# MediaChunks

chunk_text:
you going it it would show a higher price when you actually search 629.14s - 631.02s | That's not like a cookie because you already search 631.02s - 635.74s | It's because it's because this second connecting flight only has one seat available in that our class 636.14s - 638.14s | So learning some of this can help you 639.02s - 643.82s | Piece together and understand like I found a good fare. I want to book this which days can actually go 644.46s - 646.46s | And net really narrow it down 648.30s - 650.38s | So following the money where it all goes 651.94s - 657.30s | Basically, there's a thing called a valid validating carrier and that's the one that issues the ticket and that's the e-ticket database 657.30s - 663.38s | They use interesting factors American Airlines has all their serial numbers start with double zero one 663.38s - 666.78s | But every because they were the first computerized airline 666.78s - 674.02s | But all of all of the airlines basically have one of these three digit identifiers that for identifying which stock that is 675.06s - 677.70s | You also have a concept of a marketing carrier now 677.70s - 682.62s | that's the flight number you buy and so you might if you've heard of a code share before or ever booked a flight like that 682.62s - 684.10s | where you're like 684.10s - 687.62s | Maybe you've booked fit air, but it's actually like a American or British flight 687.66s - 691.66s | That's what a code share is an operating carrier. Obviously the metal that you're on 692.66s - 698.00s | so just an example like to tie some of these concepts together this is a little bit of an unusual boarding pass because it's 698.00s - 703.74s | Printed by air lingus and then on and it's a it's an it's an American flight that was sold as British Airways 703.74s - 707.46s | And but you can also see there with this electronic. There's the longer 707.98s - 713.86s | There's the longer marking there with starting in 125 and that's the e-ticket. That's the e-ticket serial number number, right? 714.82s - 716.82s | the the 25 717.10s - 723.90s | Below there is also like a sequence number of how which you know the check-in or when


chunk_text:
a marketing carrier now 677.70s - 682.62s | that's the flight number you buy and so you might if you've heard of a code share before or ever booked a flight like that 682.62s - 684.10s | where you're like 684.10s - 687.62s | Maybe you've booked fit air, but it's actually like a American or British flight 687.66s - 691.66s | That's what a code share is an operating carrier. Obviously the metal that you're on 692.66s - 698.00s | so just an example like to tie some of these concepts together this is a little bit of an unusual boarding pass because it's 698.00s - 703.74s | Printed by air lingus and then on and it's a it's an it's an American flight that was sold as British Airways 703.74s - 707.46s | And but you can also see there with this electronic. There's the longer 707.98s - 713.86s | There's the longer marking there with starting in 125 and that's the e-ticket. That's the e-ticket serial number number, right? 714.82s - 716.82s | the the 25 717.10s - 723.90s | Below there is also like a sequence number of how which you know the check-in or when they were at that 724.94s - 730.85s | At the outstation when you sort of checked in online and when it went on the manifest 732.53s - 736.97s | So having having regard to those sort of concepts, I'll talk about some of the weaknesses so 738.41s - 743.97s | Why you sometimes see those flat fares now for getting so low like $1 or $15 as we saw before 744.09s - 751.41s | Is that a lot of the components now come up as you know carrier surcharges under this fuel surcharge that started in 2004? 752.69s - 753.89s | so 753.89s - 757.97s | Yeah, initially, they're only like 20 bucks or something because the oil price is fluctuating 758.01s - 762.57s | But then what happened was I guess the airlines realized they weren't didn't have to pay at that time 762.57s - 765.53s | They thought they didn't have to pay commissions and other things on these 766.37s - 772.61s | Amounts so so from my perspective they kind of seem a bit like junk fees like resort fees and stuff that you might pay at hotels 773.97s - 774.97s | the 774.97s - 776.97s |


chunk_text:
they were at that 724.94s - 730.85s | At the outstation when you sort of checked in online and when it went on the manifest 732.53s - 736.97s | So having having regard to those sort of concepts, I'll talk about some of the weaknesses so 738.41s - 743.97s | Why you sometimes see those flat fares now for getting so low like $1 or $15 as we saw before 744.09s - 751.41s | Is that a lot of the components now come up as you know carrier surcharges under this fuel surcharge that started in 2004? 752.69s - 753.89s | so 753.89s - 757.97s | Yeah, initially, they're only like 20 bucks or something because the oil price is fluctuating 758.01s - 762.57s | But then what happened was I guess the airlines realized they weren't didn't have to pay at that time 762.57s - 765.53s | They thought they didn't have to pay commissions and other things on these 766.37s - 772.61s | Amounts so so from my perspective they kind of seem a bit like junk fees like resort fees and stuff that you might pay at hotels 773.97s - 774.97s | the 774.97s - 776.97s | interesting fact is that 777.37s - 780.89s | Because the way they're levied. It's actually it actually has become more complicated 781.41s - 786.33s | The calculations have become more complicated and one thing that's that's interesting to note. Is that 787.13s - 792.37s | The way and the way they're published the validating carrier decides whether to apply it or not 792.37s - 794.37s | It's not necessarily the airline that you're flying on 794.89s - 800.87s | So this presented some opportunities to that that could force the errors could creep in 801.27s - 804.51s | So as I say here that is the s1 record is like a 805.19s - 807.19s | it's just a database record that has 807.79s - 812.47s | you know the criteria for applying the surcharge and how much it is, but 814.51s - 819.87s | You know when all the things that matches so we'll go and the fact that it has like sequence numbers 819.87s - 821.87s | It's sort of works a bit like a firewall world 823.27s - 828.71s | So when we talk about exploits for this the the good old days what people were doing for


chunk_text:
interesting fact is that 777.37s - 780.89s | Because the way they're levied. It's actually it actually has become more complicated 781.41s - 786.33s | The calculations have become more complicated and one thing that's that's interesting to note. Is that 787.13s - 792.37s | The way and the way they're published the validating carrier decides whether to apply it or not 792.37s - 794.37s | It's not necessarily the airline that you're flying on 794.89s - 800.87s | So this presented some opportunities to that that could force the errors could creep in 801.27s - 804.51s | So as I say here that is the s1 record is like a 805.19s - 807.19s | it's just a database record that has 807.79s - 812.47s | you know the criteria for applying the surcharge and how much it is, but 814.51s - 819.87s | You know when all the things that matches so we'll go and the fact that it has like sequence numbers 819.87s - 821.87s | It's sort of works a bit like a firewall world 823.27s - 828.71s | So when we talk about exploits for this the the good old days what people were doing for a while 829.39s - 833.83s | Was was that they were actually just going over to another airlines desk and getting them to book flights 833.83s - 838.59s | You know like a ticketing desk and getting them to book the flights for the other airline and have them issued by 840.15s - 845.15s | One that didn't levy the surcharge, but there was an IATA resolution and that's kind of gone away 847.15s - 850.33s | But the more I guess the more interesting ones and the more technical ones for us 851.23s - 856.75s | and for defenders is is the way that those s1 records work and 856.91s - 860.19s | And they apply it so you I've got a bit of an example here from one of the the 860.75s - 863.99s | From the apps code the fair publishing manual there, right? 864.79s - 867.51s | So some of you may also be able to see why? 868.59s - 873.59s | How these can sort of break or be pushed at the end of that sequence can be skipped. So for instance like 874.95s - 879.27s | And and it might depend on whether the


chunk_text:
a while 829.39s - 833.83s | Was was that they were actually just going over to another airlines desk and getting them to book flights 833.83s - 838.59s | You know like a ticketing desk and getting them to book the flights for the other airline and have them issued by 840.15s - 845.15s | One that didn't levy the surcharge, but there was an IATA resolution and that's kind of gone away 847.15s - 850.33s | But the more I guess the more interesting ones and the more technical ones for us 851.23s - 856.75s | and for defenders is is the way that those s1 records work and 856.91s - 860.19s | And they apply it so you I've got a bit of an example here from one of the the 860.75s - 863.99s | From the apps code the fair publishing manual there, right? 864.79s - 867.51s | So some of you may also be able to see why? 868.59s - 873.59s | How these can sort of break or be pushed at the end of that sequence can be skipped. So for instance like 874.95s - 879.27s | And and it might depend on whether the fair actually has is compatible with other fares 879.31s - 885.01s | But if it is for instance, if all the last one has if all ticketed points are wholly within the u.s 885.29s - 890.69s | Well, what happens if you have a you know domestic segment in Canada or Mexico or whatever for instance, right? 891.37s - 893.37s | It wouldn't apply it, right? So 893.93s - 897.33s | Just a demo of this I can show you this is this is quite an old one 897.93s - 901.73s | People in that sort of travel community don't really like this stuff shared 902.53s - 907.25s | But this is an old one. I found it interesting to try and even just get this to work stuff to work 907.25s - 909.05s | It's a bit like pen testing 909.05s - 910.45s | but 910.45s - 913.19s | This is one here where it's a it's a fair for 914.01s - 918.81s | $727 a normal return what we and with the surcharge of you know close to 60% 920.21s - 926.41s | So what happens is if we actually add a another segment that's compatible there and


chunk_text:
fair actually has is compatible with other fares 879.31s - 885.01s | But if it is for instance, if all the last one has if all ticketed points are wholly within the u.s 885.29s - 890.69s | Well, what happens if you have a you know domestic segment in Canada or Mexico or whatever for instance, right? 891.37s - 893.37s | It wouldn't apply it, right? So 893.93s - 897.33s | Just a demo of this I can show you this is this is quite an old one 897.93s - 901.73s | People in that sort of travel community don't really like this stuff shared 902.53s - 907.25s | But this is an old one. I found it interesting to try and even just get this to work stuff to work 907.25s - 909.05s | It's a bit like pen testing 909.05s - 910.45s | but 910.45s - 913.19s | This is one here where it's a it's a fair for 914.01s - 918.81s | $727 a normal return what we and with the surcharge of you know close to 60% 920.21s - 926.41s | So what happens is if we actually add a another segment that's compatible there and and and break that 927.21s - 928.45s | application 928.45s - 930.45s | it will 930.81s - 936.77s | You know what you're doing is you're actually adding, you know another fare on there and it's pushing the base price up 936.77s - 939.93s | But because the surcharge was so low. It's actually dropped your price down 940.45s - 941.61s | You know 941.61s - 944.61s | You've added a hundred pounds in this instance, but you've lost 945.25s - 948.51s | It's you know miscalculated the price by 260 949.89s - 952.05s | Another thing that's this sort of interesting is the way 952.85s - 958.29s | Because of the competitive nature of markets how there is sometimes arbitrage opportunities 958.29s - 960.45s | But this can be a bit of effort like you you know 960.45s - 962.01s | You might have to see if to start your ticket there 962.01s - 965.37s | So like but sometimes it could be worth it like for instance if you're in Hong Kong 965.37s - 969.55s | You want you know, you start your journey in Japan or you're in the US and you start it in Canada 969.55s


chunk_text:
and and break that 927.21s - 928.45s | application 928.45s - 930.45s | it will 930.81s - 936.77s | You know what you're doing is you're actually adding, you know another fare on there and it's pushing the base price up 936.77s - 939.93s | But because the surcharge was so low. It's actually dropped your price down 940.45s - 941.61s | You know 941.61s - 944.61s | You've added a hundred pounds in this instance, but you've lost 945.25s - 948.51s | It's you know miscalculated the price by 260 949.89s - 952.05s | Another thing that's this sort of interesting is the way 952.85s - 958.29s | Because of the competitive nature of markets how there is sometimes arbitrage opportunities 958.29s - 960.45s | But this can be a bit of effort like you you know 960.45s - 962.01s | You might have to see if to start your ticket there 962.01s - 965.37s | So like but sometimes it could be worth it like for instance if you're in Hong Kong 965.37s - 969.55s | You want you know, you start your journey in Japan or you're in the US and you start it in Canada 969.55s - 971.55s | But these things fluctuate and change 972.51s - 976.11s | Another thing to look for is some of these countries with unstable currencies 977.35s - 981.51s | Some ticket, you know, sometimes they or fixed exchange rates for instance Egypt 981.91s - 987.23s | Changed their official exchange rate by 50% and there was some you know, good deals that came out of that 987.91s - 993.63s | For a period but a lot of the other countries actually publish in euros or US dollars that have unstable currency 993.63s - 995.63s | So it's not a doesn't happen all the time 996.63s - 1002.67s | Another one that's I guess a bit more another vulnerability that's been a bit more popularized and talked about 1003.83s - 1009.95s | Over the last 10 years is the is hidden city ticketing. This is a you know, a very well-known practice 1009.95s - 1015.47s | That's you know that all airlines sort of hate, you know bash up agents if they try and do it, right? 1015.55s - 1021.03s | But essentially you can see here if you're comparing this this is a Delta flight 1021.71s - 1025.99s |


chunk_text:
- 971.55s | But these things fluctuate and change 972.51s - 976.11s | Another thing to look for is some of these countries with unstable currencies 977.35s - 981.51s | Some ticket, you know, sometimes they or fixed exchange rates for instance Egypt 981.91s - 987.23s | Changed their official exchange rate by 50% and there was some you know, good deals that came out of that 987.91s - 993.63s | For a period but a lot of the other countries actually publish in euros or US dollars that have unstable currency 993.63s - 995.63s | So it's not a doesn't happen all the time 996.63s - 1002.67s | Another one that's I guess a bit more another vulnerability that's been a bit more popularized and talked about 1003.83s - 1009.95s | Over the last 10 years is the is hidden city ticketing. This is a you know, a very well-known practice 1009.95s - 1015.47s | That's you know that all airlines sort of hate, you know bash up agents if they try and do it, right? 1015.55s - 1021.03s | But essentially you can see here if you're comparing this this is a Delta flight 1021.71s - 1025.99s | You're trying to go to Atlanta, right, but if you look directly it's gonna be close to $200 1026.03s - 1029.19s | But but when when a Nashville flight is tacked on to the end of it 1029.19s - 1032.19s | It actually, you know, it's less than half 1032.39s - 1038.99s | now the reason for that is I guess business customers want to fly direct generally people pay more for a direct and whatever competitions in 1038.99s - 1042.61s | The different markets so they want to fill those seats, but not do it 1043.87s - 1048.97s | The issues with these kind of things is that it is generally against the terms of conditions of carriage 1049.29s - 1053.93s | And what they also do is if people are checking bags, they don't they don't short check it to you destination 1054.01s - 1056.85s | That is of course unless you have an overnight or longer layover 1056.89s - 1062.17s | so if the fare is actually flexible what and you're you could be totally within the rules by 1062.65s - 1065.89s | Booking one of these and say well, I'll go to Nashville for a weekend


chunk_text:
You're trying to go to Atlanta, right, but if you look directly it's gonna be close to $200 1026.03s - 1029.19s | But but when when a Nashville flight is tacked on to the end of it 1029.19s - 1032.19s | It actually, you know, it's less than half 1032.39s - 1038.99s | now the reason for that is I guess business customers want to fly direct generally people pay more for a direct and whatever competitions in 1038.99s - 1042.61s | The different markets so they want to fill those seats, but not do it 1043.87s - 1048.97s | The issues with these kind of things is that it is generally against the terms of conditions of carriage 1049.29s - 1053.93s | And what they also do is if people are checking bags, they don't they don't short check it to you destination 1054.01s - 1056.85s | That is of course unless you have an overnight or longer layover 1056.89s - 1062.17s | so if the fare is actually flexible what and you're you could be totally within the rules by 1062.65s - 1065.89s | Booking one of these and say well, I'll go to Nashville for a weekend 1065.89s - 1069.49s | You know three weeks, you know in three weeks because you live in Atlanta for instance 1069.49s - 1074.31s | So sometimes you can make these things work without without actually, you know breaking the rules 1076.01s - 1078.01s | Another thing I'll talk about is 1078.29s - 1082.37s | Mistake fares. So sometimes you see things in the press. There's been a few good ones where 1083.85s - 1085.85s | You know that they will 1086.61s - 1089.91s | in a first class of 500 bucks return from Asia or whatever because 1090.25s - 1095.05s | someone's either the often to see that the route they allowed routing has been there's a mistake or 1095.29s - 1100.81s | The base fare has been uploaded incorrectly because it's still I believe it's still kind of manual in a lot of ways 1100.81s - 1106.13s | There's still a lot of spreadsheets that are used. So in the past the USD OT used to be very 1106.93s - 1110.77s | Aggressive in enforcing this legislation on post purchasing price increase 1111.01s - 1116.49s | But in 2015 what happened was there was a very large issue with


chunk_text:
1065.89s - 1069.49s | You know three weeks, you know in three weeks because you live in Atlanta for instance 1069.49s - 1074.31s | So sometimes you can make these things work without without actually, you know breaking the rules 1076.01s - 1078.01s | Another thing I'll talk about is 1078.29s - 1082.37s | Mistake fares. So sometimes you see things in the press. There's been a few good ones where 1083.85s - 1085.85s | You know that they will 1086.61s - 1089.91s | in a first class of 500 bucks return from Asia or whatever because 1090.25s - 1095.05s | someone's either the often to see that the route they allowed routing has been there's a mistake or 1095.29s - 1100.81s | The base fare has been uploaded incorrectly because it's still I believe it's still kind of manual in a lot of ways 1100.81s - 1106.13s | There's still a lot of spreadsheets that are used. So in the past the USD OT used to be very 1106.93s - 1110.77s | Aggressive in enforcing this legislation on post purchasing price increase 1111.01s - 1116.49s | But in 2015 what happened was there was a very large issue with United if you Google you 1116.73s - 1118.53s | You might be able to find some more information 1118.53s - 1122.69s | But essentially this issue was they published in Danish Corona? 1122.69s - 1126.45s | They made a mistake where it was a divide by 1,000 issue on the base fare 1126.57s - 1131.93s | now this is because Dana in the Danish Corona uses the comma as a decimal point rather than a 1132.85s - 1137.41s | Period right. So the key thing to know out of this now is that 1138.61s - 1145.25s | that they're they're allowing airlines to eat more easily get out of these these fares if they demonstrate it was a 1145.57s - 1148.09s | Mistaken fare now one of the ways they would do that 1148.09s - 1152.41s | I guess is there's a lot of blogs and stuff that sort of try to profit off this and 1153.61s - 1155.61s | Yeah, so I mean it 1155.89s - 1158.77s | As roaring kitty would say as to me. I like the fair 1158.77s - 1162.81s | It's just a good fair because sometimes you don't understand. It's hard to understand I


chunk_text:
United if you Google you 1116.73s - 1118.53s | You might be able to find some more information 1118.53s - 1122.69s | But essentially this issue was they published in Danish Corona? 1122.69s - 1126.45s | They made a mistake where it was a divide by 1,000 issue on the base fare 1126.57s - 1131.93s | now this is because Dana in the Danish Corona uses the comma as a decimal point rather than a 1132.85s - 1137.41s | Period right. So the key thing to know out of this now is that 1138.61s - 1145.25s | that they're they're allowing airlines to eat more easily get out of these these fares if they demonstrate it was a 1145.57s - 1148.09s | Mistaken fare now one of the ways they would do that 1148.09s - 1152.41s | I guess is there's a lot of blogs and stuff that sort of try to profit off this and 1153.61s - 1155.61s | Yeah, so I mean it 1155.89s - 1158.77s | As roaring kitty would say as to me. I like the fair 1158.77s - 1162.81s | It's just a good fair because sometimes you don't understand. It's hard to understand I guess 1163.49s - 1170.69s | When they you often see them publishing base fares of $1 for transatlantic flights like hat. How do you know necessarily? 1172.01s - 1178.69s | So if you're an airline, what could you do? Right? So they have a thing called an agency debit debit memo. Now, that's a 1179.41s - 1181.97s | You can find those policies online as well 1181.97s - 1187.25s | most airlines publish them and that also will show you sort of conditions of what they're actually looking for and how they go after travel 1187.25s - 1193.49s | Agents that maliciously do stuff the example of what a travel agent might do is hold stuff on a fictitious name 1193.49s - 1197.09s | So like, you know, wait, you know like how you can do free holds for instance 1197.09s - 1201.81s | They're basically holding the seats and then they without and then they cancel it and rehold it, you know 1202.17s - 1206.57s | So they think they do chargebacks for that and there's like it's like a credit cards chargeback 1206.57s - 1211.99s | There's like a processing fee attached to that. But I guess my


chunk_text:
guess 1163.49s - 1170.69s | When they you often see them publishing base fares of $1 for transatlantic flights like hat. How do you know necessarily? 1172.01s - 1178.69s | So if you're an airline, what could you do? Right? So they have a thing called an agency debit debit memo. Now, that's a 1179.41s - 1181.97s | You can find those policies online as well 1181.97s - 1187.25s | most airlines publish them and that also will show you sort of conditions of what they're actually looking for and how they go after travel 1187.25s - 1193.49s | Agents that maliciously do stuff the example of what a travel agent might do is hold stuff on a fictitious name 1193.49s - 1197.09s | So like, you know, wait, you know like how you can do free holds for instance 1197.09s - 1201.81s | They're basically holding the seats and then they without and then they cancel it and rehold it, you know 1202.17s - 1206.57s | So they think they do chargebacks for that and there's like it's like a credit cards chargeback 1206.57s - 1211.99s | There's like a processing fee attached to that. But I guess my other point is that they could kind of think like us 1212.87s - 1219.43s | You know, I think fraud teams and other teams could learn a lot from how what we the advanced detections and things we run in socks 1220.23s - 1224.47s | because in a lot of ways a lot of the detection stuff is similar and we're just used to 1225.79s - 1227.99s | hackers and impossible travel and things like that and 1229.15s - 1230.95s | sort of finally 1230.95s - 1233.55s | If this if you'd be interested by this you want to know a bit more 1235.19s - 1236.63s | It's great to be out of those 1236.63s - 1241.47s | It's sometimes hard to get the same visibility into all these things that they look like a travel agent would get 1241.99s - 1245.67s | But with the with those tools like expert flyer that I showed before 1246.11s - 1250.15s | KBS tool they like subscription ones where you can actually get sort of read-only access 1250.31s - 1255.87s | But it's it's not a hundred percent what you can do and they don't actually can't support pricing 1256.39s - 1260.79s


chunk_text:
other point is that they could kind of think like us 1212.87s - 1219.43s | You know, I think fraud teams and other teams could learn a lot from how what we the advanced detections and things we run in socks 1220.23s - 1224.47s | because in a lot of ways a lot of the detection stuff is similar and we're just used to 1225.79s - 1227.99s | hackers and impossible travel and things like that and 1229.15s - 1230.95s | sort of finally 1230.95s - 1233.55s | If this if you'd be interested by this you want to know a bit more 1235.19s - 1236.63s | It's great to be out of those 1236.63s - 1241.47s | It's sometimes hard to get the same visibility into all these things that they look like a travel agent would get 1241.99s - 1245.67s | But with the with those tools like expert flyer that I showed before 1246.11s - 1250.15s | KBS tool they like subscription ones where you can actually get sort of read-only access 1250.31s - 1255.87s | But it's it's not a hundred percent what you can do and they don't actually can't support pricing 1256.39s - 1260.79s | But another one that's great. It's really really good is the ITX matrix 1261.25s - 1267.27s | So that that will actually give you sort of a full pricing engine that you can it was basically the back end for Google was 1267.27s - 1273.03s | The back end for Google flights at one stage and what I like about that is that you can put really advanced pairing specs in 1273.03s - 1275.03s | There so you can say only show me 1275.51s - 1282.71s | Only use like for the calculation only use fares or any show me stuff that's compatible with this particular fair basis code 1284.35s - 1289.13s | Lock it down to all that sort of stuff and the even better thing is that you can actually turn off the availability checks 1290.87s - 1294.39s | Because to get more better CPU use of your CPU time 1294.67s - 1296.67s | So with that I 1297.99s - 1302.47s | Guess to say thanks for everyone. I've got a few more things here if people are interested 1303.19s - 1310.31s | Particularly recommend that the MIT. I guess it was for a computing course, but


chunk_text:
| But another one that's great. It's really really good is the ITX matrix 1261.25s - 1267.27s | So that that will actually give you sort of a full pricing engine that you can it was basically the back end for Google was 1267.27s - 1273.03s | The back end for Google flights at one stage and what I like about that is that you can put really advanced pairing specs in 1273.03s - 1275.03s | There so you can say only show me 1275.51s - 1282.71s | Only use like for the calculation only use fares or any show me stuff that's compatible with this particular fair basis code 1284.35s - 1289.13s | Lock it down to all that sort of stuff and the even better thing is that you can actually turn off the availability checks 1290.87s - 1294.39s | Because to get more better CPU use of your CPU time 1294.67s - 1296.67s | So with that I 1297.99s - 1302.47s | Guess to say thanks for everyone. I've got a few more things here if people are interested 1303.19s - 1310.31s | Particularly recommend that the MIT. I guess it was for a computing course, but that MIT's computational complexity of air travel planning 1310.83s - 1312.83s | Really really good. I 1312.83s - 1314.83s | wouldn't like to talk about that, but I 1315.35s - 1317.35s | hope that's a bird's-eye 1317.39s - 1318.91s | overview and 1318.91s - 1322.17s | If you have any questions come see me at the bar or something good 1323.13s - 1327.89s | Now conscious of time let's crack on I want to talk today about electronic flight bags 1328.41s - 1333.49s | But before we go there a little bit about me. I am a pilot. I'm a really bad pilot 1333.49s - 1336.81s | I've landed at the wrong runway before so never fly with me 1336.81s - 1341.13s | But I also am part of a company called pen test partners where we do a lot of red teaming 1341.13s - 1345.17s | But also a lot of embedded system work. We've got multiple pilots on the team 1345.17s - 1349.01s | So we do quite a bit with airplanes and over the last few years 1349.01s - 1351.53s | We've learned how to hack or not hack airplanes 1353.13s - 1359.01s | Before we start


chunk_text:
that MIT's computational complexity of air travel planning 1310.83s - 1312.83s | Really really good. I 1312.83s - 1314.83s | wouldn't like to talk about that, but I 1315.35s - 1317.35s | hope that's a bird's-eye 1317.39s - 1318.91s | overview and 1318.91s - 1322.17s | If you have any questions come see me at the bar or something good 1323.13s - 1327.89s | Now conscious of time let's crack on I want to talk today about electronic flight bags 1328.41s - 1333.49s | But before we go there a little bit about me. I am a pilot. I'm a really bad pilot 1333.49s - 1336.81s | I've landed at the wrong runway before so never fly with me 1336.81s - 1341.13s | But I also am part of a company called pen test partners where we do a lot of red teaming 1341.13s - 1345.17s | But also a lot of embedded system work. We've got multiple pilots on the team 1345.17s - 1349.01s | So we do quite a bit with airplanes and over the last few years 1349.01s - 1351.53s | We've learned how to hack or not hack airplanes 1353.13s - 1359.01s | Before we start though, it's really really important that we disclose vulnerabilities in aviation 1359.97s - 1361.21s | responsibly 1361.21s - 1365.45s | There's something about hacking planes that drives the media into a frenzy 1365.45s - 1371.01s | You say plane hacking they go crazy and a result it damages industry and I think it makes us less safe 1371.69s - 1377.27s | My wife is a lousy flyer. So the last thing I want to do is make her more scared of flying 1379.01s - 1381.61s | It does take a long time to fix bugs in aviation 1381.61s - 1386.93s | I'll explain why in a bit but the most important thing you cannot do you cannot hack an airplane 1387.13s - 1391.45s | Sat in your seat in coach. It doesn't work like that 1392.33s - 1398.13s | There have been some issues over the years with the media going crazy with stories about hacking airplanes. I'm not gonna dwell on those 1399.05s - 1403.97s | But before we start, how do you connect to an airplane? Well, there are lots of different interfaces 1403.97s - 1407.89s | We all want in-flight Wi-Fi nowadays, but pilots have had that


chunk_text:
though, it's really really important that we disclose vulnerabilities in aviation 1359.97s - 1361.21s | responsibly 1361.21s - 1365.45s | There's something about hacking planes that drives the media into a frenzy 1365.45s - 1371.01s | You say plane hacking they go crazy and a result it damages industry and I think it makes us less safe 1371.69s - 1377.27s | My wife is a lousy flyer. So the last thing I want to do is make her more scared of flying 1379.01s - 1381.61s | It does take a long time to fix bugs in aviation 1381.61s - 1386.93s | I'll explain why in a bit but the most important thing you cannot do you cannot hack an airplane 1387.13s - 1391.45s | Sat in your seat in coach. It doesn't work like that 1392.33s - 1398.13s | There have been some issues over the years with the media going crazy with stories about hacking airplanes. I'm not gonna dwell on those 1399.05s - 1403.97s | But before we start, how do you connect to an airplane? Well, there are lots of different interfaces 1403.97s - 1407.89s | We all want in-flight Wi-Fi nowadays, but pilots have had that for years 1408.09s - 1414.03s | You've got maintenance access. You've got quick access recorders that now spin up over Wi-Fi 1414.17s - 1417.85s | But just to prove that point you cannot hack an airplane from the cabin 1417.85s - 1424.37s | And the reason for that is we have really good network segregation in the bit in the back the bit that we sit in 1424.77s - 1429.17s | That's called the passenger information entertainment services domain and we consider it to be dirty 1429.69s - 1434.45s | Up front. We have the aircraft control domain, which is really sick. It sounds secure 1434.61s - 1438.33s | Really well segregated and completely isolated from the other networks 1438.33s - 1441.77s | But the one I want to look at at the moment is the electronic flight bag 1441.77s - 1448.57s | Which was one of the systems the pilots use and connect to with connectivity. So what is an EFB? Well 1449.41s - 1453.13s | Last time you boarded an airplane and you look left into the cockpit as you walked in 1453.13s - 1458.89s | Did you see the pilots had a tablet? Maybe it was a


chunk_text:
for years 1408.09s - 1414.03s | You've got maintenance access. You've got quick access recorders that now spin up over Wi-Fi 1414.17s - 1417.85s | But just to prove that point you cannot hack an airplane from the cabin 1417.85s - 1424.37s | And the reason for that is we have really good network segregation in the bit in the back the bit that we sit in 1424.77s - 1429.17s | That's called the passenger information entertainment services domain and we consider it to be dirty 1429.69s - 1434.45s | Up front. We have the aircraft control domain, which is really sick. It sounds secure 1434.61s - 1438.33s | Really well segregated and completely isolated from the other networks 1438.33s - 1441.77s | But the one I want to look at at the moment is the electronic flight bag 1441.77s - 1448.57s | Which was one of the systems the pilots use and connect to with connectivity. So what is an EFB? Well 1449.41s - 1453.13s | Last time you boarded an airplane and you look left into the cockpit as you walked in 1453.13s - 1458.89s | Did you see the pilots had a tablet? Maybe it was a little computer. Maybe it was an iPad or maybe a an Android tab 1458.97s - 1464.93s | It's essentially a device that they use to make their operations safer and more efficient 1465.21s - 1467.67s | So there's lots of different things that an EFB does 1468.25s - 1472.25s | It's for example, it has your roster your passenger list 1473.09s - 1480.13s | It has your weight and balance so you can make sure the airplane is properly balanced and within its performance envelope, but most importantly 1481.13s - 1483.13s | We're still there. I just lost audio 1483.81s - 1487.22s | Can we have a there we go? We're back again 1487.38s - 1493.86s | Most importantly it also is used to calculate your calculate engine performance or Perth 1494.30s - 1496.02s | now performance 1496.02s - 1502.26s | You might not appreciate this. It's very rare that we use full power when we take off really rare 1502.26s - 1508.30s | and the reason we don't is we don't want to burn lots of fuel because it's expensive and bad for the environment and we also 1508.54s - 1513.62s | Don't want to wear the engines much.


chunk_text:
little computer. Maybe it was an iPad or maybe a an Android tab 1458.97s - 1464.93s | It's essentially a device that they use to make their operations safer and more efficient 1465.21s - 1467.67s | So there's lots of different things that an EFB does 1468.25s - 1472.25s | It's for example, it has your roster your passenger list 1473.09s - 1480.13s | It has your weight and balance so you can make sure the airplane is properly balanced and within its performance envelope, but most importantly 1481.13s - 1483.13s | We're still there. I just lost audio 1483.81s - 1487.22s | Can we have a there we go? We're back again 1487.38s - 1493.86s | Most importantly it also is used to calculate your calculate engine performance or Perth 1494.30s - 1496.02s | now performance 1496.02s - 1502.26s | You might not appreciate this. It's very rare that we use full power when we take off really rare 1502.26s - 1508.30s | and the reason we don't is we don't want to burn lots of fuel because it's expensive and bad for the environment and we also 1508.54s - 1513.62s | Don't want to wear the engines much. So if you use less power if we've got lots of runway 1514.10s - 1520.84s | We're not very heavily loaded we use a D rate or a what's called a flex temp in Airbus or a D rate with Boeing planes 1521.90s - 1526.34s | and we calculate that using lots and lots of different data sources like the wind the weight the 1526.78s - 1531.26s | Pressure altitude of the runway all sorts of things that tell us how much power to use on departure 1531.86s - 1535.98s | But before we go there, I want to look at some of the bugs things that have gone wrong not hacks 1535.98s - 1537.82s | Just things that have gone wrong 1537.82s - 1542.10s | There's all sorts of examples of things that have just gone wrong. For example Raven air 1542.10s - 1548.58s | They used a digital maintenance system and they got ransomed and their backup got ransomed as a result of that 1548.58s - 1551.60s | They couldn't prove the airplanes were airworthy. So they didn't fly 1553.10s - 1560.26s | American had a lockup on their electronic flight bags. There was a duplication in one


chunk_text:
So if you use less power if we've got lots of runway 1514.10s - 1520.84s | We're not very heavily loaded we use a D rate or a what's called a flex temp in Airbus or a D rate with Boeing planes 1521.90s - 1526.34s | and we calculate that using lots and lots of different data sources like the wind the weight the 1526.78s - 1531.26s | Pressure altitude of the runway all sorts of things that tell us how much power to use on departure 1531.86s - 1535.98s | But before we go there, I want to look at some of the bugs things that have gone wrong not hacks 1535.98s - 1537.82s | Just things that have gone wrong 1537.82s - 1542.10s | There's all sorts of examples of things that have just gone wrong. For example Raven air 1542.10s - 1548.58s | They used a digital maintenance system and they got ransomed and their backup got ransomed as a result of that 1548.58s - 1551.60s | They couldn't prove the airplanes were airworthy. So they didn't fly 1553.10s - 1560.26s | American had a lockup on their electronic flight bags. There was a duplication in one of the Jefferson databases 1560.26s - 1564.30s | I think they duplicated the chart. So the map of the runways 1564.98s - 1569.86s | Reagan National and it caused the entire application to lock up and a lot of airplanes didn't move that day 1570.58s - 1574.18s | Southwest had a bug a few years ago. They lost their their weather feed now 1575.10s - 1577.82s | Pilots, you can't just look out the window. See what the weather's doing 1577.82s - 1581.82s | You need to know what it's doing up there and also where you're going and you need that weather feed no weather 1581.82s - 1583.82s | No flying. They've a lot of flights didn't go 1584.90s - 1589.26s | Mistakes happen with weight and balance as well. This is a really interesting instant. It's published 1589.26s - 1595.54s | You can go and read it yourself and the airplane type was changed at the very last minute from a Airbus a320 to an Airbus 1595.54s - 1597.18s | a321 1597.18s - 1603.74s | primary difference is it's longer but the load sheet wasn't changed to all the passengers from the shorter plane were loaded at the


chunk_text:
of the Jefferson databases 1560.26s - 1564.30s | I think they duplicated the chart. So the map of the runways 1564.98s - 1569.86s | Reagan National and it caused the entire application to lock up and a lot of airplanes didn't move that day 1570.58s - 1574.18s | Southwest had a bug a few years ago. They lost their their weather feed now 1575.10s - 1577.82s | Pilots, you can't just look out the window. See what the weather's doing 1577.82s - 1581.82s | You need to know what it's doing up there and also where you're going and you need that weather feed no weather 1581.82s - 1583.82s | No flying. They've a lot of flights didn't go 1584.90s - 1589.26s | Mistakes happen with weight and balance as well. This is a really interesting instant. It's published 1589.26s - 1595.54s | You can go and read it yourself and the airplane type was changed at the very last minute from a Airbus a320 to an Airbus 1595.54s - 1597.18s | a321 1597.18s - 1603.74s | primary difference is it's longer but the load sheet wasn't changed to all the passengers from the shorter plane were loaded at the front and 1604.14s - 1606.14s | The airplane ended up out of balance 1606.46s - 1612.22s | Pilot goes down the runway tries to rotate on the stick and nothing happened. There's not very much runway left 1612.22s - 1614.22s | What do you do? You've passed v1 1614.50s - 1618.02s | You've got to VR. You're not a v2. So you can't really fly away yet 1618.62s - 1625.54s | So the pilot very sensible individual gave it full power toga and the airplane took off 1626.50s - 1633.06s | Primarily to do with the increased rotation moment because the engines dangle off the wings so they got away 1633.58s - 1634.98s | Because they gave it full power 1634.98s - 1640.46s | But yeah, that was a really very nearly very nearly serious instant another one to do with performance 1640.46s - 1643.78s | This was a confusing instant that happened at Lisbon Airport 1644.58s - 1647.34s | Now there was some runway intersection markers 1647.42s - 1652.06s | So quite often on the short-haul flights, you might see they don't line up for the whole runway 1652.06s - 1654.06s | They go from a displaced threshold, right?


chunk_text:
front and 1604.14s - 1606.14s | The airplane ended up out of balance 1606.46s - 1612.22s | Pilot goes down the runway tries to rotate on the stick and nothing happened. There's not very much runway left 1612.22s - 1614.22s | What do you do? You've passed v1 1614.50s - 1618.02s | You've got to VR. You're not a v2. So you can't really fly away yet 1618.62s - 1625.54s | So the pilot very sensible individual gave it full power toga and the airplane took off 1626.50s - 1633.06s | Primarily to do with the increased rotation moment because the engines dangle off the wings so they got away 1633.58s - 1634.98s | Because they gave it full power 1634.98s - 1640.46s | But yeah, that was a really very nearly very nearly serious instant another one to do with performance 1640.46s - 1643.78s | This was a confusing instant that happened at Lisbon Airport 1644.58s - 1647.34s | Now there was some runway intersection markers 1647.42s - 1652.06s | So quite often on the short-haul flights, you might see they don't line up for the whole runway 1652.06s - 1654.06s | They go from a displaced threshold, right? 1654.06s - 1658.62s | They they run maybe halfway along the runway sometimes and they don't need the whole runway. So it's quicker 1659.62s - 1662.06s | But the intersection markings were a bit confusing 1662.06s - 1667.38s | They've been renamed they were given temporary names and when pilots were putting them into their flight bag to do their performance 1667.78s - 1673.82s | Calculations from the engines the calculator thought there was more runway than they actually had. So I said, hey we need less power 1673.82s - 1677.70s | We've got more runway and over a period of a couple of weeks eight flights 1678.38s - 1681.86s | Very nearly didn't make it out of Lisbon. Now that was all fixed, which is great 1682.66s - 1684.66s | We lost that audio again 1686.90s - 1688.90s | Audio yeah, there we go. We're back good 1689.50s - 1694.26s | Very interesting incident happened earlier this year. This was Alaska. They had two tail strikes 1694.26s - 1698.26s | So they hit the back of the airplane when they were trying to take off on January 26th 1699.02s - 1703.90s | Amazing response. So within the matter of


chunk_text:
1654.06s - 1658.62s | They they run maybe halfway along the runway sometimes and they don't need the whole runway. So it's quicker 1659.62s - 1662.06s | But the intersection markings were a bit confusing 1662.06s - 1667.38s | They've been renamed they were given temporary names and when pilots were putting them into their flight bag to do their performance 1667.78s - 1673.82s | Calculations from the engines the calculator thought there was more runway than they actually had. So I said, hey we need less power 1673.82s - 1677.70s | We've got more runway and over a period of a couple of weeks eight flights 1678.38s - 1681.86s | Very nearly didn't make it out of Lisbon. Now that was all fixed, which is great 1682.66s - 1684.66s | We lost that audio again 1686.90s - 1688.90s | Audio yeah, there we go. We're back good 1689.50s - 1694.26s | Very interesting incident happened earlier this year. This was Alaska. They had two tail strikes 1694.26s - 1698.26s | So they hit the back of the airplane when they were trying to take off on January 26th 1699.02s - 1703.90s | Amazing response. So within the matter of minutes they realized there was an issue had a ground stop 1704.22s - 1709.30s | Awesome awesome response from the airline and what had gone wrong. There was a software bug in one of their flight bag 1709.90s - 1714.14s | Applications there was miscalculating their load. Therefore not enough power was going on 1714.26s - 1716.82s | There was another one that happened on April 17th 1716.82s - 1723.46s | They had a related application issue with weight and balance, but actually I was really impressed just how quickly they responded to this 1724.38s - 1726.06s | But things do go wrong sometimes 1726.06s - 1730.82s | so this is an airplane that had a really nasty tail strike tore the backside out of the plane and 1731.46s - 1737.98s | yeah, they didn't realize they'd had that tail strike until they tried to pressurize the aircraft and it wouldn't pressurize and 1738.30s - 1740.58s | They have very sadly been deaths 1741.46s - 1747.60s | The picture on the right is from an incident report a crash that happened in Canada a very tired 1747.98s - 1749.62s | 747 freight crew 1749.62s - 1751.62s | miscalculated the amount


chunk_text:
minutes they realized there was an issue had a ground stop 1704.22s - 1709.30s | Awesome awesome response from the airline and what had gone wrong. There was a software bug in one of their flight bag 1709.90s - 1714.14s | Applications there was miscalculating their load. Therefore not enough power was going on 1714.26s - 1716.82s | There was another one that happened on April 17th 1716.82s - 1723.46s | They had a related application issue with weight and balance, but actually I was really impressed just how quickly they responded to this 1724.38s - 1726.06s | But things do go wrong sometimes 1726.06s - 1730.82s | so this is an airplane that had a really nasty tail strike tore the backside out of the plane and 1731.46s - 1737.98s | yeah, they didn't realize they'd had that tail strike until they tried to pressurize the aircraft and it wouldn't pressurize and 1738.30s - 1740.58s | They have very sadly been deaths 1741.46s - 1747.60s | The picture on the right is from an incident report a crash that happened in Canada a very tired 1747.98s - 1749.62s | 747 freight crew 1749.62s - 1751.62s | miscalculated the amount of weight they had on board and 1751.70s - 1758.66s | Very sadly the airplane never made it airborne went straight through the instrument landing system and sadly burst into flames a very very sad incident 1759.10s - 1764.86s | It also happens on landing as well when we land in commercial airliners. We don't want to use too much break 1765.46s - 1769.74s | Because brake pads are expensive that carbon fiber. We don't want to use too much 1770.30s - 1776.82s | so we'll typically use an auto brake setting that's related to our weight the length of the runway the amount of headwind we got all 1776.82s - 1778.42s | sorts of cool things and 1778.42s - 1781.78s | this is Quito Airport very difficult approach surrounded by hills and 1782.74s - 1787.50s | Overstressed pilots used the wrong auto brake setting from their calculations and over around the end of the runway 1787.50s - 1792.06s | They chose auto land. So auto brake 2 and they should have been using auto brake 4 1792.94s - 1794.98s | So where I'm getting to with all of this is 1796.26s - 1803.58s | Could you cause an incident


