# MediaChunks

chunk_id: 196_chunk_25
chunk_text:
like the industry can handle it, 1317.40s - 1318.40s | but they couldn't. 1319.40s - 1320.40s | They didn't. 1321.40s - 1322.40s | They had decades to do it. 1323.40s - 1324.40s | So it felt like the government, right? 1325.40s - 1327.40s | Like the government doesn't want to get into the game, 1328.40s - 1330.40s | but sometimes it has to get into the game, right? 1331.40s - 1332.40s | And to your point, it's also really cool 1333.40s - 1334.40s | because as you look around the room, 1335.40s - 1336.40s | there are so many people here from different backgrounds. 1337.40s - 1338.40s | And I have to say, you know, 1339.40s - 1340.40s | labeling idea really appealed to me 1341.40s - 1342.40s | because as you heard at the beginning, I keep kosher. 1343.40s - 1344.40s | Well, how do I know if something's kosher 1345.40s - 1346.40s | when I'm stopping in the store? 1347.40s - 1348.40s | There's a label. 1349.40s - 1351.40s | It was tested against a particular kosher standard. 1352.40s - 1355.40s | So to be honest, we've seen that work, 1356.40s - 1358.40s | how that ecosystem works, and you copy it and do it here. 1359.40s - 1361.40s | But I want to come back to your point about cost and benefit 1362.40s - 1364.40s | because we had this debate in another area of policy, 1365.40s - 1366.40s | which is paying ransoms. 1367.40s - 1370.40s | And the question we often get is, you know, 1371.40s - 1374.40s | I mentioned $1.3 billion paid in ransoms. 1375.40s - 1376.40s | Why are ransomware attacks increasing? 1377.40s - 1378.40s | Well, they're profitable. 1379.40s - 1380.40s | They make a lot of money. 1381.40s - 1382.40s | So the question is, as governments, 1383.40s - 1384.40s | what should we do about that? 1385.40s - 1386.40s | Should we ban ransom payments 1387.40s - 1389.40s | as part of incentivizing, frankly, companies to say, 1390.40s - 1391.40s | why don't you put the money in at the beginning 1392.40s - 1393.40s | and improve cybersecurity? 1394.40s - 1396.40s | But then folks argue, what are you going to do 1397.40s - 1398.40s | when a hospital gets hit? 1399.40s - 1400.40s | And they say, well, if I pay this $5 million ransom, 1401.40s - 1402.40s


chunk_id: 196_chunk_26
chunk_text:
and you copy it and do it here. 1359.40s - 1361.40s | But I want to come back to your point about cost and benefit 1362.40s - 1364.40s | because we had this debate in another area of policy, 1365.40s - 1366.40s | which is paying ransoms. 1367.40s - 1370.40s | And the question we often get is, you know, 1371.40s - 1374.40s | I mentioned $1.3 billion paid in ransoms. 1375.40s - 1376.40s | Why are ransomware attacks increasing? 1377.40s - 1378.40s | Well, they're profitable. 1379.40s - 1380.40s | They make a lot of money. 1381.40s - 1382.40s | So the question is, as governments, 1383.40s - 1384.40s | what should we do about that? 1385.40s - 1386.40s | Should we ban ransom payments 1387.40s - 1389.40s | as part of incentivizing, frankly, companies to say, 1390.40s - 1391.40s | why don't you put the money in at the beginning 1392.40s - 1393.40s | and improve cybersecurity? 1394.40s - 1396.40s | But then folks argue, what are you going to do 1397.40s - 1398.40s | when a hospital gets hit? 1399.40s - 1400.40s | And they say, well, if I pay this $5 million ransom, 1401.40s - 1402.40s | I can recover faster. 1403.40s - 1404.40s | So we've had this debate. 1405.40s - 1406.40s | And where we came out and ideas on this 1407.40s - 1408.40s | is we decided to take a pause. 1409.40s - 1411.40s | But really, the construct we were talking about 1412.40s - 1415.40s | was saying, could you announce that you were considering 1416.40s - 1417.40s | putting in controls on ransoms? 1418.40s - 1419.40s | So that would incentivize folks to take cybersecurity. 1420.40s - 1421.40s | I am all for blocking ransom. 1422.40s - 1423.40s | I hate paying ransoms. 1424.40s - 1425.40s | And I would love if the government would mandate 1426.40s - 1428.40s | no paying ransoms, just so you set a standard. 1429.40s - 1430.40s | And it's funny, since I'm spending a lot of time 1431.40s - 1432.40s | in Singapore, they're so small, 1433.40s - 1434.40s | so they can do things very quickly. 1435.40s - 1437.40s | And so they also can make decisions 1437.40s - 1438.40s | like can't pay ransom. 1439.40s - 1440.40s | And their view is like, America's too big, 1441.40s - 1442.40s | the ship's sailed,


chunk_id: 196_chunk_27
chunk_text:
| I can recover faster. 1403.40s - 1404.40s | So we've had this debate. 1405.40s - 1406.40s | And where we came out and ideas on this 1407.40s - 1408.40s | is we decided to take a pause. 1409.40s - 1411.40s | But really, the construct we were talking about 1412.40s - 1415.40s | was saying, could you announce that you were considering 1416.40s - 1417.40s | putting in controls on ransoms? 1418.40s - 1419.40s | So that would incentivize folks to take cybersecurity. 1420.40s - 1421.40s | I am all for blocking ransom. 1422.40s - 1423.40s | I hate paying ransoms. 1424.40s - 1425.40s | And I would love if the government would mandate 1426.40s - 1428.40s | no paying ransoms, just so you set a standard. 1429.40s - 1430.40s | And it's funny, since I'm spending a lot of time 1431.40s - 1432.40s | in Singapore, they're so small, 1433.40s - 1434.40s | so they can do things very quickly. 1435.40s - 1437.40s | And so they also can make decisions 1437.40s - 1438.40s | like can't pay ransom. 1439.40s - 1440.40s | And their view is like, America's too big, 1441.40s - 1442.40s | the ship's sailed, they can never do it. 1443.40s - 1444.40s | Cats out of the bag, can't do it. 1445.40s - 1446.40s | We have an option. 1447.40s - 1448.40s | It hasn't gotten that bad yet in Singapore. 1449.40s - 1450.40s | Maybe we can do it. 1451.40s - 1452.40s | We don't think they can do it. 1453.40s - 1454.40s | And I tell them, it's like, hey, it's not all or nothing. 1455.40s - 1456.40s | You don't have to do the whole country or nothing. 1457.40s - 1458.40s | The federal government can just say, 1459.40s - 1461.40s | hey, the federal agencies can't pay a ransom. 1462.40s - 1464.40s | And you learn, oh, now these other critical industries 1465.40s - 1466.40s | can't pay ransom. 1467.40s - 1468.40s | You can do this in bite-sized chunks. 1469.40s - 1470.40s | You don't have to get sucked into 1471.40s - 1472.40s | it doesn't work in my edge case. 1473.40s - 1476.40s | It's like, no, we can do this in steps and learn. 1477.40s - 1479.40s | And if you know hospitals are going to be really hard, 1480.40s - 1481.40s | decide that later. 1482.40s


chunk_id: 196_chunk_28
chunk_text:
they can never do it. 1443.40s - 1444.40s | Cats out of the bag, can't do it. 1445.40s - 1446.40s | We have an option. 1447.40s - 1448.40s | It hasn't gotten that bad yet in Singapore. 1449.40s - 1450.40s | Maybe we can do it. 1451.40s - 1452.40s | We don't think they can do it. 1453.40s - 1454.40s | And I tell them, it's like, hey, it's not all or nothing. 1455.40s - 1456.40s | You don't have to do the whole country or nothing. 1457.40s - 1458.40s | The federal government can just say, 1459.40s - 1461.40s | hey, the federal agencies can't pay a ransom. 1462.40s - 1464.40s | And you learn, oh, now these other critical industries 1465.40s - 1466.40s | can't pay ransom. 1467.40s - 1468.40s | You can do this in bite-sized chunks. 1469.40s - 1470.40s | You don't have to get sucked into 1471.40s - 1472.40s | it doesn't work in my edge case. 1473.40s - 1476.40s | It's like, no, we can do this in steps and learn. 1477.40s - 1479.40s | And if you know hospitals are going to be really hard, 1480.40s - 1481.40s | decide that later. 1482.40s - 1483.40s | Start with the easier cases, right? 1484.40s - 1486.40s | So yeah, I just, I hope the conversation 1487.40s - 1488.40s | doesn't get sucked into an all or nothing. 1489.40s - 1490.40s | So that's the way you would approach it. 1491.40s - 1492.40s | Yeah, you just identify the ones 1493.40s - 1494.40s | you have most control over first. 1495.40s - 1496.40s | It's the easiest to defend, easiest to explain. 1497.40s - 1500.40s | Work your way through it because you want to, 1501.40s - 1503.40s | I hate that we're giving money and fuel 1504.40s - 1506.40s | to our adversaries to get better. 1507.40s - 1508.40s | What I don't like is if you say, 1509.40s - 1510.40s | oh, hospitals, they can pay ransoms. 1511.40s - 1512.40s | Well, guess who's going to get hit? 1513.40s - 1514.40s | All the hospitals because they know 1515.40s - 1516.40s | that's their safe revenue source. 1517.40s - 1518.40s | You don't want to give them the roadmap. 1519.40s - 1522.40s | But the other thing that is frustrating is 1523.40s - 1526.40s | most ransoms can be sourced back mostly to


chunk_id: 196_chunk_29
chunk_text:
- 1483.40s | Start with the easier cases, right? 1484.40s - 1486.40s | So yeah, I just, I hope the conversation 1487.40s - 1488.40s | doesn't get sucked into an all or nothing. 1489.40s - 1490.40s | So that's the way you would approach it. 1491.40s - 1492.40s | Yeah, you just identify the ones 1493.40s - 1494.40s | you have most control over first. 1495.40s - 1496.40s | It's the easiest to defend, easiest to explain. 1497.40s - 1500.40s | Work your way through it because you want to, 1501.40s - 1503.40s | I hate that we're giving money and fuel 1504.40s - 1506.40s | to our adversaries to get better. 1507.40s - 1508.40s | What I don't like is if you say, 1509.40s - 1510.40s | oh, hospitals, they can pay ransoms. 1511.40s - 1512.40s | Well, guess who's going to get hit? 1513.40s - 1514.40s | All the hospitals because they know 1515.40s - 1516.40s | that's their safe revenue source. 1517.40s - 1518.40s | You don't want to give them the roadmap. 1519.40s - 1522.40s | But the other thing that is frustrating is 1523.40s - 1526.40s | most ransoms can be sourced back mostly to Russia. 1527.40s - 1528.40s | And so it feels like at some level 1529.40s - 1531.40s | it's a nation to nation problem. 1532.40s - 1534.40s | It's not me as a small business owner problem, right? 1535.40s - 1537.40s | Because if you can convince Russia to crack down on it, 1538.40s - 1539.40s | that's probably 70% of the problem. 1540.40s - 1541.40s | And so, oh, if it's a 70% problem, 1542.40s - 1544.40s | my government needs to get involved in that, right? 1545.40s - 1547.40s | Because if it's really them trying to exercise power 1548.40s - 1551.40s | and influence us, us banning it, 1552.40s - 1553.40s | they're going to still try to influence us 1554.40s - 1555.40s | and do other things, you know? 1555.40s - 1557.40s | And so their objective hasn't changed. 1558.40s - 1560.40s | Maybe the way they approach it will. 1561.40s - 1564.40s | But anyway, sorry, I just have this big ransomware thing. 1565.40s - 1566.40s | It really bothers me. 1567.40s - 1568.40s | Because you watch ransomware groups 1569.40s - 1570.40s | hack into ransomware groups and leak it. 1571.40s - 1572.40s | They


chunk_id: 196_chunk_30
chunk_text:
Russia. 1527.40s - 1528.40s | And so it feels like at some level 1529.40s - 1531.40s | it's a nation to nation problem. 1532.40s - 1534.40s | It's not me as a small business owner problem, right? 1535.40s - 1537.40s | Because if you can convince Russia to crack down on it, 1538.40s - 1539.40s | that's probably 70% of the problem. 1540.40s - 1541.40s | And so, oh, if it's a 70% problem, 1542.40s - 1544.40s | my government needs to get involved in that, right? 1545.40s - 1547.40s | Because if it's really them trying to exercise power 1548.40s - 1551.40s | and influence us, us banning it, 1552.40s - 1553.40s | they're going to still try to influence us 1554.40s - 1555.40s | and do other things, you know? 1555.40s - 1557.40s | And so their objective hasn't changed. 1558.40s - 1560.40s | Maybe the way they approach it will. 1561.40s - 1564.40s | But anyway, sorry, I just have this big ransomware thing. 1565.40s - 1566.40s | It really bothers me. 1567.40s - 1568.40s | Because you watch ransomware groups 1569.40s - 1570.40s | hack into ransomware groups and leak it. 1571.40s - 1572.40s | They say they delete it. 1573.40s - 1574.40s | How do you verify they've deleted it? 1575.40s - 1576.40s | You don't know. 1577.40s - 1578.40s | There's this whole false sense that we paid them off 1579.40s - 1580.40s | and we're okay. 1581.40s - 1582.40s | It's, no, you're not okay. 1582.40s - 1584.40s | Once you empower the ransomware industry, 1585.40s - 1587.40s | and it is an industry, it's becoming a lobbying group. 1588.40s - 1589.40s | Well, I'm the insurance company 1590.40s - 1591.40s | that specializes in paying ransom. 1592.40s - 1594.40s | Oh, well, I'm the ransomware negotiator specialist group. 1595.40s - 1596.40s | Oh, I am the rating agency 1597.40s - 1599.40s | for which ransomware groups are credible. 1600.40s - 1602.40s | So really, you're rating ransomware groups now. 1603.40s - 1604.40s | An ecosystem is built of special interests 1605.40s - 1607.40s | that want to perpetuate the ransomware payment industry, 1608.40s - 1609.40s | the Bitcoin bros, whatever. 1610.40s - 1611.40s | It's going to get metastasized 1612.40s - 1614.40s | and it's going to be here as an industry interest. 1616.78s - 1617.78s | We're bringing Jeff in to


chunk_id: 196_chunk_31
chunk_text:
say they delete it. 1573.40s - 1574.40s | How do you verify they've deleted it? 1575.40s - 1576.40s | You don't know. 1577.40s - 1578.40s | There's this whole false sense that we paid them off 1579.40s - 1580.40s | and we're okay. 1581.40s - 1582.40s | It's, no, you're not okay. 1582.40s - 1584.40s | Once you empower the ransomware industry, 1585.40s - 1587.40s | and it is an industry, it's becoming a lobbying group. 1588.40s - 1589.40s | Well, I'm the insurance company 1590.40s - 1591.40s | that specializes in paying ransom. 1592.40s - 1594.40s | Oh, well, I'm the ransomware negotiator specialist group. 1595.40s - 1596.40s | Oh, I am the rating agency 1597.40s - 1599.40s | for which ransomware groups are credible. 1600.40s - 1602.40s | So really, you're rating ransomware groups now. 1603.40s - 1604.40s | An ecosystem is built of special interests 1605.40s - 1607.40s | that want to perpetuate the ransomware payment industry, 1608.40s - 1609.40s | the Bitcoin bros, whatever. 1610.40s - 1611.40s | It's going to get metastasized 1612.40s - 1614.40s | and it's going to be here as an industry interest. 1616.78s - 1617.78s | We're bringing Jeff in to help us work ransomware policy. 1618.78s - 1619.78s | Oh, my gosh. 1620.78s - 1621.78s | Sorry, I'm going to get more wine. 1622.78s - 1623.78s | Jesus Christ. 1630.60s - 1631.60s | Sorry. 1632.60s - 1633.60s | Would you like some more? 1634.60s - 1635.60s | Okay. 1636.60s - 1637.60s | Sorry, that's just a raw issue for me. 1642.79s - 1643.79s | Just be blessed. 1647.93s - 1648.93s | Yes, thank you. 1649.93s - 1650.93s | Okay, so that was it. 1650.93s - 1651.93s | What's your take on your reaction? 1652.93s - 1654.93s | You know, I think it's very true 1655.93s - 1656.93s | that as we look at the ransomware problem, 1657.93s - 1658.93s | there's three ways we have to look at it. 1659.93s - 1660.93s | The first I mentioned earlier is the us way. 1661.93s - 1662.93s | We've seen, for example, 1663.93s - 1664.93s | that companies that just back up their data 1665.93s - 1666.93s | and keep them offline 1667.93s - 1668.93s | can recover faster than those who pay a ransom. 1669.93s - 1670.93s | So getting companies to back up, 1671.93s - 1672.93s | getting them to


chunk_id: 196_chunk_32
chunk_text:
help us work ransomware policy. 1618.78s - 1619.78s | Oh, my gosh. 1620.78s - 1621.78s | Sorry, I'm going to get more wine. 1622.78s - 1623.78s | Jesus Christ. 1630.60s - 1631.60s | Sorry. 1632.60s - 1633.60s | Would you like some more? 1634.60s - 1635.60s | Okay. 1636.60s - 1637.60s | Sorry, that's just a raw issue for me. 1642.79s - 1643.79s | Just be blessed. 1647.93s - 1648.93s | Yes, thank you. 1649.93s - 1650.93s | Okay, so that was it. 1650.93s - 1651.93s | What's your take on your reaction? 1652.93s - 1654.93s | You know, I think it's very true 1655.93s - 1656.93s | that as we look at the ransomware problem, 1657.93s - 1658.93s | there's three ways we have to look at it. 1659.93s - 1660.93s | The first I mentioned earlier is the us way. 1661.93s - 1662.93s | We've seen, for example, 1663.93s - 1664.93s | that companies that just back up their data 1665.93s - 1666.93s | and keep them offline 1667.93s - 1668.93s | can recover faster than those who pay a ransom. 1669.93s - 1670.93s | So getting companies to back up, 1671.93s - 1672.93s | getting them to test, 1673.93s - 1674.93s | getting that in place. 1675.93s - 1676.93s | And frankly, in addition to that, 1677.93s - 1678.93s | we've launched some free programs at the White House 1678.93s - 1679.93s | for folks who we know have fewer resources. 1680.93s - 1682.93s | Whether they're the nation's 1,800 rural hospitals, 1683.93s - 1684.93s | we now have a free program training them, 1685.93s - 1686.93s | getting them cybersecurity tech. 1687.93s - 1689.93s | Similar for schools with less than 2,500 kids. 1690.93s - 1691.93s | Because we recognize that for them, 1692.93s - 1693.93s | it's probably not a matter of will. 1694.93s - 1695.93s | It's probably a matter of skill and capability. 1696.93s - 1697.93s | So that's a big part of it. 1698.93s - 1699.93s | The second part of that is to say, 1700.93s - 1701.93s | what can we do to make it riskier, 1702.93s - 1703.93s | costlier, and harder? 1704.93s - 1705.93s | That's disrupting infrastructure around the world. 1706.93s - 1707.93s | Frankly, it's naming people 1708.93s - 1709.93s | who have conducted these attacks. 1710.93s - 1711.93s | You may have seen just recently, 1712.93s


chunk_id: 196_chunk_33
chunk_text:
test, 1673.93s - 1674.93s | getting that in place. 1675.93s - 1676.93s | And frankly, in addition to that, 1677.93s - 1678.93s | we've launched some free programs at the White House 1678.93s - 1679.93s | for folks who we know have fewer resources. 1680.93s - 1682.93s | Whether they're the nation's 1,800 rural hospitals, 1683.93s - 1684.93s | we now have a free program training them, 1685.93s - 1686.93s | getting them cybersecurity tech. 1687.93s - 1689.93s | Similar for schools with less than 2,500 kids. 1690.93s - 1691.93s | Because we recognize that for them, 1692.93s - 1693.93s | it's probably not a matter of will. 1694.93s - 1695.93s | It's probably a matter of skill and capability. 1696.93s - 1697.93s | So that's a big part of it. 1698.93s - 1699.93s | The second part of that is to say, 1700.93s - 1701.93s | what can we do to make it riskier, 1702.93s - 1703.93s | costlier, and harder? 1704.93s - 1705.93s | That's disrupting infrastructure around the world. 1706.93s - 1707.93s | Frankly, it's naming people 1708.93s - 1709.93s | who have conducted these attacks. 1710.93s - 1711.93s | You may have seen just recently, 1712.93s - 1713.93s | the State Department named and put out 1714.93s - 1715.93s | a $10 million bounty for this was Iranian actor. 1716.93s - 1717.93s | I'm all for that. 1718.93s - 1719.93s | I'm all for the naming. 1720.93s - 1721.93s | Who conducted attacks against water systems. 1722.93s - 1723.93s | And we see that folks don't like to be 1724.93s - 1725.93s | shouted out in that way. 1726.93s - 1727.93s | And then the final one is things we can do 1728.93s - 1729.93s | to take the fight to them. 1730.93s - 1731.93s | Those are things I can't talk about here. 1732.93s - 1733.93s | But those are things we think through carefully as well. 1734.93s - 1735.93s | I'll know that we're bringing 70 countries together 1736.93s - 1737.93s | at the end of September. 1738.93s - 1739.93s | From all over the world. 1740.93s - 1741.93s | From Vietnam to Ghana to Nicaragua 1742.93s - 1743.93s | to everybody's affected by ransomware. 1744.93s - 1745.93s | And frankly, actors live around the world. 1746.93s - 1747.93s | Money moves all around the world 1748.93s - 1749.93s | through crypto infrastructure. 1750.93s


chunk_id: 196_chunk_34
chunk_text:
- 1713.93s | the State Department named and put out 1714.93s - 1715.93s | a $10 million bounty for this was Iranian actor. 1716.93s - 1717.93s | I'm all for that. 1718.93s - 1719.93s | I'm all for the naming. 1720.93s - 1721.93s | Who conducted attacks against water systems. 1722.93s - 1723.93s | And we see that folks don't like to be 1724.93s - 1725.93s | shouted out in that way. 1726.93s - 1727.93s | And then the final one is things we can do 1728.93s - 1729.93s | to take the fight to them. 1730.93s - 1731.93s | Those are things I can't talk about here. 1732.93s - 1733.93s | But those are things we think through carefully as well. 1734.93s - 1735.93s | I'll know that we're bringing 70 countries together 1736.93s - 1737.93s | at the end of September. 1738.93s - 1739.93s | From all over the world. 1740.93s - 1741.93s | From Vietnam to Ghana to Nicaragua 1742.93s - 1743.93s | to everybody's affected by ransomware. 1744.93s - 1745.93s | And frankly, actors live around the world. 1746.93s - 1747.93s | Money moves all around the world 1748.93s - 1749.93s | through crypto infrastructure. 1750.93s - 1751.93s | So we bring countries together 1752.93s - 1753.93s | for things like classes on blockchain analysis. 1754.93s - 1755.93s | Classes on regulatory approaches 1756.93s - 1757.93s | for them on how to secure their hospitals. 1758.93s - 1760.93s | To help them and also to make it a global fight. 1761.93s - 1762.93s | So these are really exciting opportunities. 1763.93s - 1764.93s | We have a bunch of companies coming 1765.93s - 1766.93s | to also talk about what they'd like to do 1766.93s - 1767.93s | with other governments around the world 1768.93s - 1769.93s | in terms of disruptions and takedowns. 1770.93s - 1771.93s | So that's the way we approach it. 1772.93s - 1773.93s | Because it is a hard problem. 1774.93s - 1775.93s | And it's a hard problem when you have countries 1776.93s - 1777.93s | harboring people conducting attacks. 1778.93s - 1779.93s | And those are the government-to-government 1780.93s - 1781.93s | conversations we have to say, 1782.93s - 1783.93s | this isn't acceptable. 1784.93s - 1785.93s | And here's what we want to do about it. 1786.93s - 1787.93s | And it's beyond just a criminal enterprise 1788.93s


chunk_id: 196_chunk_35
chunk_text:
- 1751.93s | So we bring countries together 1752.93s - 1753.93s | for things like classes on blockchain analysis. 1754.93s - 1755.93s | Classes on regulatory approaches 1756.93s - 1757.93s | for them on how to secure their hospitals. 1758.93s - 1760.93s | To help them and also to make it a global fight. 1761.93s - 1762.93s | So these are really exciting opportunities. 1763.93s - 1764.93s | We have a bunch of companies coming 1765.93s - 1766.93s | to also talk about what they'd like to do 1766.93s - 1767.93s | with other governments around the world 1768.93s - 1769.93s | in terms of disruptions and takedowns. 1770.93s - 1771.93s | So that's the way we approach it. 1772.93s - 1773.93s | Because it is a hard problem. 1774.93s - 1775.93s | And it's a hard problem when you have countries 1776.93s - 1777.93s | harboring people conducting attacks. 1778.93s - 1779.93s | And those are the government-to-government 1780.93s - 1781.93s | conversations we have to say, 1782.93s - 1783.93s | this isn't acceptable. 1784.93s - 1785.93s | And here's what we want to do about it. 1786.93s - 1787.93s | And it's beyond just a criminal enterprise 1788.93s - 1789.93s | and it's actually coordinated at a government level. 1790.93s - 1791.93s | Then it becomes a government, 1792.93s - 1793.93s | a much bigger government problem. 1794.93s - 1795.93s | And I just want to go back to your point 1796.93s - 1803.93s | when I joined this Homeland Security Advisory Council 1804.93s - 1808.93s | years ago when Janet Napolitano was the secretary. 1809.93s - 1810.93s | And I remember I was talking to some people 1811.93s - 1812.93s | and I said, how come we don't name our adversaries? 1813.93s - 1814.93s | Everybody knows China's coming after us. 1815.93s - 1816.93s | Everybody knows these things are going on. 1817.93s - 1818.93s | The industry, we've known about it for years. 1819.93s - 1820.93s | The government never names our adversaries. 1821.93s - 1822.93s | Why is that? 1823.93s - 1824.93s | And some of the people are like, 1824.93s - 1825.93s | that's really interesting. 1826.93s - 1827.93s | I wonder, yeah, let's, 1828.93s - 1829.93s | well, not six months later, nine months later, 1830.93s - 1831.93s | not because of me, but six or nine months later, 1832.93s - 1833.93s |


chunk_id: 196_chunk_36
chunk_text:
- 1789.93s | and it's actually coordinated at a government level. 1790.93s - 1791.93s | Then it becomes a government, 1792.93s - 1793.93s | a much bigger government problem. 1794.93s - 1795.93s | And I just want to go back to your point 1796.93s - 1803.93s | when I joined this Homeland Security Advisory Council 1804.93s - 1808.93s | years ago when Janet Napolitano was the secretary. 1809.93s - 1810.93s | And I remember I was talking to some people 1811.93s - 1812.93s | and I said, how come we don't name our adversaries? 1813.93s - 1814.93s | Everybody knows China's coming after us. 1815.93s - 1816.93s | Everybody knows these things are going on. 1817.93s - 1818.93s | The industry, we've known about it for years. 1819.93s - 1820.93s | The government never names our adversaries. 1821.93s - 1822.93s | Why is that? 1823.93s - 1824.93s | And some of the people are like, 1824.93s - 1825.93s | that's really interesting. 1826.93s - 1827.93s | I wonder, yeah, let's, 1828.93s - 1829.93s | well, not six months later, nine months later, 1830.93s - 1831.93s | not because of me, but six or nine months later, 1832.93s - 1833.93s | we named China. 1834.93s - 1838.93s | And once the government names somebody for an act, 1839.93s - 1840.93s | it actually gives permission to companies, 1841.93s - 1845.93s | oh, okay, it's just not my paranoid, crazy security guy. 1846.93s - 1847.93s | My government is saying it. 1848.93s - 1849.93s | It lends a certain amount of credibility. 1850.93s - 1851.93s | So by just naming them, 1852.93s - 1853.93s | even if you do nothing more than name them, 1854.93s - 1855.93s | companies can say, 1856.93s - 1857.93s | oh, well, we really don't want to maybe do business with them 1858.93s - 1860.93s | or we have to scrutinize employees hired from there 1861.93s - 1862.93s | or contracts or whatever. 1863.93s - 1864.93s | It gives permission for the companies 1865.93s - 1866.93s | and it gives the people in the risk groups 1867.93s - 1868.93s | something they can point to to say, 1869.93s - 1871.93s | this is why I'm asking you about our exports to Russia 1872.93s - 1874.93s | because they are involved in these kinds of activities. 1875.93s - 1876.93s | And so you might not even realize 1877.93s


chunk_id: 196_chunk_37
chunk_text:
we named China. 1834.93s - 1838.93s | And once the government names somebody for an act, 1839.93s - 1840.93s | it actually gives permission to companies, 1841.93s - 1845.93s | oh, okay, it's just not my paranoid, crazy security guy. 1846.93s - 1847.93s | My government is saying it. 1848.93s - 1849.93s | It lends a certain amount of credibility. 1850.93s - 1851.93s | So by just naming them, 1852.93s - 1853.93s | even if you do nothing more than name them, 1854.93s - 1855.93s | companies can say, 1856.93s - 1857.93s | oh, well, we really don't want to maybe do business with them 1858.93s - 1860.93s | or we have to scrutinize employees hired from there 1861.93s - 1862.93s | or contracts or whatever. 1863.93s - 1864.93s | It gives permission for the companies 1865.93s - 1866.93s | and it gives the people in the risk groups 1867.93s - 1868.93s | something they can point to to say, 1869.93s - 1871.93s | this is why I'm asking you about our exports to Russia 1872.93s - 1874.93s | because they are involved in these kinds of activities. 1875.93s - 1876.93s | And so you might not even realize 1877.93s - 1878.93s | the benefit you're doing 1879.93s - 1880.93s | by giving permission for people in these companies 1881.93s - 1882.93s | to actually say those names out loud 1882.93s - 1883.93s | in a different context. 1884.93s - 1887.93s | And it doesn't cost you a whole new government program. 1888.93s - 1890.93s | That's why I'm a big fan of naming. 1891.93s - 1892.93s | You don't even have to necessarily shame them. 1893.93s - 1894.93s | It's kind of, you know. 1895.93s - 1896.93s | We know who you are and we can find out who you are, 1897.93s - 1898.93s | whether a person or a country. 1899.93s - 1900.93s | And we're telling all of our friends 1901.93s - 1902.93s | that you're no fun to play with, right? 1903.93s - 1904.93s | Got to figure out how to adapt that part. 1905.93s - 1906.93s | Yeah, yeah. 1907.93s - 1908.93s | We're taking all of our marbles and going home. 1909.93s - 1911.93s | I've got this other interesting, 1912.93s - 1913.93s | I want to drop this on you now 1914.93s - 1915.93s | because I'm curious on your thoughts. 1916.93s -


chunk_id: 196_chunk_38
chunk_text:
- 1878.93s | the benefit you're doing 1879.93s - 1880.93s | by giving permission for people in these companies 1881.93s - 1882.93s | to actually say those names out loud 1882.93s - 1883.93s | in a different context. 1884.93s - 1887.93s | And it doesn't cost you a whole new government program. 1888.93s - 1890.93s | That's why I'm a big fan of naming. 1891.93s - 1892.93s | You don't even have to necessarily shame them. 1893.93s - 1894.93s | It's kind of, you know. 1895.93s - 1896.93s | We know who you are and we can find out who you are, 1897.93s - 1898.93s | whether a person or a country. 1899.93s - 1900.93s | And we're telling all of our friends 1901.93s - 1902.93s | that you're no fun to play with, right? 1903.93s - 1904.93s | Got to figure out how to adapt that part. 1905.93s - 1906.93s | Yeah, yeah. 1907.93s - 1908.93s | We're taking all of our marbles and going home. 1909.93s - 1911.93s | I've got this other interesting, 1912.93s - 1913.93s | I want to drop this on you now 1914.93s - 1915.93s | because I'm curious on your thoughts. 1916.93s - 1918.93s | So maybe a year ago or so, 1919.93s - 1921.93s | Microsoft writes this report 1922.93s - 1925.93s | about Russia attacking their Azure infrastructure 1926.93s - 1927.93s | in their cloud. 1928.93s - 1929.93s | Ukraine has some assets in Azure. 1930.93s - 1931.93s | Microsoft writes this great report, 1932.93s - 1933.93s | releases some IOCs, 1934.93s - 1935.93s | talks about what they're seeing in their infrastructure 1935.93s - 1940.93s | and in years, it brought to light, 1941.93s - 1942.93s | it illustrated this point that, 1943.93s - 1944.93s | first off, it reinforced the belief 1945.93s - 1946.93s | that if you're a cloud provider, 1947.93s - 1950.93s | you inherit the risk models of all of your customers. 1951.93s - 1952.93s | If Ukraine is a customer, 1953.93s - 1954.93s | their risk model is now your risk model. 1955.93s - 1956.93s | So these cloud providers have to be prepared 1957.93s - 1958.93s | to defend against every single client's risk model, 1959.93s - 1960.93s | which is crazy. 1961.93s - 1963.93s | But it also means only the largest super hyperscalers 1963.93s - 1966.93s | can really perform at that


chunk_id: 196_chunk_39
chunk_text:
1918.93s | So maybe a year ago or so, 1919.93s - 1921.93s | Microsoft writes this report 1922.93s - 1925.93s | about Russia attacking their Azure infrastructure 1926.93s - 1927.93s | in their cloud. 1928.93s - 1929.93s | Ukraine has some assets in Azure. 1930.93s - 1931.93s | Microsoft writes this great report, 1932.93s - 1933.93s | releases some IOCs, 1934.93s - 1935.93s | talks about what they're seeing in their infrastructure 1935.93s - 1940.93s | and in years, it brought to light, 1941.93s - 1942.93s | it illustrated this point that, 1943.93s - 1944.93s | first off, it reinforced the belief 1945.93s - 1946.93s | that if you're a cloud provider, 1947.93s - 1950.93s | you inherit the risk models of all of your customers. 1951.93s - 1952.93s | If Ukraine is a customer, 1953.93s - 1954.93s | their risk model is now your risk model. 1955.93s - 1956.93s | So these cloud providers have to be prepared 1957.93s - 1958.93s | to defend against every single client's risk model, 1959.93s - 1960.93s | which is crazy. 1961.93s - 1963.93s | But it also means only the largest super hyperscalers 1963.93s - 1966.93s | can really perform at that level. 1967.93s - 1968.93s | The second is, 1969.93s - 1973.93s | Russia's attacking Ukraine on Microsoft infrastructure, 1974.93s - 1975.93s | which might be in the United States, 1976.93s - 1977.93s | might be elsewhere. 1978.93s - 1979.93s | So that means you're battling, 1980.93s - 1981.93s | you're doing battle on Microsoft infrastructure. 1982.93s - 1983.93s | I'm going to keep repeating that 1984.93s - 1985.93s | because in air, sea, land, and space, 1986.93s - 1987.93s | you shoot down an airplane, 1988.93s - 1989.93s | the sky is still there, 1990.93s - 1991.93s | you sink the ship, the ocean's still there, 1991.93s - 1993.93s | blow up the tank, the earth is still the earth. 1994.93s - 1995.93s | But you fight in cyberspace, 1996.93s - 1997.93s | and it will change, 1998.93s - 2000.93s | and it will not be the same tomorrow. 2001.93s - 2003.93s | And you fight Microsoft on Microsoft territory, 2004.93s - 2005.93s | they'll just change it on you tomorrow. 2006.93s - 2007.93s | Right? 2008.93s - 2009.93s | So my instinct is you're probably not going to win 2010.93s - 2011.93s | against the guy, 2012.93s - 2014.93s


chunk_id: 196_chunk_40
chunk_text:
level. 1967.93s - 1968.93s | The second is, 1969.93s - 1973.93s | Russia's attacking Ukraine on Microsoft infrastructure, 1974.93s - 1975.93s | which might be in the United States, 1976.93s - 1977.93s | might be elsewhere. 1978.93s - 1979.93s | So that means you're battling, 1980.93s - 1981.93s | you're doing battle on Microsoft infrastructure. 1982.93s - 1983.93s | I'm going to keep repeating that 1984.93s - 1985.93s | because in air, sea, land, and space, 1986.93s - 1987.93s | you shoot down an airplane, 1988.93s - 1989.93s | the sky is still there, 1990.93s - 1991.93s | you sink the ship, the ocean's still there, 1991.93s - 1993.93s | blow up the tank, the earth is still the earth. 1994.93s - 1995.93s | But you fight in cyberspace, 1996.93s - 1997.93s | and it will change, 1998.93s - 2000.93s | and it will not be the same tomorrow. 2001.93s - 2003.93s | And you fight Microsoft on Microsoft territory, 2004.93s - 2005.93s | they'll just change it on you tomorrow. 2006.93s - 2007.93s | Right? 2008.93s - 2009.93s | So my instinct is you're probably not going to win 2010.93s - 2011.93s | against the guy, 2012.93s - 2014.93s | the company that controls your territory, 2015.93s - 2016.93s | your domain. 2017.93s - 2018.93s | It's not your domain, it's their domain. 2019.93s - 2020.93s | You're just a guest. 2021.93s - 2022.93s | Don't be surprised if all your stuff 2023.93s - 2024.93s | gets deleted tomorrow, right? 2025.93s - 2026.93s | That's super fascinating. 2027.93s - 2028.93s | But it leans me to believe 2029.93s - 2032.93s | there's no unconflicted parties now. 2033.93s - 2035.93s | Like, Microsoft can't be neutral. 2038.66s - 2039.66s | It's sort of this great sorting. 2040.66s - 2041.66s | You're being sorted. 2042.66s - 2043.66s | You're being picked into sides. 2044.66s - 2045.66s | You're either pro-Microsoft or anti-Microsoft. 2046.66s - 2047.66s | If you're pro-Microsoft, 2048.66s - 2049.66s | that means you're probably anti-Russia 2050.66s - 2052.66s | because Russia's attacking Microsoft. 2053.66s - 2054.66s | Like, I didn't want to necessarily 2055.66s - 2056.66s | have to make that decision, 2057.66s - 2058.66s | but I'm being forced to make that decision, right? 2059.66s - 2060.66s | And these conflicts are sorting us, 2061.66s - 2063.66s | our tech stacks, our cloud providers. 2064.66s - 2066.66s


chunk_id: 196_chunk_41
chunk_text:
| the company that controls your territory, 2015.93s - 2016.93s | your domain. 2017.93s - 2018.93s | It's not your domain, it's their domain. 2019.93s - 2020.93s | You're just a guest. 2021.93s - 2022.93s | Don't be surprised if all your stuff 2023.93s - 2024.93s | gets deleted tomorrow, right? 2025.93s - 2026.93s | That's super fascinating. 2027.93s - 2028.93s | But it leans me to believe 2029.93s - 2032.93s | there's no unconflicted parties now. 2033.93s - 2035.93s | Like, Microsoft can't be neutral. 2038.66s - 2039.66s | It's sort of this great sorting. 2040.66s - 2041.66s | You're being sorted. 2042.66s - 2043.66s | You're being picked into sides. 2044.66s - 2045.66s | You're either pro-Microsoft or anti-Microsoft. 2046.66s - 2047.66s | If you're pro-Microsoft, 2048.66s - 2049.66s | that means you're probably anti-Russia 2050.66s - 2052.66s | because Russia's attacking Microsoft. 2053.66s - 2054.66s | Like, I didn't want to necessarily 2055.66s - 2056.66s | have to make that decision, 2057.66s - 2058.66s | but I'm being forced to make that decision, right? 2059.66s - 2060.66s | And these conflicts are sorting us, 2061.66s - 2063.66s | our tech stacks, our cloud providers. 2064.66s - 2066.66s | I mean, how do you think about territory? 2067.66s - 2068.66s | Or how do you think about 2069.66s - 2070.66s | it's no longer just a sales platform, right? 2071.66s - 2072.66s | It's a domain. 2073.66s - 2075.66s | And everybody's conflicted now. 2076.66s - 2080.66s | These are really the toughest questions now 2081.66s - 2082.66s | because we have the laws of war 2083.66s - 2084.66s | and the civil wars 2085.66s - 2086.66s | where people wear uniforms, 2087.66s - 2088.66s | or if not, they pretend to. 2089.66s - 2090.66s | They dress in civilian clothes 2091.66s - 2092.66s | and there are rules for that. 2093.66s - 2094.66s | And there's borders, right? 2095.66s - 2096.66s | There's the border of the war 2097.66s - 2098.66s | and then there's folks in the homeland. 2099.66s - 2100.66s | And in digital war, 2101.66s - 2102.66s | those borders don't exist. 2103.66s - 2104.66s | The attribution is far harder. 2105.66s - 2106.66s | And the role of private companies 2107.66s - 2108.66s | is also different 2109.66s - 2110.66s | because we traditionally had 2111.66s - 2112.66s | a defense industrial base,


chunk_id: 196_chunk_42
chunk_text:
| I mean, how do you think about territory? 2067.66s - 2068.66s | Or how do you think about 2069.66s - 2070.66s | it's no longer just a sales platform, right? 2071.66s - 2072.66s | It's a domain. 2073.66s - 2075.66s | And everybody's conflicted now. 2076.66s - 2080.66s | These are really the toughest questions now 2081.66s - 2082.66s | because we have the laws of war 2083.66s - 2084.66s | and the civil wars 2085.66s - 2086.66s | where people wear uniforms, 2087.66s - 2088.66s | or if not, they pretend to. 2089.66s - 2090.66s | They dress in civilian clothes 2091.66s - 2092.66s | and there are rules for that. 2093.66s - 2094.66s | And there's borders, right? 2095.66s - 2096.66s | There's the border of the war 2097.66s - 2098.66s | and then there's folks in the homeland. 2099.66s - 2100.66s | And in digital war, 2101.66s - 2102.66s | those borders don't exist. 2103.66s - 2104.66s | The attribution is far harder. 2105.66s - 2106.66s | And the role of private companies 2107.66s - 2108.66s | is also different 2109.66s - 2110.66s | because we traditionally had 2111.66s - 2112.66s | a defense industrial base, right? 2113.66s - 2114.66s | And for all intents and purposes, 2115.66s - 2117.66s | their sole or vast majority customer 2118.66s - 2119.66s | was militaries, right? 2120.66s - 2121.66s | The U.S. militaries 2122.66s - 2123.66s | and frankly our allies' militaries. 2124.66s - 2125.66s | And now you see 2126.66s - 2127.66s | when the evening before 2128.66s - 2129.66s | Russia's invasion of Ukraine, 2130.66s - 2131.66s | they disable an American commercial satellite company. 2132.66s - 2133.66s | Why? 2134.66s - 2135.66s | Because one of its customers 2136.66s - 2137.66s | was the Ukrainian military 2138.66s - 2139.66s | and they wanted to disrupt 2140.66s - 2141.66s | Ukrainian soldiers' ability to communicate. 2141.66s - 2142.66s | And now to the Russians, 2143.66s - 2144.66s | they were combatant in the war. 2145.66s - 2146.66s | So those questions of 2147.66s - 2148.66s | what's the border? 2149.66s - 2150.66s | General Maksony talked about 2151.66s - 2152.66s | the Chinese cyber attacks 2153.66s - 2154.66s | against infrastructure in the United States. 2155.66s - 2156.66s | We used to think that was the homeland. 2157.66s - 2158.66s | In prior wars, 2159.66s -


chunk_id: 196_chunk_43
chunk_text:
right? 2113.66s - 2114.66s | And for all intents and purposes, 2115.66s - 2117.66s | their sole or vast majority customer 2118.66s - 2119.66s | was militaries, right? 2120.66s - 2121.66s | The U.S. militaries 2122.66s - 2123.66s | and frankly our allies' militaries. 2124.66s - 2125.66s | And now you see 2126.66s - 2127.66s | when the evening before 2128.66s - 2129.66s | Russia's invasion of Ukraine, 2130.66s - 2131.66s | they disable an American commercial satellite company. 2132.66s - 2133.66s | Why? 2134.66s - 2135.66s | Because one of its customers 2136.66s - 2137.66s | was the Ukrainian military 2138.66s - 2139.66s | and they wanted to disrupt 2140.66s - 2141.66s | Ukrainian soldiers' ability to communicate. 2141.66s - 2142.66s | And now to the Russians, 2143.66s - 2144.66s | they were combatant in the war. 2145.66s - 2146.66s | So those questions of 2147.66s - 2148.66s | what's the border? 2149.66s - 2150.66s | General Maksony talked about 2151.66s - 2152.66s | the Chinese cyber attacks 2153.66s - 2154.66s | against infrastructure in the United States. 2155.66s - 2156.66s | We used to think that was the homeland. 2157.66s - 2158.66s | In prior wars, 2159.66s - 2160.66s | we have two oceans on either side of this country. 2161.66s - 2162.66s | It was really hard to cross that 2163.66s - 2164.66s | with submarines, planes. 2165.66s - 2166.66s | In digital space, 2167.66s - 2168.66s | vulnerabilities at home 2169.66s - 2170.66s | impact what can be done on the battlefield. 2171.66s - 2172.66s | And what offensive cyber options 2173.66s - 2174.66s | do we have for this? 2175.66s - 2176.66s | My question always is, 2177.66s - 2178.66s | okay, I'll tell you what they are, 2179.66s - 2180.66s | but let's talk about the next step. 2181.66s - 2183.66s | Our own digital infrastructure's vulnerabilities 2184.66s - 2185.66s | actually shape and limit 2186.66s - 2187.66s | what we can do offensively 2188.66s - 2189.66s | because we know we're very vulnerable. 2190.66s - 2191.66s | Think about the United States 2192.66s - 2193.66s | versus China on a great firewall. 2194.66s - 2195.66s | Think about the United States 2196.66s - 2197.66s | and our civil liberties and privacy 2198.66s - 2199.66s | which we deeply, deeply value. 2199.66s - 2200.66s | The US government doesn't monitor 2201.66s - 2202.66s |


chunk_id: 196_chunk_44
chunk_text:
2160.66s | we have two oceans on either side of this country. 2161.66s - 2162.66s | It was really hard to cross that 2163.66s - 2164.66s | with submarines, planes. 2165.66s - 2166.66s | In digital space, 2167.66s - 2168.66s | vulnerabilities at home 2169.66s - 2170.66s | impact what can be done on the battlefield. 2171.66s - 2172.66s | And what offensive cyber options 2173.66s - 2174.66s | do we have for this? 2175.66s - 2176.66s | My question always is, 2177.66s - 2178.66s | okay, I'll tell you what they are, 2179.66s - 2180.66s | but let's talk about the next step. 2181.66s - 2183.66s | Our own digital infrastructure's vulnerabilities 2184.66s - 2185.66s | actually shape and limit 2186.66s - 2187.66s | what we can do offensively 2188.66s - 2189.66s | because we know we're very vulnerable. 2190.66s - 2191.66s | Think about the United States 2192.66s - 2193.66s | versus China on a great firewall. 2194.66s - 2195.66s | Think about the United States 2196.66s - 2197.66s | and our civil liberties and privacy 2198.66s - 2199.66s | which we deeply, deeply value. 2199.66s - 2200.66s | The US government doesn't monitor 2201.66s - 2202.66s | US network space. 2203.66s - 2204.66s | China has a massive firewall 2205.66s - 2206.66s | and monitors and defends 2207.66s - 2208.66s | Chinese IP space. 2209.66s - 2210.66s | So it's an asymmetric battle 2211.66s - 2212.66s | in digital space. 2213.66s - 2214.66s | So those factors, 2215.66s - 2216.66s | where are the borders? 2217.66s - 2218.66s | Who is a combatant? 2219.66s - 2220.66s | And what are the roles of companies 2221.66s - 2222.66s | providing services to militaries? 2223.66s - 2224.66s | Another great example, 2225.66s - 2226.66s | Taiwan is an island. 2227.66s - 2228.66s | In the event of a conflict, 2229.66s - 2230.66s | it has gone up significantly 2231.66s - 2232.66s | in the last year. 2233.66s - 2234.66s | A number of them could be 2235.66s - 2236.66s | just anchor drags, 2237.66s - 2238.66s | not malicious at all. 2239.66s - 2240.66s | As occurred after the Houthis 2241.66s - 2242.66s | struck a ship in the Red Sea, 2243.66s - 2244.66s | the ship was sailing unevenly 2245.66s - 2246.66s | and dragged an anchor 2247.66s - 2248.66s | along the bottom of the Red Sea


chunk_id: 196_chunk_45
chunk_text:
US network space. 2203.66s - 2204.66s | China has a massive firewall 2205.66s - 2206.66s | and monitors and defends 2207.66s - 2208.66s | Chinese IP space. 2209.66s - 2210.66s | So it's an asymmetric battle 2211.66s - 2212.66s | in digital space. 2213.66s - 2214.66s | So those factors, 2215.66s - 2216.66s | where are the borders? 2217.66s - 2218.66s | Who is a combatant? 2219.66s - 2220.66s | And what are the roles of companies 2221.66s - 2222.66s | providing services to militaries? 2223.66s - 2224.66s | Another great example, 2225.66s - 2226.66s | Taiwan is an island. 2227.66s - 2228.66s | In the event of a conflict, 2229.66s - 2230.66s | it has gone up significantly 2231.66s - 2232.66s | in the last year. 2233.66s - 2234.66s | A number of them could be 2235.66s - 2236.66s | just anchor drags, 2237.66s - 2238.66s | not malicious at all. 2239.66s - 2240.66s | As occurred after the Houthis 2241.66s - 2242.66s | struck a ship in the Red Sea, 2243.66s - 2244.66s | the ship was sailing unevenly 2245.66s - 2246.66s | and dragged an anchor 2247.66s - 2248.66s | along the bottom of the Red Sea 2249.66s - 2250.66s | and cut communications 2251.66s - 2252.66s | to several big parts of Africa 2253.66s - 2254.66s | for quite a period of time. 2255.66s - 2256.66s | That wasn't malicious 2257.66s - 2258.66s | unless you consider the Houthi 2259.66s - 2260.66s | which is probably 2261.66s - 2262.66s | satellite resilience 2263.66s - 2264.66s | to a cable cut and telecommunications 2265.66s - 2266.66s | so that it's not isolated. 2267.66s - 2268.66s | It needs to think about 2269.66s - 2270.66s | which commercial satellite companies 2271.66s - 2273.66s | can we rely on in a conflict 2274.66s - 2275.66s | and then which can be resistant 2276.66s - 2277.66s | to advanced electronic warfare 2278.66s - 2279.66s | and resistant to jamming. 2280.66s - 2281.66s | So there's a lot that now 2282.66s - 2283.66s | in the context of technology 2284.66s - 2285.66s | moving much more quickly 2286.66s - 2287.66s | than traditional military weapons 2287.66s - 2288.66s | and that's a war that we have to think about 2289.66s - 2290.66s | because there's a reason 2291.66s - 2292.66s | we want to have civilians and combatants. 2293.66s - 2294.66s


chunk_id: 196_chunk_46
chunk_text:
2249.66s - 2250.66s | and cut communications 2251.66s - 2252.66s | to several big parts of Africa 2253.66s - 2254.66s | for quite a period of time. 2255.66s - 2256.66s | That wasn't malicious 2257.66s - 2258.66s | unless you consider the Houthi 2259.66s - 2260.66s | which is probably 2261.66s - 2262.66s | satellite resilience 2263.66s - 2264.66s | to a cable cut and telecommunications 2265.66s - 2266.66s | so that it's not isolated. 2267.66s - 2268.66s | It needs to think about 2269.66s - 2270.66s | which commercial satellite companies 2271.66s - 2273.66s | can we rely on in a conflict 2274.66s - 2275.66s | and then which can be resistant 2276.66s - 2277.66s | to advanced electronic warfare 2278.66s - 2279.66s | and resistant to jamming. 2280.66s - 2281.66s | So there's a lot that now 2282.66s - 2283.66s | in the context of technology 2284.66s - 2285.66s | moving much more quickly 2286.66s - 2287.66s | than traditional military weapons 2287.66s - 2288.66s | and that's a war that we have to think about 2289.66s - 2290.66s | because there's a reason 2291.66s - 2292.66s | we want to have civilians and combatants. 2293.66s - 2294.66s | They lead to the points you made, Jeff, 2295.66s - 2296.66s | about a way to attribute, 2297.66s - 2298.66s | a way to hold people accountable 2299.66s - 2300.66s | if they're not following the laws of war. 2301.66s - 2302.66s | So these are the kinds of things 2303.66s - 2304.66s | which the conflict in Ukraine 2305.66s - 2306.66s | and more broadly, 2307.66s - 2308.66s | conflicts around the world 2309.66s - 2310.66s | are really showing us. 2311.66s - 2312.66s | I'll give another example. 2313.66s - 2314.66s | One of the things we worked on in NATO 2315.66s - 2316.66s | was NATO had had a policy 2317.66s - 2318.66s | that was to the level of a kinetic attack, 2319.66s - 2320.66s | a physical attack, 2321.66s - 2323.66s | where NATO members will come behind an ally. 2324.66s - 2328.66s | Well, when Albania was cyber-attacked by Iran 2329.66s - 2330.66s | and their entire government was disrupted, 2331.66s - 2332.66s | the question really was 2333.66s - 2334.66s | what could NATO members 2335.66s - 2336.66s | quickly get there to help Albania recover 2337.66s - 2338.66s | and we'd


chunk_id: 196_chunk_47
chunk_text:
| They lead to the points you made, Jeff, 2295.66s - 2296.66s | about a way to attribute, 2297.66s - 2298.66s | a way to hold people accountable 2299.66s - 2300.66s | if they're not following the laws of war. 2301.66s - 2302.66s | So these are the kinds of things 2303.66s - 2304.66s | which the conflict in Ukraine 2305.66s - 2306.66s | and more broadly, 2307.66s - 2308.66s | conflicts around the world 2309.66s - 2310.66s | are really showing us. 2311.66s - 2312.66s | I'll give another example. 2313.66s - 2314.66s | One of the things we worked on in NATO 2315.66s - 2316.66s | was NATO had had a policy 2317.66s - 2318.66s | that was to the level of a kinetic attack, 2319.66s - 2320.66s | a physical attack, 2321.66s - 2323.66s | where NATO members will come behind an ally. 2324.66s - 2328.66s | Well, when Albania was cyber-attacked by Iran 2329.66s - 2330.66s | and their entire government was disrupted, 2331.66s - 2332.66s | the question really was 2333.66s - 2334.66s | what could NATO members 2335.66s - 2336.66s | quickly get there to help Albania recover 2337.66s - 2338.66s | and we'd stood up a capability 2339.66s - 2340.66s | just where countries say, 2341.66s - 2342.66s | hey, I'll offer vulnerability analysis, 2343.66s - 2344.66s | I'll offer incident response, 2345.66s - 2346.66s | I'll offer attribution 2347.66s - 2348.66s | to help a country in digital space. 2349.66s - 2350.66s | That kind of cooperation, 2351.66s - 2352.66s | how do allies actually work together 2353.66s - 2354.66s | is also really new 2355.66s - 2356.66s | and it also helps control conflict earlier, 2357.66s - 2358.66s | make it less likely that folks 2359.66s - 2360.66s | will escalate as they respond. 2361.66s - 2362.66s | So these are the kind of things 2363.66s - 2364.66s | we're thinking through. 2365.66s - 2366.66s | Okay, so I would love to keep talking to you 2367.66s - 2368.66s | for hours and go through that model 2369.66s - 2370.66s | but we're out of time 2371.66s - 2372.66s | so I'll give you any closing thoughts, 2373.66s - 2374.66s | your first time out at DEF CON, 2375.66s - 2376.66s | anything that you would, 2377.66s - 2378.66s | any recommendations, 2379.66s - 2380.66s | anything you'd like to share.


