# MediaChunks

chunk_id: 192_chunk_117
chunk_text:
5234.54s | So, uh, but there are a couple of microphones, if you have a question for 5234.54s - 5238.58s | our panel, come on up on each aisle. 5238.58s - 5241.38s | So if you have a question, if we've got like, I think about as you can tell, 5241.38s - 5243.30s | our panelists love to talk. 5243.30s - 5247.30s | So let's start, let's start over here on the right. 5247.54s - 5248.86s | It's a great text file for anyone. 5249.06s - 5253.70s | Oh, are the mics on the Q and a mics? 5253.74s - 5253.86s | Yeah. 5253.86s - 5255.22s | The Q and a mics need to be on. 5255.82s - 5256.10s | Okay. 5256.10s - 5256.54s | Try again. 5257.10s - 5257.42s | Hello. 5257.98s - 5258.50s | Can you hear me? 5258.82s - 5259.14s | Yes. 5259.46s - 5261.74s | So, um, it's, I mean, it's interesting. 5261.74s - 5263.30s | I've been, I think it needs to be louder. 5263.30s - 5263.54s | Sorry. 5263.54s - 5263.66s | Yeah. 5263.66s - 5264.02s | Louder. 5265.38s - 5265.82s | Hello. 5265.86s - 5266.26s | There we go. 5266.26s - 5266.66s | There we go. 5266.66s - 5271.58s | Now, um, uh, I just wanted to ask you, I I've been kind of. 5272.26s - 5273.78s | Periphery to what you guys have been doing. 5273.78s - 5279.14s | I've been in a computer networking space since the seventies, but I wanted to ask 5279.14s - 5285.22s | you about modern hacking, particularly with the, um, you know, the authoritarian 5285.26s - 5291.54s | countries like Russia, China, North Korea, kind of coming into the, you know, the 5291.54s - 5295.22s | hacking space, so to speak, just want to get your thoughts on that, you know? 5295.46s - 5299.98s | You mean in terms of, of, uh, as nation state actors or, or people in 5299.98s - 5303.54s | authoritarian States trying to get access to the free internet or. 5303.86s - 5306.06s | Well, I mean, yeah, it could be that true. 5306.06s - 5311.06s | I mean, it's impacting the culture and, and you know, what's your perceptions 5311.06s - 5314.18s | on that whole, that, that evolution that's occurred. 5315.18s - 5316.46s | Does anybody want to take that first? 5316.78s - 5320.82s | Well, if one thing


chunk_id: 192_chunk_118
chunk_text:
There we go. 5266.66s - 5271.58s | Now, um, uh, I just wanted to ask you, I I've been kind of. 5272.26s - 5273.78s | Periphery to what you guys have been doing. 5273.78s - 5279.14s | I've been in a computer networking space since the seventies, but I wanted to ask 5279.14s - 5285.22s | you about modern hacking, particularly with the, um, you know, the authoritarian 5285.26s - 5291.54s | countries like Russia, China, North Korea, kind of coming into the, you know, the 5291.54s - 5295.22s | hacking space, so to speak, just want to get your thoughts on that, you know? 5295.46s - 5299.98s | You mean in terms of, of, uh, as nation state actors or, or people in 5299.98s - 5303.54s | authoritarian States trying to get access to the free internet or. 5303.86s - 5306.06s | Well, I mean, yeah, it could be that true. 5306.06s - 5311.06s | I mean, it's impacting the culture and, and you know, what's your perceptions 5311.06s - 5314.18s | on that whole, that, that evolution that's occurred. 5315.18s - 5316.46s | Does anybody want to take that first? 5316.78s - 5320.82s | Well, if one thing I'll say about that is one thing about the hacking community 5320.82s - 5321.78s | has been really good. 5322.26s - 5327.18s | Um, on all sides of the spectrum is the idea to be able to help people in other 5327.18s - 5331.14s | countries, freely communicate with other countries because a lot of countries 5331.18s - 5336.58s | authoritarian sometime, um, they want, yeah, they seek to control the conversation 5336.90s - 5341.42s | between other countries and definitely people try to relate at with proxies or 5341.42s - 5342.14s | different tools. 5342.14s - 5346.74s | So that way they can get information out or get the information in for whatever 5346.74s - 5351.26s | purpose that could be just to talk to family or, you know, if there is, you 5351.26s - 5355.90s | know, like I said, a change in, uh, um, in, uh, you know, in, uh, in what the 5355.90s - 5357.66s | people want from their government. 5358.06s - 5361.06s | Um, so in that regard, the hacker community has been great and there's 5361.06s - 5364.94s | definitely, you know, public organizations you can get involved with and there's 5364.94s -


chunk_id: 192_chunk_119
chunk_text:
I'll say about that is one thing about the hacking community 5320.82s - 5321.78s | has been really good. 5322.26s - 5327.18s | Um, on all sides of the spectrum is the idea to be able to help people in other 5327.18s - 5331.14s | countries, freely communicate with other countries because a lot of countries 5331.18s - 5336.58s | authoritarian sometime, um, they want, yeah, they seek to control the conversation 5336.90s - 5341.42s | between other countries and definitely people try to relate at with proxies or 5341.42s - 5342.14s | different tools. 5342.14s - 5346.74s | So that way they can get information out or get the information in for whatever 5346.74s - 5351.26s | purpose that could be just to talk to family or, you know, if there is, you 5351.26s - 5355.90s | know, like I said, a change in, uh, um, in, uh, you know, in, uh, in what the 5355.90s - 5357.66s | people want from their government. 5358.06s - 5361.06s | Um, so in that regard, the hacker community has been great and there's 5361.06s - 5364.94s | definitely, you know, public organizations you can get involved with and there's 5364.94s - 5369.30s | also private ones, but that part is actually a really amazing, you know, 5369.62s - 5373.86s | smaller, not as well documented in the press, which is probably for the best in 5373.86s - 5374.14s | a way. 5374.50s - 5378.42s | Cause one thing is definitely nation States like to target reporters quite a 5378.42s - 5382.14s | bit, which is another very expensive, uh, expansive topic actually. 5382.46s - 5383.02s | But yeah, 5384.62s - 5384.82s | yeah. 5385.50s - 5386.34s | Next question over here. 5387.62s - 5391.74s | Um, back in the day we had like a Commodore and if the kid messed it up, 5391.74s - 5392.66s | you could reset it. 5392.66s - 5396.18s | And later on we had windows and you couldn't mess with it anymore because 5396.18s - 5398.94s | then dad couldn't do his work and had to get somebody to fix it. 5399.38s - 5400.94s | And you could explore. 5400.94s - 5405.46s | And now we've got webpages where you get sued because you vote, viewed the 5405.46s - 5407.22s | source code of the webpage. 5407.74s - 5411.74s | Uh, hacking used to be fun


chunk_id: 192_chunk_120
chunk_text:
5369.30s | also private ones, but that part is actually a really amazing, you know, 5369.62s - 5373.86s | smaller, not as well documented in the press, which is probably for the best in 5373.86s - 5374.14s | a way. 5374.50s - 5378.42s | Cause one thing is definitely nation States like to target reporters quite a 5378.42s - 5382.14s | bit, which is another very expensive, uh, expansive topic actually. 5382.46s - 5383.02s | But yeah, 5384.62s - 5384.82s | yeah. 5385.50s - 5386.34s | Next question over here. 5387.62s - 5391.74s | Um, back in the day we had like a Commodore and if the kid messed it up, 5391.74s - 5392.66s | you could reset it. 5392.66s - 5396.18s | And later on we had windows and you couldn't mess with it anymore because 5396.18s - 5398.94s | then dad couldn't do his work and had to get somebody to fix it. 5399.38s - 5400.94s | And you could explore. 5400.94s - 5405.46s | And now we've got webpages where you get sued because you vote, viewed the 5405.46s - 5407.22s | source code of the webpage. 5407.74s - 5411.74s | Uh, hacking used to be fun and educational and now it's become downright 5411.74s - 5412.74s | dangerous. 5412.90s - 5414.02s | So it was always dangerous. 5415.78s - 5421.66s | It's, I think it, there was a lot of us back then that we did it even despite 5421.66s - 5422.50s | it being dangerous. 5422.50s - 5426.30s | And now a lot of people are afraid to even try, what can we do to help this? 5426.34s - 5430.22s | Well, you gotta get the idiots, uh, who think they're in power out of power. 5430.22s - 5433.50s | I think what you're referring to is the attorney general in Missouri. 5435.10s - 5438.74s | Uh, if I'm to have this correct, the attorney general in Missouri decided 5438.74s - 5443.78s | that viewing source code of a webpage was tantamount to committing a crime. 5444.10s - 5446.14s | Uh, I think he threatened a reporter with jail time. 5446.34s - 5449.46s | Look, there are people who don't get technology who don't get what we're all 5449.46s - 5450.82s | about or they're not interested in getting it. 5450.82s - 5452.66s | They're just using it as hammer. 5452.70s - 5453.82s | They


chunk_id: 192_chunk_121
chunk_text:
and educational and now it's become downright 5411.74s - 5412.74s | dangerous. 5412.90s - 5414.02s | So it was always dangerous. 5415.78s - 5421.66s | It's, I think it, there was a lot of us back then that we did it even despite 5421.66s - 5422.50s | it being dangerous. 5422.50s - 5426.30s | And now a lot of people are afraid to even try, what can we do to help this? 5426.34s - 5430.22s | Well, you gotta get the idiots, uh, who think they're in power out of power. 5430.22s - 5433.50s | I think what you're referring to is the attorney general in Missouri. 5435.10s - 5438.74s | Uh, if I'm to have this correct, the attorney general in Missouri decided 5438.74s - 5443.78s | that viewing source code of a webpage was tantamount to committing a crime. 5444.10s - 5446.14s | Uh, I think he threatened a reporter with jail time. 5446.34s - 5449.46s | Look, there are people who don't get technology who don't get what we're all 5449.46s - 5450.82s | about or they're not interested in getting it. 5450.82s - 5452.66s | They're just using it as hammer. 5452.70s - 5453.82s | They use fear tactics. 5453.82s - 5457.18s | They use their own ignorance and I think that they can intimidate people. 5457.50s - 5461.98s | And, you know, hacking has always been about, um, saying, you know, we're 5461.98s - 5462.78s | going to do it anyway. 5463.26s - 5467.46s | And, um, we have to, to stand by each other and, and, and not let 5467.46s - 5468.42s | ourselves be intimidated. 5468.46s - 5470.22s | I think for me, oh yeah. 5470.74s - 5475.30s | Uh, for me, I view like hacking as inherently, uh, anti-authoritarian, 5475.34s - 5479.18s | like, like, like you are breaking into a system for me, like hacking means 5479.18s - 5483.06s | like you're doing something to a system, whether it's a computer system, a 5483.06s - 5486.66s | cultural system, anything, whether it's Ikea hacking, whatever you are doing 5486.90s - 5491.86s | something with a system that it was not intended to, that you were not intended 5491.86s - 5493.26s | to do, it might be illegal. 5493.30s - 5496.14s | I mean, Ikea hacking isn't illegal, but it's, you know, you were not that 5496.14s - 5497.34s | you're not


chunk_id: 192_chunk_122
chunk_text:
use fear tactics. 5453.82s - 5457.18s | They use their own ignorance and I think that they can intimidate people. 5457.50s - 5461.98s | And, you know, hacking has always been about, um, saying, you know, we're 5461.98s - 5462.78s | going to do it anyway. 5463.26s - 5467.46s | And, um, we have to, to stand by each other and, and, and not let 5467.46s - 5468.42s | ourselves be intimidated. 5468.46s - 5470.22s | I think for me, oh yeah. 5470.74s - 5475.30s | Uh, for me, I view like hacking as inherently, uh, anti-authoritarian, 5475.34s - 5479.18s | like, like, like you are breaking into a system for me, like hacking means 5479.18s - 5483.06s | like you're doing something to a system, whether it's a computer system, a 5483.06s - 5486.66s | cultural system, anything, whether it's Ikea hacking, whatever you are doing 5486.90s - 5491.86s | something with a system that it was not intended to, that you were not intended 5491.86s - 5493.26s | to do, it might be illegal. 5493.30s - 5496.14s | I mean, Ikea hacking isn't illegal, but it's, you know, you were not that 5496.14s - 5497.34s | you're not following the instructions. 5497.34s - 5498.62s | You're doing it your own way kind of thing. 5498.70s - 5499.50s | It's a mindset. 5499.54s - 5500.26s | Yeah, exactly. 5500.30s - 5501.82s | Hacking is an individual act. 5501.82s - 5505.38s | I mean, you know, you couldn't say that nation states use hacking, uh, 5505.38s - 5506.98s | abilities, use hacking skills. 5507.34s - 5510.58s | Uh, but hackers as a rule are individuals. 5510.58s - 5513.82s | They don't make good soldiers because they ask a lot of questions and they, 5513.82s - 5518.18s | they think outside the box and they, they type things that they shouldn't 5518.18s - 5519.66s | type and according to the rules. 5519.66s - 5520.10s | Exactly. 5520.10s - 5521.54s | So, um, something to keep in mind. 5522.54s - 5523.42s | All right over here. 5524.14s - 5525.46s | Uh, I have a question for the panel. 5525.50s - 5527.74s | Uh, the guys that could you speak up a little bit? 5527.74s - 5530.50s | I think I, uh, I have a question for the panel. 5530.50s - 5534.50s | You spoke briefly about freaking and, and ISDN and all


chunk_id: 192_chunk_123
chunk_text:
following the instructions. 5497.34s - 5498.62s | You're doing it your own way kind of thing. 5498.70s - 5499.50s | It's a mindset. 5499.54s - 5500.26s | Yeah, exactly. 5500.30s - 5501.82s | Hacking is an individual act. 5501.82s - 5505.38s | I mean, you know, you couldn't say that nation states use hacking, uh, 5505.38s - 5506.98s | abilities, use hacking skills. 5507.34s - 5510.58s | Uh, but hackers as a rule are individuals. 5510.58s - 5513.82s | They don't make good soldiers because they ask a lot of questions and they, 5513.82s - 5518.18s | they think outside the box and they, they type things that they shouldn't 5518.18s - 5519.66s | type and according to the rules. 5519.66s - 5520.10s | Exactly. 5520.10s - 5521.54s | So, um, something to keep in mind. 5522.54s - 5523.42s | All right over here. 5524.14s - 5525.46s | Uh, I have a question for the panel. 5525.50s - 5527.74s | Uh, the guys that could you speak up a little bit? 5527.74s - 5530.50s | I think I, uh, I have a question for the panel. 5530.50s - 5534.50s | You spoke briefly about freaking and, and ISDN and all that kind of cool stuff. 5534.82s - 5536.62s | Um, I'm super interested in the topic. 5536.70s - 5540.26s | Uh, what would be a good starting point for me to dive into that, that world? 5540.58s - 5541.70s | 2,600 magazine. 5542.14s - 5543.26s | Well, that's just one of many. 5543.26s - 5548.46s | There are so many, um, um, books and guides and online tutorials. 5548.62s - 5550.58s | It's hard to point to one thing. 5550.86s - 5551.82s | Exploding the phone. 5552.26s - 5555.10s | Lapsley has a book on this topic. 5555.10s - 5558.18s | It's, it's, um, it's a very long book on the history of freaking called 5558.18s - 5560.10s | exploding the phone by Phil Lapsley. 5560.98s - 5561.18s | Yeah. 5561.18s - 5563.18s | I think, I think it's, it's hacker approved. 5563.22s - 5564.02s | Everybody loves it. 5564.26s - 5564.86s | Check it out. 5565.66s - 5566.06s | Appreciate it. 5566.26s - 5566.50s | All right. 5569.70s - 5570.06s | Level. 5570.26s - 5570.66s | Oh, there we go. 5570.66s - 5574.38s | Now we have, um, back in the day, I loved reading the books 5574.38s -


chunk_id: 192_chunk_124
chunk_text:
that kind of cool stuff. 5534.82s - 5536.62s | Um, I'm super interested in the topic. 5536.70s - 5540.26s | Uh, what would be a good starting point for me to dive into that, that world? 5540.58s - 5541.70s | 2,600 magazine. 5542.14s - 5543.26s | Well, that's just one of many. 5543.26s - 5548.46s | There are so many, um, um, books and guides and online tutorials. 5548.62s - 5550.58s | It's hard to point to one thing. 5550.86s - 5551.82s | Exploding the phone. 5552.26s - 5555.10s | Lapsley has a book on this topic. 5555.10s - 5558.18s | It's, it's, um, it's a very long book on the history of freaking called 5558.18s - 5560.10s | exploding the phone by Phil Lapsley. 5560.98s - 5561.18s | Yeah. 5561.18s - 5563.18s | I think, I think it's, it's hacker approved. 5563.22s - 5564.02s | Everybody loves it. 5564.26s - 5564.86s | Check it out. 5565.66s - 5566.06s | Appreciate it. 5566.26s - 5566.50s | All right. 5569.70s - 5570.06s | Level. 5570.26s - 5570.66s | Oh, there we go. 5570.66s - 5574.38s | Now we have, um, back in the day, I loved reading the books 5574.38s - 5576.18s | about hackers in the eighties and nineties. 5576.62s - 5580.26s | Uh, I'm curious about commentary from folks who have appeared, uh, as 5580.30s - 5585.38s | semi fictional characters in unauthorized biographies, laud mod wars, things like 5585.38s - 5590.18s | that, or those who have appeared as a named character in a movie, or even 5590.18s - 5595.26s | to have in a book now where they've worked with the author, I mean, uh, I 5595.26s - 5598.82s | can't speaking, you know, from, for the CDC book who the author of whom is 5598.82s - 5602.58s | hiding behind his notebook right there for some men, like, you know, what I 5602.58s - 5605.86s | would say is it is not the book that, that we would have written about CDC, 5605.90s - 5607.18s | but we didn't write the fucking book. 5607.54s - 5610.82s | So, uh, you know, and I think he, he did, he did write by us. 5610.82s - 5615.42s | I think, um, largely speaking, I think, you know, uh, John might have a 5615.42s - 5617.78s | different opinion about the, the, the MOD book. 5617.82s - 5619.78s |


chunk_id: 192_chunk_125
chunk_text:
5576.18s | about hackers in the eighties and nineties. 5576.62s - 5580.26s | Uh, I'm curious about commentary from folks who have appeared, uh, as 5580.30s - 5585.38s | semi fictional characters in unauthorized biographies, laud mod wars, things like 5585.38s - 5590.18s | that, or those who have appeared as a named character in a movie, or even 5590.18s - 5595.26s | to have in a book now where they've worked with the author, I mean, uh, I 5595.26s - 5598.82s | can't speaking, you know, from, for the CDC book who the author of whom is 5598.82s - 5602.58s | hiding behind his notebook right there for some men, like, you know, what I 5602.58s - 5605.86s | would say is it is not the book that, that we would have written about CDC, 5605.90s - 5607.18s | but we didn't write the fucking book. 5607.54s - 5610.82s | So, uh, you know, and I think he, he did, he did write by us. 5610.82s - 5615.42s | I think, um, largely speaking, I think, you know, uh, John might have a 5615.42s - 5617.78s | different opinion about the, the, the MOD book. 5617.82s - 5619.78s | Maybe you can talk about how, what that was for you. 5619.86s - 5620.26s | Yeah. 5621.86s - 5624.02s | Was there even a, um, a mod laud war? 5624.54s - 5625.34s | Did that really happen? 5625.38s - 5625.74s | Oh yeah. 5625.74s - 5626.06s | What? 5626.34s - 5627.26s | Did that even exist? 5627.46s - 5628.62s | Was there a mod laud war? 5628.62s - 5629.30s | Cyber war. 5631.06s - 5632.42s | That's for a different session. 5632.54s - 5632.82s | Okay. 5634.82s - 5637.70s | And if you're referring to Emmanuel Goldstein in, uh, in the film 5637.70s - 5638.82s | Hackers, that was a joke. 5638.90s - 5641.54s | But I have a, oh yeah, I do have a quick story. 5641.54s - 5643.26s | So, and, and, and a plug. 5643.26s - 5647.94s | So I have a, uh, I'm working, I, I rep by, uh, uh, SpectraVision, 5647.94s - 5649.22s | which is Elijah Woods company. 5649.22s - 5653.62s | And I'm going to do, uh, one of the projects I'm going to do is a Spotify, 5654.50s - 5659.14s | uh, based, um, uh, podcasts about hacking and stuff, you know?


chunk_id: 192_chunk_126
chunk_text:
Maybe you can talk about how, what that was for you. 5619.86s - 5620.26s | Yeah. 5621.86s - 5624.02s | Was there even a, um, a mod laud war? 5624.54s - 5625.34s | Did that really happen? 5625.38s - 5625.74s | Oh yeah. 5625.74s - 5626.06s | What? 5626.34s - 5627.26s | Did that even exist? 5627.46s - 5628.62s | Was there a mod laud war? 5628.62s - 5629.30s | Cyber war. 5631.06s - 5632.42s | That's for a different session. 5632.54s - 5632.82s | Okay. 5634.82s - 5637.70s | And if you're referring to Emmanuel Goldstein in, uh, in the film 5637.70s - 5638.82s | Hackers, that was a joke. 5638.90s - 5641.54s | But I have a, oh yeah, I do have a quick story. 5641.54s - 5643.26s | So, and, and, and a plug. 5643.26s - 5647.94s | So I have a, uh, I'm working, I, I rep by, uh, uh, SpectraVision, 5647.94s - 5649.22s | which is Elijah Woods company. 5649.22s - 5653.62s | And I'm going to do, uh, one of the projects I'm going to do is a Spotify, 5654.50s - 5659.14s | uh, based, um, uh, podcasts about hacking and stuff, you know? 5659.38s - 5662.66s | But one of the stories that's interesting is that this guy wrote a, 5663.26s - 5666.42s | a book, a fucking, what's it called? 5666.42s - 5668.10s | A, a graphic novel. 5668.10s - 5672.18s | He's a very famous graphic novelist and he wrote a story and he 5672.18s - 5675.62s | actually lifted a lot of my story. 5675.90s - 5678.78s | There's actually another book that, uh, the Hacker Cracker book 5678.78s - 5680.58s | that that guy stole my story. 5680.58s - 5685.38s | He said he was a Decepticon from Brooklyn, but yo, Decepts was over by 2000, 5685.38s - 5685.66s | brother. 5685.66s - 5686.62s | I was the only one. 5687.06s - 5688.70s | Yo, why you stealing my street cred? 5688.70s - 5692.86s | But yo, this other guy wrote this book, steals part of my story, puts it in 5692.86s - 5696.10s | there, but didn't turn around just the other day. 5696.10s - 5701.18s | Unfortunately he, he committed suicide and it's just such a bizarre set of 5701.18s - 5706.38s | circumstances that like, you know, we're going to have his partner on the show.


chunk_id: 192_chunk_127
chunk_text:
5659.38s - 5662.66s | But one of the stories that's interesting is that this guy wrote a, 5663.26s - 5666.42s | a book, a fucking, what's it called? 5666.42s - 5668.10s | A, a graphic novel. 5668.10s - 5672.18s | He's a very famous graphic novelist and he wrote a story and he 5672.18s - 5675.62s | actually lifted a lot of my story. 5675.90s - 5678.78s | There's actually another book that, uh, the Hacker Cracker book 5678.78s - 5680.58s | that that guy stole my story. 5680.58s - 5685.38s | He said he was a Decepticon from Brooklyn, but yo, Decepts was over by 2000, 5685.38s - 5685.66s | brother. 5685.66s - 5686.62s | I was the only one. 5687.06s - 5688.70s | Yo, why you stealing my street cred? 5688.70s - 5692.86s | But yo, this other guy wrote this book, steals part of my story, puts it in 5692.86s - 5696.10s | there, but didn't turn around just the other day. 5696.10s - 5701.18s | Unfortunately he, he committed suicide and it's just such a bizarre set of 5701.18s - 5706.38s | circumstances that like, you know, we're going to have his partner on the show. 5706.38s - 5708.10s | I just can't believe like that. 5708.66s - 5708.98s | Yeah. 5709.10s - 5712.42s | And, and then, yeah, just some shit happened where he, um, wound up accused 5712.46s - 5717.70s | of, um, um, inappropriate, um, conversations with people who are under 5717.70s - 5719.70s | age and a sexual manner. 5719.70s - 5722.18s | And then, you know, and, and he committed suicide. 5722.18s - 5724.10s | So it was just weird, you know, link. 5724.10s - 5726.30s | But anyway, I just wanted to tell that story since you had mentioned like 5726.58s - 5730.46s | fictional stuff and you know, I see stuff sometime, like I'm like, ah, I 5730.46s - 5731.82s | say, yo, I don't give a shit. 5731.86s - 5732.54s | Like, you know what I mean? 5732.54s - 5736.54s | But sometime they do, they kind of, yeah, they be stealing my shit a little too much. 5736.90s - 5738.46s | In, in a CDC, we have a thing. 5738.46s - 5740.86s | Like we keep track of like people who like claim they're part of the 5740.86s - 5741.66s | cult of the cow, whatever. 5741.66s


chunk_id: 192_chunk_128
chunk_text:
5706.38s - 5708.10s | I just can't believe like that. 5708.66s - 5708.98s | Yeah. 5709.10s - 5712.42s | And, and then, yeah, just some shit happened where he, um, wound up accused 5712.46s - 5717.70s | of, um, um, inappropriate, um, conversations with people who are under 5717.70s - 5719.70s | age and a sexual manner. 5719.70s - 5722.18s | And then, you know, and, and he committed suicide. 5722.18s - 5724.10s | So it was just weird, you know, link. 5724.10s - 5726.30s | But anyway, I just wanted to tell that story since you had mentioned like 5726.58s - 5730.46s | fictional stuff and you know, I see stuff sometime, like I'm like, ah, I 5730.46s - 5731.82s | say, yo, I don't give a shit. 5731.86s - 5732.54s | Like, you know what I mean? 5732.54s - 5736.54s | But sometime they do, they kind of, yeah, they be stealing my shit a little too much. 5736.90s - 5738.46s | In, in a CDC, we have a thing. 5738.46s - 5740.86s | Like we keep track of like people who like claim they're part of the 5740.86s - 5741.66s | cult of the cow, whatever. 5741.66s - 5743.42s | And we, the phrase you use is stolen utter. 5743.74s - 5748.90s | So I'm still, yeah, we get, we, we keep a list, man. 5749.74s - 5749.98s | All right. 5749.98s - 5750.66s | Next one over here. 5751.38s - 5753.46s | Uh, so not so much questions. 5753.62s - 5757.26s | Oh, not so much a question or anything. 5757.26s - 5761.06s | Just wanted to say, this is the, my fourth con, my fourth death con, uh, 5761.10s - 5761.66s | DEF CON. 5761.66s - 5766.74s | And, uh, uh, this is probably my favorite panel in the four DEF CONS. 5766.90s - 5767.50s | All right. 5771.50s - 5774.10s | You know, I always wonder, like when I was putting in the proposal for this, 5774.10s - 5775.62s | I'm like, is this something people give a shit about? 5775.62s - 5776.46s | Like, it's important to me. 5776.46s - 5778.38s | It's important to us, but I don't know whether you guys care. 5778.38s - 5780.58s | Like I'm going to give you a little piece of my history. 5780.62s - 5787.50s | Uh, I started hacking two to three years before


chunk_id: 192_chunk_129
chunk_text:
- 5743.42s | And we, the phrase you use is stolen utter. 5743.74s - 5748.90s | So I'm still, yeah, we get, we, we keep a list, man. 5749.74s - 5749.98s | All right. 5749.98s - 5750.66s | Next one over here. 5751.38s - 5753.46s | Uh, so not so much questions. 5753.62s - 5757.26s | Oh, not so much a question or anything. 5757.26s - 5761.06s | Just wanted to say, this is the, my fourth con, my fourth death con, uh, 5761.10s - 5761.66s | DEF CON. 5761.66s - 5766.74s | And, uh, uh, this is probably my favorite panel in the four DEF CONS. 5766.90s - 5767.50s | All right. 5771.50s - 5774.10s | You know, I always wonder, like when I was putting in the proposal for this, 5774.10s - 5775.62s | I'm like, is this something people give a shit about? 5775.62s - 5776.46s | Like, it's important to me. 5776.46s - 5778.38s | It's important to us, but I don't know whether you guys care. 5778.38s - 5780.58s | Like I'm going to give you a little piece of my history. 5780.62s - 5787.50s | Uh, I started hacking two to three years before you guys created CDC. 5788.22s - 5794.86s | And, uh, my first, you know, Commodore 64, um, with the modem, I had the 5794.86s - 5800.66s | little plugin slide modem, uh, I, I, I reserved the airline ticket for 5800.66s - 5802.82s | Michael Jackson to fly and come to my house. 5805.18s - 5810.02s | One of the first things I had the, the Casio phone dialer, and I used to 5810.02s - 5812.62s | freak the hell out of my face with that. 5812.62s - 5815.98s | So I want to say, you know, you guys gave me a flashback to the past, man. 5815.98s - 5817.02s | That was a beautiful thing. 5817.26s - 5817.82s | Got the book. 5817.82s - 5818.50s | I'm going to love it. 5818.50s - 5818.90s | Read it. 5819.38s - 5820.14s | Thank you for coming. 5820.46s - 5821.18s | I want to hear more. 5823.46s - 5826.02s | I think you got one over here and then, yeah, I think we're almost out of time. 5826.02s - 5826.14s | Right? 5826.14s - 5826.34s | Yeah. 5826.82s - 5827.02s | Yeah. 5827.06s - 5827.42s | Over here. 5827.78s - 5828.70s


chunk_id: 192_chunk_130
chunk_text:
you guys created CDC. 5788.22s - 5794.86s | And, uh, my first, you know, Commodore 64, um, with the modem, I had the 5794.86s - 5800.66s | little plugin slide modem, uh, I, I, I reserved the airline ticket for 5800.66s - 5802.82s | Michael Jackson to fly and come to my house. 5805.18s - 5810.02s | One of the first things I had the, the Casio phone dialer, and I used to 5810.02s - 5812.62s | freak the hell out of my face with that. 5812.62s - 5815.98s | So I want to say, you know, you guys gave me a flashback to the past, man. 5815.98s - 5817.02s | That was a beautiful thing. 5817.26s - 5817.82s | Got the book. 5817.82s - 5818.50s | I'm going to love it. 5818.50s - 5818.90s | Read it. 5819.38s - 5820.14s | Thank you for coming. 5820.46s - 5821.18s | I want to hear more. 5823.46s - 5826.02s | I think you got one over here and then, yeah, I think we're almost out of time. 5826.02s - 5826.14s | Right? 5826.14s - 5826.34s | Yeah. 5826.82s - 5827.02s | Yeah. 5827.06s - 5827.42s | Over here. 5827.78s - 5828.70s | Until they kick us off. 5828.74s - 5829.30s | That's what they kick us. 5829.30s - 5829.50s | Okay. 5829.50s - 5830.14s | We're just going to keep going. 5830.50s - 5831.50s | We're hacking the schedule. 5831.54s - 5833.70s | How are we going to talk about real hacking shit? 5833.74s - 5834.58s | You guys ready? 5834.58s - 5836.58s | That, that just only got started. 5838.02s - 5838.14s | Yeah. 5838.14s - 5840.94s | I mean, like we could talk about this shit for fucking days, as you can tell, 5841.54s - 5847.06s | so I saw a few of you have a title of archivist or part of your, your bios for 5847.54s - 5853.10s | archivist for those that might be in the audience, like me, who might have archives 5853.10s - 5857.78s | from the eighties and nineties, all that old crap that we have laying around on 5857.78s - 5859.86s | floppy disks or printouts or something. 5860.30s - 5861.78s | Is there stuff you're looking for? 5862.22s - 5863.50s | That is an excellent question. 5863.50s - 5864.22s | All of it. 5864.46s - 5865.22s | Yeah, absolutely. 5865.22s - 5865.70s


chunk_id: 192_chunk_131
chunk_text:
| Until they kick us off. 5828.74s - 5829.30s | That's what they kick us. 5829.30s - 5829.50s | Okay. 5829.50s - 5830.14s | We're just going to keep going. 5830.50s - 5831.50s | We're hacking the schedule. 5831.54s - 5833.70s | How are we going to talk about real hacking shit? 5833.74s - 5834.58s | You guys ready? 5834.58s - 5836.58s | That, that just only got started. 5838.02s - 5838.14s | Yeah. 5838.14s - 5840.94s | I mean, like we could talk about this shit for fucking days, as you can tell, 5841.54s - 5847.06s | so I saw a few of you have a title of archivist or part of your, your bios for 5847.54s - 5853.10s | archivist for those that might be in the audience, like me, who might have archives 5853.10s - 5857.78s | from the eighties and nineties, all that old crap that we have laying around on 5857.78s - 5859.86s | floppy disks or printouts or something. 5860.30s - 5861.78s | Is there stuff you're looking for? 5862.22s - 5863.50s | That is an excellent question. 5863.50s - 5864.22s | All of it. 5864.46s - 5865.22s | Yeah, absolutely. 5865.22s - 5865.70s | All of it. 5865.82s - 5866.10s | Okay. 5866.70s - 5870.50s | We should chat after, uh, I don't know. 5870.50s - 5875.14s | I mean, I have ran an elite three disks laying around from the bulletin board that 5875.14s - 5875.66s | I ran. 5875.90s - 5880.46s | I mean, you definitely want to talk to Jason Scott, archive.org. 5880.50s - 5883.14s | I mean, that's, that's good for like the, the, the media and stuff. 5883.14s - 5885.98s | I think a bigger question that, you know, we've been talking about for years is some 5885.98s - 5889.14s | sort of like to find an organization, a university, a museum or something that 5889.14s - 5892.14s | would take, create like a collection based for the computer underground. 5892.14s - 5896.30s | And I've been talking about like the need to do, you know, basically an oral history 5896.30s - 5896.98s | of the computer underground. 5896.98s - 5898.34s | Cause we're fucking dying, man. 5898.34s - 5902.02s | Like literally like, you know, three, there are three CDC members who've died in the 5902.02s - 5902.90s | last few years. 5903.30s - 5907.42s | Um,


chunk_id: 192_chunk_132
chunk_text:
| All of it. 5865.82s - 5866.10s | Okay. 5866.70s - 5870.50s | We should chat after, uh, I don't know. 5870.50s - 5875.14s | I mean, I have ran an elite three disks laying around from the bulletin board that 5875.14s - 5875.66s | I ran. 5875.90s - 5880.46s | I mean, you definitely want to talk to Jason Scott, archive.org. 5880.50s - 5883.14s | I mean, that's, that's good for like the, the, the media and stuff. 5883.14s - 5885.98s | I think a bigger question that, you know, we've been talking about for years is some 5885.98s - 5889.14s | sort of like to find an organization, a university, a museum or something that 5889.14s - 5892.14s | would take, create like a collection based for the computer underground. 5892.14s - 5896.30s | And I've been talking about like the need to do, you know, basically an oral history 5896.30s - 5896.98s | of the computer underground. 5896.98s - 5898.34s | Cause we're fucking dying, man. 5898.34s - 5902.02s | Like literally like, you know, three, there are three CDC members who've died in the 5902.02s - 5902.90s | last few years. 5903.30s - 5907.42s | Um, the founder of root just passed away last year and like, these are, you know, 5907.42s - 5911.02s | it's like, like the Blade Runner thing, you know, these are stories passing away 5911.02s - 5912.58s | like tears and tears in the rain. 5912.58s - 5916.54s | Like, uh, and, and for me, you know, I certainly wouldn't be the person I am if 5916.54s - 5919.38s | it hadn't been for the hacker community and like coming up through this and like, 5919.38s - 5923.46s | so I think this culture is important both personally and because as I was alluding to 5923.50s - 5929.70s | earlier, it has had a massive impact on, you know, outside culture, you know, sort 5929.70s - 5931.38s | of Normie culture. 5932.10s - 5935.86s | But if you're looking for a clearing house, um, right now, in my opinion, 5935.86s - 5939.70s | archive.org is doing the best job and Jason Scott has a real passion for our 5939.70s - 5941.78s | community and has done so much. 5941.82s - 5946.02s | He was, he, you know, the, my, the, the, the big hacker board that was a CDC board 5946.06s


chunk_id: 192_chunk_133
chunk_text:
the founder of root just passed away last year and like, these are, you know, 5907.42s - 5911.02s | it's like, like the Blade Runner thing, you know, these are stories passing away 5911.02s - 5912.58s | like tears and tears in the rain. 5912.58s - 5916.54s | Like, uh, and, and for me, you know, I certainly wouldn't be the person I am if 5916.54s - 5919.38s | it hadn't been for the hacker community and like coming up through this and like, 5919.38s - 5923.46s | so I think this culture is important both personally and because as I was alluding to 5923.50s - 5929.70s | earlier, it has had a massive impact on, you know, outside culture, you know, sort 5929.70s - 5931.38s | of Normie culture. 5932.10s - 5935.86s | But if you're looking for a clearing house, um, right now, in my opinion, 5935.86s - 5939.70s | archive.org is doing the best job and Jason Scott has a real passion for our 5939.70s - 5941.78s | community and has done so much. 5941.82s - 5946.02s | He was, he, you know, the, my, the, the, the big hacker board that was a CDC board 5946.06s - 5948.86s | that I was on was the works in, in Boston. 5948.86s - 5952.78s | You, if you read like duo securities, like history of the loft, like that is where 5952.78s - 5955.54s | the loft came together, was on this bulletin board on the works. 5955.54s - 5957.10s | And it was founded by Jason Scott. 5957.10s - 5960.82s | So, you know, he doesn't really talk about that stuff, but he was instrumental, like 5960.82s - 5966.06s | sort of, um, by extension in bringing together a lot of the people who were then 5966.06s - 5968.22s | instrumental in, in the hacker scene of the nineties. 5968.38s - 5971.46s | And any remnant of geo cities that still exist today, it's because of him. 5977.02s - 5978.42s | So, first of all, thank you guys. 5978.46s - 5984.38s | Uh, you know, growing up with CDC text files and hope 2001, 2002, um, hugely 5984.50s - 5985.54s | formative experiences. 5985.54s - 5986.66s | So thank you guys for this. 5986.66s - 5988.46s | This is a, is a big deal for me. 5989.30s - 5993.66s | Um, we talked about, you know, hacking


chunk_id: 192_chunk_134
chunk_text:
- 5948.86s | that I was on was the works in, in Boston. 5948.86s - 5952.78s | You, if you read like duo securities, like history of the loft, like that is where 5952.78s - 5955.54s | the loft came together, was on this bulletin board on the works. 5955.54s - 5957.10s | And it was founded by Jason Scott. 5957.10s - 5960.82s | So, you know, he doesn't really talk about that stuff, but he was instrumental, like 5960.82s - 5966.06s | sort of, um, by extension in bringing together a lot of the people who were then 5966.06s - 5968.22s | instrumental in, in the hacker scene of the nineties. 5968.38s - 5971.46s | And any remnant of geo cities that still exist today, it's because of him. 5977.02s - 5978.42s | So, first of all, thank you guys. 5978.46s - 5984.38s | Uh, you know, growing up with CDC text files and hope 2001, 2002, um, hugely 5984.50s - 5985.54s | formative experiences. 5985.54s - 5986.66s | So thank you guys for this. 5986.66s - 5988.46s | This is a, is a big deal for me. 5989.30s - 5993.66s | Um, we talked about, you know, hacking has always been dangerous, but which is true, 5993.66s - 5995.74s | but you know, back in the day, they didn't really know what to do with us. 5995.74s - 5995.94s | Right. 5995.94s - 5999.94s | You talked about stuff was left on passworded and whatever these days you 5999.94s - 6002.30s | really run the risk getting in somewhere. 6002.30s - 6004.50s | They're going to, you know, throw the book at you. 6005.14s - 6010.70s | Um, what are some things you think we can do to kind of give back, you know, uh, 6010.74s - 6016.30s | provide hosting or something without exposing ourselves to undue risk, um, and 6016.30s - 6019.18s | contribute to the de-shitification of being inclusive is huge. 6019.18s - 6023.74s | Being inclusive to the people we perceive as enemies, because that's the way they 6023.74s - 6025.30s | understand what we're all about. 6025.34s - 6029.18s | You know, having people attend conferences like this one, seeing what hacker spirit 6029.18s - 6034.10s | truly is, maybe they won't want to lock us up then maybe, you know, they'll listen. 6034.10s - 6035.98s | Maybe they'll reach out to us


chunk_id: 192_chunk_135
chunk_text:
has always been dangerous, but which is true, 5993.66s - 5995.74s | but you know, back in the day, they didn't really know what to do with us. 5995.74s - 5995.94s | Right. 5995.94s - 5999.94s | You talked about stuff was left on passworded and whatever these days you 5999.94s - 6002.30s | really run the risk getting in somewhere. 6002.30s - 6004.50s | They're going to, you know, throw the book at you. 6005.14s - 6010.70s | Um, what are some things you think we can do to kind of give back, you know, uh, 6010.74s - 6016.30s | provide hosting or something without exposing ourselves to undue risk, um, and 6016.30s - 6019.18s | contribute to the de-shitification of being inclusive is huge. 6019.18s - 6023.74s | Being inclusive to the people we perceive as enemies, because that's the way they 6023.74s - 6025.30s | understand what we're all about. 6025.34s - 6029.18s | You know, having people attend conferences like this one, seeing what hacker spirit 6029.18s - 6034.10s | truly is, maybe they won't want to lock us up then maybe, you know, they'll listen. 6034.10s - 6035.98s | Maybe they'll reach out to us instead. 6036.26s - 6040.02s | You know, speaking personally, uh, what I was convicted of. 6040.06s - 6044.02s | If that happened today, I wouldn't be around, you know, that there's just no 6044.02s - 6048.98s | way I was treated fairly and look what I did, you know, I annoyed the hell out of, 6048.98s - 6051.90s | uh, uh, the, the powers that be for, for four decades. 6052.30s - 6057.06s | Um, so, you know, it's, um, if, if you treat people, right. 6057.06s - 6059.90s | If you, uh, listen to what they're doing, what they're saying, you'll 6059.90s - 6060.98s | learn something from them. 6060.98s - 6062.66s | And that, that works in all directions. 6062.78s - 6067.06s | I mean, I think that's true, but also like there are, you know, as you, things 6067.06s - 6070.54s | have changed in some ways, like there's stuff that I did, um, that I'm not going 6070.54s - 6073.94s | to necessarily talk about that, that, uh, you know, I might've gotten like at the 6073.94s - 6077.22s | time, kind of like a slap on the wrist or it might've been a, you know,


chunk_id: 192_chunk_136
chunk_text:
instead. 6036.26s - 6040.02s | You know, speaking personally, uh, what I was convicted of. 6040.06s - 6044.02s | If that happened today, I wouldn't be around, you know, that there's just no 6044.02s - 6048.98s | way I was treated fairly and look what I did, you know, I annoyed the hell out of, 6048.98s - 6051.90s | uh, uh, the, the powers that be for, for four decades. 6052.30s - 6057.06s | Um, so, you know, it's, um, if, if you treat people, right. 6057.06s - 6059.90s | If you, uh, listen to what they're doing, what they're saying, you'll 6059.90s - 6060.98s | learn something from them. 6060.98s - 6062.66s | And that, that works in all directions. 6062.78s - 6067.06s | I mean, I think that's true, but also like there are, you know, as you, things 6067.06s - 6070.54s | have changed in some ways, like there's stuff that I did, um, that I'm not going 6070.54s - 6073.94s | to necessarily talk about that, that, uh, you know, I might've gotten like at the 6073.94s - 6077.22s | time, kind of like a slap on the wrist or it might've been a, you know, something 6077.22s - 6080.86s | that now, now, you know, it wouldn't necessarily be Gitmo, but it would, you 6080.86s - 6085.34s | know, like I would not, it would not be a happy experience for me if today, if I 6085.34s - 6088.78s | was busted for stuff that happened, that, you know, that what the punishment would 6088.78s - 6089.50s | have been back then. 6089.50s - 6094.30s | And there are kids whose lives are going to be ruined in the future if we don't 6094.30s - 6095.02s | change this. 6095.90s - 6096.42s | All right. 6096.62s - 6101.46s | Well, let me, if I could jump in on that real quick, just the idea, one, one thing 6101.46s - 6106.66s | that I think is interesting is that that question is interesting for me. 6106.66s - 6113.54s | I would say that ultimately it is better to not have fear. 6113.54s - 6117.78s | You should be not afraid to explore the world around us. 6117.82s - 6123.58s | I think the first thought is to just think about, I like the idea of just blue sky 6123.58s - 6127.70s | ideation and just being


chunk_id: 192_chunk_137
chunk_text:
something 6077.22s - 6080.86s | that now, now, you know, it wouldn't necessarily be Gitmo, but it would, you 6080.86s - 6085.34s | know, like I would not, it would not be a happy experience for me if today, if I 6085.34s - 6088.78s | was busted for stuff that happened, that, you know, that what the punishment would 6088.78s - 6089.50s | have been back then. 6089.50s - 6094.30s | And there are kids whose lives are going to be ruined in the future if we don't 6094.30s - 6095.02s | change this. 6095.90s - 6096.42s | All right. 6096.62s - 6101.46s | Well, let me, if I could jump in on that real quick, just the idea, one, one thing 6101.46s - 6106.66s | that I think is interesting is that that question is interesting for me. 6106.66s - 6113.54s | I would say that ultimately it is better to not have fear. 6113.54s - 6117.78s | You should be not afraid to explore the world around us. 6117.82s - 6123.58s | I think the first thought is to just think about, I like the idea of just blue sky 6123.58s - 6127.70s | ideation and just being able to explore, which is the heart of the hacker 6127.70s - 6128.34s | community. 6128.74s - 6133.22s | When you start erecting too many rules around yourself and guidelines, yo, you 6133.22s - 6135.70s | just limit your own creativity. 6135.74s - 6142.02s | Like I had a class that I taught at university and about hacktivism and one 6142.02s - 6147.94s | of the, one of the amazing classes was called a, we, we had them ask, come up 6147.94s - 6150.62s | with ideas how to defeat AI just on paper. 6151.06s - 6152.58s | And they loved the class. 6152.58s - 6154.62s | It was an amazing fucking class. 6155.34s - 6160.54s | I would hire all of them for work on a, on a, on a contract. 6160.82s - 6164.74s | But my point being is that it's multiple ways to think about ideas. 6164.74s - 6169.22s | I think what happens is so many people get caught up in, in that. 6169.26s - 6173.94s | And like I said, they never get a chance to fully explore the intellectual, you 6173.94s - 6176.18s | know, abilities that they have. 6176.18s - 6179.54s | And


