# Media

url: https://www.youtube.com/watch?v=iN1c0j4nGvo
title: DEF CON 32 - Navigating the Cyber Security Labyrinth Choose Your Own Security Adventure - punkcoder
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=iN1c0j4nGvo",
  "title": "DEF CON 32 - Navigating the Cyber Security Labyrinth Choose Your Own Security Adventure - punkcoder",
  "description": "Over the last 36 months, the cybersecurity landscape has evolved with unprecedented complexity, marked by ransomware, supply chain attacks, zero-days, remote work challenges, and more. Amid mass layoffs and pervasive mental burnout, organizations face daunting tasks in defending against escalating cyber threats. Layoffs exacerbate the skills gap, leaving teams stretched thin. Mental burnout hampers practitioners' abilities. In this talk, we'll explore the impacts of recent and chart a path forward for application security. As a lone AppSec professional, your choices will shape the future. Will you navigate through complexity or become lost in redundant complications?",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1639,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.50s | This text was transcribed using whisper model: large-v2

 Alright, so you are now attending Navigating the Cyber Security Labyrinth, Choose Your Own Security Adventure.
7.50s - 14.50s |  Uh, the first thing I'd like to point out is because I am an independent consultant and I am here as my own business, as Wistan Security,
14.50s - 20.80s |  um, nothing that I say on this stage will ever be endorsed by any of my employers.
20.80s - 24.30s |  Okay? So we're just getting that out of the way here to start with.
24.30s - 29.30s |  Uh, my name is James and because of that I go by Punk Coder.
29.30s - 38.80s |  Um, I spent 15 years as a software developer. I did, have done the last 7 or 8, 9, 10, something like that as a security professional in AppSec.
38.80s - 43.80s |  Um, but this talk isn't about me. It's about you.
43.80s - 52.60s |  And I want to make that very clear because this entire conversation is, you know, me kind of reflecting back over the things that have happened to me
52.60s - 57.10s |  and what we've done to get here and what the future needs to look like.
57.10s - 62.40s |  So this is a conversation about exploits. Sorry I'm not going to be dropping any zero days on you.
62.40s - 67.40s |  Code, AppSec, and maybe some memes.
67.40s - 74.90s |  Okay? So this has been a tough couple years for all of us. For those of you who recognize this, this is the image of what happened in the world
74.90s - 82.40s |  whenever we had the breached forums who went offline because they were taken down by the United States government.
82.70s - 91.70s |  Then within 48 hours we're back online again, only to be taken down another 72 hours later, only to come back 24 hours later after that.
91.70s - 96.70s |  I feel like this has been tough no matter what side of any of this you're on.
96.70s - 100.70s |  If you're Red Team, you're AppSec, it doesn't matter. It's all been tough.
100.70s - 106.70s |  In top of that, we're dealing with things left over from the pandemic where all of our lives changed
107.00s - 113.00s |  and cyber security inevitably changed because of this.
113.00s - 119.00s |  Okay? It's been tough because this has also been the last year of breaches.
119.00s - 124.00s |  Like this isn't even a full list, this is just kind of the big ones.
124.00s - 127.00s |  Okay? And they barely fit on my screen.
127.00s - 134.33s |  But did we stand up and say, enough is enough?
134.33s - 138.33s |  Quick, everybody get the servers back online, get back to business.
138.63s - 144.63s |  It's all just pace after another, one after another, and we continue along with the speed.
144.63s - 146.63s |  And everybody likes a joke.
146.63s - 152.63s |  The number of times that I've seen this set up because humor is how we deal with it, right?
152.63s - 158.63s |  We saw this come out and this was originally because of a node library that was a problem
158.63s - 165.63s |  and then we had the log4j incident and it became the poster child for log4j
165.93s - 171.93s |  and then we had the CrowdStrike issue come out and it became the poster child for CrowdStrike, right?
171.93s - 175.93s |  That tire, you know, we always talk about the little block that's down there that's possibly
175.93s - 179.93s |  going to be the end of it, but in this case, it was the giant block.
179.93s - 185.93s |  They took 8.5 million computers off of the world, critical infrastructure,
185.93s - 191.93s |  and then a couple weeks later, had a giant banner just across the street at this previous
192.23s - 196.23s |  conference at Black Hat advertising and you know what?
196.23s - 204.08s |  Their booth was filled and sometimes we reveled in the fact that we were running stuff
204.08s - 208.08s |  so old we couldn't be impacted by it.
208.08s - 214.08s |  There were people who were absolutely proud of the fact that this didn't happen at Southwest Airlines
214.08s - 220.59s |  because they were running Windows 3.1, okay?
220.59s - 224.59s |  Now, we have things that we are trying to do in this space to make things better.
224.89s - 228.89s |  There are people who are fighting the good fight and trying to go for this stuff.
228.89s - 234.89s |  NIST has done a fantastic job of going through and saying, hey, we've got the secure by design guidelines.
234.89s - 240.89s |  How many people have heard or read the secure by design guidelines published by CISA?
240.89s - 244.89s |  How many of you have actually talked to your developers about them?
244.89s - 250.22s |  Did your response look like this?
250.52s - 256.52s |  I was told you will take C away from me when you pry it from my cold dead hands.
256.52s - 264.57s |  No matter how hard we push for rust, this is what we're up against.
264.57s - 270.57s |  And to show you the other side of this conversation, how desperate the other side of this is,
270.57s - 276.57s |  this is the group of signatories for the secure by design paper.
276.57s - 280.57s |  Saying this is what we need to do.
280.87s - 288.87s |  Last time I checked, we were up to 12 foreign countries, including every major security agency in the United States.
288.87s - 298.31s |  And the answer to this was, you will take C from me when you pry it from my cold dead hands.
298.31s - 301.31s |  So where does this leave us?
301.31s - 308.55s |  We keep trading long-term success for short-term wins.
308.55s - 317.23s |  I don't think I'm alone in this in saying that we can't continue down this path.
317.53s - 321.53s |  Like cyber security cannot continue down this path.
321.53s - 324.53s |  And that's part of the reason I'm up here giving this conversation.
324.53s - 329.84s |  Because we end up with things like this.
329.84s - 337.82s |  Anybody spot what's missing in this?
337.82s - 341.82s |  What's missing in this is the human being.
341.82s - 346.82s |  Because we have continued to go round cycle after cycle after cycle,
346.82s - 355.89s |  thinking that one more piece of software will fix the issue.
356.19s - 362.19s |  And we here in the AppSec have a particularly difficult challenge.
362.19s - 368.19s |  You can go to three different managers and ask them, what does AppSec mean?
368.19s - 371.19s |  And you know what answer you get?
371.19s - 373.19s |  You get this one.
373.19s - 377.19s |  AppSec is the process of finding and fixing and preventing security vulnerabilities
377.19s - 381.19s |  in application level in hardware, software and development processes.
381.49s - 385.49s |  It includes guidance on measures for applications designing and developing
385.49s - 389.49s |  through the whole life cycle including after the application has launched.
389.49s - 391.49s |  You know why you get that answer?
391.49s - 400.72s |  Because that's the first answer you get when you type what is AppSec into Google.
400.72s - 403.72s |  Our bosses don't understand what it is that we do.
403.72s - 406.72s |  I know in the 15 years I was a software developer,
406.72s - 410.72s |  my boss kind of understood what I did.
411.02s - 415.02s |  I moved over for several years doing cybersecurity.
415.02s - 419.02s |  I can guarantee you my boss didn't understand what it was that we did.
419.02s - 425.02s |  And the worst part about this is, the longer that we go along this,
425.02s - 429.85s |  the crazier the headlines get.
429.85s - 433.85s |  This is not a sustainable path.
433.85s - 437.85s |  But I will say, I don't want to go full gloom and doom on this,
437.85s - 441.85s |  because there have been good things that have come out of this.
442.15s - 446.15s |  If you do not follow Inspirational Skeletor,
446.15s - 448.15s |  I strongly suggest that you do.
448.15s - 453.15s |  As an InfoSec person, this has kept me in a sane, rational position
453.15s - 455.15s |  for far longer than it should have.
455.15s - 459.15s |  And when this doesn't work, I go to therapy.
461.15s - 465.15s |  And I can tell you, the people that I interact with,
465.15s - 469.15s |  and I say this specifically because I think it's important for us to address mental health
469.15s - 471.15s |  and normalize it.
471.45s - 475.45s |  Because the work that we do in AppSec and in cybersecurity,
475.45s - 481.45s |  a lot of times is thankless work with long hours and stressful issues.
481.45s - 489.08s |  There is no shame in saying, hey, I need somebody to talk to about this.
489.08s - 493.08s |  But this leads down a whole series of paths and questions, right?
493.08s - 496.08s |  We've gone the full spectrum from where all of this is,
496.08s - 500.08s |  what we think will actually fix it, and how we cope with this situation.
500.38s - 502.38s |  But that's not what this talk is about.
502.38s - 506.38s |  This talk is about trying to figure out the answers
506.38s - 510.38s |  to some of the questions that will determine your future,
510.38s - 514.38s |  my future, and our future together, collectively.
514.38s - 515.38s |  Okay?
515.38s - 517.38s |  Because realistically speaking,
517.38s - 520.38s |  the people who are making the difference are sitting in this room.
520.38s - 523.85s |  My boss doesn't understand what it was.
523.85s - 527.85s |  I pointed out a couple things that became an issue later on,
527.85s - 529.85s |  and my boss went, wow, that's a really good job.
530.15s - 533.15s |  You should do that long term.
533.15s - 535.15s |  Cool.
535.15s - 536.15s |  Okay?
536.15s - 539.15s |  So, this is going to lead you to a series of questions.
539.15s - 541.15s |  And I want, we're going to do a little voting.
541.15s - 542.15s |  This is going to be a little interactive.
542.15s - 543.15s |  Do something fun.
543.15s - 545.15s |  Hack a little slideshow, right?
545.15s - 547.15s |  So, what I'm going to do is I'm going to pop up a question.
547.15s - 550.15s |  We're going to talk about pros and cons, and I'm going to have you vote.
550.15s - 552.15s |  And we're going to go in a direction.
552.15s - 555.15s |  So, the easy one, because it's fun for us all to sit back
555.15s - 557.15s |  and kind of be angry at it right now.
557.45s - 558.45s |  AI.
558.45s - 561.45s |  How many people think that AI is actually going to go through
561.45s - 563.45s |  and save cybersecurity?
563.45s - 567.45s |  How many people think that AI in AppSec is going to solve the problem?
567.45s - 570.45s |  And I'm not putting myself in either direction,
570.45s - 573.45s |  because I've got an argument for both sides.
573.45s - 574.45s |  So, think about it.
574.45s - 577.45s |  And think about what the outcome of this is.
577.45s - 580.45s |  And the reason that I'm asking you to think about that outcome
580.45s - 582.45s |  is because more than likely at this point,
582.45s - 584.45s |  somebody's already checked in with you, right?
584.75s - 588.75s |  This decision was made before we ever sat down at the table.
588.75s - 591.75s |  How many people got asked what their opinion
591.75s - 594.75s |  about Copilot was before it rolled out?
594.75s - 604.31s |  How much did your response matter?
604.31s - 605.31s |  Okay?
605.31s - 608.31s |  So, on the pro side, how many people honestly believe
608.31s - 611.31s |  that AI will do all the things that the security vendors say it will,
611.31s - 614.31s |  and it will change us, and we will be better off for it
614.31s - 616.31s |  in the AppSec space?
616.31s - 620.31s |  How many people say that AI is the next thing
620.61s - 622.61s |  that this C-suite wants us to do,
622.61s - 624.61s |  more interested in focusing on that
624.61s - 628.61s |  than the fact that everything right now is on fire?
628.61s - 629.61s |  All right.
629.61s - 634.50s |  We will go down the path of AI dooms us all.
634.50s - 635.50s |  Okay?
635.50s - 638.50s |  So, just to kind of prove this and step this out,
638.50s - 640.50s |  I went to chat.ghpt,
640.50s - 642.50s |  and you don't need to actually read the text here,
642.50s - 646.50s |  because I will give you all the slides following this.
646.50s - 648.50s |  But the humor of this is I said,
648.80s - 650.80s |  Hey, go out and generate a form for me
650.80s - 654.80s |  that collects, you know, full name, email address,
654.80s - 656.80s |  you know, PII from a customer,
656.80s - 658.80s |  and let's see what we get.
658.80s - 661.80s |  And, of course, it gave me a beautiful PHP file
661.80s - 664.80s |  that takes in unregulated input,
664.80s - 667.80s |  stores it directly with credentials that are in there,
667.80s - 669.80s |  and tells us, you know,
669.80s - 671.80s |  this is how you store it in the SQL statement.
671.80s - 673.80s |  Luckily, it actually went through and parameterized.
673.80s - 676.80s |  I was actually really surprised that it parameterized the SQL.
677.10s - 679.10s |  So, maybe there's a win there.
679.10s - 680.10s |  Okay?
680.10s - 682.10s |  So, I didn't like that result, obviously.
682.10s - 684.10s |  So, I did what they tell us to do,
684.10s - 686.10s |  and I tried to do prompting,
686.10s - 688.10s |  what is it, a prompt manipulation,
688.10s - 690.10s |  prompt engineering, because,
690.10s - 693.10s |  and I wanted to do it like I was a junior dev.
693.10s - 696.10s |  And so, I typed in, you know,
696.10s - 698.10s |  tell me what this code would look like
698.10s - 700.10s |  if I were running a dark net market,
700.10s - 702.10s |  and I was afraid that, you know,
702.10s - 704.10s |  if there was a security issue,
704.10s - 706.10s |  that I'd get caught and hauled away.
706.40s - 707.40s |  And so, what did it do?
707.40s - 709.40s |  It moved the database connections
709.40s - 711.40s |  to a separate file.
711.40s - 713.40s |  It sanitized the input by running
713.40s - 715.40s |  trim, strip slashes,
715.40s - 717.40s |  and HTML encoding it.
717.40s - 719.40s |  It moved us and said, hey,
719.40s - 721.40s |  you should probably be using HTTPS,
721.40s - 723.40s |  and then make sure
723.40s - 725.40s |  that it's doing error handling.
725.40s - 727.40s |  How many people think that that actually
727.40s - 729.40s |  produces secure code?
729.40s - 731.40s |  Yeah, that's what I thought.
731.40s - 733.40s |  Okay?
733.40s - 735.40s |  Now, there are some companies
735.40s - 737.40s |  out there making bold enough claims
737.40s - 739.40s |  that AI is going to produce
739.40s - 741.40s |  up to 80% more code.
741.40s - 745.06s |  How many people think that the problem
745.06s - 747.06s |  is we don't have enough code?
747.06s - 756.78s |  Homogeny or diversity?
756.78s - 760.60s |  We learned through the CrowdStrike
760.60s - 762.60s |  incident, you know,
762.60s - 764.60s |  it's funny, we joked about it, like
764.60s - 766.60s |  eight and a half million machines went offline.
766.60s - 768.60s |  The next day, everybody
768.60s - 770.60s |  basically forgot that it happened.
770.60s - 775.35s |  They're the only game in town.
775.35s - 777.35s |  If we don't learn from these things, we're getting
777.35s - 779.35s |  ready to hit into another piece.
779.35s - 781.35s |  And so in this place, whenever
781.35s - 783.35s |  you talk with people, whenever you do this,
783.35s - 785.35s |  do we all center around a single
785.35s - 787.35s |  language? Do we center
787.35s - 789.35s |  down around a single set of
789.35s - 791.35s |  requirements?
791.35s - 793.35s |  Is that the right thing for us to do?
793.35s - 795.35s |  Or is it a good idea to teach the principles
795.35s - 797.35s |  of security and go
797.35s - 799.35s |  in that direction?
799.35s - 801.35s |  Teach teams to be independently
801.35s - 803.35s |  sufficient and to think about security
803.35s - 805.35s |  in the context of their application?
805.35s - 807.35s |  Do we implement a check
807.35s - 809.35s |  in the CICD pipeline that is the same
809.35s - 811.35s |  for every single one of our programs?
811.35s - 813.35s |  Or do we have
813.35s - 815.35s |  teams go through, implement the ones that
815.35s - 817.35s |  make sense for them, and tune
817.35s - 819.35s |  them and teach them how to tune
819.35s - 821.35s |  so that it meets
821.35s - 823.35s |  their threat model?
823.35s - 825.35s |  I'm asking that question
825.35s - 827.35s |  because you all are going to be the ones
827.35s - 829.35s |  that are implementing that.
829.35s - 831.35s |  As AppSec, that's what we do.
831.35s - 833.35s |  And whenever it
833.35s - 835.35s |  comes time, there's a good chance
835.35s - 837.35s |  that maybe somebody comes to you and
837.35s - 839.35s |  says, this is what we're doing.
839.35s - 841.35s |  There's also a good chance if you've
841.35s - 843.35s |  done your job well enough that somebody's going to ask
843.35s - 845.35s |  you for your opinion on it
845.35s - 847.35s |  and then ask you
847.35s - 849.35s |  to implement it.
849.35s - 851.35s |  I want you to think about these questions.
851.35s - 853.35s |  I want you to have the answer to these
853.35s - 855.35s |  questions before we
855.35s - 857.35s |  get to the point where somebody asks that question
857.35s - 859.35s |  because in the moment,
859.35s - 861.35s |  you're not going to be thinking
861.35s - 863.35s |  clearly about the subject.
863.35s - 865.35s |  And this is kind of a high-level one.
865.35s - 867.35s |  We're going to go into some more
867.35s - 869.35s |  interesting ones here a little further on.
869.35s - 871.35s |  But I want you to
871.35s - 873.35s |  think about that. And as you're sitting in the audience
873.35s - 875.35s |  today, sitting through our
875.35s - 877.35s |  talks about SQL injection,
877.35s - 879.35s |  AI manipulation,
879.35s - 881.35s |  think about these questions
881.35s - 883.35s |  because as you're
883.35s - 885.35s |  going through and putting those in context,
885.35s - 887.35s |  these are the questions that you're going to have to answer
887.35s - 889.35s |  for people when you take this information
889.35s - 893.72s |  back.
893.72s - 895.72s |  To become
895.72s - 899.06s |  a community leader,
899.06s - 901.06s |  do you sit back and do your own thing
901.06s - 903.06s |  or do you help build a
903.06s - 905.06s |  community? I'm not
905.06s - 907.06s |  on this stage because I am an elite
907.06s - 909.06s |  hacker.
909.06s - 911.06s |  Most people can tell you
911.06s - 913.06s |  that the reason that I teach courses
913.06s - 915.06s |  on AppSec is because
915.06s - 917.06s |  I halfway know what I'm talking about.
917.06s - 919.06s |  I'm passionate about the fact
919.06s - 921.06s |  that it gets done, which is the reason I do it.
921.06s - 923.06s |  If you came here
923.06s - 925.06s |  looking for the latest zero day, you're
925.06s - 927.06s |  not going to get it from me. That's not how this works.
929.06s - 931.06s |  But that doesn't mean I can't
931.06s - 933.06s |  start people on the path who
933.06s - 935.06s |  will be the people who find those zero days.
935.06s - 937.06s |  It doesn't mean you
937.06s - 939.06s |  can't be the person who starts that down.
939.06s - 942.70s |  So you have a choice.
942.70s - 944.70s |  Do we sit back,
944.70s - 946.70s |  do our own thing,
946.70s - 948.70s |  or do we work within the community
948.70s - 952.33s |  to start things?
952.33s - 954.33s |  Tough question.
954.33s - 956.33s |  Which way do we go?
956.33s - 961.02s |  This is your journey.
961.02s - 964.58s |  Become a community leader. Votes.
964.58s - 966.58s |  Do your own thing.
968.58s - 970.58s |  So the path on this one leads us down
970.58s - 972.58s |  being a community leader.
972.58s - 974.58s |  And I will tell you about my experience with this.
974.58s - 976.58s |  This is the group
976.58s - 978.58s |  of people who runs B-Sides Boulder.
978.58s - 980.58s |  The reason that
980.58s - 982.58s |  B-Sides Boulder runs is because originally
982.58s - 984.58s |  there was B-Sides Denver
984.58s - 986.58s |  and all the tickets sold out
986.58s - 988.58s |  before
988.58s - 990.58s |  we could get seats.
990.58s - 992.58s |  And I'm not blowing smoke here
992.58s - 994.58s |  because two of the people who are responsible
994.58s - 996.58s |  for this are sitting in the audience.
996.58s - 998.58s |  This happened
998.58s - 1000.58s |  because we saw something
1000.58s - 1002.58s |  and we said, hey, I don't know
1002.58s - 1004.58s |  the first thing about running a conference,
1004.58s - 1006.58s |  but we want to do it.
1006.58s - 1008.58s |  We're now five years in,
1008.58s - 1010.58s |  going strong.
1010.58s - 1012.58s |  Most of this is just
1012.58s - 1014.58s |  giving up. Being a part of the community
1014.58s - 1016.58s |  doesn't mean giving up your entire life.
1016.58s - 1018.58s |  It doesn't mean you only
1018.58s - 1020.58s |  do that now. It doesn't mean
1020.58s - 1022.58s |  all of us are busy.
1022.58s - 1024.58s |  Everybody here is busy.
1024.58s - 1026.58s |  We all have things going on.
1026.58s - 1028.58s |  I do B-Sides Boulder.
1028.58s - 1030.58s |  I do AppSec Village at DEF CON.
1030.58s - 1032.58s |  My hope is that
1032.58s - 1034.58s |  one of you walks out of this room
1034.58s - 1036.58s |  thinking about this and take it back
1036.58s - 1038.58s |  to your home.
1038.58s - 1040.58s |  Start the next DC 720.
1040.58s - 1042.58s |  Start the next B-Sides event.
1042.58s - 1044.58s |  Go do a developer conference
1044.58s - 1046.58s |  where you just go and say, hey,
1046.58s - 1048.58s |  we're going to have a cybersecurity meetup
1048.58s - 1050.58s |  with developers at a conference.
1050.58s - 1052.58s |  You want to have coffee? Let's go have coffee.
1052.58s - 1054.58s |  Any of that small stuff
1054.58s - 1056.58s |  makes an impression. It makes a difference.
1056.58s - 1059.93s |  Okay?
1059.93s - 1061.93s |  So this is an interesting one.
1061.93s - 1063.93s |  Do you become a business leader?
1063.93s - 1065.93s |  Your boss walks in,
1065.93s - 1067.93s |  pulls you up on Zoom, says,
1067.93s - 1069.93s |  okay, here's the deal.
1069.93s - 1071.93s |  That thing that you said, hey, SQL injection
1071.93s - 1073.93s |  is a pretty bad thing, yeah, we had
1073.93s - 1075.93s |  an incident that happened,
1075.93s - 1077.93s |  and that bad thing happened,
1077.93s - 1079.93s |  and we noticed, hey, you said that bad thing
1079.93s - 1081.93s |  was going to happen, so we think you should be
1081.93s - 1083.93s |  in charge of it now. Okay?
1083.93s - 1085.93s |  So your choice is, you can either be in charge
1085.93s - 1087.93s |  of it now, or
1087.93s - 1089.93s |  you can have somebody who may not
1089.93s - 1091.93s |  know what they're doing be in charge
1091.93s - 1093.93s |  of you. It's your choice.
1093.93s - 1095.93s |  One means your life is now going to be
1095.93s - 1097.93s |  spreadsheets and nothing technical.
1097.93s - 1099.93s |  And the other side
1099.93s - 1101.93s |  means you have the ability to make an
1101.93s - 1103.93s |  impact on a much smaller level.
1103.93s - 1107.24s |  What do you do?
1107.24s - 1109.24s |  This one I don't know has a right answer.
1109.24s - 1111.24s |  That's
1111.24s - 1113.24s |  the reason there's no choice down here,
1113.24s - 1115.24s |  is because inherently
1115.24s - 1117.24s |  this is open-ended. This is
1117.24s - 1119.24s |  each one of our path. I went down this
1119.24s - 1121.24s |  path and I made the wrong choice.
1121.24s - 1123.24s |  I realize that now, for myself.
1123.24s - 1125.24s |  But I'm asking
1125.24s - 1127.24s |  you to sit down and think and consider
1127.24s - 1129.24s |  that question before it happens
1129.24s - 1131.24s |  to you so you can think clearly
1131.24s - 1133.24s |  about the process and not just think about
1133.24s - 1136.74s |  what's going on in the moment.
1136.74s - 1138.74s |  To exploit or not to exploit?
1138.74s - 1140.74s |  Okay?
1140.74s - 1142.74s |  We talk about this in going
1142.74s - 1144.74s |  through the process, right? Do you go
1144.74s - 1146.74s |  through and say, hey, that
1146.74s - 1148.74s |  looks a little shady.
1148.74s - 1150.74s |  Maybe I should actually test it
1150.74s - 1152.74s |  for something. What's at the end of that
1152.74s - 1154.74s |  path? Right?
1154.74s - 1156.74s |  And I ask that question because I can
1156.74s - 1158.74s |  make an argument for both directions on this.
1158.74s - 1160.74s |  Again, this is a very interesting one.
1160.74s - 1162.74s |  You get a device, somebody drops it in your
1162.74s - 1164.74s |  hand and says, hey, I think there's something wrong with
1164.74s - 1166.74s |  this. Do you go after
1166.74s - 1171.75s |  it? Does it matter?
1171.75s - 1173.75s |  Does the time that you spend in your
1173.75s - 1175.75s |  free time or in your work time
1175.75s - 1177.75s |  justify the contribution
1177.75s - 1182.15s |  that you'll make in that space?
1182.15s - 1184.15s |  The reason I ask is because
1184.15s - 1187.98s |  of this graph. This is
1187.98s - 1189.98s |  the CVEs per year.
1189.98s - 1191.98s |  And it's not a super
1191.98s - 1193.98s |  sophisticated graph. We can
1193.98s - 1195.98s |  see that the big number is going up.
1195.98s - 1197.98s |  And I can tell you
1197.98s - 1199.98s |  that as somebody who's an app sec, we
1199.98s - 1201.98s |  feel the pain when this goes
1201.98s - 1203.98s |  up. Everybody in the room, you feel
1203.98s - 1205.98s |  the pain whenever this goes up, right? I'm not just
1205.98s - 1207.98s |  crazy.
1207.98s - 1209.98s |  But guess what? If we trace
1209.98s - 1211.98s |  this out in the direction that we're going,
1211.98s - 1213.98s |  this is what that looks like.
1213.98s - 1218.18s |  That is what it looks like.
1218.18s - 1221.66s |  That line that's going up
1221.66s - 1223.66s |  there, that's a
1223.66s - 1227.67s |  close curve on it. Stuff's
1227.67s - 1229.67s |  not sustainable now.
1229.67s - 1231.67s |  You don't believe me that
1231.67s - 1233.67s |  here's the backlog article for
1233.67s - 1235.67s |  what happened
1235.67s - 1237.67s |  that was going on with this.
1237.67s - 1239.67s |  And I don't want to drop this on software developers
1239.67s - 1241.67s |  because I don't think it's fully their problem.
1241.67s - 1243.67s |  Part of it's our
1243.67s - 1245.67s |  problem, part of it's management. I usually
1245.67s - 1247.67s |  come through here and ask, how many PMs are
1247.67s - 1249.67s |  in the crowd? How many PMs are in the crowd today?
1249.67s - 1251.67s |  Do we have any in here
1251.67s - 1253.67s |  right now? There's
1253.67s - 1255.67s |  one, there's like three people pointing
1255.67s - 1257.67s |  to one person over here.
1257.67s - 1259.67s |  I'm not calling
1259.67s - 1261.67s |  you out. What I'm saying is by you being
1261.67s - 1263.67s |  in this room, it's important because
1263.67s - 1265.67s |  it helps you to prioritize
1265.67s - 1267.67s |  this stuff. The developers
1267.67s - 1269.67s |  are not the bad guys. The app sec people
1269.67s - 1271.67s |  are not the bad guys. This stuff happens.
1271.67s - 1273.67s |  Okay?
1273.67s - 1275.67s |  It happens
1275.67s - 1277.67s |  to everyone. This is
1277.67s - 1286.14s |  hard. I've been
1286.14s - 1288.14s |  very vocal about this one.
1288.14s - 1290.14s |  The 90 day window for exploits.
1290.14s - 1292.14s |  Do you give them the 90
1292.14s - 1294.14s |  days? Do you work with a team
1294.14s - 1296.14s |  that is difficult to work with
1296.14s - 1298.14s |  who turns around and threatens you
1298.14s - 1300.14s |  with legal action?
1300.14s - 1302.14s |  Or do you just drop it hot
1302.14s - 1304.14s |  and say, congratulations, here's your
1304.14s - 1308.34s |  O day? Once you've found that
1308.34s - 1310.34s |  exploit, what
1310.34s - 1312.34s |  path are you going to take?
1312.34s - 1314.34s |  And I'm asking you to
1314.34s - 1316.34s |  think about those consequences because I
1316.34s - 1318.34s |  guarantee you the person who dropped
1318.34s - 1320.34s |  the log for J on
1320.34s - 1322.34s |  Minecraft did
1322.34s - 1324.34s |  not think about all
1324.34s - 1326.34s |  of the people who would be working
1326.34s - 1332.57s |  Christmas day. So what do
1332.57s - 1334.57s |  you do with that? How do you
1334.57s - 1336.57s |  answer that question before we get to that
1336.57s - 1338.57s |  space?
1338.57s - 1340.57s |  How do you reach out to developers?
1340.57s - 1342.57s |  Because at the end
1342.57s - 1344.57s |  of this, every piece of software
1344.57s - 1347.82s |  isn't going to solve our problem.
1347.82s - 1349.82s |  The problems that we have is that writing software
1349.82s - 1351.82s |  is hard. Writing
1351.82s - 1353.82s |  secure software is
1353.82s - 1359.56s |  even harder.
1359.56s - 1361.56s |  So I've been a
1361.56s - 1363.56s |  proponent for a long time of saying, hey,
1363.56s - 1365.56s |  if you're a purple team member,
1365.56s - 1367.56s |  you need to be bringing a developer to
1367.56s - 1369.56s |  Defcon. If you have to sell them on the parties,
1369.56s - 1371.56s |  sell them on the parties.
1371.56s - 1373.56s |  But get them here. Let's
1373.56s - 1375.56s |  have that conversation. Take the
1375.56s - 1377.56s |  things that you learned here in this room, take
1377.56s - 1379.56s |  it back to the lunchroom and just
1379.56s - 1381.56s |  chat with them. Do
1381.56s - 1383.56s |  lunch and learns, do presentations.
1383.56s - 1385.56s |  Make it spicy. Add memes.
1385.56s - 1387.56s |  Whatever you have to do
1387.56s - 1389.56s |  to build that relationship because that's
1389.56s - 1391.56s |  the important part of this.
1391.56s - 1393.56s |  Why? Because guess
1393.56s - 1395.56s |  what? We've got
1395.56s - 1397.56s |  another issue in AppSec that's
1397.56s - 1401.03s |  coming in this direction. These
1401.03s - 1403.03s |  are the numbers from Stack Overflow.
1403.03s - 1405.03s |  As it turns out right now, we've
1405.03s - 1407.03s |  got a big problem with developers not being
1407.03s - 1409.03s |  very happy.
1409.03s - 1411.03s |  And anybody who's been in this room
1411.03s - 1413.03s |  who's actually written code understands
1413.03s - 1415.03s |  why. When
1415.03s - 1417.03s |  it works, you're under fire
1417.03s - 1419.03s |  to produce more features. When
1419.03s - 1421.03s |  it doesn't work, you're under fire
1421.03s - 1423.03s |  to get things working.
1423.03s - 1426.73s |  Every time that the ops and IT
1426.73s - 1428.73s |  people get angry at the development
1428.73s - 1430.73s |  staff because something that they did
1430.73s - 1432.73s |  broke production, they don't think
1432.73s - 1434.73s |  about the fact that the app developer
1434.73s - 1436.73s |  has been sitting there for 80
1436.73s - 1438.73s |  hours working overtime
1438.73s - 1440.73s |  to get that feature into
1440.73s - 1442.73s |  production to meet something that
1442.73s - 1444.73s |  the sales team sold
1444.73s - 1446.73s |  but never asked them about
1446.73s - 1448.73s |  and then broke
1448.73s - 1450.73s |  production which means they're going to be on for at least
1450.73s - 1452.73s |  another 10 hours trying to fix
1452.73s - 1454.73s |  production. That's what
1454.73s - 1456.73s |  leads to burnout in this
1456.73s - 1458.73s |  channel. And guess what?
1458.73s - 1460.73s |  There's no shade here but this
1460.73s - 1462.73s |  can't be everybody's exit. This is the guy
1462.73s - 1464.73s |  that wrote NeoFetch. It says
1464.73s - 1466.73s |  very clearly up in his description
1466.73s - 1468.73s |  have taken up farming, archived
1468.73s - 1470.73s |  all of his projects.
1470.73s - 1476.60s |  This is the path that we're going
1476.60s - 1478.60s |  and the problem with it is
1478.60s - 1480.60s |  that whenever the developers go
1480.60s - 1482.60s |  you can't protect something
1482.60s - 1484.60s |  that you don't understand
1484.60s - 1486.60s |  and those developers are
1486.60s - 1488.60s |  the repository for the knowledge of
1488.60s - 1490.60s |  how those decisions were made,
1490.60s - 1492.60s |  what security concerns were brought
1492.60s - 1494.60s |  in during the actual development
1494.60s - 1496.60s |  process.
1496.60s - 1498.60s |  You know how I know that
1498.60s - 1500.60s |  you can't do this?
1500.60s - 1502.60s |  I have the receipts. If you've been in this
1502.60s - 1504.60s |  room long enough you saw me on stage giving this
1504.60s - 1506.60s |  presentation where I said the exact same thing.
1506.60s - 1508.60s |  Guess what? Two years later
1508.60s - 1510.60s |  we're in the exact same
1510.60s - 1512.60s |  spot. The only difference
1512.60s - 1514.60s |  is because of what's going
1514.60s - 1516.60s |  on with the economic recession
1516.60s - 1518.60s |  we're seeing developers leave our
1518.60s - 1520.60s |  companies faster
1520.60s - 1522.60s |  and at a higher pace and
1522.60s - 1524.60s |  when they leave they take knowledge of
1524.60s - 1526.60s |  how those systems work with them.
1526.60s - 1530.17s |  So as application security
1530.17s - 1532.17s |  people who know how hard this is
1532.17s - 1534.17s |  we have to lead with empathy.
1534.17s - 1536.17s |  We have to go in this place.
1536.17s - 1538.17s |  If you are expecting
1538.17s - 1540.17s |  the adults to show up
1540.17s - 1542.17s |  they're never going to get here.
1542.17s - 1544.17s |  I hate to tell you this
1544.17s - 1546.17s |  but we are the adults in the room.
1546.17s - 1548.17s |  By virtue of you
1548.17s - 1550.17s |  taking time out of your free time
1550.17s - 1552.17s |  to sit in this room and listen
1552.17s - 1554.17s |  to topics about things that you
1554.17s - 1556.17s |  will take back to a work setting
1556.17s - 1558.17s |  you are the adult
1558.17s - 1562.15s |  in the room. The reason I'm
1562.15s - 1564.15s |  asking you to actively think about
1564.15s - 1566.15s |  the answers to these questions and think
1566.15s - 1568.15s |  about this process and think
1568.15s - 1570.15s |  about this while we're going through and listening
1570.15s - 1572.15s |  to the talks that are going on today.
1572.15s - 1574.15s |  Listening to the talks that you will hear in other
1574.15s - 1576.15s |  villages is because of this.
1576.15s - 1578.15s |  Okay?
1578.15s - 1580.15s |  And with that I have about
1580.15s - 1582.15s |  three minutes and I want to say
1582.15s - 1584.15s |  thank you. Because
1584.15s - 1586.15s |  you all are coming to this place
1586.15s - 1588.15s |  to take up
1588.15s - 1590.15s |  and take charge
1590.15s - 1592.15s |  and hopefully make a difference in this space.
1592.15s - 1594.15s |  If there is anything that I can ever
1594.15s - 1596.15s |  personally do to help you
1596.15s - 1598.15s |  do not hesitate to reach out to me.
1598.15s - 1600.15s |  And I hope you would take that
1600.15s - 1602.15s |  and pay that forward to the developers that
1602.15s - 1604.15s |  you work with, to the IT people
1604.15s - 1606.15s |  who are working overtime, to the
1606.15s - 1608.15s |  architects who are trying to figure out how to secure
1608.15s - 1610.15s |  things before we actually know how the technology
1610.15s - 1612.15s |  works. We are all
1612.15s - 1614.15s |  in this together.
1614.15s - 1616.15s |  Okay?
1616.15s - 1618.15s |  So let's treat each other with a little respect
1618.15s - 1620.15s |  and the next time that somebody wants to
1620.15s - 1622.15s |  sit there and rag on the development team for
1622.15s - 1624.15s |  breaking production, just look at them and say
1624.15s - 1626.15s |  hey, we don't do that here.
1626.15s - 1628.15s |  Okay? With that
1628.15s - 1630.15s |  thank you very much for coming to listen to my talk.


url: https://www.youtube.com/watch?v=Tv_W0iRr0qQ
title: DEF CON 32 - Maturing Your Application Security Program - SheHacksPurple
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=Tv_W0iRr0qQ",
  "title": "DEF CON 32 - Maturing Your Application Security Program - SheHacksPurple",
  "description": "After working with over 400 companies on their application security programs the most common question I receive is \u201cwhat\u2019s next?\u201d. They want to know how to mature their programs, and when they look at the maturity models available, they find them intimidating and so far beyond their current maturity level that they feel impossible. In this talk I will take you through 3 common AppSec program maturity levels I have encountered over the years, with practical and actionable next steps you could take immediately to improve your security posture.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1699,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

1.23s - 8.23s | This text was transcribed using whisper model: large-v2

 All right. Let's start. So hi, I'm Tanya Jenka. I'm also known as SheHacksPurple, and I want
8.23s - 16.15s |  to talk about maturing our AppSec programs. So I work with companies all the time. I work
16.15s - 22.11s |  with customers a lot. I love my customers. And I see all different levels. But when I
22.11s - 28.35s |  work with someone, that means they take security seriously enough to engage me or to engage
28.35s - 35.03s |  some group or to engage IAN's research. There's tons of companies that haven't engaged anyone.
35.03s - 41.55s |  Like they don't have one of you to rely on, and they are like out there. And so I want
41.55s - 46.91s |  to talk about three different models of AppSec that I see a lot, and then how we could take
46.91s - 51.51s |  them to the next level. So if you are one of those models, that's cool. I can help you
51.51s - 55.79s |  do better. And so where are we going to talk about? We're going to talk about common AppSec
55.79s - 62.11s |  models, why they fail, and how we can just provide more value to our employers. Because
62.11s - 67.79s |  to be quite frank, we all want software to be more secure. That's what we want. And so
67.79s - 72.03s |  I want to briefly tell you how I did my research because someone pointed out to me, they're
72.03s - 75.35s |  like, you can't just say because Tanya said so. You actually have to explain like how
75.35s - 79.23s |  you learned these things. We can't just take your word for it. And I was like, you know,
79.23s - 84.19s |  that's a really good point. So I've been working with this company called IAN's Research since
84.19s - 89.11s |  I guess I started very, very late 2018. So let's call it 2019. And then I've worked with
89.11s - 94.65s |  almost 400 different AppSec teams over that time. You know how like there used to be that
94.65s - 100.35s |  game show online where you could phone a friend. So IAN's lets you phone a nerd. I'm one of
100.35s - 105.39s |  the nerds. And then I just help crush your AppSec programs. And I do between one and seven
105.39s - 110.41s |  calls a week. And then after so many years and taking so many notes, because I'm one
110.41s - 115.25s |  of those obsessive note taker persons because I can't remember anything. I just realized
115.25s - 119.37s |  like, wow, I have a lot of data. And when you have 400 companies that you've spread
119.37s - 124.77s |  the data across, it's no longer like it's a data set. It's no longer you're talking
124.77s - 128.89s |  about this company. It's a data set. And I was like, I need to start sharing this data
128.89s - 134.47s |  in an anonymized ways. And so this is one of the talks where I'm sharing that data after
134.47s - 139.23s |  so many years. And so thank you to IAN's Research for actually giving me money because it's
139.23s - 143.47s |  pretty cool to get paid to just do really awesome work. So I'm this person when I brush
143.47s - 148.95s |  my hair, I look pretty good. I work at SunGrep and I'm the head of community there. And they're
148.95s - 153.67s |  very gracious and let me do lots of silly things like make cards against AppSec. I'm
153.67s - 158.95s |  known as SheXPurple. I wrote a book called Alice and Bob Learn Application Security.
158.95s - 164.45s |  So this is year 28 in tech for me. I'm old. I founded some stuff. I advise some people
164.65s - 169.49s |  and I do some research. And so hopefully you're like, she seems qualified enough. I guess
169.49s - 175.21s |  I'm not going to leave. I'll sit down. It's hot. Don't leave. So I want to talk about
175.21s - 182.21s |  maturity. So how do I say? So this is like, so it says like, Tanya, gently explain that.
185.31s - 191.81s |  So we as an industry, some of us are doing great and that is not very many of us. A lot
191.81s - 198.13s |  of us are AppSec programs where like, I wish it was so much better. We don't feel super
198.13s - 203.01s |  like we're not bragging to our friends. We're not like, we're just not as satisfied with
203.01s - 208.49s |  how it's going. And we know this because we keep seeing giant breaches, right? We keep
208.49s - 214.31s |  seeing software development not going as securely and reliably as we expect it to. Like the
214.31s - 220.09s |  whole thing with CrowdStrike was just us not following proper software development practices,
220.09s - 225.69s |  trusting the way we know we should. And they know too, because there's so many pressures.
225.69s - 231.13s |  And so this talks about how we can mature because the whole industry is not where the
231.13s - 236.83s |  people in this room are. The people in this room, you came probably from another country
236.83s - 241.43s |  or from another part in this country to this place to learn, to become better. Everyone
241.43s - 245.21s |  else isn't doing that, right? Only some of us are. So there's a bit of the cream of the
245.21s - 248.65s |  crop going on here. So if you're like, of course we would do that. Yeah, you would,
248.97s - 254.61s |  but not everyone's doing it. So I want us to all kind of continue on that. So one of
254.61s - 260.45s |  the issues I see with, so there are some models. So there's OWASP, SAM, BSIM and NIST. I actually
260.45s - 265.17s |  haven't used BSIM because it costs money and I'm very cheap. You'd be surprised. But I've
265.17s - 270.49s |  done a lot of SAM and a lot of NIST. And these, when I talk with customers, they're like,
270.49s - 274.09s |  oh, let's do a maturity model. And I'm like, great. And then I start telling them about
274.09s - 279.45s |  it and they're so overwhelmed. I went to a SAM, an OWASP SAM user meetup. So SAM's
279.45s - 285.69s |  awesome just to be clear. And it's not a person, it's the software assurance maturity model.
285.69s - 290.13s |  And they were telling me that on average, their user group, so the people that are obsessed
290.13s - 296.67s |  with SAM, they rate at like 1.1 out of three. So these are the people that have been doing
296.67s - 300.93s |  SAM for years, working their butts off and they're barely getting one out of three. So
300.93s - 306.09s |  when I ask a client who's like, what does AppSec stand for? To look at SAM, their eyes
306.09s - 310.53s |  glaze over, they start to cry. They're just like, I can't even, I can't even fathom where
310.53s - 316.57s |  to start. So I'm going to start below that. Okay. Because that's where we are. So onto
316.57s - 322.81s |  the models. I just like cats and this is the OSI model, but with cats. Anyway. Okay. So
322.81s - 327.65s |  model one, let's just pen test the important things. Who has worked with a client at some
327.69s - 332.33s |  point where that's all they do. So like once or twice a year, they have a pen tester come
332.33s - 338.65s |  in, they do a pen test, they fail it so bad. And, and then they're like, yeah, that's our
338.65s - 344.13s |  AppSec program. And I'm like, whoa, that's expensive for what you're getting. Like pen
344.13s - 348.21s |  testing is awesome. But if that's the only thing you're doing, and you're just pen testing
348.21s - 355.57s |  like two of your 200 apps once a year, you're getting a blink of a tiny, tiny portion of
355.57s - 362.33s |  your entire attack surface. And like, this is not going to go well. And so unfortunately,
362.33s - 366.93s |  even in 2024, lots of companies are starting their first AppSec program. Like last year, I
366.93s - 371.61s |  worked with a gaming company and you own their games. And I helped them start their first
371.61s - 378.33s |  AppSec program. And so this, this year I trained a company that handles $2 billion of
378.49s - 383.57s |  their customers' money. And they were letting every single person at the company query the
383.57s - 387.77s |  production database using the same user. And then they take client scripts, and they
387.77s - 392.37s |  just run it without any checking against the database that handles $2 billion. And I was
392.37s - 399.01s |  like, oh, okay, we redesigned it. Life is way better now. Like everything's going right,
399.01s - 405.37s |  but like $2 billion. And that's what they were doing. Right. So at least these people
405.37s - 409.29s |  are doing two pen tests a year because they were doing literally nothing before I got
409.29s - 415.37s |  there in March. So yeah. So let's talk about this model. So it is extremely common.
415.73s - 419.97s |  Generally, there's no formal system development lifecycle. They're like, we're doing
420.45s - 427.29s |  WaterGile. We're doing DevOpsGile. We're doing, you know, we have a scrum meeting, but
427.29s - 433.29s |  it's only once a week. And then like, we do sprints, but they're six months long. Every
433.29s - 439.25s |  single team is doing something different. There's a mixed tech stack. So we have like
439.29s - 442.93s |  five different programming languages, and 12 different versions of six different
442.93s - 447.61s |  frameworks. And then like, some of us are using PaaS, some of us are using IAC, like
447.61s - 453.69s |  everyone just like, let's do our own thing. It's great. It's not. We have code all over
453.69s - 458.97s |  the place. So I'm like, oh, where do you keep your code? They're like, so about that. And
458.97s - 464.17s |  it's in like five different types of repositories, but there's actually like 22
464.17s - 469.05s |  instances. So you don't even know where your code is. Um, yeah, everyone's just kind of
469.05s - 474.37s |  doing their own thing. And that's not good. So why is this model bad? I think you already
474.37s - 478.61s |  know, but let me tell you. So it's quite expensive for what you're getting. So pen
478.61s - 484.49s |  testers are not cheap, like good ones are not cheap, and they shouldn't be. But usually, I
484.49s - 489.33s |  like to do pen testing as like this beautiful cherry on top to make something perfect, not
489.33s - 494.61s |  as my only effort whatsoever. And so you're having terrible, terrible coverage. Developers
494.61s - 500.05s |  are getting zero support. Like there's no opportunity for anyone to learn. That's one
500.05s - 503.81s |  of the biggest problems with this one. None of your staff's getting better, because you
503.81s - 507.69s |  have this awesome, brilliant pen tester coming in doing cool work, and then all their super
507.69s - 512.69s |  awesome brain and knowledge leaves. Right. And so that is one of the many reasons this
512.69s - 518.97s |  is bad. And so how can we mature this model? So I have, so this one, I have the, if you
518.97s - 524.93s |  have budget, and if you don't have budget, a lot of my career, my budget has not been
524.93s - 528.13s |  quite what I want. I totally have an awesome budget now running a community. It's like
528.13s - 534.97s |  8,000 bucks anyway. Um, how do we mature this model? So first I like to start with secure
534.97s - 539.89s |  coding training, and I'm going to give you a link to free training for secure coding
539.89s - 543.93s |  after this. There's going to be a bunch of free resources because I want all of you to
543.93s - 550.05s |  be awesome. Um, but the way I teach secure coding training is not the same way as someone
550.05s - 555.01s |  else does. And so, although obviously I'm the best ever, what you want is training that
555.01s - 560.05s |  works for your team, that your team likes. And so as much as like a salesperson will
560.05s - 564.41s |  tell you ours is the best ever, what only really matters is that your team likes it
564.41s - 569.19s |  and that your team's willing to sit through it or go on the platform and play or attend
569.19s - 573.83s |  the monthly lunch and learns, whatever it is that you decide, try it out on some devs
573.83s - 579.55s |  first and make sure that they're willing to tolerate it. Don't pay $12,000 to have someone
579.55s - 586.35s |  come in that they hate, right? Or a system or whatever it is that you do, try to make
586.35s - 591.27s |  sure it's a thing that they'll tolerate. Um, so the no budget plan. So for those of us
591.27s - 596.11s |  that don't have giant budgets, you don't have to raise your hands cause it's sad. Um, okay.
596.11s - 601.15s |  So one, so use free tools like zap and burp if you're going to do dynamic scanning and
601.15s - 605.83s |  then for static analysis. So for, for dynamic analysis, there's basically like two super
605.83s - 609.99s |  clear awesome winners. And then for stack analysis, like there's tons, like I could
609.99s - 614.83s |  fill this whole page. So like there's many, many, many open source SAS that are free.
614.83s - 621.27s |  They're like, not bad, not bad. Um, and then create a guideline. And I have one online
621.27s - 626.31s |  again, that's free, but basically create some sort of guidance for your devs about
626.31s - 631.55s |  how to create code that you feel is acceptable. And it's totally okay to steal something off
631.55s - 636.15s |  of my website, off the OS website, off of like websites that give you permission to
636.15s - 641.91s |  do that. So you don't have to reinvent the wheel, but give them some guidance. Um, next
641.91s - 648.75s |  create, create a list of requirements. So when you start a project, you set clear expectations
648.75s - 654.43s |  for security for everyone on that project. And this could be just like five things.
654.43s - 657.27s |  Like you're going to scan it with our little SAS. You're going to scan it with our little
657.27s - 661.87s |  desk. You're going to fix the mediums and above, and then we're going to do a pen test
661.87s - 667.83s |  at the end. That could just be your entire requirements, right? And follow the guideline.
667.83s - 671.83s |  Like it doesn't have to be really advanced and you can add to it over time, but starting
671.83s - 675.91s |  a project with super clear expectations will get you a lot more of what you want in this
675.91s - 681.71s |  world. Um, consolidate your code. So this is a really hard one. This is one of those
681.71s - 684.67s |  things where you're going to have to talk to lots of people, but if your code is all
684.67s - 690.43s |  in the same place, your life's going to be better. Um, the devs will also probably enjoy
690.43s - 693.91s |  that once it happens, like while we're doing it, it's going to suck. But once it's all
693.91s - 699.47s |  in the same place, like everyone's going to benefit, not just you. And then lastly, oh,
699.47s - 703.11s |  actually no, I have a whole nother page. Push for a real system development lifecycle, push
703.11s - 707.43s |  for centralization, push for standardization. This is a really hard one that requires a
707.43s - 713.27s |  lot of social currency, but it is worth every single hour that you spend talking to people
713.27s - 717.35s |  to make that happen. Like every single person in your whole it department will benefit from
717.35s - 722.91s |  that. Okay. Number six, threat model, the super important apps. So those ones that you
722.91s - 727.11s |  used to just pen test and that's all you did do a threat model. You can do a super basic
727.11s - 731.43s |  threat model. Um, there's this amazing human named Adam show stack. He has this thing called
731.43s - 737.03s |  the four question frame for threat modeling is just four questions and a conversation.
737.03s - 742.19s |  I start with that. It's so good. He's so smart. Um, you don't have to read all of his awesome
742.19s - 747.51s |  books, but you totally could. And like, just start with that and you will get really far
747.51s - 753.55s |  share information about incidents. So if you've had an app incident, if you're allowed, if
753.55s - 757.95s |  it makes sense, share with the devs. Quite often when I started talking to them about
757.95s - 762.35s |  security incidents, they had no idea. They had no idea we've been attacked. They had
762.35s - 766.99s |  no idea we're attacked 4 billion times a day. They have no idea this stuff's happening and
766.99s - 772.55s |  I'm not doing it to scare their pants off. I want them to understand the threats we face.
772.55s - 776.55s |  So I'm not trying to fear uncertainty and doubt. I'm like, this is specifically what
776.55s - 783.31s |  is happening to us and why I need your help so bad. Um, scan for secrets. There are free
783.31s - 787.63s |  secret scanners. There's paid for secret scanners. Basically if you have more time, you should
787.63s - 792.15s |  use a free one. If you have more money, she's a paid one, but basically scan your code for
792.15s - 795.91s |  secrets and then rotate those secrets. Use a secret management tool, but that's later
795.91s - 801.87s |  for when you have money. Um, there's a free WAF from OWASP called mod security and you
801.87s - 809.03s |  can put that in front of your super scary, terrible, like last updated in 2008 apps.
809.03s - 814.99s |  Do that. Um, and then you still pen test the important apps. However, now you don't fail
814.99s - 818.83s |  horribly and it's no longer completely embarrassing where you're like, Oh God, I can't look the
818.83s - 824.39s |  pen tester in the face. This is so bad. Um, so that's nice. And then, so now if you have
824.39s - 828.19s |  budget, I want to add three more things. So if you have budget, see how she kind of looks
828.19s - 833.87s |  like a badass. She's like, I have budget, hire an app sec person. Like that is the best
833.87s - 839.71s |  investment you can ever make. Like hire someone from this room. Um, like seriously, the people
839.71s - 844.79s |  there in this room, probably almost all of them will be amazing to work with. Um, pay
844.79s - 851.27s |  for a next gen SAST. So I find that the paid SAS are a lot better than the paid tasks.
851.27s - 855.07s |  I kind of think that sucks. And I remember people telling me at the beginning of my app
855.07s - 858.75s |  sec career that DAS sucks. I'm like, DAS is amazing. And they're like, one day when you're
858.75s - 865.39s |  a more mature app sec professional, Tanya, you'll understand. And one day I just did,
865.39s - 870.67s |  I'm sorry if you make a DAS, I'm a jerk. Um, continue with your free-ish DAS. I just
870.67s - 877.23s |  would never buy one. Um, and then all of step two. So still do the no budget plan. So this
877.23s - 884.47s |  is model one. And now we're going to do model two. All right. Model tool. Like I call this
884.47s - 890.59s |  tools, tools and more tools. Um, so this is the most common thing. I see this absolutely
890.59s - 895.15s |  all the time. Actually, let me go back for a second. So this is SAS plus DAS, perhaps
895.15s - 901.91s |  one other tool, a little bit of governance. Okay. So partially rolled out tools. This
901.91s - 909.63s |  is the most common thing. So partially rolled out. So we've paid $75,000 for a DAS and like
909.63s - 915.67s |  $60,000 for a SAS. And we are totally using 20% of our licenses, which I hate. I work
915.67s - 923.37s |  for a vendor. Take every penny you can. You paid for it. Lots of bug reports, but ain't
923.37s - 927.05s |  no one fixing anything. So we've got lots of reports. They're not getting to the right
927.05s - 931.85s |  people. Maybe there's lots of false positives. Maybe we're just not distributing them well.
931.85s - 936.81s |  Maybe we're just not scanning the right things. Maybe we're scanning so rarely that it's unhelpful,
936.81s - 943.29s |  but things are just not getting fixed. Um, inconsistent program. So I see this a lot.
943.29s - 947.89s |  I see huge inconsistencies. Like one team has to do this huge architecture review. And
947.89s - 954.05s |  I worked at this one place and they had an 80 page template. So it was like 160 pages when
954.05s - 957.93s |  you filled it out. And guess how many people filled it out? Zero. You can't see I'm doing
957.93s - 963.41s |  this. Yeah. Um, no, that doesn't work. And usually they always have a SAS and a DAS,
963.41s - 968.45s |  um, little to no documentation. And the most common thing anyone ever says is,
968.45s - 973.65s |  why won't the devs fix the bugs? I'm never going to talk to them or interact with them
973.81s - 977.89s |  or provide support. I'm not going to even ask them this question. I'm going to ask everyone
977.89s - 981.65s |  else in the entire company this question. This is a thing that I hear all the time. I'm like,
981.65s - 986.21s |  did you ask the devs why they're not fixing it? No. When's the last time you talked to them? Never.
987.25s - 992.69s |  I see the beginning of your problem. So why is this model bad? I really like dragons and I just
992.69s - 999.09s |  wanted to have dragons in my presentation. Um, okay. So the coverage is bad. It's not terrible.
999.09s - 1005.25s |  It's not like the last one, but the coverage is bad. Not much is fixed. So we as an industry are
1005.25s - 1012.05s |  not here to find bugs. We are here to reduce organizational risk in a meaningful and lasting
1012.05s - 1017.73s |  way. That's our job. It does not matter if you find 45,000 bugs, you've found every bug that
1017.73s - 1023.49s |  exists. If no one's fixing anything, in my opinion, your paycheck is too big. What we
1023.49s - 1027.97s |  want to do is fix the things. We want to prevent the things from happening in the first place.
1027.97s - 1033.81s |  We want to protect artworks and you're just not doing it as well as you could with this program.
1033.81s - 1040.53s |  And so how do we mature it? I used an AI to make this. I was like, show me a little girl
1040.53s - 1045.01s |  growing up and becoming more mature. And this is what the AI gave me. I'm like, I'll take it.
1045.01s - 1049.89s |  Sounds good. Okay. So we want to do everything from the previous maturity model. I was like,
1049.89s - 1053.81s |  show me a little girl maturing. And this is, I guess this is how little girls mature now.
1054.29s - 1059.33s |  Okay. So then the number one thing I would do is hire more AppSec folks. And I realize I am
1059.33s - 1067.41s |  an AppSec folks. So I am biased, but I kind of think we're awesome. But really though, AppSec folks.
1068.53s - 1074.05s |  Okay. So one of the pieces of advice is your entire AppSec team can not just be pen testers.
1075.25s - 1080.29s |  You have to have one of those people at least because we need them, but you can't have a team
1080.37s - 1084.21s |  but you can't have a team where you have five AppSec folks and every single one of them's just
1084.21s - 1088.85s |  got the pen testing skills. And like, they don't, none of them have ever been a dev. None of them
1088.85s - 1092.61s |  know how to read code or maybe they do know how to read code, but like they just know how to do
1092.61s - 1096.53s |  pen testing. They don't know how to do code review. They don't know how to do a threat model.
1096.53s - 1101.97s |  They don't know how to write a policy. So you need a well-rounded AppSec team with a whole bunch of
1101.97s - 1106.61s |  different types of skill sets. That's very important. One of them needs to have that pen
1106.61s - 1110.93s |  tester. I'm going to F up your shit type of thing. But the rest of them, like you have to
1110.93s - 1116.61s |  have a rainbow type of team. This is one of those times when diversity can, like diversity of
1116.61s - 1123.81s |  experience and like skillset will really, really bring you a lot of value. Reassess your tools.
1123.81s - 1129.73s |  So if it's been two or three years and you still haven't rolled your SAS, DAST, AST, whatever
1129.73s - 1135.49s |  acronym thing out, it's the wrong tool. Done. You're done with it. Switch tools.
1136.29s - 1139.97s |  I find that I'll work with companies and they're like, well, we've had it five years. And I'm like,
1139.97s - 1144.77s |  yeah, and you're using 30% of your licenses. So for five years, you've been paying for 70%
1144.77s - 1151.17s |  of things you're not using. You've wasted this many dollars. It's not working for you. It's like
1151.17s - 1158.05s |  the sunk cost fallacy applies. Just get rid of it. Start again. Find a tool and make sure you
1158.05s - 1164.13s |  evaluate it with your devs and make sure the rollout is fast. Don't buy a tool if it's going
1164.13s - 1168.45s |  to take you two years to roll it out. I wanted to buy this IAST once. I was like so in love with it.
1168.45s - 1172.69s |  I really, really wanted to buy it. And after three months, we still had not finished the proof of
1172.69s - 1177.01s |  concept because I just couldn't get the team to roll it out. And my boss was like, you're going
1177.01s - 1182.29s |  to roll this out for the rest of your career if we buy it. So it needs to be something that rolls
1182.29s - 1190.05s |  out fast. Ensure your rollout's complete. Make the vendor give you every penny of value you paid for.
1190.05s - 1194.61s |  Put us through our paces. I know that may sound like strange advice from a person that
1194.61s - 1199.33s |  works at one of those places, but you should get every single bit of value you can for that thing
1199.33s - 1204.69s |  you're paying for. And the thing you can do is if at six months, you still are not able to roll out
1204.69s - 1208.69s |  all the licenses, you can say, well, you know what? It's been six months and we haven't been
1208.69s - 1212.77s |  able to roll them out. Maybe I don't want to pay for the rest of the six months for those licenses
1212.77s - 1218.45s |  we're not using. Some companies I've been able to do is I'll say, I want to buy half in the first
1218.45s - 1221.89s |  six months and the other half in the next six months, because I know it's going to take a long
1221.89s - 1227.49s |  time. But ideally just get something that's easy to roll out if that is a possibility for you and
1227.49s - 1232.85s |  the way that your stack looks, because it's not always possible. The hardest advice ever,
1232.85s - 1239.33s |  provide support, make friends, talk to people, build trust. This is hard. So this can mean
1239.33s - 1245.89s |  writing a one pager with security guidance, helping them with their frameworks. Being available is
1245.89s - 1250.13s |  really, really hard because I know all of you are probably really, really busy, but this is
1250.13s - 1254.13s |  something that creates a ton of value and you don't have to dye your hair purple. It just helps. All
1254.13s - 1259.09s |  of you actually look really good in purple. Some of you just don't know it yet. Start to manage
1259.09s - 1265.01s |  incidents better. Send your team on incident response training if you can. Figure out a way
1265.01s - 1270.21s |  for actually, let me do this. Create a way to report incidents really quickly. Do incident
1270.21s - 1274.61s |  training for devs so they know what it looks like and they can tell you when they see something bad
1274.61s - 1279.89s |  and then create an incident response process. Make sure everyone knows it that needs to know it.
1279.89s - 1284.05s |  A lot of these companies, they don't got nothing. They're really good at responding to malware.
1284.05s - 1288.29s |  They're ready for ransomware. Everything else, they have no plan whatsoever.
1289.41s - 1294.05s |  Model three. And we have how many minutes left? We have five minutes. Okay. I call this the
1294.05s - 1301.89s |  stranglehold big spend. So you have every single tool. You have like 11 tools. You've spent all
1301.89s - 1307.57s |  the money. You have a stranglehold governance. No one can breathe. It takes three weeks to make
1307.57s - 1313.97s |  a one line change of code. There's constant friction. The security posture is not satisfying
1313.97s - 1320.37s |  for how much you're spending and sec and dev don't talk unless they're yelling. I have worked here
1320.37s - 1327.01s |  so many times. And you come in and I remember my friend Nicole, she's like, I walk in and I'm like,
1327.01s - 1332.29s |  hey, I'm Nicole. I'm from security. I come in peace. And then I put my hands out like this.
1332.29s - 1337.41s |  And hopefully people laugh. Sometimes they boo. And then I know what level I'm at to start and
1337.41s - 1343.33s |  how much peacemaking I need to do. But the I come in peace really works well. So why is this model
1343.33s - 1349.89s |  bad? You're spending a zillion dollars and you are not getting your money's worth. You are slowing
1349.89s - 1355.57s |  down innovation. Maybe even people are quitting because they just can't stand how annoying,
1355.57s - 1361.57s |  how much friction there is. You, the security team are petting the cat, which is a dev backwards
1361.57s - 1367.25s |  all day long. And the devs are just like, oh, I used to work somewhere where I literally I saw
1367.25s - 1372.69s |  the security guy. And then I went like this and my boss was like, did you literally just duck?
1372.69s - 1379.49s |  And I was like, I'm so busted. Don't we don't want to be that. None of us want to be that.
1379.49s - 1384.85s |  We're that way because so many other cultural things have happened. That's what led us to that.
1384.85s - 1391.01s |  So I suggest scaling with either a security champions program, delegation, like specific
1391.01s - 1397.17s |  delegation, automation. So I have like a bunch of things I can talk about how to scale your
1397.17s - 1403.89s |  program better. But if you do a champs program, it's a big undertaking. Be serious about it. Be
1403.89s - 1409.01s |  intentional. Do a really good job. I would love to talk to you about that after. I'm a big giant fan.
1409.01s - 1413.33s |  I'm a bit obsessive. If you're not going to do a champions program, do an advocacy program to
1413.33s - 1418.85s |  change the culture where you work so it's more positive. Make it a standard. Take all your
1418.85s - 1423.41s |  guidance and guidelines, turn them into standards because you're ready for that now. And then provide
1423.41s - 1429.09s |  training and workshops on how to apply that and help everyone become compliant. You will make
1429.09s - 1433.09s |  friends, not enemies that way. Instead of just publishing a policy and then being like, good
1433.09s - 1439.01s |  luck with that. Make your tools go fast. You want fast tools. You are paying a fortune. You deserve
1439.01s - 1444.05s |  fast, efficient tools full of true positives. If you're not getting it, break up.
1445.49s - 1449.97s |  Examine your APIs. So at this point, you should be taking care of your APIs, not just your front
1449.97s - 1455.65s |  end web apps. You should be taking care of every type of software, including mobile, including IoT,
1455.65s - 1460.37s |  including WebSockets. All of those things need attention now. And you might need to get a special
1460.37s - 1464.53s |  subset of your tools to make sure you pay them the special attention they deserve.
1465.33s - 1471.09s |  Embrace threat modeling, threat modeling rules. You want a company-wide secret management at this
1471.09s - 1476.93s |  point. I do not sell a secret management tool. I wish I did because they are amazing and you need
1476.93s - 1484.21s |  one. Your whole company should have a management program, like an app, but also just like a plan
1484.21s - 1489.09s |  to manage your secrets as a whole so that you never, ever leak a secret again. You want to do
1489.09s - 1494.21s |  continuous scanning. And I don't mean this in like a swear word marketing buzzword type of way.
1494.21s - 1498.45s |  I mean like set up your tools so they're always scanning all the time and you're reviewing them
1498.45s - 1503.17s |  when you see something disconcerting. You can do this with more modern tools where they're just
1503.17s - 1508.53s |  kind of scanning on their own and then you review it when you have time. Training that doesn't suck.
1509.33s - 1513.97s |  Evaluate the training with your devs to see if they actually like it. Do the one they like.
1514.77s - 1519.97s |  Do the one that they're willing to tolerate. This might mean it's like one day a week for
1519.97s - 1526.21s |  three weeks. It might mean it's a one hour every other week. It might mean it's a full day for
1526.21s - 1531.17s |  three days in a row and it's interactive and they get to like move around. There's many different
1531.17s - 1536.13s |  types of trainings. Don't just go with the cheap one. Don't just go with the popular one. Go with
1536.13s - 1542.93s |  the one they like the best because you will get the best results. If you have a WAF on stuff,
1542.93s - 1547.17s |  if you have the money to a rasp, it's just better. I know a lot of people are going to
1547.17s - 1553.17s |  swear at me about that after. Your AppSec team should be trained in incident response or your
1553.17s - 1558.85s |  incident response team should have some training in AppSec so that if a real AppSec incident like
1558.85s - 1564.53s |  a big one happens, you are ready. This is more advanced and that's okay. And lastly, use a data
1564.53s - 1570.85s |  driven approach. See that giant smile he has? It's gorgeous. It's wonderful because he's using data
1570.85s - 1575.41s |  to improve his program. I talk about this a lot too. You should be gathering metrics on the
1575.41s - 1581.25s |  regular and then using that to do experiments and then improving, improving, improving. Whatever's
1581.25s - 1585.33s |  not working, you throw it out. Whatever is working, you do more of that. I know that sounds
1585.33s - 1591.17s |  obvious, but taking that time every 90 days to look at your metrics and improve will bring you
1591.17s - 1597.17s |  huge value over time. And I totally have one minute left. So conclusion, we learned three
1597.17s - 1601.81s |  common AppSec models, how to identify the models, how to improve the models and build a better
1601.81s - 1606.53s |  program. But more importantly, if you want to get your phones out, I have some resources. So
1607.25s - 1613.49s |  I have free secure coding courses, AppSec courses. Next week I'm releasing incident response for devs,
1613.49s - 1618.45s |  all of it's free. There is no payment except we add you to our newsletter, but me and my colleague
1618.45s - 1623.33s |  Amanda write it and I think it doesn't suck very much. And you can just unsubscribe if you don't
1623.33s - 1630.13s |  like it, but I didn't say that. Okay, next books. I love books. These books are not free. I only
1630.13s - 1634.85s |  wrote one of them and my mom says that one's the best one, but I love DevOps and I feel like us
1634.85s - 1639.81s |  security folks can learn a lot from the amazing DevOps folks, especially the researchers. This is
1639.81s - 1645.81s |  really good content. Cyber Mentoring Monday, every single Monday on Twitter and on Mastodon InfoSec
1645.81s - 1651.89s |  Exchange, I use this hashtag to match with people. I have so many people write me and they want an
1651.89s - 1657.09s |  AppSec mentor and the people in this room, if you would answer one of them, you will make the whole
1657.09s - 1661.57s |  year. Seriously, you've changed someone's entire life when you answer their call.
1661.57s - 1666.85s |  And if I can just ask one favor from you is to answer someone and have a virtual coffee with them,
1666.85s - 1672.53s |  recommend a book, recommend a talk, just giving them your time and encouragement can literally
1672.53s - 1679.49s |  change their entire career trajectory. And then lastly, me, I am a nerd on the internet. I do this
1679.49s - 1683.73s |  all the time. It's basically all I do. I love giving stuff away for free. I'm not as good at
1683.73s - 1690.45s |  business, but I'm really good at sharing. I am SheHacksPurple on all the things. And then lastly,
1691.09s - 1695.49s |  thank you. Thank you so much for coming. There's so much cool stuff and you came to see this.