chunk_id: 196_chunk_48
chunk_text:
stood up a capability 2339.66s - 2340.66s | just where countries say, 2341.66s - 2342.66s | hey, I'll offer vulnerability analysis, 2343.66s - 2344.66s | I'll offer incident response, 2345.66s - 2346.66s | I'll offer attribution 2347.66s - 2348.66s | to help a country in digital space. 2349.66s - 2350.66s | That kind of cooperation, 2351.66s - 2352.66s | how do allies actually work together 2353.66s - 2354.66s | is also really new 2355.66s - 2356.66s | and it also helps control conflict earlier, 2357.66s - 2358.66s | make it less likely that folks 2359.66s - 2360.66s | will escalate as they respond. 2361.66s - 2362.66s | So these are the kind of things 2363.66s - 2364.66s | we're thinking through. 2365.66s - 2366.66s | Okay, so I would love to keep talking to you 2367.66s - 2368.66s | for hours and go through that model 2369.66s - 2370.66s | but we're out of time 2371.66s - 2372.66s | so I'll give you any closing thoughts, 2373.66s - 2374.66s | your first time out at DEF CON, 2375.66s - 2376.66s | anything that you would, 2377.66s - 2378.66s | any recommendations, 2379.66s - 2380.66s | anything you'd like to share. 2381.66s - 2382.66s | Absolutely. 2383.66s - 2384.66s | So first, I feel really privileged 2385.66s - 2386.66s | to be here with everyone here. 2387.66s - 2388.66s | It looks like I'm so enjoying my time here. 2389.66s - 2390.66s | Folks often ask me, 2391.66s - 2392.66s | why are you in government? 2393.66s - 2394.66s | Government's slow, 2395.66s - 2396.66s | government, I'm told, 2397.66s - 2398.66s | can be bureaucratic. 2399.66s - 2400.66s | Who knows? 2401.66s - 2402.66s | And I often think to myself, 2403.66s - 2404.66s | my dad came here as a refugee, 2405.66s - 2406.66s | my grandparents came as refugees 2407.66s - 2409.66s | and I know that I have freedom to be me. 2410.66s - 2411.66s | Things I want to say, 2412.66s - 2413.66s | how I want to worship, 2414.66s - 2415.66s | who I want to talk with 2416.66s - 2417.66s | is a tremendous privilege 2418.66s - 2419.66s | as we see looking around the world 2420.66s - 2421.66s | and freedoms aren't free. 2422.66s - 2423.66s | We, defending that, 2424.66s - 2425.66s | working to ensure that we use the power, 2426.66s


chunk_id: 196_chunk_49
chunk_text:
2381.66s - 2382.66s | Absolutely. 2383.66s - 2384.66s | So first, I feel really privileged 2385.66s - 2386.66s | to be here with everyone here. 2387.66s - 2388.66s | It looks like I'm so enjoying my time here. 2389.66s - 2390.66s | Folks often ask me, 2391.66s - 2392.66s | why are you in government? 2393.66s - 2394.66s | Government's slow, 2395.66s - 2396.66s | government, I'm told, 2397.66s - 2398.66s | can be bureaucratic. 2399.66s - 2400.66s | Who knows? 2401.66s - 2402.66s | And I often think to myself, 2403.66s - 2404.66s | my dad came here as a refugee, 2405.66s - 2406.66s | my grandparents came as refugees 2407.66s - 2409.66s | and I know that I have freedom to be me. 2410.66s - 2411.66s | Things I want to say, 2412.66s - 2413.66s | how I want to worship, 2414.66s - 2415.66s | who I want to talk with 2416.66s - 2417.66s | is a tremendous privilege 2418.66s - 2419.66s | as we see looking around the world 2420.66s - 2421.66s | and freedoms aren't free. 2422.66s - 2423.66s | We, defending that, 2424.66s - 2425.66s | working to ensure that we use the power, 2426.66s - 2427.66s | the skill, the talents 2428.66s - 2429.66s | that's represented in this room 2430.66s - 2431.66s | to ensure that folks around the world 2432.66s - 2433.66s | can rely on the medical service 2434.66s - 2435.66s | in their digitally connected hospitals, 2435.66s - 2436.66s | in their digitally connected power systems 2437.66s - 2438.66s | and frankly just being able to 2439.66s - 2440.66s | communicate around the world. 2441.66s - 2442.66s | Our digital systems are not resilient enough 2443.66s - 2444.66s | for everything that relies on them 2445.66s - 2446.66s | and we can make it that way. 2447.66s - 2448.66s | When we think about, for example, 2449.66s - 2450.66s | so many things here, 2451.66s - 2452.66s | using the abilities you have, 2453.66s - 2454.66s | using the generative AI tools we see there 2455.66s - 2456.66s | to, when we find vulnerabilities, 2457.66s - 2458.66s | use them to patch them. 2459.66s - 2460.66s | There's so much ability here 2461.66s - 2462.66s | and frankly, as tech continues to be 2463.66s - 2464.66s | a part of our lives, 2465.66s - 2466.66s | really using the force


chunk_id: 196_chunk_50
chunk_text:
- 2427.66s | the skill, the talents 2428.66s - 2429.66s | that's represented in this room 2430.66s - 2431.66s | to ensure that folks around the world 2432.66s - 2433.66s | can rely on the medical service 2434.66s - 2435.66s | in their digitally connected hospitals, 2435.66s - 2436.66s | in their digitally connected power systems 2437.66s - 2438.66s | and frankly just being able to 2439.66s - 2440.66s | communicate around the world. 2441.66s - 2442.66s | Our digital systems are not resilient enough 2443.66s - 2444.66s | for everything that relies on them 2445.66s - 2446.66s | and we can make it that way. 2447.66s - 2448.66s | When we think about, for example, 2449.66s - 2450.66s | so many things here, 2451.66s - 2452.66s | using the abilities you have, 2453.66s - 2454.66s | using the generative AI tools we see there 2455.66s - 2456.66s | to, when we find vulnerabilities, 2457.66s - 2458.66s | use them to patch them. 2459.66s - 2460.66s | There's so much ability here 2461.66s - 2462.66s | and frankly, as tech continues to be 2463.66s - 2464.66s | a part of our lives, 2465.66s - 2466.66s | really using the force for that good 2467.66s - 2468.66s | is a partnership I hope 2469.66s - 2470.66s | everybody here will think about. 2471.66s - 2472.66s | If anybody's interested in talking further, 2473.66s - 2474.66s | I'm available. 2475.66s - 2476.66s | Thank you for all you do every day 2477.66s - 2478.66s | and looking forward to be back at DESCOM 2479.66s - 2480.66s | with another bottle of wine next year.


chunk_id: 196_chunk_51
chunk_text:
for that good 2467.66s - 2468.66s | is a partnership I hope 2469.66s - 2470.66s | everybody here will think about. 2471.66s - 2472.66s | If anybody's interested in talking further, 2473.66s - 2474.66s | I'm available. 2475.66s - 2476.66s | Thank you for all you do every day 2477.66s - 2478.66s | and looking forward to be back at DESCOM 2479.66s - 2480.66s | with another bottle of wine next year.


chunk_id: 197_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=WGXNimCkDOE", "title": "DEF CON 32 - Changing Global Threat Landscape - Rob Joyce, The Dark Tangent", "description": "Rob Joyce, former NSA and White House cyber official, will engage with Dark Tangent to analyze the evolving state of global cyber threats. Their discussion will explore the impact and potential of artificial intelligence, assessing how AI is reshaping the cybersecurity landscape and what it means for the future of global security.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2640, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 9.74s - 14.74s | This text was transcribed using whisper model: large-v2 who went to sleep last night? Okay, most of you. Good. Um, 21.08s - 24.08s | hey, so I want to, uh, thank you for coming to one of the first 24.08s - 26.78s | sessions of the day. Um, there's more of you here than I 26.78s - 30.26s | expected, um, which is really cool. If you don't remember 30.26s - 33.06s | anything that happens here, that's okay. We're recording it 33.06s - 37.86s | and we'll release all that stuff for free later. So I want to 37.86s - 41.32s | have a fireside chat with Rob Joyce, um, probably most 41.32s - 46.26s | famously known, um, for memeing the Russians. No, I'm kidding. 46.26s - 49.36s | Rob has a really long history of a distinguished service for the 49.36s - 52.84s | United States and, uh, and so I want to first have, he's just 52.84s - 55.14s | going to talk a little bit about where you're coming from, what 55.14s - 57.94s | you've done, and then we've got some questions and, and the 57.94s - 60.94s | concept is we'll have a conversation. Hopefully you'll 60.94s - 64.52s | learn something and then, uh, depending on how things go, we 64.54s - 69.78s | might have some Q and A. Sounds like a plan? Ready to do this? 69.78s - 72.58s | All good, Jeff. Okay, go for it, Rob. Hey, good morning 72.58s - 77.56s | everybody. So, Rob Joyce, I just retired in March after 34 years 77.56s - 81.02s | at the National Security Agency. So that was a career where I 81.02s - 86.04s | came st- thank you. So, wild ride, interesting and exciting. 88.54s - 92.78s | I started there as a technical engineer, um, worked my way up 92.80s


chunk_id: 197_chunk_1
chunk_text:
- 46.26s | famously known, um, for memeing the Russians. No, I'm kidding. 46.26s - 49.36s | Rob has a really long history of a distinguished service for the 49.36s - 52.84s | United States and, uh, and so I want to first have, he's just 52.84s - 55.14s | going to talk a little bit about where you're coming from, what 55.14s - 57.94s | you've done, and then we've got some questions and, and the 57.94s - 60.94s | concept is we'll have a conversation. Hopefully you'll 60.94s - 64.52s | learn something and then, uh, depending on how things go, we 64.54s - 69.78s | might have some Q and A. Sounds like a plan? Ready to do this? 69.78s - 72.58s | All good, Jeff. Okay, go for it, Rob. Hey, good morning 72.58s - 77.56s | everybody. So, Rob Joyce, I just retired in March after 34 years 77.56s - 81.02s | at the National Security Agency. So that was a career where I 81.02s - 86.04s | came st- thank you. So, wild ride, interesting and exciting. 88.54s - 92.78s | I started there as a technical engineer, um, worked my way up 92.80s - 97.28s | to operational things, um, like during the Iraq war, I was the 97.28s - 101.24s | Iraq issue manager, worked counter-terrorism, back and 101.24s - 105.08s | forth across NSA where we have two missions. One is signals 105.08s - 109.48s | intelligence, that's to produce the foreign intelligence against 109.48s - 113.46s | the adversaries to understand plans, intentions, capabilities, 113.46s - 117.52s | threats, um, and that's a very traditional intelligence 117.52s - 122.94s | mission. But we also have a second side where you, you work 122.94s - 127.72s | to protect the national security systems and those are systems 127.72s - 130.86s | that carry classified information, war fighting, 130.86s - 133.42s | command and control, or intelligence. And so those are 133.42s - 136.66s | the most sensitive networks of the United States government. 136.66s - 141.00s | And so the, the dual nature of NSA, both playing offense and 141.00s - 144.44s | defense kind of gives you a unique mindset. It really sets 144.46s - 151.04s | you up to, to think about, um, you know, how, uh, an offensive 151.04s - 156.04s | nation state would come at you.


chunk_id: 197_chunk_2
chunk_text:
- 97.28s | to operational things, um, like during the Iraq war, I was the 97.28s - 101.24s | Iraq issue manager, worked counter-terrorism, back and 101.24s - 105.08s | forth across NSA where we have two missions. One is signals 105.08s - 109.48s | intelligence, that's to produce the foreign intelligence against 109.48s - 113.46s | the adversaries to understand plans, intentions, capabilities, 113.46s - 117.52s | threats, um, and that's a very traditional intelligence 117.52s - 122.94s | mission. But we also have a second side where you, you work 122.94s - 127.72s | to protect the national security systems and those are systems 127.72s - 130.86s | that carry classified information, war fighting, 130.86s - 133.42s | command and control, or intelligence. And so those are 133.42s - 136.66s | the most sensitive networks of the United States government. 136.66s - 141.00s | And so the, the dual nature of NSA, both playing offense and 141.00s - 144.44s | defense kind of gives you a unique mindset. It really sets 144.46s - 151.04s | you up to, to think about, um, you know, how, uh, an offensive 151.04s - 156.04s | nation state would come at you. And by playing both offense and 156.04s - 159.34s | defense, you know, the, the old adage of it takes a thief to 159.34s - 162.78s | catch a thief changes the way you approach both defense and 162.78s - 165.12s | offense. And I found it fairly fascinating. 165.12s - 168.86s | And, um, NSA is not known to be the easiest of places to 168.86s - 172.76s | survive. So just the number of years you served must mean you 172.78s - 176.12s | have some secret skill to survive in a bureaucratic, 176.12s - 179.38s | technical, competitive, you know, aggressive kind of 179.38s - 180.56s | environment. 180.56s - 184.50s | So I don't know how many of you ever read the book soul of a new 184.50s - 190.80s | machine. It's a 1980s book about the, the, uh, the PDP 11 190.80s - 194.84s | designers up in the Boston research triangle. I read that 194.84s - 197.10s | years ago and there was something in there that stuck 197.10s - 200.04s | with me where people didn't focus on the next job. You 200.06s - 203.04s | focused on the one you were


chunk_id: 197_chunk_3
chunk_text:
And by playing both offense and 156.04s - 159.34s | defense, you know, the, the old adage of it takes a thief to 159.34s - 162.78s | catch a thief changes the way you approach both defense and 162.78s - 165.12s | offense. And I found it fairly fascinating. 165.12s - 168.86s | And, um, NSA is not known to be the easiest of places to 168.86s - 172.76s | survive. So just the number of years you served must mean you 172.78s - 176.12s | have some secret skill to survive in a bureaucratic, 176.12s - 179.38s | technical, competitive, you know, aggressive kind of 179.38s - 180.56s | environment. 180.56s - 184.50s | So I don't know how many of you ever read the book soul of a new 184.50s - 190.80s | machine. It's a 1980s book about the, the, uh, the PDP 11 190.80s - 194.84s | designers up in the Boston research triangle. I read that 194.84s - 197.10s | years ago and there was something in there that stuck 197.10s - 200.04s | with me where people didn't focus on the next job. You 200.06s - 203.04s | focused on the one you were in. And if you played a good game, 203.04s - 205.20s | it was like pinball. You got a free game, you got to play 205.20s - 209.34s | again. And that was kind of my focus. I enjoyed the jobs I was 209.34s - 214.48s | in, had multiple careers and jobs across those 34 years. Um, 214.48s - 219.18s | but it was very much focused on, have a good idea, um, talk 219.18s - 222.58s | about that idea and bring something to the, to the effort. 222.58s - 224.78s | And then you get to do new, bigger, better. 224.78s - 228.86s | And how do you organizationally, so normally in an organization 228.88s - 234.02s | that's very flat, um, you intern all over the place and you have 234.02s - 237.66s | an idea of what's going on, but when everything is siloed, how 237.66s - 240.10s | do you know that you're just, you come up with a great idea. 240.10s - 243.56s | It wasn't done five years ago, you know, or it's not ongoing 243.56s - 247.50s | now. So before you can even propose a good idea, you don't 247.50s


chunk_id: 197_chunk_4
chunk_text:
in. And if you played a good game, 203.04s - 205.20s | it was like pinball. You got a free game, you got to play 205.20s - 209.34s | again. And that was kind of my focus. I enjoyed the jobs I was 209.34s - 214.48s | in, had multiple careers and jobs across those 34 years. Um, 214.48s - 219.18s | but it was very much focused on, have a good idea, um, talk 219.18s - 222.58s | about that idea and bring something to the, to the effort. 222.58s - 224.78s | And then you get to do new, bigger, better. 224.78s - 228.86s | And how do you organizationally, so normally in an organization 228.88s - 234.02s | that's very flat, um, you intern all over the place and you have 234.02s - 237.66s | an idea of what's going on, but when everything is siloed, how 237.66s - 240.10s | do you know that you're just, you come up with a great idea. 240.10s - 243.56s | It wasn't done five years ago, you know, or it's not ongoing 243.56s - 247.50s | now. So before you can even propose a good idea, you don't 247.50s - 251.14s | maybe even have the information to, yeah, it inside the fence 251.14s - 254.44s | line, there's a lot of sharing. So, you know, everybody there 254.44s - 258.24s | has a clearance doesn't matter if you, um, you know, work the 258.26s - 262.34s | janitorial staff, the technical staff, the language staff, the 262.34s - 266.00s | cybersecurity teams, everybody has the same clearance. You may 266.00s - 269.14s | get some special accesses and some is compartmented, but 269.14s - 272.60s | overall, you know, it, it, it's important to understand the 272.60s - 275.58s | greater mission and what, what we're trying to achieve. And so 275.58s - 276.58s | you do get some opportunities. 276.58s - 279.52s | Okay. So it's not just everybody in their one area, but oblivious 279.52s - 283.96s | to what else is, yeah. Um, okay. So then, then you got your, uh, 283.96s - 286.16s | big assignment, you went to Europe. 286.18s - 290.72s | Yeah. So I got to represent NSA in the, uh, U.S. embassy in 290.72s - 294.72s | London. So, um, being the cryptologic representative to the 294.72s - 300.32s |


chunk_id: 197_chunk_5
chunk_text:
- 251.14s | maybe even have the information to, yeah, it inside the fence 251.14s - 254.44s | line, there's a lot of sharing. So, you know, everybody there 254.44s - 258.24s | has a clearance doesn't matter if you, um, you know, work the 258.26s - 262.34s | janitorial staff, the technical staff, the language staff, the 262.34s - 266.00s | cybersecurity teams, everybody has the same clearance. You may 266.00s - 269.14s | get some special accesses and some is compartmented, but 269.14s - 272.60s | overall, you know, it, it, it's important to understand the 272.60s - 275.58s | greater mission and what, what we're trying to achieve. And so 275.58s - 276.58s | you do get some opportunities. 276.58s - 279.52s | Okay. So it's not just everybody in their one area, but oblivious 279.52s - 283.96s | to what else is, yeah. Um, okay. So then, then you got your, uh, 283.96s - 286.16s | big assignment, you went to Europe. 286.18s - 290.72s | Yeah. So I got to represent NSA in the, uh, U.S. embassy in 290.72s - 294.72s | London. So, um, being the cryptologic representative to the 294.72s - 300.32s | UK and in that, um, you know, it was awesome until COVID hit. So 300.32s - 304.14s | when you're a liaison and you're representational, not a lot of 304.14s - 308.00s | interesting things happen when you're in a total COVID lockdown. 308.00s - 308.20s | Yeah. 308.70s - 312.08s | And so did you gain a different appreciation of what, what the 312.08s - 314.28s | view from the outside is looking back at America? 314.38s - 314.64s | Yeah. 314.66s - 316.46s | So our partners or allies or? 316.62s - 319.70s | I don't care if you're at a company or a government agency, when 319.70s - 324.76s | you represent yourself to your partners, your customers, um, you, 324.86s - 327.50s | you understand different things about the way the organization 327.50s - 330.30s | functions and, and what it looks like from, from the outside. 330.30s - 330.68s | Definitely. 330.68s - 336.72s | Yeah. So, um, so then you come back to the States and then you 336.72s - 337.98s | were in charge of? 338.28s - 340.08s | The cybersecurity directorate. 340.12s - 342.82s | So cybersecurity directorate, which is most famous


chunk_id: 197_chunk_6
chunk_text:
UK and in that, um, you know, it was awesome until COVID hit. So 300.32s - 304.14s | when you're a liaison and you're representational, not a lot of 304.14s - 308.00s | interesting things happen when you're in a total COVID lockdown. 308.00s - 308.20s | Yeah. 308.70s - 312.08s | And so did you gain a different appreciation of what, what the 312.08s - 314.28s | view from the outside is looking back at America? 314.38s - 314.64s | Yeah. 314.66s - 316.46s | So our partners or allies or? 316.62s - 319.70s | I don't care if you're at a company or a government agency, when 319.70s - 324.76s | you represent yourself to your partners, your customers, um, you, 324.86s - 327.50s | you understand different things about the way the organization 327.50s - 330.30s | functions and, and what it looks like from, from the outside. 330.30s - 330.68s | Definitely. 330.68s - 336.72s | Yeah. So, um, so then you come back to the States and then you 336.72s - 337.98s | were in charge of? 338.28s - 340.08s | The cybersecurity directorate. 340.12s - 342.82s | So cybersecurity directorate, which is most famous for its 342.82s - 343.46s | Twitter handle. 344.06s - 350.24s | Yeah, I did, you know, even, even before going to the UK, I had a 350.24s - 351.64s | true Twitter presence. 351.72s - 355.12s | I worked, um, to kind of engage, right. 355.12s - 359.76s | That's where a lot of the InfoSec timely information is popping out. 360.28s - 362.28s | And, uh, I built a following. 362.34s - 366.96s | I had probably more positive and beneficial interactions with that 366.96s - 369.92s | Twitter handle than the official NSA handles. 369.94s - 373.50s | So the public affairs chief came to me one day and said, we want to 373.50s - 375.30s | give you an official NSA handle. 375.94s - 378.70s | And I told them, hell no, not even know, but hell no. 378.70s - 382.54s | Cause that means the lawyers get to decide what I can put out there. 382.54s - 385.06s | I'd have to go through the pre-publication review. 385.34s - 388.98s | Our public affairs officers would be pushing things at me to push out 388.98s - 392.54s | there and, and it just wasn't a


chunk_id: 197_chunk_7
chunk_text:
for its 342.82s - 343.46s | Twitter handle. 344.06s - 350.24s | Yeah, I did, you know, even, even before going to the UK, I had a 350.24s - 351.64s | true Twitter presence. 351.72s - 355.12s | I worked, um, to kind of engage, right. 355.12s - 359.76s | That's where a lot of the InfoSec timely information is popping out. 360.28s - 362.28s | And, uh, I built a following. 362.34s - 366.96s | I had probably more positive and beneficial interactions with that 366.96s - 369.92s | Twitter handle than the official NSA handles. 369.94s - 373.50s | So the public affairs chief came to me one day and said, we want to 373.50s - 375.30s | give you an official NSA handle. 375.94s - 378.70s | And I told them, hell no, not even know, but hell no. 378.70s - 382.54s | Cause that means the lawyers get to decide what I can put out there. 382.54s - 385.06s | I'd have to go through the pre-publication review. 385.34s - 388.98s | Our public affairs officers would be pushing things at me to push out 388.98s - 392.54s | there and, and it just wasn't a reasonable idea. 393.06s - 395.50s | So when they didn't expect me to say no. 396.02s - 398.70s | So they went away and thought they argued with the lawyers. 398.70s - 402.16s | They came back with a four page document for me to sign that said, 402.16s - 404.76s | you can have a official handle. 405.00s - 409.60s | You don't have to go through pre-pub review, but anything bad that happens 409.60s - 412.40s | is on you and you know, the nooses around your neck, right? 412.40s - 412.52s | Right. 412.52s - 416.36s | Is it a one paragraph and like four pages of rope to hang yourself? 416.40s - 416.88s | Yes. 416.96s - 420.84s | And, and I said, I'm already doing that right with my private one. 420.84s - 424.40s | So, so I agreed, I signed up, I started putting out some things 424.40s - 426.28s | continued with edgy memes. 426.34s - 429.46s | Um, you know, Jeff talked about, you know, a couple of times taunting 429.46s - 433.78s | the Russians, things like that, but it was cybersecurity awareness 433.78s - 437.14s | month where they came


chunk_id: 197_chunk_8
chunk_text:
reasonable idea. 393.06s - 395.50s | So when they didn't expect me to say no. 396.02s - 398.70s | So they went away and thought they argued with the lawyers. 398.70s - 402.16s | They came back with a four page document for me to sign that said, 402.16s - 404.76s | you can have a official handle. 405.00s - 409.60s | You don't have to go through pre-pub review, but anything bad that happens 409.60s - 412.40s | is on you and you know, the nooses around your neck, right? 412.40s - 412.52s | Right. 412.52s - 416.36s | Is it a one paragraph and like four pages of rope to hang yourself? 416.40s - 416.88s | Yes. 416.96s - 420.84s | And, and I said, I'm already doing that right with my private one. 420.84s - 424.40s | So, so I agreed, I signed up, I started putting out some things 424.40s - 426.28s | continued with edgy memes. 426.34s - 429.46s | Um, you know, Jeff talked about, you know, a couple of times taunting 429.46s - 433.78s | the Russians, things like that, but it was cybersecurity awareness 433.78s - 437.14s | month where they came to me with this public affairs idea of all 437.14s - 439.30s | the boring stuff they were going to talk about in October. 439.66s - 443.82s | And, um, I, I just couldn't stomach it. 444.26s - 448.66s | And so, uh, in a little act of defiance, I made a meme, the sweating 448.66s - 452.54s | guy with the two buttons and it said memes or cybersecurity awareness. 453.00s - 456.80s | And I, I pushed that out and it got good response and pickup. 456.84s - 458.24s | And I said, I can do this. 458.24s - 461.36s | You know, cybersecurity awareness month is 30 days. 461.36s - 465.16s | I can engage with 30, 31 more, 30 more memes. 465.60s - 471.60s | Um, I did not understand how hard it is to come up with 30 good ideas 472.24s - 474.20s | because, you know, I wasn't doing them at work. 474.20s - 478.36s | I was doing them at home after hours and I'd get home at seven 478.36s - 479.88s | or eight at night, burnout. 479.96s - 481.44s | I'd come up with an idea. 481.58s - 482.58s | I'd


chunk_id: 197_chunk_9
chunk_text:
to me with this public affairs idea of all 437.14s - 439.30s | the boring stuff they were going to talk about in October. 439.66s - 443.82s | And, um, I, I just couldn't stomach it. 444.26s - 448.66s | And so, uh, in a little act of defiance, I made a meme, the sweating 448.66s - 452.54s | guy with the two buttons and it said memes or cybersecurity awareness. 453.00s - 456.80s | And I, I pushed that out and it got good response and pickup. 456.84s - 458.24s | And I said, I can do this. 458.24s - 461.36s | You know, cybersecurity awareness month is 30 days. 461.36s - 465.16s | I can engage with 30, 31 more, 30 more memes. 465.60s - 471.60s | Um, I did not understand how hard it is to come up with 30 good ideas 472.24s - 474.20s | because, you know, I wasn't doing them at work. 474.20s - 478.36s | I was doing them at home after hours and I'd get home at seven 478.36s - 479.88s | or eight at night, burnout. 479.96s - 481.44s | I'd come up with an idea. 481.58s - 482.58s | I'd make a meme. 482.90s - 486.02s | I'd get up in the morning and ready to post it at 5 a.m. 486.02s - 490.86s | before I was going in the skiff and I'd look at it and I'm going, holy crap. 490.86s - 492.78s | I think that was a good idea last night. 492.78s - 496.20s | Yeah, I can't put this on an official NSA Twitter account. 496.22s - 498.62s | And so we'd get something a little more benign. 499.06s - 503.26s | Um, but I learned that first year it was a lot of work and I had a couple 503.26s - 509.46s | people who informally helped, but the next year, um, I just kept, uh, a 509.48s - 513.88s | running log whenever I had an idea and started building up a year's stack. 513.92s - 514.28s | Yeah. 514.32s - 514.56s | Yeah. 514.76s - 518.40s | So I had material banked up and, uh, it went much better last year. 518.72s - 520.68s | And, uh, so did you pass the torch? 520.84s - 524.64s | You know, are they going to, is there a meme worthy successor? 524.72s - 527.48s


chunk_id: 197_chunk_10
chunk_text:
make a meme. 482.90s - 486.02s | I'd get up in the morning and ready to post it at 5 a.m. 486.02s - 490.86s | before I was going in the skiff and I'd look at it and I'm going, holy crap. 490.86s - 492.78s | I think that was a good idea last night. 492.78s - 496.20s | Yeah, I can't put this on an official NSA Twitter account. 496.22s - 498.62s | And so we'd get something a little more benign. 499.06s - 503.26s | Um, but I learned that first year it was a lot of work and I had a couple 503.26s - 509.46s | people who informally helped, but the next year, um, I just kept, uh, a 509.48s - 513.88s | running log whenever I had an idea and started building up a year's stack. 513.92s - 514.28s | Yeah. 514.32s - 514.56s | Yeah. 514.76s - 518.40s | So I had material banked up and, uh, it went much better last year. 518.72s - 520.68s | And, uh, so did you pass the torch? 520.84s - 524.64s | You know, are they going to, is there a meme worthy successor? 524.72s - 527.48s | Well, Dave Luber is now the CSD director. 527.80s - 531.64s | He's debating about whether memes are CSD or memes are Rob. 531.96s - 535.96s | So I will certainly come out with, uh, some memes in October. 535.96s - 538.28s | We'll see whether NSA, or maybe a head to head. 538.64s - 538.96s | Yeah. 538.96s - 540.52s | We could be complimentary. 540.52s - 541.86s | There's not a competition. 542.26s - 542.42s | Yeah. 542.42s - 543.50s | I think that's fantastic. 543.50s - 547.78s | Um, when I hear that story, I think about the dilemma that we have 547.78s - 549.98s | sort of in cybersecurity versus hacking. 550.58s - 556.06s | Um, so in hacking, you get to hack when you feel like hacking, right? 556.06s - 561.78s | It's when you are, um, opportunistically the stars align and you're inspired 561.78s - 565.58s | and you hack and it's great, uh, in InfoSec, you have to be professionally 565.62s - 567.18s | sort of creative all the time. 567.18s - 568.10s | You're on the clock. 568.56s - 570.00s | It's your page, you know, paycheck. 570.76s - 574.88s |


chunk_id: 197_chunk_11
chunk_text:
| Well, Dave Luber is now the CSD director. 527.80s - 531.64s | He's debating about whether memes are CSD or memes are Rob. 531.96s - 535.96s | So I will certainly come out with, uh, some memes in October. 535.96s - 538.28s | We'll see whether NSA, or maybe a head to head. 538.64s - 538.96s | Yeah. 538.96s - 540.52s | We could be complimentary. 540.52s - 541.86s | There's not a competition. 542.26s - 542.42s | Yeah. 542.42s - 543.50s | I think that's fantastic. 543.50s - 547.78s | Um, when I hear that story, I think about the dilemma that we have 547.78s - 549.98s | sort of in cybersecurity versus hacking. 550.58s - 556.06s | Um, so in hacking, you get to hack when you feel like hacking, right? 556.06s - 561.78s | It's when you are, um, opportunistically the stars align and you're inspired 561.78s - 565.58s | and you hack and it's great, uh, in InfoSec, you have to be professionally 565.62s - 567.18s | sort of creative all the time. 567.18s - 568.10s | You're on the clock. 568.56s - 570.00s | It's your page, you know, paycheck. 570.76s - 574.88s | And I, I remember the.com days as we came into this era, some people 574.92s - 576.44s | can't be professionally creative. 576.44s - 577.36s | That's not who they are. 577.58s - 578.64s | And other people can. 579.08s - 581.24s | And I remember reading a story about this. 581.24s - 584.72s | It was, I'm not the first to ever even think of this Disney animators. 584.72s - 589.48s | When animation went from a craft to an industry, the same thing 589.48s - 593.32s | happened, professional illustrators, animators versus not. 593.96s - 594.24s | Okay. 594.24s - 594.92s | So let's kick it off. 594.92s - 596.66s | I've got to, there's a bunch of stuff going on. 596.66s - 599.68s | I think the first, just most topical thing, top of mind, 599.68s - 600.68s | cause it's just so recent. 601.00s - 605.84s | It's it's like hack and leak Trump's complaining that somebody is coming 605.84s - 610.36s | after him, dumping his emails like this happens every election cycle now. 610.44s - 610.76s | Yeah. 610.76s - 612.44s | What what's old is new, right? 612.44s - 615.32s | And so


chunk_id: 197_chunk_12
chunk_text:
And I, I remember the.com days as we came into this era, some people 574.92s - 576.44s | can't be professionally creative. 576.44s - 577.36s | That's not who they are. 577.58s - 578.64s | And other people can. 579.08s - 581.24s | And I remember reading a story about this. 581.24s - 584.72s | It was, I'm not the first to ever even think of this Disney animators. 584.72s - 589.48s | When animation went from a craft to an industry, the same thing 589.48s - 593.32s | happened, professional illustrators, animators versus not. 593.96s - 594.24s | Okay. 594.24s - 594.92s | So let's kick it off. 594.92s - 596.66s | I've got to, there's a bunch of stuff going on. 596.66s - 599.68s | I think the first, just most topical thing, top of mind, 599.68s - 600.68s | cause it's just so recent. 601.00s - 605.84s | It's it's like hack and leak Trump's complaining that somebody is coming 605.84s - 610.36s | after him, dumping his emails like this happens every election cycle now. 610.44s - 610.76s | Yeah. 610.76s - 612.44s | What what's old is new, right? 612.44s - 615.32s | And so if you haven't followed, because you're in the DEF CON bubble, 615.68s - 620.04s | um, they announced, uh, in the last 24 hours that the Trump campaign 620.04s - 624.68s | was hit with a hack and journalists started receiving material, internal 624.70s - 626.24s | communications to the campaign. 626.70s - 627.26s | And. 628.10s - 631.90s | You know, the assumption is that we are in a cycle again with 631.90s - 634.06s | hack and leak already starting. 634.14s - 636.58s | And, you know, there's, there's various opinions and 636.58s - 638.06s | conjecture about who it is. 638.46s - 641.82s | Um, you know, being here and not in the know, I, you know, I'm not 641.82s - 645.54s | going to take, uh, take a guess at that, but you know, the, the 645.54s - 647.62s | ones we've seen in the past, right. 647.62s - 651.14s | We've certainly seen the Russians involved in hack and leaks 651.14s - 652.78s | and focused on our campaigns. 653.04s - 654.60s | We've also seen the Iranians. 654.60s - 658.42s | There was a lot of work in the, uh, in the previous election


chunk_id: 197_chunk_13
chunk_text:
if you haven't followed, because you're in the DEF CON bubble, 615.68s - 620.04s | um, they announced, uh, in the last 24 hours that the Trump campaign 620.04s - 624.68s | was hit with a hack and journalists started receiving material, internal 624.70s - 626.24s | communications to the campaign. 626.70s - 627.26s | And. 628.10s - 631.90s | You know, the assumption is that we are in a cycle again with 631.90s - 634.06s | hack and leak already starting. 634.14s - 636.58s | And, you know, there's, there's various opinions and 636.58s - 638.06s | conjecture about who it is. 638.46s - 641.82s | Um, you know, being here and not in the know, I, you know, I'm not 641.82s - 645.54s | going to take, uh, take a guess at that, but you know, the, the 645.54s - 647.62s | ones we've seen in the past, right. 647.62s - 651.14s | We've certainly seen the Russians involved in hack and leaks 651.14s - 652.78s | and focused on our campaigns. 653.04s - 654.60s | We've also seen the Iranians. 654.60s - 658.42s | There was a lot of work in the, uh, in the previous election 658.42s - 663.96s | cycle to pre bunk, meaning to debunk in advance before it came out. 663.96s - 668.36s | Some Iranian material focused on the campaigns and China has also been 668.36s - 670.16s | involved in some of the activities. 670.16s - 675.16s | They've been a little more careful and, and, uh, um, cautious in that space, 675.48s - 680.24s | but it is very clear and starting this early, it's, um, it's pretty surprising. 680.24s - 680.52s | Right. 680.78s - 684.46s | I can't imagine buckle up for October because I think we're in for a wild ride. 684.46s - 684.62s | Yeah. 684.62s - 684.82s | Yeah. 684.82s - 687.06s | The October surprise is coming early. 687.42s - 689.78s | That you, some, you mentioned pre bunking. 689.78s - 693.86s | I'm really disappointed that, that, that pre bunking is not terribly effective. 693.86s - 696.54s | You know, the studies show it doesn't work as well as we'd hoped. 696.82s - 699.70s | So we're still searching for tools to deal with this 699.70s - 701.52s | information or dismal information. 701.52s - 702.26s | It's yeah. 702.34s - 705.60s |


chunk_id: 197_chunk_14
chunk_text:
658.42s - 663.96s | cycle to pre bunk, meaning to debunk in advance before it came out. 663.96s - 668.36s | Some Iranian material focused on the campaigns and China has also been 668.36s - 670.16s | involved in some of the activities. 670.16s - 675.16s | They've been a little more careful and, and, uh, um, cautious in that space, 675.48s - 680.24s | but it is very clear and starting this early, it's, um, it's pretty surprising. 680.24s - 680.52s | Right. 680.78s - 684.46s | I can't imagine buckle up for October because I think we're in for a wild ride. 684.46s - 684.62s | Yeah. 684.62s - 684.82s | Yeah. 684.82s - 687.06s | The October surprise is coming early. 687.42s - 689.78s | That you, some, you mentioned pre bunking. 689.78s - 693.86s | I'm really disappointed that, that, that pre bunking is not terribly effective. 693.86s - 696.54s | You know, the studies show it doesn't work as well as we'd hoped. 696.82s - 699.70s | So we're still searching for tools to deal with this 699.70s - 701.52s | information or dismal information. 701.52s - 702.26s | It's yeah. 702.34s - 705.60s | One of the harder challenges is, you know, the Russians used to be 705.60s - 708.18s | awesome at creating disinformation. 708.56s - 712.88s | They would create whole storylines that, that would take people down a path. 713.28s - 718.52s | Now, unfortunately they don't have to, they, their MO today is to pick divisive 718.52s - 724.64s | issues that have people already pre loaded on both sides and just amplify the stuff 724.64s - 726.52s | that's naturally coming out of those communities. 726.56s - 728.28s | They'll just keep loading up both sides. 728.44s - 728.64s | Yes. 728.64s - 730.02s | Like they don't have to pick a side. 730.20s - 733.08s | And so I get frustrated when people tell me like, but why would the 733.08s - 736.84s | Russians like support though the liberals in France or whatever? 736.94s - 738.94s | It's like, you know, they, they support everybody. 739.18s - 740.74s | They just try to get everybody to fight. 741.22s - 741.38s | Yeah. 741.74s - 744.58s | Cause they want the perception of chaos or real chaos, right? 744.74s - 748.14s | They, they introduce it well, but


chunk_id: 197_chunk_15
chunk_text:
One of the harder challenges is, you know, the Russians used to be 705.60s - 708.18s | awesome at creating disinformation. 708.56s - 712.88s | They would create whole storylines that, that would take people down a path. 713.28s - 718.52s | Now, unfortunately they don't have to, they, their MO today is to pick divisive 718.52s - 724.64s | issues that have people already pre loaded on both sides and just amplify the stuff 724.64s - 726.52s | that's naturally coming out of those communities. 726.56s - 728.28s | They'll just keep loading up both sides. 728.44s - 728.64s | Yes. 728.64s - 730.02s | Like they don't have to pick a side. 730.20s - 733.08s | And so I get frustrated when people tell me like, but why would the 733.08s - 736.84s | Russians like support though the liberals in France or whatever? 736.94s - 738.94s | It's like, you know, they, they support everybody. 739.18s - 740.74s | They just try to get everybody to fight. 741.22s - 741.38s | Yeah. 741.74s - 744.58s | Cause they want the perception of chaos or real chaos, right? 744.74s - 748.14s | They, they introduce it well, but I think don't they, they also come. 749.22s - 750.46s | There's a boomerang effect, right? 750.46s - 753.62s | We saw that a little bit with COVID when they started fueling the anti COVID 753.62s - 756.50s | stuff for the West and then it blows up and now there's an anti COVID movement 756.50s - 760.10s | in Russia and it's like, it comes back now, I think some of it when they try to 760.10s - 762.02s | take some of the technical issues, right? 762.32s - 767.56s | Often it's often it's, um, you know, more domestic and they seem successful with 767.56s - 767.80s | those. 767.84s - 768.20s | Yeah. 768.40s - 768.68s | Yeah. 768.72s - 772.24s | Well, they must have to have a way of preventing it from coming back at them. 772.84s - 774.64s | And you can see that in the APTs, right? 774.64s - 777.44s | If it's a Cyrillic keyboard setting, don't infect. 778.08s - 783.08s | Um, so I've got to figure out a way to have two keyboards plugged in or add, 783.08s - 784.92s | maybe just add Cyrillic as a language pack. 784.92s


chunk_id: 197_chunk_16
chunk_text:
I think don't they, they also come. 749.22s - 750.46s | There's a boomerang effect, right? 750.46s - 753.62s | We saw that a little bit with COVID when they started fueling the anti COVID 753.62s - 756.50s | stuff for the West and then it blows up and now there's an anti COVID movement 756.50s - 760.10s | in Russia and it's like, it comes back now, I think some of it when they try to 760.10s - 762.02s | take some of the technical issues, right? 762.32s - 767.56s | Often it's often it's, um, you know, more domestic and they seem successful with 767.56s - 767.80s | those. 767.84s - 768.20s | Yeah. 768.40s - 768.68s | Yeah. 768.72s - 772.24s | Well, they must have to have a way of preventing it from coming back at them. 772.84s - 774.64s | And you can see that in the APTs, right? 774.64s - 777.44s | If it's a Cyrillic keyboard setting, don't infect. 778.08s - 783.08s | Um, so I've got to figure out a way to have two keyboards plugged in or add, 783.08s - 784.92s | maybe just add Cyrillic as a language pack. 784.92s - 785.28s | You can. 785.40s - 785.68s | Yeah. 785.68s - 786.48s | And that does work. 786.68s - 787.20s | Uh, it works. 787.20s - 789.72s | And then Chinese and then I should just load them all. 791.40s - 791.76s | Yeah. 792.68s - 793.04s | Okay. 793.24s - 798.48s | So then, um, so the, one of the countries you mentioned China, I mean, they're, 798.60s - 799.80s | they're having a moment. 799.82s - 802.16s | They're, um, they're getting pretty aggressive. 802.68s - 802.88s | Yeah. 802.92s - 808.56s | Um, you know, not just volt typhoon, but I don't emotionally, it was like, okay, 808.56s - 809.44s | it's espionage. 809.44s - 812.80s | You're doing recon, you're stealing secrets, which sucks. 813.68s - 817.88s | But now it's like, you're preparing the battlefield and that's not so cool. 818.46s - 822.46s | And so we're pulling their stuff out as fast as we can possibly pull it out. 822.46s - 824.06s | And it's going in as fast as we can find it. 824.06s - 828.34s | And it's, it's, it doesn't seem like there's much public awareness about like 828.34s -


