and keep improving
1797.93s - 1800.41s |  it to make better results.
1800.41s - 1805.89s |  Doesn't work either, so it goes on, try one more time, with a different payload, and again,
1805.89s - 1811.77s |  sending the DOM of the application for the admin user, it sends it, and after that, it
1811.77s - 1817.29s |  gets that interaction on the interactive server that we have, and it's super interesting to
1817.29s - 1821.73s |  see that it understands that this is an interaction for an admin that has access to the website
1821.73s - 1826.53s |  and is able to retrieve the whole DOM of the application, and if we try to search for the
1826.53s - 1834.65s |  flag, oops, well, like the flag, we are going to see that all this here is URL encoded,
1834.65s - 1838.17s |  but this is the flag that has exfiltrated from the DOM of the admin user.
1838.17s - 1841.97s |  With that, the AI understands that the challenge has successfully finished, and has everything
1841.97s - 1853.00s |  it needs to complete the challenge.
1853.00s - 1858.64s |  So too many examples, and too many scrolling, so now let's jump to something different,
1858.64s - 1864.86s |  a different experiment we did, and it's to know if can AI be compared to human pen testers.
1864.86s - 1869.38s |  So for this, we did an experiment that you may have seen in the internet, that we published
1869.38s - 1878.86s |  some of the results, and here on the screen, you are going to see both terminals, one screenshot
1878.86s - 1882.58s |  is the pen tester working, and the other one is the AI working at the same time, trying
1882.58s - 1884.98s |  to solve the same challenge.
1884.98s - 1887.82s |  Something interesting about this case is that you're going to see images, because now we
1887.82s - 1893.90s |  have built in a new browser for the AI, so it can understand buttons, everything, and
1893.90s - 1898.30s |  more JavaScript application-based, so it improves the results a lot on the client-side
1898.30s - 1899.30s |  applications.
1899.30s - 1904.38s |  And if you keep tracking the numbers, you are going to see that after the AI finished
1904.38s - 1910.50s |  in four minutes, the pen tester is still struggling, like, 20 minutes more to exploit this vulnerability
1910.50s - 1912.26s |  and this challenge.
1912.26s - 1916.58s |  So for this, we hired five pen testers from different companies, going from junior to
1916.58s - 1918.84s |  principal.
1918.84s - 1923.70s |  We gave them 40 hours to solve all of the validation cases that they were able to solve
1923.70s - 1926.18s |  from our validation set.
1926.18s - 1933.70s |  They could use any tools, no exceptions, they could do whatever they want, just a real CTF.
1933.70s - 1938.02s |  The thing is that, well, I'm just going to let it continue just a few seconds so you
1938.02s - 1942.50s |  can see how the AI has finished, and the pen tester is still working on the challenge up
1942.50s - 1947.46s |  to 19 minutes, approximately.
1947.46s - 1953.42s |  So the results from this experiment were quite interesting, and let us understand much more
1953.62s - 1957.66s |  how these things work and how they can be applied to our field.
1957.66s - 1965.06s |  So on this chart, you can see how Expo obtained the same results as the principal, both solving
1965.06s - 1970.90s |  the 85% of this challenge from the validation set.
1970.90s - 1977.22s |  And on the other chart, you can see their resolutions, percentage made by difficulty.
1977.22s - 1982.34s |  And if you pay attention to the easy and medium, you are going to see that the AI excels the
1982.38s - 1984.66s |  human pen tester and perform better results.
1984.86s - 1989.66s |  However, as Diego mentioned before, for the hard challenges, the AI is struggling a little
1989.66s - 1994.58s |  bit more, and those cases that require more creativity, alternative thinking, or more
1994.58s - 1998.58s |  careful process, the human excels in those cases.
1999.02s - 2004.82s |  So this gives us a huge hint about how this can be applied to our field, where we can
2004.82s - 2009.90s |  imagine a place where the AI is taking care of all those things that are less interesting
2009.90s - 2015.26s |  for us and leaving the human experts the work of working on the more exciting parts
2015.26s - 2017.46s |  of or more challenging parts of the application.
2021.80s - 2026.24s |  OK, and now we go to our last question for today.
2026.56s - 2030.20s |  So can AI actually be our second brain or assistant?
2030.68s - 2037.24s |  So we know that AI has been very useful in multiple contexts, but we haven't seen before
2037.64s - 2043.52s |  how we can use the AI to assist a pen tester or a backhunter, in this case, for the people
2043.52s - 2044.84s |  that are interesting here.
2045.24s - 2050.60s |  So for this meaning, we use something called human in the loop, we have been talking about
2050.96s - 2057.04s |  before. So here we have a prototype in what we wanted to do is basically analyze how we
2057.04s - 2062.92s |  can use AI to perform better the work of the human.
2063.36s - 2069.40s |  OK, so yeah, here is a small video, which just let it run.
2070.00s - 2074.40s |  But basically what we wanted to create was a prototype that basically will provide some
2074.40s - 2081.96s |  goals. Apart from that goal, what we can do is provide some feedback to the AI so we can
2081.96s - 2083.88s |  change the workflow and how it works.
2084.04s - 2088.64s |  So, for example, if we are analyzing how the AI is performing and what kind of software is
2088.64s - 2093.76s |  trying to do, we can go in the middle and we can try and change that workflow.
2093.80s - 2097.36s |  So, for example, if we see that it's trying to execute a command that it's fed, we can
2097.36s - 2100.64s |  modify that and let the AI interact and continue with that.
2100.92s - 2105.72s |  Also, if we see that, for example, it's trying to exploit an SQL injection and we see that
2105.72s - 2110.56s |  it's missing some payloads or it's missing some entry points, we can also provide that as
2110.56s - 2116.28s |  part of the learnings and we can say to the AI that he has to be and follow that right
2116.32s - 2118.84s |  path. So this is just a prototype, an example.
2118.84s - 2122.64s |  This is not something that we are pretending to sell or everything like that.
2122.88s - 2127.68s |  We just wanted to see how we can interact with the human in the loop.
2129.72s - 2131.00s |  So let's skip this one.
2132.04s - 2138.24s |  OK, and now to sum up, we're going to be reviewing again the three questions that we
2138.24s - 2140.12s |  have been talking about before.
2140.44s - 2144.92s |  So for the first question of all, if we can mimic human back hunters.
2145.20s - 2150.80s |  OK, we have seen that the AI is surprisingly good for some examples, especially the easy
2150.80s - 2151.76s |  ones and the medium ones.
2152.08s - 2156.20s |  But depending on the difficulty, we have to improve the performance.
2156.76s - 2162.68s |  Then talking about if we can compare human pen testers to AI, as Joel was talking
2162.68s - 2167.52s |  before, expert human excel such creativity and are really, really good at hard
2167.52s - 2172.08s |  challenges. But yeah, the AI is faster and better.
2172.12s - 2177.12s |  We saw in the example that we provided like five pen testers, we gave them like 40
2177.12s - 2181.12s |  hours and the AI was able to solve all of them in just 30 minutes.
2182.08s - 2187.60s |  And if we talk about if the AI can be our second brain or assistant, this is something
2187.60s - 2189.80s |  that we need to try together.
2190.08s - 2194.08s |  So we will be sharing some stuff in our websites in a couple of weeks.
2194.36s - 2199.28s |  So just we can go there to expo.com, you can join the waitlist and we will be sharing
2199.28s - 2202.00s |  everything over there and also in our social media.
2202.00s - 2203.72s |  So let's keep an eye on that.
2205.28s - 2208.96s |  And finally, we don't want to forget about the team, this is not something that we have
2208.96s - 2212.16s |  done ourselves, this is an effort of all the expo team.
2212.56s - 2216.96s |  So a big shout out to all of them because we have been working hard these three last
2216.96s - 2221.04s |  months. And yeah, this is something that we have done all together.
2222.48s - 2225.40s |  And yeah, that's the end of the talk.
2225.48s - 2229.76s |  Again, thank you to DEFCON and the Backcountry Village for giving us the opportunity.
2233.50s - 2235.90s |  And we have some questions if you want.
2239.30s - 2242.42s |  Yes, I'm not sure, I'm not sure if we have a mic.
2242.42s - 2258.04s |  So just so so far, everything has been done under control and environment control
2258.04s - 2262.24s |  environment. We are not yet using this to do bug bounties.
2262.24s - 2267.28s |  We are trying to test this to be used to test how to understand how this could be used
2267.28s - 2269.92s |  in a bug bounty field and in the security field.
2270.20s - 2273.88s |  So so far, there is not a monetary search for this now.
2274.16s - 2276.44s |  It's just this what we have shown.
2278.36s - 2288.96s |  Yes. Sorry, could you repeat that?
2299.29s - 2303.05s |  Yeah, yeah, we have tried probably those are into, if I remember correctly, into
2303.05s - 2305.21s |  misconfigurations category.
2305.65s - 2308.53s |  But we have tried the headers, manipulation and information.
2309.17s - 2310.73s |  We have a few challenges of those.
2310.89s - 2314.17s |  I can maybe look for the results after the talk, if you want.
2315.17s - 2336.63s |  Yes. So for for the first question, it's depending on how you set the goal, it's very
2336.63s - 2339.83s |  persistent. For example, we saw the cross-site scripting that was trying, keeping
2339.83s - 2344.75s |  trying, then doing something that we also do kind of human thing is like going and
2344.75s - 2348.87s |  looking around to see if can find another hints or something to get into the
2348.87s - 2354.11s |  feedback, but then goes back to the goal is very persistent into that in terms of
2354.11s - 2357.51s |  technical details. It's like you can set the amount of iterations that you want to
2357.51s - 2361.07s |  spend so you don't have like an infinite loop of things trying out.
2361.67s - 2363.99s |  And the second question was to protect.
2364.15s - 2367.15s |  So now is everything run in an isolated environment and protected.
2367.15s - 2372.47s |  So we are working on improving that in order to be conscious about what it's doing
2372.47s - 2375.91s |  and running. And that's that's also taking into account all the sales force that it
2375.91s - 2377.43s |  has to do while testing application.
2378.39s - 2381.67s |  So one more, there we go, we're quicker.
2385.24s - 2409.52s |  Thank you. Yeah, the thing is that if you're going to play CTF, when you go into hard
2409.52s - 2413.20s |  challenges, it's like you have to maybe change too many things together.
2413.44s - 2418.20s |  You have to. So probably the AI is being able to detect the first two vectors, but
2418.20s - 2423.04s |  then it doesn't go farther and detects the final one that is giving you the flag.
2423.24s - 2428.12s |  So that for us is a known solution, even though it found valid endpoints and it
2428.12s - 2429.76s |  started exploiting vulnerabilities.
2429.96s - 2433.24s |  If it doesn't get the flag, it's a no, no, no resolution for us.
2433.44s - 2439.32s |  So probably the creativity and the effort I can put in human and into going to so
2439.32s - 2442.16s |  deep, that's what makes the difference for now, at least.
2442.20s - 2443.76s |  Yeah. Yeah.
2444.56s - 2446.40s |  So I think we have no more time for questions.
2447.68s - 2448.84s |  OK, thank you, everyone.


url: https://www.youtube.com/watch?v=s_w7fxESt-o
title: DEF CON 32 - ICS 101 - Bryson Bort, Tom VanNorman
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=s_w7fxESt-o",
  "title": "DEF CON 32 - ICS 101 - Bryson Bort, Tom VanNorman",
  "description": "Introduction to industrial control systems:\n\nWhat is ICS\nPurdue model\nHow ICS is architected\nAttacker view of ICS architecture\nHow to build your own ICS lab\nEquipment\nHow to learn / conduct vulnerability research",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 837,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.88s | This text was transcribed using whisper model: large-v2

 I'm Grayson Bort, I'm the founder of Scythe,
2.88s - 6.56s |  the founder of Grimm, and the co-founder of the ICS Village.
6.56s - 9.36s |  I'm Tommy Norman, co-founder of ICS Village
9.36s - 11.64s |  and a senior VP at Grimm.
11.64s - 15.58s |  So we run a village down there on industrial control systems
15.58s - 17.60s |  so if you wanna get some hands-on experience,
17.60s - 20.20s |  which we're gonna just quickly kinda give a high level on,
20.20s - 23.12s |  please come on down, we can fuck up shit together.
23.12s - 25.30s |  And the best part about it, since it's not production,
25.30s - 27.96s |  we all know what it's like to not test in Prague, right?
27.96s - 31.42s |  You can poison a fake water supply.
32.56s - 33.40s |  Okay.
33.40s - 35.04s |  Oh, mics?
35.04s - 36.24s |  Do I need a mic?
36.24s - 38.36s |  Or is it for recording?
38.36s - 39.20s |  Yes.
40.64s - 41.64s |  It's fine.
43.60s - 46.28s |  All right, so let's talk industrial control systems.
46.28s - 48.68s |  Who knows what an industrial control system is?
49.66s - 60.86s |  What's an industrial control system?
60.86s - 65.45s |  Imagine that, what a good nerd answer.
65.45s - 67.55s |  Any computer that's at least 20 years old.
69.65s - 73.61s |  Also correct.
73.61s - 76.85s |  No, but so why is that important to understand, right?
76.85s - 79.21s |  Most of us, it's easy to learn
79.21s - 80.37s |  about information technology.
80.37s - 82.45s |  This is part of why we wanted to put this talk together
82.45s - 85.65s |  is because getting into industrial control systems
85.65s - 87.85s |  isn't just something you can walk down to Best Buy
87.85s - 92.85s |  and ask for a HMI or a DCS or any of those things.
94.05s - 94.93s |  You're not gonna be able to do it.
94.93s - 97.85s |  Now, strangely, you can buy them all on eBay.
97.85s - 99.21s |  We're gonna get to that, right?
99.21s - 102.83s |  So it's more of this like obfuscated, obtuse discipline
102.83s - 106.17s |  that it's like, I'm interested, but how do I get to it?
106.17s - 107.41s |  And so that's why, yeah, exactly.
107.41s - 109.01s |  That's why we're talking about it today.
109.01s - 111.35s |  So that joke, when we go back to industrial control systems
111.35s - 112.77s |  already sets the condition,
112.77s - 115.77s |  how it's so different than information technology, right?
115.77s - 118.77s |  You're trained to buy a phone every two years.
118.77s - 121.33s |  Your laptop has a problem, you patch it,
121.33s - 122.69s |  you buy a new one, right?
122.69s - 124.13s |  It's not expensive, it's easy to do.
124.13s - 125.69s |  You're used to doing that.
125.69s - 127.13s |  In the industrial control system environment,
127.45s - 129.65s |  these things are not built on confidentiality,
129.65s - 130.93s |  integrity, and availability,
130.93s - 134.01s |  which are the security principles you've been taught in IT.
134.01s - 137.15s |  It's built on resilience and availability.
138.69s - 141.09s |  Because what happens when water's not available?
142.31s - 144.57s |  You wanna give a nerd answer to that?
144.57s - 145.41s |  Bad shit.
146.57s - 148.69s |  Bad shit happens, right?
148.69s - 150.79s |  So this is a completely different world
150.79s - 152.29s |  with a completely different impact.
152.29s - 153.73s |  Here's the good news.
153.73s - 155.47s |  It's not as hard as it sounds.
156.47s - 158.83s |  So we're gonna talk through some of those pieces
158.83s - 160.59s |  and we're gonna explain, kind of give you an idea
160.59s - 164.43s |  of how the architecture works, how threats work.
164.43s - 166.59s |  And then we're gonna talk through some specific examples
166.59s - 168.67s |  of how you can start to build your own lab
168.67s - 170.27s |  and learn some of those things.
170.27s - 171.63s |  And you wanna try?
171.63s - 174.27s |  So the one thing that I always talk about
174.27s - 175.67s |  with industrial control systems,
175.67s - 179.03s |  why or how are they different than IT,
179.03s - 181.35s |  other than being really old?
181.35s - 182.47s |  Health, life, and safety.
182.47s - 183.55s |  Those are the three things, right?
183.67s - 186.19s |  Your email goes out, what happens?
186.19s - 187.87s |  You have a quiet day, right?
187.87s - 190.91s |  Your website goes down, you lose money, it's a bad day.
190.91s - 193.77s |  Amazon, Delta we saw, bad day.
195.25s - 198.07s |  Those controllers go down and your grid turns off
198.07s - 200.37s |  or your water plant turns off.
200.37s - 202.35s |  That's health, life, and safety.
202.35s - 205.91s |  So those are the three things that I always go back to
205.91s - 207.71s |  when we talk about control systems.
207.71s - 209.53s |  IT, you can turn that stuff off.
209.53s - 211.51s |  You'll have a bad day, you'll have a quiet day.
211.51s - 212.43s |  You're not gonna kill people.
212.43s - 213.59s |  You're not gonna pollute the environment.
213.59s - 217.59s |  You're not gonna destroy things and hurt people.
217.59s - 218.75s |  Way to bring us down, man.
218.75s - 220.27s |  I know, how about it?
220.27s - 222.27s |  You made me run all the way downstairs up to here
222.27s - 223.27s |  and we were lost.
224.39s - 225.79s |  We were lost for five minutes.
225.79s - 228.83s |  We could not figure out where this place was.
228.83s - 230.03s |  So here's the good news.
230.03s - 231.43s |  This is why it's easier.
231.43s - 232.95s |  Besides the fact that everything is older
232.95s - 234.27s |  and actually much simpler.
235.51s - 238.52s |  Forgot my point.
240.16s - 242.96s |  Been here seven days and blackout was really long, okay?
243.84s - 246.88s |  Is there's a physical effect, right?
246.88s - 249.12s |  Hey, I pop shell, I have an interpreter session.
249.12s - 251.40s |  Okay, hey, data got lost.
251.40s - 252.24s |  What does that mean?
252.24s - 253.84s |  How do I feel that?
253.84s - 255.08s |  With industrial control systems,
255.08s - 257.92s |  there is a physical change in the world, right?
257.92s - 261.48s |  The lights go off, the light bulb goes on, right?
261.48s - 264.44s |  We're not popping calc.exe in a Windows box.
264.44s - 266.68s |  You're actually seeing something change.
266.68s - 269.12s |  So there's a lot more of that physical feedback loop
269.12s - 269.96s |  on the learning.
269.96s - 270.80s |  So how is it set up?
270.80s - 272.40s |  Who's heard of the Purdue model?
273.28s - 274.32s |  We've got some hands, all right.
274.32s - 275.24s |  We've got ringers.
276.96s - 278.16s |  What's the Purdue model?
280.52s - 281.56s |  There are no experts.
293.52s - 295.20s |  Data segmentation, data flow.
299.68s - 302.56s |  So I meant the words that are the correct answer.
303.52s - 304.36s |  No, you got it.
304.36s - 306.64s |  So it is a nominal enterprise architecture
306.64s - 308.32s |  and it breaks down five levels.
308.32s - 310.20s |  The first you all know, IT.
310.20s - 311.84s |  And IT is just one box.
311.84s - 313.64s |  And then there is always,
313.64s - 316.04s |  I want you to all repeat with me, an air gap.
317.40s - 319.44s |  It's not an air gap.
319.44s - 320.52s |  Is not an air gap.
321.64s - 324.32s |  Your IT will always talk to your OT.
324.32s - 325.72s |  And there's a lot of reasons for that.
325.72s - 327.48s |  I've always had, I always love it when there's some nerd
327.48s - 328.60s |  who's like, well, actually,
328.60s - 330.84s |  have you ever like been in a nuclear power plant?
330.84s - 332.48s |  I'm like, yep, that air gap is never pure.
333.48s - 334.96s |  There's a reason, okay.
334.96s - 336.64s |  So let's just understand that.
336.64s - 339.44s |  Next level up is your DMZ.
339.44s - 341.48s |  So you need shared service functions
341.48s - 344.32s |  because there's still some level of IT functionality.
344.32s - 345.72s |  There's centralized management
345.72s - 347.64s |  that we need to be running these things.
347.64s - 349.92s |  So that's your high level industrial control systems.
349.92s - 352.28s |  Then we start breaking down into what are called,
352.28s - 353.88s |  specific control zones.
353.88s - 356.12s |  And so that's basically two, one, zero.
356.12s - 357.80s |  And that's where we have this combination
357.80s - 359.80s |  of engineering workstations,
359.80s - 361.44s |  programmable logic controllers,
361.88s - 365.16s |  the things that are actually making a process do a thing.
365.16s - 366.84s |  Again, going back to my original point,
366.84s - 368.84s |  that process has an output.
368.84s - 370.52s |  That's the cool part about this.
370.52s - 373.68s |  Those subsystems are outputting something.
373.68s - 375.76s |  And so the purpose of the Purdue model
375.76s - 377.68s |  is understanding that segmentation
377.68s - 379.28s |  and then learning how to design
379.28s - 381.56s |  what are called control zones and conduits.
381.56s - 382.96s |  How do I create segmentation
382.96s - 385.92s |  so that if there's an issue on this output over here
385.92s - 387.80s |  that is spitting out this widget,
387.80s - 389.72s |  it doesn't impact something over here.
390.52s - 392.16s |  And then the conduits are my way
392.16s - 394.04s |  of driving still the information,
394.04s - 396.12s |  the data flow that I need to have between them.
396.12s - 397.88s |  Now, here's the problem.
397.88s - 400.12s |  I just said five levels of something.
400.12s - 404.29s |  Doesn't that just feel like defense in depth?
404.29s - 405.57s |  Yes.
405.57s - 406.41s |  Yes.
408.13s - 410.41s |  You were shaking no, because you knew where I was going.
410.41s - 412.17s |  The correct answer is in fact, yes.
412.17s - 414.85s |  There are no trick questions, just dumb answers.
417.57s - 420.82s |  Glad you all get my sense of humor.
421.14s - 423.18s |  So the point is that all collapses
423.18s - 425.94s |  into what we really see from the threat perspective.
425.94s - 427.78s |  So there's basically two ways.
427.78s - 429.38s |  Well, there's actually five ways in,
429.38s - 431.74s |  but we're gonna simplify it to the two common.
431.74s - 433.30s |  The one which you probably hear the most
433.30s - 435.42s |  and gets the most press play is,
435.42s - 437.90s |  oh my gosh, my operational technology devices
437.90s - 439.58s |  are directly connected to the internet.
439.58s - 441.62s |  Look at what Shodan or Census turned up.
444.14s - 445.78s |  Yeah, it happens,
445.78s - 448.26s |  but it's not the most common access vector.
448.26s - 450.50s |  The most common access vector is what you see
451.18s - 453.58s |  in most of your daily enterprise IT lives,
453.58s - 457.42s |  because IT is the big squishy thing on the internet.
457.42s - 459.26s |  That's its entire purpose.
459.26s - 461.26s |  And I'm not gonna guess you're all model employees.
461.26s - 463.26s |  So you're not just surfing the web
463.26s - 468.34s |  instead of doing your jobs.
468.34s - 469.18s |  Take the credit.
469.18s - 472.14s |  That's about the nicest thing I'm gonna say to you all day.
472.14s - 474.30s |  We can go back to Dr. Doom here if you want.
477.66s - 480.22s |  So all of those tactics that you see in IT
480.22s - 482.42s |  are the same ones that we have to worry about.
482.46s - 484.50s |  They come in, they pivot, they move,
484.50s - 486.34s |  and again, because an air gap is not an air gap
486.34s - 488.86s |  is not an air gap, I cross over.
488.86s - 491.46s |  Now, we still have three to four levels,
491.46s - 493.62s |  actually four levels on that side,
493.62s - 495.22s |  but here's where they all collapse.
495.22s - 498.30s |  So you're all aware of the gloom and doom cyber weapons.
498.30s - 499.94s |  We know about Indestroyer, Indestroyer 2,
499.94s - 502.42s |  we've seen the Russian military using in Ukraine.
502.42s - 505.02s |  That's not the thing we have to worry about most.
505.02s - 507.54s |  The same way that PowerShell pretty much defines
507.54s - 513.92s |  what happens in IT, same thing in OT.
513.92s - 515.00s |  It's the living off the land,
515.00s - 517.60s |  taking over those high-level industrial control systems,
517.60s - 520.24s |  they tell everything else what to do.
520.24s - 522.44s |  So now we've anchored how this works,
522.44s - 523.76s |  what we got to worry about.
523.76s - 526.24s |  Now let's talk about how we start to teach ourselves.
527.36s - 528.20s |  Labs.
528.20s - 532.44s |  So if anybody has not been in the ISS Village downstairs,
532.44s - 534.28s |  back in the corner, please stop by.
534.28s - 537.48s |  We'll show you what we have, our hands on demos.
537.48s - 538.80s |  Yes, we know where that is.
538.80s - 540.72s |  And it's far, but not that far.
541.64s - 543.44s |  It's not in another building, right?
543.44s - 546.24s |  So how do we build these systems?
546.24s - 548.88s |  How do we build in an environment where we can train?
548.88s - 551.52s |  We can see if our patches work.
551.52s - 552.64s |  That's a really important one.
552.64s - 554.32s |  Never patch production, right?
556.12s - 557.88s |  Live anyway, you want to patch production,
557.88s - 560.32s |  but you want to test those patches before you push it out
560.32s - 562.68s |  or things happen.
562.68s - 563.64s |  How do we do that?
563.64s - 567.88s |  Well, with ICS Village and my day job and all that,
567.88s - 569.16s |  we build these systems out.
569.16s - 571.36s |  So what we've been doing,
572.28s - 574.08s |  we don't use virtualized systems,
574.08s - 578.16s |  but we'll use virtualized systems when it should be used,
578.16s - 579.92s |  such as HMIs and things like that, right?
579.92s - 580.76s |  They're all virtualized.
580.76s - 583.00s |  They're just window assets.
583.00s - 586.20s |  When we get down to controllers,
587.16s - 589.08s |  we're using the real ones, right?
589.08s - 590.24s |  We're not using Raspberry Pi.
590.24s - 592.24s |  Sure, you can use OpenPLC, you can do all these other ones.
592.24s - 594.40s |  But the reason why we're not doing that downstairs
594.40s - 598.48s |  in ICS Village is they just don't work the same.
598.48s - 601.36s |  So when you go out and you want to learn
601.36s - 602.28s |  how these systems work,
602.28s - 603.88s |  whether you're interested in the control system
603.88s - 604.72s |  to get a job in it,
604.72s - 608.32s |  or you're a working practitioner or professional now in it,
608.32s - 609.56s |  how do you do this?
610.52s - 611.56s |  We source stuff from eBay.
611.56s - 613.04s |  We source stuff from our vendors.
613.04s - 615.92s |  We get stuff donated to us, but-
615.92s - 617.24s |  How can I buy something from eBay?
617.24s - 619.04s |  How would I make that work for home?
621.08s - 624.32s |  So I wouldn't recommend that, actually.
627.28s - 629.04s |  The problem is that we run into,
629.04s - 630.48s |  you buy that thing from eBay.
630.48s - 631.64s |  Well, great, now you need a license.
631.64s - 632.48s |  Now you need a key.
632.48s - 633.32s |  Now you need that thing.
633.32s - 634.16s |  You need that thing.
634.16s - 635.08s |  You need that cable, all that stuff.
635.08s - 636.60s |  That stuff's not trivial.
636.60s - 639.00s |  Once you're using it, yes, now you understand.
639.00s - 641.96s |  But for somebody to take that thing from,
641.96s - 643.44s |  you know, that Allen Bradley controller
643.44s - 646.84s |  from eBay that you bought for 150 bucks,
646.84s - 647.96s |  well, where's the cable?
647.96s - 648.84s |  Where's the license?
648.84s - 649.68s |  Where's that?
649.68s - 651.64s |  So that gets quite difficult.
651.64s - 653.40s |  Come volunteer for ICS Village.
653.40s - 655.60s |  We'll show you how to do that stuff.
655.60s - 658.48s |  We can get you connected with different universities,
658.80s - 661.36s |  colleges, learning institutions.
661.36s - 663.00s |  I'll show you how to do that.
664.24s - 667.56s |  One of the things that we're constantly saying
667.56s - 668.96s |  to people when they come up, they're saying,
668.96s - 671.00s |  hey, where do I start?
671.00s - 671.92s |  What do I do?
673.52s - 675.04s |  We're looking at authentication.
675.04s - 676.72s |  We're looking at segmentation.
676.72s - 679.36s |  We're looking at knowing what's on your network.
679.36s - 681.52s |  Well, what does that even mean?
681.52s - 683.80s |  So, you know, whether you're gonna walk down
683.80s - 686.56s |  your plant floor, whether you're gonna take PCAPs,
686.56s - 687.48s |  whether you're gonna do something,
687.48s - 688.36s |  know what's on your network.
689.24s - 691.20s |  Your asset detection, authentication.
691.20s - 693.40s |  Don't leave everything admin, admin.
693.40s - 696.40s |  However, that's a legitimate thing now.
696.40s - 699.32s |  You go into that, you know, nuclear plant
699.32s - 701.12s |  like Price just talked about here.
701.12s - 702.44s |  Well, you have guard gates and guns
702.44s - 703.80s |  and you're seven layers down.
703.80s - 704.92s |  Does it really matter at that point
704.92s - 706.60s |  if your sticky note has that?
707.56s - 709.12s |  I don't think it does.
709.12s - 712.68s |  Because if your adversary's in there that far anyway,
712.68s - 714.16s |  you're done.
715.08s - 717.84s |  But what you need is to be able to get into that HMI
717.84s - 719.24s |  or get into that thing really quick
719.24s - 721.12s |  to turn that thing off or on or whatever.
721.12s - 723.28s |  So it's a balance, right?
723.28s - 725.32s |  If you have a gateway device,
725.32s - 727.72s |  no, don't use admin, admin, that's really bad.
727.72s - 729.68s |  Complicated passwords.
729.68s - 731.52s |  And then segmentation.
731.52s - 734.80s |  Now, those are the three things that we come back
734.80s - 736.40s |  and say, hey, you do those three things,
736.40s - 738.52s |  you're going to make your life
738.52s - 741.56s |  or your network so much more secure.
741.56s - 742.88s |  Do we have a lot of other things off that?
742.88s - 744.20s |  Yes, but those are the three things
744.20s - 745.36s |  that we keep on going back.
745.36s - 747.12s |  So how does that tie in with labs?
747.16s - 748.28s |  Well, how do you patch something?
748.28s - 749.52s |  How do you go and change that password?
749.52s - 752.16s |  How do you update that X509 server
752.16s - 753.76s |  or whatever cert you have?
753.76s - 755.00s |  That's not trivial.
755.00s - 758.40s |  If you're doing it, okay, that works.
758.40s - 760.40s |  But now, come back three years later
760.40s - 761.36s |  and learn how those certs work
761.36s - 762.64s |  and how you updated that.
762.64s - 764.92s |  Guarantee, unless you're doing that on a day-by-day,
764.92s - 766.76s |  you're not going to figure it out.
766.76s - 769.40s |  But now it's running a real production device.
769.40s - 773.08s |  So it's, I already hear they're yelling at us
773.08s - 775.08s |  to get off the stage now.
775.08s - 777.08s |  Anyway, we came late.
777.92s - 779.16s |  We have a lot of stuff to talk about.
779.16s - 781.92s |  Come downstairs, ICS Village.
781.92s - 784.00s |  We have a lot of really great volunteers down there.
784.00s - 786.20s |  Bryce and I are down there.
786.20s - 787.36s |  We'll show you what's going on.
787.36s - 788.88s |  We will do all that stuff.
788.88s - 789.92s |  He's yelling at me again.
789.92s - 791.44s |  The second time he's come in,
791.44s - 793.40s |  that guy in the red shirt,
793.40s - 795.36s |  yelling at the guys that were late.
795.36s - 796.44s |  Thank you, everyone.
796.44s - 801.04s |  Our apologies for coming up here and doing this.
801.04s - 802.96s |  Yes, yes, yes.
802.96s - 811.65s |  Ashley, yes.
811.65s - 813.45s |  So it's not what we do.
813.49s - 816.53s |  We go off of usually like SANS critical controls.
816.53s - 818.25s |  We go off of industry things
818.25s - 819.45s |  because why?
819.45s - 820.29s |  They work.
820.29s - 821.13s |  They're right.
821.13s - 830.40s |  That's what you need.
830.40s - 831.60s |  Yep, we're happy to do that.
831.60s - 832.44s |  We're done.
832.44s - 833.28s |  We're done.
833.28s - 834.12s |  Thank you.