url: https://www.youtube.com/watch?v=PwcIyS9bc_o
title: DEF CON 32 - Gridlock The Dual Edged Sword of EV and Solar APIs in Grid Security - Vangelis Stykas
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=PwcIyS9bc_o",
  "title": "DEF CON 32 - Gridlock The Dual Edged Sword of EV and Solar APIs in Grid Security - Vangelis Stykas",
  "description": "In this talk, we delve deep into the increasingly interconnected world of electronic vehicles (EVs), photovoltaic (PV) solar systems, and the broader power grid infrastructure\u2014a nexus that is becoming a fertile ground for potential large-scale cyber disruptions. As we navigate through this complex interplay of technology and infrastructure, we will uncover the critical vulnerabilities lurking within the API connections that bind these systems together. Our exploration will not only highlight these weaknesses but will also demonstrate, through real-world scenarios and potential attack vectors, how they can be exploited to launch sophisticated cyber-attacks, emphasizing the urgent need for robust security frameworks and proactive cybersecurity measures to safeguard our collective future. The advent of PV inverters and EV charging systems has been marred by the industry's \"rush to market\" mentality, leading to overlooked security considerations.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1748,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

2.10s - 9.86s | This text was transcribed using whisper model: large-v2

 Hello all. Can you hear me first of all? Okay, nice. I'm going to take a picture. If anyone
9.86s - 23.69s |  is not okay with that, please hide yourself. That's obligatory for my mom. She never believes
23.69s - 33.81s |  that people come and hear me talk. So, yeah. Kind of a thing. So, welcome to my talk. Gridlock,
33.81s - 41.87s |  the dual edge sort of EV and solar APIs in grid security. Fair warning, this talk is
41.87s - 49.75s |  PG 17, which means I love saying fuck and shit. So, if you're not comfortable with that,
49.75s - 58.11s |  can you please raise your hand? Everyone's okay with that? Really? Thank you for that.
58.11s - 63.63s |  That's me. I'm Vangelis Thikas. I'm the CTO at the penetration testing firm which specializes
63.79s - 72.74s |  in green energy, energy renewable and everything else, EV and PV penetration testing. What?
74.58s - 79.62s |  Okay. That's me. I'm Vangelis Thikas. I'm the CTO of a penetration testing firm
80.26s - 87.62s |  called Atropos. We're testing mainly EVs and PVs. My research industry is mainly APIs for IoT
87.62s - 92.58s |  and for the past couple of years, malware, ransomware and other things that might get
92.58s - 99.30s |  me killed. But, yeah. That's just me. So, this talk is about solar panels. I'm going to be
99.30s - 105.94s |  honest. I have no idea how they work. I'm not a solar panel specialist. I'm an API specialist.
106.58s - 111.14s |  This talk is about APIs. If you thought that you were going to see any kind of
111.14s - 116.66s |  solar shit or, I don't know, firmware things, you're on the wrong talk. Sorry about that.
117.22s - 123.06s |  Quick intro. There are two kinds of installations of solar panel. The one is home panels which is
123.06s - 128.34s |  from 1 kilowatt to 10 kilowatts. And then there are plants which is from 200 kilowatts to 20
128.34s - 135.54s |  megawatts. The home are usually on roof and they're integrated there. The plants are maximizing
135.54s - 142.34s |  profit and minimizing cost because, yeah, capitalism and shit. So, the solar market,
143.14s - 149.46s |  it has several big players. They're mainly Chinese. Lots, and I mean lots of white label
149.46s - 154.10s |  providers that provide generic implementation. We're going to see that they're really rushing
154.10s - 161.30s |  to market. And they have over 30 million current installations the past week that I checked.
162.90s - 168.18s |  Yeah, you can see that we are moving towards solar panels. So, more and more solar panel
168.98s - 177.94s |  energy is being used. Yeah, that's what the solar panel is. It consists of many cells,
177.94s - 183.22s |  blah, blah, blah, things I don't understand. Things that if you understand, I'm really happy
183.22s - 193.49s |  with you because you're really smart. But do you know what that is? So, that's Fortnite.
194.13s - 201.41s |  My older son is playing Fortnite and he loves it. And apparently everyone who wins him either
201.41s - 210.53s |  is a cheater or, I don't know, a hacker. And once upon a time there was a guy Tesla 2004 that
210.53s - 219.81s |  kind of kicked his ass. So, we went after him for no apparent reason other than me being petty.
220.61s - 225.41s |  So, what's the solar market? So, the solar market generates more than a terawatt globally.
225.41s - 231.57s |  A terawatt is a little bit less than what the states, the USA, is consuming every day.
232.37s - 236.69s |  It's cheaper to produce. It has low maintenance and it can run unsupervised.
237.33s - 242.85s |  But as it is expensive to store, it is easier to throw it to the grid, which,
244.53s - 248.37s |  yeah, I don't know if you understand what they are doing. They are just throwing
249.01s - 258.13s |  and depending stuff that is not there every day. I'm introducing you horror scenario. The horror
258.13s - 265.01s |  scenario was a scenario that was built by a really smart guy that I cannot really pronounce his name
265.01s - 270.37s |  because it has too many syllables. Sorry about that, Marcus. I'm gonna read it. It's the only
270.37s - 274.61s |  wall of text that I'm going to read. The power grid needs to maintain a constant balance between
274.61s - 280.53s |  supply or power. Its supply exceeds demands. There is, however, a limit to these countermeasures.
280.53s - 286.53s |  So, they're doing some countermeasures. We need to maintain balance. But especially in Europe,
287.73s - 293.09s |  power grids are in their wind, which means that nations are constantly exporting and importing
293.09s - 298.21s |  power to each other. And power grid regulators have made agreements, blah, blah, blah. What
298.21s - 303.81s |  that means is that if you take down Germany, you're probably going to take down France. You're
303.81s - 309.49s |  probably going to take down Spain, probably the whole continent. So, yeah, that doesn't sound good
309.49s - 318.13s |  to pretty much anyone. This is a practical solar power supply during the eclipse in Germany and how
318.13s - 324.77s |  it was theoretically proven with some math I don't really understand that if you take down
324.77s - 331.57s |  enough solar panels, you are going to take down the power grid for enough time. Again, mathematical
331.57s - 338.29s |  models. I'm a simpleton. I don't understand what they're doing. But it says that at least Germany
338.29s - 345.97s |  and France, as far as I know, cover 35 to 50% of its power using only PV installations, which means
345.97s - 352.77s |  if you take them down, they would have huge problems. Horuscenario had several CVs on one
353.65s - 359.89s |  inverter, SMA. They changed them for RCE. They RCE on those devices, and they interfere with
359.89s - 367.55s |  the devices to destabilize the grid. What we are going to see today, we are going to see
368.43s - 374.35s |  Horuscenario on steroids. We, unfortunately, we're not going to get any CVs because everything is
374.35s - 381.39s |  going to be done with APIs. Cloud doesn't give you any CVs. You know that. We don't need any
381.39s - 387.31s |  physical access. We don't need to be nearby. We can be in our beach house in Greece while hacking
387.31s - 394.99s |  PVs. We could brick and munch. We're inverter agnostic because we are just using the cloud,
394.99s - 402.30s |  and we're looking at more or less a little bit over 500 gigabit hours. Quick intro on my tool
402.30s - 408.62s |  set. Deer Search, Burpsuit, ZXD compiler, APK Lab I.O., which unfortunately is no longer working,
409.42s - 413.98s |  one small droplet on DigitalOcean, Sudan I.O. so that I could find more people,
414.54s - 422.99s |  and basic web application penetration testing. Steps that I was doing, I followed,
423.79s - 429.31s |  I tried to find a demo account. If I couldn't find a demo account, I'd register a new account.
429.31s - 435.31s |  I would find obvious, and I mean really obvious, web issues. I try to control devices by exploiting
435.31s - 441.87s |  those obvious issues, and I would really want to hack Tesla 2004 because he kicked my son's
442.59s - 450.99s |  fortnight. My results, SolrMan, Sunsync, Solax, Growad, Ingecom, Foxes, everyone,
450.99s - 457.79s |  Platform Admin, SolrMan, I couldn't upgrade the firmware. The other thing is, I don't know who
457.79s - 463.79s |  of you are a researcher in here, but you're going to get a lot of those ads. So if you are researching
463.79s - 468.99s |  for PVs, you're going to get a lot of PV ads. If you are researching for, I don't know, sex toys,
468.99s - 474.27s |  you're going to get a lot of ads for sex toys, and this goes to all your house, so yeah,
474.27s - 482.82s |  not a great thing. The disclosure was a train wreck. I have been trying for the past three and
482.82s - 490.18s |  a half years to disclose. Only one and a half vendors responded and acted on the disclosure.
490.18s - 496.02s |  The disclosure had everything that they needed to do. I tried really, really hard to get any
496.02s - 501.30s |  reaction. I emailed, I tweeted, I called them on their phone. I couldn't do anything else other
501.30s - 509.94s |  than drive there and talk to them, but that's not feasible, I guess. Okay. The responses.
509.94s - 515.46s |  SolrMan fixed in five days. Sunsync responded after three years. It's no longer no response.
515.46s - 521.78s |  After my OWASP talk, they did respond and try to fix it. Solax autoresponded. They responded
521.86s - 528.50s |  to their DMs, and then they went, well, Growad asked me where I'm from, because that makes sense,
529.30s - 537.46s |  and Injecon didn't do anything. So I know you're here for the zero days. I'm not legally allowed
537.46s - 542.66s |  to release the zero days, but I can talk about them, and if you have common sense, you can find
542.66s - 549.38s |  pretty much everything. What's the plan? I really want them to fix it, really. I just want to act
549.38s - 555.30s |  on it and fix it. I want to prove that you can control gigawatts of power effectively,
555.30s - 563.30s |  destabilizing country power grids, help avoiding global outages, and I don't know, make the whole
563.30s - 571.54s |  world a safer place, I guess. What did I find? EIDR, RCE, broken authentication, broken
571.54s - 582.16s |  authorization, EIDR, EIDR, EIDR. What did I get? Lots, and I mean lots, I mean couple of million,
582.16s - 588.56s |  couple of tens of million of personal data, access to administrative accounts and panel,
588.56s - 596.61s |  ways to manipulate and break panels, access to internal networks. You can see how many gigawatts
596.61s - 604.69s |  you could control from their panels. I'm not going to list them, and yeah, I know there are more
605.57s - 613.73s |  clouds, but yeah, I couldn't hack some of them, and also my wife didn't allow me to buy any more
613.73s - 624.98s |  inverters because, I don't know, reasons. Solarman, pretty huge player, EIDR on the user add
624.98s - 629.94s |  functionality, I could add a user with any privilege on any group, groups and organizations
629.94s - 635.62s |  were consecutive integers, which means I could pretty much add the user to every group with
635.62s - 643.78s |  admin privileges. What did I get? Full functionality, potential GDPR violation, I love that I should say
643.78s - 649.54s |  potential because I didn't get it, but this was GDPR violation with lacking user and company data,
649.54s - 656.34s |  information on plants and power generated. Really good response, they fixed it in five days,
656.34s - 664.74s |  they chased for verification, so all in all, good for them. Sunsync is probably one of the biggest
664.74s - 671.46s |  players, you don't know them because they're white label, so yeah, you might, if you have FPV,
671.46s - 676.42s |  you might have this back end, but with another label in front, and their issues were,
680.42s - 684.66s |  there was missing the whole point of authorization altogether.
686.82s - 691.70s |  If you're taking pictures, take that picture because you're gonna see that slide a lot for a
691.70s - 698.02s |  lot of platforms. Full functionality of the application, again, potential GDPR violation
698.02s - 703.46s |  because we are not violating the GDPR, information on plants, interact with the plants,
703.46s - 707.38s |  firmware update, because who doesn't want a firmware update on everyone,
707.38s - 715.06s |  backdoor to the network, platform admin. That's all the gateways, you can see we're looking at
715.06s - 723.30s |  half a million gateways, and that's all the firmwares, so you could just upload the firmware
723.30s - 732.06s |  and do whatever you want with that. The disclosure, but I want to say that
732.06s - 739.26s |  after my OWASP talk, their CISO reached out and he was pretty furious that my emails,
739.26s - 744.86s |  phones and everything else didn't reach to him, he was pretty cool, they said they fixed it.
746.94s - 753.42s |  They did not. I reached out last week and told them that I'm gonna say that, and he said no,
753.42s - 757.98s |  we fixed them, so yeah, you do what you want with that information.
758.86s - 768.58s |  Grobat is probably the biggest, and I mean the biggest player in there. I wasn't allowed to buy
768.58s - 778.26s |  a Grobat device because it was like 5k and my wife told me that you're not allowed to spend 5k for
778.74s - 786.02s |  research, so I had to Google some serials and then me being me, I'm doing that, I don't need it,
786.66s - 795.22s |  I find some broken one for 200 euros, so I bought it and then I had full functionality on everything.
795.22s - 800.50s |  What was the vulnerability? I don't know, pretty much everything, they didn't check anything,
800.50s - 805.46s |  so full functionality of the application, potential GDPR violation, interact with the
805.46s - 811.06s |  plants, firmware update on gateway, back to the network, platform admin, all in all, you know,
811.70s - 819.70s |  terrible shit. How did the disclosure go? Dear customer, due to the spring festive holidays,
819.70s - 826.18s |  we can reply in time, thanks for your understanding. That was January 26th of
826.98s - 835.70s |  2022. They do have a lot of spring festive holidays in China, I guess.
837.30s - 842.90s |  Would you please advise which country you're from? Because it makes sense, if I'm from Greece,
842.90s - 847.70s |  they shouldn't fix it, but if I'm from, I don't know, the States, it should. And then while I
847.70s - 854.74s |  was researching, I also found out. Three years later, Grobat vulnerability disclosure policy,
854.74s - 861.46s |  Grobat takes product security very seriously and is committed to protecting our users and their data.
862.58s - 869.46s |  You know what? Fuck off Grobat. Grow a pair, respond to the disclosure emails and do something.
869.46s - 876.42s |  They're the same thing, they didn't respond, they can go do a thing, I don't know. Solax
876.98s - 883.62s |  is the fifth bigger or fourth there in the fifth, one of the five biggest
884.18s - 888.18s |  providers in there. They were pretty good. And I mean, pretty good.
890.58s - 898.90s |  They had only one either, but that either was really, really good. So when you were editing
898.90s - 909.06s |  your user, you were also passing your user level. So when you see user level user, you usually end
909.06s - 915.70s |  up writing, I don't know, user level administrator, user level super administrator or user level root.
915.70s - 923.54s |  So remember that slide? Full functionality, potential GDPR violation, information,
923.54s - 928.50s |  interact with the plans, firmware update, backdoor to the network, platform admin.
928.50s - 932.82s |  You're going to see it a little bit more. Sorry about that. Sorry for repeating, but they're all shit.
935.06s - 942.66s |  Yeah, that's 21,000 pages of installations. You can do the multiplication. That's a lot,
942.66s - 952.05s |  and I mean a lot of devices. That's some EV chargers that they're still not there, but
952.05s - 958.93s |  you can see the demo in there because I'm admin, as I said. Thank you for conducting Solax cloud
958.93s - 965.41s |  support. We are extremely busy at the moment, and that moment has taken them three years.
966.93s - 972.37s |  They're going to respond to me. Then I was starting calling. They didn't answer my calls.
972.37s - 980.05s |  Finally, I just tweeted because it's Twitter, not X, fuck Elon Musk. And I just tweeted,
980.05s - 985.49s |  can someone tell me what I should do with Solax? Then they said that. So is there a problem with
985.49s - 990.77s |  that? Can you tell us what the issue is? I told them, yeah, I sent an email to that, that, that,
990.77s - 996.37s |  that, and that. Let me check. That was their answer. If you can see, I don't know if it's
996.37s - 1002.77s |  possible, that's 2023. So they're either checking really hard or they're just ignoring me.
1003.73s - 1012.77s |  Again, Solax, not cool. In GECON, there's MOLIS, so just 30,000 or 40,000 installation.
1014.93s - 1020.45s |  They're based in Spain or Italy. I don't remember. Sorry about that. They were missing the basic
1020.45s - 1027.49s |  concept of authorization. All IDs were consecutive integers. And again, full functionality,
1027.49s - 1032.77s |  potential GDPR, interact with the plants, firmware update, backdoor, platform admin.
1032.77s - 1040.45s |  Sorry for repeating myself, but they're shit. So you can see that we can also see the RAM,
1040.45s - 1046.69s |  the storage, and there is a really, really small button at the top. Can you see it? It says
1046.69s - 1057.14s |  sell. So you can just click on there and get a sale on each device. Again, you can also do,
1057.14s - 1065.30s |  I don't know, reports, stop it. And you could also disable all their protections, which means
1065.30s - 1073.78s |  that if you were someone who wants to do harm, you could make that thing be on fire. You could
1073.78s - 1091.42s |  literally burn shit up remotely. Does anyone want to guess how the disclosure went? I called them
1092.14s - 1098.38s |  and they just dropped the phone on me. When I said I want to do a vulnerability disclosure,
1098.38s - 1103.34s |  I just heard the toot, toot, toot. They could also say fuck you, but okay.
1104.62s - 1112.54s |  Foxes is the last one. These have only been around my disclosure for six months. So yeah,
1112.54s - 1121.18s |  it's way above my 90 days, but yeah, still not good. They were pretty good too. They had
1121.18s - 1130.61s |  only one issue. Their password reset was not that good. So they had, I don't know,
1130.61s - 1136.85s |  most of the Chinese companies nowadays have a password reset that says, we send you a four
1136.85s - 1143.81s |  digit pin. That pin was brute forcible and the user ID was consecutive integers, which means
1143.81s - 1149.09s |  you could pretty much reset everyone's password with a Python script with for loop.
1150.93s - 1156.45s |  Same thing. Sorry about that. Full functionality, Yada, Indirect, firmware update,
1156.45s - 1163.65s |  backdoor to the network, platform admin, you name it, they have it. Again, anyone want to
1163.65s - 1175.66s |  guess the disclosure? So enough with the photovoltaic. Let's go to EV chargers.
1176.62s - 1187.90s |  Uh, just a reminder. We are not after the power grid. We're after a guy who is named Tesla 2004.
1187.90s - 1195.50s |  He does probably doesn't own a panel, but he or his mom has a Tesla. So let's go up after some
1195.50s - 1205.01s |  EV charges, right? Project TV, 2000 installation in the UK. Growat based again, department of
1205.01s - 1212.61s |  transport approved. That's in the UK. Growat and Shenzhen are China based companies. Can you see
1213.81s - 1223.36s |  the issue in this request? Anyone? No, it's not an either. You would wish it was an either.
1224.96s - 1230.16s |  There is no authentication at all. So you were authenticating on the application. You were
1230.16s - 1235.76s |  saying, yeah, I'm demo with a demo password. And then all the other requests didn't have
1235.76s - 1241.04s |  any kind of authentication, any kind of JWT or cookies. They were just doing, yeah, he said he
1241.04s - 1246.64s |  was that. Let's go with our lives. Fully lacking authentication. Check for a valid combination.
1246.64s - 1252.32s |  Only once on login. Charger IDs were consecutive numbers, so it could be easily, and I mean really
1252.32s - 1260.66s |  easily brute forced. Yeah. Full functionality, lock and lock, remote, backdoor, brick all the
1260.66s - 1268.98s |  devices, platform admin. Disclosure. Oh, my lovely disclosure. Did not respond for weeks.
1268.98s - 1274.34s |  Only responded when I had to reach out to BBC. Eventually fixed after a failed first attempt.
1274.34s - 1279.78s |  You really don't want to have to resend the message and say, yeah, you know that fixed.
1279.78s - 1285.54s |  That's not actually fixed, so you have to try harder. They have a stateless login or whatever
1285.54s - 1294.74s |  the fuck that means. I'm not going to test it anymore. Also, do you remember the Grobat PV?
1294.74s - 1301.86s |  They have the same thing. They just fixed it for the EV. I don't know why. I don't know.
1301.86s - 1312.42s |  EV box, pretty big on the market. They have around 400,000 charging points. They're based in Amsterdam.
1312.42s - 1318.50s |  They were acquired by ENCE. They were really, really, really good. They had a pretty solid API.
1321.47s - 1334.64s |  Want to guess? Let's play a guess game. What's the issue in here? No one? Come on. It says when you
1334.64s - 1342.32s |  update your user, you are also passing your role. Why would I pass my role? So let's try admin,
1342.40s - 1349.52s |  account owner, and then admin, because I also want the fucking server. I just don't want only
1350.16s - 1357.68s |  the EV chargers, which means I had access to pretty much everything. Total compromises,
1357.68s - 1362.80s |  everything, potential GDPR violation, full admin functionality, which means I could give money,
1362.80s - 1369.04s |  I could charge back, I could do financial shit. It was really, really bad. But
1369.44s - 1375.28s |  they responded in just two hours. They fixed it in 24 hours, double checked that everything was
1375.28s - 1384.30s |  fixed. Excellent response. I'm happy when I see this kind of responses. Oh, my lovely wallbox.
1384.30s - 1391.50s |  I don't know how many of you are familiar with EVs. I personally got that banned in the UK,
1392.06s - 1397.74s |  so they probably hate me. So 200,000 users, they're based in Barcelona,
1398.70s - 1404.78s |  merged with Kensington, and their aim to raise 300 million USD. Probably not because they're
1404.78s - 1413.26s |  banned now. I had a second level IDOR, anything in the request body was not validated. I had found
1413.26s - 1419.42s |  four different instances on this in the API, which means I found something, they fixed it,
1419.42s - 1424.94s |  then I went to something else and said, fix that too. And then I said, I'm not doing a free
1424.94s - 1432.46s |  penetration test for you. Fix your shit. Check your proper authentication. Total control over
1432.46s - 1439.82s |  all chargers. Lock and lock. No way to update firmware. Potential GDPR violation. Unfortunately,
1439.82s - 1447.15s |  no platform admin. So they responded the next day. They fixed it in a couple of days.
1447.15s - 1454.27s |  They re-engaged after a month. I found a second issue. They fixed it in a couple of days again.
1454.27s - 1458.99s |  Then they wanted to engage to provide the site of their new hardware platform,
1458.99s - 1466.83s |  which meant I had to sign an NDA and not talk about it, which, no thanks. I don't do NDAs.
1467.71s - 1475.79s |  And then, as I said, charger pool amid warnings, hackers could attack national grid. So yeah,
1475.79s - 1485.12s |  we're getting there. Kudos to the UK government. I think that's the last of the private ones.
1485.36s - 1490.56s |  EoCharger, EoHub, it was the first charger in the UK. It had a lot, and I mean a lot,
1490.56s - 1497.12s |  of teething problems. It had around 15,000 users estimated, and it's a fucking Raspberry Pi,
1499.41s - 1506.13s |  which can be easily rooted. It had no bootloader security, and I was able to recover,
1506.13s - 1513.25s |  not only me, my good friend who is now not with us, Mike Polidoro, the full source code,
1514.21s - 1517.33s |  and I mean two Python scripts because that was their source code,
1519.09s - 1524.37s |  with hard-coded credentials and full documentation. Okay, let me show you something in there.
1524.93s - 1547.84s |  It means you could potentially full decryption, total control, you could mimic the server
1547.84s - 1554.24s |  communication, you can make the devices be part of a botnet, potential GDPR violation,
1554.96s - 1562.05s |  credentials leakage, and platform admin. They tried. I'm not going to be
1563.49s - 1568.61s |  bad with them. They responded in a timely function. They worked hard into reworking pretty
1568.61s - 1575.49s |  much everything, and then they introduced their new and improved Eo Mini, which was still a
1575.49s - 1585.94s |  Raspberry Pi. So all in all, they tried at least. My personal opinion, take it with a pinch of salt
1585.94s - 1593.38s |  because I'm not a hardware expert. Raspberry Pi are a valid prototyping device, but not good
1593.38s - 1598.66s |  to put into production. They're easily extracted all their data. They're easily routable, and
1598.66s - 1606.42s |  there's no secure bootloader. Last one, and we should be off. Public chargers. I have looked
1606.42s - 1611.22s |  after ChargePoint, which is an American electric vehicle. It's one of the top three public
1611.22s - 1616.74s |  chargers providers in the world. A good friend told me that when someone says he's one of the
1616.74s - 1627.74s |  top three, he's the third. They went public in 2021, and they had a publicly exposed unauthenticated
1627.74s - 1634.46s |  GraphQL endpoint with introspection enabled. It was potentially leaking their full schema,
1634.46s - 1639.50s |  and no authentication parameters were to be seen. So you could pretty much do whatever you want,
1639.50s - 1650.19s |  but CMA and crime alert. API research is really, really, really tricky on that. Never, ever
1650.19s - 1657.23s |  interact with a device that you don't own. If you mistakenly do it, notify the vendor immediately
1657.23s - 1662.27s |  and stop doing whatever you are doing because you don't want to end up in jail. At least I don't
1662.27s - 1669.23s |  want to end up in jail. They responded in an hour. They fixed it in the same day. Excellent response.
1670.11s - 1676.91s |  They acknowledged the issue. I could have checked further, but as I said, my goal is to stay outside
1676.91s - 1688.26s |  of prison. So yeah, that was probably a wise choice. For your takeaways, go with a provider
1688.26s - 1695.46s |  that will act on problems. So no random white labels. Try to isolate IoT devices on their own
1696.26s - 1702.58s |  villains. Vulnerabilities will happen and expect them to happen. Also, just a heads up. If your
1703.14s - 1710.82s |  device will be on fire, your private villain will not really help. So take that under consideration.
1710.82s - 1717.62s |  And for those being vendors, know that authorization is not equal to authentication.
1718.34s - 1721.86s |  Push to market cannot always be the excuse. I understand that you have to
1722.58s - 1727.94s |  rush to market because you are a startup, but after you are in the market for five years,
1727.94s - 1735.30s |  you have to secure your seat or you will end up in one of your really bad lists. And pen test
1735.30s - 1744.69s |  your things. Not by me. By anyone. Do try to secure yourself. That was me. Thank you.


url: https://www.youtube.com/watch?v=H8Y-j0sYqvo
title: DEF CON 32 - Fine Grained Authorisation with Relationship Based Access Control - Ben Dechrai
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=H8Y-j0sYqvo",
  "title": "DEF CON 32 - Fine Grained Authorisation with Relationship Based Access Control - Ben Dechrai",
  "description": "Who can tag me in a post? If I move this file to another folder, who now has access? If my owner breaks up with his friend, will I still get a bone?\n\nWhether you're a human, or a dog, let's face it, authorisation is hard. Role-based access control is a great starting point but hard to scale. Attribute-based access control scales better, but neither are much good at answering more complex conditions, like whether friends-of-friends can read your posts. For such situations, we generally have to wrap this up into business logic.\n\nThis is where relationship-based access control (ReBAC) comes in, offering a nuanced approach to accessing resources without codifying that into the applications.\n\nIn this session, we'll look at how to define these relationships, experience live demos, and discover how we can deploy our own fine-grained authorisation service. Expect some tail-wagging insights and a few laughs as we explore access control from a canine's point of view.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1721,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.94s | This text was transcribed using whisper model: large-v2

 All right. So with that in mind, welcome to the stage, Ben.
4.94s - 11.51s |  Thank you. Hello everyone. Um, I'm going to be that annoying guy for the uh, person behind
14.11s - 19.01s |  the camera. I like moving a lot, hence I've got the, the handheld. I don't like to be stuck
19.01s - 24.09s |  behind a podium. But the main reason I'm here today is uh, cause I'd like to talk to you
24.09s - 29.13s |  about some security matters that interest me. Uh, who here is familiar with access control
29.13s - 32.83s |  within web applications in some way or form? About half of you. That's cool. Who knows
32.83s - 39.83s |  what RBAC is? ABAC? Rebac? Cool. Increasingly dropping numbers of hands. That's kind of what I
40.51s - 44.31s |  expected. I think we've got about 10% people here who know Rebac. So we're going to dive
44.31s - 48.15s |  in and we're going to go a little bit deep dive into how Rebac works. Now normally this
48.15s - 53.85s |  is a 45 minute to one hour conversation. So excuse me if I skip over some bits, but please
53.85s - 56.75s |  come and ask me questions afterwards. But we're going to go a little bit deep on how
56.77s - 60.91s |  the data actually gets stored so that we as developers understand how Rebac was going to
60.91s - 65.71s |  help us and how the relationship based access control actually works or may not work for you.
65.71s - 70.29s |  It's not always the right solution. But who am I? Um, I'm a guy who develops slides that
70.29s - 75.49s |  have really bad contrast on LED screens. Uh, also I've been a software engineer for too
75.49s - 78.89s |  many years. I don't, I used to put the number up there. Uh, it made me feel old so now I
78.89s - 83.03s |  just do a sense. You can do the maths in your head. Uh, I love working with developer and
83.05s - 87.15s |  open source communities. I've been doing that for about 20 years. I'm really passionate
87.15s - 90.59s |  about security and privacy. If you want to talk to me about any of those things, those are
90.59s - 95.63s |  my jam. Come talk to me afterwards. Uh, I'm currently working as a developer advocate for a
95.63s - 100.27s |  company called ArcJet, hence the branding across my chest here. We're a, uh, a middle
100.27s - 104.41s |  west security solution for your web applications. If you are writing any kind of web
104.41s - 108.17s |  application at all, check out arcjet.com and just plug it in. It's free. Give it a try.
108.17s - 112.55s |  We'd love to hear what you think about it. Uh, if you want to contact me, I've got the X
112.57s - 117.23s |  logo on there, although I still like to call them Twitter. Um, I, I feel some ways about an
117.23s - 123.07s |  organization, uh, whose community does not accept certain people's desire to change their
123.07s - 126.95s |  identity. So I will not allow Twitter to change their identity either. So my Twitter handle
126.95s - 132.75s |  is at Ben Dechry. My DMs are open. Uh, contact me if you like. It's, it's not an
132.75s - 137.69s |  instruction. It's a, it's an offer. So let's get into it. Access control 101. Basics and
137.69s - 141.83s |  understandings thereof. First thing we're going to have a look at, um, is the, the
141.87s - 145.01s |  caricatures we're going to be looking at. So whenever it comes to access control, the dog
145.01s - 148.65s |  wants the bone, right? So we're going to look at ways that we can stop or allow the dog
148.65s - 152.75s |  from accessing the bone. First one's going to be using RBAC, role based access control.
152.75s - 156.05s |  It's probably one of the simplest access control mechanisms. So we'll skip through this
156.05s - 159.55s |  very quickly. Basically we have a number of roles. You've got an admin, you've got a
159.55s - 164.49s |  manager, employee, and a guest. And in our case, our dog, this is Shadow. Shadow has a blue
164.49s - 169.73s |  hat on. Blue hats are employees. Uh, and the door is locked to all, but the admins,
169.73s - 174.11s |  managers, and employees, we don't want guest dogs getting to the bones. Only employee
174.11s - 178.91s |  manager and admin dogs, my analogies fall apart a little bit sometimes, are going to get
178.91s - 183.29s |  access to the bone. So because, because Shadow has access, the door opens. Role based
183.29s - 189.05s |  access control. Nice and simple. Next one. Attribute based access control. This is kind of
189.05s - 192.09s |  like role based because you could say, well, the role is an attribute of a person, but
192.09s - 196.73s |  attribute puts so many more layers on top of this. So we've got, uh, four attributes here
196.73s - 201.47s |  of the dog. This is Min. Uh, this is a, a, a white Siberian husky. These are actual real
201.47s - 205.61s |  dogs in my life. I like to relay them into my talks. Uh, there are four characteristics.
205.61s - 210.45s |  Service dog, good boy, loyal, and fierce. I can tell you while Shadow is a service dog, Min
210.45s - 214.15s |  will never be a service dog. If you've ever seen one of those dogs that just cannot control
214.15s - 217.99s |  itself because it's always so bloody happy, that's Min. So she will never ever be a, a, a
217.99s - 223.75s |  service dog. But she is usually, uh, a good boy or, or loyal. She is not fierce. We've
223.77s - 227.65s |  decided in this case that we're going to make her a loyal dog and the door will open if you
227.65s - 233.05s |  are a good boy or a loyal dog. Now, as an aside, I go on tangents occasionally. You might be
233.05s - 237.35s |  asking yourself, but why doesn't a service dog get a bone? Because a service dog is good,
237.35s - 242.49s |  right? Service dogs deserve bones. Anybody agree with that? Nobody agrees with that? You
242.49s - 247.33s |  all hate service dogs. That's what I'm learning about you lot. Jesus. Rough crowd. Um, no,
247.33s - 251.77s |  service dogs are working. They don't get to eat. But we're going to layer an attribute on
251.79s - 255.49s |  top of this. Because you could say, well, that's just a role, right? The attribute here we're
255.49s - 262.29s |  going to put in is time. Who does have a dog? Wrong audience. Who has cats? Okay, let's
262.29s - 268.67s |  pretend your cat likes eating bones. Or for those of you who have dogs. Who, who, uh, lets
268.67s - 273.47s |  their dog sleep in their bedroom with them at night? Who would like the sound of a crunching
273.47s - 278.43s |  bone at 3 a.m.? No, I certainly don't like the sound of a crunching bone at 3 a.m., so if
278.43s - 286.43s |  it's outside of 9 p.m. to 9 a.m., no bone for you. So, sadly, men get no bone. Uh, but there
286.43s - 289.67s |  are plenty of other things we can do attributes on. We've got actual identity, physical
289.67s - 293.97s |  location, network location, the time, the weather, whether or not you're authenticated to a
293.97s - 297.59s |  system. There are lots of things you can layer on top of this as an attribute of whether or
297.59s - 302.13s |  not somebody should get access to a resource. So, a bit more complexity, a bit more
302.13s - 306.47s |  flexibility about how we can control our resources, which brings us on to relationship based
306.47s - 312.25s |  access control. And this changes the paradigm quite significantly as I lose my balance. So,
312.25s - 317.79s |  um, this dog doesn't actually have a name. Uh, who, who here had a dog? What was your dog's
317.79s - 324.29s |  name? Liam. This is Liam. Thank you. Liam, um, is actually a dog. Dali designed Liam. I
324.29s - 329.09s |  thought it came out a little bit like a cat, but, uh, that's what we're going with. So, um, Liam
329.09s - 333.93s |  has an owner. Uh, you are the mad scientist, congratulations. Uh, so Liam's owner is a mad
333.93s - 338.05s |  scientist. The mad scientist is friends with a farmer. The farmer has a whole load of
338.05s - 344.22s |  sheep, and for the vegetarians in the audience, I apologize, but sheep have bones. Ten
344.22s - 348.94s |  minutes? Oh, I need to stay back. This is, this is not good for me, because A, I'm going to fall
348.94s - 353.68s |  off the back of the stage. Not too far, okay. Just right, right here, okay. The guy who
353.68s - 359.60s |  likes to roam may no longer roam. That's okay. Uh, so, we, we have this, this chain of
359.60s - 364.94s |  relationships, as you can see. So, we can see here that, uh, Liam may or may not have access to
364.94s - 370.26s |  the bone based on the rules that you can see. Now I'm getting feedback. Based on the rules
370.26s - 374.90s |  you can see on the door there. Yep. Oh, sorry, let's just zoom in a little bit. The rules you
374.90s - 379.26s |  can see on the, on the door there. So, with relationship based access control, we don't
379.26s - 387.47s |  actually have a concept of users anymore. We just have a concept of entities and
387.47s - 395.69s |  relationships. Entities and relationships. I'll keep going unless they actually stop me, or
395.69s - 400.61s |  unless too many people in the audience cringe. So, here we've got an action. Can the action
400.65s - 405.23s |  eat be completed on the bone? Uh, so, note that we're looking here at what can be done to the
405.23s - 410.27s |  bone. We're not looking at what Shadow or, or Liam can do. We're looking at what can be done
410.27s - 414.69s |  to the bone, what actions can be taking place. If it's the animal owner, or the friend of the
414.69s - 420.11s |  owner of an animal, or the pet of a friend of the owner of the animal, they can eat the bone.
420.11s - 424.47s |  Technically, I suppose you could argue, no, I probably wouldn't want the owner of the bone,
424.47s - 428.23s |  the sheep, to be eating the bone. That would be a little bit weird. But you can see we just
428.23s - 432.19s |  find here a set of relationships that allow us to decide whether or not the bone can be
432.19s - 436.81s |  accessed by the dog. And because through those green lines there, which are really terrible
436.81s - 441.23s |  in this background, you can see that the flow does actually go all the way through. Liam
441.23s - 446.23s |  gets a bone. Good for Liam. So, the door opens. Now, say one day the farmer and the mad
448.89s - 452.47s |  scientist break friends. They're no longer friends with each other. Suddenly that
452.47s - 455.85s |  relationship is broken. Now, nothing has changed about the bone, and nothing has changed
455.85s - 460.01s |  about Liam. But the relationship is broken, therefore the friend component of that rule
460.01s - 465.17s |  there breaks. So, the only rule that allowed Liam to get access to that bone is now broken,
465.17s - 469.59s |  and the door shuts. So, that's what a relationship-based access control is about. It's not
469.59s - 474.71s |  so much about defining what somebody or some user can do. It's about what actions can be
474.71s - 480.75s |  performed on a resource based on a set of rules that relates lots of resources together. Does
480.79s - 486.79s |  that make sense? Cool. So, under the hood, who here is familiar with the entity attribute
486.79s - 491.75s |  value model of designing? So, if you've ever done any kind of content management systems or
491.75s - 495.21s |  anything like that where you've got an undefined at the beginning of your project, you have
495.21s - 498.75s |  an undefined number of entities, you want a way to be able to create new entities in your
498.75s - 502.95s |  system without having to do a database deployment, because they are nasty, especially when
502.95s - 508.53s |  you have a lot of data. So, the entity attribute value model of data storage basically says
508.53s - 512.31s |  you have a table that defines entities, and you have another table that defines the
512.31s - 515.93s |  attributes and values for that entity. So, if you want to add another entity, it's just
515.93s - 520.69s |  another row in a table. Nice and simple. Let's have a quick look at how that works. So,
520.69s - 525.15s |  we've got a user and an article. So, we're going to be looking at a blog post system, for
525.15s - 528.53s |  example. So, we've got a user and an article, and on this right hand side here we've got a
528.53s - 531.81s |  whole jumbled load of mess. But you can see that we've got the entity ID, the second
531.81s - 537.43s |  column. So, the first, second, and the last two rows in the attribute table belong to a
537.43s - 542.43s |  user. And because the second column has number twos in it, the third and fourth rows belong
545.05s - 549.35s |  to an article. So, you can see the user's username is Robin, and the user's password is
549.35s - 554.93s |  password. Down there we have username Morgan and password. For some reason they like using
554.93s - 559.81s |  JSON Web Tokens for their passwords, but that's their password. And then in the middle
559.81s - 563.05s |  through there you can see that we've got an article, one article, instance ID of the
563.05s - 568.31s |  article is one. We've got a title of Rebec for the win, and content is can has FGA, fine
568.31s - 574.81s |  grained access control. So, now if we want to pull stuff out, we can use a fairly simple
574.81s - 581.05s |  ish join within an SQL table to say, well, pull all these things out, and I can pull out, for
581.05s - 587.51s |  example, get me all of the articles that you have. Give me the title and the content. Or
587.55s - 590.63s |  maybe rather than getting information about one entity, you could say give me a list of
590.63s - 596.29s |  all the users and just give me their usernames. So, this table setup basically allows you
596.29s - 600.87s |  to get really varied views across the data you have without having to change your database
600.87s - 604.59s |  schema, without having to know what that schema looks like to start with, and you can
604.59s - 609.25s |  store arbitrary data in there and pull it out in whichever way you want. It's complicated
609.25s - 615.83s |  and expensive to pull out, and it's somewhat complicated to set up and use within more so
615.83s - 619.65s |  than if you had like an article table and a user table and a comment table. So, if we
619.65s - 623.69s |  wanted to add a comment, for example, we just add an extra row over there, and then we can
623.69s - 628.15s |  add some extra columns here saying, okay, so we've now got this entity ID three, instance ID
628.15s - 633.19s |  one, so this is comment number one, the article ID is number one, author is Sam, comment
633.19s - 638.69s |  was first, and here's the date Sam. So, without making any database schema change, I've
638.69s - 643.65s |  added a whole new entity to the system. The only reason I tell you about EAV is because this
643.69s - 648.61s |  is very similar to the way that Reback is managed under the hood. So, let's have a look at
648.61s - 653.39s |  how that works. We've got entities on the left-hand side, Robin is a user, Acme Co is an
653.39s - 658.19s |  organization, and Reback for the win is an article. And down here we have some
658.19s - 662.47s |  relationships. So, we're now looking at just subject ID, and I apologize for the color
662.47s - 666.51s |  scheme, we've got a relationship ID, which is just arbitrary for this table, we've got a
666.51s - 671.77s |  subject entity ID and an object entity ID. So, how does a subject relate to an entity? A
671.77s - 676.23s |  subject is an entity, it's just the primary entity within a relationship. So, we're saying
676.23s - 683.23s |  subject one, the user, entity ID three, the article, relationship type is owner. Therefore
683.23s - 689.66s |  we know that Robin is the owner of the Reback for the win article. We can then add in that
689.66s - 694.66s |  Robin, user one, is a member of organization Acme Co. And we can add in that Morgan, user
695.08s - 700.08s |  four, is a member of the organization Acme Co as well. So, we now know that both Robin
703.58s - 708.32s |  and Morgan are members of Acme Co. Now we have another one here where we say the organization
708.32s - 714.28s |  is a viewer of the Reback article. But organizations can't view things. So, we're able
714.28s - 718.28s |  to extend that slightly and put an extra entity relation on there. How do the entities
718.28s - 723.74s |  relate to each other? Through this member relation. So, if we dial that back, if we see
723.74s - 729.74s |  here we've got member, in the middle two rows here we've got a relationship of members. So,
729.74s - 737.02s |  what we now know is that members of organization two can view the Reback for the win article.
739.64s - 744.64s |  So, now if I add another member into that organization they automatically inherit that because
744.64s - 749.52s |  the relationship exists already. Does that make sense? This is where it gets a little bit
749.52s - 753.64s |  murky. You don't need to know all of this. I just want you to understand how the data sits
753.68s - 758.88s |  in there so that when we start pulling it out you can see what's going on. So, the other
758.88s - 762.76s |  thing we can do is define permissions on all of these. So, we've got the relationships
762.76s - 766.80s |  but what does that actually mean they can do? So, permission ID one, again arbitrarily
766.80s - 772.84s |  for the permissions table, relates to relationship ID one. So, relationship ID one was Robin
772.84s - 777.60s |  is the owner of the Reback article. So, we're saying here, well, one of the permissions
777.60s - 784.88s |  is read. Relationship ID one is also that Robin is the owner of the article. Robin also has
786.50s - 793.50s |  write access. And then we have relationship ID four which is this, this inferred down
793.50s - 800.38s |  here, members of organization two, members of organization two have read permissions. So,
800.38s - 804.96s |  even over here we've got relationship types and entities like viewer is just a label. It
804.96s - 808.84s |  doesn't mean anything to the system. But when you look at that you see what that means is
808.84s - 815.96s |  the permission for viewer for any member of organization two has read access on article
815.96s - 823.96s |  one. So, there's one extra table here compared to EAV but this allows us to define a multitude
823.96s - 829.34s |  of relationships and permissions and how they relate to each other and to other entities.
829.34s - 833.54s |  And more importantly they allow you to chain those identities. Remember how we went from
833.54s - 838.12s |  Liam to the mad scientist to the farmer to the sheep to the bone? It's not just one to one.
838.12s - 841.72s |  You can define these huge big chains and if any part of that chain gets broken then the
841.72s - 848.26s |  relationship breaks. So, querying the Reback model, how does this work? Let's say we come in
848.26s - 854.96s |  here and we want to find out who can read. We can see here that the read, sorry, who can
854.96s - 860.96s |  write. The permission ID there is two. So, if we, let's just go back one. I think I've got the
867.39s - 873.09s |  wrong one highlighted there. I want to find out who can write a Reback article two. So, first
873.09s - 877.09s |  thing we do is we look at the, and the highlighting isn't working so great here, the object
877.09s - 881.43s |  entity ID three there is the Reback article. So, we say okay, within the relationships let's
881.43s - 885.97s |  find out everything we know about the article. And we can see here that the fourth one there
886.01s - 890.85s |  can be excluded straight away because the relationship ID number four is not in the
890.85s - 898.13s |  permissions table. However, relationship ID one is in that table that is related to the
898.13s - 905.39s |  object identity two. So, we can pull out the user Robin has write access to the article. So,
905.39s - 909.35s |  you can look at things in other directions as well. And then further to that you can even
909.35s - 913.05s |  say okay, well tell me everything about the article rather than starting from the permissions.
913.09s - 918.31s |  So, we look at article number three. We know that Robin is the owner of that article
918.31s - 923.97s |  already. And if we look at the viewer here we can then, and this is what I was talking about
923.97s - 929.59s |  before how member gets extrapolated to infer relationship status. So, we can see that the
929.59s - 937.59s |  member here of organization two has access to the article. And if we then fold those in you see
937.59s - 941.39s |  how before this one here was highlighted. What we're now doing is saying the subject is now
941.39s - 946.93s |  the object. So, where the object is now entity ID two where also the relationship type is
946.93s - 951.05s |  member. That's where this one basically gets folded out. So, that's probably one of the
951.05s - 957.85s |  most complicated lookups. It's really deep diving straight into the depths of the Reback
957.85s - 961.59s |  schema. But essentially what we're doing there at that point is we're saying this
961.59s - 964.77s |  permission or this relationship here doesn't make sense from a permission sense because
964.77s - 969.35s |  you don't give permissions to inanimate objects like organizations. Necessarily, I mean
969.35s - 974.65s |  you do. But that doesn't really help an end user. How do we then unfold that and then
974.65s - 979.77s |  extrapolate that to refer to the actual user entities? And this is where it gets
979.77s - 983.51s |  complicated because Reback as I said doesn't have a concept of a user necessarily. You
983.51s - 987.97s |  can, you could actually ask Reback what is the relationship between this organization
987.97s - 991.89s |  and that network? Neither of them really do anything. They're system entities. They're
991.89s - 997.47s |  not user entities. But they still have relationships. So, it's powerful but also complex.
997.47s - 1002.47s |  So, implementation details. Let's have a think about how we might do something in code.
1005.71s - 1010.13s |  Which is probably the way most of us do the more complicated business logic like this. So,
1010.13s - 1015.25s |  if we want to allow editing an article, if a user is an admin or an editor, if an editor is
1015.25s - 1020.97s |  allowed to edit this particular article, if the article is sensitive then we also want to
1020.97s - 1024.47s |  make sure that the person is on site and we want to make sure that they're doing it during
1024.47s - 1030.29s |  office hours. Seems like a fairly robust kind of setup that you might have in a large
1030.29s - 1037.17s |  organization. So, if. If the user is admin or if the user is editor. Cool. So, we've got, we
1037.17s - 1043.67s |  know what role the user has. Also, if the user is an editor and the list of document
1043.67s - 1048.21s |  editors contains the current user. So, we don't want any editor to be able to edit this.
1048.21s - 1052.83s |  Only if the list of editors for this particular article includes the current user. So, we
1052.83s - 1056.83s |  can compound those two together. Then also we want to say, well, if the document isn't
1056.83s - 1061.53s |  sensitive, then we can carry on. Otherwise, we're going to check to see if the user's
1061.53s - 1067.57s |  location is on premises or if the user's location is currently in office hours. And I say
1067.57s - 1071.69s |  the user's location because in a world like today, who knows when it's 9 to 5 for
1071.69s - 1076.03s |  somebody. So, as long as it's within the location they're in, it's working hours and
1076.03s - 1081.19s |  they're on premises or the document is not sensitive and they meet the user requirements,
1081.19s - 1085.15s |  they're going to get access to this document. Imagine if you had to come back and change
1085.15s - 1090.78s |  those rules three months later. So, instead what we're going to do is we're going to
1090.78s - 1096.28s |  define entities within our relationship-based access management tool of choice. We're
1096.28s - 1100.24s |  going to define a document. The document has an owner and an editor. The owner is a
1100.24s - 1106.50s |  user and the editor is a member of an organization with the member type editor. So, you
1106.50s - 1110.74s |  can have different types of people within groups. And then we're going to have a
1110.74s - 1114.28s |  sensitive document. That's the definition of a normal document. A sensitive document is
1114.28s - 1119.60s |  going to extend document. It's also going to have an edit action on it that says if it's
1119.60s - 1124.56s |  within working hours and the document, it's the document owner who's trying to do this
1124.56s - 1128.06s |  action. Because remember, we're defining actions on an entity and who's allowed to
1128.06s - 1133.24s |  perform it. So, can edit be done on a sensitive document? Yes, you can if you are the
1133.24s - 1138.82s |  document owner and you are the document owner and you're on premises. Or if you're an
1138.82s - 1143.64s |  editor and you're on premises. So, this gets tied into your relationship-based access
1143.64s - 1149.64s |  model schema and permission systems. So, now your code can change from this to that.
1151.48s - 1157.48s |  And now your business logic isn't restricted or it doesn't include the permissions
1157.48s - 1161.06s |  check because there's no real reason for that to be there. The permission for who
1161.06s - 1165.40s |  should access an entity within your system should not be dependent on what's in the
1165.40s - 1170.14s |  business logic. There's a fast and firm rule for that. This gives you two benefits. One
1170.14s - 1174.64s |  from a clean code, easy to read perspective. That is much easier to read. You know
1174.64s - 1178.44s |  exactly what's going to happen. You don't have to think about it. Also, from a
1178.44s - 1182.98s |  permissions and access control management perspective, your security team can manage the
1182.98s - 1187.90s |  rules and the schema separately from your development team and it puts the
1187.90s - 1195.88s |  responsibility in the right place. So, demo time. This is the fun part. So, the first
1195.92s - 1200.20s |  part was all about dogs. Then we went to document access management, which is
1200.20s - 1205.92s |  important but boring. So, we're going to go back to dogs. I have tried a number of
1205.92s - 1209.54s |  products. There are all these products up on the screen here. There are many more. These
1209.54s - 1213.58s |  are relationship-based access management tools. Some of them are open source and
1213.58s - 1220.12s |  free to use. Some of them are paid for. I'm going to be using Permify in this demo. Am I
1220.12s - 1223.42s |  going to annoy anybody by switching over to this on the AV team? Because they didn't
1223.58s - 1228.42s |  check me on this one. So, I apologize in advance. I'm going to need both hands. So, I'm
1228.42s - 1234.84s |  just going to stop screen sharing. Let's jump over here and we're going to have a first
1234.84s - 1242.84s |  look at Postman. So, let's make this a bit bigger. Can you all read that okay? Excellent.
1242.84s - 1247.70s |  So, let's have a look from the beginning. We're going to create a tenant. In fact, the
1247.70s - 1255.40s |  first thing I'm going to do, because like all developers, I decided to test this before I
1255.40s - 1258.12s |  started the talk. So, I'm just going to restart Permify in the background. So, we're
1258.12s - 1262.24s |  starting from a bank slate. So, now over here, what we're going to do is we're going to
1262.24s - 1266.08s |  create a new tenant. So, Permify allows you to have multiple tenants in your system. So,
1266.08s - 1271.24s |  you can sandbox or isolate certain areas of your organization or even certain
1271.24s - 1279.66s |  organizations within a larger system. So, we're going to create a tenant over here called
1279.66s - 1285.82s |  Dog and Bone. If I hit send on that, we'll see down here that we get a positive response
1285.82s - 1289.36s |  back, a 200, and we've got our tenant. So, the next thing I'm going to do is create the
1289.36s - 1296.00s |  schema. Now, this schema, for some reason, Permify wants it in a single string. So, to make
1296.00s - 1303.67s |  it easier, I have it over here. This is very similar to what we saw in the slides. Basically,
1303.67s - 1308.41s |  we've got a definition of a dog. A dog has an owner, which is a person. We've got a sheep. A
1308.41s - 1312.71s |  sheep has an owner that is also a person. A sheep also has a bone, which is of entity type
1312.71s - 1317.91s |  bone. We've got a person. A person can have a friend, would be another person. A person can
1317.91s - 1322.75s |  also have sheep and a person can have dogs. So, we've got bidirectional rules here. And
1322.75s - 1327.45s |  then we've got a relationship between the bone. The bone has an owner, and that's a sheep.
1327.45s - 1334.15s |  And then we've got a permission. Can the owner's friend's dog eat? And eat is true if that
1334.15s - 1343.26s |  comes out as a relationship that exists. So, let's submit that through, and we should find
1343.26s - 1353.07s |  that that has now worked. If I now create some relationships, come on, get bigger. Where's
1353.07s - 1362.18s |  the handle? It's always hiding. I'll just scroll through little by little. So, actually, if
1362.18s - 1367.00s |  I make this slightly smaller, is that still readable at the back? Yep, okay. So, at least we
1367.00s - 1370.04s |  can see a bit more at a time. So, we can see here we've got a relationship between a subject
1370.04s - 1374.34s |  and an entity. Remember I said a subject is also an entity, but it's just a primary entity in a
1374.34s - 1379.88s |  relationship. Is the microphone cutting in? A little? I'll go back to this one. Because I
1379.88s - 1384.34s |  don't need to type as much now. So, we can see the subject, mad scientist, is the owner of
1384.34s - 1390.04s |  shadow the dog. We can see here that shadow the dog is also a dog belonging to the scientist.
1390.04s - 1395.08s |  And then we've got the farmer has dolly the sheep. The sheep belongs to the farmer. And we've
1395.08s - 1403.74s |  got dolly is a sheep to the femur. And the femur is a bone to the sheep. So, we've got these
1403.74s - 1410.08s |  relationships built up now. So, if I come through and I ask what friends does the scientist
1410.08s - 1414.78s |  have, because we haven't defined those relationships yet, if I execute that, we'll see down
1414.82s - 1422.02s |  here that the result is nothing. We have no ‑‑ he has no friends. He's a sad scientist. As it
1422.02s - 1427.52s |  happens, the farmer is also a sad farmer. The farmer has sheep. So, a little bit happier
1427.52s - 1432.82s |  probably. I know, sheep are better than dogs. I digress yet again. So, can shadow eat the
1432.82s - 1441.71s |  bone? What do we reckon? No? So, if I hit that, it comes through. Result denied. So, it's a
1441.75s - 1449.36s |  very low energy kind of reaction that I'm getting. But it's also a very low energy kind of
1449.36s - 1455.90s |  output. So, I thought I've got these two requests here that I can make. The first one calls
1455.90s - 1460.36s |  data right. What I'm going to do is I'm going to say, okay, the mad scientist is now friends
1460.36s - 1464.90s |  with the farmer. And then I've got another one here, break friends. It's data delete. And
1464.90s - 1468.94s |  in here I'm defining the mad scientist is no longer a friend with the farmer. So, to make this
1468.94s - 1480.39s |  a little more exciting, I decided to show you all my sister's Facebook page. And also, let's
1480.39s - 1485.21s |  bring this back in over here. I have a dog and a bone. Let's just refresh this because it
1485.21s - 1490.97s |  doesn't like having the lid shut on it. And for some reason I'm getting an image rendering
1490.97s - 1496.59s |  error. There we go. What demos go perfectly. So, door's closed. Dog can't get a bone. So,
1496.75s - 1502.75s |  what happens if the farmer makes friends with the scientist? What do you think? No, it
1509.65s - 1516.15s |  didn't work. Did I call the right one there? Looks like you're offline. Yeah, but I'm doing
1516.15s - 1527.49s |  everything locally. So, did I call the wrong one? Did I call break friends? Let's double
1527.49s - 1536.82s |  click on that one. Darn it. Well, I will show you that if we come over here and look at
1539.12s - 1545.20s |  friends of mad scientist, we should now have, there we go, the friendship is now in here. So,
1545.20s - 1551.74s |  now if I call can shadow eat the bone, it comes back as still denied. Okay. So, this is
1551.74s - 1555.24s |  where the demo fails. I'm more than happy to work out why the demo failed. It was
1555.24s - 1559.54s |  probably something to do with keeping my Wi-Fi off at DEF CON and closing my laptop lid
1559.54s - 1563.82s |  between testing demos. But the theory is there. The results should have come back
1563.82s - 1567.50s |  immediately. I had a little bit of a cheat in my app. It was basically polling every
1567.50s - 1572.58s |  second. But there are plenty of ways of connecting to databases and getting a full
1572.58s - 1577.74s |  time stream of data back. So, you can get almost like a push notification or an immediate
1577.74s - 1581.70s |  notification of permission changes if that's something you need in your environment. Most
1581.70s - 1584.50s |  of the time it's probably something you only need every time you make a request to make
1584.50s - 1590.74s |  sure that request should be honored. But one of the things that I want to caution is that
1590.74s - 1597.16s |  while this is complicated and exciting and perhaps when it comes to permission systems,
1597.16s - 1602.66s |  dare I say a little bit sexy, I'm not sure, it's not always the right solution. As I
1602.66s - 1606.32s |  said, there's a lot more computation power required for doing things like checking
1606.32s - 1610.20s |  whether or not a permission should be granted. Role based access control is always going
1610.20s - 1615.70s |  to be your easiest. That's always simply like is this person an admin, yes or no. In fact,
1615.70s - 1619.40s |  in some situations if you think of your home internet router, you don't even have
1619.40s - 1623.66s |  permission systems like are they logged in, yes or no. That's technically the simplest. So,
1623.66s - 1631.16s |  work out which level of permissions complexity or the way that your data is modeled and how
1631.16s - 1635.48s |  you want to define whether or not access should be allowed. Work out what level of
1635.48s - 1639.44s |  complexity you can get to at a minimum while still meeting your requirements. Because if you
1639.44s - 1645.02s |  go for the full thing straight out, re-back all the way baby, absolutely it's fun. You will
1645.02s - 1649.40s |  probably create a situation where your job is now indispensable. You will not be fired
1649.40s - 1653.40s |  because nobody knows what the hell you did. But it's not always the right solution.
1654.02s - 1657.64s |  Pick the right one for you. If you're currently going through a situation where you want
1657.64s - 1662.56s |  to implement some kind of permission control, more than welcome to come up and talk to me
1662.56s - 1666.68s |  afterwards and tell me a story. I'll let you know if I've got any clue at all as to what
1666.68s - 1672.18s |  you may or may not consider. I'm certainly not going to tell you I know your system
1672.18s - 1675.56s |  inside out and can tell you what the answer is but I'm happy to have a chat and go through
1675.56s - 1682.02s |  that with you. But I would like to finish by just saying thank you. If I can even fire
1682.02s - 1690.64s |  my slides. Let's just get that back up there. So again, that's my contact details at the
1690.64s - 1695.94s |  top there. ArcJet are currently running a contest. If you want to try our product out,
1695.94s - 1699.76s |  there's some prizes we're giving away as well. Challenge.arcjet.com. Give it a try. Let us
1699.76s - 1703.94s |  know. We would really love to know from you how you find the product, how easy it is to
1703.94s - 1709.60s |  use and what we can do to make it easier for you to make your website sit better. But this
1709.60s - 1712.94s |  talk is about permission systems. Come talk to me. Thank you for your time. Have a great
1712.94s - 1714.56s |  rest of your DEF CON. Thanks.


