# Media

url: https://www.youtube.com/watch?v=-ad-Y18pY54
title: DEF CON 32 - You got a lighter I need to do some Electroporation - J. Utley, P. Rhodes, J. Hill
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=-ad-Y18pY54",
  "title": "DEF CON 32 - You got a lighter  I need to do some Electroporation  - J. Utley, P. Rhodes, J. Hill",
  "description": "Biological warfare is a phenomenon that spans human history, tracing its roots to ancient times rather than being a recent invention. To gain insights into bioweapons' current and future landscape, it is imperative to look into historical examples of conventional biological warfare and understand how methods were devised and implemented. Our future hinges significantly on our ability to foster transparency and creativity within the global community. This optimism is intertwined with our comprehension of technological advancements, the rapid pace of innovation, the interconnectedness of various domains, and the imperative task of constructing practical defenses against emerging threats. As a poignant reminder, our vulnerability lies in technological shortcomings and our collective failure of imagination. This discourse extends to establishing social norms and mores that are pivotal in shaping attitudes toward biological warfare and encompasses an exploration of prospective research endeavors and emerging initiatives leveraging artificial intelligence (AI) in the realm of bioweaponry. As we confront the intricate interplay between technological advancements and human agency, it is imperative to remain vigilant and resolute in our pursuit of a future safeguarded against the malevolent exploitation of biological agents.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1634,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.52s | This text was transcribed using whisper model: large-v2

 welcome uh welcome to our talk uh it's titled hey bro you got a lighter i need to do some
5.52s - 11.60s |  electroporation so the first warning is on the defcon website it's mentioned that it's like
11.60s - 17.04s |  about a bio weapon under the description that is not what this talk is about i don't know why i
17.04s - 22.88s |  didn't get fixed but so we'll start with saying that this device that uh we're about ready to
22.88s - 31.57s |  show you should not be used as a bio weapon okay cool moving on um all right so for those that
31.57s - 38.13s |  don't know me my name is dr james utley i have a phd in health science i do kind of a lot of
38.13s - 44.77s |  things in the bio so i'm a i guess i'm a biohacker doubling as a professional scientist and i'll just
44.77s - 48.21s |  go through this real quick so you know that i'm not some yahoo that doesn't know what he's kind
48.21s - 55.17s |  of talking about but i think that title of being a yay who is kind of cooler anyway so anyway first
55.17s - 60.45s |  off is i have the honor and the privilege of being a chief scientific officer at a at a
60.45s - 68.05s |  regenerative medicine stem cell clinic in panama which where i live so whoo go origins we uh that's
68.05s - 75.33s |  my that's my day job i also we're flying today under the flag of viva securus which is myself
75.33s - 81.89s |  phil roads and josh hill otherwise known as the post-6 ninja he couldn't make it here today but
81.89s - 86.05s |  he is a mystical creature that has fueled some of the greatness behind our company for sure
87.01s - 92.13s |  and then uh lastly as i have uh folks here from a biohacker collective we have here in las vegas
92.13s - 99.57s |  called syndicate laboratories it's uh yeah we're a shout out it's a homage to the the yt cracker
99.57s - 107.81s |  album for any of those who didn't get that anyway so uh phil philism is the master of many talents
107.81s - 115.97s |  here uh pentester and i don't know if there is truly like this find a fed type uh but anyway
115.97s - 122.69s |  here's one um meaning he's in the navy so who could go navy all right so yeah you can grab the
122.69s - 127.57s |  contacts there from the qr hopefully people can get them yeah all right moving on let's get into
127.57s - 134.61s |  uh oh yes i want to apologize in advance like i don't mean to offend anyone here on this uh this
134.61s - 140.21s |  talk of like what we're gonna you know but it has been infected with like dad jokes and just just
141.01s - 148.45s |  just some fuckery and i uh so be warned if you want me to say earmuffs beforehand i can but
148.45s - 153.73s |  we're making this we kind of like we're thinking like hey are we overusing memes and then we're
153.73s - 159.89s |  like no no let's just let's just go with it right and uh so you'll see anyway moving on
161.73s - 168.05s |  so this is where we're going to start uh so where this all started here is this is what we're we've
168.05s - 174.53s |  developed you know what we've kind of like take the next generation of is is from an electro pen
174.53s - 180.29s |  right so you see some of these like university students here that put together an electroporation
180.29s - 186.21s |  device and we'll kind of get into like we're trying to keep this talk like very kind of simple
186.21s - 192.85s |  and easy to digest and so um but anyway this is where it started and these college kids did a
192.85s - 201.57s |  great job of like really uh taking this barbecue lighter um and then electroporating uh or in
201.57s - 207.73s |  trans transfecting some uh some dna from extracellular to inside the cell and that's what
207.73s - 214.69s |  this that's what this talk is because we took their study and we uh made the next i mean basically
214.69s - 221.25s |  it's an easier device to assemble in my in my opinion um but the key take-home point here is that
222.93s - 229.17s |  we want to stress that like the there's the potential for to democratize science using
229.17s - 236.29s |  frugal tools and that's really what kind of this whole thing is about is that you the people can
236.29s - 239.73s |  learn about these techniques whether it's genetic engineering whether it's you know science in
239.73s - 246.05s |  general um however however you like be able to to learn it from the comfort of your own home
247.97s - 254.50s |  anyway moving on and yeah i guess i kind of started that i started my rant already right
254.50s - 259.06s |  so we just like you know the access to electroporation technology or genetic engineering
259.06s - 265.14s |  that you can uh you know the sky's the limit and you know and kind of like what is your imagination
265.14s - 271.14s |  and how to uh you know transfect cells or genetic engineering and this is just one way to do it and
271.14s - 278.18s |  it allows that like those the people can then uh you know identify like what uh you know that they
278.18s - 283.94s |  have the the skills and the resources and the know-how to do these type of experiments and it
283.94s - 291.30s |  doesn't have to be confined by fancy instruments or you know big pharma or you know or academia
291.30s - 297.38s |  just kind of like locking it up you know science is for everyone so this is just one example
298.66s - 303.78s |  now some of this stuff is already done in biohacker labs that are you know out throughout
303.78s - 309.54s |  the community and you know i i really uh i really appreciate that community and that's why
309.54s - 315.22s |  i try to invest my time and my effort into into the biohacker community meaning like the genetic
315.22s - 320.42s |  engineer diy bio those folks because it's important i know i've noticed over like the
320.42s - 325.62s |  last five years that they just become like less uh i guess maybe less organized or maybe less
325.62s - 331.54s |  prevalent and so if you uh if you have a curiosity for science then you know find a community and
331.54s - 340.83s |  join it so for sure okay now this is a little bit of a the detour here but it's all in the same
340.83s - 346.99s |  row so so so bear with me here transfection is actually what we're trying to do through
346.99s - 353.63s |  electroporation so we're trying to use electricity to develop a pore in a cell to then insert from
353.63s - 360.43s |  an extracellular maybe that's a dna or rna into the cell to hijack uh you know hijack the machinery
360.43s - 370.35s |  and or uh express a different protein now because i am a one a big nicholas cage fan and i like the
370.35s - 376.35s |  the fact of i like electroporation this presentation has been transfected with
376.35s - 381.79s |  nicholas cage memes and so if you see it's a process used in genetic engineering you know
381.79s - 389.71s |  from foreign into the cell so the challenge is here when we get to the end um that there is a
390.27s - 397.15s |  number of nicholas cage memes and or references and or uh and i'll i'll give you one hard one but
397.15s - 401.15s |  at the end we'll see uh we'll see if every you know we have a last slide here that will
401.79s - 408.75s |  that we can see uh how many how many nicholas cage references we have seen and i will also agree that
409.31s - 417.07s |  nicholas cage's face on things is the best thing i've ever looked up so okay all right and again
417.07s - 422.11s |  i'm sorry i'm sorry that you chose this session because there's uh some some some terrible memes
422.11s - 427.87s |  and dad jokes anyway this was so how this all started for me personally is that i realized
427.87s - 432.27s |  from that paper that you could use a lighter to it's not for smoking it's for electroporation
432.27s - 439.79s |  poration and so i wrote this like really cringy type sub stack post uh some years ago and with
439.79s - 446.19s |  that we're like okay well let's see if we can fucking do this thing for real and that's where
446.19s - 451.15s |  it kind of all started um so welcome to the biovault revolution you didn't know that you
451.15s - 456.51s |  were attending this talk and it's a you know a low-cost portable electroporator which just means
456.51s - 460.91s |  it's a barbecue lighter and maybe phil you want to show like what the device looks like
461.63s - 468.83s |  and it's you know inspired by a barbecue lighter or the pzt or the piezoelectric effect of a of a
468.83s - 474.75s |  light of a lighter to start a barbecue and it's meant to you know bring synthetic biology to the
474.75s - 481.55s |  masses okay so electroporation 101 and i'm sorry i'm going through this fast because we only have
481.55s - 487.95s |  a limited amount of time so it's a technique to deliver molecules you know dna into cells right
487.95s - 493.23s |  and it uses electropulses right which is the clicking of the lighter to create a pore which
493.23s - 498.35s |  then uh it then it will enter so sometimes when you're like when you're trying to select
499.39s - 502.83s |  you're trying to select what you want to electroporate or trans infect
503.55s - 508.67s |  uh you get kind of confused like this is what's what's right you know dna rna or whatever but
508.67s - 514.91s |  that's part of the uh that's part of the journey here because this is really part one of really
514.91s - 521.23s |  three phases of a project part one meaning that this is the tool and we're going to try to show
521.23s - 527.47s |  you how we can provide some reproducibility on the tool to electroporate or at um and then step
527.47s - 532.03s |  two is really the plasmid selection like what do you want to put inside the cell and then the last
532.03s - 539.31s |  part is like recovery and counting which we'll kind of gloss over at the end okay electroporation
539.31s - 544.03s |  101 so the first thing to start with is it's not easy it's really difficult to do it in a diy
544.03s - 550.03s |  environment it is really difficult and so it's really carefully uh hinged on parameters like
550.03s - 556.75s |  optimizing those parameters which means like the gap the amount of uh you know trigger the pulse
556.75s - 563.55s |  and those type of things and uh so the electric field the ionic composition of the the fluid in
563.55s - 569.71s |  which you're putting your dna with to transfect the cells in which you which you you have chosen
570.35s - 575.63s |  um so it's actually really it's actually really difficult difficult so as you know if you take
575.63s - 580.11s |  this home and you want to do it just know that it's very very hard um but it's not possible and
580.11s - 586.51s |  you see here i've got like a little picture of the cuvette we call it the cuvette and it has a
586.51s - 593.15s |  microfluidic well which you kind of develop and through the pulsing it provides some electricity
594.03s - 601.47s |  and that's that's that right so again we're going to talk about we're going to talk about how we're
601.47s - 608.11s |  taking a nucleic acid sequence and we're trying to take it from extracellular and put it inside the
608.11s - 614.67s |  cell and i will this is my the freebie here if you look at the nucleus of this meme here um nucleus
614.67s - 623.12s |  cage i don't know hopefully somebody finds that funny moving on okay so another breakdown here
624.64s - 630.48s |  you know you have like this plasmid right so you have like your fluid in which you're
630.48s - 635.60s |  and i guess i i should say that pbs or phosphate buffered saline is really good
636.24s - 641.92s |  um and you want to you want to add your dna and what you've chosen right um with this with
641.92s - 647.28s |  your cells and give it a good pulse you'll see on the right hand side and by doing so it opens up a
647.28s - 654.64s |  pore and that plasmid will then uh become intracellular that's the ultimate goal that's
654.64s - 664.51s |  what you're trying to do um and yeah so why are we doing this we're why are we doing this is because
665.39s - 670.51s |  you know we're all part banana and some of us are part you know if you ever and the broader
670.51s - 676.59s |  point is that if you want to learn about this to make yourself a nicholas cage hybrid banana
677.15s - 680.99s |  like you should be able to right nobody should tell you you can't do that so
681.87s - 689.92s |  you know that's the uh that's the that's the essence there okay so spoiler alert the device
689.92s - 696.80s |  is really ugly and you'll see on the left hand side of this slide there you see it's just a
696.80s - 704.32s |  barbecue lighter and it has the trigger which is the uh the pzt effect and we've kind of like
704.32s - 709.44s |  optimized it and if you were ever wanted to look back at the college kids that did this before
710.08s - 715.36s |  they 3d printed this nice housing environment that had some wires that kind of delivered
716.00s - 721.84s |  but it was definitely difficult to to like you know uh to make contact with the cuvette and
721.84s - 727.04s |  really it's about like the consistency of the fluid the micro the microfluidic well
727.04s - 732.96s |  or a channel if you will um and the cuvette that really kind of makes a difference um you'll see
732.96s - 737.92s |  there's some other equipment of course this is a pipette um and then on the right hand side there
737.92s - 743.36s |  was like some crazy ideas like okay if i'm going to put a i'm going to try to have it migrate down
743.36s - 750.32s |  a microfluidic well and then kind of aggregate there and then uh then zap it there uh no did
750.32s - 755.68s |  not really work because it just killed cells which we'll talk about later um okay moving on
757.04s - 759.76s |  because it's so ugly you know maybe it's the greatest threat to world peace
760.40s - 767.52s |  okay light laugh no okay all right all right we're moving on um we were had this like running joke
767.52s - 771.28s |  about this full body electroporation i don't know if this movie is going to give us if this will
771.28s - 778.24s |  give us sounds but it's like okay let's what's oh all right okay and there's no sound but you
778.24s - 786.48s |  can outplay as luigi again i i already apologized up front um okay yeah but back to back to it yes
786.48s - 794.72s |  this is still a very ugly device and um but it's cheap that's the uh that's the part it's uh it's
794.72s - 800.08s |  cheap to make and you can make it at your home it's very crude um and you can get all these these
800.08s - 805.76s |  items here um i don't know phil let's see we didn't we don't have the heat shrink well wire
805.76s - 811.68s |  insulator but that's like duct tape or a electrical tape the aluminum tape is kind of a conductive
811.68s - 818.88s |  material um that you want to put over the magnets there's a roll of adhesive magnets there that we
818.88s - 824.32s |  kind of stack and that kind of makes that field and then you have the the aluminum overlay that
824.32s - 830.08s |  kind of is a conductive material to make the cuvette and then it's like nine volt battery
830.08s - 836.72s |  kind of a and it doesn't travel very well i'll say that um they're kind of wondering like what
836.72s - 842.80s |  the fuck is that um because i live in panama i travel here so anyway um so we made some more
842.80s - 847.36s |  devices when we got back but it's definitely cheaper than uh and we'll see if this lands
847.36s - 851.12s |  we'll see if this joke lands it's definitely more than the ten dollar uber eats card you
851.12s - 858.16s |  receive because of the crowd strike windows outage nobody nobody yeah okay good it landed it
858.16s - 872.46s |  landed it already expired wow okay so i'm glad the joke landed there because yeah okay uh again
872.46s - 877.34s |  i guess we kind of kind of talked on this at one point here on this slide is this smart glass bio
877.34s - 882.06s |  interface which is a really cool name for a microscope slide they seem to work uh well
882.06s - 887.02s |  when you're trying to develop the arc gap so yeah just a standard microscope
888.54s - 896.94s |  okay uh and you know as so the point here is to kind of like iterate on do you know find crazy
896.94s - 901.98s |  devices and as long as you can insert this pzt crystal or the pzeo electric crystal
902.62s - 909.34s |  uh effect then you could essentially make it an electroporator and i was using superglue to
909.34s - 912.54s |  like develop part of the device and i was like hey you know what i'm gonna use this like
912.54s - 917.18s |  superglue casing to make another one and i put a little washer there and then that red cap
917.18s - 922.78s |  became like the spring and i was like okay this will do it you know um anyway the point is like
922.78s - 931.50s |  you know use your imagination um but the pro tip is that the the bic lighters they suck you know
931.50s - 936.14s |  they're probably great lighters but when you're trying to do that trying to make an electroporator
936.14s - 941.98s |  from from the device they suck we they suck so bad that we took a part two and we're like okay
941.98s - 946.62s |  can we put this thing you know make it a device and then we're like i don't think so and then we
946.62s - 950.22s |  were so genius that we're like you know what we should need to do we need to get another one
950.22s - 955.34s |  and fail for the third time and we did we did in that so pro tip bic lighters suck
956.94s - 961.10s |  um again you know i've like talked about this like it's the power of the voltage
961.74s - 969.74s |  um the piezoelectric effect from the crystal here right and it's uh you'll see this next
969.74s - 976.70s |  couple slides of how how firing is it important important i took this uh one of the words from the
976.70s - 981.98s |  from the college kids that first did this electropen and they said it's very reliable
982.70s - 986.70s |  you know and i'm like okay so there's fair reproducibility which we'll get into
987.26s - 990.86s |  um but that's it you're trying to get over around this like 2 000 volts
992.78s - 998.78s |  um this is actually a little close whoa extreme close-up
1000.54s - 1004.70s |  um okay well here's another and here's another aspect or an important part
1005.42s - 1011.18s |  of of the assembly here which is the cuvette or we were calling it earlier the bio interface
1012.14s - 1018.46s |  and it's if you show that fill you'll see that it's aluminum tape wrapped around it some adhesive
1018.46s - 1025.34s |  magnets on top of some glass pretty crude pretty awesome and in the center picture here these are
1025.34s - 1032.22s |  kind of like some weird configurations i was like hey you know what let's try to adjust the arc gap
1032.22s - 1037.58s |  which which you'll see or let's try to develop a well let's see what works the best you know
1037.58s - 1044.38s |  they were trying to contain me but in a cage made of necklace um and this is the arc gap which i
1044.38s - 1049.58s |  think i'd say at this when you're developing this device or building this device that actually is
1049.58s - 1056.22s |  kind of the most important part and it it is size does matter so most of the literature around
1056.22s - 1063.02s |  electroporation on like a like a like a no shit commercial device is around the one millimeter
1063.02s - 1070.86s |  arc gap um so you see that but we used two really scientific indexes to kind of mess with the gap
1070.86s - 1078.54s |  the first one being the post-it note index so if you take the post-it notes at around 10 or
1078.54s - 1084.14s |  five and fold them in half it gives you kind of a start but then we went we're like hey you know
1084.14s - 1090.70s |  what this is vegas and we need uh another method which is the playing card index so if you start
1090.70s - 1095.34s |  with five playing cards gives you that nice gap but if you want to extend it out to two millimeters
1095.34s - 1102.46s |  just add an extra playing card before while you're while you're yeah when you're uh as you're
1102.46s - 1107.42s |  developing this the the point is you know try it you know mess with it because it is important
1108.14s - 1115.58s |  on uh on zapping these cells and what lighter is the best we found that it's the scripto
1115.58s - 1126.91s |  aim and flame it's fire yes follow them on facebook all right now this is where myself and
1126.91s - 1133.15s |  phil decided to get a little crazy in terms of testing we wanted to look at what these college
1133.15s - 1136.91s |  kids did in their study and then it's like hey let's see if we can kind of reproduce something
1136.91s - 1144.67s |  or provide some scientific value to this and um but as it says on the slide i'm not a crystal
1144.67s - 1151.23s |  wizard or an electrician so you know but the short of it is we zap this thing with a high voltage
1151.23s - 1157.79s |  multimeter and we were getting some reproducibility but it looks like we have uh each fire is two
1157.79s - 1162.59s |  seconds in between and then we waited two minutes and if you can see that you know you don't have
1162.59s - 1167.55s |  to be a genius to see kind of a pattern here that two clicks is good then it drops off right so it
1167.55s - 1173.87s |  kind of decays which has some correlation with what's on the left hand side even though there
1173.87s - 1180.51s |  is a lot of different lighters here and this voltage curve which uh anyway so there's some
1180.51s - 1186.91s |  reproducibility is the point moving on here's the was the raw data so you know that uh it's not just
1186.91s - 1193.39s |  a terrible color chart and then we have this other setting on the multimeter called resistance
1193.39s - 1199.23s |  and again we're not crystal wizards or electricians so we're like hey let's try to hook this thing up
1199.23s - 1204.27s |  and see what the resistance looks like meaning that we can provide reproducibility and sure
1204.27s - 1210.03s |  enough we did it has this nice nice curve there so because we're trying to answer the question
1210.03s - 1214.83s |  is this device does it have some reliability that then you can control the other variables
1214.83s - 1220.51s |  to actually get the dna or the rna inside the cell and so we're saying yes all right now we're
1220.51s - 1226.67s |  going to play this video real quick because i'm running out of time and this is my office here in
1226.67s - 1235.31s |  panama in my biohacker lab anyway here's a device phil shows it it's a click click click
1236.99s - 1239.95s |  i'm gonna fast forward here just a little bit
1241.23s - 1244.83s |  and then you hook that guy up the cuvette and if you really want to
1246.99s - 1251.15s |  well again it's hard to do and there's a lot of trial and error but you can kind of pre-chill
1251.15s - 1256.11s |  that cuvette cuvette so then when you're adding your plasmid or your electrocompetent cells
1256.83s - 1260.11s |  then it uh you're trying to reduce the amount of cell death that you're
1260.83s - 1269.60s |  you know you're the creator of death death of cells um all right so we're gonna yeah okay you
1269.60s - 1274.80s |  put that's where you're gonna put the the fluid the stuff the dna the cells and the phosphate
1274.80s - 1281.28s |  buffered saline and while i'm going through this i'll oh i have a look i also have a little note
1281.28s - 1288.08s |  card because there was things i didn't want to miss around this part which is they you know
1288.08s - 1292.88s |  there's a recommended 2.5 microliters of dna like that's kind of the max if you do more of that and
1292.88s - 1298.96s |  in terms of plasma generation uh it's not very efficient you can use pbs and or sterile water
1298.96s - 1303.68s |  but if you have like contaminants then it kind of messes with uh it'll mess with the the
1303.68s - 1310.32s |  electroporation uh transformation effect uh you're going to kill a lot of cells so this is on this
1310.32s - 1316.48s |  video this is where i'm i'm uh uh providing the inoculum or um the plasmid in through the
1316.48s - 1323.44s |  microfluidic well and and then i'm gonna buzz it okay good video over but the take-home point here
1323.44s - 1330.64s |  is to make sure that you know that you're going to be killing a lot of cells so um and that's just
1330.64s - 1335.04s |  that's just the nature of electroporation i think the literature supports that like between 50 and
1335.04s - 1341.12s |  70 percent of cells are destroyed in this process on these with uh electroporator devices
1343.20s - 1349.28s |  and but uh but you're going to because these it's kind of a more uncontrolled if you will
1349.28s - 1354.88s |  you're going to provide a lot of cell death okay so transformation why what are some things that
1354.88s - 1361.44s |  you can test this guy on you can use ecolite electrocompetent ecoli is very so in terms of
1361.44s - 1368.24s |  electroporation or transfection it's a easier to do uh we had talked about some yeast and then me
1368.24s - 1375.44s |  as of course being a uh stem cell scientist um i was like okay let's hit it up with some stem cells
1375.44s - 1384.96s |  now um like let's see the uh the reporter marker if you will um uh it's really good for the green
1384.96s - 1389.44s |  fluorescent protein or the super folding green fluorescent protein is because when you incubate
1389.44s - 1395.68s |  them then you can see it on the see it on the back end anyway um we're gonna you'll see this
1395.68s - 1401.04s |  is electroporator device here on the on the slide here and of course nicholas nicholas cage is always
1401.04s - 1407.92s |  trying to reinvent himself obviously now we're getting to the last part here is the so this is
1407.92s - 1412.88s |  kind of after we're not talking about the tool but we're talking about the the protocol for cloning
1414.16s - 1419.92s |  you can see in this nice meme here that when you're you're you've already transformed yourselves
1419.92s - 1424.88s |  using this commercial electroporator and then of course this barbecue barbecue lighter that we have
1424.88s - 1429.60s |  here then you look at the colonies and you're like okay there's no colonies and then you have no idea
1429.60s - 1433.52s |  what went wrong and then you cry and then you repeat it and you adjust and that's the whole
1433.52s - 1438.32s |  thing about science you know you just kind of have to adjust the parameters to get it right on and if
1438.32s - 1445.60s |  you do so you can cross the holy grail and make your nicholas cage banana hybrid and the cell
1445.60s - 1449.20s |  recovery is a really tough thing which i think we're like running out of time on that one but
1449.20s - 1456.16s |  here's a short little picture of like uh and this took many iterations but if you see and i'm glad
1456.16s - 1460.64s |  i took a good picture of this even though not so good you see there's kind of this wave of these
1460.64s - 1470.00s |  tiny little colonies those uh graciously were conducted via the bio volt or the electroporator
1470.00s - 1477.60s |  or pen yeah okay troubleshooting now the troubleshooting is of course i have talked about
1477.60s - 1482.32s |  there's a lot of cell death you are the destroyer of worlds when it comes to this a lot of cells are
1482.32s - 1487.12s |  going to die but all you need is a small portion to grow and then you're like okay mission complete
1487.12s - 1491.76s |  the excessive arcing remember the uh some some of the two methods that we said you know use the
1491.76s - 1495.12s |  the playing card index it's really great i like i actually like that one a lot
1495.12s - 1501.20s |  uh but you can adjust the arc and then but you should keep in mind that despite whatever prior
1501.20s - 1508.16s |  studies or even around electroporators that it is it has low efficiency meaning like it doesn't
1508.16s - 1515.39s |  work all the fucking time so you just got to know that going into it um if you want the protocol you
1515.39s - 1520.27s |  can choose your adventure here um one of these will lead you to an access point where we could
1520.27s - 1532.35s |  provide a protocol to have one build and whatever else but it uh so have a look see and then where's
1532.35s - 1540.27s |  my goon or what am i good on time still yeah okay good yeah okay cool um all right and now
1540.27s - 1555.01s |  we move to the uh the key of cage and we will pause here oh uno minuto yeah okay we're at one minute
1555.73s - 1562.53s |  and uh so if uh anybody have a guess how many how many memes we got nickels cage memes
1566.21s - 1577.33s |  send it go ahead 12 that's 1 2 12 yeah no there there there is a there is there's more than that
1578.21s - 1583.89s |  there is ah you got it he's the guy right there if you put 20 here he's kind of like a ruse
1583.89s - 1587.17s |  and then there was that extra one which you must have been scanning qr codes
1587.17s - 1595.65s |  ah oh oh congratulations congratulations okay well yeah we have something for you
1595.65s - 1602.05s |  uh okay well that is our talk um it was it was brief but remember this is tool one of a
1602.05s - 1607.41s |  electroporating journey i hope people try it you know the biohacking community if you uh have an
1607.41s - 1614.21s |  inclination for science then you know please reach out to one of us and and uh again we fly under the
1614.21s - 1620.37s |  flag of viva securis which is actually a medical device pen testing company um and then this right
1620.37s - 1625.33s |  this last is you know remember please don't do coke in the bathroom it uh this is a real sign
1625.33s - 1629.97s |  somewhere in the world for all you osin folks you can go find it thank you


url: https://www.youtube.com/watch?v=slpJQmm3L8k
title: DEF CON 32 - The Past, Present, and Future of Bioweapons - Panel
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=slpJQmm3L8k",
  "title": "DEF CON 32 - The Past, Present, and Future of Bioweapons - Panel",
  "description": "Biological warfare is a phenomenon that spans human history, tracing its roots to ancient times rather than being a recent invention. To gain insights into bioweapons' current and future landscape, it is imperative to delve into historical examples of conventional biological warfare and understand how methods were devised and implemented.\n\nHowever, amidst the exploration of historical precedents, it becomes evident that our optimism for the future hinges significantly on our ability to foster transparency and creativity within the global community. This optimism is intertwined with our comprehension of technological advancements, the rapid pace of innovation, the interconnectedness of various domains, and the imperative task of constructing practical defenses against emerging threats. It is crucial to acknowledge that despite the sophistication of technology, its efficacy remains intricately linked to human ingenuity. As a poignant reminder, our vulnerability lies in technological shortcomings and our collective failure of imagination. Creativity, a distinctly human attribute, stands as the cornerstone in the perpetual endeavor to safeguard against unforeseen adversities.\n\nFurthermore, the discourse extends to establishing social norms and mores that are pivotal in shaping attitudes toward biological warfare. Addressing the proliferation of disinformation and its potential to fuel the proliferation and utilization of bioweapons becomes imperative. This discussion encompasses an exploration of prospective research endeavors and emerging initiatives leveraging artificial intelligence (AI) in the realm of bioweaponry. Notably, the utility of Generative AI in affecting societal shifts toward the normalization of bioweapon deployment warrants scrutiny. Additionally, the current societal landscape, particularly the desensitization of internet denizens to overt hostile actions, poses profound implications for the future trajectory of biological warfare.\n\nIn essence, a comprehensive understanding of historical precedents, coupled with a proactive approach towards fostering transparency, creativity, and the cultivation of robust societal norms, is indispensable in navigating the complexities of bioweapon proliferation. As we confront the intricate interplay between technological advancements and human agency, it is imperative to remain vigilant and resolute in our pursuit of a future safeguarded against the malevolent exploitation of biological agents.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1983,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.00s | This text was transcribed using whisper model: large-v2