chunk_id: 197_chunk_17
chunk_text:
- 785.28s | You can. 785.40s - 785.68s | Yeah. 785.68s - 786.48s | And that does work. 786.68s - 787.20s | Uh, it works. 787.20s - 789.72s | And then Chinese and then I should just load them all. 791.40s - 791.76s | Yeah. 792.68s - 793.04s | Okay. 793.24s - 798.48s | So then, um, so the, one of the countries you mentioned China, I mean, they're, 798.60s - 799.80s | they're having a moment. 799.82s - 802.16s | They're, um, they're getting pretty aggressive. 802.68s - 802.88s | Yeah. 802.92s - 808.56s | Um, you know, not just volt typhoon, but I don't emotionally, it was like, okay, 808.56s - 809.44s | it's espionage. 809.44s - 812.80s | You're doing recon, you're stealing secrets, which sucks. 813.68s - 817.88s | But now it's like, you're preparing the battlefield and that's not so cool. 818.46s - 822.46s | And so we're pulling their stuff out as fast as we can possibly pull it out. 822.46s - 824.06s | And it's going in as fast as we can find it. 824.06s - 828.34s | And it's, it's, it doesn't seem like there's much public awareness about like 828.34s - 832.26s | how warm, not hot, how warm this effort is. 832.26s - 835.74s | And, and you've seen it probably much longer and can maybe contextualize 835.74s - 836.62s | it better for us. 837.06s - 837.30s | Yeah. 837.30s - 842.22s | So the, the, the reference Jeff's making is to a camp series of campaigns that 842.22s - 846.38s | are coming at the U S if you look for volt typhoon in some of the media 846.38s - 851.04s | references going back, um, as much as two years now where we've been chasing 851.04s - 856.16s | this, um, hacking activity, mostly living off the land technology where they're 856.16s - 859.84s | not bringing malware, but they're bringing techniques to gain access to 859.84s - 864.08s | networks, but it is the networks themselves that they're gaining access 864.08s - 865.72s | to, which is the differentiator. 866.20s - 871.52s | There's a set of them that are military related things that we would need to 871.52s - 875.96s | respond to a crisis in, um, you know, in the Asian hemisphere. 876.44s - 880.84s | Um, so if China, Taiwan were to kick


chunk_id: 197_chunk_18
chunk_text:
832.26s | how warm, not hot, how warm this effort is. 832.26s - 835.74s | And, and you've seen it probably much longer and can maybe contextualize 835.74s - 836.62s | it better for us. 837.06s - 837.30s | Yeah. 837.30s - 842.22s | So the, the, the reference Jeff's making is to a camp series of campaigns that 842.22s - 846.38s | are coming at the U S if you look for volt typhoon in some of the media 846.38s - 851.04s | references going back, um, as much as two years now where we've been chasing 851.04s - 856.16s | this, um, hacking activity, mostly living off the land technology where they're 856.16s - 859.84s | not bringing malware, but they're bringing techniques to gain access to 859.84s - 864.08s | networks, but it is the networks themselves that they're gaining access 864.08s - 865.72s | to, which is the differentiator. 866.20s - 871.52s | There's a set of them that are military related things that we would need to 871.52s - 875.96s | respond to a crisis in, um, you know, in the Asian hemisphere. 876.44s - 880.84s | Um, so if China, Taiwan were to kick off, um, you know, what would we have to do? 880.84s - 884.84s | We'd have to move a lot of troops and material all the way from the 884.84s - 886.88s | West over into that theater. 887.08s - 890.12s | We would stage and go through Hawaii and Guam. 890.12s - 894.72s | And so there's, there's implementation of hacks into critical 894.72s - 896.44s | infrastructure in Hawaii and Guam. 897.02s - 900.60s | You can say that's, you know, military preparations, but this 900.60s - 902.40s | campaign goes farther than that. 902.46s - 906.02s | It goes all the way back to domestic us where the critical 906.02s - 911.58s | infrastructures like transportation, aviation, pipelines, electricity 911.94s - 915.46s | are all being targeted with the same set of living off the land techniques. 915.78s - 919.74s | And the intent there is not to disrupt the military, but 919.74s - 921.82s | to create societal panic, right? 921.86s - 925.90s | There's, there is, there's language for that when you're trying to 925.90s - 928.98s | induce panic in a society and that's terrorism, right? 928.98s - 934.00s | This prepositioning literally is


chunk_id: 197_chunk_19
chunk_text:
off, um, you know, what would we have to do? 880.84s - 884.84s | We'd have to move a lot of troops and material all the way from the 884.84s - 886.88s | West over into that theater. 887.08s - 890.12s | We would stage and go through Hawaii and Guam. 890.12s - 894.72s | And so there's, there's implementation of hacks into critical 894.72s - 896.44s | infrastructure in Hawaii and Guam. 897.02s - 900.60s | You can say that's, you know, military preparations, but this 900.60s - 902.40s | campaign goes farther than that. 902.46s - 906.02s | It goes all the way back to domestic us where the critical 906.02s - 911.58s | infrastructures like transportation, aviation, pipelines, electricity 911.94s - 915.46s | are all being targeted with the same set of living off the land techniques. 915.78s - 919.74s | And the intent there is not to disrupt the military, but 919.74s - 921.82s | to create societal panic, right? 921.86s - 925.90s | There's, there is, there's language for that when you're trying to 925.90s - 928.98s | induce panic in a society and that's terrorism, right? 928.98s - 934.00s | This prepositioning literally is with the intent of being able to execute 934.00s - 935.88s | terrorism against the U S population. 935.88s - 943.52s | So we've moved, um, far down the rabbit hole in this work where, um, you know, 943.52s - 948.80s | there's, there's set up for great power competition and preparations for conflict. 949.36s - 955.48s | It kind of sucks when you're, you're in this kind of a contest and we don't 955.48s - 958.72s | necessarily ascribe to those kind of rules, right? 958.72s - 960.38s | We don't really behave that way. 960.42s - 964.06s | I'm hoping that we're breaking in and stealing all their secrets, but we're 964.06s - 965.82s | not stealing their corporate secrets. 966.38s - 969.62s | And it just feels like it's an uneven matchup, right? 969.74s - 970.70s | It definitely is. 970.70s - 973.78s | And, you know, that's one of the challenges is, you know, we're a 973.78s - 975.90s | society, a rule of law society. 976.26s - 979.66s | So, um, you know, one of the things the military does, we have a cyber 979.66s - 984.02s | command, but they are bound by the


chunk_id: 197_chunk_20
chunk_text:
with the intent of being able to execute 934.00s - 935.88s | terrorism against the U S population. 935.88s - 943.52s | So we've moved, um, far down the rabbit hole in this work where, um, you know, 943.52s - 948.80s | there's, there's set up for great power competition and preparations for conflict. 949.36s - 955.48s | It kind of sucks when you're, you're in this kind of a contest and we don't 955.48s - 958.72s | necessarily ascribe to those kind of rules, right? 958.72s - 960.38s | We don't really behave that way. 960.42s - 964.06s | I'm hoping that we're breaking in and stealing all their secrets, but we're 964.06s - 965.82s | not stealing their corporate secrets. 966.38s - 969.62s | And it just feels like it's an uneven matchup, right? 969.74s - 970.70s | It definitely is. 970.70s - 973.78s | And, you know, that's one of the challenges is, you know, we're a 973.78s - 975.90s | society, a rule of law society. 976.26s - 979.66s | So, um, you know, one of the things the military does, we have a cyber 979.66s - 984.02s | command, but they are bound by the law of armed conflict and that law of 984.02s - 988.50s | armed conflict says you're not going to create generic pain and suffering 988.50s - 990.24s | to a civilian population. 990.52s - 994.64s | So things like a water plant and an aviation, general civilian 994.64s - 1000.12s | aviation, um, electric grid, those are off limits because of the, the, the 1000.12s - 1002.80s | broad nature and the unfocused. 1002.96s - 1007.32s | And it's, it's, I guess China is very much, you know, dual use early days, 1007.32s - 1012.24s | Russia, you know, single use, but now that the world's dual use, you really 1012.24s - 1017.56s | have to spend time, I bet de-conflicting like multi-tenant in a structure or 1017.56s - 1019.18s | building or a network stack, right? 1019.18s - 1021.78s | How do you, you have to have a whole team that does nothing, but. 1022.54s - 1022.74s | Yeah. 1022.74s - 1026.26s | When, when I joined NSA, you know, the world was simple. 1026.26s - 1027.42s | It was the cold war. 1027.42s - 1034.02s | It was bipolar tensions, Russia, us, and the Russian things that we


chunk_id: 197_chunk_21
chunk_text:
law of armed conflict and that law of 984.02s - 988.50s | armed conflict says you're not going to create generic pain and suffering 988.50s - 990.24s | to a civilian population. 990.52s - 994.64s | So things like a water plant and an aviation, general civilian 994.64s - 1000.12s | aviation, um, electric grid, those are off limits because of the, the, the 1000.12s - 1002.80s | broad nature and the unfocused. 1002.96s - 1007.32s | And it's, it's, I guess China is very much, you know, dual use early days, 1007.32s - 1012.24s | Russia, you know, single use, but now that the world's dual use, you really 1012.24s - 1017.56s | have to spend time, I bet de-conflicting like multi-tenant in a structure or 1017.56s - 1019.18s | building or a network stack, right? 1019.18s - 1021.78s | How do you, you have to have a whole team that does nothing, but. 1022.54s - 1022.74s | Yeah. 1022.74s - 1026.26s | When, when I joined NSA, you know, the world was simple. 1026.26s - 1027.42s | It was the cold war. 1027.42s - 1034.02s | It was bipolar tensions, Russia, us, and the Russian things that we cared 1034.02s - 1039.06s | about were these bespoke military communications, bespoke government 1039.06s - 1044.02s | devices, and now, you know, the world's on Microsoft windows, the, the world 1044.16s - 1050.40s | on all of these major us branded, um, infrastructure between switches and 1050.40s - 1052.52s | routers and firewalls and other things. 1052.92s - 1057.00s | And so, yeah, it is definitely a dual use, um, world we've entered. 1058.08s - 1060.08s | So, um, so what do we do? 1060.08s - 1062.64s | I mean, are the politicians sort of up to speed or are we 1062.64s - 1063.80s | organized the right way? 1063.80s - 1068.26s | Do you think, is it, do we need a new revolution or new way of, uh, you 1068.26s - 1072.00s | know, virtualization, like, what are your thoughts on how do we navigate 1072.10s - 1074.14s | besides just keep pulling their stuff out? 1074.90s - 1078.14s | Well, I think one of the big tools in the tool belt is 1078.14s - 1080.26s | this continuous engagement, right? 1080.26s - 1084.50s | You'll, you'll hear general Nakasone was here, you know, as former director 1084.50s -


chunk_id: 197_chunk_22
chunk_text:
cared 1034.02s - 1039.06s | about were these bespoke military communications, bespoke government 1039.06s - 1044.02s | devices, and now, you know, the world's on Microsoft windows, the, the world 1044.16s - 1050.40s | on all of these major us branded, um, infrastructure between switches and 1050.40s - 1052.52s | routers and firewalls and other things. 1052.92s - 1057.00s | And so, yeah, it is definitely a dual use, um, world we've entered. 1058.08s - 1060.08s | So, um, so what do we do? 1060.08s - 1062.64s | I mean, are the politicians sort of up to speed or are we 1062.64s - 1063.80s | organized the right way? 1063.80s - 1068.26s | Do you think, is it, do we need a new revolution or new way of, uh, you 1068.26s - 1072.00s | know, virtualization, like, what are your thoughts on how do we navigate 1072.10s - 1074.14s | besides just keep pulling their stuff out? 1074.90s - 1078.14s | Well, I think one of the big tools in the tool belt is 1078.14s - 1080.26s | this continuous engagement, right? 1080.26s - 1084.50s | You'll, you'll hear general Nakasone was here, you know, as former director 1084.50s - 1090.22s | NSA, he pushed this idea of continuous engagement that, you know, if you, if 1090.22s - 1094.30s | you think about a soccer field, um, you know, it's not a great strategy if 1094.30s - 1099.10s | the opposing team gets to shoot unlimited, um, shots on your goal. 1099.44s - 1102.64s | Um, and you just have to play defense continuously and try 1102.64s - 1103.92s | to stop each and every kick. 1104.28s - 1108.80s | The idea that you've got to be out there and, you know, and attacking 1108.80s - 1112.84s | into, um, the far end of the field and bringing the pressure back to them 1113.08s - 1119.04s | so that you use multiple tools to go and take away their implants, take 1119.04s - 1123.68s | away their infrastructure, um, reveal their, their tools and intent, right? 1123.68s - 1125.62s | That's one of the superpowers of NSA. 1125.96s - 1130.52s | I mentioned that, you know, the, there's the intent by China to create 1130.52s - 1136.18s | societal panic, that that intent is not something you find on an 1136.18s - 1138.44s | incident response activity, right? 1138.46s -


chunk_id: 197_chunk_23
chunk_text:
1090.22s | NSA, he pushed this idea of continuous engagement that, you know, if you, if 1090.22s - 1094.30s | you think about a soccer field, um, you know, it's not a great strategy if 1094.30s - 1099.10s | the opposing team gets to shoot unlimited, um, shots on your goal. 1099.44s - 1102.64s | Um, and you just have to play defense continuously and try 1102.64s - 1103.92s | to stop each and every kick. 1104.28s - 1108.80s | The idea that you've got to be out there and, you know, and attacking 1108.80s - 1112.84s | into, um, the far end of the field and bringing the pressure back to them 1113.08s - 1119.04s | so that you use multiple tools to go and take away their implants, take 1119.04s - 1123.68s | away their infrastructure, um, reveal their, their tools and intent, right? 1123.68s - 1125.62s | That's one of the superpowers of NSA. 1125.96s - 1130.52s | I mentioned that, you know, the, there's the intent by China to create 1130.52s - 1136.18s | societal panic, that that intent is not something you find on an 1136.18s - 1138.44s | incident response activity, right? 1138.46s - 1144.38s | That's an intelligence policy, um, uh, development where you understand 1144.38s - 1149.48s | them giving commands, orders, resources to execute this command. 1149.76s - 1152.92s | And that's where the public private partnership is really important 1152.94s - 1156.90s | because, you know, the hyperscale cloud providers, the operating system 1156.90s - 1162.06s | vendors, the, uh, the, the internet backbone, um, providers, they are 1162.06s - 1167.32s | going to see the activity, um, and they actually are in a better position 1167.32s - 1168.86s | to do something about it, right? 1168.86s - 1174.58s | To do that community defense, to clean the pipes, to challenge some of this. 1175.02s - 1181.14s | But you need the, the connection to that intent and you need the community 1181.14s - 1186.08s | to come together because no one element in that, in that ecosystem really. 1186.36s - 1186.84s | I'm curious. 1186.84s - 1189.76s | How do you, how do you, um, when you were inside, how do you 1189.76s - 1192.80s | view open source intelligence? 1192.84s - 1196.52s | There's just an unlimited of different feeds you could spend all of your 1196.52s -


chunk_id: 197_chunk_24
chunk_text:
1144.38s | That's an intelligence policy, um, uh, development where you understand 1144.38s - 1149.48s | them giving commands, orders, resources to execute this command. 1149.76s - 1152.92s | And that's where the public private partnership is really important 1152.94s - 1156.90s | because, you know, the hyperscale cloud providers, the operating system 1156.90s - 1162.06s | vendors, the, uh, the, the internet backbone, um, providers, they are 1162.06s - 1167.32s | going to see the activity, um, and they actually are in a better position 1167.32s - 1168.86s | to do something about it, right? 1168.86s - 1174.58s | To do that community defense, to clean the pipes, to challenge some of this. 1175.02s - 1181.14s | But you need the, the connection to that intent and you need the community 1181.14s - 1186.08s | to come together because no one element in that, in that ecosystem really. 1186.36s - 1186.84s | I'm curious. 1186.84s - 1189.76s | How do you, how do you, um, when you were inside, how do you 1189.76s - 1192.80s | view open source intelligence? 1192.84s - 1196.52s | There's just an unlimited of different feeds you could spend all of your 1196.52s - 1198.48s | budget buying different threat feeds. 1199.00s - 1203.80s | Um, maybe give some people a way of thinking about how to orient to this 1203.92s - 1209.40s | unlimited amount of potential intelligence and is it useful, you know, what do you. 1209.50s - 1212.14s | Yeah, it, it's absolutely useful. 1212.22s - 1219.58s | Um, you know, because it's available and, and, um, you can get it through 1219.58s - 1224.46s | open source places, that's not where the special sauce of NSA is applied. 1224.82s - 1225.06s | Right. 1225.06s - 1229.06s | But there's some point where you've got to bring together the ability to know 1229.06s - 1234.58s | things that are knowable in the outside with that special intelligence that you 1234.58s - 1237.84s | can only get from classified techniques. 1237.94s - 1242.82s | And so, um, you know, we actually started an organization, the 1242.82s - 1247.62s | cybersecurity collaboration center to bring the classified material out into 1247.62s - 1253.50s | industry where they could then find more examples of the tradecraft techniques, 1253.50s - 1254.98s | intrusions, or other things. 1255.42s - 1259.18s | Um, and they quite frankly


chunk_id: 197_chunk_25
chunk_text:
1198.48s | budget buying different threat feeds. 1199.00s - 1203.80s | Um, maybe give some people a way of thinking about how to orient to this 1203.92s - 1209.40s | unlimited amount of potential intelligence and is it useful, you know, what do you. 1209.50s - 1212.14s | Yeah, it, it's absolutely useful. 1212.22s - 1219.58s | Um, you know, because it's available and, and, um, you can get it through 1219.58s - 1224.46s | open source places, that's not where the special sauce of NSA is applied. 1224.82s - 1225.06s | Right. 1225.06s - 1229.06s | But there's some point where you've got to bring together the ability to know 1229.06s - 1234.58s | things that are knowable in the outside with that special intelligence that you 1234.58s - 1237.84s | can only get from classified techniques. 1237.94s - 1242.82s | And so, um, you know, we actually started an organization, the 1242.82s - 1247.62s | cybersecurity collaboration center to bring the classified material out into 1247.62s - 1253.50s | industry where they could then find more examples of the tradecraft techniques, 1253.50s - 1254.98s | intrusions, or other things. 1255.42s - 1259.18s | Um, and they quite frankly are the ones who can do something about it. 1259.46s - 1264.30s | So, uh, a lot of work to connect in that unclassified space where industry works. 1264.78s - 1265.78s | Yeah, that's fantastic. 1265.80s - 1270.04s | Now, is that a widespread bottle or is that kind of unique to the U S or are we 1270.04s - 1273.36s | sort of taking pages out of other countries playbooks because we're not the 1273.36s - 1277.32s | only ones under pressure, there's a lot of other countries being targeted as well. 1277.56s - 1282.00s | And so I, I'm guessing that's almost like this ecosystem of experimentation of like, 1282.00s - 1285.72s | you know, if I eat garlic, does it keep the Chinese away, you know, instead of 1285.72s - 1290.68s | the vampire, if I, you know, only route my packets through this, you know, what 1290.68s - 1293.40s | are people trying is it's, it's gotta be massive experimentation. 1293.50s - 1293.74s | Yeah. 1293.74s - 1298.26s | So, so there's a lot of, um, international collaboration, cooperation, 1298.26s - 1303.26s | cybersecurity is really a cross cutting issue that a lot of people can


chunk_id: 197_chunk_26
chunk_text:
are the ones who can do something about it. 1259.46s - 1264.30s | So, uh, a lot of work to connect in that unclassified space where industry works. 1264.78s - 1265.78s | Yeah, that's fantastic. 1265.80s - 1270.04s | Now, is that a widespread bottle or is that kind of unique to the U S or are we 1270.04s - 1273.36s | sort of taking pages out of other countries playbooks because we're not the 1273.36s - 1277.32s | only ones under pressure, there's a lot of other countries being targeted as well. 1277.56s - 1282.00s | And so I, I'm guessing that's almost like this ecosystem of experimentation of like, 1282.00s - 1285.72s | you know, if I eat garlic, does it keep the Chinese away, you know, instead of 1285.72s - 1290.68s | the vampire, if I, you know, only route my packets through this, you know, what 1290.68s - 1293.40s | are people trying is it's, it's gotta be massive experimentation. 1293.50s - 1293.74s | Yeah. 1293.74s - 1298.26s | So, so there's a lot of, um, international collaboration, cooperation, 1298.26s - 1303.26s | cybersecurity is really a cross cutting issue that a lot of people can rally 1303.26s - 1308.22s | behind, but at the same time, the U S is unique in that, you know, you look at the 1308.22s - 1312.78s | technologists that gather at places like DEF CON, you look at the power of the 1312.78s - 1317.70s | Valley, you look at the major hyperscale cloud providers are U S right. 1317.90s - 1322.34s | So there, there is a responsibility to get the American industry involved 1322.56s - 1325.92s | because they're global multinational companies and they're the ones who can 1325.92s - 1330.48s | actually make sea change, but you know, we've got friends and allies, you, you 1330.48s - 1336.68s | look at the UK has the, um, national cybersecurity center and they, um, have 1336.68s - 1340.32s | a lot of like-minded ideas and there's things that they innovate and, and flow 1340.32s - 1344.56s | over here and there's things we do, they copy, you know, Israel is another example 1344.56s - 1350.88s | of, you know, dense, um, technical capable organization and somebody that's under 1350.90s - 1355.38s | threat, quite frankly, a lot of the time, um, from their Iranian conflicts. 1355.38s - 1359.62s


chunk_id: 197_chunk_27
chunk_text:
rally 1303.26s - 1308.22s | behind, but at the same time, the U S is unique in that, you know, you look at the 1308.22s - 1312.78s | technologists that gather at places like DEF CON, you look at the power of the 1312.78s - 1317.70s | Valley, you look at the major hyperscale cloud providers are U S right. 1317.90s - 1322.34s | So there, there is a responsibility to get the American industry involved 1322.56s - 1325.92s | because they're global multinational companies and they're the ones who can 1325.92s - 1330.48s | actually make sea change, but you know, we've got friends and allies, you, you 1330.48s - 1336.68s | look at the UK has the, um, national cybersecurity center and they, um, have 1336.68s - 1340.32s | a lot of like-minded ideas and there's things that they innovate and, and flow 1340.32s - 1344.56s | over here and there's things we do, they copy, you know, Israel is another example 1344.56s - 1350.88s | of, you know, dense, um, technical capable organization and somebody that's under 1350.90s - 1355.38s | threat, quite frankly, a lot of the time, um, from their Iranian conflicts. 1355.38s - 1359.62s | So, um, you know, we learn from them because they're in the tactical 1359.62s - 1361.26s | knife fight each and every day. 1361.90s - 1366.58s | There's, um, there's this, I guess, interesting alignment, uh, worrying 1366.58s - 1369.86s | alignment over the last year or two with, with Russia and China getting 1369.86s - 1371.40s | closer and closer together. 1371.82s - 1376.34s | Um, so I'm wondering if you'll, if they'll, do they share these kinds of 1376.34s - 1379.78s | techniques in your experience or do they, when, when countries get close to each 1379.80s - 1384.04s | other, they still keep these capabilities separate and they just kind of support 1384.04s - 1385.56s | each other, but they never merge. 1385.88s - 1392.48s | Yeah, I, I think, um, you know, there's still, well, there's, there's common 1392.48s - 1394.28s | reasons for them to get together. 1394.72s - 1396.68s | Um, they still distrust each other a lot. 1396.92s - 1401.24s | And so we don't see the kind of collaboration that you do, um, like 1401.24s - 1402.58s | with the five eyes countries. 1402.68s - 1407.76s | So you wouldn't see


chunk_id: 197_chunk_28
chunk_text:
| So, um, you know, we learn from them because they're in the tactical 1359.62s - 1361.26s | knife fight each and every day. 1361.90s - 1366.58s | There's, um, there's this, I guess, interesting alignment, uh, worrying 1366.58s - 1369.86s | alignment over the last year or two with, with Russia and China getting 1369.86s - 1371.40s | closer and closer together. 1371.82s - 1376.34s | Um, so I'm wondering if you'll, if they'll, do they share these kinds of 1376.34s - 1379.78s | techniques in your experience or do they, when, when countries get close to each 1379.80s - 1384.04s | other, they still keep these capabilities separate and they just kind of support 1384.04s - 1385.56s | each other, but they never merge. 1385.88s - 1392.48s | Yeah, I, I think, um, you know, there's still, well, there's, there's common 1392.48s - 1394.28s | reasons for them to get together. 1394.72s - 1396.68s | Um, they still distrust each other a lot. 1396.92s - 1401.24s | And so we don't see the kind of collaboration that you do, um, like 1401.24s - 1402.58s | with the five eyes countries. 1402.68s - 1407.76s | So you wouldn't see like coming, coming in from, let's say a Russian kind of IOC 1408.26s - 1410.86s | signature, but really it's on behalf of. 1411.78s - 1412.06s | Yeah. 1412.62s - 1416.14s | Don't believe you'd see that unless somebody is adopting tools to do false 1416.14s - 1418.78s | flags and, you know, change the scent. 1418.90s - 1421.86s | Because I'm curious, because in China that's, you know, they, they do have 1421.86s - 1424.18s | their sort of rule of law rule of the party. 1424.62s - 1427.50s | And in Russia, there's this big connection between the sort of 1427.50s - 1429.06s | organized crime in the state. 1429.06s - 1432.54s | I mean, you can't really sometimes tell which is which right. 1432.62s - 1435.82s | And so those two models aren't really compatible. 1435.82s - 1436.58s | I don't think. 1436.72s - 1441.08s | I don't think the, the Chinese leadership would be cool with this, you know, arms 1441.08s - 1444.52s | distance criminals really running the show. 1444.60s - 1451.96s | And so it makes me think that, um, ransomware and a lot of these, uh, highly 1452.00s - 1456.88s | technical, sophisticated,


chunk_id: 197_chunk_29
chunk_text:
like coming, coming in from, let's say a Russian kind of IOC 1408.26s - 1410.86s | signature, but really it's on behalf of. 1411.78s - 1412.06s | Yeah. 1412.62s - 1416.14s | Don't believe you'd see that unless somebody is adopting tools to do false 1416.14s - 1418.78s | flags and, you know, change the scent. 1418.90s - 1421.86s | Because I'm curious, because in China that's, you know, they, they do have 1421.86s - 1424.18s | their sort of rule of law rule of the party. 1424.62s - 1427.50s | And in Russia, there's this big connection between the sort of 1427.50s - 1429.06s | organized crime in the state. 1429.06s - 1432.54s | I mean, you can't really sometimes tell which is which right. 1432.62s - 1435.82s | And so those two models aren't really compatible. 1435.82s - 1436.58s | I don't think. 1436.72s - 1441.08s | I don't think the, the Chinese leadership would be cool with this, you know, arms 1441.08s - 1444.52s | distance criminals really running the show. 1444.60s - 1451.96s | And so it makes me think that, um, ransomware and a lot of these, uh, highly 1452.00s - 1456.88s | technical, sophisticated, uh, crime operations seem to be mostly coming from 1456.88s - 1458.18s | Russia, right? 1458.18s - 1459.88s | They're not really coming from China. 1460.48s - 1460.68s | Yeah. 1461.36s - 1465.52s | There, there is a set of China, um, that's active in it. 1465.66s - 1472.58s | Um, so if any of you saw the ISUN leaks, there was a company called ISUN got 1472.58s - 1474.58s | hacked and their data was dumped. 1474.94s - 1480.30s | It was really an interesting kind of case study into the Chinese ecosystem. 1480.74s - 1486.50s | They have a lot of independent companies who hack on their own, but then market 1486.50s - 1490.54s | the things that they gather back to the Chinese government so they don't get 1490.54s - 1494.68s | direct direction, they may get direction to build tools and infrastructure, but 1494.70s - 1497.30s | then those tools and infrastructure become dual uses. 1497.30s - 1498.30s | They run their own ops. 1499.02s - 1503.90s | Um, we don't see kind of the same ecosystem happen in the, in the Russian 1503.90s - 1507.46s | space where they do leverage the criminal ecosystem. 1507.98s


chunk_id: 197_chunk_30
chunk_text:
uh, crime operations seem to be mostly coming from 1456.88s - 1458.18s | Russia, right? 1458.18s - 1459.88s | They're not really coming from China. 1460.48s - 1460.68s | Yeah. 1461.36s - 1465.52s | There, there is a set of China, um, that's active in it. 1465.66s - 1472.58s | Um, so if any of you saw the ISUN leaks, there was a company called ISUN got 1472.58s - 1474.58s | hacked and their data was dumped. 1474.94s - 1480.30s | It was really an interesting kind of case study into the Chinese ecosystem. 1480.74s - 1486.50s | They have a lot of independent companies who hack on their own, but then market 1486.50s - 1490.54s | the things that they gather back to the Chinese government so they don't get 1490.54s - 1494.68s | direct direction, they may get direction to build tools and infrastructure, but 1494.70s - 1497.30s | then those tools and infrastructure become dual uses. 1497.30s - 1498.30s | They run their own ops. 1499.02s - 1503.90s | Um, we don't see kind of the same ecosystem happen in the, in the Russian 1503.90s - 1507.46s | space where they do leverage the criminal ecosystem. 1507.98s - 1512.74s | Um, but in both cases, they provide this safe haven. 1513.10s - 1518.98s | They know the, uh, the, the players, they, um, they enable the players in that 1518.98s - 1523.34s | they certainly don't constrain them, but they also interact with them in different 1523.34s - 1523.70s | ways. 1524.00s - 1524.20s | Yeah. 1524.20s - 1528.56s | It's curious because you can watch what kind of prosecutions, uh, or news 1528.56s - 1530.52s | coverages are happening in Russia or China. 1530.52s - 1534.08s | And you can see in the States, you'll see prosecutions from computer crime all 1534.08s - 1534.62s | the time. 1535.28s - 1538.82s | Um, and maybe it's just not reported the same way there, but it just, it definitely 1538.82s - 1542.42s | seems like the types of crimes that are getting reported or, or publicly talked 1542.42s - 1546.96s | about are quite different, which makes you think that either they don't care or 1546.96s - 1551.24s | they're using it, you know, for recruitment or training or something's going on. 1551.24s - 1551.84s | That's different. 1552.44s - 1552.72s | Yeah. 1552.86s - 1559.14s | Um,


chunk_id: 197_chunk_31
chunk_text:
- 1512.74s | Um, but in both cases, they provide this safe haven. 1513.10s - 1518.98s | They know the, uh, the, the players, they, um, they enable the players in that 1518.98s - 1523.34s | they certainly don't constrain them, but they also interact with them in different 1523.34s - 1523.70s | ways. 1524.00s - 1524.20s | Yeah. 1524.20s - 1528.56s | It's curious because you can watch what kind of prosecutions, uh, or news 1528.56s - 1530.52s | coverages are happening in Russia or China. 1530.52s - 1534.08s | And you can see in the States, you'll see prosecutions from computer crime all 1534.08s - 1534.62s | the time. 1535.28s - 1538.82s | Um, and maybe it's just not reported the same way there, but it just, it definitely 1538.82s - 1542.42s | seems like the types of crimes that are getting reported or, or publicly talked 1542.42s - 1546.96s | about are quite different, which makes you think that either they don't care or 1546.96s - 1551.24s | they're using it, you know, for recruitment or training or something's going on. 1551.24s - 1551.84s | That's different. 1552.44s - 1552.72s | Yeah. 1552.86s - 1559.14s | Um, then those nation States do treat their hacker element as, you know, uh, a 1559.14s - 1564.26s | national asset and they use them differently, but there's the spectrum that 1564.26s - 1567.38s | goes from the very official nation state. 1567.46s - 1572.66s | You know, you work for the military, the Intel service, some special branch of the 1572.66s - 1578.82s | government to do intelligence operations or cyber operations in advance all the 1578.82s - 1583.68s | way down through this quasi, I know and understand it's going on. 1584.04s - 1589.16s | I either task it or I just accept the benefits of it all the way down to, um, 1589.20s - 1590.04s | last couple of years. 1590.04s - 1594.78s | The interesting one is, um, some of the hacktivist space where you get inspired 1594.78s - 1599.40s | by a national requirement and take action. 1599.78s - 1604.02s | I'm thinking, you know, the, the Russian hackers to Ukraine, the Ukrainian hackers 1604.02s - 1608.68s | to Russia, um, some of the Israel, um, Hamas, Palestine. 1608.80s - 1613.80s | Yeah, this is, is this, it seems to me to be pretty unique that


chunk_id: 197_chunk_32
chunk_text:
then those nation States do treat their hacker element as, you know, uh, a 1559.14s - 1564.26s | national asset and they use them differently, but there's the spectrum that 1564.26s - 1567.38s | goes from the very official nation state. 1567.46s - 1572.66s | You know, you work for the military, the Intel service, some special branch of the 1572.66s - 1578.82s | government to do intelligence operations or cyber operations in advance all the 1578.82s - 1583.68s | way down through this quasi, I know and understand it's going on. 1584.04s - 1589.16s | I either task it or I just accept the benefits of it all the way down to, um, 1589.20s - 1590.04s | last couple of years. 1590.04s - 1594.78s | The interesting one is, um, some of the hacktivist space where you get inspired 1594.78s - 1599.40s | by a national requirement and take action. 1599.78s - 1604.02s | I'm thinking, you know, the, the Russian hackers to Ukraine, the Ukrainian hackers 1604.02s - 1608.68s | to Russia, um, some of the Israel, um, Hamas, Palestine. 1608.80s - 1613.80s | Yeah, this is, is this, it seems to me to be pretty unique that a country would 1613.80s - 1618.96s | basically turn to the public and say, okay, hack on our behalf, go get them. 1619.32s - 1622.36s | And, and I'm going to tell an NSA story cause it's unclassified. 1622.80s - 1628.60s | Um, years ago there was this, uh, uh, a meeting with the industry and folks 1629.46s - 1634.26s | that NSA was hosting and part of it was sort of the, uh, I think it was called 1634.26s - 1637.02s | like cyber red Dawn was sort of the theme. 1637.42s - 1643.42s | And the idea was, is there, they were exploring the concept, could there ever 1643.42s - 1644.78s | be a sort of cyber red Dawn? 1644.78s - 1646.70s | And if so, what would we do about it? 1647.26s - 1654.74s | And, um, and my, my observation was, well, if there is a cyber red Dawn and we're 1654.74s - 1659.00s | under attack, all the Microsoft employees are not going to go run to the hills and 1659.00s - 1659.76s | take up guns. 1659.92s - 1662.36s | They're going to run to Microsoft to defend the networks, right? 1662.36s - 1665.44s


chunk_id: 197_chunk_33
chunk_text:
a country would 1613.80s - 1618.96s | basically turn to the public and say, okay, hack on our behalf, go get them. 1619.32s - 1622.36s | And, and I'm going to tell an NSA story cause it's unclassified. 1622.80s - 1628.60s | Um, years ago there was this, uh, uh, a meeting with the industry and folks 1629.46s - 1634.26s | that NSA was hosting and part of it was sort of the, uh, I think it was called 1634.26s - 1637.02s | like cyber red Dawn was sort of the theme. 1637.42s - 1643.42s | And the idea was, is there, they were exploring the concept, could there ever 1643.42s - 1644.78s | be a sort of cyber red Dawn? 1644.78s - 1646.70s | And if so, what would we do about it? 1647.26s - 1654.74s | And, um, and my, my observation was, well, if there is a cyber red Dawn and we're 1654.74s - 1659.00s | under attack, all the Microsoft employees are not going to go run to the hills and 1659.00s - 1659.76s | take up guns. 1659.92s - 1662.36s | They're going to run to Microsoft to defend the networks, right? 1662.36s - 1665.44s | The people that understand their networks are going to defend their networks. 1665.88s - 1669.32s | And then is the president going to get on television and say like network 1669.32s - 1675.20s | operators that know iOS 3.2 0.5, uh, point to these IP address ranges, go, you 1675.20s - 1679.72s | know, these people that understand Nokia go, how would that work? 1679.72s - 1684.08s | And what's, you know, um, so I really lauded them for the, the, the thinking 1684.08s - 1688.98s | of it, but, you know, in, in the end, I'm so curious on, like, they're just going to 1688.98s - 1689.98s | create noise, right? 1689.98s - 1695.66s | How do you, unless it's a big public campaign just to embarrass them, like, 1695.66s - 1697.10s | look, I got into a radio station. 1697.26s - 1700.30s | I don't see them actually having an effect, right. 1700.30s - 1702.18s | Beyond a public relations effect. 1702.22s - 1702.54s | Yeah. 1702.54s - 1706.34s | So, you know, in, in our world, again, I go back to that country. 1706.34s - 1707.62s | We're a rule of law. 1708.00s - 1714.16s |


chunk_id: 197_chunk_34
chunk_text:
| The people that understand their networks are going to defend their networks. 1665.88s - 1669.32s | And then is the president going to get on television and say like network 1669.32s - 1675.20s | operators that know iOS 3.2 0.5, uh, point to these IP address ranges, go, you 1675.20s - 1679.72s | know, these people that understand Nokia go, how would that work? 1679.72s - 1684.08s | And what's, you know, um, so I really lauded them for the, the, the thinking 1684.08s - 1688.98s | of it, but, you know, in, in the end, I'm so curious on, like, they're just going to 1688.98s - 1689.98s | create noise, right? 1689.98s - 1695.66s | How do you, unless it's a big public campaign just to embarrass them, like, 1695.66s - 1697.10s | look, I got into a radio station. 1697.26s - 1700.30s | I don't see them actually having an effect, right. 1700.30s - 1702.18s | Beyond a public relations effect. 1702.22s - 1702.54s | Yeah. 1702.54s - 1706.34s | So, you know, in, in our world, again, I go back to that country. 1706.34s - 1707.62s | We're a rule of law. 1708.00s - 1714.16s | You're not going to see the U S, um, you know, tasking people to independently 1714.60s - 1717.52s | take up arms, cyber arms for the government, right? 1717.52s - 1721.28s | The, the idea of letters of mark and reprisal, all of those things. 1721.64s - 1728.14s | When I led tailored access operations, which was the hackers of NSA, we literally 1728.14s - 1732.92s | only used NSA civilians on keyboard in military, um, on keyboard. 1733.32s - 1735.04s | We would not use contractors. 1735.06s - 1740.14s | There's different organizations have different rules, but that nation state 1740.14s - 1746.98s | intrusion into another nation sensitive network is so risky that you've got to 1746.98s - 1748.36s | own that, right? 1748.36s - 1755.46s | If it goes bad, literally you could see a state department official, the state 1755.46s - 1757.10s | department getting demarched. 1757.10s - 1761.74s | You could see a white house press secretary or a senior official having to 1761.74s - 1764.78s | address the fallout consequences of a hack gone bad. 1765.22s - 1770.62s | And so if I'm controlling it at that level inside our operations, we're 1770.62s -


chunk_id: 197_chunk_35
chunk_text:
You're not going to see the U S, um, you know, tasking people to independently 1714.60s - 1717.52s | take up arms, cyber arms for the government, right? 1717.52s - 1721.28s | The, the idea of letters of mark and reprisal, all of those things. 1721.64s - 1728.14s | When I led tailored access operations, which was the hackers of NSA, we literally 1728.14s - 1732.92s | only used NSA civilians on keyboard in military, um, on keyboard. 1733.32s - 1735.04s | We would not use contractors. 1735.06s - 1740.14s | There's different organizations have different rules, but that nation state 1740.14s - 1746.98s | intrusion into another nation sensitive network is so risky that you've got to 1746.98s - 1748.36s | own that, right? 1748.36s - 1755.46s | If it goes bad, literally you could see a state department official, the state 1755.46s - 1757.10s | department getting demarched. 1757.10s - 1761.74s | You could see a white house press secretary or a senior official having to 1761.74s - 1764.78s | address the fallout consequences of a hack gone bad. 1765.22s - 1770.62s | And so if I'm controlling it at that level inside our operations, we're 1770.62s - 1774.54s | certainly not going to ask people to go up and take up cyber arms on our behalf. 1774.94s - 1779.82s | But the interesting space in this hacktivist motivational thing is we are 1779.82s - 1786.14s | also seeing Intel services kind of take official government action, but cloak 1786.14s - 1791.30s | themselves and create disinformation that it's being done by activists to kind of 1791.30s - 1796.08s | create the fog of war and shed the, shed the attribution a little bit from 1796.08s - 1797.56s | nation state capabilities. 1798.48s - 1801.80s | Do you ever see, um, in the hacktivist, do you see the useful idiots being 1801.80s - 1802.72s | employed a lot? 1803.72s - 1804.36s | Absolutely. 1804.36s - 1810.08s | It, it ranges from that, you know, useful idiot through tasking to no, we'll do it 1810.08s - 1811.60s | and pretend to be an activist group. 1811.84s - 1812.32s | Oh man. 1812.48s - 1817.96s | So, um, there's another group that, um, it's much smaller, uh, the super 1818.02s - 1823.02s | empowered individual and the super powered individual really kind of came to 1823.02s - 1828.10s | light


chunk_id: 197_chunk_36
chunk_text:
1774.54s | certainly not going to ask people to go up and take up cyber arms on our behalf. 1774.94s - 1779.82s | But the interesting space in this hacktivist motivational thing is we are 1779.82s - 1786.14s | also seeing Intel services kind of take official government action, but cloak 1786.14s - 1791.30s | themselves and create disinformation that it's being done by activists to kind of 1791.30s - 1796.08s | create the fog of war and shed the, shed the attribution a little bit from 1796.08s - 1797.56s | nation state capabilities. 1798.48s - 1801.80s | Do you ever see, um, in the hacktivist, do you see the useful idiots being 1801.80s - 1802.72s | employed a lot? 1803.72s - 1804.36s | Absolutely. 1804.36s - 1810.08s | It, it ranges from that, you know, useful idiot through tasking to no, we'll do it 1810.08s - 1811.60s | and pretend to be an activist group. 1811.84s - 1812.32s | Oh man. 1812.48s - 1817.96s | So, um, there's another group that, um, it's much smaller, uh, the super 1818.02s - 1823.02s | empowered individual and the super powered individual really kind of came to 1823.02s - 1828.10s | light at the beginning, um, of the Ukraine, the invasion of, by Russia of 1828.10s - 1833.90s | Ukraine, where the community got really distraught and wanted to get involved. 1833.90s - 1837.58s | They wanted to do something right, but not necessarily a call to arms, go attack 1837.82s - 1838.30s | Russia. 1838.30s - 1842.86s | It was much more like, oh no, what can I do in my position where I'm sitting? 1843.18s - 1845.42s | And you saw all kinds of community responses. 1845.44s - 1849.92s | Um, I think the Mongo DB community said, you know, we've got this community 1849.92s - 1854.20s | platform, but we're just, we just, let's have the, the Russian projects move away. 1854.20s - 1854.48s | Right. 1854.48s - 1856.28s | You have a year to move away your projects. 1856.28s - 1857.44s | We just, we don't want them here. 1858.16s - 1863.76s | Um, you saw different companies responding to, uh, sanctions that were coming. 1864.88s - 1872.40s | So if you were, I don't know, Eugene Kaspersky in a super empowered individual, 1872.40s - 1875.00s | he could order softer updates, right? 1875.00s - 1879.42s | If


chunk_id: 197_chunk_37
chunk_text:
at the beginning, um, of the Ukraine, the invasion of, by Russia of 1828.10s - 1833.90s | Ukraine, where the community got really distraught and wanted to get involved. 1833.90s - 1837.58s | They wanted to do something right, but not necessarily a call to arms, go attack 1837.82s - 1838.30s | Russia. 1838.30s - 1842.86s | It was much more like, oh no, what can I do in my position where I'm sitting? 1843.18s - 1845.42s | And you saw all kinds of community responses. 1845.44s - 1849.92s | Um, I think the Mongo DB community said, you know, we've got this community 1849.92s - 1854.20s | platform, but we're just, we just, let's have the, the Russian projects move away. 1854.20s - 1854.48s | Right. 1854.48s - 1856.28s | You have a year to move away your projects. 1856.28s - 1857.44s | We just, we don't want them here. 1858.16s - 1863.76s | Um, you saw different companies responding to, uh, sanctions that were coming. 1864.88s - 1872.40s | So if you were, I don't know, Eugene Kaspersky in a super empowered individual, 1872.40s - 1875.00s | he could order softer updates, right? 1875.00s - 1879.42s | If he has had a bad day and wants to order an update to delete everybody's 1879.86s - 1882.34s | data, he could write same thing. 1882.34s - 1886.70s | Elon Musk, if he wants to turn down off Starlink, cause he's having a bad day 1886.70s - 1891.18s | online, he's super empowered to wreck the U S foreign policy, right? 1891.18s - 1892.82s | This, this is fairly new. 1893.30s - 1895.70s | It's not a giant board of a corporation. 1895.70s - 1896.78s | It's not Boeing. 1897.30s - 1899.46s | It's one guy or gal. 1900.26s - 1902.98s | So how do you even deal with that? 1903.72s - 1909.60s | Yeah, I, I think we've got to look at the resiliency of our networks and, and the, 1909.96s - 1912.32s | the system of systems we've created, right? 1912.68s - 1918.24s | I think CrowdStrike was a wake up call that, you know, it was not a decision 1918.24s - 1923.16s | made, but an accident that then had massive repercussions, right? 1923.16s - 1927.12s | So, you know, that all the people who are looking at creating mischief on the 1927.12s - 1929.28s | internet


chunk_id: 197_chunk_38
chunk_text:
he has had a bad day and wants to order an update to delete everybody's 1879.86s - 1882.34s | data, he could write same thing. 1882.34s - 1886.70s | Elon Musk, if he wants to turn down off Starlink, cause he's having a bad day 1886.70s - 1891.18s | online, he's super empowered to wreck the U S foreign policy, right? 1891.18s - 1892.82s | This, this is fairly new. 1893.30s - 1895.70s | It's not a giant board of a corporation. 1895.70s - 1896.78s | It's not Boeing. 1897.30s - 1899.46s | It's one guy or gal. 1900.26s - 1902.98s | So how do you even deal with that? 1903.72s - 1909.60s | Yeah, I, I think we've got to look at the resiliency of our networks and, and the, 1909.96s - 1912.32s | the system of systems we've created, right? 1912.68s - 1918.24s | I think CrowdStrike was a wake up call that, you know, it was not a decision 1918.24s - 1923.16s | made, but an accident that then had massive repercussions, right? 1923.16s - 1927.12s | So, you know, that all the people who are looking at creating mischief on the 1927.12s - 1929.28s | internet are now studying that. 1929.28s - 1930.56s | What are those choke points? 1930.58s - 1937.46s | What are those ways in that if I cause pain at that point amplifies and magnifies 1937.46s - 1939.18s | the effect I can have throughout. 1939.62s - 1943.94s | And so that's, that's a place a super empowered individual could do something, 1944.22s - 1950.34s | but it's also a place where the, the, the pressure of a hack or even the accident 1950.74s - 1952.94s | could, uh, could ripple through our systems. 1953.38s - 1955.22s | Well, and it also could work in reverse. 1955.22s - 1958.98s | I mean, I remember this is years ago, but there's this guy, Larry, who ran 1959.00s - 1964.48s | SpamHouse and it's like, well, if you anger Larry, I mean, this is an example, 1964.48s - 1968.52s | but if you angle angry Larry and he puts you in this black hole list, you just 1968.52s - 1969.20s | don't get email. 1970.32s - 1972.08s | So, you know, don't piss off Larry. 1972.64s - 1980.08s | Um, so with these super empowered individuals, I think there's a, um, 1980.36s - 1984.32s