url: https://www.youtube.com/watch?v=0FfTWEP79k4
title: DEF CON 32 - Hacking Corporate Banking for Fun and Profit - niks, Charles Waterhouse
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=0FfTWEP79k4",
  "title": "DEF CON 32 - Hacking Corporate Banking for Fun and Profit - niks, Charles Waterhouse",
  "description": "I conducted thorough research on a corporate banking software widely utilized by numerous banks globally. This research was conducted during a bug bounty program for a leading bank in middle east, which employs this software. By examining their marketing brochures, we identified the third party company responsible for its development and after looking at their client we found out, their software is utilized by 60-70% of banks worldwide.\n\nIn this talk i will explain how did i recon corporate banking application from extracting interesting endpoints and methods. Further used them to find attack surface. Furthermore, I will delve into the methods used to uncover critical vulnerabilities within their application, including SQL injections, bypassing access control mechanisms etc.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1272,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.24s | This text was transcribed using whisper model: large-v2

 Alright, I would like you all to give me a put your hands together and welcome to the stage our next presenters
7.00s - 9.00s |  Nick's and
9.96s - 11.96s |  Charlie I am so sorry
17.34s - 24.10s |  Hey, yeah, so today we are talking about hacking corporate banking for fun and profit so
26.34s - 30.46s |  Introducing myself, I'm a full-time bug bounty hunter for for SNAK
31.18s - 37.38s |  I also recognized in 2021 as and as one of their liaison hacker and
38.50s - 40.50s |  I will sorry
40.58s - 42.02s |  Okay
42.02s - 46.02s |  I'm also I'm also founder of besides and about and
47.18s - 50.14s |  I am advisor at risk profiler dot IO
51.66s - 53.58s |  Hey guys, my name is Charlie waterhouse
53.58s - 59.62s |  I am a security analyst and was on the back side of this helping triage these phones as they came in and we kind of
59.62s - 66.06s |  Work together to go a little further and figure out some stuff on this. I have spent non-traditional and pin testing background
66.06s - 73.22s |  I spent 22 years as an airline flight attendant international manager and speaker and translator in the meantime, though
73.22s - 77.94s |  I've also done over 2,400 engagements based on a wasp and reviewed about
78.50s - 83.34s |  25 30,000 reports from a lot some of you guys out here that have seen me on the back end of that
83.78s - 87.78s |  I work with a lot of our large corporate clients to help them understand the flaws
88.30s - 94.34s |  And as I like to say translate the geek side to non-geek so that the guys who would not technical understand what we're looking at
96.30s - 99.54s |  So to start we're gonna give you guys a little bit about this
100.66s - 106.22s |  During the bounty hunt on this we were kind of looking at this was a private program for a large large bank
107.14s - 112.78s |  And the scope was our corporate banking application. This is the back end where they're doing transfers and setting up stuff
113.90s - 115.74s |  after exploring a bit
115.74s - 121.02s |  We found that there was a third-party application that was running and claim to be used by 60% of the bank
121.02s - 123.46s |  So this was like, okay now we can start digging a little more
123.90s - 130.45s |  The program has three roles. We have a maker verifier and checker the maker initiates a transaction
130.73s - 133.29s |  The checker ensures everything's in place and ready to go
133.65s - 137.77s |  Verifier is the final checkbox and so the app has corporate groups
137.77s - 143.17s |  Each was managed by different branches and they're all separate not linked to each other recognized by GCIF now
143.53s - 146.25s |  One of the things we found out from my end when we started looking
146.85s - 154.01s |  Louder louder always. Okay. So when we started looking we found that the GCIF is actually kind of a unique thing
154.01s - 159.65s |  I we started poking around. This is a Google patent for linking your bank accounts together
159.93s - 162.37s |  So let's say that you have a large corporate bank
162.37s - 166.45s |  You have a loan that's for your house for your car for your bank for your credit cards
166.53s - 172.61s |  They're all linked you through your GCIF. So it's your universal identifier across different divisions within the same bank
173.29s - 176.25s |  so let's keep that in mind when we're going through this and
177.17s - 180.49s |  Next slide so we can see what each role looks like with the maker
180.93s - 185.53s |  The verifier and the authorizer these are pretty standard and look pretty similar
186.13s - 187.77s |  So at this point
187.77s - 189.77s |  Nix you want to take it over where you were at on this?
191.29s - 192.81s |  Yeah, so
192.81s - 194.81s |  So client has given some
195.25s - 200.65s |  SLA's when they are going to fix all these vulnerabilities. So starting from critical
201.25s - 205.45s |  Which which is which has been given that they will fix in like 15 days
206.89s - 209.77s |  High up to 30 days medium up to 90 days
209.77s - 218.48s |  But they they never followed it and they fix all the vulnerabilities after one year. So
221.24s - 227.52s |  So getting to know the application it's using servlets kind of a single-page app which we tend to kind of go in how much there
228.56s - 230.76s |  The maker role has administration
231.32s - 237.16s |  Application module on it and so we're kind of noted that and that each role has custom permissions
237.64s - 239.64s |  But the maker role does have that admin
240.16s - 242.64s |  But it doesn't have all the admin purposes permissions
243.64s - 245.64s |  There's a servlet path for the front office
246.04s - 248.04s |  That we see here and the admin path
248.32s - 254.00s |  what we kind of want to focus on though is these widget IDs and the event IDs because these are going to come critical as
254.00s - 256.36s |  We go through and we're going to use them through those
256.64s - 263.28s |  Modifiers several pages with keywords that we saw with that event ID and then we had the modifiers to go in with it
263.28s - 268.36s |  And then the front office was in the web portal spot and input validation was required to get in
271.80s - 277.80s |  So there was there was two sides of it this application one is a front-end and the other is the back-end
278.16s - 282.24s |  Back-end is not really a back-end, but they have given custom permissions on it
283.24s - 290.08s |  It is kind of very large application, so they haven't provided much much of like
290.80s - 292.80s |  permissions on it
292.80s - 294.48s |  so
294.48s - 300.08s |  So when there was a demo, sorry, so so I started recon on the application
300.08s - 306.50s |  I found that they are running a third-party application and this third-party application was a
307.20s - 310.56s |  demo only so I couldn't find much information available on the
310.80s - 313.00s |  And I don't want to call them and
313.84s - 316.24s |  Have a demo setup for myself
316.96s - 321.76s |  So I go ahead and decided to review their JavaScript files
323.00s - 325.00s |  JavaScript so basically
325.00s - 332.12s |  This application has two event IDs as to two parameters event IDs and widget widget IDs
332.52s - 339.00s |  So what I did I and and there was there was one more parameter GC GC
339.00s - 345.68s |  If which Charlie just explains that is used to I need I identify the bank customer all across the world
345.88s - 347.88s |  so what I did I
348.04s - 350.04s |  used a graphic script to
350.56s - 357.00s |  Figure out all the event IDs because what happened is if you want to serve any functionality in this application
357.00s - 359.00s |  You have to change the event IDs
359.64s - 362.12s |  in the in the parameter and you will get
363.00s - 366.34s |  If you if you have access to that particular functionality you will
367.34s - 370.18s |  Able to load it. So what I did I just
371.18s - 373.38s |  grab all the event IDs
373.94s - 375.94s |  through through a graphic script and
377.62s - 383.58s |  And and each there was like common.js file, but
384.10s - 389.46s |  In each page you load the event IDs you will get a new
390.86s - 394.70s |  JavaScript file and it has a it will contain a new
395.38s - 400.98s |  Event IDs for next for maybe for the next functionalities. So
401.82s - 403.66s |  so this is like
403.66s - 409.58s |  this is like a few event IDs that I found from just just to start from and
410.02s - 417.22s |  After I after I go load these event IDs in the application. I found like more than
417.90s - 419.26s |  500
419.26s - 421.26s |  modules running on this application
422.10s - 424.65s |  so
425.09s - 427.33s |  Starting from the our first findings
428.01s - 429.17s |  so
429.17s - 431.17s |  It's an acceleration from
431.29s - 436.69s |  Authorizer to admin role. So what they are doing that the maker role has admin button
436.69s - 442.17s |  So when when I click the admin button, it will redirect me to the admin admin panel of it
442.21s - 446.45s |  But the admin panel also do not have much permissions available
446.81s - 450.37s |  Just a couple of couple of modules are loading
450.57s - 455.09s |  So what so when I click click the click that
455.73s - 463.33s |  admin role what I found that they are generating they are basically checking that if this role has
463.77s - 466.85s |  dual dual code dual role available on their
467.41s - 469.25s |  on their
469.25s - 471.09s |  on their
471.09s - 475.77s |  Privilege, I mean on their like like if I go through authorizer
475.77s - 481.93s |  It will check that if if this role has dual permissions available or not
482.25s - 487.69s |  if dual permissions are available, it will assign that admin panel to me, so
488.85s - 493.05s |  what I did I just load this URL from from the
494.09s - 496.25s |  from the authorizer role and
497.05s - 502.93s |  It will allow me access to the admin panel, but there was no module was loading
502.93s - 507.65s |  There was just they were just maybe just hiding the modules
509.05s - 513.05s |  From the admin application. So what I did I just use the event IDs
513.61s - 520.25s |  Put the event IDs in in the parameter and try to load try to load different modules
521.21s - 523.21s |  from this generated
524.25s - 530.17s |  Administration from the authorizer role, so I did it one by one from the
531.17s - 533.37s |  Starting from the user list report, so
534.93s - 536.93s |  When I when I load the event IDs
537.21s - 540.37s |  I found that the page is
541.77s - 547.57s |  Template page is loading and while clicking on submit. I was able to access all their
548.25s - 550.89s |  user from the from an authorizer role
552.37s - 553.73s |  So
553.73s - 559.49s |  Using those event IDs and there are some frames URLs as well. So the frame see wires are connecting
560.33s - 562.77s |  connecting to the event IDs only so
565.65s - 572.01s |  Whatever you load even the even the frames or event IDs you will get the same information and
573.21s - 577.33s |  Just by loading one by one event IDs. You will actually able to
577.93s - 587.47s |  Access all of their admin panel from an authorizer or verifier role. So it was just hiding hiding the hiding the
588.47s - 594.79s |  Modules not actually authorizing the user for that particular role
595.79s - 596.99s |  so
596.99s - 599.91s |  This is the this is the second finding. I found like
600.79s - 603.87s |  This is again. I'm I was using
606.11s - 608.11s |  Event IDs to load up
608.55s - 610.47s |  to load a particular
610.47s - 613.51s |  particular function, so what I did I
614.39s - 618.79s |  Using this GS link finder I caught up with a particular page
619.51s - 625.83s |  limit setup main page dot GSP and when I load this page, I was actually able to
626.71s - 628.19s |  get a
628.19s - 629.95s |  get a
629.95s - 633.67s |  Get a page where I was able to set up their
634.83s - 636.47s |  customers
636.47s - 642.83s |  Whatever whatever withdrawal or whatever daily limit they want to set for each customer. So
643.51s - 645.15s |  I can set it for
645.15s - 649.75s |  They are all customers as well. So once I click and
650.59s - 652.59s |  approve this
653.23s - 655.23s |  They just simply
655.31s - 658.45s |  Set up their limit to all the all the customers they have
666.36s - 670.92s |  Yeah last minute prep, sorry guys, it's to mean it's supposed to be a very surprised cat there
672.48s - 676.30s |  So, yeah, so
676.66s - 680.62s |  So when when I so there was another under part of this
681.30s - 688.14s |  This functionality that I didn't didn't tell you that when you once you submit the submit the
689.66s - 692.18s |  Submit any request it will actually go to the
692.78s - 698.78s |  Go to as authorizer. So you have to authorize that request in order to get it approved. So
699.54s - 703.10s |  So these IDs are these event IDs are quite simple
703.10s - 708.38s |  so as you say as you can see if you want to leave any page or modify any page or
709.10s - 714.46s |  Authorize any page you just have to modify a simple value like view modify or
714.98s - 721.46s |  and just just have to just have to alter those values to set set this up and
722.86s - 724.86s |  once once you load this
725.46s - 727.46s |  let's say you modify something and
727.98s - 733.42s |  You end up in authorization page and you just have to modify the auth ID and
733.70s - 739.18s |  Once you are once you go to the auth ID you will you will have to do I mean they display
739.78s - 746.70s |  The value you just modified you just have to authorize that value to have it set up for all the users
747.26s - 749.26s |  so
749.74s - 751.62s |  So
751.62s - 754.78s |  Since I since I modified a value from here
755.06s - 761.18s |  I just modify I just go to the authorization page and there was a request pending that
762.06s - 763.22s |  that
763.22s - 768.78s |  This this particular thing is modified. You just have to authorize it or unauthorized unauthorized
768.78s - 773.46s |  so just for since since it it was client application, and I don't want to
774.46s - 775.94s |  impact it much
775.94s - 781.74s |  so I just use the unauthorized button to simply reject the request which I just
782.10s - 789.78s |  Sent for modification since it was for all the customers. So just just for a safer side. Maybe they are using a
790.42s - 791.78s |  broad
791.78s - 793.02s |  behind
793.02s - 796.62s |  And showing us this is a staging environment only
798.54s - 805.22s |  So so from from from authorized page, I just click on the authorizer ID which was
805.78s - 808.26s |  which was which I just modified and
809.10s - 810.70s |  On this page
810.70s - 812.70s |  There was two two things
812.70s - 819.10s |  Authorize reject you if you if you authorize it will set up for all the cost all the all their customers if you reject
819.10s - 823.94s |  It will instantly reject and do not modify the those limits to all the customers
824.44s - 828.02s |  So I just rejected it and and simply got rejected
829.06s - 830.22s |  so
830.22s - 832.22s |  in the finding three the
832.34s - 835.14s |  It was a customer onboarding ID or
835.90s - 839.06s |  Again it was it was through the event IDs only and
839.94s - 843.74s |  I found an interesting event IDs from the from the JS that
844.74s - 848.62s |  customer set of view page, so I thought I thought I
849.26s - 853.58s |  Might I might be able to I might be able to set up the customer
854.34s - 859.50s |  customers information from this page, so what I did I just go to the
859.54s - 861.94s |  So what I did I just go to the
862.98s - 869.06s |  servlet and I modified the event IDs to customer set it set up view main page and
869.70s - 871.54s |  what I and
871.54s - 873.54s |  there was and
873.54s - 877.38s |  When when I loaded it was actually loading that customers
878.82s - 880.82s |  customers in information and
882.42s - 884.82s |  There was there was one more button that is
885.18s - 892.26s |  Action if you if you want to modify modify or thrice or something you can use action or either you can just mode
892.26s - 894.46s |  do you just put the value in the
895.18s - 900.90s |  Event IDs itself so once you once you get once you got the event
901.22s - 906.02s |  once you got the that customer did you you just have to click on it and
907.86s - 909.58s |  And
909.62s - 914.66s |  You can you can modify whatever the group name or you can even
915.98s - 917.98s |  remove the remove the
918.58s - 922.74s |  corporate ID from from that particular customer so once you remove the
923.42s - 928.66s |  corporate ID that from that customer actually all their accounts could get unlinked and
929.94s - 936.78s |  They they're even their customers do not have do not able to access their account informations
937.34s - 943.20s |  so
943.20s - 949.88s |  Well, well, so again once I once I submit this request I have to authorize this
950.20s - 952.20s |  so I just modified the
953.00s - 956.40s |  Event ID to auth page and once I go there
956.40s - 963.00s |  I just have to authorize or reject this in order to approve it for that dot that particular customer
963.36s - 966.83s |  so while while while
967.51s - 971.79s |  While doing this all of all of this. I also found found that
972.79s - 977.55s |  The customer setup page was also vulnerable to accesses
977.67s - 982.47s |  so what I did I just put the put the access payload in their
983.51s - 985.51s |  their
985.79s - 987.43s |  Relationship manager
987.43s - 989.07s |  name and
989.07s - 993.87s |  Whenever they see the relationship manager name on their bank
994.87s - 996.19s |  bank
996.19s - 1000.59s |  Account the the accesses payload will pop up and I can
1001.11s - 1004.75s |  able to grab their cookies just from just straight from their
1005.43s - 1006.59s |  their
1006.59s - 1008.59s |  bank bank account
1008.75s - 1013.53s |  so
1014.53s - 1016.53s |  So the as I said
1016.53s - 1023.37s |  There was a there was two side of this application one is for the front front office and one is the back office
1023.77s - 1025.77s |  the front office
1025.81s - 1032.13s |  Contains the widget widget servlet and the back of back office contains
1033.37s - 1035.37s |  contains the
1035.81s - 1038.33s |  Another another servlet, so
1039.73s - 1045.05s |  So what I did I just I just sort all the widget controller and
1045.57s - 1047.81s |  try I start fudging for
1048.81s - 1051.97s |  SQL SQL injection vulnerabilities, but I found that
1052.97s - 1056.61s |  There was one parameter that is called the DIR
1056.81s - 1061.45s |  It was giving me 500 internal server error while supplying a single single code
1061.57s - 1063.45s |  so I
1063.45s - 1067.45s |  So I thought I mean there was a change in response
1067.45s - 1071.05s |  So I thought let's try some Boolean and blind conditions
1071.21s - 1077.17s |  so when I try when I started fuzzing for Boolean and blind based I found that
1078.01s - 1084.77s |  There was a Boolean based blind is working and the database is Oracle and I
1085.37s - 1091.89s |  I just I just use a SQL map to dump all their all their databases and I
1092.09s - 1095.81s |  Was able to fuzz I was able to get all of their
1096.85s - 1099.09s |  all of their database systems
1101.52s - 1103.16s |  so
1103.16s - 1110.40s |  Since since I was able to since I was able to escalate the escalate the authorizer or very very fire rolled in the
1110.80s - 1114.56s |  admin panel, so I just used an authorizer role and
1115.52s - 1121.20s |  I tried to weave the customer customer we've set a customer set of view page and
1121.68s - 1127.80s |  I found that the customer name and content customer and customer underscore name was vulnerable to
1128.40s - 1130.40s |  again Boolean based blind and
1131.08s - 1133.52s |  What I do I just went ahead and
1134.88s - 1141.32s |  Started started the SQL map on it and I was able to dump all their DB again
1142.96s - 1148.40s |  So I got like I said like this was fun and profit
1148.40s - 1153.04s |  So I got all the fun and I got all of profits as well
1155.16s - 1156.44s |  So
1156.44s - 1160.64s |  So later after an year they come and they said that
1162.28s - 1164.40s |  We have fixed all the issues
1164.52s - 1171.04s |  so what they did they just removed the corporate admin power module from the application and they think that it's
1171.48s - 1173.48s |  fixed from their side and
1173.76s - 1180.76s |  on the on the on the front end they they come after another one year and they put the
1181.24s - 1182.76s |  cloud fear
1182.76s - 1189.75s |  Across their application and they think that it's fixed again. So that's
1190.95s - 1196.55s |  Yeah, so looking at it from my end from the triage in you have to ask what the clients always ask us
1196.55s - 1202.43s |  What what it's matter if you come in you do a cross-site scripting you pop a alert that just says one
1203.07s - 1208.27s |  The CEO is gonna go. Okay, what we had to kind of go in and explain to him is not only do we
1208.99s - 1213.99s |  Manage to have almost full admin access from any role across your system
1214.23s - 1218.91s |  we managed to also dump your entire SQL database and showed them a row in a column that we pulled and
1219.31s - 1225.15s |  So we can also take care of that and then in addition anybody who has a relationship manager listed
1225.15s - 1228.79s |  I can now get their creds. That's all his high-value clients
1229.51s - 1233.75s |  When we see these relationship managers in our banking app, imagine that just stole your ID
1234.35s - 1236.83s |  That's where they start coming in and they go. Oh
1237.83s - 1242.63s |  And yeah, that's when you want to be that guy going this is what I found you
1243.15s - 1245.95s |  And so getting their attention with this when they see it
1245.95s - 1250.83s |  They were paying a lot of attention once they saw clearly what the impact was that basically
1251.39s - 1253.39s |  Nix ran roughshod over him
1253.95s - 1258.39s |  So yeah, that's kind of what we're looking at with bad session management
1258.87s - 1260.07s |  so
1260.07s - 1262.07s |  Anything else add next?
1262.07s - 1267.91s |  That's all for a month. All right. Thank you guys. Hopefully this was kind of informative and you guys learned something


url: https://www.youtube.com/watch?v=mFJ-NUnFBac
title: DEF CON 32 - Abusing Windows Hello Without a Severed Hand - Ceri Coburn, Dirk jan Mollema
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=mFJ-NUnFBac",
  "title": "DEF CON 32 - Abusing Windows Hello Without a Severed Hand  - Ceri Coburn, Dirk jan Mollema",
  "description": "Windows Hello is touted by Microsoft as the modern de facto authentication scheme on Windows platforms, supporting authentication and encryption backed by biometrics. In a world that is quickly accelerating towards a passwordless existence, what new threats do we face in this complex landscape? We will take a deep dive into the inner working of Windows Hello. Via the release of a new tool, it will be demonstrated how an attacker on a fully compromised Windows host can leverage secrets backed by Windows Hello biometrics without needing the biometric data that protects them. We will also show how the hardware protections of Windows Hello and its accompanying Primary Refresh Tokens can be defeated, making it possible to use Windows Hello for identity persistency and PRT stealing, in some cases even without Administrator access on the host.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2518,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241102"
}