 I would like to welcome you all to our talk, a discussion of past, present, and possible future
6.00s - 15.01s |  of bioweapons. I am Dr. Xavier Lewis-Palmer. I'm Miao Liu, Miao Miao. Hey guys, I'm Luke Potter.
15.89s - 23.09s |  Right on. So as a disclaimer, the perspectives and opinions shared in this talk do not reflect
23.09s - 28.45s |  our workplaces. Further, this talk is designed to be a high-level, innocuous, and accessible talk.
29.09s - 33.25s |  There is an extended open-end Q&A session to make this more fun and interactive,
33.25s - 38.85s |  so we'll be brief with topics discussed at first. However, this portion will only be great if people
38.85s - 44.85s |  get cool about a lot of things very quickly. That said, we'll discuss some past, followed
44.85s - 52.77s |  by the future, as well as the present issues with bioweapons and just staying ahead of a lot
52.77s - 61.49s |  of the hype around them. And this will lead into our Q&A session. Take it away, Miao.
64.61s - 70.77s |  Hello, Las Vegas DEF CON. My name is Miao. I'm a biohacker from Australia, and I'm going to be
70.77s - 76.69s |  talking to you about the past of bioweapons. So I want you to take your mind back and imagine
76.69s - 84.13s |  the year is 1348. A crisp spring breeze carries the smell of grass and salt water.
85.01s - 90.53s |  You're a blacksmith that exports your wares via the port on one side of the city.
92.13s - 95.97s |  The other side of your city is heavily fortified by two stone walls.
97.49s - 104.37s |  Your city, Kaffa, has just entered its third year of the siege caused by the Golden Horde,
104.37s - 110.21s |  the descendants of Genghis Khan. Every morning you wake up to the familiar sounds of the clicks
110.21s - 117.33s |  and thwacks of the trebuchets launching rocks at your town. Today, though, something's different.
117.33s - 122.13s |  Instead of the reply being heralded by the sound of stone on stone,
123.09s - 131.95s |  something different has happened. You look up to the sky for answers, only to find more questions.
132.91s - 140.75s |  Is it a bird? Is it a plane? No, it's a plague-infested corpse being thrown over the walls.
143.34s - 149.10s |  As the putrid bodies start exploding left and right, you and your fellow townspeople carry
149.10s - 158.94s |  the corpses into the sea on the far side of Kaffa. Your hands have cuts in them, and unbeknownst to
159.10s - 165.50s |  you, the blood of those cadavers is actually infecting you with the disease. As you begin to
165.50s - 173.10s |  flee via boats to go to the rest of Europe, you're unaware that you're about to spread the deadliest
173.10s - 182.93s |  bioweapon attack in the history of the human race. This attack caused the Black Plague to enter
182.93s - 190.05s |  Europe, and it resulted in the deaths of about 25 million Europeans, which was about somewhere
190.05s - 199.12s |  between a quarter and a third of all Europeans at that time. So were the Golden Horde that
199.12s - 206.72s |  launched this attack the original biohackers? I think they were. They were using technology
206.72s - 241.07s |  offensively by using a trebuchet to launch bodies. What's that? Okay.
245.07s - 249.39s |  So they used the technology offensively. This is the first time... Okay, so before this,
250.27s - 255.95s |  there had been kind of bioweapons attacks, like people have sent plague victims into towns
255.95s - 262.91s |  or chucked an infested body into a well, but this was the first time someone had used technology
264.27s - 271.07s |  to attack people with a biological agent, and the results were absolutely devastating.
271.95s - 278.11s |  To think of asymmetric warfare, one body thrown over a wall effectively killed 25 million people,
278.11s - 284.91s |  so it's very powerful. Now, for the next, like, four to six hundred years,
284.91s - 290.43s |  there were some variations on this. People were, like, chucking, they knew it was effective to do
290.43s - 296.27s |  this, throwing all sorts of bodies and cows over walls, letting rabid animals into towns and things,
296.27s - 302.51s |  but it wasn't very directed. And I guess, like, this begs the question of what exactly is a
302.51s - 314.53s |  bioweapon? So is this a bioweapon? Kind of? Maybe? Some people nodding heads. So by the strictest
314.53s - 322.37s |  definition, I would say no. It's very cute, but would it need to have fleas on it, maybe? Would
322.37s - 331.97s |  that make it a bioweapon? Almost. If it has a pathogenic bacteria on some fleas on a rodent,
331.97s - 339.25s |  that would be a bioweapon. So the definition of a bioweapon is a virus, a bacteria,
340.21s - 347.09s |  or a toxic compound produced by one, used as a weapon. So for viruses, it might be something like
347.09s - 355.09s |  Ebola, a bacteria might be the plague, and a toxic compound might be anthrax, the spores of
355.09s - 359.73s |  Bacillus anthracis. So, and it has to be used, obviously, as a weapon, so it has to be delivered.
359.73s - 362.93s |  If it just exists in nature, we wouldn't necessarily say it's a bioweapon.
363.89s - 368.69s |  Some people might say it is, but they'll be wrong. And the thing that makes it a bioweapon is
368.69s - 375.57s |  generally we use it to affect and do something, like kill something. So these are all popular
375.57s - 382.93s |  ways that people have used to transmit bioweapons. So the gun that fires it or whichever, it could be
382.93s - 387.09s |  as simple as a blanket, as we saw with smallpox, which was deliberately used against Native
387.09s - 394.85s |  Americans. It could be an arrow. Polish people in the 17th century dipped the arrows in the
394.85s - 401.41s |  blood and saliva of rabid dogs before firing them at enemies. A train carriage can be used to
401.41s - 407.17s |  contain people, so we saw in Japan, those ricin attacks. Agricultural bioweapons, which hopefully
407.17s - 412.29s |  the audience will ask us a bit about, is like a really, really common one. And of course, smallpox
412.29s - 417.33s |  attacks in the wake of September 11th, sorry, anthrax attacks that were used on September 11th,
417.33s - 425.01s |  which used envelopes. So in some ways, the USPS was part of the vector. I'm very careful every
425.01s - 430.45s |  time I click the slide now. No one's shouting at me, that's all right. Okay, so that was, it was
430.45s - 437.41s |  basically, bioweapons were this big nebulous thing where no one really knew what was causing them. So
437.41s - 445.89s |  when the Golden Horde launched dead bodies into Kaffir, they thought that the bodies were
445.89s - 451.17s |  cursed, and that they were throwing the curse of God in, and that's what caused it. We know now
451.17s - 456.61s |  that that wasn't the case. This guy, Louis Pasteur, he came up with the germ theory of disease,
456.61s - 462.05s |  and this changed biological warfare. Because when we worked out what was actually causing this,
462.77s - 468.05s |  bioweapons changed from being a really common tool in warfare, to being something that was kind of
468.05s - 477.65s |  used by state agents and governments as a secret form of warfare. So we saw this a lot in World
477.65s - 484.29s |  War One. Basically, different governments were using this to affect mainly agriculture and horses.
484.29s - 487.97s |  So horses were used a lot in World War One. They were using them to make the horses lame so that
487.97s - 494.69s |  they couldn't be as effective in warfare, using them to destroy, give the cows diseases so that
494.69s - 502.69s |  the army couldn't be as strong. And the net effect of this was that a lot of people got sick, and
502.69s - 508.29s |  everyone kind of agreed it was a bad idea. But the big change was that bioweapons became
509.57s - 513.33s |  something that was invisible, and people would deny using them.
514.29s - 518.45s |  Kind of completely in opposition to throwing a body over a wall. Instead, they would infect some
518.45s - 522.53s |  cows and then sell them to a farmer, and that would eventually cause problems in the neighbouring
522.53s - 529.57s |  country. I won't go heaps into it, because from a biohack perspective, it's not really that relevant.
529.57s - 534.29s |  It's just kind of good to know about. There's diseases we don't really hear about anymore,
534.29s - 538.37s |  but basically, they led to the Geneva Convention. Now, the Geneva Convention is important.
539.25s - 545.65s |  It outlawed the use of biological weapons in warfare. It didn't outlaw their research,
545.65s - 553.01s |  development and stockpiling. And that led to World War Two, when we saw Japan, Unit 731,
553.57s - 559.89s |  poisoned tens of thousands of people by poisoning thousands of wells with plague. We saw
561.97s - 565.17s |  Winston Churchill was a big fan of using them. He dropped anthrax on a whole bunch of
565.81s - 569.97s |  places. And the Nazis weren't really a fan of them. They preferred chemical weapons.
569.97s - 578.05s |  But this led to the Bioweapons Convention, which was in the mid-70s. Now, this basically said,
578.05s - 582.61s |  okay, well, we're not going to allow you to stockpile them anymore, or research them for
582.61s - 590.45s |  future use. The only problem is, it's a voluntary convention that you sign up to. It's not enforceable
591.25s - 597.73s |  nor auditable. This is still what we're regulated under. So every country signs up to it, and those
597.73s - 602.93s |  countries continue to make biological weapons. Basically, any country that has the capacity to
602.93s - 606.37s |  make biological weapons at some point has, which is terrifying.
608.53s - 615.25s |  During the Cold War, we saw what this could look like. So the Soviets were stockpiling plague.
615.25s - 619.97s |  They may have been stockpiling smallpox. Some of these stockpiles have not been recovered to this
619.97s - 629.49s |  day. They exist in countries with dubious attitudes towards this. Countries like Turkmenistan,
629.49s - 634.29s |  that don't really have democracy or anything like that. We don't know where they are. We know that
634.29s - 638.77s |  these places have had leaks. They've killed dozens of people when these leaks have happened.
638.77s - 643.81s |  And it's all been shut down now. But we weren't aware about how large a scale this was happening
644.53s - 648.53s |  until the fall of the Soviet Union. So we don't actually know what's happening right now.
649.97s - 655.65s |  At a state level, but at an individual level, it's definitely within our means to do it.
656.69s - 659.65s |  That's the end of my part of the presentation. I'm going to pass it across to Xavier now.
667.15s - 673.12s |  Thank you, Miao. So I need not bore you with the present. So I'll dive into what's important
673.12s - 680.48s |  for making better sense of hype surrounding bioweapons and just biotechnology in general.
682.35s - 685.95s |  I'm sure many of you are inundated with poor quality information on matters of biology and
685.95s - 691.47s |  biotechnology from multiple angles and levels of power. What we all need are resilience and
691.47s - 697.55s |  accessible spaces for them. I want you to think of your local bio maker and hacker spaces. And I also
697.55s - 703.23s |  encourage everyone getting a library card and using interlibrary loan to get research and to
703.23s - 709.55s |  learn. It's important that everyone gets used to also not exploiting or thinking about biology.
711.47s - 715.15s |  Just as with how many of you in this audience have not done that for other aspects,
716.03s - 723.65s |  of technology in your life, it has long been since time for that in bio. So to stay ahead
723.65s - 730.53s |  of the hype, to stay ahead of misinformation campaigns and disinformation campaigns,
731.65s - 737.65s |  the responsibility is on everyone to develop comfortable and relative degrees of theoretical
737.65s - 742.69s |  and practical literacy. What this eventually translates to is everyone learning terminology
742.69s - 750.37s |  discussed, learning to parse and write literature, to understand institutional structures, to
750.37s - 755.49s |  understand institutional responsibilities, institutional processes, institutional points
755.49s - 762.13s |  of failure, and to better understand the nature of propaganda so they can see hints of it in all
762.13s - 769.41s |  media that you consume. No one is immune to bypassing it or getting influenced by it.
771.44s - 775.44s |  But also we need to make sure that we're also learning about systems of ethics and learning
775.44s - 783.92s |  how they change. In short, don't stop learning. You may make mistakes from time to time, but that's
783.92s - 791.12s |  okay. And it's part of the process. What's more dangerous if you decide to persist with a static
791.12s - 797.52s |  understanding of the world and are not able to adapt to changes that occur and to new discoveries
797.52s - 803.52s |  that emerge? It limits your ability to use new technology and to be abreast of
804.56s - 818.94s |  new events that occur. But yes, I will hand this off to Lucas. Hey guys, can you hear me?
819.74s - 823.82s |  Great. So I want to thank Xavier because I want to start my section's talk with the Oprah joke,
823.82s - 827.10s |  hey, check under your chairs. And he said I couldn't do that even though it would have been
827.10s - 835.18s |  hilarious. So I'm here to talk about the future of bioweapons. So hopefully no one here goes on
835.18s - 838.86s |  vacation thinking to yourself, oh man, I can't wait to get Lyme disease. I'm wondering if this
838.86s - 844.06s |  place has tularemia. Maybe it has bubonic plague. That'd be awesome. If you do, please don't talk
844.06s - 848.46s |  to me after this. We're going to talk about the future. So we've been through the past,
848.46s - 852.46s |  we've been to the present, and I'm hoping we can all agree bioweapons don't sound great.
852.46s - 856.94s |  I don't want giant baseball-sized lumps on my neck. I would rather not have smallpox.
857.58s - 865.07s |  Hopefully you guys think that too. So here is the expected outline you probably wanted to hear
865.07s - 869.71s |  for today. Introduction of future bioweapons, the synthetic biology, basically how to create them,
869.71s - 874.11s |  talking in detail about CRISPR-Cas9, talons, ZFNs, and new genomic techniques.
874.83s - 880.03s |  We're not going to do that talk because I like not being in jail and I'd like to keep it that way.
880.03s - 882.19s |  So we'll talk about them a little bit, but then move on to more
884.19s - 891.79s |  basically practical issues or concerns. So here's the genomic editing technologies. We have
892.43s - 897.07s |  CRISPR-Cas9 up there. That's the really common one. That's the one the ODIN used to sell kits
897.07s - 902.59s |  for. It's very good at deleting genes, but not very good at putting in new genes, which makes
902.59s - 908.51s |  sense. Usually the introductory exercise in synthetic biology is making E. coli grow in the
908.51s - 912.91s |  dark. And of course, E. coli is a disease. You can modify any disease however you want with
912.91s - 919.47s |  CRISPR-Cas9, theoretically. It just has some issues with changing it that we don't have time
919.47s - 924.19s |  to get into. And again, rather not go to jail for, so we'll leave it there. We have transcription
924.19s - 929.63s |  activated, activated-like effector genomic editing. Your talk beforehand was electroporation,
929.63s - 933.63s |  all methods of getting DNA inside the cell and getting that cell to express different strands
933.63s - 938.59s |  of DNA. We also have ZFNs, and that's basically what you guys probably thought we were going to
938.59s - 942.51s |  talk about. I'm not sure you guys have the biological background to do it, but that's how
942.51s - 948.43s |  you would change a bacteria or a virus or, well, not quite a prion, usual biological agent into
948.43s - 952.59s |  being effective. Now, what we're going to talk about instead is something you probably are sick
952.59s - 958.83s |  of hearing about. Who's heard of LLMs? Yeah, hopefully everyone. That's been the big talk
958.83s - 965.15s |  for a while now. And here's an issue I think you guys want to hear about. So the WMDP Benchmark,
965.15s - 970.35s |  Measuring and Reducing Malicious Use with Unlearning, is a paper about what ChatGPT knows
970.35s - 975.47s |  about chemical, biological, and cyber threats. If you ask it politely enough, ChatGPT will tell you
975.47s - 980.75s |  how to make a bioweapon. It's got to learn how to ask it. I'm not sure who would open AI and let
980.75s - 988.35s |  ChatGPT read the anarchist cookbook, but maybe he's not doing great at his job. The issue here
988.91s - 995.55s |  is where most lone wolf or terrorist attacks get caught at. Who here went through a plane,
995.55s - 1000.43s |  used a plane to get here today and had to go through the TSA? Yeah, almost everyone, right?
1001.07s - 1006.43s |  How many people think the TSA has caught more than three terrorist attacks? Yeah, they've
1006.43s - 1012.27s |  historically caught nothing. The most frequent time attacks like this get caught is at the
1012.27s - 1017.55s |  communication phase, when people are talking about doing an attack, which is an issue because with
1017.63s - 1022.35s |  ChatGPT, you don't need to talk to anyone else. You need to talk to ChatGPT, and with the amount
1022.35s - 1027.15s |  of requests they serve, you can't really verify all those requests. As you've shown, they have
1027.15s - 1033.79s |  that data already. Unless it unlearns it, you have access to it. That's the proliferative
1033.79s - 1039.79s |  knowledge. There is nuclear and radiological issues here, but this is DEFCON. It's about
1039.79s - 1044.19s |  biohackers. They're not going to have the chain of custody to get a nuclear weapon, hopefully.
1045.07s - 1050.27s |  We'll keep saying that to ourselves. Now we're going to talk about killing with math.
1050.27s - 1056.27s |  Who here today has a personal physiological model on them? Yes, you don't think you do,
1056.27s - 1060.59s |  but if you have a fitness tracker, you kind of do. You have a ton of data on how you sleep,
1060.59s - 1065.71s |  how your heart rate works. Basically, everything that you do that's tracked by a fitness tracker
1065.71s - 1072.43s |  makes you more like you. There's a lot of mannequins nowadays. Who has taken a CPR class?
1073.07s - 1077.79s |  Anyone? Okay. You have the basic plastic mannequins you have to push up and down to practice CPR.
1077.79s - 1082.67s |  They have more advanced versions of that. They have embedded in them with integrated systems
1083.31s - 1087.07s |  the physiology of the person. You can say, hey, this mannequin lost this much blood,
1087.07s - 1090.67s |  and now this is what's happening to its physiology. You can use that, which is an
1090.67s - 1096.75s |  open source software, to basically predict your own physiological issues or make your own bio
1096.75s - 1100.59s |  attacks to optimize them for a certain population, which means that no longer you have to worry about
1100.59s - 1105.07s |  making tons and tons of biological weapons. You can go, okay, I've optimized this weapon
1105.07s - 1113.87s |  to affect these people with these comorbidities. Again, you guys are at DEF CON. You probably care
1113.87s - 1117.55s |  about your data. You probably keep it secure. Hopefully, most of your phones are in airplane
1117.55s - 1124.03s |  mode. Your hospital doesn't do that. Every dollar they spend is a dollar not treating patients,
1124.03s - 1127.87s |  if they're a public one, or if they're a private healthcare system, a dollar not going to profit,
1127.87s - 1131.07s |  which means cybersecurity falls by the wayside. If you really want to make an
1131.07s - 1135.39s |  effective biological agent, you can use hospital records. Most of them are available for purchase
1135.39s - 1141.15s |  if there's been a cyber attack on those systems. Of course, they cost a ton of money, which also
1141.15s - 1148.11s |  goes well into funding your biological agents. This is a section we've written quite well in.
1148.11s - 1152.27s |  I don't expect any of you guys to read that whole blurb of text, but basically you can make
1152.27s - 1159.63s |  CHAT GPT say things that are academic sounding and completely wrong. In this case, this paragraph
1159.63s - 1164.83s |  here, if anyone's read it, you can laugh now, is about drinking gasoline to cure COVID-19.
1165.47s - 1170.43s |  CHAT GPT should not be able to tell you that. They put in safeguards quickly after CHAT GPT
1170.43s - 1176.75s |  3.5 was released to make sure COVID-19 couldn't be said. We just plopped in respiratory infection.
1177.47s - 1182.03s |  Same thing. You can make tons and tons of misinformation and make it really quickly.
1182.03s - 1185.79s |  This actually came into a head with the paper, The Disinformation Dozen.
1187.15s - 1192.35s |  Basically, the 12 people who spread the most disinformation on, I guess at the time, Twitter,
1192.35s - 1197.87s |  now X. I don't know. I don't follow social media. None of them were really associated with a
1197.87s - 1203.95s |  foreign actor. None of them had nation state ideas or ambitions. They just wanted to make money by
1203.95s - 1209.31s |  selling you little crystals or saying, oh no, buy my weird colloidal silver thing to cure COVID.
1210.19s - 1215.07s |  They didn't necessarily have to have nation state ambitions to spread misinformation and make a
1215.07s - 1219.47s |  biological agent more effective. You could just make them want to make money and tell them how
1219.47s - 1224.51s |  to spread disinformation that way to make money. That came up to an issue with biocyber warfare
1224.51s - 1230.43s |  and crime. Basically, at some point, if you have a country that's committing so many cyber attacks
1230.43s - 1235.39s |  against another country, at what point do you just call it a war when it's, in theory, just crime
1235.39s - 1242.43s |  because they're just doing ransomware attacks? I know you guys might be reading that title there,
1242.43s - 1245.71s |  familiarity with nuclear issues and thinking, hey, wait a second. This is a bio thing. We're
1245.71s - 1250.99s |  the biohacking village. Yes. The issue is the majority of the US is interested in boosting
1250.99s - 1255.31s |  their nuclear knowledge. They don't even do surveys about biological knowledge. Who here
1255.31s - 1259.23s |  thinks that if they had the genome of a bio agent that they could identify if it was synthetically
1259.23s - 1266.51s |  manufactured? No one has that data. The US does not do a good job of advertising how to get that
1266.51s - 1270.51s |  data. There's reasons for that, maybe because they don't want a ton of people knowing synthetic
1270.51s - 1275.39s |  biology at that level. But again, if you don't trust doctors or government officials to tell
1275.39s - 1282.91s |  you what that information is, how do you identify it? Again, it's almost strange because the nuclear
1282.91s - 1288.03s |  threat has a very nice, well-defined symbology. You see a mushroom cloud, that doesn't just happen.
1288.03s - 1293.07s |  You can go, hey, someone might have dropped off a nuke right there. It's very easy to point out.
1293.07s - 1298.99s |  Diseases happen every day. Everyone gets sick eventually. At some point, there might be more
1298.99s - 1305.23s |  people getting sick, but how do you tell it's a bioweapon? Here's the key takeaways. Every dollar
1305.23s - 1310.59s |  spent on security is a dollar that isn't profit, which means that all of your health information or
1310.59s - 1315.15s |  hospital information, basically that system has a vested interest in keeping your data
1315.15s - 1323.15s |  not secure or only as secure as legally mandated. Biological agents being modified, that's not a
1323.15s - 1328.27s |  future threat. That's present. You can change them now. You can buy a kit relatively cheaply and use
1328.27s - 1334.35s |  it today. But bioweapons are already pretty bad. You don't need to change them very much to make
1334.35s - 1340.43s |  them worse. You basically have influence campaigns all around you. There's advertising campaigns.
1340.43s - 1343.63s |  We don't call them influence campaigns because in theory, they're just trying to make money,
1343.63s - 1347.95s |  but so can other things that affect your biological health. It's still an influence campaign.
1348.67s - 1351.95s |  And again, you should be really worried about who controls your data, especially medical data,
1351.95s - 1356.27s |  because that can be used against you and a biological agent. Now, I'd like to open up the
1356.27s - 1360.83s |  panel for questions. I think we have tons of time. I think we have a full 30 minutes.
1360.83s - 1367.87s |  Basically, any questions you have, do we have? Yeah, we have one microphone up here. If you guys
1367.87s - 1372.27s |  want to queue up basically at the center aisles, we'll just pass the microphone around. Great
1372.27s - 1387.98s |  talking to you, and I'm excited for your questions. So I was wondering, has there been examples of
1388.86s - 1393.58s |  bioweapons engineered that had capabilities for selective immunity?
1394.86s - 1400.94s |  Oh, man. So I don't love this story, but it does amuse me. Has anyone here heard of
1400.94s - 1408.54s |  Operation Coast from South Africa before it stopped being apartheid? Okay. No, I told you
1408.54s - 1415.74s |  this story like three times. Sorry. In theory, yes. Someone in apartheid South Africa, a white
1415.74s - 1421.02s |  guy, of course, tried to make essentially a bio agent that would affect black South Africans
1421.02s - 1426.46s |  selectively more than white South Africans. It doesn't work that way. Race doesn't really exist,
1426.46s - 1432.14s |  especially on a genetic level. It's very silly, but basically the guy got upset that he couldn't
1432.14s - 1437.18s |  select for black South Africans, but instead of giving up saying, oh, hey, maybe I'm being silly
1437.18s - 1444.94s |  and racist, goes on to invent ecstasy, which is just a wildlife story. Probably still racist though.
1452.14s - 1456.46s |  Hello. So the other thing as well, with biological weapons, one of the things that's really great
1456.46s - 1464.54s |  about them is that there's always a level of plausible deniability. So even if there was
1464.54s - 1469.66s |  one of these weapons out there, we might not know about it. So it could have affected one person and
1469.66s - 1475.34s |  taken them out and it looks like it was natural causes. And if you're a nation state or a company,
1475.34s - 1478.78s |  you might have a vested interest for this. And this type of warfare has been around since like
1478.78s - 1483.66s |  the shogunate in Japan that have ninjas that would take out one person for some political
1483.66s - 1487.90s |  means. So it's always a worry. And then conversely, there's a false, there's a type one error and a
1487.90s - 1493.10s |  type two error. So some countries will say, oh, this country has been launching biological weapons
1493.10s - 1498.14s |  against us, but it's just nature, but there's no way to prove either way. So there's a lot of
1498.14s - 1506.56s |  advantage to having them. Yeah. I think it's generally important for people to ask themselves
1507.36s - 1514.64s |  from this assertion that I have, how can I work my way to that conclusion logically? And
1516.48s - 1520.24s |  do I reasonably have access to that information before I proceed?
1526.64s - 1530.24s |  So I'm in regulatory and one thing that everyone's favorite person,
1530.80s - 1536.16s |  one thing that's recently we're starting to be mindful of are sequences of concern. So if your
1536.16s - 1541.20s |  company makes a legal nucleotide strands that are 50 nucleotides or longer, you have to check
1541.20s - 1545.12s |  if there are sequences of concern against a national database. And that's something that
1545.12s - 1549.04s |  the U S is rolling out, but I'm just kind of also thinking, you know,
1550.00s - 1554.88s |  even if you're a vendor selling oligos for whatever purpose to, for whatever use,
1555.76s - 1561.04s |  that's one way to regulate it. But if it's out in the wild, how would that be detected in terms
1561.04s - 1564.72s |  of those sequences of concern? Because there is some databases being developed.
1564.72s - 1567.84s |  So the way we detect it is by using those same sequences of concern,
1569.12s - 1574.80s |  unfortunately. So I made a COVID test and I was ordering COVID nonstop and COVID sequences,
1574.80s - 1579.68s |  because I need to order those sequences to be able to find them in DNA. So we're finding a
1579.68s - 1585.04s |  match all the time. So I had, I ordered a synthetic COVID genome, but like, if I wanted
1585.04s - 1590.64s |  to make smallpox hypothetically, I could just use the vaccine, which is 95% sequence homology. So
1590.64s - 1596.32s |  there's, there's a problem that exists with looking at the actual sequences on DNA synthesizers,
1596.32s - 1600.56s |  because anytime someone is trying to fight the condition, they are going to be sequencing
1600.56s - 1606.24s |  something that looks exactly like it. With AI and sentient AI, we have to be terrified of this
1606.24s - 1611.84s |  because of something called instrumental convergence, right? Which is that the steps
1611.84s - 1615.60s |  to making a nuclear bomb and making a nuclear power plant for the first, you know, 20 out of
1615.60s - 1620.80s |  30 steps look identical. And you might allow something to go all the way along and then
1621.44s - 1624.88s |  it takes a detour and you're like, not like that. And then all of a sudden it's over.
1624.88s - 1630.08s |  So I think that there's other ways we need to be policing things around this. And that's cultural
1630.64s - 1636.08s |  um, yeah, communication channels, uh, making people feel like they're not lone wolves. So
1636.08s - 1640.48s |  that's not a problem, but I think that the real regulation probably can't happen at that level
1640.48s - 1649.20s |  to have any effect is my opinion. It's always strange to me when someone says,
1649.20s - 1653.52s |  Oh, I'm scared of the regulation person. Like that means I should definitely be regulating you.
1653.52s - 1658.16s |  Like I should be regulating twice as much as whatever we are now. Um, I think the issue is
1658.16s - 1661.92s |  less about sequences of concern though. There was a really cool use case with a Peter Ney out
1661.92s - 1667.52s |  of use next, um, who basically made a map, a strand of DNA that was malware that infected
1667.52s - 1671.20s |  a PCR machine. Um, what you wouldn't probably have as a sequence of concern because you're
1671.20s - 1675.44s |  looking at it, it's binary code. Um, the bigger issue as you're talking about before is low rule
1675.44s - 1679.52s |  factors. Cause we can, the second you're talking about spreading a biological weapon, it's going
1679.52s - 1684.72s |  to be on some platform likely make someone can find you. Um, so for instance, I'm less worried
1684.72s - 1688.96s |  about finding a sequence of concern that you order from, you know, Sears or Amazon and more
1688.96s - 1693.44s |  about you going out to a farm and getting anthrax because that's something we can't really control.
1693.44s - 1697.84s |  It's just there natively. Um, if you really want to get a disease, just go to a hospital.
1697.84s - 1700.40s |  There's probably someone that has it. You can just grab it from there.
1702.24s - 1706.80s |  And also as additional, I think it is a lot of importance to, you know, how we fund categorization
1706.80s - 1711.52s |  and, you know, search for new sequences. And there's a lot of work underway, which
1712.08s - 1718.08s |  can definitely help to, to address these matters. But we also must be thinking about,
1718.08s - 1723.36s |  you know, what may, what are, what are emergent discoveries that we may have and how do we deal
1723.36s - 1735.60s |  with them? Good afternoon. Thanks for the great talk. My question is, um, well, first a statement,
1735.60s - 1742.24s |  Congress is absolutely inept. Uh, we've seen the talks of how they try to regulate AI.
1742.24s - 1748.96s |  They can't regulate cybersecurity. And now with the emergence of bioweapons, we've seen them try
1748.96s - 1754.96s |  to regulate guns and the gun enthusiasts have just made, okay, we can just 3d print guns.
1754.96s - 1760.00s |  So now with bioweapons, I'm not that anybody would make bioweapons for fun,
1760.00s - 1766.00s |  but now that we have citizen scientists that can buy CRISPRs and then just start playing around
1766.00s - 1771.12s |  with it, what chances, I mean, we'd have to develop our own community of regulating just
1771.12s - 1779.68s |  like all those other communities regulated. So my question is when does self-regulation become
1779.68s - 1786.40s |  a prison if governments step in, just as that they've stepped in with other, um, community
1787.04s - 1796.26s |  guidelines. All right. Um, Oh, sir. Uh, could you, uh, clarify the last portion of your question
1796.26s - 1806.38s |  in terms of what you mean by a prison? The, what I meant was a prison in that if we
1806.38s - 1812.86s |  self-regulate to the point where breakthrough or even innovation or even study cannot be conducted
1812.86s - 1819.26s |  because we've regulated ourselves. So we've self-regulated, but then governments have
1819.26s - 1827.09s |  piggybacked on that and said, okay, you've done this. Now you can't do this. So I'm from Australia
1827.09s - 1831.81s |  and we're a country with really high regulation. Even to set up my first bio lab, we had to meet
1831.81s - 1836.77s |  with federal agents. Like that was just a given. But, uh, I think a good thing that came out of
1836.77s - 1840.85s |  that was by being a part of that process, Australia is a bit, Australia is a different
1840.85s - 1847.89s |  country. I'm going to say, you know, um, but we've helped write legislation. So we've helped
1847.89s - 1852.69s |  work with them to try and create something that looks better for everyone. I don't actually think
1852.69s - 1856.13s |  it's, it's, it's where it should be. I think it should be a lot more free, but of course,
1856.13s - 1861.09s |  I think that I'm a biohacker. Um, I think though that there's definitely been some positives. We've
1861.09s - 1866.05s |  stopped people who we didn't want to be in our community from, from having access to things they
1866.05s - 1871.17s |  shouldn't have, I think. Um, but it's a tricky one. I think dialogue is a, is a good way of doing it.
1871.17s - 1876.05s |  I personally have run for politics three times. Like I've run federally twice and state once.
1876.05s - 1879.81s |  And by running against the candidate, I didn't have a serious chance of winning. Like I run
1879.81s - 1886.61s |  against the prime minister now, but I did get to debate him in a public forum. And that was a great
1886.61s - 1892.29s |  way to make the things I cared about be talked about on a bigger scale. But I think telling,
1892.29s - 1896.85s |  telling stories is really important. If you have some, a good story to tell why it's important,
1896.85s - 1901.17s |  why it's not important, make it newsworthy and contact, you know, journalists or something like
1901.17s - 1905.65s |  that, publish yourself. Um, I think those are good ways of, of changing things. You know,
1905.65s - 1909.73s |  someone lives next door to Kamala Harris and someone lives next door to her and next door to
1909.73s - 1912.77s |  her. And if you have a conversation with someone in a supermarket, it could end up going all the
1912.77s - 1918.05s |  way through. So I think, um, that's a good way. Americans are fine at talking though. Everyone's
1918.05s - 1920.53s |  always chatting to each other. Not quite the same where I'm from.
1923.46s - 1927.38s |  And just, uh, you know, additionally, I think it's very important that we all do our civic
1927.38s - 1932.98s |  duty to, you know, make our voices heard. You know, it's one thing to, you know, have our small
1932.98s - 1938.66s |  spaces where we, you know, we gripe about these processes, but if we're not playing a role in,
1938.66s - 1945.78s |  you know, in any of these, uh, in any of these politics or discussions on a local or other level,
1945.78s - 1950.26s |  I mean, I think it's kind of self-defeating. Um, but additionally, I think it's also very
1950.26s - 1955.06s |  important that, uh, you know, as we, you know, as we, you know, try to, uh, you know,
1956.10s - 1961.22s |  watch and monitor things in our communities, that we make sure that we're as educated as possible.
1961.22s - 1966.26s |  We don't cling to, you know, outmoded ideas, not just on technology, but also in the social
1966.26s - 1970.42s |  processes that guide the use and the development of these technologies.
1975.76s - 1976.56s |  Thank you very much, Jeff.
1978.32s - 1979.60s |  Thanks a lot, guys.


url: https://www.youtube.com/watch?v=nGDTVPnTDOw
title: DEF CON 32 - The Interplay between Safety and Security in Aviation Systems - Lillian Ash Baker
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=nGDTVPnTDOw",
  "title": "DEF CON 32 - The Interplay between Safety and Security in Aviation Systems - Lillian Ash Baker",
  "description": "Safety has been at the forefront of Civil Aviation since the formalization of DO-178, Software Considerations in Airborne Systems and Equipment Certification, in 1981. However, times have changed since then and we live in a world with seemingly limitless connectivity. DO-356A, Airworthiness Security Methods and Considerations, forms the cybersecurity bedrock in which aviation systems are designed and implemented. In this talk, participants will learn about how Safety and Security is applied to system design and how they interact with one another. Design Assurance Levels (DAL) and Security Assurance Levels (SAL) concepts are presented and explained what their purpose is. This talk is designed to appeal to the general cybersecurity community by introducing fundamentals of Safety analyses and discussing how Safety and Security interact with one another.\n\nThis talk will first touch upon fundamental documents that form the Certification basis for System Development (ARP4754B), System Safety (ARP4761A), and Security Considerations (DO-356A). From there, it walk through pieces that form a safety analysis and Design Assurance Level (DAL), walk through a system architecture under consideration, and learn about how Safety and requirements in a system can be used to inform the Threat Model for the system. From there, we end with a discussion on how Security Mitigations are assigned Security Assurance Level (SAL) and what this means for developers.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1204,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 3.32s | This text was transcribed using whisper model: large-v2