chunk_id: 192_chunk_138
chunk_text:
able to explore, which is the heart of the hacker 6127.70s - 6128.34s | community. 6128.74s - 6133.22s | When you start erecting too many rules around yourself and guidelines, yo, you 6133.22s - 6135.70s | just limit your own creativity. 6135.74s - 6142.02s | Like I had a class that I taught at university and about hacktivism and one 6142.02s - 6147.94s | of the, one of the amazing classes was called a, we, we had them ask, come up 6147.94s - 6150.62s | with ideas how to defeat AI just on paper. 6151.06s - 6152.58s | And they loved the class. 6152.58s - 6154.62s | It was an amazing fucking class. 6155.34s - 6160.54s | I would hire all of them for work on a, on a, on a contract. 6160.82s - 6164.74s | But my point being is that it's multiple ways to think about ideas. 6164.74s - 6169.22s | I think what happens is so many people get caught up in, in that. 6169.26s - 6173.94s | And like I said, they never get a chance to fully explore the intellectual, you 6173.94s - 6176.18s | know, abilities that they have. 6176.18s - 6179.54s | And that may include exploring and finding new loopholes. 6179.54s - 6184.14s | Like I said, just even doing it on paper or chat GPT, you know, you could break 6184.14s - 6186.06s | chat GPT, go poison the model. 6186.06s - 6189.82s | Maybe I'm saying too much, but the point is that, yo, no one's gonna arrest you 6189.82s - 6191.86s | for that yet, soon, not yet. 6193.30s - 6195.70s | There's so many domains to explore. 6196.02s - 6197.26s | Um, um, yeah. 6197.26s - 6200.90s | And I think, you know, you could say, be careful, but I also say, yo, sometimes 6200.90s - 6202.42s | you just gotta get out there and do shit. 6202.78s - 6204.46s | This is not legal advice. 6206.90s - 6207.82s | But it's good advice. 6207.94s - 6208.54s | It's good advice. 6208.54s - 6209.06s | It's good advice. 6209.26s - 6209.98s | I'm trying my best. 6209.98s - 6211.02s | My I'm from Canada. 6211.02s - 6216.26s | My flipper zero is illegal, but, Oh, Oh, all right. 6216.26s - 6216.66s | Over here. 6221.18s - 6222.02s | Hit the microphone on. 6223.42s - 6224.22s | Oh, there's


chunk_id: 192_chunk_139
chunk_text:
that may include exploring and finding new loopholes. 6179.54s - 6184.14s | Like I said, just even doing it on paper or chat GPT, you know, you could break 6184.14s - 6186.06s | chat GPT, go poison the model. 6186.06s - 6189.82s | Maybe I'm saying too much, but the point is that, yo, no one's gonna arrest you 6189.82s - 6191.86s | for that yet, soon, not yet. 6193.30s - 6195.70s | There's so many domains to explore. 6196.02s - 6197.26s | Um, um, yeah. 6197.26s - 6200.90s | And I think, you know, you could say, be careful, but I also say, yo, sometimes 6200.90s - 6202.42s | you just gotta get out there and do shit. 6202.78s - 6204.46s | This is not legal advice. 6206.90s - 6207.82s | But it's good advice. 6207.94s - 6208.54s | It's good advice. 6208.54s - 6209.06s | It's good advice. 6209.26s - 6209.98s | I'm trying my best. 6209.98s - 6211.02s | My I'm from Canada. 6211.02s - 6216.26s | My flipper zero is illegal, but, Oh, Oh, all right. 6216.26s - 6216.66s | Over here. 6221.18s - 6222.02s | Hit the microphone on. 6223.42s - 6224.22s | Oh, there's nobody here. 6224.38s - 6225.10s | There's nobody there. 6226.02s - 6227.06s | Wait, wait, wait, wait, wait. 6228.06s - 6228.42s | Test. 6228.50s - 6228.98s | Yeah, there you go. 6228.98s - 6229.50s | You're good. 6232.50s - 6235.46s | I don't know what to call it, but I'm going to call it the underground fed side 6236.94s - 6241.46s | because we did things that weren't approved of by the FBI. 6242.78s - 6243.30s | Okay. 6244.14s - 6249.06s | Um, one of them was even coming to DEF CON conferences surreptitiously because 6249.06s - 6252.70s | we wanted to know how to harden a nationally secure computer, which we'd 6252.70s - 6256.18s | signed off in blood that we did a good job, but we couldn't get a list of what 6256.18s - 6261.94s | was vulnerable because yes, the fed, the FBI, you know, what's the list of 6261.94s - 6262.50s | vulnerabilities? 6262.50s - 6266.58s | Where can I get a list of vulnerabilities of an HBUX system or a Sun microsystem? 6266.86s - 6270.46s | And he said, the only person on earth who cares about that is criminal. 6270.50s - 6271.74s | And


chunk_id: 192_chunk_140
chunk_text:
nobody here. 6224.38s - 6225.10s | There's nobody there. 6226.02s - 6227.06s | Wait, wait, wait, wait, wait. 6228.06s - 6228.42s | Test. 6228.50s - 6228.98s | Yeah, there you go. 6228.98s - 6229.50s | You're good. 6232.50s - 6235.46s | I don't know what to call it, but I'm going to call it the underground fed side 6236.94s - 6241.46s | because we did things that weren't approved of by the FBI. 6242.78s - 6243.30s | Okay. 6244.14s - 6249.06s | Um, one of them was even coming to DEF CON conferences surreptitiously because 6249.06s - 6252.70s | we wanted to know how to harden a nationally secure computer, which we'd 6252.70s - 6256.18s | signed off in blood that we did a good job, but we couldn't get a list of what 6256.18s - 6261.94s | was vulnerable because yes, the fed, the FBI, you know, what's the list of 6261.94s - 6262.50s | vulnerabilities? 6262.50s - 6266.58s | Where can I get a list of vulnerabilities of an HBUX system or a Sun microsystem? 6266.86s - 6270.46s | And he said, the only person on earth who cares about that is criminal. 6270.50s - 6271.74s | And you're not turning criminal. 6271.74s - 6272.02s | Are you? 6273.58s - 6275.22s | How in the world did I harden such a system? 6276.30s - 6280.74s | Well, I went places I wasn't supposed to go under names. 6280.74s - 6281.90s | I wasn't supposed to be. 6282.98s - 6287.22s | Um, I remember 12 of us went to a DEF CON conference very early in the 6287.22s - 6288.70s | sequence and I won't list the one. 6289.78s - 6292.02s | And the idea was, is that no feds were going to come. 6292.78s - 6294.06s | We could recognize feds. 6294.42s - 6295.30s | They had a contest. 6296.06s - 6296.62s | Okay. 6296.86s - 6298.54s | To try to recognize feds. 6298.82s - 6303.26s | And, uh, if any one of us told on the others under mutual assured 6303.26s - 6304.70s | destruction, we're going to alter each other. 6306.34s - 6307.42s | You get all the t-shirts that way. 6307.62s - 6308.10s | Well, yeah. 6308.10s - 6313.02s | So, so mutual is sure destruction of our careers was the deal. 6313.58s - 6316.82s | So we just went off into a side conference


chunk_id: 192_chunk_141
chunk_text:
you're not turning criminal. 6271.74s - 6272.02s | Are you? 6273.58s - 6275.22s | How in the world did I harden such a system? 6276.30s - 6280.74s | Well, I went places I wasn't supposed to go under names. 6280.74s - 6281.90s | I wasn't supposed to be. 6282.98s - 6287.22s | Um, I remember 12 of us went to a DEF CON conference very early in the 6287.22s - 6288.70s | sequence and I won't list the one. 6289.78s - 6292.02s | And the idea was, is that no feds were going to come. 6292.78s - 6294.06s | We could recognize feds. 6294.42s - 6295.30s | They had a contest. 6296.06s - 6296.62s | Okay. 6296.86s - 6298.54s | To try to recognize feds. 6298.82s - 6303.26s | And, uh, if any one of us told on the others under mutual assured 6303.26s - 6304.70s | destruction, we're going to alter each other. 6306.34s - 6307.42s | You get all the t-shirts that way. 6307.62s - 6308.10s | Well, yeah. 6308.10s - 6313.02s | So, so mutual is sure destruction of our careers was the deal. 6313.58s - 6316.82s | So we just went off into a side conference and talked about what was 6316.82s - 6319.26s | vulnerable for systems so we could harden them when we got back. 6320.26s - 6324.06s | Now I know even the movie hidden figures doesn't cover all the hidden figures. 6324.06s - 6327.90s | I know there are a lot of ladies that did some really awesome stuff. 6328.86s - 6329.34s | Okay. 6330.66s - 6331.94s | Not just the ones they showed. 6331.94s - 6335.26s | I got names and people I met, they were just amazing. 6335.50s - 6344.02s | Um, one of them did the invention of wing flutter analysis in 1943 because 6344.02s - 6345.70s | all the engineers went to war. 6345.78s - 6348.70s | So she was not a Rosie of the river. 6348.70s - 6352.14s | She was a wing flutter analysis designer. 6353.78s - 6356.22s | She went into computer programming in the 1960s. 6357.22s - 6366.14s | Um, but I'm a decriminalization of hacking and the whole concept that 6366.14s - 6375.26s | vulnerability, uncovery, disclosure, express exploration, uh, cleanup 6375.74s - 6380.06s | limitation should be normal and it's okay. 6380.38s - 6384.62s | And it's the idea of what's called


chunk_id: 192_chunk_142
chunk_text:
and talked about what was 6316.82s - 6319.26s | vulnerable for systems so we could harden them when we got back. 6320.26s - 6324.06s | Now I know even the movie hidden figures doesn't cover all the hidden figures. 6324.06s - 6327.90s | I know there are a lot of ladies that did some really awesome stuff. 6328.86s - 6329.34s | Okay. 6330.66s - 6331.94s | Not just the ones they showed. 6331.94s - 6335.26s | I got names and people I met, they were just amazing. 6335.50s - 6344.02s | Um, one of them did the invention of wing flutter analysis in 1943 because 6344.02s - 6345.70s | all the engineers went to war. 6345.78s - 6348.70s | So she was not a Rosie of the river. 6348.70s - 6352.14s | She was a wing flutter analysis designer. 6353.78s - 6356.22s | She went into computer programming in the 1960s. 6357.22s - 6366.14s | Um, but I'm a decriminalization of hacking and the whole concept that 6366.14s - 6375.26s | vulnerability, uncovery, disclosure, express exploration, uh, cleanup 6375.74s - 6380.06s | limitation should be normal and it's okay. 6380.38s - 6384.62s | And it's the idea of what's called what we now call a security researcher. 6385.14s - 6385.66s | Right. 6386.46s - 6387.70s | So that that's okay. 6387.82s - 6388.82s | That's legal. 6388.98s - 6390.10s | That's fine. 6390.18s - 6391.42s | That's normal. 6391.94s - 6399.10s | Um, we, uh, we did complaints to the FBI. 6399.18s - 6401.10s | Like there was no tomorrow on that one. 6401.22s - 6401.62s | We did. 6401.62s - 6402.34s | We really did. 6402.62s - 6410.03s | Um, I got into computer security because of a competing warfare exercise with a 6410.03s - 6411.87s | toy national top secret on my hard drive. 6413.47s - 6415.75s | I had to take out all computers, foreign and domestic. 6417.03s - 6424.07s | To prove that I could move a secret from a top secret computer to merely a secret 6424.07s - 6427.79s | computer, just because I wanted the computer update. 6427.95s - 6428.11s | Yeah. 6428.11s - 6432.35s | I mean, I think it's, I think it's fair to say that like, um, there are, could 6432.35s - 6433.55s | you repeat that entire question? 6434.59s - 6439.11s | Actually, sir, can you fill in the blanks


chunk_id: 192_chunk_143
chunk_text:
what we now call a security researcher. 6385.14s - 6385.66s | Right. 6386.46s - 6387.70s | So that that's okay. 6387.82s - 6388.82s | That's legal. 6388.98s - 6390.10s | That's fine. 6390.18s - 6391.42s | That's normal. 6391.94s - 6399.10s | Um, we, uh, we did complaints to the FBI. 6399.18s - 6401.10s | Like there was no tomorrow on that one. 6401.22s - 6401.62s | We did. 6401.62s - 6402.34s | We really did. 6402.62s - 6410.03s | Um, I got into computer security because of a competing warfare exercise with a 6410.03s - 6411.87s | toy national top secret on my hard drive. 6413.47s - 6415.75s | I had to take out all computers, foreign and domestic. 6417.03s - 6424.07s | To prove that I could move a secret from a top secret computer to merely a secret 6424.07s - 6427.79s | computer, just because I wanted the computer update. 6427.95s - 6428.11s | Yeah. 6428.11s - 6432.35s | I mean, I think it's, I think it's fair to say that like, um, there are, could 6432.35s - 6433.55s | you repeat that entire question? 6434.59s - 6439.11s | Actually, sir, can you fill in the blanks in this document I have on the screen? 6439.31s - 6439.95s | Oh, yeah. 6440.67s - 6450.79s | Uh, unfortunately, no, I, I, I, I spent more time, um, spotting feds then, uh, 6451.19s - 6456.95s | then, uh, uh, then attesting to the intelligence of a fed, sorry. 6457.35s - 6461.67s | I do think, you know, you kind of raise a valid point, which is that there are 6461.67s - 6465.91s | people working within a system that also need to, to maneuver around 6465.91s - 6467.67s | the strictures of that system. 6467.71s - 6467.99s | Yes. 6468.07s - 6468.27s | Yeah. 6468.95s - 6471.27s | But I, I know that we're almost running out of time, so I want to make sure 6471.27s - 6473.87s | that, that these guys have a chance to, to, to get in their questions. 6475.31s - 6475.55s | All right. 6476.43s - 6477.47s | Oh, another microphone. 6477.51s - 6477.91s | Okay, great. 6477.91s - 6478.23s | Thanks. 6478.63s - 6480.67s | First of all, thank you for coming out here. 6480.67s - 6482.99s | I think the person to person is very important. 6483.51s - 6489.39s | Um, so


chunk_id: 192_chunk_144
chunk_text:
in this document I have on the screen? 6439.31s - 6439.95s | Oh, yeah. 6440.67s - 6450.79s | Uh, unfortunately, no, I, I, I, I spent more time, um, spotting feds then, uh, 6451.19s - 6456.95s | then, uh, uh, then attesting to the intelligence of a fed, sorry. 6457.35s - 6461.67s | I do think, you know, you kind of raise a valid point, which is that there are 6461.67s - 6465.91s | people working within a system that also need to, to maneuver around 6465.91s - 6467.67s | the strictures of that system. 6467.71s - 6467.99s | Yes. 6468.07s - 6468.27s | Yeah. 6468.95s - 6471.27s | But I, I know that we're almost running out of time, so I want to make sure 6471.27s - 6473.87s | that, that these guys have a chance to, to, to get in their questions. 6475.31s - 6475.55s | All right. 6476.43s - 6477.47s | Oh, another microphone. 6477.51s - 6477.91s | Okay, great. 6477.91s - 6478.23s | Thanks. 6478.63s - 6480.67s | First of all, thank you for coming out here. 6480.67s - 6482.99s | I think the person to person is very important. 6483.51s - 6489.39s | Um, so you all grew up, well, you were there when the internet was born and, uh, 6489.43s - 6495.15s | you all had your, uh, really unique ways of thinking about information. 6495.71s - 6500.79s | Um, and it seems like half of your energy was just getting to that 6500.79s - 6502.55s | information when it started out. 6502.95s - 6507.95s | And as you pointed out, now it's, it's free, it's everywhere, but you 6507.95s - 6510.35s | also have your echo chambers. 6510.63s - 6514.47s | You have, you get, you get a, you know, street cred for being the person 6514.47s - 6515.43s | who found something, et cetera. 6515.55s - 6520.71s | So, so now you have your, your echo chambers, you have your, uh, algorithmic 6520.99s - 6525.75s | content, you have your, uh, machine learning, uh, hallucinations. 6526.35s - 6530.03s | I just want to get your thoughts on how do you separate fact from fiction? 6530.03s - 6531.91s | Now data is everywhere. 6532.19s - 6538.03s | Well, speaking as the author of history of fake things on the internet available 6538.03s - 6539.71s | wherever fine books are sold. 6540.07s - 6544.03s


chunk_id: 192_chunk_145
chunk_text:
you all grew up, well, you were there when the internet was born and, uh, 6489.43s - 6495.15s | you all had your, uh, really unique ways of thinking about information. 6495.71s - 6500.79s | Um, and it seems like half of your energy was just getting to that 6500.79s - 6502.55s | information when it started out. 6502.95s - 6507.95s | And as you pointed out, now it's, it's free, it's everywhere, but you 6507.95s - 6510.35s | also have your echo chambers. 6510.63s - 6514.47s | You have, you get, you get a, you know, street cred for being the person 6514.47s - 6515.43s | who found something, et cetera. 6515.55s - 6520.71s | So, so now you have your, your echo chambers, you have your, uh, algorithmic 6520.99s - 6525.75s | content, you have your, uh, machine learning, uh, hallucinations. 6526.35s - 6530.03s | I just want to get your thoughts on how do you separate fact from fiction? 6530.03s - 6531.91s | Now data is everywhere. 6532.19s - 6538.03s | Well, speaking as the author of history of fake things on the internet available 6538.03s - 6539.71s | wherever fine books are sold. 6540.07s - 6544.03s | I mean, like there is no one single answer like, or, or specific thing, 6544.03s - 6545.43s | but it's critical thinking, man. 6545.43s - 6550.07s | It's like, uh, you know, being able to, being sure to assess everything 6550.07s - 6553.43s | critically and, you know, I don't pretend to be a professor of this, but, 6553.43s - 6556.83s | you know, it's, you know, think about, um, what the source is, like where's it, 6556.83s - 6559.63s | where it's coming from, what the motivations might be, et cetera. 6559.63s - 6563.19s | Like, you know, if other sources are saying the same things, et cetera. 6563.47s - 6565.91s | And having real in-person conversations. 6566.87s - 6571.07s | One thing, one thing that I would say about that is just, I think 6571.07s - 6573.39s | about it like a thought problem. 6573.39s - 6578.03s | We live in an era of like what I would call like an information atmosphere. 6578.55s - 6581.39s | There's an amazing amount of data out there. 6581.39s - 6586.51s | You can see every breach gets bigger and bigger and it's so much data to 6586.51s - 6588.39s


chunk_id: 192_chunk_146
chunk_text:
| I mean, like there is no one single answer like, or, or specific thing, 6544.03s - 6545.43s | but it's critical thinking, man. 6545.43s - 6550.07s | It's like, uh, you know, being able to, being sure to assess everything 6550.07s - 6553.43s | critically and, you know, I don't pretend to be a professor of this, but, 6553.43s - 6556.83s | you know, it's, you know, think about, um, what the source is, like where's it, 6556.83s - 6559.63s | where it's coming from, what the motivations might be, et cetera. 6559.63s - 6563.19s | Like, you know, if other sources are saying the same things, et cetera. 6563.47s - 6565.91s | And having real in-person conversations. 6566.87s - 6571.07s | One thing, one thing that I would say about that is just, I think 6571.07s - 6573.39s | about it like a thought problem. 6573.39s - 6578.03s | We live in an era of like what I would call like an information atmosphere. 6578.55s - 6581.39s | There's an amazing amount of data out there. 6581.39s - 6586.51s | You can see every breach gets bigger and bigger and it's so much data to 6586.51s - 6588.39s | process and there's all these tools. 6588.39s - 6594.31s | Now in that is this like a, it's an amazing moment to figure out new tools 6594.31s - 6599.11s | and ideas, how to move through this information atmosphere that has enveloped 6599.11s - 6605.99s | the entire world and us, our personal, our digital selves, um, um, every, every 6605.99s - 6611.95s | complex app or whatever webpage or fucking piece of media, it has all these 6611.95s - 6613.99s | different layers of information. 6614.59s - 6619.51s | So I don't, I'm just proposing back to you the idea of like thinking about it 6619.51s - 6622.23s | that way as a way to like, to tackle it. 6622.23s - 6628.35s | Cause in a way, in, in some ways figuring out how to navigate that, not as an 6628.35s - 6634.95s | abstract can help you like reorient on what data is real. 6635.07s - 6639.39s | I mean, in some ways it doesn't, there's so much misinformation and culture 6639.39s - 6642.23s | jamming, I don't know how many people in here into culture jamming at all. 6642.63s - 6647.51s | That's a whole other


chunk_id: 192_chunk_147
chunk_text:
| process and there's all these tools. 6588.39s - 6594.31s | Now in that is this like a, it's an amazing moment to figure out new tools 6594.31s - 6599.11s | and ideas, how to move through this information atmosphere that has enveloped 6599.11s - 6605.99s | the entire world and us, our personal, our digital selves, um, um, every, every 6605.99s - 6611.95s | complex app or whatever webpage or fucking piece of media, it has all these 6611.95s - 6613.99s | different layers of information. 6614.59s - 6619.51s | So I don't, I'm just proposing back to you the idea of like thinking about it 6619.51s - 6622.23s | that way as a way to like, to tackle it. 6622.23s - 6628.35s | Cause in a way, in, in some ways figuring out how to navigate that, not as an 6628.35s - 6634.95s | abstract can help you like reorient on what data is real. 6635.07s - 6639.39s | I mean, in some ways it doesn't, there's so much misinformation and culture 6639.39s - 6642.23s | jamming, I don't know how many people in here into culture jamming at all. 6642.63s - 6647.51s | That's a whole other track, but the, but the idea of it, the idea that there's so 6647.51s - 6652.39s | much voluminous information out there that you can actually get lost in your 6652.39s - 6657.91s | own data and not able to really concentrate and make sense of your own thing. 6657.91s - 6662.95s | There's that term about a hyper normalization and ideas about that. 6662.95s - 6666.79s | Yo, you could actually be overloaded with information and lose yourself. 6667.31s - 6671.51s | And I think you see that a lot in society, but it's an evolutionary 6671.51s - 6676.03s | process as we try to figure out how to discern through the information 6676.03s - 6679.19s | atmosphere, what's real and pull that out. 6679.19s - 6682.03s | And in some ways it doesn't even matter if it's not real, if you 6682.03s - 6683.91s | believe it, it's all that matters. 6683.95s - 6684.67s | I don't know about that. 6684.95s - 6685.35s | Whoa. 6685.35s - 6685.51s | Yeah. 6685.51s - 6686.47s | Check that film out actually. 6686.47s - 6689.59s | Hyper normalization by Adam Curtis that covers like all of this and 6689.59s - 6691.51s


chunk_id: 192_chunk_148
chunk_text:
track, but the, but the idea of it, the idea that there's so 6647.51s - 6652.39s | much voluminous information out there that you can actually get lost in your 6652.39s - 6657.91s | own data and not able to really concentrate and make sense of your own thing. 6657.91s - 6662.95s | There's that term about a hyper normalization and ideas about that. 6662.95s - 6666.79s | Yo, you could actually be overloaded with information and lose yourself. 6667.31s - 6671.51s | And I think you see that a lot in society, but it's an evolutionary 6671.51s - 6676.03s | process as we try to figure out how to discern through the information 6676.03s - 6679.19s | atmosphere, what's real and pull that out. 6679.19s - 6682.03s | And in some ways it doesn't even matter if it's not real, if you 6682.03s - 6683.91s | believe it, it's all that matters. 6683.95s - 6684.67s | I don't know about that. 6684.95s - 6685.35s | Whoa. 6685.35s - 6685.51s | Yeah. 6685.51s - 6686.47s | Check that film out actually. 6686.47s - 6689.59s | Hyper normalization by Adam Curtis that covers like all of this and 6689.59s - 6691.51s | Masters of Deception are in that film. 6691.71s - 6693.31s | That we, we have, we got room for one. 6693.35s - 6693.51s | Yeah. 6693.51s - 6697.55s | Well, more of a, if anyone wants to catch up with us afterwards, 6697.55s - 6698.75s | you know, we'll be around. 6698.75s - 6699.51s | So, yeah. 6700.03s - 6700.31s | All right. 6700.31s - 6700.79s | Awesome. 6700.83s - 6704.31s | So, uh, I have a comment that leads into a question. 6704.67s - 6709.59s | So I got my start into computers, uh, with an Apple two plus in the late 6709.59s - 6713.11s | eighties when my grandfather gave it to me and thank you. 6713.15s - 6717.31s | Uh, he and my parents worked very hard to build a level of curiosity 6717.31s - 6718.43s | of how things worked for me. 6718.87s - 6721.03s | So I was naturally intrigued. 6721.43s - 6725.35s | Uh, when I got this, I had, he gave me books of how to write, literally 6725.35s - 6727.39s | write poker games, copying from the book. 6727.39s - 6729.19s | It wasn't, I mean, it was literally. 6729.75s -


chunk_id: 192_chunk_149
chunk_text:
| Masters of Deception are in that film. 6691.71s - 6693.31s | That we, we have, we got room for one. 6693.35s - 6693.51s | Yeah. 6693.51s - 6697.55s | Well, more of a, if anyone wants to catch up with us afterwards, 6697.55s - 6698.75s | you know, we'll be around. 6698.75s - 6699.51s | So, yeah. 6700.03s - 6700.31s | All right. 6700.31s - 6700.79s | Awesome. 6700.83s - 6704.31s | So, uh, I have a comment that leads into a question. 6704.67s - 6709.59s | So I got my start into computers, uh, with an Apple two plus in the late 6709.59s - 6713.11s | eighties when my grandfather gave it to me and thank you. 6713.15s - 6717.31s | Uh, he and my parents worked very hard to build a level of curiosity 6717.31s - 6718.43s | of how things worked for me. 6718.87s - 6721.03s | So I was naturally intrigued. 6721.43s - 6725.35s | Uh, when I got this, I had, he gave me books of how to write, literally 6725.35s - 6727.39s | write poker games, copying from the book. 6727.39s - 6729.19s | It wasn't, I mean, it was literally. 6729.75s - 6732.43s | Code with comments of this is what it does. 6732.47s - 6734.51s | They had magazines that they would, you could order that 6734.51s - 6735.47s | would like have people. 6735.47s - 6735.71s | Yeah. 6735.83s - 6735.95s | Yeah. 6735.95s - 6737.39s | You don't, I can't find that anymore. 6737.39s - 6738.11s | I've been looking. 6738.31s - 6742.71s | So, um, my daughter just completed her second bachelor degree in 6742.71s - 6746.31s | software engineering at 19 and they don't teach that style anymore. 6746.31s - 6748.27s | And it's a, it's a lost art, I think. 6748.31s - 6750.67s | But you take two hours typing in a program. 6750.71s - 6752.27s | You you're vested. 6752.79s - 6753.23s | Yes. 6753.39s - 6757.55s | And you want to know why every line and every character works the way it does. 6758.03s - 6762.51s | So, uh, leading into that, I have first visited my first dial up BBS in like 6762.51s - 6768.15s | 1989, uh, I was like nine years old with my Apple two plus moving forward. 6768.15s - 6769.63s | And we are being rushed off. 6770.91s -


chunk_id: 192_chunk_150
chunk_text:
6732.43s | Code with comments of this is what it does. 6732.47s - 6734.51s | They had magazines that they would, you could order that 6734.51s - 6735.47s | would like have people. 6735.47s - 6735.71s | Yeah. 6735.83s - 6735.95s | Yeah. 6735.95s - 6737.39s | You don't, I can't find that anymore. 6737.39s - 6738.11s | I've been looking. 6738.31s - 6742.71s | So, um, my daughter just completed her second bachelor degree in 6742.71s - 6746.31s | software engineering at 19 and they don't teach that style anymore. 6746.31s - 6748.27s | And it's a, it's a lost art, I think. 6748.31s - 6750.67s | But you take two hours typing in a program. 6750.71s - 6752.27s | You you're vested. 6752.79s - 6753.23s | Yes. 6753.39s - 6757.55s | And you want to know why every line and every character works the way it does. 6758.03s - 6762.51s | So, uh, leading into that, I have first visited my first dial up BBS in like 6762.51s - 6768.15s | 1989, uh, I was like nine years old with my Apple two plus moving forward. 6768.15s - 6769.63s | And we are being rushed off. 6770.91s - 6775.15s | The goons are like, we're getting, I'll be quick. 6775.15s - 6779.95s | So in, uh, uh, 1994, I started actively going to dial up BBS is all of you 6779.95s - 6784.35s | became legends to me as I was looking at text files, but looking at that. 6784.35s - 6788.07s | And with my daughter coming up, she's 19, her friends, other people, how 6788.07s - 6792.59s | would you suggest to build that in the same nostalgic learning experience 6792.59s - 6796.47s | for the next generation so that they're mentally, emotionally, 6797.19s - 6799.07s | spiritually engaged in the tech? 6799.27s - 6800.67s | Who's who's her hero. 6800.71s - 6801.99s | Who does she look up to? 6803.39s - 6803.79s | I don't know. 6805.15s - 6809.63s | I mean, if you can make a connection there, you know, find a role model 6809.71s - 6811.91s | and, you know, kind of push towards that. 6811.91s - 6816.63s | I mean, I, I I'm on stage with a lot of people that I consider role models 6816.63s - 6818.43s | and, you know, I'm, I'm honored to be here. 6818.43s - 6823.19s |


chunk_id: 192_chunk_151
chunk_text:
6775.15s | The goons are like, we're getting, I'll be quick. 6775.15s - 6779.95s | So in, uh, uh, 1994, I started actively going to dial up BBS is all of you 6779.95s - 6784.35s | became legends to me as I was looking at text files, but looking at that. 6784.35s - 6788.07s | And with my daughter coming up, she's 19, her friends, other people, how 6788.07s - 6792.59s | would you suggest to build that in the same nostalgic learning experience 6792.59s - 6796.47s | for the next generation so that they're mentally, emotionally, 6797.19s - 6799.07s | spiritually engaged in the tech? 6799.27s - 6800.67s | Who's who's her hero. 6800.71s - 6801.99s | Who does she look up to? 6803.39s - 6803.79s | I don't know. 6805.15s - 6809.63s | I mean, if you can make a connection there, you know, find a role model 6809.71s - 6811.91s | and, you know, kind of push towards that. 6811.91s - 6816.63s | I mean, I, I I'm on stage with a lot of people that I consider role models 6816.63s - 6818.43s | and, you know, I'm, I'm honored to be here. 6818.43s - 6823.19s | So these are the people I look to, it was like, find that person, I guess, 6823.19s - 6825.23s | who, who can, you know, light up the path. 6825.23s - 6829.67s | I can't necessarily suggest that, but, you know, listen to her and her interests. 6829.71s - 6830.03s | Yeah. 6830.31s - 6834.23s | I was looking at the overall younger community, you know, because when I was 6834.23s - 6837.83s | growing up, I, like you talked about, we had dial up BBS, we had to search, we 6837.83s - 6843.23s | had to go, it was an active search, which engaged at a different level, you know, 6843.39s - 6846.71s | but the only thing, and someone recommended this to me recently is tour, 6847.23s - 6852.71s | not necessarily the most hospitable place to go, but you have to go on a search 6852.71s - 6854.55s | and a hunt to actually find things you want. 6854.95s - 6858.51s | Sometimes there is actually fun, creative, artistic sites, other things. 6859.11s - 6863.67s | But is there, do you have any ideas or maybe you could put it, you know, if 6863.67s - 6867.15s |


chunk_id: 192_chunk_152
chunk_text:
So these are the people I look to, it was like, find that person, I guess, 6823.19s - 6825.23s | who, who can, you know, light up the path. 6825.23s - 6829.67s | I can't necessarily suggest that, but, you know, listen to her and her interests. 6829.71s - 6830.03s | Yeah. 6830.31s - 6834.23s | I was looking at the overall younger community, you know, because when I was 6834.23s - 6837.83s | growing up, I, like you talked about, we had dial up BBS, we had to search, we 6837.83s - 6843.23s | had to go, it was an active search, which engaged at a different level, you know, 6843.39s - 6846.71s | but the only thing, and someone recommended this to me recently is tour, 6847.23s - 6852.71s | not necessarily the most hospitable place to go, but you have to go on a search 6852.71s - 6854.55s | and a hunt to actually find things you want. 6854.95s - 6858.51s | Sometimes there is actually fun, creative, artistic sites, other things. 6859.11s - 6863.67s | But is there, do you have any ideas or maybe you could put it, you know, if 6863.67s - 6867.15s | this idea sinks in posts and share some ideas. 6867.35s - 6871.27s | I've noticed kids are very interested in learning about things like old cameras, 6871.27s - 6874.55s | old computers, things that they can get their hands on, things they can take 6874.55s - 6878.39s | apart, things that can break and fix, answer their questions, encourage them, 6878.39s - 6885.43s | give them books, take them to a vintage computer festivals or whatnot. 6885.71s - 6889.43s | So it's like rebels, hacker spaces, maker spaces. 6889.51s - 6889.83s | All right. 6890.59s - 6891.75s | We're going to leave it there, folks. 6891.75s - 6892.95s | You were an awesome audience. 6892.95s - 6893.75s | Thank you. 6894.23s - 6898.27s | Thank you for everybody stuck around, you know, thanks, man. 6898.27s - 6899.15s | That was awesome.


chunk_id: 192_chunk_153
chunk_text:
this idea sinks in posts and share some ideas. 6867.35s - 6871.27s | I've noticed kids are very interested in learning about things like old cameras, 6871.27s - 6874.55s | old computers, things that they can get their hands on, things they can take 6874.55s - 6878.39s | apart, things that can break and fix, answer their questions, encourage them, 6878.39s - 6885.43s | give them books, take them to a vintage computer festivals or whatnot. 6885.71s - 6889.43s | So it's like rebels, hacker spaces, maker spaces. 6889.51s - 6889.83s | All right. 6890.59s - 6891.75s | We're going to leave it there, folks. 6891.75s - 6892.95s | You were an awesome audience. 6892.95s - 6893.75s | Thank you. 6894.23s - 6898.27s | Thank you for everybody stuck around, you know, thanks, man. 6898.27s - 6899.15s | That was awesome.


chunk_id: 193_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=dnAkvpl48zY", "title": "DEF CON 32 - Compromising Electronic Logger & Creating Truck2Truck Worm -Jake Jepson, Rik Chatterjee", "description": "Presented by Jake Jepson and Rik Chatterjee, two Systems Engineering Master's students at Colorado State University, this talk delves into the critical security implications within the trucking industry, particularly focusing on Electronic Logging Devices (ELDs). These devices, integral to compliance with Hours of Service regulations, present unique cyber-physical threats due to their networked nature and lack of standardized security protocols.\n\nThe presentation will walk through examining potential remote exploits via wireless ELD compromise, leading to cyber physical control payloads and even wormable scenarios. Key vulnerabilities identified include insecure defaults and poor security practices shown on a commercially available ELD. These vulnerabilities not only expose truck networks to potential unauthorized control but also highlight systemic issues in device certification and security oversight.\n\nThe talk will cover their journey from acquiring and reverse engineering ELDs, discovering their common architectures and weaknesses, to demonstrating proof of concept attacks that underline the urgent need for industry-wide security reforms. Notably, Jepson will discuss his first CVE, detailing the coordinated disclosure process and subsequent manufacturer response.\n\nThis session is semi-technical, ideal for cybersecurity professionals and amateurs alike, interested in vehicle network protocols, and embedded systems security. Prior knowledge of network protocols such as CAN and J1939, along with an understanding of firmware reverse engineering, will enhance the learning experience, but is not required. Tools and techniques used include network scanners, reverse engineering platforms like Ghidra, and various wireless communication methods.\n\nBy attending this presentation, participants will not only understand the specific security flaws affecting heavy vehicles but also appreciate the broader implications for embedded systems security in transportation. This talk is a call to action for improving security practices and regulatory standards in an increasingly interconnected world.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1180, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.02s - 6.78s | This text was transcribed using whisper model: large-v2 That was quite the introduction for compromising an electronic logging device and creating 6.78s - 9.90s | a truck-to-truck worm, but that's what we're going to be talking about. 9.90s - 16.30s | So my name is Jake, this is Rick, and Rick, take it away. 16.30s - 18.66s | Thanks Jake. 18.66s - 25.06s | So we are systems engineering master's students from Colorado State University and we work 25.06s - 34.64s | with Dr. Jeremy Daly and primarily


chunk_id: 193_chunk_1
chunk_text:
vehicle network protocols, and embedded systems security. Prior knowledge of network protocols such as CAN and J1939, along with an understanding of firmware reverse engineering, will enhance the learning experience, but is not required. Tools and techniques used include network scanners, reverse engineering platforms like Ghidra, and various wireless communication methods.\n\nBy attending this presentation, participants will not only understand the specific security flaws affecting heavy vehicles but also appreciate the broader implications for embedded systems security in transportation. This talk is a call to action for improving security practices and regulatory standards in an increasingly interconnected world.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1180, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.02s - 6.78s | This text was transcribed using whisper model: large-v2 That was quite the introduction for compromising an electronic logging device and creating 6.78s - 9.90s | a truck-to-truck worm, but that's what we're going to be talking about. 9.90s - 16.30s | So my name is Jake, this is Rick, and Rick, take it away. 16.30s - 18.66s | Thanks Jake. 18.66s - 25.06s | So we are systems engineering master's students from Colorado State University and we work 25.06s - 34.64s | with Dr. Jeremy Daly and primarily concentrate our research on cyber security of heavy vehicles. 34.64s - 39.88s | And there's a video of the work we have done, hopefully it plays. 39.88s - 54.08s | Alongside the truck, you reflash the electronic device, which is running its software with 54.08s - 60.24s | a malicious firmware that will slow down the truck once it starts executing. 60.24s - 64.32s | We were successful in this attack, the car broke up alongside it. 64.32s - 69.44s | About 30 seconds later, the truck begins to slow down and the car pulls out. 69.44s - 74.96s | This is a wireless attack, it gives us the freedom to explore creative attack vectors, 74.96s - 75.96s | including flying a drone. 75.96s - 79.76s | Critical infrastructure is becoming more and more connected, including trucks. 79.76s - 82.44s | One of the reasons is due to the ELD mandate. 82.44s - 86.60s | When the ELD mandate first came out, it did not have much security in it. 86.60s - 89.04s | It couldn't use many security improvements. 89.04s - 93.92s | And so here at Colorado State University, we are exploring the security of heavy vehicles 93.92s


chunk_id: 193_chunk_2
chunk_text:
concentrate our research on cyber security of heavy vehicles. 34.64s - 39.88s | And there's a video of the work we have done, hopefully it plays. 39.88s - 54.08s | Alongside the truck, you reflash the electronic device, which is running its software with 54.08s - 60.24s | a malicious firmware that will slow down the truck once it starts executing. 60.24s - 64.32s | We were successful in this attack, the car broke up alongside it. 64.32s - 69.44s | About 30 seconds later, the truck begins to slow down and the car pulls out. 69.44s - 74.96s | This is a wireless attack, it gives us the freedom to explore creative attack vectors, 74.96s - 75.96s | including flying a drone. 75.96s - 79.76s | Critical infrastructure is becoming more and more connected, including trucks. 79.76s - 82.44s | One of the reasons is due to the ELD mandate. 82.44s - 86.60s | When the ELD mandate first came out, it did not have much security in it. 86.60s - 89.04s | It couldn't use many security improvements. 89.04s - 93.92s | And so here at Colorado State University, we are exploring the security of heavy vehicles 93.92s - 98.96s | as well as the security of the devices attached to the heavy vehicles, such as the electronic 98.96s - 103.26s | log. 103.26s - 109.78s | So basically what we did is, as far as we know, the first wireless drive-by attack on 109.78s - 112.30s | a truck. 112.30s - 120.42s | And I was driving the truck, Ray got to drive the smooth Tesla by it. 120.42s - 125.98s | And what he did was basically flash the ELD that was plugged into the truck while the 125.98s - 128.58s | car was driving by the truck. 128.58s - 134.76s | And after about 30 seconds, after the firmware was loaded, the device rebooted. 134.76s - 140.14s | Basically what happened was a car pulled ahead and the truck started to slow down. 140.14s - 145.26s | And what we found and what we did was that the accelerator pedal stopped working. 145.26s - 151.78s | It was stuck in idle, and that's why we could not move the truck any forward. 151.78s - 159.53s | So a bit of background on what happened, why we did, and why we chose to do that. 159.53s


chunk_id: 193_chunk_3
chunk_text:
- 98.96s | as well as the security of the devices attached to the heavy vehicles, such as the electronic 98.96s - 103.26s | log. 103.26s - 109.78s | So basically what we did is, as far as we know, the first wireless drive-by attack on 109.78s - 112.30s | a truck. 112.30s - 120.42s | And I was driving the truck, Ray got to drive the smooth Tesla by it. 120.42s - 125.98s | And what he did was basically flash the ELD that was plugged into the truck while the 125.98s - 128.58s | car was driving by the truck. 128.58s - 134.76s | And after about 30 seconds, after the firmware was loaded, the device rebooted. 134.76s - 140.14s | Basically what happened was a car pulled ahead and the truck started to slow down. 140.14s - 145.26s | And what we found and what we did was that the accelerator pedal stopped working. 145.26s - 151.78s | It was stuck in idle, and that's why we could not move the truck any forward. 151.78s - 159.53s | So a bit of background on what happened, why we did, and why we chose to do that. 159.53s - 164.89s | So first big question that comes up is, why do we do research on commercial vehicles? 164.89s - 170.71s | Well, one simple answer to that thing is they're very important to the supply chain. 170.71s - 175.03s | And I think the pandemic gave us a good lesson on why it's important to the supply chain. 175.03s - 181.27s | The shortages were pretty obvious, what lack of trucks on the road can do. 181.27s - 187.47s | And they are considered part of critical infrastructure for that very same reason. 187.47s - 189.03s | What's under the hood of trucks? 189.03s - 193.31s | Well, basically modern trucks are very much electronical. 193.31s - 199.19s | They have lots of embedded computers inside them, around 150 ECUs, as we call them, electronic 199.19s - 203.31s | controller units to control functions of modern trucks. 203.31s - 207.95s | They use a lot of different network protocols like CAN, CAN FD, LIN, and even the most recent 207.95s - 212.55s | ones have started using automotive Ethernet for some purposes. 212.55s - 218.79s | In most trucks here in the United States, they say J1939 is


chunk_id: 193_chunk_4
chunk_text:
- 164.89s | So first big question that comes up is, why do we do research on commercial vehicles? 164.89s - 170.71s | Well, one simple answer to that thing is they're very important to the supply chain. 170.71s - 175.03s | And I think the pandemic gave us a good lesson on why it's important to the supply chain. 175.03s - 181.27s | The shortages were pretty obvious, what lack of trucks on the road can do. 181.27s - 187.47s | And they are considered part of critical infrastructure for that very same reason. 187.47s - 189.03s | What's under the hood of trucks? 189.03s - 193.31s | Well, basically modern trucks are very much electronical. 193.31s - 199.19s | They have lots of embedded computers inside them, around 150 ECUs, as we call them, electronic 199.19s - 203.31s | controller units to control functions of modern trucks. 203.31s - 207.95s | They use a lot of different network protocols like CAN, CAN FD, LIN, and even the most recent 207.95s - 212.55s | ones have started using automotive Ethernet for some purposes. 212.55s - 218.79s | In most trucks here in the United States, they say J1939 is the standard of choice. 218.79s - 225.85s | And most trucks on the road do use that standard for communication between these ECUs. 225.85s - 230.05s | Now what are electronic logging devices and how do they come into trucks? 231.05s - 237.13s | Well, it was started off as a mandate for commercial trucks and most of them use it 237.13s - 240.61s | ever since the mandate in 2017. 240.61s - 246.93s | The goal of an ELD is to record hours of service because paper logs are not reliable enough. 246.93s - 252.69s | Truckers would more often than not be honest in those paper logs and keep driving more 252.69s - 254.77s | than the allotted hours. 254.77s - 259.33s | And the goal of electronic logging devices was to basically get rid of that and have 259.33s - 263.17s | a device log your hours of service. 263.17s - 269.13s | The big problem with that was in the entire mandate that was out there, there was no mention 269.13s - 271.81s | of security at all. 271.81s - 277.53s | The process for getting your own ELD was make one, self-certify it, and you


chunk_id: 193_chunk_5
chunk_text:
the standard of choice. 218.79s - 225.85s | And most trucks on the road do use that standard for communication between these ECUs. 225.85s - 230.05s | Now what are electronic logging devices and how do they come into trucks? 231.05s - 237.13s | Well, it was started off as a mandate for commercial trucks and most of them use it 237.13s - 240.61s | ever since the mandate in 2017. 240.61s - 246.93s | The goal of an ELD is to record hours of service because paper logs are not reliable enough. 246.93s - 252.69s | Truckers would more often than not be honest in those paper logs and keep driving more 252.69s - 254.77s | than the allotted hours. 254.77s - 259.33s | And the goal of electronic logging devices was to basically get rid of that and have 259.33s - 263.17s | a device log your hours of service. 263.17s - 269.13s | The big problem with that was in the entire mandate that was out there, there was no mention 269.13s - 271.81s | of security at all. 271.81s - 277.53s | The process for getting your own ELD was make one, self-certify it, and you can start selling 277.53s - 280.73s | it out to each of the trucks. 280.73s - 285.89s | There are about 880 ELDs as of this time that are out there. 285.89s - 290.29s | So a lot of different variants from a few different manufacturers. 290.29s - 294.61s | And the goal of the ELD is once again, they go into the diagnostic port of a truck, similar 294.61s - 300.49s | to that of a car, and they log data. 300.49s - 305.17s | One of the fundamental issues with this thing is that more often than not, they require 305.17s - 311.69s | both read and write access to the internal network of a commercial vehicle to do that. 311.89s - 318.05s | That write access may create a problem if exploited. 318.05s - 324.05s | The other thing is that ELDs don't work as standalone devices, and more often there are 324.05s - 330.25s | other apps or other devices that are connected over Wi-Fi, Bluetooth, or sometimes even over 330.25s - 337.92s | cellular to get the data of the ELDs that the ELDs record from a modern truck. 337.92s - 344.84s | Now, when