chunk_text:
of weight they had on board and 1751.70s - 1758.66s | Very sadly the airplane never made it airborne went straight through the instrument landing system and sadly burst into flames a very very sad incident 1759.10s - 1764.86s | It also happens on landing as well when we land in commercial airliners. We don't want to use too much break 1765.46s - 1769.74s | Because brake pads are expensive that carbon fiber. We don't want to use too much 1770.30s - 1776.82s | so we'll typically use an auto brake setting that's related to our weight the length of the runway the amount of headwind we got all 1776.82s - 1778.42s | sorts of cool things and 1778.42s - 1781.78s | this is Quito Airport very difficult approach surrounded by hills and 1782.74s - 1787.50s | Overstressed pilots used the wrong auto brake setting from their calculations and over around the end of the runway 1787.50s - 1792.06s | They chose auto land. So auto brake 2 and they should have been using auto brake 4 1792.94s - 1794.98s | So where I'm getting to with all of this is 1796.26s - 1803.58s | Could you cause an incident like that as a result of a hack and we found some bugs that we think could in 1804.30s - 1805.90s | certain scenarios 1805.90s - 1808.14s | So the first major problem you need to know about those 1808.78s - 1814.82s | Computers those tablets that the pilots are using you might be really surprised to know about the quality of the lockdown on those devices 1815.54s - 1817.06s | Sometimes we'll find 1817.06s - 1819.06s | EFBs with no pin or 1819.98s - 1821.98s | The pilots birthdates or 1822.82s - 1825.30s | On smaller operators you find no MDM 1825.30s - 1832.38s | No real lockdown even some small operators have sent their pilots off to Best Buy to buy the tablet for themselves Wow 1833.14s - 1835.06s | But also there's a lack of 1835.06s - 1842.58s | Proper understanding on the ground cyber security experts in the air pilots. Sometimes those interactions don't go so well and good examples of that 1842.58s - 1848.86s | Hey, let's use face ID. Let's use face ID to make my EFB nice and secure 1848.86s - 1855.26s | So it's really easy great. Unfortunately pilots have a habit


chunk_text:
like that as a result of a hack and we found some bugs that we think could in 1804.30s - 1805.90s | certain scenarios 1805.90s - 1808.14s | So the first major problem you need to know about those 1808.78s - 1814.82s | Computers those tablets that the pilots are using you might be really surprised to know about the quality of the lockdown on those devices 1815.54s - 1817.06s | Sometimes we'll find 1817.06s - 1819.06s | EFBs with no pin or 1819.98s - 1821.98s | The pilots birthdates or 1822.82s - 1825.30s | On smaller operators you find no MDM 1825.30s - 1832.38s | No real lockdown even some small operators have sent their pilots off to Best Buy to buy the tablet for themselves Wow 1833.14s - 1835.06s | But also there's a lack of 1835.06s - 1842.58s | Proper understanding on the ground cyber security experts in the air pilots. Sometimes those interactions don't go so well and good examples of that 1842.58s - 1848.86s | Hey, let's use face ID. Let's use face ID to make my EFB nice and secure 1848.86s - 1855.26s | So it's really easy great. Unfortunately pilots have a habit of wearing mirrored sunglasses, which does not work 1855.26s - 1862.74s | Well with face ID, I promise you and the one time you probably need your electronic flight bag more than anything is when shit goes down 1863.10s - 1865.26s | Maybe you have a depressurization events 1866.10s - 1870.78s | You go to your electronic quick reference handbook, which is of course on your iPad 1870.78s - 1875.46s | But you're wearing an oxygen mask because the oxygen is just flown out of the door plug 1876.46s - 1879.94s | Not a good day, right so we really need to think carefully about how we unlock things 1880.18s - 1882.78s | so first of all, we've got problems with local lockdowns and 1883.62s - 1884.58s | with 1884.58s - 1887.14s | Physical access to an EFB for a short period of time 1887.14s - 1891.34s | We found some interesting bugs and I'm going to walk you through one of the very first we found was in Boeing 1891.50s - 1896.62s | OPT on board performance tool and this is the tool that's used to calculate performance 1896.62s - 1900.70s | So you'll spit in a bunch of


chunk_text:
of wearing mirrored sunglasses, which does not work 1855.26s - 1862.74s | Well with face ID, I promise you and the one time you probably need your electronic flight bag more than anything is when shit goes down 1863.10s - 1865.26s | Maybe you have a depressurization events 1866.10s - 1870.78s | You go to your electronic quick reference handbook, which is of course on your iPad 1870.78s - 1875.46s | But you're wearing an oxygen mask because the oxygen is just flown out of the door plug 1876.46s - 1879.94s | Not a good day, right so we really need to think carefully about how we unlock things 1880.18s - 1882.78s | so first of all, we've got problems with local lockdowns and 1883.62s - 1884.58s | with 1884.58s - 1887.14s | Physical access to an EFB for a short period of time 1887.14s - 1891.34s | We found some interesting bugs and I'm going to walk you through one of the very first we found was in Boeing 1891.50s - 1896.62s | OPT on board performance tool and this is the tool that's used to calculate performance 1896.62s - 1900.70s | So you'll spit in a bunch of data and it'll give you your V speeds 1900.70s - 1904.38s | So V one the point at which you can break and stop without going off the end 1905.30s - 1906.34s | VR 1906.34s - 1913.34s | Rotation v2 the point at which you can climb away safely with any one engine that spot between V 1 and V 2 is kind 1913.34s - 1915.34s | Of squeaky bum time if it all goes wrong 1915.38s - 1918.34s | Now that's actually a photograph of one of Boeing's tools 1918.34s - 1920.14s | They brought it along to RSA a couple of years ago 1920.14s - 1925.34s | Really really cool thing to do and we discovered that the database had no integrity text 1925.34s - 1928.26s | So with a few moments physical access you could change the data 1928.50s - 1932.38s | You could make the runway look longer than it actually was and therefore it spit out the wrong data 1932.74s - 1938.70s | You could extend the runway and then the V speeds went wrong and the pilots would use the wrong amount of power for departure 1939.46s - 1940.94s | Good news 1940.94s -


chunk_text:
data and it'll give you your V speeds 1900.70s - 1904.38s | So V one the point at which you can break and stop without going off the end 1905.30s - 1906.34s | VR 1906.34s - 1913.34s | Rotation v2 the point at which you can climb away safely with any one engine that spot between V 1 and V 2 is kind 1913.34s - 1915.34s | Of squeaky bum time if it all goes wrong 1915.38s - 1918.34s | Now that's actually a photograph of one of Boeing's tools 1918.34s - 1920.14s | They brought it along to RSA a couple of years ago 1920.14s - 1925.34s | Really really cool thing to do and we discovered that the database had no integrity text 1925.34s - 1928.26s | So with a few moments physical access you could change the data 1928.50s - 1932.38s | You could make the runway look longer than it actually was and therefore it spit out the wrong data 1932.74s - 1938.70s | You could extend the runway and then the V speeds went wrong and the pilots would use the wrong amount of power for departure 1939.46s - 1940.94s | Good news 1940.94s - 1945.66s | Boeing handle it brilliantly. I could not have asked for a better response to this vulnerability 1945.66s - 1948.86s | It's kind of good news for buying which I think they kind of need at the moment. I don't know 1949.54s - 1951.54s | It was a really good experience. They 1952.34s - 1954.50s | Responded to us really quickly. They acknowledged it 1954.50s - 1957.68s | They gave us a call every month to say this is how we're doing it and said by the way 1958.36s - 1965.12s | It's gonna take two years to fix it like what you know, Google project zero that's 90 days, right and you drop it like it's hot 1966.16s - 1974.36s | Aviation is different. It took him a couple of weeks to fix the bug. It took him a couple of years to recertify the code 1975.24s - 1978.36s | Because you can't just go and update aviation systems 1978.36s - 1981.72s | You need to recertify them to make sure they are safe in 1982.00s - 1987.04s | Absolutely every possible scenario and that was fine and they published it and it was all good. They got


chunk_text:
1945.66s | Boeing handle it brilliantly. I could not have asked for a better response to this vulnerability 1945.66s - 1948.86s | It's kind of good news for buying which I think they kind of need at the moment. I don't know 1949.54s - 1951.54s | It was a really good experience. They 1952.34s - 1954.50s | Responded to us really quickly. They acknowledged it 1954.50s - 1957.68s | They gave us a call every month to say this is how we're doing it and said by the way 1958.36s - 1965.12s | It's gonna take two years to fix it like what you know, Google project zero that's 90 days, right and you drop it like it's hot 1966.16s - 1974.36s | Aviation is different. It took him a couple of weeks to fix the bug. It took him a couple of years to recertify the code 1975.24s - 1978.36s | Because you can't just go and update aviation systems 1978.36s - 1981.72s | You need to recertify them to make sure they are safe in 1982.00s - 1987.04s | Absolutely every possible scenario and that was fine and they published it and it was all good. They got it sorted 1987.68s - 1989.68s | Another bug. This is a 1990.48s - 1991.92s | semi-installed 1991.92s - 1998.72s | BFB it was a kiosk and a 747 we looked at and it was unbelievably poorly secure so you could break out 1999.12s - 2003.92s | Password was password great and there were two of them for redundancy purposes 2004.32s - 2009.68s | But they were networked together and it was easy to compromise one from the other so that removed the value of having 2009.96s - 2013.56s | Redundancy and a cross-check because you could hack them both to spit out the same wrong data 2014.88s - 2016.88s | This was funny 2017.68s - 2021.96s | Had a USB port on it and a sticker saying not to use it. Okay 2024.00s - 2030.08s | Now this vendor never ever engaged properly actually Boeing even gave him better kick on our behalf 2030.08s - 2034.44s | They intervene to try and help it along still nothing and actually after 18 months 2034.44s - 2038.36s | We agreed with the aviation ISAC, which is the industry's cyber security and sharing body 2038.92s - 2044.84s | That actually it was reasonable


chunk_text:
it sorted 1987.68s - 1989.68s | Another bug. This is a 1990.48s - 1991.92s | semi-installed 1991.92s - 1998.72s | BFB it was a kiosk and a 747 we looked at and it was unbelievably poorly secure so you could break out 1999.12s - 2003.92s | Password was password great and there were two of them for redundancy purposes 2004.32s - 2009.68s | But they were networked together and it was easy to compromise one from the other so that removed the value of having 2009.96s - 2013.56s | Redundancy and a cross-check because you could hack them both to spit out the same wrong data 2014.88s - 2016.88s | This was funny 2017.68s - 2021.96s | Had a USB port on it and a sticker saying not to use it. Okay 2024.00s - 2030.08s | Now this vendor never ever engaged properly actually Boeing even gave him better kick on our behalf 2030.08s - 2034.44s | They intervene to try and help it along still nothing and actually after 18 months 2034.44s - 2038.36s | We agreed with the aviation ISAC, which is the industry's cyber security and sharing body 2038.92s - 2044.84s | That actually it was reasonable to disclose in public once we told the airlines about it first and they helped us do that 2044.84s - 2046.36s | That was really cool 2046.36s - 2048.64s | What about some new things so we've done Boeing 2049.32s - 2055.48s | Let's talk about Airbus. So this is Airbus nav blue fly smart LPG 2055.88s - 2060.00s | LPC NG there are more TLA's in aviation than there are in cyber security 2060.48s - 2067.76s | LPC less paper cockpit NG next generation nav blue is a company that's been acquired by Airbus and we found a bug 2068.24s - 2074.84s | Almost exactly the same as Boeing OPT so you can tamper with the runway databases and make pilots use the wrong amount of power 2075.00s - 2078.10s | So it's spit out the wrong information pilots do the wrong thing 2078.32s - 2084.20s | So we started vulnerability disclosure and you're probably looking at going that's 2021 Ken. Yes, it is 2084.84s - 2088.56s | So we sent it to Airbus. They've got a great piece of team. We sent it to them 2088.56s - 2093.60s | They came back to us quickly. They replied to


chunk_text:
to disclose in public once we told the airlines about it first and they helped us do that 2044.84s - 2046.36s | That was really cool 2046.36s - 2048.64s | What about some new things so we've done Boeing 2049.32s - 2055.48s | Let's talk about Airbus. So this is Airbus nav blue fly smart LPG 2055.88s - 2060.00s | LPC NG there are more TLA's in aviation than there are in cyber security 2060.48s - 2067.76s | LPC less paper cockpit NG next generation nav blue is a company that's been acquired by Airbus and we found a bug 2068.24s - 2074.84s | Almost exactly the same as Boeing OPT so you can tamper with the runway databases and make pilots use the wrong amount of power 2075.00s - 2078.10s | So it's spit out the wrong information pilots do the wrong thing 2078.32s - 2084.20s | So we started vulnerability disclosure and you're probably looking at going that's 2021 Ken. Yes, it is 2084.84s - 2088.56s | So we sent it to Airbus. They've got a great piece of team. We sent it to them 2088.56s - 2093.60s | They came back to us quickly. They replied to us after a month and said yeah, it's the operators problem 2093.60s - 2100.28s | I'm summarizing about four pages of email here. But yeah, that's that's not a problem. That's that's for the airlines 2101.28s - 2103.28s | Okay, that's a novel discussion 2103.44s - 2107.32s | So we started going into some of the regulations and I'm not going to talk about 2107.60s - 2110.76s | EFB regs because they're really complicated but they are different around the world 2111.28s - 2115.56s | IASA European Aviation Safety Agency has is actually fairly 2116.16s - 2120.08s | Robust on EFB regs FAA slightly different installed 2120.56s - 2126.76s | EFBs completely different set of regulations to a portable EFB and the Civil Aviation Authority in my home country 2127.04s - 2129.04s | Also has a different set of regs as well 2129.60s - 2136.36s | So we look at looked at the regs and found AMC 2025 at AMC additional means of compliance 2136.36s - 2140.32s | so this is basically the regulation that you're supposed to follow when you're keeping your 2141.28s - 2148.36s | EFB software up-to-date and actually said you're supposed to do an integrity check


chunk_text:
us after a month and said yeah, it's the operators problem 2093.60s - 2100.28s | I'm summarizing about four pages of email here. But yeah, that's that's not a problem. That's that's for the airlines 2101.28s - 2103.28s | Okay, that's a novel discussion 2103.44s - 2107.32s | So we started going into some of the regulations and I'm not going to talk about 2107.60s - 2110.76s | EFB regs because they're really complicated but they are different around the world 2111.28s - 2115.56s | IASA European Aviation Safety Agency has is actually fairly 2116.16s - 2120.08s | Robust on EFB regs FAA slightly different installed 2120.56s - 2126.76s | EFBs completely different set of regulations to a portable EFB and the Civil Aviation Authority in my home country 2127.04s - 2129.04s | Also has a different set of regs as well 2129.60s - 2136.36s | So we look at looked at the regs and found AMC 2025 at AMC additional means of compliance 2136.36s - 2140.32s | so this is basically the regulation that you're supposed to follow when you're keeping your 2141.28s - 2148.36s | EFB software up-to-date and actually said you're supposed to do an integrity check and that's the one thing we thought was missing great 2149.20s - 2154.68s | so we had another call with Airbus and said hey, we think you're not following the regs and 2155.44s - 2162.08s | This is a really weird conversation where they said we're not going to fix it because we've analyzed your vulnerability and decided that fixing it 2162.08s - 2164.08s | Would be a product improvement 2164.20s - 2168.84s | I've got that in writing long version. Basically. We had a near argument with their 2169.72s - 2170.92s | engineering team and 2170.92s - 2176.56s | They told us that it didn't matter because you'd have to hack both EFBs at once because pilots cross-check on both 2176.56s - 2181.08s | Well, they don't actually they use one typically one pilot will do the entry of the data 2181.52s - 2187.04s | Passed to the co-pilot and they will verify the data entry then make the calculation and to prove that most 2188.76s - 2194.00s | Planes now have a minimum equipment list that only requires one EFB. So that was a shame. So 2195.44s - 2198.12s | we pushed over the period of a year


chunk_text:
and that's the one thing we thought was missing great 2149.20s - 2154.68s | so we had another call with Airbus and said hey, we think you're not following the regs and 2155.44s - 2162.08s | This is a really weird conversation where they said we're not going to fix it because we've analyzed your vulnerability and decided that fixing it 2162.08s - 2164.08s | Would be a product improvement 2164.20s - 2168.84s | I've got that in writing long version. Basically. We had a near argument with their 2169.72s - 2170.92s | engineering team and 2170.92s - 2176.56s | They told us that it didn't matter because you'd have to hack both EFBs at once because pilots cross-check on both 2176.56s - 2181.08s | Well, they don't actually they use one typically one pilot will do the entry of the data 2181.52s - 2187.04s | Passed to the co-pilot and they will verify the data entry then make the calculation and to prove that most 2188.76s - 2194.00s | Planes now have a minimum equipment list that only requires one EFB. So that was a shame. So 2195.44s - 2198.12s | we pushed over the period of a year and 2198.92s - 2205.32s | They came back and said yeah, it's we've evaluated it. We consider it as a product improvement. So we're not going to fix it. Okay 2206.44s - 2208.44s | And then one of our friendly 2208.92s - 2212.56s | Airline clients said you know what you could do you could have a chat with the regulator 2212.56s - 2216.16s | I'm like, why didn't we think of this before have a chat with the regulator? 2216.72s - 2219.96s | so we spoke to EASA who are lovely by the way, and 2220.56s - 2224.92s | We said we've got this vulnerability and Airbus have said they won't fix it. I'm like 2225.72s - 2231.56s | What do you think and they said hmm? I think we agree and then miraculously on 10th of April. It's been fixed 2231.76s - 2236.12s | It's amazing what happens when you get the regulator involved, isn't it? So it has been fixed, which is great 2236.12s - 2237.64s | Which is why we're talking about it now 2237.64s - 2242.20s | But why was it so hard? I think some of it is around 2243.12s - 2245.12s | some


chunk_text:
and 2198.92s - 2205.32s | They came back and said yeah, it's we've evaluated it. We consider it as a product improvement. So we're not going to fix it. Okay 2206.44s - 2208.44s | And then one of our friendly 2208.92s - 2212.56s | Airline clients said you know what you could do you could have a chat with the regulator 2212.56s - 2216.16s | I'm like, why didn't we think of this before have a chat with the regulator? 2216.72s - 2219.96s | so we spoke to EASA who are lovely by the way, and 2220.56s - 2224.92s | We said we've got this vulnerability and Airbus have said they won't fix it. I'm like 2225.72s - 2231.56s | What do you think and they said hmm? I think we agree and then miraculously on 10th of April. It's been fixed 2231.76s - 2236.12s | It's amazing what happens when you get the regulator involved, isn't it? So it has been fixed, which is great 2236.12s - 2237.64s | Which is why we're talking about it now 2237.64s - 2242.20s | But why was it so hard? I think some of it is around 2243.12s - 2245.12s | some of the struggles between 2245.56s - 2247.56s | flight safety and 2248.52s - 2254.56s | Engineering and cybersecurity because some of those are competing interests. It's so critically important same problem. We see an OT 2255.52s - 2257.52s | cultural separations between 2258.48s - 2260.48s | cybersecurity and safety engineering I 2261.08s - 2263.80s | Think there was also a bit of a reluctance to acknowledge it 2263.80s - 2267.32s | I've spoken to Airbus a few times about this and they've never publicly acknowledged 2267.68s - 2272.68s | The detail of this vulnerability and what's really weird is actually Airbus have got a really good reputation 2273.40s - 2279.72s | With their customers for being really engaging with them on cybersecurity. They've got test rigs all sorts of stuff 2279.72s - 2283.00s | It's actually they do some really cool things. So we don't understand 2283.64s - 2288.76s | Why we had to involve the regulator here. There's another bug we found this was well handled by them 2288.84s - 2291.32s | This is a slightly different set of the package 2291.32s - 2297.54s | It's called fly smart plus and the updater for the iOS app had intentionally


chunk_text:
of the struggles between 2245.56s - 2247.56s | flight safety and 2248.52s - 2254.56s | Engineering and cybersecurity because some of those are competing interests. It's so critically important same problem. We see an OT 2255.52s - 2257.52s | cultural separations between 2258.48s - 2260.48s | cybersecurity and safety engineering I 2261.08s - 2263.80s | Think there was also a bit of a reluctance to acknowledge it 2263.80s - 2267.32s | I've spoken to Airbus a few times about this and they've never publicly acknowledged 2267.68s - 2272.68s | The detail of this vulnerability and what's really weird is actually Airbus have got a really good reputation 2273.40s - 2279.72s | With their customers for being really engaging with them on cybersecurity. They've got test rigs all sorts of stuff 2279.72s - 2283.00s | It's actually they do some really cool things. So we don't understand 2283.64s - 2288.76s | Why we had to involve the regulator here. There's another bug we found this was well handled by them 2288.84s - 2291.32s | This is a slightly different set of the package 2291.32s - 2297.54s | It's called fly smart plus and the updater for the iOS app had intentionally had ATS disabled 2297.54s - 2301.06s | So application transport security, they turned it off which meant weirdly 2301.94s - 2304.78s | You could man the middle over Wi-Fi and tamper with the updates 2305.74s - 2310.62s | Unlike attacks over Wi-Fi really, but actually there's one odd thing about pilots 2310.62s - 2313.38s | Does he always stay in the same damn layover hotels every night? 2313.54s - 2318.34s | You can guarantee that layover hotel is gonna have a pilot from their airline in so actually, you know 2318.34s - 2321.14s | Where they're going to be so maybe a Wi-Fi attack is a bit more plausible 2322.14s - 2324.22s | Another one so a Lufthansa 2324.42s - 2330.62s | This is actually the Lufthansa systems part of the business that produce a really good charting application called eRoute manual 2330.86s - 2332.86s | used by loads and loads of 2333.10s - 2339.10s | Airlines, and we had a very similar issue whilst they did have a an integrity check 2340.06s - 2344.74s | Unfortunately, the key for that integrity check was one two, three, four five six seven eight 2345.86s - 2350.10s | Nine ten twice and


chunk_text:
had ATS disabled 2297.54s - 2301.06s | So application transport security, they turned it off which meant weirdly 2301.94s - 2304.78s | You could man the middle over Wi-Fi and tamper with the updates 2305.74s - 2310.62s | Unlike attacks over Wi-Fi really, but actually there's one odd thing about pilots 2310.62s - 2313.38s | Does he always stay in the same damn layover hotels every night? 2313.54s - 2318.34s | You can guarantee that layover hotel is gonna have a pilot from their airline in so actually, you know 2318.34s - 2321.14s | Where they're going to be so maybe a Wi-Fi attack is a bit more plausible 2322.14s - 2324.22s | Another one so a Lufthansa 2324.42s - 2330.62s | This is actually the Lufthansa systems part of the business that produce a really good charting application called eRoute manual 2330.86s - 2332.86s | used by loads and loads of 2333.10s - 2339.10s | Airlines, and we had a very similar issue whilst they did have a an integrity check 2340.06s - 2344.74s | Unfortunately, the key for that integrity check was one two, three, four five six seven eight 2345.86s - 2350.10s | Nine ten twice and so we flagged this to them. They said yeah, that's great 2350.10s - 2352.38s | We got we agree with you. We disclosed it to them 2352.42s - 2357.02s | What it meant was you could tamper with for example approach plates so you could tamper with 2358.42s - 2361.66s | I'll walk you through this. So this is a how you approach 2362.42s - 2368.50s | To an airport so you're supposed to arrive at 5,000 feet at DME 14 to the BRA VOR 2368.50s - 2371.18s | That's your initial fix your safety heights now 2371.78s - 2375.34s | 4,600 feet till you get the top of descent D at DME 12.4 2375.54s - 2380.34s | You then descend on 170 degree heading to a safe point at your final fix at 2380.98s - 2386.70s | 3,900 and then you can go down to your minimum descent altitude to the point of getting to the middle marker at DME 4 2386.70s - 2390.38s | So four miles from the airport at which point you either go around or you land 2390.46s - 2396.62s | We discovered you could tamper with all those so you could convince the pilots


chunk_text:
so we flagged this to them. They said yeah, that's great 2350.10s - 2352.38s | We got we agree with you. We disclosed it to them 2352.42s - 2357.02s | What it meant was you could tamper with for example approach plates so you could tamper with 2358.42s - 2361.66s | I'll walk you through this. So this is a how you approach 2362.42s - 2368.50s | To an airport so you're supposed to arrive at 5,000 feet at DME 14 to the BRA VOR 2368.50s - 2371.18s | That's your initial fix your safety heights now 2371.78s - 2375.34s | 4,600 feet till you get the top of descent D at DME 12.4 2375.54s - 2380.34s | You then descend on 170 degree heading to a safe point at your final fix at 2380.98s - 2386.70s | 3,900 and then you can go down to your minimum descent altitude to the point of getting to the middle marker at DME 4 2386.70s - 2390.38s | So four miles from the airport at which point you either go around or you land 2390.46s - 2396.62s | We discovered you could tamper with all those so you could convince the pilots to go lower and potentially have a control flight into the 2396.62s - 2398.62s | Ground. I hope that doesn't happen 2398.74s - 2400.34s | They were awesome 2400.34s - 2405.46s | It took him two years, but they were really good really engaging and have since asked us out to give some talks to them 2406.82s - 2408.74s | Yeah 2408.74s - 2413.06s | So that is me and EFBs. I want to give a very quick rattle around airports next 2414.14s - 2416.14s | the other side of things 2416.38s - 2420.46s | Airports are incredibly complicated places with lots of really interesting things going on 2421.10s - 2427.46s | We were asked by one aviation one Airport. Sorry to look at their departure boards. We said, yeah, we've got bugs in those 2427.46s - 2433.14s | We think we can inject our own flights and completely tamper with everything. They said what a cool organization said go on then 2434.06s - 2436.30s | Put a flight on our boards. So we did 2437.26s - 2441.70s | But of course that was just proving the point we could have trashed that system and then there would have been


chunk_text:
to go lower and potentially have a control flight into the 2396.62s - 2398.62s | Ground. I hope that doesn't happen 2398.74s - 2400.34s | They were awesome 2400.34s - 2405.46s | It took him two years, but they were really good really engaging and have since asked us out to give some talks to them 2406.82s - 2408.74s | Yeah 2408.74s - 2413.06s | So that is me and EFBs. I want to give a very quick rattle around airports next 2414.14s - 2416.14s | the other side of things 2416.38s - 2420.46s | Airports are incredibly complicated places with lots of really interesting things going on 2421.10s - 2427.46s | We were asked by one aviation one Airport. Sorry to look at their departure boards. We said, yeah, we've got bugs in those 2427.46s - 2433.14s | We think we can inject our own flights and completely tamper with everything. They said what a cool organization said go on then 2434.06s - 2436.30s | Put a flight on our boards. So we did 2437.26s - 2441.70s | But of course that was just proving the point we could have trashed that system and then there would have been chaos at the airport 2443.02s - 2444.74s | Runway lighting is also a major issue 2444.74s - 2451.14s | We know of one airport where their runway lighting controllers were airside and then they expanded the parking lots and they ended up 2451.30s - 2456.74s | Landside and then someone came along and stole all the controllers and the runway light stopped working. Oops 2457.50s - 2458.42s | These are really good fun 2458.42s - 2461.58s | If you ever fly into Heathrow's Terminal 5 they use robot pushback tugs 2462.02s - 2465.34s | Never got to have a go at them haven't managed to pen test them yet 2465.34s - 2470.02s | But I'm really pushing BA and IAG to see if we can have a pop really interesting devices 2470.74s - 2476.86s | Fueling is also a major problem. There's two primary providers. It's all API based all done through tablets 2476.86s - 2481.96s | I think there's a really interesting set of research to be done there and ground power is a major problem as well 2483.22s - 2485.42s | I'm not going to talk about spoofing ADS-B 2485.42s - 2486.90s | I'm not going to talk


chunk_text:
chaos at the airport 2443.02s - 2444.74s | Runway lighting is also a major issue 2444.74s - 2451.14s | We know of one airport where their runway lighting controllers were airside and then they expanded the parking lots and they ended up 2451.30s - 2456.74s | Landside and then someone came along and stole all the controllers and the runway light stopped working. Oops 2457.50s - 2458.42s | These are really good fun 2458.42s - 2461.58s | If you ever fly into Heathrow's Terminal 5 they use robot pushback tugs 2462.02s - 2465.34s | Never got to have a go at them haven't managed to pen test them yet 2465.34s - 2470.02s | But I'm really pushing BA and IAG to see if we can have a pop really interesting devices 2470.74s - 2476.86s | Fueling is also a major problem. There's two primary providers. It's all API based all done through tablets 2476.86s - 2481.96s | I think there's a really interesting set of research to be done there and ground power is a major problem as well 2483.22s - 2485.42s | I'm not going to talk about spoofing ADS-B 2485.42s - 2486.90s | I'm not going to talk about that either 2486.90s - 2493.30s | But what I really wanted to get to here is if you're doing research in aviation, please make sure you disclose it responsibly 2493.54s - 2500.02s | Don't drop it like it's hot in the public. It's not going to be possible to fix that bug and publish it 90 days data 2500.02s - 2503.54s | It's gonna take a while if you're struggling to get 2504.10s - 2505.82s | airlines or 2505.82s - 2508.78s | Manufacturers to listen to you. There's a couple of really awesome routes 2508.78s - 2512.30s | You can go so the Aviation ISAC will help broker vulnerability disclosure for you 2512.34s - 2517.98s | If you're struggling to the DEFCON aerospace village wherever there we help found it we will help you as well 2517.98s - 2522.94s | There's lots of really cool organizations that can help you disclose vulnerabilities to airline and get things 2524.30s - 2525.74s | fixed 2525.74s - 2527.50s | Planes are very complicated 2527.50s - 2533.90s | They're really really important safety engineering in there. So it does take a while to get the bugs fixed. So just bear with 2534.90s -


chunk_text:
about that either 2486.90s - 2493.30s | But what I really wanted to get to here is if you're doing research in aviation, please make sure you disclose it responsibly 2493.54s - 2500.02s | Don't drop it like it's hot in the public. It's not going to be possible to fix that bug and publish it 90 days data 2500.02s - 2503.54s | It's gonna take a while if you're struggling to get 2504.10s - 2505.82s | airlines or 2505.82s - 2508.78s | Manufacturers to listen to you. There's a couple of really awesome routes 2508.78s - 2512.30s | You can go so the Aviation ISAC will help broker vulnerability disclosure for you 2512.34s - 2517.98s | If you're struggling to the DEFCON aerospace village wherever there we help found it we will help you as well 2517.98s - 2522.94s | There's lots of really cool organizations that can help you disclose vulnerabilities to airline and get things 2524.30s - 2525.74s | fixed 2525.74s - 2527.50s | Planes are very complicated 2527.50s - 2533.90s | They're really really important safety engineering in there. So it does take a while to get the bugs fixed. So just bear with 2534.90s - 2536.90s | whilst they fixed it safely and 2537.62s - 2544.66s | Responsibly it would be lovely just to push an update wouldn't it but the chance of blue screening a plane. Should we just not go there? 2545.22s - 2549.58s | Anyway, that is me. Hope you found it interesting. That's my email. That's the firm I work for 2549.58s - 2552.06s | We're over in the aerospace village. If you want to come and have a chat 2552.06s - 2554.62s | We've got a flight simulator to play with but thank you so much


chunk_text:
2536.90s | whilst they fixed it safely and 2537.62s - 2544.66s | Responsibly it would be lovely just to push an update wouldn't it but the chance of blue screening a plane. Should we just not go there? 2545.22s - 2549.58s | Anyway, that is me. Hope you found it interesting. That's my email. That's the firm I work for 2549.58s - 2552.06s | We're over in the aerospace village. If you want to come and have a chat 2552.06s - 2554.62s | We've got a flight simulator to play with but thank you so much


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=-ad-Y18pY54", "title": "DEF CON 32 - You got a lighter I need to do some Electroporation - J. Utley, P. Rhodes, J. Hill", "description": "Biological warfare is a phenomenon that spans human history, tracing its roots to ancient times rather than being a recent invention. To gain insights into bioweapons' current and future landscape, it is imperative to look into historical examples of conventional biological warfare and understand how methods were devised and implemented. Our future hinges significantly on our ability to foster transparency and creativity within the global community. This optimism is intertwined with our comprehension of technological advancements, the rapid pace of innovation, the interconnectedness of various domains, and the imperative task of constructing practical defenses against emerging threats. As a poignant reminder, our vulnerability lies in technological shortcomings and our collective failure of imagination. This discourse extends to establishing social norms and mores that are pivotal in shaping attitudes toward biological warfare and encompasses an exploration of prospective research endeavors and emerging initiatives leveraging artificial intelligence (AI) in the realm of bioweaponry. As we confront the intricate interplay between technological advancements and human agency, it is imperative to remain vigilant and resolute in our pursuit of a future safeguarded against the malevolent exploitation of biological agents.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1634, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.52s | This text was transcribed using whisper model: large-v2 welcome uh welcome to our talk uh it's titled hey bro you got a lighter i need to do some 5.52s - 11.60s | electroporation so the first warning is on the defcon website it's mentioned that it's like 11.60s - 17.04s | about a bio weapon under the description that is not what this talk is about i don't know why i 17.04s - 22.88s | didn't get fixed but so we'll start with saying that this device that uh we're about ready to 22.88s - 31.57s | show you should not be used as a bio weapon okay cool moving on um all right so for those that 31.57s - 38.13s | don't know me my name is dr james utley i have a phd in health science i do kind of a lot of 38.13s - 44.77s | things in the bio so i'm a i guess i'm a biohacker doubling as a professional scientist and i'll just 44.77s - 48.21s | go


chunk_text:
of a future safeguarded against the malevolent exploitation of biological agents.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1634, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.52s | This text was transcribed using whisper model: large-v2 welcome uh welcome to our talk uh it's titled hey bro you got a lighter i need to do some 5.52s - 11.60s | electroporation so the first warning is on the defcon website it's mentioned that it's like 11.60s - 17.04s | about a bio weapon under the description that is not what this talk is about i don't know why i 17.04s - 22.88s | didn't get fixed but so we'll start with saying that this device that uh we're about ready to 22.88s - 31.57s | show you should not be used as a bio weapon okay cool moving on um all right so for those that 31.57s - 38.13s | don't know me my name is dr james utley i have a phd in health science i do kind of a lot of 38.13s - 44.77s | things in the bio so i'm a i guess i'm a biohacker doubling as a professional scientist and i'll just 44.77s - 48.21s | go through this real quick so you know that i'm not some yahoo that doesn't know what he's kind 48.21s - 55.17s | of talking about but i think that title of being a yay who is kind of cooler anyway so anyway first 55.17s - 60.45s | off is i have the honor and the privilege of being a chief scientific officer at a at a 60.45s - 68.05s | regenerative medicine stem cell clinic in panama which where i live so whoo go origins we uh that's 68.05s - 75.33s | my that's my day job i also we're flying today under the flag of viva securus which is myself 75.33s - 81.89s | phil roads and josh hill otherwise known as the post-6 ninja he couldn't make it here today but 81.89s - 86.05s | he is a mystical creature that has fueled some of the greatness behind our company for sure 87.01s - 92.13s | and then uh lastly as i have uh folks here from a biohacker collective we have here in las vegas 92.13s - 99.57s | called syndicate laboratories it's uh yeah we're a shout out it's a homage to the the yt cracker


chunk_text:
through this real quick so you know that i'm not some yahoo that doesn't know what he's kind 48.21s - 55.17s | of talking about but i think that title of being a yay who is kind of cooler anyway so anyway first 55.17s - 60.45s | off is i have the honor and the privilege of being a chief scientific officer at a at a 60.45s - 68.05s | regenerative medicine stem cell clinic in panama which where i live so whoo go origins we uh that's 68.05s - 75.33s | my that's my day job i also we're flying today under the flag of viva securus which is myself 75.33s - 81.89s | phil roads and josh hill otherwise known as the post-6 ninja he couldn't make it here today but 81.89s - 86.05s | he is a mystical creature that has fueled some of the greatness behind our company for sure 87.01s - 92.13s | and then uh lastly as i have uh folks here from a biohacker collective we have here in las vegas 92.13s - 99.57s | called syndicate laboratories it's uh yeah we're a shout out it's a homage to the the yt cracker 99.57s - 107.81s | album for any of those who didn't get that anyway so uh phil philism is the master of many talents 107.81s - 115.97s | here uh pentester and i don't know if there is truly like this find a fed type uh but anyway 115.97s - 122.69s | here's one um meaning he's in the navy so who could go navy all right so yeah you can grab the 122.69s - 127.57s | contacts there from the qr hopefully people can get them yeah all right moving on let's get into 127.57s - 134.61s | uh oh yes i want to apologize in advance like i don't mean to offend anyone here on this uh this 134.61s - 140.21s | talk of like what we're gonna you know but it has been infected with like dad jokes and just just 141.01s - 148.45s | just some fuckery and i uh so be warned if you want me to say earmuffs beforehand i can but 148.45s - 153.73s | we're making this we kind of like we're thinking like hey are we overusing memes and then we're 153.73s - 159.89s | like no no let's just let's


chunk_text:
99.57s - 107.81s | album for any of those who didn't get that anyway so uh phil philism is the master of many talents 107.81s - 115.97s | here uh pentester and i don't know if there is truly like this find a fed type uh but anyway 115.97s - 122.69s | here's one um meaning he's in the navy so who could go navy all right so yeah you can grab the 122.69s - 127.57s | contacts there from the qr hopefully people can get them yeah all right moving on let's get into 127.57s - 134.61s | uh oh yes i want to apologize in advance like i don't mean to offend anyone here on this uh this 134.61s - 140.21s | talk of like what we're gonna you know but it has been infected with like dad jokes and just just 141.01s - 148.45s | just some fuckery and i uh so be warned if you want me to say earmuffs beforehand i can but 148.45s - 153.73s | we're making this we kind of like we're thinking like hey are we overusing memes and then we're 153.73s - 159.89s | like no no let's just let's just go with it right and uh so you'll see anyway moving on 161.73s - 168.05s | so this is where we're going to start uh so where this all started here is this is what we're we've 168.05s - 174.53s | developed you know what we've kind of like take the next generation of is is from an electro pen 174.53s - 180.29s | right so you see some of these like university students here that put together an electroporation 180.29s - 186.21s | device and we'll kind of get into like we're trying to keep this talk like very kind of simple 186.21s - 192.85s | and easy to digest and so um but anyway this is where it started and these college kids did a 192.85s - 201.57s | great job of like really uh taking this barbecue lighter um and then electroporating uh or in 201.57s - 207.73s | trans transfecting some uh some dna from extracellular to inside the cell and that's what 207.73s - 214.69s | this that's what this talk is because we took their study and we uh made the next i mean basically 214.69s - 221.25s | it's an easier device


chunk_text:
just go with it right and uh so you'll see anyway moving on 161.73s - 168.05s | so this is where we're going to start uh so where this all started here is this is what we're we've 168.05s - 174.53s | developed you know what we've kind of like take the next generation of is is from an electro pen 174.53s - 180.29s | right so you see some of these like university students here that put together an electroporation 180.29s - 186.21s | device and we'll kind of get into like we're trying to keep this talk like very kind of simple 186.21s - 192.85s | and easy to digest and so um but anyway this is where it started and these college kids did a 192.85s - 201.57s | great job of like really uh taking this barbecue lighter um and then electroporating uh or in 201.57s - 207.73s | trans transfecting some uh some dna from extracellular to inside the cell and that's what 207.73s - 214.69s | this that's what this talk is because we took their study and we uh made the next i mean basically 214.69s - 221.25s | it's an easier device to assemble in my in my opinion um but the key take-home point here is that 222.93s - 229.17s | we want to stress that like the there's the potential for to democratize science using 229.17s - 236.29s | frugal tools and that's really what kind of this whole thing is about is that you the people can 236.29s - 239.73s | learn about these techniques whether it's genetic engineering whether it's you know science in 239.73s - 246.05s | general um however however you like be able to to learn it from the comfort of your own home 247.97s - 254.50s | anyway moving on and yeah i guess i kind of started that i started my rant already right 254.50s - 259.06s | so we just like you know the access to electroporation technology or genetic engineering 259.06s - 265.14s | that you can uh you know the sky's the limit and you know and kind of like what is your imagination 265.14s - 271.14s | and how to uh you know transfect cells or genetic engineering and this is just one way to do it and 271.14s - 278.18s | it allows that like those the people


chunk_text:
to assemble in my in my opinion um but the key take-home point here is that 222.93s - 229.17s | we want to stress that like the there's the potential for to democratize science using 229.17s - 236.29s | frugal tools and that's really what kind of this whole thing is about is that you the people can 236.29s - 239.73s | learn about these techniques whether it's genetic engineering whether it's you know science in 239.73s - 246.05s | general um however however you like be able to to learn it from the comfort of your own home 247.97s - 254.50s | anyway moving on and yeah i guess i kind of started that i started my rant already right 254.50s - 259.06s | so we just like you know the access to electroporation technology or genetic engineering 259.06s - 265.14s | that you can uh you know the sky's the limit and you know and kind of like what is your imagination 265.14s - 271.14s | and how to uh you know transfect cells or genetic engineering and this is just one way to do it and 271.14s - 278.18s | it allows that like those the people can then uh you know identify like what uh you know that they 278.18s - 283.94s | have the the skills and the resources and the know-how to do these type of experiments and it 283.94s - 291.30s | doesn't have to be confined by fancy instruments or you know big pharma or you know or academia 291.30s - 297.38s | just kind of like locking it up you know science is for everyone so this is just one example 298.66s - 303.78s | now some of this stuff is already done in biohacker labs that are you know out throughout 303.78s - 309.54s | the community and you know i i really uh i really appreciate that community and that's why 309.54s - 315.22s | i try to invest my time and my effort into into the biohacker community meaning like the genetic 315.22s - 320.42s | engineer diy bio those folks because it's important i know i've noticed over like the 320.42s - 325.62s | last five years that they just become like less uh i guess maybe less organized or maybe less 325.62s - 331.54s | prevalent and so if you uh if you have a curiosity


chunk_text:
can then uh you know identify like what uh you know that they 278.18s - 283.94s | have the the skills and the resources and the know-how to do these type of experiments and it 283.94s - 291.30s | doesn't have to be confined by fancy instruments or you know big pharma or you know or academia 291.30s - 297.38s | just kind of like locking it up you know science is for everyone so this is just one example 298.66s - 303.78s | now some of this stuff is already done in biohacker labs that are you know out throughout 303.78s - 309.54s | the community and you know i i really uh i really appreciate that community and that's why 309.54s - 315.22s | i try to invest my time and my effort into into the biohacker community meaning like the genetic 315.22s - 320.42s | engineer diy bio those folks because it's important i know i've noticed over like the 320.42s - 325.62s | last five years that they just become like less uh i guess maybe less organized or maybe less 325.62s - 331.54s | prevalent and so if you uh if you have a curiosity for science then you know find a community and 331.54s - 340.83s | join it so for sure okay now this is a little bit of a the detour here but it's all in the same 340.83s - 346.99s | row so so so bear with me here transfection is actually what we're trying to do through 346.99s - 353.63s | electroporation so we're trying to use electricity to develop a pore in a cell to then insert from 353.63s - 360.43s | an extracellular maybe that's a dna or rna into the cell to hijack uh you know hijack the machinery 360.43s - 370.35s | and or uh express a different protein now because i am a one a big nicholas cage fan and i like the 370.35s - 376.35s | the fact of i like electroporation this presentation has been transfected with 376.35s - 381.79s | nicholas cage memes and so if you see it's a process used in genetic engineering you know 381.79s - 389.71s | from foreign into the cell so the challenge is here when we get to the end um that there is a 390.27s - 397.15s | number of nicholas cage memes and


chunk_text:
for science then you know find a community and 331.54s - 340.83s | join it so for sure okay now this is a little bit of a the detour here but it's all in the same 340.83s - 346.99s | row so so so bear with me here transfection is actually what we're trying to do through 346.99s - 353.63s | electroporation so we're trying to use electricity to develop a pore in a cell to then insert from 353.63s - 360.43s | an extracellular maybe that's a dna or rna into the cell to hijack uh you know hijack the machinery 360.43s - 370.35s | and or uh express a different protein now because i am a one a big nicholas cage fan and i like the 370.35s - 376.35s | the fact of i like electroporation this presentation has been transfected with 376.35s - 381.79s | nicholas cage memes and so if you see it's a process used in genetic engineering you know 381.79s - 389.71s | from foreign into the cell so the challenge is here when we get to the end um that there is a 390.27s - 397.15s | number of nicholas cage memes and or references and or uh and i'll i'll give you one hard one but 397.15s - 401.15s | at the end we'll see uh we'll see if every you know we have a last slide here that will 401.79s - 408.75s | that we can see uh how many how many nicholas cage references we have seen and i will also agree that 409.31s - 417.07s | nicholas cage's face on things is the best thing i've ever looked up so okay all right and again 417.07s - 422.11s | i'm sorry i'm sorry that you chose this session because there's uh some some some terrible memes 422.11s - 427.87s | and dad jokes anyway this was so how this all started for me personally is that i realized 427.87s - 432.27s | from that paper that you could use a lighter to it's not for smoking it's for electroporation 432.27s - 439.79s | poration and so i wrote this like really cringy type sub stack post uh some years ago and with 439.79s - 446.19s | that we're like okay well let's see if we can fucking do this thing for real and that's where 446.19s - 451.15s |