 All right. Good afternoon, everyone. I am Lillian Ashbaker.
3.32s - 6.00s |  I'm a product security engineer at the Boeing company in
6.00s - 9.16s |  Whisk Aero. Today, I'll be discussing the most important
9.16s - 12.32s |  part of aviation systems development, standards and
12.32s - 16.56s |  certification. But what you I hope you get out of this is an
16.56s - 19.12s |  understanding of how the industry has developed safe
19.12s - 25.26s |  systems, and considers security in those designs. First, we need
25.26s - 29.76s |  to discuss the safety of these systems. And I'll make you all
29.76s - 33.02s |  aware of what safe actually means in the aerospace
33.02s - 36.98s |  industry. I hope you find this as interesting as I have. I
36.98s - 41.26s |  still can't shut up about it 15 years later. So the first
41.26s - 43.98s |  principles of safety that we have to talk about are failure
43.98s - 47.68s |  conditions and probabilities, right? All of this information
47.68s - 53.34s |  comes out of Advisory Circular 25 or 23. If you go read for the
53.34s - 57.02s |  pilots in the crowd, that's part of the CFRs out there that
57.20s - 64.88s |  you're legally supposed to know. So Advisory Circular 25-1309-1A
64.88s - 68.16s |  this is all public information, actually lays out all these
68.16s - 72.28s |  probabilities and kind of puts together this really nice graph
72.68s - 75.28s |  of probability versus consequence, right? So you have
75.28s - 79.56s |  probable, improbable and extremely improbable, as well as
79.56s - 83.76s |  an acceptability of those failures and faults. And there's
83.76s - 86.44s |  a line that runs right between it that says acceptable and
86.46s - 90.10s |  unacceptable, right? So you have to develop the system in order
90.10s - 93.82s |  to understand what the system effects are going to be of that.
95.38s - 98.82s |  So as we move forward, those probabilities, those failure
98.82s - 102.62s |  classifications actually have probabilities behind them as
102.62s - 106.94s |  defined in the advisory circulars, right? So when we
106.94s - 111.74s |  talk about safety, we talk about the probabilities of failure. So
111.74s - 115.22s |  for a minor classification, that's a probable failure
115.22s - 118.64s |  condition on the order of 10 to the minus fifth, major is 10 to
118.64s - 121.04s |  the minus ninth, that got reclassified as 10 to the
121.04s - 126.92s |  seventh. Hazardous is now 10 to the seventh. Catastrophic is 10
126.92s - 132.02s |  to the ninth or less. So that means that like probabilities of
132.02s - 134.32s |  10 to the ninth. So think about the systems that you currently
134.32s - 138.50s |  see in like IT and how often they have to stay up and
138.50s - 146.31s |  operate. Our stuff has to operate and not fail. So the
146.31s - 150.09s |  design assurance levels are a major component of how we
150.09s - 155.13s |  develop these systems, right? So what you have are a nice trace
155.13s - 160.37s |  of failure conditions with the severities, with the actual
160.37s - 163.47s |  definitions of what that is, extremely probable, extremely
163.47s - 167.61s |  remote, and the probabilities themselves that tie off to the
167.61s - 170.57s |  functional DAL assignments. So whenever you're talking about
170.57s - 173.21s |  aviation systems, if you see something that says that it is a
173.21s - 177.75s |  DAL-C system, this is what it means. It means that that
177.75s - 182.99s |  system has a major effect on the system operation of the
182.99s - 190.03s |  aircraft, has a remote possibility of failure, and has a
190.03s - 194.33s |  failure probability of somewhere between 10 to the fifth to 10 to
194.33s - 201.81s |  the seventh probability. So with all these probabilities, the way
201.81s - 205.35s |  that the industry works through that is that we have a bunch of
205.35s - 209.35s |  functional hazard assessments, which takes a functional look at
209.35s - 214.45s |  the individual functions that trace down throughout the system
214.45s - 217.65s |  and look at all the points in which that function can be
217.65s - 223.49s |  impacted. So if it moves through three or four systems, all the
223.49s - 226.17s |  systems in the chain have to have some sort of way of
226.17s - 233.41s |  preventing failure conditions from occurring. So once we do
233.41s - 237.97s |  that, these probabilities go into the functional DAL
237.97s - 241.59s |  assignments. If you go take a look, here's where the standards
241.59s - 247.23s |  start to come in. DO-178, DO-254, and DO-278 for ground
247.23s - 253.29s |  systems operations, as well as ARP-4754 for systems
253.29s - 258.35s |  development. What those standards actually define is not
258.35s - 264.73s |  how you develop a system. It is a very important piece here. The
264.73s - 269.53s |  development objectives that you have to meet. So that means that
269.53s - 272.57s |  you can't just go write code. You have to have requirements
272.57s - 275.77s |  for the code. You have to have traceability down to the code
275.77s - 278.71s |  itself. You have to have traceability to the actual
278.71s - 281.77s |  compiled code. And then you actually have to test all that
281.79s - 286.57s |  code. And it's defined in tables and design objectives throughout
286.57s - 293.73s |  these different, these different documents. Those design
293.73s - 296.91s |  objectives that you work through are the deliverables that go to
296.91s - 301.01s |  a regulatory body. In the U.S., that would be the FAA. Over in
301.01s - 303.85s |  Europe, that would be EASA. If you have dual use between the
303.85s - 307.19s |  two of them, it will be shared between the two of them. Those
307.19s - 311.49s |  documents are the proof that you did the work. You have to prove
311.51s - 316.29s |  that you did the operations and did the work. So as you have a
316.29s - 320.09s |  higher DAO level, so DAO A would have the most stringent. What's
320.09s - 324.43s |  unique about DAO A is that there is a required independence in
324.43s - 329.53s |  the testing. Which means the person who developed the system
329.53s - 332.53s |  cannot be the one who has tested the system. It has to be a
332.53s - 336.67s |  completely independent body that does the verification of your
336.67s - 340.71s |  code or of your system, of your hardware to ensure that there is
340.73s - 343.77s |  independence between the developers and the test teams.
343.77s - 350.66s |  All right. So now you all are experts on safety. So now as we
350.66s - 357.38s |  move forward, we start to talk about what DO356A is. So DO356A
357.38s - 360.74s |  defines the cybersecurity development objectives for
360.74s - 365.98s |  aircraft systems. One of the most important concepts in that
365.98s - 370.82s |  is this concept of IUEI, which is intentional, unauthorized,
370.84s - 375.34s |  electronic interactions. What it means is that someone has to be
375.34s - 380.22s |  doing an attack intentionally. They did not have authorization
380.22s - 384.76s |  for the system. It has to be electronic interactions. So no,
384.76s - 388.22s |  birds flying, we know that they're not real. Birds flying
388.22s - 393.60s |  into engines do not count. Right? That's not intentional by
393.60s - 398.60s |  the bird to do that. So this is what makes security threats
401.60s - 407.60s |  different from safety threats in our system development. But how
407.60s - 410.52s |  we develop our systems around the two of them kind of start to
410.52s - 415.52s |  touch. So safety is more of a kind of a what and why questions
415.52s - 419.96s |  of how all these unintended adverse effects happen within
419.96s - 424.36s |  systems operation. Security looks at more of the who and
424.36s - 429.44s |  where questions. Right? We care more about who's doing it and
430.08s - 432.62s |  what systems they're touching because they should not have
432.62s - 436.72s |  access to certain systems within security boundaries and other
436.72s - 442.26s |  places. Where the safety and security meet is in the how. How
442.26s - 446.00s |  these events can happen so that we can mitigate the effects of
446.00s - 452.69s |  those faults and the manipulation. All right? So 356
452.69s - 458.69s |  brings in a new concept of SAL. SAL is not directly tied to DAL
459.29s - 463.19s |  despite what a lot of people like to talk about with this.
463.19s - 466.47s |  But what it is is if you look at that table at the top, table 4
466.47s - 472.07s |  4 which is taken directly out of DO356A, it gives you a threat
472.07s - 476.11s |  condition effect severity which kind of looks a lot like the
476.11s - 481.21s |  advisory circulars with the definitions and gives you SAL
481.21s - 485.05s |  levels for that mitigation. But what's unique here is that
485.05s - 490.39s |  something that has an effect condition of catastrophic all of
490.39s - 494.43s |  a sudden has these two SAL levels. Right? That's kind of
494.43s - 499.73s |  weird. Why would you do two SAL levels? The big part about
499.73s - 503.13s |  security development is that we look at individual threat
503.13s - 506.17s |  vectors as it moves through a system because we have to look
506.17s - 510.07s |  at every point in which it could touch a system and have a final
510.07s - 514.25s |  effect that may or may not have a safety effect on the entire
514.25s - 518.49s |  aircraft. So if we do have an effect on the entire aircraft,
518.49s - 521.99s |  we have to go back through our safety analyses and we have to
521.99s - 526.79s |  place mitigations, two of them in this case, of SAL 3 and SAL
526.79s - 532.23s |  2 in our system to prevent a catastrophic threat condition.
532.23s - 539.11s |  So those mitigations have to be developed with security
539.11s - 544.31s |  objectives, the design objectives for SAL 3 and SAL 2.
544.31s - 549.11s |  So if you're developing a system and if you look at the actual
551.39s - 555.85s |  security assurance level objectives, they look very, very,
555.85s - 561.63s |  very similar to exactly what DO-178 and DO-254 because all
561.63s - 565.27s |  these documents are in concert with one another. They all feed
565.27s - 568.37s |  from one another. They all use a lot of same concepts from one
568.39s - 573.57s |  another. They all try to use the same structures. So that makes
573.57s - 578.17s |  it really easy for us to take our cyber security mitigations
578.17s - 584.31s |  and place them into software or hardware and have the process
584.31s - 590.10s |  look the same for development. Alright? So we're going to do a
590.10s - 594.66s |  little bit of a safety analysis on a system, right? So we have
594.66s - 597.68s |  system A, we have system B, we have system C. And then we have
597.70s - 601.34s |  a user display, right? It could be any sort of function here.
601.34s - 604.34s |  So we do our functional hazardous assessment and it says
604.34s - 610.58s |  that this system has a function that is DAL B. Okay? So we're
610.58s - 615.92s |  looking at a path of DAL B, uh, hazardously misleading data to
615.92s - 619.08s |  a display. And what we're going to do is we're going to apply
619.08s - 622.16s |  safety requirements onto this system. So we add in some
622.16s - 626.40s |  monitors for failures and we'll enunciate those. We check the
626.42s - 630.02s |  validity of the inputs. We check the, uh, at system B and system
630.02s - 633.12s |  C, right? System B is just going to do a really simple operation
633.12s - 636.96s |  of adding something on there. It could be either, uh, changing
636.96s - 643.96s |  data or manipulating data or, um, merging data at some points.
643.96s - 645.94s |  And now what we're going to do is we're going to look at a
645.94s - 649.74s |  threat. We have an attack that modifies code or memory and
649.74s - 655.82s |  changes that to 204. That's pretty bad. Um, don't know how
655.86s - 659.34s |  they managed to do that. But when we look at this system,
659.34s - 661.44s |  there's erroneous data that's now flowing through the system,
661.44s - 665.64s |  right? This is the hazard effect that we're looking at. We're
665.64s - 670.54s |  looking at how the, uh, we can cause hazardously misleading
670.54s - 676.86s |  data DAL B impacts to the system. So, fine, guess what?
676.86s - 678.98s |  We're going to hash the memory spaces so that none of that
678.98s - 682.12s |  changes, right? We're going to put hashes in place so that the
682.12s - 685.56s |  values that we're adding or subtracting or, uh, changing
686.30s - 690.28s |  around, the whole memory spaces are then hashed, right? And
690.28s - 694.08s |  we'll get back to why I picked hashing in the first place.
694.08s - 696.54s |  Safety analysis also said that there has to be a system B
696.54s - 700.82s |  prime, which is a secondary thread to the system so that,
700.82s - 705.16s |  um, system, uh, C merges data from both system B and system B
705.16s - 709.82s |  prime. Kind of looks a lot like what we do for pilot side,
709.82s - 715.06s |  copilot side in aircraft. Oh, there was another attack that
715.06s - 720.16s |  our, our pen testing team came up with. They flooded the
720.16s - 722.90s |  interface. They did a DDoS attack on our system C and
722.90s - 726.38s |  prevented data from going through to the user display.
726.38s - 730.88s |  Crashed the system. Well, I guess we need to go through and
730.88s - 733.72s |  put it together another mitigation. So now we're going
733.72s - 736.58s |  to need some sort of DDoS protection, some sort of rate
736.58s - 741.60s |  limiting in there. It's a pretty secure system so far. Except
744.16s - 748.50s |  they found a third attack, which is actually a mode command that
748.50s - 752.34s |  sent into systems, injected at system C, which then back
752.34s - 756.38s |  propagates through the system to system A, which changes a mode,
756.38s - 760.08s |  which then forces data to come out incorrectly without a pilot
760.08s - 765.28s |  commanding a mode change. So you see how there's kind of a
765.28s - 768.42s |  non-linearity through these systems where you could get
768.42s - 772.30s |  these system effects without having exactly, um, changed or
772.30s - 776.68s |  manipulated or without having commanded, uh, uh, commands be
776.68s - 781.64s |  sent and get unintentional data that was not supposed to be
781.64s - 784.74s |  there without some sort of other checks, right? So a lot of
784.74s - 788.38s |  aircraft systems, it's not just that we press a button and the
788.38s - 791.36s |  mode comes through. You press a button, it goes through, it
791.36s - 794.36s |  sends back bits that says, yes, I saw that you changed the
794.36s - 798.92s |  command of the mode. Here's the new mode information. But what's
798.92s - 802.88s |  unique about this is that that mode command may have also
802.88s - 806.52s |  propagated back through the B prime and A prime systems
806.52s - 811.70s |  through the secondary thread and has also manipulate, uh, changed
811.70s - 817.24s |  those modes, which gets around our cross-checking in system C.
817.24s - 820.80s |  So now a system, uh, so the, um, the primary thread and the
820.80s - 824.64s |  secondary threads are now sending the same data, valid
824.64s - 831.47s |  data, across and it's not being picked up by system C. So what's
831.47s - 834.97s |  interesting about this whole development here is that where
834.97s - 838.25s |  safety and, and security really touch is some of the
838.25s - 843.21s |  implementations that we actually have here. So you take a look at
843.21s - 850.99s |  system B and we applied hashing memory. Our safety analysis also
850.99s - 854.19s |  came back and said that B prime needed to be added as a safety
854.21s - 858.89s |  mitigation on the system. But what does that do for the safe,
858.89s - 863.63s |  or security of the system? Right? Now I have a secondary
863.63s - 867.19s |  thread that I can cross-check data against. An independent
867.19s - 872.27s |  thread that somebody may not have access to that I can ensure
872.27s - 876.21s |  that is part of the whole security, um, posture of this
876.21s - 882.05s |  whole entire system. So hashing memory is a great one, right? We
882.07s - 886.01s |  use it in, uh, cyber security in order to, um, prevent
886.01s - 889.75s |  manipulation, intentional manipulation of memory spaces.
889.75s - 893.79s |  Well, over on the aerospace, or on the safety side, they do that
893.79s - 896.99s |  sort of stuff to prevent accidental manipulations from
896.99s - 901.19s |  like, I don't know, uh, single event upsets from the sun,
901.19s - 906.67s |  right? Neutron events on memory spaces. Um, other areas would be
906.67s - 910.81s |  like duplicating or, uh, triplicating data stored across
910.83s - 913.97s |  the system. So that if you have manipulation in one place, you
913.97s - 916.33s |  can go pick it up in another place, and if that one's still
916.33s - 919.51s |  manipulated, you can go and pick it up somewhere else and
919.51s - 923.27s |  cross-check those three, uh, three different memory spaces.
923.27s - 928.29s |  So safety and security have to kind of be developed together in
930.39s - 938.11s |  these systems. Because you have these, uh, concepts in here of
938.11s - 941.11s |  inherited security principles, or, uh, properties of the
941.13s - 946.87s |  system. Say, uh, security is not the only developer of the
946.87s - 950.87s |  system. Safety's doing it. Implementers of code are doing
950.87s - 953.81s |  this. They're developing their own requirements with how they
953.81s - 957.81s |  either think the system should work, or how the system has been
957.81s - 962.39s |  developed in the past, and how other systems have been, uh,
962.39s - 967.29s |  have been developed. And so, we have to take a look at not just
967.31s - 971.95s |  security requirements, we have to look at the entire system
971.95s - 976.39s |  requirements pool to see which items might be part of the safe,
976.39s - 979.89s |  uh, security posture of the system. The reason why we want
979.89s - 981.99s |  to do that is because we're going to take credit for those
981.99s - 986.67s |  in our threat models at some point. And if you take credit
986.67s - 989.43s |  for them in your threat models, you have to provide the
989.43s - 992.87s |  documentation as part of the design objectives. And if you
992.87s - 995.67s |  have to provide data as part of your design objectives, it's
995.69s - 998.03s |  part of your certification baseline, and you want to take
998.03s - 1001.89s |  that credit for it. It all comes back down to the standards and
1001.89s - 1008.32s |  the certification of these systems. Another important, uh,
1008.32s - 1014.26s |  piece in here is that you can also have system effects where
1014.26s - 1018.76s |  safety and security may interact with each other in a negative
1018.76s - 1023.30s |  manner. Where one may trigger, you might want to, you know,
1023.32s - 1027.28s |  trigger a safety event, or you have an event that triggers some
1027.28s - 1032.10s |  safety safeguards that have been in place, and the security of the
1032.10s - 1034.76s |  system is reduced because systems have now been reset and
1034.76s - 1040.14s |  they lost state. You might have security implementations in
1040.14s - 1044.18s |  there, where it prevents data from cross flowing from one side
1044.18s - 1049.04s |  to another, or, um, you might have other pieces where data's
1049.04s - 1052.02s |  unavailable because it's been encrypted, that affects the
1052.04s - 1056.90s |  safety of the system. So it's very important to look at how
1056.90s - 1060.92s |  safety and security interplay in the requirements and determine,
1060.92s - 1064.48s |  like, is this a positive or a negative, um, part of our
1064.48s - 1069.48s |  system. So, um, in summary, aircraft cybersecurity is very
1071.72s - 1076.72s |  young. DO- uh, DO-356 was first released in about, in, uh, 2014.
1077.20s - 1084.64s |  In comparison to the advisory circular that I showed you at
1084.64s - 1089.64s |  first, AC, uh, 25-13-07, that was released in 88. We've had
1092.58s - 1098.94s |  these de- these definitions around in, um, in aviation for
1098.94s - 1105.36s |  almost 40 years. 40 years of development time to learn how to
1105.36s - 1109.24s |  do all these development principles with how to develop
1109.24s - 1113.58s |  safe or safe code, how to device, uh, develop safe
1113.58s - 1117.98s |  hardware, has been going on for a very long time. But the
1117.98s - 1120.38s |  security of these systems, because they're becoming more
1120.38s - 1125.28s |  and more connected and, um, even more highly connected in real
1125.28s - 1130.28s |  time in the future, these systems need better security
1130.28s - 1134.20s |  principles that work with how the systems are developed in
1134.20s - 1142.19s |  order to provide certification boundaries. To touch upon the
1142.19s - 1145.73s |  technological limitations, prior systems in the past used to have
1145.73s - 1150.43s |  federated systems where you had multiple single purpose systems
1150.43s - 1154.93s |  on board, which then moved into more highly integrated systems,
1154.93s - 1157.61s |  which then moved into more highly, uh, integrated
1157.61s - 1162.47s |  networking systems as well. So those boundaries of, um, data
1162.47s - 1167.17s |  that you couldn't get security issues across because of the
1167.17s - 1171.07s |  highly federated nature of these systems is now being whittled
1171.07s - 1173.81s |  away at as part of the development because of the
1173.81s - 1178.95s |  demands of higher speed buses. Airing 429 is not fast at all,
1178.95s - 1184.29s |  but Ethernet is, and we can do that deterministically. The way
1184.29s - 1188.73s |  that security, um, brings those direct impacts has to be
1188.75s - 1192.53s |  developed as part of the architecture because in the end,
1192.53s - 1196.53s |  you can't have a safe system with also having a cyber secure
1196.53s - 1198.03s |  system. Thank you.


url: https://www.youtube.com/watch?v=p1H6-0clP7U
title: DEF CON 32 - RF Attacks on Aviation's Defense Against Mid-Air Collisions - G. Longo, V. Lenders
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=p1H6-0clP7U",
  "title": "DEF CON 32 - RF Attacks on Aviation's Defense Against Mid-Air Collisions - G. Longo, V. Lenders",
  "description": "Aviation's Traffic Collision Avoidance System (TCAS) II has been touted as a foolproof safety net since its introduction in the 1980s. But what if we told you that this supposedly impenetrable system can be compromised? For years, attacks on TCAS have been mere theoretical exercises, foiled by an (accidental) built in security feature. That is, until now. In this presentation, we'll reveal the first working RF attacks on TCAS II, demonstrating how to hijack collision avoidance displays and create fake Traffic Advisories (TAs) and Resolution Advisories (RAs). We'll walk you through the technical challenges of building the necessary tooling using commercial off-the-shelf hardware.\n\nBut that's not all. Our research has also uncovered a second attack capable of remotely disabling an aircraft's TCAS capabilities, rendering it vulnerable to mid-air collisions. The implications are clear: if our findings can be exploited in real-world scenarios, the safety of millions of passengers hangs in the balance. Join us as we lift the lid on this shocking vulnerability and explore the dark side of aviation security.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1581,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.08s - 6.20s | This text was transcribed using whisper model: large-v2

 Hello everybody, so welcome to our presentation on the radio frequency attacks on the
6.76s - 11.00s |  Aviation's last line of defense against media collisions
11.32s - 18.68s |  It will be a talk on the attacks on the traffic collision avoiding system in aviation the so-called TCAS
19.36s - 26.44s |  So my name is Vincent Lenders. I'm a cyber security researcher for most more than 20 years focusing on
26.96s - 33.12s |  The security of wireless networks and I'm also the director of the cyber defense campus in Switzerland
33.28s - 37.20s |  I'll be giving this talk together with Giacomo. I'm Giacomo
37.20s - 40.60s |  I'm a third year PhD student from Italy in the University of Genoa
40.60s - 47.48s |  And I work also on radio security of the Onyx and maritime systems as well. So but go on Vincent
48.88s - 53.44s |  So the air traffic control is a key infrastructure
54.44s - 59.44s |  For safe air travel today with more than 30 millions
60.12s - 62.12s |  flights per year worldwide
62.24s - 66.96s |  The air traffic management is nowadays very complex a thing
67.20s - 72.36s |  So air traffic control helps organizing and optimizing the air traffic flow
72.48s - 77.34s |  It provides situation awareness to ground controllers and also support
77.70s - 85.30s |  To pilots and a very important feature of the air traffic control is to prevent media collisions
86.46s - 92.66s |  So if we look at air traffic control, there are mainly there are different procedures and technologies
93.26s - 96.50s |  for this and there are if mainly three
97.46s - 102.58s |  Technologies that I would like to introduce and are important for for their traffic control
102.58s - 109.50s |  They are all three based on modest. Well, this is a data frame a format similar to in the Internet's as IP
110.10s - 114.74s |  That allows for for wireless communication between aircraft and ground station
115.54s - 117.22s |  so the first
117.22s - 120.34s |  Technology is secondary surveillance radar called SSR
120.94s - 126.70s |  The second one is a DSP and then the third one that will be the main focus of this presentation in this a traffic
127.06s - 132.06s |  Collision collisions avoiding system. So let me start with secondary surveillance radar
132.06s - 133.86s |  This is the oldest
133.86s - 135.30s |  technology
135.30s - 140.38s |  It's it's based on ground stations on radar. So the radars their interrogate
141.42s - 143.42s |  aircraft using this modest
144.82s - 147.66s |  Format the protocol on an uplink on the
148.22s - 153.26s |  1030 megahertz uplink and then the aircraft they respond on a downlink on one
154.26s - 155.86s |  1090 megahertz
155.86s - 157.86s |  the modest downlink
158.14s - 163.70s |  So these messages are very small in contrast to IP package packets which can be like
164.70s - 168.86s |  1,500 bytes this message is very small 56 or 112 bits
169.58s - 172.54s |  but they can entail a lot of information such as the
173.06s - 178.94s |  Velocity altitude and heading and so on of the aircraft. So this is how this is working
178.94s - 183.74s |  This is a kind of an old technology. It's also mandatory and used in all
184.98s - 187.10s |  In all our spaces around the world
187.86s - 194.70s |  Now we have the automatic dependent surveillance broadcast. It's more recent. It has been mandated by the last years
195.22s - 200.18s |  in various airspaces and this is also based on modest but
200.78s - 208.46s |  Instead of having the radars interrogating the aircraft. We have the aircraft determining their own position using GNSS
208.98s - 210.98s |  using for example GPS and
211.18s - 218.10s |  When they know they are on location they broadcast this information of a modest to surrounding aircraft and also to
218.34s - 219.82s |  ground stations
219.82s - 227.54s |  So this is a more precise than secondary radar a much more precise GPS gives you a few meters accuracy
227.82s - 230.90s |  Compared to a few hundred meters for secondary radar
230.90s - 236.94s |  So it's it's welcome to also decrease the separation between the aircraft because of the higher precision
237.94s - 244.06s |  Now we come to the the focus of this talk, which is the traffic alert and collision avoiding system
244.38s - 246.38s |  It's a protocol
246.42s - 248.42s |  between the aircraft
249.26s - 254.66s |  so basically, it's a ranging distance ranging protocol based on request replies also on the
256.50s - 259.32s |  1,030 megahertz uplink and on the
260.78s - 262.78s |  1,090 megahertz downlink
263.30s - 265.02s |  There are the responses
265.02s - 269.94s |  so it's there are a lot a lot a few interrogations replies that happen to basically
270.50s - 276.50s |  Determine how if a collision is going on and how to avoid this collision. This is a very important
277.78s - 279.78s |  system because it's the last line of
280.10s - 286.42s |  defense against media conditions collisions if the other systems are failed like
287.10s - 290.66s |  Secondary radar or ADS-B and it was not possible to keep the separation
290.66s - 296.10s |  This one's kicks in and will make sure that there are no collisions
296.68s - 302.70s |  So why is this important? Well, it's kind of obvious. It goes it's all about human life if there is a
303.22s - 305.02s |  aircraft collision
305.02s - 307.02s |  that this will lead to a
307.54s - 311.10s |  Catastrophic event we had in the 70s, for example
311.94s - 313.94s |  crashes going on also in the 80s
314.38s - 317.02s |  With many deaths and this is why
319.10s - 325.82s |  1987 there was an introduction of the TCAS system and it's now mandatory in many airspaces
325.82s - 330.74s |  It depends on the size of the aircraft and also the number of passengers you have
330.94s - 336.70s |  but then if you are an aircraft that has a certain size and a certain number of passengers you will
336.94s - 341.90s |  Be required to have a TCAS system in the aircraft to avoid collisions
342.90s - 346.34s |  Now TCAS has three main core functions
346.98s - 351.10s |  One is surveillance. The other one is traffic advisory and in the most
351.70s - 354.46s |  Recent version of the traffic collision avoiding system. You have also
355.26s - 359.74s |  Resolution advisories. I will go into the detail of these three functions
359.98s - 362.98s |  So if you're on the picture on the right, we have a typical
363.82s - 367.74s |  TCAS display showing the surrounding aircraft
367.74s - 375.70s |  So this is the surveillance information that you have the aircraft periodically announced themselves and you will see this on this display
376.38s - 378.70s |  Now and there is an aircraft is found
378.82s - 386.74s |  There will be interrogations to get the range for example to get the altitude and the capabilities of the surrounding aircraft
386.74s - 389.54s |  this is all information that will then appear on this display and
390.42s - 394.50s |  If the system realized there may be a collision going on
395.14s - 399.58s |  That that might happen and then there will be some traffic advisory some TA
400.30s - 403.62s |  That is sent to the cockpit as an alarm
404.18s - 410.02s |  Alarming the the pilot that there may be a collision and if this persists after some point
410.46s - 415.82s |  Then there will be a resolution advisory and this is basically to indicate
416.46s - 422.38s |  And command to give a command to the pilot to basically do something and in TCAS too
422.58s - 426.10s |  There are two options basically to resolve the conflict
426.94s - 428.10s |  TCAS too
428.10s - 434.94s |  Foresees that one aircraft should climb and the other one should descend and this should hopefully then prevent the collision
435.02s - 439.38s |  So this is the the key function of of TCAS too
440.34s - 443.90s |  now let's talk about this talk is about the security of TCAS and
444.86s - 448.20s |  obviously, we're not the first to think about this problem, but the
448.88s - 452.32s |  The situation is somehow worrying and yet for
452.92s - 457.48s |  To our perspective also a little bit on unconvincing so far. So there has been some
458.68s - 461.68s |  Warnings, there has been some risk assessments many of them
462.36s - 463.52s |  people
463.52s - 465.08s |  publications
465.08s - 470.04s |  Analyzing the risks the cyber security risks and the risks of attacks against TCAS here
470.04s - 475.24s |  I'm mentioning a couple of those papers one the one we are we have written
476.00s - 478.76s |  Ourselves in the past. So these are warning signs
478.76s - 485.12s |  There are also people and including ourself that have done some simulations to basically to better understand
485.84s - 492.00s |  How pilots would react to TCAS attacks and also what are the conditions under which?
492.40s - 496.08s |  TCAS attacks may work and what are the limitation of these attacks?
496.80s - 497.72s |  for example
497.72s - 501.48s |  we did some work also inviting pilots in a simulator and
501.68s - 505.80s |  Exposed them to attacks and showed how they reacted to those attacks and
506.28s - 509.36s |  Then we had also some some work to better
510.04s - 512.72s |  understand in simulations the theoretical
513.60s - 519.24s |  Limitations of these attacks and what what are the better conditions that are favorable to an attacker?
519.36s - 521.60s |  So this but these are all simulations
522.36s - 527.04s |  Then most recent more recently there has been at an attempt to analyze
528.04s - 530.04s |  experimentally the impact of
530.68s - 538.04s |  Attacks on TCAS and these are the these two papers from research and one is a PhD student working on it building a testbed
538.76s - 544.16s |  And with a TCAS equipment to analyze how the systems with will react
545.00s - 546.32s |  but
546.32s - 552.12s |  Our motivation for this work that will be that Jacomo will be presenting is that despite this prior art?
552.28s - 558.64s |  There are still no convincing experimental and scientific evidence that this TCAS attacks may work
559.16s - 562.68s |  Actually, they may trigger for example resolution advisories
563.80s - 564.88s |  using
564.88s - 566.88s |  commercial and certified hardware
566.96s - 573.04s |  So there was also no so far no established methodology how to test attacks and to see how?
573.60s - 578.64s |  Systems will react in a scientific way and if these attacks are feasible
578.64s - 582.90s |  We would like to also better understand. What are the capabilities needed for an actor?
583.44s - 586.80s |  So we would like to understand. What are the requirements?
587.36s - 591.00s |  To actually need it to to be able to launch those attacks
591.16s - 596.76s |  So this was the basic motivation of a work that now Jacomo will be presenting next
597.36s - 608.30s |  So I needed to descend because you know, I needed to climb under Vincent. So
609.10s - 616.38s |  Yeah, okay. So now the fun stuff begins. So I'll start by addressing your point. So it's a protocol from 1987
616.38s - 621.70s |  So there is it's collaborative. It's in clear. There is no encryption. No PKI. No, whatever
621.70s - 624.62s |  So it's insecure. We already know that let's keep over that
625.14s - 628.94s |  So the first attack that you are going to see it's inducing a TA
628.94s - 630.06s |  It's a very simple thing
630.06s - 636.18s |  You just need to implement the 1.8 thousand pages of standards required to do so and you can find it all of these
636.26s - 642.10s |  Standards in these three key bullet points, which means in order to get a TA you need to be an aircraft
642.10s - 643.86s |  So you need to broadcast your presence
643.86s - 649.02s |  you need to reply to interrogation properly to say that you are at the correct altitude and in a correct position and
649.22s - 655.74s |  Which is our third point being in the correct position so correct range, correct altitude with a consistent identity
656.10s - 659.14s |  the second attack that you will see is about
660.02s - 664.38s |  triggering a resolution advisory. So a resolution advisory happens after a
664.98s - 670.98s |  Traffic advisory. So you first need the first one and then you start a negotiation. So you tell the other aircraft
670.98s - 675.34s |  I perceive you as dangerous. Please do something and how you can choose
675.46s - 682.26s |  Well, there is one conflict resolution algorithms that is used which is the aircraft with the lowest address always wins
682.38s - 689.14s |  so you as an attacker can find out the address of the other aircraft and always pick whenever the other aircraft is going to
689.14s - 690.98s |  climb or descend
690.98s - 696.22s |  Then the first attack is instead not involving an aircraft, but instead a ground station
696.22s - 699.86s |  So how TICAS works is basically it picks up a
700.62s - 704.42s |  Size that it will protect so how much time in the future it will look
704.86s - 710.38s |  Depending on the altitude on the currently selected altitude. This is called sensitivity and it goes in levels
710.50s - 713.22s |  So the higher you are the bigger this area is
713.62s - 718.36s |  Well, if you land in Las Vegas where you have two runways close together, you might
719.06s - 723.10s |  Actually end up in a situation when you point towards another aircraft
723.10s - 729.82s |  So what they did was they allowed ground station to tell the aircrafts to reduce their sensitivity
730.06s - 737.34s |  Well, guess what? You can send this command to any aircraft in the air to disable their TICAS with no authentication
737.34s - 743.50s |  So this is fun. You can disable the anti-collision of whatever you want fun in my understanding of the word, by the way
743.66s - 745.82s |  So why did everyone fail?
746.98s - 749.12s |  So an interrogation cycle
749.12s - 754.40s |  So one interaction of the protocols goes like so you send something and then the other aircraft replies
754.40s - 758.72s |  So this is very standard, but the range that is estimated
758.72s - 765.60s |  So the relative position is done by taking this time of flight. So the time it took to respond and subtracting
766.28s - 767.40s |  128
767.40s - 770.84s |  Microseconds, that's 10 to the power of minus 6
771.20s - 778.24s |  It's a comically short time your scheduler of your operating system is running 1,000 times slower than this
778.36s - 782.64s |  so this has acted for a long time as a security feature because
783.28s - 790.44s |  Let's say low skilled attackers could not manage to have this kind of latency to perform all of the steps of the protocol
790.88s - 796.20s |  Actually, I'm lying to you, but I'm telling you so it doesn't count. It actually is not 128
796.20s - 800.56s |  It's a little bit less because it's not with respect to the start of the packet. It's a little bit later on
800.60s - 806.76s |  So you need to receive, understand what has been said, send the correct thing out at the current time and reply
806.92s - 810.64s |  Not only that, this happens over two different frequency channels
810.64s - 812.44s |  So you need to handle coherency
812.44s - 818.08s |  And you need to be always in the same spot because if you need to do six interactions in a row to get acquired
818.08s - 822.16s |  You always need to reply consistently and at the same time
822.56s - 829.24s |  So it's a difficult thing. So the first problem that we had is that a ticket system is not exactly a docker container
829.24s - 833.48s |  We can you can just put an environment variable telling him where the database is and it runs
833.68s - 838.24s |  So we had to build a testbed before and so this one is our architecture
838.76s - 843.20s |  so the first ingredient is of course a ticket unit, which is what you're testing and
843.48s - 848.00s |  You also need to connect it to a control panel and a traffic display unit
848.00s - 851.40s |  which what we sent was showing to you some antennas and
852.12s - 856.80s |  Not only that an headset because the traffic alerts are going to come out of it
857.32s - 859.04s |  then
859.04s - 865.32s |  You put an attacker into there. So two antennas, an SDR, a computer driving it and because we are scientists
865.32s - 868.56s |  You also need to put something to measure what is going on
868.60s - 871.84s |  So we have a camera that takes a look at the traffic display
871.88s - 878.76s |  you have an a bionic bus simulator that makes the tickets believe that is flying because otherwise it will not transmit and then since
879.56s - 883.36s |  Tampering with the anti-collision system of aircraft. It's let's say unpolite
883.76s - 888.48s |  You need to put everything inside of a cage so that you don't get into jail while doing so
888.48s - 892.64s |  Well, I was helped because they are from the Ministry of Defense, but they wouldn't risk anything
893.36s - 896.12s |  So this is as you can see our testbed
896.12s - 902.16s |  I'm not very good at cable management as you can see, but it was this clusterfuck of cables basically
902.68s - 907.96s |  This is what you can get out of this and also our data gathering process was this very sophisticated
908.28s - 911.84s |  Setup with a webcam placed on a monitor that acted as a stand
912.40s - 914.40s |  So
914.44s - 916.92s |  We got this so as you can see this is OpenCV
916.92s - 922.36s |  So this can be turned as a dual use talk about machine learning and pattern recognition very easily
922.72s - 929.76s |  So we were recognizing where the aircraft was tracked and what distance was commanded and everything else. So technicalities and
930.60s - 936.52s |  Speaking about technicalities, so it's trivial to send some radio protocol. At least people have said to us
937.04s - 940.40s |  Many times so let's talk about what you need to do actually
940.88s - 943.48s |  So you have two TCAS that interact
943.48s - 951.00s |  So they send something on one frequency at two megabit per second and they respond on another frequency at one megabit per second
951.44s - 957.76s |  So when we started this basically three of these interactions were not available in real time
957.76s - 962.00s |  So two megabits is a lot for a software-defined radio implementation
962.32s - 969.12s |  And there were no implementation doing any of these protocols. So the first thing we needed to do was well
969.52s - 974.92s |  First we tested that our testbed worked because if you need to attack something you need to understand if you
975.68s - 977.68s |  Mounted it correctly. Yeah, it works
977.88s - 985.88s |  Then we started by building a decoder that with respect for instance of your dump 1090 or whatever. It could run very very fast
986.72s - 988.76s |  then we brought a
989.28s - 994.16s |  Transmit chain and we got it certified by a RAM tester. So that we got our stamp and
994.84s - 1000.92s |  Now you might be wondering so you have a RAM tester a device that does everything and you are building that yourself
1001.20s - 1005.20s |  Well, yes, you need four hundred thousand dollars to buy one and also
1005.76s - 1010.60s |  The more difficult part of the protocol are not just not implemented into there because you don't need it
1010.60s - 1015.00s |  So you can just send dead beef to an aircraft, but you will not attack it. I guarantee to you
1016.32s - 1022.68s |  There was also this other thing. So can't you just act time and reply random shit all over the airspace?
1022.68s - 1028.32s |  Well, you can't because aircraft transmit things at random in order to not pollute the airspace
1028.32s - 1033.92s |  And also you need to have silence around our response to get the other receiver to pick it up
1033.92s - 1035.92s |  So you cannot just float the air
1036.32s - 1039.76s |  So we explored two ideas. The first one was doing this in hardware
1039.76s - 1044.76s |  It's a lot less expensive otherwise, but you need smart people to do it and I'm not so
1045.04s - 1051.36s |  We started with software-defined radio because you can just buy something you can put some random PhD guy
1051.68s - 1059.00s |  And it's going also to get cheaper over time. And so the idea was can we do this with like less than $10,000?
1060.08s - 1064.48s |  Of course, you need a place to do this and do all of the weird stuff like
1065.24s - 1070.88s |  Tracking putting down. I don't know tell us with jet or something. So the first thing we tried
1071.48s - 1078.52s |  Was trying with Linux real-time and we got 190 microseconds just to reply to a single pulse. So not enough
1078.92s - 1081.20s |  So we needed to do a bunch of stuff
1081.20s - 1085.40s |  So you take a workstation you remove power saving because who cares about it
1085.60s - 1090.24s |  You remove hyperthreading you disable bunch many of the course you remove the GPU
1090.56s - 1093.08s |  Sorry for all the machine learners in the audience
1093.08s - 1099.24s |  and then since we are at a security conference you disable all of the security protections because those are slow all of the
1099.28s - 1101.28s |  Mitigations and whatever we don't care
1102.20s - 1107.32s |  Then you build basically your own Linux you pin the OS on one core
1107.56s - 1112.28s |  You pin the application on some other course and you remove all of the power saving features
1112.28s - 1118.52s |  So you run busy polling and then you compile everything as if it was your Gen 2 custom Linux distribution
1118.52s - 1123.12s |  so extreme flags optimized for architecture profile guided all the jets and
1123.76s - 1130.20s |  Then since you're a software engineer you over complicate things. So how where do you start to over complicate things?
1130.24s - 1133.28s |  so you start from the reception because you need to find out if
1133.80s - 1140.80s |  The victim aircraft has interrogated you the way is you need to build some kind of intelligent preamble detector
1140.80s - 1146.52s |  So going back and forth through your transforms and then you bring up and you understand why you studied mathematics
1146.52s - 1148.80s |  so you bring up all of these random shit about
1149.76s - 1153.16s |  symmetries in the furrier domain and back and forth transforms
1153.64s - 1160.76s |  Then you actually do not need to receive all of the bits that are being sent to you at one point
1160.76s - 1163.80s |  You just decode enough bits and you understand what is being asked to you
1163.80s - 1169.96s |  So you build a finite state machine and you start replying earlier. So you reduce latency. I need those nanoseconds
1170.60s - 1176.12s |  Then of course everything stays into a cache because you don't have the time to modulate anything
1176.12s - 1179.24s |  So you just need a lookup table and save everything into RAM
1179.40s - 1185.64s |  Then you need to get good at programming you need to read all of that Intel manual of 1.3 thousand pages
1185.64s - 1193.04s |  Also that one with full of vmulpd or other single instruction multiple data instruction you remove any mutex because those take
1193.52s - 1195.92s |  100 nanoseconds to run and it's unacceptable
1196.24s - 1201.36s |  You remove all memory allocations and you rewrite the allocator of your program in Rust
1202.04s - 1207.52s |  Because why not and then you add some threads into the mix to over complicate things even more
1207.60s - 1213.68s |  So now after two months you ended up with 40 microseconds more than you started with Wow
1213.96s - 1217.72s |  And so what kind of results you can get from that
1218.72s - 1221.76s |  You can trigger RTA. Oh, wow, it works
1221.88s - 1226.16s |  So as you can see, you can put an aircraft directly on the nose at the same altitude
1226.16s - 1231.60s |  So this will be pretty spooky if I were a pilot and you can also get an array
1231.60s - 1235.16s |  So you can distinguish it because it's red instead of yellow
1235.32s - 1242.60s |  I'd like to point out that even though it's written no GPS position. This is in no way related to GPS spoofing attacks or whatever
1243.60s - 1245.92s |  Also TCAS doesn't need GPS so and
1246.72s - 1252.24s |  Then for the TCAS the activation what you will see on the aircraft is that it starts in
1252.68s - 1260.84s |  Resolution advisory mode then something happens and it turns back to traffic advisory only mode and this happens
1261.48s - 1265.68s |  You cannot reset it back to where it started unless you plug
1266.24s - 1270.96s |  You unplug and replug the TCAS unit, which is very uncomfortable to do
1271.00s - 1275.64s |  You can't get into an avionics bay while you're flying and we wanted to verify it
1275.64s - 1279.28s |  So how can you do that? You fake being a tower and you ask aircraft
1279.28s - 1284.40s |  Can you please tell me the sensitivity level you're operating at and it's going to tell you that it decreased so it works
1285.48s - 1288.80s |  Then we tried to induce a collision avoidance
1289.64s - 1292.08s |  Maneuver for 30 minutes and it worked
1292.32s - 1299.00s |  Then the TCAS unit shut off because it didn't expect flying information with someone directly in the front of your nose for 30 minutes
1299.52s - 1301.44s |  So it's reliable and
1301.44s - 1306.88s |  The thing that we got is that the amount of money that you require is actually quite close to our target
1306.88s - 1312.08s |  You also need the one Italian PhD student that eats canned vegetables for a while, but you can manage
1313.44s - 1315.56s |  It's important vegetables are important
1316.24s - 1320.68s |  So about the sensitivity level attack, I can just tell you that it works always
1320.68s - 1324.56s |  I don't have any graph to show you. It's just going to be a line to works and
1325.44s - 1332.24s |  Instead our system managed to reply within 0.2 microseconds, which for something built in software is
1333.20s - 1334.68s |  smart and
1334.68s - 1339.24s |  Also the jitter so the delay in between two different interrogation stayed within
1339.76s - 1344.96s |  This limit set by the standard. Of course, it's a lot worse than real hardware, but it's very good
1344.96s - 1350.92s |  and so this is the most important slide, which is the success rate so
1351.52s - 1355.80s |  The level of success at one point goes to around 98%
1355.80s - 1361.20s |  So, you know that we are not bullshitting you if you see our nerve talk where they get 100% they are lying
1361.40s - 1365.96s |  So, you know that we aren't and so we get this advantage of around 30 plus
1366.76s - 1372.08s |  Microseconds and why would you care to reply before the 128 microseconds?
1372.08s - 1377.00s |  Well, if you are an attacker and you are on the ground and you want to place an aircraft at distance zero
1377.00s - 1379.92s |  so directly on the nose of another aircraft you need to
1380.52s - 1384.28s |  Reply a little bit earlier and let the speed of light do its work
1384.72s - 1386.96s |  So why do you want to do that?
1386.96s - 1394.76s |  Because some distances automatically trigger a TA on an array and with the canned vegetables from before you can manage to do this
1394.76s - 1399.20s |  Right now with hardware that you can buy at a distance of 4.2 kilometers
1399.20s - 1401.60s |  So if you are within that distance, you can do that
1402.12s - 1406.20s |  If you buy your own quantum computer that magical
1406.64s - 1413.72s |  Unicorn word thingy that does it in zero nanoseconds. You can put this up to this theoretical limit and
1414.84s - 1421.64s |  so we wanted also to find out if we you can do that to an airliner because that's what everyone wants to perform chaos and
1422.76s - 1429.84s |  So you can do that for an airline and find that 950 kilometers per hour with a probability of 80% which is
1430.48s - 1432.12s |  worrying
1432.12s - 1435.52s |  So let's talk about limitations. Let's be straightforward. So
1436.84s - 1443.48s |  You just need to be heard power wise, but you need to buy a power amplifier, which we didn't have but it's RF
1443.48s - 1449.00s |  So I guess it works and also you need to a way to find out if you want to appear in a very precise position
1449.00s - 1455.24s |  The attitude of the victim you're attacking but as you may know you can listen for ADS-B and understand this position
1455.76s - 1460.24s |  Then I conclude so we now know what kind of hardware we need
1460.24s - 1462.72s |  We know what kind of things you need to buy
1462.80s - 1467.40s |  We built a testbed for this and we succeeded basically because
1467.92s - 1473.68s |  We recognize that general SDRs framework are not enough latency wise to perform this kind of stuff
1473.68s - 1478.52s |  Also, like dump 1090 is focused on decoding very very well everything that is coming up
1478.52s - 1486.32s |  But not very very fast and also we focused on trivial technicalities like building your our own memory allocator and whatnot
1487.16s - 1492.20s |  So actually the TRA is very difficult to pull off instead the RA-DOS is
1492.80s - 1499.56s |  Extremely dangerous and also we have a problem because workstation will get faster over time. So this capability will increase
1501.00s - 1503.00s |  so
1503.28s - 1511.08s |  Systemic it's a systemic problem about a set a very delicate topic. So we had to disclose this in a very
1512.04s - 1514.64s |  Complex environment we have disclosed it basically to
1515.04s - 1520.40s |  whoops manufacturers and a bunch of authorities both national and
1521.08s - 1522.60s |  international that have
1522.60s - 1528.24s |  Acknowledged so manufacturer basically said yeah, it's a problem in the standard. Yeah, we're going to do something about it
1528.24s - 1536.00s |  And as it stands at the moment, there is no way to fix any of these attacks
1536.84s - 1538.84s |  but
1538.92s - 1542.56s |  After some kind of work now we know
1543.04s - 1548.52s |  That something has to be done and something will happen because they are already working on new
1548.84s - 1555.68s |  Iterations of collision avoidance standards. Also, it's a field what it's very important the safety of everything
1555.68s - 1561.92s |  So it's going to happen somehow. So if you want to know more we have a scientific paper coming up
1561.92s - 1563.52s |  It's using security
1564.44s - 1570.40s |  If you can't wait you can just ask me and I will hand over to you a PDF if you are not smart on
1570.40s - 1572.40s |  a USB key otherwise via email
1572.68s - 1574.68s |  So that was it
1575.20s - 1577.20s |  Hope you liked it