url: https://www.youtube.com/watch?v=wSVdfOn737o
title: DEF CON 32 - GPS spoofing it's about time, not just position - Ken Munro
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=wSVdfOn737o",
  "title": "DEF CON 32  - GPS spoofing it's about time, not just position - Ken Munro",
  "description": "Talking to pilots and operators, an important aspect of GPS spoofing and jamming is being missed from the narrative in the media. We know about position spoofing, that's a given. What doesn't appear to be getting much attention is the effect of time spoofing.\n\nThe most significant of these is an incident where time was spoofed a significant period into the future. This caused all digital certificates on board an aircraft to become invalid and caused all electronic communications to fail. As GPS clocks have protection against time being rolled backwards, but not forward, the aircraft was grounded for several weeks for systems to be reflashed and the clocks to be reset,\n\nCoarse time spoofing could therefore ground entire fleets. We'll discuss this and potential mitigations. If time allows, we could touch on conventional RF navaids and their exposure to similar attacks.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1324,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 8.80s | This text was transcribed using whisper model: large-v2

 Well, good afternoon. Now, I'm here to talk about time, time particularly in aviation.
9.52s - 14.16s |  Now, we're going to be talking about GNSS, GPS, of course, which you know,
14.16s - 19.12s |  GPS is a subset of GNSS. And forgive me because I switched between the two terms
19.12s - 22.80s |  a few times during the presentation. So let's use them interchangeably for the moment.
22.80s - 29.20s |  Now, a little bit about me and the organisation I work for. We are red teamers and pen testers,
29.20s - 34.80s |  but we spend a lot of time working in aviation. During COVID, a lot of airplanes were laid up
34.80s - 39.20s |  and we got to do some vanilla research working on retired airplanes, which is great fun.
39.76s - 43.60s |  You learn a great deal very quickly about some very new and very old systems too.
44.32s - 48.96s |  Along the way, we've advised several airlines, several manufacturers. We're on very good terms
48.96s - 56.00s |  with Boeing. And we've had the great opportunity to do some vanilla research on systems such as
56.00s - 61.44s |  collision avoidance systems, instrument landing systems, and also electronic flight bags,
61.44s - 70.08s |  which I gave a talk about yesterday. Anyway, who am I? Well, I'm a really bad pilot. I have had
70.08s - 74.88s |  so many bad incidents happen to me. I've landed at the wrong airport by mistake once. That was
74.88s - 79.36s |  embarrassing. I had my engine quit on me once. Fortunately, it happened just after I took off,
79.36s - 84.48s |  the runway was long, we were fine. I've had my undercarriage hang up twice. That was a bit
84.48s - 88.88s |  awkward. And I've very nearly crashed into three other airplanes. So whatever you do, don't fly
88.88s - 93.44s |  with me. It's really bad. Navigationally, I also accidentally trolled air traffic control. I was
93.44s - 97.52s |  there when I was actually there. That caused a bit of a consternation as well. But hey,
98.64s - 104.48s |  fortunately for you, I never made it to commercial. I studied, but I never made it
104.48s - 110.08s |  to the airlines, which was a bit of a shame. So instead, back in 2002, I founded a pen testing
110.08s - 114.72s |  firm. But I do still fly in general aviation and the sort of fun things I like flying.
115.36s - 120.64s |  My favourite airplane is the Piper Cherokee 6. I love it. I also went out to Eastern Europe to
120.64s - 126.16s |  learn to fly old Russian airliners, which are great fun. I fly multi-engine airplanes too.
126.16s - 132.08s |  But probably the scariest thing I ever did was flew into Courchevel-Alteport, which is in Courchevel
132.08s - 138.08s |  in France. It was built for 1992 Olympics. And the runway is at an angle of 20 degrees.
139.12s - 144.40s |  If you come in and you get it wrong, basically you crash. You can't put the power on, go around
144.40s - 148.00s |  and try again because there's a mountain in the way. And often what happens, and if you go to
148.00s - 153.68s |  YouTube, you'll see this, is people land with a bit too much speed and come screeching across the
153.68s - 159.12s |  ramp, brakes on fire and go ploughing into the snow bank. There's quite a recent one of a Piper
159.12s - 164.56s |  Aztec that went piling in. What they don't show you in the photograph is there is a bar right on
164.56s - 169.20s |  the left there with a viewing gallery and everyone sits there and waits for the airplanes to crash.
170.32s - 175.44s |  Amazingly, in the 30-something years it's been open, only two people have been very
175.44s - 179.60s |  seriously injured in that time. But they do have lots of crazy things. Anyway,
181.20s - 186.72s |  I want to talk about what I'm not. I am not an expert in GPS. It's not my field. I'm not a
186.72s - 192.80s |  commercial pilot, fortunately for you. But what I do want to talk about is a series of incidents
192.80s - 199.04s |  that I've been told about, that have been published, some haven't, and I'm not going to give answers.
199.92s - 204.88s |  What I think I would like to stimulate from this is hopefully your interest in the space too.
205.76s - 209.92s |  Go and start asking questions. Go and start learning about GPS and go and learn about some of
209.92s - 213.60s |  the interesting issues that we've started seeing over the last couple of years.
214.16s - 220.48s |  So I spend a lot of time working in aviation. I know quite a bit about flying airplanes. I know
220.48s - 224.80s |  quite a bit of the navigation systems. I know quite a bit about the cyber security of airplanes
224.80s - 229.84s |  too and I know lots of airlines. We're on very good terms with all sorts. I also know about people
229.84s - 237.04s |  and how pilots interact, how we manage the cockpit resources and why things go wrong. I have this
237.04s - 244.72s |  very weird fascination with reading incident reports about aviation crashes. One thing I love
244.72s - 250.24s |  more than anything about the aviation industry, it is safe. And the reason it's safe is we find
250.24s - 256.08s |  out what went wrong. Then we write it up without blame and we share it. Imagine if we could do that
256.08s - 263.04s |  in the cyber security industry, hey? That is why flying is so safe. Anyway, just before we go there,
263.76s - 269.20s |  it's really, really important. If you find vulnerabilities in aviation, you disclose them
269.20s - 274.96s |  responsibly and ethically. It takes a long time to fix things in airplanes. Why? Because we need
274.96s - 280.72s |  to be safe. You can't go and drop it like it's hot in aviation. You can't do 90 days Google
280.72s - 287.92s |  Project Zero style. Code in aviation has to be certified to make sure it's safe. You can't just
287.92s - 294.08s |  push a patch to a plane. It can take a couple of years to fix a vulnerability on an airplane.
294.08s - 299.44s |  And for those of you who've seen press reports about planes being hacked from a seat backing
299.44s - 304.64s |  coach, no, it doesn't work like that. You can't. The networks are segregated. They don't do that.
304.64s - 308.96s |  And there's always someone in control up front. When everything else goes wrong,
308.96s - 313.44s |  you've got pilots up there and that's what they're paid to do. They're paid to fly safely.
313.44s - 317.44s |  So a little bit of a recap. We need to go back to basics. We're going to go back to what I like to
317.44s - 323.12s |  think of as steam powered instance. One of the very earliest types of navigational aid was
323.12s - 328.56s |  a non-directional beacon. It's simply got an indicator in your cockpit that points at the
328.56s - 333.92s |  beacon. It's as simple as that. Very straightforward. Has very long range because it follows the
333.92s - 338.88s |  curvature of the earth. Unfortunately, there are some weaknesses, one of which being if you're
338.88s - 344.64s |  navigating in instrument conditions, so in cloud and there's thunderstorms going on, it'll point at
344.64s - 348.40s |  the thunderstorm. So you fly towards the thunderstorm instead of where you were hoping to
348.40s - 355.68s |  go. Very cheap to operate. And you often find them in very remote locations. So northern Canada,
355.68s - 360.32s |  there are still quite a lot of NDBs around because they've got great range, cheap to operate, and
360.32s - 364.24s |  there's not a huge amount of aviation traffic out there at low level. You do still find them.
364.24s - 368.64s |  They'll often be the markers or locators on an instrument landing system. So as you fly in,
368.64s - 371.76s |  if you lift in the cockpit, you hear the outer marker, middle marker, inner marker.
373.89s - 382.13s |  Huge advances were made with the VOR. These came to be used in I think 1947 when they first emerged
382.13s - 387.97s |  and they were not affected by the same issues with NDBs. They didn't point at thunderstorms and make
387.97s - 392.85s |  you fly into lightning, which is great. We like that. They're probably easier to use and follow
393.57s - 398.05s |  and they're undoubtedly more accurate, but they are only line of sight. NDB follows the curvature
398.05s - 405.25s |  of the earth. VOR, line of sight. And these are typically found at the intersections of airways.
405.25s - 410.61s |  When you're flying airway to airway, a turning point will often be accompanied by a VOR on the
410.61s - 414.13s |  ground. And if you're ever looking out of the window and you feel the airplane turn,
414.13s - 418.13s |  you might want to look down and you might just see this round thing on the ground. That's a VOR.
419.17s - 425.17s |  But they are expensive. They're expensive to maintain and they don't give you altitude
425.17s - 434.93s |  information. They give you a direction, whereas GPS gives you very precise point in space and time.
436.93s - 441.97s |  So because they're quite expensive to maintain, because we've got GPS, which is a lot better,
441.97s - 448.13s |  they're starting to be retired. They're starting to disappear. We also use DME, which is
448.13s - 452.21s |  essentially a bit like a submarine ping. You send a ping, get a response, time of flight gives you
452.21s - 456.77s |  distance. And it's actually very accurate. We use DME typically on an instrument landing system
456.77s - 461.33s |  approach. At some point during that approach, we will check DME to make sure that we occur the
461.33s - 468.50s |  correct distance from the runway. ILS. You've probably seen these. You see them at the end
468.50s - 475.94s |  of the runway. Yeah, that's the localizer. They're amazing bits of equipment, incredibly precise,
475.94s - 482.10s |  given it's radio based and allows us to make an approach in what we call Cat 3C. So completely
482.10s - 488.02s |  fogged out, the airplane can still land safely with a combination of a radio altimeter. The only
488.02s - 495.86s |  minor issue with the instrument landing system is it can give false glide slopes. So typically an
495.86s - 503.54s |  ILS is aligned at a three degrees angle and you'll also have false signals at six degrees, so multiples
504.34s - 510.74s |  nine degrees, 12, etc. So as a result of that, we always used to approach the instrument landing
510.74s - 518.42s |  system by flying under it. We'd intersect the glide slope and then we'd get clearance to descend.
518.42s - 522.98s |  So we wouldn't typically approach from above because you might end up picking up one of the
522.98s - 529.38s |  false GPS approaches. But they're really expensive to maintain. They're incredibly expensive to build
529.94s - 533.86s |  and they're incredibly expensive to maintain because you have to calibrate them. And there's
533.86s - 539.38s |  this incredible process involving mirrors. So there'll be mirrors set up on the runway and
539.38s - 543.54s |  then you'll have a calibration airplane will then fly down, signing lasers off the mirrors,
543.54s - 549.70s |  make sure it's correctly calibrated. It's expensive. As a result of that, a lot of regional
549.70s - 555.62s |  airports are starting to retire their instrument landing systems. Why? Because we've got GPS. GPS
555.62s - 564.26s |  is more accurate. Fantastic. And you're starting to see LPV approaches take over where ILS was
564.26s - 571.30s |  used before. An example of that, so runway 19 right hand in Las Vegas itself is a GPS approach.
572.34s - 576.26s |  The other major runways still have instrument landing systems, but if you're approaching from
576.26s - 584.74s |  the north, you'll typically find a GPS based approach. We also use inertial reference. So
584.74s - 591.86s |  back in the day, when you were flying something like a 707, you had a navigator on board and that
591.86s - 597.06s |  navigator would have had a sextant and there was also a periscope in the roof like there is on the
597.06s - 602.74s |  B52 and they would literally do celestial sightings using a sextant and work out where they are.
603.54s - 610.10s |  Now we no longer have navigators. We don't really have that option. So inertial reference was used,
610.10s - 613.86s |  particularly where we're not flying over land, where we don't have ground based beacons.
613.86s - 619.14s |  And it means that simply relying on a very, very accurate accelerometer, the one on the right is
619.30s - 626.10s |  the inertial reference system from Concorde, gyro based, and the one on the left is the much
626.10s - 632.18s |  more recent version, which is laser based gyros. They are so accurate that on a 3000 nautical mile
632.18s - 637.94s |  flight from say London to New York, you could be as little as one nautical mile off position,
637.94s - 643.22s |  which is phenomenal advances, but actually not great if you then want to approach and land.
644.18s - 648.34s |  You need to be a bit better than one nautical mile away from the runway. That'd be a bad day.
649.62s - 655.94s |  So as we're starting to see conventional nav aids start to be retired because they're expensive and
655.94s - 661.94s |  not as accurate, we're starting to see them being removed. And particularly the VORs that are off
661.94s - 668.66s |  airway routes, they're being retired. There's also a lot of VORs are still part of the approach. So
668.66s - 673.30s |  for example, a standard approach route or a standard instrument departure will often involve
673.38s - 679.78s |  a VOR. One of my favourite, why do I have a favourite VOR? I don't know. There's a proposal
679.78s - 684.98s |  to recover Delta Tango, sorry, retired Delta Tango Yankee, which is a critical part or was
684.98s - 691.95s |  a critical part of a number of the standard approaches into London's Heathrow. 10 years ago,
691.95s - 699.63s |  we had 44 VORs in the UK, we're now down to below 19. So we're starting to rely increasingly
700.27s - 706.83s |  on GPS. Now let's look at some of the incidents that we've stumbled onto. I would strongly
706.83s - 710.11s |  recommend if you want to learn more about this, go and follow the Ops Group. Really
710.11s - 715.23s |  interesting grouping, gathering data, have real time GPS spoofing and jamming reports.
716.43s - 722.35s |  As I'm sure you've started to see, we're starting to see position errors, particularly around areas
722.35s - 728.03s |  of conflict. There's a lot going on in Eastern Europe and Ukraine, obviously. And part of that,
728.03s - 732.67s |  we believe, is there to mitigate drone-based attacks. A lot of consumer drones rather than
732.67s - 737.39s |  military drones are being used. They rely on GPS in some cases. So to mitigate an attack,
737.95s - 744.19s |  you would jam or spoof GPS. We saw a lot of jamming and spoofing going on in the Black Sea,
744.19s - 748.27s |  but that was typically for shipping. So around military installations in the Black Sea,
748.27s - 755.17s |  you'd often get a 20 nautical mile position error when you were at sea. It's increased massively
755.17s - 760.53s |  though. The last report I read had a 400% increase, which is huge. We're seeing moves
760.53s - 767.41s |  away from jamming towards position errors. Position can be incredibly interesting. Now,
768.05s - 773.09s |  for safety reasons, when we're approaching to land, we will have the ground proximity
773.09s - 778.61s |  warning system. So if we descend too low or we start flying towards hills, which would be really
778.61s - 785.97s |  bad, the GPWS will give us an alert and say, too low, pull up. But if you've got a position error,
785.97s - 791.09s |  you're flying down your ILS, the GPWS thinks you're somewhere else because it's being spoofed
791.65s - 798.21s |  and triggers. First thing you have to do is go around. So we're seeing numerous flights have to
798.21s - 802.45s |  go around and try again because they're getting position errors that are triggering the ground
802.45s - 810.05s |  proximity. We're also seeing some interesting issues around poisoning. Now, inertial reference,
810.05s - 814.21s |  I mentioned there, it's not as accurate, right? It's great, but it's not as accurate as GPS.
814.85s - 819.97s |  So therefore we would deprecate to GPS as the most accurate source of position and time on
819.97s - 827.57s |  the airplane. So the IRS will be updated by the GPS pretty frequently. So when we start to see
827.57s - 832.69s |  position errors, what we're then starting to see is inertial reference then becomes poisoned
832.69s - 838.45s |  by GPS. And when the instructions to pilots is if you are experiencing spoofing or likely to
838.45s - 843.89s |  experience spoofing, you would then switch from GPS to inertial reference so you don't see poisoning
843.89s - 854.08s |  going on. We've seen anecdotal reports pop up around airplanes not able to reacquire. You go
854.08s - 861.12s |  into an area of spoofing, you lose GPS, you then leave the area of spoofing and jamming
862.48s - 868.16s |  some distance later. Now, in order to see the satellites in the skies, you need to know where
868.16s - 872.48s |  they are. And that's your satellite almanac, which is part of a GPS system. The multimode receivers,
872.48s - 879.60s |  which will gather that data, we've seen reports where you get beyond the jamming area and the MMR
879.60s - 883.28s |  can't now reacquire the signal because the satellites aren't where it thinks they are.
884.80s - 889.68s |  There have been all sorts of reports of course position jamming causing problems around areas
889.68s - 894.64s |  of perhaps what we might call hostile airspace, places we wouldn't really want to fly into where
894.64s - 899.68s |  maybe it's a war zone or an unfriendly hostile nation. You do not want to be accidentally flying
899.68s - 905.84s |  into their airspace. That reset process, if they're no longer working, needs to be done on
905.84s - 911.52s |  the ground so the planes are no longer moving, it can reacquire correctly. Interestingly,
911.52s - 915.28s |  more modern multimode receivers don't seem to be as vulnerable. They seem to be better at
915.28s - 918.72s |  reacquiring afterwards compared to some of the older multimode receivers that are in
918.72s - 922.08s |  slightly older airplanes. Really interesting. I haven't got to the bottom of that.
923.36s - 930.64s |  Now, when we do see GPS jamming and spoofing going on, there'll often be a notice to airmen,
930.64s - 935.68s |  a NOTAM, and that tells the pilots, look, you're really likely to receive some jamming or spoofing
936.32s - 945.20s |  there. So before you go there, switch. But remember, we're retiring older base nav-aids.
945.20s - 949.76s |  We're starting to retire our instrument landing systems in favour of GPS. But now we've got
949.76s - 956.40s |  position problems. There was a really interesting incident at Tartu airport in Estonia. So Finnair
956.40s - 961.68s |  suspended their flights, they were flying ATR-72s in there I believe, and they started to experience
962.24s - 967.60s |  GPS spoofing and jamming and couldn't safely approach the airport. So they suspended flights
967.60s - 972.16s |  for a couple of months while they looked for other sources of data and they ended up settling
972.16s - 976.96s |  back on distance measuring equipment to ensure that if they were spoofed, they could correctly
976.96s - 980.96s |  approach the airport. But we started to see these issues affecting real flights.
982.72s - 986.64s |  But where I really want to move on to is the concept of time. We think too much, to my mind,
986.64s - 993.76s |  about GPS being a source of position, but it's actually a source of time. We're starting to see
993.84s - 1000.24s |  reports of the clocks on board airplanes during spoofing events start to do weird things.
1001.36s - 1005.44s |  Initially, we were starting to see very minor errors, so maybe it would jump forward a minute
1005.44s - 1010.88s |  or so, maybe even go back. And in that situation, pilots were advised, it's part of their quick
1010.88s - 1015.60s |  reference handbook, to switch back to the local clock on the airplane rather than rely on the
1015.60s - 1024.56s |  GPS one that was doing weird things. This is an incident I was party to. The GPS time did
1024.56s - 1030.32s |  something really weird. It rolled forward a very large amount, not something that's been widely
1030.32s - 1034.96s |  seen. Because it happened quickly, the pilots weren't able to switch the local time and it
1034.96s - 1039.12s |  caused a series of follow-up incidents. And you start to realise how important time is to an
1039.12s - 1047.12s |  airplane. It started to cause the digital certificates used for electronic communication
1047.12s - 1051.92s |  to become invalid. They weren't expired like we'd expect a certificate, they just weren't valid
1051.92s - 1055.68s |  because the time was too far in the future. One of the first effects, and you'll probably see this
1055.68s - 1059.60s |  as a passenger Wi-Fi might fail. Why? Because its digital certificates aren't valid anymore.
1060.24s - 1065.92s |  You then start to see issues around the controller to pilot data link communication,
1065.92s - 1072.56s |  which requires an accurate source of time. That's now not working, so you're now back to VHF.
1073.60s - 1078.08s |  Now in this particular incident, the flight landed safely. Pilots asked for radar vectors
1078.88s - 1083.36s |  and they landed fine. We expected them to land fine, that was not an issue.
1084.40s - 1088.96s |  But you see time being a really important component of other parts of the airplane
1088.96s - 1093.60s |  communications too. So TCAS, the Collision Avoidance Service, that's what stops airplanes
1093.60s - 1100.48s |  flying into each other. Great, we like that. The latest versions of TCAS allow for even
1102.32s - 1106.72s |  less spacing, so we can use airspace more efficiently, but it's still super safe
1106.72s - 1112.08s |  because we have GPS as precise sources of time. So we're starting to see TCAS causing issues.
1112.08s - 1117.84s |  Even something as simple as logging of incidents on an airplane. What do we need when we're creating
1117.84s - 1123.52s |  logs? An accurate source of time. So what is the authoritative source of time on board?
1123.52s - 1130.30s |  Well what's the most accurate source of time? GPS. What was really interesting about this incident
1130.30s - 1136.94s |  was that the time can actually be quite hard to re-establish. Now I've seen varying reports,
1136.94s - 1142.14s |  I've seen time go forward, I've heard about time going back as well. But in this particular
1142.14s - 1148.30s |  incident, there are protections in place to stop the time being rolled back. Why would time go back?
1148.46s - 1154.22s |  We wouldn't do that, would we? But actually we're not quite sure whether this is just this airplane,
1155.34s - 1159.26s |  the type of airplane, or even the manufacturer. We're not sure. There needs to be a lot more
1159.26s - 1166.94s |  work done here. But they couldn't roll the time back. There were protections in place to stop
1166.94s - 1172.70s |  the time that they'd go forward, but not back. And as a result, the airplane, most of the components
1172.70s - 1177.50s |  on it, had to be reflashed, which was a hugely expensive and time-consuming maintenance problem
1177.58s - 1184.70s |  issue. Cost directly, but most importantly, downtime on the airplane. It was down for a
1184.70s - 1189.02s |  significant period of time whilst everything was reflashed and time was brought back to normal.
1190.14s - 1196.14s |  Planes are very connected. Planes do lots of connectivity. Even something as simple as a data
1196.14s - 1203.82s |  loader requires a source of time. The SATCOMs require a source of time. Connectivity and safety
1203.82s - 1208.94s |  aboard airplanes needs the time to be right. So what do I take from this? Well,
1209.74s - 1215.90s |  it's pretty straightforward to spoof GPS. It's not that complicated. It doesn't require much
1215.90s - 1222.62s |  power. GPS is a very weak signal. A few watts will do it. It seems to be specific to some planes,
1223.58s - 1228.46s |  but I think more research is needed. And also I think as engineers become more familiar with the
1228.46s - 1234.54s |  process, I think we'll see maintenance, for instance like this, become much less disruptive,
1234.54s - 1242.62s |  which I think is great. What is the future? Well, hybrid. Using GPS, but correlating it with
1242.62s - 1247.98s |  systems on the ground that we know about. There are already sources of information on the ground.
1247.98s - 1253.50s |  We've got existing nav aids on the ground that we can cross-check with to make sure that the
1253.50s - 1259.42s |  GPS position we're receiving, the GPS time we're receiving is correct. But we need to think
1259.42s - 1265.98s |  carefully about retiring all those existing steam-powered navigation aids that are on the
1265.98s - 1270.94s |  ground. Because if we get too excited about it, we're not going to have anything to be hybrid against.
1272.62s - 1279.10s |  Scary. Let's just put aviation aside for a moment. It's not just aviation that uses GPS.
1279.58s - 1283.50s |  Financial services need a really accurate source of time for high-frequency trading.
1283.50s - 1288.14s |  A lot of industrial control systems use GPS. There are lots of other areas where GPS is used as a
1288.14s - 1293.02s |  trusted source of time. And spoofing in financial services, I'm not quite sure how that would work,
1293.82s - 1297.26s |  because you've got a stationary target rather than something up there. But it does get you
1297.26s - 1301.82s |  thinking, doesn't it? It does let you realise how important time is. Now, there's some further
1301.82s - 1307.66s |  watching. I really want you to watch one of my colleagues in the aerospace village give a talk
1307.66s - 1312.22s |  a bit later on. He's talking about the world of PKI in airplanes. Really, really interesting and
1312.22s - 1315.34s |  very relevant to what we've been talking about today. It's going to be in Crater Stage 2 at
1315.34s - 1319.10s |  half past five down the way there. But that's me. I hope you found it interesting. I'd be
1319.10s - 1322.06s |  glad to take some questions if you want to come to the front. Thank you.


url: https://www.youtube.com/watch?v=uCcyd3lTPXk
title: DEF CON 32 - MFT Malicious Fungible Tokens - Mauro Eldritch, Cybelle Oliveira
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=uCcyd3lTPXk",
  "title": "DEF CON 32 - MFT Malicious Fungible Tokens  - Mauro Eldritch, Cybelle Oliveira",
  "description": "In this technical talk, we will uncover a new aspect of NFTs: using them as attack vectors to relay C2 commands. Fingerprinting a system? Exfiltrating information? Encrypting and wiping data? Executing arbitrary commands? Of course! But with a dark twist: deployed NFTs are blockchain-backed assets immune to takedowns. Imagine having your own \u201cimmortal\u201d C2 Server for less than $10 dollars in $ETH.\n\nFor this, we will introduce \u201cmFT\u201d an open-source tool that automates the creation of malicious payloads and provide sample harmless NFTs, allowing attendees to explore this novel attack vector on their own machines safely. This talk is the spiritual successor of \"Everything is a C2 if you're brave enough\".",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1300,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.76s | This text was transcribed using whisper model: large-v2