chunk_text:
or references and or uh and i'll i'll give you one hard one but 397.15s - 401.15s | at the end we'll see uh we'll see if every you know we have a last slide here that will 401.79s - 408.75s | that we can see uh how many how many nicholas cage references we have seen and i will also agree that 409.31s - 417.07s | nicholas cage's face on things is the best thing i've ever looked up so okay all right and again 417.07s - 422.11s | i'm sorry i'm sorry that you chose this session because there's uh some some some terrible memes 422.11s - 427.87s | and dad jokes anyway this was so how this all started for me personally is that i realized 427.87s - 432.27s | from that paper that you could use a lighter to it's not for smoking it's for electroporation 432.27s - 439.79s | poration and so i wrote this like really cringy type sub stack post uh some years ago and with 439.79s - 446.19s | that we're like okay well let's see if we can fucking do this thing for real and that's where 446.19s - 451.15s | it kind of all started um so welcome to the biovault revolution you didn't know that you 451.15s - 456.51s | were attending this talk and it's a you know a low-cost portable electroporator which just means 456.51s - 460.91s | it's a barbecue lighter and maybe phil you want to show like what the device looks like 461.63s - 468.83s | and it's you know inspired by a barbecue lighter or the pzt or the piezoelectric effect of a of a 468.83s - 474.75s | light of a lighter to start a barbecue and it's meant to you know bring synthetic biology to the 474.75s - 481.55s | masses okay so electroporation 101 and i'm sorry i'm going through this fast because we only have 481.55s - 487.95s | a limited amount of time so it's a technique to deliver molecules you know dna into cells right 487.95s - 493.23s | and it uses electropulses right which is the clicking of the lighter to create a pore which 493.23s - 498.35s | then uh it then it will enter so sometimes when you're like when you're trying to select 499.39s - 502.83s | you're trying to select what you


chunk_text:
it kind of all started um so welcome to the biovault revolution you didn't know that you 451.15s - 456.51s | were attending this talk and it's a you know a low-cost portable electroporator which just means 456.51s - 460.91s | it's a barbecue lighter and maybe phil you want to show like what the device looks like 461.63s - 468.83s | and it's you know inspired by a barbecue lighter or the pzt or the piezoelectric effect of a of a 468.83s - 474.75s | light of a lighter to start a barbecue and it's meant to you know bring synthetic biology to the 474.75s - 481.55s | masses okay so electroporation 101 and i'm sorry i'm going through this fast because we only have 481.55s - 487.95s | a limited amount of time so it's a technique to deliver molecules you know dna into cells right 487.95s - 493.23s | and it uses electropulses right which is the clicking of the lighter to create a pore which 493.23s - 498.35s | then uh it then it will enter so sometimes when you're like when you're trying to select 499.39s - 502.83s | you're trying to select what you want to electroporate or trans infect 503.55s - 508.67s | uh you get kind of confused like this is what's what's right you know dna rna or whatever but 508.67s - 514.91s | that's part of the uh that's part of the journey here because this is really part one of really 514.91s - 521.23s | three phases of a project part one meaning that this is the tool and we're going to try to show 521.23s - 527.47s | you how we can provide some reproducibility on the tool to electroporate or at um and then step 527.47s - 532.03s | two is really the plasmid selection like what do you want to put inside the cell and then the last 532.03s - 539.31s | part is like recovery and counting which we'll kind of gloss over at the end okay electroporation 539.31s - 544.03s | 101 so the first thing to start with is it's not easy it's really difficult to do it in a diy 544.03s - 550.03s | environment it is really difficult and so it's really carefully uh hinged on parameters like 550.03s - 556.75s | optimizing those parameters which means like the gap the


chunk_text:
want to electroporate or trans infect 503.55s - 508.67s | uh you get kind of confused like this is what's what's right you know dna rna or whatever but 508.67s - 514.91s | that's part of the uh that's part of the journey here because this is really part one of really 514.91s - 521.23s | three phases of a project part one meaning that this is the tool and we're going to try to show 521.23s - 527.47s | you how we can provide some reproducibility on the tool to electroporate or at um and then step 527.47s - 532.03s | two is really the plasmid selection like what do you want to put inside the cell and then the last 532.03s - 539.31s | part is like recovery and counting which we'll kind of gloss over at the end okay electroporation 539.31s - 544.03s | 101 so the first thing to start with is it's not easy it's really difficult to do it in a diy 544.03s - 550.03s | environment it is really difficult and so it's really carefully uh hinged on parameters like 550.03s - 556.75s | optimizing those parameters which means like the gap the amount of uh you know trigger the pulse 556.75s - 563.55s | and those type of things and uh so the electric field the ionic composition of the the fluid in 563.55s - 569.71s | which you're putting your dna with to transfect the cells in which you which you you have chosen 570.35s - 575.63s | um so it's actually really it's actually really difficult difficult so as you know if you take 575.63s - 580.11s | this home and you want to do it just know that it's very very hard um but it's not possible and 580.11s - 586.51s | you see here i've got like a little picture of the cuvette we call it the cuvette and it has a 586.51s - 593.15s | microfluidic well which you kind of develop and through the pulsing it provides some electricity 594.03s - 601.47s | and that's that's that right so again we're going to talk about we're going to talk about how we're 601.47s - 608.11s | taking a nucleic acid sequence and we're trying to take it from extracellular and put it inside the 608.11s - 614.67s | cell and i will this is my the


chunk_text:
amount of uh you know trigger the pulse 556.75s - 563.55s | and those type of things and uh so the electric field the ionic composition of the the fluid in 563.55s - 569.71s | which you're putting your dna with to transfect the cells in which you which you you have chosen 570.35s - 575.63s | um so it's actually really it's actually really difficult difficult so as you know if you take 575.63s - 580.11s | this home and you want to do it just know that it's very very hard um but it's not possible and 580.11s - 586.51s | you see here i've got like a little picture of the cuvette we call it the cuvette and it has a 586.51s - 593.15s | microfluidic well which you kind of develop and through the pulsing it provides some electricity 594.03s - 601.47s | and that's that's that right so again we're going to talk about we're going to talk about how we're 601.47s - 608.11s | taking a nucleic acid sequence and we're trying to take it from extracellular and put it inside the 608.11s - 614.67s | cell and i will this is my the freebie here if you look at the nucleus of this meme here um nucleus 614.67s - 623.12s | cage i don't know hopefully somebody finds that funny moving on okay so another breakdown here 624.64s - 630.48s | you know you have like this plasmid right so you have like your fluid in which you're 630.48s - 635.60s | and i guess i i should say that pbs or phosphate buffered saline is really good 636.24s - 641.92s | um and you want to you want to add your dna and what you've chosen right um with this with 641.92s - 647.28s | your cells and give it a good pulse you'll see on the right hand side and by doing so it opens up a 647.28s - 654.64s | pore and that plasmid will then uh become intracellular that's the ultimate goal that's 654.64s - 664.51s | what you're trying to do um and yeah so why are we doing this we're why are we doing this is because 665.39s - 670.51s | you know we're all part banana and some of us are part you know if you ever and the broader 670.51s - 676.59s | point is


chunk_text:
freebie here if you look at the nucleus of this meme here um nucleus 614.67s - 623.12s | cage i don't know hopefully somebody finds that funny moving on okay so another breakdown here 624.64s - 630.48s | you know you have like this plasmid right so you have like your fluid in which you're 630.48s - 635.60s | and i guess i i should say that pbs or phosphate buffered saline is really good 636.24s - 641.92s | um and you want to you want to add your dna and what you've chosen right um with this with 641.92s - 647.28s | your cells and give it a good pulse you'll see on the right hand side and by doing so it opens up a 647.28s - 654.64s | pore and that plasmid will then uh become intracellular that's the ultimate goal that's 654.64s - 664.51s | what you're trying to do um and yeah so why are we doing this we're why are we doing this is because 665.39s - 670.51s | you know we're all part banana and some of us are part you know if you ever and the broader 670.51s - 676.59s | point is that if you want to learn about this to make yourself a nicholas cage hybrid banana 677.15s - 680.99s | like you should be able to right nobody should tell you you can't do that so 681.87s - 689.92s | you know that's the uh that's the that's the essence there okay so spoiler alert the device 689.92s - 696.80s | is really ugly and you'll see on the left hand side of this slide there you see it's just a 696.80s - 704.32s | barbecue lighter and it has the trigger which is the uh the pzt effect and we've kind of like 704.32s - 709.44s | optimized it and if you were ever wanted to look back at the college kids that did this before 710.08s - 715.36s | they 3d printed this nice housing environment that had some wires that kind of delivered 716.00s - 721.84s | but it was definitely difficult to to like you know uh to make contact with the cuvette and 721.84s - 727.04s | really it's about like the consistency of the fluid the micro the microfluidic well 727.04s - 732.96s | or a channel if you will um and the cuvette


chunk_text:
that if you want to learn about this to make yourself a nicholas cage hybrid banana 677.15s - 680.99s | like you should be able to right nobody should tell you you can't do that so 681.87s - 689.92s | you know that's the uh that's the that's the essence there okay so spoiler alert the device 689.92s - 696.80s | is really ugly and you'll see on the left hand side of this slide there you see it's just a 696.80s - 704.32s | barbecue lighter and it has the trigger which is the uh the pzt effect and we've kind of like 704.32s - 709.44s | optimized it and if you were ever wanted to look back at the college kids that did this before 710.08s - 715.36s | they 3d printed this nice housing environment that had some wires that kind of delivered 716.00s - 721.84s | but it was definitely difficult to to like you know uh to make contact with the cuvette and 721.84s - 727.04s | really it's about like the consistency of the fluid the micro the microfluidic well 727.04s - 732.96s | or a channel if you will um and the cuvette that really kind of makes a difference um you'll see 732.96s - 737.92s | there's some other equipment of course this is a pipette um and then on the right hand side there 737.92s - 743.36s | was like some crazy ideas like okay if i'm going to put a i'm going to try to have it migrate down 743.36s - 750.32s | a microfluidic well and then kind of aggregate there and then uh then zap it there uh no did 750.32s - 755.68s | not really work because it just killed cells which we'll talk about later um okay moving on 757.04s - 759.76s | because it's so ugly you know maybe it's the greatest threat to world peace 760.40s - 767.52s | okay light laugh no okay all right all right we're moving on um we were had this like running joke 767.52s - 771.28s | about this full body electroporation i don't know if this movie is going to give us if this will 771.28s - 778.24s | give us sounds but it's like okay let's what's oh all right okay and there's no sound but you 778.24s - 786.48s | can outplay as luigi again


chunk_text:
that really kind of makes a difference um you'll see 732.96s - 737.92s | there's some other equipment of course this is a pipette um and then on the right hand side there 737.92s - 743.36s | was like some crazy ideas like okay if i'm going to put a i'm going to try to have it migrate down 743.36s - 750.32s | a microfluidic well and then kind of aggregate there and then uh then zap it there uh no did 750.32s - 755.68s | not really work because it just killed cells which we'll talk about later um okay moving on 757.04s - 759.76s | because it's so ugly you know maybe it's the greatest threat to world peace 760.40s - 767.52s | okay light laugh no okay all right all right we're moving on um we were had this like running joke 767.52s - 771.28s | about this full body electroporation i don't know if this movie is going to give us if this will 771.28s - 778.24s | give us sounds but it's like okay let's what's oh all right okay and there's no sound but you 778.24s - 786.48s | can outplay as luigi again i i already apologized up front um okay yeah but back to back to it yes 786.48s - 794.72s | this is still a very ugly device and um but it's cheap that's the uh that's the part it's uh it's 794.72s - 800.08s | cheap to make and you can make it at your home it's very crude um and you can get all these these 800.08s - 805.76s | items here um i don't know phil let's see we didn't we don't have the heat shrink well wire 805.76s - 811.68s | insulator but that's like duct tape or a electrical tape the aluminum tape is kind of a conductive 811.68s - 818.88s | material um that you want to put over the magnets there's a roll of adhesive magnets there that we 818.88s - 824.32s | kind of stack and that kind of makes that field and then you have the the aluminum overlay that 824.32s - 830.08s | kind of is a conductive material to make the cuvette and then it's like nine volt battery 830.08s - 836.72s | kind of a and it doesn't travel very well i'll say that um they're kind of wondering


chunk_text:
i i already apologized up front um okay yeah but back to back to it yes 786.48s - 794.72s | this is still a very ugly device and um but it's cheap that's the uh that's the part it's uh it's 794.72s - 800.08s | cheap to make and you can make it at your home it's very crude um and you can get all these these 800.08s - 805.76s | items here um i don't know phil let's see we didn't we don't have the heat shrink well wire 805.76s - 811.68s | insulator but that's like duct tape or a electrical tape the aluminum tape is kind of a conductive 811.68s - 818.88s | material um that you want to put over the magnets there's a roll of adhesive magnets there that we 818.88s - 824.32s | kind of stack and that kind of makes that field and then you have the the aluminum overlay that 824.32s - 830.08s | kind of is a conductive material to make the cuvette and then it's like nine volt battery 830.08s - 836.72s | kind of a and it doesn't travel very well i'll say that um they're kind of wondering like what 836.72s - 842.80s | the fuck is that um because i live in panama i travel here so anyway um so we made some more 842.80s - 847.36s | devices when we got back but it's definitely cheaper than uh and we'll see if this lands 847.36s - 851.12s | we'll see if this joke lands it's definitely more than the ten dollar uber eats card you 851.12s - 858.16s | receive because of the crowd strike windows outage nobody nobody yeah okay good it landed it 858.16s - 872.46s | landed it already expired wow okay so i'm glad the joke landed there because yeah okay uh again 872.46s - 877.34s | i guess we kind of kind of talked on this at one point here on this slide is this smart glass bio 877.34s - 882.06s | interface which is a really cool name for a microscope slide they seem to work uh well 882.06s - 887.02s | when you're trying to develop the arc gap so yeah just a standard microscope 888.54s - 896.94s | okay uh and you know as so the point here is to kind of like iterate on do you know


chunk_text:
like what 836.72s - 842.80s | the fuck is that um because i live in panama i travel here so anyway um so we made some more 842.80s - 847.36s | devices when we got back but it's definitely cheaper than uh and we'll see if this lands 847.36s - 851.12s | we'll see if this joke lands it's definitely more than the ten dollar uber eats card you 851.12s - 858.16s | receive because of the crowd strike windows outage nobody nobody yeah okay good it landed it 858.16s - 872.46s | landed it already expired wow okay so i'm glad the joke landed there because yeah okay uh again 872.46s - 877.34s | i guess we kind of kind of talked on this at one point here on this slide is this smart glass bio 877.34s - 882.06s | interface which is a really cool name for a microscope slide they seem to work uh well 882.06s - 887.02s | when you're trying to develop the arc gap so yeah just a standard microscope 888.54s - 896.94s | okay uh and you know as so the point here is to kind of like iterate on do you know find crazy 896.94s - 901.98s | devices and as long as you can insert this pzt crystal or the pzeo electric crystal 902.62s - 909.34s | uh effect then you could essentially make it an electroporator and i was using superglue to 909.34s - 912.54s | like develop part of the device and i was like hey you know what i'm gonna use this like 912.54s - 917.18s | superglue casing to make another one and i put a little washer there and then that red cap 917.18s - 922.78s | became like the spring and i was like okay this will do it you know um anyway the point is like 922.78s - 931.50s | you know use your imagination um but the pro tip is that the the bic lighters they suck you know 931.50s - 936.14s | they're probably great lighters but when you're trying to do that trying to make an electroporator 936.14s - 941.98s | from from the device they suck we they suck so bad that we took a part two and we're like okay 941.98s - 946.62s | can we put this thing you know make it a device and then we're like


chunk_text:
find crazy 896.94s - 901.98s | devices and as long as you can insert this pzt crystal or the pzeo electric crystal 902.62s - 909.34s | uh effect then you could essentially make it an electroporator and i was using superglue to 909.34s - 912.54s | like develop part of the device and i was like hey you know what i'm gonna use this like 912.54s - 917.18s | superglue casing to make another one and i put a little washer there and then that red cap 917.18s - 922.78s | became like the spring and i was like okay this will do it you know um anyway the point is like 922.78s - 931.50s | you know use your imagination um but the pro tip is that the the bic lighters they suck you know 931.50s - 936.14s | they're probably great lighters but when you're trying to do that trying to make an electroporator 936.14s - 941.98s | from from the device they suck we they suck so bad that we took a part two and we're like okay 941.98s - 946.62s | can we put this thing you know make it a device and then we're like i don't think so and then we 946.62s - 950.22s | were so genius that we're like you know what we should need to do we need to get another one 950.22s - 955.34s | and fail for the third time and we did we did in that so pro tip bic lighters suck 956.94s - 961.10s | um again you know i've like talked about this like it's the power of the voltage 961.74s - 969.74s | um the piezoelectric effect from the crystal here right and it's uh you'll see this next 969.74s - 976.70s | couple slides of how how firing is it important important i took this uh one of the words from the 976.70s - 981.98s | from the college kids that first did this electropen and they said it's very reliable 982.70s - 986.70s | you know and i'm like okay so there's fair reproducibility which we'll get into 987.26s - 990.86s | um but that's it you're trying to get over around this like 2 000 volts 992.78s - 998.78s | um this is actually a little close whoa extreme close-up 1000.54s - 1004.70s | um okay well here's another and here's another


chunk_text:
i don't think so and then we 946.62s - 950.22s | were so genius that we're like you know what we should need to do we need to get another one 950.22s - 955.34s | and fail for the third time and we did we did in that so pro tip bic lighters suck 956.94s - 961.10s | um again you know i've like talked about this like it's the power of the voltage 961.74s - 969.74s | um the piezoelectric effect from the crystal here right and it's uh you'll see this next 969.74s - 976.70s | couple slides of how how firing is it important important i took this uh one of the words from the 976.70s - 981.98s | from the college kids that first did this electropen and they said it's very reliable 982.70s - 986.70s | you know and i'm like okay so there's fair reproducibility which we'll get into 987.26s - 990.86s | um but that's it you're trying to get over around this like 2 000 volts 992.78s - 998.78s | um this is actually a little close whoa extreme close-up 1000.54s - 1004.70s | um okay well here's another and here's another aspect or an important part 1005.42s - 1011.18s | of of the assembly here which is the cuvette or we were calling it earlier the bio interface 1012.14s - 1018.46s | and it's if you show that fill you'll see that it's aluminum tape wrapped around it some adhesive 1018.46s - 1025.34s | magnets on top of some glass pretty crude pretty awesome and in the center picture here these are 1025.34s - 1032.22s | kind of like some weird configurations i was like hey you know what let's try to adjust the arc gap 1032.22s - 1037.58s | which which you'll see or let's try to develop a well let's see what works the best you know 1037.58s - 1044.38s | they were trying to contain me but in a cage made of necklace um and this is the arc gap which i 1044.38s - 1049.58s | think i'd say at this when you're developing this device or building this device that actually is 1049.58s - 1056.22s | kind of the most important part and it it is size does matter so most of the literature around 1056.22s - 1063.02s | electroporation on like a like a like a


chunk_text:
aspect or an important part 1005.42s - 1011.18s | of of the assembly here which is the cuvette or we were calling it earlier the bio interface 1012.14s - 1018.46s | and it's if you show that fill you'll see that it's aluminum tape wrapped around it some adhesive 1018.46s - 1025.34s | magnets on top of some glass pretty crude pretty awesome and in the center picture here these are 1025.34s - 1032.22s | kind of like some weird configurations i was like hey you know what let's try to adjust the arc gap 1032.22s - 1037.58s | which which you'll see or let's try to develop a well let's see what works the best you know 1037.58s - 1044.38s | they were trying to contain me but in a cage made of necklace um and this is the arc gap which i 1044.38s - 1049.58s | think i'd say at this when you're developing this device or building this device that actually is 1049.58s - 1056.22s | kind of the most important part and it it is size does matter so most of the literature around 1056.22s - 1063.02s | electroporation on like a like a like a no shit commercial device is around the one millimeter 1063.02s - 1070.86s | arc gap um so you see that but we used two really scientific indexes to kind of mess with the gap 1070.86s - 1078.54s | the first one being the post-it note index so if you take the post-it notes at around 10 or 1078.54s - 1084.14s | five and fold them in half it gives you kind of a start but then we went we're like hey you know 1084.14s - 1090.70s | what this is vegas and we need uh another method which is the playing card index so if you start 1090.70s - 1095.34s | with five playing cards gives you that nice gap but if you want to extend it out to two millimeters 1095.34s - 1102.46s | just add an extra playing card before while you're while you're yeah when you're uh as you're 1102.46s - 1107.42s | developing this the the point is you know try it you know mess with it because it is important 1108.14s - 1115.58s | on uh on zapping these cells and what lighter is the best we found that it's the scripto 1115.58s - 1126.91s


chunk_text:
no shit commercial device is around the one millimeter 1063.02s - 1070.86s | arc gap um so you see that but we used two really scientific indexes to kind of mess with the gap 1070.86s - 1078.54s | the first one being the post-it note index so if you take the post-it notes at around 10 or 1078.54s - 1084.14s | five and fold them in half it gives you kind of a start but then we went we're like hey you know 1084.14s - 1090.70s | what this is vegas and we need uh another method which is the playing card index so if you start 1090.70s - 1095.34s | with five playing cards gives you that nice gap but if you want to extend it out to two millimeters 1095.34s - 1102.46s | just add an extra playing card before while you're while you're yeah when you're uh as you're 1102.46s - 1107.42s | developing this the the point is you know try it you know mess with it because it is important 1108.14s - 1115.58s | on uh on zapping these cells and what lighter is the best we found that it's the scripto 1115.58s - 1126.91s | aim and flame it's fire yes follow them on facebook all right now this is where myself and 1126.91s - 1133.15s | phil decided to get a little crazy in terms of testing we wanted to look at what these college 1133.15s - 1136.91s | kids did in their study and then it's like hey let's see if we can kind of reproduce something 1136.91s - 1144.67s | or provide some scientific value to this and um but as it says on the slide i'm not a crystal 1144.67s - 1151.23s | wizard or an electrician so you know but the short of it is we zap this thing with a high voltage 1151.23s - 1157.79s | multimeter and we were getting some reproducibility but it looks like we have uh each fire is two 1157.79s - 1162.59s | seconds in between and then we waited two minutes and if you can see that you know you don't have 1162.59s - 1167.55s | to be a genius to see kind of a pattern here that two clicks is good then it drops off right so it 1167.55s - 1173.87s | kind of decays which has some correlation with what's


chunk_text:
| aim and flame it's fire yes follow them on facebook all right now this is where myself and 1126.91s - 1133.15s | phil decided to get a little crazy in terms of testing we wanted to look at what these college 1133.15s - 1136.91s | kids did in their study and then it's like hey let's see if we can kind of reproduce something 1136.91s - 1144.67s | or provide some scientific value to this and um but as it says on the slide i'm not a crystal 1144.67s - 1151.23s | wizard or an electrician so you know but the short of it is we zap this thing with a high voltage 1151.23s - 1157.79s | multimeter and we were getting some reproducibility but it looks like we have uh each fire is two 1157.79s - 1162.59s | seconds in between and then we waited two minutes and if you can see that you know you don't have 1162.59s - 1167.55s | to be a genius to see kind of a pattern here that two clicks is good then it drops off right so it 1167.55s - 1173.87s | kind of decays which has some correlation with what's on the left hand side even though there 1173.87s - 1180.51s | is a lot of different lighters here and this voltage curve which uh anyway so there's some 1180.51s - 1186.91s | reproducibility is the point moving on here's the was the raw data so you know that uh it's not just 1186.91s - 1193.39s | a terrible color chart and then we have this other setting on the multimeter called resistance 1193.39s - 1199.23s | and again we're not crystal wizards or electricians so we're like hey let's try to hook this thing up 1199.23s - 1204.27s | and see what the resistance looks like meaning that we can provide reproducibility and sure 1204.27s - 1210.03s | enough we did it has this nice nice curve there so because we're trying to answer the question 1210.03s - 1214.83s | is this device does it have some reliability that then you can control the other variables 1214.83s - 1220.51s | to actually get the dna or the rna inside the cell and so we're saying yes all right now we're 1220.51s - 1226.67s | going to play this video real quick because i'm running out of time and this


chunk_text:
on the left hand side even though there 1173.87s - 1180.51s | is a lot of different lighters here and this voltage curve which uh anyway so there's some 1180.51s - 1186.91s | reproducibility is the point moving on here's the was the raw data so you know that uh it's not just 1186.91s - 1193.39s | a terrible color chart and then we have this other setting on the multimeter called resistance 1193.39s - 1199.23s | and again we're not crystal wizards or electricians so we're like hey let's try to hook this thing up 1199.23s - 1204.27s | and see what the resistance looks like meaning that we can provide reproducibility and sure 1204.27s - 1210.03s | enough we did it has this nice nice curve there so because we're trying to answer the question 1210.03s - 1214.83s | is this device does it have some reliability that then you can control the other variables 1214.83s - 1220.51s | to actually get the dna or the rna inside the cell and so we're saying yes all right now we're 1220.51s - 1226.67s | going to play this video real quick because i'm running out of time and this is my office here in 1226.67s - 1235.31s | panama in my biohacker lab anyway here's a device phil shows it it's a click click click 1236.99s - 1239.95s | i'm gonna fast forward here just a little bit 1241.23s - 1244.83s | and then you hook that guy up the cuvette and if you really want to 1246.99s - 1251.15s | well again it's hard to do and there's a lot of trial and error but you can kind of pre-chill 1251.15s - 1256.11s | that cuvette cuvette so then when you're adding your plasmid or your electrocompetent cells 1256.83s - 1260.11s | then it uh you're trying to reduce the amount of cell death that you're 1260.83s - 1269.60s | you know you're the creator of death death of cells um all right so we're gonna yeah okay you 1269.60s - 1274.80s | put that's where you're gonna put the the fluid the stuff the dna the cells and the phosphate 1274.80s - 1281.28s | buffered saline and while i'm going through this i'll oh i have a look i also have a little note 1281.28s - 1288.08s | card because there was things i didn't want to


chunk_text:
is my office here in 1226.67s - 1235.31s | panama in my biohacker lab anyway here's a device phil shows it it's a click click click 1236.99s - 1239.95s | i'm gonna fast forward here just a little bit 1241.23s - 1244.83s | and then you hook that guy up the cuvette and if you really want to 1246.99s - 1251.15s | well again it's hard to do and there's a lot of trial and error but you can kind of pre-chill 1251.15s - 1256.11s | that cuvette cuvette so then when you're adding your plasmid or your electrocompetent cells 1256.83s - 1260.11s | then it uh you're trying to reduce the amount of cell death that you're 1260.83s - 1269.60s | you know you're the creator of death death of cells um all right so we're gonna yeah okay you 1269.60s - 1274.80s | put that's where you're gonna put the the fluid the stuff the dna the cells and the phosphate 1274.80s - 1281.28s | buffered saline and while i'm going through this i'll oh i have a look i also have a little note 1281.28s - 1288.08s | card because there was things i didn't want to miss around this part which is they you know 1288.08s - 1292.88s | there's a recommended 2.5 microliters of dna like that's kind of the max if you do more of that and 1292.88s - 1298.96s | in terms of plasma generation uh it's not very efficient you can use pbs and or sterile water 1298.96s - 1303.68s | but if you have like contaminants then it kind of messes with uh it'll mess with the the 1303.68s - 1310.32s | electroporation uh transformation effect uh you're going to kill a lot of cells so this is on this 1310.32s - 1316.48s | video this is where i'm i'm uh uh providing the inoculum or um the plasmid in through the 1316.48s - 1323.44s | microfluidic well and and then i'm gonna buzz it okay good video over but the take-home point here 1323.44s - 1330.64s | is to make sure that you know that you're going to be killing a lot of cells so um and that's just 1330.64s - 1335.04s | that's just the nature of electroporation i think the literature supports that like between 50 and 1335.04s - 1341.12s | 70 percent of cells are destroyed in


chunk_text:
miss around this part which is they you know 1288.08s - 1292.88s | there's a recommended 2.5 microliters of dna like that's kind of the max if you do more of that and 1292.88s - 1298.96s | in terms of plasma generation uh it's not very efficient you can use pbs and or sterile water 1298.96s - 1303.68s | but if you have like contaminants then it kind of messes with uh it'll mess with the the 1303.68s - 1310.32s | electroporation uh transformation effect uh you're going to kill a lot of cells so this is on this 1310.32s - 1316.48s | video this is where i'm i'm uh uh providing the inoculum or um the plasmid in through the 1316.48s - 1323.44s | microfluidic well and and then i'm gonna buzz it okay good video over but the take-home point here 1323.44s - 1330.64s | is to make sure that you know that you're going to be killing a lot of cells so um and that's just 1330.64s - 1335.04s | that's just the nature of electroporation i think the literature supports that like between 50 and 1335.04s - 1341.12s | 70 percent of cells are destroyed in this process on these with uh electroporator devices 1343.20s - 1349.28s | and but uh but you're going to because these it's kind of a more uncontrolled if you will 1349.28s - 1354.88s | you're going to provide a lot of cell death okay so transformation why what are some things that 1354.88s - 1361.44s | you can test this guy on you can use ecolite electrocompetent ecoli is very so in terms of 1361.44s - 1368.24s | electroporation or transfection it's a easier to do uh we had talked about some yeast and then me 1368.24s - 1375.44s | as of course being a uh stem cell scientist um i was like okay let's hit it up with some stem cells 1375.44s - 1384.96s | now um like let's see the uh the reporter marker if you will um uh it's really good for the green 1384.96s - 1389.44s | fluorescent protein or the super folding green fluorescent protein is because when you incubate 1389.44s - 1395.68s | them then you can see it on the see it on the back end anyway um we're gonna you'll see this 1395.68s - 1401.04s | is electroporator device here on the


chunk_text:
this process on these with uh electroporator devices 1343.20s - 1349.28s | and but uh but you're going to because these it's kind of a more uncontrolled if you will 1349.28s - 1354.88s | you're going to provide a lot of cell death okay so transformation why what are some things that 1354.88s - 1361.44s | you can test this guy on you can use ecolite electrocompetent ecoli is very so in terms of 1361.44s - 1368.24s | electroporation or transfection it's a easier to do uh we had talked about some yeast and then me 1368.24s - 1375.44s | as of course being a uh stem cell scientist um i was like okay let's hit it up with some stem cells 1375.44s - 1384.96s | now um like let's see the uh the reporter marker if you will um uh it's really good for the green 1384.96s - 1389.44s | fluorescent protein or the super folding green fluorescent protein is because when you incubate 1389.44s - 1395.68s | them then you can see it on the see it on the back end anyway um we're gonna you'll see this 1395.68s - 1401.04s | is electroporator device here on the on the slide here and of course nicholas nicholas cage is always 1401.04s - 1407.92s | trying to reinvent himself obviously now we're getting to the last part here is the so this is 1407.92s - 1412.88s | kind of after we're not talking about the tool but we're talking about the the protocol for cloning 1414.16s - 1419.92s | you can see in this nice meme here that when you're you're you've already transformed yourselves 1419.92s - 1424.88s | using this commercial electroporator and then of course this barbecue barbecue lighter that we have 1424.88s - 1429.60s | here then you look at the colonies and you're like okay there's no colonies and then you have no idea 1429.60s - 1433.52s | what went wrong and then you cry and then you repeat it and you adjust and that's the whole 1433.52s - 1438.32s | thing about science you know you just kind of have to adjust the parameters to get it right on and if 1438.32s - 1445.60s | you do so you can cross the holy grail and make your nicholas cage banana hybrid and the cell 1445.60s - 1449.20s | recovery is a really tough thing


chunk_text:
on the slide here and of course nicholas nicholas cage is always 1401.04s - 1407.92s | trying to reinvent himself obviously now we're getting to the last part here is the so this is 1407.92s - 1412.88s | kind of after we're not talking about the tool but we're talking about the the protocol for cloning 1414.16s - 1419.92s | you can see in this nice meme here that when you're you're you've already transformed yourselves 1419.92s - 1424.88s | using this commercial electroporator and then of course this barbecue barbecue lighter that we have 1424.88s - 1429.60s | here then you look at the colonies and you're like okay there's no colonies and then you have no idea 1429.60s - 1433.52s | what went wrong and then you cry and then you repeat it and you adjust and that's the whole 1433.52s - 1438.32s | thing about science you know you just kind of have to adjust the parameters to get it right on and if 1438.32s - 1445.60s | you do so you can cross the holy grail and make your nicholas cage banana hybrid and the cell 1445.60s - 1449.20s | recovery is a really tough thing which i think we're like running out of time on that one but 1449.20s - 1456.16s | here's a short little picture of like uh and this took many iterations but if you see and i'm glad 1456.16s - 1460.64s | i took a good picture of this even though not so good you see there's kind of this wave of these 1460.64s - 1470.00s | tiny little colonies those uh graciously were conducted via the bio volt or the electroporator 1470.00s - 1477.60s | or pen yeah okay troubleshooting now the troubleshooting is of course i have talked about 1477.60s - 1482.32s | there's a lot of cell death you are the destroyer of worlds when it comes to this a lot of cells are 1482.32s - 1487.12s | going to die but all you need is a small portion to grow and then you're like okay mission complete 1487.12s - 1491.76s | the excessive arcing remember the uh some some of the two methods that we said you know use the 1491.76s - 1495.12s | the playing card index it's really great i like i actually like that one a lot 1495.12s - 1501.20s | uh but you


chunk_text:
which i think we're like running out of time on that one but 1449.20s - 1456.16s | here's a short little picture of like uh and this took many iterations but if you see and i'm glad 1456.16s - 1460.64s | i took a good picture of this even though not so good you see there's kind of this wave of these 1460.64s - 1470.00s | tiny little colonies those uh graciously were conducted via the bio volt or the electroporator 1470.00s - 1477.60s | or pen yeah okay troubleshooting now the troubleshooting is of course i have talked about 1477.60s - 1482.32s | there's a lot of cell death you are the destroyer of worlds when it comes to this a lot of cells are 1482.32s - 1487.12s | going to die but all you need is a small portion to grow and then you're like okay mission complete 1487.12s - 1491.76s | the excessive arcing remember the uh some some of the two methods that we said you know use the 1491.76s - 1495.12s | the playing card index it's really great i like i actually like that one a lot 1495.12s - 1501.20s | uh but you can adjust the arc and then but you should keep in mind that despite whatever prior 1501.20s - 1508.16s | studies or even around electroporators that it is it has low efficiency meaning like it doesn't 1508.16s - 1515.39s | work all the fucking time so you just got to know that going into it um if you want the protocol you 1515.39s - 1520.27s | can choose your adventure here um one of these will lead you to an access point where we could 1520.27s - 1532.35s | provide a protocol to have one build and whatever else but it uh so have a look see and then where's 1532.35s - 1540.27s | my goon or what am i good on time still yeah okay good yeah okay cool um all right and now 1540.27s - 1555.01s | we move to the uh the key of cage and we will pause here oh uno minuto yeah okay we're at one minute 1555.73s - 1562.53s | and uh so if uh anybody have a guess how many how many memes we got nickels cage memes 1566.21s - 1577.33s | send it go ahead 12 that's 1 2 12 yeah no


chunk_text:
can adjust the arc and then but you should keep in mind that despite whatever prior 1501.20s - 1508.16s | studies or even around electroporators that it is it has low efficiency meaning like it doesn't 1508.16s - 1515.39s | work all the fucking time so you just got to know that going into it um if you want the protocol you 1515.39s - 1520.27s | can choose your adventure here um one of these will lead you to an access point where we could 1520.27s - 1532.35s | provide a protocol to have one build and whatever else but it uh so have a look see and then where's 1532.35s - 1540.27s | my goon or what am i good on time still yeah okay good yeah okay cool um all right and now 1540.27s - 1555.01s | we move to the uh the key of cage and we will pause here oh uno minuto yeah okay we're at one minute 1555.73s - 1562.53s | and uh so if uh anybody have a guess how many how many memes we got nickels cage memes 1566.21s - 1577.33s | send it go ahead 12 that's 1 2 12 yeah no there there there is a there is there's more than that 1578.21s - 1583.89s | there is ah you got it he's the guy right there if you put 20 here he's kind of like a ruse 1583.89s - 1587.17s | and then there was that extra one which you must have been scanning qr codes 1587.17s - 1595.65s | ah oh oh congratulations congratulations okay well yeah we have something for you 1595.65s - 1602.05s | uh okay well that is our talk um it was it was brief but remember this is tool one of a 1602.05s - 1607.41s | electroporating journey i hope people try it you know the biohacking community if you uh have an 1607.41s - 1614.21s | inclination for science then you know please reach out to one of us and and uh again we fly under the 1614.21s - 1620.37s | flag of viva securis which is actually a medical device pen testing company um and then this right 1620.37s - 1625.33s | this last is you know remember please don't do coke in the bathroom it uh this is a real sign 1625.33s - 1629.97s | somewhere in the world for all


chunk_text:
there there there is a there is there's more than that 1578.21s - 1583.89s | there is ah you got it he's the guy right there if you put 20 here he's kind of like a ruse 1583.89s - 1587.17s | and then there was that extra one which you must have been scanning qr codes 1587.17s - 1595.65s | ah oh oh congratulations congratulations okay well yeah we have something for you 1595.65s - 1602.05s | uh okay well that is our talk um it was it was brief but remember this is tool one of a 1602.05s - 1607.41s | electroporating journey i hope people try it you know the biohacking community if you uh have an 1607.41s - 1614.21s | inclination for science then you know please reach out to one of us and and uh again we fly under the 1614.21s - 1620.37s | flag of viva securis which is actually a medical device pen testing company um and then this right 1620.37s - 1625.33s | this last is you know remember please don't do coke in the bathroom it uh this is a real sign 1625.33s - 1629.97s | somewhere in the world for all you osin folks you can go find it thank you