url: https://www.youtube.com/watch?v=ksbFhXdF2EI
title: DEF CON 32 - Physical OSINT - Lukas McCullough
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=ksbFhXdF2EI",
  "title": "DEF CON 32 - Physical OSINT - Lukas McCullough",
  "description": "Open source intelligence may sound like something you\u2019ve never done, but even something as simple as finding your old friends on social media overlaps with skills required for the job. Learn about what OSINT is, how to start an investigation, and resources used by experts to collect the maximum amount of data on a facility before ever visiting the site.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 943,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.11s - 2.67s | This text was transcribed using whisper model: large-v2

 Hello, hello.
2.67s - 4.87s |  So I have just about a minute till I start,
4.87s - 6.39s |  but I'll get started now.
6.39s - 8.03s |  Good morning, everyone.
8.03s - 11.59s |  Hope you had a good Saturday night, some parties and stuff.
11.59s - 13.91s |  So just a little bit of background on me.
13.91s - 15.43s |  I'm from Physical Security Village.
15.43s - 16.55s |  My name's Lucas.
16.55s - 19.23s |  I'm a grad student at BU, cybersecurity and criminal
19.23s - 21.67s |  justice major.
21.67s - 24.63s |  So I'm just going to go over a little bit of what is OSINT.
24.63s - 27.11s |  So OSINT is really anything on the internet
27.11s - 30.67s |  that can be classified as usable, right?
30.67s - 33.07s |  As long as you don't have to break into anything or pay
33.07s - 36.47s |  for it, because I'm a broke college student,
36.47s - 39.27s |  that is what I consider open source intelligence.
39.27s - 44.31s |  So not hacking into anything, et cetera, et cetera.
44.31s - 47.39s |  So where you can apply the information,
47.39s - 48.79s |  there's tons of organizations that
48.79s - 51.79s |  use open source intelligence, one of them being Trace Labs.
51.79s - 54.69s |  This is where I got my start in open source intelligence.
54.69s - 58.89s |  What it does is they have a crowdsourced game,
58.89s - 62.77s |  like a CTF game, where you take information
62.77s - 64.49s |  based on missing people.
64.49s - 67.49s |  You try to help find them, but it incentivizes you,
67.49s - 69.53s |  because you get points based on how actionable
69.53s - 71.13s |  that intelligence is.
71.13s - 73.57s |  So it's a really good way to innovate on the fly,
73.57s - 76.41s |  and it makes you feel good afterwards.
76.41s - 79.77s |  Also, shout out to Joe Gray from the OSINTian.
79.77s - 82.93s |  He taught me a lot of what I know.
82.93s - 86.13s |  So commonly used resources in OSINT
86.13s - 88.45s |  are basically social media, right?
88.45s - 90.45s |  So everyone here, I assume, is on LinkedIn
90.45s - 91.49s |  and has been posting.
91.49s - 95.01s |  So if I were to follow you, you were my target,
95.01s - 99.41s |  I could see information based on your career, what
99.41s - 101.19s |  you're striving to achieve.
101.19s - 103.29s |  Everyone posts stuff like that.
103.29s - 105.57s |  And then from there, I'll probably get your full name.
105.57s - 107.81s |  You could go to Instagram, Facebook, stuff like that.
107.81s - 109.93s |  You could find family, friends.
109.93s - 112.77s |  And then once you start getting to know this person's life,
112.77s - 115.33s |  you're really able to insert yourself into their story
115.33s - 118.89s |  and get more information on them than they probably
118.89s - 121.45s |  know is out and available.
121.45s - 125.61s |  So has anyone here posted a photo of their new badge
125.61s - 128.81s |  the first day that they got to work?
128.81s - 132.01s |  OK, well, a lot of people do, and it's a big security risk.
132.01s - 135.29s |  It's a great part of OSINT and shifting to social engineering,
135.29s - 138.97s |  because that just shows, oh, I'm a new person.
138.97s - 140.29s |  I got my badge.
140.29s - 142.47s |  And now I know what new people with their new badges
142.47s - 143.27s |  look like as well.
143.27s - 146.47s |  So that's a security risk in this.
146.47s - 148.47s |  So I'm going to go over some tools that are used
148.47s - 150.75s |  a lot in OSINT investigations.
150.75s - 152.19s |  First one being Multigo.
152.19s - 155.95s |  So Multigo has so many different databases it pulls from.
155.95s - 160.23s |  You can just insert a name, an address, phone number,
160.23s - 163.55s |  any sort of identifier, and it will pull from those databases
163.55s - 167.07s |  any objects listed with that same identifier.
167.07s - 169.39s |  So I personally have not accessed
169.39s - 172.35s |  all the APIs in Multigo, but it's a great place
172.39s - 176.11s |  to find new leads that you didn't even
176.11s - 178.19s |  know were actually available.
178.19s - 181.35s |  It's a great starting tool.
181.35s - 185.35s |  So Whois is going to link a little bit next to the tool
185.35s - 187.15s |  I show afterward.
187.15s - 190.55s |  It just turns domain names into server IPs.
190.55s - 192.39s |  So that's really useful for when you're
192.39s - 194.39s |  trying to do OSINT on a company.
194.39s - 196.81s |  You have their domain name, and then you can get their IPs,
196.81s - 198.71s |  and then you shift to Shodan.
198.71s - 201.43s |  So Shodan shows technologies and stuff
201.43s - 206.07s |  like that for what's hosted on that server IP.
206.07s - 209.63s |  So it'll show, if you can see the open ports in the top
209.63s - 212.55s |  right, it also shows what is returned
212.55s - 214.47s |  by each of those ports.
214.47s - 215.99s |  And then in the bottom, it'll show
215.99s - 218.91s |  what kind of operating system, et cetera,
218.91s - 222.07s |  is running on that machine.
222.07s - 224.71s |  Next one up is, I don't know how to pronounce it.
224.71s - 226.91s |  It's either Wiggle, Weigel.
226.91s - 229.91s |  Wiggle.net is where all people who do war driving
229.91s - 233.23s |  upload their data for the public to browse.
233.23s - 234.79s |  This is super useful, essentially,
234.79s - 238.39s |  for when you're looking at commercial spaces,
238.39s - 241.95s |  you can see what Wi-Fi networks are operating in that area.
241.95s - 244.47s |  And you can kind of narrow down what router, et cetera,
244.47s - 245.91s |  is there.
245.91s - 249.83s |  And the MAC addresses are listed with the router, with the SSID.
249.83s - 252.07s |  You can find out which manufacturer
252.07s - 253.43s |  created that router.
253.43s - 255.07s |  And you can cross-verify that.
255.07s - 257.35s |  If you see a picture of it, let's say in a Google review
257.35s - 259.43s |  or something like that, you see a Cisco router,
259.43s - 262.79s |  you see an address that is generated by a Cisco router
262.79s - 265.23s |  as well, then you know that's the router and the network
265.23s - 267.99s |  that you're going to have to look at.
267.99s - 272.15s |  So a lot of OSINT investigators love frameworks.
272.15s - 274.99s |  So this framework here, it has, you
274.99s - 276.71s |  see these little blue dots?
276.71s - 279.35s |  Each one of those, I know it's really small,
279.35s - 283.39s |  represents a different amount of information
283.39s - 285.71s |  that you want to get, whether it's email addresses,
285.71s - 289.35s |  usernames, anything from what language
289.35s - 290.75s |  you see on the screen.
290.75s - 292.55s |  You click on that blue dot, and then you
292.55s - 296.31s |  have those websites that this person has graciously
296.31s - 299.63s |  created to point you in the direction of that tool
299.63s - 300.99s |  that you need.
300.99s - 303.07s |  A lot of people use their own frameworks
303.07s - 306.75s |  and create their own routines that they go
306.75s - 308.47s |  through for each investigation.
308.47s - 311.05s |  But this is a great way to find your own
311.05s - 315.55s |  by finding those tools that you gravitate towards a lot.
315.55s - 317.67s |  So I'm going to transition to locations a bit.
317.67s - 319.99s |  I think everyone knows Google Dorking.
319.99s - 326.95s |  So you can use Google Dorking for finding floor plans,
326.95s - 329.07s |  rental agreements, stuff like that.
329.07s - 333.03s |  A great thing to know is there's a lot of information
333.03s - 335.27s |  that's listed by address, and especially
335.27s - 337.51s |  if you're looking to high-rises and stuff like that.
337.51s - 339.55s |  High-rises don't typically change shape
339.55s - 341.31s |  from the first floor to the top floor.
341.31s - 345.15s |  So it's mainly cookie cutter every way up.
345.25s - 347.95s |  So this is an example of finding information from an address
347.95s - 350.47s |  rather than finding information on an address.
350.47s - 352.19s |  So this is Master Lock here.
352.19s - 354.39s |  If you put in their address there
354.39s - 356.83s |  and you put file type PDF, it shows only things
356.83s - 359.71s |  that have the address listed in that PDF.
359.71s - 362.51s |  So I found one down here named Restricted Information.
362.51s - 365.91s |  And so, of course, I want to click on it.
365.91s - 367.47s |  And when I click on it, I find it
367.47s - 370.51s |  is a template for how they fire people, which
370.51s - 373.19s |  is really interesting to have on the open internet.
373.19s - 377.79s |  It's good to know that it's available.
377.79s - 380.29s |  So if you ever want to scare someone who works at Master Lock,
380.29s - 382.59s |  feel free to send it to them.
382.59s - 385.51s |  And not to pick on them, but I did find another thing.
385.51s - 387.67s |  This is a great social engineering avenue, right?
387.67s - 390.75s |  So you have a contract between the state of Wisconsin
390.75s - 392.07s |  and Master Lock, right?
392.07s - 393.63s |  And at the bottom, you see there's
393.63s - 396.87s |  the name and phone number and email of that contact.
396.87s - 398.97s |  So what you can do is become a middleman, right?
398.97s - 401.27s |  And that's just finding something on the open internet.
401.27s - 404.99s |  You don't have to go through that person's email just
404.99s - 406.07s |  to find this information.
406.07s - 410.19s |  I don't know why it's on Google, but it's a great social
410.19s - 412.47s |  engineering avenue.
412.47s - 415.67s |  So next up, just as I said, commercial properties
415.67s - 416.47s |  are great.
416.47s - 419.51s |  So very few companies own their offices.
419.51s - 422.39s |  So they rent from a high-rise, stuff like that.
422.39s - 425.11s |  And everyone right now is looking to rent, right?
425.11s - 427.75s |  Everyone wants to get someone in their space.
427.75s - 430.23s |  So they post those floor plans.
430.23s - 434.59s |  They post what other large companies are there.
434.59s - 436.95s |  So you want to go there, you know?
436.95s - 439.63s |  And they're very uniform in the way that they're stacked.
439.63s - 442.35s |  So if you get one floor plan for a floor,
442.35s - 446.13s |  it's typically going to be the same all the way up.
446.13s - 450.89s |  So this is the new tool that I found for this year.
450.89s - 452.81s |  It's called GeoSpy AI.
452.81s - 456.97s |  So it works by you put an image right into the browser.
456.97s - 458.17s |  You can pay for an API.
458.17s - 460.81s |  I don't feel like there's a need for it quite yet.
460.81s - 462.93s |  And you get stuff like this.
462.93s - 465.93s |  So if you see on the right side there, it's on my phone.
465.93s - 469.69s |  You can see it shows approximate location of where it is.
469.69s - 471.89s |  So this photo was actually taken in Shanghai,
471.89s - 473.85s |  but it said it was in Hong Kong.
473.85s - 476.73s |  So it's approximately 760 miles away.
476.73s - 478.29s |  Not a great look.
478.29s - 480.89s |  However, it does work on different locations.
480.89s - 483.17s |  It's really good at getting a baseline of where
483.17s - 485.77s |  this image was taken, and then you have to verify, right?
485.77s - 489.73s |  So this one, if you can see on the right, it is a bit small.
489.73s - 493.05s |  It's three kilometers away from the actual target location.
493.05s - 496.33s |  So that is a very good baseline for just throwing
496.33s - 501.61s |  an image into a tool and shooting out this information.
501.61s - 505.09s |  Finally, I'm going to go over a applied OSINT vignette.
505.09s - 511.61s |  So I'm going to go walk through a small investigation I did.
511.61s - 513.93s |  It involved a massage parlor.
513.93s - 519.09s |  It was for a bit of a, what's the word?
519.09s - 522.49s |  Information gathering for a local department.
522.49s - 524.57s |  So this is just Google image reviews, right?
524.57s - 526.49s |  Or Google review images.
526.49s - 527.93s |  You can see on the left-most side,
527.93s - 529.51s |  that is just an image of the hallway.
529.51s - 532.65s |  You see there's three doors, and then on the second image,
532.65s - 534.35s |  you can see that there's a monitor there.
534.35s - 535.77s |  That monitor is really interesting
535.77s - 537.73s |  because every single room has one.
537.73s - 542.45s |  So what that has is every camera location, right?
542.45s - 545.25s |  So whoever's inside can see what's going on on the outside.
545.25s - 546.93s |  And then on the right, you can actually
546.93s - 550.41s |  see one of those cameras above that door.
550.41s - 552.13s |  So as I said, cameras, right?
552.13s - 553.93s |  So if you're doing an OSINT investigation,
553.93s - 556.17s |  you always want to see entrances, egresses,
556.17s - 557.37s |  and especially those cameras.
557.37s - 560.35s |  Because if you're going to do a pen test or something
560.35s - 562.77s |  like that, you probably don't want to get caught by those.
562.77s - 565.89s |  So on the left here, we have one large camera on the roof.
565.89s - 568.69s |  And it's pointing at the first three parking lot spots
568.69s - 571.09s |  and further back behind them.
571.09s - 573.85s |  Additionally, you have the camera on the right in red.
573.85s - 574.97s |  And that's facing the door.
574.97s - 578.85s |  So it has an image of anyone trying to enter that location.
578.85s - 580.45s |  And then there's a back door if you go.
580.45s - 581.69s |  It's just Google Maps, right?
581.69s - 583.69s |  Street view, you drop the pin.
583.69s - 585.49s |  You can look around a building, and there's
585.49s - 587.77s |  another camera there based on that back entrance.
587.77s - 589.25s |  But it's only facing one way.
589.25s - 590.97s |  So if you wanted to enter from the back,
590.97s - 594.77s |  you could go from, I think this was the east-facing side.
594.77s - 598.45s |  So you'd go from the west, and then no one would know.
598.45s - 601.47s |  And then, as I said, the four buildings, right?
601.47s - 603.83s |  If you want to confirm, especially
603.83s - 606.75s |  for smaller strip malls and houses like that,
606.75s - 609.39s |  you can see everyone likes HVAC units now.
609.39s - 612.27s |  It's how you cool your house, your building.
612.27s - 615.83s |  You can see the piping goes to four different locations.
615.83s - 618.35s |  So that approximately, it's like there's
618.35s - 620.47s |  four different rooms that need to be cooled, right?
620.47s - 623.89s |  So in this photo here, you can see there's three,
623.89s - 625.55s |  and then there's another one behind it.
625.55s - 627.35s |  So you're not able to see it in this photo.
627.35s - 629.95s |  That's great about cross-referencing
629.95s - 632.07s |  with different photos.
632.07s - 636.55s |  And then finally, we have a wiggle.net example.
636.55s - 638.71s |  So for this, it shows, if anyone's
638.71s - 640.19s |  familiar with war driving, right?
640.19s - 643.03s |  It shows all the networks down in the bottom on the street.
643.03s - 646.59s |  No one turned up into that actual lot, unfortunately.
646.59s - 649.95s |  However, you can see all those networks, and some of them
649.95s - 651.63s |  with varying levels of security.
651.63s - 655.63s |  And it shows a MAC address and the SSID.
655.63s - 658.39s |  So going back on what I said before,
658.39s - 661.79s |  it's really useful to know what manufacturer
661.99s - 664.67s |  made that router for exploitation
664.67s - 667.71s |  and stuff like that.
667.71s - 670.75s |  It's a great addition to investigations,
670.75s - 674.31s |  stuff like that.
674.31s - 680.43s |  Any questions?
680.43s - 682.87s |  That was really quick, so I wasn't expecting that.
682.87s - 687.76s |  All right, thank you.
687.76s - 690.10s |  Oh, yeah.
690.10s - 711.34s |  Yeah, I can take questions down here.
711.34s - 712.18s |  Mic down here?
712.18s - 720.53s |  OK, perfect.
720.53s - 733.90s |  Yeah, I can hand this one to him.
733.90s - 736.06s |  I think that one's on now.
736.06s - 741.02s |  So once you get beyond the online research,
741.02s - 749.10s |  can you talk a bit about the in-person surveillance aspects?
749.10s - 754.26s |  So the question was the shift from online to in-person.
754.26s - 762.48s |  That shifts more to tactical surveillance measures.
762.48s - 765.84s |  So you've got your camera, you've got the black van,
765.84s - 767.28s |  inserting bugs and stuff like that.
767.28s - 769.52s |  I don't have much experience in that field.
769.52s - 771.76s |  That's where you'd shift towards that social engineering
771.76s - 772.56s |  aspect as well.
772.56s - 774.60s |  I can speak a little bit on the social engineering
774.60s - 777.40s |  rather than the covert intelligence gathering.
777.40s - 781.04s |  So with those ID badges and with those photos
781.04s - 783.08s |  you can specifically find on LinkedIn,
783.08s - 785.68s |  you can throw together a get up that looks pretty legitimate.
785.68s - 788.72s |  And then you can have your own free will, whatever
788.72s - 791.76s |  building you want to enter.
791.76s - 795.80s |  Additionally, carrying a lot of stuff,
795.80s - 799.60s |  like two, three boxes of donuts, a ladder,
799.60s - 800.92s |  two buckets of paint.
800.92s - 803.60s |  Tons of people love to hold doors open for you.
803.60s - 806.28s |  And I know everyone gets training on that to not do
806.28s - 810.40s |  that, but everyone forgets it in the moment.
810.40s - 813.16s |  So I'd highly recommend just picking up a hard hat,
813.16s - 817.24s |  picking up a high-vis vest, and seeing where that gets you.
817.24s - 818.70s |  And then from there, once you're in,
818.70s - 820.60s |  you gain access to a lot of that information
820.60s - 822.28s |  that's not open source.
822.28s - 824.88s |  So you get access to desks, stuff like that.
824.88s - 827.44s |  So it's always great to carry a set of common access keys
827.44s - 830.40s |  on you, just so you can open those cabinets
830.40s - 832.60s |  and get access to documents that people are like, oh,
832.60s - 833.36s |  it's in my office.
833.36s - 834.84s |  There's no need to secure it anymore
834.84s - 837.40s |  than putting it in my desk.
837.40s - 853.20s |  But yeah, does that answer your question?
853.20s - 854.24s |  All good.
854.24s - 857.48s |  Maybe this is a silly question, but you
857.48s - 862.40s |  talked about working for a local authority.
862.40s - 863.88s |  How do they approach you?
863.88s - 867.76s |  Is this part of your job, part of your studies,
867.76s - 873.64s |  or do you do any investigations of your own initiative?
873.64s - 876.64s |  So the question was how I referenced
876.64s - 883.60s |  that I worked with a local department for the OSINT vignette
883.60s - 884.40s |  that I showed.
884.40s - 888.48s |  So I work for another volunteer organization
888.48s - 890.16s |  in open source intelligence.
890.16s - 891.84s |  And I just give them the information.
891.84s - 894.76s |  I'm not involved in, it's very compartmentalized.
894.84s - 897.00s |  So I don't know what they do with that information.
897.00s - 901.08s |  I just find it and then make an intelligence report
901.08s - 902.96s |  kind of thing.
902.96s - 905.68s |  They did a lot of good work around the Super Bowl.
905.68s - 908.96s |  Every Super Bowl, they do OSINT investigations
908.96s - 911.04s |  based on human trafficking.
911.04s - 914.52s |  And it shifts from that missing persons cases
914.52s - 915.40s |  to human trafficking.
915.40s - 920.00s |  It's kind of similar, but it's a little bit more harder,
920.00s - 920.52s |  for sure.
920.52s - 923.28s |  But it does have that same sort of satisfaction
923.28s - 939.32s |  that I'm being helpful.
939.32s - 940.28s |  I think that's a wrap.
940.28s - 942.52s |  Thank you so much for coming out.


url: https://www.youtube.com/watch?v=sp91zygVcmE
title: DEF CON 32 - Curious Case of Alice&Bob: What You Can Do as Digital Investigators - Catherine Ullman
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=sp91zygVcmE",
  "title": "DEF CON 32 - Curious Case of Alice&Bob: What You Can Do as Digital Investigators - Catherine Ullman",
  "description": "The game is afoot! The curious case of Alice and Bob will explore beyond the surface of technical know-how. Attendees will navigate the intricate labyrinth of digital investigation, learning not just 'where' to seek digital clues \u2013 perhaps hidden in the registry \u2013 but crucially, 'why' these details matter and 'how' they fit into the larger puzzle of our investigation. Join me on a narrative adventure illuminating the practical use of tools in a real-world scenario. For both seasoned and aspiring digital sleuths, this talk aims to sharpen investigative skills, setting or recalibrating your expectations of what digital forensics can realistically achieve.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3233,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.44s | This text was transcribed using whisper model: large-v2