chunk_id: 193_chunk_6
chunk_text:
can start selling 277.53s - 280.73s | it out to each of the trucks. 280.73s - 285.89s | There are about 880 ELDs as of this time that are out there. 285.89s - 290.29s | So a lot of different variants from a few different manufacturers. 290.29s - 294.61s | And the goal of the ELD is once again, they go into the diagnostic port of a truck, similar 294.61s - 300.49s | to that of a car, and they log data. 300.49s - 305.17s | One of the fundamental issues with this thing is that more often than not, they require 305.17s - 311.69s | both read and write access to the internal network of a commercial vehicle to do that. 311.89s - 318.05s | That write access may create a problem if exploited. 318.05s - 324.05s | The other thing is that ELDs don't work as standalone devices, and more often there are 324.05s - 330.25s | other apps or other devices that are connected over Wi-Fi, Bluetooth, or sometimes even over 330.25s - 337.92s | cellular to get the data of the ELDs that the ELDs record from a modern truck. 337.92s - 344.84s | Now, when we start looking at ELDs from an attacker's perspective, the main goal is to 344.84s - 352.52s | somehow go in there, compromise the ELD, and write bad messages so that you can do something 352.52s - 354.84s | bad with the truck. 354.84s - 360.40s | The initial landscape looks very difficult because there are around 880, and launching 360.40s - 366.44s | a successful attack on 880 different variants is extremely difficult. 366.44s - 371.92s | The other big problem is most trucks have started incorporating gateways, which basically 371.92s - 374.04s | act as firewalls. 374.04s - 378.68s | They sit between your diagnostic port and the internal components, which need to be 378.68s - 382.00s | shielded from attacks. 382.00s - 386.72s | The other thing is that it's a device that plugs in, so plugging it out would stop the 386.72s - 389.19s | attack. 389.19s - 394.95s | So, a typical threat scenario would involve two things, either short-range access over 394.95s - 400.43s | Bluetooth or Wi-Fi, or long-range access via cellular networks. 400.43s - 405.75s | But doing a deeper dive into the world of ELDs reveals something entirely different. 405.75s -


chunk_id: 193_chunk_7
chunk_text:
we start looking at ELDs from an attacker's perspective, the main goal is to 344.84s - 352.52s | somehow go in there, compromise the ELD, and write bad messages so that you can do something 352.52s - 354.84s | bad with the truck. 354.84s - 360.40s | The initial landscape looks very difficult because there are around 880, and launching 360.40s - 366.44s | a successful attack on 880 different variants is extremely difficult. 366.44s - 371.92s | The other big problem is most trucks have started incorporating gateways, which basically 371.92s - 374.04s | act as firewalls. 374.04s - 378.68s | They sit between your diagnostic port and the internal components, which need to be 378.68s - 382.00s | shielded from attacks. 382.00s - 386.72s | The other thing is that it's a device that plugs in, so plugging it out would stop the 386.72s - 389.19s | attack. 389.19s - 394.95s | So, a typical threat scenario would involve two things, either short-range access over 394.95s - 400.43s | Bluetooth or Wi-Fi, or long-range access via cellular networks. 400.43s - 405.75s | But doing a deeper dive into the world of ELDs reveals something entirely different. 405.75s - 413.23s | Actually, there are only a few distinct ELDs, let's say about 10 of them, and most of them 413.23s - 418.75s | are basically rebranded clones of one another, and there is significant code reuse among 418.75s - 420.75s | all the ELDs. 421.55s - 426.51s | Okay, that takes out 880 and leaves us with 10 to look at. 426.51s - 432.07s | The other problem is gateways, but gateways have become popular most recently, and trucks 432.07s - 433.67s | run for a lot of time. 433.67s - 438.79s | They run for 20, 30 years on the road, and gateways are relatively modern. 438.79s - 442.87s | So most trucks out on the road today don't have gateways. 442.87s - 447.39s | So there is the question of having a firewall inside a truck is gone. 447.39s - 453.67s | Even the ones that do have gateways, they can be subjected to some configuration errors, 453.67s - 459.07s | and recently our team has discovered some diagnostic protocol flaws that allows you 459.07s - 464.19s | to write messages in a way that can bypass a firewall and go into the parts of the truck


chunk_id: 193_chunk_8
chunk_text:
413.23s | Actually, there are only a few distinct ELDs, let's say about 10 of them, and most of them 413.23s - 418.75s | are basically rebranded clones of one another, and there is significant code reuse among 418.75s - 420.75s | all the ELDs. 421.55s - 426.51s | Okay, that takes out 880 and leaves us with 10 to look at. 426.51s - 432.07s | The other problem is gateways, but gateways have become popular most recently, and trucks 432.07s - 433.67s | run for a lot of time. 433.67s - 438.79s | They run for 20, 30 years on the road, and gateways are relatively modern. 438.79s - 442.87s | So most trucks out on the road today don't have gateways. 442.87s - 447.39s | So there is the question of having a firewall inside a truck is gone. 447.39s - 453.67s | Even the ones that do have gateways, they can be subjected to some configuration errors, 453.67s - 459.07s | and recently our team has discovered some diagnostic protocol flaws that allows you 459.07s - 464.19s | to write messages in a way that can bypass a firewall and go into the parts of the truck 464.19s - 469.95s | where it should not go and actually cause some harm. 469.95s - 475.35s | The other thing about ELDs is that if something bad happens, the first thing a diagnostic 475.35s - 480.99s | technician would do is remove the ELD to plug their own maintenance tool there to 480.99s - 483.75s | find out what's wrong with the truck. 483.75s - 487.99s | So actually finding out the issue becomes a big problem if an attack is launched to 487.99s - 496.67s | an ELD, and thus we introduce in this research a novel approach of actually compromising 496.67s - 501.43s | an ELD and creating a truck-to-truck warm. 501.43s - 506.43s | With that, I would like to hand it over to Jake to go into the in-depths of this research. 506.43s - 511.43s | Just so I can see cameras. 511.43s - 515.95s | Alrighty, so since it's DEF CON, instead of just going over what we found, I'm also going 515.95s - 519.35s | to go over how we did it, because it's a bit of a journey. 519.35s - 527.19s | This was the first, like, big thing that I've reverse-engineered,


chunk_id: 193_chunk_9
chunk_text:
464.19s - 469.95s | where it should not go and actually cause some harm. 469.95s - 475.35s | The other thing about ELDs is that if something bad happens, the first thing a diagnostic 475.35s - 480.99s | technician would do is remove the ELD to plug their own maintenance tool there to 480.99s - 483.75s | find out what's wrong with the truck. 483.75s - 487.99s | So actually finding out the issue becomes a big problem if an attack is launched to 487.99s - 496.67s | an ELD, and thus we introduce in this research a novel approach of actually compromising 496.67s - 501.43s | an ELD and creating a truck-to-truck warm. 501.43s - 506.43s | With that, I would like to hand it over to Jake to go into the in-depths of this research. 506.43s - 511.43s | Just so I can see cameras. 511.43s - 515.95s | Alrighty, so since it's DEF CON, instead of just going over what we found, I'm also going 515.95s - 519.35s | to go over how we did it, because it's a bit of a journey. 519.35s - 527.19s | This was the first, like, big thing that I've reverse-engineered, and therefore it, in comparison 527.19s - 529.27s | to, like, CTFs and stuff like that. 529.71s - 536.27s | All right, so real quickly, I want to make it clear that I'm not up here to shame the company. 536.27s - 538.99s | In my opinion, all companies have security vulnerabilities. 538.99s - 545.03s | Some might not have been found yet, but this company did a great job in their response. 545.03s - 551.75s | So we did a responsible disclosure with them, and they ended up putting out a patch, and 551.75s - 555.63s | in our opinion, they responded pretty well. 555.75s - 561.39s | So one day, Dr. Daly, which is our advisor, just went on to Amazon, and he bought some 561.39s - 563.07s | of these devices. 563.07s - 567.31s | It's actually, screens are up there, it's actually the little disk, right? 567.31s - 572.83s | So it's about this big, and the reason he bought them is that they all look very similar. 572.83s - 573.83s | And they were. 573.83s - 577.87s | They were the exact same devices being sold by many different major brands. 577.87s - 582.39s |


chunk_id: 193_chunk_10
chunk_text:
and therefore it, in comparison 527.19s - 529.27s | to, like, CTFs and stuff like that. 529.71s - 536.27s | All right, so real quickly, I want to make it clear that I'm not up here to shame the company. 536.27s - 538.99s | In my opinion, all companies have security vulnerabilities. 538.99s - 545.03s | Some might not have been found yet, but this company did a great job in their response. 545.03s - 551.75s | So we did a responsible disclosure with them, and they ended up putting out a patch, and 551.75s - 555.63s | in our opinion, they responded pretty well. 555.75s - 561.39s | So one day, Dr. Daly, which is our advisor, just went on to Amazon, and he bought some 561.39s - 563.07s | of these devices. 563.07s - 567.31s | It's actually, screens are up there, it's actually the little disk, right? 567.31s - 572.83s | So it's about this big, and the reason he bought them is that they all look very similar. 572.83s - 573.83s | And they were. 573.83s - 577.87s | They were the exact same devices being sold by many different major brands. 577.87s - 582.39s | So the devices are IO6, IO1020 micro-ELDs. 582.39s - 587.55s | We found that this device was sold by, like, 50 plus different brands, and this is kind 587.55s - 590.13s | of commonplace in the ELD industry. 590.13s - 594.67s | So as Rick mentioned before, these devices come with additional wireless networks on 594.67s - 595.67s | them. 595.67s - 600.95s | So this one had Bluetooth and GPS, which were mentioned in the manual, but what was interesting 600.95s - 605.95s | is that when you first powered it on, it actually popped up a Wi-Fi network as well, which is 605.95s - 610.67s | curious because why would you go through all the effort of programming the Wi-Fi if you 610.67s - 612.51s | don't mention it in the manual? 612.51s - 619.07s | So that's kind of the first thing that kind of was a clue initially, and if you go ahead 619.07s - 623.35s | and look at the picture of the PCB, that's the PCB of the board. 623.35s - 628.75s | It's an ESP32-based device, and that port right there is kind of what we're going to 628.75s - 629.75s | talk


chunk_id: 193_chunk_11
chunk_text:
So the devices are IO6, IO1020 micro-ELDs. 582.39s - 587.55s | We found that this device was sold by, like, 50 plus different brands, and this is kind 587.55s - 590.13s | of commonplace in the ELD industry. 590.13s - 594.67s | So as Rick mentioned before, these devices come with additional wireless networks on 594.67s - 595.67s | them. 595.67s - 600.95s | So this one had Bluetooth and GPS, which were mentioned in the manual, but what was interesting 600.95s - 605.95s | is that when you first powered it on, it actually popped up a Wi-Fi network as well, which is 605.95s - 610.67s | curious because why would you go through all the effort of programming the Wi-Fi if you 610.67s - 612.51s | don't mention it in the manual? 612.51s - 619.07s | So that's kind of the first thing that kind of was a clue initially, and if you go ahead 619.07s - 623.35s | and look at the picture of the PCB, that's the PCB of the board. 623.35s - 628.75s | It's an ESP32-based device, and that port right there is kind of what we're going to 628.75s - 629.75s | talk about next. 629.75s - 633.15s | So it was labeled PROG, which we assumed was likely programming. 633.15s - 637.03s | It's an ESP32 device, so doing a little bit of hardware reverse engineering, figuring 637.03s - 639.91s | out what pins, what communication, what programs to use. 639.91s - 644.27s | We're eventually able to check the e-fuses on it, and checking the e-fuses allowed us 644.27s - 648.19s | to determine that it had no protections on it at all, so we could go ahead and just dump 648.19s - 651.67s | the firmware off of it, and the first thing we're going to do with the firmware is run 651.67s - 657.13s | strings on it, and normally you don't hit the jackpot with just strings, but in this 657.13s - 658.71s | case we did. 658.71s - 665.79s | So as looking through strings, I come across that SSID, and then two lines down, I see 665.79s - 670.83s | what I can only describe as a Wi-Fi password, and that is what we found. 670.83s - 674.39s | It was the hard-coded default Wi-Fi password for this device. 674.39s - 679.11s | We continue scrolling


chunk_id: 193_chunk_12
chunk_text:
about next. 629.75s - 633.15s | So it was labeled PROG, which we assumed was likely programming. 633.15s - 637.03s | It's an ESP32 device, so doing a little bit of hardware reverse engineering, figuring 637.03s - 639.91s | out what pins, what communication, what programs to use. 639.91s - 644.27s | We're eventually able to check the e-fuses on it, and checking the e-fuses allowed us 644.27s - 648.19s | to determine that it had no protections on it at all, so we could go ahead and just dump 648.19s - 651.67s | the firmware off of it, and the first thing we're going to do with the firmware is run 651.67s - 657.13s | strings on it, and normally you don't hit the jackpot with just strings, but in this 657.13s - 658.71s | case we did. 658.71s - 665.79s | So as looking through strings, I come across that SSID, and then two lines down, I see 665.79s - 670.83s | what I can only describe as a Wi-Fi password, and that is what we found. 670.83s - 674.39s | It was the hard-coded default Wi-Fi password for this device. 674.39s - 679.11s | We continue scrolling down, and we start seeing stuff about web servers, and these endpoints 679.11s - 685.83s | of slash upload.php, talking about OTAs and flashing, but it needs a key, and as we go 685.83s - 691.31s | down a little bit more, we see something that starts with a one, and it ends with a six, 691.31s - 694.03s | and I'll let you figure out what's in between that. 694.03s - 700.11s | And that was the hard-coded key that protected the over-the-air updates for this device. 700.11s - 706.20s | All right, so once we now got onto the Wi-Fi network, of course we can go ahead and do 706.20s - 707.68s | an NMAP scan. 707.68s - 711.92s | The NMAP results there are incomplete, but essentially it would find three services. 711.92s - 717.92s | We had a Telnet service on port 23, we had SSH, well, NMAP thought it was SSH on port 717.92s - 723.24s | 22, I did not think it was that, and then we had an HTTP server on port 80. 723.24s - 728.08s | So if we look at the screenshot of the HTTP server, we can see it's listing


chunk_id: 193_chunk_13
chunk_text:
down, and we start seeing stuff about web servers, and these endpoints 679.11s - 685.83s | of slash upload.php, talking about OTAs and flashing, but it needs a key, and as we go 685.83s - 691.31s | down a little bit more, we see something that starts with a one, and it ends with a six, 691.31s - 694.03s | and I'll let you figure out what's in between that. 694.03s - 700.11s | And that was the hard-coded key that protected the over-the-air updates for this device. 700.11s - 706.20s | All right, so once we now got onto the Wi-Fi network, of course we can go ahead and do 706.20s - 707.68s | an NMAP scan. 707.68s - 711.92s | The NMAP results there are incomplete, but essentially it would find three services. 711.92s - 717.92s | We had a Telnet service on port 23, we had SSH, well, NMAP thought it was SSH on port 717.92s - 723.24s | 22, I did not think it was that, and then we had an HTTP server on port 80. 723.24s - 728.08s | So if we look at the screenshot of the HTTP server, we can see it's listing serial version, 728.08s - 732.72s | and then we have that key, and then a little bit of foreshadowing, we have a firmware-mal, 732.72s - 735.56s | standing for a malicious firmware that we created. 735.56s - 739.92s | All righty, so this slide is, of course, the part that takes the longest. 739.92s - 741.96s | This is the reverse engineer. 741.96s - 744.44s | We found a device that has these vulnerabilities. 744.44s - 748.44s | We went ahead and did a little bit of testing to confirm it's not doing firmware signing, 748.44s - 751.64s | and that we could actually upload a modified binary to it. 751.64s - 753.18s | But now, what do we do with that? 753.18s - 756.98s | So at this point, we need to reverse engineer the binary, figure out how it works, to the 756.98s - 761.14s | point that we can create a malicious firmware for it, and get it to do what we want it to 761.14s - 762.14s | do. 762.14s - 772.26s | So this was on ESP32, so the code for it is Extensa, and Extensa was not well-supported. 772.26s - 776.50s | It's now


chunk_id: 193_chunk_14
chunk_text:
serial version, 728.08s - 732.72s | and then we have that key, and then a little bit of foreshadowing, we have a firmware-mal, 732.72s - 735.56s | standing for a malicious firmware that we created. 735.56s - 739.92s | All righty, so this slide is, of course, the part that takes the longest. 739.92s - 741.96s | This is the reverse engineer. 741.96s - 744.44s | We found a device that has these vulnerabilities. 744.44s - 748.44s | We went ahead and did a little bit of testing to confirm it's not doing firmware signing, 748.44s - 751.64s | and that we could actually upload a modified binary to it. 751.64s - 753.18s | But now, what do we do with that? 753.18s - 756.98s | So at this point, we need to reverse engineer the binary, figure out how it works, to the 756.98s - 761.14s | point that we can create a malicious firmware for it, and get it to do what we want it to 761.14s - 762.14s | do. 762.14s - 772.26s | So this was on ESP32, so the code for it is Extensa, and Extensa was not well-supported. 772.26s - 776.50s | It's now officially supported by Ghidra, but at the time, it was not on any of the major 776.50s - 779.98s | ones that I at least had the money for. 779.98s - 782.02s | And so we were looking at community support. 782.02s - 785.78s | And the best community support was for Ghidra at the time, but it still needed a lot of 785.78s - 786.78s | work. 786.78s - 791.20s | So after spending weeks fixing up the decomp and going through all that, I had a bunch 791.20s - 792.66s | of flows. 792.66s - 795.82s | And it's kind of hard to describe what I mean by flows, but essentially, I had a bunch of 795.82s - 796.82s | functions. 796.82s - 797.82s | They all kind of connected to each other. 797.82s - 802.34s | It was clear what their purpose was, but I was missing the thing that connected them 802.34s - 805.66s | and the main function, and that was a giant thing. 805.66s - 806.66s | I still don't have main. 806.66s - 811.34s | So I did what any good hacker would do, is I went snooping, and I learned that there's


chunk_id: 193_chunk_15
chunk_text:
officially supported by Ghidra, but at the time, it was not on any of the major 776.50s - 779.98s | ones that I at least had the money for. 779.98s - 782.02s | And so we were looking at community support. 782.02s - 785.78s | And the best community support was for Ghidra at the time, but it still needed a lot of 785.78s - 786.78s | work. 786.78s - 791.20s | So after spending weeks fixing up the decomp and going through all that, I had a bunch 791.20s - 792.66s | of flows. 792.66s - 795.82s | And it's kind of hard to describe what I mean by flows, but essentially, I had a bunch of 795.82s - 796.82s | functions. 796.82s - 797.82s | They all kind of connected to each other. 797.82s - 802.34s | It was clear what their purpose was, but I was missing the thing that connected them 802.34s - 805.66s | and the main function, and that was a giant thing. 805.66s - 806.66s | I still don't have main. 806.66s - 811.34s | So I did what any good hacker would do, is I went snooping, and I learned that there's 811.34s - 812.82s | an Expressive Forms. 812.82s - 817.26s | I created an account, logged on, and after looking around, I found that there is an account 817.26s - 819.50s | called io6llc. 819.50s - 825.94s | And I guess that was probably related to someone that was working at that company. 825.94s - 828.74s | And most of their questions and that stuff were pretty normal. 828.74s - 835.42s | They were either reporting bugs, or they were asking about help for certain things. 835.42s - 840.92s | But on one of them, they posted a full crash dump, which was beautiful, because if we look 840.92s - 844.80s | at the crash dump, we can see it's talking about having a bunch of different threads, 844.80s - 847.60s | and it actually gives names to each of those threads. 847.60s - 852.20s | And so if I cross-reference those strings that we were looking at earlier, and I look 852.20s - 856.88s | at where those names are used, I came across a function that ended up being main, and it 856.88s - 859.32s | just wasn't decompiled correctly. 859.32s - 864.00s | So now that I


chunk_id: 193_chunk_16
chunk_text:
811.34s - 812.82s | an Expressive Forms. 812.82s - 817.26s | I created an account, logged on, and after looking around, I found that there is an account 817.26s - 819.50s | called io6llc. 819.50s - 825.94s | And I guess that was probably related to someone that was working at that company. 825.94s - 828.74s | And most of their questions and that stuff were pretty normal. 828.74s - 835.42s | They were either reporting bugs, or they were asking about help for certain things. 835.42s - 840.92s | But on one of them, they posted a full crash dump, which was beautiful, because if we look 840.92s - 844.80s | at the crash dump, we can see it's talking about having a bunch of different threads, 844.80s - 847.60s | and it actually gives names to each of those threads. 847.60s - 852.20s | And so if I cross-reference those strings that we were looking at earlier, and I look 852.20s - 856.88s | at where those names are used, I came across a function that ended up being main, and it 856.88s - 859.32s | just wasn't decompiled correctly. 859.32s - 864.00s | So now that I had that, I was actually able to get the full picture of how it all worked, 864.00s - 868.16s | and we went from there. 868.16s - 872.64s | So quick overview of the vulnerabilities that were discovered through the reverse engineer. 872.64s - 878.48s | We already talked about the default network credentials, and we had this web server that 878.48s - 883.62s | seemingly was unused by these resellers, but it was always on and it was always there. 883.62s - 886.84s | We had Bluetooth and Wi-Fi being on at the same time. 886.84s - 888.80s | Firmware wasn't being signed. 888.80s - 892.44s | Firmware updates were protected by the weak password. 892.44s - 897.76s | And then what I ended up finding was that service on port 22 was actually a debug service. 897.76s - 905.32s | It essentially acted as an echo server, which we had no use for, and it was beautiful, because 905.32s - 910.58s | it gave us a giant function to go ahead and put our malicious code in that would always 910.58s - 911.58s | get called. 911.58s - 912.84s | It was in its own thread. 912.84s -


chunk_id: 193_chunk_17
chunk_text:
had that, I was actually able to get the full picture of how it all worked, 864.00s - 868.16s | and we went from there. 868.16s - 872.64s | So quick overview of the vulnerabilities that were discovered through the reverse engineer. 872.64s - 878.48s | We already talked about the default network credentials, and we had this web server that 878.48s - 883.62s | seemingly was unused by these resellers, but it was always on and it was always there. 883.62s - 886.84s | We had Bluetooth and Wi-Fi being on at the same time. 886.84s - 888.80s | Firmware wasn't being signed. 888.80s - 892.44s | Firmware updates were protected by the weak password. 892.44s - 897.76s | And then what I ended up finding was that service on port 22 was actually a debug service. 897.76s - 905.32s | It essentially acted as an echo server, which we had no use for, and it was beautiful, because 905.32s - 910.58s | it gave us a giant function to go ahead and put our malicious code in that would always 910.58s - 911.58s | get called. 911.58s - 912.84s | It was in its own thread. 912.84s - 916.12s | We didn't have to make any trampolines out for space or anything like that. 916.12s - 922.08s | And so we went ahead and just put in a pretty simple little bit of malicious code, and it's 922.08s - 925.72s | what you kind of see on the screen up there. 925.72s - 930.64s | And so essentially, this would check a status variable, and once the status variable was 930.64s - 935.12s | equal to certain conditions, we knew that CAN was initialized, and it actually had a 935.12s - 936.64s | connection to the CAN bus. 936.64s - 940.84s | And then at this point, we just went ahead and spammed TSC1 messages. 940.84s - 944.60s | TSC1 messages are Torque Speed Control 1 messages. 944.60s - 950.42s | They are a J1939 message that are essentially there to allow you to tell the engine to go 950.42s - 952.02s | to a certain torque. 952.46s - 956.66s | In the video, you saw us slowing down the truck, because for safety reasons, we're going 956.66s - 962.42s | to slow down the truck, but we could have also sped up the truck as well. 962.42s


chunk_id: 193_chunk_18
chunk_text:
916.12s | We didn't have to make any trampolines out for space or anything like that. 916.12s - 922.08s | And so we went ahead and just put in a pretty simple little bit of malicious code, and it's 922.08s - 925.72s | what you kind of see on the screen up there. 925.72s - 930.64s | And so essentially, this would check a status variable, and once the status variable was 930.64s - 935.12s | equal to certain conditions, we knew that CAN was initialized, and it actually had a 935.12s - 936.64s | connection to the CAN bus. 936.64s - 940.84s | And then at this point, we just went ahead and spammed TSC1 messages. 940.84s - 944.60s | TSC1 messages are Torque Speed Control 1 messages. 944.60s - 950.42s | They are a J1939 message that are essentially there to allow you to tell the engine to go 950.42s - 952.02s | to a certain torque. 952.46s - 956.66s | In the video, you saw us slowing down the truck, because for safety reasons, we're going 956.66s - 962.42s | to slow down the truck, but we could have also sped up the truck as well. 962.42s - 967.76s | In terms of how long it takes, it's a wireless attack, so if you're really close to the device, 967.76s - 968.76s | it goes pretty quickly. 968.76s - 971.56s | It can go in like 30 seconds, the entire thing. 971.56s - 975.56s | But the farther you move away, the longer it takes. 975.56s - 979.90s | We also found that the service on port 23 was this Telnet service, and this provided 979.92s - 985.28s | a pretty comprehensive API that not only allowed you to do all the normal ELD stuff, but it 985.28s - 991.36s | also allowed you to go ahead and change those defaults. 991.36s - 995.48s | Unfortunately, those weren't being used, and then we found something interesting. 995.48s - 999.88s | As we were looking through a function that was essentially the main command handler, 999.88s - 1004.46s | we can see that most of the commands are a pretty normal string compare between essentially 1004.46s - 1006.56s | the command and whatever your input is. 1006.94s - 1012.86s | But if you go all the way down to the bottom, and you see these five consecutive if


chunk_id: 193_chunk_19
chunk_text:
- 967.76s | In terms of how long it takes, it's a wireless attack, so if you're really close to the device, 967.76s - 968.76s | it goes pretty quickly. 968.76s - 971.56s | It can go in like 30 seconds, the entire thing. 971.56s - 975.56s | But the farther you move away, the longer it takes. 975.56s - 979.90s | We also found that the service on port 23 was this Telnet service, and this provided 979.92s - 985.28s | a pretty comprehensive API that not only allowed you to do all the normal ELD stuff, but it 985.28s - 991.36s | also allowed you to go ahead and change those defaults. 991.36s - 995.48s | Unfortunately, those weren't being used, and then we found something interesting. 995.48s - 999.88s | As we were looking through a function that was essentially the main command handler, 999.88s - 1004.46s | we can see that most of the commands are a pretty normal string compare between essentially 1004.46s - 1006.56s | the command and whatever your input is. 1006.94s - 1012.86s | But if you go all the way down to the bottom, and you see these five consecutive if statements, 1012.86s - 1018.26s | and you match all of these very specific criteria, you'll see it goes all the way down to a send 1018.26s - 1021.42s | can function, and that's what it would allow you to do. 1021.42s - 1026.90s | This secret function would allow you to arbitrarily wirelessly send whatever can messages you 1026.90s - 1032.22s | want as if you were connected over Bluetooth, Wi-Fi, anything like that. 1034.34s - 1039.78s | All right, so while I was doing this, I didn't have much experience with ESP32s, but I know 1039.78s - 1043.58s | that they're loved in the IoT community, and one of the things I knew about them is that 1043.58s - 1051.26s | they could simultaneously be an access point and a station, or a client and an access point, 1051.26s - 1052.26s | essentially. 1052.26s - 1056.50s | And so this would allow us to create a worm, a device that would not only be able to execute 1056.50s - 1061.66s | the attack, but could also scan for and spread to other devices. 1061.66s - 1065.92s | So we get a lot of truck deliveries to our building where


chunk_id: 193_chunk_20
chunk_text:
statements, 1012.86s - 1018.26s | and you match all of these very specific criteria, you'll see it goes all the way down to a send 1018.26s - 1021.42s | can function, and that's what it would allow you to do. 1021.42s - 1026.90s | This secret function would allow you to arbitrarily wirelessly send whatever can messages you 1026.90s - 1032.22s | want as if you were connected over Bluetooth, Wi-Fi, anything like that. 1034.34s - 1039.78s | All right, so while I was doing this, I didn't have much experience with ESP32s, but I know 1039.78s - 1043.58s | that they're loved in the IoT community, and one of the things I knew about them is that 1043.58s - 1051.26s | they could simultaneously be an access point and a station, or a client and an access point, 1051.26s - 1052.26s | essentially. 1052.26s - 1056.50s | And so this would allow us to create a worm, a device that would not only be able to execute 1056.50s - 1061.66s | the attack, but could also scan for and spread to other devices. 1061.66s - 1065.92s | So we get a lot of truck deliveries to our building where we were working, and we didn't 1065.92s - 1069.60s | really think it was worth it to build this full cyber weapon on the actual device. 1069.60s - 1073.36s | So we switched over to dev boards, and on these dev boards, we developed this worm. 1073.36s - 1077.72s | And essentially, it works exactly like how it would on the actual devices. 1077.72s - 1081.72s | It just goes ahead, uses the default credentials to log in, perform an over-the-air update, 1081.72s - 1084.76s | and copy itself onto the new device. 1084.76s - 1086.48s | So is this realistic? 1086.48s - 1087.84s | I would argue yes. 1087.84s - 1089.52s | Trucks congregate a lot. 1089.52s - 1093.98s | They have truck stops, gas stations, rest stops, ports, distribution centers, hubs. 1093.98s - 1098.34s | And if you've ever been on the highway, sometimes they take a really long time to pass each 1098.34s - 1099.84s | other. 1099.84s - 1105.58s | We found that with the normal ESP32 dev boards, we were able to get a total distance of about 1105.58s - 1108.46s | 120 feet in a dense parking lot. 1108.46s - 1112.34s | So this


chunk_id: 193_chunk_21
chunk_text:
we were working, and we didn't 1065.92s - 1069.60s | really think it was worth it to build this full cyber weapon on the actual device. 1069.60s - 1073.36s | So we switched over to dev boards, and on these dev boards, we developed this worm. 1073.36s - 1077.72s | And essentially, it works exactly like how it would on the actual devices. 1077.72s - 1081.72s | It just goes ahead, uses the default credentials to log in, perform an over-the-air update, 1081.72s - 1084.76s | and copy itself onto the new device. 1084.76s - 1086.48s | So is this realistic? 1086.48s - 1087.84s | I would argue yes. 1087.84s - 1089.52s | Trucks congregate a lot. 1089.52s - 1093.98s | They have truck stops, gas stations, rest stops, ports, distribution centers, hubs. 1093.98s - 1098.34s | And if you've ever been on the highway, sometimes they take a really long time to pass each 1098.34s - 1099.84s | other. 1099.84s - 1105.58s | We found that with the normal ESP32 dev boards, we were able to get a total distance of about 1105.58s - 1108.46s | 120 feet in a dense parking lot. 1108.46s - 1112.34s | So this is between all of the different cars that were parked there. 1112.34s - 1117.02s | So that's about 12 parking spaces. 1117.02s - 1120.52s | Now, the other thing that we found, that for many trucks, the diagnostic port is also 1120.52s - 1124.84s | left on all the time, which means that it can continually spread, even while the driver 1124.84s - 1129.32s | is sleeping in one of those large sleeper trucks. 1129.32s - 1130.56s | So this is fixed, right? 1130.56s - 1135.32s | This ability for us to drive up alongside of a truck that's using these popular ELD 1135.32s - 1140.52s | devices, reflash it, and then control the vehicle, causing it to speed up, slow down, 1140.52s - 1143.12s | spread a worm, something like that is fixed. 1143.12s - 1145.44s | Well, IO6 responded great. 1145.44s - 1150.94s | They went ahead and they pushed out a patch to fix these issues, and they overall responded 1150.94s - 1153.24s | well to the vulnerability report. 1153.24s - 1158.74s | But these vulnerabilities arose from government-mandated, self-certified devices that lacked sufficient 1158.74s - 1160.14s | security standards. 1160.14s - 1165.18s | So we argue


chunk_id: 193_chunk_22
chunk_text:
is between all of the different cars that were parked there. 1112.34s - 1117.02s | So that's about 12 parking spaces. 1117.02s - 1120.52s | Now, the other thing that we found, that for many trucks, the diagnostic port is also 1120.52s - 1124.84s | left on all the time, which means that it can continually spread, even while the driver 1124.84s - 1129.32s | is sleeping in one of those large sleeper trucks. 1129.32s - 1130.56s | So this is fixed, right? 1130.56s - 1135.32s | This ability for us to drive up alongside of a truck that's using these popular ELD 1135.32s - 1140.52s | devices, reflash it, and then control the vehicle, causing it to speed up, slow down, 1140.52s - 1143.12s | spread a worm, something like that is fixed. 1143.12s - 1145.44s | Well, IO6 responded great. 1145.44s - 1150.94s | They went ahead and they pushed out a patch to fix these issues, and they overall responded 1150.94s - 1153.24s | well to the vulnerability report. 1153.24s - 1158.74s | But these vulnerabilities arose from government-mandated, self-certified devices that lacked sufficient 1158.74s - 1160.14s | security standards. 1160.14s - 1165.18s | So we argue that since government regulators have little incentive to get security right, 1165.18s - 1167.70s | the problem is not fixed until that changes. 1167.70s - 1168.50s | Thank you.


chunk_id: 193_chunk_23
chunk_text:
that since government regulators have little incentive to get security right, 1165.18s - 1167.70s | the problem is not fixed until that changes. 1167.70s - 1168.50s | Thank you.


chunk_id: 194_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=kWSP4F5dxTw", "title": "DEF CON 32 - DriverJack Turning NTFS and Emulated ROFs into an Infection - Alessandro Magnosi", "description": "This article reassesses complex cyberattack tactics, focusing specifically on existing security measures and emerging weaknesses. We begin our investigation by examining initial methods of deployment in contemporary attacks, including those that focus on simulated read-only filesystems and NTFS vulnerabilities. Since the improvements made to the Windows security architecture in 2011, which include the enforcement of Driver Signature Enforcement (DSE) and Hypervisor-protected Code Integrity (HVCI), the nature of cyber threats has changed, requiring new ways to carry out attacks.\n\nOur research presents a new method that takes advantage of previously uncovered weaknesses in emulated filesystems, allowing attackers to covertly install and maintain harmful programs. In addition, we uncover new NTFS vulnerabilities that enable attackers to conceal their presence and sustain persistence within victim systems. The study also investigates alternate methods for delivering and executing malware in usermode. In addition, we discuss several Indicators of Compromise (IOCs) to identify and detect these tactics.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2832, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.59s - 8.07s | This text was transcribed using whisper model: large-v2 Okay. Hi there. Thanks a lot for sticking out with us. Today I'm going to speak around 8.07s - 14.35s | about driver jack, which is an unusual technique to load the driver on Windows 11, abusing 14.35s - 23.07s | NTFS features and CDFS bug, I'd say. So, just before starting, a few words about me. I'm 23.07s - 28.95s | Alessandro Magnozzi. I work for BSI, British Standards Institute. I mainly do research, 28.95s - 36.39s | but like a huge part of my daily business is consulting in adversary simulation, device 36.39s - 42.03s | security and appsec. I go on internet with the name Kletz Virus. You can reach me out 42.03s - 50.91s | on GitHub or Twitter. Like, feel free to reach out. Now, just before starting, I'm going 50.91s - 57.43s | to just give a bit of information about this project. This project was started in 2022 57.43s - 64.35s | with Jonas Lake from Secret Club. Um, we started working on a POC to abuse ISOs to 64.35s - 68.99s | load malicious drivers on Windows. Then we completely forgot about that for at least 68.99s - 74.27s | one year because I was working on other


chunk_id: 194_chunk_1
chunk_text:
for sticking out with us. Today I'm going to speak around 8.07s - 14.35s | about driver jack, which is an unusual technique to load the driver on Windows 11, abusing 14.35s - 23.07s | NTFS features and CDFS bug, I'd say. So, just before starting, a few words about me. I'm 23.07s - 28.95s | Alessandro Magnozzi. I work for BSI, British Standards Institute. I mainly do research, 28.95s - 36.39s | but like a huge part of my daily business is consulting in adversary simulation, device 36.39s - 42.03s | security and appsec. I go on internet with the name Kletz Virus. You can reach me out 42.03s - 50.91s | on GitHub or Twitter. Like, feel free to reach out. Now, just before starting, I'm going 50.91s - 57.43s | to just give a bit of information about this project. This project was started in 2022 57.43s - 64.35s | with Jonas Lake from Secret Club. Um, we started working on a POC to abuse ISOs to 64.35s - 68.99s | load malicious drivers on Windows. Then we completely forgot about that for at least 68.99s - 74.27s | one year because I was working on other stuff. And then in 2023, I had an engagement that 74.27s - 81.51s | supported the development of this technique a bit further. Now, the engagement was a bit 81.55s - 88.87s | um, like it was an OT engagement and uh, the main um, the main uh, aim of this OT engagement 88.87s - 96.27s | was to deploy a kernel rootkit on an OT workstation. Now, regardless of the engagement, the 96.27s - 102.11s | engagement was pretty well uh, and we found ourself in a situation where we could tamper 102.11s - 110.11s | um, ISO files that were distributed to machines via an update catalog. Uh, so this gave us 110.11s - 117.59s | a motivation to read, resume the uh, research that we were doing in 2022 and we tried to 117.59s - 122.23s | understand if we could develop it further. Now, we didn't know exactly what to expect 122.23s - 126.95s | from the malware that we were generating. Uh, we just need, we just know that we wanted 126.95s - 131.15s | something to backdoor an installer, present on an ISO and then we want to weaponize it 131.15s - 136.75s |


chunk_id: 194_chunk_2
chunk_text:
stuff. And then in 2023, I had an engagement that 74.27s - 81.51s | supported the development of this technique a bit further. Now, the engagement was a bit 81.55s - 88.87s | um, like it was an OT engagement and uh, the main um, the main uh, aim of this OT engagement 88.87s - 96.27s | was to deploy a kernel rootkit on an OT workstation. Now, regardless of the engagement, the 96.27s - 102.11s | engagement was pretty well uh, and we found ourself in a situation where we could tamper 102.11s - 110.11s | um, ISO files that were distributed to machines via an update catalog. Uh, so this gave us 110.11s - 117.59s | a motivation to read, resume the uh, research that we were doing in 2022 and we tried to 117.59s - 122.23s | understand if we could develop it further. Now, we didn't know exactly what to expect 122.23s - 126.95s | from the malware that we were generating. Uh, we just need, we just know that we wanted 126.95s - 131.15s | something to backdoor an installer, present on an ISO and then we want to weaponize it 131.15s - 136.75s | in a, the best way possible. Of course, ISOs have been weaponized for years right now for 136.75s - 141.43s | their ability to uh, to bypass multi W but this was not really what we wanted to do. We 141.43s - 146.87s | want, we didn't want to just provide an ISO to our uh, customer. We had in the position of 146.87s - 153.11s | weaponize an I, an ISO. Uh, and then we just wanted to execute some code and like deploy 153.11s - 159.51s | some vectors around, I don't know if you uh, if you uh, are aware uh, always aware about the 159.51s - 164.11s | um, what StackSnap was doing back in 2011 but we wanted to achieve something like 164.11s - 170.19s | backdooring DLL on different softwares to intercept communication, intercept code going and 170.19s - 177.39s | arriving from PLCs and doing stuff like that with uh, using side loading with hooking or uh, 177.39s - 184.17s | DLL proxying on uh, certain specific DLL used by this kind of software. And the addition, and 184.17s - 188.91s | the additional thing that we wanted to achieve was deploying a


chunk_id: 194_chunk_3
chunk_text:
in a, the best way possible. Of course, ISOs have been weaponized for years right now for 136.75s - 141.43s | their ability to uh, to bypass multi W but this was not really what we wanted to do. We 141.43s - 146.87s | want, we didn't want to just provide an ISO to our uh, customer. We had in the position of 146.87s - 153.11s | weaponize an I, an ISO. Uh, and then we just wanted to execute some code and like deploy 153.11s - 159.51s | some vectors around, I don't know if you uh, if you uh, are aware uh, always aware about the 159.51s - 164.11s | um, what StackSnap was doing back in 2011 but we wanted to achieve something like 164.11s - 170.19s | backdooring DLL on different softwares to intercept communication, intercept code going and 170.19s - 177.39s | arriving from PLCs and doing stuff like that with uh, using side loading with hooking or uh, 177.39s - 184.17s | DLL proxying on uh, certain specific DLL used by this kind of software. And the addition, and 184.17s - 188.91s | the additional thing that we wanted to achieve was deploying a kernel driver on these boxes. 188.91s - 195.99s | Now the uh, we started and one example of the ISOs that we end up backdooring was step 7 195.99s - 202.13s | installation media and the reason for this is that it's naturally deployed by using ISO files 202.13s - 209.63s | and it's pretty difficult to backdoor because um, step 7 use, utilized a back, a bootstrap to 209.63s - 215.07s | uh, launch the installer. Meaning that um, meaning that it actually performs an integrity 215.07s - 219.75s | check on the content of the disk before actually launching the installer and it has 2 219.75s - 225.85s | layer of checks so you need to, you need, you need to, if you want to um, uh, execute malicious 225.85s - 230.93s | code using the installer, you need to find a way to not tamper with any existing DLL and any 230.93s - 235.93s | existing executable on the disk. Um, talking about deploying the Windows uh, rootkit, a 239.19s - 244.61s | Windows rootkit um, usually when you need to deploy a rootkit on Windows, a kernel rootkit, a 244.85s - 249.15s | kernel driver on


chunk_id: 194_chunk_4
chunk_text:
kernel driver on these boxes. 188.91s - 195.99s | Now the uh, we started and one example of the ISOs that we end up backdooring was step 7 195.99s - 202.13s | installation media and the reason for this is that it's naturally deployed by using ISO files 202.13s - 209.63s | and it's pretty difficult to backdoor because um, step 7 use, utilized a back, a bootstrap to 209.63s - 215.07s | uh, launch the installer. Meaning that um, meaning that it actually performs an integrity 215.07s - 219.75s | check on the content of the disk before actually launching the installer and it has 2 219.75s - 225.85s | layer of checks so you need to, you need, you need to, if you want to um, uh, execute malicious 225.85s - 230.93s | code using the installer, you need to find a way to not tamper with any existing DLL and any 230.93s - 235.93s | existing executable on the disk. Um, talking about deploying the Windows uh, rootkit, a 239.19s - 244.61s | Windows rootkit um, usually when you need to deploy a rootkit on Windows, a kernel rootkit, a 244.85s - 249.15s | kernel driver on Windows, what you end up doing is you call create service, you create a 249.15s - 254.43s | service for the service driver and then you start the service with the driver. Of course one 254.43s - 260.33s | requirement for this is that the driver file that you are loading needs to be on disk. Um, now 260.33s - 265.33s | this can be done manually by manually placing uh, a registry key in the file system and then 268.33s - 273.47s | calling anti-load driver to load the driver. This is a bit more stealth uh, way of loading a 273.47s - 278.11s | driver and it's uh, in, in the name for this the thing is Windows log event evasion because it 278.11s - 282.65s | doesn't generate the event that is usually created when you create a service and start the 282.65s - 289.65s | service. But of course there is something else that uh, that sticks up. So like there, there is 289.65s - 293.99s | a every time you, you load the driver regardless if you're using the serve, the start service, 293.99s - 298.99s | the create service or you use directly the


chunk_id: 194_chunk_5
chunk_text:
Windows, what you end up doing is you call create service, you create a 249.15s - 254.43s | service for the service driver and then you start the service with the driver. Of course one 254.43s - 260.33s | requirement for this is that the driver file that you are loading needs to be on disk. Um, now 260.33s - 265.33s | this can be done manually by manually placing uh, a registry key in the file system and then 268.33s - 273.47s | calling anti-load driver to load the driver. This is a bit more stealth uh, way of loading a 273.47s - 278.11s | driver and it's uh, in, in the name for this the thing is Windows log event evasion because it 278.11s - 282.65s | doesn't generate the event that is usually created when you create a service and start the 282.65s - 289.65s | service. But of course there is something else that uh, that sticks up. So like there, there is 289.65s - 293.99s | a every time you, you load the driver regardless if you're using the serve, the start service, 293.99s - 298.99s | the create service or you use directly the anti-load driver uh, function. Uh, you generate uh, 299.59s - 304.59s | an event uh, which is the load driver event that is a sysmon event and an event 6 that provides 307.83s - 312.03s | all the information about the driver you be loaded. So even if it's more stealthy uh, there is 312.03s - 317.03s | still this that's the, that, that, that appears on, on as an event on the Windows log. So we 319.17s - 324.17s | wanted a technique that would help us bypass this event load driver as well. Uh, and so we 325.17s - 330.17s | ended up creating 4 uh, 4 libraries framework. I mean 2 of them are the core of this 332.87s - 339.51s | presentation which is IOCDFS, IOCDFS lib and driver jack uh, that will be abused to load a 339.51s - 344.41s | driver on Windows. The other 2 are collateral projects. They were not supposed to be part of 344.41s - 350.69s | the project. They, they just are RPC exec. I will just talk about it briefly. RPC execs is a 350.69s - 355.69s | less common way to execute on Windows uh, on local