chunk_id: 197_chunk_39
chunk_text:
are now studying that. 1929.28s - 1930.56s | What are those choke points? 1930.58s - 1937.46s | What are those ways in that if I cause pain at that point amplifies and magnifies 1937.46s - 1939.18s | the effect I can have throughout. 1939.62s - 1943.94s | And so that's, that's a place a super empowered individual could do something, 1944.22s - 1950.34s | but it's also a place where the, the, the pressure of a hack or even the accident 1950.74s - 1952.94s | could, uh, could ripple through our systems. 1953.38s - 1955.22s | Well, and it also could work in reverse. 1955.22s - 1958.98s | I mean, I remember this is years ago, but there's this guy, Larry, who ran 1959.00s - 1964.48s | SpamHouse and it's like, well, if you anger Larry, I mean, this is an example, 1964.48s - 1968.52s | but if you angle angry Larry and he puts you in this black hole list, you just 1968.52s - 1969.20s | don't get email. 1970.32s - 1972.08s | So, you know, don't piss off Larry. 1972.64s - 1980.08s | Um, so with these super empowered individuals, I think there's a, um, 1980.36s - 1984.32s | there's another element coming in, which is like either personal responsibility 1984.38s - 1989.18s | or liability, and we're starting to see sanctions, right? 1989.22s - 1994.46s | Uh, enter the field as a new tool, new option in a sort of a diplomatic tool belt. 1994.90s - 1999.30s | And, um, the example I always bring up is, uh, there's a skirmish on the 1999.30s - 2001.98s | border between China and India. 2002.50s - 2004.98s | There's loss of life on both sides. 2005.30s - 2010.86s | India is really upset, but instead of engaging in more armed conflict, they 2010.86s - 2012.66s | go and ban Tik Tok from their app store. 2013.64s - 2017.60s | And, uh, and Tik Tok says, Oh no, that's $6 billion in revenue. 2017.60s - 2018.24s | We're doomed. 2019.16s - 2020.88s | And China says, we'll retaliate. 2021.12s - 2021.96s | We'll ban. 2023.00s - 2026.80s | Oh, there's no Indian apps because we don't allow them in the app store in China. 2027.48s - 2028.76s | It's asymmetric, right? 2028.76s - 2030.68s | They, they didn't have a method to respond. 2030.68s - 2034.52s | And so I


chunk_id: 197_chunk_40
chunk_text:
| there's another element coming in, which is like either personal responsibility 1984.38s - 1989.18s | or liability, and we're starting to see sanctions, right? 1989.22s - 1994.46s | Uh, enter the field as a new tool, new option in a sort of a diplomatic tool belt. 1994.90s - 1999.30s | And, um, the example I always bring up is, uh, there's a skirmish on the 1999.30s - 2001.98s | border between China and India. 2002.50s - 2004.98s | There's loss of life on both sides. 2005.30s - 2010.86s | India is really upset, but instead of engaging in more armed conflict, they 2010.86s - 2012.66s | go and ban Tik Tok from their app store. 2013.64s - 2017.60s | And, uh, and Tik Tok says, Oh no, that's $6 billion in revenue. 2017.60s - 2018.24s | We're doomed. 2019.16s - 2020.88s | And China says, we'll retaliate. 2021.12s - 2021.96s | We'll ban. 2023.00s - 2026.80s | Oh, there's no Indian apps because we don't allow them in the app store in China. 2027.48s - 2028.76s | It's asymmetric, right? 2028.76s - 2030.68s | They, they didn't have a method to respond. 2030.68s - 2034.52s | And so I think now there's also a new tools emerging in the toolbox 2034.52s - 2036.36s | that didn't exist a few years ago. 2036.78s - 2041.20s | Are those, how do you, do you ever get involved in the discussions about no, 2041.22s - 2042.46s | no, select this tool. 2042.70s - 2042.98s | Okay. 2042.98s - 2043.18s | Yeah. 2043.18s - 2045.26s | We'll hack it if you want us to, but you should maybe really 2045.26s - 2046.70s | try this other option first. 2046.74s - 2051.78s | Yeah, no, uh, my first response in a lot of the policy discussions, right. 2051.78s - 2055.24s | When, when I was at the white house or when we're talking to the white house 2055.24s - 2060.30s | in, in operational space is usually the best response to a hack is 2060.30s - 2061.86s | not to hack straight back. 2062.10s - 2062.42s | Right. 2062.42s - 2065.86s | The, the answer of I'll bring a bigger cyber stick to somebody 2066.18s - 2067.96s | is usually not the answer. 2068.34s - 2074.62s | Um, the U S has a whole quiver of different tools and it ranges from 2074.70s -


chunk_id: 197_chunk_41
chunk_text:
think now there's also a new tools emerging in the toolbox 2034.52s - 2036.36s | that didn't exist a few years ago. 2036.78s - 2041.20s | Are those, how do you, do you ever get involved in the discussions about no, 2041.22s - 2042.46s | no, select this tool. 2042.70s - 2042.98s | Okay. 2042.98s - 2043.18s | Yeah. 2043.18s - 2045.26s | We'll hack it if you want us to, but you should maybe really 2045.26s - 2046.70s | try this other option first. 2046.74s - 2051.78s | Yeah, no, uh, my first response in a lot of the policy discussions, right. 2051.78s - 2055.24s | When, when I was at the white house or when we're talking to the white house 2055.24s - 2060.30s | in, in operational space is usually the best response to a hack is 2060.30s - 2061.86s | not to hack straight back. 2062.10s - 2062.42s | Right. 2062.42s - 2065.86s | The, the answer of I'll bring a bigger cyber stick to somebody 2066.18s - 2067.96s | is usually not the answer. 2068.34s - 2074.62s | Um, the U S has a whole quiver of different tools and it ranges from 2074.70s - 2080.30s | sanctions to financials, um, to name and shame, to diplomatic pressures, 2080.30s - 2083.68s | to indictments, to all of these other things. 2083.70s - 2088.78s | And, you know, it, it, it needs to be this tapestry of a solution. 2089.20s - 2093.86s | Um, there is no one thing that is going to make, um, you know, the 2093.86s - 2098.00s | Chinese PLA say, Ooh, you know, that was too hard. 2098.00s - 2105.78s | I'm going to stop and, and just, uh, make my, my, my hacking entities go away. 2105.78s - 2107.44s | We're done with hacking forever. 2107.78s - 2108.06s | Right. 2108.06s - 2112.04s | So you've got to get to the point where you add that friction, the 2112.04s - 2115.26s | continuous engagement, so they can't be as successful all the time. 2115.78s - 2119.74s | But you also want to do some things to think about the decision makers, right. 2120.38s - 2124.42s | Everybody in those official structures has a boss all the way 2124.42s - 2125.74s | up to the leader of the country. 2126.22s - 2130.06s | And if their hacking operations are bringing pain


chunk_id: 197_chunk_42
chunk_text:
2080.30s | sanctions to financials, um, to name and shame, to diplomatic pressures, 2080.30s - 2083.68s | to indictments, to all of these other things. 2083.70s - 2088.78s | And, you know, it, it, it needs to be this tapestry of a solution. 2089.20s - 2093.86s | Um, there is no one thing that is going to make, um, you know, the 2093.86s - 2098.00s | Chinese PLA say, Ooh, you know, that was too hard. 2098.00s - 2105.78s | I'm going to stop and, and just, uh, make my, my, my hacking entities go away. 2105.78s - 2107.44s | We're done with hacking forever. 2107.78s - 2108.06s | Right. 2108.06s - 2112.04s | So you've got to get to the point where you add that friction, the 2112.04s - 2115.26s | continuous engagement, so they can't be as successful all the time. 2115.78s - 2119.74s | But you also want to do some things to think about the decision makers, right. 2120.38s - 2124.42s | Everybody in those official structures has a boss all the way 2124.42s - 2125.74s | up to the leader of the country. 2126.22s - 2130.06s | And if their hacking operations are bringing pain to the people who are 2130.06s - 2135.54s | their bosses, whether it's, Hey, I gave you, you know, this massive pile 2135.54s - 2141.14s | of money and you failed, or I gave you the authority to do this hack and 2141.14s - 2143.04s | you got caught and embarrassed me. 2143.04s - 2148.38s | And now, you know, our ambassador is responding to a Dimarsh or, you 2148.38s - 2152.86s | know, we've been called out for this global campaign of hacking critical 2152.86s - 2158.70s | infrastructure and, and, you know, it is, it is disparaging us in the world's 2158.70s - 2163.46s | eyes and causing us, you know, uh, reputational problems, those things 2163.46s - 2168.46s | stack up to where the authorities constrict, the money constricts the, 2168.50s - 2174.18s | the chain of command, um, is much more involved and adds bureaucracy into that 2174.18s - 2177.94s | space, you want to add the friction, but in the end, you've got to get to 2177.94s - 2179.78s | human beings who make decisions. 2180.02s - 2183.74s | And there's a lot of tools for those human beings, um, to stop. 2184.54s - 2185.98s


chunk_id: 197_chunk_43
chunk_text:
to the people who are 2130.06s - 2135.54s | their bosses, whether it's, Hey, I gave you, you know, this massive pile 2135.54s - 2141.14s | of money and you failed, or I gave you the authority to do this hack and 2141.14s - 2143.04s | you got caught and embarrassed me. 2143.04s - 2148.38s | And now, you know, our ambassador is responding to a Dimarsh or, you 2148.38s - 2152.86s | know, we've been called out for this global campaign of hacking critical 2152.86s - 2158.70s | infrastructure and, and, you know, it is, it is disparaging us in the world's 2158.70s - 2163.46s | eyes and causing us, you know, uh, reputational problems, those things 2163.46s - 2168.46s | stack up to where the authorities constrict, the money constricts the, 2168.50s - 2174.18s | the chain of command, um, is much more involved and adds bureaucracy into that 2174.18s - 2177.94s | space, you want to add the friction, but in the end, you've got to get to 2177.94s - 2179.78s | human beings who make decisions. 2180.02s - 2183.74s | And there's a lot of tools for those human beings, um, to stop. 2184.54s - 2185.98s | So, um, I want to go back. 2185.98s - 2189.58s | We were talking about, uh, a mutual friend, Tony Sager. 2189.82s - 2194.86s | Um, and I use this quote, Tony said, I don't know how many decades ago, but 2194.86s - 2200.82s | he said that, um, you can't, you can't defeat your opponent one-on-one because 2200.82s - 2204.78s | there's just the population disparity between, um, different countries. 2205.10s - 2206.30s | So you have to automate. 2206.78s - 2210.34s | And so we try to automate as much of everything we can. 2210.34s - 2213.30s | We, we look at everything, we create automation, we try to automate everything 2213.30s - 2218.54s | we could possibly automate, and then we try to automate the rest because 2218.54s - 2220.02s | there's just not enough humans. 2220.34s - 2221.46s | And that was a long time ago. 2221.86s - 2224.30s | Tell us, tell me about your, your thoughts around automation, automated 2224.30s - 2226.98s | defense, like how do you free up your operators? 2227.22s - 2231.26s | Like, what do you think the highest useful purpose of a human is in this 2231.30s -


chunk_id: 197_chunk_44
chunk_text:
| So, um, I want to go back. 2185.98s - 2189.58s | We were talking about, uh, a mutual friend, Tony Sager. 2189.82s - 2194.86s | Um, and I use this quote, Tony said, I don't know how many decades ago, but 2194.86s - 2200.82s | he said that, um, you can't, you can't defeat your opponent one-on-one because 2200.82s - 2204.78s | there's just the population disparity between, um, different countries. 2205.10s - 2206.30s | So you have to automate. 2206.78s - 2210.34s | And so we try to automate as much of everything we can. 2210.34s - 2213.30s | We, we look at everything, we create automation, we try to automate everything 2213.30s - 2218.54s | we could possibly automate, and then we try to automate the rest because 2218.54s - 2220.02s | there's just not enough humans. 2220.34s - 2221.46s | And that was a long time ago. 2221.86s - 2224.30s | Tell us, tell me about your, your thoughts around automation, automated 2224.30s - 2226.98s | defense, like how do you free up your operators? 2227.22s - 2231.26s | Like, what do you think the highest useful purpose of a human is in this 2231.30s - 2235.62s | chain and how much of it can be automated away to let them focus on that truly 2235.62s - 2237.26s | human aspect? 2237.26s - 2238.90s | Is it the risk reward? 2238.90s - 2241.38s | Like you need a human to make this decision or? 2242.06s - 2242.34s | Yeah. 2242.38s - 2245.38s | What I've found is the, the humans are the creative element. 2245.58s - 2249.94s | They're going to find the new and novel thing that slips through the cracks. 2250.38s - 2256.06s | And whether it's the, the, the criminals innovating or whether it is the, um, the, 2256.06s - 2260.78s | the, the defenders innovating, it's going to be the case where, you know, that 2260.78s - 2263.66s | innovation is going to move the needle and change things. 2263.66s - 2269.90s | But I do think we are at, um, we're at an inflection point right now where, um, 2270.06s - 2274.74s | you know, generative AI, large-scale machine learning, um, is just going to 2274.74s - 2276.66s | increase the pace and speed. 2277.22s - 2281.78s | As you've looked over the last several years, the time from knowledge of


chunk_id: 197_chunk_45
chunk_text:
2235.62s | chain and how much of it can be automated away to let them focus on that truly 2235.62s - 2237.26s | human aspect? 2237.26s - 2238.90s | Is it the risk reward? 2238.90s - 2241.38s | Like you need a human to make this decision or? 2242.06s - 2242.34s | Yeah. 2242.38s - 2245.38s | What I've found is the, the humans are the creative element. 2245.58s - 2249.94s | They're going to find the new and novel thing that slips through the cracks. 2250.38s - 2256.06s | And whether it's the, the, the criminals innovating or whether it is the, um, the, 2256.06s - 2260.78s | the, the defenders innovating, it's going to be the case where, you know, that 2260.78s - 2263.66s | innovation is going to move the needle and change things. 2263.66s - 2269.90s | But I do think we are at, um, we're at an inflection point right now where, um, 2270.06s - 2274.74s | you know, generative AI, large-scale machine learning, um, is just going to 2274.74s - 2276.66s | increase the pace and speed. 2277.22s - 2281.78s | As you've looked over the last several years, the time from knowledge of a 2281.78s - 2287.30s | vulnerability and a POC hitting the internet to the amount of exploitation 2287.30s - 2289.78s | has just shrunk and shrunk and shrunk. 2290.26s - 2296.02s | And, you know, I also think we talked early about the Chinese living off the 2296.02s - 2298.54s | land campaign in Volt Typhoon. 2298.94s - 2304.78s | Um, we're going to need machine learning to baseline what is normal and find the 2304.78s - 2310.14s | anomalous things because of the stealth and quietness of those activities. 2310.50s - 2316.58s | So, um, you know, I believe that the automation is going to start to address 2316.94s - 2322.74s | the machine speed attacks and we're both going to see the, the ratcheting on 2322.74s - 2327.62s | either side, um, moving towards speed and scale needing that automation. 2328.98s - 2329.34s | Okay. 2329.34s - 2333.06s | So we've got, um, if I'm reading this right, well, we have 11 minutes left. 2333.06s - 2333.66s | Is that correct? 2333.66s - 2334.14s | Everyone? 2335.22s - 2335.66s | Five. 2335.66s - 2337.58s | Oh, well then let's take one question. 2343.14s - 2343.38s | Yep. 2343.38s


chunk_id: 197_chunk_46
chunk_text:
a 2281.78s - 2287.30s | vulnerability and a POC hitting the internet to the amount of exploitation 2287.30s - 2289.78s | has just shrunk and shrunk and shrunk. 2290.26s - 2296.02s | And, you know, I also think we talked early about the Chinese living off the 2296.02s - 2298.54s | land campaign in Volt Typhoon. 2298.94s - 2304.78s | Um, we're going to need machine learning to baseline what is normal and find the 2304.78s - 2310.14s | anomalous things because of the stealth and quietness of those activities. 2310.50s - 2316.58s | So, um, you know, I believe that the automation is going to start to address 2316.94s - 2322.74s | the machine speed attacks and we're both going to see the, the ratcheting on 2322.74s - 2327.62s | either side, um, moving towards speed and scale needing that automation. 2328.98s - 2329.34s | Okay. 2329.34s - 2333.06s | So we've got, um, if I'm reading this right, well, we have 11 minutes left. 2333.06s - 2333.66s | Is that correct? 2333.66s - 2334.14s | Everyone? 2335.22s - 2335.66s | Five. 2335.66s - 2337.58s | Oh, well then let's take one question. 2343.14s - 2343.38s | Yep. 2343.38s - 2344.66s | You got to get closer to the microphone. 2398.33s - 2399.65s | Do you want to kind of repeat the question? 2400.17s - 2405.65s | So, so I'll, I'll summarize a bit of what I heard, which is, Hey, there's a lot of 2405.65s - 2410.13s | different organizations in the U S that are part of the puzzle for cybersecurity. 2410.53s - 2417.57s | And, you know, whether it's DHS, CISA, FBI, NSA, um, DOD, you know, where are the 2417.57s - 2422.61s | lanes, who's the orchestrator and, you know, how does the change in the political 2422.61s - 2426.01s | environment, especially, you know, if we have a new administration change all of 2426.01s - 2428.49s | that, so we have been getting better. 2428.49s - 2432.17s | I won't say it's perfectly solved and all the gears are in, in complete 2432.17s - 2436.37s | synchronicity, but you know, there's strengths and weaknesses in each of the 2436.37s - 2440.25s | agencies and we're starting to get a rhythm where we know how to play to those 2440.25s - 2440.89s | strengths. 2440.97s - 2446.53s | Um, and you'll see things like campaigns


chunk_id: 197_chunk_47
chunk_text:
- 2344.66s | You got to get closer to the microphone. 2398.33s - 2399.65s | Do you want to kind of repeat the question? 2400.17s - 2405.65s | So, so I'll, I'll summarize a bit of what I heard, which is, Hey, there's a lot of 2405.65s - 2410.13s | different organizations in the U S that are part of the puzzle for cybersecurity. 2410.53s - 2417.57s | And, you know, whether it's DHS, CISA, FBI, NSA, um, DOD, you know, where are the 2417.57s - 2422.61s | lanes, who's the orchestrator and, you know, how does the change in the political 2422.61s - 2426.01s | environment, especially, you know, if we have a new administration change all of 2426.01s - 2428.49s | that, so we have been getting better. 2428.49s - 2432.17s | I won't say it's perfectly solved and all the gears are in, in complete 2432.17s - 2436.37s | synchronicity, but you know, there's strengths and weaknesses in each of the 2436.37s - 2440.25s | agencies and we're starting to get a rhythm where we know how to play to those 2440.25s - 2440.89s | strengths. 2440.97s - 2446.53s | Um, and you'll see things like campaigns where we have multiple agencies involved 2446.53s - 2451.61s | in that, you know, FBI doing domestic stuff with their legal authority with DOJ, 2451.97s - 2458.37s | um, combined with cyber command doing some extra outside the U S activity to do 2458.37s - 2463.49s | takedowns in conjunction with FBI doing the internal U S CISA working with 2463.49s - 2468.09s | industry and doing that campaign to synchronize the things that are across, 2468.17s - 2473.77s | uh, the, the, the civilian infrastructure and then NSA lending technical expertise 2473.77s - 2476.45s | and foreign intelligence, um, into that mix. 2476.45s - 2480.53s | And, and we're getting better and learning over time on how we do those. 2481.01s - 2486.25s | Um, the, the national cyber director was created to kind of be that band 2486.29s - 2488.05s | conductor across all of them. 2488.45s - 2495.17s | And so, um, you know, we've got that, that, that apex, um, in reality, you know, 2495.21s - 2500.13s | a lot of the, the activity today, um, is ground up. 2500.49s - 2506.49s | And, and when I say that, I mean, one agency has either a


chunk_id: 197_chunk_48
chunk_text:
where we have multiple agencies involved 2446.53s - 2451.61s | in that, you know, FBI doing domestic stuff with their legal authority with DOJ, 2451.97s - 2458.37s | um, combined with cyber command doing some extra outside the U S activity to do 2458.37s - 2463.49s | takedowns in conjunction with FBI doing the internal U S CISA working with 2463.49s - 2468.09s | industry and doing that campaign to synchronize the things that are across, 2468.17s - 2473.77s | uh, the, the, the civilian infrastructure and then NSA lending technical expertise 2473.77s - 2476.45s | and foreign intelligence, um, into that mix. 2476.45s - 2480.53s | And, and we're getting better and learning over time on how we do those. 2481.01s - 2486.25s | Um, the, the national cyber director was created to kind of be that band 2486.29s - 2488.05s | conductor across all of them. 2488.45s - 2495.17s | And so, um, you know, we've got that, that, that apex, um, in reality, you know, 2495.21s - 2500.13s | a lot of the, the activity today, um, is ground up. 2500.49s - 2506.49s | And, and when I say that, I mean, one agency has either a special, um, insight, 2506.49s - 2510.57s | a special relationship, a team that's been working, and then they start to bring 2510.57s - 2514.81s | the players in that can collaborate and add to that mix. 2515.17s - 2521.65s | And then, you know, the, the, the, uh, ONCD and others then do the convening 2521.65s - 2526.45s | to bring us all around the execution and synchronization, um, that, that, 2526.45s - 2533.73s | because the roles are enshrined in statue and law and policy, um, you know, 2533.73s - 2535.81s | we'll continue throughout administrations. 2535.81s - 2541.53s | The nice thing about, um, cybersecurity, it's something that's fairly bipartisan. 2541.93s - 2547.13s | Um, everybody can get behind the need to stop foreign adversaries into our spaces. 2547.45s - 2553.57s | So, um, I, I am, uh, optimistic that the trajectory continues the biggest 2553.57s - 2557.77s | shortcoming, and I heard an ask about the shortcoming I see today is, you know, 2557.77s - 2563.21s | the scope and scale of the threats against the resources and, you know, the 2563.21s - 2567.97s | innovation that comes, um, from the attackers into the vulnerability space. 2568.33s


chunk_id: 197_chunk_49
chunk_text:
special, um, insight, 2506.49s - 2510.57s | a special relationship, a team that's been working, and then they start to bring 2510.57s - 2514.81s | the players in that can collaborate and add to that mix. 2515.17s - 2521.65s | And then, you know, the, the, the, uh, ONCD and others then do the convening 2521.65s - 2526.45s | to bring us all around the execution and synchronization, um, that, that, 2526.45s - 2533.73s | because the roles are enshrined in statue and law and policy, um, you know, 2533.73s - 2535.81s | we'll continue throughout administrations. 2535.81s - 2541.53s | The nice thing about, um, cybersecurity, it's something that's fairly bipartisan. 2541.93s - 2547.13s | Um, everybody can get behind the need to stop foreign adversaries into our spaces. 2547.45s - 2553.57s | So, um, I, I am, uh, optimistic that the trajectory continues the biggest 2553.57s - 2557.77s | shortcoming, and I heard an ask about the shortcoming I see today is, you know, 2557.77s - 2563.21s | the scope and scale of the threats against the resources and, you know, the 2563.21s - 2567.97s | innovation that comes, um, from the attackers into the vulnerability space. 2568.33s - 2573.65s | And you see a lot of effort into, we've got to get to the point where we do the 2573.65s - 2576.49s | things we know matter, right? 2576.49s - 2578.85s | We've got to get on two factor authentication. 2578.85s - 2583.01s | We've got to get companies, um, building more secure software. 2583.01s - 2587.81s | We've got to get out of some of the memory unsafe languages and get the core 2587.81s - 2593.01s | technologies over into things that, uh, that are defendable and defensible. 2593.33s - 2597.65s | And then, um, you know, we've got to, we've got to build the staffs and teams. 2597.65s - 2602.77s | And I think Jeff, to your question about automation, you know, the, the scope and 2602.77s - 2608.53s | scale is so hard on some of these threats and, you know, having a big enough team to 2608.53s - 2613.77s | defend 24 seven and who wants to work that graveyard shift in the middle of the night 2613.77s - 2617.37s | on a holiday, you know, automation helps take the pressure off some of that. 2617.37s - 2619.65s | So I like the


chunk_id: 197_chunk_50
chunk_text:
- 2573.65s | And you see a lot of effort into, we've got to get to the point where we do the 2573.65s - 2576.49s | things we know matter, right? 2576.49s - 2578.85s | We've got to get on two factor authentication. 2578.85s - 2583.01s | We've got to get companies, um, building more secure software. 2583.01s - 2587.81s | We've got to get out of some of the memory unsafe languages and get the core 2587.81s - 2593.01s | technologies over into things that, uh, that are defendable and defensible. 2593.33s - 2597.65s | And then, um, you know, we've got to, we've got to build the staffs and teams. 2597.65s - 2602.77s | And I think Jeff, to your question about automation, you know, the, the scope and 2602.77s - 2608.53s | scale is so hard on some of these threats and, you know, having a big enough team to 2608.53s - 2613.77s | defend 24 seven and who wants to work that graveyard shift in the middle of the night 2613.77s - 2617.37s | on a holiday, you know, automation helps take the pressure off some of that. 2617.37s - 2619.65s | So I like the trajectory we're on. 2619.69s - 2620.77s | It is a journey though. 2620.77s - 2624.29s | It is a long journey and we're just, um, we're, we're on the path. 2625.33s - 2625.65s | All right. 2625.65s - 2626.25s | Thank you, Rob. 2626.25s - 2627.45s | Thank you for your service. 2627.57s - 2631.21s | Thank you everyone for being here and we'll see you around the con. 2631.77s - 2632.21s | Appreciate it. 2632.25s - 2632.65s | Thanks.


chunk_id: 197_chunk_51
chunk_text:
trajectory we're on. 2619.69s - 2620.77s | It is a journey though. 2620.77s - 2624.29s | It is a long journey and we're just, um, we're, we're on the path. 2625.33s - 2625.65s | All right. 2625.65s - 2626.25s | Thank you, Rob. 2626.25s - 2627.45s | Thank you for your service. 2627.57s - 2631.21s | Thank you everyone for being here and we'll see you around the con. 2631.77s - 2632.21s | Appreciate it. 2632.25s - 2632.65s | Thanks.


chunk_id: 198_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=PmqvBe1LSZc", "title": "DEF CON 32 - Defeating EDR Evading Malware with Memory Forensics - Case, Sellers, Richard, et al.", "description": "Endpoint detection and response (EDR) software has gained significant market share due to its ability to examine system state for signs of malware and attacker activity well beyond what traditional anti-virus software is capable of detecting. This deep inspection capability of EDRs has led to an arms race with malware developers who want to evade EDRs while still achieving desired goals, such as code injection, lateral movement, and credential theft. This monitoring and evasion occurs in the lowest levels of hardware and software, including call stack frames, exception handlers, system calls, and manipulation of native instructions. Given this reality, EDRs are limited in how much lower they can operate to maintain an advantage. The success of EDR bypasses has led to their use in many high-profile attacks and by prolific ransomware groups.\n\nIn this talk, we discuss our research effort that led to the development of new memory forensics techniques for the detection of the bypasses that malware uses to evade EDRs. This includes bypass techniques, such as direct and indirect system calls, module overwriting, malicious exceptions handlers, and abuse of debug registers. Our developed capabilities were created as new plugins to the Volatility memory analysis framework, version 3, and will be released after the talk.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2627, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.62s - 10.90s | This text was transcribed using whisper model: large-v2 Okay, thank you all for coming to my presentation. 10.90s - 13.84s | For those who I haven't met before, my name is Andrew Case. 13.84s - 19.38s | I am a core developer on the Volatility Memory Analysis Project and also the Director of 19.38s - 23.14s | Research at Vellect City. 23.14s - 28.54s | At Vellect City, we do a significant amount of incident response and malware analysis 28.54s - 33.46s | and as part of our research workflow and being on the research team there, we make sure that 33.74s - 38.30s | for all the malware techniques that we see during our attacks and that we see other vendors 38.30s - 42.96s | reporting about, any type of malware technique, any attacker toolkit that's really being used 42.96s - 47.80s | in the wild, we want to make sure that we have a complete understanding


chunk_id: 198_chunk_1
chunk_text:
abuse of debug registers. Our developed capabilities were created as new plugins to the Volatility memory analysis framework, version 3, and will be released after the talk.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2627, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.62s - 10.90s | This text was transcribed using whisper model: large-v2 Okay, thank you all for coming to my presentation. 10.90s - 13.84s | For those who I haven't met before, my name is Andrew Case. 13.84s - 19.38s | I am a core developer on the Volatility Memory Analysis Project and also the Director of 19.38s - 23.14s | Research at Vellect City. 23.14s - 28.54s | At Vellect City, we do a significant amount of incident response and malware analysis 28.54s - 33.46s | and as part of our research workflow and being on the research team there, we make sure that 33.74s - 38.30s | for all the malware techniques that we see during our attacks and that we see other vendors 38.30s - 42.96s | reporting about, any type of malware technique, any attacker toolkit that's really being used 42.96s - 47.80s | in the wild, we want to make sure that we have a complete understanding of it and also 47.80s - 52.34s | that we can automatically detect it during our investigations. 52.34s - 57.94s | To ensure that we meet that goal and meet that reality, we very often perform very targeted, 57.94s - 62.52s | very specific deep dives on specific techniques that we see the malware using, that we see 62.52s - 67.28s | attackers using, and then we make sure that we document all the different techniques, 67.28s - 70.84s | all the different tools that use it, whether they're private tools from threat groups, 70.84s - 76.22s | whether it's some open source tool that has implemented it, and then we make infected 76.22s - 77.22s | machines with it. 77.22s - 81.16s | So we make our infected virtual machines, we make sure all the techniques are active, 81.16s - 85.52s | we do the deepest memory forensics research we know how to do, which we have most of the 85.52s - 89.60s | volatility developers at Vellect City, so that's pretty deep, and then we do talks like 89.60s - 91.36s | this where we publish it. 91.36s - 95.00s | For one of the latest research projects


chunk_id: 198_chunk_2
chunk_text:
of it and also 47.80s - 52.34s | that we can automatically detect it during our investigations. 52.34s - 57.94s | To ensure that we meet that goal and meet that reality, we very often perform very targeted, 57.94s - 62.52s | very specific deep dives on specific techniques that we see the malware using, that we see 62.52s - 67.28s | attackers using, and then we make sure that we document all the different techniques, 67.28s - 70.84s | all the different tools that use it, whether they're private tools from threat groups, 70.84s - 76.22s | whether it's some open source tool that has implemented it, and then we make infected 76.22s - 77.22s | machines with it. 77.22s - 81.16s | So we make our infected virtual machines, we make sure all the techniques are active, 81.16s - 85.52s | we do the deepest memory forensics research we know how to do, which we have most of the 85.52s - 89.60s | volatility developers at Vellect City, so that's pretty deep, and then we do talks like 89.60s - 91.36s | this where we publish it. 91.36s - 95.00s | For one of the latest research projects that we did, that's what I'm going to be talking 95.00s - 101.56s | to you about today, we looked at all the ways that EDRs were being evaded by real malware. 101.56s - 106.82s | Because what we noticed in our investigations is that we're working in enterprises, they're 106.82s - 111.66s | trying to do security correctly, they have EDRs, they have them configured, they're listed 111.66s - 116.80s | as active on these machines, but over and over again, as we were doing memory forensics, 116.80s - 122.20s | we were finding very potent malware in the same processes where the EDRs supposedly were. 122.20s - 126.16s | So obviously we wanted to figure out why that disconnect was happening, and through our 126.16s - 131.64s | memory forensics work, we wanted to be able to detect it automatically as well. 131.64s - 136.88s | Because as you'll see as we go through the slides, normally when malware bypasses EDRs, 136.88s - 138.30s | it's not every process. 138.30s - 142.92s | It's just the process or the two processes where the malware is running out of directly 142.92s - 145.72s | or where it's injected code


chunk_id: 198_chunk_3
chunk_text:
that we did, that's what I'm going to be talking 95.00s - 101.56s | to you about today, we looked at all the ways that EDRs were being evaded by real malware. 101.56s - 106.82s | Because what we noticed in our investigations is that we're working in enterprises, they're 106.82s - 111.66s | trying to do security correctly, they have EDRs, they have them configured, they're listed 111.66s - 116.80s | as active on these machines, but over and over again, as we were doing memory forensics, 116.80s - 122.20s | we were finding very potent malware in the same processes where the EDRs supposedly were. 122.20s - 126.16s | So obviously we wanted to figure out why that disconnect was happening, and through our 126.16s - 131.64s | memory forensics work, we wanted to be able to detect it automatically as well. 131.64s - 136.88s | Because as you'll see as we go through the slides, normally when malware bypasses EDRs, 136.88s - 138.30s | it's not every process. 138.30s - 142.92s | It's just the process or the two processes where the malware is running out of directly 142.92s - 145.72s | or where it's injected code into. 145.72s - 150.88s | So if you detect the EDR evasion, then you also directly detect the malware. 150.88s - 154.36s | And so this has allowed us to do very scalable work. 154.36s - 159.16s | And at Vilexity, where we're dealing in many investigations with dozens, hundreds, thousands 159.16s - 164.56s | of memory samples, we don't have time, and it would obviously not be very time efficient, 164.56s - 167.00s | to manually look at anything to start. 167.00s - 171.40s | So we want a set of techniques that will at least say, hey, out of these 100 memory samples, 171.40s - 173.76s | these are the five you really need to focus on. 173.76s - 175.28s | And that's where we target our research. 175.28s - 177.12s | We don't want a lot of false positives. 177.12s - 179.24s | We don't want algorithms that take forever to run. 179.24s - 182.84s | We just want to find the malware so that we can deep dive it. 182.84s - 186.24s | And then as you can probably guess by the title and the fact that all this research 186.24s - 191.90s | was done


chunk_id: 198_chunk_4
chunk_text:
into. 145.72s - 150.88s | So if you detect the EDR evasion, then you also directly detect the malware. 150.88s - 154.36s | And so this has allowed us to do very scalable work. 154.36s - 159.16s | And at Vilexity, where we're dealing in many investigations with dozens, hundreds, thousands 159.16s - 164.56s | of memory samples, we don't have time, and it would obviously not be very time efficient, 164.56s - 167.00s | to manually look at anything to start. 167.00s - 171.40s | So we want a set of techniques that will at least say, hey, out of these 100 memory samples, 171.40s - 173.76s | these are the five you really need to focus on. 173.76s - 175.28s | And that's where we target our research. 175.28s - 177.12s | We don't want a lot of false positives. 177.12s - 179.24s | We don't want algorithms that take forever to run. 179.24s - 182.84s | We just want to find the malware so that we can deep dive it. 182.84s - 186.24s | And then as you can probably guess by the title and the fact that all this research 186.24s - 191.90s | was done with volatility, we're going to be looking for that malware in memory. 191.90s - 195.48s | If you haven't seen memory forensics before, or maybe you've never looked at a memory sample 195.48s - 200.30s | yourself, the reason why there's this whole industry now around memory forensics and why 200.30s - 206.34s | it's so vital to incorporate it in your investigations is that when you look at the real attacks 206.34s - 210.62s | in the wild, when you look at the malware that's going to be used in environments where 210.62s - 214.22s | the attackers don't want to get caught, where the EDRs are, where there's actually security 214.22s - 217.58s | teams, that malware is going to be memory only. 217.58s - 219.94s | It's not going to touch the file system. 219.94s - 222.94s | Anything that traverses the network is going to be encrypted. 222.94s - 226.98s | So if you don't get a memory sample, then you just threw all the evidence away. 226.98s - 230.74s | If you walk up to that compromised machine and you turn it off, as soon as that machine 230.74s - 233.94s | shuts down, the


chunk_id: 198_chunk_5
chunk_text:
with volatility, we're going to be looking for that malware in memory. 191.90s - 195.48s | If you haven't seen memory forensics before, or maybe you've never looked at a memory sample 195.48s - 200.30s | yourself, the reason why there's this whole industry now around memory forensics and why 200.30s - 206.34s | it's so vital to incorporate it in your investigations is that when you look at the real attacks 206.34s - 210.62s | in the wild, when you look at the malware that's going to be used in environments where 210.62s - 214.22s | the attackers don't want to get caught, where the EDRs are, where there's actually security 214.22s - 217.58s | teams, that malware is going to be memory only. 217.58s - 219.94s | It's not going to touch the file system. 219.94s - 222.94s | Anything that traverses the network is going to be encrypted. 222.94s - 226.98s | So if you don't get a memory sample, then you just threw all the evidence away. 226.98s - 230.74s | If you walk up to that compromised machine and you turn it off, as soon as that machine 230.74s - 233.94s | shuts down, the evidence is gone forever. 233.94s - 239.30s | And what I have highlighted here on the slide is just an interesting report from Microsoft. 239.30s - 245.82s | There's hundreds of reports like this that companies have published. 245.82s - 249.50s | But I like this one because in two sentences, it really summarizes why we spend so much 249.50s - 251.10s | time doing memory. 251.10s - 252.10s | This was Microsoft. 252.10s - 253.42s | It was really interesting. 253.42s - 258.26s | It was basically a spyware company out of Australia that was being used to target some 258.26s - 263.02s | high-level people, and Microsoft burned the whole company to the ground in one report. 263.02s - 266.94s | They burned every piece of malware that company had, all the capabilities. 266.94s - 271.14s | And as I have highlighted in red here with the screenshot, over and over again, Microsoft 271.14s - 277.18s | made the point to say that where the evasion is, where the real payloads are, are in memory. 277.18s - 281.58s | And if you look at what these payloads are capable of, it's key logging, it's screenshots, 281.58s - 286.34s


chunk_id: 198_chunk_6
chunk_text:
evidence is gone forever. 233.94s - 239.30s | And what I have highlighted here on the slide is just an interesting report from Microsoft. 239.30s - 245.82s | There's hundreds of reports like this that companies have published. 245.82s - 249.50s | But I like this one because in two sentences, it really summarizes why we spend so much 249.50s - 251.10s | time doing memory. 251.10s - 252.10s | This was Microsoft. 252.10s - 253.42s | It was really interesting. 253.42s - 258.26s | It was basically a spyware company out of Australia that was being used to target some 258.26s - 263.02s | high-level people, and Microsoft burned the whole company to the ground in one report. 263.02s - 266.94s | They burned every piece of malware that company had, all the capabilities. 266.94s - 271.14s | And as I have highlighted in red here with the screenshot, over and over again, Microsoft 271.14s - 277.18s | made the point to say that where the evasion is, where the real payloads are, are in memory. 277.18s - 281.58s | And if you look at what these payloads are capable of, it's key logging, it's screenshots, 281.58s - 286.34s | it's recording the microphone, recording the webcam, exfiltrating files, everything 286.34s - 291.58s | that allowed this spyware to operate against politicians, journalists, all these people, 291.58s - 292.66s | it was memory only. 292.66s - 296.34s | So traditional disk forensics isn't going to get you anywhere, and you need to know 296.34s - 300.58s | how to efficiently do memory forensics to even make sense of the data and detect the 300.58s - 303.82s | malware in the first place. 303.82s - 308.98s | So as part of our research project, when we first broke down how EDRs are monitoring system 308.98s - 312.50s | activity, the first three have been around a while. 312.50s - 317.86s | Kernel callbacks is where EDRs or antivirus inside the kernel, so from their driver, they 317.86s - 323.14s | can register to say that that callback will be notified every time a process starts or 323.14s - 325.94s | a thread starts or a DLL gets loaded. 325.94s - 333.30s | EDRs will also monitor activity through two of the newer interfaces, so ETW and AMSI. 333.30s - 339.74s | ETW is where kernel drivers can receive a wide


chunk_id: 198_chunk_7
chunk_text:
| it's recording the microphone, recording the webcam, exfiltrating files, everything 286.34s - 291.58s | that allowed this spyware to operate against politicians, journalists, all these people, 291.58s - 292.66s | it was memory only. 292.66s - 296.34s | So traditional disk forensics isn't going to get you anywhere, and you need to know 296.34s - 300.58s | how to efficiently do memory forensics to even make sense of the data and detect the 300.58s - 303.82s | malware in the first place. 303.82s - 308.98s | So as part of our research project, when we first broke down how EDRs are monitoring system 308.98s - 312.50s | activity, the first three have been around a while. 312.50s - 317.86s | Kernel callbacks is where EDRs or antivirus inside the kernel, so from their driver, they 317.86s - 323.14s | can register to say that that callback will be notified every time a process starts or 323.14s - 325.94s | a thread starts or a DLL gets loaded. 325.94s - 333.30s | EDRs will also monitor activity through two of the newer interfaces, so ETW and AMSI. 333.30s - 339.74s | ETW is where kernel drivers can receive a wide range of system activity from processes, 339.74s - 344.50s | also other parts of the kernel, and then AMSI, if you go to other DEF CON talks, Black Hat 344.50s - 350.26s | talks, it gets mentioned a lot, because at this point, what AMSI does is it lets Defender, 350.26s - 355.82s | so Windows Defender, as well as all the EVs, AVs and EDRs, they get to register to say 355.82s - 360.54s | before a PowerShell script runs, before a macro runs, before all these scripting languages 360.54s - 366.06s | where traditional reversing doesn't work and there's a lot of obfuscation, those antivirus 366.06s - 369.22s | engines and the EDR engines get to scan the scripts. 369.22s - 372.98s | If they say they are malicious, then the scripts get blocked. 372.98s - 378.06s | And then what we'll really be focusing on with this talk is the last one, which is system 378.06s - 379.46s | call monitoring. 379.46s - 384.00s | And we'll have some pictures for that to make sure everyone is on the same page. 384.00s - 389.02s | And so when we broke down the bypasses, even, not even just


chunk_id: 198_chunk_8
chunk_text:
range of system activity from processes, 339.74s - 344.50s | also other parts of the kernel, and then AMSI, if you go to other DEF CON talks, Black Hat 344.50s - 350.26s | talks, it gets mentioned a lot, because at this point, what AMSI does is it lets Defender, 350.26s - 355.82s | so Windows Defender, as well as all the EVs, AVs and EDRs, they get to register to say 355.82s - 360.54s | before a PowerShell script runs, before a macro runs, before all these scripting languages 360.54s - 366.06s | where traditional reversing doesn't work and there's a lot of obfuscation, those antivirus 366.06s - 369.22s | engines and the EDR engines get to scan the scripts. 369.22s - 372.98s | If they say they are malicious, then the scripts get blocked. 372.98s - 378.06s | And then what we'll really be focusing on with this talk is the last one, which is system 378.06s - 379.46s | call monitoring. 379.46s - 384.00s | And we'll have some pictures for that to make sure everyone is on the same page. 384.00s - 389.02s | And so when we broke down the bypasses, even, not even just like your really sophisticated 389.02s - 394.06s | threat groups, every ransomware family at this point, the half-decent ones, the first 394.06s - 398.22s | thing they do is load a kernel driver through bring your own vulnerable driver, and they 398.22s - 401.98s | disable all the EDR callbacks and the AV callbacks. 401.98s - 406.78s | At that point, the ransomware can inject code, start new processes, and those systems are 406.78s - 408.10s | blind. 408.10s - 413.80s | For event tracing and AMSI, there are dozens and dozens of papers on how to disable these, 413.80s - 417.50s | and it's essentially a modern part of what you see in real investigations. 417.50s - 422.46s | But what we noticed, and as we'll see here on the next slide, is when we get to system 422.46s - 425.26s | call monitoring, we had no way to detect this. 425.26s - 430.26s | So before this research effort, with memory forensics, with volatility, you could very 430.26s - 435.42s | quickly determine that callbacks had been unregistered, that ETW had been tampered with, 435.42s - 437.10s | that AMSI had been tampered with. 437.10s - 439.86s |


chunk_id: 198_chunk_9
chunk_text:
like your really sophisticated 389.02s - 394.06s | threat groups, every ransomware family at this point, the half-decent ones, the first 394.06s - 398.22s | thing they do is load a kernel driver through bring your own vulnerable driver, and they 398.22s - 401.98s | disable all the EDR callbacks and the AV callbacks. 401.98s - 406.78s | At that point, the ransomware can inject code, start new processes, and those systems are 406.78s - 408.10s | blind. 408.10s - 413.80s | For event tracing and AMSI, there are dozens and dozens of papers on how to disable these, 413.80s - 417.50s | and it's essentially a modern part of what you see in real investigations. 417.50s - 422.46s | But what we noticed, and as we'll see here on the next slide, is when we get to system 422.46s - 425.26s | call monitoring, we had no way to detect this. 425.26s - 430.26s | So before this research effort, with memory forensics, with volatility, you could very 430.26s - 435.42s | quickly determine that callbacks had been unregistered, that ETW had been tampered with, 435.42s - 437.10s | that AMSI had been tampered with. 437.10s - 439.86s | Again, these are going to point you right to the malware. 439.86s - 444.94s | But the system call monitoring that EDRs use, and it's one of the best ways they get visibility 444.94s - 447.74s | on the system, there was no way to detect this. 447.74s - 451.90s | And so in our investigations, we were having to do a lot of manual work to find it, to 451.90s - 456.04s | unravel it, and that just doesn't work for the scale that we operate at. 456.04s - 460.58s | We need automated ways. 460.58s - 466.46s | And the reason that the system calls are so critical to EDRs is the idea with system calls 466.46s - 470.10s | is this is your boundary from process memory to the kernel. 470.10s - 473.10s | So this diagram here are the Windows internals book. 473.10s - 478.26s | You have your processes running, your web browser, your office application, whatever 478.26s - 484.02s | it is that the process is running in user land or user mode, it's all the same thing. 484.02s - 488.88s | Besides manipulating their own memory, whenever they want to access a resource


chunk_id: 198_chunk_10
chunk_text:
Again, these are going to point you right to the malware. 439.86s - 444.94s | But the system call monitoring that EDRs use, and it's one of the best ways they get visibility 444.94s - 447.74s | on the system, there was no way to detect this. 447.74s - 451.90s | And so in our investigations, we were having to do a lot of manual work to find it, to 451.90s - 456.04s | unravel it, and that just doesn't work for the scale that we operate at. 456.04s - 460.58s | We need automated ways. 460.58s - 466.46s | And the reason that the system calls are so critical to EDRs is the idea with system calls 466.46s - 470.10s | is this is your boundary from process memory to the kernel. 470.10s - 473.10s | So this diagram here are the Windows internals book. 473.10s - 478.26s | You have your processes running, your web browser, your office application, whatever 478.26s - 484.02s | it is that the process is running in user land or user mode, it's all the same thing. 484.02s - 488.88s | Besides manipulating their own memory, whenever they want to access a resource on the system, 488.88s - 492.86s | so they want to read or write a file, they want to read or write a network packet, anything 492.86s - 497.30s | beyond manipulating their own memory, they have to ask the operating system to do it. 497.30s - 501.26s | Because obviously you don't want your random notepad process writing directly to the hard 501.26s - 507.02s | drive or you don't want notepad writing directly to the ring buffer of your network driver. 507.02s - 514.74s | So for processes that want to talk to network devices and request those operations, reading 514.74s - 519.54s | a file, writing a file, interacting with the network, it has to go through a system call. 519.54s - 524.14s | And that system call is going to change the execution context into the kernel, which is 524.14s - 526.30s | obviously the most privileged part. 526.30s - 531.24s | It has full access to the operating system itself, to other drivers, to other hardware. 531.24s - 536.24s | What you're seeing on the right side of this slide is the arrow that breaks down between 536.24s - 539.90s | process memory and the


chunk_id: 198_chunk_11
chunk_text:
on the system, 488.88s - 492.86s | so they want to read or write a file, they want to read or write a network packet, anything 492.86s - 497.30s | beyond manipulating their own memory, they have to ask the operating system to do it. 497.30s - 501.26s | Because obviously you don't want your random notepad process writing directly to the hard 501.26s - 507.02s | drive or you don't want notepad writing directly to the ring buffer of your network driver. 507.02s - 514.74s | So for processes that want to talk to network devices and request those operations, reading 514.74s - 519.54s | a file, writing a file, interacting with the network, it has to go through a system call. 519.54s - 524.14s | And that system call is going to change the execution context into the kernel, which is 524.14s - 526.30s | obviously the most privileged part. 526.30s - 531.24s | It has full access to the operating system itself, to other drivers, to other hardware. 531.24s - 536.24s | What you're seeing on the right side of this slide is the arrow that breaks down between 536.24s - 539.90s | process memory and the kernel where the system calls happen. 539.90s - 542.32s | You're seeing a stack trace of that here. 542.32s - 545.90s | When you look at a stack trace, you want to start at the bottom to make sense of it. 545.90s - 550.48s | So in the beginning, what these lines or these rows here with the U, this is in user land 550.48s - 552.56s | or again process memory. 552.56s - 555.30s | You can see that the Edge browser is running. 555.30s - 558.68s | It eventually gets to this call, ZW create file. 558.68s - 562.88s | Your system calls will, in almost all cases, start with ZW. 562.88s - 566.92s | And then you can see this is sysinternals monitoring the call stack. 566.92s - 571.12s | It eventually, when this system call is made, it jumps into the kernel file. 571.12s - 573.34s | And this K means we're in kernel memory. 573.34s - 578.92s | So this last call, the ZW, whatever that particular system call is, that is the last boundary 578.92s - 580.84s | before we jump in the kernel. 580.84s - 586.24s | And the reason we're focusing on