 Welcome, everybody, to our talk, Malicious Fungible Tokens.
3.50s - 7.22s |  My name is Mauro and my partner today is Ivel, and we welcome you.
7.22s - 8.34s |  Thank you for choosing our talk.
10.02s - 11.84s |  Hey, everyone, good evening.
11.84s - 13.22s |  Hi, how are you doing?
13.22s - 15.68s |  Thanks for being here to our talk.
15.68s - 18.44s |  First, of course, English is not our first language.
18.44s - 19.90s |  We have a little bit accent.
19.90s - 24.36s |  So if you don't understand any word, please raise your hands or say
24.36s - 26.82s |  you are saying so much bullshit in English.
26.98s - 31.32s |  That's OK, because we can speak, improve our English.
31.32s - 33.40s |  OK, thank you.
33.40s - 34.44s |  So let's start.
35.56s - 37.24s |  As I said, my name is Ivel.
37.24s - 39.16s |  I'm from Brazil, Sao Paulo, Brazil.
39.16s - 41.12s |  I work at Cyber Threat Intelligence.
41.12s - 44.08s |  And well, I like malware.
44.08s - 48.20s |  I like to research about malware, hands-on wares and things like this.
48.46s - 51.62s |  It's pretty cool. You know, I know how it works.
53.54s - 54.68s |  Well, my name is Mauro.
54.68s - 56.64s |  I'm a Uruguayan-Argentinian hacker.
56.66s - 58.50s |  I'm here today to show this talk.
58.50s - 60.80s |  And I spoke at different events around the world.
60.80s - 63.58s |  And I'm the leader of the BITSOC Quetzal team, which is the first
63.58s - 67.04s |  Latin American Web3 Threats Research Team.
69.94s - 75.38s |  This talk, we are going to use NFTs as immortal command and control servers.
75.62s - 77.46s |  We are not going to sell you any NFT.
77.46s - 80.08s |  We are not going to try to put you into crypto.
80.08s - 82.46s |  So we are not going to make you invest into anything.
82.46s - 85.54s |  This talk is the continuation or the spiritual successor of
85.56s - 87.76s |  Everything is a C2, if you're brave enough,
87.76s - 91.50s |  which was a talk at the previous Adversary Village, where we used the Spotify,
91.72s - 96.30s |  World of Warcraft, Wikipedia and whatever you can name as a C2 server in the past.
97.94s - 103.52s |  So this talk is 30 minutes only, but it's divided in two parts, OK?
103.70s - 107.62s |  First, I will give ingredients and then, Mauro, you cook this.
107.66s - 110.16s |  OK, first, let me introduce you.
110.16s - 114.74s |  Podo, or Leopoldo, is his dog, Amazing Dog, a golden retriever.
115.12s - 118.90s |  OK, so let's talk.
118.94s - 126.62s |  Let's clarify what NFTs, C2 servers and lovely golden retriever, the lovely dog.
127.00s - 132.34s |  So NFTs, basically they are all information when you
133.96s - 137.50s |  upload, you know, an NFT in a blockchain.
137.72s - 139.68s |  This is all information storage.
139.68s - 142.14s |  And well, everything is there.
142.50s - 145.38s |  Data, metadata and things like that.
145.76s - 148.64s |  But you can store this image as well.
148.64s - 154.84s |  And off-chain, I mean, in a decentralized platform for this.
155.10s - 158.48s |  And it's immortal as well.
158.48s - 162.22s |  You know, you can change like in blockchain.
162.44s - 164.28s |  This is very important.
164.28s - 165.48s |  So we have two types.
165.48s - 170.58s |  You know how we can store our image on-chain and off-chain.
171.42s - 173.48s |  On blockchain and not in the blockchain.
174.26s - 176.06s |  Oops, sorry.
176.32s - 177.90s |  OK, sorry.
178.10s - 180.90s |  So what is a C2 command and control servers?
181.12s - 185.98s |  It's a server that we can send and receive information of malware.
185.98s - 189.66s |  So we can use this in anywhere, right?
189.66s - 191.16s |  But not in this case.
191.42s - 198.34s |  But the problem is if I try to do something in NFT, if I use a regular server,
198.38s - 200.68s |  you know, for C2, what can happen?
201.14s - 207.56s |  This can be banned or blacklisted, you know, and the list that
207.98s - 213.32s |  denies a list or everything can be messy and can be taken down,
213.32s - 215.78s |  even if it's in Tor browser.
215.98s - 220.58s |  So, yeah, it works, of course, but not in this case.
220.58s - 224.82s |  This particular case, we need something more resilient, right?
224.82s - 235.36s |  OK, so, as I said, blockchain, I don't know if everybody's familiar with blockchain,
235.36s - 236.40s |  I guess, right?
236.58s - 241.08s |  So everything is there, back that sits there is permanent.
241.08s - 243.78s |  You can change, it's there and that's it.
244.00s - 246.08s |  You just upload there and you keep there.
246.24s - 249.62s |  Can ban it, can flag anything.
249.92s - 258.18s |  But usually NFTs can be stored there or no, can be NFT is an image.
259.18s - 266.98s |  In NFT image, you can put like name, description, trade and everything, including metadata is there, right?
268.44s - 277.38s |  So instead we do this with that ugly monkeys, we everybody saw that ugly monkeys aware or weird image
277.42s - 283.88s |  because we see weird image from artists that say, oh, this is a brand new thing, but it's not my thing.
283.88s - 287.26s |  Sorry. What about Golden Retriever?
287.34s - 289.06s |  They are really, really cool.
289.06s - 291.02s |  And as a dog, too bad it's not a cat.
291.02s - 292.52s |  But let's start with a dog.
292.52s - 293.86s |  Maybe the next time, right?
294.40s - 297.98s |  Maybe. Now let's explain what is this.
298.90s - 301.94s |  Mostly NFTs, there's a platform.
301.94s - 306.28s |  The most known one is OpenSea, that one with the ugly monkey.
307.26s - 311.14s |  That was hacked several times, but it's not about this talk.
312.10s - 319.24s |  This is a very big market, probably is whitelist for almost all Web3, you know, companies.
319.48s - 321.94s |  All traffic go through this API.
322.12s - 325.44s |  OK, but that is off-chain, too.
326.16s - 331.96s |  It's partially stored in on-chain, I mean in the blockchain.
332.26s - 338.68s |  But the metadata is decentralized in other places, like this file system is in another place.
339.18s - 346.74s |  Now, this is very important when you use decentralized metadata, where it can be in many, many places.
346.74s - 351.28s |  But here is specifically talk about interplanetary file system.
351.94s - 355.36s |  I don't know if some everybody is familiar with this.
355.82s - 359.46s |  It's a cool place, you know, very decentralized platforms.
359.72s - 367.68s |  It's like torrent, you know, when you try to download or upload a file, a music there, you have seeds, no?
368.04s - 371.76s |  So these seeds, everything is shared among these seeds.
372.16s - 380.12s |  And when you have these, you hold these files and you can share, you know, and hold these files.
380.16s - 381.84s |  You have, you receive coins.
381.92s - 386.12s |  I mean, you are paid, you know, to have these files.
386.46s - 393.78s |  This is really nice for who's, you know, who have this, you have these files as a file coin, I guess the name.
393.82s - 394.66s |  Yes, right.
396.14s - 401.30s |  And then this image, when you upload there, is converted in another kind of file.
401.50s - 409.42s |  This AVIF, I'm not so familiar with this kind of, you know, I'm not an artist to convert the images.
409.76s - 418.84s |  And then the original file that's stored in this decentralized place is highly distributed among the seeds.
419.24s - 425.04s |  And this is the thing, you know, everything is in the seeds, all these files.
425.16s - 431.00s |  So starting from here is the thing, you know, what we're talking about.
431.20s - 435.32s |  Please explain what we do with these files that are decentralized.
435.86s - 443.94s |  Well, the point with the Interplanetary File System is that it's used widely by Lockheed Martin, IBM, other high vendors.
444.38s - 446.74s |  The point is that everything is distributed.
446.78s - 448.54s |  Anyone can run an APFS node.
449.02s - 454.02s |  So if you want to take something down, you have to ask every single node owner to take it down.
454.46s - 462.34s |  But as my partner here said, OpenSea and some other platforms reward you for holding the file or sharing the file with Filecoin.
462.60s - 467.08s |  So if you get a hold of a file, everybody deletes it and you have it.
467.36s - 469.96s |  There's a supply-demand problem here.
470.40s - 474.68s |  You can make lots of money by being the last one, the last holder of that file.
475.20s - 482.56s |  So that opens the path to certain kind of abuses of people not actually honoring takedown requests.
485.39s - 487.39s |  Okay, so now comes the important part.
488.39s - 494.27s |  This sounds pretty good in theory, but we have to make it into code, especially into Ruby code.
494.27s - 500.47s |  So if any one of you knows Ruby, you know that it might be nice, but it's not as flexible as other languages.
500.55s - 512.59s |  So what we need right now, we need a malicious C2 server, a malware that can interpret and send commands from NFTs, and obviously the malicious NFTs.
512.61s - 514.61s |  I'm going to switch the mic.
515.09s - 517.09s |  Okay, I'm back here.
517.49s - 523.37s |  So for this experiment, we have Leopoldo. I presented him in the previous slides.
523.49s - 533.97s |  We have four NFTs, which every single one does anything different, and we're going to test different attack vectors encoded inside these NFTs.
533.97s - 539.41s |  We have Initial Access Marker, Ramson Retriever, Treat Actor, and Golden Locker, my personal favorite.
540.01s - 541.73s |  It's not for sale.
541.73s - 547.09s |  Okay, on the left, you can see the malware coded in Ruby called MFT, Malicious Fungible Tokens.
547.09s - 552.67s |  And on the right side, you can see the C2 server coded once again in Ruby and Sinatra.
553.89s - 557.33s |  Let's start by exploiting the most basic things in OpenSea.
557.89s - 560.93s |  Let's start by exploiting the common fields, the low-hanging fruit.
561.69s - 567.09s |  Treat Actor, what it actually does, is has a description field publicly viewable by anyone.
567.25s - 571.93s |  It's visible to anyone, which is encoded in Base64 and ROT13.
572.25s - 577.69s |  When decoded, it says IP address, which is always hard-coded on all examples to local hosts,
577.85s - 580.61s |  so you cannot do any damage to anyone else.
581.53s - 583.53s |  It has a code
583.73s - 590.41s |  parameter that actually represents UNIX command and actions, which are actually proprietary modules of the malware.
590.93s - 597.17s |  This is not detected by CyberChef, even with magic on DEV10, so that was pretty awesome for me.
597.89s - 605.13s |  Then we have Golden Locker, which has a description just encoded in Base64, which is not also discovered by
605.81s - 610.09s |  CyberChef, and has other actions. We will see them in detail now.
611.05s - 614.41s |  Here's the malware, and we will have a demo at the end of this talk.
615.01s - 622.17s |  When you search for an account, for an ENS domain name or an Ethereum account, it will list all NFTs,
622.61s - 626.93s |  showing the newer ones first, because if you are pricing Situ servers,
626.93s - 631.65s |  this one will have the latest information that you need, the most up-to-date information and commands.
632.09s - 637.01s |  Then, if you can see the contract and the description and the collection.
637.61s - 641.49s |  And then, here's the thing. If you see the description, you will see the encoded
642.45s - 643.93s |  payload.
643.93s - 649.13s |  But if you see below, you will see the URL for the picture and the metadata, and then you'll go to
649.53s - 653.09s |  IPFS.IO, and here you will say, Mauro, what happens if I
653.73s - 660.89s |  send a takedown request to IPFS.IO? Absolutely nothing, because IPFS.IO is just an IPFS browser.
661.33s - 663.61s |  All this information is stored on different
664.41s - 669.45s |  IPSF nodes across the world, and you have to make a takedown request to every single one.
670.45s - 675.13s |  Then, if any one of you is familiar with Terraform,
675.69s - 681.73s |  actually, Terraform has a Terraform plan, which will show you what changes will happen before you push the button.
682.05s - 687.57s |  So you can avoid something like, you know, a CrowdStrike incident and things like that.
688.41s - 692.77s |  Actually, I tried to implement that. It's a function I'm super in love with.
693.01s - 698.65s |  So the malware will tell you what's going to happen once you run that NFT. Will the code tell you step-by-step
698.65s - 701.69s |  what's going to happen before you push the button?
702.57s - 709.13s |  And then, you will see it running in action, as you can see here. They will say, okay, I'm using this server as a relay.
709.13s - 715.81s |  I will run this custom code, WhoAmI, which answers back with Mauro Eldritch ID, which answers back with my ID,
716.37s - 721.49s |  hostname, and so on. There are some fake functions that I have not coded in,
721.85s - 727.33s |  obviously, for obvious reasons, that are wipe, encrypt, and open a reverse shell. That won't work at all.
728.69s - 732.69s |  And this is what the attacker will see from the Sitio server.
733.13s - 738.69s |  We'll see all the answers, for example, new exfiltration from localhost, and everything that happens.
738.69s - 745.25s |  But let's see how it works in the back. Before exploiting this, which is a super low-hanging fruit,
745.77s - 749.85s |  we will try to do something more complex. Remember that my partner told that
750.25s - 755.93s |  once you send a picture to an NFT, it will be stored in ABIF format and decentralized.
756.17s - 761.53s |  Well, the original file, the raw file, will be decentralized as well, for no apparent reason.
762.17s - 765.49s |  So, that's where we can inject more shenanigans.
765.93s - 769.57s |  In this case, I just wanted to test that the steganography will work.
769.57s - 776.01s |  So, I put Mauro Eldritch was here. The method is the most simple method on steganography, less single bit or LSB,
776.93s - 780.05s |  which has a hard-coded location that everyone knows.
781.05s - 786.69s |  And then, if you see here, you have once again the picture URL and the metadata URL.
786.69s - 791.77s |  Let's try to download the picture and check if the message made it to production on OpenSea.
792.77s - 798.65s |  And, for nobody's surprise, once downloaded and check it with setsteg, which is a third-party tool I do not own,
798.93s - 801.17s |  you can see the message replicated.
801.77s - 804.73s |  This means that we can decentralize messages,
805.33s - 809.29s |  steganographic messages, across all the world of using OpenSea.
809.85s - 811.69s |  Why is this so important?
811.69s - 818.13s |  Because the malware will only send traffic to OpenSea API.
818.69s - 824.45s |  So, when doing forensics on an affected device, you will see that the traffic and the attack comes from OpenSea,
824.89s - 826.85s |  from nowhere else, just OpenSea.
827.21s - 831.73s |  From Wireshark, from TCP DAM, you will see only connections to OpenSea API.
832.73s - 840.85s |  And then, I decided to create, let's say, my master hardcraft, Initial Access Marker, which has all the attack vectors.
841.17s - 844.09s |  It has steganographic signet messages.
844.41s - 849.29s |  It has a trait, which is a common field on all NFTs.
849.57s - 854.49s |  But it also has something called Exif field.
854.93s - 860.29s |  Exif metadata is data that is usually put by machines, by your processors,
860.57s - 863.21s |  by your cameras, by your phones.
863.77s - 870.05s |  The point is, the trick here is that, Exif metadata, it's hard to just put any arbitrary value in, you know?
870.77s - 874.49s |  You can put numbers, you have certain fields that are more flexible than others.
875.01s - 880.97s |  But there's a field, a specific field called profile copyright, that allows you to put basically anything you want without limit.
881.33s - 883.17s |  And that's where it stores the payload as well.
884.05s - 889.89s |  And once you check it, once you go to any IPFS browser,
890.29s - 895.61s |  you will see that the trait is already distributed globally.
896.05s - 902.21s |  So you can rely on the trait and not even start messing with metadata or messing with Exif metadata as well.
903.25s - 907.97s |  But then, I say, OK, let's try if we can check the other two vectors.
908.45s - 911.97s |  Downloading the picture that you can see here, which is hosted on IPFS.io,
913.13s - 919.49s |  you can see that by running Exif tool on the specific field, you will see once again the payload.
920.17s - 925.13s |  Running SetStag will render once again the payload.
925.65s - 930.73s |  So this adds different layers of resilience to store the same or different payloads on a simple NFT.
931.57s - 935.37s |  Remember that minting an NFT is something super, absolutely cheap.
936.09s - 943.05s |  So you can basically write immortal C2 servers for five pounds, seven dollars, or whatever is in your currency.
943.81s - 948.41s |  You can also check this with different third-party tools I do not own to see that the payload is reflected.
949.49s - 952.65s |  And now it's time to the demos. We are very good in time.
952.65s - 957.41s |  The demos don't have sound, but you will enjoy my angel voice narrating it.
961.92s - 968.68s |  This first example is, sorry, let's try to improve the quality because you deserve better.
971.73s - 980.86s |  Give me a second. Basically, what we are going to do here is run GoldenLocker,
981.06s - 983.14s |  one of the low-hanging fruit exploitation.
983.62s - 988.38s |  Above you can see the malware and below you can see the C2 server.
988.78s - 992.66s |  They are both running on the same machine in order to not damage anything.
993.26s - 995.42s |  We'll try to decode the instructions.
995.86s - 1002.50s |  The network is not cooperating, but we will try to decode instructions that are hosted on the malware.
1003.22s - 1008.76s |  Give me a second, which belongs to GoldenLocker.
1010.52s - 1012.76s |  It will then give us an action plan.
1013.24s - 1014.24s |  Sorry about that.
1018.42s - 1021.22s |  It will give us an action plan then, and what will happen?
1021.78s - 1028.26s |  It will try to run WhoAmI, id, hostname, and will try to uniquely identify the host and do some other shenanigans.
1029.74s - 1031.18s |  Then we need to execute it.
1031.86s - 1037.47s |  Sorry.
1037.67s - 1039.27s |  Hackers with tech problems.
1039.63s - 1040.63s |  Happens.
1040.71s - 1042.03s |  This happens from time to time, you know.
1047.66s - 1048.82s |  We will try to run it again.
1055.27s - 1060.19s |  The idea is to then execute it and see how the commands are reflected on the other server.
1060.59s - 1061.91s |  Here it is trying to work.
1062.23s - 1063.39s |  Give it some seconds.
1068.87s - 1072.39s |  The quality is not the best, but let's try to bear with it.
1075.53s - 1079.37s |  And then it tries to find a viable payload.
1079.49s - 1084.29s |  If you see here, you will see that it says, I have found a tainted exif registry.
1084.45s - 1087.53s |  I have found a tainted steganographic message that I can use.
1088.33s - 1094.49s |  And if it will try to find the description first, it will try to then jump into something more complex each time
1094.89s - 1098.37s |  in order to try to use the low-hungered fruit available first.
1099.89s - 1100.89s |  Sorry, just.
1107.27s - 1112.87s |  And then the idea, the final idea is that, as I said before, you will see all the traffic being reflected to OpenSea.
1113.55s - 1120.79s |  That makes it actually difficult for forensic teams to know where the tanks come from, but also it will help them in another way.
1122.03s - 1128.99s |  If any of you is a defender or forensic analyst or similar, you will really appreciate the value of having
1129.83s - 1134.19s |  basically immortal C2 server, because you will have an artifact that you can
1135.03s - 1138.67s |  dissect and check basically forever and use as an example forever.
1139.03s - 1143.63s |  You won't have to rely on malware libraries and you won't have to rely on, you know,
1144.55s - 1146.83s |  platforms that simulate attacks on malware.
1148.51s - 1151.63s |  Well, since this is not cooperating, I will move on.
1153.68s - 1155.96s |  I'm sorry about that. Sometimes that happens.
1156.04s - 1159.88s |  Sometimes it's not easy, but we'll move on.
1163.80s - 1169.80s |  And as in all crypto experiments, there is something that you cannot just be safe from and are scammers.
1170.24s - 1176.32s |  As soon as we publish it, the pictures of my golden retriever, I have people trying to buy it for 15th, 20th and so on.
1176.72s - 1179.28s |  And let me tell you, it's not worth it.
1179.32s - 1182.68s |  He showers once a month, so he smells like a seal.
1182.72s - 1183.72s |  It's not worth it.
1184.76s - 1192.40s |  And then going back to the serious track, as I was discovering this and reporting these issues with IPFSIO,
1192.96s - 1196.12s |  I started seeing some ads, promoted ads on Twitter.
1196.64s - 1198.12s |  I refuse to call it X.
1199.32s - 1205.88s |  If you look at the lower left corner of the post on the left, you will see that the source address is IPFSIO.
1206.36s - 1214.60s |  Somebody is hosting a drainer campaign, a phishing campaign on IPFSIO, rendering it basically immortal, unable to be taken down.
1215.20s - 1220.40s |  So it has a rent-free web server to host the campaign forever.
1221.32s - 1226.72s |  Those are the dangers of decentralization when it's weaponized.
1229.24s - 1231.80s |  And then, so I hope you enjoyed this talk.
1231.84s - 1232.92s |  It's time to say goodbye.
1233.28s - 1235.20s |  I know that you may have questions.
1235.60s - 1239.76s |  This talk is not exactly about NFTs or blockchain in general, but rather how to end up using it.
1240.08s - 1240.96s |  I hope you enjoyed it.
1240.96s - 1242.48s |  Sorry for the demo not working.
1242.48s - 1243.84s |  I apologize, heartfelt.
1244.40s - 1245.92s |  And well, thanks for coming.
1245.92s - 1246.80s |  Thanks for your time.
1247.24s - 1248.60s |  I really enjoy your company today.
1248.64s - 1249.72s |  You can contact us here.
1253.20s - 1254.20s |  Thank you, everyone.
1254.24s - 1257.64s |  Any questions, comments, or something like this?
1258.36s - 1259.44s |  The dog is not for sale.
1259.88s - 1262.52s |  Did you release the tool?
1262.56s - 1263.56s |  Yeah, the tool is released.
1263.72s - 1269.68s |  You can actually create your own MetaMask address, jump to OpenSea, and start dealing with it.
1270.04s - 1272.20s |  Feel free to fork it, change it, your call.
1273.92s - 1274.72s |  Someone else?
1274.96s - 1275.72s |  Questions?
1276.24s - 1276.88s |  Comments?
1277.88s - 1278.40s |  No?
1278.72s - 1280.84s |  So, a quick advertisement.
1281.64s - 1283.92s |  We are holding a new village here.
1284.20s - 1285.28s |  It's La Villa Hacker.
1285.28s - 1289.20s |  It's more focused on people who speak Spanish and Portuguese.
1289.20s - 1292.48s |  We have awesome talks, all in Spanish and Portuguese.
1292.84s - 1294.96s |  If you want to visit us, it would be awesome.
1295.00s - 1296.76s |  And thank you very much, guys.
1297.36s - 1297.84s |  Thank you.


url: https://www.youtube.com/watch?v=xcbKIWXThT4
title: DEF CON 32 - Master Splinter’s initial physical access dojo - Daniel Isler
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=xcbKIWXThT4",
  "title": "DEF CON 32 - Master Splinter\u2019s initial physical access dojo - Daniel Isler",
  "description": "Storytelling of a highly complex Red Team with multiple initial accesses only with Social Engineering. could anyone do it? Yes.\n\nUnder the format of Storytelling this presentation aims to take attendees first person through a RedTeam service with multiple initial accesses with 100% Social Engineering. How to present critical vulnerabilities in a public way without exposing the target company? This live comic will show us how, through one of its protagonists and with practical examples made with the attendees themselves. How does a professional Social Engineering unit work? What are the roles and tasks? How to emulate the reach of a cybercriminal gang in less than three weeks? This dojo aims to show the methodologies and techniques applied in the field to obtain relevant findings, even reaching critical infrastructure without raising alerts and in an extremely limited time. From the first meeting with the client, information gathering, vector selection, exploitation, pretexting to the physical intrusion, even reaching the datacenter. We will demonstrate how luck is no longer an element to consider when your work is SE from Monday to Friday and you have to perform this type of service every month.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1473,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.30s | This text was transcribed using whisper model: large-v2

 Okay, welcome everybody.
2.30s - 4.74s |  So if you're like me and you grew up with the Ninja Turtles,
4.74s - 6.74s |  you're gonna be really excited about this one.
6.74s - 10.98s |  We've got Daniel Eisler on behalf of Adversary Village,
10.98s - 13.78s |  Master Splinter's Initial Physical Access Dojo,
13.78s - 16.66s |  Storytelling of Complex Adversarial.
16.66s - 24.28s |  Thanks so much and here we go.
24.28s - 27.02s |  Hi, maybe most of you don't know me.
27.02s - 31.98s |  And as you can see, I don't speak very well English.
32.14s - 35.18s |  So I hope you enjoy this talk.
35.18s - 38.32s |  Before I start, well, you already see it,
38.32s - 80.34s |  but it's important this very first announce.
80.34s - 83.30s |  Welcome, I am the Master Splinter.
83.30s - 86.58s |  And no, I'm not coming from the Comic Con.
86.58s - 90.94s |  You can call me Rad, Splinter, Danny, or Daniel.
91.94s - 93.02s |  Oh, awesome.
93.02s - 93.84s |  Hello, hello.
95.32s - 96.72s |  Okay.
96.72s - 97.56s |  Yeah, yeah.
98.52s - 103.16s |  Since 2015, I'm the team leader of Friendly Rats,
103.16s - 104.66s |  the social engineering unit
104.66s - 106.74s |  at DreamLab Technologies in Chile.
108.30s - 109.80s |  Friendly Rats, DreamLab.
110.94s - 113.24s |  I have the honor to present several cons.
113.24s - 115.54s |  I don't know if you, you hear me?
115.54s - 116.64s |  No, not too much.
117.48s - 118.68s |  Yeah.
118.68s - 120.94s |  I, okay, that's it.
122.72s - 125.52s |  Several cons associated with social engineering,
125.54s - 129.36s |  such as Ecoparty in Buenos Aires, Argentina,
130.46s - 133.36s |  Osintomatico in Madrid, in Spain,
133.36s - 136.26s |  Layer 8 in Rhode Island.
136.26s - 139.72s |  And with a lot of nervous and joy,
139.72s - 144.44s |  I will be, now is my fifth time presenting at DEFCON.
144.44s - 147.10s |  So thank you, Adversary Village.
148.70s - 153.38s |  Today, I'm gonna need the help of two volunteers
153.44s - 156.70s |  who wants to be real rats, ninja rats.
156.70s - 161.54s |  So to be more faster, I have,
161.54s - 164.18s |  no, no, but raise your hand, two persons.
164.18s - 167.08s |  I have one, two, okay.
167.08s - 168.52s |  Thank you, buddy.
168.52s - 170.52s |  No, no, but I will call you.
170.52s - 171.62s |  Thanks, thanks.
171.62s - 173.12s |  Don't go.
173.12s - 181.32s |  So welcome to the dojo.
181.32s - 183.62s |  Okay, all rats are welcome.
183.64s - 186.84s |  I could assure that everyone here
186.84s - 190.58s |  has social engineering success story.
190.58s - 192.48s |  I'm sure you're treasure it,
194.12s - 197.82s |  even share it as an accomplishment or an adventure.
197.82s - 201.30s |  In fact, I love to hear that stories after this
201.30s - 203.40s |  with a beer, if you like.
203.40s - 206.60s |  Now, I invite you to imagine that.
206.60s - 210.90s |  Not the beer, the story of social engineering.
210.92s - 215.92s |  And imagine that like a day job, like us,
217.06s - 219.76s |  Monday through Friday, all year long.
219.76s - 223.54s |  That's why our first adage will be,
223.54s - 226.78s |  there's no such a thing as luck.
226.78s - 230.30s |  I don't know if you can say that in Vegas,
230.30s - 233.08s |  but we don't trust in luck.
236.04s - 239.28s |  What I will try to do today is to share with you
239.30s - 242.70s |  how training, preparation, techniques and methods
242.70s - 246.44s |  can help in a social engineering service or in a red team.
246.44s - 250.54s |  So you can finally decide if luck really exists or not.
250.54s - 253.82s |  It's difficult to make an eye-catching story
253.82s - 258.72s |  when it has only existed in a report format.
258.72s - 261.92s |  As you will see, I will do my best.
263.46s - 267.76s |  So, it all starts in another country
267.78s - 272.78s |  with a critical infrastructure company of that nation.
273.92s - 275.42s |  We never expect to meet a client
275.42s - 278.46s |  who is really willing to give us a clue
279.50s - 282.06s |  as to what we are going to face.
282.06s - 285.96s |  He just point us to a few possible locations
285.96s - 287.66s |  where they might be found.
288.64s - 291.54s |  Control rooms, sorry, control rooms,
291.54s - 296.54s |  monitoring rooms, machine rooms, offices and data center.
298.22s - 303.22s |  One of the first thing we found in the assessment stage
304.88s - 309.88s |  was that due to the type of service this client provide,
310.48s - 314.06s |  in the case of any unusual activity
314.06s - 318.86s |  or unauthorized personnel, the collaborators,
318.86s - 323.14s |  any of them were authorized to reduce
323.14s - 325.94s |  or at least detain the intruder
325.96s - 329.92s |  until certain forces arrived.
333.56s - 336.96s |  We start the first week with information gathering,
336.96s - 343.21s |  focusing in the following three findings.
343.21s - 345.13s |  Corporate ID.
345.13s - 347.73s |  Thanks to a post in social networks,
347.73s - 352.73s |  we found a 3.2 feet long version of the corporate ID
353.01s - 357.03s |  with the personal ID of each of one of the developers.
358.41s - 361.77s |  The second one was relevant profiles
361.77s - 364.13s |  with exposed information.
364.13s - 369.13s |  We identified four strategic collaborators account
369.37s - 374.37s |  for identity impersonation and possible authorizations.
375.65s - 380.65s |  And the third one was weak accesses and credentials.
380.73s - 383.41s |  We found an internal login
383.41s - 385.89s |  without two-factor authentication
385.91s - 389.59s |  with the possibility of several consecutive attempts
389.59s - 392.05s |  to enter wrong credentials.
392.05s - 396.97s |  So maybe some, you know what happened with that.
398.11s - 400.77s |  The human, humans, sorry.
401.63s - 406.63s |  At this stage, it's very important to consider
407.23s - 411.27s |  as burned the rat performing the interaction
411.27s - 414.03s |  in the field for information gathering.
414.03s - 417.25s |  He can't be part of the physical intrusion
417.25s - 421.17s |  because collaborators could recognize him or her.
422.57s - 426.69s |  This phase allows us to achieve two findings.
426.69s - 431.33s |  First, the ID and the uniform design.
431.33s - 434.25s |  We validated the design was the same
434.25s - 439.01s |  as the one we found in the publication, in the post.
439.01s - 443.21s |  Second one, we want to check if indeed
443.21s - 445.81s |  the attitude of the cats,
449.03s - 452.99s |  if one of us perform an inappropriate action.
452.99s - 457.99s |  So the burned rat took a picture of one of the accesses.
461.31s - 463.99s |  In less than two minutes,
463.99s - 466.75s |  he had one of the cats on his back,
466.75s - 468.51s |  almost breaking the camera
468.51s - 470.67s |  and demanding to delete the picture.
470.67s - 472.39s |  So it's gonna be tough.
474.07s - 476.27s |  How we organize in our unit?
477.27s - 479.65s |  To deal with any type of service,
479.65s - 481.61s |  we use the following distribution.
482.83s - 485.79s |  We have four kind of consultants.
485.79s - 490.19s |  Support, they are the ones who will immediately respond
490.19s - 492.99s |  to all the requests needed by the alpha team,
492.99s - 497.31s |  like information, supplies, mobilization,
497.31s - 499.67s |  buy some stuff, et cetera.
499.67s - 502.23s |  The queue, like the queue agent.
502.25s - 504.77s |  They are in charge for preparation devices,
504.77s - 509.77s |  payloads, scripts, wifi, malicious webpage, et cetera.
510.81s - 515.25s |  Then the alpha can be one or an alpha team.
515.25s - 518.23s |  There are experts in exploitation, execution,
518.23s - 521.05s |  capture, cloning and exfiltration,
521.05s - 523.29s |  recovery and access enabling.
524.17s - 528.17s |  And the last one, anyone here,
528.17s - 530.61s |  you could be one of these ones today.
531.59s - 533.39s |  Cover.
533.39s - 536.63s |  We work with freelance consultants,
536.63s - 541.63s |  from psychologists to actors, dogs to elderly people.
541.99s - 546.07s |  We use, one time my son used to work too,
546.07s - 547.35s |  with five years old.
548.47s - 550.91s |  The resorts are always good,
550.91s - 554.75s |  as they are not emotionally charged or stressed
554.75s - 556.73s |  about the success of the service.
557.55s - 561.19s |  The comments, their comments are usually,
561.19s - 564.23s |  this is the most fun I ever had,
564.23s - 569.23s |  or I wouldn't have imagined it will be so easy.
571.71s - 573.67s |  When they say that,
573.67s - 577.39s |  I start to see the hateful faces of the rats.
577.39s - 581.95s |  So I explained them that it looks easy,
581.95s - 584.91s |  thanks to the hard work of all the rats.
584.93s - 588.85s |  That's why they managed to get inside the data center,
588.85s - 593.49s |  manager's office or implant a device in a critical area.
593.49s - 596.33s |  So now you know our team.
597.47s - 601.21s |  So this was the plan or the organization.
601.21s - 603.53s |  The uniform used by the cats
603.53s - 606.85s |  was not available for sale to public.
606.85s - 611.85s |  So our custom designer made her own research
613.13s - 614.49s |  to generate replicas.
615.07s - 617.11s |  So yes, we have a custom designer.
618.19s - 622.43s |  As you can see, it is necessary for the details,
622.43s - 627.43s |  including the natural aging and soiling of each uniform.
628.75s - 633.75s |  You can't always buy online or trust online stores.
636.91s - 640.95s |  This always happen when you buy online stores a uniform.
640.95s - 642.55s |  So don't do it.
643.45s - 645.51s |  Found a custom designer.
646.89s - 649.45s |  So what gonna do the Alpha team?
649.45s - 653.33s |  They gonna dress like a central office collaborator.
653.33s - 656.37s |  They will show up under the pretext
656.37s - 661.37s |  of undertaking a review of sanitization protocols
662.93s - 665.37s |  associated with COVID-19.
665.37s - 672.13s |  Of course, this project took place in that time.
672.13s - 676.83s |  Q, during the second week, our Q guys
678.87s - 683.11s |  focus on four strategic profile email accounts.
683.11s - 688.11s |  Probably everyone is familiar with this kind of tools.
689.59s - 694.59s |  Who doesn't know, you can customize password dictionaries
694.71s - 697.55s |  for brute force attack.
697.55s - 702.55s |  So we achieve an effective access for four accounts
702.57s - 704.97s |  thanks to the low restrictions
704.97s - 706.91s |  on the weak password settings.
708.45s - 710.97s |  Those were the results.
710.97s - 715.97s |  So nothing very complex for these critical accounts.
717.87s - 720.27s |  What gonna make support?
720.27s - 723.37s |  Once inside of the email account,
723.37s - 726.53s |  we blacklist or spam all the people
726.53s - 728.77s |  where we are going to contact.
729.55s - 732.99s |  Support team should permanently check the spam mailbox.
732.99s - 736.91s |  And if they receive an email from one of these contacts,
736.91s - 738.61s |  respond as soon as possible
738.61s - 742.07s |  and delete both the spam email and the sent email.
742.07s - 744.05s |  So it's invisible for the user.
747.83s - 750.63s |  And another lethal weapon that we have,
753.19s - 756.51s |  it will seem maybe absurd for you,
756.51s - 760.89s |  but we register the phone number of our team
760.89s - 765.33s |  with the name of the user of the compromised email account.
765.33s - 770.33s |  So the phone call will be displayed the name in the screen.
773.41s - 776.41s |  I know it sounds basic, but believe me,
776.41s - 779.95s |  in a real scenario, it can save everything.
781.73s - 786.73s |  Cover, few days before the execution,
786.75s - 791.23s |  we sent on a script, a manual on protocols
791.23s - 794.03s |  on preventive measures for COVID-19
794.03s - 796.19s |  to our covering consultant.
797.55s - 802.55s |  As a guideline, he were to be 100% focused on coverage.
803.51s - 808.51s |  That is lead conversation, initiate presentations
808.51s - 810.91s |  and argue about our presence,
810.91s - 817.18s |  perform distraction actions to support the alpha team.
817.18s - 820.76s |  So in the preparation day, we met with the rats
820.76s - 824.30s |  to review objectives and all relevant information.
824.30s - 829.30s |  Names, position, contacts, roles, custom props,
830.46s - 834.72s |  technical language, pretext, possible situations,
834.72s - 836.50s |  issues and solutions.
837.60s - 842.60s |  And the last added value, it's a powerful weapon.
842.94s - 847.94s |  More than the phone, a nice but lethal sticker
848.74s - 853.74s |  for each collaborator who was going to interact with us
853.80s - 855.20s |  during the activity.
855.20s - 859.00s |  That is a principle of reciprocity, it's so strong.
860.06s - 863.72s |  So let's start, execution day.
864.58s - 867.94s |  Support team, two consultants, one in the field
867.96s - 872.96s |  and other remotely managing respectively the email account
874.76s - 879.76s |  and a telephone to impersonate the user profile.
881.22s - 884.96s |  The alpha team was composed of two consultants,
884.96s - 889.40s |  a cover consultant who will pretend to be our boss
889.40s - 891.08s |  and two other alpha.
892.44s - 895.64s |  We arrive in the first access.
895.64s - 897.90s |  The alpha team identified itself
897.90s - 900.38s |  as a corporate office staff.
900.38s - 903.18s |  With technical language, we speak with the guard
903.18s - 907.90s |  ending with, don't worry, we already know the facility.
907.90s - 912.02s |  The guard revealed allows us access
912.02s - 915.14s |  upon seeing our uniforms and credentials.
915.14s - 917.86s |  So it is important to understand
917.86s - 921.06s |  that once you are a interlocutor
921.06s - 924.46s |  that considers you trusty person
924.46s - 929.58s |  or better yet, someone who can resolve situation.
929.58s - 931.14s |  Yeah, yeah.
931.14s - 934.74s |  Then you're standing in a privileged place.
934.74s - 938.10s |  The guard looked at us with appreciation
938.10s - 944.40s |  and announced over the radio that we were going on our own.
944.40s - 949.16s |  Okay, upon entering, we found ourselves in a maze.
950.24s - 953.04s |  We knew we didn't have to look like strangers
953.04s - 954.78s |  so we keep walking naturally.
955.74s - 958.02s |  We walk through several corridors
958.02s - 960.30s |  until we research a security door
960.30s - 962.02s |  with proximity card opening
962.02s - 964.78s |  with two factors of authentication.
964.78s - 969.54s |  We stop in front of the access simulating a conversation
969.54s - 972.42s |  until a cat appeared.
972.42s - 977.42s |  A maintenance technician carrying a large number of boxes.
978.20s - 983.20s |  So we obviously very kindly help him to open the door.
984.90s - 989.66s |  On the other side was an armed guard cat
989.66s - 993.10s |  who saw us in complicity with the technician
993.10s - 995.74s |  plus the uniforms and credentials.
996.70s - 1000.38s |  He went from the angry cat gesture, you know,
1000.38s - 1005.38s |  as a simple raised eyebrow of a cat who had just eaten.
1009.71s - 1012.19s |  So we advanced through the corridors,
1012.19s - 1017.19s |  very similar to those in Dead Star or Jurassic Park
1017.63s - 1022.63s |  or Resident Evil with double doors and control accesses.
1023.87s - 1028.87s |  So we knock at a crystal door and a cat on duty appeared.
1031.15s - 1034.39s |  Here it's very important for you to understand
1034.39s - 1037.27s |  what is going on in the minds
1037.27s - 1041.79s |  and behavior of our consultants.
1042.39s - 1044.87s |  The cover must be 100% focused
1044.87s - 1047.83s |  on establishing a situation of comfort
1049.59s - 1051.47s |  and trust with the cat.
1051.47s - 1054.83s |  So it is essential to play the pretext,
1054.83s - 1059.31s |  the game without any doubt, without any hesitation.
1059.31s - 1061.79s |  The alpha team members had to be perceived
1061.79s - 1065.65s |  as a cat, as his companions.
1065.65s - 1069.67s |  When in reality, they were counting the numbers of people,
1069.67s - 1073.91s |  a lock, unattended equipment, available network points,
1073.91s - 1077.79s |  access cameras, and printed information.
1077.79s - 1080.51s |  So let's talk about the truth
1081.43s - 1084.89s |  or the truth before the truth, you know?
1084.89s - 1087.33s |  We are workers, that is the truth,
1087.33s - 1091.73s |  but the truth before the truth is our real objective.
1091.73s - 1095.85s |  So the cat can't know that, can't know that, yeah.
1095.85s - 1100.19s |  So I need two volunteers.
1101.17s - 1107.96s |  So I think there's one here.
1107.96s - 1110.66s |  You say, and the guy there.
1112.48s - 1113.32s |  I don't know.
1113.32s - 1115.78s |  Yeah, yeah, you can come, come, come, and you too.
1115.78s - 1117.28s |  Yeah, yeah, both.
1117.28s - 1118.12s |  Yeah, yeah.
1119.28s - 1124.28s |  So we will play an improv situation.
1125.10s - 1127.68s |  So your name?
1127.68s - 1128.52s |  Katya.
1128.52s - 1129.34s |  Katya.
1130.02s - 1130.86s |  You?
1130.86s - 1131.68s |  Chris.
1131.68s - 1132.52s |  Chris.
1132.52s - 1133.36s |  Chris.
1133.36s - 1134.18s |  Thank you both.
1134.18s - 1135.58s |  So we're gonna make this improv
1135.58s - 1138.62s |  to know the truth before the truth.
1138.62s - 1143.54s |  So I'm gonna give you this.
1143.54s - 1144.38s |  Let me check.
1145.22s - 1154.42s |  It's a noise canceling headphones.
1154.42s - 1155.32s |  Sorry.
1155.32s - 1156.16s |  Put it on.
1156.16s - 1162.70s |  Yeah.
1162.70s - 1165.06s |  Okay, so you can,
1166.64s - 1168.24s |  Chris, Chris, Chris, Chris.
1168.24s - 1171.84s |  So the truth will be,
1171.84s - 1174.50s |  you're gonna painting a fence.
1174.50s - 1177.24s |  That is the truth, the reality, the action.
1177.24s - 1179.86s |  But the real goal is gonna be,
1180.94s - 1185.94s |  she needs to touch her left eye, like here.
1187.34s - 1190.56s |  But the truth is painting a fence.
1195.18s - 1196.10s |  Paint, no?
1196.10s - 1196.94s |  Yeah, yeah.
1196.94s - 1197.76s |  Let me check.
1197.76s - 1198.60s |  Yeah, it's everything.
1198.60s - 1199.66s |  Okay, let's start.
1200.70s - 1202.30s |  Sorry, sorry, sorry, sorry.
1202.30s - 1208.64s |  Yeah.
1208.66s - 1210.16s |  Rub, Chilean rub.
1211.22s - 1213.90s |  So let's start the improv.
1213.90s - 1217.92s |  So action.
1217.92s - 1219.52s |  He's painting something.
1220.52s - 1225.47s |  You can help.
1225.47s - 1228.63s |  Watch out with the paint.
1228.63s - 1232.00s |  That was fast.
1232.00s - 1237.84s |  Look for your goal.
1237.84s - 1240.98s |  Okay, give them an applause, please.
1241.96s - 1243.04s |  Thank you.
1243.04s - 1248.20s |  But who was the real rat?
1248.20s - 1249.76s |  Wait, wait, wait.
1249.78s - 1251.94s |  Who was the real rat?
1251.94s - 1257.37s |  Let's hear this.
1257.37s - 1259.21s |  It's a secret instruction.
1259.21s - 1261.49s |  Thank you for being my real helper.
1261.49s - 1264.49s |  The first thing I need you to do is to move your head
1264.49s - 1266.81s |  as if you were listening to music.
1266.81s - 1267.97s |  Now, look at me.
1269.69s - 1272.13s |  She had the real goal.
1272.13s - 1275.29s |  The real goal was he touched his nose.
1276.57s - 1281.57s |  But everyone saw, see, the truth is painting, you know?
1281.59s - 1283.83s |  This game is yours.
1283.83s - 1286.47s |  You have to get the other participant
1286.47s - 1290.07s |  to touch his or her own nose.
1290.07s - 1291.29s |  Break a leg.
1291.29s - 1294.31s |  Now, I leave you with a classic from my country,
1294.31s - 1296.63s |  the true game of Tiro de Gracia.
1297.99s - 1300.11s |  Yeah, now give them applause.
1302.56s - 1303.64s |  Nice, nice.
1303.64s - 1306.36s |  Okay, now you understand the truth
1306.36s - 1308.84s |  or the truth before the truth.
1308.84s - 1309.68s |  Two minutes.
1310.52s - 1311.96s |  No.
1311.98s - 1313.94s |  Okay, this is gonna be fast.
1316.66s - 1321.58s |  Okay, coverage consultant introduced himself
1321.58s - 1323.76s |  and told the proposal of the visit
1323.76s - 1328.54s |  that the cat on duty, very doubtful and skeptical.
1328.54s - 1329.48s |  Let's see them.
1330.78s - 1332.34s |  I gotta be fast.
1332.34s - 1334.50s |  So, what happens here?
1334.50s - 1336.18s |  We introduce himself.
1336.18s - 1339.98s |  We send the email from the account.
1339.98s - 1345.23s |  And after that, we have the permission.
1345.23s - 1348.17s |  So, we talk with everyone in there.
1348.17s - 1352.67s |  We give them the sticker.
1352.67s - 1354.15s |  We send this email.
1354.15s - 1357.71s |  And in this email says that the entire department
1357.71s - 1359.31s |  is gonna be on field.
1359.31s - 1361.55s |  So, if you want to talk with them,
1361.55s - 1365.63s |  you need to call to our phone, yeah?
1365.63s - 1368.35s |  So, stickers.
1369.29s - 1374.17s |  So, we start to walking in other places, other offices.
1374.17s - 1377.37s |  And you know the flow, you know?
1377.37s - 1379.81s |  The call, the email.
1379.81s - 1383.53s |  And we arrive to an estranged office.
1383.53s - 1386.13s |  Inside of this office was a few people,
1386.13s - 1388.73s |  but many unlock equipment.
1388.73s - 1391.29s |  One of them says, we don't block them
1391.29s - 1393.21s |  to be able to monitor.
1393.21s - 1398.21s |  To this day, I do not know how we contain our excitement.
1398.21s - 1400.83s |  It was the data center cameras.
1400.83s - 1405.83s |  And as an old man who just know only fans, I asked,
1405.87s - 1407.07s |  what is that?
1407.07s - 1408.79s |  What is that place?
1408.79s - 1410.67s |  And he says, it's the data center.
1410.67s - 1414.83s |  Oh, and it's in here?
1414.83s - 1418.47s |  Yes, but only we and the technicians can enter.
1418.47s - 1420.77s |  Then, the cover rat seriously said,
1422.51s - 1424.99s |  okay, I'm gonna finish here.
1424.99s - 1429.65s |  So, after that, we went to the data center.
1429.65s - 1432.57s |  Now, you're gonna lost a rap song with this.
1432.57s - 1437.57s |  I'm gonna, we have this rap song, how we get in there.
1439.51s - 1442.81s |  Sorry, technical problems.
1443.83s - 1446.85s |  But we go in there, we go to the data center,
1446.85s - 1450.73s |  we give the guy another sticker,
1450.73s - 1454.39s |  and then we go to the rat hole.
1455.37s - 1459.53s |  So, sorry, you can't see everything, but nah, it's okay.
1459.53s - 1460.63s |  Hope you enjoy it.