chunk_id: 194_chunk_6
chunk_text:
anti-load driver uh, function. Uh, you generate uh, 299.59s - 304.59s | an event uh, which is the load driver event that is a sysmon event and an event 6 that provides 307.83s - 312.03s | all the information about the driver you be loaded. So even if it's more stealthy uh, there is 312.03s - 317.03s | still this that's the, that, that, that appears on, on as an event on the Windows log. So we 319.17s - 324.17s | wanted a technique that would help us bypass this event load driver as well. Uh, and so we 325.17s - 330.17s | ended up creating 4 uh, 4 libraries framework. I mean 2 of them are the core of this 332.87s - 339.51s | presentation which is IOCDFS, IOCDFS lib and driver jack uh, that will be abused to load a 339.51s - 344.41s | driver on Windows. The other 2 are collateral projects. They were not supposed to be part of 344.41s - 350.69s | the project. They, they just are RPC exec. I will just talk about it briefly. RPC execs is a 350.69s - 355.69s | less common way to execute on Windows uh, on local or remote processes without requiring uh, 358.79s - 364.69s | RX memory to be allocated in target process. And interleaver is uh, it became a sort of P 364.69s - 370.73s | manipulation library um, that we cannot share completely but I will share a simple block 370.73s - 376.71s | which is coupling P. You can find coupling P which is coupling preserve on my GitHub page. 376.73s - 382.17s | Now coupling P is a short version of interleaver. It doesn't manipulate completely the uh, the P 382.17s - 387.17s | file but it, it's an extension to what Nick Lenders implemented back in 2000, 20, 20? I don't 390.15s - 396.45s | remember exactly. Uh, so coupling is a framework that takes uh, target DLL, clone the export 396.45s - 401.45s | address, the export address table and uh, include it in uh, DLL that you developed. Uh, now 401.67s - 406.67s | this is used usually for DLL side loading using the DLL main function as uh, main entry point 410.41s - 416.41s | for the DLL. Now the problem is that this process is destructive so if you have some exports in 416.41s - 422.79s


chunk_id: 194_chunk_7
chunk_text:
or remote processes without requiring uh, 358.79s - 364.69s | RX memory to be allocated in target process. And interleaver is uh, it became a sort of P 364.69s - 370.73s | manipulation library um, that we cannot share completely but I will share a simple block 370.73s - 376.71s | which is coupling P. You can find coupling P which is coupling preserve on my GitHub page. 376.73s - 382.17s | Now coupling P is a short version of interleaver. It doesn't manipulate completely the uh, the P 382.17s - 387.17s | file but it, it's an extension to what Nick Lenders implemented back in 2000, 20, 20? I don't 390.15s - 396.45s | remember exactly. Uh, so coupling is a framework that takes uh, target DLL, clone the export 396.45s - 401.45s | address, the export address table and uh, include it in uh, DLL that you developed. Uh, now 401.67s - 406.67s | this is used usually for DLL side loading using the DLL main function as uh, main entry point 410.41s - 416.41s | for the DLL. Now the problem is that this process is destructive so if you have some exports in 416.41s - 422.79s | your payload DLL, these will be erased. So coupling P just solves the problem and it just 422.79s - 428.03s | preserved the existing export address table and just add the forwards afterward. That's it. 428.05s - 433.65s | Not, not, not, not really a, not really a difficult project. Uh, RPC proxy invoke instead or 433.65s - 438.65s | RPC exec is uh, general library that we implemented to as I said is to execute code on local 440.93s - 446.87s | or remote processes. Uh, it's, it's uh, borrowed by browser exploitation. It abuses the 446.87s - 451.87s | NDR server call to, to execute arbitrary calls. Uh, it doesn't require RX memory and we 452.61s - 457.61s | also implemented in a way that it doesn't require a valid RPC binding handle for uh, for 460.69s - 466.39s | execution. This is, this, there is a reason for this. We wanted something that we could use to 466.39s - 472.23s | execute arbitrary calls in any server, even in any service, in any processes, even if it 472.23s - 478.61s | wasn't actually using RPC and we wanted to avoid maintaining, like we wanted to be


chunk_id: 194_chunk_8
chunk_text:
| your payload DLL, these will be erased. So coupling P just solves the problem and it just 422.79s - 428.03s | preserved the existing export address table and just add the forwards afterward. That's it. 428.05s - 433.65s | Not, not, not, not really a, not really a difficult project. Uh, RPC proxy invoke instead or 433.65s - 438.65s | RPC exec is uh, general library that we implemented to as I said is to execute code on local 440.93s - 446.87s | or remote processes. Uh, it's, it's uh, borrowed by browser exploitation. It abuses the 446.87s - 451.87s | NDR server call to, to execute arbitrary calls. Uh, it doesn't require RX memory and we 452.61s - 457.61s | also implemented in a way that it doesn't require a valid RPC binding handle for uh, for 460.69s - 466.39s | execution. This is, this, there is a reason for this. We wanted something that we could use to 466.39s - 472.23s | execute arbitrary calls in any server, even in any service, in any processes, even if it 472.23s - 478.61s | wasn't actually using RPC and we wanted to avoid maintaining, like we wanted to be able to 478.65s - 485.15s | erase tracks if we wanted and using this technique we can load RPC, initialize it remotely, 485.15s - 491.05s | execute our stuff, our stuff and then just get rid of RPC RT4 completely by freeing the 491.05s - 496.07s | library and no traces will remain in the service. The process. Uh, the code is there. There 498.07s - 504.37s | are also some demos around um, that you can check. It's just for functionality. The project 504.37s - 511.17s | code is implemented and it has some not limitation but is implemented nerfed. Uh, meaning 511.17s - 517.41s | that it's not using for example uh, code pattern search for uh, for locating the required 517.41s - 523.49s | uh, the required entry point in RPC RT4. RPC RT4 changes over time a lot so you need to 523.49s - 527.49s | adjust it to depending on your version, on your Windows version or you need to implement 527.49s - 532.93s | yourself the code that actually do the pattern searches. Previous research. So when it 532.93s - 539.73s | comes to the core of the research or loading a driver on


chunk_id: 194_chunk_9
chunk_text:
able to 478.65s - 485.15s | erase tracks if we wanted and using this technique we can load RPC, initialize it remotely, 485.15s - 491.05s | execute our stuff, our stuff and then just get rid of RPC RT4 completely by freeing the 491.05s - 496.07s | library and no traces will remain in the service. The process. Uh, the code is there. There 498.07s - 504.37s | are also some demos around um, that you can check. It's just for functionality. The project 504.37s - 511.17s | code is implemented and it has some not limitation but is implemented nerfed. Uh, meaning 511.17s - 517.41s | that it's not using for example uh, code pattern search for uh, for locating the required 517.41s - 523.49s | uh, the required entry point in RPC RT4. RPC RT4 changes over time a lot so you need to 523.49s - 527.49s | adjust it to depending on your version, on your Windows version or you need to implement 527.49s - 532.93s | yourself the code that actually do the pattern searches. Previous research. So when it 532.93s - 539.73s | comes to the core of the research or loading a driver on Windows, you have a few ways to 539.73s - 543.81s | load a valid driver or an unsigned code on Windows to execute unsigned code on Windows. 543.81s - 548.51s | You can either, actually there are four. So the first one was implemented by Gabrielle 548.51s - 554.05s | Landau not long ago uh, by exploiting a new vulnerable class that is false file immutability. 554.05s - 557.75s | I didn't put it in the slides just because it wasn't available when I started doing this 557.75s - 562.55s | research but go check it out because it's an incredible research. Uh, but the standard 562.57s - 567.51s | way to uh, load unsigned code on Windows are either you, it's not unsigned, you, you load 567.51s - 574.49s | signed code so you have a kernel driver that you want to load, you uh, join the um, you 574.49s - 581.13s | join the um, Microsoft developer program. Microsoft sign your own driver and you're 581.13s - 586.13s | good to go. You can use a fake signature so before 2015 Microsoft allowed um, kernel drivers 587.13s - 592.13s | signed with uh, with a valid code signing


chunk_id: 194_chunk_10
chunk_text:
Windows, you have a few ways to 539.73s - 543.81s | load a valid driver or an unsigned code on Windows to execute unsigned code on Windows. 543.81s - 548.51s | You can either, actually there are four. So the first one was implemented by Gabrielle 548.51s - 554.05s | Landau not long ago uh, by exploiting a new vulnerable class that is false file immutability. 554.05s - 557.75s | I didn't put it in the slides just because it wasn't available when I started doing this 557.75s - 562.55s | research but go check it out because it's an incredible research. Uh, but the standard 562.57s - 567.51s | way to uh, load unsigned code on Windows are either you, it's not unsigned, you, you load 567.51s - 574.49s | signed code so you have a kernel driver that you want to load, you uh, join the um, you 574.49s - 581.13s | join the um, Microsoft developer program. Microsoft sign your own driver and you're 581.13s - 586.13s | good to go. You can use a fake signature so before 2015 Microsoft allowed um, kernel drivers 587.13s - 592.13s | signed with uh, with a valid code signing certificate and cross signed by an EV uh, CA 595.43s - 600.41s | certificate to load on Windows. So if you have a certificate that was expired before or 600.41s - 607.01s | issued before 2015 and you have a leaked EV CA certificate, you can still use, you can 607.01s - 612.01s | still set up your own uh, fake uh, timestamp server and you can back sign one of these 612.31s - 618.97s | drivers and you can uh, generate a signature that is expired so signed with an expired 618.97s - 625.31s | certificate but still valid to load on Windows. Uh, the, the third and last technique was 625.31s - 630.89s | uh, using a vulnerable driver. Now as you can understand, we didn't have, we didn't have 630.89s - 637.53s | any kernel driver uh, on the developer program. We didn't have any EV CA certificate leaked 637.55s - 642.15s | and unknown that we can, that we could use so we went to the route of uh, using a 642.15s - 648.49s | vulnerable driver to load our unsigned code. Now of course, we then started the research 648.49s - 654.83s | to one


chunk_id: 194_chunk_11
chunk_text:
certificate and cross signed by an EV uh, CA 595.43s - 600.41s | certificate to load on Windows. So if you have a certificate that was expired before or 600.41s - 607.01s | issued before 2015 and you have a leaked EV CA certificate, you can still use, you can 607.01s - 612.01s | still set up your own uh, fake uh, timestamp server and you can back sign one of these 612.31s - 618.97s | drivers and you can uh, generate a signature that is expired so signed with an expired 618.97s - 625.31s | certificate but still valid to load on Windows. Uh, the, the third and last technique was 625.31s - 630.89s | uh, using a vulnerable driver. Now as you can understand, we didn't have, we didn't have 630.89s - 637.53s | any kernel driver uh, on the developer program. We didn't have any EV CA certificate leaked 637.55s - 642.15s | and unknown that we can, that we could use so we went to the route of uh, using a 642.15s - 648.49s | vulnerable driver to load our unsigned code. Now of course, we then started the research 648.49s - 654.83s | to one for abusable vulnerable drivers and we found 4 of them, 2 of them we just uh, report 654.83s - 660.87s | to the vendors because they were not useful to us. 2 of them we kept them. Um, now usually 660.87s - 665.27s | when you want to load unsigned code on Windows, you search for of course there are a lot of 665.31s - 668.59s | vulnerabilities affecting vulnerable drivers. Buffer overflow, user after free, there are a 668.59s - 673.99s | lot, not just this that I, that I um, that I included here. But usually what you want is to 673.99s - 679.79s | have a stable, a stable physical memory read write, virtual memory read write or for example 679.79s - 686.07s | uh, unprotected MSR access. Um, MSR stands for model specific register. Now the first, this 686.07s - 693.07s | was abused a lot in 2018, 2020. So when you have and it appears when you have an unco- 693.11s - 700.11s | an unrestricted code uh, call to uh, WR uh, MSR. So there is a specific model specific 700.11s - 703.85s | register on Windows which is the uh, well actually not


chunk_id: 194_chunk_12
chunk_text:
for abusable vulnerable drivers and we found 4 of them, 2 of them we just uh, report 654.83s - 660.87s | to the vendors because they were not useful to us. 2 of them we kept them. Um, now usually 660.87s - 665.27s | when you want to load unsigned code on Windows, you search for of course there are a lot of 665.31s - 668.59s | vulnerabilities affecting vulnerable drivers. Buffer overflow, user after free, there are a 668.59s - 673.99s | lot, not just this that I, that I um, that I included here. But usually what you want is to 673.99s - 679.79s | have a stable, a stable physical memory read write, virtual memory read write or for example 679.79s - 686.07s | uh, unprotected MSR access. Um, MSR stands for model specific register. Now the first, this 686.07s - 693.07s | was abused a lot in 2018, 2020. So when you have and it appears when you have an unco- 693.11s - 700.11s | an unrestricted code uh, call to uh, WR uh, MSR. So there is a specific model specific 700.11s - 703.85s | register on Windows which is the uh, well actually not on Windows, it's not specific to 703.85s - 708.85s | Windows but it's the IA uh, 32 L star that contains on Windows the pointer to um, the system 712.39s - 719.23s | call dispatch function. So on, before KPTI was introduced uh, this points to KI system call 719.27s - 724.27s | 64. After KPTI mitigation uh, this points to KI system call 64 uh, shadow but regardless this 726.97s - 733.71s | points to a dispatch function that is responsible to switch to um, that is responsible to 733.71s - 739.65s | switch to um, from user mode to kernel mode and execute and dispatch to the relevant system 739.65s - 745.23s | call uh, handler on kernel side. Now if you have an unrestricted call to and you can 745.23s - 750.43s | override this register, what you can do is you can weaponize it to point to your user 750.43s - 755.43s | defined uh, handler and this is abused in MSR exec by Xerox uh, from back engineering uh, 758.91s - 765.91s | magnificent tool to be honest. Um, and this literally implements its own uh, dispatch 765.91s - 770.91s | function that swap to


chunk_id: 194_chunk_13
chunk_text:
on Windows, it's not specific to 703.85s - 708.85s | Windows but it's the IA uh, 32 L star that contains on Windows the pointer to um, the system 712.39s - 719.23s | call dispatch function. So on, before KPTI was introduced uh, this points to KI system call 719.27s - 724.27s | 64. After KPTI mitigation uh, this points to KI system call 64 uh, shadow but regardless this 726.97s - 733.71s | points to a dispatch function that is responsible to switch to um, that is responsible to 733.71s - 739.65s | switch to um, from user mode to kernel mode and execute and dispatch to the relevant system 739.65s - 745.23s | call uh, handler on kernel side. Now if you have an unrestricted call to and you can 745.23s - 750.43s | override this register, what you can do is you can weaponize it to point to your user 750.43s - 755.43s | defined uh, handler and this is abused in MSR exec by Xerox uh, from back engineering uh, 758.91s - 765.91s | magnificent tool to be honest. Um, and this literally implements its own uh, dispatch 765.91s - 770.91s | function that swap to kernel mode using the swap JS uh, instruction. Uh, disables maps map 771.81s - 776.81s | and executes arbitrary code uh, stored in a user mode buffer. Uh, afterward it uses ROP to 782.55s - 787.55s | sorry, it uses ROP to uh, restore maps map and restore the IA uh, L 32 L star. Now this, the 793.93s - 798.67s | other, the other vulnerable pattern that we have is arbitrary physical memory access. Now uh, 798.69s - 804.67s | usually when uh, this, this presents itself in two forms. Either a call, a restricted call to 804.67s - 810.61s | ZW map your sec uh, map your section or that can map whatever physical address in a linear 810.61s - 816.45s | address or by using mmap IO space. Now the vulnerable pattern that we found the most was 816.45s - 821.85s | this. It's abusable, it's less abusable than ZW map your section because these actually 821.85s - 827.33s | provide uh, access that uh, you can't specify the access right so you can't specify read 827.35s - 832.85s | write uh, instead of read. And this usually is used for privilege escalation. So if you have


chunk_id: 194_chunk_14
chunk_text:
kernel mode using the swap JS uh, instruction. Uh, disables maps map 771.81s - 776.81s | and executes arbitrary code uh, stored in a user mode buffer. Uh, afterward it uses ROP to 782.55s - 787.55s | sorry, it uses ROP to uh, restore maps map and restore the IA uh, L 32 L star. Now this, the 793.93s - 798.67s | other, the other vulnerable pattern that we have is arbitrary physical memory access. Now uh, 798.69s - 804.67s | usually when uh, this, this presents itself in two forms. Either a call, a restricted call to 804.67s - 810.61s | ZW map your sec uh, map your section or that can map whatever physical address in a linear 810.61s - 816.45s | address or by using mmap IO space. Now the vulnerable pattern that we found the most was 816.45s - 821.85s | this. It's abusable, it's less abusable than ZW map your section because these actually 821.85s - 827.33s | provide uh, access that uh, you can't specify the access right so you can't specify read 827.35s - 832.85s | write uh, instead of read. And this usually is used for privilege escalation. So if you have a 832.85s - 838.83s | pattern that like this, so you have a call to mmap IO space, IO allocate MDL and then mm, mm 838.83s - 844.23s | build MDL for non-page pool and then mmap lock page specific, specify cache. You have a 844.23s - 851.07s | pattern where you can actually uh, allocate page memory, page pool memory, sorry, non-page 851.07s - 856.61s | pool memory in a user mode buffer and using a technique known as proc scanning you can 856.63s - 862.69s | identify e-process structure in the non-page pool and swap tokens around to achieve uh, 862.69s - 869.27s | privilege escalation. And then there is the prints of all other vulnerabilities uh, arbitrary 869.27s - 873.71s | virtual read, arbitrary kernel virtual uh, memory read write. This presents itself in a lot 873.71s - 879.81s | of different ways. Can be a mem move, a mem copy, a ZW write virtual memory, can be a 879.81s - 885.79s | direct pointer assignment uh, it can be whatever. Now this is used for a lot of different 885.83s - 891.53s | stuff uh, let alone bypass DSC for example or just mapping arbitrary stuff


chunk_id: 194_chunk_15
chunk_text:
a 832.85s - 838.83s | pattern that like this, so you have a call to mmap IO space, IO allocate MDL and then mm, mm 838.83s - 844.23s | build MDL for non-page pool and then mmap lock page specific, specify cache. You have a 844.23s - 851.07s | pattern where you can actually uh, allocate page memory, page pool memory, sorry, non-page 851.07s - 856.61s | pool memory in a user mode buffer and using a technique known as proc scanning you can 856.63s - 862.69s | identify e-process structure in the non-page pool and swap tokens around to achieve uh, 862.69s - 869.27s | privilege escalation. And then there is the prints of all other vulnerabilities uh, arbitrary 869.27s - 873.71s | virtual read, arbitrary kernel virtual uh, memory read write. This presents itself in a lot 873.71s - 879.81s | of different ways. Can be a mem move, a mem copy, a ZW write virtual memory, can be a 879.81s - 885.79s | direct pointer assignment uh, it can be whatever. Now this is used for a lot of different 885.83s - 891.53s | stuff uh, let alone bypass DSC for example or just mapping arbitrary stuff in memory, in 891.53s - 898.17s | kernel memory. And this is heavily abused by tools like ADMapper or KDU to load your driver 898.17s - 904.55s | in memory. Now of course Windows doesn't like this uh, so they started introducing a lot of 904.55s - 911.19s | different mitigations. Since 2018 there was the introduction of uh, KBDI after the 911.19s - 916.63s | Spectrum Meltdown uh, attack. Uh, then they started introducing VBS, virtualization 916.63s - 922.67s | based security and started enforcing HVCI. After the HVCI they introduced KDP which we will 922.67s - 929.07s | see. And then they implemented the Microsoft uh, driver block list and afterward they 929.07s - 934.55s | started introducing support first for kernel chat, control enforcement, enforcement 934.55s - 939.55s | technology that uh, neutralize, neutralizes ROP based attack. And then in like weeks ago uh, 942.55s - 948.93s | they announced that Windows 11 24H2 will support uh, Intel VTRP, redirection protection 948.93s - 953.93s | that kills another black class that we will gonna see in like now. So VBS is uh, is 957.41s - 962.27s | really, is really tough for uh, for exploiting vulnerable drivers


chunk_id: 194_chunk_16
chunk_text:
in memory, in 891.53s - 898.17s | kernel memory. And this is heavily abused by tools like ADMapper or KDU to load your driver 898.17s - 904.55s | in memory. Now of course Windows doesn't like this uh, so they started introducing a lot of 904.55s - 911.19s | different mitigations. Since 2018 there was the introduction of uh, KBDI after the 911.19s - 916.63s | Spectrum Meltdown uh, attack. Uh, then they started introducing VBS, virtualization 916.63s - 922.67s | based security and started enforcing HVCI. After the HVCI they introduced KDP which we will 922.67s - 929.07s | see. And then they implemented the Microsoft uh, driver block list and afterward they 929.07s - 934.55s | started introducing support first for kernel chat, control enforcement, enforcement 934.55s - 939.55s | technology that uh, neutralize, neutralizes ROP based attack. And then in like weeks ago uh, 942.55s - 948.93s | they announced that Windows 11 24H2 will support uh, Intel VTRP, redirection protection 948.93s - 953.93s | that kills another black class that we will gonna see in like now. So VBS is uh, is 957.41s - 962.27s | really, is really tough for uh, for exploiting vulnerable drivers because HVCI want to 962.27s - 967.27s | prevents you from abusing a vulnerable driver to load your VTL0 rootkit in memory. Now how 970.73s - 975.75s | it works, well you have now the Windows low is, is, is runs on top of the hypervisor and uh, it 979.15s - 985.59s | divides the, divides the, the, the trust level into trust level, the VTL1 and VTL0. Now your 985.59s - 990.59s | own kernel runs in VTL0. Now this is the guest uh, operating system, the guest operating 992.63s - 999.03s | OS and what it, what it, what it, what it does is that this uses a normal uh, page structured 999.03s - 1003.97s | approach to, for address resolution to map a physical address into a linear address. So you 1003.97s - 1008.97s | have your CR3, you have your um, you have your uh, PML4 entry, then you have your uh, page 1012.01s - 1016.89s | directory pointer entry, then you have your page directory entry, the page table entry and 1016.89s - 1021.65s | then finally you have your, your physical address. This physical address though is a guest 1021.67s - 1027.11s | physical


chunk_id: 194_chunk_17
chunk_text:
because HVCI want to 962.27s - 967.27s | prevents you from abusing a vulnerable driver to load your VTL0 rootkit in memory. Now how 970.73s - 975.75s | it works, well you have now the Windows low is, is, is runs on top of the hypervisor and uh, it 979.15s - 985.59s | divides the, divides the, the, the trust level into trust level, the VTL1 and VTL0. Now your 985.59s - 990.59s | own kernel runs in VTL0. Now this is the guest uh, operating system, the guest operating 992.63s - 999.03s | OS and what it, what it, what it, what it does is that this uses a normal uh, page structured 999.03s - 1003.97s | approach to, for address resolution to map a physical address into a linear address. So you 1003.97s - 1008.97s | have your CR3, you have your um, you have your uh, PML4 entry, then you have your uh, page 1012.01s - 1016.89s | directory pointer entry, then you have your page directory entry, the page table entry and 1016.89s - 1021.65s | then finally you have your, your physical address. This physical address though is a guest 1021.67s - 1027.11s | physical address, meaning that there is another layer, second layer access resolution that is 1027.11s - 1032.11s | translates a guest physical address into a real physical address that is managed entirely by, by 1035.05s - 1040.05s | the hypervisor. Uh, using extended page tables. Now what is the problem for us? Is that before 1043.79s - 1048.79s | this was introduced, page protection was kernel based. So when you had control of kernel, you 1049.57s - 1055.47s | could do literally anything. So if you had a virtual, if you had a virtual read write, you 1055.47s - 1060.55s | could literally locate the digi options for example, that is the global variable and like 1060.55s - 1065.79s | managing the driver signature enforcement and you could just override it. You could nullify 1065.79s - 1071.09s | it, load your unsigned code and then restore it of course because it, even though it was 1071.09s - 1076.09s | possible to modify it, it was still protected by kernel patch guard. Um, KPP, kernel page 1076.77s - 1081.77s | protect, kernel, yeah, patch guard. Uh, but now, now it's different because now the 1084.71s - 1089.71s | enforcement is done and


chunk_id: 194_chunk_18
chunk_text:
address, meaning that there is another layer, second layer access resolution that is 1027.11s - 1032.11s | translates a guest physical address into a real physical address that is managed entirely by, by 1035.05s - 1040.05s | the hypervisor. Uh, using extended page tables. Now what is the problem for us? Is that before 1043.79s - 1048.79s | this was introduced, page protection was kernel based. So when you had control of kernel, you 1049.57s - 1055.47s | could do literally anything. So if you had a virtual, if you had a virtual read write, you 1055.47s - 1060.55s | could literally locate the digi options for example, that is the global variable and like 1060.55s - 1065.79s | managing the driver signature enforcement and you could just override it. You could nullify 1065.79s - 1071.09s | it, load your unsigned code and then restore it of course because it, even though it was 1071.09s - 1076.09s | possible to modify it, it was still protected by kernel patch guard. Um, KPP, kernel page 1076.77s - 1081.77s | protect, kernel, yeah, patch guard. Uh, but now, now it's different because now the 1084.71s - 1089.71s | enforcement is done and hypervisor level. Now HVCI does two things and in together with KDP 1093.55s - 1099.39s | that's a lot of problems. Like HVCI enforces that any page is either writable or executable, 1099.39s - 1104.39s | can be bought. So this is designed to um, to avoid you from writing your own code and 1106.69s - 1112.13s | kernel memory and then execute it. So and now this protection is enforced on hypervisor level 1112.13s - 1118.23s | meaning that you, even if you have your fantastic read write primitive, uh, you can't change 1118.23s - 1122.81s | the protection of a page because even though you are changing the protection of the page on 1122.81s - 1128.11s | the first level address translation, this memory protection does not propagate to the second 1128.11s - 1133.89s | level address translation and it's there that the protection is enforced. So if you have read 1133.95s - 1138.63s | write, it's gonna be read write even if you change the protection on VTL zero. And if it's 1138.63s - 1144.59s | read execute, it's gonna be read execute even if you try to change the protection on VTL zero. 1144.59s - 1150.87s


chunk_id: 194_chunk_19
chunk_text:
hypervisor level. Now HVCI does two things and in together with KDP 1093.55s - 1099.39s | that's a lot of problems. Like HVCI enforces that any page is either writable or executable, 1099.39s - 1104.39s | can be bought. So this is designed to um, to avoid you from writing your own code and 1106.69s - 1112.13s | kernel memory and then execute it. So and now this protection is enforced on hypervisor level 1112.13s - 1118.23s | meaning that you, even if you have your fantastic read write primitive, uh, you can't change 1118.23s - 1122.81s | the protection of a page because even though you are changing the protection of the page on 1122.81s - 1128.11s | the first level address translation, this memory protection does not propagate to the second 1128.11s - 1133.89s | level address translation and it's there that the protection is enforced. So if you have read 1133.95s - 1138.63s | write, it's gonna be read write even if you change the protection on VTL zero. And if it's 1138.63s - 1144.59s | read execute, it's gonna be read execute even if you try to change the protection on VTL zero. 1144.59s - 1150.87s | And with KDP you have another problem because certain area of memory, data section of 1150.87s - 1157.45s | memory, are protected by this KDP that enforces that the page is read only. So for example 1157.45s - 1162.11s | G option is protected that way. So now even if you have an arbitrary read write and the 1162.13s - 1166.47s | page should be read write, it's actually read only so even if you have it, you can't change 1166.47s - 1173.97s | G options to zero anymore. So what is the strategy around this? Well, luckily someone very 1173.97s - 1178.99s | smart, smarter than me of course, uh, developed a technique which is called page remapping 1178.99s - 1184.73s | and page remapping attack exploited um, it's not a bug, it's like a limitation of KDP. KDP 1184.73s - 1189.73s | doesn't enforce how pages on the guest are translated to pages on the host system. So 1192.47s - 1198.95s | meaning that not enforcing that, what I can do, one possible thing I can do is I can copy 1198.95s - 1203.95s | over my con, the content I want to modify to another page.


chunk_id: 194_chunk_20
chunk_text:
| And with KDP you have another problem because certain area of memory, data section of 1150.87s - 1157.45s | memory, are protected by this KDP that enforces that the page is read only. So for example 1157.45s - 1162.11s | G option is protected that way. So now even if you have an arbitrary read write and the 1162.13s - 1166.47s | page should be read write, it's actually read only so even if you have it, you can't change 1166.47s - 1173.97s | G options to zero anymore. So what is the strategy around this? Well, luckily someone very 1173.97s - 1178.99s | smart, smarter than me of course, uh, developed a technique which is called page remapping 1178.99s - 1184.73s | and page remapping attack exploited um, it's not a bug, it's like a limitation of KDP. KDP 1184.73s - 1189.73s | doesn't enforce how pages on the guest are translated to pages on the host system. So 1192.47s - 1198.95s | meaning that not enforcing that, what I can do, one possible thing I can do is I can copy 1198.95s - 1203.95s | over my con, the content I want to modify to another page. I can modify the um, the page 1206.75s - 1211.75s | structures on VTL zero to make it point to a read write page on the hypervisor level. And 1214.39s - 1220.19s | this will effectively make my page read write. And I can modify then the content. So 1220.21s - 1225.21s | Satoshi Sanda developed a proof of concept and use it, used a null byte page to nullify DSC 1229.13s - 1234.13s | in exact this way. Now this is also usable for executing arbitrary code. Um, and we have 1237.67s - 1244.61s | two main strategies for executing arbitrary code even if HBCI is enabled. So this depends 1244.63s - 1249.63s | a lot on the um, this depends a lot on the uh, Intel CPU level. So if you have, if you have 1252.57s - 1258.51s | any CPU that is before Tiger Lake, before 11 generation, you can still use ROP because this 1258.51s - 1263.25s | kind of CPU doesn't, do not support chat. So you can use kernel forge. Kernel forge is a 1263.25s - 1268.25s | technique implemented firstly by Crash and also discussed by Conor McGar uh, in his, in a


chunk_id: 194_chunk_21
chunk_text:
I can modify the um, the page 1206.75s - 1211.75s | structures on VTL zero to make it point to a read write page on the hypervisor level. And 1214.39s - 1220.19s | this will effectively make my page read write. And I can modify then the content. So 1220.21s - 1225.21s | Satoshi Sanda developed a proof of concept and use it, used a null byte page to nullify DSC 1229.13s - 1234.13s | in exact this way. Now this is also usable for executing arbitrary code. Um, and we have 1237.67s - 1244.61s | two main strategies for executing arbitrary code even if HBCI is enabled. So this depends 1244.63s - 1249.63s | a lot on the um, this depends a lot on the uh, Intel CPU level. So if you have, if you have 1252.57s - 1258.51s | any CPU that is before Tiger Lake, before 11 generation, you can still use ROP because this 1258.51s - 1263.25s | kind of CPU doesn't, do not support chat. So you can use kernel forge. Kernel forge is a 1263.25s - 1268.25s | technique implemented firstly by Crash and also discussed by Conor McGar uh, in his, in a 1268.31s - 1273.31s | blog post. And he uses a thread and a dummy event to modify the kernels, the, the thread, the 1277.35s - 1284.35s | thread kernel stack uh, at run time. Meaning that it will replace frame on kernel side of the, of 1284.35s - 1290.83s | a thread to make it execute a ROP chain on return. Executing arbitrary code. And on, if 1290.83s - 1297.33s | instead you have uh, uh, CPU that is before 12 generation, you can use the page remapping 1297.35s - 1302.35s | attack as I said uh, that abuses MULK. Now why before 12 generation? I can say, actually I 1304.73s - 1310.73s | should say a CPU before 12 generation and before Windows and a version of Windows before 24 1310.73s - 1315.73s | H2 because as I said uh, Windows 11 24 H2 and uh, supports Intel BTRP that is a killer 1319.67s - 1325.31s | exactly for this kind of attack, for page remapping attack. So it avoids any user from being 1325.33s - 1330.33s | able to redirect a page from VTL zero to remap to another page in the, in the OS system. 1333.77s -


chunk_id: 194_chunk_22
chunk_text:
1268.31s - 1273.31s | blog post. And he uses a thread and a dummy event to modify the kernels, the, the thread, the 1277.35s - 1284.35s | thread kernel stack uh, at run time. Meaning that it will replace frame on kernel side of the, of 1284.35s - 1290.83s | a thread to make it execute a ROP chain on return. Executing arbitrary code. And on, if 1290.83s - 1297.33s | instead you have uh, uh, CPU that is before 12 generation, you can use the page remapping 1297.35s - 1302.35s | attack as I said uh, that abuses MULK. Now why before 12 generation? I can say, actually I 1304.73s - 1310.73s | should say a CPU before 12 generation and before Windows and a version of Windows before 24 1310.73s - 1315.73s | H2 because as I said uh, Windows 11 24 H2 and uh, supports Intel BTRP that is a killer 1319.67s - 1325.31s | exactly for this kind of attack, for page remapping attack. So it avoids any user from being 1325.33s - 1330.33s | able to redirect a page from VTL zero to remap to another page in the, in the OS system. 1333.77s - 1340.27s | Now and what about if we have something, what about if we have something uh, more? Um, I 1340.27s - 1345.41s | actually, I actually, I'm actually exploring some other technique for trying to bypass HVCI 1345.41s - 1350.81s | but currently these are the only way I uh, thought that large pages could also be used for 1350.81s - 1355.83s | this kind of thing but apparently it's not gonna, it's not really working. So, but we still, 1358.79s - 1364.97s | even if we can do stuff, we still need to load a vulnerable driver to execute any of these 1364.97s - 1371.07s | strategies. So if we want to load a vulnerable driver we need to be aware that there is 1371.07s - 1375.15s | something called driver block list that will probably prevent us from loading a known 1375.15s - 1380.55s | vulnerable driver on Windows. Now the driver block list is a black list and of course it 1380.55s - 1386.09s | has some problems that were identified by Will Dorman and Yarden Shafir another researcher. The 1386.09s - 1392.49s | block list by itself is, is just a collection of ashes and


chunk_id: 194_chunk_23
chunk_text:
1340.27s | Now and what about if we have something, what about if we have something uh, more? Um, I 1340.27s - 1345.41s | actually, I actually, I'm actually exploring some other technique for trying to bypass HVCI 1345.41s - 1350.81s | but currently these are the only way I uh, thought that large pages could also be used for 1350.81s - 1355.83s | this kind of thing but apparently it's not gonna, it's not really working. So, but we still, 1358.79s - 1364.97s | even if we can do stuff, we still need to load a vulnerable driver to execute any of these 1364.97s - 1371.07s | strategies. So if we want to load a vulnerable driver we need to be aware that there is 1371.07s - 1375.15s | something called driver block list that will probably prevent us from loading a known 1375.15s - 1380.55s | vulnerable driver on Windows. Now the driver block list is a black list and of course it 1380.55s - 1386.09s | has some problems that were identified by Will Dorman and Yarden Shafir another researcher. The 1386.09s - 1392.49s | block list by itself is, is just a collection of ashes and uh, file names and file version that 1392.49s - 1397.17s | are supposed to be not loaded on Windows and if the driver block list is enabled it will 1397.17s - 1402.17s | prevent normal uh, normal vulnerable drivers to be loaded but it has a measure flow. The 1402.61s - 1407.61s | coverage is ridiculous. So uh, I, I made a bit of, a little script to check how many uh, how 1412.25s - 1419.25s | many drivers were blocked from the load driver projects. Uh, this just check the um, the ashes 1419.25s - 1425.09s | but it's, it's, it's really, it's really ridiculous. The coverage is really ridiculous. And also 1425.09s - 1430.63s | it can be disabled by admin. Uh, of course when we bypass the block list we need to be aware 1430.63s - 1435.53s | that there is also the CRL, the CRL. So even if a driver is not in the block list it doesn't 1435.53s - 1440.51s | mean that the certificate is still valid. So there are other, there are other, there are, there 1440.51s - 1447.63s | are other things that may prevent us from loading uh, uh, a vulnerable


chunk_id: 194_chunk_24
chunk_text:
uh, file names and file version that 1392.49s - 1397.17s | are supposed to be not loaded on Windows and if the driver block list is enabled it will 1397.17s - 1402.17s | prevent normal uh, normal vulnerable drivers to be loaded but it has a measure flow. The 1402.61s - 1407.61s | coverage is ridiculous. So uh, I, I made a bit of, a little script to check how many uh, how 1412.25s - 1419.25s | many drivers were blocked from the load driver projects. Uh, this just check the um, the ashes 1419.25s - 1425.09s | but it's, it's, it's really, it's really ridiculous. The coverage is really ridiculous. And also 1425.09s - 1430.63s | it can be disabled by admin. Uh, of course when we bypass the block list we need to be aware 1430.63s - 1435.53s | that there is also the CRL, the CRL. So even if a driver is not in the block list it doesn't 1435.53s - 1440.51s | mean that the certificate is still valid. So there are other, there are other, there are, there 1440.51s - 1447.63s | are other things that may prevent us from loading uh, uh, a vulnerable driver on Windows. And 1447.63s - 1452.53s | now to the meat of this presentation, what can we do to load a malicious uh, vulnerable driver 1452.53s - 1457.97s | on Windows using this like unusual technique? So let's talk about a bit about the anti-object 1458.83s - 1464.91s | manager. So the anti-object manager is a subsystem on Windows that provide access to resources 1464.91s - 1471.25s | uh, using uh, name value approach. It's not entirely correct but it's the most, it's the most 1471.25s - 1478.49s | accurate the, the simplification. Uh, it provides access to these objects using a unified API 1478.49s - 1483.49s | and uh, it like every object is, is, is uh, it can be indexed by uh, using a name, can be 1483.49s - 1488.49s | recovered using a name. And these names are uh, categorized in uh, in categories that we call 1492.63s - 1497.63s | namespaces. Now uh, you probably already seen the uh, object manager in WinObject, SysInternals 1500.77s - 1505.11s | and you can see a graphical representation of the object manager. So you have all these 1505.11s - 1510.11s | objects with the type associated and uh,


chunk_id: 194_chunk_25
chunk_text:
driver on Windows. And 1447.63s - 1452.53s | now to the meat of this presentation, what can we do to load a malicious uh, vulnerable driver 1452.53s - 1457.97s | on Windows using this like unusual technique? So let's talk about a bit about the anti-object 1458.83s - 1464.91s | manager. So the anti-object manager is a subsystem on Windows that provide access to resources 1464.91s - 1471.25s | uh, using uh, name value approach. It's not entirely correct but it's the most, it's the most 1471.25s - 1478.49s | accurate the, the simplification. Uh, it provides access to these objects using a unified API 1478.49s - 1483.49s | and uh, it like every object is, is, is uh, it can be indexed by uh, using a name, can be 1483.49s - 1488.49s | recovered using a name. And these names are uh, categorized in uh, in categories that we call 1492.63s - 1497.63s | namespaces. Now uh, you probably already seen the uh, object manager in WinObject, SysInternals 1500.77s - 1505.11s | and you can see a graphical representation of the object manager. So you have all these 1505.11s - 1510.11s | objects with the type associated and uh, you have the name categorized in namespaces. Now 1510.71s - 1515.71s | usually uh, when you, this is actually used um, this categorization is used because any 1518.71s - 1524.25s | namespace is as a certain accessibility. So if I want for example to make uh, an object 1524.25s - 1529.25s | available in to the Win32 layer, I usually use a sim link that connect the global, which is the 1531.95s - 1536.97s | global um, namespace to the specific object I want to, I want to connect it with. And this is what 1537.19s - 1542.19s | you usually do even with drivers uh, for example. Now the empty object manager uh, is in uh, of 1549.90s - 1554.90s | course uh, provides access to object to other subsystem like the IOManager, the process 1554.90s - 1560.68s | manager, the memo, the memory manager, et cetera. And whenever, whenever an object of type 1560.68s - 1565.68s | file is uh, is, is, is accessed by the IOManager, the IOManager will immediately check the 1566.14s - 1571.14s | file object and will dispatch it to the relevant driver that is meant to handle that, that 1574.40s - 1579.40s |


chunk_id: 194_chunk_26
chunk_text:
you have the name categorized in namespaces. Now 1510.71s - 1515.71s | usually uh, when you, this is actually used um, this categorization is used because any 1518.71s - 1524.25s | namespace is as a certain accessibility. So if I want for example to make uh, an object 1524.25s - 1529.25s | available in to the Win32 layer, I usually use a sim link that connect the global, which is the 1531.95s - 1536.97s | global um, namespace to the specific object I want to, I want to connect it with. And this is what 1537.19s - 1542.19s | you usually do even with drivers uh, for example. Now the empty object manager uh, is in uh, of 1549.90s - 1554.90s | course uh, provides access to object to other subsystem like the IOManager, the process 1554.90s - 1560.68s | manager, the memo, the memory manager, et cetera. And whenever, whenever an object of type 1560.68s - 1565.68s | file is uh, is, is, is accessed by the IOManager, the IOManager will immediately check the 1566.14s - 1571.14s | file object and will dispatch it to the relevant driver that is meant to handle that, that 1574.40s - 1579.40s | specific file object. Now the NTFS driver manage the NTFS file system. What kind of file 1581.98s - 1586.98s | system is the NTFS file system? So the NTFS uh, NTFS is a complex file system. Uh, it was 1588.72s - 1593.06s | always designed by Microsoft for extensibility and to support different kind of other file 1593.10s - 1598.78s | systems like FAT32 et cetera. And the main, the main thing that I want you to memorize for 1598.78s - 1604.48s | now is that every file on Windows is a set of attributes of course and every file has at least 1604.48s - 1609.08s | one stream associated. So every file on Windows is actually, can actually be referred to as a 1609.08s - 1614.08s | triple. It's, it's tripled. Triple, triple. So um, so and um, and usually you have oh, I don't 1614.28s - 1619.28s | know what I'm saying. So usually you have the file name, the stream type uh, the stream name 1622.62s - 1626.62s | and the stream type. Every file has at least one stream. So if you specific, if you create a 1626.62s - 1631.46s | file with just the file


chunk_id: 194_chunk_27
chunk_text:
specific file object. Now the NTFS driver manage the NTFS file system. What kind of file 1581.98s - 1586.98s | system is the NTFS file system? So the NTFS uh, NTFS is a complex file system. Uh, it was 1588.72s - 1593.06s | always designed by Microsoft for extensibility and to support different kind of other file 1593.10s - 1598.78s | systems like FAT32 et cetera. And the main, the main thing that I want you to memorize for 1598.78s - 1604.48s | now is that every file on Windows is a set of attributes of course and every file has at least 1604.48s - 1609.08s | one stream associated. So every file on Windows is actually, can actually be referred to as a 1609.08s - 1614.08s | triple. It's, it's tripled. Triple, triple. So um, so and um, and usually you have oh, I don't 1614.28s - 1619.28s | know what I'm saying. So usually you have the file name, the stream type uh, the stream name 1622.62s - 1626.62s | and the stream type. Every file has at least one stream. So if you specific, if you create a 1626.62s - 1631.46s | file with just the file name, you are immediately, it means that the other, the stream name 1631.46s - 1637.80s | and the stream type are defaulting back to something. For files is the data stream and for 1637.80s - 1642.80s | directories you have the index allocation stream. But they are usually always a triple. Um, 1644.60s - 1649.04s | now another thing I want you to memorize is the concept of reparse points. Because this was 1649.04s - 1655.42s | meant for extensibility, uh, NTFS supports a lot of type of reparse point. The main and 1655.42s - 1660.48s | common, the most common reparse points that you will see in NTFS are three. Although there 1660.48s - 1665.50s | are like 20 or 30 different reparse tags. So reparse types. So reparse point types. So the 1668.46s - 1672.96s | main, the most common are junction points that points directory that links directory to 1672.98s - 1679.02s | directories. Uh, mount point that links directories to drives to, to mounted drives and 1679.02s - 1684.26s | symbolic links that link files to other files. So this is not to be confused with link file. 1684.26s - 1690.10s | Link file are regular


chunk_id: 194_chunk_28
chunk_text:
name, you are immediately, it means that the other, the stream name 1631.46s - 1637.80s | and the stream type are defaulting back to something. For files is the data stream and for 1637.80s - 1642.80s | directories you have the index allocation stream. But they are usually always a triple. Um, 1644.60s - 1649.04s | now another thing I want you to memorize is the concept of reparse points. Because this was 1649.04s - 1655.42s | meant for extensibility, uh, NTFS supports a lot of type of reparse point. The main and 1655.42s - 1660.48s | common, the most common reparse points that you will see in NTFS are three. Although there 1660.48s - 1665.50s | are like 20 or 30 different reparse tags. So reparse types. So reparse point types. So the 1668.46s - 1672.96s | main, the most common are junction points that points directory that links directory to 1672.98s - 1679.02s | directories. Uh, mount point that links directories to drives to, to mounted drives and 1679.02s - 1684.26s | symbolic links that link files to other files. So this is not to be confused with link file. 1684.26s - 1690.10s | Link file are regular files. They have a data stream and they are just regular files. They 1690.10s - 1696.54s | need to be parsed to access to another location on the file system. Uh, indeed symbolic 1696.56s - 1703.26s | links are an NTFS features. Meaning that they are just, they are just literally linked on 1703.26s - 1709.84s | NTFS. They link directly on NTFS uh, to another file. And usually a reparse point is always a 1709.84s - 1714.54s | reparse tag. Which in this case is symbolic link. And are reparse, reparse data that will 1714.54s - 1719.54s | actually point to the real file that is pointed to. Now about CDFS. CDFS is a way more um, is a 1720.26s - 1725.26s | way simpler file system. It's, it just, it just comprises uh, root directory and then it 1731.26s - 1736.30s | has directory and, and then there's directory entries and file entries that are associated 1736.30s - 1743.40s | and are always parsed from the root directory. Is um, is an implementation of the ISO uh, 1743.40s - 1748.42s | 9667s and 960 and um, the important thing is that the CDFS file system probe, the CDFS


chunk_id: 194_chunk_29
chunk_text:
files. They have a data stream and they are just regular files. They 1690.10s - 1696.54s | need to be parsed to access to another location on the file system. Uh, indeed symbolic 1696.56s - 1703.26s | links are an NTFS features. Meaning that they are just, they are just literally linked on 1703.26s - 1709.84s | NTFS. They link directly on NTFS uh, to another file. And usually a reparse point is always a 1709.84s - 1714.54s | reparse tag. Which in this case is symbolic link. And are reparse, reparse data that will 1714.54s - 1719.54s | actually point to the real file that is pointed to. Now about CDFS. CDFS is a way more um, is a 1720.26s - 1725.26s | way simpler file system. It's, it just, it just comprises uh, root directory and then it 1731.26s - 1736.30s | has directory and, and then there's directory entries and file entries that are associated 1736.30s - 1743.40s | and are always parsed from the root directory. Is um, is an implementation of the ISO uh, 1743.40s - 1748.42s | 9667s and 960 and um, the important thing is that the CDFS file system probe, the CDFS file 1754.62s - 1761.46s | system uh, is also uh, also apply, applies to optical disk as much as applies to ISO files. So 1761.46s - 1767.50s | ISO files are a beautiful implementation of this CDFS file system. Now just to give a bit of 1767.50s - 1772.94s | difference to the NTFS. Of course CDFS does not support reparse point, does not support a lot 1772.94s - 1777.28s | of things that are supported by NTFS, but also it has a completely different threat model. So 1777.28s - 1784.12s | NTFS supports rich permissions. So it has an AC, an ACL and the ACL is associated with 1784.12s - 1789.50s | different AC entries, access control entries which define what, what can be done on each 1789.50s - 1795.40s | file by each user in the system. For CD file system this is not a problem because the 1795.40s - 1801.24s | content on a CD is supposed to be, is supposed to be immutable. So everyone has access to a 1801.24s - 1807.68s | file system. If you mount a drive, anyone, an admin, a regular user, anyone has access to the 1807.68s - 1814.48s | mounted