chunk_id: 198_chunk_12
chunk_text:
kernel where the system calls happen. 539.90s - 542.32s | You're seeing a stack trace of that here. 542.32s - 545.90s | When you look at a stack trace, you want to start at the bottom to make sense of it. 545.90s - 550.48s | So in the beginning, what these lines or these rows here with the U, this is in user land 550.48s - 552.56s | or again process memory. 552.56s - 555.30s | You can see that the Edge browser is running. 555.30s - 558.68s | It eventually gets to this call, ZW create file. 558.68s - 562.88s | Your system calls will, in almost all cases, start with ZW. 562.88s - 566.92s | And then you can see this is sysinternals monitoring the call stack. 566.92s - 571.12s | It eventually, when this system call is made, it jumps into the kernel file. 571.12s - 573.34s | And this K means we're in kernel memory. 573.34s - 578.92s | So this last call, the ZW, whatever that particular system call is, that is the last boundary 578.92s - 580.84s | before we jump in the kernel. 580.84s - 586.24s | And the reason we're focusing on this background so much is this is where your EDRs live. 586.24s - 590.64s | Because if you look at this slide, what we're seeing, I'll explain in more detail in a second, 590.64s - 593.72s | but on the left is the normal system call handler. 593.72s - 596.40s | So this is what you get with Windows by default. 596.40s - 600.76s | In this case, the slide is showing ZW protect virtual memory. 600.76s - 603.12s | So another system call on Windows. 603.12s - 606.60s | On the left is the normal flow that's going to reach the kernel. 606.60s - 609.36s | On the right is an EDR that has hooked it. 609.36s - 615.16s | So EDRs that want to monitor what processes are doing on the machine by injecting code 615.24s - 620.36s | into every process, hooking the system call functions of interest, it has complete control 620.36s - 623.96s | over what that process is doing right before it makes the system call. 623.96s - 628.84s | So if it wants to look for suspicious parameters, if it wants to log out what files are being read, 628.84s - 633.44s |


chunk_id: 198_chunk_13
chunk_text:
this background so much is this is where your EDRs live. 586.24s - 590.64s | Because if you look at this slide, what we're seeing, I'll explain in more detail in a second, 590.64s - 593.72s | but on the left is the normal system call handler. 593.72s - 596.40s | So this is what you get with Windows by default. 596.40s - 600.76s | In this case, the slide is showing ZW protect virtual memory. 600.76s - 603.12s | So another system call on Windows. 603.12s - 606.60s | On the left is the normal flow that's going to reach the kernel. 606.60s - 609.36s | On the right is an EDR that has hooked it. 609.36s - 615.16s | So EDRs that want to monitor what processes are doing on the machine by injecting code 615.24s - 620.36s | into every process, hooking the system call functions of interest, it has complete control 620.36s - 623.96s | over what that process is doing right before it makes the system call. 623.96s - 628.84s | So if it wants to look for suspicious parameters, if it wants to log out what files are being read, 628.84s - 633.44s | what parts of the registry are being interacted with, by hooking that lowest level function, 633.44s - 636.12s | the EDR has full visibility. 636.12s - 641.40s | And so as we'll see here in a second, what malware wants to do is make its system calls 641.40s - 644.84s | without EDRs interfering or detecting it. 644.84s - 648.56s | But some background real quick while we're on a nice slide with a picture. 648.56s - 654.24s | What we're seeing here, again on the left, is the normal system call handler that jumped. 654.24s - 655.40s | We're going to go back. 655.40s - 659.04s | So what we see on the left is the normal system call handler. 659.04s - 661.28s | And there's a few things to keep in mind. 661.28s - 666.56s | First off, when you have the NT version of a function and then the ZW prefix version, 666.56s - 670.48s | it's the same exact function, but one's in user land, one's in the kernel. 670.48s - 672.24s | So we're seeing that here. 672.24s - 677.80s | The second thing is from regular C code or C++ code, when you call


chunk_id: 198_chunk_14
chunk_text:
what parts of the registry are being interacted with, by hooking that lowest level function, 633.44s - 636.12s | the EDR has full visibility. 636.12s - 641.40s | And so as we'll see here in a second, what malware wants to do is make its system calls 641.40s - 644.84s | without EDRs interfering or detecting it. 644.84s - 648.56s | But some background real quick while we're on a nice slide with a picture. 648.56s - 654.24s | What we're seeing here, again on the left, is the normal system call handler that jumped. 654.24s - 655.40s | We're going to go back. 655.40s - 659.04s | So what we see on the left is the normal system call handler. 659.04s - 661.28s | And there's a few things to keep in mind. 661.28s - 666.56s | First off, when you have the NT version of a function and then the ZW prefix version, 666.56s - 670.48s | it's the same exact function, but one's in user land, one's in the kernel. 670.48s - 672.24s | So we're seeing that here. 672.24s - 677.80s | The second thing is from regular C code or C++ code, when you call a function, 677.80s - 680.52s | the parameters are sent in certain registers. 680.52s - 683.00s | We're going to focus on 64-bit machines. 683.00s - 687.64s | And besides RCX and R10, they're exactly the same. 687.64s - 690.96s | The weird thing is with Windows, when you make a system call, 690.96s - 694.84s | your second parameter needs to be an R10 instead of RCX. 694.84s - 697.36s | So this has to get updated in those paths. 697.36s - 701.48s | And then EAX or RAX has to hold the system call number. 701.48s - 706.12s | So for all the hundreds of system calls that Windows has for a particular version, 706.12s - 708.28s | each system call has its own number. 708.28s - 711.44s | And if you look at these handlers, they all look exactly like this, 711.44s - 717.12s | except this number changes, because that is the index into the system call table at runtime. 717.12s - 721.24s | And then we have a quick check to see what system call path is supported. 721.24s - 724.16s | And then to make that transition to kernel mode, 724.16s - 726.52s |


chunk_id: 198_chunk_15
chunk_text:
a function, 677.80s - 680.52s | the parameters are sent in certain registers. 680.52s - 683.00s | We're going to focus on 64-bit machines. 683.00s - 687.64s | And besides RCX and R10, they're exactly the same. 687.64s - 690.96s | The weird thing is with Windows, when you make a system call, 690.96s - 694.84s | your second parameter needs to be an R10 instead of RCX. 694.84s - 697.36s | So this has to get updated in those paths. 697.36s - 701.48s | And then EAX or RAX has to hold the system call number. 701.48s - 706.12s | So for all the hundreds of system calls that Windows has for a particular version, 706.12s - 708.28s | each system call has its own number. 708.28s - 711.44s | And if you look at these handlers, they all look exactly like this, 711.44s - 717.12s | except this number changes, because that is the index into the system call table at runtime. 717.12s - 721.24s | And then we have a quick check to see what system call path is supported. 721.24s - 724.16s | And then to make that transition to kernel mode, 724.16s - 726.52s | we're either going to use the system call instruction, 726.52s - 729.80s | or if we're on an older processor, older version of Windows, 729.80s - 732.00s | we're going to make the int2e call. 732.00s - 736.48s | So again, this is on the left is what we would expect on a regular machine 736.48s - 738.08s | where you don't have EDRs. 738.08s - 741.08s | And then if you look on the right here, instead of all this code, 741.08s - 743.20s | make eventually calling system call, 743.20s - 747.76s | we just have a jump out to an unknown region, which is going to be the EDR. 747.76s - 751.52s | And then when malware calls something like protect virtual memory here 751.52s - 755.52s | or create file on the previous slide, the EDR has full control of that. 755.52s - 759.16s | It's going to kill the ransomware before it can launch any payloads. 759.16s - 761.60s | It's going to kill all the code injection techniques. 761.60s - 765.32s | And so if you have a decent EDR and it's not being tampered with, 765.32s - 768.84s | it's going to stop


chunk_id: 198_chunk_16
chunk_text:
we're either going to use the system call instruction, 726.52s - 729.80s | or if we're on an older processor, older version of Windows, 729.80s - 732.00s | we're going to make the int2e call. 732.00s - 736.48s | So again, this is on the left is what we would expect on a regular machine 736.48s - 738.08s | where you don't have EDRs. 738.08s - 741.08s | And then if you look on the right here, instead of all this code, 741.08s - 743.20s | make eventually calling system call, 743.20s - 747.76s | we just have a jump out to an unknown region, which is going to be the EDR. 747.76s - 751.52s | And then when malware calls something like protect virtual memory here 751.52s - 755.52s | or create file on the previous slide, the EDR has full control of that. 755.52s - 759.16s | It's going to kill the ransomware before it can launch any payloads. 759.16s - 761.60s | It's going to kill all the code injection techniques. 761.60s - 765.32s | And so if you have a decent EDR and it's not being tampered with, 765.32s - 768.84s | it's going to stop all these regular malware techniques from functioning. 768.84s - 771.04s | But like I said, we constantly do investigations 771.04s - 774.04s | where there's very potent malware on the machine. 774.04s - 776.32s | There's supposedly EDR on the machine. 776.32s - 787.54s | But when we dig into the infected processes, the EDR has been nullified. 787.54s - 789.46s | So what we're going to do for the rest of the talk 789.46s - 792.30s | is look at all of the bypasses that we found. 792.30s - 793.82s | Like I said, in our own investigations, 793.82s - 796.30s | there's a bunch of open source tools that do it as well. 796.30s - 798.26s | And then how we can detect them. 798.26s - 800.70s | The first one goes by a couple different names, 800.70s - 804.38s | module unhooking, system call unhooking, API unhooking. 804.38s - 809.22s | The basic idea here is the malware is going to unhook the system call handlers. 809.22s - 812.50s | And the end goal is when malware starts running 812.50s - 816.70s | and they're in a process that EDRs have all the system calls in this


chunk_id: 198_chunk_17
chunk_text:
all these regular malware techniques from functioning. 768.84s - 771.04s | But like I said, we constantly do investigations 771.04s - 774.04s | where there's very potent malware on the machine. 774.04s - 776.32s | There's supposedly EDR on the machine. 776.32s - 787.54s | But when we dig into the infected processes, the EDR has been nullified. 787.54s - 789.46s | So what we're going to do for the rest of the talk 789.46s - 792.30s | is look at all of the bypasses that we found. 792.30s - 793.82s | Like I said, in our own investigations, 793.82s - 796.30s | there's a bunch of open source tools that do it as well. 796.30s - 798.26s | And then how we can detect them. 798.26s - 800.70s | The first one goes by a couple different names, 800.70s - 804.38s | module unhooking, system call unhooking, API unhooking. 804.38s - 809.22s | The basic idea here is the malware is going to unhook the system call handlers. 809.22s - 812.50s | And the end goal is when malware starts running 812.50s - 816.70s | and they're in a process that EDRs have all the system calls in this hook form, 816.70s - 818.82s | it wants to get it back to the original form 818.82s - 822.70s | so that the EDR is blind to what's going on. 822.70s - 826.18s | The way this works, and this PowerPoint keeps jumping a lot. 826.18s - 831.18s | The way this works, this is a screenshot from a very recent report, 831.18s - 834.06s | from a very recent report maybe two or three months ago 834.06s - 837.70s | of malware that did this to then spread across a huge network. 837.70s - 843.62s | And the basic idea is where system calls are implemented in memory is NTDLL. 843.62s - 847.30s | So the first DLL that loads in every process is NTDLL. 847.30s - 851.22s | That has all of those system call handlers, one per system call. 851.22s - 852.98s | And that's what the EDRs hook. 852.98s - 856.26s | They put the jump instruction, it goes directly to the EDR code. 856.26s - 858.78s | And then like I said, the EDR can evaluate the parameters 858.78s - 860.82s | before the system call is made. 860.82s - 862.10s | So you can


chunk_id: 198_chunk_18
chunk_text:
hook form, 816.70s - 818.82s | it wants to get it back to the original form 818.82s - 822.70s | so that the EDR is blind to what's going on. 822.70s - 826.18s | The way this works, and this PowerPoint keeps jumping a lot. 826.18s - 831.18s | The way this works, this is a screenshot from a very recent report, 831.18s - 834.06s | from a very recent report maybe two or three months ago 834.06s - 837.70s | of malware that did this to then spread across a huge network. 837.70s - 843.62s | And the basic idea is where system calls are implemented in memory is NTDLL. 843.62s - 847.30s | So the first DLL that loads in every process is NTDLL. 847.30s - 851.22s | That has all of those system call handlers, one per system call. 851.22s - 852.98s | And that's what the EDRs hook. 852.98s - 856.26s | They put the jump instruction, it goes directly to the EDR code. 856.26s - 858.78s | And then like I said, the EDR can evaluate the parameters 858.78s - 860.82s | before the system call is made. 860.82s - 862.10s | So you can see it in the steps here. 862.10s - 863.82s | This report was really nice. 863.82s - 868.58s | What this malware did is it read the clean copy of NTDLL from disk. 868.58s - 871.46s | So that copy on disk is what Microsoft published. 871.46s - 873.90s | That does not have any EDR hooks present. 873.90s - 876.22s | So it reads NTDLL from disk. 876.22s - 880.38s | It finds where those system call handlers are in their clean state on disk. 880.42s - 882.94s | And it just overwrites all the EDRs hooks. 882.94s - 885.62s | And now the malware can call any system call at once 885.62s - 887.82s | with whatever malicious parameters it wants, 887.82s - 890.06s | any malicious end goal that it has. 890.06s - 892.98s | And even though the EDR is technically loaded in that process, 892.98s - 895.18s | its code is never going to be activated. 895.18s - 896.82s | And so when we look at ransomware and we're like, 896.82s - 898.26s | how can it inject code? 898.26s - 899.78s | How is it encrypting all the files? 899.78s - 901.42s | How


chunk_id: 198_chunk_19
chunk_text:
see it in the steps here. 862.10s - 863.82s | This report was really nice. 863.82s - 868.58s | What this malware did is it read the clean copy of NTDLL from disk. 868.58s - 871.46s | So that copy on disk is what Microsoft published. 871.46s - 873.90s | That does not have any EDR hooks present. 873.90s - 876.22s | So it reads NTDLL from disk. 876.22s - 880.38s | It finds where those system call handlers are in their clean state on disk. 880.42s - 882.94s | And it just overwrites all the EDRs hooks. 882.94s - 885.62s | And now the malware can call any system call at once 885.62s - 887.82s | with whatever malicious parameters it wants, 887.82s - 890.06s | any malicious end goal that it has. 890.06s - 892.98s | And even though the EDR is technically loaded in that process, 892.98s - 895.18s | its code is never going to be activated. 895.18s - 896.82s | And so when we look at ransomware and we're like, 896.82s - 898.26s | how can it inject code? 898.26s - 899.78s | How is it encrypting all the files? 899.78s - 901.42s | How is it elevating privileges? 901.42s - 904.10s | It's because the EDR has no idea what's going on. 904.10s - 907.94s | And this is one of the many ways that we'll talk about how it happens. 907.94s - 911.90s | So again, you go from the state where every process on the machine 911.90s - 913.82s | has their system calls hooked. 913.82s - 917.18s | The malicious code, the malware is going to run in its own process 917.18s - 919.82s | or it's going to inject code into a victim process. 919.82s - 922.86s | And in that victim process or the malware's own process, 922.86s - 927.54s | the system call handlers will be reverted back to where they were on disk. 927.54s - 930.46s | But all the other processes will have the hooked form. 930.46s - 933.14s | So what we realized is instead of trying to figure out 933.14s - 936.38s | the 50 different variations for module unhooking, 936.38s - 942.18s | we could just use data in memory to tell us where the malware is. 942.18s - 947.46s | So what our new volatility plugin does is it enumerates every process.


chunk_id: 198_chunk_20
chunk_text:
is it elevating privileges? 901.42s - 904.10s | It's because the EDR has no idea what's going on. 904.10s - 907.94s | And this is one of the many ways that we'll talk about how it happens. 907.94s - 911.90s | So again, you go from the state where every process on the machine 911.90s - 913.82s | has their system calls hooked. 913.82s - 917.18s | The malicious code, the malware is going to run in its own process 917.18s - 919.82s | or it's going to inject code into a victim process. 919.82s - 922.86s | And in that victim process or the malware's own process, 922.86s - 927.54s | the system call handlers will be reverted back to where they were on disk. 927.54s - 930.46s | But all the other processes will have the hooked form. 930.46s - 933.14s | So what we realized is instead of trying to figure out 933.14s - 936.38s | the 50 different variations for module unhooking, 936.38s - 942.18s | we could just use data in memory to tell us where the malware is. 942.18s - 947.46s | So what our new volatility plugin does is it enumerates every process. 947.46s - 951.22s | It reads the bytes of all the system call handlers that the EDRs 951.22s - 953.38s | or that the malware often targets. 953.38s - 955.54s | And then we just compare the implementations. 955.54s - 957.66s | And as you'll see here in a couple of slides, 957.66s - 961.06s | what we can do is say you have 100 processes running. 961.06s - 963.50s | 99 of them have one implementation. 963.50s - 967.02s | And this one process on its own has a different implementation. 967.02s - 970.02s | The 99 are the ones where the EDR is still active. 970.02s - 974.66s | And that one kind of outlier process is the one that the malware is unhooked. 974.66s - 976.78s | And so we like, when we do this type of research, 976.78s - 980.54s | we like to make experiments that can be repeated by anyone else. 980.54s - 982.86s | Obviously, not everyone works at Valexity 982.86s - 985.98s | and has access to our infected samples from the wild. 985.98s - 989.06s | So we come up with experiments using open source tools 989.06s - 991.18s | where


chunk_id: 198_chunk_21
chunk_text:
947.46s - 951.22s | It reads the bytes of all the system call handlers that the EDRs 951.22s - 953.38s | or that the malware often targets. 953.38s - 955.54s | And then we just compare the implementations. 955.54s - 957.66s | And as you'll see here in a couple of slides, 957.66s - 961.06s | what we can do is say you have 100 processes running. 961.06s - 963.50s | 99 of them have one implementation. 963.50s - 967.02s | And this one process on its own has a different implementation. 967.02s - 970.02s | The 99 are the ones where the EDR is still active. 970.02s - 974.66s | And that one kind of outlier process is the one that the malware is unhooked. 974.66s - 976.78s | And so we like, when we do this type of research, 976.78s - 980.54s | we like to make experiments that can be repeated by anyone else. 980.54s - 982.86s | Obviously, not everyone works at Valexity 982.86s - 985.98s | and has access to our infected samples from the wild. 985.98s - 989.06s | So we come up with experiments using open source tools 989.06s - 991.18s | where you can recreate this on your own 991.18s - 993.30s | and you can test it in your own environment. 993.30s - 996.26s | So a very nice tool for testing EDR, 996.26s - 999.82s | a very nice open source tool for testing EDR bypasses 999.82s - 1001.46s | is called SilentStrike. 1001.46s - 1003.90s | So this is an open source EDR, 1003.90s - 1007.02s | and it was actually developed just to test these bypasses 1007.02s - 1009.02s | and then see if you could detect them. 1009.02s - 1013.38s | The way SilentStrike works is it hooks NT Protect virtual memory. 1013.38s - 1016.34s | This is one of the main functions that malware needs 1016.34s - 1018.10s | to perform code injection 1018.10s - 1020.86s | and also to try to keep that code injection stealthy. 1020.86s - 1023.26s | And so what this open source EDR does 1023.26s - 1024.86s | is it hooks that function. 1024.86s - 1027.22s | If it gets called where the region's going to become 1027.22s - 1029.02s | readable, writable, and executable, 1029.02s - 1030.66s | the EDR says you can't do that, 1030.66s - 1033.58s | and


chunk_id: 198_chunk_22
chunk_text:
you can recreate this on your own 991.18s - 993.30s | and you can test it in your own environment. 993.30s - 996.26s | So a very nice tool for testing EDR, 996.26s - 999.82s | a very nice open source tool for testing EDR bypasses 999.82s - 1001.46s | is called SilentStrike. 1001.46s - 1003.90s | So this is an open source EDR, 1003.90s - 1007.02s | and it was actually developed just to test these bypasses 1007.02s - 1009.02s | and then see if you could detect them. 1009.02s - 1013.38s | The way SilentStrike works is it hooks NT Protect virtual memory. 1013.38s - 1016.34s | This is one of the main functions that malware needs 1016.34s - 1018.10s | to perform code injection 1018.10s - 1020.86s | and also to try to keep that code injection stealthy. 1020.86s - 1023.26s | And so what this open source EDR does 1023.26s - 1024.86s | is it hooks that function. 1024.86s - 1027.22s | If it gets called where the region's going to become 1027.22s - 1029.02s | readable, writable, and executable, 1029.02s - 1030.66s | the EDR says you can't do that, 1030.66s - 1033.58s | and that stops a lot of different code injection techniques. 1033.58s - 1036.06s | So for our experiment, what we did 1036.06s - 1040.10s | is we took a base Windows 10 install, so no EDR. 1040.10s - 1042.26s | With SilentStrike, you can tell it 1042.26s - 1044.38s | to create individual processes 1044.38s - 1047.46s | that it will then treat as an EDR and protect. 1047.46s - 1050.34s | So we started a notepad and we started a WordPad. 1050.34s - 1053.06s | At this point, they have SilentStrike active in it, 1053.06s - 1055.02s | which is your EDR. 1055.02s - 1057.02s | We then took a memory sample. 1057.02s - 1060.94s | After that, we ran R77, which is an open source rootkit 1060.94s - 1062.94s | that does this module unhooking, 1062.94s - 1065.98s | and we unhooked the notepad process. 1065.98s - 1067.94s | And then we took a second memory sample. 1067.94s - 1071.34s | So we have the state before and after the malware ran. 1072.34s - 1073.86s | And with our new plugin, 1073.86s - 1077.30s | so unhook system calls to volatility three, 1077.30s - 1079.26s | what it's saying


chunk_id: 198_chunk_23
chunk_text:
that stops a lot of different code injection techniques. 1033.58s - 1036.06s | So for our experiment, what we did 1036.06s - 1040.10s | is we took a base Windows 10 install, so no EDR. 1040.10s - 1042.26s | With SilentStrike, you can tell it 1042.26s - 1044.38s | to create individual processes 1044.38s - 1047.46s | that it will then treat as an EDR and protect. 1047.46s - 1050.34s | So we started a notepad and we started a WordPad. 1050.34s - 1053.06s | At this point, they have SilentStrike active in it, 1053.06s - 1055.02s | which is your EDR. 1055.02s - 1057.02s | We then took a memory sample. 1057.02s - 1060.94s | After that, we ran R77, which is an open source rootkit 1060.94s - 1062.94s | that does this module unhooking, 1062.94s - 1065.98s | and we unhooked the notepad process. 1065.98s - 1067.94s | And then we took a second memory sample. 1067.94s - 1071.34s | So we have the state before and after the malware ran. 1072.34s - 1073.86s | And with our new plugin, 1073.86s - 1077.30s | so unhook system calls to volatility three, 1077.30s - 1079.26s | what it's saying here is what we do 1079.26s - 1080.90s | is we enumerate all the functions. 1080.90s - 1081.82s | The slide is cut. 1081.82s - 1084.38s | There's probably like 50 functions we actually check. 1084.38s - 1085.98s | But the idea is we're saying, 1085.98s - 1088.06s | for these processes down here, 1088.06s - 1089.86s | there's no distinct implementations. 1089.86s - 1093.74s | So every process inside of that memory sample 1093.74s - 1095.62s | had the same version of the function. 1095.62s - 1098.46s | And then the two that we started under SilentStrike, 1098.46s - 1101.94s | their NT protect virtual memory, had the EDR's view. 1101.94s - 1104.82s | This is before we ran R77. 1104.82s - 1108.70s | We then ran the R77 rootkit on the machine. 1108.70s - 1111.50s | We unhooked notepad, and you can see it removes 1112.18s - 1113.34s | from distinct implementations. 1113.34s - 1115.70s | It's been reverted back to the base form. 1115.70s - 1116.94s | So then we took this plugin, 1116.94s - 1120.42s | ran it across the many hundreds of memory samples 1120.42s - 1122.82s | that we have to test our code


chunk_id: 198_chunk_24
chunk_text:
here is what we do 1079.26s - 1080.90s | is we enumerate all the functions. 1080.90s - 1081.82s | The slide is cut. 1081.82s - 1084.38s | There's probably like 50 functions we actually check. 1084.38s - 1085.98s | But the idea is we're saying, 1085.98s - 1088.06s | for these processes down here, 1088.06s - 1089.86s | there's no distinct implementations. 1089.86s - 1093.74s | So every process inside of that memory sample 1093.74s - 1095.62s | had the same version of the function. 1095.62s - 1098.46s | And then the two that we started under SilentStrike, 1098.46s - 1101.94s | their NT protect virtual memory, had the EDR's view. 1101.94s - 1104.82s | This is before we ran R77. 1104.82s - 1108.70s | We then ran the R77 rootkit on the machine. 1108.70s - 1111.50s | We unhooked notepad, and you can see it removes 1112.18s - 1113.34s | from distinct implementations. 1113.34s - 1115.70s | It's been reverted back to the base form. 1115.70s - 1116.94s | So then we took this plugin, 1116.94s - 1120.42s | ran it across the many hundreds of memory samples 1120.42s - 1122.82s | that we have to test our code on. 1122.82s - 1125.34s | And the only place this plugin fired 1125.34s - 1128.74s | was either traditional API hooking or EDR unhooks. 1128.74s - 1131.14s | And so there's no false positives with this. 1131.14s - 1133.06s | If the EDR's hooked every process, 1133.06s - 1134.74s | it doesn't make sense that it would skip one 1134.74s - 1136.26s | or that one should be reverted. 1136.26s - 1141.01s | This directly tells you where the malware's running. 1141.01s - 1144.77s | We then started looking into other ways to read NTDLL. 1144.77s - 1146.69s | So you saw it in the screenshot before 1146.69s - 1148.29s | from that malware report. 1148.29s - 1151.61s | And I walked you through where for unhooking to work, 1151.61s - 1155.29s | the malware needs access to a clean copy of NTDLL, 1155.29s - 1157.45s | which normally you can just read from disk, 1157.45s - 1159.13s | but there was several EDR vendors 1159.13s - 1160.57s | that started detecting that. 1160.57s - 1162.49s | Because why would some random process 1162.49s - 1166.25s | need to read NTDLL as a file and parse the section? 1166.25s -


chunk_id: 198_chunk_25
chunk_text:
on. 1122.82s - 1125.34s | And the only place this plugin fired 1125.34s - 1128.74s | was either traditional API hooking or EDR unhooks. 1128.74s - 1131.14s | And so there's no false positives with this. 1131.14s - 1133.06s | If the EDR's hooked every process, 1133.06s - 1134.74s | it doesn't make sense that it would skip one 1134.74s - 1136.26s | or that one should be reverted. 1136.26s - 1141.01s | This directly tells you where the malware's running. 1141.01s - 1144.77s | We then started looking into other ways to read NTDLL. 1144.77s - 1146.69s | So you saw it in the screenshot before 1146.69s - 1148.29s | from that malware report. 1148.29s - 1151.61s | And I walked you through where for unhooking to work, 1151.61s - 1155.29s | the malware needs access to a clean copy of NTDLL, 1155.29s - 1157.45s | which normally you can just read from disk, 1157.45s - 1159.13s | but there was several EDR vendors 1159.13s - 1160.57s | that started detecting that. 1160.57s - 1162.49s | Because why would some random process 1162.49s - 1166.25s | need to read NTDLL as a file and parse the section? 1166.25s - 1167.61s | The only reason to do that 1167.61s - 1170.33s | is to unhook the EDR out of memory. 1170.33s - 1173.45s | So this made it harder for that malware to operate. 1173.45s - 1177.13s | It can't read NTDLL from disk or it's going to get caught. 1177.13s - 1180.57s | So we saw some malware samples and some open source tools 1180.57s - 1184.33s | that abused suspended processes to get the clean copy. 1184.33s - 1186.89s | If you've ever investigated process hollowing, 1186.89s - 1188.37s | whether you were writing code for it 1188.37s - 1190.21s | or you were trying to detect it, 1190.21s - 1192.73s | creating suspended processes is the first step 1192.73s - 1194.57s | of every process hollowing technique. 1194.57s - 1197.05s | So we'll see that we catch some of those as well 1197.05s - 1198.49s | as kind of a side effect. 1198.53s - 1200.69s | But the idea for EDR bypasses 1200.69s - 1204.53s | is the malware will create a suspended process. 1204.53s - 1206.37s | The idea with a suspended process 1206.37s - 1208.89s | is that the only thing that's going to load


chunk_id: 198_chunk_26
chunk_text:
1167.61s | The only reason to do that 1167.61s - 1170.33s | is to unhook the EDR out of memory. 1170.33s - 1173.45s | So this made it harder for that malware to operate. 1173.45s - 1177.13s | It can't read NTDLL from disk or it's going to get caught. 1177.13s - 1180.57s | So we saw some malware samples and some open source tools 1180.57s - 1184.33s | that abused suspended processes to get the clean copy. 1184.33s - 1186.89s | If you've ever investigated process hollowing, 1186.89s - 1188.37s | whether you were writing code for it 1188.37s - 1190.21s | or you were trying to detect it, 1190.21s - 1192.73s | creating suspended processes is the first step 1192.73s - 1194.57s | of every process hollowing technique. 1194.57s - 1197.05s | So we'll see that we catch some of those as well 1197.05s - 1198.49s | as kind of a side effect. 1198.53s - 1200.69s | But the idea for EDR bypasses 1200.69s - 1204.53s | is the malware will create a suspended process. 1204.53s - 1206.37s | The idea with a suspended process 1206.37s - 1208.89s | is that the only thing that's going to load 1208.89s - 1212.09s | is the application executable and NTDLL. 1212.09s - 1215.29s | It's kind of like a half created process at that point. 1215.29s - 1219.93s | Once the EXE and NTDLL are mapped into the process, 1219.93s - 1222.13s | then at that point, the parent process, 1222.13s - 1224.89s | the one who created the process gets control back. 1224.89s - 1226.29s | So then what the malware does 1226.29s - 1228.41s | is it just reads from its child process, 1229.21s - 1230.85s | the clean NTDLL out of memory. 1230.85s - 1233.21s | The EDR doesn't see a suspended process 1233.21s - 1235.05s | until it actually starts running. 1235.05s - 1237.93s | So this puts a clean copy of NTDLL in memory. 1237.93s - 1240.09s | The malware doesn't have to go read it from disk. 1240.09s - 1241.61s | And so obviously we wanted to be able 1241.61s - 1243.13s | to detect this as well. 1244.57s - 1246.53s | So we did some reverse engineering 1246.53s - 1248.49s | and read some preexisting reports 1248.49s - 1250.89s | on what happens with suspended processes. 1250.89s - 1252.41s | Like I said,


chunk_id: 198_chunk_27
chunk_text:
1208.89s - 1212.09s | is the application executable and NTDLL. 1212.09s - 1215.29s | It's kind of like a half created process at that point. 1215.29s - 1219.93s | Once the EXE and NTDLL are mapped into the process, 1219.93s - 1222.13s | then at that point, the parent process, 1222.13s - 1224.89s | the one who created the process gets control back. 1224.89s - 1226.29s | So then what the malware does 1226.29s - 1228.41s | is it just reads from its child process, 1229.21s - 1230.85s | the clean NTDLL out of memory. 1230.85s - 1233.21s | The EDR doesn't see a suspended process 1233.21s - 1235.05s | until it actually starts running. 1235.05s - 1237.93s | So this puts a clean copy of NTDLL in memory. 1237.93s - 1240.09s | The malware doesn't have to go read it from disk. 1240.09s - 1241.61s | And so obviously we wanted to be able 1241.61s - 1243.13s | to detect this as well. 1244.57s - 1246.53s | So we did some reverse engineering 1246.53s - 1248.49s | and read some preexisting reports 1248.49s - 1250.89s | on what happens with suspended processes. 1250.89s - 1252.41s | Like I said, we see it a lot 1252.41s - 1253.33s | because you have to do this 1253.33s - 1255.69s | if you want to create a hollowed process. 1255.69s - 1257.65s | But what you have in kernel memory 1257.69s - 1260.77s | is for every process, you have an E-process structure. 1260.77s - 1262.69s | For every thread, you have an E-thread 1262.69s - 1264.29s | or a K-thread structure. 1264.29s - 1267.37s | When that process gets created in the suspended state, 1267.37s - 1269.85s | every process starts with one thread. 1269.85s - 1272.41s | And when you create the thread suspended, 1272.41s - 1274.41s | its suspense count goes to one, 1274.41s - 1276.85s | which tells the operating system not to run it. 1276.85s - 1279.29s | Normally, if you just create a process in the normal way 1279.29s - 1281.25s | or you double-click it on your desktop, 1281.25s - 1283.01s | the suspend count's gonna be zero. 1283.01s - 1284.97s | And as soon as that process can get scheduled, 1284.97s - 1286.77s | its threads are going to run. 1286.77s - 1289.85s | But what we saw in every piece of malware that


chunk_id: 198_chunk_28
chunk_text:
we see it a lot 1252.41s - 1253.33s | because you have to do this 1253.33s - 1255.69s | if you want to create a hollowed process. 1255.69s - 1257.65s | But what you have in kernel memory 1257.69s - 1260.77s | is for every process, you have an E-process structure. 1260.77s - 1262.69s | For every thread, you have an E-thread 1262.69s - 1264.29s | or a K-thread structure. 1264.29s - 1267.37s | When that process gets created in the suspended state, 1267.37s - 1269.85s | every process starts with one thread. 1269.85s - 1272.41s | And when you create the thread suspended, 1272.41s - 1274.41s | its suspense count goes to one, 1274.41s - 1276.85s | which tells the operating system not to run it. 1276.85s - 1279.29s | Normally, if you just create a process in the normal way 1279.29s - 1281.25s | or you double-click it on your desktop, 1281.25s - 1283.01s | the suspend count's gonna be zero. 1283.01s - 1284.97s | And as soon as that process can get scheduled, 1284.97s - 1286.77s | its threads are going to run. 1286.77s - 1289.85s | But what we saw in every piece of malware that we had 1289.85s - 1292.81s | and every open-source tool we had access to that did this, 1292.81s - 1294.77s | when they create the suspended process 1294.77s - 1297.13s | just to read the clean NTDLL, 1297.13s - 1299.29s | they're never going to run that child process. 1299.29s - 1301.21s | They are just getting that into memory 1301.21s - 1304.41s | to get access to the clean system call handlers. 1304.41s - 1306.09s | So this was pretty easy. 1306.09s - 1307.21s | We wrote a plugin. 1307.21s - 1308.89s | Volatility could already enumerate 1308.89s - 1310.65s | every thread of every process. 1310.65s - 1312.89s | And then we just added an extra step to say, 1312.89s - 1316.09s | does that thread have a suspend count greater than zero? 1316.09s - 1319.33s | Running it across our large data set of memory samples, 1319.33s - 1322.33s | the only false positive we had, which was pretty random, 1322.33s - 1325.41s | is this work folder shell DLL inside of Edge 1325.41s - 1326.69s | makes suspended threads. 1326.69s - 1327.69s | We don't know why. 1327.69s - 1330.09s | So we just added that


chunk_id: 198_chunk_29
chunk_text:
we had 1289.85s - 1292.81s | and every open-source tool we had access to that did this, 1292.81s - 1294.77s | when they create the suspended process 1294.77s - 1297.13s | just to read the clean NTDLL, 1297.13s - 1299.29s | they're never going to run that child process. 1299.29s - 1301.21s | They are just getting that into memory 1301.21s - 1304.41s | to get access to the clean system call handlers. 1304.41s - 1306.09s | So this was pretty easy. 1306.09s - 1307.21s | We wrote a plugin. 1307.21s - 1308.89s | Volatility could already enumerate 1308.89s - 1310.65s | every thread of every process. 1310.65s - 1312.89s | And then we just added an extra step to say, 1312.89s - 1316.09s | does that thread have a suspend count greater than zero? 1316.09s - 1319.33s | Running it across our large data set of memory samples, 1319.33s - 1322.33s | the only false positive we had, which was pretty random, 1322.33s - 1325.41s | is this work folder shell DLL inside of Edge 1325.41s - 1326.69s | makes suspended threads. 1326.69s - 1327.69s | We don't know why. 1327.69s - 1330.09s | So we just added that to the list of ones 1330.09s - 1331.09s | we don't print out. 1331.09s - 1334.01s | And besides that, we didn't have a single false positive. 1334.01s - 1335.45s | And then, like I said, at Vlexity, 1335.45s - 1338.09s | we have hundreds and hundreds of memory samples 1338.09s - 1340.45s | in different states that we test these things on. 1340.45s - 1342.21s | And quite a few of the samples 1342.21s - 1344.57s | that we know have process hollowing in them, 1344.57s - 1346.81s | they were detected, too, because if you're 1346.81s - 1348.85s | familiar with that technique, the idea 1348.85s - 1351.13s | is you create a process in a suspended state, 1351.13s - 1354.53s | you overwrite the code, and then you let that new process run. 1354.53s - 1357.57s | And so not only is this plugin picking up all the EDR 1357.57s - 1361.77s | bypasses, we generically caught a bunch 1361.77s - 1371.69s | of different process hollowing techniques as well. 1371.69s - 1375.41s | At Black Hat Europe, maybe two years ago now, three years ago, 1375.41s - 1377.21s | there was a really cool white paper


chunk_id: 198_chunk_30
chunk_text:
to the list of ones 1330.09s - 1331.09s | we don't print out. 1331.09s - 1334.01s | And besides that, we didn't have a single false positive. 1334.01s - 1335.45s | And then, like I said, at Vlexity, 1335.45s - 1338.09s | we have hundreds and hundreds of memory samples 1338.09s - 1340.45s | in different states that we test these things on. 1340.45s - 1342.21s | And quite a few of the samples 1342.21s - 1344.57s | that we know have process hollowing in them, 1344.57s - 1346.81s | they were detected, too, because if you're 1346.81s - 1348.85s | familiar with that technique, the idea 1348.85s - 1351.13s | is you create a process in a suspended state, 1351.13s - 1354.53s | you overwrite the code, and then you let that new process run. 1354.53s - 1357.57s | And so not only is this plugin picking up all the EDR 1357.57s - 1361.77s | bypasses, we generically caught a bunch 1361.77s - 1371.69s | of different process hollowing techniques as well. 1371.69s - 1375.41s | At Black Hat Europe, maybe two years ago now, three years ago, 1375.41s - 1377.21s | there was a really cool white paper 1377.21s - 1380.29s | and talk on a project called Dirty Vanity. 1380.29s - 1382.49s | The idea was they tested against basically 1382.49s - 1385.69s | every commercial EDR they could get their hands on. 1385.69s - 1388.45s | And the idea is they wanted to be able to do code injection 1388.45s - 1391.85s | into a victim process without the EDRs catching them. 1391.85s - 1394.17s | And if you're familiar with this, to do code injection, 1394.17s - 1396.01s | there's five or six APIs you have 1396.01s - 1397.87s | to call to make that work. 1397.87s - 1400.61s | And if you call all those in a row and you're injecting, 1400.61s - 1403.01s | the end result is you're going to inject into your victim 1403.01s - 1407.45s | process any half-decent EDR, any enterprise-level EDR 1407.45s - 1409.09s | is going to catch that. 1409.09s - 1411.69s | So what was really interesting about Dirty Vanity 1411.69s - 1414.97s | is they instead created clone processes or a forked process 1414.97s - 1417.05s | if you're more familiar with Linux. 1417.05s - 1419.73s | So the idea with a clone or a


chunk_id: 198_chunk_31
chunk_text:
1377.21s - 1380.29s | and talk on a project called Dirty Vanity. 1380.29s - 1382.49s | The idea was they tested against basically 1382.49s - 1385.69s | every commercial EDR they could get their hands on. 1385.69s - 1388.45s | And the idea is they wanted to be able to do code injection 1388.45s - 1391.85s | into a victim process without the EDRs catching them. 1391.85s - 1394.17s | And if you're familiar with this, to do code injection, 1394.17s - 1396.01s | there's five or six APIs you have 1396.01s - 1397.87s | to call to make that work. 1397.87s - 1400.61s | And if you call all those in a row and you're injecting, 1400.61s - 1403.01s | the end result is you're going to inject into your victim 1403.01s - 1407.45s | process any half-decent EDR, any enterprise-level EDR 1407.45s - 1409.09s | is going to catch that. 1409.09s - 1411.69s | So what was really interesting about Dirty Vanity 1411.69s - 1414.97s | is they instead created clone processes or a forked process 1414.97s - 1417.05s | if you're more familiar with Linux. 1417.05s - 1419.73s | So the idea with a clone or a forked process 1419.73s - 1422.19s | is your process is running. 1422.19s - 1424.61s | You create a clone of your own process. 1424.61s - 1426.61s | So that child process you created 1426.61s - 1428.57s | has your same exact state. 1428.57s - 1430.41s | So then what Dirty Vanity did is they 1430.41s - 1433.33s | called the first couple APIs from the parent. 1433.33s - 1435.19s | And then they create the clone, which 1435.19s - 1437.29s | has the same exact state as the parent. 1437.29s - 1440.13s | And they called the final set of APIs from the child. 1440.13s - 1442.53s | So the end result is they're still injecting code 1442.53s - 1444.17s | into the victim process. 1444.17s - 1446.21s | But none of the EDRs that they tested 1446.21s - 1449.61s | were able to detect the calls going across the process 1449.61s - 1450.49s | boundary. 1450.49s - 1452.87s | So obviously, we wanted to be able to detect this 1452.87s - 1456.01s | from a memory forensic standpoint. 1456.01s - 1457.83s | So while we were looking into what 1457.83s - 1460.05s | it means to clone a process


chunk_id: 198_chunk_32
chunk_text:
forked process 1419.73s - 1422.19s | is your process is running. 1422.19s - 1424.61s | You create a clone of your own process. 1424.61s - 1426.61s | So that child process you created 1426.61s - 1428.57s | has your same exact state. 1428.57s - 1430.41s | So then what Dirty Vanity did is they 1430.41s - 1433.33s | called the first couple APIs from the parent. 1433.33s - 1435.19s | And then they create the clone, which 1435.19s - 1437.29s | has the same exact state as the parent. 1437.29s - 1440.13s | And they called the final set of APIs from the child. 1440.13s - 1442.53s | So the end result is they're still injecting code 1442.53s - 1444.17s | into the victim process. 1444.17s - 1446.21s | But none of the EDRs that they tested 1446.21s - 1449.61s | were able to detect the calls going across the process 1449.61s - 1450.49s | boundary. 1450.49s - 1452.87s | So obviously, we wanted to be able to detect this 1452.87s - 1456.01s | from a memory forensic standpoint. 1456.01s - 1457.83s | So while we were looking into what 1457.83s - 1460.05s | it means to clone a process in Windows, 1460.05s - 1463.61s | the real internal state, we saw that what Windows does when 1463.61s - 1466.91s | it's setting up that clone is it makes a suspended thread. 1467.03s - 1469.43s | So that child that's being cloned into 1469.43s - 1471.39s | has its first thread suspended. 1471.39s - 1475.03s | And with Dirty Vanity, it never restarted the child process 1475.03s - 1477.63s | or the initial thread of the child process. 1477.63s - 1480.43s | So the plug-in that we had detected it right away. 1480.43s - 1481.91s | And if you're interested in this, 1481.91s - 1483.55s | I have it cited here at the bottom. 1483.55s - 1485.47s | We found this thing called the Definitive Guide 1485.47s - 1486.87s | to Process Cloning on Windows. 1486.87s - 1490.95s | It's like 40 pages of APIs and data structures and background. 1490.95s - 1492.59s | But it pretty much told us exactly 1492.59s - 1495.79s | what we needed to know on top of what we saw with reversing. 1497.63s - 1501.55s | We made a memory sample that was infected with Dirty Vanity. 1501.55s - 1504.39s | And as you


chunk_id: 198_chunk_33
chunk_text:
in Windows, 1460.05s - 1463.61s | the real internal state, we saw that what Windows does when 1463.61s - 1466.91s | it's setting up that clone is it makes a suspended thread. 1467.03s - 1469.43s | So that child that's being cloned into 1469.43s - 1471.39s | has its first thread suspended. 1471.39s - 1475.03s | And with Dirty Vanity, it never restarted the child process 1475.03s - 1477.63s | or the initial thread of the child process. 1477.63s - 1480.43s | So the plug-in that we had detected it right away. 1480.43s - 1481.91s | And if you're interested in this, 1481.91s - 1483.55s | I have it cited here at the bottom. 1483.55s - 1485.47s | We found this thing called the Definitive Guide 1485.47s - 1486.87s | to Process Cloning on Windows. 1486.87s - 1490.95s | It's like 40 pages of APIs and data structures and background. 1490.95s - 1492.59s | But it pretty much told us exactly 1492.59s - 1495.79s | what we needed to know on top of what we saw with reversing. 1497.63s - 1501.55s | We made a memory sample that was infected with Dirty Vanity. 1501.55s - 1504.39s | And as you can see, we're running our suspended threads 1504.39s - 1505.31s | plug-in. 1505.31s - 1508.87s | It's telling us that inside of the fake EXE process, which 1508.87s - 1511.27s | is what Dirty Vanity calls itself if you just 1511.27s - 1513.31s | compile it straight from GitHub. 1513.31s - 1518.63s | And then it's saying that this process ID, 6752, this thread, 1518.63s - 1522.53s | it is suspended or suspend count is greater than 0. 1522.53s - 1525.15s | And then if you look at PSTree in volatility, 1525.15s - 1528.07s | so this is drawing out the parent-child relationship 1528.07s - 1532.79s | of processes, you can see that the original fake EXE 1532.79s - 1535.55s | has a child called fake EXE. 1535.55s - 1540.43s | So this is that process that was created through cloning. 1540.43s - 1541.51s | So this is the parent. 1541.51s - 1545.11s | This is where Dirty Vanity will call the first couple APIs. 1545.11s - 1548.01s | It then forks or clones off a child process 1548.01s - 1552.43s | where it will call the remaining APIs, bypassing the EDR. 1552.43s - 1554.63s | But what you can


chunk_id: 198_chunk_34
chunk_text:
can see, we're running our suspended threads 1504.39s - 1505.31s | plug-in. 1505.31s - 1508.87s | It's telling us that inside of the fake EXE process, which 1508.87s - 1511.27s | is what Dirty Vanity calls itself if you just 1511.27s - 1513.31s | compile it straight from GitHub. 1513.31s - 1518.63s | And then it's saying that this process ID, 6752, this thread, 1518.63s - 1522.53s | it is suspended or suspend count is greater than 0. 1522.53s - 1525.15s | And then if you look at PSTree in volatility, 1525.15s - 1528.07s | so this is drawing out the parent-child relationship 1528.07s - 1532.79s | of processes, you can see that the original fake EXE 1532.79s - 1535.55s | has a child called fake EXE. 1535.55s - 1540.43s | So this is that process that was created through cloning. 1540.43s - 1541.51s | So this is the parent. 1541.51s - 1545.11s | This is where Dirty Vanity will call the first couple APIs. 1545.11s - 1548.01s | It then forks or clones off a child process 1548.01s - 1552.43s | where it will call the remaining APIs, bypassing the EDR. 1552.43s - 1554.63s | But what you can see volatility picking up on 1554.63s - 1557.91s | is the child's always going to have its main thread suspended. 1557.91s - 1559.89s | And so we pick up on that right away. 1559.89s - 1561.51s | You would then run PSTree would probably 1561.51s - 1564.11s | be the next thing if this was a real investigation. 1564.11s - 1566.03s | You would figure out the parent that 1566.03s - 1568.27s | created the suspended process. 1568.27s - 1571.51s | And then you can see here what it does in demo mode. 1571.51s - 1573.75s | So if you don't have an EDR you're targeting, 1573.75s - 1575.67s | Dirty Vanity will run command shell 1575.67s - 1578.63s | with some shellcode that makes a pop-up on the screen 1578.63s - 1580.23s | or prints it to the terminal. 1580.23s - 1583.03s | So you see that here as well, that child process. 1583.03s - 1585.03s | But through the new plugin, you see exactly 1585.03s - 1586.79s | which process is malicious. 1586.79s - 1594.47s | You can then do your normal memory forensics workflow. 1594.47s - 1596.53s | As you've been seeing in the slides, 1596.53s -