0.11s - 12.71s | This text was transcribed using whisper model: large-v2

 We're going to start by introducing Kerry and Dirk, abusing Windows Hello without a
12.71s - 22.66s |  severed hand. Give a good hand for Kerry and Dirk.
22.66s - 29.98s |  Good afternoon everyone. So my name's Kerry. I'm from Wales in the United Kingdom. So my
29.98s - 36.62s |  background is in software development. I was in that world for around 18 years within
36.62s - 45.36s |  the DRM and security solution space. And back in 2019 to this very DEF CON week, I switched
45.36s - 51.94s |  over to cyber security and joined Pentest Partners. So I've been dedicated to red teaming
51.94s - 56.76s |  and offensive security for the last three years and have spoken at DEF CON last year
56.76s - 63.88s |  and various besides events as well. And I I am authored several tools on GitHub, um
63.88s - 69.34s |  mostly on the offensive security side, uh but one or two on the uh defensive side as
69.34s - 77.76s |  well. Hi, so I'm Dirk. I'm just gonna put this down here. Yeah. We're gonna leave that
77.76s - 83.72s |  one there where it is. Um so I'm Dirk Jan. Um second time DEF CON. Um I've given a talk
83.72s - 89.80s |  uh at quite a few conferences. I started at making uh Active Directory tools. Slowly
89.80s - 95.26s |  switched to the Azure AD space which is now called Entra. Um I have a blog. I have a Twitter
95.26s - 100.50s |  account. But mainly excited to to be here. Um and show you our latest research on uh
100.50s - 106.84s |  Windows 11. So show you all the first parts and then I'll come in later and we'll uh uh
106.84s - 113.40s |  basically talk you through all the nice things things that we did in the past couple months.
113.50s - 119.28s |  So uh as Dirk Jan said, the talk is in two halves. So the first half is a focus on abusing
119.28s - 124.02s |  Windows Hello from a privileged perspective. Uh so we'll go into sort of Windows Hello
124.02s - 129.38s |  containers, protectors, and keys. Uh I'll do a quick tool demonstration of the tool
129.38s - 133.96s |  that was released as part of this research. And then we switch to sort of attacks that
133.96s - 142.16s |  you can do uh from a an unprivileged perspective which which Dirk Jan will be doing then. So
142.16s - 148.24s |  what is Windows Hello? It's Microsoft's passwordless technology. Uh it's it's the ethos
148.24s - 153.88s |  behind it is sort of two key pairs that are generated uh when they're enrolled either for
153.88s - 158.88s |  the operating system when you log in. Uh it can also be used for pass keys and even third
158.88s - 166.22s |  party applications can enroll uh Windows Hello key pairs. So in terms of the differences
166.22s - 170.96s |  between Windows Hello and Windows Hello for Business, there aren't any in a in a technical
170.96s - 175.94s |  sense. The only difference is that uh Windows Hello for Business is a focus on certificate
175.94s - 181.54s |  based authentication to Active Directory whereas um Windows Hello is more sort of consumer
181.54s - 190.77s |  market. So we'll start with key storage providers. Uh so Windows has got a common API for dealing
190.77s - 196.29s |  with cryptographic operations and they are called key storage providers. So some examples
196.29s - 202.25s |  of the ones that have existed for many years uh there's the software key storage provider.
202.25s - 207.73s |  So as the name suggests, the keys for this particular provider are all generated in software.
207.73s - 212.33s |  So if you do have system level access to an operating system, it means that you can you
212.33s - 217.57s |  know exfiltrate these keys. Then you've got the newer uh platform key storage provider
217.57s - 223.95s |  uh and this is for uh machines that have TPM. And the Microsoft SmartCard key storage provider
223.95s - 230.55s |  which obviously is for storing uh private keys on SmartCard. So the KSPs they they design
230.55s - 236.43s |  for general uh crypt cryptographic operations or encryption, sign in, key agreement, that
236.43s - 243.07s |  sort of thing. And Windows Hello is no different. They've they've implemented a KSP called uh
243.07s - 249.07s |  the passport key storage provider. So the passport key storage provider is split into
249.07s - 255.27s |  sort of two privileged services. You've got the NGC service which is where the applications
255.27s - 260.95s |  communicate with over an RPC interface. And then the NGC service will communicate with
260.95s - 266.63s |  the NGC controller service. Now this particular service um is tasked with storing all the
266.63s - 272.67s |  metadata associated with any enrolled Windows Hello keys. And that metadata is stored within
272.67s - 279.47s |  local app data, Microsoft NGC for the local service account. And you do need system level
279.51s - 289.10s |  privileges to access that particular folder. So the KSP for sorry the passport key storage
289.10s - 294.24s |  provider is essentially a proxy actually for the exit existing key storage providers that I
294.24s - 299.34s |  just talked about. So it doesn't actually implement any of the uh public private key
299.34s - 304.22s |  operations itself within the passport key storage provider. It essentially proxies it and
304.22s - 309.22s |  offloads it to the KSPs. Now each um user is enrolled within a container folder. Uh so
312.92s - 317.70s |  it's a GUID there that you see on the right hand side image. So every user has their own unique
317.70s - 323.10s |  container folder. And within the containers then you have a collection of protectors and the
323.10s - 329.54s |  key metadata and various bits and pieces like that. So breaking down into containers
329.54s - 335.98s |  themselves. So they're all all all the metadata is split across these dot files. Um generally
335.98s - 341.08s |  most of them are are unicode strings within them. So as an example there you can see one dot
341.08s - 346.08s |  dot contains the user security ID. Um seven dot dot contains the backing key storage
348.48s - 353.78s |  provider for for this particular container which is either TPM backed or or software
353.78s - 359.96s |  depending on if a TPM exists or not. And then you got nine dot dot which stores the Azure
359.96s - 364.96s |  recovery key which we'll get into that uh a little later on. So protectors. These are your
365.12s - 370.12s |  Windows Hello authentication methods. Um so more commonly the bio protector which would be
373.26s - 379.36s |  your face or your fingerprint uh method of authentication. And of course you got the usual
379.36s - 384.84s |  pin that you enroll with Windows Hello as well. And those protectors they have a file called
384.84s - 391.42s |  fifteen dot dot. And this is where um a set of intermediate pins are encrypted. Now these
391.98s - 396.78s |  intermediate pins are the same across all protectors. But of course they are encrypted
396.78s - 402.16s |  differently depending on what protector was being used. And the intermediate pin is split
402.16s - 408.16s |  across a signing pin, a decrypt pin, and what I believe to be an external pin which again we'll
408.16s - 414.84s |  touch on that in a bit. Now there are five known protectors. Um and each of these gets a a
414.84s - 420.50s |  folder within the uh the container folder itself. And the the folder name is actually based
420.52s - 426.42s |  on the ID. So number one is the pin protector. Number two is the bio protector which covers
426.42s - 433.14s |  both face and fingerprint. And then you got the number three is the Azure recovery protector.
433.14s - 437.40s |  I'd never seen references to number four. They don't seem to be in the symbols for Microsoft.
437.40s - 441.94s |  So not quite sure what happened there. So they skipped straight to five which was the pre-boot
441.94s - 447.68s |  protector. And then you've got uh number six which is a companion device protector. But that
447.70s - 452.70s |  was deprecated in Windows 10 uh version 2004. So we start off with the pin protector. So the
455.50s - 462.14s |  pin protector can be both alphanumeric and numeric. But by default um it's it's numeric only.
462.14s - 467.54s |  So you have to actually click a checkbox to say that you want want it to be alphanumeric. Uh but
467.54s - 474.26s |  if it is numeric um inside seven dot dot it actually stores the pin length. And this is how
474.30s - 478.24s |  or this is why that once you've got the the correct pin when you're logging in with Windows
478.24s - 483.44s |  Hello it will automatically uh log you in without pressing enter. And it it knows that based on
483.44s - 489.12s |  the pin length that is stored. Uh one dot dot again just contains the back end key storage
489.12s - 494.92s |  provider that's used for encrypting the protector. And then in a when it's using the software
494.92s - 501.60s |  KSP two dot dot contains the uh the software key storage provider key ID that was used for
501.60s - 506.60s |  protecting the biometric data. So Teal from the insecurity dot B website that you've done an
509.18s - 514.82s |  excellent blog on this and I do highly recommend you take uh a read of it. So this is the
514.82s - 519.82s |  process of how the pin protector is decrypted uh during the a software based approach. So that
521.96s - 526.96s |  area in red there you see is is DPAPING encrypted blob. Um there are sort of articles on the
527.22s - 532.22s |  web already uh that cover the internals of DPAPING. Uh but what basically happens is the user
535.60s - 540.60s |  enters in a pin that goes through a PBKDF2 key derivation function uh along with certain the
543.38s - 548.88s |  salt and the rounds that comes from um the CNG key that gets stored as part of the software
548.88s - 553.88s |  KSP. And that eventually will return you a a private key and a separate RSA private key that is
554.88s - 559.88s |  actually used for decrypting the intermediate pins inside 15 dot dot. So moving on to TPM based
563.78s - 569.46s |  decryption it as you can see it's a lot simpler. There's no key derivation function going on or
569.46s - 574.70s |  anything like that like the software version. Uh all that happens is the the pin is entered it
574.70s - 579.70s |  gets converted to hex and that's what's used to unseal um the 15 dot dot uh intermediate pins.
580.70s - 585.70s |  So the two dot dot is no longer present in that scenario and that's because there is a fixed key
588.24s - 594.99s |  ID that it uses every time so it doesn't generate anyone. So what type of abuses can we do with the
594.99s - 599.99s |  pin protector? So when it's TPM backed it's actually fairly robust um the biggest risk I would
601.93s - 606.93s |  say is four digit pins can probably be brute forced within around 70 days um based on the
607.75s - 613.99s |  anti-hammering technology within the TPM it basically slows down any brute forcing. So a four
613.99s - 619.47s |  digit pin would take about 70 days. But if we move over to a software backed pin that's when you
619.47s - 624.47s |  start to get in trouble. So there's a hashcat hash that already exists within hashcat that you can
626.21s - 632.41s |  generate a windows hello based um hash but because we now know the lengths of the pin as well we
632.43s - 638.01s |  can make a targeted mask attack when you're decrypting it and with a de a decent uh or modest
638.01s - 644.27s |  rig I should say eight digits can be cracked within seconds uh and up to 11 digits you can still
644.27s - 651.01s |  do within uh within days. Uh and thanks to the windows hello to uh hashcat project for that
651.01s - 657.05s |  inspiration. So moving on to the bio protector. So one thing you will notice on the bio
657.07s - 662.83s |  protector with that red section at the top right there is no input from the user and that uh that
662.83s - 668.05s |  includes any of the biometric readers and that's because the biometric protector is not actually
668.05s - 673.05s |  protected by my biometrics at all. It's actually protected by the system DPAPI key um which means
675.65s - 680.89s |  that once you've got a system level compromise uh you can basically reverse those three
680.93s - 688.03s |  intermediate pins and bypass um the biometrics all together. So that the encryption for this is
688.03s - 693.97s |  based on the windows vault credentials. Again I won't go into too much detail of um you know the
693.97s - 699.05s |  vault the windows vault and how them credentials are protected. Lots of articles already out
699.05s - 705.53s |  there um but what basically happens is you decrypt the uh the secret within the windows vault
705.53s - 712.07s |  that gives you an AES key that is then used for decrypting the 15 dot dot which gets you the
712.07s - 717.07s |  three intermediate pins once again. So onto the recovery protector. So you'll only see this uh
719.21s - 724.21s |  under windows hello for business scenarios. Uh and if the tenant is enabled um the recovery
726.75s - 732.79s |  capability it allows users to reset their pin without destroying all the enrolled windows hello
732.79s - 738.53s |  keys. If you reset the pin without the recovery protector in place basically any enrolled uh key
738.53s - 743.77s |  path through windows hello will then be destroyed and you'd have to start start from you know from
743.77s - 749.73s |  the start again. So how does the recovery protector work? So the three intermediate pins are
749.73s - 756.75s |  first protected with the system DPAPI key and then a a public key is fetched from cred dot
756.75s - 761.75s |  microsoft dot com forward slash get encryption key and that encrypted DPAPI blob is then
763.39s - 769.29s |  encrypted once again. Um but for some reason Microsoft decided to store the encrypted blob
769.29s - 774.29s |  inside the top level container folders nine dot dot dot and not inside the protector folder. So
776.03s - 783.30s |  again I don't know why they've done that. So the reverse process of getting at the intermediate
783.32s - 788.50s |  pins with the recovery protector. There's a post call that goes to cred dot microsoft dot com
788.50s - 793.50s |  forward slash unprotect secret and the access token for that does require both the NGCMF and the MFA
795.74s - 802.04s |  claim. So that what that basically means is when you're going through the uh the reset process you
802.04s - 807.48s |  have to authenticate to enter but you also have to go through the the process of doing your MFA
807.50s - 813.68s |  otherwise you can't decrypt the blob. Um that's got it's own client ID specific for the
813.68s - 818.68s |  Microsoft pin. Uh the again fifteen dot dot contains the uh intermediate pins. Four dot dot
821.34s - 827.06s |  contains the AES IB that's used to decrypt it. Now there is a nine dot dot inside the
827.06s - 832.30s |  protector folder but I don't really know what the what what's in that folder. Again they
832.32s - 840.60s |  shifted the uh the contents of the encrypted data in nine dot dot within the container folder. So
840.60s - 846.12s |  here's an example of the the decrypting process for this particular protector. You'll see the
846.12s - 851.92s |  protected secret there on the left. Um and then that that's the response you get from the
851.92s - 856.52s |  Microsoft server on the right. And those with the BDI will notice that that base sixty four
856.52s - 863.30s |  encoded data looks like the the DPAPI common header that you get. Um and then the system
863.32s - 868.42s |  DPAPI key is used to decrypt that secret you get back. Which gives you the three same
868.42s - 874.96s |  intermediate pins. So the preboot protector I haven't done a lot of research in this area yet
874.96s - 880.80s |  and I believe it's for scenarios where you're going from BitLocker straight to desktop so that
880.80s - 886.18s |  you don't need to enter in your pin. And the most likely scenario is the fifteen dot dot is
886.18s - 891.82s |  gonna be protected by BitLocker. Um but there's more research needed in that area. And then
891.84s - 896.84s |  companion device protector was originally intended for IOT device scenarios. Uh an opaque blob in
899.40s - 904.88s |  the documentation um is sent to the IOT but what I believe is that opaque blob is the
904.88s - 910.52s |  intermediate pins and that companion device protector is designed to encrypt it. But no real
910.52s - 915.52s |  research needed in this area because it's been deprecated and I've never seen it in real life.
915.56s - 920.56s |  So a quick protector recap. So protectors encrypt three intermediate pins. They're all the
922.34s - 928.70s |  same pins across all the protectors. Uh now the inputs to the protectors do differ depending on
928.70s - 934.88s |  what the protector type is. Bio protectors don't actually need biometrics to decrypt them. And
934.88s - 940.26s |  the pin protector is actually extremely vulnerable when there's no TPM present. So what is
940.26s - 946.04s |  the purpose of these intermediate pins? Well they are designed to unlock the actual enrolled
946.04s - 951.34s |  keys within Windows Hello. So once you have access to these intermediate pins, you can forget
951.34s - 957.12s |  all the protectors. You no longer need them. The pins stay constant for the duration of that
957.12s - 963.12s |  container. So there's four types of keys that I've come across so far. So the vault key is
963.12s - 968.12s |  used um uh uses the decrypt pin. Um the only scenario I've seen that used is uh the consume
970.30s - 975.64s |  a scenario where the local account password is encrypted and then it reverses that then and
975.64s - 980.28s |  gets the decrypted password once the pin is entered. But it doesn't get used in Hello for
980.28s - 986.08s |  Business scenarios. Now the enter pin uh the enter key is enrolled during Windows Hello for
986.08s - 992.58s |  Business and that uses the sign pin. And if you're enrolling for passkey enabled websites or
992.58s - 998.92s |  Fido based websites um that also uses the sign pin. And then this is what I call the external
998.96s - 1005.26s |  pin. And the external pin only seems to be used with third party applications. So an example of
1005.26s - 1011.70s |  this is the key that gets enrolled uh for OctaFastPass. To use that particular key uh you
1011.70s - 1019.93s |  use the external pin. So once again the keys do leverage uh or proxy the the encryption and
1019.93s - 1024.71s |  decryption or the signing operations to a backing key storage provider. And that will either be
1024.71s - 1030.75s |  software or TPM. Which means if it is it is in software you can actually extract the Windows
1030.75s - 1036.49s |  Hello key and and take them away and and use them off the device. Uh the the keys also have
1036.49s - 1042.69s |  metadata files and there are some common metadata files across all the key types. But then
1042.69s - 1047.69s |  some of the keys have specific dat files for that particular key. So as I mentioned the vault key
1048.05s - 1054.89s |  is used for recovering the plain text password of a local account. But that's only under the
1054.89s - 1060.63s |  Windows Hello scenario. Not not Hello for Business. And again Teal from InSecurity has
1060.63s - 1066.37s |  covered that in detail. So I do recommend you take a look at that blog. So moving on to the
1066.37s - 1071.37s |  passkey enrolled keys. So 7.dat contains CBOR encoded data. Now I've never come across this
1071.69s - 1076.69s |  encoding format before so a good shout out to Ace Bond who managed to spot that on Twitter um or
1080.33s - 1085.63s |  X whatever you're calling it these days. Um and then once I checked what CBOR is used for of
1085.63s - 1090.51s |  course it was WebAuthn. So that that that's what gave me the hint um that it's used for
1090.51s - 1095.51s |  passkeys. And then inside um right so so onto the CBOR encoded data that which is inside 7.dat
1095.99s - 1100.99s |  that contains the relay party ID the user ID username or display name. But one other important
1105.77s - 1111.43s |  aspect to WebAuthn is the credential ID. But they don't actually store that because it that's
1111.43s - 1116.45s |  actually a sha256 hash of the public key itself which is you see that green area there uh in the
1117.71s - 1122.71s |  middle picture. And then 11.dat for the ones that do know um a little about WebAuthn. During
1122.71s - 1127.71s |  the attestation uh during the login process of WebAuthn it has a sign count that gets
1129.55s - 1134.55s |  incremented every time. And the relay party backend generally will check that sign count to
1135.39s - 1140.39s |  make sure it's incrementing as expected. So what sort of abuses can we do with passkey? So
1142.57s - 1147.57s |  navigatorcredentials.get is the main function within browsers that um allow you to do an
1148.57s - 1153.57s |  assertion with WebAuthn. So we you can actually hijack that particular function and then proxy
1156.07s - 1161.07s |  the assertion request back to a a compromised host. So that way then you'll be able to use those
1161.35s - 1166.35s |  WebAuthn enrolled certificates and log in to um WebAuthn bit websites. And because we can use
1169.45s - 1174.63s |  the key directly without the need of Windows hello we can fake the user presence and return
1174.65s - 1179.65s |  that assertion back to the relaying party and log in. So on to the enter key. So this is enrolled
1181.73s - 1186.83s |  during Windows hello for business enrollment. Um lots of research already in this area
1186.83s - 1191.83s |  including including Dirk Jan's great work. Uh but basically um you allow site you use this key
1193.87s - 1198.87s |  to sign the uh the PRTs that are used for requesting a credential to uh enter. Um there are
1199.59s - 1204.59s |  uh features where you can then get the TGT or the cloud TGT and authenticate to active directory
1207.57s - 1212.57s |  locally. And again this particular um key pair uses the sign in pin from the the intermediate
1213.91s - 1218.91s |  pins. And the key name which is inside one dot dot is made up of the uh tenant ID on the on the
1220.45s - 1225.45s |  user ID. So on to enter key abuse. Um so we can now with this research you can directly use
1229.13s - 1234.13s |  the uh Windows hello enrolled keys along with the um the transport key to request a new PRT on a
1236.03s - 1241.03s |  compromised device. So you no longer need to try and extract the PRT from Mimikatz. Uh and one
1242.37s - 1247.37s |  other aspect that's come from this research um is the return of of Dirk Jan's CV that um he
1249.25s - 1254.25s |  reported to Microsoft for the um key derivation function version one where you can take the
1255.23s - 1260.23s |  random context and the derived key and then use it away from uh the device uh to sign uh new new
1262.81s - 1267.81s |  PRTs. So we we did report this to Microsoft which obviously they did say they have fixed it with
1269.49s - 1274.49s |  the release of um key derivation version two. Um but as as they did come back and said they've
1277.49s - 1282.49s |  also uh deprecated it as well and they said it will be deprecated uh during um August of this
1283.07s - 1288.07s |  year. And we that we mean that we tested this half an hour ago and it still worked so.
1292.65s - 1296.71s |  Okay so a quick introduction to the tool itself that came out of this. The tool is called
1296.71s - 1301.69s |  Shamai and the reason it's called Shamai is that's Welsh for hello which is where I come from.
1301.69s - 1307.69s |  Um so the features of the software allow you to enumerate all the Windows hello keys that are
1307.69s - 1312.93s |  enrolled on the device and that's across all the users. Any keys that are used in the software
1312.93s - 1318.01s |  back key storage provider you can dump and extract and then use them away from the device. It
1318.01s - 1323.01s |  also dumps the um you know the hashcat hash that you can then try to crack offline. It has the
1325.31s - 1330.31s |  PRT authentication module so that you can you can do the enter based abuse. A web authen
1332.15s - 1337.15s |  proxy module which is the the browser functionality. Um and I will get to uh introduce
1337.69s - 1342.69s |  you to the integrating Octa Fastpass eventually. Just haven't quite got there yet. So uh a
1343.97s - 1348.97s |  quick demonstration. Let's see if it's gonna work. So what you see here is uh on the machine on
1351.43s - 1355.05s |  your right. So there's two virtual machines here. So the machine on your right is your
1355.05s - 1360.15s |  compromise machine running the Shamai tool. And the machine on the left is the attacker
1360.15s - 1365.15s |  machine um that is looking to sort of abuse that Windows hello base key. So we set up
1369.74s - 1374.74s |  the key to be listening. Just get the IP address for the compromise machine. So we go back to
1379.09s - 1384.03s |  um the attack machine. It's just gonna create a new incognito window to show new no cache
1384.03s - 1389.03s |  credentials. Stick in the um the compromised host address. And then once you hit save that
1391.47s - 1396.61s |  will enumerate all the enrolled web authent keys. So you can see Amazon, GitHub, web
1396.61s - 1402.61s |  authent.io. So you click on GitHub. That will take us to GitHub. We go to the sign in option.
1402.61s - 1418.30s |  We use the sign in with the pass key support. Proxies it across and you're logged in.
1418.30s - 1422.90s |  Alright thank you. Um so this tooling is something you can do when you have like full level
1422.90s - 1427.28s |  access to uh to a computer. Uh so if you're a system on a device and you can steal these kind
1427.28s - 1431.98s |  of things. We use it remotely at Citra. Um and at this point we're also gonna take a step
1431.98s - 1436.72s |  back. Uh because Kerry was mostly talking about system level access. Um there's also a lot
1436.74s - 1441.08s |  of things that we can do if we have regular user access. So all of these scenarios that we're
1441.08s - 1446.96s |  gonna cover uh are basically relevant uh if you have like a uh uh some mower beacon running
1446.96s - 1451.56s |  on the device in the user session if they left their device unlocked at Citra. Um and we're
1451.56s - 1456.56s |  mostly gonna cover uh like how this works with uh Entra or the former uh Azure AD. Um and
1458.20s - 1461.80s |  I'm gonna assume a few things here. So I'm gonna assume that you're all familiar with
1461.80s - 1465.70s |  primary refresh tokens because if I have to explain all of this then uh we're definitely
1465.70s - 1469.80s |  gonna run out of time. Uh so we are gonna talk about primary refresh tokens and especially
1469.80s - 1474.60s |  how these are used with Windows Hello for Business. Um so primary refresh tokens they are
1474.60s - 1478.74s |  just single sign on tokens. So you can sign into anything that's cloud connected with them.
1478.74s - 1483.64s |  Um now Windows requests these basically by sending a specific request to the token
1483.64s - 1488.38s |  endpoint in Entra. Um and then it's sending a JSON web token and the reason that it's sending
1488.38s - 1493.58s |  such a JSON web token is that these JSON web tokens are essentially signed with the uh
1493.60s - 1498.94s |  certificate of the device. So Entra uh can see that this request comes from a legit device
1498.94s - 1504.04s |  that is already known to Entra um and that we uh that we know that's a trusted device in
1504.04s - 1509.92s |  our tenants. Um and this will also result in the primary refresh token keys being tied back
1509.92s - 1514.76s |  to our device, being tied to the TPM if we have one so it's all basically end to end uh
1514.76s - 1521.66s |  secured. Um if we are using um Windows Hello keys then uh we will see a specific payload.
1521.68s - 1525.72s |  So if you use like regular username password authentication it's gonna send username
1525.72s - 1529.98s |  password to request a PRT. Uh but if we were to use Windows Hello it's actually signing some
1529.98s - 1535.06s |  data with these Windows Hello private keys. Um so if we look at this payload we see a
1535.06s - 1540.76s |  couple of interesting fields and the most uh interesting here uh for our attack is this
1540.76s - 1545.24s |  nonce value. So this is something that you'll see with a lot of Entra operations that there's
1545.24s - 1549.70s |  always a nonce involved. Uh and the whole reason for this is that these nonces are
1549.72s - 1554.52s |  essentially time bounds. So the presence of this nonce which will expire after five
1554.52s - 1559.92s |  minutes means that um after five minutes I cannot just replay this request and get a token
1559.92s - 1563.70s |  again because then I would need to get a new nonce. And especially if it's tied to
1563.70s - 1567.70s |  hardware that means that we actually need to have hardware uh access to the hardware of
1567.70s - 1572.40s |  that device to create the signature and that we cannot just like copy it offline and send
1572.40s - 1578.14s |  it from elsewhere. Um we also see the username that we're authenticating to and uh we
1578.18s - 1582.26s |  also see the assertion field. And this is actually another JSON web token. So we have a
1582.26s - 1588.02s |  JSON web token inside a JSON web token. And this is the assertion. And this assertion is
1588.02s - 1592.30s |  actually signed with the private key from Windows Hello for Business uh that we also saw
1592.30s - 1596.24s |  earlier on the operating system. Uh so this is a JSON web token that is signed with a
1596.24s - 1601.44s |  specific uh with this this private RSA key. There's a specific key uh derivation algorithm
1601.44s - 1606.54s |  going on here. Um and in the payload we see a couple of fields. So we see the uh the
1606.54s - 1611.42s |  issuer which is the the username. Uh we see the audience. It's our tenant ID. Uh and we
1611.42s - 1617.26s |  also see some uh time stamps where it was issued again against replay attacks. Um so there
1617.26s - 1621.10s |  were a few things wrong with this which is also why I said that this is the old version
1621.10s - 1627.50s |  essentially. Um but the problem is that uh this assertion is generated with our Windows
1627.50s - 1632.50s |  Hello for Business key. And it turns out that if we want to use this Windows Hello key
1632.50s - 1639.18s |  from the user session then we can just politely ask the operating system to sign it for us.
1639.18s - 1644.92s |  Um because it turns out that uh basically if we call the uh passwords key storage provider
1644.92s - 1650.42s |  then we don't need to enter any pins. We don't need to enter uh or prompt the user to approve
1650.42s - 1654.92s |  anything because the keys are essentially cached in your session after you already signed
1654.92s - 1660.10s |  in with Windows Hello for Business. So if you sign in on a website and you use Windows
1660.10s - 1663.64s |  Hello for Business to sign in, you'll see a pin pop up. Um I'm not sure why that's there
1663.64s - 1667.78s |  because the key is already in your session. Uh the intermediate pins already cached in your
1667.78s - 1672.94s |  session. So if we just ask the operating system nicely to sign this assertion, it will do so
1672.94s - 1678.08s |  for us uh without requiring any admin rights whatsoever. Um we do have to use the native
1678.08s - 1683.32s |  encrypt methods because uh C-Sharp doesn't expose these um or doesn't expose these methods
1683.32s - 1688.80s |  by itself. Uh the software RSA provider only accepts software keys, not TPM based keys. Um
1688.80s - 1694.80s |  but we can basically generate this assertion ourselves. So I wrote a very um well slightly
1694.80s - 1699.78s |  straightforward PowerShell script um and basically if you just run this it will grab the key
1699.78s - 1703.68s |  from the key store, it will open the backing private key and the password uh key storage
1703.68s - 1708.68s |  provider and simply generate the uh signature. Um and this signature we can then use for
1711.18s - 1717.36s |  authentication purposes. Now if you look at this assertion uh there is essentially a small
1717.36s - 1723.50s |  issue. And we saw that in the uh the basically the overlaying uh JSON web token there was a
1723.50s - 1729.04s |  nonce. But here there's no nonce. There's just a timestamp. And the timestamp is a input that
1729.04s - 1734.98s |  we control as an attacker. So if I can ask Windows to just sign anything, I can also change
1734.98s - 1739.38s |  this timestamp to be anything. So normally of course this timestamp will prevent me from
1739.38s - 1744.18s |  using this after it has expired. But if I can change it, I can just put it in a timestamp like
1744.18s - 1750.02s |  in the future. Um or whatever. I can put it like 5 minutes from now, 10 minutes from now. Um
1750.02s - 1754.72s |  but since it's simply also a time range, so it starts with like when it was issued and when it
1754.72s - 1760.40s |  expired. Um and it turned out that there's actually no limits on how big this range can be.
1760.40s - 1766.26s |  Um so this I'm essentially calling the golden assertion. Uh so if you would have access to a
1766.26s - 1770.88s |  user session, then you could just generate this assertion with some simple PowerShell codes.
1770.88s - 1774.48s |  Um and the timestamp you could just make it as wide as you want it. So I could just say this was
1774.48s - 1779.42s |  issued like a few years ago. It's valid for the next 15 years. Um and then that assertion could
1779.42s - 1784.06s |  be used at any point in time. Cause there was no nonce in there that uh expired. So we could
1784.06s - 1789.20s |  use this assertion to also authenticate in the in the future. Um however there's one little
1789.20s - 1794.20s |  problem. That is that the uh PRT that we get after this, it is basically tied to the uh private
1794.70s - 1800.60s |  key of the device. It will link be linked with the transport key and it will also be only
1800.60s - 1806.14s |  accessible by the TPM. So even if we can use this assertion, if we there would be a requirement
1806.14s - 1810.62s |  to use it with the same device, it would still be linked to that device uh on which we maybe no
1810.62s - 1816.02s |  longer have a session. So sounds like an issue. Um but it turns out that it's actually not an
1816.02s - 1821.56s |  issue because you can also use this assertion on a different device. Um and I was really
1821.58s - 1826.36s |  surprised with this. I didn't know exactly why that was necessary. Um but it turns out that
1826.36s - 1831.36s |  this is needed because you can also use basically Windows Hello keys remotely over RDP. So if
1833.90s - 1838.84s |  you have a device with Windows Hello uh you can use remote desktop to authenticate to some
1838.84s - 1844.28s |  other device. Um and it's basically gonna use the user certificates uh plus the Windows Hello
1844.28s - 1850.38s |  for Business private key to also get you a primary refresh token on that other device. So
1850.38s - 1853.70s |  then you don't have to enter any other credentials anymore and you can just use your
1853.70s - 1858.28s |  passwordless Windows Hello for Business keys uh to also authenticate on that uh on that
1858.28s - 1863.28s |  other device. Um but it's interesting because our device probably has a TPM. But the other
1864.86s - 1870.02s |  device doesn't necessarily need to have a TPM. So if we RDP to a device that doesn't have a
1870.02s - 1875.36s |  TPM, then it will still use our Windows Hello for Business key which is protected by the TPM
1875.38s - 1881.76s |  on our laptop. Um but it's the resulting PRT is actually not gonna be hardware protected. So
1881.76s - 1887.32s |  that means that if I have this machine on the left hand side where um we see that they're the
1887.32s - 1892.60s |  key is protected by the platform uh crypto provider so it's TPM backed. Uh we cannot just
1892.60s - 1898.20s |  extract that uh unless we have like some weird downgrades. Um but if you RDP them to the
1898.20s - 1902.58s |  system on the right, then you see that there I can just simply run Mimikatz. I can extract
1902.60s - 1907.24s |  the PRT and this PRT is backed by the Windows Hello for Business key on our very much
1907.24s - 1913.44s |  lockdown device. So even if your device is very well protected, if you RDP to a device
1913.44s - 1918.38s |  that's not, so if you like uh RDP to a virtual machine running somewhere in Azure, uh without
1918.38s - 1922.92s |  a TPM uh that is Android joined or hybrid joined or some other device that doesn't have a
1922.92s - 1928.52s |  TPM for some reason, uh you are essentially exposing your uh credentials because this
1928.54s - 1932.74s |  primary first token is a single sign on token for your account and it's also Windows Hello
1932.74s - 1938.34s |  for Business based so it meets like MFA policies, uh strong MFA policies even um so it's
1938.34s - 1944.78s |  quite a risk basically. And there's no way to limit uh you from RDPing to um non-TPM
1944.78s - 1951.12s |  devices. Um so this is an issue by itself as well but we can also use this knowledge to
1951.12s - 1956.56s |  basically work around the limitations. So if we take our golden assertion um we just
1956.60s - 1961.04s |  generate a uh assertion that's going to be valid for the next 10 years and we can use it
1961.04s - 1965.58s |  with any other device in the tenant at any point in time. So you can just register like a
1965.58s - 1970.72s |  rogue device, maybe you compromise a different device, you can just use those keys to sign
1970.72s - 1976.32s |  the outer JSON web token and this inner JSON web token is already signed based on the uh
1976.32s - 1980.66s |  Windows Hello for Business keys. Um and as you can see here in the expiry, uh it is going
1980.66s - 1985.66s |  to be valid till somewhere 2026 um but I could have put anything there basically. Um so
1987.16s - 1993.10s |  this was reported to Microsoft because this sounded like a uh vulnerability. So after this
1993.10s - 1997.90s |  they uh changed it a little bit. So if you look at the new uh assertion then you'll see that
1997.90s - 2002.94s |  there is actually a nonce in there which means that this inner assertion is now also tied to
2002.94s - 2009.08s |  the validity of this nonce uh which is gonna be uh 5 minutes. So basically it's now also
2009.08s - 2013.48s |  restricted to 5 minutes and after that we cannot use this assertion anymore because the
2013.48s - 2017.38s |  nonce will have expired. We would have to get a new nonce which means that we need to
2017.38s - 2022.72s |  calculate a new signature which means we once again need to have access to the private key.
2022.72s - 2028.46s |  So this was fixed um well actually fixed in July last year. Uh so Windows at that point
2028.46s - 2034.20s |  included the nonce. Um however the problem with this is that even if Windows is doing this
2034.20s - 2038.80s |  new behavior um as long as you don't enforce this then the whole control is basically
2038.80s - 2045.80s |  useless. So it was actually quite um interesting as well I would say. Um because in July
2045.80s - 2051.38s |  Microsoft put out these CVEs uh one for Entra, one for ADFS because ADFS has many of the
2051.38s - 2057.58s |  same mechanisms. Um and they made a very descriptive this uh very extensive description of
2057.58s - 2062.42s |  this attack. Basically calling like the golden assertion, you can make an assertion, use it
2062.42s - 2067.06s |  on a different device. So they're kind of spoiling my talk a little bit. Um but the
2067.06s - 2072.60s |  interesting part was that they only enforced this server side in like May this year. Because
2072.60s - 2076.46s |  if you enforce this before everyone patched then the old protocol's not going to work and
2076.46s - 2081.74s |  all the devices are going to break. So they put the description online um like in July and
2081.74s - 2086.40s |  they only enforced it uh in May so in all the time in between anyone could have done this
2086.40s - 2091.48s |  based on the description uh maybe based on reversing the protocol. Um but since May is now
2091.48s - 2095.92s |  fixed and because it's the cloud it's basically fixed everywhere. So you can no longer make
2095.92s - 2102.18s |  this golden assertion so as much as I like the name um it's not really relevant anymore. Um
2102.18s - 2107.12s |  however there is some remaining things that we can do with this. Because effectively this
2107.12s - 2111.42s |  limits our attack to this five minute window because our knowledge is valid for five
2111.42s - 2117.44s |  minutes um so we can do it for the next five minutes but not anymore after that. Um but it
2117.44s - 2123.44s |  doesn't always really matter because uh we can still request a new PRT on a different
2123.44s - 2129.80s |  device within those five minutes. So then as if that device is not a does not have a TPM
2129.80s - 2136.18s |  then uh we can use it get a PRT that's also not tied to a TPM. Um so you can still do this
2136.18s - 2141.84s |  you can just not do it until infinity um but you can still do it within the five minutes.
2141.84s - 2146.92s |  And as soon as we request this primary first token it's going to be valid for the next 90
2146.92s - 2153.02s |  days. We can use it for single sign on to anything that we want. Um and we can even use this
2153.04s - 2157.08s |  to provision new Windows Hello for business keys because it's counts as doing
2157.08s - 2161.74s |  multi-factor authentication. We can use this to provision new FIDO keys basically making
2161.74s - 2167.42s |  our uh takeover of this account complete. Um and this is not mitigated by any of the uh
2167.42s - 2172.36s |  current measures out there. So even if you have like the all the new uh features like
2172.36s - 2177.82s |  virtualization based security, LSA, PPL, uh Windows Hello extended session security,
2177.86s - 2182.86s |  TPMs, um secure core PCs, secure AI, whatever. Um this is basically still possible. So just to
2186.60s - 2191.48s |  see this in action um here I'm again running my PowerShell script. It's generating the
2191.48s - 2196.84s |  assertion. Um it is now including a non so it's not going to be valid forever. Um and we
2196.84s - 2202.42s |  can keep be basically copy that assertion to my different hosts. Um here I have RoadTX
2202.42s - 2207.76s |  as part of RoadTools that I'm running and I'm requesting a new uh primary first token
2207.76s - 2213.10s |  based on the hello assertion um with a rogue device that I registered. Um which in this
2213.10s - 2217.38s |  case is a fake device. Could also be like a virtual machine or something. Um and you see
2217.38s - 2222.14s |  that I get a primary first token. I also get a plain text session key so there's no TPM
2222.14s - 2227.38s |  here. There's no um additional hardware protection and I can also use this to uh sign
2227.38s - 2232.18s |  into anything um and it's going to be valid for ninety days or until somebody notices this
2232.18s - 2238.22s |  and uh revokes it. And if we look at the tokens that we uh receive then we see that these
2238.22s - 2243.82s |  tokens have the RSA plus MFA claim which means that uh this is actually a token that was
2243.82s - 2248.16s |  backed by a Windows Hello for Business passwordless authentication. Um which means it
2248.16s - 2253.36s |  will also comply with uh policies that require like phishing resistant multi-factor
2253.36s - 2258.48s |  authentication. Um this also complies with token protection policies. Basically all the um
2258.48s - 2265.02s |  advanced stuff that is uh that's currently out there. Um so basically this all hinges on
2265.02s - 2270.72s |  that fake device. There are some things that you can do to mitigate this. Um basically your
2270.72s - 2275.46s |  strongest control would be device compliance because if we provision a fake device it's not
2275.46s - 2280.64s |  going to be an Intune, it's not going to end up being compliant. Um of course there's also
2280.64s - 2284.74s |  things around that so if we do have a device that we can get compliant we can do the same
2284.76s - 2290.64s |  thing it's just more hurdles that you can throw up um to prevent people from doing this. Um
2290.64s - 2295.48s |  you can also monitor for this so uh you can see like if somebody registers a new device and
2295.48s - 2299.38s |  then uses that to authenticate with the existing Windows Hello for Business key from a
2299.38s - 2305.12s |  different device. Might be a little bit suspicious. Um you can also restrict who can join or
2305.12s - 2309.80s |  register new devices so then you can limit the attacker to using existing devices. Doesn't
2309.80s - 2315.50s |  fully mitigate it but it does restrict it a little bit. Um and ideally also uh you
2315.50s - 2320.60s |  wouldn't have any uh host in your network that you uh allow people to RDP to that don't
2320.60s - 2325.84s |  have a TPM because if you do RDP to a system without a TPM uh you are essentially exposing
2325.84s - 2333.62s |  these uh credentials. And there's also some endpoints protections. Yes going back to sort
2333.62s - 2338.40s |  of the the container scenario uh the endpoint mitigation is that you can use for the abuse
2338.40s - 2343.40s |  that we've demonstrated use Windows Hello ESS which is uh Windows Hello's newer
2343.40s - 2348.94s |  technology. Um failing that physical keys are always better than sort of the embedded
2348.94s - 2354.14s |  enrollment Windows Hello enrollment methods. If you don't have a TPM don't use Windows
2354.14s - 2360.58s |  Hello. Um but you can also create um detections based on access to the metadata files
2360.58s - 2366.88s |  within the containers. Uh realistically NGC controller services is the only process that
2366.90s - 2372.88s |  should be reading or or writing to those files. So if you find that any other process might be
2372.88s - 2377.88s |  reading or writing those files you can create alerts around that um access. So what the
2380.52s - 2387.42s |  hell is Windows ESS to start with? Um so it was launched in circa 2020 and it's a feature
2387.42s - 2392.40s |  that's needed in the hardware itself. And it's part of Microsoft's secure core capable
2392.42s - 2398.92s |  machines. Now I've tested a lot of endpoint devices and I'm still not seeing a great deal of
2398.92s - 2405.26s |  these in the wild. Uh and the main thing that you need is that the SDEV and SDCP tables
2405.26s - 2411.84s |  within ACPI. And that's to do with secure devices that can be accessed via um either the
2411.84s - 2418.28s |  face camera or the or the fingerprint. So I don't know why there's not a huge deal of uh of
2418.30s - 2423.84s |  these devices um out there. Uh I do know a lot of the newer surface devices have this
2423.84s - 2428.84s |  capability. Um and what and what actually happens when you have ESS enabled is the first 20
2432.28s - 2437.38s |  minutes of this talk you can completely throw out the window because they've rewritten all the
2437.38s - 2442.38s |  container um structure. So it's all in in in JSON. Um all the containers are in one single
2442.60s - 2447.60s |  JSON file. Same with the protectors as well. And you'll notice new processes that are running.
2451.04s - 2456.04s |  So you'll have a bio ISO dot EXE and an NGC ISO dot EXE. They are running inside um trustlets
2459.74s - 2466.02s |  within VTL1 which is the same place where LSAS uh the isolated LSAS runs as well. Now I
2466.02s - 2471.02s |  haven't gone beyond that so maybe I'll be back next year to DEF CON or don't know. So uh
2473.06s - 2479.60s |  so it's uh the next thing on my list is to look at uh Windows Hello ESS. So I just want to
2479.60s - 2483.90s |  give a shout out to all these awesome people that was um you know all these blogs that were
2483.90s - 2489.60s |  also referenced uh during this research. I know Dirk Yarn uh is not going to appreciate this
2489.60s - 2494.68s |  but uh realistically he should be on it uh uh there as well but he didn't want to be on there
2494.68s - 2502.21s |  so there you go. So there's the two tools. You've got the Shimaian road tools and the
2502.61s - 2509.45s |  Shimaian will be live soon enough and I'll I'll I'll tweet once it's all live. It's still
2509.45s - 2514.45s |  private at the moment but Dirk Yarn's road tools is is already available. Thanks for listening.


url: https://www.youtube.com/watch?v=zZurduFDuPk
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - AMDSinkclose - Universal Ring2 Privilege Escalation - Enrique Nissim, Krzysztof Okupski

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=zZurduFDuPk",
  "title": "DEF CON 32 - AMDSinkclose - Universal Ring2 Privilege Escalation - Enrique Nissim, Krzysztof Okupski",
  "description": "",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2668,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241028"
}

0.00s - 6.30s | This text was transcribed using whisper model: large-v2

 Um, well, thanks everyone for joining into this session. This is the AMD SYNCLOS, a
6.30s - 11.38s |  universal way into SMM. My name is Enrique Nissim and here with me is Kristof
11.38s - 18.02s |  Okupski. We are principal security consultants at IOactive and we work on the
18.02s - 26.02s |  embedded system mostly. Um, so yeah, this is our outline for today. It's very uh, a
26.02s - 30.36s |  good summary of it. It's gonna be pretty rough. We're gonna need your undivided
30.36s - 35.00s |  attention for this so stay with us. Um, yeah, we're just gonna jump into it. This
35.00s - 41.10s |  is uh, gonna be a brief on SMM. So SMM stands for System Management Mode. It's
41.10s - 47.08s |  one of the most powerful execution modes in x86. It grants you full access to IO
47.08s - 51.48s |  devices and memory. And it's very good for attackers cause it definitely will
51.48s - 55.08s |  grant you some potential, some persistence uh, capabilities. Either as a
55.08s - 59.38s |  boot kit or in some cases as a firmware implant as we'll see later. What's good
59.38s - 65.98s |  also is that code here is hidden from the OS and the hypervisor. So antivirus,
65.98s - 71.70s |  EDRs or anti-cheat engines won't, won't, won't see these things, right? Now in terms
71.70s - 75.16s |  of privilege level, this is just a simplification but we can think it about like
75.16s - 79.10s |  this. We have our applications, like for instance our browser, running at the very
79.10s - 84.64s |  top of ring three. Then we have our OS, ring zero. And if we have a hypervisor, it's
84.64s - 90.28s |  down the OS of course. And only then we have SMM. Now, how does this work? We can
90.28s - 95.38s |  divide the uh, the thing in, in, in two, two phases. We have boot time where the
95.38s - 102.02s |  firmware BIOS UFI code will, after initializing the, the hardware, will load the SMM
102.02s - 108.16s |  code into an special area of memory called SM RAM. And then it will hand off the
108.16s - 113.60s |  execution to the OS loader, then the OS loads. And as you can see, SMM is just a
113.60s - 118.04s |  run time concept. It will provide services for the, for the platform. For instance, power
118.04s - 123.74s |  management, security, and the OS can invoke some services from it as well. So how does
123.74s - 128.38s |  that happen? Well there's this con, concept of system management interrupt. When an SMI
128.38s - 135.08s |  occurs, the processor gets interrupted and then this, the, the current register set of the
135.08s - 140.10s |  processor is saved into the SM RAM into a safety area. And then whatever needs to happen
140.84s - 145.84s |  happens. Some um, good feature for the system. And it then comes back to the OS. In this
148.84s - 155.08s |  case, we are doing a synchronous SMI like a software SMI. The OS is um, invoking a
155.08s - 160.08s |  service from SMM. Now, we've been working on this area for a bit. Um, we published some,
163.48s - 167.82s |  some blogs. We've done some, some presentations before. How are you on Hexagon? We have a
167.82s - 174.02s |  couple of CVEs in 2023 and we also released some tools for um, checking for
174.02s - 179.92s |  misconfigurations and known issues. Um, all of these things that we've done before are
179.92s - 184.46s |  mostly related to either misconfigurations from vendors or software vulnerabilities in
184.46s - 190.58s |  components. Now, we're gonna present today is an architectural flaw in the AMD processor
190.58s - 196.08s |  itself. So that's very different. And so for that we're gonna just see again what is, what
196.10s - 201.64s |  makes the security of SMM. So we can think on the CPU when it's an SMM mode. We have the
201.64s - 206.32s |  memory controller in the middle and we can just access this area with, where the SMM code
206.32s - 211.18s |  and data lives. We can execute instructions from this area. We can write to this area and
211.18s - 215.60s |  read. However, when the CPU is in normal mode, meaning non-SMM, the memory controller just
215.60s - 222.24s |  rejects um, if, if, if you read from this uh, from this memory, you're just gonna return,
222.62s - 227.16s |  receive Fs. Writes are discarded and of course execution is disallowed. How does this
227.16s - 234.04s |  hap- how is this happening? Well we have um, what's called a TSIG region or top of memory
234.04s - 239.04s |  segment region. Essentially the firmware after loads, after it loads SMM at boot time, it
241.74s - 246.74s |  will hopefully configure these two registers and the idea is to overlap um, have this region
247.22s - 254.22s |  to overlap with all the contents of SMRAM to protect it. We have uh, two registers, we have
254.22s - 259.00s |  the TSIG base and the TSIG mask which is the length. The TSIG ma- the TSIG mask as you can
259.00s - 264.74s |  see have also uh, additional fields and yeah, essentially this is the way. The memory
264.74s - 269.74s |  controller will see that uh, the CPU is executing in normal mode and will just reject to read
270.08s - 275.08s |  the content or write the content of the SMRAM. Has to be enabled, that's why the T-valid is
278.08s - 283.08s |  there. Now the layout of SMRAM uh, basically it's up to the vendor to define, but most
287.10s - 293.10s |  systems out there are gonna follow what the EDK2 has, which is TianoCore, this is reference
293.10s - 299.34s |  code. And uh, essentially it's gonna consist at the very bottom you can see here um, SMM
299.34s - 304.88s |  core area, this is just supporting code for the rest of um, of what's gonna be in there. And
304.88s - 309.88s |  then for each core we're gonna have an SMM base and at a specific offset 8000 from the SMM
312.06s - 317.30s |  base we're gonna have the entry point, which is where the processor, the core is gonna start
317.30s - 322.90s |  executing from when the SMI happens. And then we have a safe state at offset FE00. This is
322.90s - 328.54s |  TianoCore, right? It can be laid out differently by the vendor. And then we have the SMI
328.54s - 333.78s |  handlers at the very top which is, are gonna be the functions that are, are gonna be useful
333.78s - 339.68s |  for, for us, for the system. Handling power, security, or whatever. Um, so yeah, just
339.68s - 343.96s |  assume of the SMRAM registers, we have the three just, we just mentioned, and we also have
343.96s - 350.26s |  an SMM block. That's very important. Hopefully the firmware code is gonna set this bit so
350.26s - 355.20s |  that the, whatever runs at run time, the OS cannot tamper with these registers. We don't
355.20s - 360.70s |  want, for example, at run time, having the OS disabling the TSEC location because this will
360.70s - 366.78s |  just, um, update or change the code at the SMRAM location and execute with these
366.78s - 373.02s |  additional privileges, right? Now this needs to be configured for each core. With that we
373.02s - 378.02s |  can see a first difference between how Intel and AMD manage the access to MSRs. On Intel
378.68s - 383.68s |  systems, these MSRs that are related to SMM are only accessible while the CPU is in SMM. In
388.60s - 395.36s |  fact obtaining the SMM base, for example, on Intel, could be considered a leak. On AMD, all
395.36s - 401.80s |  these MSRs are accessible from ring zero, no problem. Again, if we have the SMM block bit
401.80s - 406.98s |  set, then the configuration cannot be changed. Not even SMM can change the configuration
406.98s - 410.40s |  until the next power cycle in which, I mean, the firmware will take over again and
410.40s - 417.52s |  configure this in the same way. But we can now spot the bug in the documentation. This is
417.52s - 422.52s |  the same TSEC mask register and the fields, just a picture from the documentation. We can
424.96s - 430.90s |  see how the SMM block is covering all of the fields except for two over there. These two
430.90s - 436.16s |  fields are gonna be what we're gonna be talking about, um, in this session. And we have
436.18s - 442.88s |  T-CLOSE and A-CLOSE. Um, we're just gonna focus on T-CLOSE. A-CLOSE stands for um, the same
442.88s - 447.26s |  feature but for uh, a previous region called ASEC which overlaps on the video memory. It's
447.26s - 452.36s |  not used anymore so it doesn't matter. But what happens is when this bit is set, the data
452.36s - 458.36s |  accesses that the core, that the core performs when it's running in SMM are gonna be
458.36s - 465.24s |  directed to MMIO instead of to SMRAM. And that's, that's, that's cool because as we said
465.26s - 472.32s |  before, we can set this bit from ring zero because it's not blocked by the SMM block, right?
472.32s - 476.80s |  It actually, in the, in the A-CLOSE description it also says hey, I mean, don't forget to
476.80s - 482.24s |  unset this when you are returning from SMM because otherwise your safety are gonna be
482.24s - 487.24s |  erroneously read from MMIO. That's bad. Um, the documentation says as well hey, if you have a
488.24s - 495.28s |  valid T-CLOSE region and you're in SMM and the T-CLOSE is set, then instruction fetches are
495.28s - 500.76s |  still gonna be directed to DRAM but data accesses are gonna go to MMIO instead. If you are
500.76s - 506.76s |  not in SMM then both accesses, both type of accesses are gonna go to MMIO. So we can
506.76s - 513.40s |  say um, X86 behaves in a hardware, like a hardware architecture. Goes to hardware, right? If
513.40s - 518.14s |  we have um, our core, core zero for example running in normal mode, both data and
518.14s - 523.54s |  instruction fetches just go to MMIO. If we have our core zero now in SMM with the T-CLOSE
523.54s - 529.38s |  off, this is what happens. No problem. We read and execute from SMRAM. However when set
529.38s - 534.38s |  T-CLOSE on, now data fetches go like this. This is a problem because this portion can be
535.08s - 540.08s |  controlled by an attacker. So triggering the condition is super easy. We just need to um, set
544.26s - 549.22s |  this, this bit, this T-CLOSE bit and call into an SMI and the system will immediately freeze
549.22s - 554.24s |  and um, you're gonna spot the problem right there. This feature exists because um, well AMD
557.94s - 564.24s |  wanted to have the ability to reuse the physical address space and have SMM code um, access an
564.26s - 570.68s |  MMIO device that were using the same SMRAM uh, physical memory essentially. Um, we haven't
570.68s - 577.68s |  seen any vendor using this feature. Um, but yeah, that's why. And it was on, on what we could
577.68s - 582.46s |  track is in 2006 there was this document that first mentioned the feature. So it means it's
582.46s - 587.46s |  been around at least for 18 years. Now, for people familiarized with um, biosecurity they're
588.46s - 593.46s |  probably gonna remember this vulnerability presented by Christopher Domas in 2015 called the
597.36s - 603.20s |  memory sinkhole attack. And what happened was that he was able to remap the APIC which is a
603.20s - 609.34s |  specific device um, in the um, available and overlap it with the TSIG area and it caused the
609.34s - 614.28s |  same effect. Uh, data fetches will go to MMIO instead of SMRAM. Now the difference here of
614.28s - 620.88s |  course is that that was only limited to the APIC and it only affected the 4K region where the
620.88s - 625.88s |  APIC was overlapped with. The sinkholes behavior changed uh, how the entire TSIG works. Um,
628.42s - 634.06s |  any device in theory could be overlapped right? Because we just direct any access to the
634.06s - 639.06s |  MMIO space. So we can bring some, some attack ideas in. Our easy thing will be, the easiest
639.06s - 644.06s |  thing will be to just grab any PCI device and hopefully we'll have a good register layout on
649.06s - 653.80s |  its bar so that we can take control of the execution at the very beginning of the entry point.
653.80s - 657.60s |  As there are multiple integrated devices that we could use, we could just try remapping one
657.60s - 663.54s |  of those and based on what we read, the register should become visible at the TSIG location
663.56s - 668.56s |  from the OS. However this failed. We can see here how uh, we have an ethernet controller uh,
672.24s - 677.24s |  with its original uh, bar 2 uh, D0714000. We have some registers right here, they're
679.64s - 683.78s |  visible registers and we're gonna try to overlap, when we try to overlap it with the SMM
683.78s - 688.78s |  entry uh, BFEB0000, we can see that we're still reading Fs. So the remapping failed.
689.06s - 694.06s |  Registers are not available. Um, we can see that the registers were moved from their
697.24s - 702.24s |  original location. They're, they're, something happened. When we restore, we can see the
704.58s - 710.38s |  registers again. So it's not that we broke anything, so it's just the the priority of the
710.38s - 715.42s |  memory probably failed right? So what that that led us to try to understand ok how that
716.14s - 723.14s |  how how is that working? Have this register called top of memory or TOM. Um, this thing
723.14s - 729.98s |  defines a limit between the usable DRAM before 4 gigabytes on the physical address space and
729.98s - 736.98s |  MMIO space on top. Now on Intel, this register has a lock bit. Once it's configured you
736.98s - 741.62s |  cannot tamper with it anymore at runtime. But on AMD it doesn't have such a lock so we
741.62s - 747.10s |  can just you know, modify this and maybe that's good for us. The idea is simple, we have
747.10s - 752.54s |  this is uh, imagine this is layout right? And we'll move the MMIO space of the TOM that
752.54s - 758.04s |  defines the MMIO space to match with the TSEC base. So we have something like that. Maybe
758.04s - 763.04s |  then trying the same trick that we uh did before could work. Unfortunately we could move
765.22s - 769.86s |  the TSEC no problem but it didn't change the behavior that we saw before. In practice it
769.86s - 774.86s |  didn't work. So that led us to dig dig dig uh deeper into into the computation and we found
777.70s - 782.50s |  there are some actual priorities when the core access um some portion of the physical address
782.50s - 786.74s |  space. Essentially determines what where it's going. And we can see that the TSEC and ASIC
786.74s - 792.48s |  mechanisms are listed 4. Which means 1, 2 and 3 whatever is listed there has less less
792.48s - 797.72s |  priority than this. And at the at the number 1 we can see the TOM is is is listed there. So
797.72s - 803.62s |  we have that's why it never worked right? It would have never worked. What's at 5 where we
803.62s - 808.62s |  have the MMIO configuration space and the APIC? Uh that makes sense. We the APIC was used
812.66s - 819.44s |  before in the Intel attack. The MMIO config space we cannot use really. Um and then at 6 we
819.44s - 824.58s |  have this NOR bridge address space uh routing but uh that probably stands for older
824.60s - 829.60s |  architectures. This is not seen in modern modern stuff. So we cannot use it. For the APIC we
832.38s - 837.22s |  cannot really use it and we're gonna explain why. But for that we need to give an analysis
837.22s - 842.22s |  of of um how the SMM entry point code works. When the SMM when the SMI occurs the SMM core
845.82s - 851.26s |  uh the the core um executing at SMM starts executing in real mode. In 16 bit mode flat. No
851.28s - 857.06s |  protection whatsoever. What it has to do is quickly go to protected mode 32 bit and then goes
857.06s - 861.42s |  to long mode and then passes the execution to the handlers. This is a very simplified view.
861.42s - 866.50s |  Now that first step going to from real mode to protected mode is is key right? That's the
866.50s - 873.24s |  first thing that needs to happen. For this um on x86 we need essentially an are enabled
873.24s - 878.24s |  segmentation. Uh segmentation provides um the ability for the for the core to see the
878.40s - 885.00s |  memory in a segmented way. That's that's how it's called. Essentially we can have different
885.00s - 890.08s |  segments for memory and assigns uh different permissions or like um the ability to execute
890.08s - 894.78s |  code or or just read data and stuff like that. We have this key data structure called global
894.78s - 901.62s |  descriptor table of G or GDT. And we have a register on the processor that is called GDTR
901.62s - 907.52s |  that's gonna point to the base of our GDT structure and it's gonna have a limit in bytes. And
907.54s - 910.98s |  so the GDT is just really an array of descriptors. And we're gonna have different type of
910.98s - 914.74s |  descriptors. We have we have code descriptors, data descriptors. Each one is gonna have a
914.74s - 919.08s |  base. The first one is never used. That's why it's called it's called null descriptor. But
919.08s - 924.78s |  then when we have a jump you can see we'll have um a jump. It's not only having an offset
924.78s - 928.96s |  like a target location but it's also gonna have like a segment selector right here. That
928.96s - 932.46s |  segment selector picks the descriptor that we're gonna use for the for for our our code
932.48s - 939.48s |  segment. And then the top the the offset is added to the base that is indicated by the GDT
939.48s - 944.48s |  forming the final linear address. With that we can do uh an analysis of um the EDK2 SMM
946.98s - 951.98s |  entry point. Essentially um we can see that at the very beginning we are moving into the
954.50s - 960.96s |  register BX. The entry point plus 4D. This is in this is a decom like um extracted from a
961.90s - 967.84s |  compiled uh SMM code. So you can see at 4D right there we have a GDT description ready to to to
967.84s - 972.64s |  be loaded into the GDTR. The next instruction that matters for us is the load GDT. This is
972.64s - 978.48s |  instruction that is gonna load the GDTR with the content that BX points to. And finally we
978.48s - 985.26s |  have a jump over here that's gonna perform the actual um going into protected mode. And it
985.26s - 992.04s |  has the selector of co of code as well and the offset. Now with this what what will happen
992.04s - 998.88s |  if we over overlap a device that we control on the entry point? And we control offset 4D.
998.88s - 1003.18s |  What will happen is that the load GDT will be loading something that we control. So we can
1003.18s - 1008.86s |  load our fake GDT right? So that's what we're trying to do here. We're trying to get control
1008.86s - 1015.06s |  over the offset 4D with any device that we can find. So that the the fake GDT then provides
1015.06s - 1019.86s |  the descriptors we need and we can take control and jump down there. That's the whole idea of
1019.86s - 1026.94s |  the attack. And that's why the APIC is a problem. Two things. First the system becomes
1026.94s - 1032.48s |  unstable when the APIC is moved. Super unstable. Second, the APIC racers are not useful for
1032.48s - 1037.78s |  taking control in the way we need. We can see that at 4D we have these reserved regions with
1037.78s - 1043.32s |  all zeros. Rights are discarded here. We're not able to control here and if we load a GDTR
1043.32s - 1049.72s |  with all zeros we're essentially saying to the processor hey here's an empty GDT. So this
1049.72s - 1054.56s |  won't work. And at this point we found another device not documented by the the
1054.56s - 1059.90s |  specification that also has priority over uh the TSEC region. That's the spy controller and
1059.90s - 1064.90s |  Christophe's gonna describe it for us. Alright. So the spy controller is a very nice device
1067.80s - 1071.24s |  for us because it's present in all the systems we've tested. And it's basically used to
1071.24s - 1077.14s |  access the spy flash on um AMD uh systems. So for example for reading, writing, erasing the spy
1077.14s - 1081.74s |  flash. It always goes for the spy controller. And it has a couple of key features that are
1081.74s - 1087.42s |  really uh interesting to us. First of all, we can relocate the bar over the SMM entry point.
1087.42s - 1092.18s |  Secondly, the portions which are interesting to us at offset 4D we can control them. And
1092.18s - 1098.00s |  three, it actually takes precedence over uh SMRAM when TCLOS is enabled. So with that in
1098.02s - 1103.06s |  mind, what we will do for our attack is simply take the spy bar, relocate it over the SMM
1103.06s - 1108.14s |  entry point of core zero. And then afterwards manipulate the values at offset 4D within that
1108.14s - 1113.14s |  bar. Um the um registers that actually correspond to that portion of memory in the bar uh are
1115.98s - 1121.14s |  the memory range and ROM protection zero register. Those were used in the past to uh lock
1121.14s - 1126.28s |  down access to the spy flash. But mostly these are not configured and not fixed. So we can
1126.30s - 1131.40s |  fully control them. On some systems they are fixed. But actually they are fixed to values
1131.40s - 1136.40s |  which are still useful for us. So before I dive into the exploits, uh I also want to uh show
1138.82s - 1145.22s |  you a little bit our debugging stuff because it's a little bit special. Um so we are facing
1145.22s - 1150.62s |  actually two challenges uh when we try to develop the exploit. First of all, we didn't have
1150.62s - 1155.66s |  really have a way to know whether our payload ran because the system just crashes, reboots
1155.68s - 1160.42s |  and memory is just all wiped. Uh and secondly, we didn't really have any debugging framework
1160.42s - 1166.12s |  for SMM. Um and like for example, when crashes happen, we want to be able to modify the
1166.12s - 1171.92s |  code however we see fit. So to resolve the first issue, we actually took a PCI squirrel which
1171.92s - 1177.70s |  is typically used with PCI leach for DMA attacks. But the nice thing about it is actually
1177.70s - 1182.70s |  is that it has a bar buffer as we call it. Where when we write to it, it actually survives
1183.02s - 1188.02s |  across reboots. So for instance a payload can write a value to uh the bar buffer kind of like a
1190.52s - 1194.52s |  checkpoint so we know it ran. And then when the system reboots it's still going to be there.
1194.52s - 1199.76s |  Right. And if we want to modify for example for the second issue, if we want to modify uh code
1199.76s - 1205.74s |  in SMM for some extra debugging capabilities, for that we just um injected a firmware implant
1205.74s - 1211.20s |  uh that loads a nice SMM module that allows us to do all of that. So the setup looks like
1211.20s - 1216.78s |  this. We just have the PCI squirrel connected to our target device via an M2 uh adapter
1216.78s - 1222.18s |  and all of this is powered externally by a power supply. So it's time to get our hands dirty.
1222.18s - 1227.32s |  So let's take a look at how uh the exploit looks like. In the first attempt uh we remap the
1227.32s - 1232.80s |  spy bar just like mentioned before over the SMM entry point of core zero. Then we tweak uh
1232.80s - 1238.94s |  these values at offset 4D. We create a fake GDT in the beginning of the address space uh
1238.94s - 1242.94s |  with the with a nice base address that will allow us when the jump happens to redirect
1242.94s - 1248.82s |  execution to our own payload. And then when we uh execute the SMM entry point code with T
1248.82s - 1254.16s |  cost enabled what's going to happen is uh the all GDT is actually going to load the GDT
1254.16s - 1259.76s |  register uh with a value that points to our own fake GDT. So that's great. And afterwards when
1259.76s - 1265.64s |  the jump happens a descriptor from the fake GDT is going to be taken that we control um and
1265.64s - 1272.88s |  it's going to be used as a base uh for the jump. So and um this is going to redirect
1272.88s - 1279.28s |  execution like this at least in theory. So um an interesting detail is actually how we pick
1279.28s - 1286.22s |  the base address in the GDT descriptor. Um and for that we have to understand how it
1286.22s - 1291.36s |  normally executes and how it executes with T cost in this case. So um when the for jump
1291.38s - 1297.76s |  happens um and the normal execution what happens is the GDT register is going to point to a
1297.76s - 1302.36s |  GDT with an SMRAM where it's nicely protected. Um and the segment selector is going to
1302.36s - 1307.70s |  index into that table um and the base is going to be actually fixed to zero. Which means
1307.70s - 1313.54s |  with a base of zero when we add it uh to the far jump offset what's going to happen is the
1313.54s - 1318.72s |  linear address is going to be the same. Now in our case actually we have a bit of an issue.
1318.72s - 1325.68s |  We want to read the execution um outside of TSEG. The only problem is that within the first
1325.68s - 1331.22s |  four gigs of memory after TSEG there's not really any spot where we can put a payload. Right?
1331.22s - 1334.96s |  So if we increase the base a little bit sure the instruction pointer is going to go a bit more
1334.96s - 1340.74s |  up up up up. And the address space we don't really have DRAM over there that we control. So
1340.74s - 1347.74s |  we wondered okay what happens if we actually increase the base such that when we uh the
1347.76s - 1353.54s |  base of the GDT descriptor such that when we add it to the far jump offset it actually
1353.54s - 1358.54s |  overflows. Um yeah? It just overflows. So we thought okay this isn't going to be possible but
1360.94s - 1366.62s |  actually it was. Uh and this is nice because uh if we choose the base efficiently big and we
1366.62s - 1369.72s |  add the offset we can actually make it wrap around and make it jump to our own payload in the
1369.72s - 1373.32s |  beginning of the physical address space. The beginning of the physical address space we have
1373.44s - 1380.44s |  DRAM there. Great. We control all of that. So uh that was one of the key takeaways actually
1380.44s - 1385.98s |  that we had from the research as well. So this worked. Our payload actually ran and we saw
1385.98s - 1390.88s |  this because it would write a value this nice checkpoint to our bar buffer but the system
1390.88s - 1395.46s |  would crash and we wondered okay why is this happening? Um the reason was the SMM safe
1395.46s - 1400.36s |  state. So like Enrique mentioned when a CPU goes to SMM mode it actually saves the current
1400.40s - 1404.94s |  register state into the uh SMM safe state. When it returns it just restores it. What happens
1404.94s - 1411.48s |  is when T-Close is enabled actually the writes when the core enters SMM are going to be
1411.48s - 1416.22s |  discarded which means when we return with T-Close disabled actually it's just going to use
1416.22s - 1422.02s |  stale values that were still there that were stored before. And to resolve this the trick is
1422.02s - 1428.12s |  actually pretty straight forward. We trigger the SMM twice. One time um without T-Close and
1428.12s - 1434.86s |  the second time with T-Close. So we first put the core zero into a known controlled state
1434.86s - 1439.20s |  and then trigger an SMI without T-Close. This is going to prime the SMM safe state and
1439.20s - 1444.24s |  afterwards when we trigger the bug with T-Close enabled the code is going to go for the same
1444.24s - 1450.78s |  execution path and is just going to reuse the values that we stored before. So that worked
1450.78s - 1455.98s |  but unfortunately it crashed again. But this time around we did see actually that the uh
1456.14s - 1460.78s |  core zero was returning from SMM so that was great. We had full control of core zero.
1460.78s - 1466.66s |  OS code was running. We saw our checkpoints. Great. But no matter what we tried this damn
1466.66s - 1471.12s |  thing was still crashing. Um so we spent an eternity debugging this thing until we
1471.12s - 1478.14s |  stumbled into this. When we enable T-Close what happens is we enable it on core zero only
1478.14s - 1484.30s |  but actually it gets enabled on both cores. Core zero and core one. Um and we found that
1484.30s - 1487.96s |  the culprit for this is symmetric multi-threading. So this is AMD's implementation of
1487.96s - 1492.66s |  Intel hyper-threading. Um and what it does is it divides a physical core into two logical
1492.66s - 1497.70s |  cores. And some of the resources on these logical cores are shared and some of them are not.
1497.70s - 1503.58s |  So for instance the SMM base MSR is separate so every logical core has a different base MSR.
1503.58s - 1510.62s |  But the T-Sec mask is actually shared which is what we just saw. Right? And we wondered is
1510.70s - 1516.04s |  this the actual issue because we assume when an SMI gets triggered that only one core goes
1516.04s - 1521.52s |  into SMM at a time. And we put this to the test and what we saw is the following. When we
1521.52s - 1527.36s |  have multiple cores running in normal mode so outside of SMM um when we when one of them
1527.36s - 1532.86s |  triggers an SMI an interrupt gets asserted on all of the cores and all of the cores are
1532.86s - 1539.30s |  gonna go into SMM mode and gonna start executing the SMM entry point codes um for uh for each
1539.32s - 1545.16s |  one of them. So our assumptions were actually wrong. Right? We assumed SMIs are local but
1545.16s - 1549.42s |  they're actually not. And we thought that this was actually the case because the indicate
1549.42s - 1554.90s |  two code has a so called rendezvous routine which will every time you enter into SMM this
1554.90s - 1560.34s |  routine is gonna be triggered and that core which entered into SMM will send an explicit
1560.34s - 1565.78s |  inter-processor interrupt to all of the logical cores to explicitly pull them from whatever
1565.80s - 1570.50s |  state they were in into SMM. And well what's the point of that if actually all the cores
1570.50s - 1575.20s |  always go into SMM anyway right? Um and we dug a little bit deeper into the documentation
1575.20s - 1579.98s |  and we found that the IO hub seems to be responsible for this to uh basically assert this
1579.98s - 1584.98s |  interrupt on all of the cores so we're out of luck. So to summarize we had all cores always
1587.74s - 1593.06s |  going into SMM and T-Cores being enabled on two cores at the same time and not just one as
1593.08s - 1599.08s |  we initially thought. And this will actually make just core one go haywire. Right? We have
1599.08s - 1604.28s |  control of core zero but core one is uh just gonna go nuts and crash the whole system. So to
1604.28s - 1610.98s |  tackle the problem we had to get control of core one some way. Uh and we dug deep into our
1610.98s - 1617.00s |  bag of tricks to really uh see if maybe there's a nice elegant solution to this to just take
1617.00s - 1623.94s |  core one out of the running. Um so we tried to um we tried to find another device to
1623.94s - 1629.08s |  overlap with the entry point of core one. There was none. Uh we tried to disable SMT in the
1629.08s - 1635.62s |  BIOS that also didn't work. We tried to uh use the uh so called init IPI and also the SKN
1635.62s - 1641.22s |  instruction to put core one into a state that would actually make it ignore SMIs. That also
1641.22s - 1646.64s |  didn't work. And finally we also tried to send a so called SMI IPI which at least according
1647.30s - 1651.98s |  to the documentation would allow us to trigger a SMI on individual cores. And it also didn't
1651.98s - 1657.22s |  work. So despite the documentation indicating one thing in practice we didn't manage to uh get
1657.22s - 1661.68s |  it to work. So we're running out of options and we had to take a step back and analyze the
1661.68s - 1666.66s |  problem. And we realized okay the LGDT is the actual problem because it's gonna be load
1666.66s - 1673.70s |  loading the GDT register with all Fs. Right? So is this is there maybe some way we can
1673.70s - 1680.30s |  actually still take advantage of this. Um so when the SMM entry point normally executes what
1680.30s - 1684.44s |  happens with the GDT register is it's gonna be loaded with a nice value for the base. It's
1684.44s - 1690.58s |  gonna be pointing to the GDT within uh SMRAM. Right? And afterwards the segment selector is
1690.58s - 1697.22s |  gonna be taken, added to it, uh and the base within that uh descriptor is gonna be used to
1697.22s - 1703.16s |  calculate the final linear address. Now in our case what's gonna happen with the
1703.16s - 1708.36s |  cores is enabled uh the GDT register is gonna be loaded with all Fs. Both the limit and the
1708.36s - 1714.96s |  base. And what's gonna happen then is when the four jump the segment selector is gonna be
1714.96s - 1720.50s |  added to it. And once again we have our good old friends integer overflow. It's actually
1720.50s - 1725.28s |  gonna result in the physical address seven. And this is actually awesome because address
1725.28s - 1729.84s |  seven and the physical address space once again that's DRAM. We control DRAM. So we can
1729.86s - 1734.70s |  take advantage of that. We can put our GDT at the beginning of DRAM and we can just
1734.70s - 1741.10s |  overflow this thing like this. And afterwards uh from the GDT we control we set a nice base so
1741.10s - 1747.04s |  that afterwards uh the code jumps wherever we want it to. So to summarize we have two types of
1747.04s - 1751.38s |  wraparounds. One is between the GDT descriptor base and the four jump offset. And the second
1751.38s - 1757.26s |  one between the GDT register base and the four jump segment selector. And the nice thing
1757.28s - 1762.28s |  about this is we can actually reuse the same fake GDT for both core zero and core one. And
1764.48s - 1770.59s |  the added bonus is we don't even need the spy bar anymore. The only thing that we really have
1770.59s - 1775.93s |  to take care of is the SMM safe state. Once again for core one. For core zero we just do the
1775.93s - 1780.77s |  same thing as before. But core one is gonna be running in some unknown state. It could be
1780.77s - 1784.87s |  running in ring three, ring zero just in an unknown context. We have to bring it to uh the
1784.87s - 1790.21s |  same controlled state as core zero. And we do so by using a kernel synchronization API.
1790.21s - 1796.29s |  Which on Windows is the deferred procedure call. Or on Linux symmetric multiprocessing. And
1796.29s - 1802.13s |  basically once that's done uh we have both cores in a known state. And we can use the same
1802.13s - 1808.17s |  trick we did uh use for core zero. So all good things are three. So let's try again. The
1808.17s - 1813.67s |  exploit this time is greatly simplified. And well the only thing we have to do is we create
1813.67s - 1818.47s |  a fake GDT in the beginning of the address space. We choose the um base address within the
1818.47s - 1824.35s |  descriptor accordingly. And that's it. And then when we trigger when we enable T-Close and
1824.35s - 1829.51s |  run the uh SMM entry point code again. The old GDT this time around is gonna point to the
1829.51s - 1835.09s |  very end of the address space of the first four gigs. But then when the far jump happens it's
1835.09s - 1839.23s |  gonna wrap around. It's gonna fetch the GDT descriptor entry from the beginning of the
1839.25s - 1844.73s |  address space. From our fake GDT. And then afterwards it's gonna redirect execution for both
1844.73s - 1851.13s |  core zero and core one to our own payload. And that finally worked. Well we managed to
1851.13s - 1856.27s |  control both cores. Core zero and core one. Uh our payload was executed with SMM privileges.
1856.27s - 1861.87s |  And uh it would return gracefully from SMM to the operating system and nothing would crash.
1861.87s - 1865.61s |  And that was great. There were only a couple of things that we wanted to improve uh in our
1865.63s - 1870.63s |  exploit. And that was um to reload the GDT because the base actually is um a bit off. So we
1874.91s - 1879.01s |  just reloaded the GDT so that the base address is zero again. So that we don't have strange
1879.01s - 1884.39s |  misalignment issues. We set up long modes. Uh so page tables, stack pointer etc. So we can
1884.39s - 1890.89s |  execute like uh any SQL that we want. Uh and then we also install an SMI handler so that we
1890.89s - 1894.73s |  only have to exploit the bug once. And then basically we have kind of semi persistence of
1894.75s - 1901.19s |  the system resets. Right? So for the demo just to show you I'm not selling just some snake
1901.19s - 1906.19s |  snake oil. Uh we have a system over here which is a Huawei MateBook V16 from 2000 uh 23. And
1912.17s - 1916.51s |  you can see when the system boots it actually shows the Huawei logo. That logo is embedded in
1916.51s - 1922.65s |  the firmware code. For that um so for our exploit we're actually gonna modify that uh that
1922.67s - 1927.67s |  logo. So um we're gonna run our exploit with uh kernel privileges. So you'll see over here
1930.01s - 1934.91s |  that we have to elevate privileges and it's gonna be triggered via a malicious driver. And
1934.91s - 1940.49s |  then our exploit is gonna do uh 3 things. At first it's gonna use the synclose issue to
1940.49s - 1946.59s |  elevate privileges to SMM. Then it's gonna disable the spy flash protections. And then
1946.59s - 1952.17s |  afterwards it's gonna write to the spy flash the portion where the um boot splash logo is
1952.19s - 1957.19s |  actually residing. This takes a little while about 15 minutes so we just fast forward that
1957.19s - 1963.69s |  portion. And you can see okay it shows done patching. All good. And at this point we just
1963.69s - 1968.71s |  reset the system and pray that it works. So let's see. Yeah this one takes a little while. And
1982.28s - 1996.10s |  there we go. Well successful. So I mean this was just one example of what we can do with this
1996.14s - 2000.94s |  kind of access into the system. But let's take a more systematic approach to see whether this
2000.94s - 2005.32s |  works on all systems just on some. What does this actually depend on? So the next attack
2005.32s - 2011.92s |  path um paths depend on how the platform is actually configured. Um so every vendor
2011.92s - 2016.36s |  configures certain features that uh AMD provides to them. And specifically there are 2 of
2016.36s - 2021.64s |  them which are key to this. One is room armor which can be used to restrict access to the
2021.64s - 2026.98s |  portions of the spy flash. And the second one is platform secure boot which is AMD's
2026.98s - 2033.66s |  equivalent of boot guard which will verify the initial stages of the firmware code. Um so if
2033.66s - 2038.60s |  everything is enabled the very least thing that we can do is we can write to a portion of the
2038.60s - 2041.80s |  spy flash where you have your variables lived. So for instance in these variables you're
2041.80s - 2047.60s |  gonna have things like the secure boot uh keys which I used. So we can break secure boot.
2047.60s - 2052.30s |  That's nice. Um but if nothing is enabled actually we have firmware implants. I'm gonna
2052.30s - 2055.98s |  explain in a moment uh what the difference actually is. So in the first configuration
2055.98s - 2060.32s |  whenever where everything is uh properly configured. We see ok we escalate from the
2060.32s - 2066.02s |  operating system to SMM. And from there we can write to the let's say firmware uh data
2066.02s - 2069.92s |  portion of the spy flash where the configurations are. So we can manipulate like secure
2069.92s - 2074.70s |  boot keys. So that afterwards we can actually load our own malicious boot loader before the
2075.06s - 2080.34s |  OS loader runs. And the second configuration where the PSB is not enabled. We have basically
2080.34s - 2085.34s |  the same scenario. Um roam armor still will still restrict write access to um to the data
2087.84s - 2094.58s |  portion. And we can we can still just um uh inject our own boot kits. And the third
2094.58s - 2099.32s |  configuration we can write to even firmware code but that's gonna be still verified by
2099.34s - 2105.18s |  platform secure boot. So ok in these three we have the same scenario. We can just inject a
2105.18s - 2109.18s |  boot kit which is still nice because it runs before the OS loader. Any protections provided
2109.18s - 2116.26s |  by the operating system would still be um rendered null. But in the last scenario where
2116.26s - 2120.86s |  none of these features are enabled what we can do is we can inject our uh malware into the
2120.86s - 2126.24s |  spy flash into the firmware code portion of it. And when that happens uh uh is what we're
2126.26s - 2133.20s |  gonna get is we can um run our own malware at the very earliest stage of the boot process.
2133.20s - 2139.80s |  And there's a key difference here between a firmware implant and uh a boot kit. Is that this
2139.80s - 2144.68s |  attack actually is resistant to uh to OS reinstallations. So even if you wipe your drive
2144.68s - 2148.92s |  it's still gonna be around. Um and even if you try to push a firmware update from the
2148.92s - 2153.36s |  operating system it's still gonna be around because the uh the malware can just say well
2153.58s - 2160.32s |  update was successful. Um and the only way to really get rid of it at that point is to take
2160.32s - 2166.66s |  apart your system, take a spy programmer to read out the spy flash, inspect it and if it's
2166.66s - 2173.76s |  infected um just uh rewrite it. But typically it's not really in the repertoire of a typical
2173.76s - 2179.50s |  IT guy right? So to illustrate how prevalent actually these misconfigurations are we did
2179.52s - 2184.16s |  some research last year on that and we saw that the majority of the systems have none of the
2184.16s - 2188.96s |  security features actually enabled. Which means all the systems which have none of the
2188.96s - 2194.44s |  features enabled are vulnerable to firmware implants. Which is pretty bad. And to put a cherry
2194.44s - 2199.20s |  on top we also found that once you're infected with that kind of uh firmware implant you can
2199.20s - 2204.18s |  even disable platform secure boot forever by burning a specific fuse so that your system
2204.20s - 2209.20s |  remains vulnerable to firmware uh implant reinfections forever. Sweet. So let's wrap up the
2212.14s - 2220.12s |  presentation. Thanks Christoph. So yeah in terms of affected systems right? Pretty much all of
2224.20s - 2229.20s |  them. Uh yeah um our tests were on Ryzen mostly, several laptops uh but turns out the Threat
2229.36s - 2234.36s |  Reaper series is also affected, Epic series is also affected meaning servers. Um and yeah uh due
2242.90s - 2247.90s |  to the longevity of this this this thing we can estimate the total number of affected chips
2251.24s - 2256.24s |  are in around the hundreds of millions. Um there's an advisory from AMD published now um
2259.42s - 2265.92s |  where more information on the system, the affected systems and cover uh there's a microcode
2265.92s - 2270.92s |  update now. Information is there and so you can check. Mitigations. Yeah AMD as I just said
2275.06s - 2281.56s |  provided um with microcode updates. However it might not cover all of the affected systems of
2281.56s - 2286.58s |  course. Um in terms of what an OEM can do, they can just modify the SMM entry point code and
2289.44s - 2295.92s |  to detect if the T-close bit is set. And if it is then just abort the execution and this this
2295.92s - 2302.62s |  will just render the exploitation unfeasible. Uh this can even be done at the EDK 2 level for
2302.62s - 2307.62s |  AMD system right? And we really haven't covered here core boot but core boot is affected in
2311.00s - 2315.84s |  the same way. We just I mean um core boot does the very beginning of the entry point performs
2315.84s - 2322.42s |  a low GDT. They have to go to protected mode as well so it's it's the same thing. Um and
2322.42s - 2326.76s |  actually core boot they are checking for this uh for for other issues as well at the entry
2326.76s - 2331.76s |  point so they could they could very well do this. Um and users well they can you know a
2334.56s - 2339.56s |  hypervisor could trap the access on the TSEC mask MSR so that's another uh way to stop this.
2340.06s - 2345.06s |  Timeline wise well we reported this back in October of 2023. A CVE of 2023 uh 3.1.3.15 was
2350.64s - 2355.28s |  assigned in November. And then we discussed mitigations and impact with AMD over the course
2355.28s - 2361.18s |  of the next months. Um and yeah finally yesterday um the advisory was published and we are
2361.18s - 2366.18s |  here at DEF CON today. This was the official AMD response. Essentially we work with them in a
2370.12s - 2378.24s |  process of uh responsible disclosure. And yeah they've been great to work with. Conclusions
2378.24s - 2384.54s |  and takeaways. Well the vulnerability has been around for nearly two decades. Um the
2384.54s - 2389.82s |  complexity of the architecture clearly plays in favor of attackers and we see this uh with
2389.82s - 2396.20s |  the flexibility of of of the GDT. Um the two types of wraparounds, the the the byte level
2397.06s - 2402.06s |  uh um address um like granularity that there is with it, no problem. Um and also with the how
2405.34s - 2411.40s |  the MSRs can be accessed without any restriction. Uh that that's that's all good for attackers
2411.40s - 2416.42s |  right? Um these things combined are what made this exploit approach possible. It might be
2417.42s - 2422.42s |  on other exploit methods too. Um but yeah all of this of of course requires an in depth
2426.66s - 2431.46s |  understanding of the architecture. And in the end we managed to exploit this without
2431.46s - 2437.00s |  requiring physical presence. So that's very good. And yeah, exploit code will be released
2437.00s - 2441.90s |  soon. So stay tuned for that. Questions?
2442.90s - 2456.31s |  What is the question up there? Is there a microphone? Okay. Oh there's Christoph.
2462.18s - 2467.18s |  Uh uh hello. Um it wasn't entirely clear to me. Is the spyflash chip you're referring to on
2470.76s - 2475.76s |  the uh CPU die or is it external? External. Okay. Yes. Yep. Hi how are you? We were talking
2475.76s - 2480.76s |  with Enrique that this is interesting also to bypass an anti-cheat system right? Uh in the
2485.10s - 2492.10s |  video game industry. Um Playstation 5 runs on an MID chip. Uh is is is it also vulnerable or
2492.10s - 2497.10s |  is it uh a different kind of chip and it doesn't affect it? Thank you. Um so I'm sorry if
2499.74s - 2504.98s |  if I understood your question correctly was about bypassing uh anti-cheat systems uh using
2505.00s - 2510.00s |  this method? No installing something to bypass uh the anti-cheat systems and uh uh. Once
2513.34s - 2518.34s |  you achieve arbitrary code execution in SMM uh yeah pretty much uh like modern anti-cheat
2521.42s - 2527.26s |  systems running uh either kernel or even maybe a hypervisor level could could run and and
2527.26s - 2532.26s |  this this runs even below that. Does that make sense? Um but uh since uh MID has this
2532.74s - 2537.74s |  closed the processors that are vulnerable to this attack it is the it is not disclosed in
2540.38s - 2545.38s |  Playstation 5 which has MID. So that's what I was asking if maybe it's also yeah. Ah okay.
2553.43s - 2559.03s |  But yeah I'm sorry I I don't know uh I I don't understand your question correctly. The the
2559.03s - 2564.03s |  Playstation 5 hypervisor blocks the MSR. Oh. Uh if it's for that yes. The the yes. The
2565.43s - 2570.71s |  we we check that. And it is being trapped by the hypervisor layer on the Playstation. Yes.
2570.71s - 2575.71s |  Sorry. Hey thank you. Um quick question. Um why didn't disabling SMT prevent the system
2579.05s - 2584.05s |  from becoming unstable? Uh yes. So the SMT when we try to disable it um essentially what
2586.25s - 2591.63s |  happened is the other logical core will just not run but it still be there and it will be
2591.83s - 2595.87s |  the all the entry points and uh will be already configured by the firmware if that makes
2595.87s - 2600.97s |  sense. So when the SMI happens it was a level underneath I mean it won't you won't see the
2600.97s - 2608.01s |  processor available at the OS level but all all the layout and and and and and at at yeah at
2608.01s - 2612.75s |  the deeper level the the logical core is still there if that makes sense. Yes it does. So we
2612.75s - 2620.17s |  have to deal with that regardless. Yes we try it. Thank you. Hello. Do you know what uh
2620.23s - 2625.77s |  changes AMD microcode update made? Um I'm sorry could you could you speak up louder? I'll say.
2625.77s - 2631.75s |  Do you know what changes AMD microcode update made to mitigate this issue? Oh interesting
2631.75s - 2636.75s |  question. Uh yes. Um no I mean officially we don't. Uh. Um what uh we don't. That's a long and
2636.75s - 2642.75s |  short of it. Uh yes. Ok well if no more questions thank you so much for joining us today.