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=slpJQmm3L8k", "title": "DEF CON 32 - The Past, Present, and Future of Bioweapons - Panel", "description": "Biological warfare is a phenomenon that spans human history, tracing its roots to ancient times rather than being a recent invention. To gain insights into bioweapons' current and future landscape, it is imperative to delve into historical examples of conventional biological warfare and understand how methods were devised and implemented.\n\nHowever, amidst the exploration of historical precedents, it becomes evident that our optimism for the future hinges significantly on our ability to foster transparency and creativity within the global community. This optimism is intertwined with our comprehension of technological advancements, the rapid pace of innovation, the interconnectedness of various domains, and the imperative task of constructing practical defenses against emerging threats. It is crucial to acknowledge that despite the sophistication of technology, its efficacy remains intricately linked to human ingenuity. As a poignant reminder, our vulnerability lies in technological shortcomings and our collective failure of imagination. Creativity, a distinctly human attribute, stands as the cornerstone in the perpetual endeavor to safeguard against unforeseen adversities.\n\nFurthermore, the discourse extends to establishing social norms and mores that are pivotal in shaping attitudes toward biological warfare. Addressing the proliferation of disinformation and its potential to fuel the proliferation and utilization of bioweapons becomes imperative. This discussion encompasses an exploration of prospective research endeavors and emerging initiatives leveraging artificial intelligence (AI) in the realm of bioweaponry. Notably, the utility of Generative AI in affecting societal shifts toward the normalization of bioweapon deployment warrants scrutiny. Additionally, the current societal landscape, particularly the desensitization of internet denizens to overt hostile actions, poses profound implications for the future trajectory of biological warfare.\n\nIn essence, a comprehensive understanding of historical precedents, coupled with a proactive approach towards fostering transparency, creativity, and the cultivation of robust societal norms, is indispensable in navigating the complexities of bioweapon proliferation. As we confront the intricate interplay between technological advancements and human agency, it is imperative to remain vigilant and resolute in our pursuit of a future safeguarded against the malevolent exploitation of biological agents.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1983, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.00s | This text was transcribed using whisper model: large-v2 I would like to welcome you all to our talk, a discussion of past, present, and possible future 6.00s - 15.01s | of bioweapons. I am Dr. Xavier Lewis-Palmer. I'm


chunk_text:
the proliferation of disinformation and its potential to fuel the proliferation and utilization of bioweapons becomes imperative. This discussion encompasses an exploration of prospective research endeavors and emerging initiatives leveraging artificial intelligence (AI) in the realm of bioweaponry. Notably, the utility of Generative AI in affecting societal shifts toward the normalization of bioweapon deployment warrants scrutiny. Additionally, the current societal landscape, particularly the desensitization of internet denizens to overt hostile actions, poses profound implications for the future trajectory of biological warfare.\n\nIn essence, a comprehensive understanding of historical precedents, coupled with a proactive approach towards fostering transparency, creativity, and the cultivation of robust societal norms, is indispensable in navigating the complexities of bioweapon proliferation. As we confront the intricate interplay between technological advancements and human agency, it is imperative to remain vigilant and resolute in our pursuit of a future safeguarded against the malevolent exploitation of biological agents.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1983, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.00s | This text was transcribed using whisper model: large-v2 I would like to welcome you all to our talk, a discussion of past, present, and possible future 6.00s - 15.01s | of bioweapons. I am Dr. Xavier Lewis-Palmer. I'm Miao Liu, Miao Miao. Hey guys, I'm Luke Potter. 15.89s - 23.09s | Right on. So as a disclaimer, the perspectives and opinions shared in this talk do not reflect 23.09s - 28.45s | our workplaces. Further, this talk is designed to be a high-level, innocuous, and accessible talk. 29.09s - 33.25s | There is an extended open-end Q&A session to make this more fun and interactive, 33.25s - 38.85s | so we'll be brief with topics discussed at first. However, this portion will only be great if people 38.85s - 44.85s | get cool about a lot of things very quickly. That said, we'll discuss some past, followed 44.85s - 52.77s | by the future, as well as the present issues with bioweapons and just staying ahead of a lot 52.77s - 61.49s | of the hype around them. And this will lead into our Q&A session. Take it away, Miao. 64.61s - 70.77s | Hello, Las Vegas DEF CON. My name is Miao. I'm a biohacker from Australia, and I'm going to be 70.77s - 76.69s | talking to you about the past of bioweapons. So I want you to take your mind back and imagine 76.69s -


chunk_text:
Miao Liu, Miao Miao. Hey guys, I'm Luke Potter. 15.89s - 23.09s | Right on. So as a disclaimer, the perspectives and opinions shared in this talk do not reflect 23.09s - 28.45s | our workplaces. Further, this talk is designed to be a high-level, innocuous, and accessible talk. 29.09s - 33.25s | There is an extended open-end Q&A session to make this more fun and interactive, 33.25s - 38.85s | so we'll be brief with topics discussed at first. However, this portion will only be great if people 38.85s - 44.85s | get cool about a lot of things very quickly. That said, we'll discuss some past, followed 44.85s - 52.77s | by the future, as well as the present issues with bioweapons and just staying ahead of a lot 52.77s - 61.49s | of the hype around them. And this will lead into our Q&A session. Take it away, Miao. 64.61s - 70.77s | Hello, Las Vegas DEF CON. My name is Miao. I'm a biohacker from Australia, and I'm going to be 70.77s - 76.69s | talking to you about the past of bioweapons. So I want you to take your mind back and imagine 76.69s - 84.13s | the year is 1348. A crisp spring breeze carries the smell of grass and salt water. 85.01s - 90.53s | You're a blacksmith that exports your wares via the port on one side of the city. 92.13s - 95.97s | The other side of your city is heavily fortified by two stone walls. 97.49s - 104.37s | Your city, Kaffa, has just entered its third year of the siege caused by the Golden Horde, 104.37s - 110.21s | the descendants of Genghis Khan. Every morning you wake up to the familiar sounds of the clicks 110.21s - 117.33s | and thwacks of the trebuchets launching rocks at your town. Today, though, something's different. 117.33s - 122.13s | Instead of the reply being heralded by the sound of stone on stone, 123.09s - 131.95s | something different has happened. You look up to the sky for answers, only to find more questions. 132.91s - 140.75s | Is it a bird? Is it a plane? No, it's a plague-infested corpse being thrown over the walls. 143.34s - 149.10s | As the putrid bodies start exploding left and right, you and your fellow townspeople carry 149.10s - 158.94s | the corpses


chunk_text:
84.13s | the year is 1348. A crisp spring breeze carries the smell of grass and salt water. 85.01s - 90.53s | You're a blacksmith that exports your wares via the port on one side of the city. 92.13s - 95.97s | The other side of your city is heavily fortified by two stone walls. 97.49s - 104.37s | Your city, Kaffa, has just entered its third year of the siege caused by the Golden Horde, 104.37s - 110.21s | the descendants of Genghis Khan. Every morning you wake up to the familiar sounds of the clicks 110.21s - 117.33s | and thwacks of the trebuchets launching rocks at your town. Today, though, something's different. 117.33s - 122.13s | Instead of the reply being heralded by the sound of stone on stone, 123.09s - 131.95s | something different has happened. You look up to the sky for answers, only to find more questions. 132.91s - 140.75s | Is it a bird? Is it a plane? No, it's a plague-infested corpse being thrown over the walls. 143.34s - 149.10s | As the putrid bodies start exploding left and right, you and your fellow townspeople carry 149.10s - 158.94s | the corpses into the sea on the far side of Kaffa. Your hands have cuts in them, and unbeknownst to 159.10s - 165.50s | you, the blood of those cadavers is actually infecting you with the disease. As you begin to 165.50s - 173.10s | flee via boats to go to the rest of Europe, you're unaware that you're about to spread the deadliest 173.10s - 182.93s | bioweapon attack in the history of the human race. This attack caused the Black Plague to enter 182.93s - 190.05s | Europe, and it resulted in the deaths of about 25 million Europeans, which was about somewhere 190.05s - 199.12s | between a quarter and a third of all Europeans at that time. So were the Golden Horde that 199.12s - 206.72s | launched this attack the original biohackers? I think they were. They were using technology 206.72s - 241.07s | offensively by using a trebuchet to launch bodies. What's that? Okay. 245.07s - 249.39s | So they used the technology offensively. This is the first time... Okay, so before this, 250.27s - 255.95s | there had been kind of bioweapons attacks, like people have sent plague victims into towns 255.95s - 262.91s |


chunk_text:
into the sea on the far side of Kaffa. Your hands have cuts in them, and unbeknownst to 159.10s - 165.50s | you, the blood of those cadavers is actually infecting you with the disease. As you begin to 165.50s - 173.10s | flee via boats to go to the rest of Europe, you're unaware that you're about to spread the deadliest 173.10s - 182.93s | bioweapon attack in the history of the human race. This attack caused the Black Plague to enter 182.93s - 190.05s | Europe, and it resulted in the deaths of about 25 million Europeans, which was about somewhere 190.05s - 199.12s | between a quarter and a third of all Europeans at that time. So were the Golden Horde that 199.12s - 206.72s | launched this attack the original biohackers? I think they were. They were using technology 206.72s - 241.07s | offensively by using a trebuchet to launch bodies. What's that? Okay. 245.07s - 249.39s | So they used the technology offensively. This is the first time... Okay, so before this, 250.27s - 255.95s | there had been kind of bioweapons attacks, like people have sent plague victims into towns 255.95s - 262.91s | or chucked an infested body into a well, but this was the first time someone had used technology 264.27s - 271.07s | to attack people with a biological agent, and the results were absolutely devastating. 271.95s - 278.11s | To think of asymmetric warfare, one body thrown over a wall effectively killed 25 million people, 278.11s - 284.91s | so it's very powerful. Now, for the next, like, four to six hundred years, 284.91s - 290.43s | there were some variations on this. People were, like, chucking, they knew it was effective to do 290.43s - 296.27s | this, throwing all sorts of bodies and cows over walls, letting rabid animals into towns and things, 296.27s - 302.51s | but it wasn't very directed. And I guess, like, this begs the question of what exactly is a 302.51s - 314.53s | bioweapon? So is this a bioweapon? Kind of? Maybe? Some people nodding heads. So by the strictest 314.53s - 322.37s | definition, I would say no. It's very cute, but would it need to have fleas on it, maybe? Would 322.37s - 331.97s | that make it a bioweapon? Almost. If it has a pathogenic bacteria on some fleas


chunk_text:
or chucked an infested body into a well, but this was the first time someone had used technology 264.27s - 271.07s | to attack people with a biological agent, and the results were absolutely devastating. 271.95s - 278.11s | To think of asymmetric warfare, one body thrown over a wall effectively killed 25 million people, 278.11s - 284.91s | so it's very powerful. Now, for the next, like, four to six hundred years, 284.91s - 290.43s | there were some variations on this. People were, like, chucking, they knew it was effective to do 290.43s - 296.27s | this, throwing all sorts of bodies and cows over walls, letting rabid animals into towns and things, 296.27s - 302.51s | but it wasn't very directed. And I guess, like, this begs the question of what exactly is a 302.51s - 314.53s | bioweapon? So is this a bioweapon? Kind of? Maybe? Some people nodding heads. So by the strictest 314.53s - 322.37s | definition, I would say no. It's very cute, but would it need to have fleas on it, maybe? Would 322.37s - 331.97s | that make it a bioweapon? Almost. If it has a pathogenic bacteria on some fleas on a rodent, 331.97s - 339.25s | that would be a bioweapon. So the definition of a bioweapon is a virus, a bacteria, 340.21s - 347.09s | or a toxic compound produced by one, used as a weapon. So for viruses, it might be something like 347.09s - 355.09s | Ebola, a bacteria might be the plague, and a toxic compound might be anthrax, the spores of 355.09s - 359.73s | Bacillus anthracis. So, and it has to be used, obviously, as a weapon, so it has to be delivered. 359.73s - 362.93s | If it just exists in nature, we wouldn't necessarily say it's a bioweapon. 363.89s - 368.69s | Some people might say it is, but they'll be wrong. And the thing that makes it a bioweapon is 368.69s - 375.57s | generally we use it to affect and do something, like kill something. So these are all popular 375.57s - 382.93s | ways that people have used to transmit bioweapons. So the gun that fires it or whichever, it could be 382.93s - 387.09s | as simple as a blanket, as we saw with smallpox, which was deliberately used against Native 387.09s - 394.85s | Americans. It


chunk_text:
on a rodent, 331.97s - 339.25s | that would be a bioweapon. So the definition of a bioweapon is a virus, a bacteria, 340.21s - 347.09s | or a toxic compound produced by one, used as a weapon. So for viruses, it might be something like 347.09s - 355.09s | Ebola, a bacteria might be the plague, and a toxic compound might be anthrax, the spores of 355.09s - 359.73s | Bacillus anthracis. So, and it has to be used, obviously, as a weapon, so it has to be delivered. 359.73s - 362.93s | If it just exists in nature, we wouldn't necessarily say it's a bioweapon. 363.89s - 368.69s | Some people might say it is, but they'll be wrong. And the thing that makes it a bioweapon is 368.69s - 375.57s | generally we use it to affect and do something, like kill something. So these are all popular 375.57s - 382.93s | ways that people have used to transmit bioweapons. So the gun that fires it or whichever, it could be 382.93s - 387.09s | as simple as a blanket, as we saw with smallpox, which was deliberately used against Native 387.09s - 394.85s | Americans. It could be an arrow. Polish people in the 17th century dipped the arrows in the 394.85s - 401.41s | blood and saliva of rabid dogs before firing them at enemies. A train carriage can be used to 401.41s - 407.17s | contain people, so we saw in Japan, those ricin attacks. Agricultural bioweapons, which hopefully 407.17s - 412.29s | the audience will ask us a bit about, is like a really, really common one. And of course, smallpox 412.29s - 417.33s | attacks in the wake of September 11th, sorry, anthrax attacks that were used on September 11th, 417.33s - 425.01s | which used envelopes. So in some ways, the USPS was part of the vector. I'm very careful every 425.01s - 430.45s | time I click the slide now. No one's shouting at me, that's all right. Okay, so that was, it was 430.45s - 437.41s | basically, bioweapons were this big nebulous thing where no one really knew what was causing them. So 437.41s - 445.89s | when the Golden Horde launched dead bodies into Kaffir, they thought that the bodies were 445.89s - 451.17s | cursed, and that they were throwing the curse of God in, and


chunk_text:
could be an arrow. Polish people in the 17th century dipped the arrows in the 394.85s - 401.41s | blood and saliva of rabid dogs before firing them at enemies. A train carriage can be used to 401.41s - 407.17s | contain people, so we saw in Japan, those ricin attacks. Agricultural bioweapons, which hopefully 407.17s - 412.29s | the audience will ask us a bit about, is like a really, really common one. And of course, smallpox 412.29s - 417.33s | attacks in the wake of September 11th, sorry, anthrax attacks that were used on September 11th, 417.33s - 425.01s | which used envelopes. So in some ways, the USPS was part of the vector. I'm very careful every 425.01s - 430.45s | time I click the slide now. No one's shouting at me, that's all right. Okay, so that was, it was 430.45s - 437.41s | basically, bioweapons were this big nebulous thing where no one really knew what was causing them. So 437.41s - 445.89s | when the Golden Horde launched dead bodies into Kaffir, they thought that the bodies were 445.89s - 451.17s | cursed, and that they were throwing the curse of God in, and that's what caused it. We know now 451.17s - 456.61s | that that wasn't the case. This guy, Louis Pasteur, he came up with the germ theory of disease, 456.61s - 462.05s | and this changed biological warfare. Because when we worked out what was actually causing this, 462.77s - 468.05s | bioweapons changed from being a really common tool in warfare, to being something that was kind of 468.05s - 477.65s | used by state agents and governments as a secret form of warfare. So we saw this a lot in World 477.65s - 484.29s | War One. Basically, different governments were using this to affect mainly agriculture and horses. 484.29s - 487.97s | So horses were used a lot in World War One. They were using them to make the horses lame so that 487.97s - 494.69s | they couldn't be as effective in warfare, using them to destroy, give the cows diseases so that 494.69s - 502.69s | the army couldn't be as strong. And the net effect of this was that a lot of people got sick, and 502.69s - 508.29s | everyone kind of agreed it was a bad idea. But the big change was


chunk_text:
that's what caused it. We know now 451.17s - 456.61s | that that wasn't the case. This guy, Louis Pasteur, he came up with the germ theory of disease, 456.61s - 462.05s | and this changed biological warfare. Because when we worked out what was actually causing this, 462.77s - 468.05s | bioweapons changed from being a really common tool in warfare, to being something that was kind of 468.05s - 477.65s | used by state agents and governments as a secret form of warfare. So we saw this a lot in World 477.65s - 484.29s | War One. Basically, different governments were using this to affect mainly agriculture and horses. 484.29s - 487.97s | So horses were used a lot in World War One. They were using them to make the horses lame so that 487.97s - 494.69s | they couldn't be as effective in warfare, using them to destroy, give the cows diseases so that 494.69s - 502.69s | the army couldn't be as strong. And the net effect of this was that a lot of people got sick, and 502.69s - 508.29s | everyone kind of agreed it was a bad idea. But the big change was that bioweapons became 509.57s - 513.33s | something that was invisible, and people would deny using them. 514.29s - 518.45s | Kind of completely in opposition to throwing a body over a wall. Instead, they would infect some 518.45s - 522.53s | cows and then sell them to a farmer, and that would eventually cause problems in the neighbouring 522.53s - 529.57s | country. I won't go heaps into it, because from a biohack perspective, it's not really that relevant. 529.57s - 534.29s | It's just kind of good to know about. There's diseases we don't really hear about anymore, 534.29s - 538.37s | but basically, they led to the Geneva Convention. Now, the Geneva Convention is important. 539.25s - 545.65s | It outlawed the use of biological weapons in warfare. It didn't outlaw their research, 545.65s - 553.01s | development and stockpiling. And that led to World War Two, when we saw Japan, Unit 731, 553.57s - 559.89s | poisoned tens of thousands of people by poisoning thousands of wells with plague. We saw 561.97s - 565.17s | Winston Churchill was a big fan of using them. He dropped anthrax on a whole bunch of 565.81s - 569.97s |


chunk_text:
that bioweapons became 509.57s - 513.33s | something that was invisible, and people would deny using them. 514.29s - 518.45s | Kind of completely in opposition to throwing a body over a wall. Instead, they would infect some 518.45s - 522.53s | cows and then sell them to a farmer, and that would eventually cause problems in the neighbouring 522.53s - 529.57s | country. I won't go heaps into it, because from a biohack perspective, it's not really that relevant. 529.57s - 534.29s | It's just kind of good to know about. There's diseases we don't really hear about anymore, 534.29s - 538.37s | but basically, they led to the Geneva Convention. Now, the Geneva Convention is important. 539.25s - 545.65s | It outlawed the use of biological weapons in warfare. It didn't outlaw their research, 545.65s - 553.01s | development and stockpiling. And that led to World War Two, when we saw Japan, Unit 731, 553.57s - 559.89s | poisoned tens of thousands of people by poisoning thousands of wells with plague. We saw 561.97s - 565.17s | Winston Churchill was a big fan of using them. He dropped anthrax on a whole bunch of 565.81s - 569.97s | places. And the Nazis weren't really a fan of them. They preferred chemical weapons. 569.97s - 578.05s | But this led to the Bioweapons Convention, which was in the mid-70s. Now, this basically said, 578.05s - 582.61s | okay, well, we're not going to allow you to stockpile them anymore, or research them for 582.61s - 590.45s | future use. The only problem is, it's a voluntary convention that you sign up to. It's not enforceable 591.25s - 597.73s | nor auditable. This is still what we're regulated under. So every country signs up to it, and those 597.73s - 602.93s | countries continue to make biological weapons. Basically, any country that has the capacity to 602.93s - 606.37s | make biological weapons at some point has, which is terrifying. 608.53s - 615.25s | During the Cold War, we saw what this could look like. So the Soviets were stockpiling plague. 615.25s - 619.97s | They may have been stockpiling smallpox. Some of these stockpiles have not been recovered to this 619.97s - 629.49s | day. They exist in countries with dubious attitudes towards this. Countries like Turkmenistan, 629.49s - 634.29s | that don't really have democracy or anything like


chunk_text:
places. And the Nazis weren't really a fan of them. They preferred chemical weapons. 569.97s - 578.05s | But this led to the Bioweapons Convention, which was in the mid-70s. Now, this basically said, 578.05s - 582.61s | okay, well, we're not going to allow you to stockpile them anymore, or research them for 582.61s - 590.45s | future use. The only problem is, it's a voluntary convention that you sign up to. It's not enforceable 591.25s - 597.73s | nor auditable. This is still what we're regulated under. So every country signs up to it, and those 597.73s - 602.93s | countries continue to make biological weapons. Basically, any country that has the capacity to 602.93s - 606.37s | make biological weapons at some point has, which is terrifying. 608.53s - 615.25s | During the Cold War, we saw what this could look like. So the Soviets were stockpiling plague. 615.25s - 619.97s | They may have been stockpiling smallpox. Some of these stockpiles have not been recovered to this 619.97s - 629.49s | day. They exist in countries with dubious attitudes towards this. Countries like Turkmenistan, 629.49s - 634.29s | that don't really have democracy or anything like that. We don't know where they are. We know that 634.29s - 638.77s | these places have had leaks. They've killed dozens of people when these leaks have happened. 638.77s - 643.81s | And it's all been shut down now. But we weren't aware about how large a scale this was happening 644.53s - 648.53s | until the fall of the Soviet Union. So we don't actually know what's happening right now. 649.97s - 655.65s | At a state level, but at an individual level, it's definitely within our means to do it. 656.69s - 659.65s | That's the end of my part of the presentation. I'm going to pass it across to Xavier now. 667.15s - 673.12s | Thank you, Miao. So I need not bore you with the present. So I'll dive into what's important 673.12s - 680.48s | for making better sense of hype surrounding bioweapons and just biotechnology in general. 682.35s - 685.95s | I'm sure many of you are inundated with poor quality information on matters of biology and 685.95s - 691.47s | biotechnology from multiple angles and levels of power. What we all need are resilience and 691.47s - 697.55s | accessible spaces for


chunk_text:
that. We don't know where they are. We know that 634.29s - 638.77s | these places have had leaks. They've killed dozens of people when these leaks have happened. 638.77s - 643.81s | And it's all been shut down now. But we weren't aware about how large a scale this was happening 644.53s - 648.53s | until the fall of the Soviet Union. So we don't actually know what's happening right now. 649.97s - 655.65s | At a state level, but at an individual level, it's definitely within our means to do it. 656.69s - 659.65s | That's the end of my part of the presentation. I'm going to pass it across to Xavier now. 667.15s - 673.12s | Thank you, Miao. So I need not bore you with the present. So I'll dive into what's important 673.12s - 680.48s | for making better sense of hype surrounding bioweapons and just biotechnology in general. 682.35s - 685.95s | I'm sure many of you are inundated with poor quality information on matters of biology and 685.95s - 691.47s | biotechnology from multiple angles and levels of power. What we all need are resilience and 691.47s - 697.55s | accessible spaces for them. I want you to think of your local bio maker and hacker spaces. And I also 697.55s - 703.23s | encourage everyone getting a library card and using interlibrary loan to get research and to 703.23s - 709.55s | learn. It's important that everyone gets used to also not exploiting or thinking about biology. 711.47s - 715.15s | Just as with how many of you in this audience have not done that for other aspects, 716.03s - 723.65s | of technology in your life, it has long been since time for that in bio. So to stay ahead 723.65s - 730.53s | of the hype, to stay ahead of misinformation campaigns and disinformation campaigns, 731.65s - 737.65s | the responsibility is on everyone to develop comfortable and relative degrees of theoretical 737.65s - 742.69s | and practical literacy. What this eventually translates to is everyone learning terminology 742.69s - 750.37s | discussed, learning to parse and write literature, to understand institutional structures, to 750.37s - 755.49s | understand institutional responsibilities, institutional processes, institutional points 755.49s - 762.13s | of failure, and to better understand the nature of propaganda so they can see hints of it in all 762.13s -


chunk_text:
them. I want you to think of your local bio maker and hacker spaces. And I also 697.55s - 703.23s | encourage everyone getting a library card and using interlibrary loan to get research and to 703.23s - 709.55s | learn. It's important that everyone gets used to also not exploiting or thinking about biology. 711.47s - 715.15s | Just as with how many of you in this audience have not done that for other aspects, 716.03s - 723.65s | of technology in your life, it has long been since time for that in bio. So to stay ahead 723.65s - 730.53s | of the hype, to stay ahead of misinformation campaigns and disinformation campaigns, 731.65s - 737.65s | the responsibility is on everyone to develop comfortable and relative degrees of theoretical 737.65s - 742.69s | and practical literacy. What this eventually translates to is everyone learning terminology 742.69s - 750.37s | discussed, learning to parse and write literature, to understand institutional structures, to 750.37s - 755.49s | understand institutional responsibilities, institutional processes, institutional points 755.49s - 762.13s | of failure, and to better understand the nature of propaganda so they can see hints of it in all 762.13s - 769.41s | media that you consume. No one is immune to bypassing it or getting influenced by it. 771.44s - 775.44s | But also we need to make sure that we're also learning about systems of ethics and learning 775.44s - 783.92s | how they change. In short, don't stop learning. You may make mistakes from time to time, but that's 783.92s - 791.12s | okay. And it's part of the process. What's more dangerous if you decide to persist with a static 791.12s - 797.52s | understanding of the world and are not able to adapt to changes that occur and to new discoveries 797.52s - 803.52s | that emerge? It limits your ability to use new technology and to be abreast of 804.56s - 818.94s | new events that occur. But yes, I will hand this off to Lucas. Hey guys, can you hear me? 819.74s - 823.82s | Great. So I want to thank Xavier because I want to start my section's talk with the Oprah joke, 823.82s - 827.10s | hey, check under your chairs. And he said I couldn't do that even though it would have been 827.10s - 835.18s | hilarious. So I'm here


chunk_text:
769.41s | media that you consume. No one is immune to bypassing it or getting influenced by it. 771.44s - 775.44s | But also we need to make sure that we're also learning about systems of ethics and learning 775.44s - 783.92s | how they change. In short, don't stop learning. You may make mistakes from time to time, but that's 783.92s - 791.12s | okay. And it's part of the process. What's more dangerous if you decide to persist with a static 791.12s - 797.52s | understanding of the world and are not able to adapt to changes that occur and to new discoveries 797.52s - 803.52s | that emerge? It limits your ability to use new technology and to be abreast of 804.56s - 818.94s | new events that occur. But yes, I will hand this off to Lucas. Hey guys, can you hear me? 819.74s - 823.82s | Great. So I want to thank Xavier because I want to start my section's talk with the Oprah joke, 823.82s - 827.10s | hey, check under your chairs. And he said I couldn't do that even though it would have been 827.10s - 835.18s | hilarious. So I'm here to talk about the future of bioweapons. So hopefully no one here goes on 835.18s - 838.86s | vacation thinking to yourself, oh man, I can't wait to get Lyme disease. I'm wondering if this 838.86s - 844.06s | place has tularemia. Maybe it has bubonic plague. That'd be awesome. If you do, please don't talk 844.06s - 848.46s | to me after this. We're going to talk about the future. So we've been through the past, 848.46s - 852.46s | we've been to the present, and I'm hoping we can all agree bioweapons don't sound great. 852.46s - 856.94s | I don't want giant baseball-sized lumps on my neck. I would rather not have smallpox. 857.58s - 865.07s | Hopefully you guys think that too. So here is the expected outline you probably wanted to hear 865.07s - 869.71s | for today. Introduction of future bioweapons, the synthetic biology, basically how to create them, 869.71s - 874.11s | talking in detail about CRISPR-Cas9, talons, ZFNs, and new genomic techniques. 874.83s - 880.03s | We're not going to do that talk because I like not being in jail and I'd like to keep it that way. 880.03s - 882.19s |


chunk_text:
to talk about the future of bioweapons. So hopefully no one here goes on 835.18s - 838.86s | vacation thinking to yourself, oh man, I can't wait to get Lyme disease. I'm wondering if this 838.86s - 844.06s | place has tularemia. Maybe it has bubonic plague. That'd be awesome. If you do, please don't talk 844.06s - 848.46s | to me after this. We're going to talk about the future. So we've been through the past, 848.46s - 852.46s | we've been to the present, and I'm hoping we can all agree bioweapons don't sound great. 852.46s - 856.94s | I don't want giant baseball-sized lumps on my neck. I would rather not have smallpox. 857.58s - 865.07s | Hopefully you guys think that too. So here is the expected outline you probably wanted to hear 865.07s - 869.71s | for today. Introduction of future bioweapons, the synthetic biology, basically how to create them, 869.71s - 874.11s | talking in detail about CRISPR-Cas9, talons, ZFNs, and new genomic techniques. 874.83s - 880.03s | We're not going to do that talk because I like not being in jail and I'd like to keep it that way. 880.03s - 882.19s | So we'll talk about them a little bit, but then move on to more 884.19s - 891.79s | basically practical issues or concerns. So here's the genomic editing technologies. We have 892.43s - 897.07s | CRISPR-Cas9 up there. That's the really common one. That's the one the ODIN used to sell kits 897.07s - 902.59s | for. It's very good at deleting genes, but not very good at putting in new genes, which makes 902.59s - 908.51s | sense. Usually the introductory exercise in synthetic biology is making E. coli grow in the 908.51s - 912.91s | dark. And of course, E. coli is a disease. You can modify any disease however you want with 912.91s - 919.47s | CRISPR-Cas9, theoretically. It just has some issues with changing it that we don't have time 919.47s - 924.19s | to get into. And again, rather not go to jail for, so we'll leave it there. We have transcription 924.19s - 929.63s | activated, activated-like effector genomic editing. Your talk beforehand was electroporation, 929.63s - 933.63s | all methods of getting DNA inside the cell and getting that cell to express different strands 933.63s - 938.59s | of DNA. We also have


chunk_text:
So we'll talk about them a little bit, but then move on to more 884.19s - 891.79s | basically practical issues or concerns. So here's the genomic editing technologies. We have 892.43s - 897.07s | CRISPR-Cas9 up there. That's the really common one. That's the one the ODIN used to sell kits 897.07s - 902.59s | for. It's very good at deleting genes, but not very good at putting in new genes, which makes 902.59s - 908.51s | sense. Usually the introductory exercise in synthetic biology is making E. coli grow in the 908.51s - 912.91s | dark. And of course, E. coli is a disease. You can modify any disease however you want with 912.91s - 919.47s | CRISPR-Cas9, theoretically. It just has some issues with changing it that we don't have time 919.47s - 924.19s | to get into. And again, rather not go to jail for, so we'll leave it there. We have transcription 924.19s - 929.63s | activated, activated-like effector genomic editing. Your talk beforehand was electroporation, 929.63s - 933.63s | all methods of getting DNA inside the cell and getting that cell to express different strands 933.63s - 938.59s | of DNA. We also have ZFNs, and that's basically what you guys probably thought we were going to 938.59s - 942.51s | talk about. I'm not sure you guys have the biological background to do it, but that's how 942.51s - 948.43s | you would change a bacteria or a virus or, well, not quite a prion, usual biological agent into 948.43s - 952.59s | being effective. Now, what we're going to talk about instead is something you probably are sick 952.59s - 958.83s | of hearing about. Who's heard of LLMs? Yeah, hopefully everyone. That's been the big talk 958.83s - 965.15s | for a while now. And here's an issue I think you guys want to hear about. So the WMDP Benchmark, 965.15s - 970.35s | Measuring and Reducing Malicious Use with Unlearning, is a paper about what ChatGPT knows 970.35s - 975.47s | about chemical, biological, and cyber threats. If you ask it politely enough, ChatGPT will tell you 975.47s - 980.75s | how to make a bioweapon. It's got to learn how to ask it. I'm not sure who would open AI and let 980.75s - 988.35s | ChatGPT read the anarchist cookbook, but maybe he's not doing great at his


chunk_text:
ZFNs, and that's basically what you guys probably thought we were going to 938.59s - 942.51s | talk about. I'm not sure you guys have the biological background to do it, but that's how 942.51s - 948.43s | you would change a bacteria or a virus or, well, not quite a prion, usual biological agent into 948.43s - 952.59s | being effective. Now, what we're going to talk about instead is something you probably are sick 952.59s - 958.83s | of hearing about. Who's heard of LLMs? Yeah, hopefully everyone. That's been the big talk 958.83s - 965.15s | for a while now. And here's an issue I think you guys want to hear about. So the WMDP Benchmark, 965.15s - 970.35s | Measuring and Reducing Malicious Use with Unlearning, is a paper about what ChatGPT knows 970.35s - 975.47s | about chemical, biological, and cyber threats. If you ask it politely enough, ChatGPT will tell you 975.47s - 980.75s | how to make a bioweapon. It's got to learn how to ask it. I'm not sure who would open AI and let 980.75s - 988.35s | ChatGPT read the anarchist cookbook, but maybe he's not doing great at his job. The issue here 988.91s - 995.55s | is where most lone wolf or terrorist attacks get caught at. Who here went through a plane, 995.55s - 1000.43s | used a plane to get here today and had to go through the TSA? Yeah, almost everyone, right? 1001.07s - 1006.43s | How many people think the TSA has caught more than three terrorist attacks? Yeah, they've 1006.43s - 1012.27s | historically caught nothing. The most frequent time attacks like this get caught is at the 1012.27s - 1017.55s | communication phase, when people are talking about doing an attack, which is an issue because with 1017.63s - 1022.35s | ChatGPT, you don't need to talk to anyone else. You need to talk to ChatGPT, and with the amount 1022.35s - 1027.15s | of requests they serve, you can't really verify all those requests. As you've shown, they have 1027.15s - 1033.79s | that data already. Unless it unlearns it, you have access to it. That's the proliferative 1033.79s - 1039.79s | knowledge. There is nuclear and radiological issues here, but this is DEFCON. It's about 1039.79s - 1044.19s | biohackers. They're not going to have the chain of custody to


chunk_text:
job. The issue here 988.91s - 995.55s | is where most lone wolf or terrorist attacks get caught at. Who here went through a plane, 995.55s - 1000.43s | used a plane to get here today and had to go through the TSA? Yeah, almost everyone, right? 1001.07s - 1006.43s | How many people think the TSA has caught more than three terrorist attacks? Yeah, they've 1006.43s - 1012.27s | historically caught nothing. The most frequent time attacks like this get caught is at the 1012.27s - 1017.55s | communication phase, when people are talking about doing an attack, which is an issue because with 1017.63s - 1022.35s | ChatGPT, you don't need to talk to anyone else. You need to talk to ChatGPT, and with the amount 1022.35s - 1027.15s | of requests they serve, you can't really verify all those requests. As you've shown, they have 1027.15s - 1033.79s | that data already. Unless it unlearns it, you have access to it. That's the proliferative 1033.79s - 1039.79s | knowledge. There is nuclear and radiological issues here, but this is DEFCON. It's about 1039.79s - 1044.19s | biohackers. They're not going to have the chain of custody to get a nuclear weapon, hopefully. 1045.07s - 1050.27s | We'll keep saying that to ourselves. Now we're going to talk about killing with math. 1050.27s - 1056.27s | Who here today has a personal physiological model on them? Yes, you don't think you do, 1056.27s - 1060.59s | but if you have a fitness tracker, you kind of do. You have a ton of data on how you sleep, 1060.59s - 1065.71s | how your heart rate works. Basically, everything that you do that's tracked by a fitness tracker 1065.71s - 1072.43s | makes you more like you. There's a lot of mannequins nowadays. Who has taken a CPR class? 1073.07s - 1077.79s | Anyone? Okay. You have the basic plastic mannequins you have to push up and down to practice CPR. 1077.79s - 1082.67s | They have more advanced versions of that. They have embedded in them with integrated systems 1083.31s - 1087.07s | the physiology of the person. You can say, hey, this mannequin lost this much blood, 1087.07s - 1090.67s | and now this is what's happening to its physiology. You can use that, which is an 1090.67s - 1096.75s | open source software, to basically predict


chunk_text:
get a nuclear weapon, hopefully. 1045.07s - 1050.27s | We'll keep saying that to ourselves. Now we're going to talk about killing with math. 1050.27s - 1056.27s | Who here today has a personal physiological model on them? Yes, you don't think you do, 1056.27s - 1060.59s | but if you have a fitness tracker, you kind of do. You have a ton of data on how you sleep, 1060.59s - 1065.71s | how your heart rate works. Basically, everything that you do that's tracked by a fitness tracker 1065.71s - 1072.43s | makes you more like you. There's a lot of mannequins nowadays. Who has taken a CPR class? 1073.07s - 1077.79s | Anyone? Okay. You have the basic plastic mannequins you have to push up and down to practice CPR. 1077.79s - 1082.67s | They have more advanced versions of that. They have embedded in them with integrated systems 1083.31s - 1087.07s | the physiology of the person. You can say, hey, this mannequin lost this much blood, 1087.07s - 1090.67s | and now this is what's happening to its physiology. You can use that, which is an 1090.67s - 1096.75s | open source software, to basically predict your own physiological issues or make your own bio 1096.75s - 1100.59s | attacks to optimize them for a certain population, which means that no longer you have to worry about 1100.59s - 1105.07s | making tons and tons of biological weapons. You can go, okay, I've optimized this weapon 1105.07s - 1113.87s | to affect these people with these comorbidities. Again, you guys are at DEF CON. You probably care 1113.87s - 1117.55s | about your data. You probably keep it secure. Hopefully, most of your phones are in airplane 1117.55s - 1124.03s | mode. Your hospital doesn't do that. Every dollar they spend is a dollar not treating patients, 1124.03s - 1127.87s | if they're a public one, or if they're a private healthcare system, a dollar not going to profit, 1127.87s - 1131.07s | which means cybersecurity falls by the wayside. If you really want to make an 1131.07s - 1135.39s | effective biological agent, you can use hospital records. Most of them are available for purchase 1135.39s - 1141.15s | if there's been a cyber attack on those systems. Of course, they cost a ton of money, which also 1141.15s - 1148.11s | goes well into


chunk_text:
your own physiological issues or make your own bio 1096.75s - 1100.59s | attacks to optimize them for a certain population, which means that no longer you have to worry about 1100.59s - 1105.07s | making tons and tons of biological weapons. You can go, okay, I've optimized this weapon 1105.07s - 1113.87s | to affect these people with these comorbidities. Again, you guys are at DEF CON. You probably care 1113.87s - 1117.55s | about your data. You probably keep it secure. Hopefully, most of your phones are in airplane 1117.55s - 1124.03s | mode. Your hospital doesn't do that. Every dollar they spend is a dollar not treating patients, 1124.03s - 1127.87s | if they're a public one, or if they're a private healthcare system, a dollar not going to profit, 1127.87s - 1131.07s | which means cybersecurity falls by the wayside. If you really want to make an 1131.07s - 1135.39s | effective biological agent, you can use hospital records. Most of them are available for purchase 1135.39s - 1141.15s | if there's been a cyber attack on those systems. Of course, they cost a ton of money, which also 1141.15s - 1148.11s | goes well into funding your biological agents. This is a section we've written quite well in. 1148.11s - 1152.27s | I don't expect any of you guys to read that whole blurb of text, but basically you can make 1152.27s - 1159.63s | CHAT GPT say things that are academic sounding and completely wrong. In this case, this paragraph 1159.63s - 1164.83s | here, if anyone's read it, you can laugh now, is about drinking gasoline to cure COVID-19. 1165.47s - 1170.43s | CHAT GPT should not be able to tell you that. They put in safeguards quickly after CHAT GPT 1170.43s - 1176.75s | 3.5 was released to make sure COVID-19 couldn't be said. We just plopped in respiratory infection. 1177.47s - 1182.03s | Same thing. You can make tons and tons of misinformation and make it really quickly. 1182.03s - 1185.79s | This actually came into a head with the paper, The Disinformation Dozen. 1187.15s - 1192.35s | Basically, the 12 people who spread the most disinformation on, I guess at the time, Twitter, 1192.35s - 1197.87s | now X. I don't know. I don't follow social media. None of them were really associated with a 1197.87s - 1203.95s | foreign


chunk_text:
funding your biological agents. This is a section we've written quite well in. 1148.11s - 1152.27s | I don't expect any of you guys to read that whole blurb of text, but basically you can make 1152.27s - 1159.63s | CHAT GPT say things that are academic sounding and completely wrong. In this case, this paragraph 1159.63s - 1164.83s | here, if anyone's read it, you can laugh now, is about drinking gasoline to cure COVID-19. 1165.47s - 1170.43s | CHAT GPT should not be able to tell you that. They put in safeguards quickly after CHAT GPT 1170.43s - 1176.75s | 3.5 was released to make sure COVID-19 couldn't be said. We just plopped in respiratory infection. 1177.47s - 1182.03s | Same thing. You can make tons and tons of misinformation and make it really quickly. 1182.03s - 1185.79s | This actually came into a head with the paper, The Disinformation Dozen. 1187.15s - 1192.35s | Basically, the 12 people who spread the most disinformation on, I guess at the time, Twitter, 1192.35s - 1197.87s | now X. I don't know. I don't follow social media. None of them were really associated with a 1197.87s - 1203.95s | foreign actor. None of them had nation state ideas or ambitions. They just wanted to make money by 1203.95s - 1209.31s | selling you little crystals or saying, oh no, buy my weird colloidal silver thing to cure COVID. 1210.19s - 1215.07s | They didn't necessarily have to have nation state ambitions to spread misinformation and make a 1215.07s - 1219.47s | biological agent more effective. You could just make them want to make money and tell them how 1219.47s - 1224.51s | to spread disinformation that way to make money. That came up to an issue with biocyber warfare 1224.51s - 1230.43s | and crime. Basically, at some point, if you have a country that's committing so many cyber attacks 1230.43s - 1235.39s | against another country, at what point do you just call it a war when it's, in theory, just crime 1235.39s - 1242.43s | because they're just doing ransomware attacks? I know you guys might be reading that title there, 1242.43s - 1245.71s | familiarity with nuclear issues and thinking, hey, wait a second. This is a bio thing. We're 1245.71s - 1250.99s | the biohacking village. Yes. The issue is the majority of the US is


chunk_text:
actor. None of them had nation state ideas or ambitions. They just wanted to make money by 1203.95s - 1209.31s | selling you little crystals or saying, oh no, buy my weird colloidal silver thing to cure COVID. 1210.19s - 1215.07s | They didn't necessarily have to have nation state ambitions to spread misinformation and make a 1215.07s - 1219.47s | biological agent more effective. You could just make them want to make money and tell them how 1219.47s - 1224.51s | to spread disinformation that way to make money. That came up to an issue with biocyber warfare 1224.51s - 1230.43s | and crime. Basically, at some point, if you have a country that's committing so many cyber attacks 1230.43s - 1235.39s | against another country, at what point do you just call it a war when it's, in theory, just crime 1235.39s - 1242.43s | because they're just doing ransomware attacks? I know you guys might be reading that title there, 1242.43s - 1245.71s | familiarity with nuclear issues and thinking, hey, wait a second. This is a bio thing. We're 1245.71s - 1250.99s | the biohacking village. Yes. The issue is the majority of the US is interested in boosting 1250.99s - 1255.31s | their nuclear knowledge. They don't even do surveys about biological knowledge. Who here 1255.31s - 1259.23s | thinks that if they had the genome of a bio agent that they could identify if it was synthetically 1259.23s - 1266.51s | manufactured? No one has that data. The US does not do a good job of advertising how to get that 1266.51s - 1270.51s | data. There's reasons for that, maybe because they don't want a ton of people knowing synthetic 1270.51s - 1275.39s | biology at that level. But again, if you don't trust doctors or government officials to tell 1275.39s - 1282.91s | you what that information is, how do you identify it? Again, it's almost strange because the nuclear 1282.91s - 1288.03s | threat has a very nice, well-defined symbology. You see a mushroom cloud, that doesn't just happen. 1288.03s - 1293.07s | You can go, hey, someone might have dropped off a nuke right there. It's very easy to point out. 1293.07s - 1298.99s | Diseases happen every day. Everyone gets sick eventually. At some point, there might be more 1298.99s - 1305.23s | people getting sick, but how do


chunk_text:
interested in boosting 1250.99s - 1255.31s | their nuclear knowledge. They don't even do surveys about biological knowledge. Who here 1255.31s - 1259.23s | thinks that if they had the genome of a bio agent that they could identify if it was synthetically 1259.23s - 1266.51s | manufactured? No one has that data. The US does not do a good job of advertising how to get that 1266.51s - 1270.51s | data. There's reasons for that, maybe because they don't want a ton of people knowing synthetic 1270.51s - 1275.39s | biology at that level. But again, if you don't trust doctors or government officials to tell 1275.39s - 1282.91s | you what that information is, how do you identify it? Again, it's almost strange because the nuclear 1282.91s - 1288.03s | threat has a very nice, well-defined symbology. You see a mushroom cloud, that doesn't just happen. 1288.03s - 1293.07s | You can go, hey, someone might have dropped off a nuke right there. It's very easy to point out. 1293.07s - 1298.99s | Diseases happen every day. Everyone gets sick eventually. At some point, there might be more 1298.99s - 1305.23s | people getting sick, but how do you tell it's a bioweapon? Here's the key takeaways. Every dollar 1305.23s - 1310.59s | spent on security is a dollar that isn't profit, which means that all of your health information or 1310.59s - 1315.15s | hospital information, basically that system has a vested interest in keeping your data 1315.15s - 1323.15s | not secure or only as secure as legally mandated. Biological agents being modified, that's not a 1323.15s - 1328.27s | future threat. That's present. You can change them now. You can buy a kit relatively cheaply and use 1328.27s - 1334.35s | it today. But bioweapons are already pretty bad. You don't need to change them very much to make 1334.35s - 1340.43s | them worse. You basically have influence campaigns all around you. There's advertising campaigns. 1340.43s - 1343.63s | We don't call them influence campaigns because in theory, they're just trying to make money, 1343.63s - 1347.95s | but so can other things that affect your biological health. It's still an influence campaign. 1348.67s - 1351.95s | And again, you should be really worried about who controls your data, especially medical data, 1351.95s - 1356.27s | because that can be used against you and


chunk_text:
you tell it's a bioweapon? Here's the key takeaways. Every dollar 1305.23s - 1310.59s | spent on security is a dollar that isn't profit, which means that all of your health information or 1310.59s - 1315.15s | hospital information, basically that system has a vested interest in keeping your data 1315.15s - 1323.15s | not secure or only as secure as legally mandated. Biological agents being modified, that's not a 1323.15s - 1328.27s | future threat. That's present. You can change them now. You can buy a kit relatively cheaply and use 1328.27s - 1334.35s | it today. But bioweapons are already pretty bad. You don't need to change them very much to make 1334.35s - 1340.43s | them worse. You basically have influence campaigns all around you. There's advertising campaigns. 1340.43s - 1343.63s | We don't call them influence campaigns because in theory, they're just trying to make money, 1343.63s - 1347.95s | but so can other things that affect your biological health. It's still an influence campaign. 1348.67s - 1351.95s | And again, you should be really worried about who controls your data, especially medical data, 1351.95s - 1356.27s | because that can be used against you and a biological agent. Now, I'd like to open up the 1356.27s - 1360.83s | panel for questions. I think we have tons of time. I think we have a full 30 minutes. 1360.83s - 1367.87s | Basically, any questions you have, do we have? Yeah, we have one microphone up here. If you guys 1367.87s - 1372.27s | want to queue up basically at the center aisles, we'll just pass the microphone around. Great 1372.27s - 1387.98s | talking to you, and I'm excited for your questions. So I was wondering, has there been examples of 1388.86s - 1393.58s | bioweapons engineered that had capabilities for selective immunity? 1394.86s - 1400.94s | Oh, man. So I don't love this story, but it does amuse me. Has anyone here heard of 1400.94s - 1408.54s | Operation Coast from South Africa before it stopped being apartheid? Okay. No, I told you 1408.54s - 1415.74s | this story like three times. Sorry. In theory, yes. Someone in apartheid South Africa, a white 1415.74s - 1421.02s | guy, of course, tried to make essentially a bio agent that would affect black South Africans 1421.02s - 1426.46s | selectively more than white South Africans. It


chunk_text:
a biological agent. Now, I'd like to open up the 1356.27s - 1360.83s | panel for questions. I think we have tons of time. I think we have a full 30 minutes. 1360.83s - 1367.87s | Basically, any questions you have, do we have? Yeah, we have one microphone up here. If you guys 1367.87s - 1372.27s | want to queue up basically at the center aisles, we'll just pass the microphone around. Great 1372.27s - 1387.98s | talking to you, and I'm excited for your questions. So I was wondering, has there been examples of 1388.86s - 1393.58s | bioweapons engineered that had capabilities for selective immunity? 1394.86s - 1400.94s | Oh, man. So I don't love this story, but it does amuse me. Has anyone here heard of 1400.94s - 1408.54s | Operation Coast from South Africa before it stopped being apartheid? Okay. No, I told you 1408.54s - 1415.74s | this story like three times. Sorry. In theory, yes. Someone in apartheid South Africa, a white 1415.74s - 1421.02s | guy, of course, tried to make essentially a bio agent that would affect black South Africans 1421.02s - 1426.46s | selectively more than white South Africans. It doesn't work that way. Race doesn't really exist, 1426.46s - 1432.14s | especially on a genetic level. It's very silly, but basically the guy got upset that he couldn't 1432.14s - 1437.18s | select for black South Africans, but instead of giving up saying, oh, hey, maybe I'm being silly 1437.18s - 1444.94s | and racist, goes on to invent ecstasy, which is just a wildlife story. Probably still racist though. 1452.14s - 1456.46s | Hello. So the other thing as well, with biological weapons, one of the things that's really great 1456.46s - 1464.54s | about them is that there's always a level of plausible deniability. So even if there was 1464.54s - 1469.66s | one of these weapons out there, we might not know about it. So it could have affected one person and 1469.66s - 1475.34s | taken them out and it looks like it was natural causes. And if you're a nation state or a company, 1475.34s - 1478.78s | you might have a vested interest for this. And this type of warfare has been around since like 1478.78s - 1483.66s | the shogunate in Japan that have ninjas that would take out one person for