chunk_id: 198_chunk_35
chunk_text:
see volatility picking up on 1554.63s - 1557.91s | is the child's always going to have its main thread suspended. 1557.91s - 1559.89s | And so we pick up on that right away. 1559.89s - 1561.51s | You would then run PSTree would probably 1561.51s - 1564.11s | be the next thing if this was a real investigation. 1564.11s - 1566.03s | You would figure out the parent that 1566.03s - 1568.27s | created the suspended process. 1568.27s - 1571.51s | And then you can see here what it does in demo mode. 1571.51s - 1573.75s | So if you don't have an EDR you're targeting, 1573.75s - 1575.67s | Dirty Vanity will run command shell 1575.67s - 1578.63s | with some shellcode that makes a pop-up on the screen 1578.63s - 1580.23s | or prints it to the terminal. 1580.23s - 1583.03s | So you see that here as well, that child process. 1583.03s - 1585.03s | But through the new plugin, you see exactly 1585.03s - 1586.79s | which process is malicious. 1586.79s - 1594.47s | You can then do your normal memory forensics workflow. 1594.47s - 1596.53s | As you've been seeing in the slides, 1596.53s - 1598.37s | the previous techniques that we looked 1598.37s - 1602.09s | into for bypassing the system call handlers 1602.09s - 1604.15s | relied on overwriting code. 1604.15s - 1605.53s | And you might have been thinking, 1605.53s - 1608.73s | especially if you've done debugging before or low level 1608.73s - 1610.89s | programming before, the idea that you're 1610.89s - 1613.43s | going to overwrite NTDLL, the entire thing 1613.43s - 1616.21s | or certain functions at runtime, is a bit unsafe. 1616.29s - 1617.81s | Because you can imagine if you're 1617.81s - 1620.85s | overwriting 30 or 40 functions code in memory, 1620.85s - 1623.41s | if any other thread is using that function 1623.41s - 1625.21s | or a system call was just made and you're 1625.21s - 1627.49s | waiting for user LAN to return again, 1627.49s - 1629.65s | you just blew away the code that was technically 1629.65s - 1631.11s | running on the CPU. 1631.11s - 1632.25s | So malware does it. 1632.25s - 1634.49s | It generally works, but it's a bit unsafe. 1634.49s - 1636.25s | And then the other thing you could imagine 1636.25s - 1638.57s | is


chunk_id: 198_chunk_36
chunk_text:
1598.37s | the previous techniques that we looked 1598.37s - 1602.09s | into for bypassing the system call handlers 1602.09s - 1604.15s | relied on overwriting code. 1604.15s - 1605.53s | And you might have been thinking, 1605.53s - 1608.73s | especially if you've done debugging before or low level 1608.73s - 1610.89s | programming before, the idea that you're 1610.89s - 1613.43s | going to overwrite NTDLL, the entire thing 1613.43s - 1616.21s | or certain functions at runtime, is a bit unsafe. 1616.29s - 1617.81s | Because you can imagine if you're 1617.81s - 1620.85s | overwriting 30 or 40 functions code in memory, 1620.85s - 1623.41s | if any other thread is using that function 1623.41s - 1625.21s | or a system call was just made and you're 1625.21s - 1627.49s | waiting for user LAN to return again, 1627.49s - 1629.65s | you just blew away the code that was technically 1629.65s - 1631.11s | running on the CPU. 1631.11s - 1632.25s | So malware does it. 1632.25s - 1634.49s | It generally works, but it's a bit unsafe. 1634.49s - 1636.25s | And then the other thing you could imagine 1636.25s - 1638.57s | is EDR could just check for its hooks. 1638.57s - 1641.45s | If it hooked 40 or 50 system call handlers 1641.45s - 1643.77s | and then it checks in whatever frequency later 1643.77s - 1645.45s | and its handlers are overwritten, 1645.45s - 1648.53s | it knows that there is malware inside of that process. 1648.53s - 1651.81s | So this led to what was some really interesting research 1651.81s - 1653.05s | on the open source side. 1653.05s - 1656.41s | And like I said, we saw it in private malware as well. 1656.41s - 1657.81s | So there were alternative methods 1657.81s - 1660.61s | developed where the code is not overwritten. 1660.61s - 1662.69s | The malware, as you'll see, can still 1662.69s - 1664.33s | make its malicious system calls. 1664.33s - 1668.01s | It can still do any system calls at once with any parameters. 1668.01s - 1669.81s | But we're not overwriting code. 1669.81s - 1673.85s | So inside of NTDLL, in that EDR protected process, 1673.85s - 1677.21s | the original implementation that the EDR gave is the same. 1677.21s - 1678.53s | The hooks are present. 1678.53s - 1682.37s | The EDR


chunk_id: 198_chunk_37
chunk_text:
EDR could just check for its hooks. 1638.57s - 1641.45s | If it hooked 40 or 50 system call handlers 1641.45s - 1643.77s | and then it checks in whatever frequency later 1643.77s - 1645.45s | and its handlers are overwritten, 1645.45s - 1648.53s | it knows that there is malware inside of that process. 1648.53s - 1651.81s | So this led to what was some really interesting research 1651.81s - 1653.05s | on the open source side. 1653.05s - 1656.41s | And like I said, we saw it in private malware as well. 1656.41s - 1657.81s | So there were alternative methods 1657.81s - 1660.61s | developed where the code is not overwritten. 1660.61s - 1662.69s | The malware, as you'll see, can still 1662.69s - 1664.33s | make its malicious system calls. 1664.33s - 1668.01s | It can still do any system calls at once with any parameters. 1668.01s - 1669.81s | But we're not overwriting code. 1669.81s - 1673.85s | So inside of NTDLL, in that EDR protected process, 1673.85s - 1677.21s | the original implementation that the EDR gave is the same. 1677.21s - 1678.53s | The hooks are present. 1678.53s - 1682.37s | The EDR would get control if the real system call was used. 1682.37s - 1684.95s | But malware is just going to avoid those code paths. 1684.95s - 1686.41s | So we'll look at the different ways 1686.41s - 1689.97s | they do that and the ways we can detect it. 1689.97s - 1692.69s | The first one we looked at were direct system calls. 1692.69s - 1694.89s | So the malware authors realized that, 1694.89s - 1699.09s | why do I need to call the system call handler inside of NTDLL? 1699.09s - 1701.13s | You saw that a system call handler is only 1701.13s - 1702.85s | five or six instructions. 1702.85s - 1704.61s | Why don't I just do that myself? 1704.61s - 1707.85s | So rather than going through NTDLL, which the EDR is hooked, 1707.85s - 1710.13s | I'm just going to set up the registers that are needed, 1710.13s - 1712.93s | and I'm going to make the syscall instruction on my own. 1712.93s - 1714.97s | And again, the EDRs that are trying 1714.97s - 1716.81s | to catch you through system call hooks, 1716.81s - 1718.49s | they are blind to you because you're


chunk_id: 198_chunk_38
chunk_text:
would get control if the real system call was used. 1682.37s - 1684.95s | But malware is just going to avoid those code paths. 1684.95s - 1686.41s | So we'll look at the different ways 1686.41s - 1689.97s | they do that and the ways we can detect it. 1689.97s - 1692.69s | The first one we looked at were direct system calls. 1692.69s - 1694.89s | So the malware authors realized that, 1694.89s - 1699.09s | why do I need to call the system call handler inside of NTDLL? 1699.09s - 1701.13s | You saw that a system call handler is only 1701.13s - 1702.85s | five or six instructions. 1702.85s - 1704.61s | Why don't I just do that myself? 1704.61s - 1707.85s | So rather than going through NTDLL, which the EDR is hooked, 1707.85s - 1710.13s | I'm just going to set up the registers that are needed, 1710.13s - 1712.93s | and I'm going to make the syscall instruction on my own. 1712.93s - 1714.97s | And again, the EDRs that are trying 1714.97s - 1716.81s | to catch you through system call hooks, 1716.81s - 1718.49s | they are blind to you because you're not 1718.49s - 1720.49s | going through their hooked code. 1720.49s - 1724.77s | The problem with this, and there was a very interesting series 1724.77s - 1727.49s | of posts by Elastic that I have cited at the end, 1727.49s - 1730.17s | this is where they started doing call stack examination. 1730.17s - 1731.89s | Elastic does this really well. 1731.89s - 1734.77s | There's some open source implementations of it also. 1734.77s - 1738.05s | But the idea is, if you were making a system call 1738.05s - 1741.05s | instruction, or you're calling the system call instruction 1741.05s - 1744.13s | outside of NTDLL, so you're in some random DLL 1744.13s - 1746.69s | that you've injected, or you're in a shellcode region, 1746.69s - 1749.17s | your EDR in kernel mode can see that. 1749.17s - 1750.97s | And then it's going to say, why is a system 1750.97s - 1753.33s | call being made from a random shellcode region that 1753.33s - 1756.41s | wouldn't normally happen on a running machine? 1756.41s - 1758.85s | And then the other downside to this, as we'll see, 1758.85s - 1761.37s | is you have to know


chunk_id: 198_chunk_39
chunk_text:
not 1718.49s - 1720.49s | going through their hooked code. 1720.49s - 1724.77s | The problem with this, and there was a very interesting series 1724.77s - 1727.49s | of posts by Elastic that I have cited at the end, 1727.49s - 1730.17s | this is where they started doing call stack examination. 1730.17s - 1731.89s | Elastic does this really well. 1731.89s - 1734.77s | There's some open source implementations of it also. 1734.77s - 1738.05s | But the idea is, if you were making a system call 1738.05s - 1741.05s | instruction, or you're calling the system call instruction 1741.05s - 1744.13s | outside of NTDLL, so you're in some random DLL 1744.13s - 1746.69s | that you've injected, or you're in a shellcode region, 1746.69s - 1749.17s | your EDR in kernel mode can see that. 1749.17s - 1750.97s | And then it's going to say, why is a system 1750.97s - 1753.33s | call being made from a random shellcode region that 1753.33s - 1756.41s | wouldn't normally happen on a running machine? 1756.41s - 1758.85s | And then the other downside to this, as we'll see, 1758.85s - 1761.37s | is you have to know where the system call indexes are. 1761.37s - 1763.37s | So like I said, there's hundreds of system calls 1763.37s - 1765.81s | per release of Windows, and the indexes 1765.81s - 1767.09s | change almost every time. 1767.09s - 1768.97s | The indexes are not guaranteed. 1768.97s - 1771.29s | If you're writing normal, legitimate code, 1771.29s - 1772.89s | you shouldn't care about the indexes. 1772.89s - 1775.25s | You just call the higher level API, 1775.25s - 1777.23s | and the operating system does the work for you. 1777.23s - 1779.53s | But in this case, where you want to make the system call 1779.53s - 1782.53s | yourself, and you don't want to use the normal APIs 1782.53s - 1784.29s | because the EDR has hooked them, you 1784.29s - 1788.93s | have to be able to get that index value to put into EAX. 1788.93s - 1793.09s | So if we look at the way that this has evolved over time, 1793.09s - 1796.21s | the first tool that made this popular is called dumpERT. 1796.21s - 1797.21s | It's an open source tool. 1797.21s - 1798.41s | It's still on GitHub. 1798.41s - 1800.73s


chunk_id: 198_chunk_40
chunk_text:
where the system call indexes are. 1761.37s - 1763.37s | So like I said, there's hundreds of system calls 1763.37s - 1765.81s | per release of Windows, and the indexes 1765.81s - 1767.09s | change almost every time. 1767.09s - 1768.97s | The indexes are not guaranteed. 1768.97s - 1771.29s | If you're writing normal, legitimate code, 1771.29s - 1772.89s | you shouldn't care about the indexes. 1772.89s - 1775.25s | You just call the higher level API, 1775.25s - 1777.23s | and the operating system does the work for you. 1777.23s - 1779.53s | But in this case, where you want to make the system call 1779.53s - 1782.53s | yourself, and you don't want to use the normal APIs 1782.53s - 1784.29s | because the EDR has hooked them, you 1784.29s - 1788.93s | have to be able to get that index value to put into EAX. 1788.93s - 1793.09s | So if we look at the way that this has evolved over time, 1793.09s - 1796.21s | the first tool that made this popular is called dumpERT. 1796.21s - 1797.21s | It's an open source tool. 1797.21s - 1798.41s | It's still on GitHub. 1798.41s - 1800.73s | It has a very nice companion blog post. 1800.73s - 1803.97s | And as you can see, for every system call 1803.97s - 1806.07s | it wants to make available to the malware, 1806.07s - 1807.97s | it has to put that little stub itself. 1807.97s - 1812.65s | It has to update R10, update EAX with the very specific index 1812.65s - 1814.73s | for the very specific system call. 1814.73s - 1817.17s | Then it can call system call in return. 1817.17s - 1818.79s | And at this point, you can make those, 1819.15s - 1820.43s | but if you look at the code, this 1820.43s - 1823.27s | is hard-coded to one version of Windows 7, 1823.27s - 1825.67s | one release under Service Pack 1. 1825.67s - 1829.47s | This is not something you could use in generic malware. 1829.47s - 1832.73s | So instead, what we want to be able to have is where, 1832.73s - 1834.83s | that is very loud, instead we want 1834.83s - 1838.07s | to make it where system calls can be resolved dynamically. 1838.07s - 1841.35s | So instead of your malware having what would literally 1841.35s -


chunk_id: 198_chunk_41
chunk_text:
| It has a very nice companion blog post. 1800.73s - 1803.97s | And as you can see, for every system call 1803.97s - 1806.07s | it wants to make available to the malware, 1806.07s - 1807.97s | it has to put that little stub itself. 1807.97s - 1812.65s | It has to update R10, update EAX with the very specific index 1812.65s - 1814.73s | for the very specific system call. 1814.73s - 1817.17s | Then it can call system call in return. 1817.17s - 1818.79s | And at this point, you can make those, 1819.15s - 1820.43s | but if you look at the code, this 1820.43s - 1823.27s | is hard-coded to one version of Windows 7, 1823.27s - 1825.67s | one release under Service Pack 1. 1825.67s - 1829.47s | This is not something you could use in generic malware. 1829.47s - 1832.73s | So instead, what we want to be able to have is where, 1832.73s - 1834.83s | that is very loud, instead we want 1834.83s - 1838.07s | to make it where system calls can be resolved dynamically. 1838.07s - 1841.35s | So instead of your malware having what would literally 1841.35s - 1844.39s | be hundreds of hard-coded system call tables 1844.39s - 1846.39s | for different versions of Windows, 1846.39s - 1849.43s | we want to find those indexes dynamically. 1849.43s - 1852.83s | The first implementation of this is called Hell's Gate. 1852.83s - 1854.87s | Almost every technique has gate in the name, 1854.87s - 1856.91s | which makes it kind of annoying to remember. 1856.91s - 1858.75s | So the first one is Hell's Gate. 1858.75s - 1862.19s | In this case, what it did is it parsed NTDLL on disk, 1862.19s - 1863.71s | kind of like we talked about before. 1863.71s - 1867.23s | But instead of overwriting pre-existing code or the EDR's 1867.23s - 1870.23s | code, it's just parsing NTDLL on disk, 1870.23s - 1872.95s | and then it's dynamically resolving the numbers. 1872.95s - 1875.43s | Because, for example, let's say in this case 1875.43s - 1878.15s | it wants to call a ZW open process. 1878.15s - 1879.83s | Instead of having to know beforehand 1879.83s - 1884.07s | that on Windows 7 Service Pack 1, the index is 23 hex, 1884.07s - 1886.39s | it can just load NTDLL. 1886.39s -


chunk_id: 198_chunk_42
chunk_text:
1844.39s | be hundreds of hard-coded system call tables 1844.39s - 1846.39s | for different versions of Windows, 1846.39s - 1849.43s | we want to find those indexes dynamically. 1849.43s - 1852.83s | The first implementation of this is called Hell's Gate. 1852.83s - 1854.87s | Almost every technique has gate in the name, 1854.87s - 1856.91s | which makes it kind of annoying to remember. 1856.91s - 1858.75s | So the first one is Hell's Gate. 1858.75s - 1862.19s | In this case, what it did is it parsed NTDLL on disk, 1862.19s - 1863.71s | kind of like we talked about before. 1863.71s - 1867.23s | But instead of overwriting pre-existing code or the EDR's 1867.23s - 1870.23s | code, it's just parsing NTDLL on disk, 1870.23s - 1872.95s | and then it's dynamically resolving the numbers. 1872.95s - 1875.43s | Because, for example, let's say in this case 1875.43s - 1878.15s | it wants to call a ZW open process. 1878.15s - 1879.83s | Instead of having to know beforehand 1879.83s - 1884.07s | that on Windows 7 Service Pack 1, the index is 23 hex, 1884.07s - 1886.39s | it can just load NTDLL. 1886.39s - 1889.59s | It can call get proc address for ZW open process. 1889.59s - 1892.15s | It can do some automated disassembly on the code, 1892.15s - 1894.89s | and it can read out the index dynamically. 1894.89s - 1895.99s | So this was Hell's Gate. 1895.99s - 1898.03s | You can see the code here on the right. 1898.03s - 1900.51s | Instead of being hard-coded to a certain number, 1900.51s - 1903.67s | it has a little API wrapper that you use as a programmer. 1903.67s - 1905.07s | You prep the system call. 1905.07s - 1907.19s | That's going to fill in this global variable. 1907.19s - 1910.03s | And then when it comes time to make the system call, 1910.03s - 1912.59s | it will fill in the number correctly for you. 1912.59s - 1916.55s | The problem with this, like I said, is most decent EDRs, 1916.55s - 1919.47s | I'm not going to say certain vendors, but most decent EDRs, 1919.47s - 1922.87s | if random code is reading NTDLL and parsing the P header 1922.87s - 1924.51s | and all of that, the EDR is going 1924.51s - 1926.43s | to flag on


chunk_id: 198_chunk_43
chunk_text:
1889.59s | It can call get proc address for ZW open process. 1889.59s - 1892.15s | It can do some automated disassembly on the code, 1892.15s - 1894.89s | and it can read out the index dynamically. 1894.89s - 1895.99s | So this was Hell's Gate. 1895.99s - 1898.03s | You can see the code here on the right. 1898.03s - 1900.51s | Instead of being hard-coded to a certain number, 1900.51s - 1903.67s | it has a little API wrapper that you use as a programmer. 1903.67s - 1905.07s | You prep the system call. 1905.07s - 1907.19s | That's going to fill in this global variable. 1907.19s - 1910.03s | And then when it comes time to make the system call, 1910.03s - 1912.59s | it will fill in the number correctly for you. 1912.59s - 1916.55s | The problem with this, like I said, is most decent EDRs, 1916.55s - 1919.47s | I'm not going to say certain vendors, but most decent EDRs, 1919.47s - 1922.87s | if random code is reading NTDLL and parsing the P header 1922.87s - 1924.51s | and all of that, the EDR is going 1924.51s - 1926.43s | to flag on it because it's just not something 1926.43s - 1928.55s | legitimate code would do. 1928.55s - 1930.95s | So this led to even more gates. 1930.95s - 1934.15s | There is Tataras Gate, which initially there 1934.19s - 1936.51s | was some detections and some YARA rules that 1936.51s - 1940.75s | were put out to detect this code pattern that's very hard-coded 1940.75s - 1943.05s | and this code pattern that's very hard-coded. 1943.05s - 1946.03s | All it did was make it a little more difficult to where 1946.03s - 1947.79s | those naive patterns would break. 1947.79s - 1949.95s | It put some no-op instructions. 1949.95s - 1952.67s | It put some other instructions that didn't have a side effect. 1952.67s - 1955.43s | But remember, you're in the system call handler path. 1955.43s - 1957.67s | So you can't add a bunch of junk instructions, 1957.67s - 1960.23s | or you will kill performance on the machine. 1960.23s - 1962.79s | In a real process, you're going to have thousands and thousands 1962.83s - 1964.23s | of system calls running. 1964.23s - 1966.87s | You cannot have where you put in a bunch of junk code


chunk_id: 198_chunk_44
chunk_text:
it because it's just not something 1926.43s - 1928.55s | legitimate code would do. 1928.55s - 1930.95s | So this led to even more gates. 1930.95s - 1934.15s | There is Tataras Gate, which initially there 1934.19s - 1936.51s | was some detections and some YARA rules that 1936.51s - 1940.75s | were put out to detect this code pattern that's very hard-coded 1940.75s - 1943.05s | and this code pattern that's very hard-coded. 1943.05s - 1946.03s | All it did was make it a little more difficult to where 1946.03s - 1947.79s | those naive patterns would break. 1947.79s - 1949.95s | It put some no-op instructions. 1949.95s - 1952.67s | It put some other instructions that didn't have a side effect. 1952.67s - 1955.43s | But remember, you're in the system call handler path. 1955.43s - 1957.67s | So you can't add a bunch of junk instructions, 1957.67s - 1960.23s | or you will kill performance on the machine. 1960.23s - 1962.79s | In a real process, you're going to have thousands and thousands 1962.83s - 1964.23s | of system calls running. 1964.23s - 1966.87s | You cannot have where you put in a bunch of junk code 1966.87s - 1968.47s | just to throw off a YARA rule. 1968.47s - 1970.63s | So even adding a few extra instructions 1970.63s - 1972.91s | will have a real impact on the system. 1972.91s - 1975.71s | So like I said, Tataras Gate is just trying to make it where, 1975.71s - 1978.83s | if all you have is a kind of brittle, basic YARA rule, 1978.83s - 1981.03s | you will not catch those code patterns. 1981.03s - 1984.83s | There was then Halos Gate, which was an interesting twist 1984.83s - 1987.15s | on reading NTDLL from disk. 1987.15s - 1990.23s | So these malware authors wanted to get away 1990.23s - 1992.61s | from reading NTDLL from disk. 1992.61s - 1995.21s | So instead, what they do is they kind of rely on the fact 1995.21s - 1998.13s | that the EDRs aren't going to hook every system call. 1998.13s - 2000.25s | They're just going to, the malware is only 2000.25s - 2001.97s | going to unhook this, sorry, the EDR 2001.97s - 2005.41s | is only going to hook the system calls that it wants to monitor. 2005.41s - 2008.01s | So what Halos


chunk_id: 198_chunk_45
chunk_text:
1966.87s - 1968.47s | just to throw off a YARA rule. 1968.47s - 1970.63s | So even adding a few extra instructions 1970.63s - 1972.91s | will have a real impact on the system. 1972.91s - 1975.71s | So like I said, Tataras Gate is just trying to make it where, 1975.71s - 1978.83s | if all you have is a kind of brittle, basic YARA rule, 1978.83s - 1981.03s | you will not catch those code patterns. 1981.03s - 1984.83s | There was then Halos Gate, which was an interesting twist 1984.83s - 1987.15s | on reading NTDLL from disk. 1987.15s - 1990.23s | So these malware authors wanted to get away 1990.23s - 1992.61s | from reading NTDLL from disk. 1992.61s - 1995.21s | So instead, what they do is they kind of rely on the fact 1995.21s - 1998.13s | that the EDRs aren't going to hook every system call. 1998.13s - 2000.25s | They're just going to, the malware is only 2000.25s - 2001.97s | going to unhook this, sorry, the EDR 2001.97s - 2005.41s | is only going to hook the system calls that it wants to monitor. 2005.41s - 2008.01s | So what Halos Gate does is it dynamically 2008.01s - 2010.13s | goes through all the other system calls 2010.13s - 2013.37s | that the EDR is not hooking, and then it just does some math. 2013.37s - 2015.45s | It says, OK, I know the system call before it 2015.45s - 2017.49s | and the system call after it are this number, 2017.49s - 2020.57s | so the one in the middle, it can dynamically figure it out. 2020.57s - 2024.01s | Again, this avoids reading NTDLL from disk. 2024.01s - 2025.81s | And then there is a really cool technique 2025.81s - 2027.97s | called address sorting. 2027.97s - 2030.65s | One of the authors of this open source project 2030.65s - 2032.61s | realized that all the system calls 2032.61s - 2034.89s | are put in order alphabetically. 2034.89s - 2037.45s | So if you just read the addresses of where they all 2037.45s - 2039.25s | are, it's kind of the same idea. 2039.25s - 2041.65s | You alphabetically sort them. 2041.65s - 2043.97s | If the one that you're trying to use is hooked, 2043.97s - 2046.33s | you just look at the one before it and you


chunk_id: 198_chunk_46
chunk_text:
Gate does is it dynamically 2008.01s - 2010.13s | goes through all the other system calls 2010.13s - 2013.37s | that the EDR is not hooking, and then it just does some math. 2013.37s - 2015.45s | It says, OK, I know the system call before it 2015.45s - 2017.49s | and the system call after it are this number, 2017.49s - 2020.57s | so the one in the middle, it can dynamically figure it out. 2020.57s - 2024.01s | Again, this avoids reading NTDLL from disk. 2024.01s - 2025.81s | And then there is a really cool technique 2025.81s - 2027.97s | called address sorting. 2027.97s - 2030.65s | One of the authors of this open source project 2030.65s - 2032.61s | realized that all the system calls 2032.61s - 2034.89s | are put in order alphabetically. 2034.89s - 2037.45s | So if you just read the addresses of where they all 2037.45s - 2039.25s | are, it's kind of the same idea. 2039.25s - 2041.65s | You alphabetically sort them. 2041.65s - 2043.97s | If the one that you're trying to use is hooked, 2043.97s - 2046.33s | you just look at the one before it and you add one, 2046.33s - 2048.53s | and now you know the index that you need. 2048.53s - 2050.21s | And then even dealing with all of that 2050.21s - 2051.85s | previously was kind of difficult. 2051.85s - 2054.61s | There's a lot of assembly, a lot of low-level C code. 2054.61s - 2056.09s | So there's this really nice project 2056.09s - 2058.09s | called Sys Whisperers 2, and the 2 2058.09s - 2060.81s | is important because the first version was not very good, 2060.81s - 2063.49s | but the second version is very powerful. 2063.49s - 2065.85s | This integrates with Visual Studio. 2065.85s - 2067.61s | You call directly through this, and it 2067.61s - 2070.21s | does all the nasty work in the background for you 2070.21s - 2073.17s | to dynamically resolve those system call indexes. 2073.17s - 2075.77s | So if you want to write code that bypasses EDRs, 2075.77s - 2078.21s | you want to be able to make whatever system call you want 2078.21s - 2080.25s | without being detected, all you have to do 2080.25s - 2083.53s | is import the Sys Whisperers 2 into your Visual Studio 2083.53s -


chunk_id: 198_chunk_47
chunk_text:
add one, 2046.33s - 2048.53s | and now you know the index that you need. 2048.53s - 2050.21s | And then even dealing with all of that 2050.21s - 2051.85s | previously was kind of difficult. 2051.85s - 2054.61s | There's a lot of assembly, a lot of low-level C code. 2054.61s - 2056.09s | So there's this really nice project 2056.09s - 2058.09s | called Sys Whisperers 2, and the 2 2058.09s - 2060.81s | is important because the first version was not very good, 2060.81s - 2063.49s | but the second version is very powerful. 2063.49s - 2065.85s | This integrates with Visual Studio. 2065.85s - 2067.61s | You call directly through this, and it 2067.61s - 2070.21s | does all the nasty work in the background for you 2070.21s - 2073.17s | to dynamically resolve those system call indexes. 2073.17s - 2075.77s | So if you want to write code that bypasses EDRs, 2075.77s - 2078.21s | you want to be able to make whatever system call you want 2078.21s - 2080.25s | without being detected, all you have to do 2080.25s - 2083.53s | is import the Sys Whisperers 2 into your Visual Studio 2083.53s - 2085.53s | project, write your malware freely, 2085.53s - 2089.33s | and it does all the hard work in the background for you. 2089.33s - 2091.13s | So with all these different techniques 2091.13s - 2093.73s | that make EDRs blind to what's happening, 2093.73s - 2095.75s | we wanted to be able to detect this. 2095.75s - 2098.21s | So we kind of already knew this before going into it, 2098.21s - 2102.17s | but we did a large sweep across all of our Windows memory 2102.17s - 2104.61s | samples, and for every version of Windows 2104.61s - 2107.45s | going back to XP through the latest Windows 11, 2107.45s - 2109.69s | there's only three DLLs that legitimately 2109.69s - 2111.01s | implement system calls. 2111.01s - 2113.41s | There's the NTDLL that I talked about, 2113.41s - 2118.13s | Wow64 for 32-bit processes, and then Win32 is for the GUI, 2118.13s - 2120.61s | so what you're seeing here on the screen with Explorer 2120.61s - 2122.29s | and PowerPoint. 2122.29s - 2125.21s | So the idea is through memory forensics, 2125.21s - 2127.49s | if we find the instructions needed 2127.49s - 2129.21s | to


chunk_id: 198_chunk_48
chunk_text:
2085.53s | project, write your malware freely, 2085.53s - 2089.33s | and it does all the hard work in the background for you. 2089.33s - 2091.13s | So with all these different techniques 2091.13s - 2093.73s | that make EDRs blind to what's happening, 2093.73s - 2095.75s | we wanted to be able to detect this. 2095.75s - 2098.21s | So we kind of already knew this before going into it, 2098.21s - 2102.17s | but we did a large sweep across all of our Windows memory 2102.17s - 2104.61s | samples, and for every version of Windows 2104.61s - 2107.45s | going back to XP through the latest Windows 11, 2107.45s - 2109.69s | there's only three DLLs that legitimately 2109.69s - 2111.01s | implement system calls. 2111.01s - 2113.41s | There's the NTDLL that I talked about, 2113.41s - 2118.13s | Wow64 for 32-bit processes, and then Win32 is for the GUI, 2118.13s - 2120.61s | so what you're seeing here on the screen with Explorer 2120.61s - 2122.29s | and PowerPoint. 2122.29s - 2125.21s | So the idea is through memory forensics, 2125.21s - 2127.49s | if we find the instructions needed 2127.49s - 2129.21s | to make a system call instruction 2129.21s - 2131.37s | and set the parameters, and it's not 2131.37s - 2133.75s | in one of those three DLLs, this is malware 2133.75s - 2137.85s | trying to bypass the system. 2137.85s - 2140.05s | And then, like I mentioned, it's some very, very cool 2140.05s - 2141.13s | low-level work. 2141.13s - 2144.13s | I threw this screenshot in literally last second, 2144.13s - 2147.69s | like right before I sent these slides to DEF CON, 2147.69s - 2150.29s | because there was a talk by a security vendor 2150.29s - 2151.61s | as I was making the slides, right 2151.61s - 2153.77s | as I was about to upload it, and I took this screenshot 2153.77s - 2155.37s | and threw it in last second, because it 2155.37s - 2157.85s | was talking about malware that was just used recently 2157.85s - 2160.41s | in the last one or two months in real attacks, 2160.41s - 2162.73s | and the malware was called DodgeBox, 2162.73s - 2165.29s | and it's talking about how in every phase of the malware, 2165.29s - 2167.25s | every component the malware had, 2167.25s - 2171.17s


chunk_id: 198_chunk_49
chunk_text:
make a system call instruction 2129.21s - 2131.37s | and set the parameters, and it's not 2131.37s - 2133.75s | in one of those three DLLs, this is malware 2133.75s - 2137.85s | trying to bypass the system. 2137.85s - 2140.05s | And then, like I mentioned, it's some very, very cool 2140.05s - 2141.13s | low-level work. 2141.13s - 2144.13s | I threw this screenshot in literally last second, 2144.13s - 2147.69s | like right before I sent these slides to DEF CON, 2147.69s - 2150.29s | because there was a talk by a security vendor 2150.29s - 2151.61s | as I was making the slides, right 2151.61s - 2153.77s | as I was about to upload it, and I took this screenshot 2153.77s - 2155.37s | and threw it in last second, because it 2155.37s - 2157.85s | was talking about malware that was just used recently 2157.85s - 2160.41s | in the last one or two months in real attacks, 2160.41s - 2162.73s | and the malware was called DodgeBox, 2162.73s - 2165.29s | and it's talking about how in every phase of the malware, 2165.29s - 2167.25s | every component the malware had, 2167.25s - 2171.17s | it did call stack spoofing, so bypassing the EDRs 2171.17s - 2173.33s | to make it appear where those system calls, 2173.33s - 2175.17s | so it's doing direct system calls, 2175.17s - 2177.61s | making it appear where it came from the trusted binary, 2177.61s - 2179.89s | so the ones we saw in the last slide, instead 2179.89s - 2181.29s | of the malware itself. 2181.29s - 2183.89s | And so it's this constant back and forth between EDRs 2183.89s - 2185.61s | and malware, trying to figure out 2185.61s - 2188.17s | that system calls are being made from the wrong spot, 2188.17s - 2190.57s | but quite honestly, the EDRs are in a tough spot, 2190.57s - 2193.13s | and usually the malware wins. 2193.13s - 2195.33s | We don't have these problems with memory forensics. 2195.33s - 2198.37s | We don't have to detect a system call the second it's made. 2198.37s - 2201.13s | We're trying to find proof of code that can do that 2201.13s - 2203.45s | or does that through memory forensics, 2203.45s - 2206.81s | and so what we did is we used Capstone, 2206.81s - 2209.61s | which


chunk_id: 198_chunk_50
chunk_text:
| it did call stack spoofing, so bypassing the EDRs 2171.17s - 2173.33s | to make it appear where those system calls, 2173.33s - 2175.17s | so it's doing direct system calls, 2175.17s - 2177.61s | making it appear where it came from the trusted binary, 2177.61s - 2179.89s | so the ones we saw in the last slide, instead 2179.89s - 2181.29s | of the malware itself. 2181.29s - 2183.89s | And so it's this constant back and forth between EDRs 2183.89s - 2185.61s | and malware, trying to figure out 2185.61s - 2188.17s | that system calls are being made from the wrong spot, 2188.17s - 2190.57s | but quite honestly, the EDRs are in a tough spot, 2190.57s - 2193.13s | and usually the malware wins. 2193.13s - 2195.33s | We don't have these problems with memory forensics. 2195.33s - 2198.37s | We don't have to detect a system call the second it's made. 2198.37s - 2201.13s | We're trying to find proof of code that can do that 2201.13s - 2203.45s | or does that through memory forensics, 2203.45s - 2206.81s | and so what we did is we used Capstone, 2206.81s - 2209.61s | which is a very flexible disassembly library, 2209.61s - 2212.85s | has Python support so you can use it directly in volatility, 2212.85s - 2215.37s | and what we do is look for blocks of code, 2215.37s - 2219.81s | so code pattern blocks where EAX gets updated, 2219.81s - 2222.93s | that's your system call index, where R10 gets updated, 2222.93s - 2225.05s | where one of the system call instruction happens, 2225.05s - 2226.53s | and where there's a return. 2226.53s - 2228.77s | We did a bunch of work so that simple things 2228.77s - 2232.41s | like to Taurus gate with this no ops wouldn't bypass our code. 2232.41s - 2233.81s | We're not doing pattern matching. 2233.81s - 2236.97s | We're doing actual automated static disassembly, 2236.97s - 2239.61s | and when we tested this on every implementation 2239.61s - 2243.03s | that we had of this technique, our new plug-in direct system 2243.03s - 2244.39s | calls detected it. 2244.39s - 2246.81s | In this case, just to make it fit on a slide nicer, 2246.81s - 2249.29s | this is Hell's Descent from Hell's Gate, 2249.29s - 2251.81s | so this is where it's


chunk_id: 198_chunk_51
chunk_text:
is a very flexible disassembly library, 2209.61s - 2212.85s | has Python support so you can use it directly in volatility, 2212.85s - 2215.37s | and what we do is look for blocks of code, 2215.37s - 2219.81s | so code pattern blocks where EAX gets updated, 2219.81s - 2222.93s | that's your system call index, where R10 gets updated, 2222.93s - 2225.05s | where one of the system call instruction happens, 2225.05s - 2226.53s | and where there's a return. 2226.53s - 2228.77s | We did a bunch of work so that simple things 2228.77s - 2232.41s | like to Taurus gate with this no ops wouldn't bypass our code. 2232.41s - 2233.81s | We're not doing pattern matching. 2233.81s - 2236.97s | We're doing actual automated static disassembly, 2236.97s - 2239.61s | and when we tested this on every implementation 2239.61s - 2243.03s | that we had of this technique, our new plug-in direct system 2243.03s - 2244.39s | calls detected it. 2244.39s - 2246.81s | In this case, just to make it fit on a slide nicer, 2246.81s - 2249.29s | this is Hell's Descent from Hell's Gate, 2249.29s - 2251.81s | so this is where it's calling the system call 2251.81s - 2253.85s | instruction on its own, and then 2253.85s - 2256.09s | the plug-in saying, hey, inside of this process 2256.09s - 2259.33s | executable with this PID, and it shows you right in memory 2259.33s - 2261.21s | where that system call handler is. 2261.21s - 2263.57s | So it's as simple as running this plug-in 2263.57s - 2265.49s | across your potentially infected samples, 2265.49s - 2269.93s | and it tells you right where the malware is. 2269.93s - 2272.59s | And then with the indirect system calls, 2272.59s - 2275.81s | the idea is instead of having that code pattern where you're 2275.81s - 2279.63s | making syscall or int2e directly from your malware code 2279.63s - 2281.25s | or your shell code, which again, you 2281.25s - 2283.45s | have to do a bunch of call stack spoofing and things, 2283.45s - 2285.21s | or the EDRs will see you. 2285.21s - 2289.27s | The idea is you find the address of the syscall instruction 2289.27s - 2293.57s | in NTDLL, but instead of calling the function of that, 2293.57s - 2295.53s | you find where the syscall instruction is,


chunk_id: 198_chunk_52
chunk_text:
calling the system call 2251.81s - 2253.85s | instruction on its own, and then 2253.85s - 2256.09s | the plug-in saying, hey, inside of this process 2256.09s - 2259.33s | executable with this PID, and it shows you right in memory 2259.33s - 2261.21s | where that system call handler is. 2261.21s - 2263.57s | So it's as simple as running this plug-in 2263.57s - 2265.49s | across your potentially infected samples, 2265.49s - 2269.93s | and it tells you right where the malware is. 2269.93s - 2272.59s | And then with the indirect system calls, 2272.59s - 2275.81s | the idea is instead of having that code pattern where you're 2275.81s - 2279.63s | making syscall or int2e directly from your malware code 2279.63s - 2281.25s | or your shell code, which again, you 2281.25s - 2283.45s | have to do a bunch of call stack spoofing and things, 2283.45s - 2285.21s | or the EDRs will see you. 2285.21s - 2289.27s | The idea is you find the address of the syscall instruction 2289.27s - 2293.57s | in NTDLL, but instead of calling the function of that, 2293.57s - 2295.53s | you find where the syscall instruction is, 2295.53s - 2296.69s | and you jump to it. 2296.69s - 2298.41s | So you set the registers yourself. 2298.41s - 2300.13s | You do all the prereqs yourself. 2300.13s - 2301.89s | You jump to the syscall instruction. 2301.89s - 2304.51s | It looks like it's coming from NTDLL, 2304.51s - 2306.77s | and then depending on which EDR you have, 2306.77s - 2309.21s | that EDR is going to think it's the real system call, 2309.21s - 2312.21s | and then you've bypassed it. 2312.21s - 2315.53s | So we wanted to be able to detect that as well. 2315.53s - 2318.29s | And something that also gets used with this technique 2318.29s - 2321.13s | are the exception handlers and the debug registers, 2321.13s - 2323.57s | which is the last thing we cover in this talk. 2323.57s - 2326.25s | So the idea is debug registers have been abused forever 2326.25s - 2327.05s | by malware. 2327.05s - 2328.89s | There was a Frack article in 2008 2328.89s - 2332.57s | that's considered the first public documentation of it. 2332.57s - 2335.89s | And the idea is by abusing debug registers, 2335.89s - 2338.21s | you


chunk_id: 198_chunk_53
chunk_text:
2295.53s - 2296.69s | and you jump to it. 2296.69s - 2298.41s | So you set the registers yourself. 2298.41s - 2300.13s | You do all the prereqs yourself. 2300.13s - 2301.89s | You jump to the syscall instruction. 2301.89s - 2304.51s | It looks like it's coming from NTDLL, 2304.51s - 2306.77s | and then depending on which EDR you have, 2306.77s - 2309.21s | that EDR is going to think it's the real system call, 2309.21s - 2312.21s | and then you've bypassed it. 2312.21s - 2315.53s | So we wanted to be able to detect that as well. 2315.53s - 2318.29s | And something that also gets used with this technique 2318.29s - 2321.13s | are the exception handlers and the debug registers, 2321.13s - 2323.57s | which is the last thing we cover in this talk. 2323.57s - 2326.25s | So the idea is debug registers have been abused forever 2326.25s - 2327.05s | by malware. 2327.05s - 2328.89s | There was a Frack article in 2008 2328.89s - 2332.57s | that's considered the first public documentation of it. 2332.57s - 2335.89s | And the idea is by abusing debug registers, 2335.89s - 2338.21s | you can get your exception handler called 2338.21s - 2339.89s | at any point in time. 2339.89s - 2341.57s | And then from your exception handler, 2341.57s - 2344.01s | you're going to make the system call instruction, 2344.01s - 2347.49s | and EDRs do not follow this well at all. 2347.49s - 2349.13s | They don't expect malware to be running 2349.13s - 2351.65s | inside of exception handlers. 2351.65s - 2353.49s | So a cool open source project for this, 2353.49s - 2355.81s | if you want to see it yourself, is called MutationGate. 2355.81s - 2357.53s | It is on GitHub. 2357.53s - 2359.05s | And you can see what it's doing. 2359.05s - 2362.09s | It's adding a vectored exception handler. 2362.09s - 2364.23s | So it's saying it wants to handle exceptions 2364.23s - 2365.53s | in its process. 2365.53s - 2367.69s | This is the function that's going to be called. 2367.69s - 2370.17s | And then on its own, it sets a breakpoint 2370.17s - 2373.33s | at this innocuous system call, nt draw text, 2373.33s - 2376.21s | that has nothing to do with code injection or malware. 2376.21s - 2379.57s | So


chunk_id: 198_chunk_54
chunk_text:
can get your exception handler called 2338.21s - 2339.89s | at any point in time. 2339.89s - 2341.57s | And then from your exception handler, 2341.57s - 2344.01s | you're going to make the system call instruction, 2344.01s - 2347.49s | and EDRs do not follow this well at all. 2347.49s - 2349.13s | They don't expect malware to be running 2349.13s - 2351.65s | inside of exception handlers. 2351.65s - 2353.49s | So a cool open source project for this, 2353.49s - 2355.81s | if you want to see it yourself, is called MutationGate. 2355.81s - 2357.53s | It is on GitHub. 2357.53s - 2359.05s | And you can see what it's doing. 2359.05s - 2362.09s | It's adding a vectored exception handler. 2362.09s - 2364.23s | So it's saying it wants to handle exceptions 2364.23s - 2365.53s | in its process. 2365.53s - 2367.69s | This is the function that's going to be called. 2367.69s - 2370.17s | And then on its own, it sets a breakpoint 2370.17s - 2373.33s | at this innocuous system call, nt draw text, 2373.33s - 2376.21s | that has nothing to do with code injection or malware. 2376.21s - 2379.57s | So the idea is this malware, this code injection, 2379.57s - 2382.21s | this EDR bypass technique, will get called 2382.21s - 2383.97s | whenever a breakpoint is set. 2383.97s - 2385.97s | And then it explicitly sets a breakpoint 2385.97s - 2388.77s | on where the system call instruction is 2388.77s - 2391.77s | inside of this innocuous function. 2391.77s - 2394.21s | So then in the implementation of it, what it does 2394.21s - 2397.09s | is every time the malware wants to make a malicious system 2397.09s - 2400.53s | call, it just calls nt draw text, which, again, you can't 2400.53s - 2402.25s | do anything malicious with that. 2402.25s - 2404.69s | And then the malware, the MutationGate, 2404.69s - 2408.29s | it updates RAX right before the system call instruction 2408.29s - 2409.93s | to be the real system call. 2409.93s - 2412.57s | So your EDR is going to think, hey, this malicious code's 2412.57s - 2413.61s | calling draw text. 2413.61s - 2415.53s | It's going to write something on the screen. 2415.53s - 2417.33s | But in reality, it's all the prereqs 2417.33s - 2420.88s | you need for code injection. 2420.88s


chunk_id: 198_chunk_55
chunk_text:
the idea is this malware, this code injection, 2379.57s - 2382.21s | this EDR bypass technique, will get called 2382.21s - 2383.97s | whenever a breakpoint is set. 2383.97s - 2385.97s | And then it explicitly sets a breakpoint 2385.97s - 2388.77s | on where the system call instruction is 2388.77s - 2391.77s | inside of this innocuous function. 2391.77s - 2394.21s | So then in the implementation of it, what it does 2394.21s - 2397.09s | is every time the malware wants to make a malicious system 2397.09s - 2400.53s | call, it just calls nt draw text, which, again, you can't 2400.53s - 2402.25s | do anything malicious with that. 2402.25s - 2404.69s | And then the malware, the MutationGate, 2404.69s - 2408.29s | it updates RAX right before the system call instruction 2408.29s - 2409.93s | to be the real system call. 2409.93s - 2412.57s | So your EDR is going to think, hey, this malicious code's 2412.57s - 2413.61s | calling draw text. 2413.61s - 2415.53s | It's going to write something on the screen. 2415.53s - 2417.33s | But in reality, it's all the prereqs 2417.33s - 2420.88s | you need for code injection. 2420.88s - 2422.40s | So we wanted to detect this. 2422.40s - 2425.12s | We didn't even have to do any major reversing for this. 2425.12s - 2427.84s | There was two very nice blog posts on the topic 2427.84s - 2429.52s | that we have referenced here. 2429.52s - 2432.60s | And the only downside to this is legitimate software 2432.60s - 2434.64s | uses exception handlers. 2434.64s - 2437.92s | You don't want your software having an unhandled exception 2437.92s - 2439.56s | and then crashing the machine. 2439.56s - 2441.52s | So by having an exception handler, 2441.52s - 2444.48s | you make it where your code gets to handle the exception, 2444.48s - 2446.72s | and then you can cleanly exit. 2446.72s - 2449.36s | So what we did is we, instead of just listing them 2449.36s - 2452.12s | all out like some plugins do, we applied 2452.12s - 2456.04s | very similar static disassembly to the function handlers. 2456.08s - 2457.92s | We looked at all the malicious techniques. 2457.92s - 2459.96s | We saw which registers they interacted with, 2459.96s - 2462.36s | which actions they performed. 2462.36s - 2465.12s | And so instead


chunk_id: 198_chunk_56
chunk_text:
- 2422.40s | So we wanted to detect this. 2422.40s - 2425.12s | We didn't even have to do any major reversing for this. 2425.12s - 2427.84s | There was two very nice blog posts on the topic 2427.84s - 2429.52s | that we have referenced here. 2429.52s - 2432.60s | And the only downside to this is legitimate software 2432.60s - 2434.64s | uses exception handlers. 2434.64s - 2437.92s | You don't want your software having an unhandled exception 2437.92s - 2439.56s | and then crashing the machine. 2439.56s - 2441.52s | So by having an exception handler, 2441.52s - 2444.48s | you make it where your code gets to handle the exception, 2444.48s - 2446.72s | and then you can cleanly exit. 2446.72s - 2449.36s | So what we did is we, instead of just listing them 2449.36s - 2452.12s | all out like some plugins do, we applied 2452.12s - 2456.04s | very similar static disassembly to the function handlers. 2456.08s - 2457.92s | We looked at all the malicious techniques. 2457.92s - 2459.96s | We saw which registers they interacted with, 2459.96s - 2462.36s | which actions they performed. 2462.36s - 2465.12s | And so instead of just listing out every vector exception 2465.12s - 2467.80s | handler, we apply the static disassembly, 2467.80s - 2470.20s | and then we only list out the malicious ones. 2470.20s - 2472.52s | And as you can see here, with our new plugin, 2472.52s - 2475.60s | we're catching mutation gate generically right away 2475.60s - 2478.68s | because of how it interacts with it. 2478.68s - 2482.26s | There was also a cool project by Marcus Hutchins, 2482.26s - 2485.56s | where he wanted to bypass EDRs in the same way. 2486.32s - 2488.36s | Instead of the vectored exception handler, 2488.36s - 2492.96s | he used the higher level one, the unhandled exception filter. 2492.96s - 2495.48s | In this case, this is going to be the address of where 2495.48s - 2497.96s | he has his exception handler called, 2497.96s - 2500.00s | and then he's calling set thread context 2500.00s - 2501.92s | on what's an invalid address. 2501.92s - 2505.00s | So this is going to trigger the exception handler. 2505.00s - 2506.88s | So what we did here was very similar. 2506.88s - 2510.52s | We enumerate all the handlers, and then we


chunk_id: 198_chunk_57
chunk_text:
of just listing out every vector exception 2465.12s - 2467.80s | handler, we apply the static disassembly, 2467.80s - 2470.20s | and then we only list out the malicious ones. 2470.20s - 2472.52s | And as you can see here, with our new plugin, 2472.52s - 2475.60s | we're catching mutation gate generically right away 2475.60s - 2478.68s | because of how it interacts with it. 2478.68s - 2482.26s | There was also a cool project by Marcus Hutchins, 2482.26s - 2485.56s | where he wanted to bypass EDRs in the same way. 2486.32s - 2488.36s | Instead of the vectored exception handler, 2488.36s - 2492.96s | he used the higher level one, the unhandled exception filter. 2492.96s - 2495.48s | In this case, this is going to be the address of where 2495.48s - 2497.96s | he has his exception handler called, 2497.96s - 2500.00s | and then he's calling set thread context 2500.00s - 2501.92s | on what's an invalid address. 2501.92s - 2505.00s | So this is going to trigger the exception handler. 2505.00s - 2506.88s | So what we did here was very similar. 2506.88s - 2510.52s | We enumerate all the handlers, and then we make it. 2510.52s - 2512.16s | This keeps jumping a lot. 2512.16s - 2513.80s | We enumerate all the handlers. 2513.84s - 2516.60s | We apply our static disassembly, and then in this case, 2516.60s - 2519.28s | we find his malicious process generically 2519.28s - 2522.24s | because the exception handler is doing things that you 2522.24s - 2524.88s | would need to bypass an EDR. 2524.88s - 2526.28s | And then with the debug registers, 2526.28s - 2528.44s | the last thing we really show here, 2528.44s - 2530.56s | if you're familiar with AMSI bypasses, 2530.56s - 2533.20s | one of the things you need to do is one of the functions 2533.20s - 2536.40s | you're probably going to tamper with is the scan buffer one. 2536.40s - 2538.48s | In this case, they set a breakpoint on it, 2538.48s - 2541.52s | and they make it where that function doesn't get any time 2541.52s - 2542.88s | that function returns. 2542.88s - 2544.64s | It returns that the code is OK. 2544.64s - 2546.56s | So you can send whatever malicious PowerShell 2546.56s - 2550.08s | you want through, whatever malicious macros that you have.