url: https://www.youtube.com/watch?v=gHqDEMrqTjE
title: DEF CON 32 - Counter Deception: Defending Yourself in a World Full of Lies - Tom Cross, Greg Conti
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=gHqDEMrqTjE",
  "title": "DEF CON 32 - Counter Deception: Defending Yourself in a World  Full of Lies - Tom Cross, Greg Conti",
  "description": "The Internet was supposed to give us access to the world's information, so that people, everywhere, would be able to know the truth. But that\u2019s not how things worked out. Instead, we have a digital deception engine of global proportions. Nothing that comes through the screen can be trusted, and even the things that are technically true have been selected, massaged, and amplified in support of someone\u2019s messaging strategy.\n\nDeception isn\u2019t just about narratives - we see deception at every layer of the network stack, from spoofed electromagnetic signatures, to false flags in malware, to phony personas used to access networks and spread influence. They hide in our blindspots, exploit our biases, and fill our egos while manipulating our perceptions.\n\nHow do we decide what is real? This talk examines time-tested maxims that teach the craft of effective deception, and then inverts those offensive principles to provide defensive strategies. We\u2019ll explore ways to counter biases, triangulate information sources, detect narratives, and how hackers can build tools that can change the game.\n\nAt their best, hackers lift their heads up above the masses to see how the world actually works, not how it purports to work, and then take action to make the world a better place. You\u2019ll leave this talk with practical skills to do just that.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2574,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241022"
}

0.14s - 5.62s | This text was transcribed using whisper model: large-v2

 Good morning DEF CON. Thanks for coming out. I appreciate it. Uh we have two speakers this
5.62s - 11.08s |  morning. Uh Tom Cross and Greg Conte and their talk is gonna be on deception and counter
11.08s - 13.46s |  deception. Please give them a good DEF CON welcome.
13.46s - 26.71s |  So uh good morning everyone. Thanks for uh making it out this morning. Um so we're uh
26.71s - 32.95s |  we're excited about this talk. Um I uh I I've been coming to DEF CON you know since it got
32.95s - 40.03s |  started and when uh you know early DEF CON uh you know at that time uh the internet was
40.03s - 45.99s |  just beginning to become publicly available um to consumers right? And we were thinking
45.99s - 49.63s |  about you know what what how is the internet gonna affect society? Like how what is gonna
49.63s - 55.35s |  happen right? Um and we were sort of imagining a world that we now live in today. And I think
55.35s - 60.35s |  it's interesting to look back at how what we thought would happen and question you know
60.35s - 65.55s |  sort of you know where we've ended up right? I think people in this community could see
65.55s - 71.75s |  both the like promise and peril of the internet. Um I remember going to lunch at DEF CON going
71.75s - 76.99s |  to a food court and everyone's paying with cash and we're thinking you know in the future
76.99s - 80.63s |  we're probably gonna pay electronically for everything and a little record will be kept
80.63s - 84.53s |  every time we buy something. And like it will create this model of our behavior and how
84.53s - 90.19s |  will that get used against us right? Um but at the same time I think people were genuinely
90.19s - 94.63s |  excited about the idea that everyone will have the world's knowledge at their fingertips
94.63s - 100.43s |  right? And maybe that will make people a little smarter. It might up level humanity. Um and
100.43s - 106.03s |  so as you know time has gone by and we've actually got all these capabilities and everyone's
106.03s - 113.11s |  using them um you know there's certain facets of human nature that have come roaring forth
113.11s - 119.91s |  uh and have a huge impact on how this stuff actually affects us. Uh I I think the part
119.91s - 124.19s |  of the problem is that people don't come to the internet because they want to get smarter.
124.19s - 128.71s |  They come to the internet because they want to be told that they're already smart. Um
128.71s - 132.95s |  they seek validation right? Um and there's a lot of people who recognize this and they're
132.95s - 139.51s |  in what I call the fun house mirror business. So they present you a world in which you're
139.51s - 144.59s |  a good person. In which you should get what you want. And in which the people that you
144.59s - 149.31s |  dislike we're gonna show you those people in the most negative light possible over and
149.31s - 156.15s |  over again. Um and this world of view that is centered around you and why you're special
156.15s - 164.03s |  um is highly compelling to people's egos. Um this is what we on some level mean by deception.
164.03s - 168.79s |  And we find deception not just in the like narratives that appear on social media but
168.79s - 174.11s |  also um at every level. Like in the phishing emails that people are getting. In the malware
174.11s - 180.95s |  that's running on their computers. Um ultimately the internet has become this massive deception
180.95s - 187.59s |  engine uh in which these uh false narratives are appearing at every level of abstraction
187.59s - 192.75s |  um and you can't trust anything that you see in the screen. Um it's I think people have
192.75s - 197.75s |  recognized this. They've recognized that the internet is not giving us what we wanted.
197.75s - 203.47s |  It's not making us smarter. Uh and in fact um the theme of this year's DEF CON is is
203.47s - 207.79s |  how do we engage with the the internet that isn't giving us what we want? How do we make
207.79s - 214.27s |  things better? Um so before I get into the overview of the talk um let me introduce us.
214.27s - 219.59s |  Uh so my name's Tom. Uh I've been coming to DEF CON for a long time. Uh I've done a few
219.59s - 224.99s |  social media projects over the years. My current uh project is called Feedseer. It's a news
224.99s - 229.35s |  reader app for Mastodon. So uh it shows you the top links that have been posted on your
229.35s - 233.79s |  feed in the past 24 hours and what people are saying about each link. Uh and um there's
233.79s - 238.47s |  lots of InfoSec folks on Mastodon. Um I've also uh you know generally had a career in
238.47s - 244.15s |  InfoSec and I've spoken at a lot of cons on information security uh topics. Often with
244.15s - 245.23s |  this gentleman, Greg.
245.23s - 253.83s |  Hi, I'm Greg Conte. Thank you for joining me here on Arrakis for DEF CON 32. Um my background
255.27s - 260.59s |  is uh I was long term faculty at West Point where I ran their cybersecurity research and
260.59s - 267.59s |  education programs. Also worked at NSA twice and US Cyber Command twice. Um and then I've
267.75s - 272.99s |  developed and taught the information operations course at Black Hat Training 7 years ago and
272.99s - 277.59s |  been running it uh since there and in private sessions and also run the military strategy
277.59s - 282.27s |  and tactics for cybersecurity course for 10 years. Same deal. Thanks Tom.
282.27s - 286.75s |  Oh and Greg and I are teaching a class on adversarial thinking at DEF CON training after
286.75s - 293.23s |  DEF CON is over. If you guys want more Vegas. Um so uh what are we gonna cover in this talk?
293.23s - 297.03s |  Um the first thing we're gonna do is we're gonna tap into some of Greg's deep expertise
297.03s - 301.51s |  with military doctrine and thinking. Militaries have been thinking about conflict for hundreds
301.51s - 307.71s |  of years um and deception in particular is an area where they have um identified maxims
307.71s - 313.67s |  that teach you how to craft effective deceptions. So we're gonna talk about how to uh to do
313.67s - 318.39s |  deception effectively. Um and then we're gonna flip the coin over and ask well if we
318.39s - 324.35s |  understand offense really well what does that teach us about defense? Um are there counter
324.35s - 331.15s |  deception principles that we can derive uh that uh tell us how to uh fight deception?
331.15s - 336.77s |  And um the the deception and counter deception principles we're gonna cover are they're useful
336.77s - 340.91s |  in any context where this could be occurring. It could be useful for malware attribution
340.95s - 346.75s |  or in a security operations context. Um but you know this year's DEF CON is about engaging
346.75s - 351.19s |  with the internet um and so we're gonna spend the third part of the talk um trying to apply
351.19s - 356.19s |  some of these counter deception maxims and ask what sort of capabilities um you know is the
356.19s - 362.73s |  internet lacking that might be useful or might help us defend ourselves against uh deception
362.73s - 369.21s |  that we're facing? So um why are we talking to you guys about this? Like why is this relevant?
369.21s - 376.31s |  I think you you know hackers have the ability to identify fuckery better than like a lot of you
376.31s - 382.09s |  know general people. So you guys have a unique talent at that. Uh and uh um you know I I
382.09s - 386.53s |  also you know I mean I I listened to Cory Doctorow's talk last year which inspired this
386.53s - 392.09s |  year's theme and his talk yesterday. Um it's he's engaged in a very important discussion
392.09s - 398.17s |  about like policy issues um and uh I I think you know what I do is I write code and I break
398.17s - 404.47s |  code um and I wanna talk about you know how I can apply those skills uh um to engage with
404.47s - 410.01s |  this problem as well. So um you know hopefully uh um you you know we we we add to the discussion
410.01s - 418.71s |  a a new dimension. Um so uh Greg let's talk about deception. So deception's been around
419.09s - 424.99s |  for millennia and the key idea is that it's the act of hiding the truth to get yourself
424.99s - 431.69s |  an advantage. And what you're trying to do is influence your target to make an incorrect
431.69s - 438.47s |  decision, right? Or to take an action that you want or fail to take an action all to your
438.47s - 445.23s |  advantage. And we've seen examples from our five legged Trojan horse AI uh generative AI
445.23s - 451.01s |  delivers when you need a five legged Trojan horse. Um to the civil war where people painted
451.03s - 456.03s |  logs black to create the to try and fake cannons. To the um Cuban missile crisis hiding
459.61s - 464.61s |  medium range ballistic missiles and concealing them in uh ships. To the uh Persian Gulf War
467.01s - 473.25s |  where the invading Iraqis were concerned about an attack by the sea by the marines and
473.25s - 479.29s |  instead were surprised by an attack by land from the opposite direction. We see it in the
479.51s - 484.51s |  Russia-Ukraine conflict. The Ghost of Kiev uh which was a mythical fighter pilot ace fighter
487.65s - 493.15s |  pilot fighting the Russian aggressors over the city which was later you know proved to be a
493.15s - 500.59s |  deception operation. So we've seen this uh for millennia. And when we think about the
500.59s - 506.23s |  targets of deception humans are the first come first to mind. And you uh you know in
506.75s - 511.75s |  information security users uh you know things like phishing, typosquatting, domain mimicry,
513.29s - 518.29s |  spoofed login pages. But also experts, think malware analysts, false flags, fileless
520.17s - 525.17s |  malware, deceptive metadata, um let's uh code injection, rotating command and control
527.61s - 533.27s |  infrastructure. So specialists can be targets for deception as well. But more than that
533.29s - 538.05s |  it's not just the humans it's our code. So our code think malware detect uh detection
538.05s - 543.83s |  systems. People try and deceive that through fileless malware, polymorphic malware,
543.83s - 548.83s |  rotating command and control infrastructure. And as we move into the era of AI, AI is also a
550.77s - 555.77s |  deception target. Think poisoning the training data of the AI or jailbreaking techniques to
555.81s - 560.81s |  overcome safeguards that people put in place. And deception can occur at all levels. It can
564.85s - 570.43s |  occur at all levels of the network stack. It can also occur in thinking more broadly at the
570.43s - 575.43s |  tactical operational and strategic level. Uh the tactical level you're actively deceiving
576.97s - 581.97s |  someone you're engaged in conflict with. All the way up to strategic level where you try to
582.91s - 587.91s |  hide your basic you know national objectives, your intentions, your strategies and your
587.91s - 592.61s |  capabilities or put forth uh maybe to put forth an alternate reality that's more
592.61s - 597.63s |  beneficial. So humans process data through this idea of the DIKW hierarchy. We begin with
601.63s - 606.63s |  data and with by adding uh context we can create information, by adding meaning we can create
606.83s - 611.83s |  knowledge and we can by adding insight we can create wisdom. Well deception can poison our
614.37s - 619.37s |  ability to you know by poisoning the data that we can have incorrect information, knowledge,
620.61s - 625.61s |  wisdom that we think is entirely accurate. So deception poisons our ability to think. And it's a
629.59s - 634.59s |  professional discipline uh deception. Uh what we have here, the orange document is a uh
636.69s - 641.69s |  declassified CIA document uh that includes the deception maxims that we're going to uh be
644.39s - 648.63s |  discussing. And also there are manuals like this is the Department of Defense joint
648.63s - 653.81s |  publication on military deception. It comes out every few years updated. So this the key
653.81s - 658.81s |  takeaway here is it's a professional discipline. And looking at some of the maxims, we're
661.25s - 664.61s |  just going to run through these pretty quick and then we're going to flip them and show how
664.63s - 669.71s |  you might counter. But one of the most important is it's easier to maintain a preexisting
669.71s - 675.31s |  belief um in in your target than to force a change. Right? So if someone believes the world is
675.31s - 681.35s |  flat you can help encourage them to continue thinking the world is flat. But if you want to have
681.35s - 689.90s |  them think the world is round well that's much harder. So yeah I really think Magruder's
689.90s - 695.60s |  principle is sort of the golden rule of deception. It speaks to this like fundamental aspect
695.62s - 699.96s |  of human nature. Um you know say there's a politician you hate. There might be different
699.96s - 704.40s |  answers in the room for who that person is but everyone hates some politician right? And if I
704.40s - 708.50s |  walk up to you and I say well you know that politician you hate? Did you hear about the
708.50s - 713.94s |  stupid thing they did this morning? Whatever I say next, whatever it is, you're going to
713.94s - 719.42s |  believe it. Because it's aligned with what you already think and it feels good to be right.
719.48s - 726.24s |  Um and so uh if if any of you have read um Asimov's Foundation series, he has a really
726.24s - 731.18s |  good um model um I think of deception that he presents in those books. There are these
731.18s - 737.92s |  robots that can manipulate people's emotions. Um and uh they they're constantly explaining
737.92s - 742.20s |  that they can't radically change people's worldview. And the way that they function is
742.20s - 746.84s |  by trying to understand what that person thinks and identify some specific belief that they
746.86s - 753.06s |  have that they can emphasize or reinforce just enough to get that person to take an action
753.06s - 757.80s |  that they might have otherwise not taken. And I I think that's a really good representation
757.80s - 768.58s |  of like effective deception in a nutshell. So one of my favorites is the idea of exploiting
768.58s - 774.22s |  the limits of human and machine sensing uh and information processing. So you think we
774.22s - 780.12s |  have as humans have senses right? And that are limited and like known parameters of what
780.12s - 785.72s |  we can uh sense. And we have limitations in our ability to process information. Machines
785.72s - 790.36s |  do the same. They have sensors and they have information processing. So if you can exploit
790.36s - 794.96s |  those limits for example uh think self-driving cars. There's been some really interesting
794.96s - 799.26s |  talks that you can exploit the sensing and processing of a self-driving car and make
799.26s - 804.92s |  it think see things that aren't there. Uh in a heist movie uh where there's usually
804.92s - 811.82s |  a motion sensor and someone moves really really slowly to slip past the motion sensor.
811.82s - 818.26s |  That kind of thing. And a variation of that is here's a picture of an inflatable tank
818.26s - 824.68s |  from Ghost Army uh in World War II. It was a group of creatives uh and they were a formal
824.68s - 830.54s |  deception unit. And it's their ability to create inflatable tanks and fake enemy or
830.54s - 836.84s |  fake troop uh emplacements uh was because the capabilities of the time to sense what
836.84s - 841.28s |  was you know sense the environment. These tanks looked real from a distance. Now they'd
841.28s - 848.28s |  be uh they'd obviously be not. Um then uh the third maxim is uh Jones's dilemma when
848.64s - 854.16s |  uh the idea is that in this competitive information environment of competing narratives that if
854.16s - 858.84s |  you're going to try and deceive someone and you're you have to ideally have more false
858.84s - 865.84s |  sources than real. So it's this battle of uh quantity and quality of of competing narratives.
867.50s - 873.38s |  Another strategy is the idea that you want to carefully uh create a story. That you don't
873.38s - 877.98s |  just have single data points but you're putting puzzle pieces out there for the deception
877.98s - 883.14s |  target to connect together that tell the story that you want that you're trying to uh to
883.20s - 890.20s |  portray. Uh another is the idea of carefully designed um planned placement of deceptive
890.84s - 897.68s |  material. The idea is you want to make your target work for it. If you if uh think if
897.68s - 903.66s |  you wanted to have a fake diary in in your room right? If you leave it on their desk
903.66s - 910.12s |  that that is an obvious place and that could be like your um that probably what you want
910.12s - 915.24s |  to do is make it hard. Have a lock on it. Have it hidden in a ventilation duct. Have
915.24s - 920.82s |  it written in code. By the time they find that and they've unpacked all that then they
920.82s - 926.04s |  think this has absolutely got to be the real diary. And we see that in malware as well
926.04s - 930.38s |  right? That's certainly a strategy. If you make them work for it people will be more
930.38s - 935.22s |  likely to believe it. The flip side of this is an orgy of evidence where things are you
935.22s - 942.96s |  know many incriminating things are obviously found. Well that should raise suspicions.
942.96s - 947.70s |  So yeah Olympic Destroyer is a really good example of the use of of some of these techniques
947.70s - 953.24s |  in order to fool malware analysts as to attribution. Doing attribution on IOCs is fraught with
953.24s - 959.40s |  risk as with respect to uh you know the manufacturing of those IOCs. Um in this case uh there was
959.40s - 963.88s |  a rich header in a binary uh that uh you know captures information about the developer's
963.88s - 968.24s |  environment and they they literally copied a rich header from a Lazarus sample and put
968.24s - 973.44s |  it in their their sample. Um and so someone who knows rich headers and like uh has a collection
973.44s - 978.68s |  of them and knows that they can be used to uh you know attribute malware might find this
978.68s - 982.72s |  and you know be excited that they connected the dots right? And so now they're emotionally
982.72s - 986.88s |  invested in the idea that this is true. Um and uh you know they they go out with this
986.88s - 990.16s |  narrative and it turns out that in fact in this case the rich header didn't match the
990.16s - 997.04s |  rest of the binary and uh the attribution was completely deceptive. Um so again uh uh
997.04s - 1001.68s |  you know avoid uh if you're trying to protect yourself against deception situations where
1001.68s - 1008.63s |  you're emotionally invested in the consequences of your work.
1008.63s - 1015.19s |  So I particularly like this one uh Maxim 6A, 6B. There are two sides of the same coin.
1015.19s - 1021.55s |  The first is ambiguity. So the idea is you want to increase doubt in the person's mind,
1021.55s - 1026.67s |  in your target's mind by providing many possible truths. Okay? Makes sense? They're they they're
1026.67s - 1031.67s |  uncertain. There's this cloud of uncertainty. The flip side of that is you want to decrease
1031.67s - 1038.39s |  doubt and focus the target on a particular um falsehood. So you want them instead of
1038.39s - 1045.31s |  being in a sea of doubt, you want them absolutely positively sure that they're right uh or that
1045.31s - 1050.31s |  they're sure about this falsehood. They think that they you know that it's true. Another
1050.31s - 1057.59s |  idea is that in in professionalized deception that there's the idea of husbanding deception
1057.59s - 1062.75s |  assets. That there are always limited resources. You need to save them for the time and at
1062.75s - 1068.43s |  the best time and the best place to be effective. You can see that in cyber in uh information
1068.43s - 1073.91s |  security capabilities O day. Right? Uh but imagine if you had the ability to place deceptive
1073.91s - 1080.67s |  material on a web server. You can't if you use it you're using that capability uh and
1080.67s - 1084.51s |  you might not be able to use it again. So you save these for the time and place you
1084.51s - 1090.39s |  think will be most effective. Uh maxim eight is the idea of feedback. In a professional
1090.39s - 1097.43s |  uh deception operation organization the attackers are monitoring their target audience looking
1097.43s - 1103.55s |  for feedback that the deception has been believed. And they are also so they want that feedback
1103.67s - 1108.51s |  loop. Uh and they're also monitoring their friendly organization to see if they are being
1108.51s - 1116.92s |  deceived. All right so now that we've talked a little bit about the principles of effective
1116.92s - 1121.96s |  deception let's flip the coin over and talk about how you practice counter deception.
1121.96s - 1129.24s |  Um so uh um at a high level I think there are four um general ways to counter deception.
1129.24s - 1133.72s |  One is through intelligence collection. So if you're actually monitoring your adversary
1133.72s - 1137.32s |  and just watching them create their deception then you know exactly what they're doing and
1137.32s - 1142.36s |  why they're doing it and what the truth is. Right? Um and the U.S. Cyber Command has this
1142.36s - 1148.20s |  defend forward uh um uh uh concept which has to do with like just going out and directly
1148.20s - 1151.72s |  spying on the people that are committing the acts so that you know exactly what they're up to.
1151.72s - 1156.84s |  Um another thing you could do not we don't always have intelligence capabilities um is
1156.84s - 1162.68s |  disruption. Um if uh so we talked about husbanding assets if uh you know someone has to go to a
1162.68s - 1168.92s |  certain effort to inject um deceptive narratives um you know in places and and you can take action
1168.92s - 1173.88s |  to to interfere with their capabilities um then that prevents them from being successful.
1173.88s - 1177.56s |  Um a simple example is like if they have to build a botnet in order to spread something
1177.56s - 1181.40s |  online and you're able to take the botnet down then you're interfering with their deceptive
1181.40s - 1188.04s |  capability. Um another thing you can do is is analytic. Sometimes that's your only option.
1188.04s - 1191.88s |  Um you're looking at the information you're collecting and you're critically analyzing it
1191.88s - 1196.04s |  in order to figure out whether or not it's deceptive. Um and a lot of our talk will focus
1196.04s - 1200.36s |  on that because that's often the only option that you've got. Um another thing you can do
1200.36s - 1206.92s |  is deterrent. So if you can if you can demonstrate uh that the deception will not be effective um
1206.92s - 1213.24s |  perhaps your adversary will not bother to do it. Um so uh in let's talk a little bit about
1213.24s - 1220.84s |  analytic processes. Um in InfoSec we're really good at devil's advocacy. Right? Um and so this is
1220.84s - 1225.56s |  the same thing. It's about playing devil's advocate with respect to things that you are
1225.56s - 1230.36s |  that you are deciding or that you believe. Um and uh you have to have the discipline to do that and
1230.36s - 1235.16s |  that's one of the hardest things about it. Um but uh you know if you have a belief or
1235.16s - 1241.16s |  intelligence related conclusion and there's a set of um facts that underpin that belief
1241.16s - 1246.04s |  you can look at each of those facts and ask yourself how hard would it be for my adversary
1246.04s - 1251.64s |  to simulate that fact? Am I am how many ways have I measured that? Um you know like is it
1251.64s - 1257.48s |  possible to fake that? Uh and um you know even in malware attribution you know a rich header is easy
1257.48s - 1262.52s |  to fake. Uh you know maybe uh you know could they get access to a particular source IP address or
1262.52s - 1269.00s |  how hard would that be uh for them to to simulate in order to fool me? Right? Um so let's talk about
1269.00s - 1273.88s |  some of the deception maxims and I'm gonna sort of flip them around and um and create counter
1273.88s - 1278.68s |  deception maxims based on them and I kind of organized them into categories. So the first
1278.68s - 1287.24s |  category uh is um maxims that suggest when deception may be present. So your human intuition
1287.24s - 1292.60s |  is both an asset and a liability when you're dealing with deception. This is the context where
1292.60s - 1299.16s |  it's an asset. You want to develop a kind of spidey sense that tells you things aren't quite right
1299.16s - 1306.28s |  here. It this looks fishy and that might prompt you to dig deeper um and explore the hypothesis
1306.28s - 1310.44s |  that what you're seeing might be a deception. Um so for example we've talked about carefully
1310.44s - 1317.48s |  sequencing um events to tell a story so it builds up in the target's mind. Um so flip that over,
1317.48s - 1321.24s |  what happens if there's all kinds of evidence that gets disclosed all at once? If you find
1321.24s - 1326.44s |  the diary sitting out on a table where it shouldn't be um you know that might be a sign to you
1326.44s - 1331.48s |  that like hey someone's trying to you know manipulate me that the this is this is possibly
1331.48s - 1337.96s |  deceptive right. Um so the the person operating the deception must either do ambiguity or
1337.96s - 1342.76s |  misdirection and in each case we can try to counter that right. So if they're engaged in
1342.76s - 1348.60s |  the ambiguity deception there's going to be a lot of narratives that are available right and if you
1348.60s - 1353.88s |  see multiple narratives then that might be a sign uh that deception is taking place. That some of
1353.88s - 1357.72s |  these narratives are simulated um that was certainly the case with Olympic Destroyer.
1357.72s - 1361.96s |  There were a bunch of organizations that had different attribution that they were publishing
1361.96s - 1367.16s |  um and and that's because the malware was intentionally sort of misleading analysts
1367.16s - 1373.16s |  into thinking that that that different narratives were correct. Um misdirection in a misdirection
1373.16s - 1377.48s |  deception the attacker is trying to get you to believe a particular thing which is false
1378.12s - 1383.08s |  and so um if you analyze it carefully perhaps you can discover that it's not true.
1384.20s - 1389.48s |  The the plus minus rule is this idea that nothing that is an imitation or a simulation can be
1389.48s - 1394.84s |  exactly the same as the real thing otherwise it is real and so identifying those characteristics
1394.84s - 1401.96s |  which are added or removed from the uh from the thing it helps you identify that it is deceptive
1401.96s - 1406.04s |  and again you have to have the discipline to say okay this isn't right it's incongruent and
1406.04s - 1414.63s |  therefore I must accept that it is not real. The place where your human intuition operates against
1414.63s - 1419.67s |  you has to do with mental discipline. Humans are really good at jumping to conclusions based on
1419.67s - 1423.67s |  not necessarily enough evidence. We kind of have to do that in order to function in the
1423.67s - 1430.07s |  complicated civilization that we have but um you know that's how uh deceptive deceptive operations
1430.07s - 1434.23s |  get you and so you kind of have to have the discipline to slow down and not listen to
1434.23s - 1439.83s |  sometimes to your intuition. Um so this is Magruder's principle is is the the biggest one
1439.83s - 1445.43s |  here. It's important to apply the same critical analysis to facts that support your assumptions
1445.43s - 1449.03s |  that you do to facts that challenge them and that's really hard for people to do.
1450.23s - 1454.55s |  You know also with respect to carefully designed placement of deceptive material don't assume the
1454.55s - 1459.27s |  fact is true just because you had to work hard to get it. Ask yourself could the adversary have
1459.27s - 1464.87s |  simulated that. I love this quote from a book on professional counter deception operations.
1465.83s - 1472.95s |  The vulnerable mind fits ambiguous information to its own preconceptions and expectations.
1472.95s - 1476.47s |  I think that's a really clear statement of vulnerability to deception.
1480.66s - 1486.98s |  So humans are not that complicated which part of the problem right. Psychologists have been studying
1486.98s - 1493.70s |  uh biases in humans for for hundreds of years and I have a list of examples here and if you're
1493.70s - 1499.70s |  wondering the prompt was humans swimming in a sea of piranha that was the prompt that gave us that.
1500.82s - 1507.30s |  But I wanted to highlight two. One is the idea of selection bias and just one instance of selection
1507.30s - 1515.38s |  bias is where you can choose from a variety of facts truths to paint a picture but you don't
1515.38s - 1519.70s |  share all the truths you're just selecting certain truths and I think we see that in many news
1519.70s - 1525.94s |  agencies today. A lot of what they say is true but which ones they choose paint a picture. So
1525.94s - 1532.26s |  that's selection bias. Confirmation bias sounds a lot like McGruder's principle. The idea that
1533.14s - 1539.46s |  we are biased toward things that already can reinforce our preconceived beliefs.
1543.20s - 1551.20s |  So the third set is maxims that suggest methods of preventing deception. So the two maxims that
1551.20s - 1556.00s |  have to do with the limits of human and machine sensing and information processing like speak to
1556.00s - 1562.32s |  the need to be able to measure reality from multiple perspectives. You know and think about
1562.32s - 1566.88s |  this on in a technical sense if you if you're in a security operations function and you have sensors
1566.88s - 1571.92s |  out there that like look at your network you know if there's only one kind of a particular sensor
1571.92s - 1577.12s |  then that sensor could be its data source could be manipulated it could be be presented with false
1577.12s - 1582.08s |  facts. If you've got multiple ways of looking at the situation then it gets harder and harder for
1582.08s - 1585.84s |  the person that's operating the deception to fool all of the sensors that you have.
1587.44s - 1592.56s |  With respect to husbanding deception assets again deception operations professional ones
1592.56s - 1598.48s |  involve effort and resources and if you can disrupt and target those capabilities then you
1598.48s - 1604.16s |  can undermine the ability for them to be successful. Feedback is also interesting. A professional
1604.16s - 1608.64s |  deception operation is going to be watching you to determine how you behave. You may choose to
1608.64s - 1612.48s |  behave as if the deception was effective because you don't want the deceiver to know that you were
1612.48s - 1619.60s |  not deceived. You may also choose to to show the adversary that you are debunked that you are
1620.16s - 1624.72s |  aware of their deception which is a deterrent method. One of the things that you know folks
1624.72s - 1629.76s |  in DHS and CISA are talking about is pre-bunking. So we think that this deceptive narrative is going
1629.76s - 1634.64s |  to be placed out there so in advance we're going to go ahead and explain to everyone that it's false
1634.64s - 1638.64s |  so that you know people just don't bother trying to push that narrative in the first place.
1640.48s - 1646.32s |  So in developing this set of trustworthy sources of data like when we're looking at things on the
1646.32s - 1652.56s |  internet it's really important for us to you know collect different places where we can get
1652.56s - 1659.52s |  different points of view that are credible and objective. And so like curating collections of
1659.52s - 1664.80s |  experts I think is really important and but also a weakness that we have is we have a tendency to
1664.80s - 1670.24s |  believe experts who you know are telling us what we already think and so we have to find objective
1670.24s - 1678.64s |  criteria for evaluating who we want to listen to. And so I think this is a real challenge like even
1679.20s - 1686.72s |  with respect to experts, experts sometimes deceive us right. So let's say there's a set of facts one
1686.72s - 1693.92s |  two three four and five and they add up to a conclusion which is 15 right. So what I can do
1693.92s - 1700.48s |  is I can present you some of those facts one two and three and a conclusion which is six. Each one
1700.48s - 1705.60s |  of the facts I've presented to you is absolutely true and the conclusion I'm presenting to you is
1705.60s - 1711.04s |  a natural consequence of the facts that I've presented right. So when you're listening to an
1711.04s - 1715.84s |  expert the challenge is that you depend upon them not just to tell you what the conclusions are but
1715.84s - 1721.20s |  also what the underlying facts are to educate you about the issue. And so you're vulnerable to the
1721.20s - 1725.92s |  fact that that without knowing more than they do about the subject that you can't see the other
1725.92s - 1732.00s |  facts that they're omitting that may lead you to a different conclusion. And so you know I
1732.56s - 1737.68s |  one of the things that people wring their hands about a little bit is journalistic objectivity.
1737.68s - 1741.60s |  There's this idea that like in the American civilization in particular where we have two
1741.60s - 1746.96s |  political parties that what should happen is that journalists should present both sides and we know
1746.96s - 1752.16s |  that like getting both of these perspectives does not get us closer to the truth right. And so
1752.16s - 1757.60s |  perhaps there's this role for journalism as a professional resource that goes out and finds
1757.60s - 1762.88s |  the other facts that are missing and adds them into the equation to get the complete truth right.
1763.68s - 1766.96s |  This is something that people have been talking about for a very long time. This is not an
1766.96s - 1772.80s |  internet problem. Walter Lippman was writing about this stuff in the 1920s and he had these
1772.80s - 1779.76s |  interesting ideas about what journalism could be but then he also you know he he was he was
1779.76s - 1785.12s |  concerned that it won't be that because the business model of newspapers doesn't support
1785.12s - 1790.48s |  this kind of work and and if if the news media isn't going to go out and find the additional
1790.48s - 1796.32s |  facts for me my question is can my computers do that? Can I can the internet give me the facts
1796.32s - 1801.52s |  that I need in order to objectively understand reality? And so that relates to the third part
1801.52s - 1807.92s |  of our talk and our call to arms. You know like hackers have an independent view of reality that's
1807.92s - 1812.96s |  somewhat outside of mainstream thinking and that enables you to see things with different eyes.
1813.92s - 1818.08s |  There are interesting capabilities and I'm going to talk about some examples of them
1818.64s - 1825.12s |  that might be useful to people to help combat deception and disinformation and I think also
1825.12s - 1831.44s |  we're we're tool makers and breakers and so you know I think we we're not entirely cynical about
1831.44s - 1840.00s |  the value that new tools can can bring. So I'm going to focus on four areas. One area it's just
1840.00s - 1844.00s |  something that I need to mention it's that model the adversary's capabilities and neutralize them.
1844.00s - 1849.04s |  I've mentioned that several times. There's been tremendous work over the years here at DefCon in
1849.04s - 1853.84s |  the misinformation village and there's also this thing called a disarm framework which is essentially
1853.84s - 1859.52s |  a kill chain for internet you know botnets and deception operations. This is fantastic work. We
1859.52s - 1863.76s |  love it and you know I want to endorse it here. There's lots of things that people can do in that
1863.76s - 1868.32s |  area. Because there's so much going on in that space we're not going to delve deeper into it.
1868.88s - 1874.08s |  We're going to focus on some other stuff. Particularly building tools for information
1874.08s - 1880.48s |  triangulation. You know knowing like when questions have been raised about what we're reading
1881.20s - 1885.60s |  and identifying and collecting those that network of experts that you can use to
1885.60s - 1892.08s |  determine whether or not something is real. So a really simple example I want to include because
1892.08s - 1896.48s |  it's a project that was the first one wiki scanner was a project that was done by somebody in this
1896.48s - 1901.28s |  community. It was a it was a small focused project and it had interesting consequences.
1901.28s - 1905.52s |  So it shows that like you can do some hacking over a few weekends and make something useful.
1906.40s - 1912.40s |  So wiki scanner looked for anonymous edits to Wikipedia and checked the you know like who is
1912.40s - 1916.64s |  information associated with the IP address and identified situations where people were editing
1916.64s - 1922.08s |  Wikipedia anonymously from the IP blocks assigned to large organizations. And so you could kind of
1922.08s - 1927.36s |  see what narratives were being pushed in Wikipedia by certain large orgs. There were certainly
1927.36s - 1932.96s |  interesting results that came out of that analysis. By the way it's mothballed. Somebody else made a
1932.96s - 1937.44s |  thing called wiki watchdog. The source code is available for that but it's also mothballed.
1937.44s - 1942.32s |  So like this is a thing anyone in this room could pick up and you know you know do something with
1942.32s - 1948.64s |  immediately and there are interesting results to be found. Sticking to the topic of Wikipedia
1948.64s - 1955.84s |  briefly the idea behind Wikipedia is that with enough eyes all bugs are shallow right. So you
1955.84s - 1960.56s |  know everyone's reading this article and they're removing fake things from it and so we get this
1960.56s - 1965.92s |  objective truth. The problem with it is that when you visit a page it might have been edited two
1965.92s - 1971.84s |  seconds ago by someone pushing an agenda and you can't really tell right. So I wrote a paper
1971.84s - 1978.32s |  in 2006 in which I suggested that we highlight passages that are new so that when you're reading
1978.32s - 1981.76s |  the article you can kind of tell which passages are less trustworthy because they haven't gone
1981.76s - 1986.24s |  through that editing process. There were some academics that built a thing called wiki trust
1986.88s - 1992.88s |  which like implemented a very similar set of ideas and with some added analytics underneath and
1992.88s - 1997.76s |  it was usable for a while. So this is kind of an interesting thing and this is also mothballed. I
1997.76s - 2003.92s |  believe in this set of ideas and there's work to be done in this area but I'm also I like the
2003.92s - 2008.32s |  high-level concept that maybe my computer should tell me when I should be careful about what I'm
2008.32s - 2015.12s |  reading because some objective objective criteria suggests that you know this information might not
2015.12s - 2023.36s |  be reliable right. So I want to return to some of the like core information resources that inspired
2023.36s - 2030.24s |  the creation of the web because there's a whole lot of ideas in here for things that we don't have
2030.24s - 2036.96s |  today and it's a way of seeing the negative space in the internet. So the first resource here is a
2036.96s - 2042.88s |  paper called As We May Think by Vannevar Bush. So Vannevar Bush was the guy that ran all defense
2042.88s - 2048.56s |  related research during World War II. So he was an incredibly important guy. He wrote a paper in
2048.56s - 2053.92s |  the 40s which might be the most important academic paper of the 20th century and it's
2053.92s - 2060.48s |  about using microfiche to create to link documents together and create knowledge management systems.
2060.48s - 2064.48s |  This guy's got a camera on his head because he imagined he wanted to take screenshots of books
2064.48s - 2069.60s |  he was reading and so he imagined having a camera in his head so he could screenshot documents right.
2069.60s - 2076.00s |  So it's it's weird tech but the ideas are super interesting and he you know had a lot of influence
2076.00s - 2081.12s |  over to other people who are incredibly important. One is Douglas Engelbart. Douglas Engelbart gave
2081.20s - 2085.04s |  the mother of all demos in which like he demonstrated things like mice and modems
2086.08s - 2092.64s |  at Stanford University in the 60s. He wrote a book about augmenting human intelligence and one of his
2092.64s - 2097.68s |  sort of precepts is that computers will always augment human intelligence better than they can
2097.68s - 2103.68s |  replace it and that is an idea that I think is it makes sense to remember these days given all
2103.68s - 2107.20s |  everything that's going on with AI and also I think social media companies sometimes forget
2107.20s - 2112.16s |  that the purpose of computers is to make us smarter. If you forget that you'll make the wrong
2112.16s - 2121.12s |  things. So Ted Nelson is the guy who coined the term hypertext. He did so it first appears in
2121.12s - 2125.76s |  print in this book which is called Computer Lib. It's an extra large book that's hand
2125.76s - 2131.92s |  written and illustrated in like a zine. It's a really interesting document and you can buy a
2131.92s - 2139.20s |  copy of it. They've got it printed again. A scholarly read through these three resources
2139.20s - 2144.56s |  will reveal a whole lot of ideas that these people had for things that the internet should do
2144.56s - 2150.48s |  that the internet does not yet do. Late in Engelbart's life he was sort of frustrated with
2150.48s - 2154.64s |  the web and like felt like it didn't achieve its potential and Ted Nelson is still ranting about
2154.64s - 2160.24s |  that on YouTube and you can find him doing so. So if we look at some of the stuff that these guys
2160.24s - 2165.84s |  did. So Xanadu is Nelson's project. Hyperscope is something that the Douglas Engelbart Institute
2165.84s - 2169.92s |  has been working on to try to implement some of his ideas. There's a bunch of things in there
2169.92s - 2174.24s |  that we don't have today and it's interesting to think or maybe we do but only in narrow
2174.24s - 2178.80s |  limited context right. So it's interesting to think about like what would it take to make this
2178.80s - 2184.72s |  a part of the internet. You know why don't we have it. In the context of deception and
2184.72s - 2189.68s |  counter deception I'm particularly interested in backlinks. All these guys wanted backlinks. So
2190.24s - 2195.52s |  web document can link out to another document from a phrase. In their systems also when you're
2195.52s - 2201.36s |  reading a document you can see which people link in and what phrases they link into. So you can
2201.36s - 2206.40s |  see if someone built upon the ideas that you're reading and you can also see if someone is
2206.40s - 2211.84s |  criticizing the thing that you're reading. Why don't we have that in the internet? Well the
2211.84s - 2218.08s |  answer is that it's a content moderation problem. If anybody could annotate a web page in any way
2218.08s - 2224.40s |  that they wanted then we'd have a bunch of spam and abuse right. And so we need to think about the
2224.40s - 2228.72s |  tools that we've built for managing content moderation and see if we can couple them to
2229.68s - 2233.60s |  backlinking in order to create something that's useful. There have been some interesting projects
2233.60s - 2238.64s |  over the years that played around with backlinking either in narrow context or you know to varying
2238.64s - 2244.00s |  degrees of success. You know I think a key thing here is that all opinions are not created equal.
2244.64s - 2249.44s |  There are certain opinions again I've curated my experts whose opinions that matter to me.
2249.44s - 2253.92s |  Those are the ones that I want to see. So when I choose to follow somebody on social media
2253.92s - 2259.20s |  I'm indicating that what they say is relevant to me even if I don't agree with it right. So I've
2259.20s - 2264.80s |  selected that group. It would be useful to me if I could see anytime I'm viewing a document if those
2264.80s - 2272.32s |  people have ever commented on it right. I'd love to build that. A challenge that we face is that
2272.32s - 2278.08s |  in order to build and innovate on top of our social media systems we need systems that are
2278.08s - 2286.64s |  technically financially and culturally open to innovation. And unfortunately many of the systems
2286.64s - 2292.72s |  that we collectively use like fail at one or more of those criteria and therefore it makes it
2292.72s - 2297.76s |  difficult for people to create new things that sit on top of them. And we need to create new things
2297.76s - 2304.56s |  in order to make the internet better. So I've talked about curating collections of experts.
2305.20s - 2311.68s |  There are some interesting protocols that exist that people have built over time for endorsing
2311.68s - 2316.72s |  people. Like I really like LinkedIn endorsements not as a tool but as a concept. You know you can
2316.72s - 2323.60s |  say I follow this person and this is why right. But unfortunately that's a closed system. Some
2323.60s - 2328.24s |  of these things out there aren't machine readable. You know I think it would be cool if I when I'm
2328.24s - 2332.80s |  following somebody on social media if I could say why. And that endorsement sticks to them if they
2332.80s - 2339.12s |  accept it. And as long as I continue to follow them. And if we did that then I could do this.
2339.12s - 2344.96s |  I could say who do the people I follow follow who are endorsed for this particular thing like law.
2345.52s - 2350.24s |  And I could get back a list of a bunch of people who are endorsed for this particular topic. And
2350.24s - 2355.28s |  I could ask what are these people saying about this thing right. It gives me the ability to sort
2355.28s - 2361.28s |  of like you know identify the reputation of people on the internet and utilize that in
2361.28s - 2368.08s |  constructive ways to help me figure out what's real. So I think there are lots of there's lots
2368.08s - 2374.08s |  of work to be done in that space. There's lots of like open potential there. Another area is LLMs.
2374.88s - 2380.48s |  You know LLMs have some built in biases. There's challenges dealing with them. They hallucinate.
2380.48s - 2385.84s |  So there's lots of caveats to what I'm saying here. And I know what they are. But at the same
2385.84s - 2391.68s |  time it is a dispassionate computer right. So can it go out and find those missing facts for me
2391.68s - 2398.24s |  that aren't included in a narrative by reading all the things right. And dispassionately present
2398.24s - 2403.84s |  them to me. That's a potentially interesting thought. And I think it's harder than it sounds.
2404.72s - 2410.64s |  But you know there are other things we could do with LLMs. I you know one of the things is that
2410.64s - 2414.88s |  that I mentioned on the last page is that there are like if you're a university professor at an
2414.88s - 2420.08s |  accredited university in a particular subject area your university website indicates that like this
2420.08s - 2424.96s |  guy is the professor of this right. But then your social media profile there's it's not machine
2424.96s - 2430.72s |  readable. Your university website is not machine readable. I can't tell you know automatically that
2430.72s - 2437.36s |  you have this expertise. But an LLM could go read every university website find all the professors
2437.36s - 2442.56s |  find all their social media profiles and created a machine readable you know system that allows me to
2442.56s - 2448.24s |  again ask this question who knows lots about economics. Here they are right. And so I think
2448.24s - 2453.28s |  that those are interesting possibilities. LLMs are really good at turning human unstructured
2453.28s - 2457.60s |  information into like very structured information that's machine readable and we can do things with
2457.60s - 2466.80s |  it. Greg? So beyond these technical solutions we have to think like how can we scale this
2467.76s - 2474.96s |  so for humans right. One is the idea of teaching media literacy in schools to try and have a better
2474.96s - 2481.60s |  informed consumers of information. Media literacy now who I have highlighted here they have a nice
2481.60s - 2488.64s |  depth of resources from K through 12 for for classroom instruction. And the other idea is to
2488.64s - 2494.16s |  emphasize critical thinking both in school and in our day-to-day lives. And this is from and I can't
2494.16s - 2500.08s |  quite see it just in right. The idea there are certain questions we ask that we ask and help us
2500.08s - 2507.20s |  probe through and see through deception. One is who benefits right. Where did this originate. There's a
2507.20s - 2514.80s |  48 questions here and they're very thought-provoking and useful. Yeah so we've put a bunch of references
2514.80s - 2520.72s |  in the slides you know which are like look at this from a bunch of different perspectives.
2520.72s - 2525.92s |  I'm sure that there are ideas that you have that relate to maybe the principles that we've
2525.92s - 2530.64s |  articulated that are different from the ones that I've come up with. And that's what I'm excited
2530.64s - 2536.72s |  about and why I wanted to talk to all of you about this. So hopefully you know somebody out there has
2536.72s - 2542.32s |  been maybe inspired to work on something. And you know there's there's lots more to read about all
2542.32s - 2547.84s |  of this stuff. You know these are our email addresses. You know we'd love to hear from you.
2547.84s - 2552.96s |  We're going to be hanging out outside after the talk is over. So if you want to talk to us or
2552.96s - 2557.76s |  poke at some of the things we're saying we'd love to talk to you more. And again I really appreciate
2557.76s - 2563.04s |  your time and attention this morning. And the fact that you made it here on the last day of
2563.04s - 2568.00s |  DEF CON for a morning session. Thank you.


url: https://www.youtube.com/watch?v=GdeKrNlvG8g
title: DEF CON 32 - DEF CON Closing Ceremonies & Awards
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=GdeKrNlvG8g",
  "title": "DEF CON 32 - DEF CON Closing Ceremonies & Awards",
  "description": "The full closing ceremonies presentation from the final day of DEF CON 32.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 8067,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 75.42s | This text was transcribed using whisper model: large-v2