 Alright, good afternoon everyone! Good afternoon. Welcome to DEF CON, welcome to Creator
6.44s - 13.22s |  Stage. Thank you for all being here. Um, before we begin, just a couple of quick notes. Uh,
13.22s - 18.22s |  number one, that these talks are being recorded and also being streamed. Um, as far as we
21.32s - 26.40s |  just got word that there is some technical difficulty with the slides on the stream, so we
26.40s - 32.64s |  apologize for that. Um, and yes, these, uh, the video of the talks will be available, uh,
32.64s - 38.84s |  eventually. Uh, you know, having done this for years, usually around, could be really
38.84s - 43.84s |  quick, or it could be in September or October. Um, for those of you, this is, if this is your
46.12s - 51.12s |  first DEF CON, welcome, welcome, enjoy. And, um, for this talk, it is proudly presented by
51.52s - 56.52s |  the Packet Hacking Village. And it is my pleasure to introduce to you someone we consider a
64.66s - 69.66s |  friend for years. She is the author of The Active Defender. Uh, and, uh, she also, and you
69.66s - 74.66s |  are all in for a treat today, that she has some, she has fascination and also, uh, good
86.14s - 91.14s |  knowledge on mysteries and, um, also the afterlife as well. Mmm, mmm. And it is my immense
91.14s - 96.14s |  pleasure to introduce to you all our first talk and our friend, Dr. Katherine Allman.
108.20s - 115.48s |  Thanks, Ming. So, uh, my, my handle's investigatorchick, for anyone who's looking, we'll
115.48s - 121.06s |  cover that in a minute. Um, this talk has essentially two things going on in it. So, you're
121.08s - 127.12s |  going to hit, see me giving a talk, but I'm also going to play the narrator role. So, you will see
127.12s - 132.12s |  two different things happening within this talk. So, this is just me telling you a little bit
134.26s - 138.50s |  first about what we're going to discuss. So, I'm going to give you a little bit of information
138.50s - 143.34s |  about myself, then we're going to talk specifically about the investigative process, then we're
143.34s - 147.58s |  going to talk specifically about some individual elements of that process, scoping, data
147.60s - 151.90s |  gathering, data analysis, data correlation, timeline analysis, and what goes on in
151.90s - 157.14s |  post-incident. Um, and then I'll summarize and we'll do some Q&A. Who here has some
157.14s - 162.74s |  background in digital forensics? A few of you. And who of you are just kind of like curious
162.74s - 167.66s |  about digital forensics? A bunch of you. Okay, cool. It's good for me to really have a good
167.66s - 172.66s |  feel for this. All right. So, a little bit about me. Um, as I said, my handle's investigatorchick.
173.18s - 178.18s |  Um, it's one letter too long. So, if you look for me on Twitter or X, whatever they're calling
180.42s - 186.32s |  it these days, it's investigatorchick, uh, only because there's a letter missing. Um, and
186.32s - 190.86s |  then on all the other platforms, it's investigatorchick. So, I've been at the University of
190.86s - 196.66s |  Buffalo for over 24 years, going on to 25. I'm on staff at a bunch of conferences, um,
196.70s - 202.90s |  including here, I'm with Packet Hacking Village. Um, I volunteer and am not full staff, but
202.90s - 207.24s |  volunteer for a bunch of other things. I've done a ton of speaking and I really love
207.24s - 213.36s |  sloths. So, this is my boy Flash that you can kind of see up here in that corner. Uh, I
213.36s - 219.90s |  adopted him at the zoo. So, let's talk about the investigative process. First of all, let's
222.50s - 226.54s |  back up and talk about what forensic science is, especially since many of you are new to
226.54s - 231.96s |  this field. So, it's this idea that we're going to apply science, right, to criminal and
231.96s - 236.96s |  civil law, although in some cases, we're not even looking at the details of law. So, um, in
238.30s - 243.20s |  my case, um, I do a combination of things, both with law enforcement, where that is the
243.20s - 248.20s |  case, and I also do things like employee relations. So, sometimes it's, it's policies.
249.48s - 255.48s |  But generally speaking, one of the history, the historians who is most important in this
255.48s - 261.62s |  field is this awesome guy named Edmund Locard. Who's heard of Locard? Anybody? A couple
261.62s - 266.56s |  people. All right. So, he's, he's awesome. He was a French criminologist. And where he's
266.56s - 272.40s |  really started was this idea of, um, dactylography, which is the study of fingerprints. And a
272.40s - 277.40s |  lot of what we use today came from what he originally created, which is pretty awesome. Um,
279.68s - 283.88s |  and he was a pioneer and, and worked in this field. And there were other folks who were
283.88s - 289.32s |  involved with it. And ultimately, he was the guy that we, we followed for the, for the
289.32s - 294.32s |  fingerprint stuff. So, this is his famous exchange principle. And it's this idea that, you
295.52s - 298.70s |  know, ultimately, if a criminal's going to do something, they're going to leave something
298.70s - 303.70s |  behind, right? So, every contact leaves a trace, is the sort of generalization that we make
304.90s - 309.90s |  for these folks. Um, but really what we're talking about, um, is the, the exact quote is
310.80s - 315.80s |  what you see on the slide here. That is what he actually said. So, for, for digital
315.80s - 320.80s |  forensics, we're talking about logs, typically. So, what do we mean by digital forensics?
322.54s - 327.64s |  Well, it's digital forensics because we're talking about digital mediums, right? So, digital
327.64s - 331.92s |  devices, we're usually talking about computer crime. And we're going to identify, we're
331.92s - 337.56s |  going to examine digital media and look for evidence of whatever it is in a forensically
337.62s - 342.56s |  sound manner. I'm not going to read these, um, descriptions to you because I know you can
342.56s - 348.60s |  all read them yourselves. Um, but this is the basic idea. And the process in digital
348.60s - 353.60s |  forensics, and we'll see how this is a little different from traditional forensics. So,
353.60s - 358.94s |  things like DNA, um, we'll talk about in just a second. But what's really important is
358.94s - 364.84s |  that we acquire this evidence that we're going to take a look at and we're going to
364.84s - 369.30s |  acquire it with the understanding that we're not going to change anything. We need
369.30s - 374.48s |  something called chain of custody. So, you can see that form on the, on the one side
374.48s - 378.84s |  that talks about specifically, um, I know the, the form itself is sort of hard to read,
378.84s - 383.68s |  but it, it's a property evidence form. So, what happens is when you collect this
383.68s - 388.02s |  information, so you, you, you get a computer, you get a drive, or you get something that
388.02s - 393.60s |  you're going to image, it shows the transition of who had it from one to another. Because
393.62s - 400.02s |  if you can't show a clear and distinct path that that evidence went, then something could
400.02s - 404.54s |  have changed or been messed with. I'm sure at least some of you have heard about this
404.54s - 409.60s |  on the news. Yes? Yeah. So, this is really important, especially in the, in the criminal
409.60s - 415.04s |  side of things. Um, we use sometimes what are called right blockers. In fact, I, I almost
415.04s - 420.72s |  always use right blockers because they, uh, there are physical and there are, um, software
420.72s - 425.10s |  kinds of right blockers. The thing you see the picture of in that bottom corner is a
425.10s - 431.02s |  physical right blocker. So, you plug your device into, uh, whatever thing. So, in that
431.02s - 436.00s |  picture there, you see a thumb drive plugged into it. And then that prevents anything from
436.00s - 441.82s |  being written or changed on the disk. Same basic concept with software, but, um, hardware
441.82s - 446.50s |  tends to be kind of the gold standard. And so, we, we have to, you know, authenticate.
446.50s - 451.92s |  We have to make a copy of that information without changing the original. And that is
451.92s - 457.58s |  how we do that. So, I mentioned there's a distinction between traditional and digital
457.58s - 465.80s |  forensics. Who watches things like CSI or, um, you know, any of the TV shows that deal
465.80s - 470.60s |  with criminalistics? At least a few people, right? Yeah. And I get a lot of people who
470.60s - 474.64s |  say, oh, that stuff's crap. And what I'll tell you is that's actually not true. There's
474.64s - 480.44s |  a lot of stuff that's, like, legit on those shows. What's not real is the time frame.
480.44s - 486.70s |  The time frames are like, you know, we're going to do a DNA analysis. It took 30 minutes.
486.70s - 491.26s |  Badass. Except that, you know, in real life, DNA could take, like, months to come back
491.26s - 497.50s |  because it's a very, very slow process. But with traditional forensics, like DNA, you
497.50s - 503.64s |  have to destroy the evidence to actually collect it and analyze it. So, for DNA, you take a
503.64s - 508.60s |  sample and that sample's run through a process and the act of running it through a process
508.60s - 513.28s |  changes it. Same thing with, like, something like fingerprints, right? When I collect a
513.28s - 519.40s |  fingerprint, whether it's using tape or some other mechanism, you're altering that. You
519.40s - 525.56s |  can't keep it pristine. But they don't expect that you can do that with digital forensics.
525.56s - 531.76s |  It's a very big distinction. They don't want us changing anything. All right. So, let's
531.76s - 536.80s |  move along to the actual investigative process. So, we have a number of steps. This is a very
536.80s - 543.20s |  high-level talk. I'm going to talk a little bit about tools, mostly to kind of give you
543.20s - 548.76s |  a hint about what kind of tools we use and maybe how we use them. But this is not a tool
548.76s - 555.00s |  talk. So, lots and lots and lots of talks cover forensic tools. So, there's lots of
555.00s - 559.48s |  stuff out there. But I wanted to focus more on the process and the mindset and the thinking
559.52s - 564.56s |  behind this than I do about the specific tools. So, these are going to be our steps. So, the
564.56s - 570.56s |  first step is the scoping call. And, oh, and I want to mention that you're going to see
570.56s - 576.20s |  this process often is not linear. We go from one to another and then we may go back and
576.20s - 596.29s |  we may see that process need to be repeated. So, let's go on to our next slide. So, here,
596.29s - 602.41s |  this is where I get to be your narrator. The scoping call. Detective Olivia Hart sat
602.41s - 607.41s |  in her dimly lit office, the soft glow of her desk lamp casting long shadows across
607.41s - 612.69s |  the worn wooden surface. The room was silent, save the occasional creak of the floorboards
612.69s - 618.85s |  beneath her feet. She leaned back in her chair, running a hand over her tired eyes. Her cell
618.85s - 625.05s |  phone rang, shattering the eerie silence. Detective, it's Captain Anderson. We've gathered
625.05s - 629.33s |  some members of the digital forensics team to assist us with this latest homicide. The
629.33s - 636.17s |  victim is Bob Byte. The sound of shuffling papers filled the air as team members began
636.17s - 640.57s |  to take notes and prepare themselves for the investigation ahead. The captain ran through
640.57s - 646.65s |  the basics, the time of discovery, the initial observations, and the victim's identity.
646.65s - 651.21s |  Any leads, Hart asked, her voice cutting through the background noise on the line. We're focused
651.21s - 657.61s |  on Alice Askey, Anderson replied, his mind racing as he considered the possibilities.
657.61s - 662.61s |  We're currently interviewing friends and neighbors that they interacted with regularly. All right,
662.61s - 675.14s |  Hart said, her tone firm and decisive. Keep us updated. All right. So, the goals of the
675.14s - 679.98s |  scoping call were things we just heard a little bit in the narrative, right? So, we need a
679.98s - 685.34s |  summary of what happened. We need a bunch of details about any individuals. We're going
685.34s - 690.54s |  to get some time stamps of some key events. And we're going to get some other details
690.54s - 697.04s |  around that incident. And we're going to establish the objective. What is it that you as a forensicator
697.04s - 703.46s |  are tasked with doing? And today, you all get to be a little bit of a forensic investigator
703.46s - 711.58s |  because I'm going to ask you to join me in this story. So, this is the initial information
711.58s - 719.46s |  you as the forensic investigator are given. Bob is dead. We knew this. He, the police
719.46s - 728.30s |  are called to 456 Central Avenue. Bob is found deceased. He's found deceased at 1201 a.m.
728.30s - 735.78s |  on February 13th, 2022. And they estimate his time of death to be about three hours
735.78s - 744.38s |  before that. Important note. What the cops tell us is that he appears to have been stabbed.
744.38s - 750.30s |  And he's known to have this existing relationship with Alice Askey, the other name that we heard.
750.30s - 756.62s |  And she lives at 123 Main Street. The police are pretty sure Alice went to Bob's house
756.62s - 764.62s |  and killed him. And you've been asked to work with the team to investigate the digital relevant
764.62s - 771.02s |  information and determine Alice's involvement. These are the specific objectives you are
771.02s - 777.82s |  given. The police have asked you to perform an analysis on the information. And they want
777.82s - 784.06s |  to know what evidence exists that proves Alice killed Bob and why did Alice kill Bob? Now,
784.06s - 791.54s |  I'm here to tell you in the talk title of my talk hints at this. These are not good
791.54s - 799.14s |  questions for forensics. Forensics cannot tell you why somebody did something. It cannot
799.14s - 805.38s |  tell you that someone did something at all. It can tell you what happened on a system.
805.38s - 813.32s |  It cannot always put hands behind keyboards. So these are not necessarily good objectives.
813.32s - 818.34s |  This kind of challenge is presented to us regularly in forensics. Open-ended questions
818.34s - 823.50s |  are not things forensics can typically answer. We just discuss what kinds of questions forensics
823.50s - 830.42s |  is not meant to cover. So like, you know, why someone did something, who did something
830.42s - 836.82s |  specifically. You often have incorrect assumptions, right? What assumption did we hear that was
836.82s - 844.30s |  a problem? Alice killed Bob, right? Like we're just getting started and we're already assuming
844.30s - 850.42s |  Alice killed Bob. That is not a good thing. They're often unrealistic timeframes and there
850.42s - 857.70s |  are limitations to what we can recover. Sometimes the scope winds up being too huge and it has
857.70s - 864.36s |  to be broken down. And sometimes requests are incomplete. So like asking for a particular
864.36s - 870.56s |  type of social media, but really wanting all the social media. So these are all challenges.
870.56s - 875.48s |  So as a result, we revise those objectives to fit more with what forensics really can
875.48s - 882.32s |  answer. So better questions that forensics can handle. Was there any activity on the
882.32s - 889.04s |  devices around the time of death? Is there evidence to indicate involvement, right? Not
889.04s - 894.64s |  to say that someone definitely did something, but could there have been a person involved?
894.64s - 899.12s |  And we want to look at all that relevant digital communication between Alice and Bob since
899.12s - 911.66s |  we know there is an existing relationship. That is a reasonable thing to do. The forensics
911.66s - 917.46s |  team sprang into action, setting up their equipment and connecting cables to Bob's laptop.
917.46s - 922.50s |  One technician began the process of creating a forensic image of the laptop while another
922.50s - 928.78s |  meticulously documented every step, ensuring the integrity of the evidence. Meanwhile,
928.78s - 933.12s |  Detective Hart scanned the room for any other digital devices that might hold clues. She
933.12s - 937.84s |  spotted a smartphone lying on the floor near the victim's body and carefully bagged it
937.84s - 943.48s |  for further analysis. Finally, after what felt like an eternity, the forensic team finished
943.48s - 950.32s |  their work. They carefully packed up the equipment, leaving the room as they had found it. Simultaneously,
950.32s - 956.28s |  additional police officers paid Alice Askey a visit at home. They encouraged her to do
956.28s - 962.36s |  the right thing if she has nothing to hide. And as a result, they convinced her to provide
962.36s - 967.04s |  her laptop and cell phone to them for examination, along, of course, with the passwords to these
967.04s - 973.48s |  devices. So that evidence and the items collected at the scene were quickly turned over to the
973.48s - 986.97s |  forensic lab for imaging and processing. So when we do data gathering, because this is
986.97s - 993.29s |  the data gathering section, we may be gathering data that's not necessarily digital. And this
993.29s - 997.97s |  can be a real challenge because what happens sometimes, sometimes you go in the field doing
997.97s - 1001.75s |  this and you do it yourself. And sometimes somebody, a different team or other people
1001.75s - 1005.69s |  go into the field. So sometimes you're going to get different information from different
1005.69s - 1010.69s |  folks at different times. It can be really chaotic. But these are the kinds of things
1010.69s - 1016.49s |  that are examples of stuff we might collect. So, you know, we might have to take a forensic
1016.49s - 1021.73s |  image on scene. You know, maybe we need some log files. This all really depends on the
1021.73s - 1029.73s |  very specific case. What kind of tools do we use? Well, we use forensic tools like FTK
1029.73s - 1035.97s |  Imager, NCASE X-Ways, Axiom. You'll see a whole list here. We'll see some pictures.
1035.97s - 1040.05s |  Sometimes scripts are used. Cameras are handy. Sometimes it's best to take photographs. We
1040.05s - 1045.01s |  might see passwords on, I don't know, Post-it notes. Because no one's ever seen that under
1045.01s - 1052.53s |  a keyboard before, right? Nobody ever does that. So we might do video, but video is encouraged
1052.53s - 1056.77s |  to do with no sound. Sound can get you in hot water because people sometimes say things
1056.77s - 1062.57s |  on scene that maybe they shouldn't be saying. And of course, sometimes you just take notes.
1062.57s - 1067.77s |  Old-fashioned paper and pen are great for that. So I know this is a little fuzzy, but
1067.77s - 1074.77s |  this is Axiom GrayKey. It's only available to law enforcement. And it's used to gather
1074.89s - 1081.89s |  data off phones, typically. And it can do phone image extractions.
1083.25s - 1090.25s |  So this is with an FTK Imager. FTK Imager is often used for acquisitions and analysis
1090.93s - 1096.09s |  of files and file systems. And I know this is kind of tough to see. The only thing you
1096.09s - 1103.09s |  really need to pay attention to is the little tiny yellow thing that says EXFVE, that little
1103.17s - 1107.85s |  tip. And we'll see what that means later. And I'll have a blown-up so you can see that
1107.85s - 1114.37s |  better. This is NCASE Forensic. This is another really common tool that is used for acquisition
1114.37s - 1121.37s |  and analysis. And this is Autopsy. Autopsy is a free tool. So I'm showing you a mixture
1121.93s - 1128.33s |  like NCASE costs money, FTK Imager is free. This tool is also free and can do all kinds
1128.33s - 1134.89s |  of cool analysis, acquisition, that kind of thing. And again, we'll get into some examples
1134.89s - 1141.89s |  of that later. So these are some related questions. So often because you have limited time frames,
1143.77s - 1147.81s |  you have to know what you have to prioritize. Because if you only have so much time to do
1147.81s - 1153.81s |  an investigation or to analyze a particular piece of evidence, then it's problematic if
1153.97s - 1158.65s |  you have tons of data, right, and you have to, you know, get through it all. Maybe you're
1158.65s - 1163.17s |  not going to get through it all, so maybe you need to prioritize. You need to ask if
1163.17s - 1167.01s |  you're not the one on scene, or even if you are, you might ask the other folks who are
1167.01s - 1170.97s |  there, did you see anything interesting? And, you know, again, is there a restriction for
1170.97s - 1176.23s |  the timeline? Now, there are a lot of challenges. We've already talked about a couple of them.
1176.23s - 1180.53s |  You might acquire unnecessary data. So you might take a whole bunch of systems, take
1180.53s - 1184.05s |  images of things, or take systems with you that are not related at all, and you may not
1184.05s - 1191.05s |  know about that. You might really need a piece of data that is completely unavailable. So
1191.05s - 1195.09s |  the device is encrypted. You don't have the key. Maybe something's inaccessible. It's
1195.09s - 1200.13s |  behind a login. Because by default, even doing criminal case, you don't have the right to
1200.13s - 1206.61s |  necessarily log in and grab that data. You need permission for that. Again, time frames
1206.61s - 1213.89s |  are always an issue. Maybe there's regulations, ISO or other regulations, right? So which
1213.89s - 1219.17s |  could tell you either you have to or you can't collect certain kinds of data. Maybe the stuff
1219.17s - 1226.01s |  you brought to do the collection, wrong size, wrong dongles, wrong, you know, media, whatever,
1226.01s - 1231.85s |  and maybe you're doing a collection of a particular type of file system that you don't have tools
1231.85s - 1241.37s |  to collect. So this is the, that is the blown up screen of the FTK imager you saw earlier.
1241.37s - 1245.69s |  Now, I can tell you that the digital forensics team, when they were working on this, they
1245.69s - 1253.90s |  saw that. Does anybody recognize what that tells you? BitLocker, yeah. So the team was
1253.90s - 1260.14s |  like, oh, wow, this laptop's encrypted. So what they had to do is they had to take, they
1260.14s - 1266.62s |  could not take a full image, right, because they don't have the password. What happens if they
1266.62s - 1274.22s |  try to take a full image of this machine without a password? Yeah. You have an encrypted brick,
1274.22s - 1279.50s |  spot on, right? So instead, they take what's called a logical disk image, and the logical
1279.50s - 1284.46s |  disk image will capture basically whatever you can see sitting there working on it, but it's,
1284.46s - 1298.14s |  you're not going to see some of the underlying data systems. All right. The whirring of hard
1298.14s - 1302.54s |  drives mingled with the soft glow of computer screens in the brightly lit forensics lab.
1303.26s - 1309.90s |  Detective Hart stands at the helm, her eyes sharp and calculating. She scans the array of devices
1309.90s - 1316.06s |  laid out before her, two laptops, two cell phones, each holding secrets waiting to be unearthed.
1316.86s - 1322.22s |  Beside her, Maya Patel, the team's lead forensic expert, delicately examines the data retrieved
1322.22s - 1328.54s |  from Alice and Bob's laptops. Meanwhile, across the room, agent Mark Thompson meticulously dissects
1328.54s - 1334.54s |  the data from their cell phones, his brow furrowed in concentration. With each tap of his fingers,
1334.54s - 1340.94s |  he builds back layers of text messages and call logs, his determination unwavering as he hunts
1340.94s - 1352.56s |  for clues. All right. So the goals of data analysis, we're going to look for scoped indicators.
1352.56s - 1359.92s |  So remember that we had some goals in terms of what we were, our objectives were. So in terms
1359.92s - 1364.56s |  of being given that initial information, you know, we're looking for names, right? We might be looking
1364.56s - 1369.52s |  for user accounts, anything that was sort of point back to what we were told in the beginning.
1370.16s - 1375.68s |  And then from there, we might pivot because we might find something interesting. So, you know,
1375.68s - 1379.44s |  you might see a particular keyword that might take you to something else.
1380.56s - 1386.24s |  You need to document those findings. And timestamps are critical. If you take nothing
1386.24s - 1393.20s |  else away from this and you're interested in forensics, universal time, UTC is your friend.
1393.20s - 1398.08s |  I see some smiles out there. How many of you that do digital forensics are like, oh my God,
1398.08s - 1405.36s |  why won't they just give me everything in UTC? Yeah. So one of the most frustrating things is
1405.36s - 1409.92s |  that you sometimes get logs in all these different time zones and then you have to correlate
1409.92s - 1414.80s |  everything, which we'll talk about later. And that's a major pain in the drain. So make sure
1414.80s - 1421.44s |  that you're documenting not only the time, but what time zone, whether it's UTC or not, whatever.
1423.28s - 1428.72s |  You know, where'd you find it? You know, if there's code, you know, you want all of that
1428.72s - 1434.24s |  information. And document anything that's weird that maybe you don't see that you would expect
1434.24s - 1441.84s |  to see, because a lack of evidence is itself evidence. We use a bunch of different tools for
1441.84s - 1446.96s |  data analysis, very similar to what we saw for collection, because a lot of these tools do the
1446.96s - 1452.48s |  same thing. So we already saw a magnet gray key. They have another product called Axiom,
1452.48s - 1458.48s |  which is available to regular forensicators, not just law enforcement. We talked about autopsy.
1458.48s - 1463.84s |  Eric Zimmerman has some free tools. There's something called Obsidian Forensics Hindsight,
1463.84s - 1469.04s |  which I believe is free. We've already mentioned NCASE, X-Ways, FTK, and there's also a product
1469.04s - 1475.20s |  called NUIX. Celebrate Inspector, which is again phones, and Volatility, which is for memory
1475.20s - 1483.12s |  forensics. So this is Celebrate Physical Analyzer, which again can be used to recover an image and
1483.12s - 1489.60s |  do some analysis on phones. You know, and often you use more than one tool to get the best results,
1489.60s - 1494.00s |  because one tool may only give you a certain piece of what you're looking for, and sometimes
1494.00s - 1503.02s |  you need two. So this is Magnet Forensic Axiom. So this is the tool that is available to anybody
1503.02s - 1512.14s |  who purchases it. And again, it can be used for looking at mobile or cloud, computer, vehicle
1512.14s - 1517.18s |  sources. It can do all kinds of stuff. And the evidence you're going to see today was processed
1517.18s - 1524.70s |  with Axiom to provide some SMS logs. So let's take a look at that. So this is a snippet of what
1524.70s - 1532.30s |  that looks like. This is Axiom Forensics, and this is the overview screen. And this is
1532.30s - 1539.92s |  Hindsight Internet History Forensics, which is used for parsing internet history. Now let's talk
1539.92s - 1546.24s |  about the challenges, okay? So again, you need permissions. If something's behind a login, you
1546.24s - 1550.32s |  can't just go, you know, even if you're law enforcement, you can't just be like, I'm gonna go
1550.32s - 1556.16s |  looking at all the things. You might ignore relevant evidence. Perhaps you collect all kinds
1556.16s - 1561.04s |  of stuff and you're like, ah, this isn't relevant, doesn't matter, I don't care about this. And that's
1561.04s - 1565.68s |  really easy trap to fall into, especially if you have a ton of stuff and you're a short
1565.68s - 1570.64s |  timeline. It's easy to assume something is irrelevant and then find out later maybe it wasn't.
1571.60s - 1576.88s |  So maybe you don't have the right tools to analyze. Maybe you suddenly find there's malware
1576.88s - 1582.16s |  on something, but the issue is really somebody who's dead. Maybe the malware is just, you know,
1582.16s - 1588.08s |  they're involved in other extracurricular activities and they got malware from that.
1588.08s - 1592.96s |  So you've got to be very careful you don't go down the wrong rabbit holes. It's very easy to
1592.96s - 1597.60s |  get tunnel vision. I'm looking for this, I'm only looking for this, and then oops, and I'm seeing a
1597.60s - 1602.96s |  bunch of nods, because yeah, some of you have been there. And follow through is really important,
1602.96s - 1607.04s |  right? You got to follow the, once you start down that rabbit hole, you often have to follow it all
1607.04s - 1612.48s |  the way down. So here's where we're going to get into what I think is the interesting stuff,
1612.48s - 1617.28s |  right? The meat and potatoes. So this is an SMS conversation between Alice and Bob,
1617.84s - 1625.28s |  and this is, once you take something like Axiom, you can then export the log information into a
1625.28s - 1629.76s |  spreadsheet, and I know this is impossible to read. So instead, I'm going to give you the
1629.76s - 1635.68s |  conversation in a much easier place to read. So I'll give you just a minute or so. We're going to
1635.68s - 1642.48s |  see that, you know, Bob and Alice are having a conversation. Alice is like, Bob, we got to talk.
1643.60s - 1649.76s |  And ultimately, when we get to the end, because there's one more slide here,
1654.72s - 1661.44s |  so what's the tone here? What do we think? Hostile, right? How about on this one?
1667.50s - 1673.02s |  This is a continuation of the previous. There's one more. Yeah, it's threatening, right?
1674.62s - 1684.64s |  Yeah. How about how it ends? Yeah, not good, right? She's kind of digging a hole.
1686.67s - 1692.99s |  So we get some information from PD. They let us know that Alice's fingerprints were all over the
1692.99s - 1697.79s |  victim's house, including on a kitchen knife, that has a profile that's very similar to the
1697.79s - 1706.92s |  murder weapon. Interesting. There's also some evidence that is a conversation between Bob B,
1707.72s - 1715.64s |  we know Bob Byte, right, and some mystery person. So Agent Thompson shows this to you
1716.20s - 1721.56s |  and makes it much easier to read this way. This is a much shorter conversation.
1725.66s - 1734.57s |  So this seems, what, a little sketch, but, you know, okay. So, I mean, this is just some evidence
1734.57s - 1742.08s |  that's collected. So then the PD comes back. They've been, you know, talking to folks to find
1742.08s - 1747.92s |  out more information. And they find out they're really concerned about Bob, because Alice has
1747.92s - 1754.40s |  a temper. We don't know that at all from reading the evidence we saw, right? And they also noted
1754.40s - 1759.36s |  that Bob, the neighbors have said, gee, Bob seems to have folks that come all hours of the night.
1760.08s - 1764.40s |  And maybe drugs, maybe there's some drug smuggling, something going on there. Interesting.
1767.88s - 1773.80s |  So then they start looking at some email logs. And the tool that's used here is called Paraben
1773.80s - 1781.56s |  E3. This is a tool that's specifically used to investigate email. And Maya shows you this and
1781.56s - 1787.72s |  says, huh, this is a Lyft receipt she got from Alice's computer. And it indicates that Alice did,
1787.72s - 1793.08s |  in fact, travel to Bob's house on the day of the murder. And here is it blown up, so you can see
1793.08s - 1798.92s |  it a little better. So we can see the pickup at 123 Main Street, which we know is Alice's house,
1799.56s - 1806.36s |  and the drop off at 456 Central Avenue. And we see that this is, in fact, at least one of Alice's
1806.36s - 1820.08s |  emails. We'll get there. Good observation, though. As the hours stretched on, the team's
1820.08s - 1824.96s |  efforts began to yield results. Maya unearthed a number of potentially important emails from the
1824.96s - 1829.92s |  laptop, while Mark's fingers fly across the keyboard, cross-referencing timestamps and
1829.92s - 1837.12s |  GPS coordinates in a relentless pursuit of the truth. His analysis of metadata ultimately reveals
1837.12s - 1841.44s |  a pattern of communication that can be linked to the prime suspect in this case.
1842.16s - 1845.68s |  Through trial and error, they each piece together fragments and information,
1846.40s - 1851.12s |  every breakthrough bringing them one step closer to unlocking the answers they are seeking.
1855.36s - 1863.31s |  So once we have all of this data, we need to correlate it, right? Bring all of this stuff
1863.31s - 1868.75s |  together from all these different places that we pulled it, normalize the findings. Again,
1868.75s - 1875.31s |  timestamps are your friend, and they need to all be in one UTC time zone so that you get a much
1875.31s - 1881.39s |  better picture of what happened. And then we're going to look for some patterns, which will help
1881.39s - 1886.59s |  us build a picture of what actually happened. So how do we do that? Well, we use some tools,
1887.39s - 1892.43s |  things like mind mapping software, and I've given some examples, but good old pen and paper,
1892.43s - 1898.43s |  even a regular old spreadsheet can be good for that. In this case, so far, what do we have? Well,
1898.99s - 1904.91s |  we have SMS messages from Bob and Alice's phones. We saw the email. We got some information from
1904.91s - 1912.91s |  PD. We can run into challenges at this particular place, too. Not enough context might be provided.
1913.47s - 1918.43s |  We might dismiss something as irrelevant, again, back to timeframes. We might just not take the
1918.43s - 1929.28s |  time to correlate. So then we're going to build a timeline. In the hushed confines of the digital
1929.28s - 1934.16s |  forensic lab, the team gathered around a large whiteboard, their eyes fixed on the intricate
1934.16s - 1939.12s |  timeline taking shape before them. Detective Hart stands at the forefront, her gaze intent,
1939.12s - 1944.16s |  as she directs the assembly of evidence into a coherent narrative. Next to her, Maya and Mark
1944.16s - 1948.80s |  meticulously arranged timestamps and digital artifacts, weaving together threads of data to
1948.80s - 1954.16s |  reveal the chronological sequence of events they uncovered. Each piece of information begins to fit
1954.16s - 1961.60s |  into the puzzle that was the grand design of their investigation. Across the room, Dr. Maya Rodriguez,
1961.60s - 1965.76s |  the forensic psychologist, examines the psychological profiles of the individuals
1965.76s - 1972.24s |  involved, her insights providing a crucial layer of context to the timeline. With each revelation,
1972.24s - 1977.52s |  she uncovers the layers of motive and intent, shedding light on the human elements driving
1977.52s - 1985.90s |  the digital drama. Why is it important that we have someone like that involved? Any guesses?
1989.48s - 1995.24s |  Right. I mean, there's so much that we don't know, right? So understanding the people involved can be
1995.24s - 2000.20s |  crucial. And what did I say digital forensics itself is not good at? It's not good at people,
2000.20s - 2006.04s |  right? It can tell you that a human probably was at a keyboard doing a thing, but it can't
2006.04s - 2013.64s |  necessarily tell you who or why. All right. So the goals of timeline analysis, we're going to
2013.64s - 2020.36s |  be looking for timestamps with everything. Again, UTC. Make sure you understand the attributes that
2020.36s - 2025.56s |  you're collecting, and then we're going to create a timeline. So tools that can be used with that
2025.56s - 2033.48s |  for that purpose. Again, Axiom. There's also a free tool called Log2Timeline. Excel is great.
2033.48s - 2041.16s |  There's a free tool called Timeline Explorer. We can have challenges with this. Maybe the timestamps
2041.16s - 2047.24s |  are missing, and maybe we don't know the particular time zones. Maybe we just forget about timestamps
2047.88s - 2055.39s |  and we just overlook them. So this is the tiny timeline of what we've uncovered so far.
2056.03s - 2061.95s |  We know that Alice sends Bob threatening texts. We know when Bob is killed. And then Bob is
2061.95s - 2069.23s |  discovered deceased. So what is your initial hypothesis based on the evidence provided?
2077.02s - 2082.30s |  Well, yeah, I mean, it's an interesting question, but if you only had what I gave you so far,
2082.86s - 2093.40s |  what does it appear to be? That Alice did it, right? Okay. So initially, our hypothesis is Alice
2093.40s - 2100.04s |  killed Bob. Because this is scientific evidence-based forensics, we're always going to do
2100.84s - 2106.04s |  a hypothesis and then see if we can prove the hypothesis or disprove the hypothesis.
2106.04s - 2113.00s |  Who here has seen the movie Clue? A bunch of you. Okay. So that's how it could have happened.
2115.45s - 2119.29s |  And Detective Hart looks at you when you come up with that hypothesis and says,
2119.85s - 2125.85s |  hmm, there's evidence that suggests that could in fact be the case. But have you exhausted your
2125.85s - 2130.33s |  search of all the evidence? Because I hear PD still has some information for all of you.
2131.29s - 2138.89s |  And they might have more information for us soon. So how about this? And look, we're back to data
2138.89s - 2144.49s |  analysis again, because we're going to look at some more data. So I know one of you caught this,
2145.29s - 2155.79s |  right? What did we not focus on when we looked at this the first time? The timestamp, right?
2155.79s - 2163.71s |  The timestamp was an hour after Bob was dead. So Alice went there, but a little too late to
2163.71s - 2174.27s |  kill him if he's already dead. A little weird. And then Maya discovers on Bob's machine that
2174.27s - 2179.07s |  there was some web activity. And if you look carefully at some of this web activity,
2180.27s - 2187.95s |  again, the timestamps are showing you after his time of death. Very strange. And if you look at
2187.95s - 2195.07s |  some of the descriptions here, we see some phishing things and some relationship counseling,
2195.07s - 2202.40s |  because we know there was a relationship going on there. Kind of interesting. So then we look
2202.40s - 2209.84s |  further. Maya continues to look for evidence on Alice's email. She finds another email address.
2209.84s - 2218.60s |  And she finds this very peculiar thing in Alice's email. What do you see here?
2220.88s - 2228.32s |  Bob's password and username, right? Huh. Interesting. So PD comes back to you and says,
2229.28s - 2236.08s |  I interviewed Alice Askey, and she found when she got there, Alice admitted she found him deceased
2236.72s - 2242.48s |  and knew she would be somebody they would look at. And she was so freaked out that she thought,
2242.48s - 2247.84s |  I know, I'll log into Bob's machine, I'll pretend to be Bob, and it'll be fine, because then they'll
2247.84s - 2255.04s |  know it wasn't, you know, it was somebody else. So she admits to this. So uh-oh, it's not Alice.
2255.28s - 2265.58s |  So here's what really happened. Just as they thought they were closing in on their target,
2265.58s - 2271.10s |  a new challenge presents itself. A strange file containing a bunch of random characters
2271.10s - 2276.06s |  buried deep within the directory of Bob's computer. Determined not to be thwarted,
2276.06s - 2280.70s |  the team pooled their expertise, each member contributing their unique skills to uncover
2280.70s - 2286.30s |  this latest mystery, which turned out to be an encrypted file. And finally, as the first light
2286.62s - 2290.14s |  And finally, as the first light of dawn filtered through the windows of the lab,
2290.78s - 2296.06s |  they triumphed. The encrypted file yielding its secrets and providing the missing piece
2296.06s - 2303.50s |  of the puzzle they needed to solve the case. The team sat down to just, oh, I'm sorry,
2303.50s - 2314.51s |  that's the next bit. So PD comes back to you. Remember that thread we saw, that conversation
2314.51s - 2320.59s |  between Bob and some mystery person? Well, it turns out that was somebody named Charlie C.
2321.39s - 2327.82s |  We're back to data analysis again, because now we need some stuff about Charlie C.
2328.38s - 2335.98s |  But as we're looking, this is where Maya discovers this very strange encrypted file.
2337.10s - 2345.50s |  It's a strange size. It's certainly nothing obvious. It's kind of hard to see, but it's a
2346.38s - 2352.94s |  file that, well, let me go back a slide here. You can see that it's Microsoft. It looks like
2352.94s - 2360.78s |  Minesweeper, but it's a weird name and a very strange size. And the gobbledygook that you see
2360.78s - 2366.38s |  in this what's called a hex editor, for those of you unfamiliar, this tells us this file is
2366.38s - 2372.94s |  encrypted. And because it's encrypted, Maya starts looking for other things having to do with
2372.94s - 2380.94s |  encryption. And she finds something called VeriCrypt installed on Bob's laptop. She knows
2380.94s - 2388.78s |  that that software can create an encrypted file. And she also has a tool called TC Detective.
2389.50s - 2396.14s |  She runs that tool against this weird file and, in fact, confirms this is the tool that was used
2396.14s - 2405.58s |  to encrypt that file. Hmm. It's just a piece of Python code. So this is something called
2405.58s - 2412.14s |  Shell Bag Explorer that Maya runs. And, again, I'll show you this blown up so you can see it
2412.14s - 2418.14s |  better. But Shell Bag Explorer is a free tool that you can use to explore something called a shell
2418.14s - 2425.02s |  bag. What is a shell bag? It is a registry entry that shows you information about user preferences
2425.02s - 2432.70s |  and some of their activities. In this particular case, it shows you a really weird mount point
2432.70s - 2440.30s |  called secret stuff. Because that doesn't sound sketch at all. So it can show you this tool,
2440.30s - 2444.62s |  things like right clicks and mount points. And it's part of, for those of you familiar,
2445.26s - 2453.02s |  registry keys called end user dot dat and user class dot dat. So what we see here is this,
2453.66s - 2459.58s |  you know, again, this path. Very interesting. And then PD comes back and they say, hey,
2459.58s - 2467.34s |  check it out. We found this post it note with some passwords. And Maya says, I wonder what I
2467.34s - 2476.70s |  can do with those. So she gets a copy of Veracrypt on her forensic machine and she loads it up and
2476.70s - 2482.70s |  she gets a copy of this file and she mounts it with Veracrypt and it is successful and she opens
2482.70s - 2494.75s |  it. And in this, she finds five files. Four weird pictures of money and a text file. Hmm. These are
2494.75s - 2500.35s |  the, or five weird pictures of money. So here's some pictures of money. Anybody see anything
2500.35s - 2507.23s |  common about this, these pictures of money? Yes. The serial numbers, right? Don't say too much.
2507.23s - 2513.87s |  Who here knows exactly what this is when you looked at it? A couple of you, right? Typically
2513.87s - 2519.63s |  it's folks who either work with law enforcement or know law enforcement folks, but we'll get there.
2522.08s - 2528.88s |  She initially doesn't think they're relevant at all. But, hmm. So then you have a further
2528.88s - 2535.36s |  conversation with Detective Hart and you find out Charlie C is known for dealings in his drug world
2535.36s - 2544.32s |  and he is, in fact, Charlie Cyber. You look at that text file and you realize this is some kind
2544.32s - 2552.88s |  of ledger file and we see some names that we recognize, right? Alice, Bob, and now Charlie.
2554.24s - 2563.92s |  So that's interesting. Then PD says, ooh, there's a ring camera. We just discovered it. It has a view
2563.92s - 2570.56s |  toward the victim's back door. And camera footage obtained from it shows Charlie Cyber entering Bob's
2570.56s - 2578.24s |  house via the back door moments before Bob's death and exiting shortly thereafter. So now we
2578.24s - 2584.24s |  have more data we have to correlate. These are all the pieces we have to correlate, right? So back to
2584.24s - 2590.40s |  the beginning, all the SMS messages, the emails, the encrypted space with the hidden file, the reports
2590.40s - 2600.97s |  from PD, the ring camera. PD comes back to you, the forensicators, and says, oh, oh, those pictures
2600.97s - 2609.85s |  of money. So those are actually used by drug dealers. Drug dealers, so when you're a drug dealer
2609.85s - 2613.45s |  and you're dealing with other drug dealers and they don't necessarily know who each other are,
2614.81s - 2619.53s |  funny this, they don't go, look, this is my ID. See, this is me. It's who you thought it was, right?
2620.09s - 2626.09s |  So the way they do identity matching is that they will give you part of a serial number and when you
2626.09s - 2631.45s |  meet, you show them the whole serial number and that's how they know that it's the same person
2632.09s - 2635.45s |  that they've been communicating with and the person they're supposed to do the deal with.
2636.09s - 2639.85s |  And this is something that law enforcement actually sees on a fairly regular basis.
2642.32s - 2650.64s |  So based on all that evidence, what we ultimately determine is that Charlie killed Bob. And if we
2650.64s - 2657.28s |  think back about that conversation between now we know Bob and Charlie, right,
2658.96s - 2667.76s |  who was trying to get out of working with him? What did Bob want to do? Yeah, Bob wanted out.
2667.76s - 2673.28s |  He was like, I'm going on my own. I'm going to do my thing. And Charlie didn't seem real happy
2673.28s - 2678.00s |  about that. But that didn't necessarily seem relevant until we had the rest of these pieces
2678.08s - 2681.28s |  and found out there were drug dealings and that's actually what was going on.
2683.48s - 2693.52s |  All right. The team sat down to discuss the case they had just concluded.
2693.52s - 2700.32s |  Each one took their place at the table. Their expressions, a mix of exhaustion and satisfaction,
2700.32s - 2706.16s |  a testament to the arduous journey they had undertaken to solve this mystery. Detective
2706.16s - 2710.88s |  Hart opened the meeting with a solemn nod, signaling the start of their post-incident
2710.88s - 2716.40s |  analysis. Her guys swept across the room before settling on the whiteboard in front of them,
2716.40s - 2721.44s |  where a timeline of events was displayed in meticulous detail. All right, everyone,
2721.44s - 2726.00s |  let's begin, she said in her voice, steady and authoritative.
2727.60s - 2732.08s |  So just because we've solved the case effectively and all the pieces have come together,
2732.64s - 2739.12s |  that does not mean we're done. We've got goals, what are called post-incident goals.
2739.76s - 2746.00s |  And these are critical as well. We need to discuss what went well and what did not go well. Maybe we
2746.00s - 2751.44s |  didn't have the right tools. Maybe we did things in the wrong order. Maybe we didn't look carefully
2751.44s - 2758.32s |  at all of our evidence as we saw here, right? What outcomes were achieved, positive and negative,
2758.32s - 2763.04s |  because again, we kind of want to look at this whole big picture. We need feedback from all the
2763.04s - 2767.84s |  different teams that are involved because nobody does this stuff in a vacuum. And one of the
2767.84s - 2772.16s |  challenges in many cases is that forensicators and the detectives, while they work together,
2772.16s - 2779.76s |  they're often separated significantly. Technical challenges that maybe can be handled later on.
2780.56s - 2786.24s |  And you want to document everything that happened and didn't happen. So if you attempted something
2786.24s - 2792.64s |  and it didn't work, that all has to be documented as well. What do we use to document that? Well,
2792.72s - 2798.32s |  you know, paper, pen, computer, you know, whatever it takes, right? It can be, theoretically, it
2798.32s - 2802.08s |  continued to be photographs and all the kinds of things we've talked about for documentation.
2803.68s - 2810.56s |  The challenges involved in all of this, lots of folks forget to document. They just are in too
2810.56s - 2813.84s |  much of a hurry and they don't write up a report. And then by the time they actually need that
2813.84s - 2819.76s |  information, it's way too late and they forget things. You could forget to document specific
2819.76s - 2824.08s |  things. You might document something that didn't happen because you started down a rabbit hole and
2824.08s - 2827.76s |  you knew that's what was going to happen and so you started writing it down and then you find out,
2827.76s - 2834.48s |  oops, and you forget to delete that. Or you go down that path and instead of deleting, you say,
2834.48s - 2838.72s |  well, we thought it was this, but we, you know, we got to a point and it wasn't that.
2840.48s - 2844.08s |  Another problem is the full story could not be told through documentation.
2844.96s - 2848.72s |  It requires the reader to make assumptions and that's not a good thing either.
2849.52s - 2857.84s |  And an after-action report should always be held. So that is ultimately the story of Alice and Bob.
2859.60s - 2864.00s |  I have to do a little tiny bit of shameless self-promotion here. I have a book here called
2864.00s - 2870.32s |  The Act of Defender. For those of you who are new to the Defender space, what this book does is it
2870.32s - 2876.96s |  looks at defense from an offensive perspective because I discovered when I started my journey
2876.96s - 2883.68s |  down this path that ultimately defense is only half the story. If you don't understand what your
2883.68s - 2888.32s |  offensive counterparts are doing, you don't have to know all the fiddly technical details, but if
2888.32s - 2893.68s |  you don't understand what they do, you will never understand how attackers work and you will not be
2893.68s - 2899.52s |  an effective defender. So I wrote this book basically to give back to a community that has
2899.52s - 2908.27s |  given me a ton because I started in the music industry. I did not start in technology. And so I
2908.27s - 2912.35s |  like to close with this quote and then we'll open it up. I think we still have a couple minutes for
2912.35s - 2919.39s |  questions. So I may not have gone where I intended to go, bachelor's degree in music industry, but I
2919.39s - 2926.19s |  think ultimately I wound up exactly where I need to be. And with that, do I have any questions? Yes.
2957.71s - 2961.55s |  So the two things that were mentioned had to do with exculpatory evidence and I purposely
2961.55s - 2965.95s |  didn't go too far into that because, you know, knowing that a lot of the folks in the audience,
2965.95s - 2971.15s |  this is all very new to them, I wanted to keep it fairly high level. The question in particular was
2971.15s - 2977.87s |  what do I use for documentation? Whatever tool works. So paper, pen, Word documents, Excel
2977.87s - 2983.55s |  spreadsheets. I have some, in some cases I have forms that I use regularly for certain kinds of
2983.55s - 2989.87s |  cases. Sometimes you have to go outside the box because the case is weird. But there's nothing
2989.87s - 2997.31s |  magical or special about any of that. It really depends on your use case. So if a Word form works
2997.31s - 3010.08s |  well for you or a spreadsheet works well for you, then that's perfectly fine. Does that help? Is
3010.08s - 3014.08s |  there any tool that I've run into problems with if I've asked for to use my notes? No, the biggest
3014.08s - 3019.68s |  problem is either having notes on like the back of a napkin and then you literally have to turn in
3019.68s - 3024.88s |  the napkin. So that's one of the big, I mean, I haven't personally run into that, but it's something
3024.88s - 3030.80s |  they warn you about. You know, pretty much as long as you can show your documentation and you're
3030.80s - 3044.72s |  not missing anything, I've never had an issue. I saw another question, hand in the back. Well, I
3044.72s - 3051.12s |  missed the last bit, what? Yeah, so he's saying he does instant response and they just do WordDoc. So
3051.12s - 3056.40s |  yeah, DFIR is my specialty and I do all kinds of different things in that space and WordDoc
3056.40s - 3060.32s |  are your friend and having templates for different kinds of things can be really helpful.
3060.88s - 3074.01s |  Other question? Yes. So the question is, I started in music industry, could I talk about the steps to
3074.01s - 3078.57s |  make the switch? I'm going to give you the like two second abbreviated version and then I'm happy
3078.57s - 3085.45s |  to discuss it further offline. And I just gave a talk, I did a closing keynote for Trimark where I
3085.45s - 3089.69s |  actually tell the really long version of that story and that was recorded and you're happy to,
3089.69s - 3095.53s |  you're welcome to check that out. So the really short answer is my father worked at the computing
3095.53s - 3099.85s |  center at the local college in the town where I grew up and I was actually around all of this
3099.85s - 3105.85s |  stuff forever and when I suddenly became unemployed because I was working for a record store after I'd
3105.85s - 3110.49s |  worked for a couple different record companies and the owner of that store and that small chain
3110.49s - 3114.09s |  decided that paying taxes was optional and New York State said otherwise and they,
3115.29s - 3120.57s |  I had to find another career option and a good friend of mine that I was talking to said, why
3120.57s - 3125.61s |  don't you go into tech? Because this was, you know, in the mid-90s when lots of places were
3125.61s - 3132.41s |  hiring for support roles on the phone and I started down that path that way. How I wound
3132.41s - 3140.49s |  up doing investigation work, I had a good friend at a later job who started to look at worms and
3140.49s - 3145.93s |  other infections and I was fascinated by what he was learning. He shared some stuff from SANS with
3145.93s - 3151.21s |  me and that's kind of the direction I wound up taking. The university where I work ultimately
3151.21s - 3156.89s |  needed somebody to do a forensics for compliance and I built that program for them. So that's the
3156.89s - 3175.77s |  super duper short answer. We might have time for one more, yes. So the question has to do with the
3175.77s - 3179.93s |  fact that I work with law enforcement but I'm not in law enforcement and why do they come to me for
3179.93s - 3184.89s |  stuff? So because I work for university, I have access to all of our data points, right? I have
3184.89s - 3191.37s |  access to all of our logs. I know the people who can get stuff for us if I can't and so they come
3191.37s - 3197.45s |  to me in part because they want that data and in some cases they want to understand that data
3197.45s - 3203.21s |  better. If it is a case that is actually going to go to a criminal court, then we collect the system
3203.21s - 3209.53s |  and that goes down to our regional forensics lab. I don't work those cases because that really needs
3209.53s - 3214.73s |  to be specially handled but when we have employee relations issues, I will do full forensic cases
3214.73s - 3219.85s |  for employee relations that's not law enforcement and do those kinds of things and I think folks
3219.85s - 3224.33s |  were just about out of time. I'll hang out for a minute or two here as long as I'm allowed and then
3224.33s - 3231.37s |  I will be out there if you need me. Thank you so much for having me. Thank you DEF CON for bringing me in.