chunk_id: 194_chunk_30
chunk_text:
file 1754.62s - 1761.46s | system uh, is also uh, also apply, applies to optical disk as much as applies to ISO files. So 1761.46s - 1767.50s | ISO files are a beautiful implementation of this CDFS file system. Now just to give a bit of 1767.50s - 1772.94s | difference to the NTFS. Of course CDFS does not support reparse point, does not support a lot 1772.94s - 1777.28s | of things that are supported by NTFS, but also it has a completely different threat model. So 1777.28s - 1784.12s | NTFS supports rich permissions. So it has an AC, an ACL and the ACL is associated with 1784.12s - 1789.50s | different AC entries, access control entries which define what, what can be done on each 1789.50s - 1795.40s | file by each user in the system. For CD file system this is not a problem because the 1795.40s - 1801.24s | content on a CD is supposed to be, is supposed to be immutable. So everyone has access to a 1801.24s - 1807.68s | file system. If you mount a drive, anyone, an admin, a regular user, anyone has access to the 1807.68s - 1814.48s | mounted files, to the files on the mounted drive. And yeah, as I said before, the CDFS driver as 1817.32s - 1822.36s | much as NTFS driver communicates with the IO manager, the IO manager have a, the, has a 1822.36s - 1827.36s | request to access a file and after passing through the filter manager, it provides access to the 1828.02s - 1833.02s | required NTFS or CDFS driver um, accordingly to what is the device driver associated with the 1837.10s - 1844.10s | file object. Now when you load an ISO on Windows, what it, what it's, the CDFS driver will 1844.10s - 1849.10s | automatically load the content of this uh, ISO file using the CD common read. Now one thing 1852.10s - 1856.72s | that I want to stress out here is that an ISO file in comparison with a CD, with an optical 1856.72s - 1861.72s | CD, an ISO file uh, is mapped in uh, physical memory somewhere. So somewhere this ISO file is 1865.22s - 1870.22s | mapped in memory. Uh, so this creates some problems and we'll see what exactly. So when you 1872.36s - 1877.36s | try to access a file, what


chunk_id: 194_chunk_31
chunk_text:
files, to the files on the mounted drive. And yeah, as I said before, the CDFS driver as 1817.32s - 1822.36s | much as NTFS driver communicates with the IO manager, the IO manager have a, the, has a 1822.36s - 1827.36s | request to access a file and after passing through the filter manager, it provides access to the 1828.02s - 1833.02s | required NTFS or CDFS driver um, accordingly to what is the device driver associated with the 1837.10s - 1844.10s | file object. Now when you load an ISO on Windows, what it, what it's, the CDFS driver will 1844.10s - 1849.10s | automatically load the content of this uh, ISO file using the CD common read. Now one thing 1852.10s - 1856.72s | that I want to stress out here is that an ISO file in comparison with a CD, with an optical 1856.72s - 1861.72s | CD, an ISO file uh, is mapped in uh, physical memory somewhere. So somewhere this ISO file is 1865.22s - 1870.22s | mapped in memory. Uh, so this creates some problems and we'll see what exactly. So when you 1872.36s - 1877.36s | try to access a file, what you end up doing is you end up calling the NTCC copy read, copy read. 1877.52s - 1882.52s | Now this points to a file object, we will describe the file object and just exploring a bit with 1888.02s - 1894.16s | where this, where this file object were located, we started noticing that the physical address 1894.16s - 1900.20s | associated with this file object were always the same. So if you remap one of this file object in 1900.20s - 1905.20s | a read write page and you overwrite the content of this file object, the file object will be 1906.18s - 1911.18s | will flush the uh, content of the modified file back to the physical memory where the ISO was 1914.36s - 1919.36s | loaded. This means that it's not read only at all. And so we developed this IOCDFS lib that you 1922.84s - 1927.84s | can use to uh, just modify any content on any ISO file that was mounted in the system. Now I 1928.82s - 1933.82s | want to, I want to specify this doesn't work for CD, real CD drive. It just works for ISO files 1938.42s - 1943.42s | and


chunk_id: 194_chunk_32
chunk_text:
you end up doing is you end up calling the NTCC copy read, copy read. 1877.52s - 1882.52s | Now this points to a file object, we will describe the file object and just exploring a bit with 1888.02s - 1894.16s | where this, where this file object were located, we started noticing that the physical address 1894.16s - 1900.20s | associated with this file object were always the same. So if you remap one of this file object in 1900.20s - 1905.20s | a read write page and you overwrite the content of this file object, the file object will be 1906.18s - 1911.18s | will flush the uh, content of the modified file back to the physical memory where the ISO was 1914.36s - 1919.36s | loaded. This means that it's not read only at all. And so we developed this IOCDFS lib that you 1922.84s - 1927.84s | can use to uh, just modify any content on any ISO file that was mounted in the system. Now I 1928.82s - 1933.82s | want to, I want to specify this doesn't work for CD, real CD drive. It just works for ISO files 1938.42s - 1943.42s | and the reason is potentially that it's because they are mapped on physical memory when they are 1945.70s - 1950.70s | loaded the first time. Of course for caching. Indeed they are more uh, it's easier to get a file 1951.04s - 1956.04s | on, on an ISO in, in comparison with uh, with a CD. Now I'm not gonna go through this but there 1960.84s - 1967.08s | are some limitation on what you can change on the file. So if you overwrite over the file uh, 1967.08s - 1973.42s | sides uh, the real file sides, not the file sides on disk but the, the virtual sides, it's the 1973.42s - 1979.46s | change is not gonna, it's not gonna appear. So you can, you can, you can change less but you 1979.46s - 1985.82s | can change more. And if you write, you try to write over the file on, over the file sides on 1985.82s - 1992.80s | disk, you end up actually breaking some stuff. So your program will crash probably um, and 1992.80s - 1996.54s | you're gonna have problems. So these are the margin tolerance where, where, where you can 1996.54s - 2004.18s |


chunk_id: 194_chunk_33
chunk_text:
the reason is potentially that it's because they are mapped on physical memory when they are 1945.70s - 1950.70s | loaded the first time. Of course for caching. Indeed they are more uh, it's easier to get a file 1951.04s - 1956.04s | on, on an ISO in, in comparison with uh, with a CD. Now I'm not gonna go through this but there 1960.84s - 1967.08s | are some limitation on what you can change on the file. So if you overwrite over the file uh, 1967.08s - 1973.42s | sides uh, the real file sides, not the file sides on disk but the, the virtual sides, it's the 1973.42s - 1979.46s | change is not gonna, it's not gonna appear. So you can, you can, you can change less but you 1979.46s - 1985.82s | can change more. And if you write, you try to write over the file on, over the file sides on 1985.82s - 1992.80s | disk, you end up actually breaking some stuff. So your program will crash probably um, and 1992.80s - 1996.54s | you're gonna have problems. So these are the margin tolerance where, where, where you can 1996.54s - 2004.18s | actually replace the file. Now, but it, this is cool but it's abusable. Now yeah it's abusable, 2004.18s - 2008.92s | there are some use case scenario where we can actually abuse it uh, for a lot of different 2008.94s - 2015.22s | means. But one of the means is hide the fact that we have a driver on an ISO for example. We can 2015.22s - 2020.22s | load an encrypted blob on an ISO and then we can just modify it after the ISO was emulated. So 2024.56s - 2030.12s | we found another thing that we could abuse and this is um, I don't know how much it's, this is 2030.12s - 2035.14s | known but like if we have a file on disk and we try to link, we try to use the same name to, to 2035.16s - 2040.16s | create a link, of course the file is gonna say no, I'm not gonna use this name because it's 2044.14s - 2049.14s | already here. But for some reason if we specify the link name with a stream name associated to 2052.68s - 2057.68s | it, it will create a reparse point for the file.


chunk_id: 194_chunk_34
chunk_text:
actually replace the file. Now, but it, this is cool but it's abusable. Now yeah it's abusable, 2004.18s - 2008.92s | there are some use case scenario where we can actually abuse it uh, for a lot of different 2008.94s - 2015.22s | means. But one of the means is hide the fact that we have a driver on an ISO for example. We can 2015.22s - 2020.22s | load an encrypted blob on an ISO and then we can just modify it after the ISO was emulated. So 2024.56s - 2030.12s | we found another thing that we could abuse and this is um, I don't know how much it's, this is 2030.12s - 2035.14s | known but like if we have a file on disk and we try to link, we try to use the same name to, to 2035.16s - 2040.16s | create a link, of course the file is gonna say no, I'm not gonna use this name because it's 2044.14s - 2049.14s | already here. But for some reason if we specify the link name with a stream name associated to 2052.68s - 2057.68s | it, it will create a reparse point for the file. So this will create a reparse point for the 2057.68s - 2063.82s | file that will overshadow the data stream that is present on the file on disk. Now this means 2063.84s - 2069.28s | that at this, at this time after I created the reparse point, the file or and the the original 2069.28s - 2074.28s | file, the original ATXT is still there but it's not gonna be, no one is gonna be able to find it 2076.12s - 2081.12s | unless I delete the reparse point. And this is abusable. Why? Because well I can create an ISO 2084.56s - 2090.36s | and I can use this as trusted installer, I need to elevate my privilege as trusted installer and I 2090.38s - 2095.38s | can use this to redirect the, a file, a driver file on C, Windows system 32 to something that is 2100.02s - 2107.34s | on the ISO for example. But this has a problem, the driver, of course the driver file, the driver 2107.34s - 2113.68s | location, the image loaded is gonna be, is gonna show that I'm loading something bad. So I be a 2113.68s - 2118.68s | bit more


chunk_id: 194_chunk_35
chunk_text:
So this will create a reparse point for the 2057.68s - 2063.82s | file that will overshadow the data stream that is present on the file on disk. Now this means 2063.84s - 2069.28s | that at this, at this time after I created the reparse point, the file or and the the original 2069.28s - 2074.28s | file, the original ATXT is still there but it's not gonna be, no one is gonna be able to find it 2076.12s - 2081.12s | unless I delete the reparse point. And this is abusable. Why? Because well I can create an ISO 2084.56s - 2090.36s | and I can use this as trusted installer, I need to elevate my privilege as trusted installer and I 2090.38s - 2095.38s | can use this to redirect the, a file, a driver file on C, Windows system 32 to something that is 2100.02s - 2107.34s | on the ISO for example. But this has a problem, the driver, of course the driver file, the driver 2107.34s - 2113.68s | location, the image loaded is gonna be, is gonna show that I'm loading something bad. So I be a 2113.68s - 2118.68s | bit more smart, a bit smarter, I create another ISO and this point I will use a coherent 2122.46s - 2127.46s | directory structure. So now I, and I, I place W, of course I can place whatever driver I want here, 2129.70s - 2134.70s | here for example there is WinIO. And I do the same thing but still I have a problem because when I 2139.50s - 2145.44s | load the driver it still say okay this sounds correct but there is still, I mean it's still 2145.44s - 2150.84s | saying listen you are loading from an ISO file, you're not loading from the system blue 2150.84s - 2155.52s | directory, you're loading from just an external drive. You're trying to fool me, you didn't 2155.52s - 2163.48s | manage to though. Then uh this is just to show that the file is still there, so if I, if you 2163.48s - 2168.02s | delete the reparse point, the original file is still there. Okay just to, just to prove the 2168.02s - 2173.02s | point. But then we notice another thing, so a direct NTFS link is not enough to bypass to fool 2176.00s - 2180.70s | the,


chunk_id: 194_chunk_36
chunk_text:
smart, a bit smarter, I create another ISO and this point I will use a coherent 2122.46s - 2127.46s | directory structure. So now I, and I, I place W, of course I can place whatever driver I want here, 2129.70s - 2134.70s | here for example there is WinIO. And I do the same thing but still I have a problem because when I 2139.50s - 2145.44s | load the driver it still say okay this sounds correct but there is still, I mean it's still 2145.44s - 2150.84s | saying listen you are loading from an ISO file, you're not loading from the system blue 2150.84s - 2155.52s | directory, you're loading from just an external drive. You're trying to fool me, you didn't 2155.52s - 2163.48s | manage to though. Then uh this is just to show that the file is still there, so if I, if you 2163.48s - 2168.02s | delete the reparse point, the original file is still there. Okay just to, just to prove the 2168.02s - 2173.02s | point. But then we notice another thing, so a direct NTFS link is not enough to bypass to fool 2176.00s - 2180.70s | the, the load driver event. But then we notice another thing, if we go to the empty object 2180.74s - 2185.74s | manager we notice that every driver is actually loaded not using C Windows system 32 but is 2188.14s - 2193.14s | loaded using system root. System 32 driver and the name of the driver. What is this system 2195.42s - 2200.42s | 32? The system 32 is a symbolic link and not an, not an NTFS symbolic link, it's an NT 2202.56s - 2208.90s | symbolic link uh that is pointing to the device that I use for booting. In my case is device 2208.90s - 2213.90s | RDS volume 3. But it's pointed to by the boot device, right? But this means and if I inspect 2217.00s - 2223.18s | the boot device, I notice that I can actually delete this symlink. So this is actually a 2223.18s - 2229.92s | permanent symlink, meanings that it's been artificially created to have a ref count of 1. 2229.92s - 2236.42s | But I can make it, I can as system I can make it temporary, load like artificially lowering the 2236.44s - 2241.82s | ref count to 0 again


chunk_id: 194_chunk_37
chunk_text:
the load driver event. But then we notice another thing, if we go to the empty object 2180.74s - 2185.74s | manager we notice that every driver is actually loaded not using C Windows system 32 but is 2188.14s - 2193.14s | loaded using system root. System 32 driver and the name of the driver. What is this system 2195.42s - 2200.42s | 32? The system 32 is a symbolic link and not an, not an NTFS symbolic link, it's an NT 2202.56s - 2208.90s | symbolic link uh that is pointing to the device that I use for booting. In my case is device 2208.90s - 2213.90s | RDS volume 3. But it's pointed to by the boot device, right? But this means and if I inspect 2217.00s - 2223.18s | the boot device, I notice that I can actually delete this symlink. So this is actually a 2223.18s - 2229.92s | permanent symlink, meanings that it's been artificially created to have a ref count of 1. 2229.92s - 2236.42s | But I can make it, I can as system I can make it temporary, load like artificially lowering the 2236.44s - 2241.82s | ref count to 0 again and then I can delete it. So what can I, what can I do with this? I, I can 2241.82s - 2248.16s | obtain system privileges, I can back up the original boot device, I can replace the boot device 2248.16s - 2253.76s | symlink with the ISO and then I can restart the service and see what happens. And what happens 2253.76s - 2258.76s | is that it works. But the driver load event still shows that I'm loading from an ISO so still I 2259.76s - 2267.58s | wasn't able to fool it. And another problem is that if I inspect the driver in system 2272.72s - 2277.88s | informer or a similar tool, I've noticed that the driver is showing for example a missing 2277.88s - 2285.34s | description. It's showing stuff that indicates that I loaded a malicious, another driver. What 2285.34s - 2292.34s | if we swap the drive letters? What if I do a drive swap for this is something that nobody will 2292.34s - 2297.40s | ever think of doing and there is a reason for that. Because if you try to swap the drive 2297.40s - 2302.50s | letters, your program, your,


chunk_id: 194_chunk_38
chunk_text:
and then I can delete it. So what can I, what can I do with this? I, I can 2241.82s - 2248.16s | obtain system privileges, I can back up the original boot device, I can replace the boot device 2248.16s - 2253.76s | symlink with the ISO and then I can restart the service and see what happens. And what happens 2253.76s - 2258.76s | is that it works. But the driver load event still shows that I'm loading from an ISO so still I 2259.76s - 2267.58s | wasn't able to fool it. And another problem is that if I inspect the driver in system 2272.72s - 2277.88s | informer or a similar tool, I've noticed that the driver is showing for example a missing 2277.88s - 2285.34s | description. It's showing stuff that indicates that I loaded a malicious, another driver. What 2285.34s - 2292.34s | if we swap the drive letters? What if I do a drive swap for this is something that nobody will 2292.34s - 2297.40s | ever think of doing and there is a reason for that. Because if you try to swap the drive 2297.40s - 2302.50s | letters, your program, your, your system will probably crash at a certain point. There is 2302.50s - 2307.50s | nothing, but if you do it for just a second and you keep everything consistent so you don't just 2310.14s - 2316.78s | remove the letters, but you swap into other letters, it actually might work. So the, I'm not 2316.80s - 2321.86s | showing the screen shot because I'm showing you a video afterward but the, the technique is 2321.86s - 2328.54s | this. We mount an ISO with an encrypted blob, we just respect the directory structure, we 2328.54s - 2333.08s | change the boot device to CD-ROM, we swap drive letters, we load the driver, we restore 2333.08s - 2337.98s | immediately the drive letters, we restore the boot device and then we can at, at that point we 2337.98s - 2346.74s | can use, we can abuse the driver that has loaded the memory even if we unmount the ISO file. 2346.74s - 2352.76s | Now what about using other techniques? Well I, I can use other techniques uh to, to load the 2352.76s - 2359.12s | malicious driver uh but in this case for example I can use uh all


chunk_id: 194_chunk_39
chunk_text:
your system will probably crash at a certain point. There is 2302.50s - 2307.50s | nothing, but if you do it for just a second and you keep everything consistent so you don't just 2310.14s - 2316.78s | remove the letters, but you swap into other letters, it actually might work. So the, I'm not 2316.80s - 2321.86s | showing the screen shot because I'm showing you a video afterward but the, the technique is 2321.86s - 2328.54s | this. We mount an ISO with an encrypted blob, we just respect the directory structure, we 2328.54s - 2333.08s | change the boot device to CD-ROM, we swap drive letters, we load the driver, we restore 2333.08s - 2337.98s | immediately the drive letters, we restore the boot device and then we can at, at that point we 2337.98s - 2346.74s | can use, we can abuse the driver that has loaded the memory even if we unmount the ISO file. 2346.74s - 2352.76s | Now what about using other techniques? Well I, I can use other techniques uh to, to load the 2352.76s - 2359.12s | malicious driver uh but in this case for example I can use uh all the partition that is 2359.12s - 2364.14s | assigned to the transactional file system. It's not supposed to be accessible by any user, it's 2366.60s - 2373.10s | not supposed to be writable, but we discovered that if you access this kind of location with 2373.10s - 2378.64s | the additional, with, with the, with the, with the required permissions, in this case backup 2378.64s - 2385.98s | intent, say restore, say backup privilege, a maximum file, maximum allowed as uh, as um, as 2385.98s - 2391.22s | access right, you can actually override this. You can actually access these locations and you 2391.22s - 2396.56s | can actually write files on them. So and this is a proof of course where I actually am 2396.56s - 2403.54s | writing, I'm writing on uh the transactional file system uh locations. Is there any benefit? I 2403.54s - 2409.54s | don't see any benefit in doing it. Uh it can just give you an additional way of exploiting the 2409.54s - 2414.54s | same vulnerability in, in other ways, not using an ISO. So let's demo it. So Windows 11, HVCI is 2417.62s - 2422.62s | enabled. Uh I have a


chunk_id: 194_chunk_40
chunk_text:
the partition that is 2359.12s - 2364.14s | assigned to the transactional file system. It's not supposed to be accessible by any user, it's 2366.60s - 2373.10s | not supposed to be writable, but we discovered that if you access this kind of location with 2373.10s - 2378.64s | the additional, with, with the, with the, with the required permissions, in this case backup 2378.64s - 2385.98s | intent, say restore, say backup privilege, a maximum file, maximum allowed as uh, as um, as 2385.98s - 2391.22s | access right, you can actually override this. You can actually access these locations and you 2391.22s - 2396.56s | can actually write files on them. So and this is a proof of course where I actually am 2396.56s - 2403.54s | writing, I'm writing on uh the transactional file system uh locations. Is there any benefit? I 2403.54s - 2409.54s | don't see any benefit in doing it. Uh it can just give you an additional way of exploiting the 2409.54s - 2414.54s | same vulnerability in, in other ways, not using an ISO. So let's demo it. So Windows 11, HVCI is 2417.62s - 2422.62s | enabled. Uh I have a simple load of a driver and I hope uh, I hope it actually, because this 2430.41s - 2435.41s | doesn't actually, oops. Oops. I did a mistake. Okay. So it doesn't show, I don't know how to 2440.79s - 2449.89s | make play. Like it doesn't show the right, uh huh. Okay. Now it seems it works. Yeah. So okay, 2456.19s - 2461.19s | here we are seeing that we are targeting the AALP SSI GPO is uh an Intel driver and we are 2462.19s - 2467.19s | loading our driver, we are switching everything and we're loading the driver. Now the driver has 2469.29s - 2474.79s | been loaded, the name is that and if you can see, honestly I would, I would challenge to spot 2474.79s - 2480.51s | the difference. The description is the right one but and if you try to point to the what, what 2480.51s - 2485.51s | file was loaded, it will actually open the right directory but indeed we loaded another. You 2486.51s - 2491.51s | can, you can actually spot it from the sides. From the sides. It's 28 kilobyte which is the 2495.41s - 2503.34s | sides of WinIO. And


chunk_id: 194_chunk_41
chunk_text:
simple load of a driver and I hope uh, I hope it actually, because this 2430.41s - 2435.41s | doesn't actually, oops. Oops. I did a mistake. Okay. So it doesn't show, I don't know how to 2440.79s - 2449.89s | make play. Like it doesn't show the right, uh huh. Okay. Now it seems it works. Yeah. So okay, 2456.19s - 2461.19s | here we are seeing that we are targeting the AALP SSI GPO is uh an Intel driver and we are 2462.19s - 2467.19s | loading our driver, we are switching everything and we're loading the driver. Now the driver has 2469.29s - 2474.79s | been loaded, the name is that and if you can see, honestly I would, I would challenge to spot 2474.79s - 2480.51s | the difference. The description is the right one but and if you try to point to the what, what 2480.51s - 2485.51s | file was loaded, it will actually open the right directory but indeed we loaded another. You 2486.51s - 2491.51s | can, you can actually spot it from the sides. From the sides. It's 28 kilobyte which is the 2495.41s - 2503.34s | sides of WinIO. And you can see also from the hash, that is the same hash of WinIO which is a 2503.34s - 2508.24s | vulnerable driver that is not currently blocked by Microsoft block list. We can do another 2508.24s - 2516.45s | attempt, this time on Windows, I don't know if there is anything I'm showing. Yeah. I'm, I'm 2516.47s - 2521.47s | proving that is WinIO here. So you will see that there is the WinIO handle uh showing up in 2523.51s - 2530.08s | devices and when I will get there, bit of fate. So we have WinIO loaded. Now when I unload the 2536.92s - 2543.46s | driver that is not unloadable usually, WinIO disappears. So it was WinIO all along. But it 2544.38s - 2549.38s | doesn't show up anywhere practically and we fooled the driver loader into thinking that we 2554.26s - 2559.26s | actually loaded a driver on C Windows system 32 as, as, as it was normal. Now on Windows 2563.50s - 2568.50s | 10 or when HDCI is not enabled, we can just strictly integrate it with KDU for example. Same 2569.38s - 2574.38s | technique, same driver as base uh for exploitation. I


chunk_id: 194_chunk_42
chunk_text:
you can see also from the hash, that is the same hash of WinIO which is a 2503.34s - 2508.24s | vulnerable driver that is not currently blocked by Microsoft block list. We can do another 2508.24s - 2516.45s | attempt, this time on Windows, I don't know if there is anything I'm showing. Yeah. I'm, I'm 2516.47s - 2521.47s | proving that is WinIO here. So you will see that there is the WinIO handle uh showing up in 2523.51s - 2530.08s | devices and when I will get there, bit of fate. So we have WinIO loaded. Now when I unload the 2536.92s - 2543.46s | driver that is not unloadable usually, WinIO disappears. So it was WinIO all along. But it 2544.38s - 2549.38s | doesn't show up anywhere practically and we fooled the driver loader into thinking that we 2554.26s - 2559.26s | actually loaded a driver on C Windows system 32 as, as, as it was normal. Now on Windows 2563.50s - 2568.50s | 10 or when HDCI is not enabled, we can just strictly integrate it with KDU for example. Same 2569.38s - 2574.38s | technique, same driver as base uh for exploitation. I still need to, no. Come on. Yes. So 2587.01s - 2592.01s | still driver jack is executing, arrives. It overwrites the content in memory because the driver 2594.15s - 2599.15s | is encrypted as I said on the ISO. And then it just loads the drive and straight executes 2602.09s - 2606.53s | KDU. The vulnerable driver was already loaded because we loaded to the driver, with the 2606.53s - 2611.53s | driver jack technique. The name is WinIO and we can execute our unsigned code on Windows. Now 2615.14s - 2620.94s | of course if you want to execute with HVCI enabled, you need to use one of the other thing that 2620.94s - 2625.94s | I showed before. Candleforge, uh Malk, or unless if, if, or, or you can use, or you can just 2626.94s - 2631.94s | disable HVCI all together. So the full chain that we used was we weaponized the step 7 2636.98s - 2641.98s | installation media. Um in, in this way initially we used that child process immediately because as 2644.02s - 2649.02s | I said uh the set up of the step 7 installation media uses multiple process to install. So we


chunk_id: 194_chunk_43
chunk_text:
still need to, no. Come on. Yes. So 2587.01s - 2592.01s | still driver jack is executing, arrives. It overwrites the content in memory because the driver 2594.15s - 2599.15s | is encrypted as I said on the ISO. And then it just loads the drive and straight executes 2602.09s - 2606.53s | KDU. The vulnerable driver was already loaded because we loaded to the driver, with the 2606.53s - 2611.53s | driver jack technique. The name is WinIO and we can execute our unsigned code on Windows. Now 2615.14s - 2620.94s | of course if you want to execute with HVCI enabled, you need to use one of the other thing that 2620.94s - 2625.94s | I showed before. Candleforge, uh Malk, or unless if, if, or, or you can use, or you can just 2626.94s - 2631.94s | disable HVCI all together. So the full chain that we used was we weaponized the step 7 2636.98s - 2641.98s | installation media. Um in, in this way initially we used that child process immediately because as 2644.02s - 2649.02s | I said uh the set up of the step 7 installation media uses multiple process to install. So we 2649.02s - 2654.02s | could blend in with an additional process. We rewrite and execute an additional file so we, 2658.82s - 2665.06s | there was no malware on the ISO except of a minimal DLL use for site loading. And then what we 2665.06s - 2671.40s | do is we use driver jack, we, we execute uh we install the full candle rootkit. Uh we were 2671.40s - 2677.44s | targeting Windows 10. HVCI was not a problem in this case. And, and then we just keep going 2677.44s - 2682.44s | with additional, with additional compromise step. So portability, we have integration with 2684.84s - 2689.84s | KDU uh if HVCI is disabled. If it's enabled and you have uh inter-K chat not supported you can 2692.14s - 2697.14s | use Candleforge as I said. If it's um, if HVCI is HVCI is HVC- oh my gosh. If, if hypervisor 2702.26s - 2707.42s | protected code, enforced code, code integrity is enabled and you don't have Intel VT 2707.44s - 2712.44s | but you have inter-K chat can use mark. Otherwise, well, the, the best chance so far uh is to 2714.64s - 2719.64s | just uh disable


chunk_id: 194_chunk_44
chunk_text:
2649.02s - 2654.02s | could blend in with an additional process. We rewrite and execute an additional file so we, 2658.82s - 2665.06s | there was no malware on the ISO except of a minimal DLL use for site loading. And then what we 2665.06s - 2671.40s | do is we use driver jack, we, we execute uh we install the full candle rootkit. Uh we were 2671.40s - 2677.44s | targeting Windows 10. HVCI was not a problem in this case. And, and then we just keep going 2677.44s - 2682.44s | with additional, with additional compromise step. So portability, we have integration with 2684.84s - 2689.84s | KDU uh if HVCI is disabled. If it's enabled and you have uh inter-K chat not supported you can 2692.14s - 2697.14s | use Candleforge as I said. If it's um, if HVCI is HVCI is HVC- oh my gosh. If, if hypervisor 2702.26s - 2707.42s | protected code, enforced code, code integrity is enabled and you don't have Intel VT 2707.44s - 2712.44s | but you have inter-K chat can use mark. Otherwise, well, the, the best chance so far uh is to 2714.64s - 2719.64s | just uh disable code integrity and ask for a reboot. Um because there is no currently, there is 2722.98s - 2728.72s | not currently a technique. As I said, I, I mistakenly believe that you could actually abuse 2728.72s - 2734.96s | large pages for it. I'm still trying to check it if, if it's possible but it doesn't look like 2735.00s - 2740.00s | it's working fine. And as key takeaways, I mean you can download the box uh the the for 2742.84s - 2747.84s | driver jack is, is already, is already public. You can, you can go and take a look. Um for like 2750.38s - 2756.88s | detection, as detection advice, I would always try to detect if uh someone is escalating 2756.88s - 2762.26s | privileges to system or trusted installer using no means. Uh monitor for drive letter change 2762.30s - 2767.30s | to just prevent this trick from uh bypassing detection. Uh of course monitor for changes in 2770.20s - 2775.80s | the anti-object manager especially for global links. Uh keep your hardware up to date is very 2775.80s - 2781.94s | important because as, as we've seen, the more we go to modern CPUs et


chunk_id: 194_chunk_45
chunk_text:
code integrity and ask for a reboot. Um because there is no currently, there is 2722.98s - 2728.72s | not currently a technique. As I said, I, I mistakenly believe that you could actually abuse 2728.72s - 2734.96s | large pages for it. I'm still trying to check it if, if it's possible but it doesn't look like 2735.00s - 2740.00s | it's working fine. And as key takeaways, I mean you can download the box uh the the for 2742.84s - 2747.84s | driver jack is, is already, is already public. You can, you can go and take a look. Um for like 2750.38s - 2756.88s | detection, as detection advice, I would always try to detect if uh someone is escalating 2756.88s - 2762.26s | privileges to system or trusted installer using no means. Uh monitor for drive letter change 2762.30s - 2767.30s | to just prevent this trick from uh bypassing detection. Uh of course monitor for changes in 2770.20s - 2775.80s | the anti-object manager especially for global links. Uh keep your hardware up to date is very 2775.80s - 2781.94s | important because as, as we've seen, the more we go to modern CPUs et cetera, the, the more 2781.94s - 2788.52s | difficulties to exploit this kind of bugs. And then, and then there is the one of the detection 2788.52s - 2794.08s | opportunity which is the probably best is when there is a drove, a driver load event, implement 2794.08s - 2799.36s | an hash cross check. So there is an hash present on the driver load event. The only thing you 2799.36s - 2805.10s | need to do is going on the file list, on the file path that is was, that was loaded, perform 2805.10s - 2810.94s | like calculate the check at run time and then compare the, the hashes. The hashes is are not 2810.94s - 2816.68s | possible to fool. So uh if the hashes are not matching it means that something happened that 2816.70s - 2821.70s | was bad. So another driver was loaded in place of the original one. And that's it. Thanks a 2824.28s - 2825.78s | lot for, for coming.


chunk_id: 194_chunk_46
chunk_text:
cetera, the, the more 2781.94s - 2788.52s | difficulties to exploit this kind of bugs. And then, and then there is the one of the detection 2788.52s - 2794.08s | opportunity which is the probably best is when there is a drove, a driver load event, implement 2794.08s - 2799.36s | an hash cross check. So there is an hash present on the driver load event. The only thing you 2799.36s - 2805.10s | need to do is going on the file list, on the file path that is was, that was loaded, perform 2805.10s - 2810.94s | like calculate the check at run time and then compare the, the hashes. The hashes is are not 2810.94s - 2816.68s | possible to fool. So uh if the hashes are not matching it means that something happened that 2816.70s - 2821.70s | was bad. So another driver was loaded in place of the original one. And that's it. Thanks a 2824.28s - 2825.78s | lot for, for coming.


chunk_id: 195_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=edM1SvSz6pc", "title": "DEF CON 32 - If Existing Cyber Vulns Magically Disappeared, What Next - Dr Stefanie Tompkins", "description": "The DEF CON community challenges the status quo, bringing a diversity of perspectives and ideas to identify hidden problems and solutions. While DARPA lays claim to the origin of the ARPANET/internet, vast communities of people with different interests created its novel components. The DARPA Cyber Grand Challenge helped launch the field of vulnerability detection and remediation and numerous DARPA Cyber Fast Track program performers continue to contribute to DEF CON.\n\nWhat if current vulnerabilities all magically disappeared overnight and critical infrastructure were \u201csafe and secure\u201d for the time being. What would come next?\n\nIn this talk, Dr. Stefanie Tompkins will discuss the value of the hacker community and many of the contributions that have come from it, as well as the growth and synergy of the two communities. She\u2019ll also explore the question of what comes next.\n\nFor a deeper dive into the real-world impacts of DARPA cyber technologies, Dr. Renee Wegrzyn, the inaugural director of the Advanced Research Projects Agency for Health (ARPA-H), will join Stefanie and a moderator. They will discuss efforts that impact DEF CON areas of interest and inform ARPA-H work, from Cyber Fast Track to current work focused on securing and defending hospitals and the health tech ecosystem from cyberattacks.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2687, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 1.55s - 28.35s | This text was transcribed using whisper model: large-v2 twenty seconds. So, my name's Stephanie Tompkins. I'm the director of a little organization 28.35s - 32.95s | called DARPA. That stands for Defense Advanced Research Projects Agency. I'm really thrilled 32.95s - 37.19s | to be here talking to you today. Uh, what I want to do is talk to you about what keeps 37.19s - 43.17s | me up at night. So, when I talk to people about DARPA, it turns out most of them know, 43.17s - 47.31s | if they've ever heard of us at all, most of them know what we're famous for. Um, that 47.31s - 54.55s | would be things like, uh, the internet. Uh, stealth technology. Um, maybe a little more 54.55s - 60.47s | obscure, but the actual creation of material science as an academic discipline, from which 60.47s - 65.47s | things like semiconductors and alloys and things like that all sort of arose.


chunk_id: 195_chunk_1
chunk_text:
inform ARPA-H work, from Cyber Fast Track to current work focused on securing and defending hospitals and the health tech ecosystem from cyberattacks.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2687, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 1.55s - 28.35s | This text was transcribed using whisper model: large-v2 twenty seconds. So, my name's Stephanie Tompkins. I'm the director of a little organization 28.35s - 32.95s | called DARPA. That stands for Defense Advanced Research Projects Agency. I'm really thrilled 32.95s - 37.19s | to be here talking to you today. Uh, what I want to do is talk to you about what keeps 37.19s - 43.17s | me up at night. So, when I talk to people about DARPA, it turns out most of them know, 43.17s - 47.31s | if they've ever heard of us at all, most of them know what we're famous for. Um, that 47.31s - 54.55s | would be things like, uh, the internet. Uh, stealth technology. Um, maybe a little more 54.55s - 60.47s | obscure, but the actual creation of material science as an academic discipline, from which 60.47s - 65.47s | things like semiconductors and alloys and things like that all sort of arose. So, lots 65.47s - 71.35s | of really big things. Um, they're also super aware that, um, the first word in DARPA is 71.35s - 75.19s | defense, right? So, we work for the Department of Defense. We spend a lot of time thinking 75.23s - 81.27s | about national security. So, when people ask me, uh, what keeps me up at night, I'm pretty 81.27s - 87.91s | sure they're expecting one of two things. A huge military risk area, and, and there are 87.91s - 92.05s | certainly plenty of them. I think you've heard a number of them already today. Um, or some 92.05s - 100.03s | really massive technological gap. Truthfully, what keeps me up at night the most is the 100.03s - 105.77s | fact that there are probably amazing national security ideas out there that we are just 105.77s - 111.81s | not hearing. Because the way DARPA works, our ideas are coming in at us and we are 111.81s - 116.75s | trying things from sort of a bottoms-up process over and over and over again, missing the 116.75s - 123.43s | idea that is going to change the world. That's terrifying. So,


chunk_id: 195_chunk_2
chunk_text:
So, lots 65.47s - 71.35s | of really big things. Um, they're also super aware that, um, the first word in DARPA is 71.35s - 75.19s | defense, right? So, we work for the Department of Defense. We spend a lot of time thinking 75.23s - 81.27s | about national security. So, when people ask me, uh, what keeps me up at night, I'm pretty 81.27s - 87.91s | sure they're expecting one of two things. A huge military risk area, and, and there are 87.91s - 92.05s | certainly plenty of them. I think you've heard a number of them already today. Um, or some 92.05s - 100.03s | really massive technological gap. Truthfully, what keeps me up at night the most is the 100.03s - 105.77s | fact that there are probably amazing national security ideas out there that we are just 105.77s - 111.81s | not hearing. Because the way DARPA works, our ideas are coming in at us and we are 111.81s - 116.75s | trying things from sort of a bottoms-up process over and over and over again, missing the 116.75s - 123.43s | idea that is going to change the world. That's terrifying. So, um, you know, one thing I 123.43s - 128.17s | know is that there are many, many communities out there, uh, across the country, across 128.17s - 134.53s | this world, um, that have amazing ideas, extraordinary expertise, and an in-depth way at 134.53s - 140.83s | looking at problems that collectively we at DARPA just might not be, uh, um, aware of. And 140.83s - 145.37s | I should say, you know, so we understand there's some barriers to entry to that. I'm going 145.37s - 149.17s | to talk about that. But I, I think it's actually worth pointing out that this particular 149.17s - 153.79s | community and DARPA, um, have quite a history of working together. Um, probably more than 153.79s - 160.63s | most people realize. So, um, take the internet. I talked about DARPA in the internet. The 160.63s - 167.13s | truth is what DARPA actually did was we created something called, uh, the ARPANET. And it's 167.13s - 172.77s | in no small part this community that helped graduate the ARPANET into the internet, um, 172.77s - 178.97s | that we know and love or don't love on any given day, um,


chunk_id: 195_chunk_3
chunk_text:
um, you know, one thing I 123.43s - 128.17s | know is that there are many, many communities out there, uh, across the country, across 128.17s - 134.53s | this world, um, that have amazing ideas, extraordinary expertise, and an in-depth way at 134.53s - 140.83s | looking at problems that collectively we at DARPA just might not be, uh, um, aware of. And 140.83s - 145.37s | I should say, you know, so we understand there's some barriers to entry to that. I'm going 145.37s - 149.17s | to talk about that. But I, I think it's actually worth pointing out that this particular 149.17s - 153.79s | community and DARPA, um, have quite a history of working together. Um, probably more than 153.79s - 160.63s | most people realize. So, um, take the internet. I talked about DARPA in the internet. The 160.63s - 167.13s | truth is what DARPA actually did was we created something called, uh, the ARPANET. And it's 167.13s - 172.77s | in no small part this community that helped graduate the ARPANET into the internet, um, 172.77s - 178.97s | that we know and love or don't love on any given day, um, uh, today. So the original 178.97s - 185.43s | ARPANET, uh, think about this. It was basically designed so that one specialized computer 185.43s - 189.97s | could talk to another specialized computer in a different part of the country. Uh, remember 189.97s - 194.01s | back then computers were the size of refrigerators or entire rooms and they cost a whole lot 194.01s - 198.85s | of money. So it didn't make a lot of sense to be redundant, um, with everybody having 198.85s - 203.73s | the same capabilities. And the original ARPANET was also really focused on being able to, 203.73s - 209.09s | uh, be resistant to disruptions. Uh, and so that led to things like packet switching. 209.09s - 214.61s | So TCPIP, um, which was a huge radical change from this sort of circuit based technology 214.65s - 219.81s | that were running communications back then, think, uh, you know, basically telephone calls. 219.81s - 225.45s | Oh, and by the way, I should mention, the very first thing typed into the ARPANET was 225.45s - 232.33s | meant to be login. They got L, they got O, and then the system crashed. Just


chunk_id: 195_chunk_4
chunk_text:
uh, today. So the original 178.97s - 185.43s | ARPANET, uh, think about this. It was basically designed so that one specialized computer 185.43s - 189.97s | could talk to another specialized computer in a different part of the country. Uh, remember 189.97s - 194.01s | back then computers were the size of refrigerators or entire rooms and they cost a whole lot 194.01s - 198.85s | of money. So it didn't make a lot of sense to be redundant, um, with everybody having 198.85s - 203.73s | the same capabilities. And the original ARPANET was also really focused on being able to, 203.73s - 209.09s | uh, be resistant to disruptions. Uh, and so that led to things like packet switching. 209.09s - 214.61s | So TCPIP, um, which was a huge radical change from this sort of circuit based technology 214.65s - 219.81s | that were running communications back then, think, uh, you know, basically telephone calls. 219.81s - 225.45s | Oh, and by the way, I should mention, the very first thing typed into the ARPANET was 225.45s - 232.33s | meant to be login. They got L, they got O, and then the system crashed. Just remember 232.33s - 237.13s | that because I'm going to come back to that part later. Um, but no, so thinking about 237.13s - 242.17s | the transformation of the ARPANET into the internet, it was a lot of poking and prodding 242.17s - 246.89s | at strengths and weaknesses, um, in the system, identification of vulnerabilities, coming 246.89s - 252.05s | up with, uh, solutions, improvements, all of that from, you know, communities like this 252.05s - 258.97s | one, but this one in particularly, which ultimately led to, um, the transformation into the internet 258.97s - 263.49s | and into something which I think most of us will agree fundamentally changed how this 263.49s - 270.33s | world, our entire world works, um, lives and communicates. Now that type of transformation 270.33s - 277.29s | is what DARPA is all about. We're focused on making really big bets, um, on high risk, 277.29s - 281.69s | you know, new technologies, things that we think are fundamentally going to be revolutionary 281.69s - 286.61s | and disruptive and game changing, right? Those are all overused words, but they are words 286.61s - 291.01s | that we live and breathe


chunk_id: 195_chunk_5
chunk_text:
remember 232.33s - 237.13s | that because I'm going to come back to that part later. Um, but no, so thinking about 237.13s - 242.17s | the transformation of the ARPANET into the internet, it was a lot of poking and prodding 242.17s - 246.89s | at strengths and weaknesses, um, in the system, identification of vulnerabilities, coming 246.89s - 252.05s | up with, uh, solutions, improvements, all of that from, you know, communities like this 252.05s - 258.97s | one, but this one in particularly, which ultimately led to, um, the transformation into the internet 258.97s - 263.49s | and into something which I think most of us will agree fundamentally changed how this 263.49s - 270.33s | world, our entire world works, um, lives and communicates. Now that type of transformation 270.33s - 277.29s | is what DARPA is all about. We're focused on making really big bets, um, on high risk, 277.29s - 281.69s | you know, new technologies, things that we think are fundamentally going to be revolutionary 281.69s - 286.61s | and disruptive and game changing, right? Those are all overused words, but they are words 286.61s - 291.01s | that we live and breathe and we actually mean them when we talk about that. So DARPA, it's 291.01s - 296.33s | not about making something 5% better or 10% better or even 50% better. It's about making 296.33s - 300.81s | it 5,000 times better or it's about saying the thing that we want to make better. We're 300.81s - 304.13s | just going to get rid of it altogether and we're going to move to an entirely different 304.13s - 308.21s | solution space. Maybe we're going to create new problems, but we're essentially moving 308.21s - 314.41s | entirely out of the domain of the problem that might feel too hard to solve. Now, um, 314.41s - 320.25s | I should point out that sometimes the timing isn't right or sometimes we were just wrong 320.25s - 325.77s | or we failed. We set these massive audacious goals and we didn't meet them. The truth is 325.77s - 331.01s | that should happen a lot because if we're succeeding at all our goals, it means we are 331.01s - 336.05s | not doing our job. Um, and we are not taking the big risks, which is what we have actually 336.05s -


chunk_id: 195_chunk_6
chunk_text:
and we actually mean them when we talk about that. So DARPA, it's 291.01s - 296.33s | not about making something 5% better or 10% better or even 50% better. It's about making 296.33s - 300.81s | it 5,000 times better or it's about saying the thing that we want to make better. We're 300.81s - 304.13s | just going to get rid of it altogether and we're going to move to an entirely different 304.13s - 308.21s | solution space. Maybe we're going to create new problems, but we're essentially moving 308.21s - 314.41s | entirely out of the domain of the problem that might feel too hard to solve. Now, um, 314.41s - 320.25s | I should point out that sometimes the timing isn't right or sometimes we were just wrong 320.25s - 325.77s | or we failed. We set these massive audacious goals and we didn't meet them. The truth is 325.77s - 331.01s | that should happen a lot because if we're succeeding at all our goals, it means we are 331.01s - 336.05s | not doing our job. Um, and we are not taking the big risks, which is what we have actually 336.05s - 341.49s | been chartered to do. And for what it's worth, um, sometimes we learn a lot more from our 341.49s - 345.69s | failures or as much from our failures as we do from our successes. And so we celebrate 345.69s - 350.37s | our failures. Um, but when we do succeed, our belief is that those successes should 350.37s - 355.41s | be fundamentally changing the world. And one of the things I actually find amazing is when 355.41s - 360.21s | we look back on those things where we were successful as the movement from this is utterly 360.21s - 369.41s | impossible to, okay, maybe, but probably not to, well, of course it's inevitable. And how 369.41s - 375.49s | did we can't even imagine what life was like before. So I'll give you a few, um, a few 375.49s - 383.45s | additional examples, uh, miniaturized, uh, GPS. So every time you use a GPS enabled device, 383.45s - 391.57s | that was DARPA, uh, graphical user interfaces, DARPA, uh, the mouse, who knew the mouse would 391.57s - 398.21s | become so ubiquitous, or maybe you don't use a mouse, but you use a