 I have had nightmares about this day not happening.
75.42s - 78.18s |  So to be here is a huge, huge relief.
78.18s - 81.26s |  And this is how I know my goons love me.
81.26s - 84.78s |  I was saying, you know, I've drank very little water the whole day.
84.78s - 85.78s |  I'm really dehydrated.
85.78s - 87.54s |  And they said, hey, no problem.
87.54s - 90.74s |  Got you covered with a Corona.
90.74s - 92.26s |  So good.
92.26s - 93.78s |  It's nice to be looked out for.
93.98s - 97.58s |  Hey, welcome to the closing ceremonies for DEF CON 32.
97.58s - 99.06s |  Show of hands.
99.06s - 101.50s |  Who has never been to a closing ceremony?
101.50s - 104.70s |  Oh, you're in for a treat.
104.70s - 110.54s |  Make sure you have a pea cup, because this thing goes long.
110.54s - 114.26s |  So let's get this going.
114.26s - 119.18s |  So the closing ceremonies, we kind of always start on a serious note.
119.18s - 122.42s |  And then we go in for the lulls.
123.06s - 127.78s |  The serious note is we really need to acknowledge the contributions
127.78s - 130.78s |  of those who came before us.
130.78s - 134.06s |  I think we are all standing on the shoulders of giants.
134.06s - 136.78s |  And we all don't live forever.
136.78s - 138.62s |  And so people in our community, I think,
138.62s - 142.66s |  are really big about giving back and contributing to others.
142.66s - 146.66s |  So what I want to do is just have a moment of silence.
146.66s - 149.14s |  I don't care who you think about or what you do.
149.18s - 152.06s |  But just reflect about those people that
152.06s - 156.62s |  helped you get to where you are now so they live on in your memory.
156.62s - 169.54s |  So we're just going to take a moment here.
169.54s - 178.10s |  All right, now we're going to think about all the cool shit we've done.
178.10s - 181.34s |  So the theme for this year was engage.
181.34s - 184.86s |  And it could mean many things to many people.
184.86s - 187.38s |  But for us at DEF CON, it really forced us
187.38s - 191.34s |  to try to move forward some thoughts that we've had for a long time.
191.34s - 193.78s |  And so this year, we launched two projects
193.78s - 198.26s |  to try to engage the community in different ways.
198.26s - 200.14s |  We don't know if it's going to work.
200.14s - 203.14s |  We don't know if it's going to fail spectacularly.
203.14s - 207.02s |  But sometimes failing is its own way of learning.
207.02s - 210.54s |  So the first thing we're trying is the DEF CON Franklin initiative.
210.54s - 213.90s |  And the idea here is to decide or learn,
213.90s - 217.86s |  is there a way to create sort of on ramps for those of us
217.86s - 221.58s |  who want to try to help protect critical infrastructure,
221.58s - 222.94s |  protect water systems?
222.94s - 226.06s |  And we're trying to create a sort of Rolodex matchmaking
226.06s - 230.74s |  system between those who want to help and those who need help.
230.74s - 232.66s |  And we'll start with water systems.
232.66s - 234.38s |  And if we get some good lessons learned,
234.38s - 238.26s |  we're going to maybe try it with education, with school systems.
238.26s - 241.18s |  And if it doesn't work, we're going to write that up.
241.18s - 244.98s |  And if it works, we're going to write that up and hope people duplicate it.
244.98s - 247.50s |  And the second initiative is the DEF CON Academy
247.50s - 251.18s |  done by the Pone College crew, Shellfish.
251.18s - 256.34s |  And the idea here is, how do we really help accelerate your learning?
256.34s - 259.10s |  So instead of getting to a certain skill level in seven years,
259.10s - 261.26s |  maybe you can get there in five or four years.
261.26s - 263.38s |  And it's going to take a lot of the lessons learned
263.38s - 265.82s |  from Pone College and other things.
265.82s - 268.06s |  And so this year, we're going to rough it out in beta.
268.06s - 269.94s |  And by next year, we're going to have the full launch.
269.94s - 272.30s |  And so if you see announcements throughout the year
272.30s - 275.02s |  as we're testing things out, please help out.
275.02s - 277.42s |  So those are two of our ways of trying to get the community
277.42s - 280.50s |  involved and trying to advance your skill level.
283.30s - 286.66s |  Finally, also for Engage, the DEF CON social Mastodon server
286.66s - 289.18s |  continues to run.
289.18s - 292.74s |  It's really fascinating to see the fragmentation in social media.
292.74s - 297.90s |  And it seems like across all platforms, there's reduced activity.
297.90s - 300.66s |  I don't know if it's people are just burned on social,
300.66s - 305.66s |  or it's too much different ways in which we can engage with each other.
305.66s - 311.34s |  But I think we're kind of into this post-COVID long haul.
311.34s - 313.90s |  And it's nice to have a little safe harbor.
313.90s - 317.22s |  We moderate DEF CON social with our code of conduct.
317.22s - 320.18s |  So if you kind of like the way that we try to enforce things here,
320.18s - 323.38s |  we try to do the same online.
323.38s - 326.42s |  So finally, the profit.
326.42s - 339.37s |  If you're in the room, we've created our Uber Contributor Award.
339.37s - 342.09s |  This is the third year we've done it.
342.09s - 343.73s |  And what we're trying to do here is we're
343.73s - 349.01s |  trying to hold out, as an example to the community, people we respect,
349.01s - 352.37s |  people with years or decades of contributing
352.37s - 357.21s |  to the community selflessly.
357.21s - 360.57s |  I first met the profit, I don't know, 30-something years ago
360.57s - 363.19s |  in the DEF CON VoiceBridge, I believe.
363.19s - 365.85s |  And so we've created these awards.
365.85s - 370.81s |  And I think we have what's written on it, right?
370.81s - 373.73s |  There's only so many characters we can have imprinted on these things, right?
373.73s - 375.29s |  I met him when he was a freaker.
375.29s - 378.21s |  He's a longtime writer for 2600 Magazine.
378.21s - 379.25s |  He's an educator.
379.25s - 380.37s |  He's a DJ.
380.37s - 382.29s |  And he really empowered.
382.29s - 385.57s |  And also, TeleFreak Challenge, QueerCon, you know,
385.57s - 388.73s |  it just goes on and on, his contributions over the decades.
388.73s - 391.37s |  So if you're here, profit, I think we somehow
391.37s - 395.61s |  tried to trick you into coming here without telling you what it was about.
395.61s - 396.09s |  Where is he?
396.09s - 398.61s |  Get the fuck up here, man.
398.61s - 399.57s |  Come on down.
399.57s - 410.26s |  Thank you so much.
410.26s - 412.18s |  You want to say something?
412.18s - 412.74s |  Say something.
416.30s - 417.14s |  Hi.
417.14s - 418.50s |  Wow.
418.50s - 422.10s |  So yeah, this is my 32nd DEF CON.
422.10s - 425.94s |  And I love this place, this community.
425.94s - 428.70s |  This is a magical community.
428.70s - 433.14s |  And anything you can dream can happen, because I've dreamed a lot of things
433.14s - 435.42s |  and then they've happened here.
435.42s - 440.18s |  I really hope that we can continue doing this incredible thing.
440.18s - 450.12s |  Thanks so much.
450.12s - 454.12s |  Also, I think profit might have been the first person
454.12s - 457.08s |  to actually get his award.
457.08s - 460.84s |  Because last time, I think Kingpin was gone.
460.84s - 463.08s |  Richard Dean was gone.
463.08s - 464.20s |  Oh, Wynn Schwartau.
464.20s - 466.24s |  Wynn was the first to pick his up, yeah.
466.24s - 467.68s |  He didn't see it coming either.
467.68s - 469.84s |  It was great.
469.84s - 473.44s |  OK, so this next one is something we've never done before,
473.44s - 477.96s |  which is for an organization instead of an individual.
477.96s - 479.72s |  You can guess who that might be.
479.72s - 498.18s |  The Electronic Frontier Foundation.
498.18s - 500.18s |  Thank you all so much.
500.18s - 501.62s |  What an amazing conference.
501.62s - 506.06s |  And we're so honored to have been a part of DEF CON for over 20 years now.
506.06s - 507.18s |  I think we've been coming.
510.74s - 512.74s |  Yes, hold it outwards.
512.74s - 514.66s |  Thank you all so much for all of your support.
514.66s - 519.46s |  This year, we've raised $130,000, helped speakers stay on stage,
519.46s - 527.05s |  and we're so honored to be a part of this community.
527.05s - 530.61s |  And we think that security research makes the world better for everyone.
543.05s - 546.17s |  OK, so now we're going to talk a little bit.
546.17s - 547.25s |  Mark, come on down.
547.25s - 549.37s |  We're going to talk a little bit about what we've
549.37s - 554.37s |  been wearing around our neck, the DEF CON badge.
554.37s - 556.25s |  Come on.
556.25s - 559.01s |  You can use this or the microphone.
559.01s - 561.98s |  Hi.
561.98s - 565.18s |  Hi, so it's amazing seeing you all wearing the badge,
565.18s - 569.86s |  and all the lights glowing, and the SAOs, and it's super cool.
569.86s - 572.22s |  OK, so I want to thank Team Cat Ball.
572.22s - 576.22s |  I did the concept design and coordination of the badge effort.
576.22s - 578.50s |  Bonnie Finley, 3D modeling, game art and dev.
578.50s - 580.70s |  Chris Maltby did plug-ins and game development.
580.70s - 587.30s |  He also created GB Studio, which is what we use to develop the game.
587.30s - 589.90s |  Nutmeg Ann on game development.
589.90s - 592.18s |  Will Tuttle, concept and narrative collab.
592.18s - 594.54s |  Ada RW, my kiddo over there, actually made one
594.54s - 595.86s |  of the characters on your badge.
595.86s - 600.14s |  It's a little dragon, if you wanted to play that one.
600.14s - 602.94s |  Huge thanks to Raspberry Pi for the hardware.
602.94s - 606.74s |  Entropic with Dimitri, GR for hardware development, firmware,
606.74s - 607.86s |  and emulator.
607.86s - 611.46s |  Joe Grand for hardware support and production testing.
611.46s - 614.54s |  Legion 303, music and sounds, which don't work on your game,
614.54s - 618.70s |  but they do work on the badge hardware itself.
618.70s - 620.90s |  And ICSN for manufacturing.
632.84s - 635.64s |  I really wanted to do something that was accessible,
635.64s - 637.80s |  because when I got into the scene,
637.80s - 640.00s |  I'm not a hardware engineer myself.
640.00s - 642.48s |  And so I wanted something that was really accessible
642.48s - 643.96s |  that anybody could play with.
643.96s - 646.16s |  So I reached out to Raspberry Pi.
646.16s - 648.40s |  So there's many layers on this badge
648.40s - 651.16s |  that you can get involved with, down to just like,
651.16s - 653.52s |  you could load up your own ROMs to play.
653.52s - 655.12s |  You could create your own game.
655.12s - 661.92s |  You could get as far as messing with the Raspberry Pi 2350 SDK.
661.92s - 664.56s |  The badge itself is pretty interactive.
664.56s - 665.80s |  There's a game on the badge.
665.80s - 668.88s |  There's a little story, if you play through it.
668.88s - 670.68s |  And it's really just a lot about,
670.68s - 675.92s |  if you work in the DEF CON scene and create your own projects,
675.92s - 679.52s |  it's kind of just take care of yourself, too, you know?
680.52s - 682.00s |  Infrared, yeah.
682.00s - 685.24s |  And then interacting with each other,
685.24s - 686.76s |  you can go up to other people.
686.76s - 689.28s |  And there's IR here.
689.28s - 693.08s |  And you can use that within the game.
693.08s - 694.52s |  It's a little buggy, but you know,
694.52s - 696.08s |  what isn't for a DEF CON project?
696.08s - 698.84s |  It's fine.
698.84s - 701.92s |  OK, we loaded up the conference map in here.
701.92s - 704.12s |  So you could actually get around the conference using
704.12s - 705.52s |  your badge.
705.52s - 708.36s |  And then if you get using the real time clock,
708.36s - 710.44s |  if you set your time at the beginning,
710.44s - 712.36s |  you'd be able to go into each one of the talks.
712.36s - 715.32s |  And it would tell you who is speaking at that point in time,
715.32s - 717.68s |  which is pretty cool.
717.68s - 720.00s |  I really wanted people to be able to express themselves
720.00s - 721.48s |  wearing the badge.
721.48s - 724.44s |  So there's full SAO support.
724.44s - 728.20s |  You can change LED color, which you've seen, I'm sure,
728.20s - 731.00s |  on everybody else around you, which is great.
731.00s - 734.40s |  And then the orientation was important for me,
734.40s - 737.04s |  so that you're playing in game mode here.
737.04s - 738.76s |  And then you can also be wearing it.
738.76s - 740.60s |  And after a certain period of time, it'll time out.
740.60s - 743.08s |  And then it shows your little character that you've chosen
743.08s - 744.92s |  and how far you've progressed in the game.
744.92s - 747.08s |  So you kind of can get a feel for where
747.08s - 750.00s |  everybody else is around you.
750.00s - 752.04s |  And then reusability is so important,
752.04s - 754.32s |  which is why it's a Raspberry Pi.
754.32s - 756.20s |  So you can do all kinds of things with this,
756.20s - 758.44s |  like whatever you can imagine.
758.44s - 759.44s |  So please reuse it.
759.44s - 760.56s |  Post your projects later.
763.40s - 765.56s |  And I just kind of touched on some of the hardware.
766.44s - 768.32s |  It's an ABS injection molded case,
768.32s - 770.92s |  which I experimented with last year with the plastics.
770.92s - 774.08s |  And we really got it right this year.
774.08s - 778.00s |  The RP2350, which is a brand new chip that was just
778.00s - 780.56s |  released this weekend to DEF CON attendees.
780.56s - 783.08s |  Y'all got the very first one.
783.08s - 786.32s |  And you can find out more about that chip on their website,
786.32s - 789.56s |  on Raspberry Pi's website.
789.56s - 790.72s |  Orientation sensor.
790.72s - 793.72s |  Real time clock, we talked about with the badge talks.
793.72s - 795.88s |  Customizable RGB LEDs.
795.88s - 797.80s |  IR communication.
797.80s - 800.80s |  There's a micro SD card in here that if you pop it out
800.80s - 802.76s |  and put in your computer, there's also
802.76s - 807.24s |  some goodies on there, like the official DEF CON soundtrack.
807.24s - 809.00s |  And then you can go get more, load up
809.00s - 811.24s |  more stuff with your SD card.
811.24s - 813.92s |  USB-C, and then it's rechargeable.
813.92s - 815.68s |  I have my own battery.
815.68s - 817.44s |  Audio does work on here.
817.44s - 820.08s |  Just because it doesn't work in the game in time,
820.08s - 822.08s |  you can still play audio from your badge, which
822.08s - 823.60s |  is pretty neat.
823.60s - 826.36s |  There is a touch screen, which we didn't utilize in the game.
826.36s - 828.72s |  But you can do stuff with if you do a Raspberry Pi project
828.72s - 831.00s |  with it afterwards.
831.00s - 834.76s |  And then UGB is the emulator for playing the games.
834.76s - 837.40s |  And it'll play any Game Boy compatible games.
837.40s - 842.16s |  So also Game Boy Color, all that stuff.
842.16s - 845.52s |  So Raspberry Pi has also put out a challenge.
845.52s - 848.88s |  And I put the URL here so y'all can check that out.
848.88s - 852.16s |  And they're offering a reward.
852.16s - 856.69s |  OK, whoops.
856.69s - 858.73s |  OK, sorry.
858.73s - 859.89s |  Let y'all come up.
859.89s - 867.28s |  Thank you.
867.28s - 870.20s |  OK, as you saw the sneak peek, our next slide
870.20s - 872.16s |  is on transparency.
872.16s - 874.64s |  And transparency is the flip side
874.64s - 878.32s |  of the code of conduct coin.
878.32s - 881.64s |  So I've mentioned this before, but I think it's important,
881.64s - 882.92s |  so I'll say it again.
882.92s - 886.20s |  That when we created a code of conduct for ourselves
886.20s - 890.32s |  and started getting practiced and handling them,
890.32s - 891.76s |  the next thing we needed to do is,
891.76s - 894.40s |  hey, we need to report on what we're getting to try
894.40s - 896.20s |  to hold ourselves accountable.
896.20s - 899.64s |  And so over the years, as we've gotten
899.64s - 902.48s |  different kinds of complaints or concerns,
902.48s - 904.28s |  we've recorded them slightly differently.
904.28s - 906.32s |  So this year, we put a bunch of energy
906.32s - 909.88s |  in to try to standardize all of our terms and terminology.
909.88s - 911.56s |  So year after year, we can actually
911.56s - 913.44s |  get a better idea of trends.
913.44s - 915.44s |  Because as we were trying to do trend analysis,
915.44s - 917.64s |  we realized we weren't very consistent
917.64s - 919.68s |  in between categories.
919.68s - 922.24s |  So this is the first year of our new standard.
922.24s - 925.76s |  And to talk about it, head of the SOC, CyberJunkie,
925.76s - 939.10s |  and head of the hotline, Ada.
939.10s - 941.50s |  So this is Ada's first time up here.
941.50s - 944.10s |  Many of you have seen stats that have come out of hotline.
944.10s - 947.02s |  Get closer to the microphone.
947.02s - 948.66s |  Many of you have already seen the stats
948.66s - 951.46s |  that have come out of hotline over the last couple of years.
951.46s - 952.98s |  Ada's the person who's responsible,
952.98s - 954.48s |  so this is the first time she's here
954.48s - 957.06s |  to actually talk about what's going on
957.06s - 960.18s |  and give some better color to it.
960.18s - 962.78s |  We've also juggled how things are presented.
962.78s - 965.30s |  So you'll see more aggregated stuff on the SOC
965.30s - 968.90s |  and helpline-specific things on the helpline.
968.90s - 975.02s |  So starting with SOC, we had to remove two people from staff.
975.02s - 981.14s |  One of those people was removed for harassment-type behavior,
981.14s - 985.26s |  and one was removed for unwanted touching
985.26s - 988.06s |  against one of our own staff.
988.06s - 989.54s |  We take that stuff very seriously.
989.54s - 991.58s |  We hold all of our staff accountable,
991.58s - 995.58s |  and we hold them to a high standard.
995.58s - 998.18s |  We kicked two attendees from con.
998.18s - 1000.74s |  When we kick an attendee from con, it's not a ban.
1000.74s - 1005.02s |  It's just a, we'd like you to go away, come back next year,
1005.02s - 1008.22s |  but we think you need to take time out.
1008.22s - 1011.82s |  Three people were banned from cons, however,
1011.82s - 1017.34s |  and all three were banned for sexual harassment-type
1017.34s - 1019.10s |  behavior.
1019.10s - 1022.50s |  We consider them to be people we do not want in our community.
1022.50s - 1024.58s |  Therefore, we don't want them coming here,
1024.58s - 1029.82s |  causing further problems, so we removed them permanently.
1029.82s - 1033.66s |  We had seven code of conduct complaints,
1033.66s - 1036.74s |  one verbal assault complaint, three complaints
1036.74s - 1039.62s |  for photo-violation policies.
1039.62s - 1043.54s |  We had 11 medical issues, and I'd
1043.54s - 1046.02s |  like to actually say that these were really
1046.02s - 1048.46s |  mild medical issues.
1048.46s - 1052.70s |  We had, I think, two ambulances roll, but nobody left in them.
1052.70s - 1054.62s |  Almost all of them were people who were parting
1054.62s - 1056.78s |  a little bit too hard, a couple of people
1056.78s - 1060.26s |  who were maybe not taking care of themselves
1060.26s - 1062.86s |  as well as they should.
1062.86s - 1068.22s |  They needed to drink more water.
1068.22s - 1069.54s |  The facility was fantastic.
1069.54s - 1073.02s |  This is the first time we've had an on-site nurse assisting us,
1073.02s - 1075.42s |  as well as all of the trained medical professionals
1075.42s - 1077.22s |  that the facility provides.
1077.22s - 1088.22s |  And so in the vast majority of these cases,
1088.22s - 1093.18s |  we had really swift response and good outcomes as a result.
1093.18s - 1095.42s |  But also, because there was a medical facility
1095.42s - 1097.82s |  and a medical nurse's office here, many of you
1097.82s - 1099.54s |  were able to take care of minor issues
1099.54s - 1101.30s |  yourselves, which meant you didn't
1101.30s - 1104.26s |  have to leave the conference for a Band-Aid or something.
1104.26s - 1106.18s |  And I think that's a really great improvement
1106.26s - 1109.74s |  in the experience as well.
1109.74s - 1111.94s |  Three lost property reports.
1111.94s - 1116.42s |  We had five complaints of replica money being circulated.
1116.42s - 1119.50s |  We have actually now found the individual was responsible.
1119.50s - 1121.30s |  It was a prank, but it's obviously not
1121.30s - 1122.70s |  going to happen again, hopefully.
1126.34s - 1128.90s |  Two reports of unwanted touching of property.
1128.90s - 1130.70s |  Please leave other people's stuff alone.
1135.12s - 1135.80s |  What he said.
1135.80s - 1137.36s |  One report of disruptive behavior.
1146.67s - 1148.67s |  Two reports of staff impersonation.
1148.67s - 1151.31s |  And I should add that one of them is now a member of staff.
1161.00s - 1163.36s |  He made a fake badge, a fake goon badge,
1163.36s - 1166.36s |  which we generally discourage.
1166.36s - 1168.68s |  But he was super ethical about what he did.
1168.68s - 1171.48s |  And he managed to socially engineer his way all the way
1171.48s - 1181.10s |  into the SOC, where I got to meet him face to face.
1181.10s - 1182.78s |  And so promptly, we hired him on the spot.
1187.70s - 1189.66s |  Four reports of unsecured doors.
1189.66s - 1197.06s |  And a growing issue, we have now up to 10 reports of theft.
1197.06s - 1201.70s |  Obviously, we're in a new venue, bigger venue,
1201.70s - 1203.94s |  lots more people around.
1203.94s - 1205.98s |  Please keep an eye on your stuff.
1205.98s - 1207.98s |  Don't leave laptops lying around.
1207.98s - 1213.10s |  Be mindful, as you would at any conference.
1213.10s - 1217.78s |  Ada, step in, and I'll say some last things at the end.
1217.78s - 1221.74s |  I'm not this tall, sorry.
1221.74s - 1223.08s |  So Hotline is a little different.
1223.08s - 1227.82s |  You guys really used the number this year more than ever
1227.82s - 1230.78s |  before, which we very much appreciate.
1230.78s - 1235.38s |  But probably I need a few more people to help out next year.
1235.38s - 1236.90s |  We get a lot of information calls,
1236.90s - 1239.58s |  especially before DEF CON.
1239.58s - 1243.18s |  People just asking, can I get badges, usually.
1243.18s - 1244.74s |  That's like the number one question.
1244.74s - 1245.50s |  Can I get a badge?
1245.50s - 1246.50s |  Where can I get a badge?
1246.50s - 1248.62s |  How can I get a badge?
1248.62s - 1251.74s |  So we get a lot of texts, a lot of calls that way.
1251.74s - 1255.34s |  We got four reports of sexual assault.
1255.34s - 1260.10s |  Now, not all of these reports will end up in bans.
1260.10s - 1262.62s |  Part of that is because maybe the victim doesn't
1262.62s - 1265.58s |  know too much about the other person, so we can't find them.
1265.58s - 1268.50s |  Or they don't want to necessarily do anything
1268.50s - 1269.00s |  about it.
1269.00s - 1273.62s |  They just need emotional support, and so we give that.
1273.62s - 1275.38s |  Three reports of restraining orders,
1275.38s - 1280.58s |  which we have somewhat enforced as much best as we can.
1280.58s - 1284.62s |  We're not the police, so we do our best.
1284.62s - 1287.98s |  11 people calling in just for paraprofessional counseling.
1287.98s - 1290.46s |  That's, I'm having a panic attack.
1290.46s - 1293.34s |  Can you help me?
1293.34s - 1296.02s |  I'm depressed about something that happened.
1296.02s - 1297.46s |  Can you talk to me?
1297.46s - 1299.34s |  Anything like that.
1299.34s - 1305.86s |  It's in line with suicide hotline training kind of stuff,
1305.86s - 1309.14s |  which is where I came from.
1309.14s - 1311.90s |  And then six counts of crisis counseling.
1311.90s - 1313.66s |  So if somebody calls in and something
1313.66s - 1318.86s |  needs to be done right now, my friend's in trouble,
1318.86s - 1320.74s |  something's been stolen, that kind of stuff.
1320.74s - 1323.54s |  Somebody's calling in in a panic.
1323.54s - 1328.02s |  One scam that called us to try a scam set of money,
1328.02s - 1331.42s |  which we're hotline, good luck, we have no money.
1334.42s - 1337.50s |  Three accessibility concerns, usually with the shuttles,
1337.50s - 1339.62s |  but sometimes there's other issues,
1339.62s - 1343.82s |  like a door doesn't work properly or something.
1343.82s - 1346.22s |  Before con, when we released the phone number
1346.22s - 1348.54s |  and before anyone else had the number,
1348.54s - 1350.30s |  only me, so I was the only person
1350.30s - 1352.14s |  who could respond to your calls.
1352.14s - 1353.82s |  I did my best.
1353.82s - 1357.58s |  You guys called a lot.
1357.58s - 1361.66s |  I can't answer all those calls myself, I'm sorry.
1361.66s - 1364.78s |  And one human, once again, stuck in back of house
1364.78s - 1370.86s |  who needed to be released into the wild.
1370.86s - 1374.58s |  So the last thing to say is it's the most important thing
1374.58s - 1377.82s |  to everyone on staff that people feel safe
1377.82s - 1379.54s |  and that you have a safe environment to enjoy
1379.54s - 1382.98s |  your conference and that you are safe where you stay.
1382.98s - 1386.30s |  And we're aware of reports of room searches
1386.30s - 1388.34s |  and some of the things that I'm sure you've read
1388.34s - 1389.38s |  on social media.
1390.42s - 1393.70s |  We want to say that please be cooperative
1393.70s - 1396.34s |  when these things happen, document them,
1396.34s - 1398.34s |  and please come forward and tell us.
1398.34s - 1401.18s |  The more we know, the more we can do.
1401.18s - 1404.50s |  And we are going to be issuing a report,
1404.50s - 1407.34s |  a statement after this conference
1407.34s - 1408.90s |  once everyone has checked out.
1410.38s - 1424.15s |  We don't want to have any hostages,
1424.15s - 1428.03s |  so make sure you get home first.
1428.03s - 1436.46s |  Okay, next up, press team, is Monica?
1436.46s - 1438.58s |  This year, we were really excited to have more
1438.58s - 1442.94s |  than 60 press badged through our registration
1442.94s - 1445.58s |  and many more wandering around as speakers
1445.58s - 1447.18s |  and also wearing human badges,
1447.18s - 1449.34s |  choosing not to disclose themselves.
1449.34s - 1454.34s |  That came from over 46 different news outlets,
1454.70s - 1458.22s |  half of which was from community-led properties
1458.22s - 1460.10s |  like podcasts, YouTube, and Twitch.
1460.10s - 1463.10s |  So if you're out there creating content for the community,
1463.10s - 1465.62s |  we'd love to welcome you on Citus Press next year.
1467.22s - 1470.14s |  So far, over 30 stories have been published
1470.14s - 1472.86s |  highlighting our research, community projects,
1472.86s - 1476.42s |  and different events, including the launch
1476.42s - 1479.98s |  of DEF CON Franklin, which we are very, very excited
1479.98s - 1483.30s |  to be linking up with some former government officials on.
1483.30s - 1486.50s |  And we invite you guys to please sign up
1486.50s - 1490.18s |  to join the hacker community there
1490.18s - 1493.82s |  and help make our critical water system safer.
1493.82s - 1501.46s |  Thanks, guys.
1501.46s - 1504.38s |  Okay, next up is policy at DEF CON.
1504.38s - 1507.46s |  This is our effort to try to connect hackers
1507.46s - 1508.80s |  with policymakers.
1508.80s - 1513.66s |  Come on up.
1513.66s - 1515.20s |  Hey, folks.
1515.20s - 1517.98s |  So I'm Katie Noble, otherwise known as Lady N,
1517.98s - 1521.62s |  and I am the deputy of policy at DEF CON.
1521.62s - 1524.66s |  So this is our third year, and we really want
1524.66s - 1527.02s |  to thank everyone who helped,
1527.02s - 1530.00s |  especially our attachés and our goons.
1530.00s - 1532.96s |  And if you're wondering what is policy at DEF CON,
1534.12s - 1535.94s |  so we've been going for three years,
1535.94s - 1539.14s |  and our whole goal is to bring policymakers
1539.14s - 1541.92s |  and hackers and security practitioners together
1541.92s - 1545.54s |  so that we can have informed conversations
1545.54s - 1550.10s |  about public policy so we can make public policy better.
1550.10s - 1551.90s |  And when I say public policy,
1551.90s - 1555.34s |  I mean things like laws, standards, regulations.
1555.34s - 1556.38s |  We were really honored this year
1556.38s - 1561.38s |  to have an awesome group of speakers show up.
1561.50s - 1564.98s |  So we had 10 talks in the policy section.
1564.98s - 1567.18s |  We had six talks on the creator stage.
1567.18s - 1570.54s |  We had over 1,500 people in our small little room,
1570.54s - 1572.68s |  got some great social media presence,
1572.68s - 1582.79s |  and we're really looking forward to doing it again next year.
1582.79s - 1585.67s |  Okay, so if you used our Discord server,
1585.67s - 1588.47s |  you indirectly were interacting with the next team,
1588.47s - 1597.59s |  the DevOps team, led by Riverside.
1597.59s - 1598.43s |  Hey, everyone.
1598.43s - 1599.91s |  My voice is almost gone.
1599.91s - 1601.51s |  Fox is gonna take care of this one.
1601.51s - 1604.55s |  Hi, everybody.
1604.55s - 1606.71s |  I am Fox, if you don't know me.
1606.71s - 1608.71s |  I am the second for DevOps.
1608.71s - 1611.87s |  Behind me on the slides, you can see our wonderful team.
1611.87s - 1615.31s |  They work all year round to keep the DEF CON Discord safe,
1615.31s - 1617.51s |  and when they're bored, they go ahead
1617.51s - 1620.99s |  and make integrations that make life at DEF CON better.
1622.59s - 1627.09s |  Let's see, next slide.
1627.09s - 1629.45s |  You can see some of the stats behind me
1629.45s - 1634.45s |  for all of our Discord, all the coding, the bots.
1636.05s - 1638.09s |  This year, we've added a couple more full bots.
1638.09s - 1643.09s |  We've added 1481 lines of code.
1649.18s - 1650.10s |  Sorry, guys.
1656.27s - 1657.83s |  I'll jump in and help a little bit.
1657.83s - 1661.35s |  So the total lines of production code right now
1661.35s - 1663.35s |  is almost 20,000 lines of code,
1663.35s - 1667.39s |  and every year, Discord changes their APIs.
1667.39s - 1669.39s |  They're constantly a moving target.
1669.39s - 1671.83s |  So this team, on a weekly basis,
1671.83s - 1673.83s |  is doing something no matter what,
1673.83s - 1678.23s |  and so it is a continual trickle of nonstop DEF CON,
1678.23s - 1680.67s |  and they're working really, really hard for all of you.
1680.67s - 1682.31s |  There's a ton of channels,
1682.31s - 1683.99s |  thousands and thousands of messages,
1683.99s - 1686.03s |  people connecting from all around the world,
1686.03s - 1687.75s |  and some of the folks that couldn't make it
1687.75s - 1689.67s |  are here in spirit and connecting
1689.67s - 1691.17s |  and doing really cool things.
1692.19s - 1694.83s |  We had a few people warned and a bunch of bans,
1694.83s - 1699.30s |  and they're doing a great job with that.
1699.30s - 1702.58s |  This year, some of our big wins with the extra integrations.
1702.58s - 1705.30s |  Last year, we had the data duplication village,
1705.30s - 1708.02s |  and it was kind of a sad state
1708.02s - 1709.50s |  where we had people writing down codes
1709.50s - 1710.58s |  and they had to bring the codes back.
1710.58s - 1712.70s |  So this year, we upgraded that to the scanning system,
1712.70s - 1715.78s |  which is much quicker, and in the meantime,
1715.78s - 1718.70s |  we also upgraded the info bot,
1719.18s - 1722.18s |  integrated that with the hacker tracker.
1722.18s - 1724.14s |  It was kind of last minute, in fact,
1724.14s - 1726.14s |  and so you see on the slide that every minute counts,
1726.14s - 1728.54s |  and we were coding all throughout CON this year.
1731.38s - 1732.74s |  And wait, don't switch yet.
1732.74s - 1737.74s |  So the team does Discord from everywhere and anywhere,
1738.06s - 1740.82s |  and some of the team members get called in
1740.82s - 1742.38s |  because the team is-
1742.38s - 1743.26s |  Closer to the mic.
1743.26s - 1747.18s |  Yeah, team is made of a hodgepodge of goons
1747.18s - 1748.34s |  from all the different departments
1748.94s - 1751.14s |  that we kind of pushed together to make this happen,
1751.14s - 1753.42s |  and so when their original home teams are like,
1753.42s - 1755.50s |  hey, we're short on staff,
1755.50s - 1758.34s |  they get put into other things and wander halls
1758.34s - 1761.62s |  and do things, so they're triple-hatting the things,
1761.62s - 1763.82s |  but there may be some weird spots
1763.82s - 1767.22s |  that we've Discorded at emergency points, so.
1769.62s - 1771.30s |  All I gotta say is it's a wonderful team.
1771.30s - 1772.70s |  They make my life easy.
1772.70s - 1774.74s |  Keep in mind, they work all year round,
1774.74s - 1777.38s |  and the final slide is just a data point slide
1777.42s - 1779.94s |  that if you download after closing,
1779.94s - 1782.74s |  you can see some of the demographics of our Discord.
1782.74s - 1783.58s |  Thank you.
1790.98s - 1794.14s |  All right, next up, if you've used the network at all,
1794.14s - 1796.46s |  you've interacted with the NOC.
1796.46s - 1797.78s |  Come on down.
1797.78s - 1798.62s |  Come on up.
1799.94s - 1801.26s |  You've got a ton of slides.
1801.26s - 1803.54s |  Sorry, I'll go through them quickly.
1803.54s - 1804.54s |  Hey, I'm Mac.
1804.54s - 1806.58s |  I'm number two in the NOC,
1806.58s - 1808.98s |  and we're gonna go through this really quickly.
1810.62s - 1812.50s |  So just kind of a reminder of what we do.
1812.86s - 1813.70s |  We provide the wireless.
1813.70s - 1816.54s |  We provide a lot of wired connections,
1816.54s - 1819.02s |  as well as support any things from the floor,
1819.02s - 1821.10s |  people running contest servers, et cetera.
1822.62s - 1824.38s |  This year is a little bit different.
1824.38s - 1826.34s |  We had stuff kind of lined up with Caesars
1826.34s - 1828.66s |  from the standpoint of being able to have some gear
1828.66s - 1830.50s |  left permanent in place
1830.50s - 1833.50s |  that wasn't so permanent as we thought it'd be,
1833.50s - 1835.42s |  so we ended up with only about four weeks
1835.42s - 1836.90s |  to put all of this in here.
1838.66s - 1841.78s |  So that being said, this was one of our fastest opening
1841.82s - 1846.82s |  for the Wi-Fi reg servers, the floor drops, et cetera.
1847.94s - 1849.14s |  So that was pretty good.
1850.46s - 1852.38s |  You see this every year.
1852.38s - 1855.06s |  We come in a week early on-site,
1855.06s - 1858.46s |  not including all the planning the weeks ahead of time,
1859.62s - 1862.66s |  and we work with the on-site facilities
1862.66s - 1864.50s |  to get everything up and running.
1864.50s - 1867.74s |  Ideally, by Wednesday, people come in,
1867.74s - 1870.22s |  a lot of last-minute scrambling,
1870.54s - 1871.94s |  and then hopefully no emergencies,
1871.94s - 1874.78s |  like having to do an emergency network brain surgery,
1875.74s - 1877.58s |  and then we have to have it all packed up
1877.58s - 1879.50s |  by 10 p.m. tonight.
1879.50s - 1882.90s |  So it's a lot, and it takes a big team to get it done.
1884.10s - 1886.26s |  Here's some of the stats from this year.
1887.54s - 1890.54s |  I'm gonna breeze through these, if that's okay, for time.
1891.46s - 1892.62s |  If you have any questions,
1892.62s - 1895.30s |  there'll be a pointer at the end.
1896.64s - 1898.30s |  But that being said, I do wanna say
1898.30s - 1899.98s |  thank you for using the network,
1901.46s - 1904.02s |  using it to its fullest potential.
1904.02s - 1909.02s |  We were pretty much capped the whole time,
1910.14s - 1914.70s |  and I'll be honest about, sorry, quick math,
1916.18s - 1920.34s |  about 60% of that was from the secured Wi-Fi,
1920.34s - 1923.46s |  and about 20% of that was from the insecure Wi-Fi.
1924.22s - 1929.22s |  We had at least 2,500 people online,
1929.58s - 1933.38s |  all at the same, sorry, devices online at the same time,
1933.38s - 1935.02s |  because people around here tend
1935.02s - 1937.02s |  to only have one device on them, right?
1938.18s - 1941.58s |  And again, the majority is still working on secure,
1941.58s - 1943.40s |  so it is a good place to go.
1944.74s - 1949.74s |  WIDI repartee, again, you really use the network
1949.78s - 1951.50s |  to its fullest potential,
1952.06s - 1955.46s |  and that really caused a lot of getting out of the gate,
1955.46s - 1958.06s |  starting, and hitting the brakes.
1959.02s - 1960.20s |  So thank you for that,
1960.20s - 1963.14s |  but also something we gotta work on, so sorry about that.
1965.26s - 1968.46s |  And I really kind of wanna put a shout-out, personally,
1968.46s - 1970.78s |  to a lot of the Cox Communication folks,
1970.78s - 1973.06s |  especially their wireless team.
1973.06s - 1974.42s |  We are relying on them.
1974.42s - 1976.18s |  You noticed on the previous slide,
1976.18s - 1980.02s |  there's 650 access points in this room.
1980.06s - 1982.74s |  That's a lot of money to be putting into equipment,
1982.74s - 1985.38s |  which is only used once or twice a year.
1985.38s - 1987.90s |  So we're really kind of starting to leverage
1987.90s - 1990.88s |  the facilities here for some of the things
1990.88s - 1995.06s |  that are much, much higher ticket item and harder to use.
1995.06s - 1996.74s |  But they were awesome to work with,
1996.74s - 1999.14s |  and pretty much worked with everything
1999.14s - 2000.78s |  that we wanted from them.
2002.60s - 2005.10s |  Bandwidth, Jeff, we need more bandwidth back here.
2006.42s - 2007.72s |  Tell him, don't tell me.
2010.94s - 2013.22s |  We have a bunch of stats with regards to what we saw
2013.22s - 2015.64s |  from attacks and random things around there.
2017.18s - 2020.74s |  Almost 1,000 different SSIDs advertised from various people.
2022.38s - 2025.74s |  And not a lot of those were actual mobile hotspots.
2025.74s - 2027.86s |  They tended to be other items,
2027.86s - 2029.62s |  if you know what I'm talking about.
2031.02s - 2034.90s |  And so, again, these stats and some more detailed ones
2034.90s - 2036.86s |  will be going up to NOC in a minute.
2037.86s - 2041.66s |  I really wanna put some call out to the team.
2041.66s - 2043.34s |  Everybody there.
2043.34s - 2055.44s |  Big round of appreciation, and I gotta do one thing.
2056.32s - 2057.96s |  As I said, I'm the number two.
2059.44s - 2062.24s |  Our leader, new management, Canadian.
2062.24s - 2065.40s |  Unfortunately couldn't be here for the closing ceremonies,
2065.40s - 2068.00s |  and I'm gonna talk about why in a sec.
2068.00s - 2070.98s |  This is from Sparky, he's our leader.
2071.74s - 2075.22s |  After what can only be described as the most chaotic year
2075.22s - 2077.64s |  I've had at DEF CON, with short prep time
2077.64s - 2081.22s |  and equipment issues, and a totally new space,
2082.62s - 2084.86s |  the DEF CON NOC team completed their work,
2084.86s - 2086.58s |  and not only did they complete it,
2086.58s - 2089.94s |  they did it faster and more efficient than we ever have.
2089.94s - 2092.46s |  These people are simply the best of the best.
2092.46s - 2095.52s |  The teamwork, the helping hands, the consistent team spirit
2095.52s - 2097.54s |  in the face of staggering pressure and odds
2097.54s - 2098.78s |  has been outstanding.
2099.62s - 2103.78s |  The operations group, special call out to Jeff and team,
2104.70s - 2107.06s |  should also be commended for what could be arguably
2107.06s - 2110.22s |  one of the best DEF CON changes ever.
2110.22s - 2111.62s |  Thank you so much.
2114.42s - 2115.26s |  You can applaud.
2121.12s - 2123.64s |  Again, to the Cox Communications team,
2123.64s - 2125.02s |  thank you guys for being there.
2125.02s - 2126.48s |  Your dedication to getting it done
2126.48s - 2128.88s |  is not only critical to our success,
2128.88s - 2131.64s |  but also building new relationships with ground crews
2131.64s - 2134.82s |  is hard, and we appreciate your team rocking so much.
2137.64s - 2139.56s |  Unfortunately, this is where the penny drops.
2139.56s - 2142.56s |  I've come down with pretty kick-ass round of COVID,
2142.56s - 2144.16s |  thought it was just CONCRUD,
2144.16s - 2146.62s |  but unfortunately it is the holy sea.
2148.48s - 2152.04s |  After 25 years of being in the NOC, I'm the lead role,
2152.04s - 2153.12s |  and this is where you see
2153.12s - 2155.86s |  the Canadian self-deprecating humor in here.
2157.12s - 2158.40s |  Sorry, editorial note.
2158.84s - 2163.50s |  I had an amazing speech ready,
2163.50s - 2165.22s |  singing the praises of my team and friends,
2165.22s - 2167.46s |  and just at the finish line took a stumble.
2167.46s - 2168.54s |  And I just want to say,
2168.54s - 2171.54s |  and I think this stands for all of the goons up here,
2171.54s - 2174.38s |  every one of us is a part of a team.
2174.38s - 2177.82s |  And when someone stumbles, we're all there to pick you up.
2177.82s - 2178.78s |  And that is one of the things
2178.78s - 2180.78s |  that just makes this community awesome.
2189.80s - 2193.56s |  So here's to next year, we open the NOC to the community,
2193.56s - 2195.88s |  where we're going to open the NOC to the community
2195.88s - 2199.10s |  we love so much, showing you more that we can.
2200.72s - 2202.80s |  And here's to a year where we could work together
2202.80s - 2205.28s |  to build a community that people are proud to be a part of,
2205.28s - 2208.00s |  because I know I am, love, Sparky.
2209.00s - 2212.08s |  So, sorry, that's the NOC team.
2215.41s - 2217.93s |  NOC.DEFCON.ORG, it's a little outdated,
2217.93s - 2219.13s |  but we're going to be updating that.
2219.13s - 2221.37s |  So additional stats, additional information
2221.37s - 2223.41s |  will be appearing there over the next couple of weeks.
2223.41s - 2234.44s |  And thank you for using the network.
2234.48s - 2236.80s |  We're having a little speed surgery up here.
2237.84s - 2239.28s |  It's like a Formula One race team.
2239.28s - 2242.84s |  One laptop's down, next laptop's in.
2242.84s - 2247.43s |  Click, click.
2247.43s - 2248.31s |  How many clicks do we have?
2248.31s - 2250.11s |  Four clicks.
2250.11s - 2252.84s |  Click.
2252.84s - 2258.96s |  I know, no pressure, no pressure.
2258.96s - 2260.04s |  Okay, one more click.
2264.39s - 2265.23s |  All right.
2266.87s - 2271.03s |  I will have a Thin Mint after I introduce the DCTV crew.
2271.03s - 2275.45s |  Come on up.
2280.63s - 2285.71s |  Hi folks, how's it going?
2285.71s - 2290.11s |  Who here watched talks from someplace not in this room?
2290.11s - 2291.11s |  Who watched them on the internet?
2291.11s - 2292.51s |  All right.
2292.51s - 2294.23s |  Well, we are DCTV.
2294.23s - 2297.27s |  We stream talks to the internet right now.
2298.35s - 2300.59s |  If you go to DCTV.DEFCON.ORG,
2300.59s - 2302.23s |  it lists all of our information.
2303.95s - 2308.95s |  New this year, we actually did talks or streams to YouTube.
2308.95s - 2312.01s |  In the past, we've just done Twitch and to the hotels.
2313.75s - 2314.71s |  I don't know if you noticed,
2314.71s - 2319.71s |  but we didn't have anything in the hotels this year.
2320.15s - 2321.47s |  We didn't have enough time, unfortunately,
2321.47s - 2324.27s |  to coordinate that, but hopefully next year,
2324.27s - 2329.85s |  we'll figure that out when we have a little bit more time.
2329.85s - 2331.97s |  One of the things that was interesting,
2331.97s - 2334.53s |  we saw lots of streams.
2336.17s - 2340.29s |  I think Twitch was 71,000 live viewers,
2340.29s - 2342.25s |  which is pretty amazing.
2342.25s - 2345.69s |  YouTube was 73,000.
2345.69s - 2347.93s |  These are crazy numbers, right?
2347.93s - 2350.33s |  But I guess that means everybody loves the content
2350.33s - 2352.25s |  and everybody's watching.
2352.25s - 2356.41s |  Fun facts, our team consumed 42 burritos this week
2359.74s - 2361.24s |  and 36 tacos.
2364.69s - 2368.01s |  I want to give a shout out to the DCTV family.
2368.01s - 2371.37s |  All these people are very important in making this happen.
2371.37s - 2374.87s |  Squeak, who's the second here, is up on stage as well.
2375.83s - 2380.83s |  Bool or And, Eagle One, Ghost Pepter, K-Sharp,
2382.39s - 2384.59s |  Robbins BS, and Sandwich.
2384.59s - 2387.71s |  Also, special shout outs to The Knock, right?
2387.71s - 2389.65s |  Without The Knock, we wouldn't have internet.
2389.65s - 2392.31s |  We wouldn't be able to stream to everybody.
2392.31s - 2396.46s |  Yes.
2396.46s - 2400.98s |  Special shout out to Peter and Alex and Michael,
2400.98s - 2405.14s |  who bring all of the cameras and all the camera gear.
2405.14s - 2407.20s |  They're the people who record the talks.
2408.06s - 2409.72s |  If you want, you can buy them afterwards, too.
2409.72s - 2411.38s |  It's pretty slick.
2411.38s - 2413.32s |  And Darrington from Defcon Social,
2413.32s - 2414.88s |  who helped us get all the YouTube stuff
2414.88s - 2417.04s |  and all that coordinated.
2417.04s - 2417.88s |  All right.
2417.88s - 2418.70s |  Thank you so much.
2418.70s - 2424.93s |  Appreciate it.
2424.93s - 2425.77s |  Well, this is great.
2425.77s - 2429.21s |  The new laptop doesn't show me the next slide.
2429.21s - 2430.37s |  Okay, let's roll the dice.
2430.37s - 2432.61s |  Who do we think the next slide's gonna be?
2432.61s - 2433.85s |  I'll get Japanese.
2433.85s - 2435.17s |  Exhibitors.
2435.17s - 2436.01s |  Okay.
2437.53s - 2441.61s |  Is anyone here to talk about?
2441.61s - 2442.61s |  Okay, here he comes.
2443.61s - 2454.38s |  I'm supposed to stay close.
2454.38s - 2459.88s |  Hello, Defcon.
2459.88s - 2465.80s |  I already forgot what I was gonna say.
2465.80s - 2470.50s |  So myself and KevOps, the official KevOps department,
2470.50s - 2473.98s |  work year-round to engage with organizations
2473.98s - 2476.80s |  that embody the spirit of Defcon,
2476.80s - 2480.52s |  who truly give back to the Defcon community.
2480.52s - 2483.84s |  This year's exhibitors provided amazing content
2484.84s - 2491.61s |  with great swag to our attendees.
2491.61s - 2494.57s |  In keeping with Defcon's transparency,
2494.57s - 2499.11s |  72% of the net proceeds that was generated this year
2499.11s - 2503.17s |  from exhibitors was converted to hotel accommodations
2503.17s - 2508.55s |  for our world-famous content creators.
2508.55s - 2514.19s |  Yeah, give it up.
2514.19s - 2517.31s |  21% went to charitable organizations
2517.31s - 2519.67s |  that directly support the EFF,
2519.67s - 2522.67s |  or I'm sorry, Defcon communities.
2523.31s - 2524.15s |  Like the EFF.
2525.45s - 2533.42s |  7% supported official Defcon parties.
2533.42s - 2535.66s |  NFO group is up.
2535.66s - 2547.21s |  Thanks, everyone.
2547.21s - 2548.97s |  It does show, right?
2548.97s - 2550.29s |  It does show, it's in the top right.
2550.29s - 2551.13s |  Can you see it?
2551.13s - 2551.97s |  It's that little teeny?
2551.97s - 2553.29s |  No, you just want a larger?
2553.29s - 2556.75s |  Okay.
2556.75s - 2557.59s |  Oh, there you go.
2557.59s - 2564.70s |  Okay, perfect.
2564.70s - 2566.50s |  Hello, everyone.
2566.50s - 2569.42s |  Who came out to visit one of the info nodes
2569.42s - 2572.95s |  and asked us a question?
2572.95s - 2574.95s |  How many of you got right answers?
2575.07s - 2576.51s |  No.
2576.51s - 2577.83s |  We don't always get it right,
2577.83s - 2580.43s |  but that's just how Khan is.
2580.43s - 2582.61s |  So I just want to take the time
2582.61s - 2584.63s |  to thank my second little Rue.
2584.63s - 2587.79s |  Without her support, I couldn't do what I do.
2587.79s - 2590.13s |  So I want to thank her first,
2590.13s - 2591.95s |  and then all of my info goons,
2591.95s - 2593.23s |  they're scattered about
2593.23s - 2595.91s |  because there's over 50 of us now.
2595.91s - 2599.79s |  And now I want to thank DT, Nikita,
2601.11s - 2603.91s |  all of our HQ folks that helped support us
2603.91s - 2605.79s |  because, you know, without you guys,
2605.79s - 2606.63s |  we wouldn't be here.
2606.63s - 2608.67s |  So I really appreciate all of you.
2608.67s - 2609.51s |  HackerTracker.
2609.51s - 2610.35s |  I'll get there.
2610.35s - 2611.17s |  Okay.
2611.17s - 2612.01s |  Give me a minute.
2614.59s - 2616.39s |  So without you guys, we wouldn't be here.
2616.39s - 2618.95s |  So I just want to say thank you to you guys.
2618.95s - 2620.67s |  Appreciate you very much.
2620.67s - 2623.63s |  And then the other team that really supports info
2623.63s - 2625.63s |  is the HackerTracker folks.
2625.63s - 2627.21s |  You know, you guys run our website,
2627.21s - 2628.55s |  you guys create the great app,
2628.55s - 2629.77s |  and I just want to thank you guys
2629.77s - 2632.43s |  for everything you do for us to help support us.
2632.43s - 2635.19s |  Get the right information out to you guys.
2635.19s - 2636.95s |  And then finally, I want to thank all of you humans
2636.95s - 2638.65s |  for coming to talk to us
2638.65s - 2642.39s |  and for taking all of last year's badges off our tables
2642.39s - 2644.77s |  because we had just had boxes and boxes.
2644.77s - 2646.55s |  So with that, thank you very much.
2646.55s - 2655.72s |  See you guys next year.
2655.72s - 2656.56s |  All right.
2656.56s - 2657.74s |  Speakers.
2659.76s - 2660.88s |  Hello, DEF CON.
2662.36s - 2663.20s |  I'm Pasties.
2663.20s - 2665.30s |  I'm number two for speaker operations.
2665.30s - 2668.44s |  We're responsible for tracks one through four
2668.44s - 2669.28s |  and war stories.
2669.64s - 2671.72s |  So if you saw any talks in there,
2671.72s - 2676.44s |  our team was the one that was getting people out and about
2676.44s - 2677.56s |  and like talking to each other,
2677.56s - 2680.56s |  engaging with some of the active content creators.
2680.56s - 2682.88s |  But we had another stage,
2682.88s - 2684.88s |  which was managed by a separate team.
2684.88s - 2687.24s |  It was the content creator stage.
2687.24s - 2688.28s |  They talked to us,
2688.28s - 2690.20s |  but they ran almost entirely on their own.
2690.20s - 2692.96s |  They just asked us a few questions ahead of time
2692.96s - 2695.72s |  and then they were off to the races and they rocked it.
2695.72s - 2697.78s |  Who saw content creator talks?
2698.78s - 2700.10s |  Yeah.
2700.10s - 2702.66s |  Who saw main stage talks?
2702.66s - 2703.50s |  Yeah.
2703.50s - 2704.94s |  All right.
2704.94s - 2705.78s |  It's always nice.
2705.78s - 2706.60s |  I was like,
2706.60s - 2708.78s |  I know that the people like to say like,
2708.78s - 2712.10s |  we'll watch the talks after the con is over,
2712.10s - 2715.10s |  but there is something about attending in person.
2715.10s - 2718.50s |  We do do some QVR metrics just to see how people
2718.50s - 2720.62s |  are engaging with our talks.
2720.62s - 2722.94s |  See if there's anything that we can improve.
2722.94s - 2726.30s |  New venues are always a particularly hard challenge.
2726.34s - 2728.26s |  You're working with new people, new spaces.
2728.26s - 2731.14s |  You don't know what's going to be involved in there.
2731.14s - 2733.48s |  Our AV people were fantastic.
2733.48s - 2734.66s |  They were incredibly fast.
2734.66s - 2738.62s |  They were doing some insane switchovers of the stages,
2738.62s - 2739.46s |  mostly in here.
2739.46s - 2742.78s |  So if you're in here for any of the fire stock changes,
2742.78s - 2746.66s |  we were alternating between like the setup that you see here
2746.66s - 2748.82s |  and having a sort of a lounge display.
2748.82s - 2749.90s |  And we did it in another track,
2749.90s - 2751.86s |  which caught us all off guard
2751.86s - 2754.50s |  because just that's how it works.
2754.50s - 2755.58s |  But they were hustling.
2755.70s - 2758.82s |  I want to set a big, big thanks out to them.
2758.82s - 2761.42s |  We do some impromptu collection of data
2761.42s - 2763.02s |  as people are leaving to sort of see
2763.02s - 2764.90s |  how they felt about the talks.
2764.90s - 2767.14s |  It's a scale of one to five and 63%,
2767.14s - 2769.50s |  I think it was 65%, sorry,
2769.50s - 2771.06s |  were called out as being great,
2771.06s - 2774.60s |  which is what we leave, this is a five out of five.
2775.98s - 2778.18s |  This is fantastic.
2778.18s - 2780.50s |  We also only had eight minutes of downtime
2780.50s - 2782.90s |  after our first morning.
2782.90s - 2784.46s |  There was a little bit more on our first morning
2784.46s - 2785.66s |  and we weren't collecting our metrics.
2785.66s - 2786.74s |  So those were not included
2786.74s - 2789.62s |  and you might've seen some spiciness around there.
2789.62s - 2794.62s |  And we had one talk, cease and desist are not unusual.
2794.62s - 2796.52s |  Unfortunately, we get, there's usually, you know,
2796.52s - 2798.86s |  one or two that kicks around.
2798.86s - 2801.02s |  This one sort of came in last minute
2801.02s - 2806.02s |  and the EFF, they graciously decided to help that creator.
2806.06s - 2808.26s |  So a round of applause for the EFF.