url: https://www.youtube.com/watch?v=p4zQ9oOQl9w
title: DEF CON 32 - So you wanna know how to make badges - c0ldbru
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=p4zQ9oOQl9w",
  "title": "DEF CON 32 - So you wanna know how to make badges - c0ldbru",
  "description": "Taking attendees through the full badge making process from ideation to ordering and producing at scale",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2769,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.12s | This text was transcribed using whisper model: large-v2

 All right. So today we're going to talk about how to make badges. So you're probably wondering who
5.12s - 12.08s |  am I? My name is Cold Brew. I am a solutions architect at my day job, the founder and lead
12.08s - 17.60s |  hacker at ROT13 Labs, and I am the organizer of High Roller Con, or one of the organizers.
18.32s - 21.68s |  If you see those little ducks everywhere for High Roller Con, those were us.
22.64s - 27.84s |  I'm also a hardware hacker noob. And why do I say that? I say that because I am not an electrical
27.84s - 32.72s |  engineer. I am not someone who's been doing this for 10 years. I'm just a dude who figured out how
32.72s - 37.36s |  to do it by tinkering. And that means that all of you can do it too. This is not something that
37.36s - 41.68s |  requires you to be some kind of crazy wizard. It's stuff that anybody can do if you just take
41.68s - 45.60s |  the time and tinker with it. And that's kind of what a lot of this talk is about.
47.04s - 50.72s |  If you'd like to follow me on things, this is kind of a list of all the social networks I'm on,
50.72s - 54.72s |  basically in order of how often I'm on them. So if you're trying to hit me up on Discord,
54.72s - 64.66s |  I may not respond for a week or two. All right, so what are we going to talk about during this
64.66s - 67.70s |  talk? We're going to, I'm going to try to go through as much of it as I can, because we've
67.70s - 72.42s |  got a live demo at the end, and I really want to get to that. So first we're going to talk about
72.42s - 76.34s |  how to come up with an idea. If you're going to make a badge, you've got to have an idea for it.
76.34s - 80.02s |  The next thing is planning out the hardware, making sure that you know exactly how it's
80.02s - 84.26s |  going to work, and you know, all of those kind of things. Planning out your firmware to make
84.26s - 88.74s |  sure that the hardware can actually do the things you want it to do. Coming up with packaging and
88.74s - 93.38s |  accessories if you want to include things like that with it. Planning out the budget, making
93.38s - 100.10s |  sure that you've got kind of all your t's crossed and all your i's dots, and then making the badge.
100.10s - 104.58s |  So we're going to try and get through as much of this as we can. So a quick disclaimer before we
104.58s - 110.66s |  dive into this too much, this is not like the right way to make a badge. There is no right way.
110.66s - 114.58s |  Everyone has a different way they like to make badges. Every time I talk to a badge maker,
114.58s - 119.86s |  I learn some new way to do it. This is just how I make them. I have a lot of people after Defcon
119.86s - 126.77s |  usually coming up and asking me about how I do it. This is how I do it. Okay, so the first thing
126.77s - 132.37s |  is coming up with the idea. In a conversation with Altbeer about a year ago, we were talking
132.37s - 136.61s |  about badges, and he said the hardest part of making badges is coming up with a good idea.
137.33s - 143.89s |  And this just stuck with me because this is so true. This is the hardest part. Once you know
143.89s - 147.09s |  what you're going to build, the rest of the steps, they happen easily. You can just read
147.09s - 152.05s |  documentation, you can figure things out, you can tinker. However you're going to do it, you can
152.05s - 156.45s |  make the badge. But the idea, that's the part that you really have to work on and make sure it's
156.45s - 162.13s |  something you're really going to be excited to build. So some things to think about when you're
162.13s - 166.37s |  coming up with your design. How do you want it to look? Like what shape do you want it to be in?
166.37s - 169.89s |  Do you want it to be abstract? Do you want it to look like a dog? You know, whatever you want it
169.89s - 174.05s |  to be. And then once you know that, then you're going to have to figure out, okay, the shape,
174.05s - 178.29s |  the color, the size of it. Do you want it to be huge? Do you want it to be a little tiny thing,
178.29s - 183.73s |  maybe an SAO? Where's the lanyard going to go if it's going to have a lanyard? Do you want to do
183.73s - 187.89s |  the dual hook ones or do you want to do the single hooks? All of these things are going to affect
187.89s - 192.93s |  your design on this. The next thing is what do you want it to actually do? Or do you want it to
192.93s - 197.01s |  do anything at all? Sometimes people just like the blinky, and that's fine too. Sometimes they
197.01s - 201.57s |  want it to have really, really intense features. Whatever it is, you need to know what it's going
201.57s - 207.25s |  to do before you start really diving into this. How are you going to power all this? You might
207.25s - 211.73s |  need a big lipo. You might be able to get away with the little 2032s. And the last thing is
211.73s - 215.57s |  what's your budget? You've got to make sure that whatever you're trying to build is realistic for
215.57s - 219.65s |  that budget. And think about the fact that you're not, or probably not at least, just going to be
219.65s - 223.57s |  making one or two of these. You might be making hundreds of them. So these are all things to
223.57s - 229.41s |  consider. And the last thing about that is be prepared to dump some money into this. It's not
229.41s - 233.41s |  cheap. I'm not trying to scare you away from it or anything because it, you know, you can do it
233.41s - 238.29s |  on a budget. But if you're trying to make something really intense and you might have to iterate a few
238.29s - 242.45s |  times, and usually places don't like to fulfill orders of just one badge, so you're probably
242.45s - 246.53s |  making five at a time. And when it comes to your house and it doesn't work, all that money's down
246.53s - 251.09s |  the drain. You've got to figure out how it should work and then order another batch and hope that
251.09s - 257.41s |  one works. So make sure that you're ready to actually put some money into this. Okay, so these
257.41s - 261.01s |  are some of the badges that I've made in the past just to kind of give you some idea of things.
261.65s - 265.65s |  I mean, some of these are, I try to get kind of a good range of like different sizes, different
265.65s - 270.93s |  styles, different things. But it's something where you've got to think about the coloring, the size,
270.93s - 276.05s |  the shape, all of that. And these are some good examples of things that I've made. We can kind of
276.05s - 283.09s |  get into them as we keep going, but just a few ideas. So now that you've got your idea,
283.09s - 286.53s |  you've decided exactly what you're going to make. Now you can start to plan out that hardware.
287.41s - 294.13s |  Is it just going to blink? If so, all you need is some LEDs and the CH2032 is probably enough
294.13s - 298.77s |  for you. Okay? Those are the little coin cells that sometimes the DEF CON badges run off of.
300.05s - 304.53s |  You've got to think about your LEDs. They have those self-blinking LEDs. They're dead simple
304.53s - 309.41s |  to use. I love using those in badges because it gives you some functionality. It gives you
309.41s - 315.41s |  something that's blinking or flashing or whatever without having to use a microcontroller. Those
315.41s - 319.57s |  usually also have a built-in resistor. So that's another part that you don't have to use. It makes
319.57s - 324.37s |  your bomb tiny. It makes the amount of parts you have to acquire tiny. It just makes your life a
324.37s - 330.69s |  lot easier, especially if you're trying to build something simple. SMD versus through-hole. SMD is
330.69s - 335.89s |  surface mount devices. Those are the ones that mount on the surface. Through-hole is the ones
335.89s - 341.25s |  that are actually going through the board. These can kind of change your design pretty wildly.
341.25s - 344.61s |  For the little duck SAOs this year, we did the through-hole ones because we thought it'd be
344.61s - 348.77s |  easier for people to solder on their own. But now when it comes time for us to solder 30,000 of
348.77s - 354.93s |  these, you know, we just can't do it easily. So we ended up only soldering 1,000 of them ourselves.
354.93s - 358.93s |  But 1,000 ducks is a lot to solder. So we're kind of regretting that decision. But
359.57s - 364.61s |  it's something to think about. If you're doing the SMD stuff, you can also do things like reverse
364.61s - 370.37s |  mounting. So this badge here is a perfect example where we did reverse mount LEDs on the back of
370.37s - 374.69s |  the board so that it shines through the board and kind of gives you that little effect you can see
374.69s - 378.21s |  there with the blue and the red. And those were the self-blinking ones, so we couldn't catch all
378.21s - 383.25s |  four of them lit up at the same time. But you get the idea. You can do a lot with just LEDs and
383.25s - 388.61s |  still make a really cool badge. Another thing I always tell people is that if you're making a very,
388.61s - 392.85s |  very simple badge, but you want to give it a little more flexibility or give it just
392.85s - 399.89s |  a little something extra, consider an SAO port. Technically, the SAO standard is supposed to have
399.89s - 405.41s |  all six pins doing different things. But if you just put power and ground, that's all most SAOs
405.41s - 410.85s |  use in the first place anyway. So it gives you a very easy way to add a little extra functionality
410.85s - 417.28s |  for people to expand upon your badge. Okay, so if you do want to go with functionality,
417.28s - 420.88s |  you want it to do something, you want it to have Wi-Fi, Bluetooth, whatever it is,
421.44s - 424.24s |  you got to think about how much processing power you're going to need for this.
425.52s - 430.08s |  There's tons and tons of MCUs out there. I'm not going to talk about all of them.
430.08s - 434.72s |  But the ones that I like to use for the larger power things where I need more processing power
434.72s - 440.72s |  is something like the ATmega328P or the RPi2040. These are really, I'm just giving these examples
440.72s - 444.40s |  so you've got at least an idea in your head if you're starting to look into these things. Those
444.40s - 448.72s |  are the ones that I have found are very easy to work with. They're very simple, they're beginner
448.72s - 453.60s |  friendly, but they give you a lot of power. The next thing to think about is things like
453.60s - 458.32s |  Wi-Fi and Bluetooth. A lot of badges these days have those things. Something like that,
458.32s - 464.40s |  you're going to have to go for something like the ESP8266 or the ESP32 series. The 8266 is going to
464.40s - 469.60s |  give you Wi-Fi, the 32 will usually give you Wi-Fi and Bluetooth. Make sure you're checking
469.60s - 474.08s |  the documentation though because not all of them are going to give you those exact things.
474.72s - 479.20s |  You've got to make sure you check the documentation. I have done this before where I ordered a chip
479.20s - 484.08s |  thinking it had something, ordered the boards, got them in, soldered it all up. Turns out it doesn't
484.08s - 489.20s |  work because I ordered the wrong chips. So learn from my mistakes and make sure you're reading the
489.20s - 496.64s |  docs on these things. The last thing to think about is how many GPIO do you need? So on that
496.64s - 503.04s |  one, if you're going to need a lot of GPIO, something like the ATmega32 or that CH32V003,
503.04s - 509.44s |  that's the new RISC-V chip. It gives you a ton of GPIO for like 10 cents a chip or something like
509.44s - 514.00s |  that. They're super cheap, but they're pretty new. So they're a little bit harder to work with,
514.00s - 518.16s |  which is another thing you want to consider when you're picking your MCU is how long has this been
518.16s - 523.44s |  around? Is there a lot of documentation? Is there a lot of community support? Those are the big
523.44s - 530.80s |  things you want to be looking at. Okay. So what is a GPIO? I know someone's going to be asking
530.80s - 536.08s |  this. That is a general purpose input output. Those are the pins on the MCU. Those are the
536.08s - 540.40s |  things that actually do something. So if you want to put a sensor or you want to blink an LED,
541.12s - 545.68s |  anything that is an input or an output, you're going to need a GPIO for that.
546.32s - 551.36s |  You can do some tricky things to get extra GPIO out of your badges, but realistically,
551.36s - 560.14s |  you want to have one GPIO per thing that you want it to do. Here's some quick examples of
560.14s - 564.62s |  pins that have a lot of GPIO. Some of those are through holes. Some of those are surface mount,
564.62s - 569.26s |  but it at least gives you an idea of all those pins are different things you can do. For these
569.26s - 576.86s |  keyboards here, you have to use one GPIO for each row of keys and for each column of keys.
577.42s - 581.50s |  And that way you can pinpoint which key was clicked. So obviously for the larger keyboards,
581.50s - 586.38s |  you're going to need a lot more GPIO. So it's just something to think about if you're building
586.38s - 593.39s |  something that has a lot of functionality. Okay. So you've got your idea. You can plan
593.39s - 598.59s |  out your hardware now. Now you can look at the power. Okay. So how long do you want it to run
598.59s - 606.11s |  for? My rule of thumb is usually if it's rechargeable, I want it to last at least 24 hours
606.11s - 609.95s |  so that people can play with it at the con. They can go home at night when they're about to pass
609.95s - 615.47s |  out and plug it in to recharge it and have it for the full next day. If it's not going to be
615.47s - 620.43s |  a rechargeable battery, I want it to last the whole con. I want people to be able to leave it
620.43s - 627.30s |  on, forget about it, fall asleep with it turned on and still be running the next day. I mean,
627.30s - 630.82s |  realistically, you could make things that power for months. I really doubt you need that, but
631.46s - 638.42s |  it's an option. When it comes to using power, the heavy hitters are usually things like NeoPixels
638.42s - 644.02s |  and Wi-Fi. NeoPixels, there's a lot of tricks you can do to make them use a little bit less power,
644.02s - 648.18s |  but if you really want that color cycling where you control what colors they are and how they move,
648.82s - 654.18s |  it's going to cost you a bit of power. The last thing to think about is do you need a charge
654.18s - 657.70s |  circuit? And that's going to be if you're doing the LiPo batteries and you want to be able to
657.70s - 663.30s |  recharge that. Some MCUs will have that built in. So again, you'll have to read the documentation
663.30s - 667.62s |  and see, is this something that I need to build on my own or is this something that my MCU comes
667.62s - 674.98s |  with? Now I chose this badge for this slide because this is one of the spaces where I really
674.98s - 680.02s |  screwed up and I really regretted it. So this is a lesson for y'all to learn from my mistake here
680.66s - 686.10s |  is I used one of these, I think it was called a CH123 battery and they're not rechargeable,
686.10s - 689.30s |  so you have to click it out and click a new one in every time you want to use it.
689.30s - 696.10s |  I was using Wi-Fi and NeoPixels on this badge and it did not last a day. And once it died,
696.82s - 701.22s |  where are you supposed to get one of these? So this was for Wild West Hack and Fest. Those who
701.22s - 705.46s |  have been to that, you know, there's not a lot of places to get batteries out there in the middle
705.46s - 712.42s |  of Deadwood. So when these badges died, you were just kind of out of luck. So I included an extra
712.42s - 718.10s |  battery with each one, but you know, it was an area where I regret that. So make sure if you're
718.10s - 722.10s |  going to use a battery that can be swapped out, make sure you're using something that people can
722.10s - 726.82s |  actually get their hands on when they want to get new, you know, replace that battery.
729.79s - 732.75s |  Okay. So we're ready to build our thing, whatever it may be.
734.19s - 741.39s |  So I usually skip this part. You should not skip this part. This is just me being lazy and not
741.39s - 747.15s |  wanting to do it, but just for full disclosure, I usually end up skipping this. I do regret it
747.15s - 752.43s |  later most of the time. This is going to save you a lot of headaches and this is going to allow you
752.43s - 756.27s |  to be able to send your circuit to other badge makers or other, you know, electrical engineers
756.27s - 760.43s |  or whatever and say, Hey, why is this not working? Or, Hey, is this going to work?
761.79s - 766.11s |  So we'll talk a little bit more about these later on, but you're going to want to draw it out. Okay.
766.11s - 771.63s |  And this is something where you can see there, there's the ATtiny85 and it's going to some
771.63s - 776.27s |  resistors and it's going to a USB port. And it allows you to actually check out what your
776.27s - 779.55s |  circuit's going to do and how it's going to do it to make sure all the connections are there,
779.55s - 789.06s |  you know, and it's going to work. So shameless plug, a buddy of mine, Relay Moth,
789.62s - 795.78s |  he actually sells t-shirts of that circuit. So I've got one on right here. We have a few of them
795.78s - 799.38s |  over at the Cyber Swamp Lords booth, but most of them have sold out, but you can get them online
799.38s - 805.54s |  if that's something that you guys like. So once you have built out your circuit, now's when you're
805.54s - 810.42s |  going to want to breadboard that. So you're going to build it with actual parts, but without a PCB.
810.42s - 814.34s |  You're just jamming wires into a breadboard and connecting everything up to make sure that it
814.34s - 820.18s |  works. You can kind of do little tricks like just touching wires together to simulate clicking a
820.18s - 824.90s |  button. You can start to build out your firmware at this phase if it actually needs firmware,
824.90s - 829.14s |  like if you're using an MCU and you want it to have Wi-Fi or Bluetooth or whatever, this is when
829.14s - 833.70s |  you can start building that and make sure that the hardware that you're choosing can actually do the
833.70s - 844.26s |  things you want it to do. Also, I usually skip this step too. So don't listen to me, just do
844.26s - 851.57s |  what you're supposed to do. So that leads into planning out the firmware. Usually Arduino IDE
851.57s - 856.45s |  is a great place to start for this. They have ways to be able to test out all kinds of functionality
856.45s - 861.09s |  on all kinds of different chipsets. They just make it a lot easier to develop on, especially
861.09s - 866.69s |  if you're just getting started. What I always tell people is if you just Google the functionality
866.69s - 872.13s |  that you want, chances are someone else has done something that's very close to that. Even if it's
872.13s - 876.37s |  not super close to it, even if it's kind of a little bit off, you can usually just steal chunks
876.37s - 881.81s |  of that and start mashing things together to build out the firmware you want. Those Fox badges that I
881.81s - 887.17s |  built a few years ago, if anybody knows about those, they were really just a hop gobble of a
887.17s - 890.37s |  bunch of other people's code that I was able to string together and make it work.
891.89s - 895.73s |  You know, it's a simple way to start, especially if you're not great with writing firmware like me,
896.29s - 901.89s |  it's a good way to get it going. So as long as you're using an MCU, some other ideas to think
901.89s - 906.85s |  about adding in there is things like a CTF, things like feature flags, there's things like a debug
906.85s - 912.85s |  mode, and again the SAO. Things like that are a great way to add functionality onto your badge
913.41s - 917.17s |  without really, you know, needing to change the hardware at all.
919.25s - 923.97s |  So we had talked before about how SAO is a standard. This is the actual pinout for it.
923.97s - 928.05s |  So you've got your three volt in your ground, then you've got a data and clock, and then you've got
928.05s - 934.05s |  two GPIO. And that's just something where this is, if you want it to be a full SAO, this is what
934.05s - 938.53s |  people are referring to. But again, you can just do that three volt in the ground and you're probably
938.53s - 944.21s |  going to be just fine. Also, some badge makers do not necessarily do 3.3 volt. I've seen badges
944.21s - 950.21s |  that are sending six volt here. Maybe don't do that, because that might blow up someone's SAO,
950.21s - 957.87s |  but people do it. Okay, so packaging and accessories. This is an area where I always
957.87s - 962.51s |  like to do a lot more. I know some badge makers, they just like to hand you a bag with the badge
962.51s - 967.71s |  in it, and that's fine too. But I always think it's a lot more fun when badges come with like
967.71s - 972.91s |  really cool packaging, and they come with cool accessories, and it's this whole experience that
972.91s - 977.39s |  you've built for someone rather than just handing them the badge. I always like doing that, so I
977.39s - 982.51s |  always encourage others to do the same thing. If you're going to do this, the thing to think about
982.51s - 987.87s |  when you're doing it is, what do you actually need to use this badge? Like if I handed you the badge,
987.87s - 992.51s |  what would you need to just turn it on and use it right now? And then there's things like,
992.51s - 997.63s |  what would you want to get with this badge? So the needs, I have things like USB cable,
997.63s - 1002.19s |  batteries, antenna, any of those kinds of things where it's like to be able to use this badge
1002.83s - 1007.87s |  straight out the gate. Those are the kinds of things you would need. The things that are wants
1007.87s - 1013.15s |  are things like the sticker, or you know, an extra SAO that comes with the badge, or the case for it,
1013.15s - 1017.95s |  or whatever. Any of those things are things that it would be great to have that, but you don't
1017.95s - 1024.29s |  really need it. Okay, so you've got all your ideas, you know what parts you're going to use,
1024.29s - 1028.05s |  you know what accessories you're going to include and all that, where the hell do you find it all?
1029.01s - 1033.89s |  So I always tell people there's basically three tiers that you can go through to actually get
1033.89s - 1040.61s |  this. There's your fast shipping kind of highest cost tier, and obviously that's Amazon. These are
1040.61s - 1046.29s |  the kind of parts where you don't want to be buying your production parts off of Amazon.
1046.29s - 1049.25s |  You're going to pay an arm and a leg. You're going to get them tomorrow, but you're going
1049.25s - 1054.77s |  to pay an arm and a leg for it. But these are perfect if you get in a jam, or when you're
1054.77s - 1059.33s |  prototyping. When you're prototyping, you probably don't want to have to sit around waiting two weeks
1059.33s - 1064.29s |  to get some parts just to try them out and be like, oh that wasn't what I needed. Use Amazon,
1064.29s - 1067.17s |  get them on there real quick, because you're only buying one or two of them.
1068.45s - 1073.01s |  The mid-tier stuff is usually takes around a week of shipping. You can get them faster,
1073.01s - 1077.17s |  but it's usually going to be sometime around a week. And these are things like Digikey, Mouser,
1077.17s - 1081.89s |  Aero. I know there's plenty more, but those are the ones that I've used and had good luck with.
1082.85s - 1088.13s |  These ones are going to be very reliable parts distributors, but they do take a little bit more
1088.13s - 1091.89s |  time. You're going to get bulk pricing and things like that, and the more you buy, the more you're
1091.89s - 1098.37s |  going to save on those ones. Those are usually where you want to go for things like MCUs,
1098.37s - 1101.73s |  where it needs to be solid, it needs to work, it needs to be authentic.
1102.69s - 1107.41s |  And the final one is the low-cost, long ship times, and this is things like AliExpress.
1107.97s - 1112.93s |  You can also use Teemu or Alibaba or any of those as well, but any of these, you're going to have
1112.93s - 1117.73s |  to wait for these parts, but they're going to be dirt cheap, no matter how many you're buying.
1118.37s - 1124.77s |  The one problem with this tier is that they're not necessarily authentic. I've had friends that
1124.77s - 1129.09s |  have ordered a bunch of parts from AliExpress, they get them, and three quarters of them don't
1129.17s - 1136.69s |  work, and they're obvious fakes. This is something where, to me, I like to order simple things like
1136.69s - 1143.01s |  resistors or LEDs or things like that. I like to order those from AliExpress to get the better
1143.01s - 1148.29s |  deal on them, but anything like an MCU where I need it to be good, I need it to work, and I need
1148.29s - 1153.17s |  it to be authentic, I'll order that from that mid-tier. You can kind of choose to slice this
1153.17s - 1159.12s |  however you want, that's just how I like to do it. Okay, so what is all this going to actually
1159.12s - 1165.36s |  cost you? I've drawn out the way that I plan budgets, and these numbers are just made up,
1165.36s - 1169.84s |  but this is how I like to do it, is I like to get all of my different things that I'm going to buy,
1169.84s - 1174.64s |  so the PCBs, the components, batteries, lanyards, accessories, cases, whatever,
1175.20s - 1178.96s |  and put down how much the complete order of that thing is going to cost,
1179.84s - 1184.80s |  then how many units I'm going to make, and a total cost to make it. So that is like,
1184.80s - 1190.24s |  if I had to invest, you know, in this case, $325 to prototype this out,
1190.24s - 1194.64s |  you know, I ordered that many parts and boards and, you know, whatever to build this thing.
1196.32s - 1200.72s |  Oh, whoops, sorry, that's time spent on dev. Total cost to make would be all of those items
1200.72s - 1206.24s |  totaled up, which gives me that cost per unit. From there, you can kind of estimate your shipping
1206.24s - 1209.84s |  if you want to include that, put what price you're planning on charging, and have this
1209.84s - 1214.48s |  calculate like how much profit are you going to make off of these badges if you sell all of them.
1215.04s - 1219.20s |  And also, what is your breakeven point? How many of these badges do you have to sell
1219.84s - 1222.40s |  to just offset the cost that you spent to make it?
1225.84s - 1230.96s |  Let's see here. Yeah, so another thing is kind of your prototyping and discovery costs,
1230.96s - 1235.60s |  but also your equipment costs. Some people like to include that. I usually consider equipment
1235.60s - 1239.60s |  that I bought to build a badge something that I would probably buy anyway for my hobbies, so
1240.24s - 1243.36s |  I don't usually include them, but it is something to think about.
1246.00s - 1250.00s |  Okay, so we're finally about to get to the demo here soon, but there's a couple things we want
1250.00s - 1255.44s |  to go over before we do that. So I had mentioned we'd come back to designing the circuit. So this
1255.44s - 1260.96s |  is the circuit that we're going to try to kind of get as far into as we can with building. So with
1260.96s - 1267.04s |  this one, we're going to use the ESP-01S. This is kind of a very small ESP unit that gets us just a
1267.04s - 1273.12s |  few IO, but it gets us Wi-Fi, which is what we're going to do with this. It's easy to work with.
1273.12s - 1277.92s |  It's very simple to solder, especially for first-time solderers. So we're going to go with
1277.92s - 1281.92s |  that one. We're going to go with a little one-inch OLED screen so we can actually see what we're
1281.92s - 1286.72s |  working with. We're going to go with the AAA batteries because they're simple. AAA batteries
1286.72s - 1292.48s |  are going to give us 4.5 volts. All this stuff we're using needs 3.3 volts, so we're going to
1292.48s - 1298.48s |  have to use a linear regulator to cut that power down from 4.5 to that 3.3 that we need.
1300.32s - 1303.28s |  Then we're going to include a little header so that we can actually program this thing
1303.92s - 1310.91s |  and, you know, simple things like buttons, LED, and switch. Okay, so you're probably thinking,
1310.91s - 1316.91s |  how do I know which of those GPIO I need to be using to do this? And the answer is simple. It's
1316.91s - 1323.23s |  the documentation. Okay, so when you're looking through this documentation for your MCU or
1323.23s - 1328.91s |  whatever it is that you're going to actually be using, they are very long documents. And
1328.91s - 1333.07s |  especially if you're just getting started, they can be really, really overwhelming to look at.