chunk_id: 195_chunk_7
chunk_text:
341.49s | been chartered to do. And for what it's worth, um, sometimes we learn a lot more from our 341.49s - 345.69s | failures or as much from our failures as we do from our successes. And so we celebrate 345.69s - 350.37s | our failures. Um, but when we do succeed, our belief is that those successes should 350.37s - 355.41s | be fundamentally changing the world. And one of the things I actually find amazing is when 355.41s - 360.21s | we look back on those things where we were successful as the movement from this is utterly 360.21s - 369.41s | impossible to, okay, maybe, but probably not to, well, of course it's inevitable. And how 369.41s - 375.49s | did we can't even imagine what life was like before. So I'll give you a few, um, a few 375.49s - 383.45s | additional examples, uh, miniaturized, uh, GPS. So every time you use a GPS enabled device, 383.45s - 391.57s | that was DARPA, uh, graphical user interfaces, DARPA, uh, the mouse, who knew the mouse would 391.57s - 398.21s | become so ubiquitous, or maybe you don't use a mouse, but you use a touchscreen, both DARPA 398.21s - 403.69s | voice recognition and Siri in particular, love it or hate it. We will accept responsibility. 403.69s - 411.23s | Um, accelerometers, the wireless capabilities at the core of today's smartphones and tablets. 411.23s - 419.27s | We kicked off the self-driving car industry, brain machine interfaces. So, um, those are 419.27s - 423.71s | the, the, all things that link back to major DARPA investments. And a lot of those are 423.71s - 428.87s | things that you have probably heard about. Um, what might be a little less well known 428.87s - 432.99s | are the more recent interactions that we have had with this community in particular. So 432.99s - 438.91s | I'm going to ask for a show of hands. How many of you have used Nmap? Okay. That's a 438.91s - 443.79s | lot of hands. Right. So DARPA was actually instrumental there. Um, exploring ways to 443.79s - 450.23s | map and learn from an environment containing 4 billion IP addresses to one of 340 trillion, 450.23s - 460.87s | so IPv4 to IPv6. How about HackRF? Right? Okay, so the creation of a $340 transmit and 460.87s


chunk_id: 195_chunk_8
chunk_text:
touchscreen, both DARPA 398.21s - 403.69s | voice recognition and Siri in particular, love it or hate it. We will accept responsibility. 403.69s - 411.23s | Um, accelerometers, the wireless capabilities at the core of today's smartphones and tablets. 411.23s - 419.27s | We kicked off the self-driving car industry, brain machine interfaces. So, um, those are 419.27s - 423.71s | the, the, all things that link back to major DARPA investments. And a lot of those are 423.71s - 428.87s | things that you have probably heard about. Um, what might be a little less well known 428.87s - 432.99s | are the more recent interactions that we have had with this community in particular. So 432.99s - 438.91s | I'm going to ask for a show of hands. How many of you have used Nmap? Okay. That's a 438.91s - 443.79s | lot of hands. Right. So DARPA was actually instrumental there. Um, exploring ways to 443.79s - 450.23s | map and learn from an environment containing 4 billion IP addresses to one of 340 trillion, 450.23s - 460.87s | so IPv4 to IPv6. How about HackRF? Right? Okay, so the creation of a $340 transmit and 460.87s - 465.71s | receive software defined radio, um, completely lowering the barrier to entry for hackers 465.75s - 471.31s | and being really transformative in how we interact, um, with spectrum. Um, how about 471.31s - 477.71s | Onion Routing? Uh, the underpinnings of Tor. Onion Routing was developed actually by the 477.71s - 482.55s | Navy, but as part of a DARPA program. And the team then decided to release that tech, 482.55s - 487.27s | that technology open source. Um, it's now used by millions of people every day, helping 487.27s - 492.67s | to give people a voice all around the world. Or how about that, uh, car hacking? The one 492.67s - 496.57s | that made the news a few years back? Maybe more than a few years back. I'm, I'm feeling my 496.57s - 500.41s | age. Uh, but remember when Charlie Miller and Chris Vlachek demonstrated they could 500.41s - 504.81s | remotely hack a car while the reporter was still inside? Yeah, that was DARPA and that 504.81s - 509.81s | freaked a lot of people out. And now automobile companies have entire teams dedicated to 509.81s - 514.49s | worrying about things


chunk_id: 195_chunk_9
chunk_text:
- 465.71s | receive software defined radio, um, completely lowering the barrier to entry for hackers 465.75s - 471.31s | and being really transformative in how we interact, um, with spectrum. Um, how about 471.31s - 477.71s | Onion Routing? Uh, the underpinnings of Tor. Onion Routing was developed actually by the 477.71s - 482.55s | Navy, but as part of a DARPA program. And the team then decided to release that tech, 482.55s - 487.27s | that technology open source. Um, it's now used by millions of people every day, helping 487.27s - 492.67s | to give people a voice all around the world. Or how about that, uh, car hacking? The one 492.67s - 496.57s | that made the news a few years back? Maybe more than a few years back. I'm, I'm feeling my 496.57s - 500.41s | age. Uh, but remember when Charlie Miller and Chris Vlachek demonstrated they could 500.41s - 504.81s | remotely hack a car while the reporter was still inside? Yeah, that was DARPA and that 504.81s - 509.81s | freaked a lot of people out. And now automobile companies have entire teams dedicated to 509.81s - 514.49s | worrying about things like that. Now if you actually just look at DEF CON alone, between 514.49s - 520.13s | 2011 and 2014, about 10% of all of the talks could be traced back to just one DARPA 520.15s - 526.65s | program. Cyber Fast Track, what we call CFT. So I think it's no surprise when you hear that 526.65s - 532.13s | history to think that we believe we absolutely need to continue to work with you, um, and 532.13s - 537.97s | hear from you. It's why I'm here. So, uh, I'm gonna go back to those very first couple 537.97s - 544.41s | letters typed into the internet, right? So L-O crash. Um, it was a memory corruption. Same 544.41s - 548.81s | old software defect that we have been repeatedly living with. Um, why are so many of the 548.83s - 552.83s | security vulnerabilities still found around today? Um, really just variations on the same 552.83s - 559.21s | theme, themes. Uh, I mean code and data corruption, buffer overflows and memory manipulation, 559.21s - 563.61s | command interjections when, uh, user input is treated as a command, um, instead of 563.61s - 568.31s | information. And


chunk_id: 195_chunk_10
chunk_text:
like that. Now if you actually just look at DEF CON alone, between 514.49s - 520.13s | 2011 and 2014, about 10% of all of the talks could be traced back to just one DARPA 520.15s - 526.65s | program. Cyber Fast Track, what we call CFT. So I think it's no surprise when you hear that 526.65s - 532.13s | history to think that we believe we absolutely need to continue to work with you, um, and 532.13s - 537.97s | hear from you. It's why I'm here. So, uh, I'm gonna go back to those very first couple 537.97s - 544.41s | letters typed into the internet, right? So L-O crash. Um, it was a memory corruption. Same 544.41s - 548.81s | old software defect that we have been repeatedly living with. Um, why are so many of the 548.83s - 552.83s | security vulnerabilities still found around today? Um, really just variations on the same 552.83s - 559.21s | theme, themes. Uh, I mean code and data corruption, buffer overflows and memory manipulation, 559.21s - 563.61s | command interjections when, uh, user input is treated as a command, um, instead of 563.61s - 568.31s | information. And even though many exploits are exquisitely written, they're still 568.31s - 572.05s | ultimately taking class, uh, advantage of the very same classes of software defects that 572.07s - 580.07s | we've been living, um, with forever. So what if, uh, all of the classes of security 580.07s - 585.57s | vulnerabilities, um, or maybe we can appropriately just call them software defects, what if 585.57s - 590.71s | they all just disappeared tomorrow? You can suggest that that is a DARPA question and it is 590.71s - 595.29s | one that we are working on and we would love more help in. But the question I want to ask 595.29s - 600.13s | you is let's imagine that that happens. What's next? Cause that's really the DARPA 600.17s - 605.75s | question. The adversary doesn't just pack up their bags and quit. Um, we will always have a 605.75s - 610.81s | mission to complete. So maybe you are the ones with the magic idea, um, about how we can 610.81s - 616.13s | make all the cyber vulnerabilities disappear overnight. But maybe you have also imagined 616.13s - 622.53s | the problem we would face when all of


chunk_id: 195_chunk_11
chunk_text:
even though many exploits are exquisitely written, they're still 568.31s - 572.05s | ultimately taking class, uh, advantage of the very same classes of software defects that 572.07s - 580.07s | we've been living, um, with forever. So what if, uh, all of the classes of security 580.07s - 585.57s | vulnerabilities, um, or maybe we can appropriately just call them software defects, what if 585.57s - 590.71s | they all just disappeared tomorrow? You can suggest that that is a DARPA question and it is 590.71s - 595.29s | one that we are working on and we would love more help in. But the question I want to ask 595.29s - 600.13s | you is let's imagine that that happens. What's next? Cause that's really the DARPA 600.17s - 605.75s | question. The adversary doesn't just pack up their bags and quit. Um, we will always have a 605.75s - 610.81s | mission to complete. So maybe you are the ones with the magic idea, um, about how we can 610.81s - 616.13s | make all the cyber vulnerabilities disappear overnight. But maybe you have also imagined 616.13s - 622.53s | the problem we would face when all of them go away. Um, and the bottom line is I mean it 622.53s - 627.13s | when I say that I'm really worried about what you might be imagining because if we're 627.13s - 631.97s | not hearing about that we are completely missing out on being able to really make those 631.97s - 638.17s | big bets and hopefully change the world. So we want you to have the opportunity, um, to 638.17s - 643.21s | solve really big problems. We want you to be able to share your seemingly crazy ideas, 643.21s - 647.93s | things that others have missed. Maybe because you're a seer, uh, maybe because you can 647.93s - 651.99s | identify a problem that no one else can, you know it intimately and you can actually 651.99s - 657.83s | envision some thread of a, of a, of an actual solution. So when you have a problem that's 657.83s - 661.77s | hugely important to you, something that you probably had to duct tape and work around 661.77s - 666.03s | forever to the point that you almost forget that it's there. Um, but you have a glimmer of 666.03s - 670.95s | an


chunk_id: 195_chunk_12
chunk_text:
them go away. Um, and the bottom line is I mean it 622.53s - 627.13s | when I say that I'm really worried about what you might be imagining because if we're 627.13s - 631.97s | not hearing about that we are completely missing out on being able to really make those 631.97s - 638.17s | big bets and hopefully change the world. So we want you to have the opportunity, um, to 638.17s - 643.21s | solve really big problems. We want you to be able to share your seemingly crazy ideas, 643.21s - 647.93s | things that others have missed. Maybe because you're a seer, uh, maybe because you can 647.93s - 651.99s | identify a problem that no one else can, you know it intimately and you can actually 651.99s - 657.83s | envision some thread of a, of a, of an actual solution. So when you have a problem that's 657.83s - 661.77s | hugely important to you, something that you probably had to duct tape and work around 661.77s - 666.03s | forever to the point that you almost forget that it's there. Um, but you have a glimmer of 666.03s - 670.95s | an idea on how to fix it. Um, there's a, there's a pretty good chance that that idea, um, 670.95s - 674.95s | should be important to us and we need to hear from you. We know that you're likely the 674.95s - 680.51s | best people to both identify and to help solve the problem and we want to enable you. Okay, 680.51s - 686.51s | so if you've ever tried to work with the government before, um, I recognize that 686.51s - 692.47s | that's not always really easy and we're easier than most, but still not necessarily 692.47s - 696.31s | trivial. Um, so we spend a lot of our time trying to figure out how to lower those 696.31s - 700.11s | barriers to entry and we do a lot of experimentation, not just in science and 700.11s - 705.59s | technology, but in business. So we've demonstrated before, um, that we can make these 705.59s - 711.51s | barriers go away. Um, and the, you know, I mentioned the cyber fast track or CFT program, 711.51s - 719.39s | uh, who here remembers CFT? Okay. A few people, but actually for those that don't, let me


chunk_id: 195_chunk_13
chunk_text:
idea on how to fix it. Um, there's a, there's a pretty good chance that that idea, um, 670.95s - 674.95s | should be important to us and we need to hear from you. We know that you're likely the 674.95s - 680.51s | best people to both identify and to help solve the problem and we want to enable you. Okay, 680.51s - 686.51s | so if you've ever tried to work with the government before, um, I recognize that 686.51s - 692.47s | that's not always really easy and we're easier than most, but still not necessarily 692.47s - 696.31s | trivial. Um, so we spend a lot of our time trying to figure out how to lower those 696.31s - 700.11s | barriers to entry and we do a lot of experimentation, not just in science and 700.11s - 705.59s | technology, but in business. So we've demonstrated before, um, that we can make these 705.59s - 711.51s | barriers go away. Um, and the, you know, I mentioned the cyber fast track or CFT program, 711.51s - 719.39s | uh, who here remembers CFT? Okay. A few people, but actually for those that don't, let me 719.39s - 724.59s | point out. So it was a two year experiment. During that time we had about 500 proposals 724.59s - 730.11s | come from people in this community, 130 of which were accepted and funded. The program 730.11s - 735.31s | manager is someone a lot of you, um, know or at least have heard of much. Um, he turned 735.31s - 742.83s | around decisions on those proposals within 24 hours and within a week we had funds, um, 742.83s - 749.11s | at the teams in order to actually start working immediately. Mudge also, um, acted as an ambassador 749.11s - 752.75s | and he made sure that the government respected the culture of the community, um, and that 752.75s - 757.63s | there was full transparency. After CFT, um, opened the doors to innovative partnerships 757.63s - 763.91s | like this, DARPA actually continued to engage. And so, um, a number of years ago now we had, 763.91s - 769.59s | uh, the cyber grand challenge also at DEF CON. And this week we are doing the semifinals 769.59s - 775.59s | of the AI cyber challenge, AICC. And additionally, a lot more people


chunk_id: 195_chunk_14
chunk_text:
719.39s - 724.59s | point out. So it was a two year experiment. During that time we had about 500 proposals 724.59s - 730.11s | come from people in this community, 130 of which were accepted and funded. The program 730.11s - 735.31s | manager is someone a lot of you, um, know or at least have heard of much. Um, he turned 735.31s - 742.83s | around decisions on those proposals within 24 hours and within a week we had funds, um, 742.83s - 749.11s | at the teams in order to actually start working immediately. Mudge also, um, acted as an ambassador 749.11s - 752.75s | and he made sure that the government respected the culture of the community, um, and that 752.75s - 757.63s | there was full transparency. After CFT, um, opened the doors to innovative partnerships 757.63s - 763.91s | like this, DARPA actually continued to engage. And so, um, a number of years ago now we had, 763.91s - 769.59s | uh, the cyber grand challenge also at DEF CON. And this week we are doing the semifinals 769.59s - 775.59s | of the AI cyber challenge, AICC. And additionally, a lot more people from this community, um, 775.59s - 781.03s | have come to DARPA or been, been working behind the scenes with DARPA. Um, so all of them 781.03s - 785.83s | have really helped shape our ideas and in a lot of ways fundamentally shape what DARPA 785.83s - 790.27s | is and how we go about doing our mission, you know, in a way that we wouldn't have recognized 790.27s - 796.23s | maybe 10 or 15 years ago. So, uh, we've proved that it's possible for the government or at 796.23s - 802.95s | least DARPA, um, to move faster than the commercial sector, uh, and to, and to, while still taking 802.95s - 808.07s | those really big, bold transformative risks, um, that are part of our mission. So we have 808.07s - 812.75s | continued that tradition of experimentation, lots and lots more business experimentation, 812.75s - 817.99s | a lot of different ways to interact much more quickly and much more easily. Um, in some 817.99s - 822.07s | ways, maybe so many different ways that that in itself has become kind of an interesting 822.07s - 827.03s | conundrum to sort of figure out what


chunk_id: 195_chunk_15
chunk_text:
from this community, um, 775.59s - 781.03s | have come to DARPA or been, been working behind the scenes with DARPA. Um, so all of them 781.03s - 785.83s | have really helped shape our ideas and in a lot of ways fundamentally shape what DARPA 785.83s - 790.27s | is and how we go about doing our mission, you know, in a way that we wouldn't have recognized 790.27s - 796.23s | maybe 10 or 15 years ago. So, uh, we've proved that it's possible for the government or at 796.23s - 802.95s | least DARPA, um, to move faster than the commercial sector, uh, and to, and to, while still taking 802.95s - 808.07s | those really big, bold transformative risks, um, that are part of our mission. So we have 808.07s - 812.75s | continued that tradition of experimentation, lots and lots more business experimentation, 812.75s - 817.99s | a lot of different ways to interact much more quickly and much more easily. Um, in some 817.99s - 822.07s | ways, maybe so many different ways that that in itself has become kind of an interesting 822.07s - 827.03s | conundrum to sort of figure out what the easiest path is. So, um, we have an organization called 827.03s - 831.03s | DARPA Connect and if anybody is struggling with working with DARPA or you're not quite 831.03s - 836.23s | sure where to start, um, all you have to do is, you know, search for DARPA Connect. Think 836.23s - 842.43s | of it as a one-stop help desk. Like how do I find a program manager at DARPA? How do 842.43s - 847.19s | I read one of their, their, their, their documents for our calls for proposal, which we try to 847.19s - 851.83s | write as simply as possible, but which are always burdened with a whole lot of sort of 851.83s - 856.07s | official terms and conditions that you might be a little worried about. Uh, DARPA Connect 856.07s - 860.59s | is there to help. They, they're going to provide custom coaching to help with just about any 860.59s - 865.15s | aspect of engaging with us or with other parts of the defense department. Because, you know, 865.15s - 868.19s | if it's not us, there's a good chance that what you're talking about should be heard 868.19s -


chunk_id: 195_chunk_16
chunk_text:
the easiest path is. So, um, we have an organization called 827.03s - 831.03s | DARPA Connect and if anybody is struggling with working with DARPA or you're not quite 831.03s - 836.23s | sure where to start, um, all you have to do is, you know, search for DARPA Connect. Think 836.23s - 842.43s | of it as a one-stop help desk. Like how do I find a program manager at DARPA? How do 842.43s - 847.19s | I read one of their, their, their, their documents for our calls for proposal, which we try to 847.19s - 851.83s | write as simply as possible, but which are always burdened with a whole lot of sort of 851.83s - 856.07s | official terms and conditions that you might be a little worried about. Uh, DARPA Connect 856.07s - 860.59s | is there to help. They, they're going to provide custom coaching to help with just about any 860.59s - 865.15s | aspect of engaging with us or with other parts of the defense department. Because, you know, 865.15s - 868.19s | if it's not us, there's a good chance that what you're talking about should be heard 868.19s - 872.39s | by somebody, um, somebody else. You know, we've also got some experiments going on and 872.39s - 878.23s | how to very rapidly get people with great ideas, um, intersecting into the classified 878.23s - 882.79s | problem space because we have a chicken and egg problem there where defining the problem 882.79s - 886.83s | and finding the solutions keep going past each other because you sort of have to already 886.83s - 891.83s | have one in order to have the other. Um, so, you know, the bottom line is you absolutely 891.83s - 896.75s | don't have to be a major defense contractor to work with us. Uh, at least 30% of our budget 896.75s - 901.95s | goes to small, uh, to small businesses and non-traditional organizations. Um, another 901.95s - 906.71s | 20% goes to universities. We really tend to have the, the fundamental thing that we look 906.71s - 913.51s | for is the idea. And we want to make sure that we can hear that idea as quickly as possible. 913.51s - 916.87s | So I know we still have a lot to learn. The world is changing rapidly, um, but


chunk_id: 195_chunk_17
chunk_text:
872.39s | by somebody, um, somebody else. You know, we've also got some experiments going on and 872.39s - 878.23s | how to very rapidly get people with great ideas, um, intersecting into the classified 878.23s - 882.79s | problem space because we have a chicken and egg problem there where defining the problem 882.79s - 886.83s | and finding the solutions keep going past each other because you sort of have to already 886.83s - 891.83s | have one in order to have the other. Um, so, you know, the bottom line is you absolutely 891.83s - 896.75s | don't have to be a major defense contractor to work with us. Uh, at least 30% of our budget 896.75s - 901.95s | goes to small, uh, to small businesses and non-traditional organizations. Um, another 901.95s - 906.71s | 20% goes to universities. We really tend to have the, the fundamental thing that we look 906.71s - 913.51s | for is the idea. And we want to make sure that we can hear that idea as quickly as possible. 913.51s - 916.87s | So I know we still have a lot to learn. The world is changing rapidly, um, but I think 916.87s - 920.63s | we're moving in the right direction there. And if we're not, I want to hear from you 920.63s - 926.19s | as to what we can be doing better. Uh, okay. So you, I say over and over again that, uh, 926.19s - 931.11s | we want to hear your ideas. Who is this we, right? We, um, at DARPA, when I say that, 931.11s - 935.43s | that means our program managers. DARPA is made up at any moment in time of about a hundred 935.43s - 942.39s | program managers. They come to us from all walks of life, from this community, from companies, 942.39s - 947.91s | from other parts of the government, from universities, from many, many different technological sectors. 947.91s - 952.59s | And they come to DARPA because they think they can change the world. And, um, that's 952.59s - 956.71s | a pretty deeply uncomfortable state to be in. I mean, it's a lot of responsibility. 956.71s - 959.75s | And one of the things we find works best to DARPA is that right around the time you start 959.75s - 965.11s | feeling comfortable, we kick


chunk_id: 195_chunk_18
chunk_text:
I think 916.87s - 920.63s | we're moving in the right direction there. And if we're not, I want to hear from you 920.63s - 926.19s | as to what we can be doing better. Uh, okay. So you, I say over and over again that, uh, 926.19s - 931.11s | we want to hear your ideas. Who is this we, right? We, um, at DARPA, when I say that, 931.11s - 935.43s | that means our program managers. DARPA is made up at any moment in time of about a hundred 935.43s - 942.39s | program managers. They come to us from all walks of life, from this community, from companies, 942.39s - 947.91s | from other parts of the government, from universities, from many, many different technological sectors. 947.91s - 952.59s | And they come to DARPA because they think they can change the world. And, um, that's 952.59s - 956.71s | a pretty deeply uncomfortable state to be in. I mean, it's a lot of responsibility. 956.71s - 959.75s | And one of the things we find works best to DARPA is that right around the time you start 959.75s - 965.11s | feeling comfortable, we kick you out. Um, we have a constant cycle, um, of new ideas 965.11s - 968.35s | and new people. And so that itself can be a little intimidating. You want to talk to 968.35s - 972.71s | a program manager, but they're, they're constantly cycling in. That's where DARPA connect can 972.71s - 977.99s | help, um, find the program manager, tell them about your idea. Think about, you know, what 977.99s - 981.99s | keeps you up at night, what keeps them up at night and look for those opportunities, 981.99s - 986.83s | um, where we can then make a major investment and do something really transformative together. 986.83s - 991.31s | Um, so when you reach out to a program manager, all you have to worry about is the problem 991.31s - 996.71s | that you care about. Let us worry about connecting it to the bigger national security questions 996.71s - 1003.39s | or to the rest of the government. Um, don't, don't ask them to tell you what to do, right? 1003.39s - 1007.47s | I mean, seriously, I can't imagine that most of you would, but it does happen. You tell 1007.47s - 1013.27s


chunk_id: 195_chunk_19
chunk_text:
you out. Um, we have a constant cycle, um, of new ideas 965.11s - 968.35s | and new people. And so that itself can be a little intimidating. You want to talk to 968.35s - 972.71s | a program manager, but they're, they're constantly cycling in. That's where DARPA connect can 972.71s - 977.99s | help, um, find the program manager, tell them about your idea. Think about, you know, what 977.99s - 981.99s | keeps you up at night, what keeps them up at night and look for those opportunities, 981.99s - 986.83s | um, where we can then make a major investment and do something really transformative together. 986.83s - 991.31s | Um, so when you reach out to a program manager, all you have to worry about is the problem 991.31s - 996.71s | that you care about. Let us worry about connecting it to the bigger national security questions 996.71s - 1003.39s | or to the rest of the government. Um, don't, don't ask them to tell you what to do, right? 1003.39s - 1007.47s | I mean, seriously, I can't imagine that most of you would, but it does happen. You tell 1007.47s - 1013.27s | them, um, where you think these missing opportunities and, um, and problems might be. And we really 1013.27s - 1019.51s | can't wait to hear from you. Okay. So understandably, I'm really passionate about talking about 1019.51s - 1023.91s | DARPA. I could probably do it all day. Um, but let's just leave it that, that DARPA is 1023.91s - 1032.15s | pretty awesome, but, um, we are simply the original ARPA. There are actually, um, quite 1032.15s - 1036.39s | a number of extraordinary organizations that had been arising around the country, um, and 1036.39s - 1042.35s | around the world that follow a very similar model and the ecosystem is expanding. Um, 1042.35s - 1045.87s | so I'm really excited that I'm going to be joined here on stage for a little fireside 1045.87s - 1051.91s | chat by the inaugural director of one of my very favorite ARPAs, ARPA-H, ARPA for health. 1051.91s - 1055.23s | We all care about health. So I think you're likely to be, uh, I'm interested in what she 1055.23s - 1060.51s | has to say. And also, uh, I will be joined by much who has very recently returned to


chunk_id: 195_chunk_20
chunk_text:
| them, um, where you think these missing opportunities and, um, and problems might be. And we really 1013.27s - 1019.51s | can't wait to hear from you. Okay. So understandably, I'm really passionate about talking about 1019.51s - 1023.91s | DARPA. I could probably do it all day. Um, but let's just leave it that, that DARPA is 1023.91s - 1032.15s | pretty awesome, but, um, we are simply the original ARPA. There are actually, um, quite 1032.15s - 1036.39s | a number of extraordinary organizations that had been arising around the country, um, and 1036.39s - 1042.35s | around the world that follow a very similar model and the ecosystem is expanding. Um, 1042.35s - 1045.87s | so I'm really excited that I'm going to be joined here on stage for a little fireside 1045.87s - 1051.91s | chat by the inaugural director of one of my very favorite ARPAs, ARPA-H, ARPA for health. 1051.91s - 1055.23s | We all care about health. So I think you're likely to be, uh, I'm interested in what she 1055.23s - 1060.51s | has to say. And also, uh, I will be joined by much who has very recently returned to 1060.55s - 1087.36s | DARPA as our chief information officer. So welcome Renee and much. Yeah. All right. Are 1087.36s - 1103.01s | these, I think it's on. Yep. Oh, there we go. Okay. All right. So it turns out, you 1103.01s - 1107.33s | know, we all know each other and we've talked to each other, you know, kind of in a, these 1107.33s - 1111.09s | kind of bilateral conversations. We've never had a chance for the three of us to chat and 1111.09s - 1116.69s | it turns out we have questions. Um, so we're hoping to sort of enjoy sitting in. We, we 1116.77s - 1121.49s | are dying to learn a few things from each other. Um, and I am going to kick off with, 1121.49s - 1126.41s | uh, something that I am sort of embarrassed that I don't really know much. Like we were 1126.41s - 1130.85s | actually program managers, um, at the same time. I have no idea what made you take that 1130.85s - 1142.35s | job to actually come work for DARPA. Yeah, sure. We'll just swap like that. Thanks. It's, 1142.35s - 1146.39s | it's the sharing amongst


chunk_id: 195_chunk_21
chunk_text:
1060.55s - 1087.36s | DARPA as our chief information officer. So welcome Renee and much. Yeah. All right. Are 1087.36s - 1103.01s | these, I think it's on. Yep. Oh, there we go. Okay. All right. So it turns out, you 1103.01s - 1107.33s | know, we all know each other and we've talked to each other, you know, kind of in a, these 1107.33s - 1111.09s | kind of bilateral conversations. We've never had a chance for the three of us to chat and 1111.09s - 1116.69s | it turns out we have questions. Um, so we're hoping to sort of enjoy sitting in. We, we 1116.77s - 1121.49s | are dying to learn a few things from each other. Um, and I am going to kick off with, 1121.49s - 1126.41s | uh, something that I am sort of embarrassed that I don't really know much. Like we were 1126.41s - 1130.85s | actually program managers, um, at the same time. I have no idea what made you take that 1130.85s - 1142.35s | job to actually come work for DARPA. Yeah, sure. We'll just swap like that. Thanks. It's, 1142.35s - 1146.39s | it's the sharing amongst agencies already. Tech transition in, in progress right in front 1146.39s - 1151.19s | of your very eyes. Um, well that's a, that's an interesting one. I thought you were going 1151.19s - 1157.23s | to ask why I, I decided to rejoin. But, but, um, the, uh, the joining. You rejoined because 1157.23s - 1163.11s | we like overwhelmed you. We were desperate to have you back. But yeah, but the first 1163.11s - 1167.83s | job and the first. Yeah, the, the, the first one was, um, well, I mean I had been working 1167.83s - 1173.75s | in technology. I was doing the loft. Um, you know, I had been around folks, uh, who were 1173.75s - 1180.29s | interacting with DARPA. There was a good academic and hacker community and program managers 1180.29s - 1187.05s | that we kind of knew. And, um, I was also in, uh, I ended up in a government, uh, contracting, 1187.05s - 1193.51s | uh, organization. Uh, I won't, uh, name them. And I was looking at things saying, you know, 1193.51s - 1198.69s | we can, we can do better. Uh, I'm seeing the same ideas coming in over


chunk_id: 195_chunk_22
chunk_text:
agencies already. Tech transition in, in progress right in front 1146.39s - 1151.19s | of your very eyes. Um, well that's a, that's an interesting one. I thought you were going 1151.19s - 1157.23s | to ask why I, I decided to rejoin. But, but, um, the, uh, the joining. You rejoined because 1157.23s - 1163.11s | we like overwhelmed you. We were desperate to have you back. But yeah, but the first 1163.11s - 1167.83s | job and the first. Yeah, the, the, the first one was, um, well, I mean I had been working 1167.83s - 1173.75s | in technology. I was doing the loft. Um, you know, I had been around folks, uh, who were 1173.75s - 1180.29s | interacting with DARPA. There was a good academic and hacker community and program managers 1180.29s - 1187.05s | that we kind of knew. And, um, I was also in, uh, I ended up in a government, uh, contracting, 1187.05s - 1193.51s | uh, organization. Uh, I won't, uh, name them. And I was looking at things saying, you know, 1193.51s - 1198.69s | we can, we can do better. Uh, I'm seeing the same ideas coming in over and over again. 1198.69s - 1202.53s | And some of them I'm seeing are from this community, but not being presented by this 1202.53s - 1209.23s | community and not being performed by this community. And wouldn't they be the best to 1209.23s - 1215.27s | do the work because they know the problem, you know, most intimately. Um, and I also 1215.27s - 1220.53s | wanted to be an ambassador. Uh, I had done this throughout the loft, uh, the first Senate 1220.53s - 1228.79s | testimony. Um, we won't talk about, uh, many of the others. Um, and, uh, it was a bi-directional 1228.79s - 1232.75s | one, you know, because I had a good relationship with people in the government where I was 1232.75s - 1237.95s | like, oh, I see rays of light. I was, you know, I'm critical of a lot of, uh, the government, 1237.95s - 1244.19s | but I also, you know, want to, uh, give kudos and encourage where I see positive actions 1244.19s - 1250.39s | going. Um, and then I also wanted to make sure that this community wasn't viewed as 1250.39s - 1256.03s | just like a resource to


chunk_id: 195_chunk_23
chunk_text:
and over again. 1198.69s - 1202.53s | And some of them I'm seeing are from this community, but not being presented by this 1202.53s - 1209.23s | community and not being performed by this community. And wouldn't they be the best to 1209.23s - 1215.27s | do the work because they know the problem, you know, most intimately. Um, and I also 1215.27s - 1220.53s | wanted to be an ambassador. Uh, I had done this throughout the loft, uh, the first Senate 1220.53s - 1228.79s | testimony. Um, we won't talk about, uh, many of the others. Um, and, uh, it was a bi-directional 1228.79s - 1232.75s | one, you know, because I had a good relationship with people in the government where I was 1232.75s - 1237.95s | like, oh, I see rays of light. I was, you know, I'm critical of a lot of, uh, the government, 1237.95s - 1244.19s | but I also, you know, want to, uh, give kudos and encourage where I see positive actions 1244.19s - 1250.39s | going. Um, and then I also wanted to make sure that this community wasn't viewed as 1250.39s - 1256.03s | just like a resource to pull from. Um, but that this community that we should be a resource 1256.03s - 1262.75s | to this community as well. Um, what I fell in love with was the fixed term. Uh, the fact 1262.75s - 1267.07s | that it was like you were fired as soon as you were hired because you're only there for 1267.19s - 1272.79s | four years, uh, at most. So you better sprint and the things you're dealing with are of 1272.79s - 1279.51s | such magnitude. And if you stop sprinting, you know, you'll have wasted your time. You'll 1279.51s - 1285.11s | have missed an opportunity to potentially have changed the world for the better. Um, 1285.11s - 1289.43s | or you'll have missed the opportunity to take a big chance at an agency that's much more, 1289.43s - 1294.91s | you know, risk tolerant and acceptant, uh, so that, you know, it's okay to fail. We're 1294.91s - 1300.11s | going to learn from the failure. So that combination was just like, okay, I, I can't 1300.11s - 1304.63s | pass this up. Let's give this a try. So that was a huge honor then. And it's a huge


chunk_id: 195_chunk_24
chunk_text:
pull from. Um, but that this community that we should be a resource 1256.03s - 1262.75s | to this community as well. Um, what I fell in love with was the fixed term. Uh, the fact 1262.75s - 1267.07s | that it was like you were fired as soon as you were hired because you're only there for 1267.19s - 1272.79s | four years, uh, at most. So you better sprint and the things you're dealing with are of 1272.79s - 1279.51s | such magnitude. And if you stop sprinting, you know, you'll have wasted your time. You'll 1279.51s - 1285.11s | have missed an opportunity to potentially have changed the world for the better. Um, 1285.11s - 1289.43s | or you'll have missed the opportunity to take a big chance at an agency that's much more, 1289.43s - 1294.91s | you know, risk tolerant and acceptant, uh, so that, you know, it's okay to fail. We're 1294.91s - 1300.11s | going to learn from the failure. So that combination was just like, okay, I, I can't 1300.11s - 1304.63s | pass this up. Let's give this a try. So that was a huge honor then. And it's a huge honor 1304.63s - 1311.67s | to rejoin. Um, I wrote a bunch of these down cause so many people sent me in questions, 1311.67s - 1318.11s | uh, and I wanted to make sure we, we, uh, caught some of these. So, uh, I'm not the 1318.11s - 1323.35s | only one who was at DARPA. You were at DARPA also, you were at another, uh, ARPA that, 1323.35s - 1329.23s | uh, I have, uh, relationships with as well. Um, two questions. I'll ask them one at a 1329.23s - 1336.23s | time. What's, what do you view as the Delta or the differences between ARPA-H and DARPA? 1336.23s - 1342.39s | Yeah. Oh, right. Yeah. Pass it. I'll pass it back. Um, so I love hearing your origin 1342.39s - 1347.51s | story to becoming a program manager. And, uh, I do think that's where a lot of the similarities 1347.51s - 1352.83s | lie. So when I became a program manager, it was also the same sense of urgency to solve 1352.83s - 1357.71s | a problem and not having an outlet for it. And so, uh, what brought me to DARPA was, 1357.71s - 1362.67s |


chunk_id: 195_chunk_25
chunk_text:
honor 1304.63s - 1311.67s | to rejoin. Um, I wrote a bunch of these down cause so many people sent me in questions, 1311.67s - 1318.11s | uh, and I wanted to make sure we, we, uh, caught some of these. So, uh, I'm not the 1318.11s - 1323.35s | only one who was at DARPA. You were at DARPA also, you were at another, uh, ARPA that, 1323.35s - 1329.23s | uh, I have, uh, relationships with as well. Um, two questions. I'll ask them one at a 1329.23s - 1336.23s | time. What's, what do you view as the Delta or the differences between ARPA-H and DARPA? 1336.23s - 1342.39s | Yeah. Oh, right. Yeah. Pass it. I'll pass it back. Um, so I love hearing your origin 1342.39s - 1347.51s | story to becoming a program manager. And, uh, I do think that's where a lot of the similarities 1347.51s - 1352.83s | lie. So when I became a program manager, it was also the same sense of urgency to solve 1352.83s - 1357.71s | a problem and not having an outlet for it. And so, uh, what brought me to DARPA was, 1357.71s - 1362.67s | was really around genome editing technologies. And this is dating myself here over a decade 1362.67s - 1367.29s | ago where these were brand new technologies, um, that had a lot of off target effects and 1367.29s - 1371.23s | unexpected consequences. Um, and that was the first time I came to DEF CON actually 1371.23s - 1374.79s | was to engage with this community, thinking about DNA as a programming language and what 1374.79s - 1379.51s | are other ways that you can be, um, preventing misuse, but creating tools to make sure we 1379.51s - 1383.55s | can get this into the real world. And so giving this back to the people is, is, is 1383.55s - 1387.67s | such an important part, I think, of what ARPAs do. And so when there was an opportunity to 1387.67s - 1392.51s | come back to government and, and lead and launch the first ARPA for health, um, with 1392.51s - 1398.95s | that spirit of adopting that, you know, DARPA bravado, but taking that model and really 1398.95s - 1404.31s | pursuing our mission, which is to accelerate better health outcomes for everyone. So we 1404.31s - 1409.31s |


chunk_id: 195_chunk_26
chunk_text:
was really around genome editing technologies. And this is dating myself here over a decade 1362.67s - 1367.29s | ago where these were brand new technologies, um, that had a lot of off target effects and 1367.29s - 1371.23s | unexpected consequences. Um, and that was the first time I came to DEF CON actually 1371.23s - 1374.79s | was to engage with this community, thinking about DNA as a programming language and what 1374.79s - 1379.51s | are other ways that you can be, um, preventing misuse, but creating tools to make sure we 1379.51s - 1383.55s | can get this into the real world. And so giving this back to the people is, is, is 1383.55s - 1387.67s | such an important part, I think, of what ARPAs do. And so when there was an opportunity to 1387.67s - 1392.51s | come back to government and, and lead and launch the first ARPA for health, um, with 1392.51s - 1398.95s | that spirit of adopting that, you know, DARPA bravado, but taking that model and really 1398.95s - 1404.31s | pursuing our mission, which is to accelerate better health outcomes for everyone. So we 1404.31s - 1409.31s | stole directly the first eight Heilmayer questions from DARPA. So this is, you know, what's the 1409.35s - 1413.23s | problem you're trying to solve? How's it done today? What's new in your approach? And then 1413.23s - 1418.75s | some tactics around, you know, cost, um, how long will it take and what are your milestones? 1418.75s - 1422.99s | We've added a few questions, um, at ARPA-H. This is one of the differentiators. It's so 1422.99s - 1427.79s | important in healthcare that we are creating tools that are cost effective, that people 1427.79s - 1433.03s | can actually afford and that they are accessible to communities, whether it's urban, rural, 1433.03s - 1437.63s | regardless of your demographics, but then having a customer experience in mind. And 1437.67s - 1441.75s | so our program managers can't launch a program unless they've thought about who's the end 1441.75s - 1446.31s | user. As a patient, we've all had negative experiences with the healthcare sector. And 1446.31s - 1452.23s | so how would you redesign with a human centered approach, that entire process, or as a 1452.23s - 1456.55s | doctor, um, you know, what I've learned that the


chunk_id: 195_chunk_27
chunk_text:
stole directly the first eight Heilmayer questions from DARPA. So this is, you know, what's the 1409.35s - 1413.23s | problem you're trying to solve? How's it done today? What's new in your approach? And then 1413.23s - 1418.75s | some tactics around, you know, cost, um, how long will it take and what are your milestones? 1418.75s - 1422.99s | We've added a few questions, um, at ARPA-H. This is one of the differentiators. It's so 1422.99s - 1427.79s | important in healthcare that we are creating tools that are cost effective, that people 1427.79s - 1433.03s | can actually afford and that they are accessible to communities, whether it's urban, rural, 1433.03s - 1437.63s | regardless of your demographics, but then having a customer experience in mind. And 1437.67s - 1441.75s | so our program managers can't launch a program unless they've thought about who's the end 1441.75s - 1446.31s | user. As a patient, we've all had negative experiences with the healthcare sector. And 1446.31s - 1452.23s | so how would you redesign with a human centered approach, that entire process, or as a 1452.23s - 1456.55s | doctor, um, you know, what I've learned that the OR is sacred. And if you're going to 1456.55s - 1460.87s | introduce something into the operating room, you need that doctor as a partner, um, 1460.87s - 1465.43s | developing those capabilities with you. And so, um, we're really trying by design to build 1465.43s - 1470.07s | that into a lot of what we're doing, um, at ARPA-H. And, you know, Stephanie said that we 1470.07s - 1474.31s | had, you all have about a hundred program managers. We're at about 20. Uh, we're still 1474.31s - 1478.95s | growing. So, uh, that's also an open call to think about what are some of those big 1478.95s - 1483.71s | problems in health, um, at the intersection of, uh, some of the cyber and, and data 1483.71s - 1486.43s | capabilities is certainly an area that we really want to grow out. 1486.43s - 1492.11s | I don't know where we're getting the hum or feedback from. So the second one is, I 1492.11s - 1496.79s | understand the connection on like the biohacking village. I understand the weird 1496.79s - 1504.63s | machines, uh, uh, Emmanuel LaFroy and, and Sergey Bratis at all. Um, and, and that


chunk_id: 195_chunk_28
chunk_text:
OR is sacred. And if you're going to 1456.55s - 1460.87s | introduce something into the operating room, you need that doctor as a partner, um, 1460.87s - 1465.43s | developing those capabilities with you. And so, um, we're really trying by design to build 1465.43s - 1470.07s | that into a lot of what we're doing, um, at ARPA-H. And, you know, Stephanie said that we 1470.07s - 1474.31s | had, you all have about a hundred program managers. We're at about 20. Uh, we're still 1474.31s - 1478.95s | growing. So, uh, that's also an open call to think about what are some of those big 1478.95s - 1483.71s | problems in health, um, at the intersection of, uh, some of the cyber and, and data 1483.71s - 1486.43s | capabilities is certainly an area that we really want to grow out. 1486.43s - 1492.11s | I don't know where we're getting the hum or feedback from. So the second one is, I 1492.11s - 1496.79s | understand the connection on like the biohacking village. I understand the weird 1496.79s - 1504.63s | machines, uh, uh, Emmanuel LaFroy and, and Sergey Bratis at all. Um, and, and that 1504.63s - 1512.39s | relationship, but this is normally a predominantly cyber, uh, conference. So ARPA-H 1512.39s - 1514.83s | and cyber, can you give me a little elaboration there? 1516.35s - 1520.55s | Yeah. So, you know, when, when coming back to our mission to accelerate better health 1520.59s - 1524.23s | outcomes for everyone, people really associate health outcomes typically with 1524.39s - 1530.19s | diagnostics or therapeutics, but actually a hospital shutting down and, uh, because 1530.19s - 1534.95s | of a ransomware attack or whatever vulnerability may be exploited actually 1534.99s - 1539.11s | immediately impacts patient outcomes as well. And so if we're being true to our 1539.11s - 1544.47s | mission, we are really, um, leaning into the, the cyber capability as well. Um, but 1544.47s - 1547.71s | this is an area where healthcare does not have a lot of strengths. We don't have the 1547.71s - 1552.27s | workforce that a national security workforce has. Um, so we hired a program 1552.27s - 1556.39s | manager, uh, back a little over a year ago, Andrew Carney, um, who had been really 1556.39s - 1561.11s | thinking about programs that, that he can


chunk_id: 195_chunk_29
chunk_text:
1504.63s - 1512.39s | relationship, but this is normally a predominantly cyber, uh, conference. So ARPA-H 1512.39s - 1514.83s | and cyber, can you give me a little elaboration there? 1516.35s - 1520.55s | Yeah. So, you know, when, when coming back to our mission to accelerate better health 1520.59s - 1524.23s | outcomes for everyone, people really associate health outcomes typically with 1524.39s - 1530.19s | diagnostics or therapeutics, but actually a hospital shutting down and, uh, because 1530.19s - 1534.95s | of a ransomware attack or whatever vulnerability may be exploited actually 1534.99s - 1539.11s | immediately impacts patient outcomes as well. And so if we're being true to our 1539.11s - 1544.47s | mission, we are really, um, leaning into the, the cyber capability as well. Um, but 1544.47s - 1547.71s | this is an area where healthcare does not have a lot of strengths. We don't have the 1547.71s - 1552.27s | workforce that a national security workforce has. Um, so we hired a program 1552.27s - 1556.39s | manager, uh, back a little over a year ago, Andrew Carney, um, who had been really 1556.39s - 1561.11s | thinking about programs that, that he can be moving into in this space. Um, and so 1561.11s - 1566.87s | when Stephanie called me this spring to tell me about the AI, uh, CC challenge, um, 1566.95s - 1572.47s | it was just such a great opportunity to play to both agencies' strengths. Um, the 1572.51s - 1576.91s | ability of a DARPA to launch a grand challenge for our agency to learn, but also 1576.91s - 1580.95s | operate at that intersection. Um, and really Stephanie, it, you know, I learned so 1580.95s - 1584.99s | much in that call about the challenge, um, where it's been and where it's going. And 1584.99s - 1588.15s | I think it'd be fun if you wanted to share some of that with the audience today. 1588.55s - 1592.99s | Oh, sure. Yeah. So the AI cyber challenges is even for DARPA, it's been moving 1592.99s - 1597.75s | really, really fast. So I should point out like DARPA starts 40 or 50 new DARPA 1597.75s - 1602.19s | programs a year. Obviously a lot of them don't succeed. Um, when we're looking for 1602.19s - 1605.87s | those really major breakthroughs, but typically our programs are around, you