chunk_id: 198_chunk_58
chunk_text:
make it. 2510.52s - 2512.16s | This keeps jumping a lot. 2512.16s - 2513.80s | We enumerate all the handlers. 2513.84s - 2516.60s | We apply our static disassembly, and then in this case, 2516.60s - 2519.28s | we find his malicious process generically 2519.28s - 2522.24s | because the exception handler is doing things that you 2522.24s - 2524.88s | would need to bypass an EDR. 2524.88s - 2526.28s | And then with the debug registers, 2526.28s - 2528.44s | the last thing we really show here, 2528.44s - 2530.56s | if you're familiar with AMSI bypasses, 2530.56s - 2533.20s | one of the things you need to do is one of the functions 2533.20s - 2536.40s | you're probably going to tamper with is the scan buffer one. 2536.40s - 2538.48s | In this case, they set a breakpoint on it, 2538.48s - 2541.52s | and they make it where that function doesn't get any time 2541.52s - 2542.88s | that function returns. 2542.88s - 2544.64s | It returns that the code is OK. 2544.64s - 2546.56s | So you can send whatever malicious PowerShell 2546.56s - 2550.08s | you want through, whatever malicious macros that you have. 2550.08s - 2553.04s | And with this code present, all of your EDRs 2553.04s - 2555.20s | are forced to say, hey, yeah, this is clean, 2555.20s - 2557.84s | and then it gets to execute on the system. 2557.84s - 2560.48s | And you can see that here with our new plugin. 2560.48s - 2562.36s | So with the vector exception handler, 2562.36s - 2563.84s | we're catching it right away. 2563.84s - 2566.56s | The project that implements what you're seeing on these slides 2566.56s - 2568.56s | is called Patchless AMSI. 2568.56s - 2571.68s | So we're not only catching its vector exception handler, 2571.68s - 2574.44s | we're also catching its abuse of the debug registers 2574.44s - 2576.56s | so that it can be called whenever 2576.56s - 2580.42s | the code is going to get scanned by the AMSI subsystem. 2580.42s - 2581.92s | So the end result of our project is 2581.92s - 2584.16s | we documented and went through every single way 2584.16s - 2586.76s | that EDRs get bypassed in user land, 2586.76s - 2588.68s | and then we wrote a bunch of volatility plugins 2588.68s - 2590.24s | to automatically


chunk_id: 198_chunk_59
chunk_text:
2550.08s - 2553.04s | And with this code present, all of your EDRs 2553.04s - 2555.20s | are forced to say, hey, yeah, this is clean, 2555.20s - 2557.84s | and then it gets to execute on the system. 2557.84s - 2560.48s | And you can see that here with our new plugin. 2560.48s - 2562.36s | So with the vector exception handler, 2562.36s - 2563.84s | we're catching it right away. 2563.84s - 2566.56s | The project that implements what you're seeing on these slides 2566.56s - 2568.56s | is called Patchless AMSI. 2568.56s - 2571.68s | So we're not only catching its vector exception handler, 2571.68s - 2574.44s | we're also catching its abuse of the debug registers 2574.44s - 2576.56s | so that it can be called whenever 2576.56s - 2580.42s | the code is going to get scanned by the AMSI subsystem. 2580.42s - 2581.92s | So the end result of our project is 2581.92s - 2584.16s | we documented and went through every single way 2584.16s - 2586.76s | that EDRs get bypassed in user land, 2586.76s - 2588.68s | and then we wrote a bunch of volatility plugins 2588.68s - 2590.24s | to automatically detect it. 2590.24s - 2592.24s | Two quick things before I break. 2592.24s - 2594.56s | We wrote a 19-page white paper about this. 2594.56s - 2597.56s | It should be on the DEF CON website by now or tomorrow. 2597.56s - 2599.32s | Feel free to email me if not. 2599.32s - 2600.32s | Also, the slides. 2600.32s - 2602.40s | Don't try to take pictures of the next couple of slides. 2602.40s - 2604.08s | These are all the references that you 2604.08s - 2606.68s | were seeing with the numbers at the top of the slides. 2606.68s - 2608.04s | We have like 45 references. 2608.04s - 2609.72s | It was a huge research effort. 2609.72s - 2611.56s | The slides are on the DEF CON website as well, 2611.56s - 2613.24s | or email me if you can't find them. 2613.24s - 2616.40s | But if you really want to understand in great detail, 2616.40s - 2619.36s | read the paper, and then read all the references as well. 2619.36s - 2624.53s | And again, thank you for coming to the talk.


chunk_id: 198_chunk_60
chunk_text:
detect it. 2590.24s - 2592.24s | Two quick things before I break. 2592.24s - 2594.56s | We wrote a 19-page white paper about this. 2594.56s - 2597.56s | It should be on the DEF CON website by now or tomorrow. 2597.56s - 2599.32s | Feel free to email me if not. 2599.32s - 2600.32s | Also, the slides. 2600.32s - 2602.40s | Don't try to take pictures of the next couple of slides. 2602.40s - 2604.08s | These are all the references that you 2604.08s - 2606.68s | were seeing with the numbers at the top of the slides. 2606.68s - 2608.04s | We have like 45 references. 2608.04s - 2609.72s | It was a huge research effort. 2609.72s - 2611.56s | The slides are on the DEF CON website as well, 2611.56s - 2613.24s | or email me if you can't find them. 2613.24s - 2616.40s | But if you really want to understand in great detail, 2616.40s - 2619.36s | read the paper, and then read all the references as well. 2619.36s - 2624.53s | And again, thank you for coming to the talk.


chunk_id: 199_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=NyOhQ4ONAUA", "title": "DEF CON 32 - Digital Emblems-When markings are required, but you have no rattle-can - Bill Woodcock", "description": "There are physical markings that are required under hundreds of different international laws, some governing transport of goods across national borders, some offering humanitarian protections on the battlefield, some seeking to protect the environment or genetic diversity\u2026 What they all have in common is that they\u2019re currently represented by visual marks applied to objects. Many of these processes are undergoing \u201cdigitalization,\u201d and becoming machine-readable, or electronically-signaled. A standards effort currently underway in the IETF seeks to create a common global marking protocol which would allow open-standards-based devices to scan, cryptographically validate, and display the digital versions of these marks. This session will relate the state of the standards effort, the scope of markings that have been considered thus far, and seek input on security or privacy vulnerabilities which may exist in the proposed standard.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2343, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.27s - 7.11s | This text was transcribed using whisper model: large-v2 I'm going to be talking today about digital emblems and that is kind of a neologism. 7.11s - 12.03s | So, I'll take a little bit of explaining what they are and why this is interesting 12.03s - 13.45s | from a technical point of view. 14.41s - 17.71s | This is basically reporting out of work that is happening 18.29s - 21.95s | in the Internet Engineering Task Force that's building on top 21.95s - 26.41s | of existing protocols, DNS, DNSSEC, and DAIN. 27.31s - 32.11s | So, let's get started. 32.91s - 39.43s | The idea behind digital emblems is that they will supplement or eventually maybe replace the 39.43s - 43.91s | physical markings that are required on things under international law. 44.59s - 47.75s | So, let's take a look at some examples of what those physical markings are. 48.43s - 54.87s | Going sort of, you know, clockwise from the top right, see a press photographer 55.25s - 61.57s | with the press marking, the thing with the orange background is ISO container marking, 61.65s - 65.55s | which every ISO container out there has one of those on it, serial number, 65.55s - 67.99s | and a lot of standardized information. 68.89s - 74.95s | You've got some UN blue helmets, they're a marking


chunk_id: 199_chunk_1
chunk_text:
I'll take a little bit of explaining what they are and why this is interesting 12.03s - 13.45s | from a technical point of view. 14.41s - 17.71s | This is basically reporting out of work that is happening 18.29s - 21.95s | in the Internet Engineering Task Force that's building on top 21.95s - 26.41s | of existing protocols, DNS, DNSSEC, and DAIN. 27.31s - 32.11s | So, let's get started. 32.91s - 39.43s | The idea behind digital emblems is that they will supplement or eventually maybe replace the 39.43s - 43.91s | physical markings that are required on things under international law. 44.59s - 47.75s | So, let's take a look at some examples of what those physical markings are. 48.43s - 54.87s | Going sort of, you know, clockwise from the top right, see a press photographer 55.25s - 61.57s | with the press marking, the thing with the orange background is ISO container marking, 61.65s - 65.55s | which every ISO container out there has one of those on it, serial number, 65.55s - 67.99s | and a lot of standardized information. 68.89s - 74.95s | You've got some UN blue helmets, they're a marking that's recognized 74.95s - 81.25s | under international Geneva Conventions specifically for peacekeepers. 81.37s - 87.07s | The thing under that is four different chemical weapons components, 87.23s - 89.79s | chemicals that are being shipped in a cardboard box. 90.47s - 94.93s | Under that, there is the end of a wooden pallet. 95.23s - 99.31s | Every piece of wood that crosses an international border has to be marked 99.87s - 105.37s | to show how it's been freed of termites and stuff. 105.37s - 111.03s | Next to that, there's a blue and white shield of UNESCO for a World Heritage Site 111.03s - 113.67s | or World Heritage Artwork. 114.17s - 119.57s | Next to that, every piece of radioactive material, every piece of radioactive fuel or waste 119.57s - 121.77s | that crosses an international border has to be marked. 122.59s - 125.23s | And then the orange bag there is a diplomatic pouch. 126.09s - 131.03s | The Vienna Convention of 1961 on Diplomatic Relations says all 131.03s - 134.01s | about how diplomatic pouches have to be handled. 134.01s - 137.17s | They can't be delayed or inspected. 137.23s - 142.41s | So,


chunk_id: 199_chunk_2
chunk_text:
that's recognized 74.95s - 81.25s | under international Geneva Conventions specifically for peacekeepers. 81.37s - 87.07s | The thing under that is four different chemical weapons components, 87.23s - 89.79s | chemicals that are being shipped in a cardboard box. 90.47s - 94.93s | Under that, there is the end of a wooden pallet. 95.23s - 99.31s | Every piece of wood that crosses an international border has to be marked 99.87s - 105.37s | to show how it's been freed of termites and stuff. 105.37s - 111.03s | Next to that, there's a blue and white shield of UNESCO for a World Heritage Site 111.03s - 113.67s | or World Heritage Artwork. 114.17s - 119.57s | Next to that, every piece of radioactive material, every piece of radioactive fuel or waste 119.57s - 121.77s | that crosses an international border has to be marked. 122.59s - 125.23s | And then the orange bag there is a diplomatic pouch. 126.09s - 131.03s | The Vienna Convention of 1961 on Diplomatic Relations says all 131.03s - 134.01s | about how diplomatic pouches have to be handled. 134.01s - 137.17s | They can't be delayed or inspected. 137.23s - 142.41s | So, let's take a look at one of those in a little more detail. 142.41s - 149.73s | This is the phytosanitary marking, the one that goes onto wood crates and pallets. 150.41s - 154.71s | So, this is administered by the Food and Agriculture Organization. 154.71s - 158.63s | That is an intergovernmental organization that is responsible 158.63s - 162.11s | for the International Plant Protection Convention. 162.11s - 166.27s | That is the body of law that requires this marking. 166.99s - 173.33s | And then specifically, there's a particular law, the International Standard 173.33s - 177.43s | for Phytosanitary Measures Number 15 requires this marking. 177.89s - 181.53s | So, within that marking, you've got a country code, region code, 181.89s - 188.79s | the treatment service provider license number, the person who did the treatment of the crate 188.79s - 195.63s | or whatever, how the treatment was done, and then you've got some sort of serialization. 195.91s - 200.51s | So, a thing to notice about this is this is a hot metal brand shoved 200.51s - 204.07s | into a piece of wood with variable data on it. 205.33s - 207.87s | Right? Hot metal


chunk_id: 199_chunk_3
chunk_text:
let's take a look at one of those in a little more detail. 142.41s - 149.73s | This is the phytosanitary marking, the one that goes onto wood crates and pallets. 150.41s - 154.71s | So, this is administered by the Food and Agriculture Organization. 154.71s - 158.63s | That is an intergovernmental organization that is responsible 158.63s - 162.11s | for the International Plant Protection Convention. 162.11s - 166.27s | That is the body of law that requires this marking. 166.99s - 173.33s | And then specifically, there's a particular law, the International Standard 173.33s - 177.43s | for Phytosanitary Measures Number 15 requires this marking. 177.89s - 181.53s | So, within that marking, you've got a country code, region code, 181.89s - 188.79s | the treatment service provider license number, the person who did the treatment of the crate 188.79s - 195.63s | or whatever, how the treatment was done, and then you've got some sort of serialization. 195.91s - 200.51s | So, a thing to notice about this is this is a hot metal brand shoved 200.51s - 204.07s | into a piece of wood with variable data on it. 205.33s - 207.87s | Right? Hot metal brand, variable data. 208.59s - 209.27s | We're engineers. 209.27s - 210.89s | We know how to deal with variable data. 211.23s - 216.01s | The hot metal brand part seems like it doesn't scale so well, though. 216.01s - 217.93s | So, what are problems with physical markings? 219.23s - 223.09s | It's really hard to tell whether a physical marking is being misused. 223.49s - 228.35s | Did the person who put the physical marking on something, were they authorized to do that? 229.17s - 230.57s | Does it still apply? 231.37s - 233.99s | Was it marked and got scraped off? 233.99s - 236.51s | Right? There are lots and lots of issues with physical markings. 237.01s - 243.89s | But beyond that, typically they're not, they're meant to be human readable, 243.89s - 246.15s | but they're not optimized for machine readability. 246.89s - 250.39s | And then you can't actually apply them to something that's not physical. 250.39s - 257.47s | So, digital data, you can't apply a physical mark to digital data and expect it to be readable. 257.89s - 261.59s | You can apply it to the thing that holds the data, but


chunk_id: 199_chunk_4
chunk_text:
brand, variable data. 208.59s - 209.27s | We're engineers. 209.27s - 210.89s | We know how to deal with variable data. 211.23s - 216.01s | The hot metal brand part seems like it doesn't scale so well, though. 216.01s - 217.93s | So, what are problems with physical markings? 219.23s - 223.09s | It's really hard to tell whether a physical marking is being misused. 223.49s - 228.35s | Did the person who put the physical marking on something, were they authorized to do that? 229.17s - 230.57s | Does it still apply? 231.37s - 233.99s | Was it marked and got scraped off? 233.99s - 236.51s | Right? There are lots and lots of issues with physical markings. 237.01s - 243.89s | But beyond that, typically they're not, they're meant to be human readable, 243.89s - 246.15s | but they're not optimized for machine readability. 246.89s - 250.39s | And then you can't actually apply them to something that's not physical. 250.39s - 257.47s | So, digital data, you can't apply a physical mark to digital data and expect it to be readable. 257.89s - 261.59s | You can apply it to the thing that holds the data, but not to the data itself. 261.99s - 267.03s | And if, for instance, an attacker is coming in over the network, 267.41s - 269.75s | they can't see the physical thing that they're attacking. 269.75s - 273.91s | So, they can't see whether something, some mark's been stenciled on it. 275.35s - 277.59s | And electronic services, right? 277.75s - 283.07s | Not just data at rest or data in flight, but like an email server. 283.39s - 288.03s | How would you mark that an email server was protected or licensed or whatever, right? 291.23s - 296.79s | So, beyond that, when we start to get into cryptographic authentication, 297.11s - 303.31s | we get this whole suite of additional capabilities around revocation and, you know, 303.35s - 309.99s | things timing out and signature roles and all these kinds of things that we kind of take for granted 310.95s - 314.91s | in cryptography, which, you know, people who do physical markings, you know, 314.91s - 319.75s | they got a stencil and a rattle can and, you know, they don't have any of those tools. 320.31s - 322.95s | So, how do we move forward? 322.99s -


chunk_id: 199_chunk_5
chunk_text:
not to the data itself. 261.99s - 267.03s | And if, for instance, an attacker is coming in over the network, 267.41s - 269.75s | they can't see the physical thing that they're attacking. 269.75s - 273.91s | So, they can't see whether something, some mark's been stenciled on it. 275.35s - 277.59s | And electronic services, right? 277.75s - 283.07s | Not just data at rest or data in flight, but like an email server. 283.39s - 288.03s | How would you mark that an email server was protected or licensed or whatever, right? 291.23s - 296.79s | So, beyond that, when we start to get into cryptographic authentication, 297.11s - 303.31s | we get this whole suite of additional capabilities around revocation and, you know, 303.35s - 309.99s | things timing out and signature roles and all these kinds of things that we kind of take for granted 310.95s - 314.91s | in cryptography, which, you know, people who do physical markings, you know, 314.91s - 319.75s | they got a stencil and a rattle can and, you know, they don't have any of those tools. 320.31s - 322.95s | So, how do we move forward? 322.99s - 325.59s | What can we mark with digital emblem? 326.15s - 332.27s | Right now, it's defined as people, places, things, data at rest, data in flight, and online services. 333.35s - 337.83s | And, you know, throughout the rest of this talk and in the standards documents and so forth, 337.83s - 340.75s | we just refer to all of that collectively as assets. 342.03s - 346.27s | Because we're not trying to differentiate them in any way, right? 346.27s - 348.75s | We want a standard that works with all of them. 351.59s - 356.39s | There are a couple of non-goals, things that come up in conversation a lot with people 356.39s - 358.71s | who are first looking at this problem space. 359.03s - 364.91s | So, people look at the protective emblems, particularly like that UNESCO emblem 365.27s - 369.47s | that gets put on, for instance, a church in Ukraine, right? 370.59s - 372.75s | And then the Russians come along and blow up the church. 373.15s - 376.71s | And people say, well, that emblem didn't protect the church. 377.43s - 382.51s | Just like if we put a digital emblem on a


chunk_id: 199_chunk_6
chunk_text:
325.59s | What can we mark with digital emblem? 326.15s - 332.27s | Right now, it's defined as people, places, things, data at rest, data in flight, and online services. 333.35s - 337.83s | And, you know, throughout the rest of this talk and in the standards documents and so forth, 337.83s - 340.75s | we just refer to all of that collectively as assets. 342.03s - 346.27s | Because we're not trying to differentiate them in any way, right? 346.27s - 348.75s | We want a standard that works with all of them. 351.59s - 356.39s | There are a couple of non-goals, things that come up in conversation a lot with people 356.39s - 358.71s | who are first looking at this problem space. 359.03s - 364.91s | So, people look at the protective emblems, particularly like that UNESCO emblem 365.27s - 369.47s | that gets put on, for instance, a church in Ukraine, right? 370.59s - 372.75s | And then the Russians come along and blow up the church. 373.15s - 376.71s | And people say, well, that emblem didn't protect the church. 377.43s - 382.51s | Just like if we put a digital emblem on a website, and somebody DDoS's the website. 383.39s - 385.75s | Okay, it didn't protect the website. 386.23s - 389.59s | But neither would a physical marking, right? 389.59s - 396.03s | The physical marking or the digital marking, what it's doing is it's making the job 396.03s - 398.87s | of a lawyer in the Hague easier, right? 398.87s - 404.27s | If they want to prosecute somebody for a war crime, showing that the person was duly informed 404.27s - 408.03s | that what they were doing was or about to do was a war crime before they did it 408.31s - 413.19s | and did it knowingly and maliciously, right, that makes their job as a lawyer easier. 413.83s - 421.95s | And then, you know, all the sort of just compliance markings, this is about ease of use, right? 421.95s - 425.11s | It's about making the job of a customs inspector easier. 425.51s - 429.19s | It's not going to do any magic, you know, 429.19s - 431.71s | it's not going to do anything really differently than the physical marking. 431.95s - 433.47s | It's just easier. 434.31s - 441.23s | And then the other


chunk_id: 199_chunk_7
chunk_text:
website, and somebody DDoS's the website. 383.39s - 385.75s | Okay, it didn't protect the website. 386.23s - 389.59s | But neither would a physical marking, right? 389.59s - 396.03s | The physical marking or the digital marking, what it's doing is it's making the job 396.03s - 398.87s | of a lawyer in the Hague easier, right? 398.87s - 404.27s | If they want to prosecute somebody for a war crime, showing that the person was duly informed 404.27s - 408.03s | that what they were doing was or about to do was a war crime before they did it 408.31s - 413.19s | and did it knowingly and maliciously, right, that makes their job as a lawyer easier. 413.83s - 421.95s | And then, you know, all the sort of just compliance markings, this is about ease of use, right? 421.95s - 425.11s | It's about making the job of a customs inspector easier. 425.51s - 429.19s | It's not going to do any magic, you know, 429.19s - 431.71s | it's not going to do anything really differently than the physical marking. 431.95s - 433.47s | It's just easier. 434.31s - 441.23s | And then the other thing is a lot of people think, well, if you do this digital emblem 441.27s - 446.99s | and you embody it in a QR code, somebody could just copy that QR code from one crate 447.23s - 451.19s | to another crate and, oh, we've hacked the system, right? 451.55s - 453.59s | But that's not how it works. 453.59s - 459.31s | This is like saying if I copy the URL of a website onto another thing that I've hacked 459.31s - 462.63s | the website, no, the website is still out there in the Internet. 463.11s - 465.31s | The digital emblem is still out there in the Internet. 465.87s - 473.51s | What's marked on the crate or the building or somebody's ID card is essentially just like a URL, right? 473.51s - 479.31s | It's a label that the validator is going to go and check. 481.35s - 487.19s | So the trick is not physically attaching it to the thing. 487.19s - 489.55s | The trick is associating it with the thing. 489.55s - 494.23s | So when somebody looks at it, they'll understand that, yes, this is the right thing. 495.51s - 498.15s


chunk_id: 199_chunk_8
chunk_text:
thing is a lot of people think, well, if you do this digital emblem 441.27s - 446.99s | and you embody it in a QR code, somebody could just copy that QR code from one crate 447.23s - 451.19s | to another crate and, oh, we've hacked the system, right? 451.55s - 453.59s | But that's not how it works. 453.59s - 459.31s | This is like saying if I copy the URL of a website onto another thing that I've hacked 459.31s - 462.63s | the website, no, the website is still out there in the Internet. 463.11s - 465.31s | The digital emblem is still out there in the Internet. 465.87s - 473.51s | What's marked on the crate or the building or somebody's ID card is essentially just like a URL, right? 473.51s - 479.31s | It's a label that the validator is going to go and check. 481.35s - 487.19s | So the trick is not physically attaching it to the thing. 487.19s - 489.55s | The trick is associating it with the thing. 489.55s - 494.23s | So when somebody looks at it, they'll understand that, yes, this is the right thing. 495.51s - 498.15s | So let's take a look at that a little bit more closely. 498.75s - 502.51s | We've got an issuer, somebody who is creating digital emblems, 504.47s - 510.11s | and they create a bundle of records that are the digital emblem, and then they sign it. 512.51s - 516.51s | That gets attached to an asset through a description. 516.55s - 521.35s | The description says, you know, this digital emblem applies to this person. 521.35s - 523.31s | This digital emblem applies to this crate. 523.35s - 526.75s | This digital emblem applies to this building or this vehicle. 529.03s - 541.39s | And that description is going to be a serial number or a height or mass or location or time and place. 543.11s - 547.39s | So a validator, somebody who wants to figure out whether this thing is legit, 547.87s - 555.19s | is going to evaluate first the signature to make sure that the issuer is a legitimate issuer, right, 555.19s - 557.75s | is who they're expecting. 558.99s - 565.15s | And they're going to check the description to make sure that the asset is the thing described by the emblem. 567.33s


chunk_id: 199_chunk_9
chunk_text:
| So let's take a look at that a little bit more closely. 498.75s - 502.51s | We've got an issuer, somebody who is creating digital emblems, 504.47s - 510.11s | and they create a bundle of records that are the digital emblem, and then they sign it. 512.51s - 516.51s | That gets attached to an asset through a description. 516.55s - 521.35s | The description says, you know, this digital emblem applies to this person. 521.35s - 523.31s | This digital emblem applies to this crate. 523.35s - 526.75s | This digital emblem applies to this building or this vehicle. 529.03s - 541.39s | And that description is going to be a serial number or a height or mass or location or time and place. 543.11s - 547.39s | So a validator, somebody who wants to figure out whether this thing is legit, 547.87s - 555.19s | is going to evaluate first the signature to make sure that the issuer is a legitimate issuer, right, 555.19s - 557.75s | is who they're expecting. 558.99s - 565.15s | And they're going to check the description to make sure that the asset is the thing described by the emblem. 567.33s - 568.93s | So who are validators? 572.55s - 575.47s | A lot of people really focus on the military uses. 575.47s - 578.75s | So you can have a loitering munition that's sitting around up there, 579.07s - 585.19s | and it's nighttime and you've got a convoy and, you know, one truck has the medical supplies. 585.67s - 589.35s | And so that one is the one that's protected under the Geneva Conventions. 589.35s - 590.91s | The other ones have ammunition. 590.91s - 592.07s | They are not protected. 592.43s - 595.67s | The loitering munition has to make a decision between these. 595.87s - 600.87s | If it can make a decision based on something machine readable and cryptographically authenticatable, 601.15s - 605.15s | it's going to make a much better decision than if it's up there in the dark trying to figure out 605.15s - 610.43s | whether there's a marking on the side of a truck that it's looking at the top of, right? 611.67s - 616.03s | But by and large, this is going to get used by customs agents, right? 616.03s - 623.19s | 99 times out of 100, it's going to


chunk_id: 199_chunk_10
chunk_text:
- 568.93s | So who are validators? 572.55s - 575.47s | A lot of people really focus on the military uses. 575.47s - 578.75s | So you can have a loitering munition that's sitting around up there, 579.07s - 585.19s | and it's nighttime and you've got a convoy and, you know, one truck has the medical supplies. 585.67s - 589.35s | And so that one is the one that's protected under the Geneva Conventions. 589.35s - 590.91s | The other ones have ammunition. 590.91s - 592.07s | They are not protected. 592.43s - 595.67s | The loitering munition has to make a decision between these. 595.87s - 600.87s | If it can make a decision based on something machine readable and cryptographically authenticatable, 601.15s - 605.15s | it's going to make a much better decision than if it's up there in the dark trying to figure out 605.15s - 610.43s | whether there's a marking on the side of a truck that it's looking at the top of, right? 611.67s - 616.03s | But by and large, this is going to get used by customs agents, right? 616.03s - 623.19s | 99 times out of 100, it's going to be somebody scanning a cargo container or, you know, a crate or whatever. 624.99s - 628.11s | So what problem is this mostly solving? 629.79s - 633.91s | Proliferation of proprietary scanners. 634.39s - 640.27s | So what's happening right now is these markings already exist and a lot more besides that. 640.91s - 644.35s | And people are trying to digitize them. 644.39s - 649.59s | People are trying to take these physical markings and create some digital workflow around them. 649.99s - 654.59s | And so, you know, they come up with something and maybe it's kind of a hack 654.95s - 660.91s | and it involves a scanner that some that a validator can use to point at the box or whatever 660.91s - 666.11s | and, you know, press the button and look at the screen on the back and it says, yes, this is OK. 666.51s - 671.15s | Or no, this is counterfeit goods or no, this has been tampered with or whatever. 672.59s - 675.95s | So the problem is that customs agents are starting to get 676.23s - 679.27s | more and more of these proprietary scanners stacking up. 679.27s - 683.11s


chunk_id: 199_chunk_11
chunk_text:
be somebody scanning a cargo container or, you know, a crate or whatever. 624.99s - 628.11s | So what problem is this mostly solving? 629.79s - 633.91s | Proliferation of proprietary scanners. 634.39s - 640.27s | So what's happening right now is these markings already exist and a lot more besides that. 640.91s - 644.35s | And people are trying to digitize them. 644.39s - 649.59s | People are trying to take these physical markings and create some digital workflow around them. 649.99s - 654.59s | And so, you know, they come up with something and maybe it's kind of a hack 654.95s - 660.91s | and it involves a scanner that some that a validator can use to point at the box or whatever 660.91s - 666.11s | and, you know, press the button and look at the screen on the back and it says, yes, this is OK. 666.51s - 671.15s | Or no, this is counterfeit goods or no, this has been tampered with or whatever. 672.59s - 675.95s | So the problem is that customs agents are starting to get 676.23s - 679.27s | more and more of these proprietary scanners stacking up. 679.27s - 683.11s | So a shipment comes in, they have to go to the closet, rummage around, 683.11s - 688.23s | figure out what the right scanner is, whether the battery is charged and then go scan the thing. 688.63s - 692.03s | And this is just the tip of the iceberg, right? 692.03s - 695.35s | This is just the first few organizations that have started to do this. 695.71s - 700.71s | And, you know, these organizations are not happy about having to develop this themselves. 700.71s - 705.31s | So you've got folks like Apple, folks like Cisco, folks like Nokia, 705.83s - 709.99s | who are really concerned about counterfeit goods. 710.51s - 713.03s | And they've got international law on their side. 713.03s - 716.83s | WIPO administers, I think, 38 different international laws, 717.31s - 720.11s | several of which are about counterfeiting. 721.79s - 727.63s | So, you know, they can work with customs agents to identify 728.03s - 732.23s | legitimate versus counterfeit goods, but their systems, 732.79s - 735.19s | like each of those each of those companies I just mentioned, 735.19s - 737.51s | each one has a completely different system for


chunk_id: 199_chunk_12
chunk_text:
| So a shipment comes in, they have to go to the closet, rummage around, 683.11s - 688.23s | figure out what the right scanner is, whether the battery is charged and then go scan the thing. 688.63s - 692.03s | And this is just the tip of the iceberg, right? 692.03s - 695.35s | This is just the first few organizations that have started to do this. 695.71s - 700.71s | And, you know, these organizations are not happy about having to develop this themselves. 700.71s - 705.31s | So you've got folks like Apple, folks like Cisco, folks like Nokia, 705.83s - 709.99s | who are really concerned about counterfeit goods. 710.51s - 713.03s | And they've got international law on their side. 713.03s - 716.83s | WIPO administers, I think, 38 different international laws, 717.31s - 720.11s | several of which are about counterfeiting. 721.79s - 727.63s | So, you know, they can work with customs agents to identify 728.03s - 732.23s | legitimate versus counterfeit goods, but their systems, 732.79s - 735.19s | like each of those each of those companies I just mentioned, 735.19s - 737.51s | each one has a completely different system for doing it. 737.51s - 740.11s | Different physical scanner, different software, different everything. 740.63s - 743.51s | So this is the main thing we're trying to solve, right? 743.51s - 746.59s | We're trying to get an open standard that can be implemented 746.59s - 750.59s | in open source software on open hardware cheaply. 751.23s - 753.87s | Everybody can just make do with a single scanner 753.87s - 756.91s | that will scan all of these different kinds of things. 758.11s - 761.47s | So what's a digital emblem look like? 762.07s - 765.43s | We've got in the top left there, the issuer, 766.95s - 770.07s | bottom left, the asset, the validator over on the right. 771.03s - 776.07s | The digital emblem is the set of records there that are in that green box. 776.67s - 782.87s | And that's the binding first issuer to emblem and then emblem to asset. 782.87s - 786.07s | So and this is just some examples, right? 786.07s - 789.63s | There are actually a whole lot more different, very specific bindings 789.63s - 790.35s | that are available. 790.35s - 793.91s | So we've got a visual representation


chunk_id: 199_chunk_13
chunk_text:
doing it. 737.51s - 740.11s | Different physical scanner, different software, different everything. 740.63s - 743.51s | So this is the main thing we're trying to solve, right? 743.51s - 746.59s | We're trying to get an open standard that can be implemented 746.59s - 750.59s | in open source software on open hardware cheaply. 751.23s - 753.87s | Everybody can just make do with a single scanner 753.87s - 756.91s | that will scan all of these different kinds of things. 758.11s - 761.47s | So what's a digital emblem look like? 762.07s - 765.43s | We've got in the top left there, the issuer, 766.95s - 770.07s | bottom left, the asset, the validator over on the right. 771.03s - 776.07s | The digital emblem is the set of records there that are in that green box. 776.67s - 782.87s | And that's the binding first issuer to emblem and then emblem to asset. 782.87s - 786.07s | So and this is just some examples, right? 786.07s - 789.63s | There are actually a whole lot more different, very specific bindings 789.63s - 790.35s | that are available. 790.35s - 793.91s | So we've got a visual representation of the emblem, right? 794.23s - 797.35s | If it's a diplomatic pouch from Cote d'Ivoire, 797.63s - 802.79s | the Cote d'Ivoire national seal is going to be the visual representation. 803.55s - 806.19s | We've got an identification of law. 806.19s - 807.75s | Again, if it's a diplomatic pouch, 807.75s - 811.71s | it's going to be the Vienna Convention of Diplomatic Relations, 1961. 812.03s - 813.63s | We've got the contact information. 813.63s - 817.83s | In this case, it would be the contact information of the logistics person 817.83s - 821.11s | in the foreign ministry of Cote d'Ivoire, 821.11s - 823.99s | who's responsible for administering their diplomatic shipments. 824.63s - 825.99s | We've got handling flags. 825.99s - 828.11s | Is there anything fragile here? 828.11s - 831.83s | Does it need to be in the pressurized compartment of the airplane hold? 832.87s - 834.91s | What should we do if, 835.63s - 838.95s | you know, the handling conditions are violated? 839.79s - 842.43s | We've got the issuer's cryptographic signature, 842.71s - 844.55s | and then we've got third party signatures. 844.55s - 847.55s | These are cross signatures to create


chunk_id: 199_chunk_14
chunk_text:
of the emblem, right? 794.23s - 797.35s | If it's a diplomatic pouch from Cote d'Ivoire, 797.63s - 802.79s | the Cote d'Ivoire national seal is going to be the visual representation. 803.55s - 806.19s | We've got an identification of law. 806.19s - 807.75s | Again, if it's a diplomatic pouch, 807.75s - 811.71s | it's going to be the Vienna Convention of Diplomatic Relations, 1961. 812.03s - 813.63s | We've got the contact information. 813.63s - 817.83s | In this case, it would be the contact information of the logistics person 817.83s - 821.11s | in the foreign ministry of Cote d'Ivoire, 821.11s - 823.99s | who's responsible for administering their diplomatic shipments. 824.63s - 825.99s | We've got handling flags. 825.99s - 828.11s | Is there anything fragile here? 828.11s - 831.83s | Does it need to be in the pressurized compartment of the airplane hold? 832.87s - 834.91s | What should we do if, 835.63s - 838.95s | you know, the handling conditions are violated? 839.79s - 842.43s | We've got the issuer's cryptographic signature, 842.71s - 844.55s | and then we've got third party signatures. 844.55s - 847.55s | These are cross signatures to create a web of trust. 848.23s - 852.15s | Let's say you're a customs agent and, you know, you get something 852.15s - 855.51s | that comes in from Cote d'Ivoire foreign ministry. 856.07s - 860.99s | And, you know, you have no idea whether they're legit or not. 860.99s - 863.07s | You haven't heard of Cote d'Ivoire before, 863.07s - 865.75s | but there are five different other signatures on there, 865.75s - 870.19s | one from Guinea and one from Gambia and one from Niger, right? 870.43s - 873.79s | All saying, yes, you know, this is this is a real foreign ministry 873.79s - 877.59s | that we work with and recognize as being a legit country. 877.79s - 881.15s | Right. So those cross signatures, that web of trust, just like in PGP, 881.35s - 884.03s | it gives you some assurance that you're dealing with a real entity 884.03s - 889.63s | and not like a typo squatter or somebody using a homograph in the label name. 891.19s - 895.59s | So then on the asset, we've got a temporal and a spatial scope of validity. 896.39s - 900.59s | Is this thing in the


chunk_id: 199_chunk_15
chunk_text:
a web of trust. 848.23s - 852.15s | Let's say you're a customs agent and, you know, you get something 852.15s - 855.51s | that comes in from Cote d'Ivoire foreign ministry. 856.07s - 860.99s | And, you know, you have no idea whether they're legit or not. 860.99s - 863.07s | You haven't heard of Cote d'Ivoire before, 863.07s - 865.75s | but there are five different other signatures on there, 865.75s - 870.19s | one from Guinea and one from Gambia and one from Niger, right? 870.43s - 873.79s | All saying, yes, you know, this is this is a real foreign ministry 873.79s - 877.59s | that we work with and recognize as being a legit country. 877.79s - 881.15s | Right. So those cross signatures, that web of trust, just like in PGP, 881.35s - 884.03s | it gives you some assurance that you're dealing with a real entity 884.03s - 889.63s | and not like a typo squatter or somebody using a homograph in the label name. 891.19s - 895.59s | So then on the asset, we've got a temporal and a spatial scope of validity. 896.39s - 900.59s | Is this thing in the place it's supposed to be at the time it's supposed to be? 900.79s - 903.87s | And so that's probably going to be a series of things, right? 903.91s - 906.99s | And if it's on an airplane, 907.31s - 912.31s | that's going to be a series of long, skinny polygons 912.99s - 916.87s | covering the airplane flight, the projected airplane flight, 917.11s - 920.27s | and then the airport at the destination 920.27s - 922.91s | where it's going to be going through customs, for instance. 924.51s - 929.67s | So that pairing of a bunch of locations and times 930.23s - 935.23s | gives some idea of of when and where this thing should be accepted. 935.51s - 940.03s | So to give a different example, let's say that we have a diplomatic envoy 941.03s - 946.15s | whose mission is in Germany in twenty twenty five. 946.43s - 950.23s | And yet they show up in Hungary in December of twenty twenty four 950.23s - 951.95s | and they present their credential. 951.95s - 958.43s | The you know, the immigration guy in Hungary can evaluate this and say, 958.43s - 962.19s | OK, that's


chunk_id: 199_chunk_16
chunk_text:
place it's supposed to be at the time it's supposed to be? 900.79s - 903.87s | And so that's probably going to be a series of things, right? 903.91s - 906.99s | And if it's on an airplane, 907.31s - 912.31s | that's going to be a series of long, skinny polygons 912.99s - 916.87s | covering the airplane flight, the projected airplane flight, 917.11s - 920.27s | and then the airport at the destination 920.27s - 922.91s | where it's going to be going through customs, for instance. 924.51s - 929.67s | So that pairing of a bunch of locations and times 930.23s - 935.23s | gives some idea of of when and where this thing should be accepted. 935.51s - 940.03s | So to give a different example, let's say that we have a diplomatic envoy 941.03s - 946.15s | whose mission is in Germany in twenty twenty five. 946.43s - 950.23s | And yet they show up in Hungary in December of twenty twenty four 950.23s - 951.95s | and they present their credential. 951.95s - 958.43s | The you know, the immigration guy in Hungary can evaluate this and say, 958.43s - 962.19s | OK, that's nice, but you're just a regular guy here, right? 962.51s - 967.71s | Your diplomatic credential is valid next month in a different country. 968.11s - 970.67s | Not right here, right now, right here, right now. 970.91s - 973.63s | You're just coming in on your regular passport. 976.07s - 978.35s | So then we've got a bunch of stuff, 978.35s - 980.87s | you know, SI base units of size and weight. 980.95s - 983.75s | You know, how big is this thing? How heavy is this thing? 985.23s - 988.79s | And then the World Customs Organization is, 989.35s - 993.83s | you know, the the international organization of customs agencies. 994.15s - 997.59s | They've got all this stuff standardized and have for a long time 997.59s - 1003.83s | for, you know, paperwork, you know, crate number three of a shipment of five. 1003.83s - 1005.75s | Right. Stuff like that. 1005.75s - 1007.71s | You know, how many barrels is it? 1009.47s - 1011.71s | Standardized. 1012.15s - 1015.91s | Packaging and so forth is all really well standardized already, right? 1015.91s - 1018.19s | So we don't need to reinvent any of that


chunk_id: 199_chunk_17
chunk_text:
nice, but you're just a regular guy here, right? 962.51s - 967.71s | Your diplomatic credential is valid next month in a different country. 968.11s - 970.67s | Not right here, right now, right here, right now. 970.91s - 973.63s | You're just coming in on your regular passport. 976.07s - 978.35s | So then we've got a bunch of stuff, 978.35s - 980.87s | you know, SI base units of size and weight. 980.95s - 983.75s | You know, how big is this thing? How heavy is this thing? 985.23s - 988.79s | And then the World Customs Organization is, 989.35s - 993.83s | you know, the the international organization of customs agencies. 994.15s - 997.59s | They've got all this stuff standardized and have for a long time 997.59s - 1003.83s | for, you know, paperwork, you know, crate number three of a shipment of five. 1003.83s - 1005.75s | Right. Stuff like that. 1005.75s - 1007.71s | You know, how many barrels is it? 1009.47s - 1011.71s | Standardized. 1012.15s - 1015.91s | Packaging and so forth is all really well standardized already, right? 1015.91s - 1018.19s | So we don't need to reinvent any of that 1020.43s - 1024.63s | name, serial numbers, distinguishing marks and then external references. 1025.11s - 1028.95s | What about a link to a photograph of the thing? 1029.31s - 1031.91s | So you can look at a picture of it and say, 1032.07s - 1034.47s | does that look like the thing in front of me? Right. 1034.47s - 1037.71s | Does this look like the person in front of me? Pretty straightforward. 1038.63s - 1042.23s | So then we get into the distribution side of this. 1042.59s - 1046.47s | How do we communicate the digital emblem to the validator? 1046.47s - 1048.91s | How does the validator find out about this thing? 1049.47s - 1052.31s | So let's run through those. 1052.67s - 1055.67s | For data at rest and data in flight. 1057.27s - 1060.75s | For data at rest, there are kind of three possibilities, right? 1060.75s - 1065.35s | Either the emblem encapsulates the data. 1065.43s - 1068.75s | So we have the emblem and the data gets shoved inside the emblem 1069.47s - 1073.51s | or the emblem and the data are sitting next to each other on some media. 1074.39s - 1079.31s |


chunk_id: 199_chunk_18
chunk_text:
1020.43s - 1024.63s | name, serial numbers, distinguishing marks and then external references. 1025.11s - 1028.95s | What about a link to a photograph of the thing? 1029.31s - 1031.91s | So you can look at a picture of it and say, 1032.07s - 1034.47s | does that look like the thing in front of me? Right. 1034.47s - 1037.71s | Does this look like the person in front of me? Pretty straightforward. 1038.63s - 1042.23s | So then we get into the distribution side of this. 1042.59s - 1046.47s | How do we communicate the digital emblem to the validator? 1046.47s - 1048.91s | How does the validator find out about this thing? 1049.47s - 1052.31s | So let's run through those. 1052.67s - 1055.67s | For data at rest and data in flight. 1057.27s - 1060.75s | For data at rest, there are kind of three possibilities, right? 1060.75s - 1065.35s | Either the emblem encapsulates the data. 1065.43s - 1068.75s | So we have the emblem and the data gets shoved inside the emblem 1069.47s - 1073.51s | or the emblem and the data are sitting next to each other on some media. 1074.39s - 1079.31s | Or the emblem gets shoved into the data and is encapsulated within the data. 1079.31s - 1081.39s | Right. So those are our three possibilities. 1081.39s - 1084.63s | And, you know, side by side is easy. 1084.63s - 1087.75s | It's just like two files or whatever. 1087.75s - 1091.07s | And then we've got different ways of doing encapsulation already. 1091.07s - 1092.79s | Plenty of standards that we can use there. 1092.79s - 1097.71s | MIME, which is used for email, is, for instance, a perfectly mature one. 1098.83s - 1101.91s | For data in flight, this is going to be TLS, right? 1101.91s - 1103.75s | I'm not a TLS expert. 1103.75s - 1105.03s | Lots of people are. 1105.03s - 1106.95s | This is going to be some sort of TLS thing. 1108.39s - 1109.83s | In band network response. 1109.83s - 1112.23s | We've already got this. Dane. 1112.23s - 1115.99s | DNS, DNSSEC, Dane. Issue a certificate. Done. 1118.03s - 1120.87s | Passive RF responders and active RF responders. 1120.87s - 1124.47s | Again, RFID. Done. We just take what's already existing. 1125.59s - 1127.19s | Active RFID beacon. 1127.19s - 1130.51s |


chunk_id: 199_chunk_19
chunk_text:
Or the emblem gets shoved into the data and is encapsulated within the data. 1079.31s - 1081.39s | Right. So those are our three possibilities. 1081.39s - 1084.63s | And, you know, side by side is easy. 1084.63s - 1087.75s | It's just like two files or whatever. 1087.75s - 1091.07s | And then we've got different ways of doing encapsulation already. 1091.07s - 1092.79s | Plenty of standards that we can use there. 1092.79s - 1097.71s | MIME, which is used for email, is, for instance, a perfectly mature one. 1098.83s - 1101.91s | For data in flight, this is going to be TLS, right? 1101.91s - 1103.75s | I'm not a TLS expert. 1103.75s - 1105.03s | Lots of people are. 1105.03s - 1106.95s | This is going to be some sort of TLS thing. 1108.39s - 1109.83s | In band network response. 1109.83s - 1112.23s | We've already got this. Dane. 1112.23s - 1115.99s | DNS, DNSSEC, Dane. Issue a certificate. Done. 1118.03s - 1120.87s | Passive RF responders and active RF responders. 1120.87s - 1124.47s | Again, RFID. Done. We just take what's already existing. 1125.59s - 1127.19s | Active RFID beacon. 1127.19s - 1130.51s | So this is something where you would query it and it would respond. 1130.71s - 1133.51s | Oh, sorry. Sorry. Beacon. 1133.51s - 1135.07s | This is like radio station. 1135.07s - 1138.03s | It's just broadcasting the signal. 1138.31s - 1140.27s | And you listen and you've got it. 1141.55s - 1144.35s | So that could be just on some specific frequency 1144.35s - 1149.83s | that the validator and the issuer both know is supposed to be used for this. 1149.83s - 1152.91s | Or it could be spread spectrum or whatever. Who knows? Right. 1153.19s - 1156.63s | This is one of those things that is going to be very specific 1156.63s - 1161.47s | to the use case and the validator and the issuer for them to work out. 1161.47s - 1165.11s | It doesn't really have anything to do with the the data model. 1166.11s - 1168.83s | Passive optical marking. 1169.07s - 1173.59s | This is the physical marking of the digital marking 1174.27s - 1176.19s | that replaces the physical marking. 1176.19s - 1178.15s | So that could be a QR code. 1178.15s - 1180.75s | Right. Could be letters painted on the


chunk_id: 199_chunk_20
chunk_text:
So this is something where you would query it and it would respond. 1130.71s - 1133.51s | Oh, sorry. Sorry. Beacon. 1133.51s - 1135.07s | This is like radio station. 1135.07s - 1138.03s | It's just broadcasting the signal. 1138.31s - 1140.27s | And you listen and you've got it. 1141.55s - 1144.35s | So that could be just on some specific frequency 1144.35s - 1149.83s | that the validator and the issuer both know is supposed to be used for this. 1149.83s - 1152.91s | Or it could be spread spectrum or whatever. Who knows? Right. 1153.19s - 1156.63s | This is one of those things that is going to be very specific 1156.63s - 1161.47s | to the use case and the validator and the issuer for them to work out. 1161.47s - 1165.11s | It doesn't really have anything to do with the the data model. 1166.11s - 1168.83s | Passive optical marking. 1169.07s - 1173.59s | This is the physical marking of the digital marking 1174.27s - 1176.19s | that replaces the physical marking. 1176.19s - 1178.15s | So that could be a QR code. 1178.15s - 1180.75s | Right. Could be letters painted on the side of something. 1181.55s - 1183.83s | Barcodes. Printed text. 1183.83s - 1187.51s | It could be like an e-ink screen that displays the data. 1188.87s - 1190.67s | Whatever. It just needs to be some way. 1190.67s - 1192.71s | It's like communicating a URL. Right. 1192.71s - 1196.59s | You just need to be able to get that label across so that the validator can check it. 1198.79s - 1200.99s | Active optical transponder. Right. 1200.99s - 1205.31s | This would be hypothetically like you blink the flashlight at them 1205.31s - 1207.71s | and they blink the flashlight back. 1207.71s - 1212.83s | Who knows? This is like if you build a matrix, this is a spot in the matrix. 1213.59s - 1216.51s | I don't know if there's a use case for that or not. 1216.51s - 1217.91s | Active optical beacon. 1217.91s - 1221.63s | At first, I was thinking, you know, active optical beacon is going to do that. 1221.91s - 1225.31s | And then I started talking with aviation folks and they were like, that's the one. 1225.31s - 1227.71s | That's the important one that we're going to do. 1227.71s - 1231.59s


chunk_id: 199_chunk_21
chunk_text:
side of something. 1181.55s - 1183.83s | Barcodes. Printed text. 1183.83s - 1187.51s | It could be like an e-ink screen that displays the data. 1188.87s - 1190.67s | Whatever. It just needs to be some way. 1190.67s - 1192.71s | It's like communicating a URL. Right. 1192.71s - 1196.59s | You just need to be able to get that label across so that the validator can check it. 1198.79s - 1200.99s | Active optical transponder. Right. 1200.99s - 1205.31s | This would be hypothetically like you blink the flashlight at them 1205.31s - 1207.71s | and they blink the flashlight back. 1207.71s - 1212.83s | Who knows? This is like if you build a matrix, this is a spot in the matrix. 1213.59s - 1216.51s | I don't know if there's a use case for that or not. 1216.51s - 1217.91s | Active optical beacon. 1217.91s - 1221.63s | At first, I was thinking, you know, active optical beacon is going to do that. 1221.91s - 1225.31s | And then I started talking with aviation folks and they were like, that's the one. 1225.31s - 1227.71s | That's the important one that we're going to do. 1227.71s - 1231.59s | So taking the navigation lights on an aircraft, 1231.59s - 1234.99s | it turns out there's already a standard for modulating data on that. 1236.07s - 1239.91s | It's a it's an 802.11 standard, just like Ethernet. 1240.27s - 1245.59s | So you can modulate the data on existing navigation and hazard lights. 1246.43s - 1249.67s | You could do the same thing on the light bar of an emergency vehicle. 1250.19s - 1255.59s | Lighthouses, you know, anything where you've got some sort of light, 1255.59s - 1258.47s | if you can modulate it fast enough, you can put data on it. 1258.83s - 1262.35s | And that is an active optical beacon, which. 1263.03s - 1267.79s | OK, cool. Active audio transponder. 1268.71s - 1273.15s | You that's like Amazon Echo or whatever, you talk to it and it talks back to you. 1273.79s - 1276.15s | Is there a use case? I don't know. 1276.15s - 1278.03s | And active audio beacon. 1278.03s - 1281.63s | So that's kind of like the optical one, right? 1281.63s - 1287.59s | You could modulate data onto an existing sound source, right? 1287.59s - 1293.99s | If that's a


chunk_id: 199_chunk_22
chunk_text:
| So taking the navigation lights on an aircraft, 1231.59s - 1234.99s | it turns out there's already a standard for modulating data on that. 1236.07s - 1239.91s | It's a it's an 802.11 standard, just like Ethernet. 1240.27s - 1245.59s | So you can modulate the data on existing navigation and hazard lights. 1246.43s - 1249.67s | You could do the same thing on the light bar of an emergency vehicle. 1250.19s - 1255.59s | Lighthouses, you know, anything where you've got some sort of light, 1255.59s - 1258.47s | if you can modulate it fast enough, you can put data on it. 1258.83s - 1262.35s | And that is an active optical beacon, which. 1263.03s - 1267.79s | OK, cool. Active audio transponder. 1268.71s - 1273.15s | You that's like Amazon Echo or whatever, you talk to it and it talks back to you. 1273.79s - 1276.15s | Is there a use case? I don't know. 1276.15s - 1278.03s | And active audio beacon. 1278.03s - 1281.63s | So that's kind of like the optical one, right? 1281.63s - 1287.59s | You could modulate data onto an existing sound source, right? 1287.59s - 1293.99s | If that's a siren on a fire truck, for instance, you could modulate data onto that. 1294.95s - 1299.35s | You could do this at audible frequencies or above or below audible frequencies. 1300.79s - 1305.87s | You could do it steganographed into like background music, right? 1306.15s - 1307.83s | All kinds of cool tricks you can do with this. 1309.03s - 1313.83s | So we just run through a couple of interesting use cases that came out of, 1313.83s - 1316.59s | like all the use case interviews at the beginning of the process. 1316.91s - 1322.87s | So diplomatic pouches, this is one of the really obvious use cases. 1322.87s - 1327.15s | And there are obviously a lot of foreign ministries out there shipping stuff around. 1329.07s - 1330.47s | But let's talk through this. 1330.47s - 1334.35s | So the law says that you can't delay or inspect it. 1334.75s - 1338.15s | Right. Customs agent receives the diplomatic pouch. 1338.15s - 1340.67s | It comes in. It's in with a lot of other stuff. 1341.07s - 1343.31s | That one, they can't delay. 1343.51s - 1346.75s | It can't sit around there and they can't inspect it.