1333.71s - 1341.71s |  So even if you skip 99% of it, the things that you really need to look at is the pin definitions.
1342.83s - 1348.35s |  This is going to show you what each pin does and what it, or I should say what it can do,
1348.35s - 1354.19s |  because not every pin can do everything. So this shows you all the pins that your
1354.19s - 1359.23s |  board offers, or your MCU offers, and then the list of things that it can do. But it also shows
1359.23s - 1365.31s |  you what they call the active and the boot time for those pins. These are important because it's
1365.31s - 1371.23s |  going to say high or low, and that tells you that it's going to be putting out power or not putting
1371.23s - 1376.75s |  out power during the boot time or while it's turned on. So this is important because if it's
1376.75s - 1384.83s |  supposed to be held high at boot time, but you have it cut off, it's not going to boot. So make
1384.83s - 1388.19s |  sure that you're paying attention to these things and understanding how they're going to work.
1389.39s - 1393.63s |  The next thing you need to pay attention to in this is the typical application section.
1394.27s - 1398.99s |  Usually it's going to show a more circuit diagram, kind of like that bottom left there,
1398.99s - 1404.03s |  but it could also show just a picture of the unit itself. But what this is going to show you
1404.59s - 1411.39s |  is what you need to provide to this chip just to make it work. You can add your own stuff after
1411.39s - 1416.03s |  this to make it do whatever it is you need it to do, but these are the bare minimum of what you
1416.03s - 1423.15s |  need to make this thing turn on. So you'll see in the top one there, which is the ESP-01, they've
1423.15s - 1430.91s |  got a couple resistors there going from enable and reset to that 3.3 volt. But on the ESP-01S,
1430.91s - 1434.43s |  which is the one that we're going to use, they've eliminated those. They built those
1434.43s - 1440.83s |  internally on the MCU, so you no longer need those. So for us, our minimal circuit is literally just
1440.83s - 1445.31s |  that ground and the three volt, and then we need the RX and TX to be able to program it. That is
1445.31s - 1450.83s |  all we need to make this thing work. Now they also have a recommended circuit section sometimes.
1450.83s - 1455.55s |  This is not always there, but in this particular one, they had that recommended circuit there of
1455.55s - 1460.83s |  that power supply reference design. That's how we know that we're going to need that 3.3 volts
1461.79s - 1467.15s |  giving our badge significantly over that, which we are. So we essentially lifted out that one as
1467.15s - 1473.84s |  well that we're going to use for this badge. Okay, so when you design a PCB, there's going to be tons
1473.84s - 1479.84s |  of layers that it shows on here, and we'll show this once we get to the demo. But the layers,
1480.48s - 1484.40s |  some of them are additive and some of them are subtractive, and so this is kind of the hardest
1484.40s - 1489.12s |  part to get used to when you start using something like EasyEDA, which is the one that I'm going to
1489.12s - 1494.16s |  be showing you guys today. So there's the top and bottom layer, and this is the actual copper
1494.16s - 1499.36s |  layer on your board. These are additive, which means that whatever I draw on my board on the
1499.36s - 1505.12s |  top and bottom layers, they're going to put copper in that shape or in that design or connecting
1505.12s - 1510.48s |  those things. Then there's the top silk and bottom silk layer. These are the silk screen,
1510.48s - 1515.36s |  so if you have the traditional green PCB with the white writing on it, the silk screen is that white
1515.36s - 1519.84s |  writing. And this one is additive as well, so anything that I write or draw or whatever,
1519.84s - 1523.36s |  it's all going to show up in white or whatever my silk screen layer is.
1524.48s - 1529.44s |  Then there's the top paste mask and bottom paste mask layers. These are what's known as the stencil
1529.44s - 1534.80s |  layer. This is where if you were ordering a stencil for SMT so you could just squeegee your solder
1534.80s - 1540.96s |  paste on there, this is the layer that they would cut out for that. So this is when you want to
1540.96s - 1546.64s |  expose the copper or expose the PCB itself. These are subtractive, so anything that you draw
1546.64s - 1553.76s |  on these layers, it's going to cut that off of the stencil layer. Top solder mask and bottom
1553.76s - 1559.84s |  solder mask is very similar to this. This is the actual solder mask, so on the green and white PCB,
1559.84s - 1566.24s |  this is the green part. Usually in EasyEDA, if you draw something on either the top paste mask
1566.24s - 1570.48s |  or top solder mask, they're just going to cut it out anyway, so they effectively work the same way,
1570.48s - 1574.88s |  but they are separate layers. So this one is also subtractive. It's going to cut out whatever you
1574.88s - 1580.80s |  draw. Then there's a couple of different layers that are kind of more used for the actual building
1580.80s - 1586.56s |  of the PCB itself. So this is the board outline layer, where that's actually the shape of your
1586.56s - 1591.36s |  badge. And there's multi-layer, which is things like through-hole components or if you drill a
1591.36s - 1597.20s |  hole in the badge or things like that. Then there's the rat lines. Rat lines is if you have all of your
1598.08s - 1602.24s |  pins set up in such a way where you have labeled the nets. So if you have a ground pin over here
1602.24s - 1606.88s |  and a ground pin over here, but you didn't connect them, a rat line is where it's going to draw a big
1606.88s - 1610.56s |  blue line across your screen saying, hey, these are supposed to be connected, but you haven't
1610.56s - 1614.88s |  connected them yet. So that's just to help you. It's not going to be printed on the board or
1614.88s - 1619.76s |  anything. It's just to help you design it. And that's same with the document layer. The document
1619.76s - 1624.96s |  layer is there so that you can make labels for things that will not be printed onto the board.
1625.92s - 1631.28s |  Now, a special note about that one. It's not supposed to be printed on the board.
1631.28s - 1635.52s |  That doesn't mean that your fab will not screw up and accidentally print it on the board.
1635.52s - 1641.76s |  So make sure before you click go on a massive order that they have not put the document layer
1641.76s - 1647.89s |  on there because I've had some friends that it just happened to recently. Okay. So here's the
1647.89s - 1651.81s |  demo time. We're going to see if this works. Everyone pray to the demo gods. We're going to
1651.81s - 1657.33s |  try and crank through as much of this badge as possible. And yeah, we'll see how it goes.
1662.72s - 1668.96s |  Okay. So I said earlier that the program that I like to use to build these is called easy EDA.
1669.52s - 1672.56s |  I usually use the online one, but just so I wouldn't have to worry about internet.
1674.16s - 1680.45s |  I've got the local one here. So when you're first starting out,
1681.97s - 1684.13s |  you're going to come in here and you're going to say you want a new project.
1685.65s - 1688.69s |  We're going to call this Nibbler because we're going to build Nibbler from Futurama.
1690.05s - 1693.57s |  So the first thing it's going to give you is this to draw your circuit diagram. We've already done
1693.57s - 1697.25s |  that. So we're just going to go ahead and skip past that. We're going to come over here and say
1697.25s - 1703.25s |  that we want a new PCB. Now it's going to show you a lot of things here about, okay, how do you want
1703.25s - 1707.01s |  this PCB to look? So it's going to tell us that we're doing millimeters. We're going to do two
1707.01s - 1712.13s |  layers. This means there's copper on the top and on the bottom. You can actually do tons of layers
1712.13s - 1716.69s |  if you want. And it's going to put those copper layers in the middle. This gets really, really
1716.69s - 1723.09s |  expensive really quick. Most people that I know of just do the top and bottom layers. I know there
1723.09s - 1727.81s |  is some badge makers out there that go crazy and do like eight layers and things. I stick with two.
1728.37s - 1732.85s |  That's just me. So board outline, this is where you can pick if you want it to be a circle,
1732.85s - 1738.13s |  round, rectangle, whatever. I just start out by leaving this as rectangular. I'm going to tinker
1738.13s - 1743.09s |  with it in just a bit and you'll see how I do that. But I leave it as rectangular. And because
1743.09s - 1747.09s |  of that, I leave these the same way too. I'm going to mess around with that board on my own. I don't
1747.09s - 1753.92s |  care what they make. Oops, I think I just clicked cancel on that. So we'll just leave these as
1753.92s - 1762.80s |  defaults for now. So now we have our pink board outline here. Okay, so we're going to go to the
1762.80s - 1770.74s |  document layer real quick. And we're going to click that we want to add an image. Now on the
1770.74s - 1775.22s |  desktop, I've got this Nibbler folder here where I've kind of picked out all of these. So we've got
1775.22s - 1781.92s |  our document layer file that I've kind of preset to this. And there it shows us our little picture
1781.92s - 1786.16s |  of Nibbler. So this is what our badge is going to look like. I'm going to set this to 150 because
1786.16s - 1791.36s |  I've already tested this out and that seems to be a pretty good size for us. So now we have our
1791.36s - 1798.80s |  Nibbler and we put it on here. So we want this board to match that Nibbler. Now, again, there
1798.80s - 1804.32s |  are lots of ways to do this in lots of different editors. This is just how I do it. I have been
1804.32s - 1809.36s |  told this is the absolute caveman method, which it does kind of seem that way. But this is what I do.
1810.16s - 1816.08s |  I just start dragging and dropping. I usually start out by making it pretty extreme like this
1816.08s - 1822.48s |  where it doesn't go very close. Whoops. But you can just drag these things and pull them all the
1822.48s - 1828.80s |  way to where you want them to go. So I'm going to pull them all super gnarly right now just so we
1828.80s - 1837.89s |  can at least see it. But then once we get this kind of close to how we want it, then we can start
1837.89s - 1841.65s |  getting it tighter and tighter. And we'll go over that too, but I'll just try and do this as quickly
1841.65s - 1847.89s |  as I can. Now, one of these is not actually connected and we're about to reach it right now.
1847.89s - 1852.37s |  So this one here is the one to look at because now I've opened it up. If I try and print this,
1852.93s - 1857.89s |  JLCPCB is going to get real mad. So when we do this, we got to make sure that we
1858.69s - 1863.49s |  connect these two properly and zoom in here to make sure they're actually touching.
1866.98s - 1869.86s |  Okay, so let's say that's good enough. We're going to call it good enough for now.
1869.86s - 1876.18s |  Once it is close, that's when I zoom in and start making this really close.
1878.10s - 1884.10s |  So I've had people ask me like, hey, how good do you need to make this? The answer is as good as
1884.10s - 1891.94s |  you want it to be. The tighter you make it and the closer you make it to exactly how your design
1891.94s - 1898.66s |  looks, the better those angles are going to look when you print that PCB. So right there, you can
1898.66s - 1903.70s |  see there's tons of little dots there. And it's really just how extreme do you want to take this?
1903.70s - 1908.10s |  That's really all it is. So let's say that we had that thing all done. We can come over here
1908.10s - 1914.42s |  to view and click 3D view. And now it shows us there is our PCB. Right now they call it blue,
1914.42s - 1918.50s |  apparently. We can make it green, we can make it purple, whatever we want. And we can select the
1918.50s - 1923.22s |  surface finish here too, if we want it to be gold or silver. But for now, this is our PCB.
1924.66s - 1929.38s |  So let's come back here. And now we can say, okay, we want to add another layer. This time
1929.38s - 1934.50s |  we're going to add the top layer. So we come over here and we go to copper.
1935.46s - 1939.78s |  And these are all just files where I took a picture of Nibbler and I put it into GIMP,
1939.78s - 1944.42s |  and I colored in each layer with like, say, green or something like that. Selected everything that
1944.42s - 1947.78s |  was green, chopped out everything else, and just saved to just that one part.
1948.66s - 1952.82s |  Okay, so that's how I made these things. Once we have this, I've already forgotten the name
1952.82s - 1957.94s |  that I selected, or the number. So this one says 62, and I'll show you how I got to that one as
1957.94s - 1962.50s |  well, is when I'm putting these in here, I essentially just guess at first. I say, okay,
1963.46s - 1967.22s |  how about 60? And I put it over here and I say, well, that's a little bit too small.
1968.10s - 1972.02s |  Now, I can place it like that, and I can readjust it over here and just say like,
1972.02s - 1976.90s |  you know, okay, that's pretty close. Let's try 84, and just kind of adjust slowly that way.
1977.46s - 1981.62s |  Or I can just delete that and reenter it as a slightly different size.
1983.06s - 1989.39s |  And this time I'll put in 62, and now it fits.
1990.91s - 1994.35s |  So you really just kind of slowly adjust these things until they look the way you want.
1996.19s - 2002.19s |  Okay, so now, if I was to, I'm going to cancel out of this. Now if I'm to go over here and go
2002.19s - 2008.83s |  to my 3D view, you can kind of vaguely see his little cape there, because that is covered copper.
2008.83s - 2013.15s |  We've added that copper layer, so now they're going to add copper in that spot on just the
2013.15s - 2017.31s |  front. So on the back, there's nothing, but on the front we can see that copper.
2018.51s - 2024.51s |  So let's say we want to expose that copper. So let's come back here, and we do another copper
2024.51s - 2032.35s |  layer. Actually, well, yeah, so you can do it like this, and just make it match the same size.
2034.27s - 2039.47s |  And now we're going to change this from the top layer to the top solder mask layer.
2040.03s - 2046.51s |  Now it becomes subtractive. So if we put this on there, and we go to our 3D view,
2047.15s - 2053.15s |  now we've exposed that copper. So this is how you start designing out how you want that thing to
2053.15s - 2059.74s |  look. Okay, so the next one we're going to do is we come in here, and we go to our FR4 layer. This
2059.74s - 2064.06s |  is the one where we're going to expose all of this as well. So it's still going to be that top silk.
2064.06s - 2069.71s |  Whoops, let me cancel this, so I can actually go to the right thing. So we come over here, and we
2069.71s - 2077.07s |  change this to the top solder mask layer. We come back, we go back to that FR4, and this one says
2077.07s - 2085.87s |  94. So I'm going to set that. Okay, we're going to go ahead and put this right here, and now
2086.83s - 2093.07s |  when we view that again, there he goes. Now he's starting to look a little bit more like Nibbler.
2094.51s - 2100.54s |  So the last one we're going to add is that top silk layer. So now once we add this,
2102.54s - 2110.30s |  oh, I didn't look at the number, 142. And again, each one of these, I just found the numbers ahead
2110.30s - 2113.02s |  of time, because I didn't want to sit there adjusting in front of y'all, and have it be
2113.02s - 2119.98s |  really, really boring. But once we slap that in there, now we've got our Nibbler. Now this
2119.98s - 2126.94s |  document layer, we can come in here, and we can turn that off, and this is what our badge looks
2126.94s - 2134.54s |  like. Now when we go to that 3D view, let's make this black, and now we've got a vague shape of
2134.54s - 2139.58s |  what Nibbler is going to look like. Okay, so now that we have the art, and we're going to call that
2139.58s - 2147.18s |  done, now we can start adding components. So we need that ESP-01S. So we're going to come over
2147.18s - 2161.15s |  here and say place footprint, and we can do ESP-01S. Now once you do this, there's a user
2161.15s - 2166.51s |  contributor section, or user contributed section, and these are things that other people have made
2166.51s - 2172.99s |  and submitted their own footprints that they use. This isn't really that sketchy. I haven't had any
2172.99s - 2178.03s |  of these that were bad yet, but they are all a little different, and some people do make some of
2178.03s - 2183.31s |  these very, very custom, where it's obvious that they were using this in some very unique way that
2183.31s - 2187.87s |  is not how you want to use it. So just be careful to look at these and make sure it makes sense.
2188.83s - 2193.87s |  The better one that I like to use is this one over here, JLCPCB Assembled, because these are
2193.87s - 2198.83s |  the ones that are actually from JLC, and this is where if you change your mind about soldering it
2198.83s - 2204.27s |  yourself, and you say, no, no, I want them to do it, you have to be using these footprints. So make
2204.27s - 2207.87s |  sure that if you're going to have them populate this for you, that these are the ones you're using.
2208.99s - 2213.63s |  Also these tend to be a little higher quality in my opinion. So we're going to choose this one here,
2213.63s - 2218.91s |  and we're going to place it. So it shows it right here. So we're going to pop it down here. We're
2218.91s - 2224.03s |  going to kind of zoom in a little bit. So once we grab this, we can kind of rotate it however we
2224.03s - 2229.71s |  want. You can move it wherever you want. So let's put this right here so it kind of stays
2230.67s - 2235.95s |  in these lines here and makes it look like it's part of our design. So now let's take this and
2235.95s - 2240.27s |  let's put it on the back layer because we don't want this to be showing, which means I got to
2240.27s - 2246.94s |  rearrange it again. Okay, so now if we go to our 3D view, we've got our nibbler just the way we
2246.94s - 2250.14s |  saw them before. You can see those little holes there, but when we turn them around...
2250.14s - 2254.94s |  Oh, I guess this one doesn't do it. Some of them will actually show. There it is.
2255.98s - 2259.66s |  So now we can see, okay, this is how it's going to look. There's our little part,
2259.66s - 2271.34s |  exactly where it's going to be if we put it there. Okay, so now we're going to add a 0.96
2273.42s - 2286.05s |  OLED. Just trying to make sure this is the right part before I actually place it.
2286.93s - 2294.05s |  Yep, that... No, we want the four-pin version. There we go. Okay, so now this screen, we want
2294.05s - 2298.93s |  this to be on the front side. Now if I put it right here, you see it's on that red. That's the
2298.93s - 2303.01s |  copper layer. So we're going to be bridging those pins together. So we got to be careful where we
2303.01s - 2307.81s |  put this to make sure we're not touching any copper. So I'm going to place that over here.
2308.85s - 2318.43s |  We'll go ahead and rotate it a little bit. Nope, don't want to do that. There we go.
2319.55s - 2326.43s |  Let's put it right about there. Okay, so I can't remember for sure what these pins are,
2326.43s - 2330.75s |  but let's say that this pin right here is a ground pin. So we come over here to net,
2331.39s - 2335.79s |  and we can put that we want that to be part of ground. Let's say that this one right here
2336.43s - 2341.47s |  is our 3.3 volt. So on this one, let's say that this one is ground.
2342.43s - 2349.65s |  That next one is 3.3 volt. Okay, now if we turn on RATLINES, you can see,
2350.37s - 2355.09s |  hopefully you can see, there's those blue lines showing me, hey, you haven't connected these yet.
2356.29s - 2362.37s |  So let's go ahead and go over how to connect those. So we're going to start on the back layer
2362.37s - 2366.37s |  here because we've got this red copper here. So we can't go through that with a front layer.
2367.57s - 2372.29s |  So we'll go from the back. And we're going to come over here. And this one right here,
2372.29s - 2378.45s |  this one right here, it says TRACK. So we want to build a track, and it kind of snaps on here.
2378.45s - 2386.77s |  We're going to build a track that comes up, comes over, and then comes down. Now we need one over
2386.77s - 2394.13s |  here. So we're going to come like this, pull that over, and connect it like that. And now
2394.13s - 2400.53s |  our RATLINES are gone because now we've connected all ground nets to all other grounds, and all of
2400.53s - 2407.57s |  our 3-volt nets to all the other ones. Now let's say that this right here was our our data line,
2408.37s - 2414.05s |  and this one here is our data line. And we still want to stay on the back there,
2414.61s - 2420.21s |  but now when we go to connect this, we can't actually make it through here. Because if we do
2420.21s - 2425.81s |  that, we're now connecting those two. They're going to become one net. So how do we get around that?
2427.17s - 2430.53s |  Well, realistically, I should have just started from the front on this. But if we weren't going
2430.53s - 2434.61s |  to go that route, we can stop this right here. We're going to stop it shy of where we're trying
2434.61s - 2440.37s |  to go. And we can come over here to this one here. This one says VIA. And what this is, is this says
2441.01s - 2445.73s |  I want to build a little tiny hole that goes from the front of the board to the back of the board.
2446.61s - 2453.09s |  So now I can go on the red, and I can start at my VIA, and move it over here,
2454.45s - 2460.29s |  and connect it like that. So these VIAs are how you can get around all of the other lines you've
2460.29s - 2464.53s |  built, or the design that you've built. Because now you're able to swap between that front layer
2464.53s - 2476.93s |  and that back layer. All right, I'm trying to think if there was anything else that was major to be
2476.93s - 2485.41s |  showing on this. But so anyway, I guess actually let's look at this real quick. So there is now
2485.41s - 2491.49s |  our badge, as far as that goes. So let's say, okay, let's say this was done. We put on the rest
2491.49s - 2494.85s |  of the components. We were happy with this. We like the way it looks. We like the way the
2494.85s - 2501.89s |  functionality is looking. We want to, we want to print it. So we'd come over here, and we would go
2501.89s - 2508.53s |  to, well first we have to save it. Then we come over here, and say generate Gerber file.
2510.21s - 2514.45s |  When you do this, it's going to ask you if you want to check the DRC. This is your design rule
2514.45s - 2519.97s |  checking. These are the rules where they tell you how close you can put things to each other,
2520.69s - 2527.41s |  and how large you can drill, or how small you can drill. But also things like, are you crossing nets?
2527.41s - 2531.57s |  It's going to check for all of that kind of stuff. So you can say yes, you want to do it.
2532.21s - 2537.65s |  And in our case, we passed. All of our nets are not bridging, and nothing like that. But when you get
2537.65s - 2541.81s |  to that step, there is sometimes when that design rule checking is going to show you something and
2541.81s - 2546.61s |  say, hey this is wrong. You can't do this. But you know that it's what you're trying to do, and you
2546.61s - 2552.21s |  don't care. You can just click that no, and just say YOLO, I want to order it anyway. And they'll let
2552.21s - 2557.73s |  you. So from here, you can select how many you want, and what color you want. But really that's going to
2557.73s - 2563.17s |  be more, it's going to show you that once you get into JLC. Now again, you can order these from
2563.17s - 2568.93s |  anywhere you want. I like using JLCPCB. I've always had good luck with them. They do great work.
2568.93s - 2574.29s |  They have good prices, and they can do the fab for you if you want them to. But you can send them off
2574.29s - 2578.53s |  to anywhere by clicking this generate Gerber button. This one right here is just going to
2578.53s - 2582.45s |  download the files for you, and ask you where you want to put them. And now you can send those out
2582.45s - 2586.53s |  to someone else. You can share them with friends. You can send them to any fab shop, and they'll be
2586.53s - 2592.29s |  able to build those boards for you. Okay, so let's say we had clicked to have JLC do that for us.
2593.17s - 2601.25s |  Let's come back here. We'll go ahead and click go. So this is what it's going to show you in JLCPCB.
2601.33s - 2605.25s |  It also shows you a little picture of your board up there at the top. But this is what you're
2605.25s - 2611.57s |  going to see. There's a lot to go over on here. But the big ones to look at is checking the
2611.57s - 2616.37s |  dimensions to make sure it looks like what you built. Sometimes those can be wildly off, especially
2616.37s - 2621.81s |  if you didn't connect those two board outlines together. PCB quantity, obviously you're going
2621.81s - 2627.73s |  to want to look at that. The next big ones to look at is down a little bit further there,
2627.73s - 2633.25s |  where it says PCB thickness and PCB color. So the thickness is literally just how thick
2633.25s - 2637.81s |  the board is. If you leave that at 1.6, that's your standard badge. That's pretty much what
2637.81s - 2641.81s |  everybody uses. You're really only going to want to adjust that if you're trying to do something
2641.81s - 2645.73s |  special with the PCB, where it needs to be significantly thinner or significantly thicker
2645.73s - 2650.29s |  for whatever reason. But it is going to adjust the cost pretty heavily if you change that.
2651.73s - 2656.45s |  PCB color, obviously that's the color of your actual badge itself that you're creating. And
2656.45s - 2660.61s |  then silkscreen on JLC, they don't usually have any other option other than white,
2660.61s - 2664.29s |  unless you're printing a white PCB, in which case your only option is black.
2664.85s - 2667.73s |  More than likely, you won't need to adjust that because you can't.
2669.01s - 2673.09s |  The next one under that is surface finish. This is what's going to determine the color
2673.09s - 2678.29s |  of that copper layer. If you want to do a black and gold badge, then you need to do that ENIG.
2678.29s - 2684.29s |  That is immersion gold. I can't remember what ENIG actually stands for. But if you want the silver,
2684.29s - 2688.05s |  that's where you're going to go with either the hassle or the lead-free hassle. Either one of
2688.05s - 2693.17s |  those two is going to be that silver color that you see on PCBs. Now the last one that
2693.17s - 2699.49s |  you need to make sure you look at is that remove order number. This one, I don't know why they do
2699.49s - 2705.65s |  not click yes by default, but they do not. The default is no. They're going to print your PCB
2705.65s - 2709.97s |  number directly on it. And the reason for this is that they want you to be able to reorder that
2709.97s - 2714.85s |  exact batch. So later on when they say, you know, would you like to reprint, you know, your previous
2714.85s - 2718.29s |  batch, you can look at the badge and you can say, okay, this is the batch number from the one that
2718.29s - 2723.41s |  I made. Yes, I want that exact one. Realistically, you don't want that, especially because they're
2723.41s - 2727.89s |  going to put it in the worst possible spot. They're going to put it dead center front,
2727.89s - 2734.13s |  center of your badge. Just check that box. It does add, like, I think it's $1.50 to remove
2734.13s - 2738.37s |  the order number from your badge. It's, it's worth it. Just do that one.
2742.00s - 2746.24s |  So that's all I've got for you, but go out there and make some badges.
2746.24s - 2750.88s |  Seriously, it's not that hard. It's a lot of fun. We wouldn't keep doing this year after year after
2750.88s - 2756.48s |  year if it wasn't. So anyway, feel free to reach out to me. If you have any questions whatsoever
2756.48s - 2760.80s |  after this, feel free to come chat with me in the vendor booth. I love meeting new people.
2760.80s - 2764.80s |  Do not hesitate to ask. Hope you guys all have a good DEF CON.


url: https://www.youtube.com/watch?v=ssLu8xHMwSk
title: DEF CON 32 - Psychic Paper: Making eink access badges accessible for anyone - Joshua Herman
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=ssLu8xHMwSk",
  "title": "DEF CON 32 - Psychic Paper: Making eink access badges accessible for anyone - Joshua Herman",
  "description": "To make RFID access badges vendors in China have created eink badges where instead of printing a badge out you instead program the eink portion of the badge with an smartphone app and then program the RFID portion. At this time the ones that are sold are either black and white or black and white and red. There is no security implemented so all you need to do is download the app to reprogram the front of the badge. This makes anyone able to reprogram both the front and back of the badge.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1610,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 8.00s | This text was transcribed using whisper model: large-v2