chunk_id: 195_chunk_30
chunk_text:
be moving into in this space. Um, and so 1561.11s - 1566.87s | when Stephanie called me this spring to tell me about the AI, uh, CC challenge, um, 1566.95s - 1572.47s | it was just such a great opportunity to play to both agencies' strengths. Um, the 1572.51s - 1576.91s | ability of a DARPA to launch a grand challenge for our agency to learn, but also 1576.91s - 1580.95s | operate at that intersection. Um, and really Stephanie, it, you know, I learned so 1580.95s - 1584.99s | much in that call about the challenge, um, where it's been and where it's going. And 1584.99s - 1588.15s | I think it'd be fun if you wanted to share some of that with the audience today. 1588.55s - 1592.99s | Oh, sure. Yeah. So the AI cyber challenges is even for DARPA, it's been moving 1592.99s - 1597.75s | really, really fast. So I should point out like DARPA starts 40 or 50 new DARPA 1597.75s - 1602.19s | programs a year. Obviously a lot of them don't succeed. Um, when we're looking for 1602.19s - 1605.87s | those really major breakthroughs, but typically our programs are around, you know, 1605.87s - 1610.31s | we lay out a hypothesis, we lay out a goal, we call for proposals, and then we fund 1610.31s - 1615.95s | people with the coolest and craziest ideas. But sometimes problems are, they just 1615.95s - 1619.35s | don't lend themselves to that structure. Sometimes we need to issue a global 1619.35s - 1624.87s | challenge. Um, and we want to have teams from all over the country, like working in 1624.87s - 1628.43s | so many different ways. Like we don't want to over specify the solution space. Um, 1628.43s - 1631.35s | the first time we did that was something called the DARPA grand challenge. You 1631.35s - 1635.83s | remember I mentioned, um, our role in the, uh, on the, uh, self-driving car 1635.83s - 1639.59s | industry. The DARPA grand challenge was all about self-driving cars and it was a 1639.59s - 1643.15s | race. And we spent a lot of time worrying about like the finish line and how to 1643.15s - 1646.87s | score, like who was going to, how do we know who actually won? It turns out in 1646.87s - 1651.47s | that first year, not


chunk_id: 195_chunk_31
chunk_text:
know, 1605.87s - 1610.31s | we lay out a hypothesis, we lay out a goal, we call for proposals, and then we fund 1610.31s - 1615.95s | people with the coolest and craziest ideas. But sometimes problems are, they just 1615.95s - 1619.35s | don't lend themselves to that structure. Sometimes we need to issue a global 1619.35s - 1624.87s | challenge. Um, and we want to have teams from all over the country, like working in 1624.87s - 1628.43s | so many different ways. Like we don't want to over specify the solution space. Um, 1628.43s - 1631.35s | the first time we did that was something called the DARPA grand challenge. You 1631.35s - 1635.83s | remember I mentioned, um, our role in the, uh, on the, uh, self-driving car 1635.83s - 1639.59s | industry. The DARPA grand challenge was all about self-driving cars and it was a 1639.59s - 1643.15s | race. And we spent a lot of time worrying about like the finish line and how to 1643.15s - 1646.87s | score, like who was going to, how do we know who actually won? It turns out in 1646.87s - 1651.47s | that first year, not a single car made it across the finish line. And some of them 1651.47s - 1655.23s | were on fire. They rolled over, all kinds of crazy stuff happened. So when I say we 1655.23s - 1658.51s | embrace failure, we do, we do embrace failure. Um, because we went back out the 1658.51s - 1663.99s | next year and we did it again. Um, and, and that challenge idea is sometimes the 1663.99s - 1669.59s | right way to structure certain, certain questions. And the AICC, the AI cyber 1669.59s - 1673.91s | challenge kind of grew around the confluence, a couple of different 1673.91s - 1678.43s | questions. Um, one was, you know, we were, we were like everybody else. We were 1678.43s - 1683.83s | looking at this wave of large language models, um, and dominating the 1683.83s - 1687.23s | conversation. And a lot of the conversation was like all of the terrible 1687.23s - 1691.11s | things that could happen. And so part of what we wanted to ask is the classic 1691.11s - 1695.39s | contrarian question. It's like, how do you harness them in ways that we have some 1695.39s - 1699.27s |


chunk_id: 195_chunk_32
chunk_text:
a single car made it across the finish line. And some of them 1651.47s - 1655.23s | were on fire. They rolled over, all kinds of crazy stuff happened. So when I say we 1655.23s - 1658.51s | embrace failure, we do, we do embrace failure. Um, because we went back out the 1658.51s - 1663.99s | next year and we did it again. Um, and, and that challenge idea is sometimes the 1663.99s - 1669.59s | right way to structure certain, certain questions. And the AICC, the AI cyber 1669.59s - 1673.91s | challenge kind of grew around the confluence, a couple of different 1673.91s - 1678.43s | questions. Um, one was, you know, we were, we were like everybody else. We were 1678.43s - 1683.83s | looking at this wave of large language models, um, and dominating the 1683.83s - 1687.23s | conversation. And a lot of the conversation was like all of the terrible 1687.23s - 1691.11s | things that could happen. And so part of what we wanted to ask is the classic 1691.11s - 1695.39s | contrarian question. It's like, how do you harness them in ways that we have some 1695.39s - 1699.27s | confidence in the outcomes for good? And what can we do as quickly as possible? 1699.27s - 1703.63s | Because we also want to learn. Um, we were having some conversations with people 1703.63s - 1707.15s | about fundamental national security vulnerabilities. And one was actually a 1707.15s - 1711.75s | conversation with Ann Neuberger, who was just up here about infrastructure and 1711.75s - 1716.19s | all of the software vulnerabilities there. So now here's another thing about 1716.39s - 1721.35s | DARPA. We do not tell our program managers what programs to run. We hire 1721.35s - 1727.47s | them and they come and tell us what needs to happen. What I can do sometimes 1727.47s - 1732.99s | is throw out into the atmosphere of DARPA a question and say, if anyone has 1732.99s - 1737.59s | ideas, this could be really important. And so we threw this question out there, 1737.61s - 1741.83s | large language models, national infrastructure, lots of looming national 1741.83s - 1746.95s | security questions. Um, and one of our program managers, Perry Adams, came in 1746.99s - 1750.71s | like within a couple of weeks and she's like, I got an


chunk_id: 195_chunk_33
chunk_text:
confidence in the outcomes for good? And what can we do as quickly as possible? 1699.27s - 1703.63s | Because we also want to learn. Um, we were having some conversations with people 1703.63s - 1707.15s | about fundamental national security vulnerabilities. And one was actually a 1707.15s - 1711.75s | conversation with Ann Neuberger, who was just up here about infrastructure and 1711.75s - 1716.19s | all of the software vulnerabilities there. So now here's another thing about 1716.39s - 1721.35s | DARPA. We do not tell our program managers what programs to run. We hire 1721.35s - 1727.47s | them and they come and tell us what needs to happen. What I can do sometimes 1727.47s - 1732.99s | is throw out into the atmosphere of DARPA a question and say, if anyone has 1732.99s - 1737.59s | ideas, this could be really important. And so we threw this question out there, 1737.61s - 1741.83s | large language models, national infrastructure, lots of looming national 1741.83s - 1746.95s | security questions. Um, and one of our program managers, Perry Adams, came in 1746.99s - 1750.71s | like within a couple of weeks and she's like, I got an idea, but we need to do a 1750.71s - 1754.43s | challenge. We need to do this thing where we're actually looking at harnessing 1754.43s - 1758.67s | the large language models and finding and repairing vulnerabilities in national 1758.71s - 1764.51s | national infrastructure as quickly as possible. Um, okay. Maybe unsurprising 1764.51s - 1768.79s | given the level of talent among our program managers. Um, less than a year 1768.79s - 1771.79s | after she, so, so actually a couple of months after she had the idea, she was 1771.79s - 1775.83s | here at DEF CON announcing the kickoff. So that was one year ago. And then not 1775.83s - 1779.51s | too many months after that, she got, got pulled in by other parts of the national 1779.51s - 1783.35s | security community, sort of by name. She needed, she was needed for a bigger 1783.35s - 1788.23s | mission. So we had to find someone else equally amazing. And that was Andrew 1788.23s - 1793.07s | Carney. And then I, and he worked for an A. Um, so we said, is it, is it actually 1793.11s - 1797.23s | like against the law for us


chunk_id: 195_chunk_34
chunk_text:
idea, but we need to do a 1750.71s - 1754.43s | challenge. We need to do this thing where we're actually looking at harnessing 1754.43s - 1758.67s | the large language models and finding and repairing vulnerabilities in national 1758.71s - 1764.51s | national infrastructure as quickly as possible. Um, okay. Maybe unsurprising 1764.51s - 1768.79s | given the level of talent among our program managers. Um, less than a year 1768.79s - 1771.79s | after she, so, so actually a couple of months after she had the idea, she was 1771.79s - 1775.83s | here at DEF CON announcing the kickoff. So that was one year ago. And then not 1775.83s - 1779.51s | too many months after that, she got, got pulled in by other parts of the national 1779.51s - 1783.35s | security community, sort of by name. She needed, she was needed for a bigger 1783.35s - 1788.23s | mission. So we had to find someone else equally amazing. And that was Andrew 1788.23s - 1793.07s | Carney. And then I, and he worked for an A. Um, so we said, is it, is it actually 1793.11s - 1797.23s | like against the law for us to share an amazing program manager? And the more we 1797.23s - 1800.23s | talked about it, the more we talked about the fact that the infrastructure 1800.23s - 1804.71s | question is one that hits almost every community from one direction or another. 1804.87s - 1808.47s | So Renee talked about the healthcare side of it. And we have also been talking 1808.47s - 1814.07s | to our counterparts at ARPA for energy about the power grid or ARPA for, for 1814.31s - 1816.59s | infrastructure within the department of transportation. 1823.41s - 1826.33s | I feel like I'm at a Cuban embassy. Bad joke. 1830.35s - 1832.19s | Okay. We can all still breathe. This is good. 1832.39s - 1838.07s | So anyway, we, so the AICC challenge. So Andrew took over. He's been awesome. Um, 1838.19s - 1842.03s | the, the semifinals are, are sort of underway at this moment. We've had some 1842.03s - 1846.47s | amazing teams. I suspect some of you were out here in the audience. Thank you, uh, 1846.47s - 1850.79s | for, for putting you are all into, uh, into that challenge. And, and I have no 1850.79s - 1854.31s |


chunk_id: 195_chunk_35
chunk_text:
to share an amazing program manager? And the more we 1797.23s - 1800.23s | talked about it, the more we talked about the fact that the infrastructure 1800.23s - 1804.71s | question is one that hits almost every community from one direction or another. 1804.87s - 1808.47s | So Renee talked about the healthcare side of it. And we have also been talking 1808.47s - 1814.07s | to our counterparts at ARPA for energy about the power grid or ARPA for, for 1814.31s - 1816.59s | infrastructure within the department of transportation. 1823.41s - 1826.33s | I feel like I'm at a Cuban embassy. Bad joke. 1830.35s - 1832.19s | Okay. We can all still breathe. This is good. 1832.39s - 1838.07s | So anyway, we, so the AICC challenge. So Andrew took over. He's been awesome. Um, 1838.19s - 1842.03s | the, the semifinals are, are sort of underway at this moment. We've had some 1842.03s - 1846.47s | amazing teams. I suspect some of you were out here in the audience. Thank you, uh, 1846.47s - 1850.79s | for, for putting you are all into, uh, into that challenge. And, and I have no 1850.79s - 1854.31s | idea where the results are. I am dying, uh, to see, and we're really looking 1854.31s - 1860.79s | forward to, to hearing that. But that's the, that's the AICC story. Um, and 1860.91s - 1864.11s | uh, I think that's the, does that cover what you're, you were looking for? I 1864.11s - 1867.03s | think it's sort of why this community, I think that's kind of obvious, right? 1867.87s - 1874.23s | So, um, that actually, you know, we've talked about many, many intersections in 1874.23s - 1878.51s | this community, um, and the ARPAs. Uh, and, and I think maybe one of the people 1878.51s - 1882.15s | who can best answer my next question, you know, Mudge is you, what advice would 1882.15s - 1886.07s | you give, uh, to members of this community on working with organizations 1886.27s - 1890.67s | like ours? Um, so I, I, I don't know how many of you out there, uh, remember 1890.67s - 1896.03s | the loft. Uh, I know that most of the really technical folks are over at H.D. 1896.03s - 1901.03s | Moore's SSH, uh, talk right now. But when I was running the loft,


chunk_id: 195_chunk_36
chunk_text:
idea where the results are. I am dying, uh, to see, and we're really looking 1854.31s - 1860.79s | forward to, to hearing that. But that's the, that's the AICC story. Um, and 1860.91s - 1864.11s | uh, I think that's the, does that cover what you're, you were looking for? I 1864.11s - 1867.03s | think it's sort of why this community, I think that's kind of obvious, right? 1867.87s - 1874.23s | So, um, that actually, you know, we've talked about many, many intersections in 1874.23s - 1878.51s | this community, um, and the ARPAs. Uh, and, and I think maybe one of the people 1878.51s - 1882.15s | who can best answer my next question, you know, Mudge is you, what advice would 1882.15s - 1886.07s | you give, uh, to members of this community on working with organizations 1886.27s - 1890.67s | like ours? Um, so I, I, I don't know how many of you out there, uh, remember 1890.67s - 1896.03s | the loft. Uh, I know that most of the really technical folks are over at H.D. 1896.03s - 1901.03s | Moore's SSH, uh, talk right now. But when I was running the loft, which was this 1901.03s - 1906.03s | very early, what we like to call ourselves hacker think tank. Um, uh, but 1906.03s - 1908.95s | that was the Senate testimony of shutting the internet down in 30 minutes 1908.95s - 1913.95s | using the internet. And, and, and, and, and, and, and, and, and, and, and, and, 1913.99s - 1916.19s | and the other Senate testimony of shutting the internet down in 30 minutes 1916.19s - 1921.19s | using BGP attacks. Um, was we had all of these ideas and solutions and thought 1922.63s - 1928.51s | they were really critical, but we looked at places to like figure out we only needed 1928.51s - 1932.01s | a small amount of funding, you know, in order to do this and there were too many 1932.01s - 1936.27s | barriers to do it. Um, and that was again back towards the question of why 1936.27s - 1941.85s | did I join ARPAs? I wanted to remove some of those barriers. And actually a lot 1941.85s - 1947.37s | of the barriers weren't as big as I thought. And so the advice that I could 1947.37s - 1953.49s | give to anybody


chunk_id: 195_chunk_37
chunk_text:
which was this 1901.03s - 1906.03s | very early, what we like to call ourselves hacker think tank. Um, uh, but 1906.03s - 1908.95s | that was the Senate testimony of shutting the internet down in 30 minutes 1908.95s - 1913.95s | using the internet. And, and, and, and, and, and, and, and, and, and, and, and, 1913.99s - 1916.19s | and the other Senate testimony of shutting the internet down in 30 minutes 1916.19s - 1921.19s | using BGP attacks. Um, was we had all of these ideas and solutions and thought 1922.63s - 1928.51s | they were really critical, but we looked at places to like figure out we only needed 1928.51s - 1932.01s | a small amount of funding, you know, in order to do this and there were too many 1932.01s - 1936.27s | barriers to do it. Um, and that was again back towards the question of why 1936.27s - 1941.85s | did I join ARPAs? I wanted to remove some of those barriers. And actually a lot 1941.85s - 1947.37s | of the barriers weren't as big as I thought. And so the advice that I could 1947.37s - 1953.49s | give to anybody who wants to work on a problem is first off don't try and go in 1953.49s - 1958.53s | and solve like a government problem. Bring a problem that you're passionate 1958.53s - 1964.21s | about in your community and it's not just your idea that you know we're 1964.21s - 1969.03s | looking for. You're probably the one that's been obsessing about it, knows the 1969.03s - 1974.15s | most nuances about it, have thought about it the most that you've probably got one 1974.15s - 1978.19s | of the better shots at the solution and you're probably one of the you know the 1978.19s - 1986.31s | best options to actually perform on it. So how do you you know cross that chasm? 1986.31s - 1994.79s | You know the first one is the PMs. So as Stephanie mentioned we don't tell the 1994.79s - 1999.31s | PMs what to do. You know they come in with a general idea or a bunch of ideas. 1999.31s - 2004.27s | Call them up. They're on the web page. You know they're public servants. We're 2004.27s - 2008.35s | all public servants up here. Get 30 minutes or 60 minutes


chunk_id: 195_chunk_38
chunk_text:
who wants to work on a problem is first off don't try and go in 1953.49s - 1958.53s | and solve like a government problem. Bring a problem that you're passionate 1958.53s - 1964.21s | about in your community and it's not just your idea that you know we're 1964.21s - 1969.03s | looking for. You're probably the one that's been obsessing about it, knows the 1969.03s - 1974.15s | most nuances about it, have thought about it the most that you've probably got one 1974.15s - 1978.19s | of the better shots at the solution and you're probably one of the you know the 1978.19s - 1986.31s | best options to actually perform on it. So how do you you know cross that chasm? 1986.31s - 1994.79s | You know the first one is the PMs. So as Stephanie mentioned we don't tell the 1994.79s - 1999.31s | PMs what to do. You know they come in with a general idea or a bunch of ideas. 1999.31s - 2004.27s | Call them up. They're on the web page. You know they're public servants. We're 2004.27s - 2008.35s | all public servants up here. Get 30 minutes or 60 minutes of their time if 2008.35s - 2014.07s | they if they can through the through one of their assistants or schedulers and 2014.07s - 2019.11s | don't ask you know tell them here's the thing that's been driving me nuts that's 2019.11s - 2024.03s | been eating our lunch in our community for so long. Here's you know how I 2024.03s - 2029.51s | quantify why this is just like bleeding us dry and the solutions in place 2029.51s - 2035.95s | aren't going to converge and here's you know here's my crazy idea with some data 2035.95s - 2040.91s | points showing that now and with the you know current technology you know might 2040.91s - 2045.99s | be the right time to do it. And then the other one is when you go to those what 2045.99s - 2049.07s | they're called broad agency announcements the BAA's what Stephanie 2049.07s - 2053.31s | was referencing which you know it's a few pages of what you know maybe 2053.31s - 2059.67s | somebody's looking for and then like a whole bunch of government ease you know 2059.67s - 2067.79s | you can you can look through those find those


chunk_id: 195_chunk_39
chunk_text:
of their time if 2008.35s - 2014.07s | they if they can through the through one of their assistants or schedulers and 2014.07s - 2019.11s | don't ask you know tell them here's the thing that's been driving me nuts that's 2019.11s - 2024.03s | been eating our lunch in our community for so long. Here's you know how I 2024.03s - 2029.51s | quantify why this is just like bleeding us dry and the solutions in place 2029.51s - 2035.95s | aren't going to converge and here's you know here's my crazy idea with some data 2035.95s - 2040.91s | points showing that now and with the you know current technology you know might 2040.91s - 2045.99s | be the right time to do it. And then the other one is when you go to those what 2045.99s - 2049.07s | they're called broad agency announcements the BAA's what Stephanie 2049.07s - 2053.31s | was referencing which you know it's a few pages of what you know maybe 2053.31s - 2059.67s | somebody's looking for and then like a whole bunch of government ease you know 2059.67s - 2067.79s | you can you can look through those find those five pages use connect and it's 2067.79s - 2072.87s | not as difficult as possible. If it is difficult or are some of the new ways 2072.87s - 2078.71s | we've lifted from what we learned from CFT from what we've learned from RFT the 2078.75s - 2083.71s | different fast tracks and everything and you're still getting stuck somewhere 2083.71s - 2088.63s | because you can't fly across country to go to an industry day or there's not an 2088.63s - 2093.11s | announcement from a PM that's directly in line with your idea that doesn't 2093.11s - 2098.11s | matter tell us where you get stuck tell us what barrier it is how far you went 2098.11s - 2105.55s | tell us some ideas on how to remove it because we actually have more ability 2105.55s - 2111.55s | and just might not know that that's a barrier precluding a lot of people from 2111.55s - 2118.43s | participating and and playing and then the last part is if it's not already 2118.43s - 2122.99s | some like oh here's an announcement of a program that came out and my thing 2122.99s - 2127.27s | doesn't really fit


chunk_id: 195_chunk_40
chunk_text:
five pages use connect and it's 2067.79s - 2072.87s | not as difficult as possible. If it is difficult or are some of the new ways 2072.87s - 2078.71s | we've lifted from what we learned from CFT from what we've learned from RFT the 2078.75s - 2083.71s | different fast tracks and everything and you're still getting stuck somewhere 2083.71s - 2088.63s | because you can't fly across country to go to an industry day or there's not an 2088.63s - 2093.11s | announcement from a PM that's directly in line with your idea that doesn't 2093.11s - 2098.11s | matter tell us where you get stuck tell us what barrier it is how far you went 2098.11s - 2105.55s | tell us some ideas on how to remove it because we actually have more ability 2105.55s - 2111.55s | and just might not know that that's a barrier precluding a lot of people from 2111.55s - 2118.43s | participating and and playing and then the last part is if it's not already 2118.43s - 2122.99s | some like oh here's an announcement of a program that came out and my thing 2122.99s - 2127.27s | doesn't really fit in it call the PM's anyway there are these things called 2127.27s - 2133.39s | office BAA's which are for a whole bunch of other ideas and when you're talking 2133.55s - 2138.31s | to the PM the PM's aren't allowed to say like oh yes you know this is what I want 2138.31s - 2144.47s | or yes I will fund your idea or anything thinking everything has to be very equal 2144.47s - 2149.19s | very open very fair but you can listen for some words that might give you a 2149.19s - 2153.43s | hint that they're interested such as you know if you wanted to you know spend 2153.43s - 2157.55s | some time and propose or write up something I'd be interested you know I'd 2157.55s - 2161.79s | have the interest to read that and consider it you know and look at it so 2161.79s - 2165.71s | you know if you hear something like that that probably means you have an 2165.71s - 2170.35s | aligned PM and you know go for it if you hear somebody saying like that doesn't 2170.35s - 2174.55s | really fit in with what I'm doing you


chunk_id: 195_chunk_41
chunk_text:
in it call the PM's anyway there are these things called 2127.27s - 2133.39s | office BAA's which are for a whole bunch of other ideas and when you're talking 2133.55s - 2138.31s | to the PM the PM's aren't allowed to say like oh yes you know this is what I want 2138.31s - 2144.47s | or yes I will fund your idea or anything thinking everything has to be very equal 2144.47s - 2149.19s | very open very fair but you can listen for some words that might give you a 2149.19s - 2153.43s | hint that they're interested such as you know if you wanted to you know spend 2153.43s - 2157.55s | some time and propose or write up something I'd be interested you know I'd 2157.55s - 2161.79s | have the interest to read that and consider it you know and look at it so 2161.79s - 2165.71s | you know if you hear something like that that probably means you have an 2165.71s - 2170.35s | aligned PM and you know go for it if you hear somebody saying like that doesn't 2170.35s - 2174.55s | really fit in with what I'm doing you know then maybe you know you couldn't 2174.55s - 2178.07s | you know look for the next PM or look for the next area so there aren't as 2178.07s - 2182.59s | many barriers as possible we're trying to remove as many make use of the PM's 2182.59s - 2188.11s | call tell us where we can do better and make sure it's solving something that 2188.11s - 2193.19s | matters to you and gives back to your community and your interest we'll figure 2193.19s - 2197.55s | out if it's something that the DOD has also they will have that problem also 2197.55s - 2201.19s | even if they don't know about it and that's where DARPA comes into play but 2201.19s - 2206.95s | we should be a resource to the community and you know any parts of the government 2206.95s - 2211.15s | shouldn't be in my personal opinion going around and just take take take 2211.15s - 2214.03s | this looks like a neat community take take take you know what ideas do you 2214.03s - 2217.79s | have for us it should be bi-directional and it should be in the areas that are 2217.79s -


chunk_id: 195_chunk_42
chunk_text:
know then maybe you know you couldn't 2174.55s - 2178.07s | you know look for the next PM or look for the next area so there aren't as 2178.07s - 2182.59s | many barriers as possible we're trying to remove as many make use of the PM's 2182.59s - 2188.11s | call tell us where we can do better and make sure it's solving something that 2188.11s - 2193.19s | matters to you and gives back to your community and your interest we'll figure 2193.19s - 2197.55s | out if it's something that the DOD has also they will have that problem also 2197.55s - 2201.19s | even if they don't know about it and that's where DARPA comes into play but 2201.19s - 2206.95s | we should be a resource to the community and you know any parts of the government 2206.95s - 2211.15s | shouldn't be in my personal opinion going around and just take take take 2211.15s - 2214.03s | this looks like a neat community take take take you know what ideas do you 2214.03s - 2217.79s | have for us it should be bi-directional and it should be in the areas that are 2217.79s - 2223.63s | naturally aligned neither group trying to change the other into you know a mold 2223.63s - 2228.59s | of what it expects it to be stay who you are I don't want you to change I want 2228.59s - 2232.31s | you to keep growing in the direction that you're already growing and the same 2232.31s - 2235.79s | way you know I do you know there are plenty of ways for the government to 2235.79s - 2240.51s | change but that's not the game that we're playing right here you know I 2240.51s - 2244.43s | think you might you really highlight a lot of the roles that a PM has and 2244.43s - 2249.07s | finding that PM champion is such a key part of I think being successful at an 2249.07s - 2253.91s | ARPA but one of the roles of a PM is is often to coach the community I've 2253.91s - 2258.43s | learned over time so how should you be thinking about the problem at ARPA-H a 2258.43s - 2262.75s | lot of people don't know what even DARPA is and in the healthcare sector so it's 2262.75s - 2266.79s | having


chunk_id: 195_chunk_43
chunk_text:
2223.63s | naturally aligned neither group trying to change the other into you know a mold 2223.63s - 2228.59s | of what it expects it to be stay who you are I don't want you to change I want 2228.59s - 2232.31s | you to keep growing in the direction that you're already growing and the same 2232.31s - 2235.79s | way you know I do you know there are plenty of ways for the government to 2235.79s - 2240.51s | change but that's not the game that we're playing right here you know I 2240.51s - 2244.43s | think you might you really highlight a lot of the roles that a PM has and 2244.43s - 2249.07s | finding that PM champion is such a key part of I think being successful at an 2249.07s - 2253.91s | ARPA but one of the roles of a PM is is often to coach the community I've 2253.91s - 2258.43s | learned over time so how should you be thinking about the problem at ARPA-H a 2258.43s - 2262.75s | lot of people don't know what even DARPA is and in the healthcare sector so it's 2262.75s - 2266.79s | having folks think about what does that future look like 10 15 years from now 2266.79s - 2271.39s | and how should you be thinking about that problem for us we don't have the 2271.39s - 2274.99s | Department of Defense as our ultimate second buyer we're we're almost 2274.99s - 2278.75s | exclusively reliant on industry so we have it we have a different challenge at 2278.75s - 2282.51s | ARPA-H but we have to help industry think about where we should be going and 2282.51s - 2287.15s | so from your perspective where should how should industry be thinking about 2287.15s - 2291.51s | cyber and in general where are we going and and how should they be thinking 2291.51s - 2299.35s | about the path that we're on so and I'm gonna have a similar one back to you for 2299.35s - 2303.71s | industry I think industry you know this is gonna be much and this is gonna be 2303.71s - 2307.35s | the whole like well it's why we hired him we knew he'd go off the rails at 2307.35s - 2312.31s | some point I think the industry is perfectly happy in this perverse steady


chunk_id: 195_chunk_44
chunk_text:
folks think about what does that future look like 10 15 years from now 2266.79s - 2271.39s | and how should you be thinking about that problem for us we don't have the 2271.39s - 2274.99s | Department of Defense as our ultimate second buyer we're we're almost 2274.99s - 2278.75s | exclusively reliant on industry so we have it we have a different challenge at 2278.75s - 2282.51s | ARPA-H but we have to help industry think about where we should be going and 2282.51s - 2287.15s | so from your perspective where should how should industry be thinking about 2287.15s - 2291.51s | cyber and in general where are we going and and how should they be thinking 2291.51s - 2299.35s | about the path that we're on so and I'm gonna have a similar one back to you for 2299.35s - 2303.71s | industry I think industry you know this is gonna be much and this is gonna be 2303.71s - 2307.35s | the whole like well it's why we hired him we knew he'd go off the rails at 2307.35s - 2312.31s | some point I think the industry is perfectly happy in this perverse steady 2312.31s - 2317.17s | state situation where we are because you know the the vulnerabilities we keep 2317.17s - 2320.99s | writing vulnerabilities faster than we can fix them it's not so much that the 2320.99s - 2325.59s | adversary has gotten so amazing it's that you know like wow well we're 2325.59s - 2329.79s | producing software more and more rapidly and with the same classes of 2329.79s - 2333.95s | vulnerabilities over and over and over again so there's not an incentive 2333.95s - 2338.87s | structure really in place for them to you know go change something if they're 2338.87s - 2344.11s | not the one owning the cost of fixing it that's us the customers or the end users 2344.11s - 2348.51s | but it is someplace where like if DARPA went in and magically made everything go 2348.51s - 2353.91s | away you know I'd be fascinated to say like okay hey why are we throwing all 2353.99s - 2358.99s | those crashes that we can't turn into RCEs in our fuzzing on the ground it 2358.99s - 2363.91s | could be that they're actually even more valuable than remote code because if the 2363.91s


chunk_id: 195_chunk_45
chunk_text:
2312.31s - 2317.17s | state situation where we are because you know the the vulnerabilities we keep 2317.17s - 2320.99s | writing vulnerabilities faster than we can fix them it's not so much that the 2320.99s - 2325.59s | adversary has gotten so amazing it's that you know like wow well we're 2325.59s - 2329.79s | producing software more and more rapidly and with the same classes of 2329.79s - 2333.95s | vulnerabilities over and over and over again so there's not an incentive 2333.95s - 2338.87s | structure really in place for them to you know go change something if they're 2338.87s - 2344.11s | not the one owning the cost of fixing it that's us the customers or the end users 2344.11s - 2348.51s | but it is someplace where like if DARPA went in and magically made everything go 2348.51s - 2353.91s | away you know I'd be fascinated to say like okay hey why are we throwing all 2353.99s - 2358.99s | those crashes that we can't turn into RCEs in our fuzzing on the ground it 2358.99s - 2363.91s | could be that they're actually even more valuable than remote code because if the 2363.91s - 2368.19s | system turns off at just the right time it can turn back on without leaving 2368.19s - 2373.51s | permanent damage isn't that kind of one like the the dreams of cyber that like 2373.51s - 2376.87s | you know you look at look at a drone I don't care about taking over the drone I 2376.87s - 2380.43s | just would rather it not drop something bad on me right now so let's turn that 2380.43s - 2386.55s | thing off or you know if I wanted to look at all of the software as a service 2386.55s - 2391.59s | look at all of AWS or GCE or anything else it's a systems of systems of 2391.59s - 2397.39s | systems with wild layers of redundancy in different ways and upsetting one part 2397.39s - 2401.95s | of the system causes it to reroute and change in different ways that might be 2401.95s - 2408.23s | invisible to the end user but might be very advantageous to either a defender 2408.23s - 2414.47s | or an attacker so it's this what is the larger system is it side channels is it 2414.47s - 2418.91s |


chunk_id: 195_chunk_46
chunk_text:
- 2368.19s | system turns off at just the right time it can turn back on without leaving 2368.19s - 2373.51s | permanent damage isn't that kind of one like the the dreams of cyber that like 2373.51s - 2376.87s | you know you look at look at a drone I don't care about taking over the drone I 2376.87s - 2380.43s | just would rather it not drop something bad on me right now so let's turn that 2380.43s - 2386.55s | thing off or you know if I wanted to look at all of the software as a service 2386.55s - 2391.59s | look at all of AWS or GCE or anything else it's a systems of systems of 2391.59s - 2397.39s | systems with wild layers of redundancy in different ways and upsetting one part 2397.39s - 2401.95s | of the system causes it to reroute and change in different ways that might be 2401.95s - 2408.23s | invisible to the end user but might be very advantageous to either a defender 2408.23s - 2414.47s | or an attacker so it's this what is the larger system is it side channels is it 2414.47s - 2418.91s | the fact that it moves into a different realm are you looking at it from like 2418.91s - 2423.07s | two layers higher than you ever thought of before or are you looking at it three 2423.07s - 2428.83s | layers lower because your phone has like 35 different CPUs and operating systems 2428.83s - 2434.67s | and shells inside of it etc so what happens if you know the adversary gets a 2434.67s - 2439.59s | turn and why don't we figure out that turn first and like you know let's box 2439.59s - 2451.39s | them in so my final question to the two of you is you're both in charge of 2451.39s - 2459.51s | agencies with really broad mandates well I'll just say broad areas of interest 2459.67s - 2470.91s | and execution and challenges two parts to this question one even how broad they 2470.91s - 2475.51s | are what's something further outside of that realm that you're like this is 2475.51s - 2478.83s | relevant and we should probably be considering that this might be within 2478.83s - 2486.27s | our domain and then two if it was just you Stephanie or Renee I


chunk_id: 195_chunk_47
chunk_text:
the fact that it moves into a different realm are you looking at it from like 2418.91s - 2423.07s | two layers higher than you ever thought of before or are you looking at it three 2423.07s - 2428.83s | layers lower because your phone has like 35 different CPUs and operating systems 2428.83s - 2434.67s | and shells inside of it etc so what happens if you know the adversary gets a 2434.67s - 2439.59s | turn and why don't we figure out that turn first and like you know let's box 2439.59s - 2451.39s | them in so my final question to the two of you is you're both in charge of 2451.39s - 2459.51s | agencies with really broad mandates well I'll just say broad areas of interest 2459.67s - 2470.91s | and execution and challenges two parts to this question one even how broad they 2470.91s - 2475.51s | are what's something further outside of that realm that you're like this is 2475.51s - 2478.83s | relevant and we should probably be considering that this might be within 2478.83s - 2486.27s | our domain and then two if it was just you Stephanie or Renee I get to call her 2486.27s - 2493.67s | Stephanie as opposed to you Tyro or dr. Tom I'm gonna beat that out of you at 2493.67s - 2501.03s | some point oh yeah yeah is a what is it you personally if there were no 2501.03s - 2506.79s | boundaries is something that you're just like I would love to entertain or go 2506.79s - 2512.83s | after this particular you know bizarre problem that nobody else seems to see 2512.83s - 2522.25s | but I see it coming around the corner so maybe back to where we started on DNA 2522.25s - 2526.57s | as a programming language so if we look 10 or 15 years from now we don't have a 2526.57s - 2530.65s | program on this I would love to find somebody excited about this but you know 2530.65s - 2534.61s | thinking about large language models every gene has a beginning a middle and 2534.61s - 2538.17s | an end there's contacts to those sentences there's predictions we can do 2538.17s - 2544.01s | and we don't have a lot of control of that biological domain we're through 2544.01s - 2547.33s | gene editing through


chunk_id: 195_chunk_48
chunk_text:
get to call her 2486.27s - 2493.67s | Stephanie as opposed to you Tyro or dr. Tom I'm gonna beat that out of you at 2493.67s - 2501.03s | some point oh yeah yeah is a what is it you personally if there were no 2501.03s - 2506.79s | boundaries is something that you're just like I would love to entertain or go 2506.79s - 2512.83s | after this particular you know bizarre problem that nobody else seems to see 2512.83s - 2522.25s | but I see it coming around the corner so maybe back to where we started on DNA 2522.25s - 2526.57s | as a programming language so if we look 10 or 15 years from now we don't have a 2526.57s - 2530.65s | program on this I would love to find somebody excited about this but you know 2530.65s - 2534.61s | thinking about large language models every gene has a beginning a middle and 2534.61s - 2538.17s | an end there's contacts to those sentences there's predictions we can do 2538.17s - 2544.01s | and we don't have a lot of control of that biological domain we're through 2544.01s - 2547.33s | gene editing through other genetic therapies we're just starting to do 2547.33s - 2551.73s | create the tools that that we can control and manipulate genes we can 2551.73s - 2556.69s | measure genes at scale and to do so in a cost-effective manner but how are we 2556.69s - 2560.29s | thinking about predicting that obviously for good but at the same time you know 2560.29s - 2565.81s | preventing malicious use of those technologies and I am so excited we have 2565.81s - 2569.41s | some little investments at our page looking at this now we have a program 2569.41s - 2573.45s | called apex that's focused on using generative AI to create you know new to 2573.45s - 2578.17s | this Earth's sequences that could be antigens to take all the other viruses 2578.17s - 2582.17s | that we don't yet have vaccines for off the table or to create you know new 2582.17s - 2586.01s | sequences to make new medicines and diagnostics and so I'm really excited to 2586.01s - 2590.85s | unlock that moving forward I'd love to hear what you are focused on Stephanie 2590.85s - 2596.21s | well I mean I'll take the bait I'll


chunk_id: 195_chunk_49
chunk_text:
other genetic therapies we're just starting to do 2547.33s - 2551.73s | create the tools that that we can control and manipulate genes we can 2551.73s - 2556.69s | measure genes at scale and to do so in a cost-effective manner but how are we 2556.69s - 2560.29s | thinking about predicting that obviously for good but at the same time you know 2560.29s - 2565.81s | preventing malicious use of those technologies and I am so excited we have 2565.81s - 2569.41s | some little investments at our page looking at this now we have a program 2569.41s - 2573.45s | called apex that's focused on using generative AI to create you know new to 2573.45s - 2578.17s | this Earth's sequences that could be antigens to take all the other viruses 2578.17s - 2582.17s | that we don't yet have vaccines for off the table or to create you know new 2582.17s - 2586.01s | sequences to make new medicines and diagnostics and so I'm really excited to 2586.01s - 2590.85s | unlock that moving forward I'd love to hear what you are focused on Stephanie 2590.85s - 2596.21s | well I mean I'll take the bait I'll ask your second question first I mean if it 2596.21s - 2600.05s | was just me I would be working on supply chain challenges my training I'm 2600.05s - 2603.85s | actually a geologist I know where the raw materials come from I know where 2603.85s - 2606.77s | they don't come from and I know all of the vulnerabilities in that really 2606.77s - 2610.89s | complex system that the world depends on but you know what there's a whole point 2610.89s - 2615.13s | about DARPA and ARPA is it actually like what I think is really exciting isn't 2615.13s - 2617.49s | that important it's what our program managers tell us it's what the 2617.49s - 2621.81s | communities are telling us an example of one that I'm particularly fascinated 2621.81s - 2625.65s | right now actually has to do with the future of quantum computing it is still 2625.65s - 2629.13s | pretty much on the knife's edge as to whether this is going to be one of the 2629.13s - 2635.61s | most transformative things for humanity ever or utterly useless and while lots 2635.61s - 2639.05s | of people are working on quantum computing


chunk_id: 195_chunk_50
chunk_text:
ask your second question first I mean if it 2596.21s - 2600.05s | was just me I would be working on supply chain challenges my training I'm 2600.05s - 2603.85s | actually a geologist I know where the raw materials come from I know where 2603.85s - 2606.77s | they don't come from and I know all of the vulnerabilities in that really 2606.77s - 2610.89s | complex system that the world depends on but you know what there's a whole point 2610.89s - 2615.13s | about DARPA and ARPA is it actually like what I think is really exciting isn't 2615.13s - 2617.49s | that important it's what our program managers tell us it's what the 2617.49s - 2621.81s | communities are telling us an example of one that I'm particularly fascinated 2621.81s - 2625.65s | right now actually has to do with the future of quantum computing it is still 2625.65s - 2629.13s | pretty much on the knife's edge as to whether this is going to be one of the 2629.13s - 2635.61s | most transformative things for humanity ever or utterly useless and while lots 2635.61s - 2639.05s | of people are working on quantum computing not a lot of people are asking 2639.05s - 2643.65s | those hard questions as to how we will actually know which side of the fence 2643.65s - 2647.97s | the technology is going to fall so we're really trying to address that kind of 2647.97s - 2653.05s | question and the bottom line is that there is no shortage of massively hard 2653.05s - 2657.29s | problems to solve and amazing technological opportunities so I am very 2657.29s - 2661.05s | cleverly going to bring this back to our original point which is the ideas 2661.05s - 2665.81s | are going to come from people like you and we really hope that you aren't shy 2665.81s - 2670.89s | about telling us what you think they are so and how to solve them exactly yeah 2670.89s - 2679.21s | with your ideas and you as the performer hopefully 32 seconds to spare so thank 2679.21s - 2683.21s | you again for your time and your attention thanks everybody


chunk_id: 195_chunk_51
chunk_text:
not a lot of people are asking 2639.05s - 2643.65s | those hard questions as to how we will actually know which side of the fence 2643.65s - 2647.97s | the technology is going to fall so we're really trying to address that kind of 2647.97s - 2653.05s | question and the bottom line is that there is no shortage of massively hard 2653.05s - 2657.29s | problems to solve and amazing technological opportunities so I am very 2657.29s - 2661.05s | cleverly going to bring this back to our original point which is the ideas 2661.05s - 2665.81s | are going to come from people like you and we really hope that you aren't shy 2665.81s - 2670.89s | about telling us what you think they are so and how to solve them exactly yeah 2670.89s - 2679.21s | with your ideas and you as the performer hopefully 32 seconds to spare so thank 2679.21s - 2683.21s | you again for your time and your attention thanks everybody


chunk_id: 196_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=TUbpJ-voI8Y", "title": "DEF CON 32 - Fireside Chat - The Dark Tangent and DNSA Anne Neuberger", "description": "This fireside chat will feature an in depth conversation between DNSA Neuberger and Dark Tangent on a variety of cybersecurity and emerging technology topics such as artificial intelligence and quantum computing. DNSA Neuberger has served in a variety of senior intelligence and cybersecurity roles within the National Security Agency, including Director of NSA\u2019s cybersecurity organization and Deputy Director of NSA\u2019s intelligence operations. She has also held multiple positions at the Department of Defense and the private sector, and now leads development of the Biden Administration\u2019s policies on cybersecurity and emerging technologies from the White House. She and DT will delve into the latest and most pressing issues in these domains that concern the White House and how hackers can influence tech-related discussions to improve policy and operational outcomes.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2483, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.00s | This text was transcribed using whisper model: large-v2 Okay, while they're trying to figure out microphone four, I'm going to just give you a little bit of background. 5.00s - 15.02s | At the federal level, there's stuff happening all the time. And so the best laid plans always fall apart. 15.02s - 22.02s | And so we were fully prepared for Anne to graciously turn down our invitation this year. 22.02s - 29.02s | And surprise, she didn't. Everything worked out this year. All the stars aligned for Anne to attend, 29.02s - 34.02s | which is really awesome, because if you've been following DEF CON for a while, 34.02s - 39.02s | we've had speakers from CISA, speakers from NSA, speakers from other agencies. 39.02s - 48.02s | But we have never had a speaker in the White House, you know, Deputy National Security Advisor, cyber. 48.02s - 55.02s | It's just the people are very busy. So I'm really, I'm really excited you made it. 55.02s - 64.02s | And so we've got some topics we're going to talk about, but I think really it's an opportunity for us to hear Anne's perspective. 64.02s - 72.02s | And then for Anne to kind of tell us her perspective from sitting in her position, where she sees things going. 72.02s - 77.02s | And then hopefully we'll have an interesting conversation and we can all learn


chunk_id: 196_chunk_1
chunk_text:
happening all the time. And so the best laid plans always fall apart. 15.02s - 22.02s | And so we were fully prepared for Anne to graciously turn down our invitation this year. 22.02s - 29.02s | And surprise, she didn't. Everything worked out this year. All the stars aligned for Anne to attend, 29.02s - 34.02s | which is really awesome, because if you've been following DEF CON for a while, 34.02s - 39.02s | we've had speakers from CISA, speakers from NSA, speakers from other agencies. 39.02s - 48.02s | But we have never had a speaker in the White House, you know, Deputy National Security Advisor, cyber. 48.02s - 55.02s | It's just the people are very busy. So I'm really, I'm really excited you made it. 55.02s - 64.02s | And so we've got some topics we're going to talk about, but I think really it's an opportunity for us to hear Anne's perspective. 64.02s - 72.02s | And then for Anne to kind of tell us her perspective from sitting in her position, where she sees things going. 72.02s - 77.02s | And then hopefully we'll have an interesting conversation and we can all learn a bit. 77.02s - 81.02s | So let's see, do they have the, are you set up now? 81.02s - 86.02s | Folks hear me now? We're actively working on it. We just tested it. 86.02s - 89.02s | They're working on it still. OK. 89.02s - 95.02s | Standard tech challenges in our lives. 95.02s - 106.02s | So maybe I'll, since you can't speak, I have the advantage. This is purely accidental. 106.02s - 112.02s | I guess I'll start with maybe a second topic. I was going to, we were going to bring up the different teams. 112.02s - 116.02s | But since it requires a little bit of me speaking, I'll do it now. 116.02s - 123.02s | One of the things I've been noticing for a number of years, and I've spoken about it, is this idea of sort of a, there's sort of a team rule of law, 123.02s - 130.02s | a sort of team authoritarian or team autocrat, whatever you want to say. 131.02s - 137.02s | There's a group of undecided nations that are being influenced by rule of law nations. 137.02s - 140.02s | We're trying to get them on


chunk_id: 196_chunk_2
chunk_text:
a bit. 77.02s - 81.02s | So let's see, do they have the, are you set up now? 81.02s - 86.02s | Folks hear me now? We're actively working on it. We just tested it. 86.02s - 89.02s | They're working on it still. OK. 89.02s - 95.02s | Standard tech challenges in our lives. 95.02s - 106.02s | So maybe I'll, since you can't speak, I have the advantage. This is purely accidental. 106.02s - 112.02s | I guess I'll start with maybe a second topic. I was going to, we were going to bring up the different teams. 112.02s - 116.02s | But since it requires a little bit of me speaking, I'll do it now. 116.02s - 123.02s | One of the things I've been noticing for a number of years, and I've spoken about it, is this idea of sort of a, there's sort of a team rule of law, 123.02s - 130.02s | a sort of team authoritarian or team autocrat, whatever you want to say. 131.02s - 137.02s | There's a group of undecided nations that are being influenced by rule of law nations. 137.02s - 140.02s | We're trying to get them on our side. 140.02s - 150.02s | Authoritarians are trying to bargain with these undecided countries, wherever they may be, Africa, Central America, trying to get them on their side, see the world through their lens. 150.02s - 154.02s | And what's happening is we're going through sort of a slow motion sorting process. 154.02s - 156.02s | Are you on our side? Are you on their side? 157.02s - 163.02s | And with tech, that's sort of accelerating. Are you picking our tech stack or their tech stack? 163.02s - 166.02s | Are you letting them into our app store or their app store, right? 166.02s - 175.02s | And you can sort of see this sorting at a tech level happening in Russia right now, with due to the Ukrainian war, not going so well right now for Russia. 175.02s - 178.02s | A lot of videos are on YouTube. 179.02s - 187.02s | Russia is now tallying their tech industries, filter YouTube, slow it down, move everybody over to our YouTube, right? 187.02s - 195.02s | So the Russian government is sorting the Russian citizens into picking the Russian tech stack. 195.02s - 198.02s | And I think


chunk_id: 196_chunk_3
chunk_text:
our side. 140.02s - 150.02s | Authoritarians are trying to bargain with these undecided countries, wherever they may be, Africa, Central America, trying to get them on their side, see the world through their lens. 150.02s - 154.02s | And what's happening is we're going through sort of a slow motion sorting process. 154.02s - 156.02s | Are you on our side? Are you on their side? 157.02s - 163.02s | And with tech, that's sort of accelerating. Are you picking our tech stack or their tech stack? 163.02s - 166.02s | Are you letting them into our app store or their app store, right? 166.02s - 175.02s | And you can sort of see this sorting at a tech level happening in Russia right now, with due to the Ukrainian war, not going so well right now for Russia. 175.02s - 178.02s | A lot of videos are on YouTube. 179.02s - 187.02s | Russia is now tallying their tech industries, filter YouTube, slow it down, move everybody over to our YouTube, right? 187.02s - 195.02s | So the Russian government is sorting the Russian citizens into picking the Russian tech stack. 195.02s - 198.02s | And I think this is becoming more explicit. 198.02s - 207.02s | And so that means we're in a sorting war kind of, and we should probably be engaged and we should think about it and not make it easy for our adversaries to sort our friends away. 207.02s - 215.02s | And that means that, you know, we don't have to agree with all of our rule of law friends, partners, allies. 215.02s - 219.02s | It's sort of like you're on a team. That's why it's called a team. 219.02s - 226.02s | You don't always agree with your teammates. You don't always play the sport the same way, but you're all working sort of together. 227.02s - 237.02s | And anyway, so one of my questions to Anne, once we got going and her microphone was working, was going to be about, you know, how do you think about this? 237.02s - 241.02s | I'm sure you use different language. I'm sure at the national level they have different concepts. 241.02s - 249.02s | But as an outsider, it's sort of, it seems like something's going on internationally and in tech, and we don't want it to happen to us.