url: https://www.youtube.com/watch?v=w4M_Z0D1rdY
title: DEF CON 32 - GUR RIBYHGVBA BS PELCGBTENCUL - Jeff Man
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=w4M_Z0D1rdY",
  "title": "DEF CON 32 - GUR RIBYHGVBA BS PELCGBTENCUL - Jeff Man",
  "description": "I recently googled the meaning of \u201cencryption\u201d and found this definition on Wikipedia: \u201cIn cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext.\u201d Um\u2026no, encoding produces code, enciphering produces ciphertext, encryption is more than just encoding, and so on. Given the jumbling together of historically very unique and significant terminology I set out to find the actual, historical definitions and try to find a way to teach and/or demonstrate the differences in the foundational forms of cryptography. But I quickly noticed that some of this terminology is so often mis-applied in our digital age that I wondered if maybe there has been an evolution of the meanings of these terms? I might not like it, but I\u2019m open to that possibility. This very quickly led me to the conclusion that my research on this topic would make for an interesting talk and so here we are. I want to share the classical, historical forms of cryptography, discuss the etymology of the terminology, look at how the words apply today \u2013 and help the audience decide if the actual meanings even matter (or it\u2019s just me). One important consideration is the tradeoff between keeping the data secret (security) and protecting the identity of individuals associated with the data (privacy). I hope you\u2019ll join me in this journey to victory (or defeat) in the ongoing battle of preserving the classic goals and objectives of data security.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1422,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.65s | This text was transcribed using whisper model: large-v2

 First of all, what's the name of this talk?
6.65s - 7.73s |  Anyone?
7.73s - 8.93s |  You have to shout.
18.31s - 21.38s |  How about that?
21.38s - 25.10s |  And an example of something called a Caesar cipher,
25.10s - 27.34s |  a simple substitution cipher.
27.34s - 29.62s |  In our tech industry,
29.62s - 33.98s |  we sometimes call it rot, rotation cipher.
35.38s - 36.50s |  My name is Jeff Mann.
36.58s - 41.02s |  I am a former NSA cryptologist,
41.02s - 45.06s |  consultant advisor, industry old timer.
45.06s - 47.50s |  And feel free to reach out to me anytime
47.50s - 49.26s |  for questions, mentoring.
51.42s - 53.30s |  Take pictures, send them to me.
55.54s - 58.14s |  Spent the early part of my career, as I said, at NSA.
58.14s - 60.40s |  I've been out for almost 30 years now.
62.06s - 65.02s |  20 years ago, I got into doing something called PCI.
66.50s - 69.28s |  Has PCI ever been said from stage at DEF CON before?
69.28s - 70.12s |  I don't know.
74.81s - 76.51s |  Most people in this industry know me
76.51s - 79.15s |  because I was one of the architects,
79.15s - 81.23s |  one of the founders of what came to be known
81.23s - 83.39s |  as the first NSA red team.
83.39s - 86.59s |  So I was doing pen testing back in the early 90s
86.59s - 90.31s |  and did it up until about the mid 90s for NSA.
90.31s - 93.53s |  But I was also a cryptanalyst at NSA,
93.53s - 95.23s |  which is why I'm here talking,
95.23s - 98.03s |  representing the crypto and privacy village, by the way.
100.35s - 104.79s |  I was working as a cryptologist designing systems
104.79s - 106.39s |  back in the late 80s.
106.39s - 107.39s |  One of the things I did,
107.39s - 110.83s |  because computers were becoming a thing,
110.83s - 113.71s |  the digital age was becoming a thing.
113.71s - 116.51s |  I had a client that asked if they could do
116.51s - 120.27s |  a paper manual process on a PC
120.27s - 121.87s |  and was able to produce what I think
121.87s - 125.15s |  was the first software-based NSA produced,
125.15s - 126.87s |  which only did half of it.
126.87s - 130.19s |  The spy in the field was still using the paper,
130.19s - 133.39s |  but the case handler was using a PC
133.39s - 137.61s |  and got the one-time pad key put on floppy disk.
138.91s - 141.31s |  I also had another customer, US Special Forces,
141.31s - 143.43s |  that I designed a cipher wheel for
143.43s - 146.19s |  that would help them with their encryption and decryption
146.19s - 151.56s |  in the field of one-time pads.
151.56s - 155.88s |  But this is just a little bit of cryptographic history
155.88s - 158.64s |  to explain where we came from in cryptography.
158.64s - 161.44s |  You were just hearing a talk talking about encryption
161.44s - 163.24s |  that works in the digital age.
164.60s - 167.56s |  But basically, people have been trying to keep secrets
167.56s - 169.44s |  for thousands of years.
169.44s - 172.64s |  And in the early days, it was primarily keeping secrets
172.64s - 176.56s |  and communicating messages from one end to another,
176.56s - 179.00s |  very often used by the military,
179.00s - 181.24s |  trying to get commands and directions
181.24s - 184.20s |  to troops on the battlefield from the command headquarters
184.20s - 186.40s |  and the generals and things like that.
187.36s - 190.44s |  There's basically, historically,
190.44s - 192.08s |  two different ways of doing that,
192.08s - 194.76s |  two different ways of protecting messages,
194.76s - 196.68s |  and that's called codes and ciphers.
198.28s - 201.36s |  The difference between the two, very briefly,
201.36s - 203.92s |  the way I learned it many years ago,
203.92s - 208.92s |  is code is something you do to words and phrases
209.68s - 212.56s |  or thoughts and ideas to try to shrink it down
212.56s - 215.40s |  to something that's briefer to transmit
215.76s - 218.72s |  and to communicate, whereas a cipher
218.72s - 220.88s |  is something you're doing to scramble
220.88s - 224.48s |  and create what used to be called a cryptogram,
224.48s - 226.60s |  but it's a one character, one letter,
226.60s - 229.64s |  one number relationship.
230.56s - 232.36s |  There's two ways of doing that.
232.36s - 237.36s |  One way is to do the title of this talk, a substitution.
237.52s - 240.52s |  You're replacing the real letters, the real characters
240.52s - 243.08s |  for something obscure and different
243.08s - 245.00s |  in hopes of confusing people,
245.60s - 248.08s |  which seemed to work since a lot and a lot of people,
248.08s - 249.32s |  not a lot of people seem to know
249.32s - 250.80s |  what the name of the talk was.
251.68s - 254.40s |  The other thing you can do is you simply
255.72s - 260.72s |  scramble the letters, same letters,
260.76s - 262.88s |  just put them in a different order in some way
262.88s - 265.40s |  where the intended recipient knows
265.40s - 267.60s |  how to put it back together.
267.60s - 269.72s |  I can give you a real brief example.
271.08s - 274.48s |  This is an example of a transposition.
275.16s - 276.76s |  Anybody know what my shirt says?
280.38s - 284.58s |  Close, too many secrets, too many secrets.
284.58s - 285.42s |  Very good.
288.28s - 293.28s |  In terms of US history, back in the American Revolution,
294.08s - 296.24s |  there was codes and ciphers used
296.24s - 301.24s |  and an example of a code would be one if by land,
301.36s - 305.80s |  two if by sea, big long phrases reduced down
305.80s - 310.28s |  to just a light or two lights in a church bell tower.
311.84s - 316.24s |  There was also codes being used by the armies.
316.24s - 318.32s |  They had entire code books written up
318.32s - 321.56s |  where numbers would represent all sorts of words
321.56s - 326.56s |  and just as an example, there was Agent 711,
326.72s - 330.00s |  which was actually the code for George Washington,
330.00s - 334.90s |  General of the Army.
334.90s - 336.54s |  They also were using ciphers,
336.54s - 338.98s |  but in this particular instance,
338.98s - 342.34s |  they weren't using letters to replace letters.
342.34s - 346.26s |  They were using symbols, but it was still a Caesar cipher.
346.26s - 349.22s |  It was still a simple substitution system
349.22s - 351.54s |  and of course, Caesar cipher, that was actually used
351.54s - 353.82s |  by the Confederate Army in the Civil War.
353.82s - 357.18s |  They had a cipher wheel themselves,
357.18s - 358.62s |  which was part of the inspiration
358.62s - 362.26s |  for the cipher wheel that I designed many years later.
362.86s - 367.86s |  Freemasons, they have loved to use ciphers for many years.
369.46s - 371.58s |  The particular cipher they use,
371.58s - 374.14s |  these are examples of tombstones
374.14s - 376.62s |  of dead members of the Freemasons
376.62s - 378.62s |  and they often would leave messages,
378.62s - 382.26s |  encrypted messages on their tombstones
382.26s - 384.62s |  using something called a pigpen cipher,
384.62s - 387.22s |  where instead of letters, they would write letters
387.22s - 389.86s |  into like tic-tac-toe squares
389.86s - 391.78s |  and instead of the letters,
391.82s - 394.50s |  they would simply use the shape of the box
394.50s - 396.58s |  or the cell that the letter fell in.
396.58s - 401.46s |  This is kind of what it looks like.
401.46s - 403.78s |  If you've ever seen the movie National Treasure,
403.78s - 406.74s |  they have something that they call the Ottendorf cipher,
406.74s - 408.58s |  where there's a whole bunch of numbers
408.58s - 411.18s |  written on the back of the Declaration of Independence
411.18s - 415.02s |  and invisible ink and that translates to,
415.02s - 418.98s |  if you know the right book, the particular page of a book,
418.98s - 421.18s |  the particular line on the page
421.18s - 424.02s |  and the particular letter across the line.
425.42s - 427.02s |  That really kind of existed.
427.02s - 430.70s |  That is something that was done in the revolution.
430.70s - 432.30s |  It was called the Arnold cipher.
434.82s - 437.90s |  Others, examples of transpositions
437.90s - 441.86s |  and this goes back, I think it's to the ancient Egyptians.
441.86s - 444.82s |  They used to have a stick of a certain size
444.82s - 447.06s |  and wrap a leather strap around it,
447.06s - 450.42s |  write their message and then unwind it
450.42s - 452.82s |  and so it was just a bunch of random letters
452.86s - 455.02s |  written out on this big long strip.
455.02s - 456.70s |  They would send it to the recipient.
456.70s - 459.10s |  He would have to have the same size stick
459.10s - 462.74s |  to wrap it back together again and put it back in order.
462.74s - 465.18s |  Also something that was used that I learned about
465.18s - 466.70s |  in my early days was something
466.70s - 468.66s |  that's sort of like a crossword puzzle,
468.66s - 470.82s |  but you have a sort of a stencil,
470.82s - 473.14s |  a square with certain holes cut out of it.
473.14s - 476.38s |  You'd write your message in one letter at a time,
476.38s - 478.58s |  rotate it, keep going with your message,
478.58s - 480.14s |  rotate it and so on and so forth.
480.14s - 483.10s |  When you pull it up, you've got a square
483.10s - 485.22s |  filled with letters in a random order
485.22s - 486.82s |  that hopefully nobody could figure out
486.82s - 488.22s |  how to put it back together.
490.74s - 494.50s |  Another example of something that I learned back in my days
494.50s - 497.26s |  is something called a substitution cipher play fair
497.26s - 499.90s |  where you would put the letters of the alphabet
499.90s - 501.82s |  in a five by five square.
502.70s - 504.70s |  Of course, we had 26 letters in the alphabet
504.70s - 506.46s |  so we had to double up very commonly.
506.46s - 509.02s |  It was JK, but it could have been anything else.
510.14s - 512.14s |  The first ones were just simply A to Z,
512.14s - 515.06s |  but to add a level of complexity,
515.06s - 518.50s |  very often you would start using a keyword.
518.50s - 522.18s |  Did I do that?
522.18s - 528.46s |  Hey, who is this guy?
530.46s - 532.62s |  To add complexity, you'd start with a keyword
532.62s - 535.02s |  and write the letters of that word out in the square
535.02s - 537.26s |  and then you've used a letter once,
537.26s - 539.98s |  you'd fill in the rest of the square with the alphabet.
539.98s - 542.42s |  And then the way that you would do the encryption
542.42s - 546.50s |  and the decryption was basically create a square
547.34s - 548.62s |  with the letter that you wanted to write
548.62s - 553.30s |  and then make a square and find out what the cipher is,
553.30s - 555.50s |  if that makes sense to you by looking at it.
557.78s - 560.46s |  World War II, Navajo,
562.66s - 565.94s |  natives were enlisted to be radio operators
565.94s - 567.78s |  and code talkers.
567.78s - 570.66s |  The Japanese, the enemy never broke the code.
570.66s - 573.34s |  They were not only just speaking in their native tongue,
573.34s - 574.62s |  which apparently the Japanese
575.02s - 576.90s |  had a hard time understanding,
576.90s - 581.90s |  but they were using words to mean other things.
582.06s - 584.50s |  So you can see some examples there,
584.50s - 587.70s |  like a battleship was a whale, things like that.
587.70s - 590.22s |  Seems intuitive now that that would have made sense,
590.22s - 591.42s |  but it worked.
593.22s - 597.10s |  Machine encryption started becoming popular in the 30s
597.10s - 600.02s |  and most famously in World War II,
600.02s - 601.94s |  there was the German Enigma machine.
602.70s - 607.50s |  I went to work for the NSA in 1986,
607.50s - 608.94s |  was learning about things like this
608.94s - 611.34s |  and sort of basic courses that we took
611.34s - 613.90s |  to get introduced to the field,
615.02s - 619.06s |  mostly to try to bide our time while our clearances,
619.06s - 622.02s |  our background investigations were being completed.
622.02s - 625.38s |  I learned at that time in 1986
625.38s - 629.02s |  that we weren't telling people
629.02s - 630.74s |  that the Enigma machine had been broken
630.74s - 631.74s |  back in World War II.
632.54s - 633.38s |  That was still a secret.
633.38s - 636.38s |  It wasn't revealed to the public
636.38s - 640.02s |  that the Enigma machine had been broken in World War II,
641.18s - 645.78s |  prior to World War II until I think 1987 or 88.
645.78s - 649.90s |  The reason being there was still somebody out there
649.90s - 651.06s |  that was using it.
652.58s - 657.58s |  It was first broken in 1938 by Polish cryptographers
657.70s - 661.38s |  and used for 50 years after that.
662.06s - 664.14s |  And we kept a secret that we knew how to break it.
664.14s - 666.30s |  I don't think there's anything else that we've ever done
666.30s - 669.66s |  in terms of secrecy that's held up that long.
671.06s - 674.14s |  We being the US, we being NSA types.
675.46s - 679.26s |  Some of the radios and equipment that were being used
679.26s - 681.82s |  when I was there at NSA back in the 80s and 90s,
681.82s - 683.94s |  a lot of these were Vietnam era,
683.94s - 688.22s |  but again, it was about communication security.
688.22s - 689.46s |  When I first went to work
689.46s - 691.58s |  for the defensive side of operations,
691.58s - 694.42s |  it was called ComSec, communication security.
694.42s - 698.14s |  Shortly after that, it was renamed to information security.
698.14s - 699.82s |  So we called it InfoSec.
702.97s - 704.25s |  But some of these radios,
704.25s - 706.81s |  initially they would take an analog signal
706.81s - 709.97s |  and they would apply an encryption algorithm,
709.97s - 712.25s |  usually built into a little black box
712.25s - 714.41s |  because that's what NSA built in those days
714.41s - 716.61s |  with key being applied to it.
716.61s - 718.61s |  So there was encryption involved
718.61s - 720.53s |  and then a receiver on the other end
721.25s - 723.37s |  that could reverse the process.
723.37s - 726.45s |  Later on, there was radios and devices
726.45s - 729.53s |  that would convert the analog signal to digital
729.53s - 731.93s |  and then do the encryption of the digits,
731.93s - 735.37s |  send it and then do the whole process in reverse.
737.33s - 739.17s |  These are just different examples.
740.65s - 744.41s |  One other way to try to defeat the enemy from,
744.41s - 747.53s |  or adversary from intercepting the signal
747.53s - 749.05s |  was not only encrypting it,
749.05s - 751.53s |  but trying to hide it across frequencies.
751.53s - 752.93s |  So send a little bit here,
752.93s - 755.73s |  then using some sort of random algorithm
755.73s - 757.77s |  that was predictable on both sides,
757.77s - 759.61s |  send more and more of the signal
759.61s - 761.81s |  just on different frequencies.
761.81s - 763.05s |  Interestingly enough,
763.05s - 768.05s |  that concept was invented
768.05s - 772.09s |  by Hedy Lamarr, a movie actress from the 1920s.
773.97s - 775.61s |  That's just a shout out to women.
775.61s - 777.45s |  We need more women in industry
777.49s - 782.06s |  because they're smarter than us men very often.
782.06s - 784.62s |  As the systems advanced,
784.62s - 787.62s |  keys needed to be more complex and longer
787.62s - 790.58s |  and keys needed to be changed frequently.
790.58s - 793.02s |  And when you were putting it into a little black box,
793.02s - 795.54s |  you needed to have key machines
795.54s - 797.54s |  that inject the keys.
797.54s - 801.06s |  So these are some examples of key injectors.
802.86s - 805.86s |  This was something that was trying to be popular.
806.86s - 809.78s |  Again, when I was at NSA in the late 80s,
809.78s - 811.86s |  sort of trying to get modern.
811.86s - 814.38s |  So they had a little thing called a KL-43
814.38s - 816.90s |  that had a keyboard and had a little LCD screen
816.90s - 819.62s |  that I think held, you could see 32 digits.
819.62s - 822.06s |  And the idea was you type in a message
822.06s - 824.98s |  and it would immediately be encrypted on the screen.
824.98s - 827.14s |  Usually it would be output to,
828.26s - 830.94s |  gosh, we didn't have thumb drives back then.
830.94s - 833.02s |  It would either be transmitted automatically
833.10s - 836.02s |  or be printed out on paper for distribution.
836.02s - 839.26s |  But the idea was this was high tech,
839.26s - 842.22s |  self-contained encryption system
842.22s - 843.90s |  rather than a little black box
843.90s - 847.02s |  or a little black inside of a radio or a phone
847.02s - 849.30s |  or a little black box that the radio or phone
849.30s - 850.42s |  was attached to.
853.22s - 856.38s |  Stu-3 telephone was what we were using at the time.
856.38s - 860.22s |  So it was one of the first times that NSA put out
860.22s - 862.42s |  for bid to a contractor
863.26s - 866.94s |  an idea of, you know, NSA came up with the specs,
866.94s - 870.94s |  but different contractors bid on the idea
870.94s - 872.98s |  of how to make a secure phone.
873.94s - 875.50s |  These secure phones were starting
875.50s - 877.38s |  to use public key cryptography
877.38s - 880.62s |  and the keys were seeded with these things
880.62s - 883.18s |  that looked like keys, but you had to stick it in,
883.18s - 886.30s |  turn it, have it, read it and set it up.
886.30s - 889.54s |  And the first ones were half duplex,
889.54s - 891.42s |  which means kind of like a walkie talkie.
891.42s - 894.78s |  It's pushed to talk, one way communication,
894.78s - 897.66s |  then you let go and then the other person would talk back.
897.66s - 901.82s |  On a telephone, that was often very difficult.
901.82s - 903.70s |  And because of the encryption,
904.86s - 906.50s |  when you used it, you kind of sounded,
906.50s - 908.10s |  the people on the other end kind of sounded
908.10s - 913.10s |  like Donald Duck, but it was modern technology at the time.
913.82s - 915.34s |  And eventually they were able to put it
915.34s - 919.54s |  into smartphones, cell phones, so it became more portable.
921.70s - 924.02s |  Very briefly, you know, now we're in the age
924.02s - 926.62s |  of digital cryptography, things have evolved.
928.86s - 931.34s |  We all use cryptography every day
931.34s - 933.42s |  in our lives on the internet.
933.42s - 936.46s |  And there's probably a lot of you guys know this,
936.46s - 939.22s |  but there's basically two forms of encryption.
939.22s - 942.30s |  There's symmetric encryption where it's the same key used
942.30s - 945.22s |  on either end of the communication.
945.22s - 947.78s |  And the communication these days are websites
947.78s - 948.98s |  and so on and so forth.
949.46s - 953.58s |  And then the other type public key cryptography
953.58s - 956.66s |  is the idea of key pairs where it's a one way,
956.66s - 959.02s |  there's a public and a private key.
959.02s - 962.22s |  I hold my private key and give you my public key.
962.22s - 964.54s |  And I give all of you my public key
964.54s - 966.02s |  because you can encrypt a message
966.02s - 969.50s |  that I can only decrypt with my private key.
969.50s - 971.98s |  But for me to talk back to you,
971.98s - 975.66s |  I've got to get your public key and I can write a message
975.66s - 977.78s |  and send it to you and you're the only one
977.78s - 978.82s |  that can decrypt it.
979.66s - 981.74s |  Very simplified view.
981.74s - 984.18s |  There is a third form up in Canada
984.18s - 986.70s |  and it's called symmetric A encryption.
987.78s - 988.62s |  That was a joke.
990.26s - 994.06s |  Whitfield Diffie, he was affiliated with NSA
994.06s - 996.14s |  often on Diffie-Hellman algorithm.
996.14s - 999.10s |  I actually took a course with him early on at NSA.
999.10s - 1002.22s |  That's why I kind of threw his picture up there.
1002.22s - 1003.50s |  And then you got the modern age
1003.50s - 1005.74s |  and all the fun stuff coming like with quantum.
1005.74s - 1008.58s |  I don't wanna say that much about quantum cryptography.
1009.54s - 1011.10s |  The other big thing that's popular,
1011.10s - 1012.42s |  I just saw it earlier in the week.
1012.42s - 1014.54s |  I was down at that other conference
1014.54s - 1016.30s |  that we don't mention around here,
1016.30s - 1018.58s |  but the idea of homomorphic encryption,
1018.58s - 1020.18s |  which really rubs me the wrong way
1020.18s - 1022.06s |  because I spent my entire career
1022.06s - 1023.58s |  and learned about all the different ways
1023.58s - 1026.82s |  that we protect data, protect data, encrypt data,
1026.82s - 1029.74s |  with the idea that we're keeping things a secret.
1029.74s - 1032.18s |  But people are coming up with ways
1032.18s - 1034.50s |  of being able to encrypt data,
1034.50s - 1037.46s |  but still get meaningful information out of it.
1037.46s - 1039.94s |  I don't get my head wrapped around that very well.
1039.94s - 1043.38s |  I kind of think that, okay, it's neat technology.
1043.38s - 1044.78s |  It's a neat idea.
1044.78s - 1046.66s |  Just don't call it encryption,
1046.66s - 1050.14s |  but I'm losing that battle as many other battles.
1051.42s - 1054.50s |  Just in terms of why I kind of put this talk together,
1056.30s - 1057.26s |  several months ago,
1057.26s - 1059.74s |  I do a podcast called Paul's Security Weekly.
1059.74s - 1061.82s |  And gosh, it was probably a year ago.
1061.82s - 1063.50s |  We were talking to somebody
1063.50s - 1066.06s |  and somebody in the chat,
1066.06s - 1067.98s |  when we used to broadcast live,
1067.98s - 1070.50s |  was saying something about encryption and encoding.
1070.50s - 1072.46s |  And I'm like, you know, those are two different things.
1072.46s - 1074.10s |  And he's like, well, no, they're interchangeable.
1074.10s - 1077.90s |  So I like went out to Google the meaning of the words.
1077.90s - 1080.66s |  And I went, I found on Wikipedia,
1080.66s - 1084.82s |  the definition here and I'm reading through it.
1084.82s - 1088.22s |  And I'm gonna have to stick to my laptop here for a minute.
1089.54s - 1091.26s |  It says, well, you can read it,
1091.26s - 1092.86s |  but it uses encryption saying
1092.86s - 1095.10s |  it's the process of encoding.
1095.10s - 1100.10s |  And later on, it talks about cipher text, plain text.
1101.54s - 1104.58s |  But this has always been kind of a beef with me
1104.58s - 1107.06s |  because there's codes and there's ciphers.
1107.06s - 1109.74s |  And encoding is something you do with code.
1109.74s - 1112.18s |  And then ciphering is something you do with ciphers.
1112.18s - 1114.10s |  They're two different things,
1114.10s - 1116.46s |  but they're very often used interchangeably,
1117.30s - 1119.86s |  which bothers me because I'm a purist.
1119.86s - 1122.66s |  Another thing I found was another definition
1122.66s - 1125.18s |  and they talked to, oops, sorry.
1125.18s - 1128.50s |  They talked about secret codes
1128.50s - 1130.78s |  and there's talking about coding and decoding
1130.78s - 1132.86s |  and that's how you get ciphers.
1132.86s - 1134.54s |  That's not technically accurate.
1136.42s - 1138.38s |  If you remember, I shared this earlier.
1140.50s - 1143.90s |  This is sort of the summary of what codes and ciphers are.
1143.90s - 1145.58s |  And I kind of wanted to set out
1145.58s - 1147.74s |  and try to give some information
1147.74s - 1150.62s |  about why I say these words are wrong.
1150.62s - 1153.14s |  And the CFP that I submitted,
1153.14s - 1156.18s |  they gave me feedback that this was sounding subjective
1156.18s - 1158.58s |  and opinion-based, but it's actually not.
1159.62s - 1162.50s |  I have sort of the Bibles of cryptography.
1162.50s - 1164.62s |  They're just declassified at some point.
1164.62s - 1166.22s |  I was allowed to keep my copies
1166.22s - 1170.58s |  of military cryptanalytics volumes one and two
1170.58s - 1173.70s |  or part one and two written by gentlemen
1173.70s - 1176.14s |  that were very highly respected cryptographers
1176.14s - 1178.90s |  before World War II sort of became the pioneers
1178.90s - 1183.90s |  in the formation of NSA, Lambros Kalimahos.
1183.98s - 1186.74s |  And if you guys have gone to the village
1186.74s - 1188.86s |  and you've heard about the Goldbug Award,
1188.86s - 1190.82s |  there's also a society at NSA
1190.82s - 1194.18s |  of cryptographers called the Dundee Society.
1194.18s - 1196.90s |  You can see the explanation of it there.
1196.90s - 1200.18s |  But then also the other author was William Friedman.
1200.18s - 1201.10s |  Thank you.
1201.10s - 1204.86s |  Between he and his wife, Elizabeth Friedman,
1204.86s - 1206.54s |  they were sort of responsible.
1206.54s - 1208.46s |  They're sort of considered the godfather,
1208.46s - 1210.90s |  the godmother of cryptography.
1210.90s - 1212.06s |  So these are the authors.
1212.06s - 1213.82s |  These guys were the ones breaking the codes
1213.82s - 1215.74s |  and ciphers back in World War II.
1216.74s - 1220.48s |  So very quickly, the definitions that they wrote
1220.48s - 1224.02s |  that are written down are such,
1224.02s - 1226.34s |  and hopefully you can see it on the screen there.
1226.34s - 1229.18s |  I just wanna highlight a couple of things here
1229.18s - 1231.74s |  where, again, it's in writing.
1231.74s - 1235.42s |  Ciphers have to do with individual letters.
1235.42s - 1236.98s |  I say characters.
1236.98s - 1242.42s |  And then the codes have to do with words and phrases.
1242.42s - 1244.66s |  Oh, this is something I picked up.
1244.66s - 1247.24s |  I was reading, preparing for this this morning,
1247.24s - 1249.30s |  and I thought this was kind of interesting.
1249.30s - 1251.14s |  I hadn't noticed it before.
1251.14s - 1253.92s |  But there's a statement there that simply says
1253.92s - 1255.90s |  you do these things, you encrypt things
1255.90s - 1259.42s |  and create cryptograms for one of two reasons,
1259.42s - 1262.70s |  secrecy and economy or brevity.
1262.70s - 1263.90s |  And I thought that was interesting
1263.90s - 1266.54s |  because the way I was learning code and cipher,
1266.54s - 1269.30s |  especially when we're starting to get into computers
1269.30s - 1272.14s |  and internet technology,
1272.14s - 1275.90s |  encoding was always considered a way to shrink down,
1275.90s - 1278.50s |  compress the data so it could be sent quicker
1278.50s - 1279.98s |  and more easily.
1279.98s - 1283.22s |  And we never presumed that it was secure.
1283.22s - 1285.86s |  That's what the encryption was for.
1285.86s - 1289.78s |  So brevity or speed, coding,
1290.78s - 1294.62s |  secrecy, protection of what you're trying to transmit,
1294.62s - 1295.46s |  cipher.
1297.66s - 1301.14s |  And then finally, just a brief mention here again,
1301.14s - 1303.98s |  where they talk about the introduction of key.
1303.98s - 1307.54s |  And we know key now most commonly as certificates,
1307.54s - 1310.94s |  but key was really any method that was used
1310.94s - 1313.10s |  and agreed upon by both sides
1314.46s - 1318.54s |  as how you were gonna do the encryption, the protection.
1318.58s - 1322.02s |  Nowadays, it's mostly just throwing huge random streams
1322.02s - 1324.06s |  that hopefully nobody can figure out
1324.06s - 1326.18s |  and giving the random streams to both ends
1326.18s - 1329.38s |  to go through a very complex mathematical algorithm.
1329.38s - 1331.18s |  That's where we are today.
1331.18s - 1333.82s |  But just to summarize in terms of
1333.82s - 1335.54s |  why I think words have meanings
1335.54s - 1337.22s |  and why I think we need to understand
1337.22s - 1338.34s |  the meanings of the words,
1338.34s - 1341.38s |  even in our modern digital context
1341.38s - 1343.10s |  is going back to the fundamentals
1343.10s - 1345.94s |  of where they came from, codes and ciphers.
1345.94s - 1348.18s |  And I would suggest to you that again,
1348.82s - 1350.70s |  if you think about codes or encoding
1350.70s - 1354.62s |  as just a way to compress and increase speed,
1354.62s - 1356.94s |  not necessarily security,
1356.94s - 1358.86s |  that's where the cipher and the encryption
1358.86s - 1361.06s |  and the big long key streams come in.
1364.47s - 1368.43s |  Real briefly, it's all about protection of data,
1368.43s - 1370.11s |  information, keeping secrets.
1370.11s - 1371.55s |  You probably know about the idea
1371.55s - 1374.39s |  of confidential integrity and availability
1374.39s - 1379.31s |  and then digital age introduced things like non repudiation.
1379.35s - 1382.35s |  We spent most of our time in the digital age
1382.35s - 1384.67s |  focusing on the confidentiality.
1384.67s - 1386.11s |  Nowadays, we're trying to figure out
1386.11s - 1387.83s |  how to do the availability
1387.83s - 1391.35s |  because of all the ransomware attacks that are out there.
1391.35s - 1393.83s |  One last thing that cipher wheel I mentioned,
1394.71s - 1398.03s |  it was put on display at the National Cryptologic Museum
1398.03s - 1400.87s |  near Fort Meade, Maryland back in April.
1400.87s - 1404.19s |  And it's on display through September.
1404.19s - 1407.47s |  If you make it to Maryland, it's in a display case.
1407.47s - 1411.19s |  There I am looking at it and there's the display.
1411.19s - 1413.47s |  If you could probably not read it there,
1413.47s - 1416.31s |  but it says Jeff Mann reinvents the wheel.
1417.35s - 1418.55s |  So thank you very much.