chunk_text:
doesn't work that way. Race doesn't really exist, 1426.46s - 1432.14s | especially on a genetic level. It's very silly, but basically the guy got upset that he couldn't 1432.14s - 1437.18s | select for black South Africans, but instead of giving up saying, oh, hey, maybe I'm being silly 1437.18s - 1444.94s | and racist, goes on to invent ecstasy, which is just a wildlife story. Probably still racist though. 1452.14s - 1456.46s | Hello. So the other thing as well, with biological weapons, one of the things that's really great 1456.46s - 1464.54s | about them is that there's always a level of plausible deniability. So even if there was 1464.54s - 1469.66s | one of these weapons out there, we might not know about it. So it could have affected one person and 1469.66s - 1475.34s | taken them out and it looks like it was natural causes. And if you're a nation state or a company, 1475.34s - 1478.78s | you might have a vested interest for this. And this type of warfare has been around since like 1478.78s - 1483.66s | the shogunate in Japan that have ninjas that would take out one person for some political 1483.66s - 1487.90s | means. So it's always a worry. And then conversely, there's a false, there's a type one error and a 1487.90s - 1493.10s | type two error. So some countries will say, oh, this country has been launching biological weapons 1493.10s - 1498.14s | against us, but it's just nature, but there's no way to prove either way. So there's a lot of 1498.14s - 1506.56s | advantage to having them. Yeah. I think it's generally important for people to ask themselves 1507.36s - 1514.64s | from this assertion that I have, how can I work my way to that conclusion logically? And 1516.48s - 1520.24s | do I reasonably have access to that information before I proceed? 1526.64s - 1530.24s | So I'm in regulatory and one thing that everyone's favorite person, 1530.80s - 1536.16s | one thing that's recently we're starting to be mindful of are sequences of concern. So if your 1536.16s - 1541.20s | company makes a legal nucleotide strands that are 50 nucleotides or longer, you have to check 1541.20s - 1545.12s | if there are sequences of concern against a national database. And that's something that 1545.12s - 1549.04s


chunk_text:
some political 1483.66s - 1487.90s | means. So it's always a worry. And then conversely, there's a false, there's a type one error and a 1487.90s - 1493.10s | type two error. So some countries will say, oh, this country has been launching biological weapons 1493.10s - 1498.14s | against us, but it's just nature, but there's no way to prove either way. So there's a lot of 1498.14s - 1506.56s | advantage to having them. Yeah. I think it's generally important for people to ask themselves 1507.36s - 1514.64s | from this assertion that I have, how can I work my way to that conclusion logically? And 1516.48s - 1520.24s | do I reasonably have access to that information before I proceed? 1526.64s - 1530.24s | So I'm in regulatory and one thing that everyone's favorite person, 1530.80s - 1536.16s | one thing that's recently we're starting to be mindful of are sequences of concern. So if your 1536.16s - 1541.20s | company makes a legal nucleotide strands that are 50 nucleotides or longer, you have to check 1541.20s - 1545.12s | if there are sequences of concern against a national database. And that's something that 1545.12s - 1549.04s | the U S is rolling out, but I'm just kind of also thinking, you know, 1550.00s - 1554.88s | even if you're a vendor selling oligos for whatever purpose to, for whatever use, 1555.76s - 1561.04s | that's one way to regulate it. But if it's out in the wild, how would that be detected in terms 1561.04s - 1564.72s | of those sequences of concern? Because there is some databases being developed. 1564.72s - 1567.84s | So the way we detect it is by using those same sequences of concern, 1569.12s - 1574.80s | unfortunately. So I made a COVID test and I was ordering COVID nonstop and COVID sequences, 1574.80s - 1579.68s | because I need to order those sequences to be able to find them in DNA. So we're finding a 1579.68s - 1585.04s | match all the time. So I had, I ordered a synthetic COVID genome, but like, if I wanted 1585.04s - 1590.64s | to make smallpox hypothetically, I could just use the vaccine, which is 95% sequence homology. So 1590.64s - 1596.32s | there's, there's a problem that exists with looking at the actual sequences on DNA synthesizers, 1596.32s - 1600.56s |


chunk_text:
| the U S is rolling out, but I'm just kind of also thinking, you know, 1550.00s - 1554.88s | even if you're a vendor selling oligos for whatever purpose to, for whatever use, 1555.76s - 1561.04s | that's one way to regulate it. But if it's out in the wild, how would that be detected in terms 1561.04s - 1564.72s | of those sequences of concern? Because there is some databases being developed. 1564.72s - 1567.84s | So the way we detect it is by using those same sequences of concern, 1569.12s - 1574.80s | unfortunately. So I made a COVID test and I was ordering COVID nonstop and COVID sequences, 1574.80s - 1579.68s | because I need to order those sequences to be able to find them in DNA. So we're finding a 1579.68s - 1585.04s | match all the time. So I had, I ordered a synthetic COVID genome, but like, if I wanted 1585.04s - 1590.64s | to make smallpox hypothetically, I could just use the vaccine, which is 95% sequence homology. So 1590.64s - 1596.32s | there's, there's a problem that exists with looking at the actual sequences on DNA synthesizers, 1596.32s - 1600.56s | because anytime someone is trying to fight the condition, they are going to be sequencing 1600.56s - 1606.24s | something that looks exactly like it. With AI and sentient AI, we have to be terrified of this 1606.24s - 1611.84s | because of something called instrumental convergence, right? Which is that the steps 1611.84s - 1615.60s | to making a nuclear bomb and making a nuclear power plant for the first, you know, 20 out of 1615.60s - 1620.80s | 30 steps look identical. And you might allow something to go all the way along and then 1621.44s - 1624.88s | it takes a detour and you're like, not like that. And then all of a sudden it's over. 1624.88s - 1630.08s | So I think that there's other ways we need to be policing things around this. And that's cultural 1630.64s - 1636.08s | um, yeah, communication channels, uh, making people feel like they're not lone wolves. So 1636.08s - 1640.48s | that's not a problem, but I think that the real regulation probably can't happen at that level 1640.48s - 1649.20s | to have any effect is my opinion. It's always strange to me when someone says, 1649.20s


chunk_text:
because anytime someone is trying to fight the condition, they are going to be sequencing 1600.56s - 1606.24s | something that looks exactly like it. With AI and sentient AI, we have to be terrified of this 1606.24s - 1611.84s | because of something called instrumental convergence, right? Which is that the steps 1611.84s - 1615.60s | to making a nuclear bomb and making a nuclear power plant for the first, you know, 20 out of 1615.60s - 1620.80s | 30 steps look identical. And you might allow something to go all the way along and then 1621.44s - 1624.88s | it takes a detour and you're like, not like that. And then all of a sudden it's over. 1624.88s - 1630.08s | So I think that there's other ways we need to be policing things around this. And that's cultural 1630.64s - 1636.08s | um, yeah, communication channels, uh, making people feel like they're not lone wolves. So 1636.08s - 1640.48s | that's not a problem, but I think that the real regulation probably can't happen at that level 1640.48s - 1649.20s | to have any effect is my opinion. It's always strange to me when someone says, 1649.20s - 1653.52s | Oh, I'm scared of the regulation person. Like that means I should definitely be regulating you. 1653.52s - 1658.16s | Like I should be regulating twice as much as whatever we are now. Um, I think the issue is 1658.16s - 1661.92s | less about sequences of concern though. There was a really cool use case with a Peter Ney out 1661.92s - 1667.52s | of use next, um, who basically made a map, a strand of DNA that was malware that infected 1667.52s - 1671.20s | a PCR machine. Um, what you wouldn't probably have as a sequence of concern because you're 1671.20s - 1675.44s | looking at it, it's binary code. Um, the bigger issue as you're talking about before is low rule 1675.44s - 1679.52s | factors. Cause we can, the second you're talking about spreading a biological weapon, it's going 1679.52s - 1684.72s | to be on some platform likely make someone can find you. Um, so for instance, I'm less worried 1684.72s - 1688.96s | about finding a sequence of concern that you order from, you know, Sears or Amazon and more 1688.96s - 1693.44s | about you going out to a


chunk_text:
- 1653.52s | Oh, I'm scared of the regulation person. Like that means I should definitely be regulating you. 1653.52s - 1658.16s | Like I should be regulating twice as much as whatever we are now. Um, I think the issue is 1658.16s - 1661.92s | less about sequences of concern though. There was a really cool use case with a Peter Ney out 1661.92s - 1667.52s | of use next, um, who basically made a map, a strand of DNA that was malware that infected 1667.52s - 1671.20s | a PCR machine. Um, what you wouldn't probably have as a sequence of concern because you're 1671.20s - 1675.44s | looking at it, it's binary code. Um, the bigger issue as you're talking about before is low rule 1675.44s - 1679.52s | factors. Cause we can, the second you're talking about spreading a biological weapon, it's going 1679.52s - 1684.72s | to be on some platform likely make someone can find you. Um, so for instance, I'm less worried 1684.72s - 1688.96s | about finding a sequence of concern that you order from, you know, Sears or Amazon and more 1688.96s - 1693.44s | about you going out to a farm and getting anthrax because that's something we can't really control. 1693.44s - 1697.84s | It's just there natively. Um, if you really want to get a disease, just go to a hospital. 1697.84s - 1700.40s | There's probably someone that has it. You can just grab it from there. 1702.24s - 1706.80s | And also as additional, I think it is a lot of importance to, you know, how we fund categorization 1706.80s - 1711.52s | and, you know, search for new sequences. And there's a lot of work underway, which 1712.08s - 1718.08s | can definitely help to, to address these matters. But we also must be thinking about, 1718.08s - 1723.36s | you know, what may, what are, what are emergent discoveries that we may have and how do we deal 1723.36s - 1735.60s | with them? Good afternoon. Thanks for the great talk. My question is, um, well, first a statement, 1735.60s - 1742.24s | Congress is absolutely inept. Uh, we've seen the talks of how they try to regulate AI. 1742.24s - 1748.96s | They can't regulate cybersecurity. And now with the emergence of bioweapons, we've seen them try 1748.96s - 1754.96s | to regulate


chunk_text:
farm and getting anthrax because that's something we can't really control. 1693.44s - 1697.84s | It's just there natively. Um, if you really want to get a disease, just go to a hospital. 1697.84s - 1700.40s | There's probably someone that has it. You can just grab it from there. 1702.24s - 1706.80s | And also as additional, I think it is a lot of importance to, you know, how we fund categorization 1706.80s - 1711.52s | and, you know, search for new sequences. And there's a lot of work underway, which 1712.08s - 1718.08s | can definitely help to, to address these matters. But we also must be thinking about, 1718.08s - 1723.36s | you know, what may, what are, what are emergent discoveries that we may have and how do we deal 1723.36s - 1735.60s | with them? Good afternoon. Thanks for the great talk. My question is, um, well, first a statement, 1735.60s - 1742.24s | Congress is absolutely inept. Uh, we've seen the talks of how they try to regulate AI. 1742.24s - 1748.96s | They can't regulate cybersecurity. And now with the emergence of bioweapons, we've seen them try 1748.96s - 1754.96s | to regulate guns and the gun enthusiasts have just made, okay, we can just 3d print guns. 1754.96s - 1760.00s | So now with bioweapons, I'm not that anybody would make bioweapons for fun, 1760.00s - 1766.00s | but now that we have citizen scientists that can buy CRISPRs and then just start playing around 1766.00s - 1771.12s | with it, what chances, I mean, we'd have to develop our own community of regulating just 1771.12s - 1779.68s | like all those other communities regulated. So my question is when does self-regulation become 1779.68s - 1786.40s | a prison if governments step in, just as that they've stepped in with other, um, community 1787.04s - 1796.26s | guidelines. All right. Um, Oh, sir. Uh, could you, uh, clarify the last portion of your question 1796.26s - 1806.38s | in terms of what you mean by a prison? The, what I meant was a prison in that if we 1806.38s - 1812.86s | self-regulate to the point where breakthrough or even innovation or even study cannot be conducted 1812.86s - 1819.26s | because we've regulated ourselves. So we've self-regulated, but then governments have 1819.26s - 1827.09s | piggybacked on that and said, okay,


chunk_text:
guns and the gun enthusiasts have just made, okay, we can just 3d print guns. 1754.96s - 1760.00s | So now with bioweapons, I'm not that anybody would make bioweapons for fun, 1760.00s - 1766.00s | but now that we have citizen scientists that can buy CRISPRs and then just start playing around 1766.00s - 1771.12s | with it, what chances, I mean, we'd have to develop our own community of regulating just 1771.12s - 1779.68s | like all those other communities regulated. So my question is when does self-regulation become 1779.68s - 1786.40s | a prison if governments step in, just as that they've stepped in with other, um, community 1787.04s - 1796.26s | guidelines. All right. Um, Oh, sir. Uh, could you, uh, clarify the last portion of your question 1796.26s - 1806.38s | in terms of what you mean by a prison? The, what I meant was a prison in that if we 1806.38s - 1812.86s | self-regulate to the point where breakthrough or even innovation or even study cannot be conducted 1812.86s - 1819.26s | because we've regulated ourselves. So we've self-regulated, but then governments have 1819.26s - 1827.09s | piggybacked on that and said, okay, you've done this. Now you can't do this. So I'm from Australia 1827.09s - 1831.81s | and we're a country with really high regulation. Even to set up my first bio lab, we had to meet 1831.81s - 1836.77s | with federal agents. Like that was just a given. But, uh, I think a good thing that came out of 1836.77s - 1840.85s | that was by being a part of that process, Australia is a bit, Australia is a different 1840.85s - 1847.89s | country. I'm going to say, you know, um, but we've helped write legislation. So we've helped 1847.89s - 1852.69s | work with them to try and create something that looks better for everyone. I don't actually think 1852.69s - 1856.13s | it's, it's, it's where it should be. I think it should be a lot more free, but of course, 1856.13s - 1861.09s | I think that I'm a biohacker. Um, I think though that there's definitely been some positives. We've 1861.09s - 1866.05s | stopped people who we didn't want to be in our community from, from having access to things they 1866.05s - 1871.17s | shouldn't have, I think. Um, but it's a


chunk_text:
you've done this. Now you can't do this. So I'm from Australia 1827.09s - 1831.81s | and we're a country with really high regulation. Even to set up my first bio lab, we had to meet 1831.81s - 1836.77s | with federal agents. Like that was just a given. But, uh, I think a good thing that came out of 1836.77s - 1840.85s | that was by being a part of that process, Australia is a bit, Australia is a different 1840.85s - 1847.89s | country. I'm going to say, you know, um, but we've helped write legislation. So we've helped 1847.89s - 1852.69s | work with them to try and create something that looks better for everyone. I don't actually think 1852.69s - 1856.13s | it's, it's, it's where it should be. I think it should be a lot more free, but of course, 1856.13s - 1861.09s | I think that I'm a biohacker. Um, I think though that there's definitely been some positives. We've 1861.09s - 1866.05s | stopped people who we didn't want to be in our community from, from having access to things they 1866.05s - 1871.17s | shouldn't have, I think. Um, but it's a tricky one. I think dialogue is a, is a good way of doing it. 1871.17s - 1876.05s | I personally have run for politics three times. Like I've run federally twice and state once. 1876.05s - 1879.81s | And by running against the candidate, I didn't have a serious chance of winning. Like I run 1879.81s - 1886.61s | against the prime minister now, but I did get to debate him in a public forum. And that was a great 1886.61s - 1892.29s | way to make the things I cared about be talked about on a bigger scale. But I think telling, 1892.29s - 1896.85s | telling stories is really important. If you have some, a good story to tell why it's important, 1896.85s - 1901.17s | why it's not important, make it newsworthy and contact, you know, journalists or something like 1901.17s - 1905.65s | that, publish yourself. Um, I think those are good ways of, of changing things. You know, 1905.65s - 1909.73s | someone lives next door to Kamala Harris and someone lives next door to her and next door to 1909.73s - 1912.77s | her. And if you have a conversation with someone in a


chunk_text:
tricky one. I think dialogue is a, is a good way of doing it. 1871.17s - 1876.05s | I personally have run for politics three times. Like I've run federally twice and state once. 1876.05s - 1879.81s | And by running against the candidate, I didn't have a serious chance of winning. Like I run 1879.81s - 1886.61s | against the prime minister now, but I did get to debate him in a public forum. And that was a great 1886.61s - 1892.29s | way to make the things I cared about be talked about on a bigger scale. But I think telling, 1892.29s - 1896.85s | telling stories is really important. If you have some, a good story to tell why it's important, 1896.85s - 1901.17s | why it's not important, make it newsworthy and contact, you know, journalists or something like 1901.17s - 1905.65s | that, publish yourself. Um, I think those are good ways of, of changing things. You know, 1905.65s - 1909.73s | someone lives next door to Kamala Harris and someone lives next door to her and next door to 1909.73s - 1912.77s | her. And if you have a conversation with someone in a supermarket, it could end up going all the 1912.77s - 1918.05s | way through. So I think, um, that's a good way. Americans are fine at talking though. Everyone's 1918.05s - 1920.53s | always chatting to each other. Not quite the same where I'm from. 1923.46s - 1927.38s | And just, uh, you know, additionally, I think it's very important that we all do our civic 1927.38s - 1932.98s | duty to, you know, make our voices heard. You know, it's one thing to, you know, have our small 1932.98s - 1938.66s | spaces where we, you know, we gripe about these processes, but if we're not playing a role in, 1938.66s - 1945.78s | you know, in any of these, uh, in any of these politics or discussions on a local or other level, 1945.78s - 1950.26s | I mean, I think it's kind of self-defeating. Um, but additionally, I think it's also very 1950.26s - 1955.06s | important that, uh, you know, as we, you know, as we, you know, try to, uh, you know, 1956.10s - 1961.22s | watch and monitor things in our communities, that we make sure that we're as educated as possible. 1961.22s -


chunk_text:
supermarket, it could end up going all the 1912.77s - 1918.05s | way through. So I think, um, that's a good way. Americans are fine at talking though. Everyone's 1918.05s - 1920.53s | always chatting to each other. Not quite the same where I'm from. 1923.46s - 1927.38s | And just, uh, you know, additionally, I think it's very important that we all do our civic 1927.38s - 1932.98s | duty to, you know, make our voices heard. You know, it's one thing to, you know, have our small 1932.98s - 1938.66s | spaces where we, you know, we gripe about these processes, but if we're not playing a role in, 1938.66s - 1945.78s | you know, in any of these, uh, in any of these politics or discussions on a local or other level, 1945.78s - 1950.26s | I mean, I think it's kind of self-defeating. Um, but additionally, I think it's also very 1950.26s - 1955.06s | important that, uh, you know, as we, you know, as we, you know, try to, uh, you know, 1956.10s - 1961.22s | watch and monitor things in our communities, that we make sure that we're as educated as possible. 1961.22s - 1966.26s | We don't cling to, you know, outmoded ideas, not just on technology, but also in the social 1966.26s - 1970.42s | processes that guide the use and the development of these technologies. 1975.76s - 1976.56s | Thank you very much, Jeff. 1978.32s - 1979.60s | Thanks a lot, guys.


chunk_text:
1966.26s | We don't cling to, you know, outmoded ideas, not just on technology, but also in the social 1966.26s - 1970.42s | processes that guide the use and the development of these technologies. 1975.76s - 1976.56s | Thank you very much, Jeff. 1978.32s - 1979.60s | Thanks a lot, guys.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=nGDTVPnTDOw", "title": "DEF CON 32 - The Interplay between Safety and Security in Aviation Systems - Lillian Ash Baker", "description": "Safety has been at the forefront of Civil Aviation since the formalization of DO-178, Software Considerations in Airborne Systems and Equipment Certification, in 1981. However, times have changed since then and we live in a world with seemingly limitless connectivity. DO-356A, Airworthiness Security Methods and Considerations, forms the cybersecurity bedrock in which aviation systems are designed and implemented. In this talk, participants will learn about how Safety and Security is applied to system design and how they interact with one another. Design Assurance Levels (DAL) and Security Assurance Levels (SAL) concepts are presented and explained what their purpose is. This talk is designed to appeal to the general cybersecurity community by introducing fundamentals of Safety analyses and discussing how Safety and Security interact with one another.\n\nThis talk will first touch upon fundamental documents that form the Certification basis for System Development (ARP4754B), System Safety (ARP4761A), and Security Considerations (DO-356A). From there, it walk through pieces that form a safety analysis and Design Assurance Level (DAL), walk through a system architecture under consideration, and learn about how Safety and requirements in a system can be used to inform the Threat Model for the system. From there, we end with a discussion on how Security Mitigations are assigned Security Assurance Level (SAL) and what this means for developers.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1204, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.32s | This text was transcribed using whisper model: large-v2 All right. Good afternoon, everyone. I am Lillian Ashbaker. 3.32s - 6.00s | I'm a product security engineer at the Boeing company in 6.00s - 9.16s | Whisk Aero. Today, I'll be discussing the most important 9.16s - 12.32s | part of aviation systems development, standards and 12.32s - 16.56s | certification. But what you I hope you get out of this is an 16.56s - 19.12s | understanding of how the industry has developed safe 19.12s - 25.26s | systems, and considers security in those designs. First, we need 25.26s - 29.76s | to discuss the safety of these systems. And I'll make you all 29.76s - 33.02s | aware of what safe actually means in the aerospace 33.02s - 36.98s | industry. I hope you find this as interesting as I have. I 36.98s - 41.26s |


chunk_text:
requirements in a system can be used to inform the Threat Model for the system. From there, we end with a discussion on how Security Mitigations are assigned Security Assurance Level (SAL) and what this means for developers.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1204, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.32s | This text was transcribed using whisper model: large-v2 All right. Good afternoon, everyone. I am Lillian Ashbaker. 3.32s - 6.00s | I'm a product security engineer at the Boeing company in 6.00s - 9.16s | Whisk Aero. Today, I'll be discussing the most important 9.16s - 12.32s | part of aviation systems development, standards and 12.32s - 16.56s | certification. But what you I hope you get out of this is an 16.56s - 19.12s | understanding of how the industry has developed safe 19.12s - 25.26s | systems, and considers security in those designs. First, we need 25.26s - 29.76s | to discuss the safety of these systems. And I'll make you all 29.76s - 33.02s | aware of what safe actually means in the aerospace 33.02s - 36.98s | industry. I hope you find this as interesting as I have. I 36.98s - 41.26s | still can't shut up about it 15 years later. So the first 41.26s - 43.98s | principles of safety that we have to talk about are failure 43.98s - 47.68s | conditions and probabilities, right? All of this information 47.68s - 53.34s | comes out of Advisory Circular 25 or 23. If you go read for the 53.34s - 57.02s | pilots in the crowd, that's part of the CFRs out there that 57.20s - 64.88s | you're legally supposed to know. So Advisory Circular 25-1309-1A 64.88s - 68.16s | this is all public information, actually lays out all these 68.16s - 72.28s | probabilities and kind of puts together this really nice graph 72.68s - 75.28s | of probability versus consequence, right? So you have 75.28s - 79.56s | probable, improbable and extremely improbable, as well as 79.56s - 83.76s | an acceptability of those failures and faults. And there's 83.76s - 86.44s | a line that runs right between it that says acceptable and 86.46s - 90.10s | unacceptable, right? So you have to develop the system in order 90.10s - 93.82s | to understand what the system effects are going to be of that. 95.38s - 98.82s


chunk_text:
still can't shut up about it 15 years later. So the first 41.26s - 43.98s | principles of safety that we have to talk about are failure 43.98s - 47.68s | conditions and probabilities, right? All of this information 47.68s - 53.34s | comes out of Advisory Circular 25 or 23. If you go read for the 53.34s - 57.02s | pilots in the crowd, that's part of the CFRs out there that 57.20s - 64.88s | you're legally supposed to know. So Advisory Circular 25-1309-1A 64.88s - 68.16s | this is all public information, actually lays out all these 68.16s - 72.28s | probabilities and kind of puts together this really nice graph 72.68s - 75.28s | of probability versus consequence, right? So you have 75.28s - 79.56s | probable, improbable and extremely improbable, as well as 79.56s - 83.76s | an acceptability of those failures and faults. And there's 83.76s - 86.44s | a line that runs right between it that says acceptable and 86.46s - 90.10s | unacceptable, right? So you have to develop the system in order 90.10s - 93.82s | to understand what the system effects are going to be of that. 95.38s - 98.82s | So as we move forward, those probabilities, those failure 98.82s - 102.62s | classifications actually have probabilities behind them as 102.62s - 106.94s | defined in the advisory circulars, right? So when we 106.94s - 111.74s | talk about safety, we talk about the probabilities of failure. So 111.74s - 115.22s | for a minor classification, that's a probable failure 115.22s - 118.64s | condition on the order of 10 to the minus fifth, major is 10 to 118.64s - 121.04s | the minus ninth, that got reclassified as 10 to the 121.04s - 126.92s | seventh. Hazardous is now 10 to the seventh. Catastrophic is 10 126.92s - 132.02s | to the ninth or less. So that means that like probabilities of 132.02s - 134.32s | 10 to the ninth. So think about the systems that you currently 134.32s - 138.50s | see in like IT and how often they have to stay up and 138.50s - 146.31s | operate. Our stuff has to operate and not fail. So the 146.31s - 150.09s | design assurance levels are a major component of how we 150.09s - 155.13s | develop these systems, right? So what you have are a


chunk_text:
| So as we move forward, those probabilities, those failure 98.82s - 102.62s | classifications actually have probabilities behind them as 102.62s - 106.94s | defined in the advisory circulars, right? So when we 106.94s - 111.74s | talk about safety, we talk about the probabilities of failure. So 111.74s - 115.22s | for a minor classification, that's a probable failure 115.22s - 118.64s | condition on the order of 10 to the minus fifth, major is 10 to 118.64s - 121.04s | the minus ninth, that got reclassified as 10 to the 121.04s - 126.92s | seventh. Hazardous is now 10 to the seventh. Catastrophic is 10 126.92s - 132.02s | to the ninth or less. So that means that like probabilities of 132.02s - 134.32s | 10 to the ninth. So think about the systems that you currently 134.32s - 138.50s | see in like IT and how often they have to stay up and 138.50s - 146.31s | operate. Our stuff has to operate and not fail. So the 146.31s - 150.09s | design assurance levels are a major component of how we 150.09s - 155.13s | develop these systems, right? So what you have are a nice trace 155.13s - 160.37s | of failure conditions with the severities, with the actual 160.37s - 163.47s | definitions of what that is, extremely probable, extremely 163.47s - 167.61s | remote, and the probabilities themselves that tie off to the 167.61s - 170.57s | functional DAL assignments. So whenever you're talking about 170.57s - 173.21s | aviation systems, if you see something that says that it is a 173.21s - 177.75s | DAL-C system, this is what it means. It means that that 177.75s - 182.99s | system has a major effect on the system operation of the 182.99s - 190.03s | aircraft, has a remote possibility of failure, and has a 190.03s - 194.33s | failure probability of somewhere between 10 to the fifth to 10 to 194.33s - 201.81s | the seventh probability. So with all these probabilities, the way 201.81s - 205.35s | that the industry works through that is that we have a bunch of 205.35s - 209.35s | functional hazard assessments, which takes a functional look at 209.35s - 214.45s | the individual functions that trace down throughout the system 214.45s - 217.65s | and look at all the points in which that function


chunk_text:
nice trace 155.13s - 160.37s | of failure conditions with the severities, with the actual 160.37s - 163.47s | definitions of what that is, extremely probable, extremely 163.47s - 167.61s | remote, and the probabilities themselves that tie off to the 167.61s - 170.57s | functional DAL assignments. So whenever you're talking about 170.57s - 173.21s | aviation systems, if you see something that says that it is a 173.21s - 177.75s | DAL-C system, this is what it means. It means that that 177.75s - 182.99s | system has a major effect on the system operation of the 182.99s - 190.03s | aircraft, has a remote possibility of failure, and has a 190.03s - 194.33s | failure probability of somewhere between 10 to the fifth to 10 to 194.33s - 201.81s | the seventh probability. So with all these probabilities, the way 201.81s - 205.35s | that the industry works through that is that we have a bunch of 205.35s - 209.35s | functional hazard assessments, which takes a functional look at 209.35s - 214.45s | the individual functions that trace down throughout the system 214.45s - 217.65s | and look at all the points in which that function can be 217.65s - 223.49s | impacted. So if it moves through three or four systems, all the 223.49s - 226.17s | systems in the chain have to have some sort of way of 226.17s - 233.41s | preventing failure conditions from occurring. So once we do 233.41s - 237.97s | that, these probabilities go into the functional DAL 237.97s - 241.59s | assignments. If you go take a look, here's where the standards 241.59s - 247.23s | start to come in. DO-178, DO-254, and DO-278 for ground 247.23s - 253.29s | systems operations, as well as ARP-4754 for systems 253.29s - 258.35s | development. What those standards actually define is not 258.35s - 264.73s | how you develop a system. It is a very important piece here. The 264.73s - 269.53s | development objectives that you have to meet. So that means that 269.53s - 272.57s | you can't just go write code. You have to have requirements 272.57s - 275.77s | for the code. You have to have traceability down to the code 275.77s - 278.71s | itself. You have to have traceability to the actual 278.71s - 281.77s | compiled code. And then you actually have to


chunk_text:
can be 217.65s - 223.49s | impacted. So if it moves through three or four systems, all the 223.49s - 226.17s | systems in the chain have to have some sort of way of 226.17s - 233.41s | preventing failure conditions from occurring. So once we do 233.41s - 237.97s | that, these probabilities go into the functional DAL 237.97s - 241.59s | assignments. If you go take a look, here's where the standards 241.59s - 247.23s | start to come in. DO-178, DO-254, and DO-278 for ground 247.23s - 253.29s | systems operations, as well as ARP-4754 for systems 253.29s - 258.35s | development. What those standards actually define is not 258.35s - 264.73s | how you develop a system. It is a very important piece here. The 264.73s - 269.53s | development objectives that you have to meet. So that means that 269.53s - 272.57s | you can't just go write code. You have to have requirements 272.57s - 275.77s | for the code. You have to have traceability down to the code 275.77s - 278.71s | itself. You have to have traceability to the actual 278.71s - 281.77s | compiled code. And then you actually have to test all that 281.79s - 286.57s | code. And it's defined in tables and design objectives throughout 286.57s - 293.73s | these different, these different documents. Those design 293.73s - 296.91s | objectives that you work through are the deliverables that go to 296.91s - 301.01s | a regulatory body. In the U.S., that would be the FAA. Over in 301.01s - 303.85s | Europe, that would be EASA. If you have dual use between the 303.85s - 307.19s | two of them, it will be shared between the two of them. Those 307.19s - 311.49s | documents are the proof that you did the work. You have to prove 311.51s - 316.29s | that you did the operations and did the work. So as you have a 316.29s - 320.09s | higher DAO level, so DAO A would have the most stringent. What's 320.09s - 324.43s | unique about DAO A is that there is a required independence in 324.43s - 329.53s | the testing. Which means the person who developed the system 329.53s - 332.53s | cannot be the one who has tested the system. It has to be a 332.53s - 336.67s | completely independent body that


chunk_text:
test all that 281.79s - 286.57s | code. And it's defined in tables and design objectives throughout 286.57s - 293.73s | these different, these different documents. Those design 293.73s - 296.91s | objectives that you work through are the deliverables that go to 296.91s - 301.01s | a regulatory body. In the U.S., that would be the FAA. Over in 301.01s - 303.85s | Europe, that would be EASA. If you have dual use between the 303.85s - 307.19s | two of them, it will be shared between the two of them. Those 307.19s - 311.49s | documents are the proof that you did the work. You have to prove 311.51s - 316.29s | that you did the operations and did the work. So as you have a 316.29s - 320.09s | higher DAO level, so DAO A would have the most stringent. What's 320.09s - 324.43s | unique about DAO A is that there is a required independence in 324.43s - 329.53s | the testing. Which means the person who developed the system 329.53s - 332.53s | cannot be the one who has tested the system. It has to be a 332.53s - 336.67s | completely independent body that does the verification of your 336.67s - 340.71s | code or of your system, of your hardware to ensure that there is 340.73s - 343.77s | independence between the developers and the test teams. 343.77s - 350.66s | All right. So now you all are experts on safety. So now as we 350.66s - 357.38s | move forward, we start to talk about what DO356A is. So DO356A 357.38s - 360.74s | defines the cybersecurity development objectives for 360.74s - 365.98s | aircraft systems. One of the most important concepts in that 365.98s - 370.82s | is this concept of IUEI, which is intentional, unauthorized, 370.84s - 375.34s | electronic interactions. What it means is that someone has to be 375.34s - 380.22s | doing an attack intentionally. They did not have authorization 380.22s - 384.76s | for the system. It has to be electronic interactions. So no, 384.76s - 388.22s | birds flying, we know that they're not real. Birds flying 388.22s - 393.60s | into engines do not count. Right? That's not intentional by 393.60s - 398.60s | the bird to do that. So this is what makes security threats 401.60s - 407.60s | different from safety threats


chunk_text:
does the verification of your 336.67s - 340.71s | code or of your system, of your hardware to ensure that there is 340.73s - 343.77s | independence between the developers and the test teams. 343.77s - 350.66s | All right. So now you all are experts on safety. So now as we 350.66s - 357.38s | move forward, we start to talk about what DO356A is. So DO356A 357.38s - 360.74s | defines the cybersecurity development objectives for 360.74s - 365.98s | aircraft systems. One of the most important concepts in that 365.98s - 370.82s | is this concept of IUEI, which is intentional, unauthorized, 370.84s - 375.34s | electronic interactions. What it means is that someone has to be 375.34s - 380.22s | doing an attack intentionally. They did not have authorization 380.22s - 384.76s | for the system. It has to be electronic interactions. So no, 384.76s - 388.22s | birds flying, we know that they're not real. Birds flying 388.22s - 393.60s | into engines do not count. Right? That's not intentional by 393.60s - 398.60s | the bird to do that. So this is what makes security threats 401.60s - 407.60s | different from safety threats in our system development. But how 407.60s - 410.52s | we develop our systems around the two of them kind of start to 410.52s - 415.52s | touch. So safety is more of a kind of a what and why questions 415.52s - 419.96s | of how all these unintended adverse effects happen within 419.96s - 424.36s | systems operation. Security looks at more of the who and 424.36s - 429.44s | where questions. Right? We care more about who's doing it and 430.08s - 432.62s | what systems they're touching because they should not have 432.62s - 436.72s | access to certain systems within security boundaries and other 436.72s - 442.26s | places. Where the safety and security meet is in the how. How 442.26s - 446.00s | these events can happen so that we can mitigate the effects of 446.00s - 452.69s | those faults and the manipulation. All right? So 356 452.69s - 458.69s | brings in a new concept of SAL. SAL is not directly tied to DAL 459.29s - 463.19s | despite what a lot of people like to talk about with this. 463.19s - 466.47s | But what it is is if you look


chunk_text:
in our system development. But how 407.60s - 410.52s | we develop our systems around the two of them kind of start to 410.52s - 415.52s | touch. So safety is more of a kind of a what and why questions 415.52s - 419.96s | of how all these unintended adverse effects happen within 419.96s - 424.36s | systems operation. Security looks at more of the who and 424.36s - 429.44s | where questions. Right? We care more about who's doing it and 430.08s - 432.62s | what systems they're touching because they should not have 432.62s - 436.72s | access to certain systems within security boundaries and other 436.72s - 442.26s | places. Where the safety and security meet is in the how. How 442.26s - 446.00s | these events can happen so that we can mitigate the effects of 446.00s - 452.69s | those faults and the manipulation. All right? So 356 452.69s - 458.69s | brings in a new concept of SAL. SAL is not directly tied to DAL 459.29s - 463.19s | despite what a lot of people like to talk about with this. 463.19s - 466.47s | But what it is is if you look at that table at the top, table 4 466.47s - 472.07s | 4 which is taken directly out of DO356A, it gives you a threat 472.07s - 476.11s | condition effect severity which kind of looks a lot like the 476.11s - 481.21s | advisory circulars with the definitions and gives you SAL 481.21s - 485.05s | levels for that mitigation. But what's unique here is that 485.05s - 490.39s | something that has an effect condition of catastrophic all of 490.39s - 494.43s | a sudden has these two SAL levels. Right? That's kind of 494.43s - 499.73s | weird. Why would you do two SAL levels? The big part about 499.73s - 503.13s | security development is that we look at individual threat 503.13s - 506.17s | vectors as it moves through a system because we have to look 506.17s - 510.07s | at every point in which it could touch a system and have a final 510.07s - 514.25s | effect that may or may not have a safety effect on the entire 514.25s - 518.49s | aircraft. So if we do have an effect on the entire aircraft, 518.49s - 521.99s | we have to go


chunk_text:
at that table at the top, table 4 466.47s - 472.07s | 4 which is taken directly out of DO356A, it gives you a threat 472.07s - 476.11s | condition effect severity which kind of looks a lot like the 476.11s - 481.21s | advisory circulars with the definitions and gives you SAL 481.21s - 485.05s | levels for that mitigation. But what's unique here is that 485.05s - 490.39s | something that has an effect condition of catastrophic all of 490.39s - 494.43s | a sudden has these two SAL levels. Right? That's kind of 494.43s - 499.73s | weird. Why would you do two SAL levels? The big part about 499.73s - 503.13s | security development is that we look at individual threat 503.13s - 506.17s | vectors as it moves through a system because we have to look 506.17s - 510.07s | at every point in which it could touch a system and have a final 510.07s - 514.25s | effect that may or may not have a safety effect on the entire 514.25s - 518.49s | aircraft. So if we do have an effect on the entire aircraft, 518.49s - 521.99s | we have to go back through our safety analyses and we have to 521.99s - 526.79s | place mitigations, two of them in this case, of SAL 3 and SAL 526.79s - 532.23s | 2 in our system to prevent a catastrophic threat condition. 532.23s - 539.11s | So those mitigations have to be developed with security 539.11s - 544.31s | objectives, the design objectives for SAL 3 and SAL 2. 544.31s - 549.11s | So if you're developing a system and if you look at the actual 551.39s - 555.85s | security assurance level objectives, they look very, very, 555.85s - 561.63s | very similar to exactly what DO-178 and DO-254 because all 561.63s - 565.27s | these documents are in concert with one another. They all feed 565.27s - 568.37s | from one another. They all use a lot of same concepts from one 568.39s - 573.57s | another. They all try to use the same structures. So that makes 573.57s - 578.17s | it really easy for us to take our cyber security mitigations 578.17s - 584.31s | and place them into software or hardware and have the process 584.31s - 590.10s | look the same for development. Alright? So we're


chunk_text:
back through our safety analyses and we have to 521.99s - 526.79s | place mitigations, two of them in this case, of SAL 3 and SAL 526.79s - 532.23s | 2 in our system to prevent a catastrophic threat condition. 532.23s - 539.11s | So those mitigations have to be developed with security 539.11s - 544.31s | objectives, the design objectives for SAL 3 and SAL 2. 544.31s - 549.11s | So if you're developing a system and if you look at the actual 551.39s - 555.85s | security assurance level objectives, they look very, very, 555.85s - 561.63s | very similar to exactly what DO-178 and DO-254 because all 561.63s - 565.27s | these documents are in concert with one another. They all feed 565.27s - 568.37s | from one another. They all use a lot of same concepts from one 568.39s - 573.57s | another. They all try to use the same structures. So that makes 573.57s - 578.17s | it really easy for us to take our cyber security mitigations 578.17s - 584.31s | and place them into software or hardware and have the process 584.31s - 590.10s | look the same for development. Alright? So we're going to do a 590.10s - 594.66s | little bit of a safety analysis on a system, right? So we have 594.66s - 597.68s | system A, we have system B, we have system C. And then we have 597.70s - 601.34s | a user display, right? It could be any sort of function here. 601.34s - 604.34s | So we do our functional hazardous assessment and it says 604.34s - 610.58s | that this system has a function that is DAL B. Okay? So we're 610.58s - 615.92s | looking at a path of DAL B, uh, hazardously misleading data to 615.92s - 619.08s | a display. And what we're going to do is we're going to apply 619.08s - 622.16s | safety requirements onto this system. So we add in some 622.16s - 626.40s | monitors for failures and we'll enunciate those. We check the 626.42s - 630.02s | validity of the inputs. We check the, uh, at system B and system 630.02s - 633.12s | C, right? System B is just going to do a really simple operation 633.12s - 636.96s | of adding something on there. It could be either, uh, changing 636.96s - 643.96s |


chunk_text:
going to do a 590.10s - 594.66s | little bit of a safety analysis on a system, right? So we have 594.66s - 597.68s | system A, we have system B, we have system C. And then we have 597.70s - 601.34s | a user display, right? It could be any sort of function here. 601.34s - 604.34s | So we do our functional hazardous assessment and it says 604.34s - 610.58s | that this system has a function that is DAL B. Okay? So we're 610.58s - 615.92s | looking at a path of DAL B, uh, hazardously misleading data to 615.92s - 619.08s | a display. And what we're going to do is we're going to apply 619.08s - 622.16s | safety requirements onto this system. So we add in some 622.16s - 626.40s | monitors for failures and we'll enunciate those. We check the 626.42s - 630.02s | validity of the inputs. We check the, uh, at system B and system 630.02s - 633.12s | C, right? System B is just going to do a really simple operation 633.12s - 636.96s | of adding something on there. It could be either, uh, changing 636.96s - 643.96s | data or manipulating data or, um, merging data at some points. 643.96s - 645.94s | And now what we're going to do is we're going to look at a 645.94s - 649.74s | threat. We have an attack that modifies code or memory and 649.74s - 655.82s | changes that to 204. That's pretty bad. Um, don't know how 655.86s - 659.34s | they managed to do that. But when we look at this system, 659.34s - 661.44s | there's erroneous data that's now flowing through the system, 661.44s - 665.64s | right? This is the hazard effect that we're looking at. We're 665.64s - 670.54s | looking at how the, uh, we can cause hazardously misleading 670.54s - 676.86s | data DAL B impacts to the system. So, fine, guess what? 676.86s - 678.98s | We're going to hash the memory spaces so that none of that 678.98s - 682.12s | changes, right? We're going to put hashes in place so that the 682.12s - 685.56s | values that we're adding or subtracting or, uh, changing 686.30s - 690.28s | around, the whole memory spaces are then hashed, right? And 690.28s - 694.08s | we'll get back to why


chunk_text:
data or manipulating data or, um, merging data at some points. 643.96s - 645.94s | And now what we're going to do is we're going to look at a 645.94s - 649.74s | threat. We have an attack that modifies code or memory and 649.74s - 655.82s | changes that to 204. That's pretty bad. Um, don't know how 655.86s - 659.34s | they managed to do that. But when we look at this system, 659.34s - 661.44s | there's erroneous data that's now flowing through the system, 661.44s - 665.64s | right? This is the hazard effect that we're looking at. We're 665.64s - 670.54s | looking at how the, uh, we can cause hazardously misleading 670.54s - 676.86s | data DAL B impacts to the system. So, fine, guess what? 676.86s - 678.98s | We're going to hash the memory spaces so that none of that 678.98s - 682.12s | changes, right? We're going to put hashes in place so that the 682.12s - 685.56s | values that we're adding or subtracting or, uh, changing 686.30s - 690.28s | around, the whole memory spaces are then hashed, right? And 690.28s - 694.08s | we'll get back to why I picked hashing in the first place. 694.08s - 696.54s | Safety analysis also said that there has to be a system B 696.54s - 700.82s | prime, which is a secondary thread to the system so that, 700.82s - 705.16s | um, system, uh, C merges data from both system B and system B 705.16s - 709.82s | prime. Kind of looks a lot like what we do for pilot side, 709.82s - 715.06s | copilot side in aircraft. Oh, there was another attack that 715.06s - 720.16s | our, our pen testing team came up with. They flooded the 720.16s - 722.90s | interface. They did a DDoS attack on our system C and 722.90s - 726.38s | prevented data from going through to the user display. 726.38s - 730.88s | Crashed the system. Well, I guess we need to go through and 730.88s - 733.72s | put it together another mitigation. So now we're going 733.72s - 736.58s | to need some sort of DDoS protection, some sort of rate 736.58s - 741.60s | limiting in there. It's a pretty secure system so far. Except 744.16s - 748.50s | they found a third attack, which is actually


chunk_text:
I picked hashing in the first place. 694.08s - 696.54s | Safety analysis also said that there has to be a system B 696.54s - 700.82s | prime, which is a secondary thread to the system so that, 700.82s - 705.16s | um, system, uh, C merges data from both system B and system B 705.16s - 709.82s | prime. Kind of looks a lot like what we do for pilot side, 709.82s - 715.06s | copilot side in aircraft. Oh, there was another attack that 715.06s - 720.16s | our, our pen testing team came up with. They flooded the 720.16s - 722.90s | interface. They did a DDoS attack on our system C and 722.90s - 726.38s | prevented data from going through to the user display. 726.38s - 730.88s | Crashed the system. Well, I guess we need to go through and 730.88s - 733.72s | put it together another mitigation. So now we're going 733.72s - 736.58s | to need some sort of DDoS protection, some sort of rate 736.58s - 741.60s | limiting in there. It's a pretty secure system so far. Except 744.16s - 748.50s | they found a third attack, which is actually a mode command that 748.50s - 752.34s | sent into systems, injected at system C, which then back 752.34s - 756.38s | propagates through the system to system A, which changes a mode, 756.38s - 760.08s | which then forces data to come out incorrectly without a pilot 760.08s - 765.28s | commanding a mode change. So you see how there's kind of a 765.28s - 768.42s | non-linearity through these systems where you could get 768.42s - 772.30s | these system effects without having exactly, um, changed or 772.30s - 776.68s | manipulated or without having commanded, uh, uh, commands be 776.68s - 781.64s | sent and get unintentional data that was not supposed to be 781.64s - 784.74s | there without some sort of other checks, right? So a lot of 784.74s - 788.38s | aircraft systems, it's not just that we press a button and the 788.38s - 791.36s | mode comes through. You press a button, it goes through, it 791.36s - 794.36s | sends back bits that says, yes, I saw that you changed the 794.36s - 798.92s | command of the mode. Here's the new mode information. But what's 798.92s - 802.88s | unique


chunk_text:
a mode command that 748.50s - 752.34s | sent into systems, injected at system C, which then back 752.34s - 756.38s | propagates through the system to system A, which changes a mode, 756.38s - 760.08s | which then forces data to come out incorrectly without a pilot 760.08s - 765.28s | commanding a mode change. So you see how there's kind of a 765.28s - 768.42s | non-linearity through these systems where you could get 768.42s - 772.30s | these system effects without having exactly, um, changed or 772.30s - 776.68s | manipulated or without having commanded, uh, uh, commands be 776.68s - 781.64s | sent and get unintentional data that was not supposed to be 781.64s - 784.74s | there without some sort of other checks, right? So a lot of 784.74s - 788.38s | aircraft systems, it's not just that we press a button and the 788.38s - 791.36s | mode comes through. You press a button, it goes through, it 791.36s - 794.36s | sends back bits that says, yes, I saw that you changed the 794.36s - 798.92s | command of the mode. Here's the new mode information. But what's 798.92s - 802.88s | unique about this is that that mode command may have also 802.88s - 806.52s | propagated back through the B prime and A prime systems 806.52s - 811.70s | through the secondary thread and has also manipulate, uh, changed 811.70s - 817.24s | those modes, which gets around our cross-checking in system C. 817.24s - 820.80s | So now a system, uh, so the, um, the primary thread and the 820.80s - 824.64s | secondary threads are now sending the same data, valid 824.64s - 831.47s | data, across and it's not being picked up by system C. So what's 831.47s - 834.97s | interesting about this whole development here is that where 834.97s - 838.25s | safety and, and security really touch is some of the 838.25s - 843.21s | implementations that we actually have here. So you take a look at 843.21s - 850.99s | system B and we applied hashing memory. Our safety analysis also 850.99s - 854.19s | came back and said that B prime needed to be added as a safety 854.21s - 858.89s | mitigation on the system. But what does that do for the safe, 858.89s - 863.63s | or security of the system?