chunk_id: 196_chunk_4
chunk_text:
this is becoming more explicit. 198.02s - 207.02s | And so that means we're in a sorting war kind of, and we should probably be engaged and we should think about it and not make it easy for our adversaries to sort our friends away. 207.02s - 215.02s | And that means that, you know, we don't have to agree with all of our rule of law friends, partners, allies. 215.02s - 219.02s | It's sort of like you're on a team. That's why it's called a team. 219.02s - 226.02s | You don't always agree with your teammates. You don't always play the sport the same way, but you're all working sort of together. 227.02s - 237.02s | And anyway, so one of my questions to Anne, once we got going and her microphone was working, was going to be about, you know, how do you think about this? 237.02s - 241.02s | I'm sure you use different language. I'm sure at the national level they have different concepts. 241.02s - 249.02s | But as an outsider, it's sort of, it seems like something's going on internationally and in tech, and we don't want it to happen to us. 249.02s - 252.02s | We want to have a seat at the wheel. 252.02s - 255.02s | So are they got you going yet? 256.02s - 259.02s | Nothing working. I'll just give you my mic. 263.02s - 265.02s | I found the microphone. 268.02s - 269.02s | Yeah, I'll be right over here. 270.02s - 272.02s | Hey, I'm going to do this, folks. 273.02s - 275.02s | Move the microphone up a little bit. 278.02s - 282.02s | This is a community that knows whatever it takes to get the job done. 283.02s - 284.02s | So first, it's wonderful to be here. 285.02s - 293.40s | The year I come is this year. So that bottle is a good challenge. 294.40s - 300.40s | It's wonderful to be here. Jeff noted why I was here. I'm really here because we need this community. 301.40s - 307.40s | Whether we think about the CrowdStrike incident, which showed us gaps in digital resilience. 307.40s - 314.40s | Whether we look at the hacks we see from the Iranians and the Russians against water infrastructure, power infrastructure in the United States. 314.40s - 324.40s | Or frankly, whether we look


chunk_id: 196_chunk_5
chunk_text:
249.02s - 252.02s | We want to have a seat at the wheel. 252.02s - 255.02s | So are they got you going yet? 256.02s - 259.02s | Nothing working. I'll just give you my mic. 263.02s - 265.02s | I found the microphone. 268.02s - 269.02s | Yeah, I'll be right over here. 270.02s - 272.02s | Hey, I'm going to do this, folks. 273.02s - 275.02s | Move the microphone up a little bit. 278.02s - 282.02s | This is a community that knows whatever it takes to get the job done. 283.02s - 284.02s | So first, it's wonderful to be here. 285.02s - 293.40s | The year I come is this year. So that bottle is a good challenge. 294.40s - 300.40s | It's wonderful to be here. Jeff noted why I was here. I'm really here because we need this community. 301.40s - 307.40s | Whether we think about the CrowdStrike incident, which showed us gaps in digital resilience. 307.40s - 314.40s | Whether we look at the hacks we see from the Iranians and the Russians against water infrastructure, power infrastructure in the United States. 314.40s - 324.40s | Or frankly, whether we look at on any given week, I get a call from our situation room with a ransomware attack, usually by folks based in Russia, that disrupts the hospital. 325.40s - 330.40s | When a hospital is disrupted, that's canceled medical services, that's ambulances turned away. 331.40s - 335.40s | It's impact on real people, particularly in communities where there's only one hospital. 336.40s - 344.40s | As we live really, really digital lives, the disruption in those lives touches people every single day. 345.40s - 350.40s | Kids at school, people who really need hospital medical services, and all around the world as well. 351.40s - 354.40s | So being here is a privilege to have a chance to talk to this community. 355.40s - 360.40s | We're trying to make this cozy, and talk to this community. So it's wonderful to be here. 361.40s - 364.40s | So, you mentioned CrowdStrike. 365.40s - 379.40s | And so, you're sitting at the job, and you get messages saying, oh no, airports are down, and trends, all these things are happening because of the CrowdStrike problem. 380.40s - 381.40s | But you don't know it's the CrowdStrike problem yet. 382.40s - 383.40s


chunk_id: 196_chunk_6
chunk_text:
at on any given week, I get a call from our situation room with a ransomware attack, usually by folks based in Russia, that disrupts the hospital. 325.40s - 330.40s | When a hospital is disrupted, that's canceled medical services, that's ambulances turned away. 331.40s - 335.40s | It's impact on real people, particularly in communities where there's only one hospital. 336.40s - 344.40s | As we live really, really digital lives, the disruption in those lives touches people every single day. 345.40s - 350.40s | Kids at school, people who really need hospital medical services, and all around the world as well. 351.40s - 354.40s | So being here is a privilege to have a chance to talk to this community. 355.40s - 360.40s | We're trying to make this cozy, and talk to this community. So it's wonderful to be here. 361.40s - 364.40s | So, you mentioned CrowdStrike. 365.40s - 379.40s | And so, you're sitting at the job, and you get messages saying, oh no, airports are down, and trends, all these things are happening because of the CrowdStrike problem. 380.40s - 381.40s | But you don't know it's the CrowdStrike problem yet. 382.40s - 383.40s | Thank you. 383.40s - 389.40s | Doesn't that look a lot like the preparatory moves that China might make before going for Taiwan? 390.40s - 395.40s | Like you're disrupting air traffic, you can't have military transport authority going. 396.40s - 400.40s | In those unknown moments, what's going through your head? 401.40s - 407.40s | How do you quickly realize, no, no, it's a mistake, it's not a preparatory move? 408.40s - 416.40s | Because it seems like, well, the tech industry has gotten us to a point now where bad deployment can look a lot like the prelude to an invasion. 417.40s - 418.40s | That's not a place you want to be in. 419.40s - 423.40s | And you know, it's really interesting, because there's two parts to my job. 424.40s - 430.40s | Which is really the reason the President, my job has been the first time that in the White House, they have somebody who works in the National Security Council. 430.40s - 437.40s | And the National Security Council typically focuses on, as it sounds, national security threats, who focuses on cyber and emerging tech. 438.40s - 440.40s | And really the reason


chunk_id: 196_chunk_7
chunk_text:
| Thank you. 383.40s - 389.40s | Doesn't that look a lot like the preparatory moves that China might make before going for Taiwan? 390.40s - 395.40s | Like you're disrupting air traffic, you can't have military transport authority going. 396.40s - 400.40s | In those unknown moments, what's going through your head? 401.40s - 407.40s | How do you quickly realize, no, no, it's a mistake, it's not a preparatory move? 408.40s - 416.40s | Because it seems like, well, the tech industry has gotten us to a point now where bad deployment can look a lot like the prelude to an invasion. 417.40s - 418.40s | That's not a place you want to be in. 419.40s - 423.40s | And you know, it's really interesting, because there's two parts to my job. 424.40s - 430.40s | Which is really the reason the President, my job has been the first time that in the White House, they have somebody who works in the National Security Council. 430.40s - 437.40s | And the National Security Council typically focuses on, as it sounds, national security threats, who focuses on cyber and emerging tech. 438.40s - 440.40s | And really the reason was the question you just asked. 441.40s - 442.40s | Because there's two parts to every problem. 443.40s - 444.40s | One is us, and one is them. 445.40s - 447.40s | And us is, how is this attack successful? 448.40s - 452.40s | And how do we quickly assess the impact and accelerate recovery? 453.40s - 457.40s | Because we can't have disruption of the most important things in Americans' lives. 457.40s - 459.40s | The second part is them. 460.40s - 461.40s | Who is the actor? 462.40s - 465.40s | Is it a criminal, is it a country, or a set of criminals, a set of countries? 466.40s - 471.40s | And then our goal overall is, how do we respond to deter the next attack? 472.40s - 473.40s | And that's really hard in cyberspace. 474.40s - 476.40s | First, because attribution is often hard. 477.40s - 484.40s | Second, because, okay, so if Russia-based ransomware attackers disrupted a hospital chain, right? 484.40s - 492.40s | Ascension Health, a number of months ago, multiple hospitals across multiple states, took them almost six weeks to recover from that ransomware attack. 493.40s - 494.40s | What's the deterrence?


chunk_id: 196_chunk_8
chunk_text:
was the question you just asked. 441.40s - 442.40s | Because there's two parts to every problem. 443.40s - 444.40s | One is us, and one is them. 445.40s - 447.40s | And us is, how is this attack successful? 448.40s - 452.40s | And how do we quickly assess the impact and accelerate recovery? 453.40s - 457.40s | Because we can't have disruption of the most important things in Americans' lives. 457.40s - 459.40s | The second part is them. 460.40s - 461.40s | Who is the actor? 462.40s - 465.40s | Is it a criminal, is it a country, or a set of criminals, a set of countries? 466.40s - 471.40s | And then our goal overall is, how do we respond to deter the next attack? 472.40s - 473.40s | And that's really hard in cyberspace. 474.40s - 476.40s | First, because attribution is often hard. 477.40s - 484.40s | Second, because, okay, so if Russia-based ransomware attackers disrupted a hospital chain, right? 484.40s - 492.40s | Ascension Health, a number of months ago, multiple hospitals across multiple states, took them almost six weeks to recover from that ransomware attack. 493.40s - 494.40s | What's the deterrence? 495.40s - 500.40s | From an individual perspective, right, there isn't law enforcement cooperation today between the U.S. and Russia. 501.40s - 507.40s | From an infrastructure perspective, we've done takedowns of infrastructure, often with partners around the world. 508.40s - 512.40s | They're temporary. There's so much vulnerable infrastructure that attackers can use in the second round. 512.40s - 513.40s | And what's driving it? 514.40s - 516.40s | It's often cryptocurrency and getting paid. 517.40s - 520.40s | In 2023 alone, there's $1.3 billion paid in ransoms. 521.40s - 529.40s | And we can talk at length about cryptocurrency and what we see it enabling from money laundering to sanctions evasions in the North Korean context. 530.40s - 534.40s | But it's really hard when you start unpacking the problem and you say, how do you deter it? 535.40s - 538.40s | And this actually played out just this week, folks may have seen, at the U.N. 539.40s - 541.40s | There's a global discussion on a new U.N. cybercrimes treaty. 542.40s - 543.40s | It would be the first one ever. 544.40s - 558.40s | And navigating both civil society and human rights groups who say, anything


chunk_id: 196_chunk_9
chunk_text:
495.40s - 500.40s | From an individual perspective, right, there isn't law enforcement cooperation today between the U.S. and Russia. 501.40s - 507.40s | From an infrastructure perspective, we've done takedowns of infrastructure, often with partners around the world. 508.40s - 512.40s | They're temporary. There's so much vulnerable infrastructure that attackers can use in the second round. 512.40s - 513.40s | And what's driving it? 514.40s - 516.40s | It's often cryptocurrency and getting paid. 517.40s - 520.40s | In 2023 alone, there's $1.3 billion paid in ransoms. 521.40s - 529.40s | And we can talk at length about cryptocurrency and what we see it enabling from money laundering to sanctions evasions in the North Korean context. 530.40s - 534.40s | But it's really hard when you start unpacking the problem and you say, how do you deter it? 535.40s - 538.40s | And this actually played out just this week, folks may have seen, at the U.N. 539.40s - 541.40s | There's a global discussion on a new U.N. cybercrimes treaty. 542.40s - 543.40s | It would be the first one ever. 544.40s - 558.40s | And navigating both civil society and human rights groups who say, anything you do enables authoritarian governments to stop somebody traveling and say, hey, do you have the password to that system? 558.40s - 570.40s | On the other hand, you have countries like the United States, the U.K., Australia, Singapore, countries around the world that want to partner and work together because these are problems that have no borders. 571.40s - 578.40s | So to your point, bringing that together, the us and the them, comes together in the case of each time an incident happens. 578.40s - 583.40s | So with CrowdStrike, I happen to have been out of Washington. 584.40s - 585.40s | So my phone rings at 4 a.m. 586.40s - 587.40s | It's a situation room. 588.40s - 589.40s | They're like, hi, we need to notify you of an incident. 590.40s - 591.40s | My first call was the CEO. 592.40s - 597.40s | And as soon as he walked through what had happened, we knew it could only be either an insider or whatever. 598.40s - 599.40s | So you woke up George. 600.40s - 601.40s | I think George was up. 602.40s - 603.40s | Already awake. 604.40s - 605.40s | He was already


chunk_id: 196_chunk_10
chunk_text:
you do enables authoritarian governments to stop somebody traveling and say, hey, do you have the password to that system? 558.40s - 570.40s | On the other hand, you have countries like the United States, the U.K., Australia, Singapore, countries around the world that want to partner and work together because these are problems that have no borders. 571.40s - 578.40s | So to your point, bringing that together, the us and the them, comes together in the case of each time an incident happens. 578.40s - 583.40s | So with CrowdStrike, I happen to have been out of Washington. 584.40s - 585.40s | So my phone rings at 4 a.m. 586.40s - 587.40s | It's a situation room. 588.40s - 589.40s | They're like, hi, we need to notify you of an incident. 590.40s - 591.40s | My first call was the CEO. 592.40s - 597.40s | And as soon as he walked through what had happened, we knew it could only be either an insider or whatever. 598.40s - 599.40s | So you woke up George. 600.40s - 601.40s | I think George was up. 602.40s - 603.40s | Already awake. 604.40s - 605.40s | He was already well awake. 605.40s - 609.40s | But our first question always is in the middle of an incident, the us question. 610.40s - 612.40s | What's the impact and how do we recover as fast as possible? 613.40s - 615.40s | The second question is, who did it and what do we do about it? 616.40s - 617.40s | Because what's most important is that we recover. 618.40s - 619.40s | Right. 619.40s - 624.40s | So having that quick ability to get to the source quickly allied your concerns that it was anything else, right? 625.40s - 632.40s | So that tight connection between the need for the tight connection between private industry and government, right, you need to have a really good Rolodex. 632.40s - 636.40s | Because when something goes wrong, you need to literally get there in minutes. 637.40s - 643.40s | And it raised, honestly, it raised questions for all of the software industry because there are many. 644.40s - 650.40s | And all of us who've coded and deployed know when we see something like this happen, the first thing we say is, there but for the grace of God, go I. 651.40s -


chunk_id: 196_chunk_11
chunk_text:
well awake. 605.40s - 609.40s | But our first question always is in the middle of an incident, the us question. 610.40s - 612.40s | What's the impact and how do we recover as fast as possible? 613.40s - 615.40s | The second question is, who did it and what do we do about it? 616.40s - 617.40s | Because what's most important is that we recover. 618.40s - 619.40s | Right. 619.40s - 624.40s | So having that quick ability to get to the source quickly allied your concerns that it was anything else, right? 625.40s - 632.40s | So that tight connection between the need for the tight connection between private industry and government, right, you need to have a really good Rolodex. 632.40s - 636.40s | Because when something goes wrong, you need to literally get there in minutes. 637.40s - 643.40s | And it raised, honestly, it raised questions for all of the software industry because there are many. 644.40s - 650.40s | And all of us who've coded and deployed know when we see something like this happen, the first thing we say is, there but for the grace of God, go I. 651.40s - 658.40s | So I think in that case, it raised real questions about testing, about rollback and what's possible, what's not. 658.40s - 664.40s | About testing across an ecosystem between different companies, the cooperation that enables that. 665.40s - 672.40s | So I think that's the kind of things we're now working on with companies to say, given our lives run on this digital infrastructure, 673.40s - 680.40s | we need to have confidence that when there are updates, they're staged, they're properly tested, and they can be rolled back if something goes wrong. 681.40s - 687.40s | It's super fascinating because far enough back in time, I think it was maybe not after Slammer worm, 688.40s - 693.40s | but Microsoft wanted to move a bunch of these drivers out of the kernel. 694.40s - 697.40s | Not give access to developers, right? Ring zero or maybe ring one. 698.40s - 705.40s | And the pushback from Europeans were that was anti-competitive, market forces argument. 706.40s - 710.40s | And from antivirus vendors, it was also anti-competitive. 711.40s - 713.40s | You'll keep your stuff in the ring zero, it'll be faster, more performant. 714.40s - 716.40s |


chunk_id: 196_chunk_12
chunk_text:
658.40s | So I think in that case, it raised real questions about testing, about rollback and what's possible, what's not. 658.40s - 664.40s | About testing across an ecosystem between different companies, the cooperation that enables that. 665.40s - 672.40s | So I think that's the kind of things we're now working on with companies to say, given our lives run on this digital infrastructure, 673.40s - 680.40s | we need to have confidence that when there are updates, they're staged, they're properly tested, and they can be rolled back if something goes wrong. 681.40s - 687.40s | It's super fascinating because far enough back in time, I think it was maybe not after Slammer worm, 688.40s - 693.40s | but Microsoft wanted to move a bunch of these drivers out of the kernel. 694.40s - 697.40s | Not give access to developers, right? Ring zero or maybe ring one. 698.40s - 705.40s | And the pushback from Europeans were that was anti-competitive, market forces argument. 706.40s - 710.40s | And from antivirus vendors, it was also anti-competitive. 711.40s - 713.40s | You'll keep your stuff in the ring zero, it'll be faster, more performant. 714.40s - 716.40s | Our stuff will be at a disadvantage. 717.40s - 722.40s | So Microsoft relented and then decades later, it blows up in their face. 723.40s - 727.40s | And now the same governments are saying, why are you allowing them to do this in ring zero? 728.40s - 732.40s | Why can one vendor destroy the entire operating system and everybody else? 733.40s - 738.40s | And so it almost seems like the regulators now are starting to become more educated or more nuanced. 739.40s - 742.40s | Maybe they can understand the impacts of some of their market forces. 743.40s - 745.40s | Market force demands carry the day. 746.40s - 749.40s | Arguments around markets carry the day, but now there's arguments around security. 750.40s - 752.40s | And they have maybe more weight now. 753.40s - 756.40s | And so now you can make a better trade-off, right? 756.40s - 762.40s | So you find yourself maybe the security argument being having more weight in these discussions? 763.40s - 764.40s | It does. 765.40s - 770.40s | Or is this commerce just roll in there and say, no, you know, commerce dictates everything. 771.40s - 778.40s |


chunk_id: 196_chunk_13
chunk_text:
Our stuff will be at a disadvantage. 717.40s - 722.40s | So Microsoft relented and then decades later, it blows up in their face. 723.40s - 727.40s | And now the same governments are saying, why are you allowing them to do this in ring zero? 728.40s - 732.40s | Why can one vendor destroy the entire operating system and everybody else? 733.40s - 738.40s | And so it almost seems like the regulators now are starting to become more educated or more nuanced. 739.40s - 742.40s | Maybe they can understand the impacts of some of their market forces. 743.40s - 745.40s | Market force demands carry the day. 746.40s - 749.40s | Arguments around markets carry the day, but now there's arguments around security. 750.40s - 752.40s | And they have maybe more weight now. 753.40s - 756.40s | And so now you can make a better trade-off, right? 756.40s - 762.40s | So you find yourself maybe the security argument being having more weight in these discussions? 763.40s - 764.40s | It does. 765.40s - 770.40s | Or is this commerce just roll in there and say, no, you know, commerce dictates everything. 771.40s - 778.40s | You know, on the positive side, more and more governments and people see that policy has to move, not at the speed of tech. 779.40s - 782.40s | It would be ideal if it moved at the speed of tech, but at least much, much faster. 783.40s - 787.40s | So things that we considered five years ago or 10 years ago are totally changed, right? 788.40s - 792.40s | I was walking around and I really encourage folks to visit the DARPA's AI Cyber Challenge booth. 793.40s - 800.40s | Now when we launched the DARPA AI Cyber Challenge a year ago with DARPA, what was so exciting was to say, let's be candid. 801.40s - 803.40s | Folks on offense are already a step ahead. 804.40s - 806.40s | Because on offense, you have to find one vulnerability to exploit. 807.40s - 810.40s | On defense, you constantly have to be managing a pretty broad space. 810.40s - 820.40s | And particularly when I think of us on the government side, when I think about DOD, we have weapons programs or weapons, think submarines, satellite systems for sure that were launched 30 years ago. 821.40s - 828.40s |


chunk_id: 196_chunk_14
chunk_text:
You know, on the positive side, more and more governments and people see that policy has to move, not at the speed of tech. 779.40s - 782.40s | It would be ideal if it moved at the speed of tech, but at least much, much faster. 783.40s - 787.40s | So things that we considered five years ago or 10 years ago are totally changed, right? 788.40s - 792.40s | I was walking around and I really encourage folks to visit the DARPA's AI Cyber Challenge booth. 793.40s - 800.40s | Now when we launched the DARPA AI Cyber Challenge a year ago with DARPA, what was so exciting was to say, let's be candid. 801.40s - 803.40s | Folks on offense are already a step ahead. 804.40s - 806.40s | Because on offense, you have to find one vulnerability to exploit. 807.40s - 810.40s | On defense, you constantly have to be managing a pretty broad space. 810.40s - 820.40s | And particularly when I think of us on the government side, when I think about DOD, we have weapons programs or weapons, think submarines, satellite systems for sure that were launched 30 years ago. 821.40s - 828.40s | They're facing a modern adversary that they never considered when they built the risk models, frankly, when they built and deployed the encryption. 829.40s - 835.40s | We're in a very different world just in terms of high-performance computing advancements and encryption we may have launched 30 years ago in a satellite. 836.40s - 842.40s | So the core goal I think we have to consider on defense is tech is our helper. 843.40s - 844.40s | Tech is our partner because it's so much harder. 845.40s - 858.40s | So for example, what's so cool and I don't know where it is now, but when I passed earlier, the AI Cyber Challenge, the teams had found three vulnerabilities in open source code that you would imagine has been fuzzed, has been checked, etc. 859.40s - 865.40s | And not only that, they built a patch for at least one of them when I passed using AI models. 866.40s - 886.40s | That's remarkable because if that can bring tech to the defensive fight, to the securing fight, potentially that could change that offense-defense dynamic, which is really tough for all of us who want to build and deploy technology


chunk_id: 196_chunk_15
chunk_text:
They're facing a modern adversary that they never considered when they built the risk models, frankly, when they built and deployed the encryption. 829.40s - 835.40s | We're in a very different world just in terms of high-performance computing advancements and encryption we may have launched 30 years ago in a satellite. 836.40s - 842.40s | So the core goal I think we have to consider on defense is tech is our helper. 843.40s - 844.40s | Tech is our partner because it's so much harder. 845.40s - 858.40s | So for example, what's so cool and I don't know where it is now, but when I passed earlier, the AI Cyber Challenge, the teams had found three vulnerabilities in open source code that you would imagine has been fuzzed, has been checked, etc. 859.40s - 865.40s | And not only that, they built a patch for at least one of them when I passed using AI models. 866.40s - 886.40s | That's remarkable because if that can bring tech to the defensive fight, to the securing fight, potentially that could change that offense-defense dynamic, which is really tough for all of us who want to build and deploy technology that's underpinning our lives, our militaries, our banks every single day. 887.40s - 890.40s | So that's kind of maybe a good tie-in. 891.40s - 893.40s | So you've got two parts to your title, right? 894.40s - 897.40s | Maybe two hats, emerging technology and security. 898.40s - 901.40s | So when you were speaking just then, I was thinking, ah, emerging technology, AI. 902.40s - 904.40s | But you also have to wear your security hat, right? 905.40s - 906.40s | Are they ever in conflict? 909.40s - 910.40s | You know, it's interesting. 911.40s - 914.40s | So I've had the privilege of both running offensive and defensive cyber operations. 915.40s - 918.40s | Now I have to stand and be closer. 919.40s - 920.40s | Sorry about that. 921.40s - 922.40s | We'll get this. 923.40s - 925.40s | So I started to say, you heard Jeff's question. 926.40s - 928.40s | I've had the privilege of both running offensive and defensive operations. 929.40s - 942.40s | So we try very much from a defensive perspective to bring that offensive mindset to say, what's the easiest way and what's the most persistent way that an adversary


chunk_id: 196_chunk_16
chunk_text:
that's underpinning our lives, our militaries, our banks every single day. 887.40s - 890.40s | So that's kind of maybe a good tie-in. 891.40s - 893.40s | So you've got two parts to your title, right? 894.40s - 897.40s | Maybe two hats, emerging technology and security. 898.40s - 901.40s | So when you were speaking just then, I was thinking, ah, emerging technology, AI. 902.40s - 904.40s | But you also have to wear your security hat, right? 905.40s - 906.40s | Are they ever in conflict? 909.40s - 910.40s | You know, it's interesting. 911.40s - 914.40s | So I've had the privilege of both running offensive and defensive cyber operations. 915.40s - 918.40s | Now I have to stand and be closer. 919.40s - 920.40s | Sorry about that. 921.40s - 922.40s | We'll get this. 923.40s - 925.40s | So I started to say, you heard Jeff's question. 926.40s - 928.40s | I've had the privilege of both running offensive and defensive operations. 929.40s - 942.40s | So we try very much from a defensive perspective to bring that offensive mindset to say, what's the easiest way and what's the most persistent way that an adversary might try to get into the system and how do we defend against that? 942.40s - 947.40s | And I think in the emerging tech area, when I think about where we spend a lot of our time. 948.40s - 954.40s | So next week NIST will be announcing the first post-quantum cryptography formal standards that are going for fixed standardization. 955.40s - 956.40s | That's exciting, right? 957.40s - 960.40s | Cryptography is the root of almost everything that we do in cybersecurity. 961.40s - 968.40s | And one of the main ways asymmetric cryptography is at risk if somebody can build a cryptographically relevant quantum computer. 968.40s - 971.40s | We think that's six to ten years off. 972.40s - 978.40s | But it's a massive risk because that kind of key exchange underpins so much of security when we're shopping. 979.40s - 982.40s | Right, and now they're talking about the store now, decrypt later. 983.40s - 988.40s | So even if it's six to ten years from now, it's not really six to ten years on the most sensitive. 989.40s - 990.40s | On information you care about. 990.40s - 991.40s | Right. 992.40s - 998.40s


chunk_id: 196_chunk_17
chunk_text:
might try to get into the system and how do we defend against that? 942.40s - 947.40s | And I think in the emerging tech area, when I think about where we spend a lot of our time. 948.40s - 954.40s | So next week NIST will be announcing the first post-quantum cryptography formal standards that are going for fixed standardization. 955.40s - 956.40s | That's exciting, right? 957.40s - 960.40s | Cryptography is the root of almost everything that we do in cybersecurity. 961.40s - 968.40s | And one of the main ways asymmetric cryptography is at risk if somebody can build a cryptographically relevant quantum computer. 968.40s - 971.40s | We think that's six to ten years off. 972.40s - 978.40s | But it's a massive risk because that kind of key exchange underpins so much of security when we're shopping. 979.40s - 982.40s | Right, and now they're talking about the store now, decrypt later. 983.40s - 988.40s | So even if it's six to ten years from now, it's not really six to ten years on the most sensitive. 989.40s - 990.40s | On information you care about. 990.40s - 991.40s | Right. 992.40s - 998.40s | So when those standards are, when NIST announced them next week, the cool part of our jobs is then saying, 999.40s - 1001.40s | okay, who are the core companies who are already testing? 1002.40s - 1006.40s | Apple's testing, Google's testing, Amazon, and some of them have done deployments already of post-quantum cryptography. 1007.40s - 1008.40s | Let's get that out first. 1009.40s - 1013.40s | Let's get that deployed because frankly, as we know as cryptography, the algorithms are often the easiest part. 1014.40s - 1017.40s | It's the implementation where there's often errors that can be exploited. 1017.40s - 1020.40s | So that's where the emerging tech part of the job comes together. 1021.40s - 1027.40s | Similarly, when we think about AI, there's so much opportunity for AI to help us on the defensive side, 1028.40s - 1031.40s | and there's so much opportunity for AI to help on the offensive side. 1032.40s - 1034.40s | The first step of either one is finding vulnerabilities. 1035.40s - 1037.40s | Whether you then go to patch them or you go to exploit them, 1038.40s - 1042.40s | we want to be on the defensive side that


chunk_id: 196_chunk_18
chunk_text:
| So when those standards are, when NIST announced them next week, the cool part of our jobs is then saying, 999.40s - 1001.40s | okay, who are the core companies who are already testing? 1002.40s - 1006.40s | Apple's testing, Google's testing, Amazon, and some of them have done deployments already of post-quantum cryptography. 1007.40s - 1008.40s | Let's get that out first. 1009.40s - 1013.40s | Let's get that deployed because frankly, as we know as cryptography, the algorithms are often the easiest part. 1014.40s - 1017.40s | It's the implementation where there's often errors that can be exploited. 1017.40s - 1020.40s | So that's where the emerging tech part of the job comes together. 1021.40s - 1027.40s | Similarly, when we think about AI, there's so much opportunity for AI to help us on the defensive side, 1028.40s - 1031.40s | and there's so much opportunity for AI to help on the offensive side. 1032.40s - 1034.40s | The first step of either one is finding vulnerabilities. 1035.40s - 1037.40s | Whether you then go to patch them or you go to exploit them, 1038.40s - 1042.40s | we want to be on the defensive side that the most sensitive systems, 1042.40s - 1046.40s | we have teams like everyone here helping us as the Cyber Challenge is doing, 1047.40s - 1050.40s | to actually use generative AI to find and patch. 1051.40s - 1053.40s | And that's what's exciting and that's where there's opportunity. 1054.40s - 1058.40s | The part that I find fascinating with AI and this potential promise 1059.40s - 1066.40s | is that you can spend an insane amount of money trying to train AI to auto-patch, auto-secure software. 1067.40s - 1069.40s | And you think about it and you're like, really, who's going to spend that much money? 1069.40s - 1073.40s | And then you realize, CrowdStrike outage, $10 billion in loss. 1074.40s - 1080.40s | For $10 billion, you could probably do a lot of training AI to auto-rewrite insecure code, 1081.40s - 1086.40s | run it against GitHub, and lift the entire ocean of the planet's baseline security 1087.40s - 1089.40s | from just one outage equivalent in value. 1090.40s - 1094.40s | And so when I start thinking about it that way, I realize that 1095.40s - 1101.40s | I would rather spend the money doing that than patching


chunk_id: 196_chunk_19
chunk_text:
the most sensitive systems, 1042.40s - 1046.40s | we have teams like everyone here helping us as the Cyber Challenge is doing, 1047.40s - 1050.40s | to actually use generative AI to find and patch. 1051.40s - 1053.40s | And that's what's exciting and that's where there's opportunity. 1054.40s - 1058.40s | The part that I find fascinating with AI and this potential promise 1059.40s - 1066.40s | is that you can spend an insane amount of money trying to train AI to auto-patch, auto-secure software. 1067.40s - 1069.40s | And you think about it and you're like, really, who's going to spend that much money? 1069.40s - 1073.40s | And then you realize, CrowdStrike outage, $10 billion in loss. 1074.40s - 1080.40s | For $10 billion, you could probably do a lot of training AI to auto-rewrite insecure code, 1081.40s - 1086.40s | run it against GitHub, and lift the entire ocean of the planet's baseline security 1087.40s - 1089.40s | from just one outage equivalent in value. 1090.40s - 1094.40s | And so when I start thinking about it that way, I realize that 1095.40s - 1101.40s | I would rather spend the money doing that than patching broken CrowdStrike systems. 1102.40s - 1108.40s | And so is there a role in government to say, okay, DARPA or whoever, 1109.40s - 1112.40s | let's do more of that faster. Let's try to auto-patch faster 1113.40s - 1117.40s | because it seems like the market is not going to spend $10 billion on its own, 1118.40s - 1120.40s | but maybe in partnership, maybe in this consortium, 1121.40s - 1122.40s | maybe if there's some government seed funding, 1122.40s - 1126.40s | there is a way where government can start and the industry can finish. 1127.40s - 1130.40s | I mean, do you think, am I off base? Is that even a role of government? 1131.40s - 1133.40s | I think that's absolutely the role of government. 1134.40s - 1136.40s | So I'll give an example, you know, really two that we'll talk about. 1137.40s - 1138.40s | And then I want to come back to the cost thing. 1139.40s - 1141.40s | So one program that we launched a year ago, 1142.40s - 1146.40s | really building on and copying an idea that came from Singapore and Finland 1147.40s - 1148.40s | is called the Cyber Trustmark Program.


chunk_id: 196_chunk_20
chunk_text:
broken CrowdStrike systems. 1102.40s - 1108.40s | And so is there a role in government to say, okay, DARPA or whoever, 1109.40s - 1112.40s | let's do more of that faster. Let's try to auto-patch faster 1113.40s - 1117.40s | because it seems like the market is not going to spend $10 billion on its own, 1118.40s - 1120.40s | but maybe in partnership, maybe in this consortium, 1121.40s - 1122.40s | maybe if there's some government seed funding, 1122.40s - 1126.40s | there is a way where government can start and the industry can finish. 1127.40s - 1130.40s | I mean, do you think, am I off base? Is that even a role of government? 1131.40s - 1133.40s | I think that's absolutely the role of government. 1134.40s - 1136.40s | So I'll give an example, you know, really two that we'll talk about. 1137.40s - 1138.40s | And then I want to come back to the cost thing. 1139.40s - 1141.40s | So one program that we launched a year ago, 1142.40s - 1146.40s | really building on and copying an idea that came from Singapore and Finland 1147.40s - 1148.40s | is called the Cyber Trustmark Program. 1148.40s - 1150.40s | So when somebody's shopping for a baby monitor, 1151.40s - 1154.40s | or to be honest, my dread, which is a connected home security system, 1155.40s - 1158.40s | there's no way to know, is this product cyber safe? 1159.40s - 1161.40s | Has it been tested against any cybersecurity standard? 1162.40s - 1163.40s | Does the vendor patch it? 1164.40s - 1166.40s | What kind of vulnerability testing did this vendor do? 1167.40s - 1170.40s | And we know that companies say, look, we're willing to do the extra work, 1171.40s - 1172.40s | but we'd love to be able to differentiate ourselves. 1173.40s - 1175.40s | And on the consumer side, a mom who's shopping for a baby monitor, 1175.40s - 1179.40s | she's worried about folks hacking in and looking at or listening to her kid. 1180.40s - 1182.40s | But how does she know if a product is safe? 1183.40s - 1186.40s | So we launched a program a year ago called the Cyber Trustmark, 1187.40s - 1188.40s | which is a labeling program. 1189.40s - 1192.40s | Essentially, any products, things connected, smart TVs, baby monitors, 1193.40s - 1194.40s | home


chunk_id: 196_chunk_21
chunk_text:
1148.40s - 1150.40s | So when somebody's shopping for a baby monitor, 1151.40s - 1154.40s | or to be honest, my dread, which is a connected home security system, 1155.40s - 1158.40s | there's no way to know, is this product cyber safe? 1159.40s - 1161.40s | Has it been tested against any cybersecurity standard? 1162.40s - 1163.40s | Does the vendor patch it? 1164.40s - 1166.40s | What kind of vulnerability testing did this vendor do? 1167.40s - 1170.40s | And we know that companies say, look, we're willing to do the extra work, 1171.40s - 1172.40s | but we'd love to be able to differentiate ourselves. 1173.40s - 1175.40s | And on the consumer side, a mom who's shopping for a baby monitor, 1175.40s - 1179.40s | she's worried about folks hacking in and looking at or listening to her kid. 1180.40s - 1182.40s | But how does she know if a product is safe? 1183.40s - 1186.40s | So we launched a program a year ago called the Cyber Trustmark, 1187.40s - 1188.40s | which is a labeling program. 1189.40s - 1192.40s | Essentially, any products, things connected, smart TVs, baby monitors, 1193.40s - 1194.40s | home security systems, Nest thermostats, 1195.40s - 1198.40s | that meets the government standard and gets tested for it, 1199.40s - 1200.40s | because just companies saying our product is good 1201.40s - 1202.40s | probably doesn't work for many consumers. 1203.40s - 1204.40s | They want to know, was it tested? 1205.40s - 1206.40s | Can have a label. 1207.40s - 1208.40s | It's called the Cyber Trustmark. 1209.40s - 1210.40s | We launched it a year ago. 1211.40s - 1212.40s | It had to go through a whole bunch of legal processes. 1213.40s - 1214.40s | Half of this is always implementation. 1215.40s - 1217.40s | And as of Friday, it's live on the Federal Register. 1218.40s - 1220.40s | And companies like Amazon said they'll, on their websites, 1221.40s - 1222.40s | they'll note labeled products at the top. 1223.40s - 1226.40s | Best Buy said that they'll have their folks in stores train people. 1227.40s - 1230.40s | And companies from Samsung to Google to LG 1231.40s - 1232.40s | said they'll be submitting their products to be tested. 1232.40s - 1235.40s | So that's a great example of where we in government are not saying, 1236.40s


chunk_id: 196_chunk_22
chunk_text:
security systems, Nest thermostats, 1195.40s - 1198.40s | that meets the government standard and gets tested for it, 1199.40s - 1200.40s | because just companies saying our product is good 1201.40s - 1202.40s | probably doesn't work for many consumers. 1203.40s - 1204.40s | They want to know, was it tested? 1205.40s - 1206.40s | Can have a label. 1207.40s - 1208.40s | It's called the Cyber Trustmark. 1209.40s - 1210.40s | We launched it a year ago. 1211.40s - 1212.40s | It had to go through a whole bunch of legal processes. 1213.40s - 1214.40s | Half of this is always implementation. 1215.40s - 1217.40s | And as of Friday, it's live on the Federal Register. 1218.40s - 1220.40s | And companies like Amazon said they'll, on their websites, 1221.40s - 1222.40s | they'll note labeled products at the top. 1223.40s - 1226.40s | Best Buy said that they'll have their folks in stores train people. 1227.40s - 1230.40s | And companies from Samsung to Google to LG 1231.40s - 1232.40s | said they'll be submitting their products to be tested. 1232.40s - 1235.40s | So that's a great example of where we in government are not saying, 1236.40s - 1237.40s | well, we're mandating this. 1238.40s - 1239.40s | We're saying, you know what? 1240.40s - 1241.40s | There's an ecosystem of people who want to bring in more secure tech 1242.40s - 1243.40s | to their homes, their schools, their offices. 1244.40s - 1245.40s | Companies who say, look, we get it. 1246.40s - 1247.40s | We'd rather build a more secure product. 1248.40s - 1250.40s | We'd rather commit to patching it and not just leaving it there. 1251.40s - 1253.40s | And then government, which is saying, okay, 1254.40s - 1255.40s | where we're trusted is when we have a standard 1256.40s - 1257.40s | and where we do the testing. 1258.40s - 1259.40s | So that's an example of, to your point, 1259.40s - 1261.40s | fitting up where we try to create the ecosystem. 1262.40s - 1263.40s | And it's frankly one of the projects at the White House 1264.40s - 1265.40s | I'm the most excited about. 1266.40s - 1267.40s | Because it took a lot of work to launch. 1268.40s - 1269.40s | But now we can say, here's the ecosystem. 1270.40s - 1271.40s | Companies, please submit their products to


chunk_id: 196_chunk_23
chunk_text:
- 1237.40s | well, we're mandating this. 1238.40s - 1239.40s | We're saying, you know what? 1240.40s - 1241.40s | There's an ecosystem of people who want to bring in more secure tech 1242.40s - 1243.40s | to their homes, their schools, their offices. 1244.40s - 1245.40s | Companies who say, look, we get it. 1246.40s - 1247.40s | We'd rather build a more secure product. 1248.40s - 1250.40s | We'd rather commit to patching it and not just leaving it there. 1251.40s - 1253.40s | And then government, which is saying, okay, 1254.40s - 1255.40s | where we're trusted is when we have a standard 1256.40s - 1257.40s | and where we do the testing. 1258.40s - 1259.40s | So that's an example of, to your point, 1259.40s - 1261.40s | fitting up where we try to create the ecosystem. 1262.40s - 1263.40s | And it's frankly one of the projects at the White House 1264.40s - 1265.40s | I'm the most excited about. 1266.40s - 1267.40s | Because it took a lot of work to launch. 1268.40s - 1269.40s | But now we can say, here's the ecosystem. 1270.40s - 1271.40s | Companies, please submit their products to be tested. 1272.40s - 1273.40s | If you're shopping, start asking for it 1274.40s - 1275.40s | and let's see where it goes. 1276.40s - 1277.40s | Yeah, it's a super interesting example 1278.40s - 1280.40s | because just like food labels or other things, 1281.40s - 1282.40s | you can always have a new standard, right? 1283.40s - 1284.40s | It's the Trustmark 1.1. 1285.40s - 1286.40s | It's the Trustmark 1.2. 1287.40s - 1288.40s | You can constantly improve it. 1289.40s - 1290.40s | There's no static point in time, right? 1291.40s - 1292.40s | It's the 2025 version. 1293.40s - 1295.40s | But it also is really embarrassing 1296.40s - 1299.40s | in that it points out, like, this is not a new idea, right? 1300.40s - 1301.40s | Trustmark type ideas. 1302.40s - 1303.40s | We've been wanting this for decades. 1304.40s - 1305.40s | People, I mean, I started my career in like 98 1306.40s - 1308.40s | and we were talking about this in 99. 1309.40s - 1310.40s | So it's taken a long time. 1311.40s - 1313.40s | Why did the industry not do this themselves, right? 1314.40s - 1316.40s | This feels


chunk_id: 196_chunk_24
chunk_text:
be tested. 1272.40s - 1273.40s | If you're shopping, start asking for it 1274.40s - 1275.40s | and let's see where it goes. 1276.40s - 1277.40s | Yeah, it's a super interesting example 1278.40s - 1280.40s | because just like food labels or other things, 1281.40s - 1282.40s | you can always have a new standard, right? 1283.40s - 1284.40s | It's the Trustmark 1.1. 1285.40s - 1286.40s | It's the Trustmark 1.2. 1287.40s - 1288.40s | You can constantly improve it. 1289.40s - 1290.40s | There's no static point in time, right? 1291.40s - 1292.40s | It's the 2025 version. 1293.40s - 1295.40s | But it also is really embarrassing 1296.40s - 1299.40s | in that it points out, like, this is not a new idea, right? 1300.40s - 1301.40s | Trustmark type ideas. 1302.40s - 1303.40s | We've been wanting this for decades. 1304.40s - 1305.40s | People, I mean, I started my career in like 98 1306.40s - 1308.40s | and we were talking about this in 99. 1309.40s - 1310.40s | So it's taken a long time. 1311.40s - 1313.40s | Why did the industry not do this themselves, right? 1314.40s - 1316.40s | This feels like the industry can handle it, 1317.40s - 1318.40s | but they couldn't. 1319.40s - 1320.40s | They didn't. 1321.40s - 1322.40s | They had decades to do it. 1323.40s - 1324.40s | So it felt like the government, right? 1325.40s - 1327.40s | Like the government doesn't want to get into the game, 1328.40s - 1330.40s | but sometimes it has to get into the game, right? 1331.40s - 1332.40s | And to your point, it's also really cool 1333.40s - 1334.40s | because as you look around the room, 1335.40s - 1336.40s | there are so many people here from different backgrounds. 1337.40s - 1338.40s | And I have to say, you know, 1339.40s - 1340.40s | labeling idea really appealed to me 1341.40s - 1342.40s | because as you heard at the beginning, I keep kosher. 1343.40s - 1344.40s | Well, how do I know if something's kosher 1345.40s - 1346.40s | when I'm stopping in the store? 1347.40s - 1348.40s | There's a label. 1349.40s - 1351.40s | It was tested against a particular kosher standard. 1352.40s - 1355.40s | So to be honest, we've seen that work, 1356.40s - 1358.40s | how that ecosystem works,