url: https://www.youtube.com/watch?v=ocXSZRKmI0I
title: DEF CON 32 - Fitness of Physical Red Teamers - Lucas Rooyakkers & Billy Graydon
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=ocXSZRKmI0I",
  "title": "DEF CON 32 - Fitness of Physical Red Teamers -  Lucas Rooyakkers & Billy Graydon",
  "description": "Cybersecurity red teams have myriad ways of practicing their skills - from CTFs to certifications - but how do you train for physical red teaming? This talk will focus on leveling up your body - add new abilities to climb, sneak, jump, and become an unstoppable ninja while performing physical penetration tests. We\u2019ll talk about which abilities you need, and how we train ourselves (and our staff) for performing at our peak for physical engagements. This will be complemented by plenty of war stories and lessons learned in the field for what abilities are most worth leveling up in, and comparisons between red teaming before and after our weight loss. We\u2019ll then discuss different exercises and habits that the audience can start doing as soon as in your hotel room to improve your lives and your ability to break into buildings!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1493,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.02s - 5.82s | This text was transcribed using whisper model: large-v2

 So welcome everyone. I'm impressed at the size of the audience who came out, took
5.82s - 9.86s |  time out of your hacker talk, hacker con to listen to two of us talk about gym for
9.86s - 16.06s |  half an hour. So we're going to end with that and how you can train yourself up
16.06s - 21.66s |  but I'll start by talking about why and what specifically we're looking to
21.66s - 26.22s |  train towards for physical red teaming. So we're going to talk about hacking
26.22s - 30.50s |  physical spaces with the human body, using the human body for things that it
30.50s - 34.22s |  might not necessarily be designed to do or meant to do and that the physical
34.22s - 39.14s |  spaces we occupy were not or did not contemplate within their security model
39.14s - 42.58s |  and then we'll talk about red team fitness and how to train yourself up for
42.58s - 47.70s |  it. So brute force and we'll show you a couple fun examples of that and how
47.70s - 51.98s |  without even any tools you can get through some locked spaces. Fences,
51.98s - 57.06s |  climbing, spelunking, speed, rope work, all of that in order to get from the
57.06s - 62.97s |  outside to whatever the crown jewels are. So deformation and latching mechanisms
62.97s - 66.29s |  and frames and this is something that we talk about in the physical security
66.29s - 72.09s |  village every year in bypass 101. We've got a cool video of it that we're going
72.09s - 77.97s |  to be releasing this con as well. Particularly double doors with a pole in
77.97s - 80.53s |  between the two of them and we'll see how that works.
80.53s - 85.25s |  Lifting heavy garage doors is something you can do as well. So if a building is
85.25s - 91.73s |  locked but there's a garage door, oftentimes there's access control on the
91.73s - 96.53s |  motor that lifts that up but there's nothing actually to pin it shut and so
96.53s - 101.89s |  you just reach down and with sufficient force you can lift the bottom segments
101.89s - 108.49s |  of that high enough to roll under and let yourself in. Pulling a door to the
108.49s - 112.93s |  side in its frame which will then disengage the latch from the frame
112.93s - 117.37s |  itself and lifting and pulling to unpin double latch doors. So we'll go
117.37s - 122.89s |  through all of that. So here here's the the image of what happens when you just
122.89s - 127.49s |  take a door like this and pull it hard enough and so you'll see that that post
127.49s - 132.61s |  that's between the two double doors actually deforms to the side and the
132.61s - 136.97s |  latch then pops in because the door is now deformed and it's able to do that
136.97s - 143.45s |  and so just by grabbing the handle and pulling hard enough towards you and
143.45s - 148.61s |  using your body weight to support that leverage you can actually force open a
148.61s - 157.29s |  lot of commercial doors of this design with no tools whatsoever. When a door has
157.29s - 162.73s |  no center mullion and it's pinned at the top and bottom very similar things
162.73s - 167.69s |  happen except the door bows out when you pull it and that's actually enough to
167.69s - 172.69s |  pop out of the frame and pull the door open just by brute force. So this is
172.69s - 176.01s |  something that on pest pen testing engagements it's one of the first things
176.01s - 181.01s |  we check for is can someone just pull the door hard enough and oftentimes you
181.01s - 187.17s |  can and that's that's a big problem because threat model wise anyone can do
187.17s - 190.93s |  it and and people do and and we've worked a bunch of cases where that was
190.93s - 196.73s |  actually the case and there was a break-in and and that's how they got in.
196.89s - 203.29s |  Climbing is another thing so often we'll we'll complain about windows not having
203.29s - 206.11s |  adequate locks and they'll say oh well they do on the first floor well the
206.11s - 208.69s |  first floor isn't the only thing you have to consider and so when you have
208.69s - 215.05s |  this rustication on the on the masonry here that provides a perfect set of
215.05s - 221.01s |  hand grips to lift yourself up and get to the second story window. Scaffolding as
221.01s - 225.61s |  well so always be considering construction and what's happening in the
225.61s - 230.25s |  transitionary stages of a building and you can climb up scaffolding even up to
230.25s - 236.09s |  a second window or all the way up to the roof and oftentimes once you're onto the
236.09s - 240.01s |  roof you can get back into the building because that door is now in the exit
240.01s - 245.05s |  direction as far as the security was considered. False floors of course so
245.05s - 248.57s |  secure or so server rooms tend to use false floors to run the cabling under
248.57s - 253.93s |  them pop that open slide underneath and and access the server room false
253.93s - 259.41s |  ceilings we'll show you a video of that in a moment and and generally getting
259.41s - 262.89s |  around the exterior of buildings as a way to get to the interior in
262.89s - 269.93s |  unintended ways. So scaffolding as well this was we're we're from up in Canada
269.93s - 274.09s |  this was the the 2019 Raptors celebration in Toronto and all
274.09s - 279.21s |  scaffolding all around the city was completely inundated with people and so
279.21s - 283.37s |  that's something that's that does happen and of course you've got a whole lot of
283.37s - 287.13s |  distractions for the police if someone wanted to break in during an event like
287.13s - 295.01s |  this. So false ceilings this is something that you're aware of from a bypass
295.01s - 299.73s |  perspective that you need to harden that ceiling that someone can pop the false
299.73s - 303.89s |  ceiling out and climb over from a red teamers perspective though if you want
303.89s - 308.17s |  to take advantage of that you need to be fit enough to do it and so that involves
308.17s - 313.81s |  getting up there moving it out of the way not damaging these relatively
313.81s - 318.37s |  delicate thin aluminum ceiling brackets getting yourself up through and over
318.37s - 322.25s |  actually being able to fit through whatever holes there and drop down on
322.25s - 327.33s |  the other side. So it takes quite a bit of a physical ability that not a lot of
327.33s - 335.49s |  people have to do that. And then just climbing in general so big beefy gate to
336.01s - 340.61s |  block out this door but you can climb over it if you're able to do that.
340.61s - 346.01s |  Pipe shafts is another thing so we do a lot of assessments of offices that are
346.01s - 350.89s |  renting out a space in a high-rise building with other offices and if
350.89s - 356.45s |  someone can get to your much less secure downstairs neighbor access a pipe shaft
356.45s - 360.65s |  utility shaft elevator shaft whatever it might be from that less secure office
360.65s - 365.13s |  they can then climb up to yours pop themselves out in a mechanical room which
365.13s - 370.73s |  is deep within the core of your office and have at it from there. But again from
370.73s - 375.09s |  a red team perspective in order to take advantage of this you need to be fit
375.09s - 385.55s |  enough to squeeze in and scale up. Of course fences as well. Fences I mean we
385.55s - 391.67s |  the way over is obvious so we always harp on it that fences keep honest
391.67s - 396.59s |  people honest there's always a way over. In this case they got the barbed wire
396.59s - 400.71s |  right here but what the hell is this pole doing there it completely defeats
400.71s - 404.19s |  the purpose of that barbed wire and we'll show you in a minute what what
404.19s - 410.07s |  consequence that has. You can often untie the top squeeze the two parts apart and
410.07s - 413.75s |  squeeze through or even pull up the bottom wire of the fence which takes
413.75s - 417.55s |  some strength to do and you need to be able to fit under it but if you're able
417.55s - 424.47s |  to do that that's the way past those. So here's a quick video of that right
424.47s - 429.23s |  barbed wire fence but because of that fence post it completely defeats the
429.23s - 432.83s |  purpose of that barbed wire. Brace yourself against the fence post don't
432.83s - 436.87s |  know why that video didn't finish. Brace yourself against the fence post and
436.87s - 442.91s |  climb over bypassing the barbed wire entirely jump down the other side. So
442.91s - 446.95s |  that was a two or that was a five second bypass there of this barbed wire fence.
446.95s - 452.87s |  And of course if a fence is properly designed it does not have a post you can
452.91s - 458.83s |  grab you can throw a thick wool blanket over that and and use the barbed wire to
458.83s - 463.23s |  to support yourself that way. So so there's ways around it but you got to be
463.23s - 468.63s |  fit enough to do it. Cases like this these are common in garages and retail
468.63s - 473.67s |  protection they provide a nice little ladder themselves it's small you got to
473.67s - 478.43s |  be able to grab and and get your toes in there but you climb up swing yourself
478.43s - 482.67s |  around the top and that's a way in as well but of course you got to be able to
482.67s - 488.47s |  climb and you got to be able to fit. And so this is something that I I used to be
488.47s - 492.35s |  a hundred pounds fatter and so when I was doing red team engagements in that
492.35s - 497.61s |  shape we'd find situations with fences that you could pull up there was a gap
497.61s - 501.67s |  in the bottom cases where it abutted the wall of a building we could pull it
501.67s - 506.71s |  apart and squeeze through or thin gaps like this and and on our team we started
506.71s - 509.91s |  calling them fatty filters because everyone else was able to squeeze
509.91s - 515.59s |  through and then damn Billy has to find some other way around. So I'm able to get
515.59s - 518.99s |  through more of the fatty filters now but that's something as well that often
518.99s - 524.79s |  it's just a thin space that you have to squeeze through. An interesting example
524.79s - 527.95s |  of this and for those who are not familiar with it I encourage you to look
527.95s - 533.49s |  up the 2015 Clinton State Correctional Facility escape. So this was a high
533.49s - 539.27s |  profile escape where they used a number of impressive techniques to get out they
539.27s - 543.71s |  popped through the back of their cell into the pipe chase behind it which
543.71s - 547.43s |  supports the plumbing for their toilets and from there climbed down into the
547.43s - 552.31s |  steam tunnels below and so those tunnels were at times very tight difficult to
552.31s - 555.31s |  squeeze through you've got to be able to lift yourself squeeze yourself and
555.31s - 559.75s |  position yourself to get through it. The most impressive part was the escape
559.75s - 563.75s |  through the prison wall itself where they waited until July when the steam
563.75s - 568.83s |  was turned off and actually cut into the steam pipe and squeezed through the
568.83s - 572.67s |  inside of the steam pipe to get through that eight foot thick concrete wall and
572.67s - 578.99s |  then from within the steam pipe cut their way out on the other side and and
578.99s - 583.99s |  there were two two prisoners that made that escape one of which did most of the
583.99s - 589.15s |  manual labor there while the other did some of the social aspects of it but but
589.15s - 592.79s |  the second one was a bit more heavy set and he almost didn't make it just
592.79s - 598.03s |  because of the diameter of this pipe. So another thing thing to think about from
598.03s - 601.51s |  a threat modeling perspective when you've got high security correctional
601.51s - 606.19s |  facilities for people getting out and similar ideas for people getting in. The
606.19s - 611.03s |  the US military has standards for the maximum diameter of any utility pipe
611.03s - 614.95s |  bypassing a secure perimeter for exactly this reason and so you have to either
614.95s - 618.99s |  put reinforced grates across it or split it up into multiple pipes to prevent
618.99s - 624.34s |  someone from getting in that way. And then false ceilings as well this one you
624.34s - 630.10s |  get a bit of a leg up because we have a roof hatch ladder right on the one side
630.10s - 637.90s |  so we're popping up there and instead of going to the hatch climbing out into the
637.90s - 644.40s |  attic on the other side and you see there's a lot of utilities a lot of
644.40s - 650.28s |  sharp things a lot of delicate delicate supports to avoid there pop the ceiling
650.28s - 665.62s |  tile out on the secure side of that door and then drop our way down. So there's a
665.62s - 668.46s |  whole lot of control you have to have over your body and a whole lot of upper
668.46s - 675.50s |  body strength to be able to do that successfully. And so ladders in general
675.50s - 681.22s |  you see cages trying to prevent you from climbing them without without unlocking
681.22s - 685.98s |  it here sometimes they're badly designed and you can just climb the back and it's
685.98s - 689.50s |  still just a ladder but when that's not the case you got to be able to climb
689.50s - 693.06s |  that cage which is not particularly difficult to do if you train up for it.
693.06s - 698.51s |  And then sometimes it's too far you don't have enough handholds and you can
698.51s - 703.03s |  do rope work to get up and down so being able to repel being able to do a
703.03s - 708.43s |  rope ascender is something as well that that we can use in various circumstances.
708.43s - 714.47s |  And then the last relevant aspect is speed. So it does not matter if you set
714.47s - 719.75s |  off every alarm if you're gone by the time security arrives. So a couple
719.75s - 726.03s |  examples of that happening these are all all Apple stores that that got robbed in
726.19s - 736.74s |  this case 12 seconds. Come in start grabbing things and then run back out
736.74s - 773.06s |  and now the employees are catching on. Very similar case 12 seconds $27,000
773.06s - 781.74s |  take and so being able to pull that door open get through even if you set off an
781.74s - 786.66s |  alarm get to the crown jewels pull them out and make your exfiltration
786.70s - 792.34s |  successfully. No guards gonna be able to show up within 12 seconds unless they're
792.34s - 799.98s |  already on site and you do see that in most burglaries is there criminals know
799.98s - 804.98s |  to be in and out within five minutes if they can do that they're gonna evade any
804.98s - 809.86s |  security that might respond to them being there and so being able to do
809.86s - 813.38s |  these bypasses do these forcible entries do these climbing whatever you have to
813.38s - 821.18s |  do to get in and back out again in a quick period of time is is important. So
821.18s - 824.30s |  now I'll hand it over to Lucas who's gonna talk about how you can train
824.30s - 830.22s |  yourself up to be capable of all these things. Hi so I'm Lucas and briefly for
830.22s - 833.26s |  the second half of this presentation we're going to be going over the health
833.26s - 837.46s |  effects of fitness the fundamental movements and movement patterns of the
837.46s - 840.94s |  human body and how to do workout planning in order to increase your
840.94s - 845.18s |  capacity for red team engagements. So one thing I first want to show you is
845.18s - 848.90s |  the math of exercise and why it's an important routine to have or adds to your
848.90s - 856.22s |  daily life. Studies often you say that it is recommended to get 75 to 100 or 150
856.22s - 861.70s |  minutes this is an hour sorry 150 minutes per week of moderate to intense
861.70s - 866.86s |  to severe exercise and if you can do that one minute of exercising at this
866.86s - 870.78s |  rate in studies gives you two and a half minutes of additional life so if you
870.78s - 874.70s |  subtract out the one minute that you spend exercising let's every second you
874.70s - 878.14s |  spend exercising you get or every minute you spend exercising that's an
878.14s - 883.06s |  additional 90 minutes of bonus life and you'll be a fit old person as well and
883.06s - 886.46s |  it's there I'm not sure about studies that like look at the upper limits of
886.46s - 890.44s |  this but it's pretty hard to overdo it unless you're like basically training is
890.44s - 894.42s |  like a full-time athlete. So here's the study where I got that math from if
894.42s - 900.78s |  anyone wants to note down the DOI. So what is physical fitness? It is an
900.78s - 904.54s |  aggregate of several several different diverse metrics including your cardio
904.54s - 910.34s |  and aerobic capacity so how long you can run for and do cardio. Pure strength so
910.34s - 915.30s |  just how much you can lift even going slow at a slow rate. Power and explosive
915.30s - 919.50s |  capacity so how much you can like how high you can jump and how much weight
919.50s - 924.22s |  you can push very fast in a short period of time. As well as endurance so how long
924.22s - 929.86s |  you can keep doing a certain hard workload for and flexibility. I've got
929.86s - 935.78s |  different examples of all those here on the GIFs. So resistance training is a
935.78s - 941.62s |  very important part of physical exercise. In the past different Olympians and
941.62s - 944.78s |  other sports people would just train specifically for their sport because it
944.78s - 948.06s |  was thought okay if I just do running I'll just practice running forever.
948.06s - 952.42s |  However it's under the fear that if you spent too much time doing weight
952.46s - 955.66s |  training you'd become muscle bound and too much of an inflexible muscle head
955.66s - 959.58s |  who couldn't do anything except for like lift heavy rocks. But most athletes
959.58s - 962.58s |  nowadays generally follow a split where they're doing a large amount of
962.58s - 967.14s |  resistance training just generic strength training in the gym as well as
967.14s - 970.86s |  a small amount of a smaller amount of time dedicated to their sports specific
970.86s - 974.42s |  training when they're at higher levels. So because of that a lot of the
974.42s - 978.78s |  preparing for the red team physical fitness is just the same as being an
978.78s - 984.02s |  athlete which is doing weighted resistance training. So yeah there is no
984.02s - 987.26s |  muscle bound syndrome and the more weight you can lift and the more
987.26s - 991.70s |  strength training you do that generally increases your flexibility and joint
991.70s - 995.18s |  health and many many other things. And versus in the past it was worried that
995.18s - 998.46s |  if you became too much like Arnold Schwarzenegger you wouldn't be able to do
998.46s - 1003.06s |  much else. And here's an example of a famous Greek powerlifter named Kyriakos
1003.06s - 1007.30s |  Grizzly. This is a 400 pound man who can do the splits. So just demonstrating that
1007.30s - 1013.90s |  strength and flexibility and cardio are not orthogonal at all. Now there are
1013.90s - 1018.38s |  seven fundamental movements of the human body according to kinesiologists. There's
1018.38s - 1022.70s |  push motions so like doing push-ups or the bench press or the overhead press.
1022.70s - 1028.50s |  There are pull motions like pull-ups. There's the squat which involves just
1028.50s - 1032.74s |  knee bending. And then there's the hip hinge where your knees don't bend at all
1032.74s - 1037.90s |  but you just lean over this way so like the deadlift. There's the twist
1037.90s - 1042.70s |  clockwise as a fundamental movement and then the tists anti-clockwise. These
1042.70s - 1047.58s |  both count as two separate ones. And then the last movement is the farmer's carry
1047.58s - 1051.10s |  which to me doesn't seem like a movement. It's just when you're carrying heavy
1051.10s - 1056.66s |  weights and walking like this but according to kinesiologists it is. So
1056.66s - 1060.42s |  traditional strength and resistance training is meant to work these seven
1060.42s - 1065.74s |  fundamental movements. So one of the most important ones is the deadlift which is
1065.74s - 1070.38s |  just lifting a heavy thing off the ground. It involves a ton of back muscles
1070.38s - 1077.58s |  and your entire anterior chain and is mostly a hip hinge motion. Other gym
1077.58s - 1083.66s |  movements include, oops, the bench press which is our horizontal pressing motion.
1083.66s - 1092.09s |  Oh geez. The barbell row which is a pulling motion. So instead of pushing the
1092.09s - 1098.78s |  weight away we're pulling it away or pulling it towards us. The overhead press
1098.78s - 1104.98s |  so we have a vertical push motion and this works the shoulders mainly. Oops. And
1104.98s - 1109.50s |  then pull-ups which is a vertical pull. So here we've got horizontal push,
1109.50s - 1114.02s |  horizontal pull, vertical push, vertical pull, hip hinge, and squat. And if you just
1114.02s - 1119.14s |  train just these five exercises this vastly improves your whole body
1119.14s - 1123.10s |  strength and coordination because all of these movements are compounds that are
1123.10s - 1127.26s |  using many many muscle groups. So like you don't just need to go and just do
1127.26s - 1131.22s |  bicep curls. In this case doing these heavy compound movements that use many
1131.22s - 1135.10s |  many muscles and require a lot of coordination improves your overall joint
1135.10s - 1141.81s |  health and strength massively. And one that I'd like to emphasize importantly
1141.81s - 1146.73s |  is the deadlift. So the deadlift is basically every time I check and try and
1146.73s - 1149.69s |  remove this from my workout routine according to science there's just too
1149.69s - 1153.57s |  many positive things it does in such a short period of time. There's basically
1153.57s - 1157.01s |  no other exercise that works as many muscles as the deadlift in a shorter
1157.01s - 1162.17s |  period of time. And even in the studies where they try out various different
1162.17s - 1167.29s |  antidepressants and and and like exercises like running and SSRIs and all
1167.29s - 1170.89s |  of these different things that in I've seen various studies where the deadlift
1170.89s - 1177.37s |  just drastically outperforms every other treatment that was applied. It also fixes
1177.37s - 1181.85s |  your grip strength and massively boosts that and your forearm strength. It
1181.85s - 1186.41s |  completely fixes your posture because on the back there you have all these spinal
1186.41s - 1189.85s |  erectors. So if you're like us and you spend a lot of time at your computer
1189.85s - 1193.61s |  with a with like chronically bad posture like this the deadlift forces you to
1193.61s - 1199.37s |  snap that up and have a straight back. It's also good for fixing back pain
1199.37s - 1203.73s |  despite the fact that it looks like it would snap your lower back if you don't
1203.73s - 1206.45s |  learn the movements and how to tighten up and stuff. So it does take a little
1206.45s - 1210.49s |  bit to learn the form but there's basically no other single compound
1210.49s - 1214.85s |  movement you can do that is effective at fixing everything in your body at once.
1214.85s - 1220.25s |  And another one is squatting. I like this article called squatting is as
1220.25s - 1225.69s |  essential as brushing your teeth. So I wanted to read a bit of this. The deep
1225.69s - 1230.89s |  squat from a joint hygiene perspective is akin to brushing our teeth. We do not
1230.89s - 1235.37s |  simply brush the top one day, the bottom another day, and the side or back
1235.37s - 1238.89s |  whenever we feel like it. We brush every angle of our teeth every day. From my
1238.89s - 1242.09s |  perspective the deep squat movement is a toothbrush for our joints ensuring
1242.09s - 1245.53s |  they're all moving without sticking over restricted areas. And I took this
1245.53s - 1249.21s |  stuff a little bit too seriously because whenever I brush my teeth I try to do it
1249.21s - 1255.21s |  in a deep squat in order just to multitask. And actually so four
1255.21s - 1259.05s |  years ago I actually couldn't get into a deep squat like this. It literally took
1259.05s - 1262.25s |  me like several months of practicing. I go down as far as I can without
1262.25s - 1266.13s |  compromising my form and it took me like two months to even just be able to get
1266.13s - 1269.89s |  down here. So don't worry. All you have to do is keep working at it and every day
1269.89s - 1276.33s |  trying harder to get into that deep squat. Another aspect is cardio. As
1276.33s - 1281.25s |  you saw from the store or the videos of people hitting the Apple stores, it's
1281.25s - 1285.73s |  very important to be able to run fast. This can take many forms including
1285.73s - 1290.65s |  jogging, bicycling, swimming, dancing, or whatever makes you personally feel the
1290.65s - 1296.09s |  most comfortable doing it. This also increases your VO2 max which is how much
1296.09s - 1302.77s |  oxygen you can take into your lungs and how efficiently you can use it. One
1302.77s - 1306.57s |  aspect of cardio that is beneficial for your health, instead of just doing normal
1306.57s - 1311.09s |  steady state cardio and going jogging for a marathon for hours, it's probably
1311.09s - 1315.85s |  best for your health scientifically to try and do very intense sprints whenever
1315.85s - 1320.29s |  you can. So very high intensity intervals for 30 seconds and then you rest for a
1320.29s - 1324.33s |  minute or two and then do another 30 second all-out sprint. There's a
1324.33s - 1328.73s |  bunch of reasons that this levels up your mitochondria which is the
1328.73s - 1337.26s |  powerhouse of the cell. So yeah. So that's our general resistance training. The 20%
1337.26s - 1341.78s |  specific training that we want to do as Red Teamers basically focuses around
1341.78s - 1346.78s |  climbing. So this uses a lot of upper back and being able to do a pull-up is
1346.78s - 1350.46s |  is very, very useful for Red Team engagements because most of the exploits
1350.46s - 1356.38s |  we're doing involve just climbing over and around things. Climbing works a lot
1356.38s - 1360.02s |  of different areas of your body and has a lot of carryover effects to other
1360.02s - 1364.98s |  other things. And there are lots of ways you can do this from rock climbing to
1364.98s - 1374.32s |  bouldering, pull-ups, and parkour. However one particular item that I'm a fan of is
1374.32s - 1378.84s |  kettlebells which if I can only have one item for the gym it would be the
1379.24s - 1383.08s |  kettlebell. This I got really into these during COVID when all the gyms were
1383.08s - 1387.60s |  closed because it's just a tiny full comprehensive thing that fits in your
1387.60s - 1392.08s |  closet. So like just taking a kettlebell and swinging it up here and catching it
1392.08s - 1396.36s |  at the top is a full body movement that uses basically every single muscle in
1396.36s - 1400.24s |  your body. So just doing repetition kettlebell snatches for 10 minutes a day
1400.24s - 1403.48s |  is a full body workout. You don't need to worry about all these other complicated
1403.48s - 1407.28s |  movements. However if you're an ultra minimalist and you're stuck in your
1407.32s - 1411.48s |  hotel room for example you can't really go wrong with just burpees and body
1411.48s - 1415.48s |  weight squats. These are also just full body exercises that don't use any
1415.48s - 1418.48s |  equipment whatsoever that you can do anywhere just if you're in a prison
1418.48s - 1424.32s |  cell a hotel room or etc. Going slightly more advanced in the calisthenics area
1424.32s - 1428.64s |  if you can do dip bars and pull-ups just doing those are also pretty
1428.64s - 1433.00s |  comprehensive movements. And if you're feeling very advanced the one-arm push-up
1433.00s - 1437.16s |  the one leg squat and handstand push-ups are just like the limit of what you can
1437.16s - 1441.96s |  do with just purely your own body weight no equipment required. So a note
1441.96s - 1445.20s |  on habit formation if exercise is not already a part of your life and we've
1445.20s - 1449.12s |  convinced you that it should be remember that consistency is key so you just need
1449.12s - 1453.04s |  to pick something that you want to do whether that's sports resistance
1453.04s - 1457.36s |  training just going on daily walks after dinner or dancing or anything else. Only
1457.36s - 1461.52s |  an ounce of discipline is required to change your life. In this case most
1461.52s - 1464.64s |  people who go to the gym compulsively don't feel impressed that they do it
1464.64s - 1467.32s |  they have a habit and it would feel weird for them not to do it. There was
1467.32s - 1472.88s |  only about one brief period of habit formation where they it's sorry where
1472.88s - 1477.68s |  they actually need to apply discipline and do something you don't want. So yeah
1477.68s - 1481.96s |  the conclusion is try and get your 150 minutes a week of exercise for maximum
1481.96s - 1486.52s |  life extension but do whatever is easiest for you to do and maintain
1486.52s - 1491.72s |  consistently and discipline is freedom. Thank you.