2815.44s - 2818.00s |  So they were able to help that speaker
2818.00s - 2819.44s |  reschedule their talk for Sunday.
2820.20s - 2821.52s |  They were able to do the talk
2821.52s - 2822.88s |  and we were able to move forward.
2822.88s - 2825.44s |  So if you do want to talk at DEF CON,
2825.44s - 2826.72s |  DEF CON does have your back,
2826.72s - 2828.68s |  as long as it's very reasonable,
2828.68s - 2830.48s |  we'll try and help and make sure
2830.48s - 2832.64s |  that your content gets presented
2832.64s - 2835.66s |  because we want to share with you guys.
2835.66s - 2837.06s |  So thank you, DEF CON.
2837.06s - 2847.28s |  We'll see you next year.
2847.28s - 2848.12s |  All right.
2848.12s - 2852.38s |  So getting you all badged up is a feat.
2852.38s - 2854.60s |  Getting everybody who's not a human badged up
2854.60s - 2856.16s |  is also a feat.
2856.16s - 2869.94s |  And that is held by the Inhuman Registration Department.
2869.94s - 2873.14s |  Hello, I'm the second for Inhuman, Esteban Restibang,
2873.14s - 2874.82s |  and this is Aster, the lead.
2875.96s - 2880.66s |  This year we badged over 1,600 Inhumans.
2880.66s - 2883.10s |  It's a lot, probably a little bit more than that.
2884.10s - 2885.68s |  Those are all the people who go
2885.68s - 2888.26s |  and make this incredible event what it is.
2888.26s - 2890.98s |  And it's super awesome to see them come through,
2890.98s - 2893.10s |  check in, grab their stuff,
2893.10s - 2896.06s |  and take off to go do wonderful things.
2897.22s - 2899.34s |  We also take care of black badges,
2899.34s - 2902.50s |  so the people who come back after winning an event.
2902.50s - 2905.46s |  And we had about 87 of those people show up this year,
2905.46s - 2907.34s |  and 15 retirees show up.
2907.34s - 2908.86s |  Retirees are weird ones,
2908.86s - 2910.18s |  because there's a lot of people who retire
2910.18s - 2911.30s |  but don't actually retire.
2911.30s - 2912.76s |  They keep working, so.
2912.76s - 2917.42s |  Speaking of which, Esteban is retiring this year
2917.42s - 2926.68s |  after 16 years as a goon and eight years doing this.
2926.68s - 2928.36s |  Thank you.
2928.36s - 2929.20s |  Yeah.
2929.20s - 2931.56s |  So if next year is just utter chaos, sorry.
2933.22s - 2935.38s |  And we badged 580 goons this year,
2935.38s - 2936.96s |  so it's a lot of goons.
2938.36s - 2940.32s |  Yeah, it's changed a lot since DEF CON 9,
2940.32s - 2942.08s |  which was my first.
2942.08s - 2944.68s |  Inhuman didn't really exist as a department,
2944.68s - 2948.14s |  and it's grown immensely in the last eight years
2948.14s - 2952.40s |  since we immortalists took it over, right?
2952.40s - 2953.24s |  Created it, really.
2953.24s - 2954.32s |  Created it, yeah.
2954.32s - 2955.88s |  Thank you to our goons.
2955.88s - 2959.04s |  Danny, Charms, McMayhem, Deca, and Louise as well.
2959.04s - 2968.50s |  So thanks, everybody.
2968.50s - 2969.90s |  All right.
2969.90s - 2970.74s |  Show of hands.
2970.74s - 2972.94s |  How many people attended a workshop?
2974.14s - 2976.74s |  How many wished they could have attended a workshop?
2977.64s - 2979.32s |  Yeah, we're trying.
2980.40s - 2982.40s |  Okay, let's bring up the workshop team.
2987.54s - 2988.38s |  Hey, everyone.
2990.84s - 2991.88s |  Thank you guys all.
2991.88s - 2992.72s |  This is so much fun.
2992.72s - 2993.54s |  I love this.
2993.54s - 2995.56s |  So workshops is, if you're not aware,
2995.84s - 2996.84s |  there are four-hour,
2996.84s - 2998.80s |  this year there were four-hour sessions.
2998.80s - 3001.60s |  We had over 29,
3001.60s - 3003.68s |  or we had 29 bespoke sessions.
3003.68s - 3006.40s |  That was, thanks to my second for that beautiful word.
3007.36s - 3010.44s |  Of those 29 sessions, we covered so many different topics.
3010.44s - 3011.56s |  There's a little bit of a blend
3011.56s - 3013.80s |  of both blue and red team stuff.
3013.80s - 3017.32s |  Lots of hacking going on, and a lot of defending, too.
3017.32s - 3019.30s |  Some of the best points that we had,
3019.30s - 3021.72s |  we had our four-hour sessions.
3021.72s - 3023.84s |  Our tickets, when they go online,
3023.84s - 3025.80s |  those go up usually like first week of July,
3025.80s - 3027.20s |  right after the 4th of July weekend
3027.20s - 3028.76s |  here in the United States.
3028.76s - 3030.56s |  Sold out within three minutes.
3030.56s - 3033.72s |  So when I say sold out, these are free sessions.
3033.72s - 3035.66s |  Our instructors come in,
3035.66s - 3037.84s |  they do this out of the goodness of their hearts.
3037.84s - 3040.48s |  We put these on and just have a blast doing it,
3040.48s - 3041.84s |  supporting them in any way we can,
3041.84s - 3044.12s |  supporting the community as well.
3044.12s - 3047.68s |  So three minutes after tickets go on sale.
3047.68s - 3049.60s |  One of the best things that we've got
3049.60s - 3053.32s |  is the forums thread that we start up every year,
3053.32s - 3055.88s |  where you can swap tickets if you happen to get one,
3055.88s - 3057.68s |  and you end up not being able to use it.
3057.68s - 3060.32s |  So keep an eye on forums to see those swaps happening
3060.32s - 3062.60s |  if you're looking to get into one of the workshops.
3062.60s - 3064.76s |  Seating is really limited.
3064.76s - 3067.56s |  This year, we were over the Spring Hill Suites,
3067.56s - 3069.52s |  where we had a great time.
3069.52s - 3073.36s |  Smaller environment, had some challenges.
3073.36s - 3076.24s |  Air conditioning didn't necessarily work too well,
3076.24s - 3080.08s |  and may have gotten a little overwhelmed
3080.08s - 3082.76s |  and caused the leak in the ceiling to fall,
3083.48s - 3086.44s |  things like that, just typical.
3087.76s - 3090.76s |  Over there, we had some amazing help from the folks,
3090.76s - 3094.68s |  the boots on the ground at the hotel, super responsive.
3094.68s - 3096.84s |  They gave us free coffee, you guys.
3096.84s - 3098.84s |  They gave us free coffee, it was great.
3102.00s - 3104.32s |  In addition to the delightful coffee,
3104.32s - 3108.72s |  we also were the recipients in our little op center there
3108.72s - 3112.16s |  of two amazing packages of some Tim Tam cookies.
3113.00s - 3116.44s |  We did consume 864 bottles of water in the space,
3116.44s - 3118.16s |  so that's pretty good.
3118.16s - 3120.68s |  Of that coffee, we had 15 gallons,
3120.68s - 3124.32s |  so that's a lot of caffeine, man, that's a lot of caffeine.
3125.52s - 3127.88s |  As a part of our workshops, people bring in tools.
3127.88s - 3132.24s |  They bring in different, whether it's working on,
3132.24s - 3135.52s |  off of the RFID readers or the programmers,
3135.52s - 3137.80s |  they'll bring those in as part of our workshops.
3137.80s - 3140.72s |  This year, we had a blow-up house,
3140.72s - 3141.84s |  which was kind of interesting,
3141.84s - 3146.00s |  and that supported a physical security hacking challenge
3146.00s - 3148.76s |  as a part of one of the workshops there.
3148.76s - 3152.76s |  We also had a challenge at the hotel with the network.
3152.76s - 3155.28s |  We were leveraging the hotel network,
3155.28s - 3157.96s |  and it was super great of them to provide that for us,
3157.96s - 3160.64s |  but we found some DHCP leases
3160.64s - 3162.36s |  that lasted a little bit too long.
3162.36s - 3163.76s |  They weren't releasing things,
3163.76s - 3166.44s |  so they created fake rooms for us
3166.44s - 3168.08s |  so we could get people on the guest network
3168.08s - 3169.68s |  and have the enhanced capabilities
3169.68s - 3171.80s |  of what that was able to be able to handle,
3172.64s - 3174.84s |  so really want to, once again, just seriously,
3174.84s - 3176.28s |  those guys are awesome over there.
3176.28s - 3177.24s |  We need to use them.
3177.24s - 3180.68s |  In the meantime, workshops call goes out every year.
3180.68s - 3182.88s |  If you have a topic you want to teach on,
3182.88s - 3184.68s |  please submit next year.
3184.68s - 3188.88s |  Same time, just as call for papers goes out, please submit.
3188.88s - 3191.44s |  We go through a standard vetting process.
3191.44s - 3193.64s |  This year, we were able to support the villages
3193.64s - 3195.80s |  because they changed the environment here,
3195.80s - 3196.64s |  so we were able to support
3196.64s - 3198.44s |  some of the village workshops as well.
3198.44s - 3200.68s |  So if you have a topic you're really passionate about
3200.68s - 3203.68s |  and you want to go ahead and instruct a group of people,
3203.68s - 3206.24s |  please submit, and we'd love to get you on stage.
3206.24s - 3214.50s |  Thank you.
3214.50s - 3217.62s |  All right, I have this pretty picture that you provided.
3217.62s - 3218.66s |  Look at that pretty picture.
3218.66s - 3220.82s |  This is what workshops look like.
3220.82s - 3222.62s |  That's not the leaking ceiling, though.
3222.62s - 3223.78s |  That's the bouncy house.
3223.78s - 3224.78s |  And that's the bouncy house.
3224.78s - 3226.10s |  They're all in the bouncy house.
3226.10s - 3228.10s |  Yeah, they look pretty happy about that.
3231.59s - 3234.19s |  So there is a slide that we forgot to include,
3234.19s - 3236.11s |  and I'm really embarrassed about it,
3236.11s - 3237.67s |  but back on the...
3237.67s - 3240.31s |  We rewind ourselves to early in the evening.
3241.35s - 3243.15s |  Building the community and engagement,
3243.15s - 3245.83s |  we launched something new this year,
3245.83s - 3248.63s |  DEF CON Next Gen, DC Next Gen,
3248.63s - 3252.55s |  which is the evolution and the improvement of DEF CON Kids.
3252.55s - 3255.19s |  And I'm not sure if Bia is here.
3255.19s - 3256.75s |  We were messaging,
3256.75s - 3258.87s |  but I don't know if she could make it here fast enough.
3258.87s - 3260.19s |  Oh, here we go.
3260.19s - 3261.27s |  Yes.
3262.27s - 3266.47s |  Okay, so give us some good words about DEF CON Next Gen.
3266.47s - 3269.39s |  Hello, DEF CON.
3272.81s - 3275.57s |  For those of you who don't know me, I am Heave.
3275.57s - 3278.13s |  My daughter is Bia Silab.
3278.13s - 3280.73s |  She started out, woo,
3280.73s - 3285.21s |  she started out in Roots Asylum when she was 11.
3285.21s - 3287.57s |  And when Roots died,
3287.57s - 3290.93s |  she pretty much harassed Nikita and Jeff nonstop
3290.93s - 3293.69s |  to get another kid's track going.
3294.29s - 3296.33s |  So they were gracious enough last year
3296.33s - 3299.33s |  to make her the youngest goon at 16.
3299.33s - 3303.41s |  And she kind of monitored the DEF CON Kids.
3303.41s - 3308.41s |  And this year she set up DC Next Gen all by herself
3308.45s - 3312.17s |  with a little logistical help from myself and some goons.
3312.17s - 3314.01s |  And I have some notes I'm going to read.
3314.01s - 3314.85s |  Here we go.
3316.01s - 3319.29s |  And she set it up so well
3319.29s - 3322.13s |  that when she got sick on Thursday,
3322.13s - 3325.17s |  the entire DC Next Gen ran all by itself
3325.17s - 3327.17s |  without any intervention from herself.
3327.17s - 3334.91s |  So I think that says a lot for her.
3334.91s - 3339.31s |  So last year we had about 50 kids.
3339.31s - 3346.18s |  This year we had 150.
3346.18s - 3350.06s |  And heads up, Jeff and Nikita,
3350.06s - 3355.06s |  we, our goons fielded the questions about DC Next Gen
3355.30s - 3356.58s |  and the number of parents
3356.58s - 3360.42s |  who are bringing their kids next year is staggering.
3360.42s - 3363.18s |  So the badge, the kids had a badge,
3363.18s - 3364.78s |  which was built by Braden Lane.
3364.78s - 3365.86s |  It was really cool.
3365.86s - 3367.94s |  It had all kinds of stuff in it.
3367.94s - 3370.86s |  Programmable in Circuit Python.
3370.86s - 3372.10s |  We had soldering kits.
3372.10s - 3374.54s |  Blenster, who everybody knows and loves,
3374.54s - 3378.38s |  he threw down and made a DC Next Gen soldering badge
3378.38s - 3383.14s |  after he saw the amazing Raider Raccoon logo that Mar made.
3383.14s - 3385.78s |  And then Hacker Boxes also provided us
3385.78s - 3388.38s |  some more soldering kits for the kids.
3388.38s - 3389.86s |  We had a number of classes.
3389.86s - 3392.66s |  Of course, a Circuit Python class built around the badge,
3392.66s - 3396.66s |  secure coding, zero trust networking with CloudFlare,
3396.66s - 3398.50s |  along with a number of classes
3398.50s - 3401.94s |  and panel discussions and talks.
3401.94s - 3405.62s |  One thing we did this year compared to like Roots Asylum,
3405.62s - 3408.30s |  instead of trapping the kids in a room,
3408.30s - 3411.34s |  we worked with the villages around the whole conference
3411.34s - 3413.46s |  and encouraged the kids to go out
3413.46s - 3414.58s |  and explore the conference
3414.58s - 3418.02s |  and find what they really enjoyed and what drove them.
3419.22s - 3420.46s |  We had our goons.
3420.46s - 3424.46s |  I'd like to thank Braden Lane, Heidi,
3424.46s - 3426.58s |  along with our volunteers.
3426.58s - 3429.74s |  And I'd also like to thank a special shout out
3429.74s - 3432.46s |  to both the NOC and the Packet Capture Village.
3432.46s - 3435.22s |  We had some problems with our laptops
3435.22s - 3437.50s |  and those guys put together everything we needed
3437.50s - 3439.34s |  to throw together an ad hoc network.
3439.34s - 3440.58s |  It was amazing.
3440.58s - 3445.58s |  And of course, Kevin, Chef, Jeff, Neil and Nikita
3447.06s - 3449.78s |  for supporting us on the backend with DC Next Gen.
3449.78s - 3452.58s |  So bring your kids to DEF CON.
3452.58s - 3460.32s |  Thank you.
3460.32s - 3464.12s |  So for many of you, DEF CON is over shortly,
3464.12s - 3466.92s |  but there is another two days of training.
3466.92s - 3468.68s |  This is something we started a few years ago.
3468.68s - 3472.04s |  So for many of us, well, for some of us, I should say,
3472.04s - 3475.56s |  Monday and Tuesday is more training
3475.56s - 3477.52s |  over at the, where are we at?
3477.52s - 3478.88s |  Sahara?
3478.88s - 3479.72s |  Yes.
3479.72s - 3481.36s |  Yeah, Sahara.
3481.36s - 3482.28s |  And when we started it,
3482.28s - 3483.64s |  we tried to do something a little different
3483.64s - 3484.48s |  with the community.
3484.48s - 3487.76s |  We're splitting the revenue 50-50 with the trainers
3487.76s - 3490.16s |  because we think that's fair.
3490.16s - 3492.88s |  And so we have a pretty diverse set of training.
3492.88s - 3494.32s |  That's pretty cool.
3494.32s - 3498.40s |  Okay, next up, arts and entertainment.
3499.36s - 3505.92s |  Chris AM.
3505.92s - 3508.20s |  We have, oh, here we go.
3508.20s - 3513.20s |  From my left stage right, Chris AM and crew.
3514.04s - 3516.00s |  We should really have some deep drum
3516.00s - 3523.12s |  and bass playing right now.
3523.12s - 3524.32s |  Hey everybody, I'm Chris AM,
3524.32s - 3527.36s |  the arts and entertainment department head.
3527.36s - 3530.84s |  Our purview is the main parties that you see
3530.84s - 3532.36s |  in the Syn and the Axe stages,
3532.36s - 3535.04s |  as well as helping out a lot of the other groups
3535.04s - 3539.32s |  around here, the parties team, a lot of the villages,
3539.32s - 3540.72s |  a lot of the side events.
3540.72s - 3542.64s |  We try to help them out as much as possible.
3543.16s - 3544.92s |  And I've got a really great set of goons
3544.92s - 3546.56s |  that are working for me
3546.56s - 3549.56s |  that just really bust it every time, all day, every day.
3549.56s - 3554.32s |  We're up to all hours and it's really fun, super fun.
3554.32s - 3557.64s |  And I want to thank everybody that attended our parties
3557.64s - 3559.96s |  up in the Syn and the Axe stages.
3559.96s - 3566.45s |  Did anybody get to see the Pirate Band last night?
3566.45s - 3568.09s |  Did anybody dress up?
3569.29s - 3570.45s |  Yeah.
3571.93s - 3574.37s |  And what did you think of the night before that
3574.81s - 3575.65s |  with the retro sci-fi?
3575.65s - 3576.49s |  Did anybody dress up for that?
3576.49s - 3581.25s |  We had some really cool homemade costumes that people made.
3582.85s - 3584.69s |  So I wanted to thank a couple of people
3584.69s - 3587.25s |  before I get off the stage here.
3587.25s - 3589.77s |  So I want to thank my entire crew.
3589.77s - 3592.73s |  I want to thank my second, Chris Klink.
3592.73s - 3594.73s |  He couldn't join us here on stage today,
3594.73s - 3597.33s |  but the rest of us are here.
3597.33s - 3599.81s |  We'll talk about the folks behind me in a second.
3599.81s - 3602.17s |  I'd like to thank everybody in QM.
3602.17s - 3604.05s |  They were gracious hosts to us.
3604.73s - 3605.77s |  They carved out a nice little space for us
3605.77s - 3608.29s |  right behind this wall for all of our gear.
3608.29s - 3611.97s |  I want to thank Log and his parties team.
3611.97s - 3614.09s |  They were really, really helpful to us,
3614.09s - 3616.13s |  getting gear back and forth, getting stuff set up,
3616.13s - 3617.09s |  teared down on time.
3617.09s - 3619.69s |  So that was really helpful.
3619.69s - 3620.85s |  There are so many other people
3620.85s - 3622.97s |  that we need help and assistance from
3622.97s - 3626.73s |  to make things successful that just can't list.
3626.73s - 3631.57s |  Behind me on the screen are the performers that you've seen.
3631.57s - 3633.53s |  Really, really like to have them there.
3635.05s - 3637.41s |  So everything that we did was recorded.
3637.41s - 3641.89s |  You'll be able to see it in the DEF CON archive pretty soon,
3641.89s - 3643.45s |  as soon as we get it up there.
3644.41s - 3647.09s |  I know I'm forgetting some things.
3648.13s - 3649.77s |  What do we want to do next?
3649.77s - 3652.53s |  Yeah, so this is a transitional year for us.
3652.53s - 3654.69s |  We're going to play a little bit of musical chairs
3654.69s - 3656.53s |  with who's in leadership positions
3656.53s - 3658.57s |  in the arts and entertainment department.
3658.57s - 3660.53s |  I'm going to take a step back from this
3660.53s - 3662.85s |  and just be a normal A&E goon,
3662.93s - 3665.09s |  where Zekes is stepping up to take over
3665.09s - 3667.05s |  as department head going forward.
3669.75s - 3670.59s |  Sucker.
3670.59s - 3671.43s |  Yeah.
3672.83s - 3674.59s |  You want to say some words, Zekes?
3675.63s - 3676.95s |  Hi, DEF CON.
3676.95s - 3678.99s |  So yeah, I'm taking over this year.
3678.99s - 3681.27s |  Well, taking over next year.
3681.27s - 3686.27s |  We start our process for this in about two weeks.
3686.35s - 3691.35s |  So what that means is that we will be starting
3691.39s - 3695.55s |  to look at new acts, stuff like that.
3697.23s - 3700.71s |  About January, we'll start doing a call for DJs and whatnot.
3701.67s - 3704.79s |  Behind me, I want to thank two people especially.
3704.79s - 3706.67s |  I've got Chonez here.
3706.67s - 3707.59s |  Hi.
3707.59s - 3712.59s |  He's our resident audio goon and video guy extraordinaire.
3713.67s - 3717.47s |  He helped me a huge, huge, huge thanks
3717.47s - 3720.55s |  for all your help in getting the video done
3720.63s - 3724.55s |  for our Twitch stream and all of our recording.
3724.55s - 3728.99s |  Absolutely phenomenal work from him and his right-hand man.
3728.99s - 3730.71s |  On my other side here is Shorzy.
3731.55s - 3734.15s |  Shorzy's our new lighting guy.
3734.15s - 3737.47s |  He did a lot of the lighting for our chill room.
3737.47s - 3738.95s |  Had an absolute blast,
3738.95s - 3741.51s |  made that room look completely different.
3741.51s - 3743.71s |  It was white walls when we walked in.
3743.71s - 3747.79s |  It was absolute color when he got done with it.
3747.79s - 3749.11s |  So big thanks to him.
3750.11s - 3752.79s |  Let's see, we did all the recordings.
3752.79s - 3755.35s |  We did have a little bit of a problem on Friday night.
3755.35s - 3758.19s |  We lost some internet connectivity.
3758.19s - 3760.31s |  It's DEF CON, it happens.
3760.31s - 3762.39s |  Luckily though, we recorded it all.
3762.39s - 3765.51s |  It will be on media.defcon.org.
3765.51s - 3767.55s |  Give me a couple weeks.
3767.55s - 3769.23s |  I need to decompress.
3770.15s - 3772.11s |  I need to decompress just a little bit.
3772.11s - 3774.07s |  I'll get all that footage all nice and neat.
3774.07s - 3776.31s |  All the music, all nice and neat.
3776.31s - 3778.47s |  We'll get it uploaded to you guys.
3778.83s - 3780.23s |  It'll be great to listen to.
3781.63s - 3782.59s |  I think that's it.
3783.43s - 3784.27s |  Go ahead.
3784.27s - 3787.27s |  Look out for the call for music for next year's DEF CON
3787.27s - 3789.79s |  starting right around January 1st.
3789.79s - 3792.11s |  And we'll be opening the call for soundtrack
3792.11s - 3793.23s |  soon after that.
3793.23s - 3796.95s |  Yeah, that's gonna be on defconmusic.org.
3796.95s - 3800.59s |  Our site will have an announcement up there for you.
3800.59s - 3801.43s |  Thank you guys.
3801.43s - 3810.20s |  See you next year.
3810.20s - 3813.12s |  Okay, so music is an appropriate entry point
3813.16s - 3816.28s |  into parties and meetups.
3816.28s - 3825.33s |  Yeah.
3825.33s - 3826.17s |  Who's that guy on stage?
3826.17s - 3827.69s |  What, you just noticed the patch?
3828.73s - 3829.57s |  Hey, I'm Log.
3829.57s - 3831.69s |  I am the parties and meetups lead.
3831.69s - 3833.17s |  Quick show of hands.
3833.17s - 3835.61s |  Who all attended one of our awesome parties
3835.61s - 3837.05s |  and meetups this weekend?
3837.97s - 3843.01s |  Hell yeah.
3843.01s - 3844.81s |  We just want to thank everyone for hosting a meetup
3844.81s - 3846.37s |  first off.
3846.37s - 3849.25s |  Absolutely, you can really need it in the community.
3849.25s - 3852.13s |  Great places to go to meet up with your DC groups,
3852.17s - 3855.69s |  with just random people that you have interests with.
3855.69s - 3859.93s |  Also, thank you everyone for hosting a party as well.
3859.93s - 3861.81s |  Absolutely amazing time.
3861.81s - 3864.25s |  Loved every single minute of it.
3864.25s - 3868.05s |  You guys absolutely know how to actually throw
3868.05s - 3869.29s |  and run a party.
3871.05s - 3874.42s |  Nope.
3874.42s - 3875.62s |  Talk about any, yeah.
3875.62s - 3878.14s |  Any exciting stories about parties?
3878.14s - 3880.10s |  No, I just think it went to a different slide.
3880.10s - 3880.94s |  Yeah.
3881.82s - 3883.74s |  But do you have any more to say?
3883.74s - 3886.22s |  No, I do want to say some thank yous real quick.
3886.22s - 3889.10s |  I do want to say a thank you definitely to Nikita, Jeff,
3889.10s - 3890.46s |  for helping us throw this out.
3890.46s - 3894.34s |  Kev Ops and the wonderful official Kev Ops department.
3894.34s - 3896.30s |  It's not an official department.
3896.30s - 3899.02s |  Thank you Nikita for the food truck village.
3899.02s - 3901.30s |  I also want to thank all my goons.
3904.46s - 3905.62s |  I want to thank all my goons.
3905.62s - 3910.62s |  SecFault, Rick, Sage, Heaven, Subaru, Silicon, and Data.
3911.46s - 3912.98s |  You guys absolutely rocked it.
3912.98s - 3915.06s |  You guys absolutely helped everything out
3915.66s - 3916.50s |  and without you guys,
3916.50s - 3918.78s |  none of the parties would have any equipment.
3918.78s - 3921.02s |  Thank you Defcon A&E as well.
3921.02s - 3923.74s |  And also thank you to the world famous exhibitors department
3923.74s - 3925.78s |  for lending us all the goons we needed
3925.78s - 3927.34s |  whenever we were short-staffed.
3933.10s - 3936.46s |  And next year, if you guys want to throw a party
3936.46s - 3938.70s |  or a meetup, or if you have any feedback
3938.70s - 3940.90s |  about the parties or meetups this year,
3940.90s - 3942.86s |  be on the lookout for the call for parties
3942.86s - 3945.90s |  and email parties at defcon.org.
3945.90s - 3952.50s |  Thank you.
3952.50s - 3954.06s |  He looks really familiar.
3955.34s - 3956.70s |  Dark tangent.
3956.70s - 3959.10s |  Okay, video team.
3960.34s - 3961.74s |  Video team?
3962.82s - 3965.38s |  I see some of the video team.
3965.38s - 3967.66s |  Okay, well then I'll talk about the video team.
3967.66s - 3969.86s |  So if Darrington's not up here.
3971.10s - 3972.70s |  So there's a video team,
3973.58s - 3977.18s |  handcrafted artisanal video creators
3978.14s - 3980.06s |  that you might've seen wearing shirts.
3981.46s - 3982.30s |  I hope.
3983.02s - 3985.74s |  And anyway, this is kind of an outgrowth
3985.74s - 3987.26s |  of reaching out into the community
3987.26s - 3988.82s |  and finding people who've been,
3988.82s - 3991.58s |  have experience building like shorts.
3991.58s - 3994.18s |  And this is, I think the third year we're doing it.
3994.18s - 3995.22s |  And what we really try to do
3995.22s - 3997.70s |  is capture behind the scenes moments,
3997.70s - 3999.26s |  more than just a picture.
4000.10s - 4003.38s |  We wanted to really like empower a group of people
4003.38s - 4005.02s |  sort of as internal Defcon
4006.66s - 4009.06s |  badged representatives that would go out
4009.06s - 4011.30s |  and capture good stories from the community.
4011.30s - 4012.46s |  What are you doing in this village?
4013.30s - 4016.34s |  Tell me about this cool aviation simulation.
4016.34s - 4018.66s |  And really capturing the stories that like,
4018.66s - 4020.58s |  I don't get to see.
4020.58s - 4023.38s |  So I can watch them all and feel like I saw my own con.
4025.30s - 4027.70s |  And the idea then is to have these,
4027.70s - 4029.78s |  you wanna show somebody what's the con all about,
4029.78s - 4032.46s |  like a mini documentary of all the things that happened.
4032.46s - 4036.82s |  And so all these have been recorded and captured.
4036.82s - 4039.10s |  They're being edited and uploaded
4039.10s - 4040.62s |  and we'll start releasing them as shorts
4040.62s - 4041.74s |  on our YouTube channel.
4041.78s - 4044.14s |  And then they'll end up on the media server.
4044.14s - 4049.14s |  So I wanna thank all of the video team for doing this
4049.14s - 4053.98s |  because you're really allowing the preservation
4053.98s - 4055.34s |  of some of the spirit of Defcon
4055.34s - 4057.86s |  that's not captured in either the music recordings
4057.86s - 4058.74s |  or the talk recording.
4058.74s - 4060.06s |  So thank you very much.
4060.06s - 4067.40s |  Give them a round of applause.
4067.40s - 4069.76s |  So next up will be communities.
4069.76s - 4074.90s |  Communities.
4074.90s - 4077.30s |  Someone represent, there he is.
4077.30s - 4085.17s |  Right on.
4085.17s - 4086.09s |  Hello, I'm Pedro.
4086.09s - 4087.77s |  I'm not actually the communities lead,
4087.77s - 4090.49s |  but I was working hand in hand with Chef
4090.49s - 4092.57s |  who is our first year communities lead.
4092.57s - 4096.01s |  He's also accompanied by Seams and Fork.
4096.01s - 4099.77s |  They serviced and assisted with the facilitation
4099.77s - 4101.81s |  and logistics for 13 communities,
4101.81s - 4105.01s |  which is a new department we've been working on.
4105.01s - 4109.81s |  Well, by we, I mean, Nikita has been working on defining,
4109.81s - 4112.77s |  getting it started, getting them spaces
4112.77s - 4115.81s |  and giving them the opportunity to grow organically
4116.49s - 4119.45s |  to hopefully continue on with Defcon.
4120.57s - 4131.53s |  I'm gonna end it there just for the sake of time.
4131.53s - 4133.17s |  If you want to start a community
4133.17s - 4136.05s |  or you think you've got a large enough affinity group,
4136.05s - 4139.53s |  just apply like any other contest, village or event,
4139.53s - 4141.33s |  and we'll try to make space for you.
4142.89s - 4146.85s |  Villages, a big, big department.
4146.85s - 4147.81s |  Come on down.
4154.57s - 4157.41s |  You guys will notice that Pedro's back.
4158.41s - 4160.53s |  He's got a longer list of things to say this time,
4160.53s - 4161.77s |  so I apologize now.
4163.49s - 4167.41s |  So we'd first like to start off with some stats.
4167.41s - 4169.41s |  So there's 34 total villages.
4169.41s - 4170.81s |  We're counting communities underneath us
4170.81s - 4172.69s |  because it was the on-ramp year form and stuff too.
4172.69s - 4174.53s |  And we definitely helped Chef
4174.53s - 4176.37s |  with his facilitation for this year.
4176.37s - 4178.29s |  And then also this is the first year
4178.29s - 4179.97s |  that we had the creator stages.
4179.97s - 4184.13s |  So Ray's behind us as well, helped lead that.
4184.13s - 4185.13s |  Huh?
4185.17s - 4188.25s |  I'm sorry, Ray's Ops, specifically.
4188.25s - 4191.25s |  May or may not be in direct competition with Kev Ops.
4192.77s - 4195.37s |  Did just an outstanding, spectacular job.
4195.37s - 4196.41s |  I don't want to steal his thunder,
4196.41s - 4198.61s |  so I won't talk about it too much.
4198.61s - 4200.33s |  But definitely want to do a special thanks
4200.33s - 4202.01s |  to all the village leads,
4202.01s - 4204.01s |  all the volunteers within the villages.
4205.49s - 4209.25s |  You guys encompass around 660,000 square feet.
4209.25s - 4210.45s |  That is Defcon.
4210.45s - 4212.25s |  Unfortunately for us,
4212.29s - 4215.49s |  it's in a 1.4 million square foot facilities.
4215.49s - 4217.61s |  That means that we have to run all over the place
4217.61s - 4219.41s |  because it's not all consolidated in one place.
4219.41s - 4222.61s |  So our goons definitely get a lot of steps in,
4222.61s - 4224.49s |  but I'll let Pedro go next.
4226.01s - 4227.81s |  So first of all, I'd like to start
4227.81s - 4232.05s |  with 128 page PowerPoint presentation on what went wrong.
4233.13s - 4235.37s |  Before I go, what I would like to do
4235.37s - 4240.37s |  is give a special thanks out to DT, Janet,
4240.37s - 4242.25s |  Nikita and Neil and their minions
4242.25s - 4243.69s |  who chased me around the con.
4244.77s - 4248.13s |  A null value for the hacker tracker stuff.
4248.13s - 4250.93s |  Raisin meat for the creator stages.
4250.93s - 4253.85s |  Bruiser, he's our official cat wrangler.
4254.73s - 4258.37s |  Chef, Seams and Forked for communities work.
4258.37s - 4262.23s |  Fox, Flex and Honey for all the administrative assists.
4262.23s - 4265.13s |  Honestly, without that help, we would have quit.
4265.13s - 4266.61s |  All of our village goons,
4266.61s - 4269.85s |  all of the Defcon departments for their assistance,
4269.85s - 4271.21s |  all of the content creators
4271.21s - 4274.31s |  because nobody would come to Defcon if there wasn't content.
4275.31s - 4276.69s |  Definitely want to give a shout out
4276.69s - 4278.37s |  to our friends and families for putting up
4278.37s - 4281.49s |  with the last minute calls, last minute emergencies
4281.49s - 4286.49s |  and all the sacrifices made to get this show on the road.
4286.51s - 4288.89s |  Finally, a special shout out.
4288.89s - 4290.89s |  I want to give a really big shout out to Nina
4290.89s - 4298.59s |  from biohacking and her mom.
4298.59s - 4299.95s |  One last thing I'd like to say
4299.95s - 4302.39s |  is I'd like to give a shout out to Irf.
4302.39s - 4306.03s |  He's a first time Defconner that showed up.
4306.03s - 4307.35s |  He helped villages.
4307.35s - 4309.59s |  He was running cable at Packet Hacking
4309.59s - 4311.31s |  and he definitely was doing Defcon
4311.31s - 4318.65s |  the way it should be done.
4318.65s - 4319.95s |  Well, first off, I want us,
4319.95s - 4322.07s |  everyone should thank Honey and Pedro
4322.07s - 4323.23s |  if you enjoyed the villages
4323.23s - 4325.87s |  because there was a ton of work behind the scenes
4325.87s - 4326.69s |  that they've been doing.
4326.69s - 4334.37s |  So please.
4334.37s - 4335.85s |  All right, so you might've noticed
4335.85s - 4337.89s |  there was four creator stages this year,
4337.89s - 4339.35s |  also known as Raise Ops.
4340.57s - 4343.03s |  But the creator stages are for villages
4343.07s - 4345.83s |  and communities to use as talk tracks.
4345.83s - 4349.79s |  This year we had 70 hours of contents recorded
4349.79s - 4352.71s |  and almost 150 speakers.
4352.71s - 4356.05s |  So please thank the speakers when you see them.
4356.05s - 4364.78s |  They had some great talks.
4364.78s - 4367.10s |  And then, yeah, thanks to the village goons,
4367.10s - 4368.62s |  especially my second year meet.
4368.62s - 4370.06s |  And thank you all.
4370.06s - 4371.02s |  See you all next year.
4371.02s - 4373.98s |  Appreciate it.
4373.98s - 4375.18s |  See you all next year.
4376.42s - 4378.90s |  And creators, I will miss our weekly calls.
4378.90s - 4380.78s |  I will not be on them for a good while.
4381.42s - 4383.08s |  See you guys some point next year.
4386.56s - 4398.84s |  Okay, so now we have merch.
4398.84s - 4400.00s |  Hello, DEF CON.
4400.00s - 4401.36s |  Who all waited in the merch line
4401.36s - 4403.46s |  at some point this weekend?
4403.46s - 4404.30s |  Yeah, it shows.
4405.24s - 4407.44s |  Thank you all for your patience in dealing with us.
4407.44s - 4410.12s |  We had quite a few people in line this year
4410.12s - 4412.92s |  and we were moving people through faster than ever.
4412.92s - 4414.04s |  After last year,
4414.04s - 4416.40s |  I was working on improving stuff on our backend,
4416.40s - 4420.28s |  so our changes weren't as visible probably
4420.32s - 4423.40s |  as the new ordering system we introduced last year.
4423.40s - 4425.64s |  But we were able to speed up a number of things.
4425.64s - 4429.40s |  We had a 13% faster order velocity year over year
4429.40s - 4430.60s |  from last year,
4430.60s - 4434.08s |  which kind of belays how much merchandise we were moving out
4434.08s - 4436.06s |  because we were actually moving out items
4436.06s - 4438.00s |  at a faster rate too.
4438.00s - 4440.88s |  Items were 18% faster than last year,
4440.88s - 4443.10s |  which I think is speaking to the hard work
4443.10s - 4445.16s |  that our friends at the Hacker Tracker did
4445.16s - 4447.44s |  to get the wishlist and the app
4447.44s - 4449.16s |  and the items available to you all to look at
4449.16s - 4450.18s |  so people can pull orders.
4451.08s - 4453.38s |  And less people have to stand in line.
4453.38s - 4456.42s |  This year, we had a new record for the largest order
4456.42s - 4459.38s |  at 49 items.
4459.38s - 4460.98s |  It was actually a three-way tie.
4461.82s - 4464.94s |  The first shirt that sold the size it sold out
4464.94s - 4467.78s |  was at 11 o'clock almost on Thursday.
4467.78s - 4468.98s |  The first item sold out-
4468.98s - 4470.00s |  What size was it?
4471.38s - 4472.24s |  Women's small.
4477.97s - 4482.77s |  The first full item sold out was at Thursday at 7.49.
4482.81s - 4485.09s |  So we actually had stuff in stock for longer
4485.09s - 4486.45s |  than we had last year,
4486.45s - 4489.41s |  thanks to the great ordering that was done
4489.41s - 4493.43s |  by Amar and the folks at DEF CON headquarters.
4493.43s - 4494.27s |  What was it?
4494.27s - 4495.09s |  What sold out?
4495.09s - 4496.09s |  The water bottle.
4500.47s - 4504.59s |  Highest number of goon steps was 37,677.
4504.59s - 4506.55s |  My blisters will show that
4506.55s - 4508.95s |  if anybody needs to see them later.
4508.95s - 4511.99s |  And we had two goons who went to the ER
4511.99s - 4514.51s |  but still showed up for their shifts the next day.
4514.51s - 4516.59s |  Unrelated to anything that happened here.
4520.40s - 4523.38s |  I'd just like to thank everybody from DEF CON headquarters,
4523.38s - 4526.24s |  DT, Janet, Nikita, Mar,
4526.24s - 4529.60s |  for making sure that things get to us,
4529.60s - 4531.56s |  get ordered and everything for us.
4531.56s - 4533.36s |  QM for getting this stuff to us.
4533.36s - 4534.92s |  Hacker Tracker folks for making
4534.92s - 4537.28s |  the electronic ordering work.
4537.28s - 4539.24s |  And everybody who was patient waiting in line.
4539.24s - 4546.03s |  Thank you very much.
4546.03s - 4547.51s |  And I think it goes without saying
4547.51s - 4551.15s |  that we'll continue to improve the speed.
4551.15s - 4552.55s |  And now that we're in the new space
4552.55s - 4554.55s |  and we kind of understand how it works,
4554.55s - 4555.91s |  we're gonna try to get really creative
4555.91s - 4558.85s |  for other ways to accelerate the merch experience.
4560.03s - 4561.91s |  So Demo Labs.
4561.91s - 4564.63s |  Not a workshop, not a talk.
4564.63s - 4570.02s |  It's a Demo Lab.
4570.02s - 4570.86s |  Thanks everybody.
4570.86s - 4573.42s |  I'm Heisenberg.
4573.42s - 4575.70s |  They've been the lead of Demo Labs for a while.
4575.70s - 4577.22s |  I know exactly where I am
4577.26s - 4580.12s |  but I'm not quite sure of my momentum.
4580.12s - 4582.22s |  The physics joke in DEF CON.
4582.22s - 4583.66s |  Good, okay.
4583.66s - 4585.86s |  It has been a privilege to lead Demo Labs
4585.86s - 4587.26s |  for about the last seven years.
4587.26s - 4589.58s |  I'm joined up here on stage with my seconds
4589.58s - 4591.58s |  for this year, Verbal and Harold.
4591.58s - 4593.62s |  How many of you all went to Demo Lab,
4593.62s - 4596.18s |  at least one Demo Lab this year?
4596.18s - 4597.02s |  Fantastic.
4597.02s - 4598.44s |  I see a decent show of hands.
4598.44s - 4599.34s |  Very good.
4599.34s - 4601.66s |  For those of you who don't know what Demo Labs is,
4601.66s - 4603.54s |  we put out a call for papers every year
4603.54s - 4605.66s |  just like a call for Demo Labs,
4605.66s - 4606.86s |  just like the call for papers,
4606.86s - 4608.50s |  like all the other calls.
4608.50s - 4611.54s |  And this year we got around 100 calls,
4611.54s - 4614.82s |  or 100 proposals, and we down-select.
4614.82s - 4618.02s |  This year we down-selected down to 36 Demo Labs.
4618.02s - 4620.18s |  And the whole purpose of Demo Labs
4620.18s - 4622.36s |  is to give you, the community,
4622.36s - 4625.54s |  the opportunity to engage with the creator
4625.54s - 4627.06s |  of that particular project.
4627.06s - 4629.78s |  Maybe it's a framework, maybe it's a tool,
4629.78s - 4631.78s |  maybe it's some kind of a technique,
4631.78s - 4634.82s |  maybe it's something that's still kind of an idea
4634.82s - 4638.26s |  and it's getting worked on and it's sort of in process,
4638.26s - 4641.78s |  but we really wanna give you the opportunity to interact.
4641.78s - 4643.42s |  The whole purpose of Demo Labs
4643.42s - 4645.64s |  is to foster this collaboration.
4645.64s - 4647.98s |  It's deliberately a small space.
4647.98s - 4652.34s |  We ask the presenters to rotate every 30 minutes or so,
4652.34s - 4657.02s |  so that that way, even though it's a fairly small space,
4657.02s - 4658.94s |  and even though we had a few lines,
4658.94s - 4660.74s |  everybody got a chance to get in
4660.74s - 4662.82s |  and interact with the presenter
4662.82s - 4666.54s |  and have an opportunity to collaborate.
4666.54s - 4670.58s |  So I'd like to also give a shout-out to the Demo Lab crew.
4670.58s - 4672.62s |  We have a crew this year.
4672.62s - 4674.66s |  So if you see us in the white lab coats,
4674.66s - 4676.00s |  those are the Demo Lab goons,
4676.00s - 4679.30s |  and so thanks to all of them for taking care of that.
4679.30s - 4682.08s |  And kind of reflecting back,
4682.08s - 4683.82s |  it's been really a privilege to,
4683.82s - 4685.58s |  there's two things that I kind of think of
4685.58s - 4687.10s |  as I reflect back on it.
4687.10s - 4689.26s |  One of them is, I remember when Demo Labs
4689.26s - 4692.44s |  was just a 19-inch monitor sitting on a table
4693.06s - 4694.36s |  in the middle of a crowded hallway, right?
4694.36s - 4695.60s |  You remember that?
4695.60s - 4700.60s |  So with DT and Grifter and Nikita's support,
4700.60s - 4702.60s |  we've turned Demo Labs into,
4702.60s - 4705.36s |  been able to evolve it into a destination event
4705.36s - 4707.88s |  on par with all of the other really cool things
4707.88s - 4708.92s |  that everybody's doing,
4708.92s - 4710.90s |  and it also is a shout-out to all you
4710.90s - 4715.80s |  who submitted papers or submitted proposals for Demo Labs.
4715.80s - 4719.12s |  So I think the other thing that I really want to mention
4719.12s - 4721.20s |  about Demo Labs, which has been something that's cool,
4721.20s - 4724.76s |  having been involved for seven, eight years or so,
4724.76s - 4727.84s |  is we see a project come in,
4727.84s - 4729.88s |  and it's really kind of ill-formed,
4729.88s - 4732.04s |  it's sort of kind of in the prototype,
4732.04s - 4733.56s |  I'm thinking about this,
4733.56s - 4736.76s |  and you watch the community engagement happen,
4736.76s - 4739.24s |  the people, and they start talking back and forth,
4739.24s - 4742.28s |  and the presenter, and then the project evolves and evolves,
4742.28s - 4744.88s |  and then a few more years, it comes back,
4744.88s - 4747.84s |  and it's just this outstanding, stellar project
4747.84s - 4750.08s |  that is really launched into the community,
4750.20s - 4754.24s |  and that is all down to you all, and your interactions,
4754.24s - 4757.50s |  and your willingness to help interact with the community.
4757.50s - 4759.44s |  So that has been fantastic.
4759.44s - 4761.88s |  The last thing I want to say is,
4761.88s - 4764.00s |  again, it has been a privilege,
4764.00s - 4766.92s |  Verbal and Harold did an outstanding job as my second,
4766.92s - 4769.72s |  this is my opportunity to take a step back,
4769.72s - 4774.12s |  and so for starting with DEF CON, the next DEF CON,
4774.12s - 4776.80s |  Verbal and Harold will be the leads for Demo Labs.
4776.80s - 4784.27s |  So I want you all to absolutely inundate them
4784.75s - 4787.11s |  with outstanding proposals,
4787.11s - 4789.35s |  so that they have a complete conundrum.
4789.35s - 4790.79s |  That would just be awesome.
4790.79s - 4798.60s |  Thank you very much.
4798.60s - 4800.92s |  Okay, you might have noticed the giant glowing box
4800.92s - 4803.88s |  that was the DARPA AI Cyber Challenge.
4804.76s - 4806.44s |  I am not sure if we,
4806.44s - 4810.22s |  do we have someone from DARPA AI Cyber Challenge?
4814.36s - 4816.36s |  I know we were trying to find Perry.
4817.36s - 4818.92s |  But if Perry couldn't make it,
4820.36s - 4822.08s |  I will tell you that as year one
4822.08s - 4824.64s |  of the second two-year contest,
4824.64s - 4827.40s |  this year was essentially the qualifiers.
4827.40s - 4829.34s |  Next year will be the finals.
4829.34s - 4832.68s |  I am told that next year, the space you saw
4832.68s - 4834.32s |  will continue to evolve,
4834.32s - 4837.54s |  and is going to get even more complicated and awesome.
4837.54s - 4842.00s |  And this year, the pre-qualifiers happen before the event.
4842.00s - 4844.62s |  Next year, the finals will happen at the event.
4844.70s - 4845.54s |  So it'll be much more
4845.54s - 4849.82s |  of a sort of spectator observation next year.
4849.82s - 4851.22s |  So you'll be able to really see
4851.22s - 4854.18s |  what the teams are doing, unlike this year.
4854.18s - 4855.58s |  So that is gonna be cool.
4855.58s - 4859.82s |  It'll be the final phase of the AI Challenge.
4860.66s - 4864.76s |  Okay, next up, Grifter, lead of contests.
4873.58s - 4875.18s |  Hey, everybody.
4875.18s - 4877.86s |  So, hi, you specifically.
4878.30s - 4883.93s |  Um, so we had quite a few contests this year.
4883.93s - 4888.93s |  We actually, we received well over 100 contest submissions.
4890.65s - 4895.09s |  And we took 89 contests and events,
4895.09s - 4896.49s |  official contests and events.
4896.49s - 4898.85s |  There are actually more that took place.
4898.85s - 4901.87s |  Like, we don't have, you know,
4901.87s - 4905.31s |  an official designation for two idiots
4905.31s - 4907.73s |  hitting each other in inflatable dinosaur suits,
4907.73s - 4909.93s |  but it happens, right?
4909.93s - 4911.93s |  I don't know who those people are,
4911.93s - 4913.17s |  but they should get help.
4915.21s - 4919.09s |  You lost, um, anyway.
4919.09s - 4922.69s |  So, this year though, every year I always say,
4922.69s - 4924.73s |  if you have an idea for a contest or an event
4924.73s - 4927.17s |  that you wanna pull off, please submit.
4927.17s - 4929.85s |  Like, try to come, come up with something new.
4929.85s - 4931.49s |  If there's something that you experience,
4931.49s - 4935.79s |  then you feel like, you know, this, this can,
4935.79s - 4937.25s |  I can do this better.
4937.65s - 4940.17s |  Do it then, prove it, right?
4940.17s - 4944.89s |  But this year we had 19 new contests and events out there.
4944.89s - 4947.81s |  So, thank you so much to all the new folks
4947.81s - 4949.13s |  who put some skin in the game
4949.13s - 4951.97s |  and created something interesting for you.
4953.41s - 4958.29s |  Um, I do wanna point something out while I'm up here.
4958.29s - 4961.97s |  So, the number one question that my goons are asked,
4961.97s - 4964.97s |  and thank you, thank you to all the contests and events goons
4964.97s - 4968.31s |  who are making sure that this thing goes off,
4968.31s - 4971.29s |  is they get asked, have you seen Grifter,
4971.29s - 4973.49s |  or where is Grifter?
4973.49s - 4975.81s |  Now, I'm usually running around,
4975.81s - 4977.53s |  talking to the contest, trying to figure out
4977.53s - 4979.93s |  who is going to get the black badge
4979.93s - 4981.55s |  at the end of the show, right?
4981.55s - 4984.49s |  So, interviewing them, talking to competitors,
4984.49s - 4985.65s |  that kind of thing.
4985.65s - 4989.69s |  And so, they made me a hacker tracker.
4991.17s - 4993.77s |  It says, definitely not a tracker,
4993.77s - 4995.49s |  but then there's a tile in it,
4995.49s - 4997.33s |  so it's definitely a tracker.
4997.33s - 4999.05s |  And I carried this all weekend,
4999.05s - 5001.81s |  and we shared a link on our group chat.
5001.81s - 5004.77s |  So, at any point, they could push a button
5004.77s - 5006.59s |  and see where Grifter was.
5007.81s - 5012.65s |  It did go off at 3.30 in the morning, on Saturday morning,
5012.65s - 5015.53s |  and I was like, you creepy bastards.
5015.53s - 5020.53s |  But yeah, I was in my hotel room, come find me.
5020.73s - 5022.05s |  Come find me.
5023.61s - 5026.85s |  All right, again, huge thanks to all the creators,
5026.85s - 5028.69s |  everybody who put the time in,
5028.69s - 5031.53s |  and for all of the competitors.
5031.53s - 5034.61s |  Honestly, these contests and events really create
5034.61s - 5036.89s |  the atmosphere that is DEF CON.
5036.89s - 5039.21s |  You may not realize that when you experience
5039.21s - 5041.29s |  something odd in the hallway,
5041.29s - 5043.35s |  or see somebody wandering around
5043.35s - 5045.17s |  with some weird contraption,
5045.17s - 5047.43s |  that that's just somebody playing a game.
5048.43s - 5053.43s |  So, again, I truly believe that the contests and events
5053.75s - 5056.59s |  are part of the soul of DEF CON.
5056.59s - 5060.37s |  Our motto is not one talk, not even one, right?
5060.37s - 5061.95s |  Watch them later on YouTube, it's fine.
5061.95s - 5063.83s |  Actually, don't, because we need you in here
5063.83s - 5065.43s |  and not in the hallway.
5065.43s - 5070.43s |  But like I said, please participate, create,
5070.55s - 5074.19s |  and continue to put together amazing things.
5074.27s - 5077.91s |  Huge thanks to DT, of course, for throwing this party.
5078.91s - 5083.91s |  To Janet, to Neil, Darrington, and all the DEF CON HQ,
5084.15s - 5087.83s |  but especially to Nikita, who,
5087.83s - 5093.91s |  yes, give her a round of applause,
5093.91s - 5097.75s |  who shares many, many phone calls with me,
5097.75s - 5102.33s |  and probably thousands of text messages throughout a year.
5102.33s - 5105.71s |  The voicemail I got on Friday morning,
5105.71s - 5107.39s |  yeah, I'm gonna say it.
5107.39s - 5109.39s |  She left me a voicemail and she said,
5109.39s - 5111.99s |  Grifter, my brother in Christ,
5111.99s - 5114.63s |  if you do not answer this phone
5114.63s - 5117.23s |  or call me back in the next 10 minutes,
5117.23s - 5122.19s |  I'm going to hurt you, a lot.
5123.45s - 5124.85s |  And I got back in five minutes.
5124.85s - 5125.85s |  I'm like, am I in the time?
5125.85s - 5128.11s |  She's like, mm-hmm, so close.
5129.29s - 5133.11s |  So, yes, thank you, Nikita, so much for your support,
5133.11s - 5135.45s |  not only here, but as a friend
5135.45s - 5137.29s |  and in my personal life as well.
5137.29s - 5140.05s |  Thank you to all of you for also being my friends,
5140.05s - 5141.85s |  and I appreciate it.
5141.85s - 5143.59s |  If you have an idea for a contest,
5143.59s - 5145.41s |  the call goes out in January.
5145.41s - 5156.66s |  We'll see you then.
5156.66s - 5163.03s |  Actually, so, is Jeff back?
5163.03s - 5163.87s |  You're back.
5163.87s - 5164.71s |  Do you wanna talk about the?
5164.71s - 5166.63s |  Yeah, okay, Mar, come on up, Mar.
5166.63s - 5170.43s |  So, what I've got around my neck here,
5170.43s - 5171.69s |  if you wanna take a picture,
5171.69s - 5174.05s |  this is the Uber badge this year,
5175.39s - 5177.99s |  and Mar's gonna tell you a little bit
5177.99s - 5183.32s |  about its construction and what makes it special.
5183.32s - 5185.60s |  All right, so, I wanted to capture
5185.60s - 5189.04s |  the glitz and glam of Las Vegas,
5189.04s - 5192.96s |  so I collaborated with my sister, Amy Valentine,
5192.96s - 5195.92s |  and she spent hours and hours
5195.92s - 5198.88s |  hand-placing all of these little glass jewels.
5198.88s - 5200.12s |  In addition to the glass jewels,
5200.12s - 5204.80s |  there is also Swarovski crystals, glass crystals,
5204.80s - 5207.44s |  and there's uranium glass,
5207.44s - 5212.44s |  which is a nod to Las Vegas's atomic history,
5212.48s - 5217.28s |  and a previous black badge that inspired me by Lost,
5217.28s - 5218.64s |  if y'all remember that one.
5220.00s - 5221.92s |  The veins are a gold leaf,
5221.92s - 5224.04s |  which is sort of an expression of the natural history
5224.04s - 5225.40s |  of the place that we're in.
5226.36s - 5227.84s |  Yeah, so the uranium glass,
5227.84s - 5229.44s |  it's a little green eyeball right there,
5229.44s - 5231.52s |  and if, yeah, we checked it out in the bathroom earlier
5231.52s - 5233.80s |  with a UV light, it was really cool.
5233.80s - 5244.04s |  There you go.
5244.04s - 5247.72s |  So each one, as you heard, is hand-crafted,
5247.72s - 5251.92s |  and when you earn, you don't win a gold badge,
5251.92s - 5253.96s |  you earn a gold badge.
5255.32s - 5257.72s |  Or, yeah, I'm sorry, gold, look at me,
5257.72s - 5259.90s |  I'm just like, oh, that's awesome.
5260.90s - 5262.20s |  Gold badges are different.
5263.08s - 5265.16s |  An uber badge, a black badge,
5265.16s - 5268.26s |  and it allows you to enter DEF CON for life,
5268.26s - 5270.20s |  which is like a pretty big commitment,
5270.20s - 5275.20s |  and we give them out every year
5275.76s - 5280.28s |  to contests that we think have reached a certain threshold,
5280.28s - 5283.72s |  and the only contest that gets it for sure every year
5283.72s - 5284.92s |  is Capture the Flag.
5285.88s - 5287.92s |  But beyond that, it's a mystery.
5287.92s - 5292.08s |  Who will be a black badge event?
5292.08s - 5293.76s |  And to answer that mystery,
5293.76s - 5304.71s |  I welcome back up to the stage, Grifter.
5304.71s - 5305.95s |  I'm gonna do it.
5307.39s - 5309.63s |  Yeah, I'm doing it, yep, there it is.
5309.63s - 5312.07s |  So anyway, here's the actual text message,
5312.07s - 5315.03s |  which I censored a little, or the actual voicemail.
5315.03s - 5316.71s |  Grifter, my brother in Christ,
5316.71s - 5319.31s |  if you do not fucking call me back in the next 10 minutes,
5319.31s - 5321.79s |  I'm gonna find somebody to shit in your hotel room
5321.79s - 5324.79s |  every day for the next week.
5324.79s - 5343.05s |  Okay, love you, bye.
5343.05s - 5343.89s |  That's my girl.
5348.15s - 5351.61s |  And she would, actually, she has that kind of authority.
5352.57s - 5356.41s |  All right, so first off,
5356.41s - 5360.93s |  we'll start with a longtime black badge earning contest.
5360.93s - 5365.93s |  A few years ago, I had a conversation with Riverside
5366.25s - 5369.25s |  about upping the ante with Capture the Packet.
5369.25s - 5371.65s |  I felt like it was getting to a place
5371.65s - 5375.09s |  where it needed a little notch up, it had to get harder,
5375.09s - 5379.53s |  and he really, really took that to the next level,
5379.53s - 5383.59s |  to the point that this year, I said, hey, man, relax.
5385.09s - 5387.67s |  But incredible challenges and incredible time.
5387.67s - 5390.01s |  I'll have him come up here and tell you about that,
5390.01s - 5400.32s |  Capture the Packet.
5400.32s - 5401.84s |  I'll do my best with my voice.
5402.84s - 5405.92s |  This new venue has been really hard with all the audio.
5405.92s - 5408.04s |  So I'm Riverside.
5408.04s - 5411.20s |  I just wanna thank everybody that made this one possible.
5411.20s - 5412.70s |  It was really challenging.
5412.70s - 5414.98s |  The PHV team, WOS DJ Co,