chunk_id: 199_chunk_23
chunk_text:
siren on a fire truck, for instance, you could modulate data onto that. 1294.95s - 1299.35s | You could do this at audible frequencies or above or below audible frequencies. 1300.79s - 1305.87s | You could do it steganographed into like background music, right? 1306.15s - 1307.83s | All kinds of cool tricks you can do with this. 1309.03s - 1313.83s | So we just run through a couple of interesting use cases that came out of, 1313.83s - 1316.59s | like all the use case interviews at the beginning of the process. 1316.91s - 1322.87s | So diplomatic pouches, this is one of the really obvious use cases. 1322.87s - 1327.15s | And there are obviously a lot of foreign ministries out there shipping stuff around. 1329.07s - 1330.47s | But let's talk through this. 1330.47s - 1334.35s | So the law says that you can't delay or inspect it. 1334.75s - 1338.15s | Right. Customs agent receives the diplomatic pouch. 1338.15s - 1340.67s | It comes in. It's in with a lot of other stuff. 1341.07s - 1343.31s | That one, they can't delay. 1343.51s - 1346.75s | It can't sit around there and they can't inspect it. 1346.95s - 1350.23s | They can look at the outside of it, but they can't open it up 1350.87s - 1353.59s | and they can't weigh it and they can't X-ray it. 1354.43s - 1355.51s | They're only allowed to look. 1356.63s - 1358.75s | Passive optical inspection of the outside. 1358.95s - 1364.31s | All right. So the problem here is that people smuggling contraband 1364.67s - 1368.83s | know this and can mark their crate diplomatic pouch, 1368.83s - 1370.79s | and that makes it illegal to inspect. 1370.79s - 1372.79s | And yet they are smuggling contraband. 1373.75s - 1376.75s | And they're not authorized by anybody due to that. 1376.75s - 1378.47s | That is inherently illegal. 1378.47s - 1380.87s | So the customs agent is in this dilemma. 1380.95s - 1381.79s | What do they do? 1381.79s - 1387.11s | They've got something marked diplomatic pouch, and yet it could contain contraband. 1387.35s - 1391.71s | So if they can scan something on that and cryptographically verify 1391.71s - 1395.27s | that it was shipped by the foreign ministry of Japan, 1395.91s - 1397.79s | it can be entirely full of cocaine. 1397.79s - 1399.51s


chunk_id: 199_chunk_24
chunk_text:
1346.95s - 1350.23s | They can look at the outside of it, but they can't open it up 1350.87s - 1353.59s | and they can't weigh it and they can't X-ray it. 1354.43s - 1355.51s | They're only allowed to look. 1356.63s - 1358.75s | Passive optical inspection of the outside. 1358.95s - 1364.31s | All right. So the problem here is that people smuggling contraband 1364.67s - 1368.83s | know this and can mark their crate diplomatic pouch, 1368.83s - 1370.79s | and that makes it illegal to inspect. 1370.79s - 1372.79s | And yet they are smuggling contraband. 1373.75s - 1376.75s | And they're not authorized by anybody due to that. 1376.75s - 1378.47s | That is inherently illegal. 1378.47s - 1380.87s | So the customs agent is in this dilemma. 1380.95s - 1381.79s | What do they do? 1381.79s - 1387.11s | They've got something marked diplomatic pouch, and yet it could contain contraband. 1387.35s - 1391.71s | So if they can scan something on that and cryptographically verify 1391.71s - 1395.27s | that it was shipped by the foreign ministry of Japan, 1395.91s - 1397.79s | it can be entirely full of cocaine. 1397.79s - 1399.51s | And it's not their problem. 1399.51s - 1401.31s | It's the foreign ministry of Japan's problem 1401.31s - 1404.07s | because it was under their authorization that it was shipped. 1404.43s - 1406.23s | And we haven't inspected it. 1406.23s - 1408.27s | We haven't looked inside. We haven't weighed it. 1408.27s - 1409.95s | We have no idea whether it's cocaine or not. 1409.95s - 1412.27s | Doesn't matter. Not our problem. 1412.27s - 1416.47s | On the other hand, we scan it and we get an invalid scan. 1416.95s - 1418.43s | Right. Doesn't validate. 1418.43s - 1421.11s | We can go to town on it, open it up, whatever, 1421.39s - 1424.07s | because it's not actually a diplomatic pouch at that point. 1424.47s - 1426.07s | That was a false marking. 1426.07s - 1428.07s | So we can't do that with physical marking. 1428.07s - 1429.67s | There's just no way to tell. 1429.67s - 1432.19s | We have to depend on all these other things, right? 1432.43s - 1435.35s | We have to get on the phone with the foreign ministry of Japan 1435.67s - 1439.15s | logistics people and hope that they also


chunk_id: 199_chunk_25
chunk_text:
| And it's not their problem. 1399.51s - 1401.31s | It's the foreign ministry of Japan's problem 1401.31s - 1404.07s | because it was under their authorization that it was shipped. 1404.43s - 1406.23s | And we haven't inspected it. 1406.23s - 1408.27s | We haven't looked inside. We haven't weighed it. 1408.27s - 1409.95s | We have no idea whether it's cocaine or not. 1409.95s - 1412.27s | Doesn't matter. Not our problem. 1412.27s - 1416.47s | On the other hand, we scan it and we get an invalid scan. 1416.95s - 1418.43s | Right. Doesn't validate. 1418.43s - 1421.11s | We can go to town on it, open it up, whatever, 1421.39s - 1424.07s | because it's not actually a diplomatic pouch at that point. 1424.47s - 1426.07s | That was a false marking. 1426.07s - 1428.07s | So we can't do that with physical marking. 1428.07s - 1429.67s | There's just no way to tell. 1429.67s - 1432.19s | We have to depend on all these other things, right? 1432.43s - 1435.35s | We have to get on the phone with the foreign ministry of Japan 1435.67s - 1439.15s | logistics people and hope that they also speak Swahili, right? 1440.11s - 1440.99s | Good luck. 1441.79s - 1444.11s | OK, so UNESCO. 1444.11s - 1447.79s | This was a really interesting one because we'd done all of these interviews 1447.79s - 1450.35s | with folks who wanted to attach a label to a thing. 1451.35s - 1454.39s | We get to UNESCO and they're like, yeah, we've got all these artworks 1454.39s - 1459.55s | to get shipped around between countries to, you know, exhibitions and stuff. 1459.55s - 1463.07s | And then we've got these buildings and we've got whole neighborhoods 1463.07s - 1464.51s | and so forth and neighborhoods. 1464.51s - 1465.23s | It's no big deal, right? 1465.23s - 1468.59s | Because you're just defining a polygon, right? 1468.59s - 1470.67s | Just like that airplane flight, right? 1470.67s - 1473.03s | We're defining a polygon and saying, yes, it's here now. 1473.03s - 1476.43s | It's been here and it will continue to be here in the future, we hope. Right. 1477.43s - 1479.27s | That's no problem. 1479.27s - 1482.59s | But the artworks, it turns out that like a double digit percentage 1482.59s - 1486.59s | of the artworks that


chunk_id: 199_chunk_26
chunk_text:
speak Swahili, right? 1440.11s - 1440.99s | Good luck. 1441.79s - 1444.11s | OK, so UNESCO. 1444.11s - 1447.79s | This was a really interesting one because we'd done all of these interviews 1447.79s - 1450.35s | with folks who wanted to attach a label to a thing. 1451.35s - 1454.39s | We get to UNESCO and they're like, yeah, we've got all these artworks 1454.39s - 1459.55s | to get shipped around between countries to, you know, exhibitions and stuff. 1459.55s - 1463.07s | And then we've got these buildings and we've got whole neighborhoods 1463.07s - 1464.51s | and so forth and neighborhoods. 1464.51s - 1465.23s | It's no big deal, right? 1465.23s - 1468.59s | Because you're just defining a polygon, right? 1468.59s - 1470.67s | Just like that airplane flight, right? 1470.67s - 1473.03s | We're defining a polygon and saying, yes, it's here now. 1473.03s - 1476.43s | It's been here and it will continue to be here in the future, we hope. Right. 1477.43s - 1479.27s | That's no problem. 1479.27s - 1482.59s | But the artworks, it turns out that like a double digit percentage 1482.59s - 1486.59s | of the artworks that are protected are in an unknown location 1486.71s - 1490.87s | because they got stolen out of a museum that the 1491.87s - 1496.11s | Mexican National Archaeology Museum in Mexico City 1496.11s - 1499.55s | that got knocked over in like ninety six, ninety eight back then, 1499.55s - 1502.31s | sometime a whole lot of that stuff still out in the wind. 1503.27s - 1505.87s | There's the Iraqi National Cultural Museum, 1506.27s - 1509.43s | thousands and thousands of pieces out there that were protected 1509.43s - 1511.91s | or, you know, out there somewhere. 1512.23s - 1516.95s | And so we need some way that a. 1518.23s - 1520.83s | Law enforcement officer that a 1523.87s - 1527.79s | auction house can check to see whether a thing 1528.15s - 1531.79s | that came out of somebody's attic is actually a protected 1531.79s - 1533.99s | cultural artifact that was stolen. 1534.63s - 1537.99s | And so what we need is a digital emblem 1538.23s - 1541.99s | that has a ton of external references to all the sort of known photographs 1541.99s - 1545.59s | and data about that thing so that somebody who gets


chunk_id: 199_chunk_27
chunk_text:
are protected are in an unknown location 1486.71s - 1490.87s | because they got stolen out of a museum that the 1491.87s - 1496.11s | Mexican National Archaeology Museum in Mexico City 1496.11s - 1499.55s | that got knocked over in like ninety six, ninety eight back then, 1499.55s - 1502.31s | sometime a whole lot of that stuff still out in the wind. 1503.27s - 1505.87s | There's the Iraqi National Cultural Museum, 1506.27s - 1509.43s | thousands and thousands of pieces out there that were protected 1509.43s - 1511.91s | or, you know, out there somewhere. 1512.23s - 1516.95s | And so we need some way that a. 1518.23s - 1520.83s | Law enforcement officer that a 1523.87s - 1527.79s | auction house can check to see whether a thing 1528.15s - 1531.79s | that came out of somebody's attic is actually a protected 1531.79s - 1533.99s | cultural artifact that was stolen. 1534.63s - 1537.99s | And so what we need is a digital emblem 1538.23s - 1541.99s | that has a ton of external references to all the sort of known photographs 1541.99s - 1545.59s | and data about that thing so that somebody who gets a hold of it 1545.59s - 1549.91s | can be reasonably expected to reassociate it with the emblem. 1550.15s - 1553.15s | So we've got a bunch of handling flags in there about like, 1553.15s - 1555.35s | is the location of the object known? 1555.35s - 1556.75s | Is the location of the emblem known? 1556.75s - 1558.27s | Are they in the same place? All that. 1559.83s - 1563.23s | Press press is interesting because we've we've talked about all these ones 1563.23s - 1567.71s | where there's some authority that is associated with the body of law 1568.03s - 1571.71s | or an authority that's allowed to ship something or whatever. Right. 1572.11s - 1574.31s | But who are press people? 1574.31s - 1577.83s | A press person is a person who's doing journalism 1578.35s - 1580.19s | and is a noncombatant. 1580.19s - 1582.27s | That's the definition of a press person. 1582.27s - 1583.83s | If they're a combatant, 1583.83s - 1587.55s | they no longer have the protections that a civilian would. 1589.15s - 1592.75s | They may be doing journalism as a job, but now they're a combatant, 1592.79s - 1594.79s | so


chunk_id: 199_chunk_28
chunk_text:
a hold of it 1545.59s - 1549.91s | can be reasonably expected to reassociate it with the emblem. 1550.15s - 1553.15s | So we've got a bunch of handling flags in there about like, 1553.15s - 1555.35s | is the location of the object known? 1555.35s - 1556.75s | Is the location of the emblem known? 1556.75s - 1558.27s | Are they in the same place? All that. 1559.83s - 1563.23s | Press press is interesting because we've we've talked about all these ones 1563.23s - 1567.71s | where there's some authority that is associated with the body of law 1568.03s - 1571.71s | or an authority that's allowed to ship something or whatever. Right. 1572.11s - 1574.31s | But who are press people? 1574.31s - 1577.83s | A press person is a person who's doing journalism 1578.35s - 1580.19s | and is a noncombatant. 1580.19s - 1582.27s | That's the definition of a press person. 1582.27s - 1583.83s | If they're a combatant, 1583.83s - 1587.55s | they no longer have the protections that a civilian would. 1589.15s - 1592.75s | They may be doing journalism as a job, but now they're a combatant, 1592.79s - 1594.79s | so they're not protected. 1595.43s - 1599.59s | But fundamentally, there's no central agency that says you're a journalist 1599.59s - 1600.55s | and you're not. 1600.55s - 1605.71s | So there's nobody that can say, you know, we're the authentic source of this. 1605.71s - 1610.19s | So we need a solution that journalists could do for themselves 1610.19s - 1615.19s | or INSEE or CPJ could do on behalf of 1616.03s - 1618.95s | journalists who are in dangerous situations. 1619.79s - 1625.59s | CITES, so CITES is the the treaty organization 1625.59s - 1629.43s | that oversees the body of law around endangered species. 1629.43s - 1633.19s | So plants and animals that are globally recognized as endangered 1633.71s - 1637.19s | all have to be shipped with all these markings any time they cross 1637.19s - 1639.11s | national borders. 1639.59s - 1641.83s | But if you've got an animal, 1642.19s - 1645.87s | it's really important that the handling be done properly. Right. 1645.91s - 1649.87s | So we've got to be able to communicate that in a fairly detailed way. 1650.11s - 1653.47s | And it's really important that the communications channel back work 1653.79s


chunk_id: 199_chunk_29
chunk_text:
they're not protected. 1595.43s - 1599.59s | But fundamentally, there's no central agency that says you're a journalist 1599.59s - 1600.55s | and you're not. 1600.55s - 1605.71s | So there's nobody that can say, you know, we're the authentic source of this. 1605.71s - 1610.19s | So we need a solution that journalists could do for themselves 1610.19s - 1615.19s | or INSEE or CPJ could do on behalf of 1616.03s - 1618.95s | journalists who are in dangerous situations. 1619.79s - 1625.59s | CITES, so CITES is the the treaty organization 1625.59s - 1629.43s | that oversees the body of law around endangered species. 1629.43s - 1633.19s | So plants and animals that are globally recognized as endangered 1633.71s - 1637.19s | all have to be shipped with all these markings any time they cross 1637.19s - 1639.11s | national borders. 1639.59s - 1641.83s | But if you've got an animal, 1642.19s - 1645.87s | it's really important that the handling be done properly. Right. 1645.91s - 1649.87s | So we've got to be able to communicate that in a fairly detailed way. 1650.11s - 1653.47s | And it's really important that the communications channel back work 1653.79s - 1657.15s | in case like the animal gets sick or whatever. Right. 1657.39s - 1658.39s | Same thing's true of plants. 1658.39s - 1661.67s | Of course, it's just a little bit less obvious. 1661.67s - 1665.07s | And then aviation, aviation is interesting, a little bit like press, right? 1665.39s - 1669.83s | You've got this no dual use thing where as long as there's no military 1669.83s - 1673.71s | use of the aircraft, it's not carrying munitions. 1673.75s - 1676.91s | It's not carrying troops, anything like that. 1677.19s - 1679.31s | It's protected as a civilian thing. 1679.31s - 1683.71s | And there's additional bodies of law under ICAO that that give it 1683.71s - 1686.71s | additional protections beyond just what a regular civilian would have. 1688.23s - 1690.35s | So we've got this question of 1690.79s - 1694.71s | whether there's any military use of that aircraft. 1695.79s - 1697.79s | But then there's also this interesting thing going on. 1699.59s - 1701.63s | Like if you talk with Airbus folks, 1702.63s - 1706.23s | they're starting to build RFID scanners into every opening 1706.23s - 1712.19s | in the hull of an


chunk_id: 199_chunk_30
chunk_text:
- 1657.15s | in case like the animal gets sick or whatever. Right. 1657.39s - 1658.39s | Same thing's true of plants. 1658.39s - 1661.67s | Of course, it's just a little bit less obvious. 1661.67s - 1665.07s | And then aviation, aviation is interesting, a little bit like press, right? 1665.39s - 1669.83s | You've got this no dual use thing where as long as there's no military 1669.83s - 1673.71s | use of the aircraft, it's not carrying munitions. 1673.75s - 1676.91s | It's not carrying troops, anything like that. 1677.19s - 1679.31s | It's protected as a civilian thing. 1679.31s - 1683.71s | And there's additional bodies of law under ICAO that that give it 1683.71s - 1686.71s | additional protections beyond just what a regular civilian would have. 1688.23s - 1690.35s | So we've got this question of 1690.79s - 1694.71s | whether there's any military use of that aircraft. 1695.79s - 1697.79s | But then there's also this interesting thing going on. 1699.59s - 1701.63s | Like if you talk with Airbus folks, 1702.63s - 1706.23s | they're starting to build RFID scanners into every opening 1706.23s - 1712.19s | in the hull of an aircraft so that they can automatically create 1712.19s - 1717.11s | a manifest of everything that's RFID tag that's going in and out of the aircraft. 1717.67s - 1723.07s | Now, their idea of why this is important largely has to do with spare parts. 1723.11s - 1727.83s | Right. So they've got these expert systems and reporting and so forth 1727.83s - 1730.51s | on the aircraft about failures. 1730.87s - 1734.87s | And the expert systems predict what spare parts are going to be necessary 1734.87s - 1735.99s | to repair that failure. 1735.99s - 1741.95s | So they're starting to do this manifest radio ahead thing where there's, 1742.43s - 1747.27s | you know, can be relayed on to the airport that they're going to land at. 1747.75s - 1751.31s | What parts the expert system thinks are going to be needed to turn 1751.31s - 1755.43s | the aircraft around and get it in the air again so that the logistics 1755.43s - 1759.27s | supply chain can get those parts to the gate with somebody qualified 1759.27s - 1762.27s | to install them before the plane even lands. 1762.27s - 1765.23s | Right. So they're


chunk_id: 199_chunk_31
chunk_text:
aircraft so that they can automatically create 1712.19s - 1717.11s | a manifest of everything that's RFID tag that's going in and out of the aircraft. 1717.67s - 1723.07s | Now, their idea of why this is important largely has to do with spare parts. 1723.11s - 1727.83s | Right. So they've got these expert systems and reporting and so forth 1727.83s - 1730.51s | on the aircraft about failures. 1730.87s - 1734.87s | And the expert systems predict what spare parts are going to be necessary 1734.87s - 1735.99s | to repair that failure. 1735.99s - 1741.95s | So they're starting to do this manifest radio ahead thing where there's, 1742.43s - 1747.27s | you know, can be relayed on to the airport that they're going to land at. 1747.75s - 1751.31s | What parts the expert system thinks are going to be needed to turn 1751.31s - 1755.43s | the aircraft around and get it in the air again so that the logistics 1755.43s - 1759.27s | supply chain can get those parts to the gate with somebody qualified 1759.27s - 1762.27s | to install them before the plane even lands. 1762.27s - 1765.23s | Right. So they're minimizing the downtime of the aircraft. 1767.79s - 1771.23s | But the thing is, if we've already scanned all these digital emblems 1771.23s - 1775.19s | that are in the hold, you know, people coming in as passengers and so forth, 1775.19s - 1778.31s | we can include that in that radio ahead manifest, 1778.55s - 1781.79s | and that can get split out to customs and immigration 1781.79s - 1784.55s | so that they know what the exception cases that are going to be coming 1784.99s - 1788.78s | into them off that aircraft are. 1788.78s - 1790.02s | So that was it. 1791.46s - 1794.30s | Plenty of time for questions, if you guys want. 1794.42s - 1797.98s | Got about 10 minutes again. 1797.98s - 1801.18s | It's this is a standards efforts happening in the ITF. 1803.30s - 1806.26s | Hypothetically, you could implement this a bunch of different ways. 1806.26s - 1807.94s | You can invent new stuff. 1807.94s - 1812.98s | But all the actual implementers at this point are doing it on top of DNS. 1813.02s - 1816.70s | So DNS, DNSSEC for the cryptographic signatures, 1817.02s - 1820.78s | DANE for the


chunk_id: 199_chunk_32
chunk_text:
minimizing the downtime of the aircraft. 1767.79s - 1771.23s | But the thing is, if we've already scanned all these digital emblems 1771.23s - 1775.19s | that are in the hold, you know, people coming in as passengers and so forth, 1775.19s - 1778.31s | we can include that in that radio ahead manifest, 1778.55s - 1781.79s | and that can get split out to customs and immigration 1781.79s - 1784.55s | so that they know what the exception cases that are going to be coming 1784.99s - 1788.78s | into them off that aircraft are. 1788.78s - 1790.02s | So that was it. 1791.46s - 1794.30s | Plenty of time for questions, if you guys want. 1794.42s - 1797.98s | Got about 10 minutes again. 1797.98s - 1801.18s | It's this is a standards efforts happening in the ITF. 1803.30s - 1806.26s | Hypothetically, you could implement this a bunch of different ways. 1806.26s - 1807.94s | You can invent new stuff. 1807.94s - 1812.98s | But all the actual implementers at this point are doing it on top of DNS. 1813.02s - 1816.70s | So DNS, DNSSEC for the cryptographic signatures, 1817.02s - 1820.78s | DANE for the certificates, and then DE on top of that, 1820.78s - 1823.82s | using existing record types almost exclusively. 1825.82s - 1829.10s | So if anybody has questions, come up to the front mic. 1833.74s - 1846.94s | QR codes and barcodes have like, you know. 1847.50s - 1849.06s | Hey, hang on just a sec. 1849.06s - 1853.39s | Can you guys hear him or is that mic on? 1853.39s - 1855.11s | Yeah. OK. 1855.11s - 1857.83s | Can you be loud because I'm I'm having a hard time. 1858.67s - 1860.63s | QR codes and barcodes have been done. 1860.67s - 1863.35s | Enough redundancy so they can play games with them. 1863.35s - 1866.15s | And you can, for instance, put, you know, readable, 1866.15s - 1869.99s | human readable text and pictures in them. 1870.43s - 1873.91s | And so it looks like it could be a nice way of, 1874.99s - 1878.07s | you know, putting labels that are both computer readable and 1879.27s - 1882.11s | readable to a human in the field. 1882.11s - 1884.87s | Has has that been discussed in this context? 1885.31s - 1890.59s | So the there are essentially


chunk_id: 199_chunk_33
chunk_text:
certificates, and then DE on top of that, 1820.78s - 1823.82s | using existing record types almost exclusively. 1825.82s - 1829.10s | So if anybody has questions, come up to the front mic. 1833.74s - 1846.94s | QR codes and barcodes have like, you know. 1847.50s - 1849.06s | Hey, hang on just a sec. 1849.06s - 1853.39s | Can you guys hear him or is that mic on? 1853.39s - 1855.11s | Yeah. OK. 1855.11s - 1857.83s | Can you be loud because I'm I'm having a hard time. 1858.67s - 1860.63s | QR codes and barcodes have been done. 1860.67s - 1863.35s | Enough redundancy so they can play games with them. 1863.35s - 1866.15s | And you can, for instance, put, you know, readable, 1866.15s - 1869.99s | human readable text and pictures in them. 1870.43s - 1873.91s | And so it looks like it could be a nice way of, 1874.99s - 1878.07s | you know, putting labels that are both computer readable and 1879.27s - 1882.11s | readable to a human in the field. 1882.11s - 1884.87s | Has has that been discussed in this context? 1885.31s - 1890.59s | So the there are essentially two ways that the digital emblem can get delivered. 1890.91s - 1893.83s | The main way is sort of like a website would be 1894.23s - 1896.71s | you're you're sort of reading the URL, the label. 1896.71s - 1899.39s | In this case, it's going to be a DNS label. 1899.39s - 1903.27s | And then you go do a lookup and you get the data and you evaluate the data. 1904.11s - 1907.39s | So you know where to get that data based on the label 1907.83s - 1910.35s | and you know what format to expect that data in. 1910.59s - 1913.47s | So that per se is not really going to be the issue, right? 1913.47s - 1916.99s | If you enter the right label, like if you have to retype it, 1917.79s - 1920.35s | you better not mistype. Sure. 1921.43s - 1925.75s | But the odds are, if you mistype, you're not going to get any sort of result. 1925.87s - 1928.63s | Right. You're not going to I mean, you get an error. Right. 1930.43s - 1936.31s | So with a QR code or a barcode or something or an RFID, 1938.31s -


chunk_id: 199_chunk_34
chunk_text:
two ways that the digital emblem can get delivered. 1890.91s - 1893.83s | The main way is sort of like a website would be 1894.23s - 1896.71s | you're you're sort of reading the URL, the label. 1896.71s - 1899.39s | In this case, it's going to be a DNS label. 1899.39s - 1903.27s | And then you go do a lookup and you get the data and you evaluate the data. 1904.11s - 1907.39s | So you know where to get that data based on the label 1907.83s - 1910.35s | and you know what format to expect that data in. 1910.59s - 1913.47s | So that per se is not really going to be the issue, right? 1913.47s - 1916.99s | If you enter the right label, like if you have to retype it, 1917.79s - 1920.35s | you better not mistype. Sure. 1921.43s - 1925.75s | But the odds are, if you mistype, you're not going to get any sort of result. 1925.87s - 1928.63s | Right. You're not going to I mean, you get an error. Right. 1930.43s - 1936.31s | So with a QR code or a barcode or something or an RFID, 1938.31s - 1942.11s | there's more of a potential for you scan something. 1942.11s - 1946.95s | But the human being doesn't really know what it is that they've just scanned. 1947.23s - 1951.99s | So, you know, somebody could affix a fake label over the real one 1951.99s - 1955.47s | or replace it or whatever and misdirect them to the wrong place. 1955.47s - 1959.23s | So that's where you start to get the need for the bindings. 1959.31s - 1962.59s | Right. The validator is an expert, right? 1962.59s - 1963.63s | They're a customs agent. 1963.63s - 1965.63s | They're trained to evaluate this stuff. 1966.27s - 1968.83s | Now you're just passing them more information. 1969.51s - 1973.07s | And with the higher expectation 1973.07s - 1976.19s | of of bandwidth there of more information, 1977.47s - 1981.39s | it's going to give them more tools to do that evaluation. Right. 1981.71s - 1986.91s | Whether the whether this is real or fake, 1987.31s - 1990.23s | there's a higher bandwidth channel for them to work with. 1990.79s - 1994.19s | So, you know, could you game it? 1994.19s - 1997.03s | Probably. They're always clever hackers.


chunk_id: 199_chunk_35
chunk_text:
1942.11s | there's more of a potential for you scan something. 1942.11s - 1946.95s | But the human being doesn't really know what it is that they've just scanned. 1947.23s - 1951.99s | So, you know, somebody could affix a fake label over the real one 1951.99s - 1955.47s | or replace it or whatever and misdirect them to the wrong place. 1955.47s - 1959.23s | So that's where you start to get the need for the bindings. 1959.31s - 1962.59s | Right. The validator is an expert, right? 1962.59s - 1963.63s | They're a customs agent. 1963.63s - 1965.63s | They're trained to evaluate this stuff. 1966.27s - 1968.83s | Now you're just passing them more information. 1969.51s - 1973.07s | And with the higher expectation 1973.07s - 1976.19s | of of bandwidth there of more information, 1977.47s - 1981.39s | it's going to give them more tools to do that evaluation. Right. 1981.71s - 1986.91s | Whether the whether this is real or fake, 1987.31s - 1990.23s | there's a higher bandwidth channel for them to work with. 1990.79s - 1994.19s | So, you know, could you game it? 1994.19s - 1997.03s | Probably. They're always clever hackers. 1997.03s - 2000.11s | But building on top of a lot of existing work 2000.47s - 2003.03s | that's already really well tested. 2004.03s - 2007.47s | You know, we're doing sort of the minimal new work possible. 2008.39s - 2011.59s | So you mentioned various encodings like MIME and such. 2011.59s - 2016.35s | It makes me think of X509 and the richness of metadata 2016.35s - 2019.87s | that can be represented in X509 for certificates. 2020.63s - 2025.87s | Do you see different use cases forcing extensions onto validators 2026.23s - 2029.87s | the way that descriptions are applied for other use cases? 2029.87s - 2031.87s | Right now, you're really focused on customs. 2031.87s - 2033.35s | Right. Customs officials. 2033.35s - 2038.75s | And this problem that you mentioned of proliferation of proprietary scanners. 2039.31s - 2040.67s | But what about like the U.S. 2040.67s - 2045.63s | Cybertrust label for IOT devices that has metadata about those IOT devices? 2046.03s - 2048.31s | Could that apply or would there be extensions? 2048.75s - 2054.71s | So in the IETF, the way the politics work, 2054.71s - 2058.87s | if you try and bite off


chunk_id: 199_chunk_36
chunk_text:
1997.03s - 2000.11s | But building on top of a lot of existing work 2000.47s - 2003.03s | that's already really well tested. 2004.03s - 2007.47s | You know, we're doing sort of the minimal new work possible. 2008.39s - 2011.59s | So you mentioned various encodings like MIME and such. 2011.59s - 2016.35s | It makes me think of X509 and the richness of metadata 2016.35s - 2019.87s | that can be represented in X509 for certificates. 2020.63s - 2025.87s | Do you see different use cases forcing extensions onto validators 2026.23s - 2029.87s | the way that descriptions are applied for other use cases? 2029.87s - 2031.87s | Right now, you're really focused on customs. 2031.87s - 2033.35s | Right. Customs officials. 2033.35s - 2038.75s | And this problem that you mentioned of proliferation of proprietary scanners. 2039.31s - 2040.67s | But what about like the U.S. 2040.67s - 2045.63s | Cybertrust label for IOT devices that has metadata about those IOT devices? 2046.03s - 2048.31s | Could that apply or would there be extensions? 2048.75s - 2054.71s | So in the IETF, the way the politics work, 2054.71s - 2058.87s | if you try and bite off something too large, it gets too many people's interest. 2059.11s - 2061.35s | And then they all show up with their opinions. 2061.63s - 2063.39s | And then nothing happens. 2063.39s - 2068.35s | And so the constraining this to markings 2068.35s - 2072.59s | required under international law is a constraint 2072.87s - 2076.19s | that keeps people who are 2078.63s - 2081.59s | interested in other things. 2081.59s - 2084.15s | Often their silo instead of in this silo 2085.39s - 2089.35s | or, you know, outside the tent, pissing out 2089.35s - 2092.59s | rather than inside the tent, pissing in or I don't know. 2093.79s - 2096.71s | But I mean, hypothetically, we get this work done. 2097.27s - 2101.27s | And, you know, there's self-driving cars out there. 2101.43s - 2105.39s | Wouldn't it be nice if the stoplight had a, you know, 2105.39s - 2108.51s | official authorized by the city of Oakland, California? 2108.79s - 2111.03s | You know, it's green right now. 2111.03s - 2114.11s | And, you know, two seconds later, it's orange. 2114.11s - 2116.11s | And two seconds after that, it's red. 2116.11s - 2117.95s | Whatever. Right. 2117.95s


chunk_id: 199_chunk_37
chunk_text:
something too large, it gets too many people's interest. 2059.11s - 2061.35s | And then they all show up with their opinions. 2061.63s - 2063.39s | And then nothing happens. 2063.39s - 2068.35s | And so the constraining this to markings 2068.35s - 2072.59s | required under international law is a constraint 2072.87s - 2076.19s | that keeps people who are 2078.63s - 2081.59s | interested in other things. 2081.59s - 2084.15s | Often their silo instead of in this silo 2085.39s - 2089.35s | or, you know, outside the tent, pissing out 2089.35s - 2092.59s | rather than inside the tent, pissing in or I don't know. 2093.79s - 2096.71s | But I mean, hypothetically, we get this work done. 2097.27s - 2101.27s | And, you know, there's self-driving cars out there. 2101.43s - 2105.39s | Wouldn't it be nice if the stoplight had a, you know, 2105.39s - 2108.51s | official authorized by the city of Oakland, California? 2108.79s - 2111.03s | You know, it's green right now. 2111.03s - 2114.11s | And, you know, two seconds later, it's orange. 2114.11s - 2116.11s | And two seconds after that, it's red. 2116.11s - 2117.95s | Whatever. Right. 2117.95s - 2123.23s | There are a zillion uses you can put something to once you have the tool. 2123.23s - 2126.67s | Right. Once you standardize the tool, you've got all the libraries, 2126.67s - 2129.39s | you've got all the open, you know, code. 2130.91s - 2132.03s | There's a lot you can do. 2132.03s - 2135.75s | So then then on the cryptographic side, you know, X509 and, you know, 2135.75s - 2139.91s | different kinds of of encryption and and signing. 2141.23s - 2144.91s | Again, we're trying to only add the little bit at the top, 2145.39s - 2147.47s | not do any new crypto. 2147.47s - 2150.43s | Right. All the crypto we're just inheriting out of DNSSEC. 2150.71s - 2153.55s | And there are a lot of people who care about DNS security. 2153.79s - 2158.99s | And a lot of people are working on, you know, post-quantum crypto for DNSSEC, 2159.91s - 2163.31s | you know, elliptic curves that are not ones recommended by the NSA. 2163.87s - 2165.75s | There's a lot of work going on there. 2165.75s - 2168.71s | And if we try and do all that also. 2168.71s -


chunk_id: 199_chunk_38
chunk_text:
- 2123.23s | There are a zillion uses you can put something to once you have the tool. 2123.23s - 2126.67s | Right. Once you standardize the tool, you've got all the libraries, 2126.67s - 2129.39s | you've got all the open, you know, code. 2130.91s - 2132.03s | There's a lot you can do. 2132.03s - 2135.75s | So then then on the cryptographic side, you know, X509 and, you know, 2135.75s - 2139.91s | different kinds of of encryption and and signing. 2141.23s - 2144.91s | Again, we're trying to only add the little bit at the top, 2145.39s - 2147.47s | not do any new crypto. 2147.47s - 2150.43s | Right. All the crypto we're just inheriting out of DNSSEC. 2150.71s - 2153.55s | And there are a lot of people who care about DNS security. 2153.79s - 2158.99s | And a lot of people are working on, you know, post-quantum crypto for DNSSEC, 2159.91s - 2163.31s | you know, elliptic curves that are not ones recommended by the NSA. 2163.87s - 2165.75s | There's a lot of work going on there. 2165.75s - 2168.71s | And if we try and do all that also. 2168.71s - 2170.95s | It's just going to make everything more complicated. 2170.95s - 2175.35s | One other thought or question on the loitering munition thing that you said, 2175.35s - 2177.67s | I immediately thought, well, 2177.67s - 2182.99s | someone's just going to mislabel their, you know, tank or other thing. 2182.99s - 2185.91s | But I think that goes to the visual description integrity or something 2186.11s - 2190.47s | there with with that and also the Hague piece that you mentioned 2190.67s - 2194.15s | that the physical binding, you know, only goes so far. 2194.15s - 2196.83s | Right. Like people will gain that. 2196.83s - 2198.15s | Yeah. Yeah. 2198.15s - 2202.27s | And one of the one of the things sorry, I didn't mention 2202.39s - 2207.51s | if you've got a delivery mechanism that can actually deliver a lot of data, 2207.51s - 2212.75s | like, you know, a big RFID can deliver, you know, many gigabytes of data. 2213.83s - 2217.75s | You can take the whole thing and cram it in there. 2218.23s - 2223.87s | And as long as the validator has cashed the root signatures, 2224.91s - 2227.59s | then


chunk_id: 199_chunk_39
chunk_text:
2170.95s | It's just going to make everything more complicated. 2170.95s - 2175.35s | One other thought or question on the loitering munition thing that you said, 2175.35s - 2177.67s | I immediately thought, well, 2177.67s - 2182.99s | someone's just going to mislabel their, you know, tank or other thing. 2182.99s - 2185.91s | But I think that goes to the visual description integrity or something 2186.11s - 2190.47s | there with with that and also the Hague piece that you mentioned 2190.67s - 2194.15s | that the physical binding, you know, only goes so far. 2194.15s - 2196.83s | Right. Like people will gain that. 2196.83s - 2198.15s | Yeah. Yeah. 2198.15s - 2202.27s | And one of the one of the things sorry, I didn't mention 2202.39s - 2207.51s | if you've got a delivery mechanism that can actually deliver a lot of data, 2207.51s - 2212.75s | like, you know, a big RFID can deliver, you know, many gigabytes of data. 2213.83s - 2217.75s | You can take the whole thing and cram it in there. 2218.23s - 2223.87s | And as long as the validator has cashed the root signatures, 2224.91s - 2227.59s | then they can validate everything you hand them 2227.99s - 2232.43s | based on following that signature chain, starting just with the root signature. 2232.87s - 2234.75s | So you can do offline validation. 2234.75s - 2237.27s | You don't need to be, you know, on the network. 2237.27s - 2241.55s | So there there are a lot of people get very hung up on the military use cases 2241.55s - 2243.55s | because they're kind of cool and fun. 2243.55s - 2249.19s | And so a lot of people worry about covert inspection, right? 2249.19s - 2252.75s | They want to be able to look at one of these things 2252.75s - 2256.39s | without alerting anybody that they're looking and to do the validation 2256.39s - 2258.43s | without alerting anybody that they're validating 2258.43s - 2261.59s | because they don't want to warn people that they're about to attack something. 2261.95s - 2267.11s | And so, you know, doing it this way gives you all of that already for free. 2267.11s - 2270.75s | Right. Because you can hand over that data, 2270.95s - 2274.55s | you know, on a beacon or whatever. 2275.55s - 2279.03s | They


chunk_id: 199_chunk_40
chunk_text:
they can validate everything you hand them 2227.99s - 2232.43s | based on following that signature chain, starting just with the root signature. 2232.87s - 2234.75s | So you can do offline validation. 2234.75s - 2237.27s | You don't need to be, you know, on the network. 2237.27s - 2241.55s | So there there are a lot of people get very hung up on the military use cases 2241.55s - 2243.55s | because they're kind of cool and fun. 2243.55s - 2249.19s | And so a lot of people worry about covert inspection, right? 2249.19s - 2252.75s | They want to be able to look at one of these things 2252.75s - 2256.39s | without alerting anybody that they're looking and to do the validation 2256.39s - 2258.43s | without alerting anybody that they're validating 2258.43s - 2261.59s | because they don't want to warn people that they're about to attack something. 2261.95s - 2267.11s | And so, you know, doing it this way gives you all of that already for free. 2267.11s - 2270.75s | Right. Because you can hand over that data, 2270.95s - 2274.55s | you know, on a beacon or whatever. 2275.55s - 2279.03s | They can validate it using a single cash signature. 2280.19s - 2282.55s | It's it's pretty robust. 2282.79s - 2285.19s | I'm not sure if that covered your question, because honestly, 2285.19s - 2288.35s | I can't actually hear more of the military use case. 2288.35s - 2291.95s | And the first point that you said, it's a reiteration of your first 2291.95s - 2297.15s | first point, basically, that it does nothing to honor the physical binding. 2297.63s - 2301.35s | But military, you can gain the system because the crime 2301.35s - 2306.03s | mislabel things in adversarial scenarios is where I was. 2306.07s - 2308.07s | I think my brain was gone. 2308.07s - 2309.59s | We can tell you what. Yeah. 2309.59s - 2313.91s | Catch me after because I honestly can't hear a damn thing. Sorry. 2314.91s - 2318.11s | And we're. Within a couple of minutes, 2318.11s - 2321.87s | without a time right now, if there's one last question 2321.87s - 2324.55s | and somebody can say it really loudly, we can do it. 2324.59s - 2327.91s | Otherwise, let's call it. 2329.55s - 2331.47s | Done a little bit early. 2331.59s - 2334.07s


chunk_id: 199_chunk_41
chunk_text:
can validate it using a single cash signature. 2280.19s - 2282.55s | It's it's pretty robust. 2282.79s - 2285.19s | I'm not sure if that covered your question, because honestly, 2285.19s - 2288.35s | I can't actually hear more of the military use case. 2288.35s - 2291.95s | And the first point that you said, it's a reiteration of your first 2291.95s - 2297.15s | first point, basically, that it does nothing to honor the physical binding. 2297.63s - 2301.35s | But military, you can gain the system because the crime 2301.35s - 2306.03s | mislabel things in adversarial scenarios is where I was. 2306.07s - 2308.07s | I think my brain was gone. 2308.07s - 2309.59s | We can tell you what. Yeah. 2309.59s - 2313.91s | Catch me after because I honestly can't hear a damn thing. Sorry. 2314.91s - 2318.11s | And we're. Within a couple of minutes, 2318.11s - 2321.87s | without a time right now, if there's one last question 2321.87s - 2324.55s | and somebody can say it really loudly, we can do it. 2324.59s - 2327.91s | Otherwise, let's call it. 2329.55s - 2331.47s | Done a little bit early. 2331.59s - 2334.07s | All right. Well, thank you all very, very much. 2335.19s - 2339.39s | I guess you can see up there the URLs for the IETF documents. 2340.43s - 2340.87s | Take care.


chunk_id: 199_chunk_42
chunk_text:
| All right. Well, thank you all very, very much. 2335.19s - 2339.39s | I guess you can see up there the URLs for the IETF documents. 2340.43s - 2340.87s | Take care.


chunk_id: 200_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=H-bhmSwnRdY", "title": "DEF CON 32 - Exploiting the Unexploitable Insights from the Kibana Bug Bounty - Mikhail Shcherbakov", "description": "We explore case studies of exploiting vulnerabilities in modern JavaScript and TypeScript applications, drawing on experiences from participating in the Kibana Bug Bounty Program. It's not uncommon to encounter a vulnerability that appears unexploitable at first glance, or to be told by a triage team that the behavior is \"by design.\" So, what options does a security researcher have in such situations? And what primitives can be utilized to construct an exploitation chain with significant impact?\n\nOur study involves breaking out of properly isolated containers in scenarios where there is RCE-by-design. We will examine several Prototype Pollutions that crash an application in less than one second after exploitation and explore how these vulnerabilities can ultimately lead to critical RCEs. Furthermore, we introduce new primitives and gadgets that enable the achievement of RCE from Prototype Pollutions previously deemed unexploitable beyond DoS attacks.\n\nBy highlighting these methods, the talk aims to equip attendees with advanced techniques for exploiting complex vulnerability chains in JavaScript applications, as well as recommendations for proper defense and mitigations against them.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2750, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.00s | This text was transcribed using whisper model: large-v2 My name is Mikhail Shcherbakov, and today I want to tell you a few stories about Kibana bug bounty. 8.00s - 14.00s | This first part of the talk is about vulnerabilities that I found in Kibana, 14.00s - 23.00s | and I combined only remote code execution vulnerabilities in this talk, just because of time limits. 23.00s - 27.00s | A few words about me. 27.00s - 33.00s | Now I am finishing my PhD studies at KTH University Stockholm, 33.00s - 41.00s | and working on the thesis Code Reuse Attacks in Managed Programming Languages and Runtimes. 41.00s - 52.00s | My main research interests are static code analysis, dynamic program analysis, and language-based security in general. 52.00s - 62.00s | I participated in bug bounty programs of Microsoft, GitHub, some open source projects, and Elastic. 62.00s - 71.00s | Today we will talk about Elastic bug bounty program, namely Kibana bug bounty program. 71.00s - 73.00s | Who is Kibana? 73.00s - 84.00s | Kibana is a part of popular ILCA stack that includes Elasticsearch, Logstash, and Kibana. 84.00s - 92.00s |