url: https://www.youtube.com/watch?v=j7twZA6SBz8
title: DEF CON 32 - I am still the Captain now! - Paul Brownridge
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=j7twZA6SBz8",
  "title": "DEF CON 32 - I am still the Captain now! - Paul Brownridge",
  "description": "Fresh from his DEFCON 31 marsec village talk, 'I am the Captain now', Paul has another year's experience at sea from which to share stories of taking control of vessels.\n\nAs it's timely, he will look at why the MV Dali incident wasn't a hack, dispelling ill-informed opinions from the wave of armchair experts that suddenly emerged, but more interestingly, ways that it so easily could have been a cyber event.\n\nFinally, maritime cyber regulation is starting to catch up, but so many operators and technology providers are likely to be caught out by IACS UR E26 & 27",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1199,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.62s | This text was transcribed using whisper model: large-v2

 So good afternoon, everybody. And welcome. This is my amazing
4.62s - 7.42s |  in my second talk at DEF CON. It's such a privilege and honor
7.42s - 11.42s |  to talk once at DEF CON, but twice. It's just unbelievable.
11.74s - 14.58s |  So before I continue, I'd like to thank my colleagues, Kerry
14.58s - 20.42s |  Coburn, John Waksmanski, Mike Leonard, Ken, and yeah, the rest
20.42s - 24.38s |  of the P2P team that are here helping out. I couldn't have
24.38s - 27.74s |  done this presentation without them. So I got to do the
27.74s - 31.36s |  obligatory. Who am I? So my name is Paul Brownridge.
31.40s - 35.44s |  Obviously, I started my working life as an engineer in Cape Town
35.44s - 40.32s |  in South Africa. I have an OT background, then just by a
40.32s - 44.40s |  series of accidents, found myself into working in
44.40s - 48.74s |  cybersecurity. So I do a lot of OT testing, maritime, IoT, APIs, a
48.74s - 52.00s |  lot of interesting stuff. I mean, we do a lot of interesting
52.00s - 55.92s |  stuff. So quite topical, probably something that's been
55.92s - 60.34s |  talked about maybe five or six times at this conference is the
60.34s - 65.90s |  MV Dolly. Is it hacked? Well, there's a lot of lot of opinion
65.90s - 68.26s |  on on the internet, right? Everybody's an armchair warrior
68.26s - 71.90s |  at the end of the day. They reckon yes, it was hacked.
71.90s - 75.06s |  Definitely. It's deep state, etc. Other people say no, not
75.06s - 78.74s |  possible. I think that once you understand how ships are
78.74s - 82.50s |  architected, you understand actually that maybe the answer
82.50s - 85.10s |  is somewhere in the middle. And what I'm going to be doing is
85.10s - 88.64s |  going to be going through the individual systems, examining
88.64s - 92.80s |  some of the the attack surface and maybe some of the threat
92.80s - 98.12s |  vectors and that. So really sort of like a high level view of the
98.12s - 102.74s |  systems on the ship. So to be quite honest, you know, before I
102.74s - 105.08s |  came across this picture, I didn't know how much damage the
105.08s - 107.66s |  ship actually done, which is quite scary, isn't it? I mean,
107.66s - 111.08s |  that is a mess or somebody's not getting getting the bonuses
111.08s - 116.88s |  here. And okay, so let's start with the main engines. So the
116.88s - 121.72s |  picture that you see over there, that is a typical engine on a
121.72s - 126.48s |  container ship. It's one engine. It differs from other engines
126.48s - 129.56s |  that you're used to in that it's supported by ancillary system.
129.56s - 134.36s |  So there's pumps, for instance, they handle the cooling, the
134.36s - 139.04s |  fuel injection, etc. And these are handled by generators in
139.04s - 144.16s |  redundant arrays. The generators will power the
144.16s - 147.04s |  steering without any power. Obviously, there's no steering.
147.44s - 150.96s |  And this is all organized by the power management system. So the
150.96s - 157.48s |  PMS that is in turn, managed by a network control system called
157.48s - 160.52s |  the integrated alarm and monitoring system. And then you
160.52s - 164.12s |  have these multiple systems all over the ship that tie into it
164.16s - 168.84s |  by a series of either serial connections, either IP over
168.84s - 174.72s |  serial, etc. And we will take a look at those in turn. And of
174.72s - 177.68s |  course, we've got the steering controls, right? We have the
177.68s - 182.48s |  controls at the helm, tied into autopilot. And it's important to
182.48s - 185.28s |  note that at this time, there is a physical switch that if
185.28s - 189.04s |  anything goes wrong, you can turn that off. It's as we go
189.04s - 190.96s |  through these slides, it's something to note all the time
190.96s - 194.76s |  that is always going to be somebody in charge, which is
194.76s - 198.96s |  really important. So there we go the helm, the steering gear, the
198.96s - 202.92s |  steering flat, which is basically a deck that you can
202.92s - 206.32s |  steer the ship from any emergency situation, you can
206.32s - 210.52s |  manually control the ship in case anything goes wrong. All
210.52s - 213.56s |  right. Then of course, the systems tie into the rudder. And
213.56s - 215.88s |  the steering gear, as I mentioned the previous slide,
216.16s - 221.24s |  it's all tied in with the generator. So this is you can
221.24s - 223.12s |  see the picture on the left hand side. This is what you see in
223.12s - 225.52s |  the movies, right with the telegraph, you know, full steam
225.52s - 230.20s |  ahead. But on the right hand side, this is the more modern
230.20s - 233.64s |  derivation of that. It's important to note that a lot of
233.64s - 238.80s |  these systems are tied down to certain revs so that it doesn't
238.80s - 242.32s |  cause any potentially dangerous vibrations on the ship. Or
243.08s - 246.04s |  sometimes it's also economics as well, because a ship will have
246.04s - 251.16s |  a most economical, I can say, revolution band, and there'll be
251.16s - 253.60s |  tying into that. What's important to note that at any
253.60s - 257.04s |  time of this, yet again, the captain can override any of
257.04s - 262.84s |  these controls. So if there's a blackout on the ship, like what
262.84s - 265.44s |  happened to Emi Dali, right? What are the procedures to
265.44s - 267.92s |  restart this? Well, normally, it's as simple as pressing a
267.92s - 270.68s |  single button on the screen. But how do we do this when the rest
270.68s - 274.28s |  of the ship does not have any power, right? So it could
274.28s - 276.92s |  involve using controls local to the generator start. So you could
276.92s - 280.24s |  send your engineers down there, waiting for it to come up to
280.24s - 283.72s |  speed, and then closing breakers, for instance. And this
283.72s - 287.80s |  is important to note, because it's a process like any OT
287.80s - 291.92s |  system, any refinery, any chemical processes, everything
291.92s - 294.92s |  works in a sequence. There's no just like one button, bam, it
294.92s - 299.80s |  comes on. It's a series of processes. Sometimes you have
299.80s - 302.72s |  manual management of the system will need to be performed. As a
302.72s - 305.88s |  load is drawn by the ship, this would take 30 seconds normally,
305.88s - 309.92s |  but you never know, and it might take several. But according to
309.92s - 314.40s |  regulations, your emergency generator should come on 45
314.40s - 318.04s |  seconds. But as we all know, in the real world, right, that
318.04s - 321.72s |  hardly ever happens. I mean, that's the ideal state. So what
321.72s - 324.92s |  could take or is supposed to take 45 seconds could take
324.92s - 330.12s |  minutes. And if you are in the open sea, with a blackout, and
330.12s - 333.28s |  your ship is coasting, that is not a problem, right? But if
333.28s - 337.36s |  you're approaching a bridge or a built up system, just 45
337.40s - 340.28s |  seconds or even sometimes if these systems don't start, a
340.28s - 344.40s |  minute or two minutes can end in emergency, like we saw in the
344.40s - 349.76s |  previous slide. So what triggers a blackout? Well, bad fuel.
349.76s - 352.56s |  Yeah, some of the cheapy fuel that you pick up at these ports,
352.56s - 357.20s |  right? Ship rolling, some of the heavy seas can cause loss of
357.20s - 361.12s |  pressure and cause the ship to blackout. Electrical problems,
361.12s - 365.40s |  bad maintenance, etc, etc. It's long. The older the ship, the
365.40s - 370.68s |  worse these problems get. And cruise ships do blackout. 2013
370.68s - 375.76s |  Carnival Triumph was out of commission for a few days, due
375.76s - 380.08s |  to the battery power fail several times. In 2019, the
380.08s - 384.24s |  Viking Sky generator was out for service maintenance. Yet again,
384.24s - 386.76s |  we see this. So it's totally possible that these
386.76s - 392.60s |  circumstances can exist, that a ship can blackout. So like I
392.60s - 396.56s |  said, you know, all the armchair warriors on the internet saying
397.32s - 401.76s |  it was a hack. Well, we'll see. So let's take a look at the
401.76s - 407.76s |  autopilot. So as we go, as we saw a slide early on, the
407.76s - 413.32s |  autopilot can connect directly to the engine. But it's always
413.32s - 416.36s |  possible to disconnect the autopilot and steer manually. As
416.36s - 418.92s |  I said, this is very important. There's always a human in the
418.92s - 423.40s |  loop. But if we take a look at the threat landscape, we're
423.40s - 425.88s |  finding more and more that these systems are connected up to the
425.88s - 430.92s |  internet. So firmware downloads and that. And that if we sort of
430.92s - 433.80s |  break it down, and we can see this almost becomes like a sort
433.80s - 437.52s |  of supply chain attack. But then you'd have to compromise the
437.52s - 442.04s |  firmware supplies. You have to sign the firmware. So yes,
442.04s - 445.80s |  possible, but very unlikely, unless you really expend a lot
445.80s - 450.80s |  of energy going back and hacking the spyware. Propulsion, rarely
450.80s - 453.56s |  connected to the internet. These are big, big chunky machines.
453.84s - 457.80s |  This is your typical OT versus IT segregation at the end of the
457.80s - 462.64s |  day. Attacks unlikely. And if it did happen, the bridge could
462.64s - 466.08s |  manually override yet again, somebody, a person's in the
466.08s - 471.10s |  loop. The power systems frequently network connected,
471.10s - 474.86s |  fair enough. Right. And this is one of those, those, those
474.86s - 477.38s |  situations are just becoming more and more connected as the
477.38s - 480.78s |  years go by. But attack is unlikely in an event happening
480.78s - 483.70s |  the bridge could manually override. Yet this recurring
483.70s - 487.58s |  theme is that there's always somebody that can change a ship
487.58s - 492.82s |  or it's going to be on bridge, etc. So conclusion, yes, ships
492.82s - 495.62s |  can be hacked, but it takes time. It's a manual process,
495.66s - 502.02s |  whoopsie-daisy. And was the MVW hacked? Well, no. It's
502.02s - 505.82s |  practically impossible. I mean, it's possible, but it's very,
505.82s - 508.34s |  very improbable. You need a large amount of time over there.
509.06s - 511.06s |  You need to know the systems, you basically need to need
511.06s - 514.22s |  engineer, tons of social, social engineering. So for an
514.22s - 516.94s |  armchair hacker from, I don't know, your nation state
516.94s - 519.10s |  somewhere, like hacking into the ship, very improbable.
519.90s - 523.66s |  Unfortunately, polarized views from uninformed commentators do
523.66s - 526.30s |  not help. You need to understand how these ships are
526.30s - 535.90s |  architected. So last year, I had about 150 slides. And I managed
535.90s - 541.42s |  to get to 120 of them before time got called. So I blasted
541.42s - 545.02s |  through 30. So I'm going to do a recap of what I did last year.
545.10s - 552.38s |  And yeah, so this is the systems recap. Integrated Control and
552.38s - 555.10s |  Monitoring System. This is the brains, the eyes of the ship.
555.42s - 560.54s |  This controls the PLCs in the engine room, rider control,
560.54s - 564.78s |  power management, these extremely, extremely important
564.78s - 569.14s |  piece of equipment. Without it, the ship cannot operate. So from
569.14s - 572.74s |  an attacker's point of view, this is a high value target. So
572.74s - 574.62s |  it's something that we take a look at all the time while we're
574.62s - 579.82s |  busy pen testing ships. This is the ECDIS, the charting system.
580.54s - 585.34s |  This is these running redundant arrays. Basically, as you can
585.34s - 589.66s |  see, there's a map on there, it tells you where you are in on
589.66s - 595.22s |  the ocean. Obviously, without it, the captain could not know
595.22s - 597.18s |  where he's supposed to be going and the crew don't know where
597.18s - 599.66s |  they're going or where they are. So if these systems go down,
599.66s - 603.14s |  then the ship has got to stop. But failing that, simply with
603.14s - 607.38s |  some of the older ships, we got some old school maps, right? You
607.38s - 609.82s |  can see the drawers over there. Those are actually all charts
609.82s - 613.18s |  from the oceans around the world. And these get delivered
613.18s - 618.26s |  by hand whenever there's an update. So it's quite, it's
618.26s - 621.42s |  quite reassuring that you still have these manual methods of the
621.42s - 625.06s |  ship knowing where they are at the end of the day. Safety
625.06s - 629.26s |  management system. So this is a separate room, usually near the
629.26s - 636.70s |  bridge, that whenever there's an emergency situation on board, it
636.70s - 639.70s |  is organized over here. So this is very interesting from
639.70s - 642.98s |  attacker's point of view, because it has tendrils into
642.98s - 648.58s |  the rest of the ship. It is from the ICMS all the way to the
648.58s - 656.54s |  ectus, pressurized doors, CCTV, fire alarm systems. This is so
656.54s - 659.54s |  important at the end of the day, because you basically can
659.58s - 665.78s |  coordinate like somebody like with the lifeboats, etc. It's
666.38s - 669.98s |  something to note as well that as the crew is running around
669.98s - 674.38s |  trying to organize a emergency situation, they can use these
674.38s - 678.50s |  iPads or these window systems to log in and take a look at what's
678.50s - 683.72s |  going on at the same time. It's an idealized version of the IT
683.72s - 686.80s |  versus OT system of ship, we've got internet coming down by
686.80s - 690.36s |  VSAT into the core, we've got the corporate network, because
690.36s - 693.60s |  as usual, you got your bean counters on the ship, your
693.60s - 696.64s |  accountants and your people, then you got third parties,
696.64s - 702.08s |  something like point of sales, etc. And your crew is obviously
702.08s - 704.84s |  you know, you need to provide Netflix, etc. for your crew. And
704.84s - 708.28s |  that's split up into Wi Fi and wired. You can see the line down
708.28s - 713.80s |  the middle, you see the bridge and the engine room. And this is
713.84s - 717.96s |  what you want in the real world, but it doesn't always work out.
718.00s - 721.32s |  Because, yeah, we'll see a little bit later. This is really
721.32s - 725.76s |  how it looks like it's a mess. So it comes on the VSAT into the
725.76s - 729.40s |  core network, and then RDP, not their protocol, but remote
729.40s - 733.40s |  distribution points. And these are basically just big chunks of
733.40s - 735.96s |  Cisco equipment, we can see in the next slide. And these are
735.96s - 741.40s |  broken down via VLAN trunks into cabin switches. This is
741.40s - 744.60s |  basically what it looks like this on the ship. So you anybody
744.60s - 748.72s |  who's been in a data center, any on prem stuff, it looks exactly
748.72s - 752.48s |  the same. It's all off the shelf stuff. It's nothing bespoke for
752.48s - 759.48s |  the maritime industry. Breaking down further, we have the VLAN
759.48s - 764.16s |  trunking down to the cabin switches. And we have it split
764.16s - 769.88s |  off into TVs, VoIPs, light, Wi-Fi, CTV, TV. The most
769.88s - 773.72s |  important thing to remember on all this is it comes down over a
773.72s - 776.92s |  single connection, right? And as an attacker, that is very
776.92s - 780.68s |  interesting. So we got the propulsion system. This is
780.68s - 783.36s |  Azipod. In the olden days, you used to have the, you know, the
783.36s - 786.96s |  big rudders that used to, you have the prop wash. But now
786.96s - 791.16s |  these are independent systems that you can control from the
791.16s - 795.64s |  ICMS. And actually, the recent ones that we tested are
795.64s - 799.64s |  controlled by Wi-Fi, just normal 2.4 gig Wi-Fi, right? Which is
799.64s - 802.36s |  quite scary at the end of the day. This is not even dedicated
802.36s - 809.21s |  cables at the end of the day. So yeah. So one of the things
809.21s - 813.53s |  when we test ships is we walk around, this goes back to my
813.53s - 816.73s |  early days in refinery, is you see pipes everywhere, you see
816.73s - 818.33s |  cables going everywhere, you don't know where everything is.
818.33s - 822.45s |  So you spend such a large amount of time chasing stuff down. And
823.05s - 827.37s |  because ships have this churn of engineers, etc., a lot of
827.37s - 830.97s |  people don't know where the systems do, or even sometimes
830.97s - 833.21s |  they leave the systems on, because they're too afraid to
833.21s - 834.65s |  turn them off, because they don't know what it does, but
834.65s - 836.49s |  they don't want to turn it off at the end of the day, right? So
836.49s - 838.61s |  in case something goes wrong, it's like, okay, cool. So you
838.61s - 842.33s |  have systems just running like this constantly. So we knew
842.33s - 846.21s |  there was something coming in that monitored the fuel
846.53s - 849.29s |  consumption. But we didn't know where it was, right? So
849.61s - 853.41s |  eventually we opened up the panels, and we put it inside,
853.73s - 857.53s |  and we found this little bugger over here. This is like a
857.53s - 861.85s |  rugged PC. It's a Windows-based PC. But we wanted to know more
861.85s - 865.25s |  of what it did, right? So you can see on the side over there,
867.05s - 870.01s |  anybody who worked with OT systems a lot, you'll recognize
870.01s - 872.53s |  that little box over there. That's an IP to serial
872.53s - 875.93s |  connector. So what it does, it takes IP, Internet Protocol,
876.41s - 884.37s |  then it changes it into serial bus. Now the thing is when you
884.37s - 888.85s |  work in OT at the moment, these systems have been around for 30,
888.85s - 892.53s |  40 years, and they still operate on discrete systems. So this is
892.53s - 899.09s |  why you have the IP to serial. So we wanted to model the attack
899.09s - 903.93s |  surface and that. So what we did is we took a look. So we knew
903.93s - 906.97s |  that the IP to serial was going to the bridge ICMS. This was
906.97s - 912.21s |  going to the charting system. So it would track where we were at
912.21s - 914.93s |  a certain time from one distance to the next. But it was also
914.93s - 918.45s |  talking to the PLCs on the main engine. It was asking for
918.45s - 921.09s |  revolutions a second. It was asking for maybe fuel
921.09s - 925.93s |  consumption. And then it was doing some fancy mathematics.
925.93s - 931.13s |  It was predicting the fuel consumption. So what we did is
931.13s - 934.85s |  once we took a look at the IP to serial connection going to the
934.85s - 938.69s |  bridge, we noticed that instead of three wires, you can see
938.69s - 942.21s |  there's two wires. There's the ground and one of the serial
942.21s - 945.73s |  connections in there. We noticed that one of the wires was
945.73s - 950.01s |  missing. So usually when you have a serial to serial
950.01s - 954.21s |  connection, you pull the PLC or the piece of equipment and it
954.21s - 957.05s |  will talk back to you. But that's how it would normally
957.05s - 959.85s |  happen. What we found is it was transmit only. So the piece of
959.85s - 963.25s |  equipment was just taking from the bridge, which is great. From
963.25s - 965.53s |  attackers point of view, there's nothing you can do. You can't
965.53s - 969.45s |  inject anything down the line. Fantastic, right? But then we
969.45s - 973.01s |  started taking a look at the connection from the IP to serial
973.01s - 977.25s |  to the PLC. And that was using Modbus. Now Modbus, five
977.25s - 982.89s |  minutes. Seriously? All right. So it's using Modbus, right? And
982.89s - 987.37s |  Modbus was, that went quickly, right? And Modbus is like a, you
987.41s - 989.97s |  have to call out to the piece of equipment for it to broadcast
989.97s - 994.13s |  its value to you. So this is, this is interesting from
994.13s - 996.57s |  attacker's point of view because now we have access to the
996.57s - 1000.57s |  machine. So now we can inject values into the PLCs at the end
1000.57s - 1003.05s |  of the day. And in terms of attack surface, this is very
1003.05s - 1007.69s |  interesting to us. However, what was more interesting, forgive
1007.69s - 1010.33s |  like I said, I got lots of slides, right? So what was more
1010.33s - 1013.17s |  interesting, we took a look at the system and we noticed we had
1013.17s - 1019.53s |  TeamViewer on there, right? So yeah, yeah. I mean, what is more
1019.53s - 1023.21s |  amusing, even more amusing, was that the fact that the company
1023.21s - 1025.85s |  actually had stopped paying for the service four years before,
1025.85s - 1027.81s |  right? But they were too afraid to turn it off, like I was
1027.81s - 1032.33s |  saying before. So you had a machine that was not updated. It
1032.33s - 1036.53s |  was still connected to the internet. You could potentially
1036.53s - 1039.17s |  connect up to the PLC and ruin everything at the end of the
1039.17s - 1043.57s |  day, right? So it was, we found this very amusing. But it was
1043.57s - 1048.05s |  good. I, yeah, I'm going to have to blast through my slides
1048.05s - 1052.41s |  again. I'm really sorry about this, guys. But how many
1052.41s - 1065.83s |  minutes? Three minutes? Two minutes? Okay. Shit. Okay. So I'm
1065.83s - 1069.35s |  going to blast through my slides quick. Next year when you come
1069.35s - 1071.55s |  and see me talk, I'll do this properly. I'll do this first so
1071.71s - 1077.51s |  I can actually get through this time. Basically, TLDR, we
1077.51s - 1081.75s |  managed to compromise the trusses system from our cabins
1081.75s - 1087.53s |  at the end of the day. So I'm going to run to the conclusion.
1087.53s - 1099.46s |  Those are really interesting slides, aren't they? Sorry,
1099.46s - 1107.78s |  guys. See TeamViewer again? Yeah. Okay. So I'm going to hack
1107.78s - 1110.38s |  it up. So I actually had some stuff about regulation as well,
1110.38s - 1112.54s |  but that's very boring. Nobody wants to go through that. Okay.
1113.18s - 1120.22s |  So ships can be hacked, but it takes time and it takes
1120.22s - 1122.98s |  presence. One of the things that we noticed that we have the
1122.98s - 1125.26s |  advantage of when we're on the ship, we can talk to engineers,
1125.50s - 1128.06s |  we can look at the documentation, right? We can see
1128.06s - 1131.82s |  what's going on. We can run the lines. In an idealized world,
1132.58s - 1136.06s |  hackers are not going to sit on the other side of the world, go
1136.06s - 1138.82s |  through the V set, take over the vessel. It's not going to
1138.82s - 1143.38s |  happen. However, social engineering is still a factor
1143.38s - 1147.50s |  that is something to consider. Convergence and modernization
1147.50s - 1150.34s |  often introduce new risk. And this is true because a lot of
1150.34s - 1152.58s |  the time we're getting IP to serial. Before we had discrete
1152.58s - 1157.94s |  systems, now we have trunking, like we said before, and it's
1157.94s - 1161.38s |  possible to RDP onto systems, et cetera, to TeamViewer, right?
1162.30s - 1165.06s |  There's undocumented stuff everywhere. This is one of the
1165.06s - 1169.58s |  things when we test the ship, we have a little AP, AP
1169.58s - 1173.54s |  monitoring, and the client or the vendor has installed so many
1173.54s - 1177.18s |  access points, right? That the client that we're testing have
1177.18s - 1181.90s |  no idea what the hell is going on. Probably about six or seven
1181.90s - 1185.78s |  undocumented APs on a ship at any one time, right? Which is
1185.78s - 1188.90s |  bonkers, right? Because I mean, all of these just bridge the man
1188.90s - 1193.46s |  over there. It's like, yeah. It's yeah, so it's crazy. And
1193.46s - 1196.50s |  that's it. Thank you for coming to see my talk.


url: https://www.youtube.com/watch?v=l89qpmb2CAQ
title: DEF CON 32 - Evading Modern Defenses When Phishing with Pixels - Melvin Langvik
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=l89qpmb2CAQ",
  "title": "DEF CON 32 - Evading Modern Defenses When Phishing with Pixels - Melvin Langvik",
  "description": "Dive into the art of phishing with QR codes! We'll cover the fundamentals of QR code phishing, revealing how these innocuous-looking images are used to deceive users into a false sense of legitimacy. After touching upon the basics, we'll explore creative tactics for obfuscating and hiding QR codes to ensure they reach their intended targets. As a sidetrack, we'll delve into how emails are rendered within the Outlook Mail Application and showcase some neat tricks that exploit its limitations for hiding QR codes from modern defensive solutions. Overall, the talk is intended to help testers up their QR code phishing game!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1068,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.02s - 2.66s | This text was transcribed using whisper model: large-v2