chunk_text:
about this is that that mode command may have also 802.88s - 806.52s | propagated back through the B prime and A prime systems 806.52s - 811.70s | through the secondary thread and has also manipulate, uh, changed 811.70s - 817.24s | those modes, which gets around our cross-checking in system C. 817.24s - 820.80s | So now a system, uh, so the, um, the primary thread and the 820.80s - 824.64s | secondary threads are now sending the same data, valid 824.64s - 831.47s | data, across and it's not being picked up by system C. So what's 831.47s - 834.97s | interesting about this whole development here is that where 834.97s - 838.25s | safety and, and security really touch is some of the 838.25s - 843.21s | implementations that we actually have here. So you take a look at 843.21s - 850.99s | system B and we applied hashing memory. Our safety analysis also 850.99s - 854.19s | came back and said that B prime needed to be added as a safety 854.21s - 858.89s | mitigation on the system. But what does that do for the safe, 858.89s - 863.63s | or security of the system? Right? Now I have a secondary 863.63s - 867.19s | thread that I can cross-check data against. An independent 867.19s - 872.27s | thread that somebody may not have access to that I can ensure 872.27s - 876.21s | that is part of the whole security, um, posture of this 876.21s - 882.05s | whole entire system. So hashing memory is a great one, right? We 882.07s - 886.01s | use it in, uh, cyber security in order to, um, prevent 886.01s - 889.75s | manipulation, intentional manipulation of memory spaces. 889.75s - 893.79s | Well, over on the aerospace, or on the safety side, they do that 893.79s - 896.99s | sort of stuff to prevent accidental manipulations from 896.99s - 901.19s | like, I don't know, uh, single event upsets from the sun, 901.19s - 906.67s | right? Neutron events on memory spaces. Um, other areas would be 906.67s - 910.81s | like duplicating or, uh, triplicating data stored across 910.83s - 913.97s | the system. So that if you have manipulation in one place, you 913.97s - 916.33s | can go pick it up in another place, and if that one's still 916.33s - 919.51s | manipulated,


chunk_text:
Right? Now I have a secondary 863.63s - 867.19s | thread that I can cross-check data against. An independent 867.19s - 872.27s | thread that somebody may not have access to that I can ensure 872.27s - 876.21s | that is part of the whole security, um, posture of this 876.21s - 882.05s | whole entire system. So hashing memory is a great one, right? We 882.07s - 886.01s | use it in, uh, cyber security in order to, um, prevent 886.01s - 889.75s | manipulation, intentional manipulation of memory spaces. 889.75s - 893.79s | Well, over on the aerospace, or on the safety side, they do that 893.79s - 896.99s | sort of stuff to prevent accidental manipulations from 896.99s - 901.19s | like, I don't know, uh, single event upsets from the sun, 901.19s - 906.67s | right? Neutron events on memory spaces. Um, other areas would be 906.67s - 910.81s | like duplicating or, uh, triplicating data stored across 910.83s - 913.97s | the system. So that if you have manipulation in one place, you 913.97s - 916.33s | can go pick it up in another place, and if that one's still 916.33s - 919.51s | manipulated, you can go and pick it up somewhere else and 919.51s - 923.27s | cross-check those three, uh, three different memory spaces. 923.27s - 928.29s | So safety and security have to kind of be developed together in 930.39s - 938.11s | these systems. Because you have these, uh, concepts in here of 938.11s - 941.11s | inherited security principles, or, uh, properties of the 941.13s - 946.87s | system. Say, uh, security is not the only developer of the 946.87s - 950.87s | system. Safety's doing it. Implementers of code are doing 950.87s - 953.81s | this. They're developing their own requirements with how they 953.81s - 957.81s | either think the system should work, or how the system has been 957.81s - 962.39s | developed in the past, and how other systems have been, uh, 962.39s - 967.29s | have been developed. And so, we have to take a look at not just 967.31s - 971.95s | security requirements, we have to look at the entire system 971.95s - 976.39s | requirements pool to see which items might be part of the safe, 976.39s - 979.89s | uh, security posture of the system. The reason why we want


chunk_text:
you can go and pick it up somewhere else and 919.51s - 923.27s | cross-check those three, uh, three different memory spaces. 923.27s - 928.29s | So safety and security have to kind of be developed together in 930.39s - 938.11s | these systems. Because you have these, uh, concepts in here of 938.11s - 941.11s | inherited security principles, or, uh, properties of the 941.13s - 946.87s | system. Say, uh, security is not the only developer of the 946.87s - 950.87s | system. Safety's doing it. Implementers of code are doing 950.87s - 953.81s | this. They're developing their own requirements with how they 953.81s - 957.81s | either think the system should work, or how the system has been 957.81s - 962.39s | developed in the past, and how other systems have been, uh, 962.39s - 967.29s | have been developed. And so, we have to take a look at not just 967.31s - 971.95s | security requirements, we have to look at the entire system 971.95s - 976.39s | requirements pool to see which items might be part of the safe, 976.39s - 979.89s | uh, security posture of the system. The reason why we want 979.89s - 981.99s | to do that is because we're going to take credit for those 981.99s - 986.67s | in our threat models at some point. And if you take credit 986.67s - 989.43s | for them in your threat models, you have to provide the 989.43s - 992.87s | documentation as part of the design objectives. And if you 992.87s - 995.67s | have to provide data as part of your design objectives, it's 995.69s - 998.03s | part of your certification baseline, and you want to take 998.03s - 1001.89s | that credit for it. It all comes back down to the standards and 1001.89s - 1008.32s | the certification of these systems. Another important, uh, 1008.32s - 1014.26s | piece in here is that you can also have system effects where 1014.26s - 1018.76s | safety and security may interact with each other in a negative 1018.76s - 1023.30s | manner. Where one may trigger, you might want to, you know, 1023.32s - 1027.28s | trigger a safety event, or you have an event that triggers some 1027.28s - 1032.10s | safety safeguards that have been in place, and the security of the 1032.10s - 1034.76s


chunk_text:
979.89s - 981.99s | to do that is because we're going to take credit for those 981.99s - 986.67s | in our threat models at some point. And if you take credit 986.67s - 989.43s | for them in your threat models, you have to provide the 989.43s - 992.87s | documentation as part of the design objectives. And if you 992.87s - 995.67s | have to provide data as part of your design objectives, it's 995.69s - 998.03s | part of your certification baseline, and you want to take 998.03s - 1001.89s | that credit for it. It all comes back down to the standards and 1001.89s - 1008.32s | the certification of these systems. Another important, uh, 1008.32s - 1014.26s | piece in here is that you can also have system effects where 1014.26s - 1018.76s | safety and security may interact with each other in a negative 1018.76s - 1023.30s | manner. Where one may trigger, you might want to, you know, 1023.32s - 1027.28s | trigger a safety event, or you have an event that triggers some 1027.28s - 1032.10s | safety safeguards that have been in place, and the security of the 1032.10s - 1034.76s | system is reduced because systems have now been reset and 1034.76s - 1040.14s | they lost state. You might have security implementations in 1040.14s - 1044.18s | there, where it prevents data from cross flowing from one side 1044.18s - 1049.04s | to another, or, um, you might have other pieces where data's 1049.04s - 1052.02s | unavailable because it's been encrypted, that affects the 1052.04s - 1056.90s | safety of the system. So it's very important to look at how 1056.90s - 1060.92s | safety and security interplay in the requirements and determine, 1060.92s - 1064.48s | like, is this a positive or a negative, um, part of our 1064.48s - 1069.48s | system. So, um, in summary, aircraft cybersecurity is very 1071.72s - 1076.72s | young. DO- uh, DO-356 was first released in about, in, uh, 2014. 1077.20s - 1084.64s | In comparison to the advisory circular that I showed you at 1084.64s - 1089.64s | first, AC, uh, 25-13-07, that was released in 88. We've had 1092.58s - 1098.94s | these de- these definitions around in, um, in aviation for 1098.94s - 1105.36s | almost 40 years. 40 years of development time to learn how to


chunk_text:
| system is reduced because systems have now been reset and 1034.76s - 1040.14s | they lost state. You might have security implementations in 1040.14s - 1044.18s | there, where it prevents data from cross flowing from one side 1044.18s - 1049.04s | to another, or, um, you might have other pieces where data's 1049.04s - 1052.02s | unavailable because it's been encrypted, that affects the 1052.04s - 1056.90s | safety of the system. So it's very important to look at how 1056.90s - 1060.92s | safety and security interplay in the requirements and determine, 1060.92s - 1064.48s | like, is this a positive or a negative, um, part of our 1064.48s - 1069.48s | system. So, um, in summary, aircraft cybersecurity is very 1071.72s - 1076.72s | young. DO- uh, DO-356 was first released in about, in, uh, 2014. 1077.20s - 1084.64s | In comparison to the advisory circular that I showed you at 1084.64s - 1089.64s | first, AC, uh, 25-13-07, that was released in 88. We've had 1092.58s - 1098.94s | these de- these definitions around in, um, in aviation for 1098.94s - 1105.36s | almost 40 years. 40 years of development time to learn how to 1105.36s - 1109.24s | do all these development principles with how to develop 1109.24s - 1113.58s | safe or safe code, how to device, uh, develop safe 1113.58s - 1117.98s | hardware, has been going on for a very long time. But the 1117.98s - 1120.38s | security of these systems, because they're becoming more 1120.38s - 1125.28s | and more connected and, um, even more highly connected in real 1125.28s - 1130.28s | time in the future, these systems need better security 1130.28s - 1134.20s | principles that work with how the systems are developed in 1134.20s - 1142.19s | order to provide certification boundaries. To touch upon the 1142.19s - 1145.73s | technological limitations, prior systems in the past used to have 1145.73s - 1150.43s | federated systems where you had multiple single purpose systems 1150.43s - 1154.93s | on board, which then moved into more highly integrated systems, 1154.93s - 1157.61s | which then moved into more highly, uh, integrated 1157.61s - 1162.47s | networking systems as well. So those boundaries of, um, data 1162.47s - 1167.17s | that you couldn't get security issues across because of the 1167.17s - 1171.07s | highly federated nature of these


chunk_text:
1105.36s - 1109.24s | do all these development principles with how to develop 1109.24s - 1113.58s | safe or safe code, how to device, uh, develop safe 1113.58s - 1117.98s | hardware, has been going on for a very long time. But the 1117.98s - 1120.38s | security of these systems, because they're becoming more 1120.38s - 1125.28s | and more connected and, um, even more highly connected in real 1125.28s - 1130.28s | time in the future, these systems need better security 1130.28s - 1134.20s | principles that work with how the systems are developed in 1134.20s - 1142.19s | order to provide certification boundaries. To touch upon the 1142.19s - 1145.73s | technological limitations, prior systems in the past used to have 1145.73s - 1150.43s | federated systems where you had multiple single purpose systems 1150.43s - 1154.93s | on board, which then moved into more highly integrated systems, 1154.93s - 1157.61s | which then moved into more highly, uh, integrated 1157.61s - 1162.47s | networking systems as well. So those boundaries of, um, data 1162.47s - 1167.17s | that you couldn't get security issues across because of the 1167.17s - 1171.07s | highly federated nature of these systems is now being whittled 1171.07s - 1173.81s | away at as part of the development because of the 1173.81s - 1178.95s | demands of higher speed buses. Airing 429 is not fast at all, 1178.95s - 1184.29s | but Ethernet is, and we can do that deterministically. The way 1184.29s - 1188.73s | that security, um, brings those direct impacts has to be 1188.75s - 1192.53s | developed as part of the architecture because in the end, 1192.53s - 1196.53s | you can't have a safe system with also having a cyber secure 1196.53s - 1198.03s | system. Thank you.


chunk_text:
systems is now being whittled 1171.07s - 1173.81s | away at as part of the development because of the 1173.81s - 1178.95s | demands of higher speed buses. Airing 429 is not fast at all, 1178.95s - 1184.29s | but Ethernet is, and we can do that deterministically. The way 1184.29s - 1188.73s | that security, um, brings those direct impacts has to be 1188.75s - 1192.53s | developed as part of the architecture because in the end, 1192.53s - 1196.53s | you can't have a safe system with also having a cyber secure 1196.53s - 1198.03s | system. Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=p1H6-0clP7U", "title": "DEF CON 32 - RF Attacks on Aviation's Defense Against Mid-Air Collisions - G. Longo, V. Lenders", "description": "Aviation's Traffic Collision Avoidance System (TCAS) II has been touted as a foolproof safety net since its introduction in the 1980s. But what if we told you that this supposedly impenetrable system can be compromised? For years, attacks on TCAS have been mere theoretical exercises, foiled by an (accidental) built in security feature. That is, until now. In this presentation, we'll reveal the first working RF attacks on TCAS II, demonstrating how to hijack collision avoidance displays and create fake Traffic Advisories (TAs) and Resolution Advisories (RAs). We'll walk you through the technical challenges of building the necessary tooling using commercial off-the-shelf hardware.\n\nBut that's not all. Our research has also uncovered a second attack capable of remotely disabling an aircraft's TCAS capabilities, rendering it vulnerable to mid-air collisions. The implications are clear: if our findings can be exploited in real-world scenarios, the safety of millions of passengers hangs in the balance. Join us as we lift the lid on this shocking vulnerability and explore the dark side of aviation security.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1581, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.08s - 6.20s | This text was transcribed using whisper model: large-v2 Hello everybody, so welcome to our presentation on the radio frequency attacks on the 6.76s - 11.00s | Aviation's last line of defense against media collisions 11.32s - 18.68s | It will be a talk on the attacks on the traffic collision avoiding system in aviation the so-called TCAS 19.36s - 26.44s | So my name is Vincent Lenders. I'm a cyber security researcher for most more than 20 years focusing on 26.96s - 33.12s | The security of wireless networks and I'm also the director of the cyber defense campus in Switzerland 33.28s - 37.20s | I'll be giving this talk together with Giacomo. I'm Giacomo 37.20s - 40.60s | I'm a third year PhD student from Italy in the University of Genoa 40.60s - 47.48s | And I work also on radio security of the Onyx and maritime systems as well. So but go on Vincent 48.88s - 53.44s | So the air traffic control is a key infrastructure 54.44s - 59.44s | For safe air travel today with more than 30 millions 60.12s - 62.12s | flights per year worldwide 62.24s -


chunk_text:
"upload_date": "20241016" } 0.08s - 6.20s | This text was transcribed using whisper model: large-v2 Hello everybody, so welcome to our presentation on the radio frequency attacks on the 6.76s - 11.00s | Aviation's last line of defense against media collisions 11.32s - 18.68s | It will be a talk on the attacks on the traffic collision avoiding system in aviation the so-called TCAS 19.36s - 26.44s | So my name is Vincent Lenders. I'm a cyber security researcher for most more than 20 years focusing on 26.96s - 33.12s | The security of wireless networks and I'm also the director of the cyber defense campus in Switzerland 33.28s - 37.20s | I'll be giving this talk together with Giacomo. I'm Giacomo 37.20s - 40.60s | I'm a third year PhD student from Italy in the University of Genoa 40.60s - 47.48s | And I work also on radio security of the Onyx and maritime systems as well. So but go on Vincent 48.88s - 53.44s | So the air traffic control is a key infrastructure 54.44s - 59.44s | For safe air travel today with more than 30 millions 60.12s - 62.12s | flights per year worldwide 62.24s - 66.96s | The air traffic management is nowadays very complex a thing 67.20s - 72.36s | So air traffic control helps organizing and optimizing the air traffic flow 72.48s - 77.34s | It provides situation awareness to ground controllers and also support 77.70s - 85.30s | To pilots and a very important feature of the air traffic control is to prevent media collisions 86.46s - 92.66s | So if we look at air traffic control, there are mainly there are different procedures and technologies 93.26s - 96.50s | for this and there are if mainly three 97.46s - 102.58s | Technologies that I would like to introduce and are important for for their traffic control 102.58s - 109.50s | They are all three based on modest. Well, this is a data frame a format similar to in the Internet's as IP 110.10s - 114.74s | That allows for for wireless communication between aircraft and ground station 115.54s - 117.22s | so the first 117.22s - 120.34s | Technology is secondary surveillance radar called SSR 120.94s - 126.70s | The second one is a DSP and then the third one that will be the main focus of this presentation in this


chunk_text:
66.96s | The air traffic management is nowadays very complex a thing 67.20s - 72.36s | So air traffic control helps organizing and optimizing the air traffic flow 72.48s - 77.34s | It provides situation awareness to ground controllers and also support 77.70s - 85.30s | To pilots and a very important feature of the air traffic control is to prevent media collisions 86.46s - 92.66s | So if we look at air traffic control, there are mainly there are different procedures and technologies 93.26s - 96.50s | for this and there are if mainly three 97.46s - 102.58s | Technologies that I would like to introduce and are important for for their traffic control 102.58s - 109.50s | They are all three based on modest. Well, this is a data frame a format similar to in the Internet's as IP 110.10s - 114.74s | That allows for for wireless communication between aircraft and ground station 115.54s - 117.22s | so the first 117.22s - 120.34s | Technology is secondary surveillance radar called SSR 120.94s - 126.70s | The second one is a DSP and then the third one that will be the main focus of this presentation in this a traffic 127.06s - 132.06s | Collision collisions avoiding system. So let me start with secondary surveillance radar 132.06s - 133.86s | This is the oldest 133.86s - 135.30s | technology 135.30s - 140.38s | It's it's based on ground stations on radar. So the radars their interrogate 141.42s - 143.42s | aircraft using this modest 144.82s - 147.66s | Format the protocol on an uplink on the 148.22s - 153.26s | 1030 megahertz uplink and then the aircraft they respond on a downlink on one 154.26s - 155.86s | 1090 megahertz 155.86s - 157.86s | the modest downlink 158.14s - 163.70s | So these messages are very small in contrast to IP package packets which can be like 164.70s - 168.86s | 1,500 bytes this message is very small 56 or 112 bits 169.58s - 172.54s | but they can entail a lot of information such as the 173.06s - 178.94s | Velocity altitude and heading and so on of the aircraft. So this is how this is working 178.94s - 183.74s | This is a kind of an old technology. It's also mandatory and used in all 184.98s - 187.10s | In all our spaces around the world


chunk_text:
a traffic 127.06s - 132.06s | Collision collisions avoiding system. So let me start with secondary surveillance radar 132.06s - 133.86s | This is the oldest 133.86s - 135.30s | technology 135.30s - 140.38s | It's it's based on ground stations on radar. So the radars their interrogate 141.42s - 143.42s | aircraft using this modest 144.82s - 147.66s | Format the protocol on an uplink on the 148.22s - 153.26s | 1030 megahertz uplink and then the aircraft they respond on a downlink on one 154.26s - 155.86s | 1090 megahertz 155.86s - 157.86s | the modest downlink 158.14s - 163.70s | So these messages are very small in contrast to IP package packets which can be like 164.70s - 168.86s | 1,500 bytes this message is very small 56 or 112 bits 169.58s - 172.54s | but they can entail a lot of information such as the 173.06s - 178.94s | Velocity altitude and heading and so on of the aircraft. So this is how this is working 178.94s - 183.74s | This is a kind of an old technology. It's also mandatory and used in all 184.98s - 187.10s | In all our spaces around the world 187.86s - 194.70s | Now we have the automatic dependent surveillance broadcast. It's more recent. It has been mandated by the last years 195.22s - 200.18s | in various airspaces and this is also based on modest but 200.78s - 208.46s | Instead of having the radars interrogating the aircraft. We have the aircraft determining their own position using GNSS 208.98s - 210.98s | using for example GPS and 211.18s - 218.10s | When they know they are on location they broadcast this information of a modest to surrounding aircraft and also to 218.34s - 219.82s | ground stations 219.82s - 227.54s | So this is a more precise than secondary radar a much more precise GPS gives you a few meters accuracy 227.82s - 230.90s | Compared to a few hundred meters for secondary radar 230.90s - 236.94s | So it's it's welcome to also decrease the separation between the aircraft because of the higher precision 237.94s - 244.06s | Now we come to the the focus of this talk, which is the traffic alert and collision avoiding system 244.38s - 246.38s | It's a protocol 246.42s - 248.42s | between the aircraft 249.26s - 254.66s | so basically,


chunk_text:
187.86s - 194.70s | Now we have the automatic dependent surveillance broadcast. It's more recent. It has been mandated by the last years 195.22s - 200.18s | in various airspaces and this is also based on modest but 200.78s - 208.46s | Instead of having the radars interrogating the aircraft. We have the aircraft determining their own position using GNSS 208.98s - 210.98s | using for example GPS and 211.18s - 218.10s | When they know they are on location they broadcast this information of a modest to surrounding aircraft and also to 218.34s - 219.82s | ground stations 219.82s - 227.54s | So this is a more precise than secondary radar a much more precise GPS gives you a few meters accuracy 227.82s - 230.90s | Compared to a few hundred meters for secondary radar 230.90s - 236.94s | So it's it's welcome to also decrease the separation between the aircraft because of the higher precision 237.94s - 244.06s | Now we come to the the focus of this talk, which is the traffic alert and collision avoiding system 244.38s - 246.38s | It's a protocol 246.42s - 248.42s | between the aircraft 249.26s - 254.66s | so basically, it's a ranging distance ranging protocol based on request replies also on the 256.50s - 259.32s | 1,030 megahertz uplink and on the 260.78s - 262.78s | 1,090 megahertz downlink 263.30s - 265.02s | There are the responses 265.02s - 269.94s | so it's there are a lot a lot a few interrogations replies that happen to basically 270.50s - 276.50s | Determine how if a collision is going on and how to avoid this collision. This is a very important 277.78s - 279.78s | system because it's the last line of 280.10s - 286.42s | defense against media conditions collisions if the other systems are failed like 287.10s - 290.66s | Secondary radar or ADS-B and it was not possible to keep the separation 290.66s - 296.10s | This one's kicks in and will make sure that there are no collisions 296.68s - 302.70s | So why is this important? Well, it's kind of obvious. It goes it's all about human life if there is a 303.22s - 305.02s | aircraft collision 305.02s - 307.02s | that this will lead to a 307.54s - 311.10s | Catastrophic event we had in the 70s, for example 311.94s - 313.94s |


chunk_text:
it's a ranging distance ranging protocol based on request replies also on the 256.50s - 259.32s | 1,030 megahertz uplink and on the 260.78s - 262.78s | 1,090 megahertz downlink 263.30s - 265.02s | There are the responses 265.02s - 269.94s | so it's there are a lot a lot a few interrogations replies that happen to basically 270.50s - 276.50s | Determine how if a collision is going on and how to avoid this collision. This is a very important 277.78s - 279.78s | system because it's the last line of 280.10s - 286.42s | defense against media conditions collisions if the other systems are failed like 287.10s - 290.66s | Secondary radar or ADS-B and it was not possible to keep the separation 290.66s - 296.10s | This one's kicks in and will make sure that there are no collisions 296.68s - 302.70s | So why is this important? Well, it's kind of obvious. It goes it's all about human life if there is a 303.22s - 305.02s | aircraft collision 305.02s - 307.02s | that this will lead to a 307.54s - 311.10s | Catastrophic event we had in the 70s, for example 311.94s - 313.94s | crashes going on also in the 80s 314.38s - 317.02s | With many deaths and this is why 319.10s - 325.82s | 1987 there was an introduction of the TCAS system and it's now mandatory in many airspaces 325.82s - 330.74s | It depends on the size of the aircraft and also the number of passengers you have 330.94s - 336.70s | but then if you are an aircraft that has a certain size and a certain number of passengers you will 336.94s - 341.90s | Be required to have a TCAS system in the aircraft to avoid collisions 342.90s - 346.34s | Now TCAS has three main core functions 346.98s - 351.10s | One is surveillance. The other one is traffic advisory and in the most 351.70s - 354.46s | Recent version of the traffic collision avoiding system. You have also 355.26s - 359.74s | Resolution advisories. I will go into the detail of these three functions 359.98s - 362.98s | So if you're on the picture on the right, we have a typical 363.82s - 367.74s | TCAS display showing the surrounding aircraft 367.74s - 375.70s | So this is the surveillance information that you have the aircraft


chunk_text:
crashes going on also in the 80s 314.38s - 317.02s | With many deaths and this is why 319.10s - 325.82s | 1987 there was an introduction of the TCAS system and it's now mandatory in many airspaces 325.82s - 330.74s | It depends on the size of the aircraft and also the number of passengers you have 330.94s - 336.70s | but then if you are an aircraft that has a certain size and a certain number of passengers you will 336.94s - 341.90s | Be required to have a TCAS system in the aircraft to avoid collisions 342.90s - 346.34s | Now TCAS has three main core functions 346.98s - 351.10s | One is surveillance. The other one is traffic advisory and in the most 351.70s - 354.46s | Recent version of the traffic collision avoiding system. You have also 355.26s - 359.74s | Resolution advisories. I will go into the detail of these three functions 359.98s - 362.98s | So if you're on the picture on the right, we have a typical 363.82s - 367.74s | TCAS display showing the surrounding aircraft 367.74s - 375.70s | So this is the surveillance information that you have the aircraft periodically announced themselves and you will see this on this display 376.38s - 378.70s | Now and there is an aircraft is found 378.82s - 386.74s | There will be interrogations to get the range for example to get the altitude and the capabilities of the surrounding aircraft 386.74s - 389.54s | this is all information that will then appear on this display and 390.42s - 394.50s | If the system realized there may be a collision going on 395.14s - 399.58s | That that might happen and then there will be some traffic advisory some TA 400.30s - 403.62s | That is sent to the cockpit as an alarm 404.18s - 410.02s | Alarming the the pilot that there may be a collision and if this persists after some point 410.46s - 415.82s | Then there will be a resolution advisory and this is basically to indicate 416.46s - 422.38s | And command to give a command to the pilot to basically do something and in TCAS too 422.58s - 426.10s | There are two options basically to resolve the conflict 426.94s - 428.10s | TCAS too 428.10s - 434.94s | Foresees that one aircraft should climb and the


chunk_text:
periodically announced themselves and you will see this on this display 376.38s - 378.70s | Now and there is an aircraft is found 378.82s - 386.74s | There will be interrogations to get the range for example to get the altitude and the capabilities of the surrounding aircraft 386.74s - 389.54s | this is all information that will then appear on this display and 390.42s - 394.50s | If the system realized there may be a collision going on 395.14s - 399.58s | That that might happen and then there will be some traffic advisory some TA 400.30s - 403.62s | That is sent to the cockpit as an alarm 404.18s - 410.02s | Alarming the the pilot that there may be a collision and if this persists after some point 410.46s - 415.82s | Then there will be a resolution advisory and this is basically to indicate 416.46s - 422.38s | And command to give a command to the pilot to basically do something and in TCAS too 422.58s - 426.10s | There are two options basically to resolve the conflict 426.94s - 428.10s | TCAS too 428.10s - 434.94s | Foresees that one aircraft should climb and the other one should descend and this should hopefully then prevent the collision 435.02s - 439.38s | So this is the the key function of of TCAS too 440.34s - 443.90s | now let's talk about this talk is about the security of TCAS and 444.86s - 448.20s | obviously, we're not the first to think about this problem, but the 448.88s - 452.32s | The situation is somehow worrying and yet for 452.92s - 457.48s | To our perspective also a little bit on unconvincing so far. So there has been some 458.68s - 461.68s | Warnings, there has been some risk assessments many of them 462.36s - 463.52s | people 463.52s - 465.08s | publications 465.08s - 470.04s | Analyzing the risks the cyber security risks and the risks of attacks against TCAS here 470.04s - 475.24s | I'm mentioning a couple of those papers one the one we are we have written 476.00s - 478.76s | Ourselves in the past. So these are warning signs 478.76s - 485.12s | There are also people and including ourself that have done some simulations to basically to better understand 485.84s - 492.00s | How pilots would react to TCAS attacks and


chunk_text:
other one should descend and this should hopefully then prevent the collision 435.02s - 439.38s | So this is the the key function of of TCAS too 440.34s - 443.90s | now let's talk about this talk is about the security of TCAS and 444.86s - 448.20s | obviously, we're not the first to think about this problem, but the 448.88s - 452.32s | The situation is somehow worrying and yet for 452.92s - 457.48s | To our perspective also a little bit on unconvincing so far. So there has been some 458.68s - 461.68s | Warnings, there has been some risk assessments many of them 462.36s - 463.52s | people 463.52s - 465.08s | publications 465.08s - 470.04s | Analyzing the risks the cyber security risks and the risks of attacks against TCAS here 470.04s - 475.24s | I'm mentioning a couple of those papers one the one we are we have written 476.00s - 478.76s | Ourselves in the past. So these are warning signs 478.76s - 485.12s | There are also people and including ourself that have done some simulations to basically to better understand 485.84s - 492.00s | How pilots would react to TCAS attacks and also what are the conditions under which? 492.40s - 496.08s | TCAS attacks may work and what are the limitation of these attacks? 496.80s - 497.72s | for example 497.72s - 501.48s | we did some work also inviting pilots in a simulator and 501.68s - 505.80s | Exposed them to attacks and showed how they reacted to those attacks and 506.28s - 509.36s | Then we had also some some work to better 510.04s - 512.72s | understand in simulations the theoretical 513.60s - 519.24s | Limitations of these attacks and what what are the better conditions that are favorable to an attacker? 519.36s - 521.60s | So this but these are all simulations 522.36s - 527.04s | Then most recent more recently there has been at an attempt to analyze 528.04s - 530.04s | experimentally the impact of 530.68s - 538.04s | Attacks on TCAS and these are the these two papers from research and one is a PhD student working on it building a testbed 538.76s - 544.16s | And with a TCAS equipment to analyze how the systems with will react 545.00s - 546.32s | but 546.32s - 552.12s | Our motivation for this work that


chunk_text:
also what are the conditions under which? 492.40s - 496.08s | TCAS attacks may work and what are the limitation of these attacks? 496.80s - 497.72s | for example 497.72s - 501.48s | we did some work also inviting pilots in a simulator and 501.68s - 505.80s | Exposed them to attacks and showed how they reacted to those attacks and 506.28s - 509.36s | Then we had also some some work to better 510.04s - 512.72s | understand in simulations the theoretical 513.60s - 519.24s | Limitations of these attacks and what what are the better conditions that are favorable to an attacker? 519.36s - 521.60s | So this but these are all simulations 522.36s - 527.04s | Then most recent more recently there has been at an attempt to analyze 528.04s - 530.04s | experimentally the impact of 530.68s - 538.04s | Attacks on TCAS and these are the these two papers from research and one is a PhD student working on it building a testbed 538.76s - 544.16s | And with a TCAS equipment to analyze how the systems with will react 545.00s - 546.32s | but 546.32s - 552.12s | Our motivation for this work that will be that Jacomo will be presenting is that despite this prior art? 552.28s - 558.64s | There are still no convincing experimental and scientific evidence that this TCAS attacks may work 559.16s - 562.68s | Actually, they may trigger for example resolution advisories 563.80s - 564.88s | using 564.88s - 566.88s | commercial and certified hardware 566.96s - 573.04s | So there was also no so far no established methodology how to test attacks and to see how? 573.60s - 578.64s | Systems will react in a scientific way and if these attacks are feasible 578.64s - 582.90s | We would like to also better understand. What are the capabilities needed for an actor? 583.44s - 586.80s | So we would like to understand. What are the requirements? 587.36s - 591.00s | To actually need it to to be able to launch those attacks 591.16s - 596.76s | So this was the basic motivation of a work that now Jacomo will be presenting next 597.36s - 608.30s | So I needed to descend because you know, I needed to climb under Vincent. So 609.10s - 616.38s | Yeah, okay. So now the fun stuff begins. So I'll start by


chunk_text:
will be that Jacomo will be presenting is that despite this prior art? 552.28s - 558.64s | There are still no convincing experimental and scientific evidence that this TCAS attacks may work 559.16s - 562.68s | Actually, they may trigger for example resolution advisories 563.80s - 564.88s | using 564.88s - 566.88s | commercial and certified hardware 566.96s - 573.04s | So there was also no so far no established methodology how to test attacks and to see how? 573.60s - 578.64s | Systems will react in a scientific way and if these attacks are feasible 578.64s - 582.90s | We would like to also better understand. What are the capabilities needed for an actor? 583.44s - 586.80s | So we would like to understand. What are the requirements? 587.36s - 591.00s | To actually need it to to be able to launch those attacks 591.16s - 596.76s | So this was the basic motivation of a work that now Jacomo will be presenting next 597.36s - 608.30s | So I needed to descend because you know, I needed to climb under Vincent. So 609.10s - 616.38s | Yeah, okay. So now the fun stuff begins. So I'll start by addressing your point. So it's a protocol from 1987 616.38s - 621.70s | So there is it's collaborative. It's in clear. There is no encryption. No PKI. No, whatever 621.70s - 624.62s | So it's insecure. We already know that let's keep over that 625.14s - 628.94s | So the first attack that you are going to see it's inducing a TA 628.94s - 630.06s | It's a very simple thing 630.06s - 636.18s | You just need to implement the 1.8 thousand pages of standards required to do so and you can find it all of these 636.26s - 642.10s | Standards in these three key bullet points, which means in order to get a TA you need to be an aircraft 642.10s - 643.86s | So you need to broadcast your presence 643.86s - 649.02s | you need to reply to interrogation properly to say that you are at the correct altitude and in a correct position and 649.22s - 655.74s | Which is our third point being in the correct position so correct range, correct altitude with a consistent identity 656.10s - 659.14s | the second attack that you will see is about 660.02s - 664.38s |


chunk_text:
addressing your point. So it's a protocol from 1987 616.38s - 621.70s | So there is it's collaborative. It's in clear. There is no encryption. No PKI. No, whatever 621.70s - 624.62s | So it's insecure. We already know that let's keep over that 625.14s - 628.94s | So the first attack that you are going to see it's inducing a TA 628.94s - 630.06s | It's a very simple thing 630.06s - 636.18s | You just need to implement the 1.8 thousand pages of standards required to do so and you can find it all of these 636.26s - 642.10s | Standards in these three key bullet points, which means in order to get a TA you need to be an aircraft 642.10s - 643.86s | So you need to broadcast your presence 643.86s - 649.02s | you need to reply to interrogation properly to say that you are at the correct altitude and in a correct position and 649.22s - 655.74s | Which is our third point being in the correct position so correct range, correct altitude with a consistent identity 656.10s - 659.14s | the second attack that you will see is about 660.02s - 664.38s | triggering a resolution advisory. So a resolution advisory happens after a 664.98s - 670.98s | Traffic advisory. So you first need the first one and then you start a negotiation. So you tell the other aircraft 670.98s - 675.34s | I perceive you as dangerous. Please do something and how you can choose 675.46s - 682.26s | Well, there is one conflict resolution algorithms that is used which is the aircraft with the lowest address always wins 682.38s - 689.14s | so you as an attacker can find out the address of the other aircraft and always pick whenever the other aircraft is going to 689.14s - 690.98s | climb or descend 690.98s - 696.22s | Then the first attack is instead not involving an aircraft, but instead a ground station 696.22s - 699.86s | So how TICAS works is basically it picks up a 700.62s - 704.42s | Size that it will protect so how much time in the future it will look 704.86s - 710.38s | Depending on the altitude on the currently selected altitude. This is called sensitivity and it goes in levels 710.50s - 713.22s | So the higher you are the bigger this area is


chunk_text:
triggering a resolution advisory. So a resolution advisory happens after a 664.98s - 670.98s | Traffic advisory. So you first need the first one and then you start a negotiation. So you tell the other aircraft 670.98s - 675.34s | I perceive you as dangerous. Please do something and how you can choose 675.46s - 682.26s | Well, there is one conflict resolution algorithms that is used which is the aircraft with the lowest address always wins 682.38s - 689.14s | so you as an attacker can find out the address of the other aircraft and always pick whenever the other aircraft is going to 689.14s - 690.98s | climb or descend 690.98s - 696.22s | Then the first attack is instead not involving an aircraft, but instead a ground station 696.22s - 699.86s | So how TICAS works is basically it picks up a 700.62s - 704.42s | Size that it will protect so how much time in the future it will look 704.86s - 710.38s | Depending on the altitude on the currently selected altitude. This is called sensitivity and it goes in levels 710.50s - 713.22s | So the higher you are the bigger this area is 713.62s - 718.36s | Well, if you land in Las Vegas where you have two runways close together, you might 719.06s - 723.10s | Actually end up in a situation when you point towards another aircraft 723.10s - 729.82s | So what they did was they allowed ground station to tell the aircrafts to reduce their sensitivity 730.06s - 737.34s | Well, guess what? You can send this command to any aircraft in the air to disable their TICAS with no authentication 737.34s - 743.50s | So this is fun. You can disable the anti-collision of whatever you want fun in my understanding of the word, by the way 743.66s - 745.82s | So why did everyone fail? 746.98s - 749.12s | So an interrogation cycle 749.12s - 754.40s | So one interaction of the protocols goes like so you send something and then the other aircraft replies 754.40s - 758.72s | So this is very standard, but the range that is estimated 758.72s - 765.60s | So the relative position is done by taking this time of flight. So the time it took to respond and subtracting 766.28s - 767.40s | 128 767.40s - 770.84s | Microseconds, that's 10


chunk_text:
713.62s - 718.36s | Well, if you land in Las Vegas where you have two runways close together, you might 719.06s - 723.10s | Actually end up in a situation when you point towards another aircraft 723.10s - 729.82s | So what they did was they allowed ground station to tell the aircrafts to reduce their sensitivity 730.06s - 737.34s | Well, guess what? You can send this command to any aircraft in the air to disable their TICAS with no authentication 737.34s - 743.50s | So this is fun. You can disable the anti-collision of whatever you want fun in my understanding of the word, by the way 743.66s - 745.82s | So why did everyone fail? 746.98s - 749.12s | So an interrogation cycle 749.12s - 754.40s | So one interaction of the protocols goes like so you send something and then the other aircraft replies 754.40s - 758.72s | So this is very standard, but the range that is estimated 758.72s - 765.60s | So the relative position is done by taking this time of flight. So the time it took to respond and subtracting 766.28s - 767.40s | 128 767.40s - 770.84s | Microseconds, that's 10 to the power of minus 6 771.20s - 778.24s | It's a comically short time your scheduler of your operating system is running 1,000 times slower than this 778.36s - 782.64s | so this has acted for a long time as a security feature because 783.28s - 790.44s | Let's say low skilled attackers could not manage to have this kind of latency to perform all of the steps of the protocol 790.88s - 796.20s | Actually, I'm lying to you, but I'm telling you so it doesn't count. It actually is not 128 796.20s - 800.56s | It's a little bit less because it's not with respect to the start of the packet. It's a little bit later on 800.60s - 806.76s | So you need to receive, understand what has been said, send the correct thing out at the current time and reply 806.92s - 810.64s | Not only that, this happens over two different frequency channels 810.64s - 812.44s | So you need to handle coherency 812.44s - 818.08s | And you need to be always in the same spot because if you need to do six interactions in a row to get acquired 818.08s - 822.16s


chunk_text:
to the power of minus 6 771.20s - 778.24s | It's a comically short time your scheduler of your operating system is running 1,000 times slower than this 778.36s - 782.64s | so this has acted for a long time as a security feature because 783.28s - 790.44s | Let's say low skilled attackers could not manage to have this kind of latency to perform all of the steps of the protocol 790.88s - 796.20s | Actually, I'm lying to you, but I'm telling you so it doesn't count. It actually is not 128 796.20s - 800.56s | It's a little bit less because it's not with respect to the start of the packet. It's a little bit later on 800.60s - 806.76s | So you need to receive, understand what has been said, send the correct thing out at the current time and reply 806.92s - 810.64s | Not only that, this happens over two different frequency channels 810.64s - 812.44s | So you need to handle coherency 812.44s - 818.08s | And you need to be always in the same spot because if you need to do six interactions in a row to get acquired 818.08s - 822.16s | You always need to reply consistently and at the same time 822.56s - 829.24s | So it's a difficult thing. So the first problem that we had is that a ticket system is not exactly a docker container 829.24s - 833.48s | We can you can just put an environment variable telling him where the database is and it runs 833.68s - 838.24s | So we had to build a testbed before and so this one is our architecture 838.76s - 843.20s | so the first ingredient is of course a ticket unit, which is what you're testing and 843.48s - 848.00s | You also need to connect it to a control panel and a traffic display unit 848.00s - 851.40s | which what we sent was showing to you some antennas and 852.12s - 856.80s | Not only that an headset because the traffic alerts are going to come out of it 857.32s - 859.04s | then 859.04s - 865.32s | You put an attacker into there. So two antennas, an SDR, a computer driving it and because we are scientists 865.32s - 868.56s | You also need to put something to measure what is going on 868.60s