5414.98s - 5417.44s |  and especially all of the DEF CON staff here
5417.44s - 5418.88s |  and the attendees to make it happen.
5418.88s - 5419.72s |  So thank you all.
5419.72s - 5421.00s |  I just wanna give you a hand.
5421.00s - 5421.84s |  It was hard.
5425.98s - 5430.78s |  We also changed the format of our prelims and our mains.
5430.78s - 5433.02s |  So normally we would have a time and go, one, two, three,
5433.02s - 5435.30s |  go, and then everybody's going.
5435.30s - 5437.22s |  And our prelims, we just left it open.
5437.22s - 5440.14s |  You sit down and you get a certain amount of time
5440.14s - 5441.78s |  from the time you start to go.
5441.78s - 5444.46s |  So we were able to get a ton of teams in
5444.46s - 5446.66s |  and it was pretty amazing.
5446.66s - 5449.06s |  And we had so much fresh blood
5449.50s - 5452.98s |  and we had some people, the team here,
5452.98s - 5457.54s |  that has been competing now 13 years in a row.
5459.90s - 5462.46s |  I wanna kind of give them just a couple of seconds
5462.46s - 5466.42s |  to also touch on from a competitor standpoint,
5466.42s - 5468.66s |  the differences that Grifter just touched on.
5470.70s - 5471.54s |  Go ahead.
5471.54s - 5472.36s |  Yeah.
5473.46s - 5474.38s |  Thanks everybody.
5475.22s - 5477.02s |  Basically we're here because of this community
5477.02s - 5478.46s |  and what we've learned from all of you over the years.
5479.30s - 5481.50s |  But what they've done in the Captured Packet Village
5481.50s - 5483.02s |  and with the contest, it's gotten tougher.
5483.02s - 5485.06s |  We've played 13 years now.
5485.06s - 5485.90s |  Great fun.
5485.90s - 5488.04s |  It's gotten tougher every single year.
5488.04s - 5489.14s |  They keep challenging us.
5489.14s - 5490.30s |  The gameplay gets better.
5490.30s - 5491.90s |  The system gets better.
5491.90s - 5493.18s |  The challenges get harder
5493.18s - 5495.08s |  and force us to learn more every single year.
5495.08s - 5497.04s |  So we always go away scratching our heads,
5497.04s - 5499.14s |  trying to learn more and come back the next year better.
5499.14s - 5501.30s |  But it's all because of their hard work.
5501.30s - 5503.46s |  And it's just been a blast to play all these years
5503.46s - 5506.22s |  and just really appreciate everything y'all do for us.
5506.22s - 5508.38s |  Yeah.
5508.58s - 5512.30s |  Um, let's see.
5512.30s - 5515.48s |  I think that the things that I want to go over is
5515.48s - 5520.48s |  in third place was Vimwaffles with 320 points.
5524.30s - 5526.62s |  Second place NightSec with 720.
5526.62s - 5531.62s |  And then the first place, the ChatGPT team with 1,220 points.
5532.58s - 5535.06s |  And so give them a hand.
5535.06s - 5535.90s |  Good job.
5536.86s - 5547.58s |  Thank you guys.
5547.58s - 5548.42s |  Thanks everyone.
5548.42s - 5564.54s |  Have a good DEF CON.
5564.54s - 5565.38s |  All right.
5565.38s - 5568.76s |  This, this next contest is only in its second year,
5569.62s - 5574.62s |  but the creator, AJ had put in one of our own goons,
5574.86s - 5576.38s |  AJ702.
5576.38s - 5577.22s |  Where you at?
5580.02s - 5582.34s |  Put in a ridiculous amount of work on this.
5582.34s - 5585.78s |  So last year I felt like it had,
5585.78s - 5588.66s |  it had sense of the mystery challenge.
5588.66s - 5593.46s |  And then this year it really felt like that.
5593.46s - 5596.58s |  It was the kind of contest that brought all aspects
5596.58s - 5599.78s |  of what it means to be a hacker together.
5599.78s - 5604.78s |  Puzzles, crypto, phone freaking, hacking, all of it.
5605.34s - 5607.02s |  And I'll let them come up here and talk about it,
5607.02s - 5613.03s |  but proud of you, girl.
5613.03s - 5615.67s |  Hello, I am AJ and this,
5615.67s - 5617.79s |  these were the creators of the cube.
5618.63s - 5620.03s |  Closer.
5620.03s - 5620.87s |  Okay.
5620.87s - 5622.75s |  So the inspiration for the cube actually came
5622.75s - 5625.35s |  from my first year at DEF CON where I engaged
5625.35s - 5628.79s |  with a goon named Romer and he impressed upon me
5628.79s - 5630.75s |  the importance of no matter if it's your first year
5630.75s - 5632.75s |  or your 20th year, you need to engage
5632.75s - 5635.89s |  and bring something to the community that is missing.
5635.89s - 5638.31s |  So a couple of years ago I was watching a movie
5638.31s - 5641.39s |  and it gave me an idea to make kind of like a puzzle box
5641.39s - 5642.23s |  for hackers.
5642.23s - 5644.95s |  So we have physical elements and also digital elements
5644.95s - 5646.95s |  and Romer's not here with us anymore,
5646.95s - 5648.67s |  but I would like to say thank you to him
5648.67s - 5650.75s |  because he's the only reason we're standing on the stage
5650.75s - 5652.23s |  and a special thanks to Nikita
5652.23s - 5654.83s |  for actually seeing our vision and accepting.
5654.83s - 5656.75s |  Thank you so much, Nikita.
5656.75s - 5657.75s |  Okay.
5657.75s - 5658.59s |  Now go ahead.
5660.59s - 5661.71s |  Hello.
5661.71s - 5663.31s |  So there was an incredible amount of work
5663.31s - 5665.63s |  that went into competing.
5665.63s - 5667.63s |  So it came down to the wire.
5667.63s - 5670.75s |  In second place, we had the teams, the misfits.
5670.75s - 5675.47s |  It was actually tied with 53% of the flags pulled.
5675.47s - 5677.55s |  So 53% of completion.
5678.51s - 5680.59s |  So we had to come down to time,
5680.59s - 5683.95s |  which was a two minute difference within the past,
5683.95s - 5685.51s |  within the last two hours.
5685.51s - 5687.63s |  So very, very close.
5689.75s - 5690.59s |  Yeah.
5690.59s - 5692.51s |  Thank you everyone for who competed.
5692.51s - 5694.79s |  Thank you, Grifter and Nikita.
5694.79s - 5697.87s |  But we had our winners, which were the Mega Doomers.
5700.03s - 5700.87s |  Fantastic.
5704.97s - 5708.59s |  There you go, you go ahead.
5708.59s - 5709.43s |  Yeah.
5709.43s - 5711.31s |  They did a lot of work, a lot of lock picking,
5711.31s - 5713.47s |  a lot of crypto, a lot of web stuff,
5713.47s - 5714.63s |  a lot of work went into it,
5714.63s - 5716.07s |  which was phenomenal to see.
5716.07s - 5717.11s |  So thank you.
5721.18s - 5722.86s |  Yeah.
5722.86s - 5725.26s |  Definitely come join the Cube next year.
5725.26s - 5726.26s |  It's amazing.
5735.07s - 5736.19s |  Are there stairs up there?
5736.19s - 5737.03s |  Yeah.
5744.18s - 5745.02s |  All right.
5745.02s - 5746.02s |  This next contest,
5747.02s - 5750.82s |  it made me excited when they submitted.
5750.82s - 5753.38s |  I was really hoping that they would bring it
5753.38s - 5754.50s |  and they brought it.
5755.74s - 5759.78s |  Freak Me had multiple pay phones out on their tables.
5759.78s - 5760.70s |  I don't know if you saw this
5760.70s - 5763.46s |  and had all of these different freaking challenges,
5763.46s - 5765.34s |  which I think brought back,
5765.34s - 5767.82s |  if you've ever competed in something like
5767.82s - 5770.26s |  the TeleFreak Challenge, the TeleChallenge,
5770.26s - 5773.66s |  then you know, like that part of our culture,
5773.70s - 5776.62s |  you can see it on your lanyard, around the space.
5776.62s - 5778.98s |  Like back in the day, computers,
5778.98s - 5780.82s |  for the whippersnappers in here,
5780.82s - 5784.34s |  your computer used to scream into a telephone
5784.34s - 5786.38s |  in order to talk to other computers.
5786.38s - 5788.50s |  They just screamed at each other.
5790.14s - 5792.26s |  And it costs a lot of money to do that.
5792.26s - 5794.22s |  And so sometimes we had to figure out
5794.22s - 5797.70s |  how we could, one, talk to each other very far away.
5797.70s - 5798.86s |  You know, I mean, I'll just say it,
5798.86s - 5801.22s |  like the DEF CON voice bridge,
5801.22s - 5803.30s |  I used to red box into that constantly.
5803.94s - 5806.66s |  That's how I could call Utah from New York, right?
5806.66s - 5810.22s |  So seeing that freak culture here
5810.22s - 5811.74s |  and seeing it celebrated
5811.74s - 5814.50s |  and seeing them bring that to new people,
5814.50s - 5817.14s |  it just, it warms my heart and they brought it.
5817.14s - 5819.42s |  The challenges they had were impressive.
5819.42s - 5821.02s |  I'll let them tell you about it.
5824.72s - 5825.72s |  Awesome, thank you.
5827.16s - 5829.60s |  All right, so Freak Me.
5831.16s - 5832.64s |  Yeah, basically you want to start by saying
5832.64s - 5835.24s |  how honored and blessed we are to be up here on stage
5835.28s - 5838.76s |  with the people we've looked up to for so, so many years.
5838.76s - 5840.40s |  Huge shout out to all the goons.
5840.40s - 5842.48s |  The production you guys put on is amazing.
5842.48s - 5844.44s |  You guys are the reason all this works so well.
5844.44s - 5845.40s |  So thank you all.
5846.28s - 5849.20s |  Freakme.com, so basically we made a CTF
5849.20s - 5852.56s |  that was hosted on the publicly switched telephone network,
5852.56s - 5856.08s |  212-203-4977.
5856.08s - 5857.08s |  Give it a call anytime.
5857.08s - 5858.44s |  We're gonna leave it up after the cons
5858.44s - 5860.48s |  so you guys continue hammering away at it.
5860.48s - 5864.28s |  We basically stuffed about 75 flags inside of a PBX
5864.28s - 5867.80s |  and we are here today to honor the Psychoholics
5867.80s - 5876.90s |  who smashed every single flag in our entire challenge.
5876.90s - 5877.74s |  Thank you all.
5877.74s - 5879.46s |  Look forward to seeing you guys next year.
5884.46s - 5886.74s |  You guys getting tired of getting black badges yet?
5886.74s - 5888.46s |  Not yet, never gets old.
5888.46s - 5889.30s |  All right.
5890.90s - 5893.34s |  Oh, the Psychoholics won another contest.
5893.34s - 5898.06s |  Oh, that's 47 black badges for those guys.
5898.06s - 5899.74s |  I think you have more black badges
5899.74s - 5901.58s |  than people on your crew, right?
5901.58s - 5903.46s |  Is that a fact?
5903.46s - 5904.46s |  Is it a fact?
5904.46s - 5906.14s |  No, but they're saying no.
5906.14s - 5907.54s |  Damn it, so they'll be back.
5909.86s - 5911.18s |  I mean, they are talented.
5912.34s - 5914.42s |  It's unreal, it's unreal.
5914.42s - 5918.42s |  So the next one coming up on stage
5918.42s - 5921.94s |  is the Social Engineering Community CTF.
5922.86s - 5926.02s |  How many people made it out or stood in the line
5926.02s - 5929.02s |  and enjoyed the community aspect of standing in line
5929.02s - 5931.30s |  for the Social Engineering Village?
5931.30s - 5932.82s |  No, all right, great, great, great.
5932.82s - 5936.78s |  Awesome, that line was down the hall, wrapped around,
5936.78s - 5938.30s |  came all the way around the other side.
5938.30s - 5939.74s |  It was something else.
5939.74s - 5941.50s |  They put a lot of effort into it
5941.50s - 5943.50s |  and they do a really, really good job
5943.50s - 5947.18s |  of not only presenting their subject matter,
5947.18s - 5949.50s |  but of entertaining the audience as well.
5949.50s - 5954.26s |  Their staff are charming and good looking,
5954.26s - 5955.46s |  especially you, buddy.
5956.30s - 5958.34s |  And then, like I said,
5958.34s - 5961.02s |  they add aspects to it that are entertaining.
5961.02s - 5962.22s |  So not only you're learning,
5962.22s - 5964.26s |  but everybody is in there laughing.
5964.26s - 5971.78s |  So here they are, the Social Engineering Community.
5971.78s - 5975.78s |  Oh, hello, DEF CON, I'm back and I'm joined with Snow.
5975.78s - 5977.74s |  It's me, JC.
5977.74s - 5979.38s |  Hi, I'm Snow.
5979.38s - 5982.62s |  And we bring you the Social Engineering Community.
5982.62s - 5985.06s |  So this is a huge labor of love.
5985.06s - 5987.66s |  It's a lot of work and I apologize about the lines,
5987.66s - 5988.82s |  but that's just part of it.
5989.18s - 5991.18s |  We gotta try and bring some line games in next year.
5991.18s - 5994.34s |  So I'm going to let Snow talk about the competition,
5994.34s - 5997.54s |  our Social Engineering Community Vishing Competition.
5998.82s - 6000.66s |  All right, so for those of you
6000.66s - 6003.18s |  who are not familiar about the competition,
6003.18s - 6006.06s |  it's not just show up here and do cool shit.
6006.06s - 6010.86s |  We pre-select 14 teams and they spend months
6010.86s - 6012.98s |  doing OSINT and building plans.
6012.98s - 6014.98s |  So much work goes into this
6014.98s - 6017.86s |  before they even step foot into DEF CON.
6017.86s - 6020.98s |  Then once they get here, they spend 22 minutes
6020.98s - 6024.26s |  in our soundproof booth in front of you all
6024.26s - 6028.18s |  placing live vishing calls, which is terrifying.
6030.06s - 6032.74s |  And as Grifter said, we like to up the ante every year.
6032.74s - 6035.74s |  Each year we get a little bit better at what we're doing
6035.74s - 6037.50s |  and then we also push the limits.
6037.50s - 6039.10s |  This year we had a heart rate sensor
6039.10s - 6041.06s |  for the competitors to wear.
6041.06s - 6043.34s |  That was fun to watch going from 80 to one.
6043.34s - 6046.86s |  I think the max was 165 I saw.
6046.86s - 6049.50s |  I felt like we needed paramedics on standby.
6049.50s - 6052.58s |  It was a little nerve wracking, but we also did something.
6052.58s - 6054.70s |  It wasn't an official competition,
6054.70s - 6056.50s |  but we decided to push the limits again
6056.50s - 6059.18s |  and Saturday morning following our same structure,
6059.18s - 6062.18s |  we had a completely AI team.
6063.78s - 6064.62s |  That was it.
6064.62s - 6065.46s |  They weren't typing prompts.
6065.46s - 6068.86s |  It was a full AI bot talking to someone
6068.86s - 6070.42s |  and that was incredible.
6070.42s - 6072.98s |  So now we're looking at how do we incorporate the AI piece
6072.98s - 6075.38s |  into our competition for next year?
6075.38s - 6076.86s |  So a lot of research, a lot of thinking,
6076.86s - 6078.26s |  a lot of work for us next year.
6078.26s - 6079.62s |  But without further ado,
6079.62s - 6082.54s |  our second place team was Hall and Ocent
6082.54s - 6085.10s |  and I'm joined on stage with our first place team.
6085.10s - 6086.26s |  I like that name.
6086.26s - 6090.94s |  A girl has a team and that team is comprised of Andy, James
6090.94s - 6095.02s |  and unfortunately their third teammate had to not be present
6095.02s - 6097.38s |  due to an emergency, but Jace.
6097.38s - 6107.16s |  So Andy, James and Jace, our first place team.
6107.16s - 6108.00s |  Awesome.
6108.00s - 6108.92s |  Thank you everyone to help support us.
6108.92s - 6112.36s |  Attendees are Gund, Nikita, Grifter, DT.
6112.36s - 6123.04s |  Thank you so much.
6123.04s - 6124.48s |  Oh, thanks.
6124.48s - 6125.32s |  Presence.
6125.32s - 6126.14s |  Thanks.
6126.14s - 6127.32s |  Bribes.
6127.32s - 6132.32s |  So this next crew put on an incredible competition.
6133.68s - 6135.40s |  I actually heard enough about it that I was like,
6135.40s - 6136.24s |  I got to make it over there.
6136.24s - 6137.72s |  I've got to make it over there
6137.72s - 6140.92s |  from the folks who were participating.
6140.92s - 6144.40s |  The Embedded Systems Village CTF put together
6144.40s - 6145.68s |  an incredible challenge.
6145.68s - 6146.92s |  They had, what did you say?
6146.96s - 6150.36s |  70 different teams that were competing
6150.36s - 6153.00s |  and they had to be gated through different things.
6153.00s - 6154.16s |  I'll let them get into that.
6154.16s - 6158.32s |  I will say though, what really warms my heart
6158.32s - 6160.30s |  is that they handed me something they had made.
6160.30s - 6164.88s |  It was a badge that they stopped and handed it to me
6164.88s - 6167.88s |  and they said, wait a minute, get him the instructions.
6167.88s - 6169.20s |  He'll hurt himself.
6172.00s - 6178.20s |  The Embedded Village Systems CTF.
6178.20s - 6179.20s |  Hey, DEF CON.
6179.20s - 6181.40s |  I'm Tevo from the Embedded Systems Village.
6183.08s - 6186.08s |  I first want to thank all the DEF CON organizers
6186.08s - 6188.82s |  and the village goons, John and Pedro.
6190.00s - 6191.84s |  This year was a lot of work
6191.84s - 6193.02s |  and I really appreciate everything
6193.02s - 6194.12s |  that you were able to help us with
6194.12s - 6196.16s |  and it was a great event.
6196.16s - 6197.50s |  I want to thank the team behind me
6197.50s - 6199.28s |  that helped put on this challenge.
6199.28s - 6201.36s |  It made a really incredible CTF.
6201.36s - 6203.20s |  We had over 50 challenges.
6203.20s - 6205.48s |  It started with some embedded devices
6205.48s - 6208.40s |  that had known vulnerabilities and end-day vulnerabilities
6208.40s - 6211.20s |  from LTE gateways to satellite base stations
6211.20s - 6213.50s |  and ruggedized camera systems.
6213.50s - 6216.32s |  This year, the challenge that we added
6216.32s - 6220.36s |  was that when teams got to a certain threshold,
6220.36s - 6222.56s |  we would give them an embedded development board
6222.56s - 6224.04s |  with challenges baked into that
6224.04s - 6225.24s |  and they would take that home
6225.24s - 6226.34s |  and they worked on them overnight
6226.34s - 6227.48s |  and they would come back the next day
6227.48s - 6230.40s |  and they would get a bunch of points in the CTF.
6230.40s - 6233.48s |  I want to give a big props to the team, BYU Pony,
6233.48s - 6234.92s |  who made a really good push
6235.36s - 6236.88s |  and actually got tied at one point,
6236.88s - 6240.60s |  but ultimately lost out to our winners, Flowers by Irene.
6261.22s - 6262.22s |  We're psychoholics.
6262.22s - 6264.98s |  We don't just win challenges, we run them.
6264.98s - 6267.34s |  We get black badges and we give them away.
6268.60s - 6269.44s |  I don't know.
6269.44s - 6272.34s |  All right, so if you're not familiar with this contest,
6272.34s - 6276.06s |  Crafting Compile is on the contest stage.
6276.06s - 6278.82s |  I'll let them get into all of the actual details
6278.82s - 6279.94s |  about how the contest went,
6279.94s - 6281.86s |  but I will say that one of the things
6281.86s - 6285.46s |  that, see, that's what they told me I would hurt myself with
6285.46s - 6287.78s |  and now DT is just swinging it around.
6290.18s - 6291.14s |  What are you saying?
6291.14s - 6292.10s |  I didn't say anything, man.
6292.10s - 6292.94s |  I'm at school.
6292.94s - 6293.78s |  We're good.
6296.34s - 6297.94s |  One of the parts of their challenge, though,
6297.94s - 6300.34s |  is that they have a team distraction
6300.34s - 6302.70s |  who is meant to distract the competitors
6302.70s - 6305.78s |  throughout the entire contest.
6305.78s - 6307.38s |  Well, at one point,
6307.38s - 6309.96s |  one of the members of team distraction came up to me
6309.96s - 6312.68s |  and said, hey, we need to talk about the sun
6312.68s - 6314.64s |  because it's really, really bright over there
6314.64s - 6316.72s |  and it's like blinding people and stuff.
6316.72s - 6320.50s |  And I was like, you want me to fix the sun?
6321.68s - 6325.76s |  And I was like, aren't you on team distraction?
6325.76s - 6327.48s |  Badge the sun.
6327.48s - 6328.64s |  All right, so.
6328.64s - 6336.03s |  All right, Crafting Compile.
6336.03s - 6340.19s |  I can feel the love, I can feel the love.
6340.19s - 6341.71s |  Hey, everyone.
6341.71s - 6345.01s |  So yeah, this psychoholics team is kind of interesting.
6345.85s - 6347.85s |  So a little background on Crash Compile.
6347.85s - 6350.13s |  It's a programming drinking game.
6350.13s - 6353.69s |  So we had 49 teams register.
6353.69s - 6354.93s |  Nine of them made the cut.
6354.93s - 6356.45s |  And on the main stage,
6356.45s - 6359.25s |  they had to go through a series of programming challenges.
6359.25s - 6361.69s |  In this case, they had to actually write code
6361.69s - 6363.17s |  to navigate a maze
6363.17s - 6366.61s |  and discover all these programming challenges along the way.
6366.61s - 6368.85s |  And anytime they messed up,
6368.85s - 6371.41s |  something didn't work or we just felt like it,
6371.41s - 6372.41s |  they had to drink.
6374.13s - 6375.37s |  For a long time.
6377.25s - 6380.69s |  We went through, I think it was around 145 beers
6380.69s - 6384.25s |  for nine teams in a short amount of time.
6384.25s - 6385.09s |  Very good.
6386.05s - 6389.25s |  The winning team, Hack O' Spaghetti,
6389.25s - 6390.49s |  not only got drunk,
6390.49s - 6393.97s |  but they also win this magnificent dice
6393.97s - 6396.53s |  that we put together, solid steel.
6396.53s - 6398.25s |  Very dangerous.
6398.25s - 6399.45s |  Don't break the laptop.
6399.45s - 6400.53s |  Don't break the laptop.
6400.65s - 6401.49s |  Don't break it to DT.
6401.49s - 6403.73s |  He'll throw it in the office.
6403.73s - 6404.69s |  Just willy nilly.
6406.01s - 6408.61s |  Anyway, we really enjoyed it this year.
6408.61s - 6409.65s |  Things went really well.
6409.65s - 6412.61s |  Wanted to thank all of the contest goons,
6412.61s - 6414.85s |  contest events goons.
6414.85s - 6416.65s |  Everything went off swimmingly.
6416.65s - 6418.45s |  We even made our own sign this year,
6418.45s - 6420.07s |  which was like arts and crafts.
6420.07s - 6421.17s |  I really enjoyed that.
6423.25s - 6424.81s |  But yeah, thank you everyone.
6424.81s - 6429.94s |  Thank you.
6429.94s - 6430.76s |  Thank you.
6430.76s - 6431.60s |  Thank you.
6431.60s - 6432.44s |  Thank you.
6432.44s - 6433.26s |  Thank you.
6433.26s - 6436.53s |  Get out.
6436.53s - 6437.97s |  I actually, just to be clear,
6437.97s - 6439.81s |  I do love the Psychaholics.
6439.81s - 6441.93s |  I play D&D with a couple of them, so.
6443.87s - 6445.05s |  All right.
6445.05s - 6447.03s |  This next crew up here,
6447.03s - 6447.87s |  I always say this,
6447.87s - 6450.45s |  this is a contest that's also near and dear to my heart
6450.45s - 6452.51s |  because I used to run it.
6452.51s - 6454.29s |  And when I did,
6455.33s - 6457.09s |  we did a lot of bad things,
6457.09s - 6459.09s |  but they have taken it,
6459.09s - 6463.33s |  allegedly, we did a lot of bad things.
6463.33s - 6465.25s |  They've taken it to the next level.
6465.25s - 6467.01s |  They've actually integrated it so much
6467.01s - 6468.29s |  into the conference now
6468.29s - 6471.69s |  that it really is part of DEF CON.
6471.69s - 6474.25s |  So, and then at a certain point,
6474.25s - 6477.25s |  there's always been strip teases,
6477.25s - 6478.65s |  but this was the first year
6478.65s - 6480.69s |  that a robot dog was twerking
6480.69s - 6482.11s |  while that was going on.
6483.13s - 6490.39s |  The scavenger hunt.
6490.39s - 6491.23s |  Allegedly.
6491.23s - 6492.07s |  Allegedly.
6492.07s - 6494.27s |  Oh, this, I love this.
6494.27s - 6495.27s |  Did you see?
6495.27s - 6496.83s |  They run over our stickers.
6496.83s - 6497.67s |  Fantastic.
6498.67s - 6500.19s |  Just like that.
6502.19s - 6504.87s |  That is some authentic traction.
6504.87s - 6505.71s |  So as mentioned,
6505.71s - 6507.11s |  we are the DEF CON scavenger hunt.
6507.11s - 6510.95s |  This is our 27th consecutive year here at the con.
6512.03s - 6512.91s |  My name is Zora.
6512.91s - 6515.59s |  This is the 10th year I've been working the scavenger hunt
6515.59s - 6517.23s |  as a judge alongside Sconce,
6517.23s - 6519.11s |  who it's also his 10th year.
6519.11s - 6523.27s |  We have EvilMofo in his 12th year as a judge for the hunt.
6523.27s - 6524.99s |  We have Balsa for his third year.
6524.99s - 6526.19s |  And of course, DualD,
6526.23s - 6528.31s |  who is busy packing up all our shenanigans
6528.31s - 6531.27s |  in his 15th year working the hunt.
6531.27s - 6533.11s |  If you don't know who we are,
6533.11s - 6538.11s |  we are allegedly the cause of all shenanigans at the con.
6538.31s - 6540.31s |  And one of the best ways that you can experience
6540.31s - 6543.35s |  a little bit of everything that DEF CON has to offer.
6543.35s - 6545.71s |  A lot of the past teams and players
6545.71s - 6548.79s |  have become core parts of this community.
6549.75s - 6550.95s |  So with that,
6551.75s - 6556.75s |  we have had a record of 150 teams sign up to play this year.
6559.03s - 6559.87s |  And with that,
6559.87s - 6570.05s |  our top three teams are all first time DEF CON attendees.
6570.05s - 6574.33s |  So we'd like to acknowledge our second and third place teams.
6574.33s - 6577.45s |  Our third place team is Degenerates
6577.45s - 6579.77s |  with a total of 103 points.
6580.77s - 6585.77s |  Our second place team is Regenerate One with 118 points.
6587.21s - 6589.17s |  And of course our first place team,
6589.17s - 6592.09s |  Bananarchy with 143 points.
6592.09s - 6592.93s |  Coming up guys.
6608.73s - 6611.65s |  So with that, thank you so much.
6611.65s - 6612.97s |  Thank you for always having us
6612.97s - 6615.13s |  and allowing us to raise all sorts of help.
6616.09s - 6617.13s |  Second and third place teams,
6617.13s - 6618.69s |  come see us outside to track one
6618.69s - 6630.23s |  and we'll see y'all next year.
6630.23s - 6632.55s |  All right, so we really like contests
6632.55s - 6635.75s |  that try to engage multiple aspects of the community
6635.75s - 6638.87s |  or try to push people to get outside of their comfort zone,
6638.91s - 6640.11s |  learn new skills,
6640.11s - 6641.83s |  engage new attendees
6641.83s - 6645.27s |  and challenge them throughout the conference.
6645.27s - 6647.83s |  This next contest did all of those things
6647.83s - 6649.95s |  and really brought some,
6649.95s - 6653.91s |  tried to focus on bringing new attendees into it
6653.91s - 6656.99s |  and pushing them to really, really experience DEF CON
6656.99s - 6658.79s |  as it was meant to be experienced.
6658.79s - 6667.79s |  And so with that, Octopus Games.
6667.79s - 6669.03s |  What's up guys?
6669.03s - 6672.66s |  Who knows about Octopus Game?
6672.66s - 6674.58s |  If you would have told me three years ago
6674.58s - 6675.66s |  when I came up with the idea
6675.66s - 6677.10s |  that I'd be up here speaking,
6677.10s - 6678.90s |  giving one of our players a black badge,
6678.90s - 6680.54s |  I would have probably laughed at you.
6680.54s - 6685.42s |  But yeah, my original idea was to rip off the show Squid Game
6685.42s - 6686.90s |  and create a battle royale
6686.90s - 6689.62s |  and everyone would meet up and battle with kids games
6689.62s - 6691.74s |  and they would make friends and explore the con
6691.74s - 6693.22s |  and it was awesome.
6693.22s - 6694.86s |  And over the next two years,
6694.86s - 6696.10s |  it's grown and evolved
6696.10s - 6699.62s |  and we have an amazing team of volunteers.
6699.62s - 6703.14s |  Let me, Josh Mason's calling me right now.
6703.14s - 6704.34s |  It's too late.
6704.34s - 6705.18s |  You got to answer it.
6705.18s - 6707.74s |  If you get called on stage, you have to answer.
6707.74s - 6708.58s |  It's too late.
6708.58s - 6710.26s |  I fucked up.
6710.26s - 6711.10s |  They'll call back.
6711.10s - 6714.10s |  Okay, so I did very little to help the people
6714.10s - 6715.74s |  that should be up here are behind me
6715.74s - 6716.58s |  and they're kind of shy,
6716.58s - 6717.50s |  especially this lady.
6717.50s - 6718.50s |  This is my wife, Nicole.
6718.50s - 6719.82s |  She ran the game this year.
6719.82s - 6722.66s |  So really they deserve all the credit.
6722.66s - 6723.86s |  I did very little.
6725.62s - 6728.26s |  So thank you, Nicole, for running the contest
6728.26s - 6730.66s |  and all of our volunteers this year.
6730.66s - 6733.02s |  Wade, who has one of the most famous mustaches
6733.02s - 6734.06s |  in InfoSec.
6735.30s - 6737.94s |  Josh Mason, who was just trying to call me right now
6737.94s - 6739.38s |  and I should have answered it.
6739.38s - 6742.38s |  Jibby, Erica, Jen and George, thank you so much.
6742.38s - 6743.58s |  Thank you to our sponsors,
6743.58s - 6746.34s |  Black Girls Hack, Cyber Supply Drop,
6746.34s - 6747.98s |  Women's Society of Cyber Jiu-Jitsu
6747.98s - 6749.62s |  is really awesome to give our players
6749.62s - 6751.70s |  some really good prizes this year.
6751.70s - 6755.74s |  And thank you to Grifter, Nikita, DT,
6755.74s - 6758.14s |  everyone on the contest and events crew,
6758.14s - 6760.02s |  Cabe's and Seco, everybody.
6760.02s - 6761.26s |  Like this is really awesome.
6761.26s - 6763.86s |  And yeah, we just wanted to build a contest.
6763.86s - 6767.74s |  That's kind of the unofficial tutorial quest for the con.
6767.74s - 6769.46s |  We want people to explore the villages,
6769.46s - 6772.34s |  meet people, like you said, outside of your comfort zone.
6772.34s - 6774.10s |  So yeah, thanks for having us.
6779.30s - 6780.26s |  All right, we're not done yet.
6780.26s - 6781.18s |  Sorry, sorry.
6782.10s - 6783.98s |  Little, little premature.
6783.98s - 6785.98s |  We had 120 competitors.
6785.98s - 6789.02s |  16 of them completed all 12 challenges
6789.02s - 6790.94s |  with the final challenge tiebreaker
6790.94s - 6794.10s |  being a large game of Simon Says.
6794.10s - 6796.62s |  And the winner was Greg.
6796.62s - 6797.46s |  That's all we know.
6797.46s - 6798.30s |  He's not here right now.
6798.30s - 6800.26s |  We do have his information and we'll be giving him the badge.
6800.26s - 6801.46s |  Thank you.
6801.46s - 6802.30s |  Oh, good.
6802.30s - 6803.62s |  Let's save this one badge.
6803.62s - 6804.66s |  Problem solved.
6804.66s - 6805.50s |  Oh, you got it?
6805.50s - 6806.34s |  Okay.
6806.34s - 6807.46s |  So you'll get it to Greg.
6807.46s - 6808.38s |  You'll get the badge.
6808.38s - 6809.22s |  Okay, great.
6809.22s - 6815.79s |  Thank you very much.
6815.79s - 6818.87s |  All right, this next contest really brings it.
6818.87s - 6822.75s |  They bring a huge team to literally build a city
6822.75s - 6827.67s |  inside of the contest area to outfit it with utilities
6827.67s - 6830.43s |  and to put on one hell of a show
6830.43s - 6844.19s |  with that Red Alert ICS CTF.
6844.19s - 6845.19s |  Hi, DEF CON.
6845.19s - 6846.71s |  Annyeonghaseyo from Korea.
6847.59s - 6849.99s |  So we've been running the Red Alert ICS CTF
6849.99s - 6852.23s |  for the past three days.
6852.23s - 6854.31s |  And we hope that our players have had a lot of fun.
6854.31s - 6858.23s |  We've run a pure ICS team CTF, right?
6858.23s - 6861.55s |  And we had 62 teams show up this year
6861.59s - 6863.43s |  and it's been a fun weekend, I hope.
6864.27s - 6867.35s |  For quick results on joint third position,
6867.35s - 6870.15s |  we have three teams, Corridor Crew, Dollar Rip,
6870.15s - 6871.63s |  and Ripper's Cape.
6871.63s - 6873.55s |  Second position, Noob Tube.
6873.55s - 6876.27s |  And first position, Team Tesuji.
6876.27s - 6882.44s |  Black Badge winners.
6882.44s - 6885.48s |  And just a quick note on the amount of work
6885.48s - 6886.32s |  that the team has done.
6886.32s - 6889.08s |  They came in second place last year and they kept working.
6889.08s - 6892.48s |  They came back this year and they just won the CTF.
6892.48s - 6895.24s |  And thank you DEF CON for making us a Black Badge event
6895.60s - 6898.72s |  for the third time and the second time in a row right now.
6898.72s - 6901.80s |  And a special gratitude to our contest leads,
6901.80s - 6904.72s |  contest goons, Sikov, Cabes, Grifter,
6904.72s - 6906.32s |  everyone here on stage.
6906.32s - 6908.64s |  And for the rest of my team on stage and off stage
6908.64s - 6911.08s |  who have come in from Korea and from Singapore.
6911.08s - 6914.72s |  And to our sponsor and partner, Athena Dynamics as well.
6914.72s - 6922.84s |  Thank you very much, everybody.
6928.98s - 6930.86s |  All right, if you were in the contest area,
6930.86s - 6932.94s |  you really couldn't miss this one.
6932.94s - 6937.38s |  The next folks coming to the stage are the Car Hacking CTF.
6937.38s - 6940.06s |  One of the things that I love about this CTF
6940.06s - 6941.98s |  is that they continue to innovate.
6941.98s - 6944.02s |  They continue to switch things up
6944.02s - 6947.32s |  and they actually convince manufacturers
6947.32s - 6950.18s |  to allow them to add aspects of the contest
6950.18s - 6952.70s |  into what they're doing with the vehicle.
6952.70s - 6957.70s |  So, like I said, the contest creators that are here
6958.02s - 6960.22s |  really make DEF CON what it is.
6960.22s - 6962.02s |  They put in a significant amount of work
6962.02s - 6964.46s |  and they even in cases jump through
6964.46s - 6968.54s |  what must only be the most ridiculous legal hoops
6968.54s - 6969.74s |  to make these things happen.
6969.74s - 6971.54s |  So, the Car Hacking CTF.
6976.33s - 6977.27s |  Thank you, Grifter.
6978.21s - 6979.05s |  I'm gonna be quick,
6979.05s - 6981.57s |  cause I wanna relax and go get in a hot tub.
6981.57s - 6982.61s |  I'm Justin Justin.
6982.61s - 6985.13s |  I'm the chief of the Car Hacking Village.
6985.13s - 6986.63s |  This has been our 10 year anniversary.
6986.63s - 6989.83s |  So, thank you DEF CON for letting us do this for 10 years.
6989.83s - 6991.73s |  Cannot believe it's been 10 years now.
6993.17s - 6994.53s |  Some firsts this year.
6994.53s - 6996.21s |  We brought a semi-truck this year.
6996.21s - 6997.21s |  I don't know if anybody's seen,
6997.21s - 6999.53s |  but we've been trying to do this for a few years now.
6999.53s - 7000.45s |  We actually made it happen.
7000.45s - 7001.93s |  So, we had a class eight semi-truck here
7001.93s - 7004.45s |  that people were able to learn and hack on.
7004.45s - 7006.57s |  And like Grifter was saying, another first for us,
7006.57s - 7010.81s |  we had an OEM Rivian actually put flags in their vehicle
7010.81s - 7013.95s |  for people to hack on and try to figure out and find.
7013.95s - 7015.21s |  So, that was really big for us
7015.21s - 7017.41s |  and amazing that an OEM actually worked with us
7017.41s - 7018.67s |  to put flags in their vehicle.
7018.67s - 7020.29s |  So, huge shout out to Rivian.
7020.29s - 7023.83s |  Thank you.
7023.83s - 7026.11s |  Moving into our CTF challenge.
7026.67s - 7027.79s |  We had about 15 challenges.
7027.79s - 7031.99s |  We tried to keep them very hard and difficult.
7031.99s - 7035.11s |  They were all around automotive networking and exploitation.
7035.11s - 7037.15s |  We had 95 teams registered this year.
7037.15s - 7039.63s |  So, a big shout out to all the teams that played.
7040.59s - 7041.79s |  Our last problem was solved
7041.79s - 7044.23s |  about an hour before the contest closed.
7044.23s - 7046.39s |  And to dig into some of our winners this year,
7046.39s - 7049.55s |  I'll just start with our second place team was Canucks.
7049.55s - 7052.03s |  So, congratulations.
7052.03s - 7054.35s |  And moving into our first place team,
7054.35s - 7057.11s |  who actually also won a Tesla.
7057.11s - 7059.15s |  So, we actually gave away a car this year
7059.15s - 7060.67s |  for our first place prize.
7060.67s - 7061.99s |  It wasn't just, well,
7061.99s - 7063.47s |  we found out about a black badge later,
7063.47s - 7066.11s |  but we're not only just allowing the winners
7066.11s - 7067.11s |  to get a black badge this year,
7067.11s - 7068.87s |  they are also winning a Tesla.
7068.87s - 7071.19s |  So, congratulations to our first place team.
7071.19s - 7072.47s |  Upper score.
7072.47s - 7078.27s |  Congratulations and thank you guys again.
7078.27s - 7079.11s |  Thanks Defcon.
7089.76s - 7091.00s |  All right.
7091.00s - 7093.68s |  You know them and you love them.
7093.68s - 7095.24s |  They knew, they were the only ones
7095.60s - 7097.08s |  who knew they were getting a black badge
7097.08s - 7098.00s |  before this morning.
7098.00s - 7101.20s |  And that's because I texted Jeff yesterday
7101.20s - 7102.96s |  as Hacker Jeopardy was starting.
7102.96s - 7105.80s |  I said, hey, it's the 30th anniversary.
7105.80s - 7107.24s |  We're doing this, right?
7107.24s - 7111.16s |  And he just sent back, yes, with exclamation points.
7111.16s - 7116.16s |  So, what they don't know is like Jeff and I had talked
7116.32s - 7118.56s |  and I said, hey, one of the guys on the team
7118.56s - 7122.52s |  for Hacker Jeopardy already has a black badge.
7122.52s - 7124.56s |  And he was like, so there's just two guys
7125.00s - 7125.84s |  that don't have black badges
7125.84s - 7128.44s |  on the 30th anniversary winning team.
7128.44s - 7130.60s |  We should give them two black badges.
7131.56s - 7146.04s |  So, come up and get those two black badges, Hacker Jeopardy.
7146.04s - 7149.44s |  30 fucking years of Hacker Jeopardy, Jeff.
7150.80s - 7154.92s |  Not many of you know that when we did Hacker Jeopardy one,
7154.92s - 7157.74s |  Jeff was my van of vinyl.
7160.04s - 7163.60s |  There are pictures, we will make sure that they are up.
7163.60s - 7167.60s |  And Nikita has somehow tolerated our bullshit
7167.60s - 7169.64s |  for how many years now?
7169.64s - 7173.12s |  Grifter and DT, the support that we've had.
7173.12s - 7178.12s |  And you guys, you've made this 30 years absolutely amazing.
7179.72s - 7183.16s |  And as long as I fucking stay vertical,
7183.16s - 7185.56s |  you can't get rid of me.
7185.56s - 7188.16s |  We will return, Hacker Jeopardy.
7188.16s - 7190.92s |  30 fucking years, thank you all.
7191.20s - 7196.20s |  This year, it came down at the very end.
7196.64s - 7200.00s |  We had three teams for the final.
7200.00s - 7202.20s |  And everybody could have won.
7202.20s - 7204.40s |  Everybody could have won.
7204.40s - 7207.92s |  And the final category was to do some sort of bullshit,
7207.92s - 7212.40s |  figuring out what all the OSI layers were
7212.40s - 7214.20s |  in reverse alphabetical order.
7214.20s - 7218.20s |  So one of the teams got it absolutely right,
7218.20s - 7220.62s |  not in the form of a question.
7221.12s - 7226.12s |  Another team got it absolutely right,
7227.56s - 7230.30s |  but not in reverse order.
7232.12s - 7235.28s |  So the only team that got it right is,
7235.28s - 7239.32s |  my other computer is your stepmom.
7239.32s - 7240.64s |  Let's hear it for them.
7254.11s - 7255.31s |  Congratulations, guys.
7258.47s - 7259.63s |  Make it weird for them.
7260.67s - 7267.08s |  All right, and last but certainly not least,
7267.60s - 7271.32s |  I say this every year, they need no introduction,
7271.32s - 7272.32s |  capture the flag.
7281.69s - 7283.57s |  Good afternoon, DEF CON.
7283.57s - 7285.37s |  We are Nautilus Institute,
7285.37s - 7288.25s |  third time organizers of DEF CON Capture the Flag.
7288.25s - 7291.61s |  And I assure you, there are actually more than three of us.
7291.61s - 7295.13s |  So kicking things off, once again,
7295.13s - 7297.09s |  we partnered with LiveCTF
7297.09s - 7301.85s |  to bring more audience enjoyable activities into our game.
7301.85s - 7305.63s |  LiveCTF is the head-to-head speed hacking component
7305.63s - 7307.45s |  of DEF CON Capture the Flag,
7307.45s - 7310.01s |  where participants must battle head-to-head
7310.01s - 7311.27s |  in a tournament for points
7311.27s - 7313.89s |  that are added to their final score.
7313.89s - 7318.37s |  You can see the full recaps online at livectf.com
7318.37s - 7322.83s |  or scan this QR code, pretend,
7322.83s - 7325.29s |  to go right to the final match.
7325.29s - 7327.89s |  All challenges are already open source
7327.89s - 7330.61s |  and linked from that site as well.
7330.61s - 7333.37s |  Our favorite moment was in one of the first rounds
7333.37s - 7336.69s |  where last year's winning team, Maple Mallard Magistrates,
7336.69s - 7339.97s |  were knocked right down into the spirit world lower bracket
7339.97s - 7342.39s |  due to an unintended solution.
7342.39s - 7346.41s |  Always watch your stir and comps versus mem comps.
7346.41s - 7348.67s |  Congratulations to Blue Water
7348.67s - 7359.11s |  for an undefeated run through LiveCTF.
7359.11s - 7361.07s |  All right, you know we've got to say thanks
7361.07s - 7363.31s |  to a bunch of people who made this possible.
7363.31s - 7366.07s |  So thanks to all the hardworking DEF CON goons
7366.07s - 7369.19s |  in every department, Dark Tangent, Nikita, Grifter,
7369.19s - 7372.47s |  Caves, Seacove, Aster, the rest of the DEF CON staff,
7372.47s - 7374.25s |  especially the knock and sock goons
7374.25s - 7376.91s |  who were extremely helpful with our
7378.75s - 7381.63s |  sometimes very quick needs.
7381.63s - 7384.41s |  Your work, dedication and creativity and ingenuity
7384.41s - 7387.81s |  inspire us to continue to make a mountain worth climbing.
7387.81s - 7389.51s |  This year's finals hosted teams
7389.55s - 7391.95s |  that qualified from many contests.
7391.95s - 7395.95s |  DEF CON CTF finals in 2023, HITCON in Taiwan,
7395.95s - 7399.03s |  Plaid CTF in the US, OCTF in China,
7399.03s - 7402.53s |  and our own qualifiers hosted this May.
7402.53s - 7406.75s |  Our qualifiers saw 1,700 teams submit hundreds of solutions
7406.75s - 7408.79s |  to dozens of challenges.
7408.79s - 7412.51s |  For finals, 12 teams flew in from dozens of countries
7412.51s - 7417.37s |  to the largest DEF CON CTF venue yet.
7417.37s - 7420.33s |  We built eight attack-defense challenges,
7420.33s - 7422.09s |  one King of the Hill challenge,
7422.09s - 7423.61s |  and our friend from Live CTF
7423.61s - 7426.65s |  ran 22 head-to-head Live CTF matches.
7426.65s - 7428.91s |  The scoreboard was busy the whole time,
7428.91s - 7430.61s |  and first place was up for grabs
7430.61s - 7434.68s |  up until the last hour of the game.
7434.68s - 7437.46s |  In third place this year, we had Super Dice Code.
7440.84s - 7444.64s |  There we go.
7444.64s - 7447.64s |  In second place, and the winners of the Live CTF,
7447.64s - 7454.33s |  we had Blue Water.
7454.33s - 7456.97s |  And in first place, some of the only people in the world
7456.97s - 7460.01s |  who have been on this stage more than I have for CTF,
7460.01s - 7479.83s |  Maple Mallard Magistrates.
7479.83s - 7481.07s |  Good afternoon, everyone.
7482.15s - 7487.15s |  We're thrilled and honored to be the DEF CON 32 CTF winners.
7487.19s - 7490.79s |  It's a privilege to represent MMM,
7490.79s - 7494.75s |  our amazing international team with PPP from the US,
7494.75s - 7498.95s |  Daduk from Korea, and Maple Bacon from Canada.
7498.95s - 7502.11s |  Winning three years in a row
7502.11s - 7505.63s |  really shows the dedication, brainpower we have,
7505.63s - 7507.91s |  and teamwork we've got.
7507.91s - 7511.87s |  The past few days were intense and challenging,
7511.87s - 7514.91s |  but that's what pushed us to our best.
7514.91s - 7516.79s |  And of course, a huge thank you
7516.79s - 7518.87s |  to the organizers and DEF CON
7518.87s - 7522.75s |  for crafting such a dynamic and engaging competition.
7522.75s - 7525.19s |  And to my two teammates,
7525.19s - 7528.11s |  your hard work, skill, and passion
7528.11s - 7531.55s |  are the reasons we're standing here today
7531.55s - 7533.55s |  as champions once again.
7534.39s - 7535.35s |  Thank you, everyone.
7535.35s - 7537.75s |  We can't wait to see you all again next year.
7537.75s - 7550.40s |  Thanks.
7550.40s - 7551.24s |  All right.
7551.24s - 7554.24s |  So this is where I would like to thank
7554.24s - 7555.52s |  all of our departments
7555.52s - 7558.52s |  that have made this conference possible.
7558.52s - 7560.76s |  And I'd also like to point out,
7560.76s - 7564.04s |  none of us were ready to change locations
7564.04s - 7565.88s |  so quickly six months ago.
7566.88s - 7568.84s |  I haven't really told the story, but...
7569.44s - 7572.72s |  So we'd had this really long-standing relationship
7572.72s - 7573.76s |  with Caesars,
7573.76s - 7577.12s |  and the main person that I would work with,
7577.12s - 7578.60s |  I wouldn't talk to very often
7578.60s - 7580.44s |  because things would be going right.
7581.36s - 7583.80s |  And almost 20 years.
7583.80s - 7586.36s |  And I get a call, I get a message,
7586.36s - 7590.08s |  and like, hey, are you available for a call sometime?
7590.08s - 7593.04s |  And I'm thinking, oh, I don't hear from him very often.
7593.04s - 7594.72s |  I wonder what's going on.
7594.72s - 7596.36s |  So I ask our salespeople,
7596.52s - 7599.32s |  Caesars sales, like, should I get ready for this call?
7599.32s - 7602.12s |  They're like, we don't know what the call's about.
7602.12s - 7603.16s |  I go, okay.
7603.16s - 7604.00s |  Oh, 20 years.
7604.00s - 7605.64s |  I bet he's retiring.
7605.64s - 7606.64s |  He's gotta be retiring.
7606.64s - 7608.24s |  He's gonna give me a heads up he's retiring
7608.24s - 7610.32s |  and he's gonna pass me off to the next guy.
7610.32s - 7611.60s |  Okay, cool.
7611.60s - 7613.96s |  So I get on the phone call and we're chit-chatting
7613.96s - 7616.92s |  and I'm waiting for him to tell me that he's retiring.
7616.92s - 7618.40s |  And he's like, I've got some bad news.
7618.40s - 7620.04s |  We're terminating the contract.
7621.28s - 7622.88s |  Oh, so you're not gonna be able to do it?
7622.88s - 7625.88s |  And I'm like, no, no, no, no, no, no, no, no, no, no, no.
7625.92s - 7627.36s |  Oh, so you're not retiring.
7629.00s - 7631.12s |  This is gonna be a problem.
7631.12s - 7633.76s |  And yeah, that was quite the moment.
7633.76s - 7637.48s |  And that's when it just all happened all at once.
7637.48s - 7642.48s |  And so I said, what the fuck do I do now?
7642.92s - 7646.36s |  And he said, oh, remember Janice used to work for us?
7646.36s - 7648.08s |  Yeah, she's over at the LVCC now.
7648.08s - 7649.76s |  We've got a date lined up for you.
7649.76s - 7651.12s |  They're holding the space.
7651.12s - 7652.84s |  Give them a call.
7652.84s - 7654.28s |  Super awesome.
7654.28s - 7657.68s |  And so it worked out and here we are,
7657.68s - 7660.12s |  which meant that everybody on this list,
7660.12s - 7663.76s |  all the teams, departments, contests, creators, villages,
7663.76s - 7667.40s |  we all had to pivot at warp speed
7667.40s - 7669.36s |  to make this conference happen,
7669.36s - 7671.56s |  which I'll be honest at many times
7671.56s - 7673.22s |  did not quite look possible.
7674.08s - 7675.96s |  But I think what's happened
7676.92s - 7678.40s |  is I think we've all just gone through
7678.40s - 7682.56s |  this giant trial by fire experience, right?
7682.56s - 7685.16s |  It was really kind of a little traumatic,
7685.16s - 7686.72s |  but we pulled it off.
7686.72s - 7690.12s |  And I think because the event was so positive
7690.12s - 7694.36s |  and the space so good, we had a great experience.
7694.36s - 7696.36s |  Who likes this space?
7696.36s - 7704.08s |  It was not something we would have done on our own.
7707.14s - 7708.20s |  We wouldn't have just decided
7708.20s - 7709.66s |  to make this kind of a big change,
7709.66s - 7711.88s |  but since we were forced to make the change,
7711.88s - 7713.90s |  we made the best of it.
7713.90s - 7717.26s |  So I just want to thank all the departments
7717.26s - 7719.06s |  and all the goons that made it possible.
7719.06s - 7720.82s |  Let's give you guys a round of applause.
7720.82s - 7730.22s |  Thank you.
7730.22s - 7733.22s |  And I'd like to acknowledge and recognize
7733.22s - 7735.30s |  the goons that are retiring.
7735.30s - 7739.22s |  Gmark, Noise, Ira, Estabang, Gattaca, Dekuna,
7739.22s - 7744.22s |  The Saint, Morphix, Brick, or Bick, Wham, Casper,
7747.14s - 7750.74s |  and all the current gold badge holders and all.
7750.74s - 7753.42s |  So a gold badge holder is sort of like an Uber badge.
7753.42s - 7757.62s |  After 10 years of service, if you decide to retire,
7757.62s - 7760.36s |  you get attendance for life for the service.
7761.34s - 7764.38s |  And then Noons, which are the new goons coming in.
7764.38s - 7765.82s |  So thank you, everyone.
7765.82s - 7773.53s |  Noons!
7773.53s - 7775.25s |  So this is us, so I'll skip by that.
7775.25s - 7777.33s |  Thank you, thank me, thank you.
7777.33s - 7778.17s |  Okay.
7780.21s - 7784.31s |  Also, we try to keep a lot of the content online year round.
7785.15s - 7787.91s |  We have a bunch of social stuff that we try to do.
7787.91s - 7791.27s |  Darrington does a movie night on our Discord.
7791.27s - 7794.31s |  We have our DEF CON social server.
7794.31s - 7797.53s |  We've got stuff on YouTube, Instagram, all that stuff.
7797.53s - 7799.91s |  There's ways to participate with the community year round,
7799.91s - 7803.03s |  or even if you don't get to attend in person.
7804.67s - 7808.15s |  So I have, I think I'm almost out of slides,
7808.15s - 7812.35s |  but I do have something here, dark chocolate story.
7812.35s - 7815.51s |  Okay, so I have to tell you the dark chocolate story.
7815.51s - 7817.55s |  In the badge, at some point,
7817.55s - 7819.63s |  you can elusively sometimes come across
7819.63s - 7820.77s |  the dark tangent character.
7820.77s - 7823.57s |  I guess I'm pretty elusive and I run away from you a lot.
7824.79s - 7828.27s |  But apparently, and no one told me, Mar,
7828.27s - 7832.91s |  that if you get near me and the bright stars align
7832.91s - 7834.79s |  and there's some proximity something,
7834.79s - 7837.99s |  it says that the dark tangent will give you dark chocolate.
7838.19s - 7842.43s |  Or the dark chocolate character arrives.
7842.43s - 7843.59s |  I don't know what it is.
7843.59s - 7845.61s |  So the first time it happens to me,
7845.61s - 7847.43s |  I'm walking down the hall and someone runs up to me
7847.43s - 7851.20s |  and says, dark chocolate.
7851.20s - 7854.08s |  I'm like, okay, what's going on?
7854.08s - 7856.32s |  I had no idea, I was totally bewildered.
7856.32s - 7858.76s |  The second time it happens though,
7858.76s - 7861.76s |  it's last night, it looks like maybe a husband and wife
7861.76s - 7864.88s |  or boyfriend, girlfriend, and they are like,
7864.88s - 7867.36s |  we've got him, we found him, dark chocolate.
7867.36s - 7870.28s |  And they come up to me and they're, dark chocolate.
7871.92s - 7874.96s |  What do we, like if I'm near you, I get a,
7874.96s - 7877.86s |  and I just so happen to have a chocolate bar in my pocket.
7877.86s - 7883.71s |  And so, there they are.
7883.71s - 7885.85s |  There they are, right there.
7892.88s - 7894.22s |  There they are.
7894.22s - 7895.90s |  And I'm thinking to myself, holy shit,
7895.90s - 7897.66s |  I've got chocolate in my pocket.
7897.66s - 7900.10s |  And so I'm, they're like, so dark chocolate,
7900.10s - 7903.06s |  and I just unzip my pocket, I hand them the chocolate bar
7903.06s - 7904.46s |  and I turn around and walk away.
7904.46s - 7909.46s |  And they're like, holy fuck, that worked.
7912.10s - 7913.58s |  It was amazing, and here you are.
7913.58s - 7916.02s |  I just, I knew that it was probably a story
7916.02s - 7918.30s |  you're gonna tell forever because it was like perfect,
7918.30s - 7920.42s |  everything aligned, so that was awesome.
7921.48s - 7922.78s |  And there they, I'm glad I told the story,
7922.78s - 7924.98s |  I'm glad I wrote that down, awesome.
7924.98s - 7928.66s |  Okay, so for next year, we expect to see you back
7928.66s - 7930.36s |  August 7th to 10th.
7937.24s - 7941.32s |  I think this space is amazing, and it gives us a,
7941.32s - 7943.28s |  so some of the comments I heard was,
7943.28s - 7947.28s |  my shoulders aren't bruised from being bumped into.
7947.28s - 7950.94s |  Other people said that it felt like a con from 10 years ago,
7950.94s - 7953.08s |  even though there might be a lot of people here,
7953.08s - 7956.24s |  they didn't feel so much like FOMO and pressure,
7956.24s - 7958.68s |  and it was much more chill and relaxed.
7958.68s - 7961.16s |  Is that a pretty honest estimation, you think?
7961.16s - 7962.06s |  Yeah, pretty cool?
7964.12s - 7966.72s |  I know there's always gonna be growing pains, but it,
7967.72s - 7972.20s |  so as organizers, we're really close to the problem,
7972.20s - 7974.56s |  and sometimes you don't see the big picture,
7974.56s - 7976.66s |  and so for me, I was really obsessing
7976.66s - 7980.80s |  over all the problems, and all I was reading online
7980.80s - 7984.40s |  was people saying, amazing, everybody under one roof,
7984.40s - 7987.36s |  this'll be great, we haven't done this since DEF CON 20,
7987.36s - 7988.28s |  yeah, 27.
7988.44s - 7989.28s |  Yeah.
7991.28s - 7995.16s |  And so, that's when I realized the power
7995.16s - 7996.88s |  of sort of community all under one roof
7996.88s - 7999.60s |  was gonna just wash over all these problems,
7999.60s - 8002.32s |  and that was really, I mean, that was one of the reasons
8002.32s - 8004.68s |  why we really put the energy in to make this happen,
8004.68s - 8007.46s |  was because we thought the benefits of all under one roof
8007.46s - 8009.36s |  was gonna be amazing, and it really,
8009.36s - 8012.56s |  holy, who, what, who's that by the door there?
8012.56s - 8013.40s |  Hey there.
8014.48s - 8015.84s |  Hey, giant chickens.
8016.40s - 8018.96s |  Oh, Jesus Christ.
8024.68s - 8029.44s |  All right, see you next year at the LVCC West Hall.
8029.44s - 8031.20s |  More content will be online,
8031.20s - 8035.24s |  and you are now authorized to disengage.