 All right, good morning audience.
2.66s - 4.42s |  Welcome to the second day of DEF CON.
4.42s - 5.26s |  Proud to be here.
5.26s - 7.66s |  Hopefully everyone's had a great experience so far.
9.14s - 11.90s |  I wanna kick things off by introducing our next speaker.
11.90s - 13.54s |  He is coming all the way from Norway.
13.54s - 15.30s |  So he's had a very long flight.
15.30s - 17.56s |  So we definitely wanna give this guy a lot of attention.
17.56s - 19.26s |  His name is Melvin Langvik
19.26s - 23.06s |  and I'll read just a quick breakdown of his bio.
23.06s - 24.90s |  Melvin is an accomplished professional
24.90s - 26.94s |  with a diverse background in tech.
26.94s - 28.74s |  He started his career as a developer,
28.74s - 30.10s |  an integration consultant,
30.10s - 31.34s |  gaining practical experience
31.34s - 33.90s |  in distributing critical backend infrastructure
33.90s - 36.50s |  for an international customer base.
36.50s - 38.58s |  Melvin's passion for cybersecurity
38.58s - 43.22s |  led him to transition into offensive security, the bad team.
43.22s - 45.18s |  He previously worked for TrustedSec,
45.18s - 47.86s |  which is an internationally recognized security company.
47.86s - 50.70s |  As part of, as TrustedSec's targeted operations team,
50.70s - 53.66s |  Melvin was tasked with performing targeted cyber attacks
53.66s - 55.08s |  against some of the most mature
55.08s - 58.14s |  and often largest companies in the world.
58.14s - 61.66s |  Today, Melvin is with the offensive security team lead
61.66s - 63.90s |  at a company called CovertAS.
63.90s - 66.82s |  So please give Melvin a very warm welcome
66.82s - 68.60s |  and listen to what he has to say.
69.58s - 70.42s |  Thank you, Melvin.
70.42s - 71.58s |  Thank you so much.
71.58s - 72.78s |  Thank you so much, guys.
72.78s - 74.78s |  Okay, so this talk is only 25 minutes.
74.78s - 76.38s |  So the first portion is gonna be super quick
76.38s - 77.90s |  and then towards the end, we'll slow down
77.90s - 79.62s |  and I'll give you guys a nice demo, okay?
79.62s - 82.62s |  So evading modern fences versus phishing with pixels.
82.62s - 85.94s |  We're gonna talk about QR code phishing specifically.
85.94s - 87.18s |  Quick introduction about myself,
87.18s - 89.74s |  even though my biography got read up here.
89.74s - 90.74s |  My name is Melvin Langvik.
90.74s - 92.38s |  I go by the alias Flangvik.
92.38s - 93.22s |  I'm the team lead
93.22s - 95.10s |  for a small Norwegian pentest company called Covert.
95.10s - 97.14s |  Previously, I was at TrustedSec.
97.14s - 99.18s |  I've done quite a few offensive security tools
99.18s - 100.02s |  for the community.
100.02s - 101.34s |  Maybe somebody recognizes sharp collection
101.34s - 102.66s |  or team filtration.
102.66s - 105.90s |  I also create trash, semi-good-ish infosec content
105.90s - 106.94s |  on YouTube and Twitch.
106.94s - 109.26s |  Stream, I don't wanna go on a stream every Sunday,
109.26s - 111.30s |  but close to every Sunday, I do a stream.
112.86s - 114.62s |  Like you guys, I'm a part-time alcoholic
114.62s - 116.02s |  when I'm at conferences.
116.58s - 120.62s |  I'm also the guy who did the meme-y C2 and EDR tier lists.
120.62s - 123.30s |  Obviously, AnyDesk is the best C2 out there, right?
123.30s - 125.02s |  So this is all a meme.
125.02s - 126.82s |  Okay, so the game plan for this talk.
126.82s - 128.46s |  We're gonna talk about QR codes one-on-one.
128.46s - 130.22s |  We're gonna talk about phishing with QR codes.
130.22s - 131.90s |  Some basic detection engineering.
131.90s - 134.22s |  Obviously, not my field, but just some basic stuff.
134.22s - 137.74s |  Image-less QR codes, question mark, potential profit,
137.74s - 139.18s |  taking things a step further,
139.18s - 141.02s |  and then we're gonna talk about the tool and toolkit
141.02s - 143.10s |  I'm gonna be demoing and sort of releasing today
143.10s - 144.50s |  called Crucible.
144.50s - 146.70s |  Okay, so let's talk about some QR codes.
146.70s - 147.62s |  What is a QR code?
147.62s - 149.38s |  QR code is a quick response code.
149.38s - 150.50s |  It's essentially a bar code
150.50s - 152.66s |  that contains a given amount of data.
153.58s - 155.86s |  A QR code works while you scan it using a device.
155.86s - 157.10s |  Typically, it's a mobile, right?
157.10s - 158.22s |  That scans the QR code,
158.22s - 160.18s |  takes you to a link or some other data.
162.22s - 164.66s |  The QR code itself has a couple of key factors.
164.66s - 167.34s |  Finder patterns marked down there in purple
167.34s - 169.22s |  is for the device you're scanning the QR code
169.22s - 171.46s |  to identify where the QR code is.
171.46s - 172.90s |  Is this a QR code or not?
172.90s - 175.06s |  You got the alignment marker in green,
175.06s - 177.90s |  sort of telling the device the position of the QR code
177.90s - 179.70s |  so it knows which way to read it.
179.70s - 181.38s |  And then you get the actual data modules,
181.38s - 183.14s |  which is the black and white data
183.14s - 187.06s |  between the alignment and finder markers.
187.06s - 189.02s |  And then you have also error correction.
189.02s - 190.66s |  I didn't know this before doing the talk,
190.66s - 195.06s |  but QR codes can actually have error correction up to 30%.
195.06s - 197.74s |  So if up to 30% of the QR code is missing,
197.74s - 200.34s |  it's still readable depending on how it's generated.
201.18s - 204.46s |  Different versions of QR codes refer to different size,
204.46s - 206.70s |  how many modules are within.
206.70s - 210.46s |  Think like the smallest one, I believe is like a 21 by 21.
210.46s - 214.42s |  Then you can go all up to like 172, I think, 171.
214.42s - 216.26s |  And that will actually give you 40,
216.26s - 218.82s |  a bit over 4,000 alphanumerical characters.
218.82s - 221.86s |  So a QR code can be huge and can contain a lot of data.
221.86s - 223.90s |  Typical use cases for us, it's much smaller
223.90s - 227.50s |  and does contain like a series of numbers
227.50s - 228.98s |  or URL or something like that.
229.94s - 232.70s |  QR codes has a lot of legitimate use cases.
232.70s - 234.86s |  If you ever charge your electric vehicle,
234.86s - 237.30s |  if you ever booked like an e-bike or like a scooter,
237.30s - 239.82s |  if you ever ordered at a restaurant during COVID,
239.82s - 240.78s |  they use QR codes.
240.78s - 242.26s |  You scan them, you get to a webpage
242.26s - 243.70s |  and then you give them all your data
243.70s - 245.10s |  and you get some food, right?
245.10s - 247.02s |  So they have a ton of legitimate use cases
247.02s - 249.26s |  and they're great, we use them all the time.
250.14s - 253.78s |  The thing is that attackers also likes to use QR codes.
253.78s - 256.46s |  I'm actually super proud of this meme.
256.46s - 259.34s |  And why do attackers use QR codes?
259.34s - 261.30s |  They're simple to create and easy to share.
261.30s - 262.54s |  There's a bunch of online tools,
262.54s - 264.42s |  there's libraries to use in scripting languages,
264.42s - 266.74s |  there's pre-built offline tools, right?
266.74s - 269.98s |  Easy to create, easy to share and therefore easy to abuse.
269.98s - 271.94s |  Again, everybody knows what a QR code is.
271.94s - 274.66s |  Even non-technical people working in large organizations
274.66s - 276.86s |  have some sort of reference to QR codes, right?
276.86s - 278.46s |  So it's definitely like a legitimate,
278.46s - 281.14s |  looks like a legitimate delivery method.
281.14s - 282.70s |  Sometimes we'll talk more about this,
282.70s - 285.46s |  but typically it's easy to evade initial email filters
285.46s - 287.66s |  and some sandbox solutions by delivering URLs
287.66s - 289.50s |  or data in QR codes.
289.50s - 292.78s |  And actually I think they convey a sense of legitimacy.
292.78s - 295.46s |  I asked a bunch of my friends who's not technical,
295.46s - 297.78s |  can anybody create a QR code?
297.78s - 299.34s |  And a lot of them thought no.
299.34s - 300.90s |  A lot of them thought that you had to be
300.90s - 302.34s |  some sort of legitimate entity,
302.34s - 303.62s |  that you had to be an organization
303.62s - 306.50s |  or get a license or whatever to create your QR code,
306.50s - 308.06s |  which is obviously wrong, right?
308.06s - 310.70s |  So I think that is underlying of why a lot of people
310.70s - 312.54s |  feel QR code are very legitimate.
313.50s - 315.54s |  And also the best thing about phishing,
315.54s - 316.70s |  specifically with QR codes,
316.70s - 318.50s |  is that you move the initial access
318.50s - 320.74s |  of whatever you are giving to the victim
320.74s - 321.98s |  off the main device.
321.98s - 324.54s |  A lot of large corporate networks or large companies
324.54s - 326.74s |  will have heavily protected machines,
326.74s - 328.82s |  but the mobile devices are either private,
328.82s - 330.70s |  owned by the employee themselves,
330.70s - 332.90s |  or maybe not as heavily enrolled
332.90s - 335.02s |  or doesn't have the same defensive capabilities
335.02s - 337.78s |  as the machine itself.
337.78s - 339.82s |  Meaning that a potential defense, a SOC,
339.82s - 341.90s |  wouldn't gain the same telemetry from that phone
341.90s - 343.14s |  as they would from the device.
343.14s - 347.10s |  I think this is true for many, many organizations out there.
347.10s - 349.50s |  Okay, so obviously phishing with QR codes,
349.50s - 351.82s |  I think everybody's seen a couple of these examples.
351.82s - 353.86s |  I think the Microsoft multi-factor authentication one
353.86s - 355.30s |  is by far the most abused, right?
355.30s - 357.18s |  Because it's based on the legitimate use case
357.18s - 358.78s |  where you set up a Microsoft account,
358.78s - 361.38s |  you have to scan the QR code to set up your multi-factor app
361.38s - 363.46s |  and therefore, you know, you have to re-authenticate
363.46s - 366.30s |  or whatever the context is a couple of times a year.
366.30s - 368.06s |  And that really makes a good phishing campaign.
368.06s - 369.66s |  DocuSign is also heavily abused.
369.66s - 370.98s |  Anything related to Microsoft,
371.22s - 374.54s |  people love throwing Microsoft logos around, right?
374.54s - 376.50s |  So a bit of detection engineering,
376.50s - 378.42s |  how do we detect QR codes?
378.42s - 381.02s |  I Googled this, which means I did great research
381.02s - 382.54s |  on the subject, right?
382.54s - 384.82s |  Found this blog post by Liam Jones,
384.82s - 386.26s |  who created a basic detection rule
386.26s - 389.74s |  for basically pulling out image attachments from emails.
389.74s - 392.46s |  It then had some automation for parsing the images
392.46s - 394.34s |  and looking for QR codes,
394.34s - 397.26s |  essentially attempting to parse every image as a QR code
397.26s - 398.54s |  and then look at the data, right?
398.54s - 400.22s |  That's the manual way to do it.
400.22s - 401.82s |  There's a couple of flaws in this rule.
401.82s - 402.66s |  You can probably spot it.
402.66s - 404.58s |  You know, there's a bunch of more image extensions
404.58s - 406.90s |  than PNG, JPEG, and SVG,
406.90s - 408.58s |  but yeah, that's just an example, right?
408.58s - 409.98s |  And then you have black box solutions,
409.98s - 412.22s |  which we don't know how to work, like Microsoft Sentinel.
412.22s - 414.62s |  If you give Microsoft some of your hard-earned money
414.62s - 416.62s |  and get like an E5 or E3 or whatever
416.62s - 419.02s |  their licensing model is at the time,
419.02s - 421.10s |  you'll get this, which is Microsoft Sentinel.
421.10s - 423.74s |  It will overwatch all your emails,
423.74s - 425.50s |  inbound, outbound from the organization,
425.50s - 426.78s |  and it will actually tell you
426.78s - 428.62s |  if you got a URL from a QR code.
428.62s - 431.50s |  You see, it will tag it as the source of this data
431.50s - 433.98s |  is from a QR code, and it will give it a URL.
433.98s - 435.66s |  And it will automatically browse through it.
435.66s - 436.50s |  It will take a look at it
436.50s - 438.78s |  and try to determine if it's nasty or not, right?
438.78s - 441.58s |  So detection solutions, defensive solutions out there
441.58s - 443.42s |  are definitely aware of QR code phishing,
443.42s - 444.54s |  and it's an established thing.
444.54s - 446.82s |  We'll get back to this later.
446.82s - 449.26s |  Okay, how about image-less delivery methods, right?
449.26s - 450.86s |  I think when I say that,
450.86s - 452.38s |  most of you are immediately gonna think
452.38s - 453.58s |  about the ASCII art method,
453.58s - 454.62s |  because it's a known method
454.62s - 457.30s |  where you basically use different weird ASCII characters
457.30s - 458.86s |  to represent the QR code.
458.86s - 460.82s |  And the reason I say that this is a known method,
460.82s - 463.58s |  because our well-known influencer, John Hammond,
463.58s - 465.06s |  made a video about this four months ago,
465.06s - 467.50s |  and at least two million people know about this now,
467.50s - 468.90s |  so it's definitely known.
468.90s - 471.26s |  Obviously, not to throw him under the bus, it's great.
471.26s - 473.26s |  Just wanna say it's an established thing.
473.26s - 475.14s |  And so when we wanna phish,
475.14s - 477.26s |  if I wanted to phish without the use of images
477.26s - 479.50s |  to avoid this detection that I just talked about,
479.50s - 482.22s |  what could I possibly use for this?
482.22s - 484.74s |  Well, I found this example in CSS.
484.74s - 487.10s |  So this great guy called Jason Adelia,
487.10s - 488.58s |  or whatever I butcher his name,
488.58s - 490.98s |  he's a web developer or a web designer,
490.98s - 494.46s |  and he has this CodePen link out on Google somewhere
494.46s - 496.18s |  where he showcases his QR code
496.18s - 498.54s |  to his website created with CSS.
498.54s - 501.02s |  So he's actually using a blank white canvas
501.02s - 504.34s |  and then using box shadows to fill in the black and white
504.34s - 505.74s |  for the entire grid array,
505.74s - 507.98s |  and it turns into this beautiful QR code.
507.98s - 509.38s |  Now, this looks interesting.
509.38s - 510.70s |  This doesn't look like shit, right?
510.70s - 512.34s |  So we could potentially use this.
512.34s - 514.34s |  So me and ChatTPT sat down one night
514.34s - 516.42s |  and we looked at some Python code,
516.42s - 518.66s |  and I came up with this dirty piece of crap.
518.66s - 520.30s |  Basically, creates a QR code,
520.30s - 522.50s |  goes through every cell in the QR code,
522.50s - 524.30s |  determines if the QR code is,
524.30s - 526.22s |  or that pixel or cell is black,
526.22s - 528.42s |  and then fills in the box shadow, the CSS,
528.42s - 530.46s |  using his technique with that.
530.46s - 531.94s |  And then this looks really great.
531.94s - 534.22s |  Actually, a bunch of email clients will happily render this.
534.22s - 537.14s |  Both Thunderbird and Apple Mail, the built-in Apple Mail,
537.14s - 539.74s |  will render this as CSS, and it scans, it looks great,
539.74s - 540.86s |  and it's not an image.
540.86s - 543.90s |  So this will fly by basic detection for email filters
543.90s - 544.90s |  because there's no image there.
544.90s - 546.94s |  So there's obviously no QR code there, right?
546.94s - 549.74s |  And of course, you can see that the CSS is not offset
549.74s - 551.38s |  because centering things to CSS
551.38s - 552.82s |  is an absolute fucking nightmare.
552.82s - 555.14s |  So I didn't bother spending the needed two hours
555.14s - 556.02s |  to center this thing.
556.02s - 557.34s |  I just screenshots it.
557.34s - 560.10s |  That's your issue now, but it is what it is.
560.10s - 561.70s |  The sad thing about this, though,
561.70s - 565.54s |  is that Outlook doesn't support this in the desktop client.
565.54s - 568.70s |  The web version of Outlook will happily render CSS for you,
568.70s - 570.34s |  but the, again, not centered,
570.34s - 573.62s |  but the desktop client will not render CSS.
573.62s - 575.34s |  This is because the Outlook desktop client
575.34s - 578.06s |  is extremely sassy and, in general,
578.06s - 582.98s |  just is very picky about what HTML tags you can use,
582.98s - 584.82s |  what CSS you can use, and you can't.
584.82s - 587.78s |  If you ever made an email in the Outlook desktop client,
587.78s - 588.82s |  you know what I'm talking about.
588.82s - 590.70s |  It's a nightmare, right?
590.70s - 592.38s |  So it doesn't work, and it's kind of important
592.38s - 595.14s |  because it turns out, at least based on one source,
595.14s - 597.30s |  that the Outlook desktop client owns
597.30s - 600.58s |  about 58.1% of desktop machines,
600.58s - 601.66s |  so it's kind of important.
602.18s - 604.30s |  When working against large organizations,
604.30s - 606.30s |  by far, the experience I have
606.30s - 608.86s |  is that most people use the Outlook desktop client.
608.86s - 610.50s |  I think we can all agree on that, right?
610.50s - 611.66s |  That's a given.
612.82s - 614.26s |  Okay, so we got to take a step back then.
614.26s - 615.66s |  CSS, sure, we can use that.
615.66s - 616.86s |  We already scripted that way,
616.86s - 619.14s |  but we got to find some other way.
619.14s - 622.30s |  What other structure could we possibly use
622.30s - 626.58s |  to create a drawing, almost, of pixels?
626.58s - 628.46s |  Like, what could we use, right?
628.46s - 632.18s |  So the answer to that, at least one, is tables.
632.18s - 635.54s |  So tables is something that Outlook desktop client supports.
635.54s - 638.50s |  When I say tables, I don't mean like Excel tables.
638.50s - 642.14s |  I mean like actual HTML tables and rows and columns,
642.14s - 643.62s |  and they support styling.
643.62s - 647.50s |  So you could take a table, and you can style each column
647.50s - 650.02s |  in that either white color or black color,
650.02s - 651.66s |  and you can create a QR code.
651.66s - 654.54s |  So again, me and Chad TPT sat down one night,
654.54s - 655.82s |  and we created this.
655.82s - 658.14s |  So you set the cell spacing and the cell padding
658.98s - 662.18s |  to zero or a given size for how big QR code you want to make,
662.18s - 663.54s |  and then you basically start filling in,
663.54s - 666.34s |  okay, this pixel of this QR code is white.
666.34s - 668.98s |  Let's pad this, or let's make the background color
668.98s - 670.82s |  of this cell white or black, right?
670.82s - 672.30s |  And then you go through the whole thing,
672.30s - 677.06s |  and voila, you got a beautiful-looking table in HTML,
677.06s - 678.58s |  and you got a beautiful-looking QR code
678.58s - 680.10s |  in Outlook desktop client, right?
680.10s - 680.98s |  And this looks good.
680.98s - 683.10s |  I actually think this deserves a round of applause,
683.10s - 685.58s |  to be perfectly honest with you.
685.58s - 686.66s |  And this is really dumb.
687.10s - 688.58s |  This is KISS all the way, right?
688.58s - 690.02s |  It's super simple, super dumb.
690.02s - 691.02s |  And is it effective?
691.02s - 691.94s |  That's the big question.
691.94s - 693.18s |  Is this effective?
693.18s - 696.46s |  So I actually, you know, I reached into my paycheck,
696.46s - 698.78s |  and I bought Microsoft Sentinel, XDR, EDR,
698.78s - 699.70s |  whatever they call it now.
699.70s - 701.34s |  They change name every week.
701.34s - 704.06s |  And I give them my money, and I wanted to test it.
704.06s - 706.50s |  So first, I set up two accounts.
706.50s - 707.70s |  I set up Microsoft Sentinel.
707.70s - 709.86s |  I started monitoring incoming email traffic,
709.86s - 713.14s |  and then I set out this QR code in a Base64,
713.14s - 715.50s |  as a Base64 image embedded within the email,
715.50s - 717.62s |  and obviously, Microsoft Sentinel picked this right up.
717.62s - 719.06s |  It says, you know, this is a QR code.
719.06s - 720.10s |  This is the URL.
720.10s - 723.10s |  That's Rick Roll, if anybody recognized that.
723.10s - 725.54s |  Hacks, Elite Hacks are to you if you recognize that.
725.54s - 727.82s |  And then I tried sending a table,
727.82s - 729.50s |  and lo and behold, nothing happened.
729.50s - 731.50s |  So Microsoft Sentinel did not detect the table
731.50s - 733.82s |  as an image or as a QR code at all,
733.82s - 735.58s |  and didn't parse it, and therefore,
735.58s - 738.14s |  as a defender, you don't have telemetry for this.
738.14s - 739.78s |  So if I send a bunch of phishing emails
739.78s - 741.42s |  with QR codes generated as tables,
741.42s - 742.74s |  the URL will not pop up.
742.74s - 743.70s |  Nobody will spam it.
743.70s - 744.90s |  No bot will hit it,
744.90s - 746.06s |  and it will reach a target,
746.06s - 748.62s |  and it's still scannable by mobile devices.
748.62s - 750.78s |  So this works great.
750.78s - 752.22s |  Now this, I've already done this.
752.22s - 754.90s |  I talked about this at a conference a couple of months back.
754.90s - 757.42s |  This is built into the tool Crucible,
757.42s - 758.70s |  which I'll talk about later,
758.70s - 760.18s |  and you can find that on GitHub.
760.18s - 763.18s |  It works great, and yeah, it's cool.
763.18s - 765.70s |  But let's think about it and take it a step further.
765.70s - 768.50s |  So we can generate QR codes in CSS, sick.
768.50s - 771.34s |  We can generate QR codes in tables, even sicker.
771.34s - 774.50s |  But what about obfuscating email content
774.50s - 776.34s |  using tables?
776.34s - 777.34s |  Because think about it.
777.34s - 779.54s |  The table is essentially our drawing board.
779.54s - 781.10s |  We can draw whatever we want.
781.10s - 784.14s |  Each column in the table is a pixel for us, right?
784.14s - 786.58s |  So we could draw the entire email.
786.58s - 791.02s |  We could render HTML and draw the entire thing as a table.
791.02s - 793.14s |  So this is what we dive into,
793.14s - 795.58s |  and this was a bit of a nightmare, to be perfectly honest.
795.58s - 796.86s |  This is the process.
796.86s - 799.86s |  So we need to, so the point, what I wanna do,
799.86s - 801.06s |  I guess I should go back on this.
801.06s - 803.38s |  Why would you wanna do this in the first place, right?
803.38s - 806.34s |  So more and more defensive solutions out there
806.34s - 809.46s |  are using AI to get the context of the email you're sending.
809.46s - 810.66s |  They're using risk scores.
810.66s - 812.98s |  They're using a context-aware AI to understand,
812.98s - 815.90s |  you know, is this potentially a legitimate message
815.90s - 817.02s |  being delivered to my user?
817.02s - 818.50s |  And then based on the risk score, whatever,
818.50s - 821.62s |  it will be delivered, sandboxed, looked at, whatever, right?
821.62s - 823.30s |  So the thought behind this is that
823.30s - 826.38s |  if we can obfuscate keywords in the email,
826.38s - 829.54s |  like MFA, like QR, like re-authenticate,
829.54s - 832.18s |  like Microsoft, right, it's gonna be much harder
832.18s - 834.94s |  for the AI model to determine the context of the email
834.94s - 836.62s |  and if it's legitimate or not.
836.62s - 838.34s |  So the whole point behind this is
838.34s - 841.50s |  I wanna take a keyword, say re-authenticate,
841.50s - 844.46s |  and I wanna render that as an image,
844.46s - 846.54s |  and then I wanna turn it into a table,
846.54s - 848.74s |  and then I wanna replace the keyword
848.74s - 851.14s |  in the email with that table.
851.14s - 852.62s |  So there's no text there.
852.62s - 855.74s |  It's a table representing the text.
855.74s - 856.58s |  So there's no text.
856.58s - 858.50s |  You can't select it, but it looks like a text.
858.50s - 861.30s |  The end user will think it's text, but it's not.
861.30s - 862.82s |  I went through this process.
862.82s - 865.42s |  So basically, you give the Python script,
865.42s - 867.90s |  the email, the HTML email that you wanna send,
867.90s - 868.74s |  and then you tell it,
868.74s - 871.54s |  hey, I wanna replace the keyword, re-authenticate.
871.54s - 873.38s |  The Python script will then render the,
873.38s - 876.50s |  no, the Python script will then inject a marker
876.50s - 878.74s |  in that as to handle that word.
878.74s - 881.98s |  So it will inject like a box around the word in HTML,
881.98s - 884.18s |  and then it will render the entire email,
884.18s - 886.42s |  and then they will use image recognition
886.42s - 888.74s |  to cut out that box,
888.74s - 890.18s |  and then it will remove the borders
890.18s - 891.70s |  and turn it into a table.
892.66s - 894.34s |  And this is dumb and complicated,
894.34s - 895.94s |  and you would never think this would work,
895.94s - 897.18s |  but it actually works.
897.18s - 900.10s |  So I'm gonna demo that right now so you can see that.
900.10s - 904.22s |  Hopefully, you can see my terminal now.
904.22s - 905.58s |  Can you see a terminal?
905.58s - 906.42s |  Great.
906.42s - 908.94s |  I'll try to clear this
908.94s - 910.90s |  and make it a bit bigger for you guys.
912.18s - 913.66s |  Like, ooh.
913.66s - 915.66s |  Okay, so this is Crucible.
915.66s - 917.34s |  This is the help menu.
917.34s - 919.70s |  You give it a URL that you want the QR code data,
920.22s - 922.42s |  the data you want inside the QR code doesn't have to be URL,
922.42s - 923.78s |  but typically it's URL.
923.78s - 925.58s |  You wanna set a QR code size.
925.58s - 926.86s |  You give it an input,
926.86s - 928.18s |  so you give it like a typically
928.18s - 930.70s |  like a phishing email template in HTML,
930.70s - 934.74s |  and then wherever the word QR underscore placeholder is
934.74s - 938.02s |  will be replaced with the QR code table or CSS,
938.02s - 939.14s |  and then you give it an output path
939.14s - 941.02s |  if you don't want a random generated name.
941.02s - 942.62s |  You can choose if you want the CSS method
942.62s - 943.50s |  or the tables method,
943.50s - 945.98s |  and you can also generate output in straight EML,
945.98s - 947.10s |  which is an email format,
947.10s - 948.90s |  so you can just open it in Outlook afterwards,
948.90s - 950.10s |  which is super nice,
950.10s - 952.06s |  and then you have the obfuscate method,
952.06s - 954.58s |  so that's what I'll be demonstrating now.
954.58s - 955.70s |  So in this command here,
955.70s - 958.02s |  I'll be linking to Defcon.org.
958.02s - 960.50s |  I'm using my MFA or QR code template,
960.50s - 964.26s |  and then I'm obfuscating the keywords MFA, QR, and Microsoft,
964.26s - 967.90s |  so those words will be pulled out of the email template
967.90s - 971.22s |  and replaced with images illustrated as tables
971.22s - 974.12s |  in the new output,
974.12s - 977.36s |  so it worked, hopefully.
977.36s - 980.90s |  I have a backup if it doesn't.
980.90s - 983.70s |  Open Sesame.
983.70s - 986.46s |  Placeholder, I think, no.
986.46s - 987.66s |  Output, okay.
987.66s - 990.30s |  Hopefully, this worked.
990.30s - 992.34s |  Yeah.
992.34s - 994.10s |  So this is a table QR code,
994.10s - 995.34s |  and this is the...
995.34s - 996.58s |  Fuck, it broke.
996.58s - 997.94s |  Okay.
997.94s - 998.74s |  It broke.
998.74s - 999.46s |  Give me a second here.
999.46s - 1003.10s |  I'll go back to the demo.
1003.10s - 1006.54s |  So it looks like this if the demo worked correctly,
1006.54s - 1007.82s |  and then this is the output,
1007.82s - 1010.22s |  so this is the generated email.
1010.22s - 1013.86s |  Can you spot the text that is tables?
1013.86s - 1014.66s |  There is text.
1014.66s - 1018.34s |  There are keywords in this email that is not text.
1018.34s - 1019.02s |  Give you guys a second.
1019.02s - 1021.06s |  Some of it is obvious.
1021.06s - 1023.10s |  Some of it is not,
1023.10s - 1026.10s |  and all of this is not text.
1026.10s - 1030.22s |  This is tiny tables inserted into the email template,
1030.22s - 1032.66s |  resulting in it looking like text,
1032.66s - 1036.46s |  but it not being text.
1036.46s - 1037.18s |  Round of applause.
1037.18s - 1044.54s |  Cue that, and again,
1044.54s - 1048.34s |  this works when you're not demoing it live at DEF CON,
1048.34s - 1050.50s |  and that's basically all I got.
1050.50s - 1052.66s |  Thank you so much, Adversary Village, for having me.
1052.66s - 1054.18s |  I got stickers for the project.
1054.18s - 1055.62s |  Scan this QR code, if you trust me,
1055.62s - 1056.90s |  to get to the project,
1056.90s - 1058.50s |  and yeah, go out there and fish somebody
1058.50s - 1062.50s |  and improve our defenses by some degree.
1062.50s - 1064.50s |  Thank you so much from me, guys.


url: https://www.youtube.com/watch?v=j3A5zQAAwcc
title: DEF CON 32 - Locksport Competitions: Compete in the Olympics of Locks -Matt Burrough
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=j3A5zQAAwcc",
  "title": "DEF CON 32 - Locksport Competitions: Compete in the Olympics of Locks  -Matt Burrough",
  "description": "Picking locks is fun, but what if you want more? Ever considered competing against other lock enthusiasts? In this talk we'll discuss the exciting lock-related competitions that take place around the world, how to find them, and what it takes to compete and win.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1469,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.60s | This text was transcribed using whisper model: large-v2