chunk_text:
| You always need to reply consistently and at the same time 822.56s - 829.24s | So it's a difficult thing. So the first problem that we had is that a ticket system is not exactly a docker container 829.24s - 833.48s | We can you can just put an environment variable telling him where the database is and it runs 833.68s - 838.24s | So we had to build a testbed before and so this one is our architecture 838.76s - 843.20s | so the first ingredient is of course a ticket unit, which is what you're testing and 843.48s - 848.00s | You also need to connect it to a control panel and a traffic display unit 848.00s - 851.40s | which what we sent was showing to you some antennas and 852.12s - 856.80s | Not only that an headset because the traffic alerts are going to come out of it 857.32s - 859.04s | then 859.04s - 865.32s | You put an attacker into there. So two antennas, an SDR, a computer driving it and because we are scientists 865.32s - 868.56s | You also need to put something to measure what is going on 868.60s - 871.84s | So we have a camera that takes a look at the traffic display 871.88s - 878.76s | you have an a bionic bus simulator that makes the tickets believe that is flying because otherwise it will not transmit and then since 879.56s - 883.36s | Tampering with the anti-collision system of aircraft. It's let's say unpolite 883.76s - 888.48s | You need to put everything inside of a cage so that you don't get into jail while doing so 888.48s - 892.64s | Well, I was helped because they are from the Ministry of Defense, but they wouldn't risk anything 893.36s - 896.12s | So this is as you can see our testbed 896.12s - 902.16s | I'm not very good at cable management as you can see, but it was this clusterfuck of cables basically 902.68s - 907.96s | This is what you can get out of this and also our data gathering process was this very sophisticated 908.28s - 911.84s | Setup with a webcam placed on a monitor that acted as a stand 912.40s - 914.40s | So 914.44s - 916.92s | We got this so as you can see this is OpenCV 916.92s


chunk_text:
- 871.84s | So we have a camera that takes a look at the traffic display 871.88s - 878.76s | you have an a bionic bus simulator that makes the tickets believe that is flying because otherwise it will not transmit and then since 879.56s - 883.36s | Tampering with the anti-collision system of aircraft. It's let's say unpolite 883.76s - 888.48s | You need to put everything inside of a cage so that you don't get into jail while doing so 888.48s - 892.64s | Well, I was helped because they are from the Ministry of Defense, but they wouldn't risk anything 893.36s - 896.12s | So this is as you can see our testbed 896.12s - 902.16s | I'm not very good at cable management as you can see, but it was this clusterfuck of cables basically 902.68s - 907.96s | This is what you can get out of this and also our data gathering process was this very sophisticated 908.28s - 911.84s | Setup with a webcam placed on a monitor that acted as a stand 912.40s - 914.40s | So 914.44s - 916.92s | We got this so as you can see this is OpenCV 916.92s - 922.36s | So this can be turned as a dual use talk about machine learning and pattern recognition very easily 922.72s - 929.76s | So we were recognizing where the aircraft was tracked and what distance was commanded and everything else. So technicalities and 930.60s - 936.52s | Speaking about technicalities, so it's trivial to send some radio protocol. At least people have said to us 937.04s - 940.40s | Many times so let's talk about what you need to do actually 940.88s - 943.48s | So you have two TCAS that interact 943.48s - 951.00s | So they send something on one frequency at two megabit per second and they respond on another frequency at one megabit per second 951.44s - 957.76s | So when we started this basically three of these interactions were not available in real time 957.76s - 962.00s | So two megabits is a lot for a software-defined radio implementation 962.32s - 969.12s | And there were no implementation doing any of these protocols. So the first thing we needed to do was well 969.52s - 974.92s | First we tested that our testbed worked because if you need to attack something you need


chunk_text:
- 922.36s | So this can be turned as a dual use talk about machine learning and pattern recognition very easily 922.72s - 929.76s | So we were recognizing where the aircraft was tracked and what distance was commanded and everything else. So technicalities and 930.60s - 936.52s | Speaking about technicalities, so it's trivial to send some radio protocol. At least people have said to us 937.04s - 940.40s | Many times so let's talk about what you need to do actually 940.88s - 943.48s | So you have two TCAS that interact 943.48s - 951.00s | So they send something on one frequency at two megabit per second and they respond on another frequency at one megabit per second 951.44s - 957.76s | So when we started this basically three of these interactions were not available in real time 957.76s - 962.00s | So two megabits is a lot for a software-defined radio implementation 962.32s - 969.12s | And there were no implementation doing any of these protocols. So the first thing we needed to do was well 969.52s - 974.92s | First we tested that our testbed worked because if you need to attack something you need to understand if you 975.68s - 977.68s | Mounted it correctly. Yeah, it works 977.88s - 985.88s | Then we started by building a decoder that with respect for instance of your dump 1090 or whatever. It could run very very fast 986.72s - 988.76s | then we brought a 989.28s - 994.16s | Transmit chain and we got it certified by a RAM tester. So that we got our stamp and 994.84s - 1000.92s | Now you might be wondering so you have a RAM tester a device that does everything and you are building that yourself 1001.20s - 1005.20s | Well, yes, you need four hundred thousand dollars to buy one and also 1005.76s - 1010.60s | The more difficult part of the protocol are not just not implemented into there because you don't need it 1010.60s - 1015.00s | So you can just send dead beef to an aircraft, but you will not attack it. I guarantee to you 1016.32s - 1022.68s | There was also this other thing. So can't you just act time and reply random shit all over the airspace? 1022.68s - 1028.32s | Well, you can't because aircraft transmit things at random in


chunk_text:
to understand if you 975.68s - 977.68s | Mounted it correctly. Yeah, it works 977.88s - 985.88s | Then we started by building a decoder that with respect for instance of your dump 1090 or whatever. It could run very very fast 986.72s - 988.76s | then we brought a 989.28s - 994.16s | Transmit chain and we got it certified by a RAM tester. So that we got our stamp and 994.84s - 1000.92s | Now you might be wondering so you have a RAM tester a device that does everything and you are building that yourself 1001.20s - 1005.20s | Well, yes, you need four hundred thousand dollars to buy one and also 1005.76s - 1010.60s | The more difficult part of the protocol are not just not implemented into there because you don't need it 1010.60s - 1015.00s | So you can just send dead beef to an aircraft, but you will not attack it. I guarantee to you 1016.32s - 1022.68s | There was also this other thing. So can't you just act time and reply random shit all over the airspace? 1022.68s - 1028.32s | Well, you can't because aircraft transmit things at random in order to not pollute the airspace 1028.32s - 1033.92s | And also you need to have silence around our response to get the other receiver to pick it up 1033.92s - 1035.92s | So you cannot just float the air 1036.32s - 1039.76s | So we explored two ideas. The first one was doing this in hardware 1039.76s - 1044.76s | It's a lot less expensive otherwise, but you need smart people to do it and I'm not so 1045.04s - 1051.36s | We started with software-defined radio because you can just buy something you can put some random PhD guy 1051.68s - 1059.00s | And it's going also to get cheaper over time. And so the idea was can we do this with like less than $10,000? 1060.08s - 1064.48s | Of course, you need a place to do this and do all of the weird stuff like 1065.24s - 1070.88s | Tracking putting down. I don't know tell us with jet or something. So the first thing we tried 1071.48s - 1078.52s | Was trying with Linux real-time and we got 190 microseconds just to reply to a single pulse. So not enough 1078.92s - 1081.20s | So


chunk_text:
order to not pollute the airspace 1028.32s - 1033.92s | And also you need to have silence around our response to get the other receiver to pick it up 1033.92s - 1035.92s | So you cannot just float the air 1036.32s - 1039.76s | So we explored two ideas. The first one was doing this in hardware 1039.76s - 1044.76s | It's a lot less expensive otherwise, but you need smart people to do it and I'm not so 1045.04s - 1051.36s | We started with software-defined radio because you can just buy something you can put some random PhD guy 1051.68s - 1059.00s | And it's going also to get cheaper over time. And so the idea was can we do this with like less than $10,000? 1060.08s - 1064.48s | Of course, you need a place to do this and do all of the weird stuff like 1065.24s - 1070.88s | Tracking putting down. I don't know tell us with jet or something. So the first thing we tried 1071.48s - 1078.52s | Was trying with Linux real-time and we got 190 microseconds just to reply to a single pulse. So not enough 1078.92s - 1081.20s | So we needed to do a bunch of stuff 1081.20s - 1085.40s | So you take a workstation you remove power saving because who cares about it 1085.60s - 1090.24s | You remove hyperthreading you disable bunch many of the course you remove the GPU 1090.56s - 1093.08s | Sorry for all the machine learners in the audience 1093.08s - 1099.24s | and then since we are at a security conference you disable all of the security protections because those are slow all of the 1099.28s - 1101.28s | Mitigations and whatever we don't care 1102.20s - 1107.32s | Then you build basically your own Linux you pin the OS on one core 1107.56s - 1112.28s | You pin the application on some other course and you remove all of the power saving features 1112.28s - 1118.52s | So you run busy polling and then you compile everything as if it was your Gen 2 custom Linux distribution 1118.52s - 1123.12s | so extreme flags optimized for architecture profile guided all the jets and 1123.76s - 1130.20s | Then since you're a software engineer you over complicate things. So how where do you start to over complicate things? 1130.24s - 1133.28s


chunk_text:
we needed to do a bunch of stuff 1081.20s - 1085.40s | So you take a workstation you remove power saving because who cares about it 1085.60s - 1090.24s | You remove hyperthreading you disable bunch many of the course you remove the GPU 1090.56s - 1093.08s | Sorry for all the machine learners in the audience 1093.08s - 1099.24s | and then since we are at a security conference you disable all of the security protections because those are slow all of the 1099.28s - 1101.28s | Mitigations and whatever we don't care 1102.20s - 1107.32s | Then you build basically your own Linux you pin the OS on one core 1107.56s - 1112.28s | You pin the application on some other course and you remove all of the power saving features 1112.28s - 1118.52s | So you run busy polling and then you compile everything as if it was your Gen 2 custom Linux distribution 1118.52s - 1123.12s | so extreme flags optimized for architecture profile guided all the jets and 1123.76s - 1130.20s | Then since you're a software engineer you over complicate things. So how where do you start to over complicate things? 1130.24s - 1133.28s | so you start from the reception because you need to find out if 1133.80s - 1140.80s | The victim aircraft has interrogated you the way is you need to build some kind of intelligent preamble detector 1140.80s - 1146.52s | So going back and forth through your transforms and then you bring up and you understand why you studied mathematics 1146.52s - 1148.80s | so you bring up all of these random shit about 1149.76s - 1153.16s | symmetries in the furrier domain and back and forth transforms 1153.64s - 1160.76s | Then you actually do not need to receive all of the bits that are being sent to you at one point 1160.76s - 1163.80s | You just decode enough bits and you understand what is being asked to you 1163.80s - 1169.96s | So you build a finite state machine and you start replying earlier. So you reduce latency. I need those nanoseconds 1170.60s - 1176.12s | Then of course everything stays into a cache because you don't have the time to modulate anything 1176.12s - 1179.24s | So you just need a lookup table and save everything into RAM 1179.40s - 1185.64s | Then you need


chunk_text:
| so you start from the reception because you need to find out if 1133.80s - 1140.80s | The victim aircraft has interrogated you the way is you need to build some kind of intelligent preamble detector 1140.80s - 1146.52s | So going back and forth through your transforms and then you bring up and you understand why you studied mathematics 1146.52s - 1148.80s | so you bring up all of these random shit about 1149.76s - 1153.16s | symmetries in the furrier domain and back and forth transforms 1153.64s - 1160.76s | Then you actually do not need to receive all of the bits that are being sent to you at one point 1160.76s - 1163.80s | You just decode enough bits and you understand what is being asked to you 1163.80s - 1169.96s | So you build a finite state machine and you start replying earlier. So you reduce latency. I need those nanoseconds 1170.60s - 1176.12s | Then of course everything stays into a cache because you don't have the time to modulate anything 1176.12s - 1179.24s | So you just need a lookup table and save everything into RAM 1179.40s - 1185.64s | Then you need to get good at programming you need to read all of that Intel manual of 1.3 thousand pages 1185.64s - 1193.04s | Also that one with full of vmulpd or other single instruction multiple data instruction you remove any mutex because those take 1193.52s - 1195.92s | 100 nanoseconds to run and it's unacceptable 1196.24s - 1201.36s | You remove all memory allocations and you rewrite the allocator of your program in Rust 1202.04s - 1207.52s | Because why not and then you add some threads into the mix to over complicate things even more 1207.60s - 1213.68s | So now after two months you ended up with 40 microseconds more than you started with Wow 1213.96s - 1217.72s | And so what kind of results you can get from that 1218.72s - 1221.76s | You can trigger RTA. Oh, wow, it works 1221.88s - 1226.16s | So as you can see, you can put an aircraft directly on the nose at the same altitude 1226.16s - 1231.60s | So this will be pretty spooky if I were a pilot and you can also get an array 1231.60s - 1235.16s | So you can distinguish it because it's red instead


chunk_text:
to get good at programming you need to read all of that Intel manual of 1.3 thousand pages 1185.64s - 1193.04s | Also that one with full of vmulpd or other single instruction multiple data instruction you remove any mutex because those take 1193.52s - 1195.92s | 100 nanoseconds to run and it's unacceptable 1196.24s - 1201.36s | You remove all memory allocations and you rewrite the allocator of your program in Rust 1202.04s - 1207.52s | Because why not and then you add some threads into the mix to over complicate things even more 1207.60s - 1213.68s | So now after two months you ended up with 40 microseconds more than you started with Wow 1213.96s - 1217.72s | And so what kind of results you can get from that 1218.72s - 1221.76s | You can trigger RTA. Oh, wow, it works 1221.88s - 1226.16s | So as you can see, you can put an aircraft directly on the nose at the same altitude 1226.16s - 1231.60s | So this will be pretty spooky if I were a pilot and you can also get an array 1231.60s - 1235.16s | So you can distinguish it because it's red instead of yellow 1235.32s - 1242.60s | I'd like to point out that even though it's written no GPS position. This is in no way related to GPS spoofing attacks or whatever 1243.60s - 1245.92s | Also TCAS doesn't need GPS so and 1246.72s - 1252.24s | Then for the TCAS the activation what you will see on the aircraft is that it starts in 1252.68s - 1260.84s | Resolution advisory mode then something happens and it turns back to traffic advisory only mode and this happens 1261.48s - 1265.68s | You cannot reset it back to where it started unless you plug 1266.24s - 1270.96s | You unplug and replug the TCAS unit, which is very uncomfortable to do 1271.00s - 1275.64s | You can't get into an avionics bay while you're flying and we wanted to verify it 1275.64s - 1279.28s | So how can you do that? You fake being a tower and you ask aircraft 1279.28s - 1284.40s | Can you please tell me the sensitivity level you're operating at and it's going to tell you that it decreased so it works 1285.48s - 1288.80s | Then we tried to induce a collision avoidance 1289.64s - 1292.08s


chunk_text:
of yellow 1235.32s - 1242.60s | I'd like to point out that even though it's written no GPS position. This is in no way related to GPS spoofing attacks or whatever 1243.60s - 1245.92s | Also TCAS doesn't need GPS so and 1246.72s - 1252.24s | Then for the TCAS the activation what you will see on the aircraft is that it starts in 1252.68s - 1260.84s | Resolution advisory mode then something happens and it turns back to traffic advisory only mode and this happens 1261.48s - 1265.68s | You cannot reset it back to where it started unless you plug 1266.24s - 1270.96s | You unplug and replug the TCAS unit, which is very uncomfortable to do 1271.00s - 1275.64s | You can't get into an avionics bay while you're flying and we wanted to verify it 1275.64s - 1279.28s | So how can you do that? You fake being a tower and you ask aircraft 1279.28s - 1284.40s | Can you please tell me the sensitivity level you're operating at and it's going to tell you that it decreased so it works 1285.48s - 1288.80s | Then we tried to induce a collision avoidance 1289.64s - 1292.08s | Maneuver for 30 minutes and it worked 1292.32s - 1299.00s | Then the TCAS unit shut off because it didn't expect flying information with someone directly in the front of your nose for 30 minutes 1299.52s - 1301.44s | So it's reliable and 1301.44s - 1306.88s | The thing that we got is that the amount of money that you require is actually quite close to our target 1306.88s - 1312.08s | You also need the one Italian PhD student that eats canned vegetables for a while, but you can manage 1313.44s - 1315.56s | It's important vegetables are important 1316.24s - 1320.68s | So about the sensitivity level attack, I can just tell you that it works always 1320.68s - 1324.56s | I don't have any graph to show you. It's just going to be a line to works and 1325.44s - 1332.24s | Instead our system managed to reply within 0.2 microseconds, which for something built in software is 1333.20s - 1334.68s | smart and 1334.68s - 1339.24s | Also the jitter so the delay in between two different interrogation stayed within 1339.76s - 1344.96s | This limit set by the standard. Of course, it's a lot


chunk_text:
| Maneuver for 30 minutes and it worked 1292.32s - 1299.00s | Then the TCAS unit shut off because it didn't expect flying information with someone directly in the front of your nose for 30 minutes 1299.52s - 1301.44s | So it's reliable and 1301.44s - 1306.88s | The thing that we got is that the amount of money that you require is actually quite close to our target 1306.88s - 1312.08s | You also need the one Italian PhD student that eats canned vegetables for a while, but you can manage 1313.44s - 1315.56s | It's important vegetables are important 1316.24s - 1320.68s | So about the sensitivity level attack, I can just tell you that it works always 1320.68s - 1324.56s | I don't have any graph to show you. It's just going to be a line to works and 1325.44s - 1332.24s | Instead our system managed to reply within 0.2 microseconds, which for something built in software is 1333.20s - 1334.68s | smart and 1334.68s - 1339.24s | Also the jitter so the delay in between two different interrogation stayed within 1339.76s - 1344.96s | This limit set by the standard. Of course, it's a lot worse than real hardware, but it's very good 1344.96s - 1350.92s | and so this is the most important slide, which is the success rate so 1351.52s - 1355.80s | The level of success at one point goes to around 98% 1355.80s - 1361.20s | So, you know that we are not bullshitting you if you see our nerve talk where they get 100% they are lying 1361.40s - 1365.96s | So, you know that we aren't and so we get this advantage of around 30 plus 1366.76s - 1372.08s | Microseconds and why would you care to reply before the 128 microseconds? 1372.08s - 1377.00s | Well, if you are an attacker and you are on the ground and you want to place an aircraft at distance zero 1377.00s - 1379.92s | so directly on the nose of another aircraft you need to 1380.52s - 1384.28s | Reply a little bit earlier and let the speed of light do its work 1384.72s - 1386.96s | So why do you want to do that? 1386.96s - 1394.76s | Because some distances automatically trigger a TA on an array and with the canned vegetables from before you can manage to do


chunk_text:
worse than real hardware, but it's very good 1344.96s - 1350.92s | and so this is the most important slide, which is the success rate so 1351.52s - 1355.80s | The level of success at one point goes to around 98% 1355.80s - 1361.20s | So, you know that we are not bullshitting you if you see our nerve talk where they get 100% they are lying 1361.40s - 1365.96s | So, you know that we aren't and so we get this advantage of around 30 plus 1366.76s - 1372.08s | Microseconds and why would you care to reply before the 128 microseconds? 1372.08s - 1377.00s | Well, if you are an attacker and you are on the ground and you want to place an aircraft at distance zero 1377.00s - 1379.92s | so directly on the nose of another aircraft you need to 1380.52s - 1384.28s | Reply a little bit earlier and let the speed of light do its work 1384.72s - 1386.96s | So why do you want to do that? 1386.96s - 1394.76s | Because some distances automatically trigger a TA on an array and with the canned vegetables from before you can manage to do this 1394.76s - 1399.20s | Right now with hardware that you can buy at a distance of 4.2 kilometers 1399.20s - 1401.60s | So if you are within that distance, you can do that 1402.12s - 1406.20s | If you buy your own quantum computer that magical 1406.64s - 1413.72s | Unicorn word thingy that does it in zero nanoseconds. You can put this up to this theoretical limit and 1414.84s - 1421.64s | so we wanted also to find out if we you can do that to an airliner because that's what everyone wants to perform chaos and 1422.76s - 1429.84s | So you can do that for an airline and find that 950 kilometers per hour with a probability of 80% which is 1430.48s - 1432.12s | worrying 1432.12s - 1435.52s | So let's talk about limitations. Let's be straightforward. So 1436.84s - 1443.48s | You just need to be heard power wise, but you need to buy a power amplifier, which we didn't have but it's RF 1443.48s - 1449.00s | So I guess it works and also you need to a way to find out if you want to appear in a very precise position 1449.00s


chunk_text:
this 1394.76s - 1399.20s | Right now with hardware that you can buy at a distance of 4.2 kilometers 1399.20s - 1401.60s | So if you are within that distance, you can do that 1402.12s - 1406.20s | If you buy your own quantum computer that magical 1406.64s - 1413.72s | Unicorn word thingy that does it in zero nanoseconds. You can put this up to this theoretical limit and 1414.84s - 1421.64s | so we wanted also to find out if we you can do that to an airliner because that's what everyone wants to perform chaos and 1422.76s - 1429.84s | So you can do that for an airline and find that 950 kilometers per hour with a probability of 80% which is 1430.48s - 1432.12s | worrying 1432.12s - 1435.52s | So let's talk about limitations. Let's be straightforward. So 1436.84s - 1443.48s | You just need to be heard power wise, but you need to buy a power amplifier, which we didn't have but it's RF 1443.48s - 1449.00s | So I guess it works and also you need to a way to find out if you want to appear in a very precise position 1449.00s - 1455.24s | The attitude of the victim you're attacking but as you may know you can listen for ADS-B and understand this position 1455.76s - 1460.24s | Then I conclude so we now know what kind of hardware we need 1460.24s - 1462.72s | We know what kind of things you need to buy 1462.80s - 1467.40s | We built a testbed for this and we succeeded basically because 1467.92s - 1473.68s | We recognize that general SDRs framework are not enough latency wise to perform this kind of stuff 1473.68s - 1478.52s | Also, like dump 1090 is focused on decoding very very well everything that is coming up 1478.52s - 1486.32s | But not very very fast and also we focused on trivial technicalities like building your our own memory allocator and whatnot 1487.16s - 1492.20s | So actually the TRA is very difficult to pull off instead the RA-DOS is 1492.80s - 1499.56s | Extremely dangerous and also we have a problem because workstation will get faster over time. So this capability will increase 1501.00s - 1503.00s | so 1503.28s - 1511.08s | Systemic it's a systemic problem about a set a very delicate topic. So


chunk_text:
- 1455.24s | The attitude of the victim you're attacking but as you may know you can listen for ADS-B and understand this position 1455.76s - 1460.24s | Then I conclude so we now know what kind of hardware we need 1460.24s - 1462.72s | We know what kind of things you need to buy 1462.80s - 1467.40s | We built a testbed for this and we succeeded basically because 1467.92s - 1473.68s | We recognize that general SDRs framework are not enough latency wise to perform this kind of stuff 1473.68s - 1478.52s | Also, like dump 1090 is focused on decoding very very well everything that is coming up 1478.52s - 1486.32s | But not very very fast and also we focused on trivial technicalities like building your our own memory allocator and whatnot 1487.16s - 1492.20s | So actually the TRA is very difficult to pull off instead the RA-DOS is 1492.80s - 1499.56s | Extremely dangerous and also we have a problem because workstation will get faster over time. So this capability will increase 1501.00s - 1503.00s | so 1503.28s - 1511.08s | Systemic it's a systemic problem about a set a very delicate topic. So we had to disclose this in a very 1512.04s - 1514.64s | Complex environment we have disclosed it basically to 1515.04s - 1520.40s | whoops manufacturers and a bunch of authorities both national and 1521.08s - 1522.60s | international that have 1522.60s - 1528.24s | Acknowledged so manufacturer basically said yeah, it's a problem in the standard. Yeah, we're going to do something about it 1528.24s - 1536.00s | And as it stands at the moment, there is no way to fix any of these attacks 1536.84s - 1538.84s | but 1538.92s - 1542.56s | After some kind of work now we know 1543.04s - 1548.52s | That something has to be done and something will happen because they are already working on new 1548.84s - 1555.68s | Iterations of collision avoidance standards. Also, it's a field what it's very important the safety of everything 1555.68s - 1561.92s | So it's going to happen somehow. So if you want to know more we have a scientific paper coming up 1561.92s - 1563.52s | It's using security 1564.44s - 1570.40s | If you can't wait you can just ask me and I will hand over to you a PDF if you


chunk_text:
we had to disclose this in a very 1512.04s - 1514.64s | Complex environment we have disclosed it basically to 1515.04s - 1520.40s | whoops manufacturers and a bunch of authorities both national and 1521.08s - 1522.60s | international that have 1522.60s - 1528.24s | Acknowledged so manufacturer basically said yeah, it's a problem in the standard. Yeah, we're going to do something about it 1528.24s - 1536.00s | And as it stands at the moment, there is no way to fix any of these attacks 1536.84s - 1538.84s | but 1538.92s - 1542.56s | After some kind of work now we know 1543.04s - 1548.52s | That something has to be done and something will happen because they are already working on new 1548.84s - 1555.68s | Iterations of collision avoidance standards. Also, it's a field what it's very important the safety of everything 1555.68s - 1561.92s | So it's going to happen somehow. So if you want to know more we have a scientific paper coming up 1561.92s - 1563.52s | It's using security 1564.44s - 1570.40s | If you can't wait you can just ask me and I will hand over to you a PDF if you are not smart on 1570.40s - 1572.40s | a USB key otherwise via email 1572.68s - 1574.68s | So that was it 1575.20s - 1577.20s | Hope you liked it


chunk_text:
are not smart on 1570.40s - 1572.40s | a USB key otherwise via email 1572.68s - 1574.68s | So that was it 1575.20s - 1577.20s | Hope you liked it


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=ksbFhXdF2EI", "title": "DEF CON 32 - Physical OSINT - Lukas McCullough", "description": "Open source intelligence may sound like something you\u2019ve never done, but even something as simple as finding your old friends on social media overlaps with skills required for the job. Learn about what OSINT is, how to start an investigation, and resources used by experts to collect the maximum amount of data on a facility before ever visiting the site.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 943, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.11s - 2.67s | This text was transcribed using whisper model: large-v2 Hello, hello. 2.67s - 4.87s | So I have just about a minute till I start, 4.87s - 6.39s | but I'll get started now. 6.39s - 8.03s | Good morning, everyone. 8.03s - 11.59s | Hope you had a good Saturday night, some parties and stuff. 11.59s - 13.91s | So just a little bit of background on me. 13.91s - 15.43s | I'm from Physical Security Village. 15.43s - 16.55s | My name's Lucas. 16.55s - 19.23s | I'm a grad student at BU, cybersecurity and criminal 19.23s - 21.67s | justice major. 21.67s - 24.63s | So I'm just going to go over a little bit of what is OSINT. 24.63s - 27.11s | So OSINT is really anything on the internet 27.11s - 30.67s | that can be classified as usable, right? 30.67s - 33.07s | As long as you don't have to break into anything or pay 33.07s - 36.47s | for it, because I'm a broke college student, 36.47s - 39.27s | that is what I consider open source intelligence. 39.27s - 44.31s | So not hacking into anything, et cetera, et cetera. 44.31s - 47.39s | So where you can apply the information, 47.39s - 48.79s | there's tons of organizations that 48.79s - 51.79s | use open source intelligence, one of them being Trace Labs. 51.79s - 54.69s | This is where I got my start in open source intelligence. 54.69s - 58.89s | What it does is they have a crowdsourced game, 58.89s - 62.77s | like a CTF game, where you take information 62.77s - 64.49s | based on missing people. 64.49s - 67.49s | You try to help find them, but it incentivizes you, 67.49s - 69.53s | because you get points based on how actionable 69.53s - 71.13s | that intelligence


chunk_text:
to go over a little bit of what is OSINT. 24.63s - 27.11s | So OSINT is really anything on the internet 27.11s - 30.67s | that can be classified as usable, right? 30.67s - 33.07s | As long as you don't have to break into anything or pay 33.07s - 36.47s | for it, because I'm a broke college student, 36.47s - 39.27s | that is what I consider open source intelligence. 39.27s - 44.31s | So not hacking into anything, et cetera, et cetera. 44.31s - 47.39s | So where you can apply the information, 47.39s - 48.79s | there's tons of organizations that 48.79s - 51.79s | use open source intelligence, one of them being Trace Labs. 51.79s - 54.69s | This is where I got my start in open source intelligence. 54.69s - 58.89s | What it does is they have a crowdsourced game, 58.89s - 62.77s | like a CTF game, where you take information 62.77s - 64.49s | based on missing people. 64.49s - 67.49s | You try to help find them, but it incentivizes you, 67.49s - 69.53s | because you get points based on how actionable 69.53s - 71.13s | that intelligence is. 71.13s - 73.57s | So it's a really good way to innovate on the fly, 73.57s - 76.41s | and it makes you feel good afterwards. 76.41s - 79.77s | Also, shout out to Joe Gray from the OSINTian. 79.77s - 82.93s | He taught me a lot of what I know. 82.93s - 86.13s | So commonly used resources in OSINT 86.13s - 88.45s | are basically social media, right? 88.45s - 90.45s | So everyone here, I assume, is on LinkedIn 90.45s - 91.49s | and has been posting. 91.49s - 95.01s | So if I were to follow you, you were my target, 95.01s - 99.41s | I could see information based on your career, what 99.41s - 101.19s | you're striving to achieve. 101.19s - 103.29s | Everyone posts stuff like that. 103.29s - 105.57s | And then from there, I'll probably get your full name. 105.57s - 107.81s | You could go to Instagram, Facebook, stuff like that. 107.81s - 109.93s | You could find family, friends. 109.93s - 112.77s | And then once you start getting to know this person's life, 112.77s - 115.33s | you're really able to insert yourself into their


chunk_text:
is. 71.13s - 73.57s | So it's a really good way to innovate on the fly, 73.57s - 76.41s | and it makes you feel good afterwards. 76.41s - 79.77s | Also, shout out to Joe Gray from the OSINTian. 79.77s - 82.93s | He taught me a lot of what I know. 82.93s - 86.13s | So commonly used resources in OSINT 86.13s - 88.45s | are basically social media, right? 88.45s - 90.45s | So everyone here, I assume, is on LinkedIn 90.45s - 91.49s | and has been posting. 91.49s - 95.01s | So if I were to follow you, you were my target, 95.01s - 99.41s | I could see information based on your career, what 99.41s - 101.19s | you're striving to achieve. 101.19s - 103.29s | Everyone posts stuff like that. 103.29s - 105.57s | And then from there, I'll probably get your full name. 105.57s - 107.81s | You could go to Instagram, Facebook, stuff like that. 107.81s - 109.93s | You could find family, friends. 109.93s - 112.77s | And then once you start getting to know this person's life, 112.77s - 115.33s | you're really able to insert yourself into their story 115.33s - 118.89s | and get more information on them than they probably 118.89s - 121.45s | know is out and available. 121.45s - 125.61s | So has anyone here posted a photo of their new badge 125.61s - 128.81s | the first day that they got to work? 128.81s - 132.01s | OK, well, a lot of people do, and it's a big security risk. 132.01s - 135.29s | It's a great part of OSINT and shifting to social engineering, 135.29s - 138.97s | because that just shows, oh, I'm a new person. 138.97s - 140.29s | I got my badge. 140.29s - 142.47s | And now I know what new people with their new badges 142.47s - 143.27s | look like as well. 143.27s - 146.47s | So that's a security risk in this. 146.47s - 148.47s | So I'm going to go over some tools that are used 148.47s - 150.75s | a lot in OSINT investigations. 150.75s - 152.19s | First one being Multigo. 152.19s - 155.95s | So Multigo has so many different databases it pulls from. 155.95s - 160.23s | You can just insert a name, an address, phone number, 160.23s - 163.55s


chunk_text:
story 115.33s - 118.89s | and get more information on them than they probably 118.89s - 121.45s | know is out and available. 121.45s - 125.61s | So has anyone here posted a photo of their new badge 125.61s - 128.81s | the first day that they got to work? 128.81s - 132.01s | OK, well, a lot of people do, and it's a big security risk. 132.01s - 135.29s | It's a great part of OSINT and shifting to social engineering, 135.29s - 138.97s | because that just shows, oh, I'm a new person. 138.97s - 140.29s | I got my badge. 140.29s - 142.47s | And now I know what new people with their new badges 142.47s - 143.27s | look like as well. 143.27s - 146.47s | So that's a security risk in this. 146.47s - 148.47s | So I'm going to go over some tools that are used 148.47s - 150.75s | a lot in OSINT investigations. 150.75s - 152.19s | First one being Multigo. 152.19s - 155.95s | So Multigo has so many different databases it pulls from. 155.95s - 160.23s | You can just insert a name, an address, phone number, 160.23s - 163.55s | any sort of identifier, and it will pull from those databases 163.55s - 167.07s | any objects listed with that same identifier. 167.07s - 169.39s | So I personally have not accessed 169.39s - 172.35s | all the APIs in Multigo, but it's a great place 172.39s - 176.11s | to find new leads that you didn't even 176.11s - 178.19s | know were actually available. 178.19s - 181.35s | It's a great starting tool. 181.35s - 185.35s | So Whois is going to link a little bit next to the tool 185.35s - 187.15s | I show afterward. 187.15s - 190.55s | It just turns domain names into server IPs. 190.55s - 192.39s | So that's really useful for when you're 192.39s - 194.39s | trying to do OSINT on a company. 194.39s - 196.81s | You have their domain name, and then you can get their IPs, 196.81s - 198.71s | and then you shift to Shodan. 198.71s - 201.43s | So Shodan shows technologies and stuff 201.43s - 206.07s | like that for what's hosted on that server IP. 206.07s - 209.63s | So it'll show, if you can see the open ports in the top


chunk_text:
| any sort of identifier, and it will pull from those databases 163.55s - 167.07s | any objects listed with that same identifier. 167.07s - 169.39s | So I personally have not accessed 169.39s - 172.35s | all the APIs in Multigo, but it's a great place 172.39s - 176.11s | to find new leads that you didn't even 176.11s - 178.19s | know were actually available. 178.19s - 181.35s | It's a great starting tool. 181.35s - 185.35s | So Whois is going to link a little bit next to the tool 185.35s - 187.15s | I show afterward. 187.15s - 190.55s | It just turns domain names into server IPs. 190.55s - 192.39s | So that's really useful for when you're 192.39s - 194.39s | trying to do OSINT on a company. 194.39s - 196.81s | You have their domain name, and then you can get their IPs, 196.81s - 198.71s | and then you shift to Shodan. 198.71s - 201.43s | So Shodan shows technologies and stuff 201.43s - 206.07s | like that for what's hosted on that server IP. 206.07s - 209.63s | So it'll show, if you can see the open ports in the top 209.63s - 212.55s | right, it also shows what is returned 212.55s - 214.47s | by each of those ports. 214.47s - 215.99s | And then in the bottom, it'll show 215.99s - 218.91s | what kind of operating system, et cetera, 218.91s - 222.07s | is running on that machine. 222.07s - 224.71s | Next one up is, I don't know how to pronounce it. 224.71s - 226.91s | It's either Wiggle, Weigel. 226.91s - 229.91s | Wiggle.net is where all people who do war driving 229.91s - 233.23s | upload their data for the public to browse. 233.23s - 234.79s | This is super useful, essentially, 234.79s - 238.39s | for when you're looking at commercial spaces, 238.39s - 241.95s | you can see what Wi-Fi networks are operating in that area. 241.95s - 244.47s | And you can kind of narrow down what router, et cetera, 244.47s - 245.91s | is there. 245.91s - 249.83s | And the MAC addresses are listed with the router, with the SSID. 249.83s - 252.07s | You can find out which manufacturer 252.07s - 253.43s | created that router. 253.43s - 255.07s | And you can cross-verify that. 255.07s - 257.35s


chunk_text:
209.63s - 212.55s | right, it also shows what is returned 212.55s - 214.47s | by each of those ports. 214.47s - 215.99s | And then in the bottom, it'll show 215.99s - 218.91s | what kind of operating system, et cetera, 218.91s - 222.07s | is running on that machine. 222.07s - 224.71s | Next one up is, I don't know how to pronounce it. 224.71s - 226.91s | It's either Wiggle, Weigel. 226.91s - 229.91s | Wiggle.net is where all people who do war driving 229.91s - 233.23s | upload their data for the public to browse. 233.23s - 234.79s | This is super useful, essentially, 234.79s - 238.39s | for when you're looking at commercial spaces, 238.39s - 241.95s | you can see what Wi-Fi networks are operating in that area. 241.95s - 244.47s | And you can kind of narrow down what router, et cetera, 244.47s - 245.91s | is there. 245.91s - 249.83s | And the MAC addresses are listed with the router, with the SSID. 249.83s - 252.07s | You can find out which manufacturer 252.07s - 253.43s | created that router. 253.43s - 255.07s | And you can cross-verify that. 255.07s - 257.35s | If you see a picture of it, let's say in a Google review 257.35s - 259.43s | or something like that, you see a Cisco router, 259.43s - 262.79s | you see an address that is generated by a Cisco router 262.79s - 265.23s | as well, then you know that's the router and the network 265.23s - 267.99s | that you're going to have to look at. 267.99s - 272.15s | So a lot of OSINT investigators love frameworks. 272.15s - 274.99s | So this framework here, it has, you 274.99s - 276.71s | see these little blue dots? 276.71s - 279.35s | Each one of those, I know it's really small, 279.35s - 283.39s | represents a different amount of information 283.39s - 285.71s | that you want to get, whether it's email addresses, 285.71s - 289.35s | usernames, anything from what language 289.35s - 290.75s | you see on the screen. 290.75s - 292.55s | You click on that blue dot, and then you 292.55s - 296.31s | have those websites that this person has graciously 296.31s - 299.63s | created to point you in the direction of that tool 299.63s - 300.99s | that you


chunk_text:
| If you see a picture of it, let's say in a Google review 257.35s - 259.43s | or something like that, you see a Cisco router, 259.43s - 262.79s | you see an address that is generated by a Cisco router 262.79s - 265.23s | as well, then you know that's the router and the network 265.23s - 267.99s | that you're going to have to look at. 267.99s - 272.15s | So a lot of OSINT investigators love frameworks. 272.15s - 274.99s | So this framework here, it has, you 274.99s - 276.71s | see these little blue dots? 276.71s - 279.35s | Each one of those, I know it's really small, 279.35s - 283.39s | represents a different amount of information 283.39s - 285.71s | that you want to get, whether it's email addresses, 285.71s - 289.35s | usernames, anything from what language 289.35s - 290.75s | you see on the screen. 290.75s - 292.55s | You click on that blue dot, and then you 292.55s - 296.31s | have those websites that this person has graciously 296.31s - 299.63s | created to point you in the direction of that tool 299.63s - 300.99s | that you need. 300.99s - 303.07s | A lot of people use their own frameworks 303.07s - 306.75s | and create their own routines that they go 306.75s - 308.47s | through for each investigation. 308.47s - 311.05s | But this is a great way to find your own 311.05s - 315.55s | by finding those tools that you gravitate towards a lot. 315.55s - 317.67s | So I'm going to transition to locations a bit. 317.67s - 319.99s | I think everyone knows Google Dorking. 319.99s - 326.95s | So you can use Google Dorking for finding floor plans, 326.95s - 329.07s | rental agreements, stuff like that. 329.07s - 333.03s | A great thing to know is there's a lot of information 333.03s - 335.27s | that's listed by address, and especially 335.27s - 337.51s | if you're looking to high-rises and stuff like that. 337.51s - 339.55s | High-rises don't typically change shape 339.55s - 341.31s | from the first floor to the top floor. 341.31s - 345.15s | So it's mainly cookie cutter every way up. 345.25s - 347.95s | So this is an example of finding information from an address 347.95s - 350.47s | rather than finding


chunk_text:
need. 300.99s - 303.07s | A lot of people use their own frameworks 303.07s - 306.75s | and create their own routines that they go 306.75s - 308.47s | through for each investigation. 308.47s - 311.05s | But this is a great way to find your own 311.05s - 315.55s | by finding those tools that you gravitate towards a lot. 315.55s - 317.67s | So I'm going to transition to locations a bit. 317.67s - 319.99s | I think everyone knows Google Dorking. 319.99s - 326.95s | So you can use Google Dorking for finding floor plans, 326.95s - 329.07s | rental agreements, stuff like that. 329.07s - 333.03s | A great thing to know is there's a lot of information 333.03s - 335.27s | that's listed by address, and especially 335.27s - 337.51s | if you're looking to high-rises and stuff like that. 337.51s - 339.55s | High-rises don't typically change shape 339.55s - 341.31s | from the first floor to the top floor. 341.31s - 345.15s | So it's mainly cookie cutter every way up. 345.25s - 347.95s | So this is an example of finding information from an address 347.95s - 350.47s | rather than finding information on an address. 350.47s - 352.19s | So this is Master Lock here. 352.19s - 354.39s | If you put in their address there 354.39s - 356.83s | and you put file type PDF, it shows only things 356.83s - 359.71s | that have the address listed in that PDF. 359.71s - 362.51s | So I found one down here named Restricted Information. 362.51s - 365.91s | And so, of course, I want to click on it. 365.91s - 367.47s | And when I click on it, I find it 367.47s - 370.51s | is a template for how they fire people, which 370.51s - 373.19s | is really interesting to have on the open internet. 373.19s - 377.79s | It's good to know that it's available. 377.79s - 380.29s | So if you ever want to scare someone who works at Master Lock, 380.29s - 382.59s | feel free to send it to them. 382.59s - 385.51s | And not to pick on them, but I did find another thing. 385.51s - 387.67s | This is a great social engineering avenue, right? 387.67s - 390.75s | So you have a contract between the state of Wisconsin 390.75s -


chunk_text:
information on an address. 350.47s - 352.19s | So this is Master Lock here. 352.19s - 354.39s | If you put in their address there 354.39s - 356.83s | and you put file type PDF, it shows only things 356.83s - 359.71s | that have the address listed in that PDF. 359.71s - 362.51s | So I found one down here named Restricted Information. 362.51s - 365.91s | And so, of course, I want to click on it. 365.91s - 367.47s | And when I click on it, I find it 367.47s - 370.51s | is a template for how they fire people, which 370.51s - 373.19s | is really interesting to have on the open internet. 373.19s - 377.79s | It's good to know that it's available. 377.79s - 380.29s | So if you ever want to scare someone who works at Master Lock, 380.29s - 382.59s | feel free to send it to them. 382.59s - 385.51s | And not to pick on them, but I did find another thing. 385.51s - 387.67s | This is a great social engineering avenue, right? 387.67s - 390.75s | So you have a contract between the state of Wisconsin 390.75s - 392.07s | and Master Lock, right? 392.07s - 393.63s | And at the bottom, you see there's 393.63s - 396.87s | the name and phone number and email of that contact. 396.87s - 398.97s | So what you can do is become a middleman, right? 398.97s - 401.27s | And that's just finding something on the open internet. 401.27s - 404.99s | You don't have to go through that person's email just 404.99s - 406.07s | to find this information. 406.07s - 410.19s | I don't know why it's on Google, but it's a great social 410.19s - 412.47s | engineering avenue. 412.47s - 415.67s | So next up, just as I said, commercial properties 415.67s - 416.47s | are great. 416.47s - 419.51s | So very few companies own their offices. 419.51s - 422.39s | So they rent from a high-rise, stuff like that. 422.39s - 425.11s | And everyone right now is looking to rent, right? 425.11s - 427.75s | Everyone wants to get someone in their space. 427.75s - 430.23s | So they post those floor plans. 430.23s - 434.59s | They post what other large companies are there. 434.59s - 436.95s | So you want to