 So this is a talk about locksport competitions.
2.60s - 4.80s |  We're going to talk about how you compete,
4.80s - 6.80s |  what the competitions are like, how you get good,
6.80s - 8.00s |  all those kinds of fun things.
8.00s - 13.10s |  So here's our quick agenda, a little bit about who I am,
13.10s - 14.80s |  who this guy next to me is.
14.80s - 16.50s |  We'll talk about what locksport actually
16.50s - 18.60s |  is, the different types of competitions,
18.60s - 21.50s |  and where we go to do these things.
21.50s - 23.60s |  So me, I'm Matt Burrow.
23.60s - 27.50s |  I am a red team manager by day, on the weekends, and at night.
27.60s - 30.00s |  I am also a co-organizer for Seattle Locksport.
30.00s - 34.28s |  So shout out to all the Seattle people in the front.
34.28s - 36.88s |  If you're in the Seattle area ever, feel free to come by.
36.88s - 38.88s |  We meet a couple times a month, have a lot of fun,
38.88s - 39.68s |  teach you how to pick locks.
39.68s - 40.58s |  It's great.
40.58s - 42.18s |  I've also written a couple of books.
42.18s - 45.48s |  The most important one here is Locksport, came out this year.
45.48s - 47.08s |  There I am on the cover.
47.08s - 49.88s |  I have a co-author here with me as well from Locksport.
49.88s - 53.38s |  If you want to come by the No Starch Press vendor booth
53.38s - 56.58s |  at 2.30 today, we will be signing copies of the book.
56.58s - 58.38s |  And I've competed in locksport competitions
58.38s - 61.48s |  around the world since about 2016.
61.48s - 65.18s |  With me here, I have Jos Valles.
65.18s - 67.48s |  Good day.
67.48s - 69.38s |  I'm Jos Valles, and like it says on the screen,
69.38s - 72.98s |  I do security stuff as a day job.
72.98s - 76.28s |  I used to be the president for tool.nl.
76.28s - 78.08s |  That's the original tool, by the way.
78.08s - 81.18s |  And, well, I wrote the book, but yada, yada, yada.
81.18s - 85.28s |  And I've been into locksport for quite some while now.
85.28s - 90.28s |  In 2006, I was my first dabble in competing.
90.28s - 93.78s |  And three years after that, I decided to start winning.
93.78s - 95.68s |  And, yeah, that's basically what happened.
95.68s - 101.09s |  So, yeah, I mean, that's it.
101.09s - 101.69s |  Take this one?
101.69s - 102.19s |  Yeah.
102.19s - 103.69s |  Yeah, there you go.
103.69s - 104.19s |  Cool.
104.19s - 106.19s |  So what is locksport?
106.19s - 108.49s |  Notice the sport in particular.
108.49s - 111.09s |  Definition of locksport, it is non-destructive opening
111.09s - 114.79s |  of locks in a manner that the manufacturer never intended.
114.79s - 117.49s |  And we do this as a hobby and as a competition
117.49s - 119.19s |  to see who can do it the fastest.
119.19s - 122.29s |  And notice we didn't say lock picking, but opening of locks.
122.29s - 125.79s |  That's an important distinction, and you'll see why in a minute.
125.79s - 127.19s |  So why do we do this, right?
127.19s - 128.39s |  What makes us tick?
128.39s - 131.69s |  Why do we go travel around the world to do these things?
131.69s - 134.39s |  Any of us, I think, who are into locksport for any amount of time
134.39s - 135.59s |  see locks as a fun puzzle.
135.59s - 136.29s |  It's a challenge.
136.29s - 137.89s |  It's something you want to defeat.
137.89s - 140.79s |  Just like hacking digitally, it's analog hacking, right?
140.79s - 142.49s |  It's a fun thing to do.
142.49s - 145.09s |  We also do it because we want to improve on our own skills.
145.09s - 146.69s |  We want to show that we're the best.
146.69s - 148.49s |  We want to set a personal best for ourselves.
148.49s - 150.89s |  Maybe we want to brag to our friends or maybe mock them a little bit.
150.89s - 154.09s |  So always good to show off to your friends and enemies.
154.09s - 155.59s |  You could maybe get famous from this.
155.59s - 159.49s |  Maybe not super famous, but you've probably all heard of LPL,
159.49s - 160.89s |  very famous locksporter.
160.89s - 163.79s |  There's several people who are well-known in the locksport community
163.79s - 167.19s |  and even beyond that that regular normal non-DEF CON people have heard of.
167.19s - 169.19s |  So you could maybe get famous.
169.19s - 170.89s |  And then there are prizes.
170.89s - 171.69s |  What kinds of prizes?
171.69s - 173.39s |  Well, locks often.
173.39s - 174.79s |  You can win trophies.
174.79s - 177.89s |  You can win lock-picking gear, all kinds of fun things.
177.89s - 181.69s |  Here we are winning at various things or at least placing.
181.69s - 185.49s |  So it's fun to get recognized for doing something well.
185.49s - 187.09s |  So yeah, come compete.
187.09s - 189.49s |  You can win things.
189.49s - 192.59s |  All right, brief history of locksport, how it got started.
192.59s - 196.49s |  Locksmiths have been picking locks and opening locks without keys forever.
196.49s - 198.19s |  That's kind of their job.
198.19s - 202.99s |  Starting in the 60s, there was the Model Railroad Club at MIT.
202.99s - 205.69s |  They started kind of getting into places, wanting to pick locks.
205.69s - 208.69s |  So a lot of it kind of spun out from there.
208.69s - 211.89s |  Then in Europe, locksport really started taking off in the late 90s.
211.89s - 216.29s |  SSDev in Germany was founded by people from the Chaos Computing Club.
216.29s - 217.69s |  They met with people from Hope.
217.69s - 220.49s |  And so then it kind of came to the US.
220.49s - 224.89s |  In the Netherlands, we had the Dutch NVHS,
224.89s - 227.89s |  which was the Dutch Association for Hinges and Locksport,
227.89s - 231.19s |  which is also kind of a funny joke if you know Dutch.
231.19s - 234.59s |  That then spun off into becoming TOOL, the original TOOL,
234.59s - 237.29s |  TOOL-NL in 2002.
237.29s - 240.29s |  And then from there, they had their first LOCKCON that year,
240.29s - 244.19s |  which is, we'll talk about a very big competition and gathering of lock picking
244.19s - 246.29s |  and various lock opening things in the Netherlands.
246.29s - 247.49s |  It's awesome.
247.49s - 249.29s |  And then eventually that trickled down into the US
249.29s - 253.49s |  and TOOL-US was started around 2006 at Hope and then DEFCON that year.
253.49s - 255.59s |  So that's the very brief history of locksport.
255.59s - 262.09s |  So it's been going on now for, you know, 20, 30 years as a major sport.
262.09s - 264.69s |  So I mentioned that lock picking is not the only thing.
264.69s - 267.99s |  So there are various kinds of competitions that we have at all these big events.
267.99s - 270.29s |  So we'll talk about the different kinds of competitions, what they're like,
270.29s - 273.79s |  and then we'll talk about where you can go and do these things.
273.79s - 277.69s |  So, of course, lock picking is the biggest event at all these various conferences
277.69s - 279.69s |  because that's what people think of when they think of locksport.
279.69s - 283.09s |  It is the primary competition, but certainly not the only one.
283.19s - 285.59s |  If you don't know about lock picking, walk through that curtain.
285.59s - 287.29s |  You will be taught lock picking in five minutes.
287.29s - 289.59s |  You'll open locks. It will be fun.
289.59s - 290.59s |  If you know a bit about lock picking,
290.59s - 293.09s |  what is it actually like to compete and do these things?
293.09s - 294.79s |  We all gather at a conference.
294.79s - 296.59s |  There are usually big round tables,
296.59s - 299.49s |  often with like five to ten people sitting at these tables.
299.49s - 300.69s |  Everyone gets a lock.
300.69s - 304.19s |  You usually get about five minutes per lock to try to pick that lock.
304.19s - 307.19s |  You record your time if you open it or did not open if you don't.
307.19s - 309.19s |  After the five minutes, they say switch.
309.19s - 311.39s |  You hand it to the person on your left or the person on your right.
311.39s - 312.99s |  All the locks move around the table.
312.99s - 315.89s |  You see how quickly you can open or how many locks you can open.
315.89s - 318.99s |  The person at the table with the most opens moves on to the final round.
318.99s - 321.49s |  Or if there's a tie, the person with the best cumulative time.
321.49s - 322.99s |  And then there's a final round table.
322.99s - 324.99s |  Same story. Pass the locks around.
324.99s - 326.49s |  Usually harder locks in that round.
326.49s - 328.49s |  And then you get your top three people.
328.49s - 330.99s |  That's most lock picking competitions.
330.99s - 332.69s |  So what does that look like?
332.69s - 334.89s |  Here's me opening a lock at LockCon.
334.89s - 338.39s |  Here's other people opening locks at LockFest, which is another great event.
338.39s - 339.89s |  So yeah, sit at a table.
339.89s - 340.99s |  You know, have a drink.
340.99s - 342.59s |  Pick locks. Record your time.
342.59s - 344.09s |  Lots of fun.
344.09s - 346.19s |  Then there's Impressioning.
346.19s - 347.69s |  We have the world expert in Impressioning.
347.69s - 349.69s |  So I'll hand off to him.
349.69s - 351.29s |  Again, hello.
351.29s - 355.79s |  Like Matt said, there are several competitions that are run around the world.
355.79s - 357.09s |  One of them is Impressioning.
357.09s - 358.19s |  What is Impressioning?
358.19s - 359.59s |  Well, Impressioning is opening locks.
359.59s - 362.99s |  Otherwise, it wouldn't be part of a locksport.
362.99s - 365.99s |  What Impressioning is, is the art of making a key
365.99s - 369.09s |  without knowing what the key exactly looks like.
369.09s - 373.69s |  So we're creating a key from scratch.
373.69s - 374.49s |  How do we do that?
374.49s - 378.39s |  We work from a uncut blank key.
378.39s - 384.19s |  So like the keys hanging at your key duplication site.
384.19s - 385.39s |  You take a blank key.
385.39s - 386.39s |  You put that in the lock.
386.39s - 387.19s |  It has to fit.
387.19s - 391.59s |  So it has to be the correct type and brand of key.
391.59s - 394.09s |  And you start wiggling that key.
394.09s - 395.29s |  You put some force on it.
395.29s - 401.09s |  And your lock will leave some marks on the key
401.09s - 404.29s |  where the depth of the key is not correct yet.
404.29s - 408.29s |  So if you take out that key and you look at it quite closely,
408.29s - 414.49s |  probably with some lights and some magnifying aids,
414.49s - 417.69s |  then you figure out where the key is not correct yet.
417.69s - 421.39s |  And then you file off just a little bit of material of that part.
421.39s - 422.49s |  And then you rinse and repeat.
422.49s - 423.79s |  Insert the key again.
423.79s - 424.59s |  Start wiggling.
424.59s - 425.49s |  Look at it.
425.49s - 427.99s |  And then you keep on doing that.
427.99s - 430.99s |  And in the end, you'll open.
430.99s - 432.29s |  You need a bit of gear for that.
432.29s - 436.59s |  This happens to be part of my gear.
436.59s - 438.99s |  And it works basically the same, as Matt said,
438.99s - 442.59s |  how the normal picking works, except that everybody
442.59s - 444.19s |  starts at the same time.
444.19s - 447.39s |  So a competition might be, I don't know,
447.39s - 449.09s |  30 people in one room.
449.09s - 451.39s |  Everybody gets the same lock.
451.39s - 453.79s |  So the lock, same brand.
453.79s - 455.29s |  But they're also keyed alike.
455.29s - 458.59s |  We have no idea what the key is, but they're keyed alike.
458.59s - 463.19s |  Because if the cut would be shallow for me,
463.19s - 466.49s |  and Matt would be handed a deeper lock,
466.49s - 469.59s |  then he has to put in more work.
469.59s - 471.99s |  Because you have to recycle through this process
471.99s - 473.39s |  over and over and over again.
473.39s - 475.59s |  And also filing more.
475.59s - 477.79s |  So to keep it a level playing field,
477.79s - 480.19s |  everybody has the same lock.
480.19s - 481.69s |  And then it's 3, 2, 1, go.
481.69s - 485.69s |  And people start abusing their locks to get them open.
485.69s - 487.59s |  A competition, a normal competition,
487.59s - 490.19s |  first round takes about an hour.
490.19s - 493.69s |  And the first maybe six, depending on where you are,
493.69s - 499.09s |  the first six to open go in, progress to the final round.
499.09s - 503.09s |  Which means they get six different locks.
503.09s - 504.29s |  And they open them.
504.29s - 506.69s |  And then you do that in a roundabout way,
506.69s - 508.39s |  same as with the picking.
508.39s - 511.89s |  So all the finalists open, they're all six locks.
511.89s - 514.99s |  And then we figure out who opened the most.
514.99s - 516.29s |  That person will win.
516.29s - 519.39s |  And if that's a tie, then we're looking at times.
519.39s - 524.89s |  And looking at times, of looking at marks,
524.89s - 526.89s |  what are we actually looking for?
526.89s - 531.29s |  Well, so we're filing those keys.
531.29s - 534.09s |  We normally use round files for it, but that's all technical.
534.09s - 537.09s |  So your key will look weirdish
537.09s - 540.79s |  if you look at the shape of the cuts because those are round.
540.79s - 543.09s |  But that's also, for me, that's a good thing
543.09s - 545.19s |  because that means that the bottom of that cut
545.19s - 549.19s |  will be smooth instead of a sharp valley.
549.19s - 552.69s |  And then you can actually way easier hunt for marks there.
552.69s - 555.79s |  And you can see at the bottom of those two pictures,
555.79s - 558.79s |  you can see quite distinct marks in this case.
558.79s - 560.49s |  They're not always that clear.
560.49s - 563.09s |  But well, for pictures, this is good.
563.09s - 565.19s |  So yeah, it's a hand file.
565.19s - 569.29s |  And like I said, first round is about an hour.
569.29s - 573.79s |  And mostly about a half of the field will open within that a lot of time.
573.79s - 579.20s |  Some people will be a bit faster.
579.20s - 580.50s |  That's a law.
580.50s - 584.10s |  Order of magnitude or so faster, maybe.
584.10s - 585.40s |  Yeah, and then what other kinds of competitions?
585.40s - 588.50s |  So there's also safe manipulation or safe cracking, if you will.
588.50s - 591.40s |  But here we don't have the entire safe shipping.
591.40s - 595.30s |  Big metal boxes to competitions would be painful and expensive.
595.40s - 598.60s |  So we just have the actual safe lock mounted on a piece of plastic.
598.60s - 603.20s |  The idea here is to figure out how to open the safe dial in the fastest time,
603.20s - 604.40s |  just like everything else.
604.40s - 605.90s |  How you actually open a safe dial,
605.90s - 608.80s |  it's a bit different than lock picking, than impressioning.
608.80s - 610.00s |  Completely different mechanism, right?
610.00s - 611.70s |  And so the attack is different.
611.70s - 615.20s |  Instead of using straight feel like you would with lock picking,
615.20s - 617.60s |  you're actually using sight and feel combined.
617.60s - 619.90s |  And then you're doing a little bit of math homework,
619.90s - 622.10s |  which is always fun in a competition.
622.10s - 625.50s |  You're building very nice graphs to show how you open the lock.
625.50s - 629.40s |  In competition, there's usually about three locks that are very commonly used.
629.40s - 633.10s |  I'd say the S&G 6730 is by far the most common.
633.10s - 634.60s |  So if you want to start practicing this hobby,
634.60s - 636.30s |  go on eBay and buy yourself one of those.
636.30s - 638.30s |  They're usually about $50.
638.30s - 640.70s |  There's also the Legarde 3300.
640.70s - 642.50s |  That one is a little bit trickier.
642.50s - 645.10s |  But if you want to practice a couple things, that's a good one to try.
645.10s - 648.60s |  And then finally, the Big Red is just kind of the prettiest lock you can buy.
648.60s - 651.30s |  Look, it's got nice red wheels.
651.30s - 654.10s |  So what are we feeling for when we're actually manipulating this lock?
654.10s - 656.70s |  You're dialing a number, and then you're going back.
656.70s - 658.50s |  And if you know anything about how you open an actual safe,
658.50s - 661.30s |  if you know the combination, you would dial, you know, the wheel,
661.30s - 664.70s |  three different numbers, and then you go back to center, back to zero,
664.70s - 668.30s |  and you rotate it, and this nose will drop in.
668.30s - 670.00s |  It's not us. I don't think that's me.
670.00s - 672.40s |  And we'll drop in and retract the bolt here.
672.40s - 674.90s |  You can see the nose has dropped into that brass circle there.
674.90s - 677.60s |  If it's not going to drop in, you'll see it rides along that brass circle,
677.60s - 680.20s |  but then it actually collides with it on both sides.
680.20s - 683.60s |  And where it collides is usually somewhere around 95 and 5.
683.60s - 688.90s |  And so if you try a number, and then you try 95 and 5, try a different number,
688.90s - 691.40s |  feel where those points are hitting.
691.40s - 695.90s |  The closer you get to the correct code, the numbers will actually start to converge
695.90s - 700.50s |  because that nose is actually going a little bit lower into that brass wheel.
700.50s - 705.70s |  And so instead of 95 and 5, eventually you might get 96 and 4.
705.70s - 708.90s |  And that's when you know, okay, I found the correct number for one of those three digits.
708.90s - 711.50s |  So you graph that. You build this graph out.
711.50s - 713.80s |  You find that point, and then there's some tests you can do to figure out
713.80s - 715.50s |  if it's the first, second, or third number.
715.50s - 719.50s |  And then you start dialing the second number or third number until you get it open.
719.50s - 721.10s |  There are some A's you can bring as well,
721.10s - 724.70s |  like this sticker that you see on top of this safe dial you stuck on here.
724.70s - 729.50s |  This gives you very fine gradients because it isn't always quite as clear as 95 to 94.
729.50s - 732.40s |  Sometimes it's 95 to 94.5.
732.40s - 735.50s |  And so this extra lines will help you find that exact number.
735.50s - 739.10s |  So it's a time-consuming process, but some people get very fast at it
739.10s - 742.30s |  and can open locks in, you know, 20 minutes maybe.
742.30s - 746.10s |  In a regular competition with non-professionals spinning the wheels,
746.10s - 749.10s |  it's, you know, two hours is probably a good time.
749.10s - 751.60s |  Usually these competitions run during a larger event.
751.60s - 754.10s |  So you have all day with the lock that you're playing with it
754.10s - 757.10s |  while other people are giving talks or other people competing in other things.
757.10s - 758.00s |  You can keep working on it.
758.00s - 763.00s |  So that's typically how safe manipulation works at these events.
763.10s - 766.60s |  And then finally, another type of competition we see a lot of is lever lock picking.
766.60s - 771.00s |  This is particularly common in Europe where you have the kind of older lever style locks
771.00s - 773.40s |  like you see a lot in England.
773.40s - 775.60s |  Completely different tools, a little bit different skill set,
775.60s - 777.50s |  but you're still basically just picking a lock.
777.50s - 778.50s |  Same ideas.
778.50s - 781.60s |  These locks are also a little bit bigger, a little bit heavier.
781.60s - 782.90s |  So we're not passing them around.
782.90s - 786.60s |  It's more kind of like the impressioning thing where you're sitting at one lock for a while
786.60s - 789.60s |  and you see how fast you get it while other people try the same lock.
789.60s - 791.90s |  Tools are often provided for you for these
791.90s - 795.00s |  because the tools are very specialized per the manufacturer of locks.
795.00s - 799.20s |  So most people aren't carrying around 50 different brands of tools for 50 different kinds of locks.
799.20s - 802.30s |  So whoever is providing the locks for the competition often also provides the tools,
802.30s - 805.60s |  which is a nice perk.
805.60s - 807.60s |  We also have a bunch of crazy events.
807.60s - 812.00s |  And I think there's actually one going on next door like right now, a dozer drill.
812.00s - 815.40s |  But people, of course, get creative at different hacker cons.
815.40s - 816.50s |  They want to try new things.
816.50s - 818.70s |  And so you can find all kinds of different events.
818.70s - 821.80s |  Dozer drill is kind of like what you see a photo of here on the screen.
821.80s - 824.50s |  This is kind of a simulation of a prison escape, right?
824.50s - 825.70s |  You've been locked up.
825.70s - 827.20s |  You need to get yourself out of handcuffs.
827.20s - 829.00s |  And then you need to get yourself out of a jail cell.
829.00s - 831.70s |  And then you need to get into a file cabinet to steal your police record.
831.70s - 835.30s |  And then you need to get into a police car and steal it and drive away.
835.30s - 840.00s |  So there are all kinds of different locks on the table to simulate that kind of escape.
840.00s - 842.30s |  And then there's also different kinds of things like forensic challenges.
842.30s - 844.00s |  Can you pick a lock without leaving marks in it?
844.00s - 845.80s |  Or can you identify the marks that were left in it?
845.90s - 849.00s |  Or can you tell what kind of pins are actually in this lock by feel?
849.00s - 849.70s |  Is that a spool?
849.70s - 850.90s |  Is it serrated?
850.90s - 852.30s |  Those kinds of things.
852.30s - 854.80s |  There's freestyle events, which is like go crazy.
854.80s - 856.00s |  Bring whatever tool you want.
856.00s - 857.20s |  Open the lock however you want.
857.20s - 859.10s |  See how it goes.
859.10s - 860.50s |  As long as it's non-destructive.
860.50s - 860.90s |  Yeah, yeah.
860.90s - 862.20s |  You can't cut the lock in half.
862.20s - 865.40s |  But yeah.
865.40s - 869.80s |  And then key duplication based on a photo rather than having the lock to try.
869.80s - 875.00s |  Kind of like impressioning different kinds of boxes of locks, time blocks.
875.10s - 877.20s |  You see things like under door tool things as well.
877.20s - 880.30s |  Trying to get into buildings just bypassing the lock entirely.
880.30s - 881.60s |  Or pick-tac-toe.
881.60s - 888.40s |  It's something that the Foxpic people put together to pick locks and try to get the fastest, you know, to get three in a row.
888.40s - 890.50s |  So all kinds of really fun, creative things.
890.50s - 895.40s |  We like coming up with different kinds of competitions to always keep it fresh and interesting.
895.40s - 897.70s |  So that brings us to where do you compete?
897.70s - 899.20s |  We've talked about all different kinds of things.
899.20s - 899.50s |  Okay.
899.50s - 900.70s |  So we've gotten you excited about this.
900.70s - 902.40s |  Hopefully you want to come give it a try.
902.40s - 906.60s |  Where can you go to do this other than, you know, in DEF CON in the Lockpick Village?
906.60s - 909.40s |  Well, probably the biggest and best event we'll start with first.
909.40s - 911.60s |  And that's you, since you've run it before.
911.60s - 912.60s |  Yeah.
912.60s - 914.70s |  Hello.
914.70s - 917.50s |  Like Matt said, you can compete, well, basically all over the world.
917.50s - 921.50s |  But the one you really want to compete in and win is LockCon.
921.50s - 926.50s |  So that's considered to be the, well, the Wimbledon of the Lockpick world.
926.50s - 929.20s |  It's one of the oldest competitions there.
929.20s - 933.00s |  It's, well, in the Netherlands, they do the Dutch Open.
933.00s - 933.60s |  It's quite small.
933.60s - 937.70s |  It's about 100 people, but those tend to be from all around the world.
937.70s - 939.00s |  So it's brilliant.
939.00s - 942.00s |  It's mostly, normally it's in October-ish.
942.00s - 945.20s |  Takes about three days, so a long weekend.
945.20s - 947.20s |  Last couple of times it was in a hotel.
947.20s - 949.80s |  And so it's all catered, all done.
949.80s - 956.00s |  And you'll be spending time with a lot of people and a lot of locks during that time.
956.00s - 962.00s |  There will always be, well, just regular picking games.
962.00s - 964.30s |  Impressioning also, definitely.
964.30s - 968.10s |  Most of the time lever locks will do safe manipulation.
968.10s - 971.90s |  Last year we had a car entry.
971.90s - 975.30s |  There's just a lot of, lot of, lot of talks, and they keep on going on and on.
975.30s - 977.70s |  It's really, really brilliant.
977.70s - 980.10s |  It's fun times to be there.
980.10s - 981.90s |  So, yeah, this is the same.
982.00s - 989.90s |  Yeah, this, I mean, competitions, like I said, table to table, and also a lot of talks.
989.90s - 1001.60s |  The picture on the right, that's actually a person that broke out of jail in a South African imprisonment.
1001.60s - 1007.60s |  And yeah, he taught himself how to pick locks and to make tools to pick locks.
1007.60s - 1012.60s |  And that was fun, because normally when he gets invited to talk about this stuff,
1012.60s - 1015.40s |  they talk about how it was to be in prison, this and that.
1015.40s - 1022.20s |  And this was the first time he could speak to a couple of geeks who were geeking out about how he made lockpicks.
1022.20s - 1025.30s |  So that was a very, very fun experience.
1025.30s - 1031.30s |  That's actually one of the very few talks that has been ever recorded at LockOn,
1031.30s - 1036.80s |  because normally it's a non-cabaret event, at least non-publicity.
1036.80s - 1041.40s |  And you tend to only can get in if you know people.
1041.40s - 1047.00s |  So it's, well, it's not that a lot of what happens there is a secret,
1047.00s - 1049.00s |  but a lot of our toys are quite expensive.
1049.00s - 1051.10s |  And we just leave our toys out at night.
1051.10s - 1057.30s |  And yeah, because it's a friendly group and it's a close-knit known group, you can actually do that.
1057.30s - 1061.40s |  But it's a very, very, very fun event.
1061.40s - 1063.50s |  Lockfest.
1063.50s - 1065.80s |  And what are we going to do, lock up our toys?
1065.80s - 1068.10s |  Yeah, yeah, yeah, it's locks, right?
1068.10s - 1069.70s |  Yeah, no, and Tim was great.
1069.70s - 1071.60s |  You know, you get some really, really good talks.
1071.60s - 1074.10s |  I enjoy that part of it every year.
1074.10s - 1077.30s |  You know, I think he even had a movie made about him, right?
1077.30s - 1078.90s |  Daniel Radcliffe played him in the movies.
1078.90s - 1080.20s |  Yeah.
1080.20s - 1082.20s |  Yeah, very cool stuff.
1082.20s - 1085.90s |  Cool. So if that's maybe a little too far for your first lockpicking competition,
1085.90s - 1088.90s |  you can look a little bit closer to the U.S. if you're from here.
1088.90s - 1090.60s |  We have Lockfest almost every year.
1090.60s - 1092.00s |  Hopefully we'll have it again next year.
1092.00s - 1094.00s |  There was a pause for COVID.
1094.10s - 1095.90s |  It's been in Seattle a number of years.
1095.90s - 1098.20s |  I don't know where the next one will be, but hopefully soon.
1098.20s - 1100.50s |  Go tell tool people you want to have Lockfest back.
1100.50s - 1101.90s |  Make it happen.
1101.90s - 1104.00s |  It's usually, again, a weekend-long event.
1104.00s - 1104.90s |  There's lockpicking.
1104.90s - 1106.70s |  There's safe opening.
1106.70s - 1110.10s |  Here you can see the timed competition that I built with a couple of folks
1110.10s - 1113.60s |  and people compete on to see how quickly they can get locks open.
1113.60s - 1114.80s |  Again, a lot of good talks.
1114.80s - 1116.20s |  Pretty small conference, again.
1116.20s - 1118.20s |  You know, the lock community is a pretty tight-knit group,
1118.20s - 1121.20s |  so maybe about 60, 80 people will show up for this.
1121.20s - 1122.30s |  Just have a really good time.
1122.30s - 1124.90s |  Have some good talks.
1124.90s - 1128.50s |  If you're a little bit more in the Midwest, there's always Locktoberfest in October.
1128.50s - 1131.10s |  It is held by Tool Chicago.
1131.10s - 1132.10s |  Seems like a really good event.
1132.10s - 1135.30s |  I have not been there, but I always see photos, and it looks super fun.
1135.30s - 1138.00s |  So maybe one day I'll make it out there when I can spare the time.
1138.00s - 1139.60s |  But they have, you know, grilling.
1139.60s - 1142.00s |  You can get some beer and some brats and go pick locks.
1142.00s - 1145.40s |  So, you know, proper Locktoberfest.
1145.40s - 1148.30s |  And here's a photo of some people winning some locks and other various picks
1148.30s - 1154.90s |  and cool things from their conference from a couple of years ago.
1154.90s - 1160.10s |  But if you're really into spending your AMLs, head out to Australia.
1160.10s - 1162.50s |  Actually, well, this happened three times now, I think.
1162.50s - 1167.70s |  In Melbourne, there is All Second.
1167.70s - 1171.30s |  It's the same ish as the other events, but it's Australia,
1171.30s - 1174.60s |  so it has a completely different feel to it.
1174.60s - 1175.90s |  Also, a lot of talks.
1175.90s - 1177.30s |  Very interested.
1177.30s - 1181.50s |  Speakers flown in from, well, basically all around the world.
1181.50s - 1186.20s |  But the people there, so the attendants, are mainly Australians.
1186.20s - 1187.50s |  And it's fun. It's brilliant.
1187.50s - 1191.20s |  And, of course, for us international lockpickers, if you go there,
1191.20s - 1196.10s |  they have different locks, and those locks are different beasts,
1196.10s - 1198.10s |  and they need to be attacked in different ways.
1198.10s - 1200.10s |  So that's very fun.
1200.10s - 1204.90s |  That's normally in June, and, well, they have workshops locked and everything.
1205.00s - 1208.80s |  So we did have picking there, master keying.
1208.80s - 1212.00s |  We actually did have an impressioning event at one point,
1212.00s - 1215.50s |  and they're also quite big on temper evidence.
1215.50s - 1221.40s |  So, yeah, that's a very, very, very fun event.
1221.40s - 1227.60s |  Toby, the head organizer, did take a break because of work and life and all the stuff.
1227.60s - 1232.70s |  It'll probably happen again, but probably not this year.
1232.70s - 1234.30s |  Well, definitely not this year.
1234.30s - 1237.40s |  Probably not next year as well, but it's still in the books.
1237.40s - 1240.10s |  At some point that will happen.
1240.10s - 1244.90s |  You see, well, a box of weird keys that they do have there,
1244.90s - 1250.50s |  and some keys are giving a lecture about impressioning.
1250.50s - 1257.60s |  Yeah, and then in Europe, well, like I said, there's lock-on in the Netherlands.
1257.60s - 1265.20s |  The Germans do every now and then also have end impressioning competitions,
1265.20s - 1268.00s |  and on a separate day, they'll do the lock-picking.
1268.00s - 1275.10s |  And the Czech guys at the moment are also doing that.
1275.10s - 1279.80s |  Smaller-ish group, so 90 people, it's rather close to Prague,
1279.80s - 1282.80s |  and that, well, they're doing that for quite a couple of years now.
1282.80s - 1285.40s |  And as you can see, they have a couple of sponsors,
1285.40s - 1288.40s |  which is not always the case within the lock-picking community,
1288.40s - 1289.60s |  at least for an event.
1289.60s - 1295.10s |  Normally, the prizes get sponsored and stuff like that, but that's about it-ish.
1295.10s - 1297.70s |  Is this yours?
1297.70s - 1298.30s |  And where else?
1298.30s - 1301.10s |  There's always a few smaller conferences or conferences that are bigger,
1301.10s - 1303.80s |  but where there's a smaller lock-picking portion to it,
1303.80s - 1306.90s |  of course, DEF CON right through there.
1306.90s - 1309.00s |  It's pretty big here, yeah.
1309.00s - 1310.70s |  There's HOPE in New York.
1310.70s - 1313.90s |  There's ShmooCon in DC, at least one more year.
1313.90s - 1319.40s |  CCC, EMF, all the various Dutch hacker cons that change their name annoyingly every year.
1319.40s - 1321.20s |  For God's reasons.
1321.20s - 1325.40s |  All the various B-sides often have lock-picking events that you can go participate in,
1325.40s - 1329.60s |  and then Hacker Hotel, again in the Netherlands.
1329.60s - 1333.50s |  Other than that, there's also locksmithing and safe technician conferences.
1333.50s - 1335.10s |  These tend to be a little bit more invite-only.
1335.10s - 1338.00s |  You probably need to be part of a locksmithing association.
1338.00s - 1340.00s |  Some of those are easier or harder to join,
1340.00s - 1345.00s |  but you can go and do safe cracking and hear a lot of talks about that if that's your thing,
1345.00s - 1349.60s |  and they have cool prizes like gold-plated locks when you win sponsors.
1349.60s - 1351.40s |  So, that is it.
1351.40s - 1353.20s |  That is all the different kinds of competitions.
1353.20s - 1354.70s |  Those are the different ways you can compete.
1354.70s - 1357.00s |  We wanted to thank a few people.
1357.00s - 1358.20s |  Our co-authors.
1358.20s - 1360.40s |  There were five of us that wrote the book.
1360.40s - 1363.70s |  Three of us are not here, so Walter, Nigel, and Banditos.
1363.70s - 1366.50s |  Really appreciate the sections of the book that they wrote.
1366.50s - 1367.00s |  It was great.
1367.00s - 1370.10s |  I want to thank specifically Peter South, who was our technical reviewer,
1370.10s - 1373.50s |  and who's also here in the front row and has helped out with Tool and Seattle Locksport
1373.50s - 1376.00s |  and co-run Seattle Locksport with me.
1376.00s - 1377.40s |  Super great guy.
1377.40s - 1378.70s |  Lucky Duck, thanks for being here.
1378.70s - 1380.90s |  You're awesome and my favorite.
1380.90s - 1386.40s |  Thanks to Random Person from the Internet for the background photo that was Creative Commons,
1386.40s - 1389.90s |  and then also thanks to Tool US for letting us come here and speak,
1389.90s - 1392.20s |  and to DEF CON for letting us speak.
1392.20s - 1395.30s |  Finally, if you want to get in touch, here are all the things.
1395.30s - 1398.00s |  You can go to links and find me or us.
1398.00s - 1403.30s |  But more importantly, we will be here at the book signing at the NoStarch booth at 2.30 today.
1403.30s - 1405.70s |  So if you do not have a copy of our book and you would like one
1405.70s - 1409.50s |  and you wanted to have at least two author signatures and a tech reviewer signature,
1409.50s - 1413.30s |  2.30, just there, vendor area east.
1413.30s - 1414.80s |  We will be sitting there and signing things.
1414.80s - 1415.70s |  So come say hi.
1415.70s - 1416.90s |  Come get books signed.
1416.90s - 1417.70s |  Thank you so much.
1417.70s - 1418.50s |  One more thing.
1418.50s - 1419.10s |  Yes, yes.
1419.10s - 1421.30s |  One more thing, hot from the press.
1421.30s - 1427.60s |  As of last week, this book also exists in a Braille format.
1427.60s - 1429.50s |  Cool.
1429.50s - 1431.10s |  Yes, very cool.
1431.10s - 1436.80s |  That is currently only in Europe because it has been transcribed there to make that happen.
1436.80s - 1441.80s |  But as I understood, I am completely new to this format and this world.
1441.80s - 1446.00s |  I do have a couple of blind friends, but of course, I don't do Braille.
1446.00s - 1451.40s |  Apparently, the way it works, if it does exist in Europe,
1451.40s - 1454.20s |  then it automagically will, at some point,
1454.20s - 1459.60s |  will become available in American Braille libraries as well.
1459.60s - 1465.22s |  So we think it's awesome.
1465.22s - 1466.32s |  Thank you, DEF CON.
1466.32s - 1467.32s |  Thank you.