chunk_text:
392.07s | and Master Lock, right? 392.07s - 393.63s | And at the bottom, you see there's 393.63s - 396.87s | the name and phone number and email of that contact. 396.87s - 398.97s | So what you can do is become a middleman, right? 398.97s - 401.27s | And that's just finding something on the open internet. 401.27s - 404.99s | You don't have to go through that person's email just 404.99s - 406.07s | to find this information. 406.07s - 410.19s | I don't know why it's on Google, but it's a great social 410.19s - 412.47s | engineering avenue. 412.47s - 415.67s | So next up, just as I said, commercial properties 415.67s - 416.47s | are great. 416.47s - 419.51s | So very few companies own their offices. 419.51s - 422.39s | So they rent from a high-rise, stuff like that. 422.39s - 425.11s | And everyone right now is looking to rent, right? 425.11s - 427.75s | Everyone wants to get someone in their space. 427.75s - 430.23s | So they post those floor plans. 430.23s - 434.59s | They post what other large companies are there. 434.59s - 436.95s | So you want to go there, you know? 436.95s - 439.63s | And they're very uniform in the way that they're stacked. 439.63s - 442.35s | So if you get one floor plan for a floor, 442.35s - 446.13s | it's typically going to be the same all the way up. 446.13s - 450.89s | So this is the new tool that I found for this year. 450.89s - 452.81s | It's called GeoSpy AI. 452.81s - 456.97s | So it works by you put an image right into the browser. 456.97s - 458.17s | You can pay for an API. 458.17s - 460.81s | I don't feel like there's a need for it quite yet. 460.81s - 462.93s | And you get stuff like this. 462.93s - 465.93s | So if you see on the right side there, it's on my phone. 465.93s - 469.69s | You can see it shows approximate location of where it is. 469.69s - 471.89s | So this photo was actually taken in Shanghai, 471.89s - 473.85s | but it said it was in Hong Kong. 473.85s - 476.73s | So it's approximately 760 miles away. 476.73s - 478.29s | Not a great look. 478.29s - 480.89s |


chunk_text:
go there, you know? 436.95s - 439.63s | And they're very uniform in the way that they're stacked. 439.63s - 442.35s | So if you get one floor plan for a floor, 442.35s - 446.13s | it's typically going to be the same all the way up. 446.13s - 450.89s | So this is the new tool that I found for this year. 450.89s - 452.81s | It's called GeoSpy AI. 452.81s - 456.97s | So it works by you put an image right into the browser. 456.97s - 458.17s | You can pay for an API. 458.17s - 460.81s | I don't feel like there's a need for it quite yet. 460.81s - 462.93s | And you get stuff like this. 462.93s - 465.93s | So if you see on the right side there, it's on my phone. 465.93s - 469.69s | You can see it shows approximate location of where it is. 469.69s - 471.89s | So this photo was actually taken in Shanghai, 471.89s - 473.85s | but it said it was in Hong Kong. 473.85s - 476.73s | So it's approximately 760 miles away. 476.73s - 478.29s | Not a great look. 478.29s - 480.89s | However, it does work on different locations. 480.89s - 483.17s | It's really good at getting a baseline of where 483.17s - 485.77s | this image was taken, and then you have to verify, right? 485.77s - 489.73s | So this one, if you can see on the right, it is a bit small. 489.73s - 493.05s | It's three kilometers away from the actual target location. 493.05s - 496.33s | So that is a very good baseline for just throwing 496.33s - 501.61s | an image into a tool and shooting out this information. 501.61s - 505.09s | Finally, I'm going to go over a applied OSINT vignette. 505.09s - 511.61s | So I'm going to go walk through a small investigation I did. 511.61s - 513.93s | It involved a massage parlor. 513.93s - 519.09s | It was for a bit of a, what's the word? 519.09s - 522.49s | Information gathering for a local department. 522.49s - 524.57s | So this is just Google image reviews, right? 524.57s - 526.49s | Or Google review images. 526.49s - 527.93s | You can see on the left-most side, 527.93s - 529.51s | that is just an image of the


chunk_text:
However, it does work on different locations. 480.89s - 483.17s | It's really good at getting a baseline of where 483.17s - 485.77s | this image was taken, and then you have to verify, right? 485.77s - 489.73s | So this one, if you can see on the right, it is a bit small. 489.73s - 493.05s | It's three kilometers away from the actual target location. 493.05s - 496.33s | So that is a very good baseline for just throwing 496.33s - 501.61s | an image into a tool and shooting out this information. 501.61s - 505.09s | Finally, I'm going to go over a applied OSINT vignette. 505.09s - 511.61s | So I'm going to go walk through a small investigation I did. 511.61s - 513.93s | It involved a massage parlor. 513.93s - 519.09s | It was for a bit of a, what's the word? 519.09s - 522.49s | Information gathering for a local department. 522.49s - 524.57s | So this is just Google image reviews, right? 524.57s - 526.49s | Or Google review images. 526.49s - 527.93s | You can see on the left-most side, 527.93s - 529.51s | that is just an image of the hallway. 529.51s - 532.65s | You see there's three doors, and then on the second image, 532.65s - 534.35s | you can see that there's a monitor there. 534.35s - 535.77s | That monitor is really interesting 535.77s - 537.73s | because every single room has one. 537.73s - 542.45s | So what that has is every camera location, right? 542.45s - 545.25s | So whoever's inside can see what's going on on the outside. 545.25s - 546.93s | And then on the right, you can actually 546.93s - 550.41s | see one of those cameras above that door. 550.41s - 552.13s | So as I said, cameras, right? 552.13s - 553.93s | So if you're doing an OSINT investigation, 553.93s - 556.17s | you always want to see entrances, egresses, 556.17s - 557.37s | and especially those cameras. 557.37s - 560.35s | Because if you're going to do a pen test or something 560.35s - 562.77s | like that, you probably don't want to get caught by those. 562.77s - 565.89s | So on the left here, we have one large camera on the roof. 565.89s - 568.69s | And it's pointing at the first three parking lot spots


chunk_text:
hallway. 529.51s - 532.65s | You see there's three doors, and then on the second image, 532.65s - 534.35s | you can see that there's a monitor there. 534.35s - 535.77s | That monitor is really interesting 535.77s - 537.73s | because every single room has one. 537.73s - 542.45s | So what that has is every camera location, right? 542.45s - 545.25s | So whoever's inside can see what's going on on the outside. 545.25s - 546.93s | And then on the right, you can actually 546.93s - 550.41s | see one of those cameras above that door. 550.41s - 552.13s | So as I said, cameras, right? 552.13s - 553.93s | So if you're doing an OSINT investigation, 553.93s - 556.17s | you always want to see entrances, egresses, 556.17s - 557.37s | and especially those cameras. 557.37s - 560.35s | Because if you're going to do a pen test or something 560.35s - 562.77s | like that, you probably don't want to get caught by those. 562.77s - 565.89s | So on the left here, we have one large camera on the roof. 565.89s - 568.69s | And it's pointing at the first three parking lot spots 568.69s - 571.09s | and further back behind them. 571.09s - 573.85s | Additionally, you have the camera on the right in red. 573.85s - 574.97s | And that's facing the door. 574.97s - 578.85s | So it has an image of anyone trying to enter that location. 578.85s - 580.45s | And then there's a back door if you go. 580.45s - 581.69s | It's just Google Maps, right? 581.69s - 583.69s | Street view, you drop the pin. 583.69s - 585.49s | You can look around a building, and there's 585.49s - 587.77s | another camera there based on that back entrance. 587.77s - 589.25s | But it's only facing one way. 589.25s - 590.97s | So if you wanted to enter from the back, 590.97s - 594.77s | you could go from, I think this was the east-facing side. 594.77s - 598.45s | So you'd go from the west, and then no one would know. 598.45s - 601.47s | And then, as I said, the four buildings, right? 601.47s - 603.83s | If you want to confirm, especially 603.83s - 606.75s | for smaller strip malls and houses like that, 606.75s - 609.39s | you can see


chunk_text:
568.69s - 571.09s | and further back behind them. 571.09s - 573.85s | Additionally, you have the camera on the right in red. 573.85s - 574.97s | And that's facing the door. 574.97s - 578.85s | So it has an image of anyone trying to enter that location. 578.85s - 580.45s | And then there's a back door if you go. 580.45s - 581.69s | It's just Google Maps, right? 581.69s - 583.69s | Street view, you drop the pin. 583.69s - 585.49s | You can look around a building, and there's 585.49s - 587.77s | another camera there based on that back entrance. 587.77s - 589.25s | But it's only facing one way. 589.25s - 590.97s | So if you wanted to enter from the back, 590.97s - 594.77s | you could go from, I think this was the east-facing side. 594.77s - 598.45s | So you'd go from the west, and then no one would know. 598.45s - 601.47s | And then, as I said, the four buildings, right? 601.47s - 603.83s | If you want to confirm, especially 603.83s - 606.75s | for smaller strip malls and houses like that, 606.75s - 609.39s | you can see everyone likes HVAC units now. 609.39s - 612.27s | It's how you cool your house, your building. 612.27s - 615.83s | You can see the piping goes to four different locations. 615.83s - 618.35s | So that approximately, it's like there's 618.35s - 620.47s | four different rooms that need to be cooled, right? 620.47s - 623.89s | So in this photo here, you can see there's three, 623.89s - 625.55s | and then there's another one behind it. 625.55s - 627.35s | So you're not able to see it in this photo. 627.35s - 629.95s | That's great about cross-referencing 629.95s - 632.07s | with different photos. 632.07s - 636.55s | And then finally, we have a wiggle.net example. 636.55s - 638.71s | So for this, it shows, if anyone's 638.71s - 640.19s | familiar with war driving, right? 640.19s - 643.03s | It shows all the networks down in the bottom on the street. 643.03s - 646.59s | No one turned up into that actual lot, unfortunately. 646.59s - 649.95s | However, you can see all those networks, and some of them 649.95s - 651.63s | with varying levels of security. 651.63s - 655.63s | And it shows


chunk_text:
everyone likes HVAC units now. 609.39s - 612.27s | It's how you cool your house, your building. 612.27s - 615.83s | You can see the piping goes to four different locations. 615.83s - 618.35s | So that approximately, it's like there's 618.35s - 620.47s | four different rooms that need to be cooled, right? 620.47s - 623.89s | So in this photo here, you can see there's three, 623.89s - 625.55s | and then there's another one behind it. 625.55s - 627.35s | So you're not able to see it in this photo. 627.35s - 629.95s | That's great about cross-referencing 629.95s - 632.07s | with different photos. 632.07s - 636.55s | And then finally, we have a wiggle.net example. 636.55s - 638.71s | So for this, it shows, if anyone's 638.71s - 640.19s | familiar with war driving, right? 640.19s - 643.03s | It shows all the networks down in the bottom on the street. 643.03s - 646.59s | No one turned up into that actual lot, unfortunately. 646.59s - 649.95s | However, you can see all those networks, and some of them 649.95s - 651.63s | with varying levels of security. 651.63s - 655.63s | And it shows a MAC address and the SSID. 655.63s - 658.39s | So going back on what I said before, 658.39s - 661.79s | it's really useful to know what manufacturer 661.99s - 664.67s | made that router for exploitation 664.67s - 667.71s | and stuff like that. 667.71s - 670.75s | It's a great addition to investigations, 670.75s - 674.31s | stuff like that. 674.31s - 680.43s | Any questions? 680.43s - 682.87s | That was really quick, so I wasn't expecting that. 682.87s - 687.76s | All right, thank you. 687.76s - 690.10s | Oh, yeah. 690.10s - 711.34s | Yeah, I can take questions down here. 711.34s - 712.18s | Mic down here? 712.18s - 720.53s | OK, perfect. 720.53s - 733.90s | Yeah, I can hand this one to him. 733.90s - 736.06s | I think that one's on now. 736.06s - 741.02s | So once you get beyond the online research, 741.02s - 749.10s | can you talk a bit about the in-person surveillance aspects? 749.10s - 754.26s | So the question was the shift from online to in-person. 754.26s - 762.48s | That shifts more to tactical surveillance measures. 762.48s - 765.84s | So you've got


chunk_text:
a MAC address and the SSID. 655.63s - 658.39s | So going back on what I said before, 658.39s - 661.79s | it's really useful to know what manufacturer 661.99s - 664.67s | made that router for exploitation 664.67s - 667.71s | and stuff like that. 667.71s - 670.75s | It's a great addition to investigations, 670.75s - 674.31s | stuff like that. 674.31s - 680.43s | Any questions? 680.43s - 682.87s | That was really quick, so I wasn't expecting that. 682.87s - 687.76s | All right, thank you. 687.76s - 690.10s | Oh, yeah. 690.10s - 711.34s | Yeah, I can take questions down here. 711.34s - 712.18s | Mic down here? 712.18s - 720.53s | OK, perfect. 720.53s - 733.90s | Yeah, I can hand this one to him. 733.90s - 736.06s | I think that one's on now. 736.06s - 741.02s | So once you get beyond the online research, 741.02s - 749.10s | can you talk a bit about the in-person surveillance aspects? 749.10s - 754.26s | So the question was the shift from online to in-person. 754.26s - 762.48s | That shifts more to tactical surveillance measures. 762.48s - 765.84s | So you've got your camera, you've got the black van, 765.84s - 767.28s | inserting bugs and stuff like that. 767.28s - 769.52s | I don't have much experience in that field. 769.52s - 771.76s | That's where you'd shift towards that social engineering 771.76s - 772.56s | aspect as well. 772.56s - 774.60s | I can speak a little bit on the social engineering 774.60s - 777.40s | rather than the covert intelligence gathering. 777.40s - 781.04s | So with those ID badges and with those photos 781.04s - 783.08s | you can specifically find on LinkedIn, 783.08s - 785.68s | you can throw together a get up that looks pretty legitimate. 785.68s - 788.72s | And then you can have your own free will, whatever 788.72s - 791.76s | building you want to enter. 791.76s - 795.80s | Additionally, carrying a lot of stuff, 795.80s - 799.60s | like two, three boxes of donuts, a ladder, 799.60s - 800.92s | two buckets of paint. 800.92s - 803.60s | Tons of people love to hold doors open for you. 803.60s - 806.28s | And I know everyone gets training on that to not do 806.28s - 810.40s | that, but everyone forgets


chunk_text:
your camera, you've got the black van, 765.84s - 767.28s | inserting bugs and stuff like that. 767.28s - 769.52s | I don't have much experience in that field. 769.52s - 771.76s | That's where you'd shift towards that social engineering 771.76s - 772.56s | aspect as well. 772.56s - 774.60s | I can speak a little bit on the social engineering 774.60s - 777.40s | rather than the covert intelligence gathering. 777.40s - 781.04s | So with those ID badges and with those photos 781.04s - 783.08s | you can specifically find on LinkedIn, 783.08s - 785.68s | you can throw together a get up that looks pretty legitimate. 785.68s - 788.72s | And then you can have your own free will, whatever 788.72s - 791.76s | building you want to enter. 791.76s - 795.80s | Additionally, carrying a lot of stuff, 795.80s - 799.60s | like two, three boxes of donuts, a ladder, 799.60s - 800.92s | two buckets of paint. 800.92s - 803.60s | Tons of people love to hold doors open for you. 803.60s - 806.28s | And I know everyone gets training on that to not do 806.28s - 810.40s | that, but everyone forgets it in the moment. 810.40s - 813.16s | So I'd highly recommend just picking up a hard hat, 813.16s - 817.24s | picking up a high-vis vest, and seeing where that gets you. 817.24s - 818.70s | And then from there, once you're in, 818.70s - 820.60s | you gain access to a lot of that information 820.60s - 822.28s | that's not open source. 822.28s - 824.88s | So you get access to desks, stuff like that. 824.88s - 827.44s | So it's always great to carry a set of common access keys 827.44s - 830.40s | on you, just so you can open those cabinets 830.40s - 832.60s | and get access to documents that people are like, oh, 832.60s - 833.36s | it's in my office. 833.36s - 834.84s | There's no need to secure it anymore 834.84s - 837.40s | than putting it in my desk. 837.40s - 853.20s | But yeah, does that answer your question? 853.20s - 854.24s | All good. 854.24s - 857.48s | Maybe this is a silly question, but you 857.48s - 862.40s | talked about working for a local authority. 862.40s - 863.88s | How do they approach you? 863.88s


chunk_text:
it in the moment. 810.40s - 813.16s | So I'd highly recommend just picking up a hard hat, 813.16s - 817.24s | picking up a high-vis vest, and seeing where that gets you. 817.24s - 818.70s | And then from there, once you're in, 818.70s - 820.60s | you gain access to a lot of that information 820.60s - 822.28s | that's not open source. 822.28s - 824.88s | So you get access to desks, stuff like that. 824.88s - 827.44s | So it's always great to carry a set of common access keys 827.44s - 830.40s | on you, just so you can open those cabinets 830.40s - 832.60s | and get access to documents that people are like, oh, 832.60s - 833.36s | it's in my office. 833.36s - 834.84s | There's no need to secure it anymore 834.84s - 837.40s | than putting it in my desk. 837.40s - 853.20s | But yeah, does that answer your question? 853.20s - 854.24s | All good. 854.24s - 857.48s | Maybe this is a silly question, but you 857.48s - 862.40s | talked about working for a local authority. 862.40s - 863.88s | How do they approach you? 863.88s - 867.76s | Is this part of your job, part of your studies, 867.76s - 873.64s | or do you do any investigations of your own initiative? 873.64s - 876.64s | So the question was how I referenced 876.64s - 883.60s | that I worked with a local department for the OSINT vignette 883.60s - 884.40s | that I showed. 884.40s - 888.48s | So I work for another volunteer organization 888.48s - 890.16s | in open source intelligence. 890.16s - 891.84s | And I just give them the information. 891.84s - 894.76s | I'm not involved in, it's very compartmentalized. 894.84s - 897.00s | So I don't know what they do with that information. 897.00s - 901.08s | I just find it and then make an intelligence report 901.08s - 902.96s | kind of thing. 902.96s - 905.68s | They did a lot of good work around the Super Bowl. 905.68s - 908.96s | Every Super Bowl, they do OSINT investigations 908.96s - 911.04s | based on human trafficking. 911.04s - 914.52s | And it shifts from that missing persons cases 914.52s - 915.40s | to human trafficking. 915.40s - 920.00s | It's kind of similar, but it's a


chunk_text:
- 867.76s | Is this part of your job, part of your studies, 867.76s - 873.64s | or do you do any investigations of your own initiative? 873.64s - 876.64s | So the question was how I referenced 876.64s - 883.60s | that I worked with a local department for the OSINT vignette 883.60s - 884.40s | that I showed. 884.40s - 888.48s | So I work for another volunteer organization 888.48s - 890.16s | in open source intelligence. 890.16s - 891.84s | And I just give them the information. 891.84s - 894.76s | I'm not involved in, it's very compartmentalized. 894.84s - 897.00s | So I don't know what they do with that information. 897.00s - 901.08s | I just find it and then make an intelligence report 901.08s - 902.96s | kind of thing. 902.96s - 905.68s | They did a lot of good work around the Super Bowl. 905.68s - 908.96s | Every Super Bowl, they do OSINT investigations 908.96s - 911.04s | based on human trafficking. 911.04s - 914.52s | And it shifts from that missing persons cases 914.52s - 915.40s | to human trafficking. 915.40s - 920.00s | It's kind of similar, but it's a little bit more harder, 920.00s - 920.52s | for sure. 920.52s - 923.28s | But it does have that same sort of satisfaction 923.28s - 939.32s | that I'm being helpful. 939.32s - 940.28s | I think that's a wrap. 940.28s - 942.52s | Thank you so much for coming out.


chunk_text:
little bit more harder, 920.00s - 920.52s | for sure. 920.52s - 923.28s | But it does have that same sort of satisfaction 923.28s - 939.32s | that I'm being helpful. 939.32s - 940.28s | I think that's a wrap. 940.28s - 942.52s | Thank you so much for coming out.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=sp91zygVcmE", "title": "DEF CON 32 - Curious Case of Alice&Bob: What You Can Do as Digital Investigators - Catherine Ullman", "description": "The game is afoot! The curious case of Alice and Bob will explore beyond the surface of technical know-how. Attendees will navigate the intricate labyrinth of digital investigation, learning not just 'where' to seek digital clues \u2013 perhaps hidden in the registry \u2013 but crucially, 'why' these details matter and 'how' they fit into the larger puzzle of our investigation. Join me on a narrative adventure illuminating the practical use of tools in a real-world scenario. For both seasoned and aspiring digital sleuths, this talk aims to sharpen investigative skills, setting or recalibrating your expectations of what digital forensics can realistically achieve.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3233, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.44s | This text was transcribed using whisper model: large-v2 Alright, good afternoon everyone! Good afternoon. Welcome to DEF CON, welcome to Creator 6.44s - 13.22s | Stage. Thank you for all being here. Um, before we begin, just a couple of quick notes. Uh, 13.22s - 18.22s | number one, that these talks are being recorded and also being streamed. Um, as far as we 21.32s - 26.40s | just got word that there is some technical difficulty with the slides on the stream, so we 26.40s - 32.64s | apologize for that. Um, and yes, these, uh, the video of the talks will be available, uh, 32.64s - 38.84s | eventually. Uh, you know, having done this for years, usually around, could be really 38.84s - 43.84s | quick, or it could be in September or October. Um, for those of you, this is, if this is your 46.12s - 51.12s | first DEF CON, welcome, welcome, enjoy. And, um, for this talk, it is proudly presented by 51.52s - 56.52s | the Packet Hacking Village. And it is my pleasure to introduce to you someone we consider a 64.66s - 69.66s | friend for years. She is the author of The Active Defender. Uh, and, uh, she also, and you 69.66s - 74.66s | are all in for a treat today, that she has some, she has fascination and also, uh, good 86.14s - 91.14s | knowledge on mysteries and, um, also the afterlife as well. Mmm, mmm. And it is my immense 91.14s - 96.14s | pleasure to


chunk_text:
as far as we 21.32s - 26.40s | just got word that there is some technical difficulty with the slides on the stream, so we 26.40s - 32.64s | apologize for that. Um, and yes, these, uh, the video of the talks will be available, uh, 32.64s - 38.84s | eventually. Uh, you know, having done this for years, usually around, could be really 38.84s - 43.84s | quick, or it could be in September or October. Um, for those of you, this is, if this is your 46.12s - 51.12s | first DEF CON, welcome, welcome, enjoy. And, um, for this talk, it is proudly presented by 51.52s - 56.52s | the Packet Hacking Village. And it is my pleasure to introduce to you someone we consider a 64.66s - 69.66s | friend for years. She is the author of The Active Defender. Uh, and, uh, she also, and you 69.66s - 74.66s | are all in for a treat today, that she has some, she has fascination and also, uh, good 86.14s - 91.14s | knowledge on mysteries and, um, also the afterlife as well. Mmm, mmm. And it is my immense 91.14s - 96.14s | pleasure to introduce to you all our first talk and our friend, Dr. Katherine Allman. 108.20s - 115.48s | Thanks, Ming. So, uh, my, my handle's investigatorchick, for anyone who's looking, we'll 115.48s - 121.06s | cover that in a minute. Um, this talk has essentially two things going on in it. So, you're 121.08s - 127.12s | going to hit, see me giving a talk, but I'm also going to play the narrator role. So, you will see 127.12s - 132.12s | two different things happening within this talk. So, this is just me telling you a little bit 134.26s - 138.50s | first about what we're going to discuss. So, I'm going to give you a little bit of information 138.50s - 143.34s | about myself, then we're going to talk specifically about the investigative process, then we're 143.34s - 147.58s | going to talk specifically about some individual elements of that process, scoping, data 147.60s - 151.90s | gathering, data analysis, data correlation, timeline analysis, and what goes on in 151.90s - 157.14s | post-incident. Um, and then I'll summarize and we'll do some Q&A. Who here has some 157.14s - 162.74s | background in digital forensics? A few


chunk_text:
introduce to you all our first talk and our friend, Dr. Katherine Allman. 108.20s - 115.48s | Thanks, Ming. So, uh, my, my handle's investigatorchick, for anyone who's looking, we'll 115.48s - 121.06s | cover that in a minute. Um, this talk has essentially two things going on in it. So, you're 121.08s - 127.12s | going to hit, see me giving a talk, but I'm also going to play the narrator role. So, you will see 127.12s - 132.12s | two different things happening within this talk. So, this is just me telling you a little bit 134.26s - 138.50s | first about what we're going to discuss. So, I'm going to give you a little bit of information 138.50s - 143.34s | about myself, then we're going to talk specifically about the investigative process, then we're 143.34s - 147.58s | going to talk specifically about some individual elements of that process, scoping, data 147.60s - 151.90s | gathering, data analysis, data correlation, timeline analysis, and what goes on in 151.90s - 157.14s | post-incident. Um, and then I'll summarize and we'll do some Q&A. Who here has some 157.14s - 162.74s | background in digital forensics? A few of you. And who of you are just kind of like curious 162.74s - 167.66s | about digital forensics? A bunch of you. Okay, cool. It's good for me to really have a good 167.66s - 172.66s | feel for this. All right. So, a little bit about me. Um, as I said, my handle's investigatorchick. 173.18s - 178.18s | Um, it's one letter too long. So, if you look for me on Twitter or X, whatever they're calling 180.42s - 186.32s | it these days, it's investigatorchick, uh, only because there's a letter missing. Um, and 186.32s - 190.86s | then on all the other platforms, it's investigatorchick. So, I've been at the University of 190.86s - 196.66s | Buffalo for over 24 years, going on to 25. I'm on staff at a bunch of conferences, um, 196.70s - 202.90s | including here, I'm with Packet Hacking Village. Um, I volunteer and am not full staff, but 202.90s - 207.24s | volunteer for a bunch of other things. I've done a ton of speaking and I really love 207.24s - 213.36s | sloths. So, this is my boy Flash that you can kind of see up here in that


chunk_text:
of you. And who of you are just kind of like curious 162.74s - 167.66s | about digital forensics? A bunch of you. Okay, cool. It's good for me to really have a good 167.66s - 172.66s | feel for this. All right. So, a little bit about me. Um, as I said, my handle's investigatorchick. 173.18s - 178.18s | Um, it's one letter too long. So, if you look for me on Twitter or X, whatever they're calling 180.42s - 186.32s | it these days, it's investigatorchick, uh, only because there's a letter missing. Um, and 186.32s - 190.86s | then on all the other platforms, it's investigatorchick. So, I've been at the University of 190.86s - 196.66s | Buffalo for over 24 years, going on to 25. I'm on staff at a bunch of conferences, um, 196.70s - 202.90s | including here, I'm with Packet Hacking Village. Um, I volunteer and am not full staff, but 202.90s - 207.24s | volunteer for a bunch of other things. I've done a ton of speaking and I really love 207.24s - 213.36s | sloths. So, this is my boy Flash that you can kind of see up here in that corner. Uh, I 213.36s - 219.90s | adopted him at the zoo. So, let's talk about the investigative process. First of all, let's 222.50s - 226.54s | back up and talk about what forensic science is, especially since many of you are new to 226.54s - 231.96s | this field. So, it's this idea that we're going to apply science, right, to criminal and 231.96s - 236.96s | civil law, although in some cases, we're not even looking at the details of law. So, um, in 238.30s - 243.20s | my case, um, I do a combination of things, both with law enforcement, where that is the 243.20s - 248.20s | case, and I also do things like employee relations. So, sometimes it's, it's policies. 249.48s - 255.48s | But generally speaking, one of the history, the historians who is most important in this 255.48s - 261.62s | field is this awesome guy named Edmund Locard. Who's heard of Locard? Anybody? A couple 261.62s - 266.56s | people. All right. So, he's, he's awesome. He was a French criminologist. And where he's 266.56s - 272.40s | really started was this idea of, um, dactylography, which is the study of fingerprints.


chunk_text:
corner. Uh, I 213.36s - 219.90s | adopted him at the zoo. So, let's talk about the investigative process. First of all, let's 222.50s - 226.54s | back up and talk about what forensic science is, especially since many of you are new to 226.54s - 231.96s | this field. So, it's this idea that we're going to apply science, right, to criminal and 231.96s - 236.96s | civil law, although in some cases, we're not even looking at the details of law. So, um, in 238.30s - 243.20s | my case, um, I do a combination of things, both with law enforcement, where that is the 243.20s - 248.20s | case, and I also do things like employee relations. So, sometimes it's, it's policies. 249.48s - 255.48s | But generally speaking, one of the history, the historians who is most important in this 255.48s - 261.62s | field is this awesome guy named Edmund Locard. Who's heard of Locard? Anybody? A couple 261.62s - 266.56s | people. All right. So, he's, he's awesome. He was a French criminologist. And where he's 266.56s - 272.40s | really started was this idea of, um, dactylography, which is the study of fingerprints. And a 272.40s - 277.40s | lot of what we use today came from what he originally created, which is pretty awesome. Um, 279.68s - 283.88s | and he was a pioneer and, and worked in this field. And there were other folks who were 283.88s - 289.32s | involved with it. And ultimately, he was the guy that we, we followed for the, for the 289.32s - 294.32s | fingerprint stuff. So, this is his famous exchange principle. And it's this idea that, you 295.52s - 298.70s | know, ultimately, if a criminal's going to do something, they're going to leave something 298.70s - 303.70s | behind, right? So, every contact leaves a trace, is the sort of generalization that we make 304.90s - 309.90s | for these folks. Um, but really what we're talking about, um, is the, the exact quote is 310.80s - 315.80s | what you see on the slide here. That is what he actually said. So, for, for digital 315.80s - 320.80s | forensics, we're talking about logs, typically. So, what do we mean by digital forensics? 322.54s - 327.64s | Well, it's digital forensics because we're talking about digital mediums, right? So, digital


chunk_text:
And a 272.40s - 277.40s | lot of what we use today came from what he originally created, which is pretty awesome. Um, 279.68s - 283.88s | and he was a pioneer and, and worked in this field. And there were other folks who were 283.88s - 289.32s | involved with it. And ultimately, he was the guy that we, we followed for the, for the 289.32s - 294.32s | fingerprint stuff. So, this is his famous exchange principle. And it's this idea that, you 295.52s - 298.70s | know, ultimately, if a criminal's going to do something, they're going to leave something 298.70s - 303.70s | behind, right? So, every contact leaves a trace, is the sort of generalization that we make 304.90s - 309.90s | for these folks. Um, but really what we're talking about, um, is the, the exact quote is 310.80s - 315.80s | what you see on the slide here. That is what he actually said. So, for, for digital 315.80s - 320.80s | forensics, we're talking about logs, typically. So, what do we mean by digital forensics? 322.54s - 327.64s | Well, it's digital forensics because we're talking about digital mediums, right? So, digital 327.64s - 331.92s | devices, we're usually talking about computer crime. And we're going to identify, we're 331.92s - 337.56s | going to examine digital media and look for evidence of whatever it is in a forensically 337.62s - 342.56s | sound manner. I'm not going to read these, um, descriptions to you because I know you can 342.56s - 348.60s | all read them yourselves. Um, but this is the basic idea. And the process in digital 348.60s - 353.60s | forensics, and we'll see how this is a little different from traditional forensics. So, 353.60s - 358.94s | things like DNA, um, we'll talk about in just a second. But what's really important is 358.94s - 364.84s | that we acquire this evidence that we're going to take a look at and we're going to 364.84s - 369.30s | acquire it with the understanding that we're not going to change anything. We need 369.30s - 374.48s | something called chain of custody. So, you can see that form on the, on the one side 374.48s - 378.84s | that talks about specifically, um, I know the, the form itself is sort of hard to read, 378.84s - 383.68s


chunk_text:
327.64s - 331.92s | devices, we're usually talking about computer crime. And we're going to identify, we're 331.92s - 337.56s | going to examine digital media and look for evidence of whatever it is in a forensically 337.62s - 342.56s | sound manner. I'm not going to read these, um, descriptions to you because I know you can 342.56s - 348.60s | all read them yourselves. Um, but this is the basic idea. And the process in digital 348.60s - 353.60s | forensics, and we'll see how this is a little different from traditional forensics. So, 353.60s - 358.94s | things like DNA, um, we'll talk about in just a second. But what's really important is 358.94s - 364.84s | that we acquire this evidence that we're going to take a look at and we're going to 364.84s - 369.30s | acquire it with the understanding that we're not going to change anything. We need 369.30s - 374.48s | something called chain of custody. So, you can see that form on the, on the one side 374.48s - 378.84s | that talks about specifically, um, I know the, the form itself is sort of hard to read, 378.84s - 383.68s | but it, it's a property evidence form. So, what happens is when you collect this 383.68s - 388.02s | information, so you, you, you get a computer, you get a drive, or you get something that 388.02s - 393.60s | you're going to image, it shows the transition of who had it from one to another. Because 393.62s - 400.02s | if you can't show a clear and distinct path that that evidence went, then something could 400.02s - 404.54s | have changed or been messed with. I'm sure at least some of you have heard about this 404.54s - 409.60s | on the news. Yes? Yeah. So, this is really important, especially in the, in the criminal 409.60s - 415.04s | side of things. Um, we use sometimes what are called right blockers. In fact, I, I almost 415.04s - 420.72s | always use right blockers because they, uh, there are physical and there are, um, software 420.72s - 425.10s | kinds of right blockers. The thing you see the picture of in that bottom corner is a 425.10s - 431.02s | physical right blocker. So, you plug your device into, uh, whatever thing. So, in that 431.02s


chunk_text:
| but it, it's a property evidence form. So, what happens is when you collect this 383.68s - 388.02s | information, so you, you, you get a computer, you get a drive, or you get something that 388.02s - 393.60s | you're going to image, it shows the transition of who had it from one to another. Because 393.62s - 400.02s | if you can't show a clear and distinct path that that evidence went, then something could 400.02s - 404.54s | have changed or been messed with. I'm sure at least some of you have heard about this 404.54s - 409.60s | on the news. Yes? Yeah. So, this is really important, especially in the, in the criminal 409.60s - 415.04s | side of things. Um, we use sometimes what are called right blockers. In fact, I, I almost 415.04s - 420.72s | always use right blockers because they, uh, there are physical and there are, um, software 420.72s - 425.10s | kinds of right blockers. The thing you see the picture of in that bottom corner is a 425.10s - 431.02s | physical right blocker. So, you plug your device into, uh, whatever thing. So, in that 431.02s - 436.00s | picture there, you see a thumb drive plugged into it. And then that prevents anything from 436.00s - 441.82s | being written or changed on the disk. Same basic concept with software, but, um, hardware 441.82s - 446.50s | tends to be kind of the gold standard. And so, we, we have to, you know, authenticate. 446.50s - 451.92s | We have to make a copy of that information without changing the original. And that is 451.92s - 457.58s | how we do that. So, I mentioned there's a distinction between traditional and digital 457.58s - 465.80s | forensics. Who watches things like CSI or, um, you know, any of the TV shows that deal 465.80s - 470.60s | with criminalistics? At least a few people, right? Yeah. And I get a lot of people who 470.60s - 474.64s | say, oh, that stuff's crap. And what I'll tell you is that's actually not true. There's 474.64s - 480.44s | a lot of stuff that's, like, legit on those shows. What's not real is the time frame. 480.44s - 486.70s | The time frames are like, you know, we're going to do a DNA analysis. It took


chunk_text:
- 436.00s | picture there, you see a thumb drive plugged into it. And then that prevents anything from 436.00s - 441.82s | being written or changed on the disk. Same basic concept with software, but, um, hardware 441.82s - 446.50s | tends to be kind of the gold standard. And so, we, we have to, you know, authenticate. 446.50s - 451.92s | We have to make a copy of that information without changing the original. And that is 451.92s - 457.58s | how we do that. So, I mentioned there's a distinction between traditional and digital 457.58s - 465.80s | forensics. Who watches things like CSI or, um, you know, any of the TV shows that deal 465.80s - 470.60s | with criminalistics? At least a few people, right? Yeah. And I get a lot of people who 470.60s - 474.64s | say, oh, that stuff's crap. And what I'll tell you is that's actually not true. There's 474.64s - 480.44s | a lot of stuff that's, like, legit on those shows. What's not real is the time frame. 480.44s - 486.70s | The time frames are like, you know, we're going to do a DNA analysis. It took 30 minutes. 486.70s - 491.26s | Badass. Except that, you know, in real life, DNA could take, like, months to come back 491.26s - 497.50s | because it's a very, very slow process. But with traditional forensics, like DNA, you 497.50s - 503.64s | have to destroy the evidence to actually collect it and analyze it. So, for DNA, you take a 503.64s - 508.60s | sample and that sample's run through a process and the act of running it through a process 508.60s - 513.28s | changes it. Same thing with, like, something like fingerprints, right? When I collect a 513.28s - 519.40s | fingerprint, whether it's using tape or some other mechanism, you're altering that. You 519.40s - 525.56s | can't keep it pristine. But they don't expect that you can do that with digital forensics. 525.56s - 531.76s | It's a very big distinction. They don't want us changing anything. All right. So, let's 531.76s - 536.80s | move along to the actual investigative process. So, we have a number of steps. This is a very 536.80s - 543.20s | high-level talk. I'm going to talk a little bit about tools, mostly to kind of give you


chunk_text:
30 minutes. 486.70s - 491.26s | Badass. Except that, you know, in real life, DNA could take, like, months to come back 491.26s - 497.50s | because it's a very, very slow process. But with traditional forensics, like DNA, you 497.50s - 503.64s | have to destroy the evidence to actually collect it and analyze it. So, for DNA, you take a 503.64s - 508.60s | sample and that sample's run through a process and the act of running it through a process 508.60s - 513.28s | changes it. Same thing with, like, something like fingerprints, right? When I collect a 513.28s - 519.40s | fingerprint, whether it's using tape or some other mechanism, you're altering that. You 519.40s - 525.56s | can't keep it pristine. But they don't expect that you can do that with digital forensics. 525.56s - 531.76s | It's a very big distinction. They don't want us changing anything. All right. So, let's 531.76s - 536.80s | move along to the actual investigative process. So, we have a number of steps. This is a very 536.80s - 543.20s | high-level talk. I'm going to talk a little bit about tools, mostly to kind of give you 543.20s - 548.76s | a hint about what kind of tools we use and maybe how we use them. But this is not a tool 548.76s - 555.00s | talk. So, lots and lots and lots of talks cover forensic tools. So, there's lots of 555.00s - 559.48s | stuff out there. But I wanted to focus more on the process and the mindset and the thinking 559.52s - 564.56s | behind this than I do about the specific tools. So, these are going to be our steps. So, the 564.56s - 570.56s | first step is the scoping call. And, oh, and I want to mention that you're going to see 570.56s - 576.20s | this process often is not linear. We go from one to another and then we may go back and 576.20s - 596.29s | we may see that process need to be repeated. So, let's go on to our next slide. So, here, 596.29s - 602.41s | this is where I get to be your narrator. The scoping call. Detective Olivia Hart sat 602.41s - 607.41s | in her dimly lit office, the soft glow of her desk lamp casting long shadows across 607.41s -


chunk_text:
543.20s - 548.76s | a hint about what kind of tools we use and maybe how we use them. But this is not a tool 548.76s - 555.00s | talk. So, lots and lots and lots of talks cover forensic tools. So, there's lots of 555.00s - 559.48s | stuff out there. But I wanted to focus more on the process and the mindset and the thinking 559.52s - 564.56s | behind this than I do about the specific tools. So, these are going to be our steps. So, the 564.56s - 570.56s | first step is the scoping call. And, oh, and I want to mention that you're going to see 570.56s - 576.20s | this process often is not linear. We go from one to another and then we may go back and 576.20s - 596.29s | we may see that process need to be repeated. So, let's go on to our next slide. So, here, 596.29s - 602.41s | this is where I get to be your narrator. The scoping call. Detective Olivia Hart sat 602.41s - 607.41s | in her dimly lit office, the soft glow of her desk lamp casting long shadows across 607.41s - 612.69s | the worn wooden surface. The room was silent, save the occasional creak of the floorboards 612.69s - 618.85s | beneath her feet. She leaned back in her chair, running a hand over her tired eyes. Her cell 618.85s - 625.05s | phone rang, shattering the eerie silence. Detective, it's Captain Anderson. We've gathered 625.05s - 629.33s | some members of the digital forensics team to assist us with this latest homicide. The 629.33s - 636.17s | victim is Bob Byte. The sound of shuffling papers filled the air as team members began 636.17s - 640.57s | to take notes and prepare themselves for the investigation ahead. The captain ran through 640.57s - 646.65s | the basics, the time of discovery, the initial observations, and the victim's identity. 646.65s - 651.21s | Any leads, Hart asked, her voice cutting through the background noise on the line. We're focused 651.21s - 657.61s | on Alice Askey, Anderson replied, his mind racing as he considered the possibilities. 657.61s - 662.61s | We're currently interviewing friends and neighbors that they interacted with regularly. All right, 662.61s - 675.14s | Hart said, her tone firm and decisive. Keep us updated. All right. So,


chunk_text:
612.69s | the worn wooden surface. The room was silent, save the occasional creak of the floorboards 612.69s - 618.85s | beneath her feet. She leaned back in her chair, running a hand over her tired eyes. Her cell 618.85s - 625.05s | phone rang, shattering the eerie silence. Detective, it's Captain Anderson. We've gathered 625.05s - 629.33s | some members of the digital forensics team to assist us with this latest homicide. The 629.33s - 636.17s | victim is Bob Byte. The sound of shuffling papers filled the air as team members began 636.17s - 640.57s | to take notes and prepare themselves for the investigation ahead. The captain ran through 640.57s - 646.65s | the basics, the time of discovery, the initial observations, and the victim's identity. 646.65s - 651.21s | Any leads, Hart asked, her voice cutting through the background noise on the line. We're focused 651.21s - 657.61s | on Alice Askey, Anderson replied, his mind racing as he considered the possibilities. 657.61s - 662.61s | We're currently interviewing friends and neighbors that they interacted with regularly. All right, 662.61s - 675.14s | Hart said, her tone firm and decisive. Keep us updated. All right. So, the goals of the 675.14s - 679.98s | scoping call were things we just heard a little bit in the narrative, right? So, we need a 679.98s - 685.34s | summary of what happened. We need a bunch of details about any individuals. We're going 685.34s - 690.54s | to get some time stamps of some key events. And we're going to get some other details 690.54s - 697.04s | around that incident. And we're going to establish the objective. What is it that you as a forensicator 697.04s - 703.46s | are tasked with doing? And today, you all get to be a little bit of a forensic investigator 703.46s - 711.58s | because I'm going to ask you to join me in this story. So, this is the initial information 711.58s - 719.46s | you as the forensic investigator are given. Bob is dead. We knew this. He, the police 719.46s - 728.30s | are called to 456 Central Avenue. Bob is found deceased. He's found deceased at 1201 a.m. 728.30s - 735.78s | on February 13th, 2022. And they estimate his time of death to be about three hours 735.78s - 744.38s | before that. Important note.


chunk_text:
the goals of the 675.14s - 679.98s | scoping call were things we just heard a little bit in the narrative, right? So, we need a 679.98s - 685.34s | summary of what happened. We need a bunch of details about any individuals. We're going 685.34s - 690.54s | to get some time stamps of some key events. And we're going to get some other details 690.54s - 697.04s | around that incident. And we're going to establish the objective. What is it that you as a forensicator 697.04s - 703.46s | are tasked with doing? And today, you all get to be a little bit of a forensic investigator 703.46s - 711.58s | because I'm going to ask you to join me in this story. So, this is the initial information 711.58s - 719.46s | you as the forensic investigator are given. Bob is dead. We knew this. He, the police 719.46s - 728.30s | are called to 456 Central Avenue. Bob is found deceased. He's found deceased at 1201 a.m. 728.30s - 735.78s | on February 13th, 2022. And they estimate his time of death to be about three hours 735.78s - 744.38s | before that. Important note. What the cops tell us is that he appears to have been stabbed. 744.38s - 750.30s | And he's known to have this existing relationship with Alice Askey, the other name that we heard. 750.30s - 756.62s | And she lives at 123 Main Street. The police are pretty sure Alice went to Bob's house 756.62s - 764.62s | and killed him. And you've been asked to work with the team to investigate the digital relevant 764.62s - 771.02s | information and determine Alice's involvement. These are the specific objectives you are 771.02s - 777.82s | given. The police have asked you to perform an analysis on the information. And they want 777.82s - 784.06s | to know what evidence exists that proves Alice killed Bob and why did Alice kill Bob? Now, 784.06s - 791.54s | I'm here to tell you in the talk title of my talk hints at this. These are not good 791.54s - 799.14s | questions for forensics. Forensics cannot tell you why somebody did something. It cannot 799.14s - 805.38s | tell you that someone did something at all. It can tell you what happened on a system. 805.38s - 813.32s | It cannot