 Hi, sorry for the set-up issues.
8.00s - 11.10s |  This is my talk about psychic paper.
11.10s - 22.36s |  It's how to use e-ink displays and also e-paper displays to fake the front of identification
22.36s - 33.98s |  badges and also discussion about the two or three e-ink systems that are pre-made from
33.98s - 41.00s |  suppliers and how they have lax security and unusual sign-up.
41.00s - 42.42s |  My handler is ZittoBBGong.
42.42s - 49.10s |  I'm a frequent of the DEF CON Discord.
49.10s - 56.00s |  But more about who I am, I have 11 years of experience in the software industry.
56.00s - 61.24s |  This is a hobby project and this is not related to my employer.
61.24s - 67.00s |  I've actually had to add that to my presentations because people think that they're too advanced
67.00s - 70.90s |  to actually not be related to my hobby.
70.90s - 73.00s |  So what is this talk about?
73.00s - 83.38s |  This talk is about the application of two to three color e-ink displays and also a design
83.38s - 93.66s |  prototype of a five color e-ink display that would be much more effective in red teaming
93.66s - 99.54s |  and or physical red teaming and social engineering.
99.54s - 106.02s |  Anecdotally, I talked with a person at DEF CON and they were able to replicate someone's
106.02s - 115.46s |  badge by looking for a high-resolution picture, copy and pasting it into an image editor
115.46s - 117.96s |  and then printing it out.
117.96s - 126.98s |  This system, while having a lower resolution, could be done in real time and also it could
126.98s - 135.56s |  be replaced real time too and combined with RFID knowledge that has been done in many
135.56s - 143.28s |  DEF CON talks, you could basically clone an entire employee ID badge or physical access
143.28s - 155.46s |  badge that uses RFID and or other technologies like MIFID and so forth.
155.46s - 159.60s |  So first we're going to go through three color e-ink displays.
159.60s - 163.32s |  These can be found on Amazon and Alibaba.
163.32s - 165.60s |  They are very easily sourced.
165.60s - 169.52s |  They are much durable than the research prototype I have.
169.52s - 176.56s |  They are reprogrammable and they have a weird way that you have to program them.
176.56s - 186.84s |  So this is the nice pictures from Amazon that they put and on the upper right side that's
186.84s - 190.28s |  the real thing.
190.28s - 197.26s |  A good idea to understand the difference between e-ink, e-paper and traditional display
197.26s - 205.20s |  technologies or not really traditional but light emissive versus non-light emissive.
205.20s - 217.24s |  So non-light emissive technologies require power and they require the emission of light.
217.24s - 229.56s |  OLED, LCD and so forth, by that nature, the obvious emission of light requires thermodynamically,
229.56s - 231.60s |  you need a power source.
231.60s - 241.44s |  On e-ink and or e-paper, e-ink is trademarked so e-ink TM, it's an electromechanical device
241.44s - 243.56s |  and what does that mean?
243.56s - 254.28s |  Electrical devices are devices that literally just move by an electric charge and then stop.
254.28s - 266.22s |  Because they stop, they can not acquire a power source after programming.
266.22s - 274.74s |  I talked with someone in a previous talk I gave at another conference and they told
274.74s - 286.46s |  me that they had a 12-year-old e-ink or e-paper device with the image for that long and there
286.46s - 291.82s |  was no image degradation.
291.82s - 298.74s |  But why I call this three color is that technically there are three colors, there is white, red
298.78s - 300.18s |  and black.
300.18s - 308.54s |  Now the other difference between e-paper and other light emissive such as LED and OLED
308.54s - 313.38s |  is that because this is electromechanical, you technically have three colors and it's
313.38s - 320.38s |  not RGB, it's white-ish, black and red.
320.38s - 326.74s |  You can see this and also if you had a Kindle, it's pretty obvious that white is not white-ish
326.74s - 327.74s |  also.
327.74s - 333.48s |  But even in the picture, you can see what two white is and white.
333.48s - 339.24s |  So that's a big thing to consider.
339.24s - 362.04s |  So this is a demo, it was on Amazon about just a two color.
362.04s - 375.97s |  As you can see the housing too, that will be important in the five color prototype.
375.97s - 382.33s |  So you could basically remake this especially if they use only a QR code to authenticate
382.37s - 389.61s |  people by just getting the data off the QR code and then using the e-ink or e-paper programmer
389.61s - 397.02s |  and then scanning it.
397.02s - 406.50s |  So some types of the suppliers are, the software is made by Hippo Inc, I'm not sure how to
406.50s - 408.78s |  pronounce that.
408.78s - 417.74s |  The APK must be downloaded from Hong Kong IP addresses or you have to be there.
417.74s - 424.46s |  There's the active version that is also $100, the non-active version is around $40.
424.46s - 432.22s |  The active version has a button and a USB-C possibly to reprogram, but it's pretty obvious
432.22s - 437.06s |  that they have to have some kind of battery to do that.
437.06s - 443.42s |  Those need phones to connect to, the higher priced one uses an iOS device, but I'm only
443.42s - 447.50s |  going to at least show the Android one.
447.50s - 451.62s |  So this is more an expanded on how to reprogram those three color.
451.62s - 458.30s |  You need a Hong Kong IP address, use a VPN too, MulVAD seems to work.
458.30s - 465.46s |  You must silo the APK, you still must be using a Hong Kong IP address to download the APK.
466.06s - 468.02s |  They have a link.
468.02s - 471.14s |  You must create the login, still using the VPN.
471.14s - 477.82s |  It has this weird setup, you use email, you set up a password, and then you have pseudo
477.82s - 484.22s |  two-factor that's emailed to you.
484.22s - 489.68s |  Then you can upload the badge.
489.68s - 496.52s |  The cards have 125 kHz NFC on it.
496.52s - 503.64s |  The important part is, I believe, like aluminum tape or just to remove it if you want to use
503.64s - 516.12s |  any other RFID technology, so you don't want to confuse the RFID or NFC sensor.
516.12s - 525.24s |  The passive ones also uses NFC to reprogram, so I suggest putting on the back or just put
525.24s - 528.78s |  it in your pocket.
528.78s - 532.82s |  Now I'm going to go into more of the prototype design I made.
532.82s - 535.42s |  So this is the more interesting part.
535.42s - 543.50s |  It was not in the talk description, but I mean, why not?
543.50s - 551.50s |  So as you can see on the right, there is an ePaper ESP32 circuit board.
551.50s - 555.08s |  It then connects to the ePaper device.
555.08s - 557.56s |  You can see that the fidelity is much better.
557.56s - 564.48s |  The white is still off-white, but it's much more high-resolution.
564.48s - 571.64s |  Also there's this, but also the purple part is the bezel.
571.64s - 576.30s |  The orange part is the physical display connector.
576.30s - 585.92s |  The middle part is a shim that they do where it takes one connector and adds it to another.
586.92s - 590.12s |  The middle part is part of the programmer.
590.12s - 601.24s |  There is also a Raspberry Pi hat, and in the future, if I were to redo it, I would have
601.24s - 602.88s |  done it that way.
602.88s - 614.82s |  This programmer either has unreliable behavior, or when I've unplugged and plugged the orange
614.82s - 617.90s |  part, it breaks my programming.
617.90s - 624.62s |  So I have to do more research on that, but you could also do it as a one-and-done engagement
624.62s - 631.40s |  anyways, since the person who I talked about doing the physical engagement when he printed
631.40s - 637.06s |  it out, he said he used it for the full engagement and nobody noticed for a month.
637.06s - 642.14s |  So this is a more high-fidelity nobody looks at, but you can also do active programming
642.18s - 650.62s |  by going in from one security, taking a picture about somebody else's picture with higher
650.62s - 657.43s |  level clearance, reprogram, and so forth.
657.43s - 664.79s |  This is the most important part and most technical part of it.
664.79s - 669.91s |  I had to find a wallet that would cover the bezel.
669.91s - 673.71s |  Do you see this bezel?
673.71s - 690.46s |  I did find a wallet.
690.46s - 691.46s |  This is on Amazon.
691.46s - 698.30s |  This is not an ad for the wallet, but I don't know if you can see that this well, but it
698.30s - 702.14s |  covers the bezel.
702.14s - 712.54s |  And number two is your friend is also called double-sided tape, and why does that matter?
712.54s - 718.38s |  You want this to generally be in place so that the bezel scene is minimized?
719.30s - 723.82s |  Sometimes people might notice the purple part and also you don't want it to fall out.
723.82s - 730.98s |  I would also recommend to use that so it doesn't fall out either, although it's pretty tight
730.98s - 742.28s |  if you don't cut anything, but yeah, double-sided tape is really important.
742.28s - 754.12s |  Cutting the bezels was annoying because this is in inches and the display prototype or
754.12s - 763.85s |  the display I'm using is in metric, so millimeters.
763.85s - 769.69s |  So the affected display that you have to program X640 by 400, there are five colors in display
769.69s - 773.85s |  which increases the fidelity.
773.85s - 776.73s |  Since it's more do-it-yourself, it makes it more fragile.
776.73s - 781.33s |  The RFID and NFC component can be separate.
781.33s - 783.17s |  There are two ways that you can integrate it.
783.17s - 793.41s |  One, cut the back of the display, I mean back of the wallet, paste the RFID device or anything
793.41s - 797.53s |  inside, remove the RFID shielding because this one is shielding.
797.53s - 802.33s |  I couldn't find one without shielding, and put it inside.
802.33s - 807.61s |  Another way would be to take a picture of the back of the wallet, make a sticker on
807.61s - 814.17s |  Sticker Mule, and then use double-sided tape on the RFID device and then put the sticker
814.17s - 819.82s |  on top of that.
819.82s - 830.52s |  So this is sort of a basic summary of the steps to do.
830.52s - 832.80s |  You could also make your own lanyard.
832.80s - 843.16s |  I actually think to make a less prototype or more like a release version would be for
843.16s - 855.64s |  me to replicate this white design and 3D print it, and then add Bluetooth programming or
855.64s - 869.34s |  something else, and maybe also add the NFC holder on the back.
869.34s - 875.54s |  So the brand for the wallet I'm using is Cavaleo.
875.54s - 879.10s |  It's a police-style badge.
879.10s - 888.02s |  I don't recommend using the other part because that's very illegal.
888.02s - 899.50s |  You can see the resolution of this e-paper device, its wave share, and then the HID card.
899.50s - 904.82s |  You can either get these cards from online.
904.82s - 908.18s |  You could get it by buying a Proxmark.
908.18s - 912.58s |  You could get one by forgetting to return your hotel badges.
912.58s - 914.90s |  It depends.
914.90s - 923.18s |  There are two general frequencies, 125 kHz and I believe 4 and 15 MHz, but it really
923.18s - 931.94s |  depends on the situation on what you're doing, and programming is annoying.
931.94s - 933.92s |  ESP32 driver board.
933.92s - 939.10s |  You can use a phone for the three-color.
939.10s - 949.58s |  The five-color also has the ability to do programming online, so it's sort of weird.
949.58s - 955.10s |  The ESP32 has two ways to do online programming, like through a website.
955.10s - 959.78s |  One is a Bluetooth one that I couldn't get working, and two is the Wi-Fi one, and the
959.78s - 963.30s |  Wi-Fi one is extremely finicky.
963.30s - 967.62s |  I look in console, and if you do it, it crashes.
967.62s - 971.94s |  It says post does not work, and you have to do it in a specific order.
971.94s - 977.30s |  If you do it in the wrong order, you could have real problems, and I would overwrite
977.30s - 979.06s |  the driver board.
979.06s - 984.92s |  This is why I don't want to use this driver board anymore.
984.92s - 990.06s |  There are many upsides for the Raspberry Pi usage.
990.06s - 1001.83s |  There was a DEF CON talk where they did a real-time badge cloning of RFID, and they
1001.83s - 1011.03s |  used Raspberry Pis, which means that you could combine this into that talk, and then you
1011.03s - 1016.15s |  wouldn't even need this driver board.
1016.15s - 1018.23s |  WaveShare also has a wiki.
1018.23s - 1024.91s |  It's okay, but there are no alternative suppliers to this.
1024.91s - 1029.43s |  This is the best solution I've seen.
1029.43s - 1037.55s |  4.01 inches is really hard to find, and also, the purpose of these e-ink, or why they even
1037.55s - 1043.11s |  exist are for digital signage.
1043.11s - 1055.86s |  If you go to a Kohl's, or a Best Buy, they have a lot of prices on the walls, and they
1055.86s - 1063.36s |  use it to automatically change it and possibly rip you off more.
1063.36s - 1066.12s |  This is more about the driver board.
1066.12s - 1072.40s |  It physically attaches, it connects to e-paper, and it supports Bluetooth and Wi-Fi.
1072.40s - 1076.64s |  Once you do programming, though, it's not needed.
1076.64s - 1083.24s |  It could be a one-and-done engagement, really, considering how it is.
1083.24s - 1086.94s |  It's very slightly inexpensive.
1086.94s - 1097.80s |  It's below $40.
1097.80s - 1104.44s |  How I recommend is, smartphones should be able to write it to the e-paper using the
1104.44s - 1113.08s |  Wi-Fi, but the Wi-Fi setup has to be programmed specifically as a static IP, and I thought
1113.08s - 1119.56s |  of doing a demo like that, but it would require too much overhead, and also, Wi-Fi is spotty,
1119.56s - 1123.16s |  and I'd have to bring some kind of Wi-Fi device.
1123.16s - 1128.16s |  I also, possibly, if you're going to do this yourself, to add a metal plate, they're not
1128.16s - 1137.68s |  expensive to do, just to make the wallet more rigid, because you can crack this quite easily
1137.68s - 1146.40s |  by dropping it, so the aluminum would at least make it more rigid, and I believe the padding
1146.40s - 1150.34s |  in the wallet gives you enough.
1150.34s - 1152.46s |  The battery programmer is like a poxmark.
1152.46s - 1157.14s |  You plug in the serial port, there's a lot of tutorials to do it, to write badge, read
1157.14s - 1161.78s |  the badge from one, and then write, and then put it, you could put it behind the prototype
1161.78s - 1167.90s |  badge, that's more advanced thing than your emulating, but the top three would be, and
1167.90s - 1172.98s |  it, by putting in, I mean, putting in behind the prototyping badges, you put in the programmed
1172.98s - 1176.58s |  RFID behind it, or keep it on you.
1176.62s - 1184.18s |  It depends on how good you want to make it.
1184.18s - 1204.14s |  So, any questions?
1204.14s - 1219.28s |  Believe it's white, red, I believe it's white, red, black, oh, it's seven, yeah, you can
1219.28s - 1226.69s |  see it here, white, blue, green, red, black, yellow, orange.
1226.69s - 1241.79s |  It's the spinner.
1241.79s - 1248.68s |  The bill of materials, if you were to redo this, would be, the e-paper display is around
1248.68s - 1271.18s |  $30 or $40, the wallet is another $30, the programmer is another $20, so around $200.
1271.18s - 1279.58s |  It depends on how you're doing the RFID reprogramming, you can use a poxmark, or, on the other hand,
1279.58s - 1285.99s |  if it's a physical, if you're doing a physical one, you could just take somebody's and use
1285.99s - 1298.18s |  the double-sided tape and the other sticker I alluded to.
1298.18s - 1316.14s |  I can't hear, I can't hear what you say, software side of what?
1316.14s - 1323.49s |  It's an Arduino sketch that you get, it's an Arduino sketch that is given to you by
1323.49s - 1324.49s |  Waveshare.
1332.42s - 1343.02s |  Do not use Arduino IDE, use the previous, the Arduino IDE have had problems, using a
1343.02s - 1350.26s |  Mac has problems, using a window machine was the only way I could get it to work.
1350.26s - 1363.83s |  It has this weird, when I program it, even though it'll verify and it shows up in tools,
1363.83s - 1378.98s |  and here's what I was alluding to, you can see how janky this is.
1378.98s - 1388.34s |  You have to program the SSID, password, static IP, gateway, subnet, DNS, to connect to Wi-Fi.
1388.34s - 1397.47s |  What I think was cool, or funny, was they also programmed the whole HTML website here.
1397.47s - 1402.63s |  That's how they get it to, that's how they get the ESP32 to work.
1402.99s - 1406.03s |  It's not a server, it's a client.
1406.03s - 1417.50s |  Server.h is this website serving, server.h means to connect to a server, and then it
1417.50s - 1418.50s |  displays this.
1418.50s - 1425.69s |  I don't know why there's script A, B, C, and D, there's a Bluetooth one too, I couldn't
1425.69s - 1448.67s |  get that one to work.
1448.67s - 1455.27s |  You can see there's, it's probably hard to see, but it uses, it says, you have to also
1455.27s - 1458.43s |  use the board ESP2 dev module.
1458.43s - 1466.23s |  That means that you have to be connected to the internet to get the module parameters
1466.23s - 1471.47s |  or setup, because Arduino does not come with that by default.
1471.47s - 1482.63s |  What I meant by the Arduino version, so this is 1.8.29, so Arduino forks themselves by
1482.63s - 1493.87s |  the IDE, where they have an Arduino IDE, and they have the Arduino regular system, or programming
1493.87s - 1496.71s |  system, not IDE.
1496.71s - 1505.87s |  When I tried programming with the traditional IDE, it had, I had lots of problems, to the
1505.87s - 1534.22s |  point where I just reverted.
1534.22s - 1552.62s |  So this is the three color dispatch being programmed.
1552.62s - 1558.18s |  This is where there was an issue when I was programming it, when, this is me tapping it
1558.18s - 1561.34s |  properly to, you can just, it'll cut.
1561.34s - 1573.84s |  So this is, so you can see sort of the interface, and see this is my face when you have only
1573.84s - 1575.52s |  three colors.
1575.52s - 1579.32s |  This is the logo I made that is in the tool.
1579.32s - 1589.82s |  I plan on trying to make a tool that's integrated to the point where it will be, try to do the
1589.82s - 1597.90s |  USB programming directly, hosted by, and or hosted by the Raspberry Pi hat, to try
1597.90s - 1606.92s |  to integrate a lot of the difficulties I had with the traditional programmers.
1606.92s - 1608.72s |  Thanks everybody for coming to this talk.


url: https://www.youtube.com/watch?v=dGSPysbdvJo
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Preparing for the Future: A Discussion of our Rapidly Evolving Threat Landscape - Panel

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=dGSPysbdvJo",
  "title": "DEF CON 32 - Preparing for the Future: A Discussion of our Rapidly Evolving Threat Landscape - Panel",
  "description": "Seems like the world has completely changed in the last 12-24 months:\n\nMultiple Global Conflicts\nLaunch of ChatGPT\nCISO\u2019s being held personally accountable for security breaches\nGovernment Regulations on security\nEconomic Uncertainties (interest rates, layoffs)\nAll of these changes have played a major role in reshaping the security landscape. From adversaries with political motivations to another just trying to provide for his/her family. Security is no longer just your job, but you could actually be held personally liable. Oh and don\u2019t forget that an adversary now has the ability to rewrite vulnerabilities with the click of a button, or can create deep fakes so real that a zoom call with multiple \u201cpeople\u201d was undetectable by a real person.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 812,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.24s | This text was transcribed using whisper model: large-v2

 Hello! Hello! I can't see anybody from these lights, but I'm sensing you're out there.
8.96s - 13.92s |  I'm sensing the mood, the vibes are good. Well, welcome everybody to our panel. My name is Rachel,
13.92s - 20.80s |  I'm the organizer of IoT Village, and we put together a little panel on threat landscapes, AI,
20.80s - 26.24s |  chat, GPT, all that jazz. So I'm going to let the panelists introduce themselves real quick,
26.24s - 34.59s |  and then we'll jump into the questions. Go for it. All right. Hello, I'm Steve McGregory,
34.59s - 42.75s |  I'm the director of cybersecurity R&D at Keysight. We build products that help people test
42.75s - 49.39s |  their network security, their devices, make assessments of their devices. I've been doing
49.39s - 57.95s |  security and R&D for since about 91. I spent the 90s running internet service provider
57.95s - 64.83s |  businesses, got hacked, and decided in 2000 to really spend my time doing cybersecurity. I
64.83s - 70.27s |  built an intrusion prevention system at a tipping point, and then moved into testing.
70.75s - 80.03s |  I've been doing that since, so nice to meet you. So Jamie Hardy. So I product manage now
80.75s - 86.03s |  adversary management at Intuit. I've been from fintech to semiconductor,
88.11s - 94.51s |  back to fintech, all over the board. And yeah, I'm super excited to be here.
95.23s - 101.95s |  I actually broke out of engineering to product management when I took over IoT security at
101.95s - 107.55s |  Qualcomm. So that's a blast. And I have a lot of insights from back in the day,
107.55s - 114.43s |  like about five years ago from IoT, and expanding that with cloud security. So super fun space.
114.59s - 119.63s |  Super fun space. Your mic's dead. You want to maybe try Steve's?
122.11s - 128.91s |  You got it. Can you hear me now? Oh, shit. Sorry. Part of my French.
130.91s - 142.99s |  No. Hello. Hello. Hello. Oh, we're good now. Yes. Cool. So again, Jamie Hardy. Cool.
143.07s - 150.67s |  Product manager, Intuit. Where are we at? So been fintech, semiconductor, government,
150.67s - 157.87s |  back to fintech. Branched out of engineering when I took over IoT security for Qualcomm.
158.59s - 163.07s |  Loving everything at Intuit now. Got lots of stories to tell, lots of fun times to have,
163.07s - 169.87s |  and super pumped to be here with these guys. And super excited to partner with IoT Village,
169.87s - 175.39s |  because I love what you guys are doing about, like, bridging the gap with people who need to,
175.39s - 181.31s |  like, outside in their daily day-to-day, being able to apply stuff. Love it.
185.94s - 191.06s |  Hi, I'm Ted Harrington. I'm one of the partners at Independent Security
191.06s - 199.30s |  Evaluators, and we founded and run IoT Village. I wrote a book called Hackable,
199.30s - 203.86s |  how to do application security right. Kind of talks about the things that we see from the front
203.86s - 206.74s |  lines of ethical hacking. I think the ideas would resonate with a lot of people in this room.
207.46s - 211.86s |  And I'm just here to learn from these guys, and to make sure that Rachel looks good while
211.86s - 216.02s |  protecting her eyes. Those are my sunglasses. I buy your book.
218.42s - 224.42s |  First question. How should IoT companies be thinking about the intersection of AI,
224.42s - 227.54s |  security, and IoT? Steve, you want to start that one?
228.10s - 236.82s |  Is this, is it working? Yeah. All right. Well, I think IoT security, IoT vendors,
236.82s - 244.26s |  or people using IoT devices have to probably be very concerned that if you go back and look at
244.26s - 250.26s |  something like Mirai, the botnet that took over all the IoT devices, they're kind of weak.
250.26s - 259.62s |  So I think using tools like AI, you can probably, the adversaries can very easily put together
259.62s - 266.82s |  automated attack tools and go after it and make Mirai look minuscule, potentially, right?
266.82s - 273.38s |  So I think, you know, we've got to take it and build security into the product. You know,
273.38s - 278.82s |  starting with our efforts to build IoT devices, make them more secure. Otherwise, we're
279.30s - 283.38s |  just leaving ourselves even more vulnerable in the face of AI.
286.98s - 292.58s |  Jamie? So, okay. So many things I want to say.
292.58s - 297.14s |  I guess coming back to the world of IoT, the number one thing I want to say is it's all
297.14s - 301.78s |  ingrained in the hardware root of trust, right? And I want to keep coming back to that. But
302.42s - 308.82s |  if I think about Gen AI, AI, ML, all this, you know, blah, blah, blah, blah that everyone talks
308.82s - 316.02s |  about, like, yeah, we are using it to be smarter. I mean, hell, I use chat GPT every day to write
316.02s - 321.62s |  whatever language I need. I mean, everybody does. And everybody uses that to write code
321.62s - 327.70s |  every single day, right? And the adversaries are using it against us just like we're using it to
327.70s - 334.34s |  defense against them. And it's whether it's IoT, cloud security, it doesn't matter. It's the same
334.34s - 343.78s |  game. And it's quite frankly scary because it's creating them to be faster and they're creating
343.78s - 351.06s |  malicious businesses off, you know, literally. I mean, quite frankly, there's sorry.
352.90s - 355.38s |  My bad. There are adversaries out
355.38s - 362.50s |  there literally, you know, running their books in QuickBooks, right? I mean, it's a scary thing.
364.98s - 371.78s |  I agree. Yeah. What I think is interesting about what you're talking about is how,
373.86s - 379.06s |  like, every emerging tech, I think this is true. That there's some new tech comes around and we're
379.06s - 382.66s |  like, everything's different now. And it's like, well, no, not really. Like the fundamental
382.66s - 386.58s |  principles of how we secure systems, how systems get exploited, those are the same. And the
386.58s - 391.62s |  implementation of the tech is different. And what you were talking about with, you know,
391.62s - 398.02s |  makes the adversary faster. But it also makes us faster, too. One thing I think that is different
398.90s - 403.62s |  about just we're dead. We're dead. Hello. It's going great. It wasn't me.
411.62s - 419.74s |  Hello. Okay. Well, we can still hear us if we're talking without microphones. I can't see a damn
419.74s - 427.90s |  person. But if you can hear us, we're happy to chat. We should be bringing a megaphone.
428.46s - 438.66s |  Yeah, seriously. Bring it in closer. You want some real stories that we shouldn't talk about?
438.66s - 445.46s |  Let's talk about that. Bring that shit closer. Under the verbal NDA. You all agree. Cool. We're
445.46s - 450.58s |  there. They're all dead. Yeah, every single one's dead. They're all dead. Yeah, that shit's dead.
450.58s - 458.98s |  Heard a click. Yeah, it died. Someone did not like a bit of it. Yeah. Yeah. They were like,
458.98s - 468.74s |  that's it. Well, on that note, great panel. Yeah. Good first question. We almost got through one.
468.74s - 473.87s |  Almost got through one question. Somebody take a picture.
481.15s - 483.63s |  Yeah. I mean, I would take a picture of them, but again, I can't see them.
484.27s - 487.87s |  There's people out there. I swear. There are people out there.
489.95s - 496.51s |  By them, I mean, I can see like the first two or three rows. Maybe. I see you and you.
497.23s - 500.67s |  Walk around and do it. Yeah. Maybe just go out into the hallway.
502.99s - 509.07s |  Yeah. Fuck it. Let's do that. All right, guys, we're going to come to you.
509.87s - 511.31s |  We're just going to get off the stage and come to you.
519.90s - 520.46s |  Totally not.
522.70s - 528.14s |  It is on. Well, first of all, thank you guys for just going with the flow on that. That was
528.14s - 536.46s |  very hacker-ish of everyone. Just adapt. Sorry, go ahead. I was letting you roll with it. This is
536.46s - 542.62s |  my nap time. Here we go. Another question for us. That was cool.
550.78s - 552.94s |  If you got a question, come on. Oh, and it's gone again.
553.82s - 560.30s |  It's it's gone again. Is it going again? Hello? No, this works. Jamie's in charge now.
561.18s - 563.02s |  All right, I'm in charge. Who's got a question?
567.82s - 572.22s |  There was an attack surface question. Should we go that direction? I couldn't hear what you're
572.22s - 578.54s |  saying. Actually, I didn't catch your name, but you want to come up here and maybe expand on that?
579.02s - 588.22s |  Ask the question. He's like, no, he's like, no. Maybe perhaps friend. No. All right. Does anyone
588.22s - 594.78s |  have any questions they want to ask? I got like three minutes left. I mean, the whole thing is
594.78s - 603.26s |  about how adversaries expand on attack surface management. Right. So we are using AI and all
603.26s - 610.14s |  these tools to expand on how we expand discovery. Right. And I can tell you, and I just feels like
610.14s - 614.54s |  a super hot mic from like port scanning, discovery and all these things. Right.
615.82s - 621.74s |  We can get more predictive in terms of where adversaries are going. Right. Every port we
621.74s - 631.02s |  discover, we can tell like 10 more. Right. But how do we provide the best practices for
631.98s - 638.06s |  the midsize small businesses that, you know, here's the thing. You got big enterprise companies
638.06s - 643.42s |  like us, and we got teams of people who know what they're doing. But then you got Joe Schmo,
643.42s - 649.34s |  who's got no dedicated engineers, no dedicated tools, and nobody probably in this audience
649.34s - 655.74s |  whatsoever, and they should be hiring. And so how do you help them? Yeah. That's my question.
656.06s - 662.78s |  That's my question back to you guys. I love that. How do you help the small company? How do you help
662.78s - 669.42s |  the company that's got 20 to 100 employees and no dedicated security tooling and no dedicated
669.42s - 675.26s |  security people? You and me and you all know how we do this. How do you solve that problem?
677.26s - 683.18s |  All I'll say, I will say is that 10 years ago, I was given a, I was speaking at AT&T
683.82s - 691.34s |  and, and I did a stat and it, it, the recommendation was one security researcher
691.34s - 697.66s |  or a person engineer per 100 employees or something like that. And realistically,
697.66s - 703.82s |  it was nowhere ever close to that. You know, you'd have 100 or 200 employee and you have an IT guy
703.82s - 708.46s |  that also does security, right? One guy for that company. And you have a thousand employees, you
708.46s - 712.94s |  may have two of those guys or something like that. Right. That was the stats that were coming up.
712.94s - 720.22s |  So that's where, where I'm going with this though, is in my hope is that AI, ML and AI are meant to
720.22s - 727.18s |  process large amounts of data and do things autonomously, which should help that case,
727.18s - 733.58s |  right? If you can, if you can budget tools that can help accelerate the one or two people,
733.58s - 738.46s |  right? Theoretically, this is, this is a good thing. And whether or not it's actually
739.18s - 745.90s |  being achieved right now, I mean, I can't answer, but that's, I mean, my, in short is that I'm
745.90s - 753.02s |  hoping AI is probably, it should be an answer for this problem that we deal with, with low, you know.
753.02s - 757.34s |  Yeah. I love that. Like when you think about security questionnaires, right? Who here has to
757.34s - 762.14s |  deal with those, right? Those are fun. Whether you're issuing them and then having to like
762.14s - 766.38s |  comb through all the results and say, is this a red flag or not? Or you're having to respond
766.38s - 770.30s |  to tons of them, to all the companies you want to do business with. I think that's a great
770.30s - 775.42s |  example of where AI and ML is going to significantly reduce person power because
775.42s - 778.54s |  it's going to be able to say like, okay, we understand the types of questions. Here's our
778.54s - 784.22s |  prepared answers. It can, it's going to be, that is a, a bright future. And it's not that far away.
784.22s - 793.98s |  I think we're, so, I mean, I mean all the mics, Jesus, I mean, why can't we build that into an AI
793.98s - 799.58s |  chatbot? Jamie, we're at time. Oh, we are. All right. I know. What a bummer. Ask some questions.
800.30s - 806.22s |  Super smart responses. Thank you all. There you go. Thanks everybody. Sorry this was so chaotic.
806.22s - 811.42s |  We'll, we'll hang out after, outside for anyone who wants to ask questions one-on-one. Thank you.


url: https://www.youtube.com/watch?v=dvV0y7gKCro
title: DEF CON 32 - Student Engagement Doesn't Have to Suck - Dr Muhsinah Morris
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=dvV0y7gKCro",
  "title": "DEF CON 32 - Student Engagement Doesn't Have to Suck - Dr  Muhsinah Morris",
  "description": "Hacking Education for better outcomes / teaching in the metaverse",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1460,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.00s | This text was transcribed using whisper model: large-v2

 Good morning, everybody.
2.00s - 5.36s |  I'd like to welcome Dr. Morris for Student Engagement
5.36s - 14.14s |  Doesn't Have to Suck with XR Village.
14.14s - 15.62s |  What's going on?
15.62s - 17.30s |  Y'all better wake up.
17.30s - 18.82s |  I'm that professor.
18.82s - 23.38s |  Hi, I'm Dr. Messina Morris, Molder of Minds.
23.38s - 26.02s |  My students at Morehouse College in Atlanta, Georgia
26.02s - 27.98s |  call me Dr. Mom.
27.98s - 29.06s |  They won't let it go.
29.06s - 31.30s |  So I told them it had to stand for something.
31.30s - 34.14s |  And so I am the Molder of Minds.
34.14s - 37.26s |  And I am here to talk to you all about how student engagement
37.26s - 39.02s |  doesn't have to suck.
39.02s - 39.86s |  Why?
39.86s - 40.78s |  I know it.
40.78s - 44.30s |  I was a biomolecular chemistry PhD student
44.30s - 48.66s |  who had teachers that talked to me like this.
48.66s - 54.46s |  Today, we're going to be.
54.46s - 56.22s |  Did y'all just learn some chemistry?
56.22s - 56.94s |  Oh, you didn't.
56.94s - 59.02s |  OK, so I had to go teach myself.
59.02s - 62.58s |  And so I became a professor to make chemistry
62.58s - 66.22s |  more accessible for more people, because we need more people
66.22s - 69.14s |  to see molecules like me, right?
69.14s - 72.54s |  OK, so student engagement doesn't have to suck.
72.54s - 74.14s |  I'm Dr. Messina Morris.
74.14s - 75.86s |  You can find me at Unite the Metaverse.
75.86s - 77.26s |  And I have an assignment for you.
77.26s - 78.82s |  And I know some of you all want to do it.
78.82s - 79.90s |  And some of you all don't.
79.90s - 83.10s |  So I have two different options.
83.10s - 85.30s |  Here's a QR code, OK?
85.30s - 86.86s |  If you want to stay linked in with me,
86.86s - 88.98s |  because sometimes after a talk goes,
88.98s - 90.26s |  you want to talk to the people.
90.26s - 92.86s |  But you can't, because they're flying off to another event.
92.86s - 94.02s |  So go ahead and get this.
94.02s - 95.94s |  And I can stay in contact with you.
95.94s - 97.50s |  This is the QR code.
97.50s - 100.78s |  And then I'll give you.
100.78s - 102.78s |  And then if you want to just follow me,
102.78s - 104.94s |  you go to my website and then put
104.94s - 109.46s |  that I met you at DEFCON at UniteTheMetaverse.com
109.46s - 111.98s |  in the contact submission, however you want to do it.
111.98s - 113.38s |  Those are your two options.
113.38s - 115.58s |  Go to my website or get this QR code
115.58s - 116.82s |  and put your information in.
116.82s - 118.28s |  I'll put you on my server, because I
118.28s - 121.10s |  am training 1,000 educators and 1,000 student creators
121.10s - 123.86s |  to do what I do, OK?
123.86s - 125.50s |  I think all of my students are ready.
125.50s - 127.86s |  So let's go.
127.86s - 129.22s |  All right.
129.22s - 131.98s |  So why AITAs?
131.98s - 137.90s |  So people might say, why would you put AI teaching assistants
137.90s - 138.98s |  in schools?
138.98s - 141.86s |  Because they're going to get rid of teachers.
141.86s - 143.90s |  Well, let me just help you understand
143.90s - 146.14s |  as an educator the capacity.
146.14s - 149.50s |  It's not even as many students as I typically
149.50s - 153.38s |  have in one period in this particular classroom.
153.38s - 155.14s |  In a lecture hall, there's usually hundreds
155.14s - 157.22s |  of students in chemistry.
157.22s - 160.26s |  And so when there are hundreds of students
160.26s - 161.82s |  and you have no teaching assistant,
161.82s - 163.58s |  or you might have one or maybe two
163.58s - 165.34s |  that are also graduate students that
165.34s - 168.10s |  are matriculating through their graduate experience,
168.10s - 171.38s |  they don't have time to get to all of the student questions.
171.38s - 173.46s |  And you just don't have enough time in the day.
173.46s - 177.06s |  So I have given my cell phone number out since 2009
177.06s - 180.32s |  to students saying, please just contact me
180.32s - 183.22s |  if you need anything, creating accessibility.
183.22s - 185.98s |  Well, historically, when they used AI-powered teaching
185.98s - 188.10s |  assistants, they were just chatbots.
188.10s - 192.22s |  And so why are we using this now?
192.22s - 194.42s |  They're 3D, they're spatial, and they're
194.42s - 196.82s |  in unique environments.
196.82s - 199.70s |  But it's going to help us enhance efficiency and reduce
199.70s - 201.34s |  administrative burden.
201.34s - 203.18s |  It's going to help us personalize learning
203.18s - 206.46s |  and student support, and then improve access to information,
206.46s - 208.34s |  because I'm a chemist that wants to do that,
208.34s - 211.54s |  and then enhance classroom interaction.
211.54s - 214.54s |  So when you think about the future of what classrooms are,
214.54s - 217.30s |  you might think that the classrooms actually
217.30s - 218.96s |  look like what you're seeing on day one.
218.96s - 220.54s |  They still look like whatever it looked
220.54s - 222.86s |  like when you were in school.
222.86s - 224.06s |  It has not evolved.
224.06s - 226.06s |  Education has not evolved.
226.06s - 229.90s |  But even still in the world, we are
229.90s - 232.30s |  in the age of the intelligent classroom
232.30s - 235.18s |  where we should, where AI technology
235.18s - 238.34s |  and educational pedagogy are going to intersect.
238.38s - 241.06s |  And so I coined the term metaversive teaching
241.06s - 243.58s |  and learning when I created the Metaversity at Morehouse
243.58s - 246.98s |  College, so that people could understand
246.98s - 249.38s |  that there's a pedagogical approach to making
249.38s - 252.34s |  virtual reality of the classroom and doing it effectively,
252.34s - 255.58s |  as well as using AI-powered teaching assistants.
255.58s - 257.86s |  All of the technologies that undergird
257.86s - 259.86s |  what is going to be the metaverse,
259.86s - 262.62s |  or what will be the next iteration of the web
262.62s - 264.86s |  as we go into this fourth industrial revolution,
264.86s - 268.42s |  it's really important that our students are understanding
268.42s - 273.86s |  at the college level what the new future of work looks like.
273.86s - 276.38s |  There is a disconnect.
276.38s - 279.66s |  So a lot of the issues that I have,
279.66s - 288.84s |  or a lot of my professors have with me even doing this is,
288.84s - 289.84s |  what do y'all think?
289.84s - 291.08s |  Let me hear from the audience.
291.08s - 293.88s |  What do you think the teachers are saying about this?
293.88s - 296.52s |  What are educators saying about AI-powered teaching
296.52s - 298.48s |  assistants?
298.48s - 300.12s |  Go.
300.12s - 304.37s |  We're not ready for that.
304.37s - 306.01s |  Crazy is never going to work.
306.01s - 308.33s |  What else?
308.33s - 310.13s |  It's not personal enough.
310.13s - 311.25s |  That's the one.
311.25s - 313.13s |  Anybody else?
313.13s - 316.65s |  We're going to replace human beings, right?
316.65s - 318.53s |  Yes.
318.53s - 319.93s |  Say it again?
319.93s - 321.25s |  Cheating.
321.25s - 321.89s |  Cheating.
321.89s - 322.41s |  Well, guess what?
322.41s - 323.89s |  They're going to do it anyway.
323.89s - 325.69s |  What else?
325.69s - 328.61s |  If you're going to cheat life, you're going to do it anyway.
329.41s - 332.49s |  So the biggest thing is, we are trying
332.49s - 335.89s |  to engage students to learn and comb through information.
335.89s - 339.53s |  And we are in the age of what I call the connected student.
339.53s - 343.01s |  Students who literally have been scrolling,
343.01s - 347.09s |  were born into this technology, don't know quite how to use it,
347.09s - 349.17s |  don't ethically know how to use it,
349.17s - 352.21s |  didn't see the evolution of it, but it's here.
352.21s - 355.29s |  And so they use it however they feel like it.
355.29s - 359.01s |  And since there is really no safe guardrails on it,
359.01s - 362.01s |  teachers are afraid of what could be.
362.01s - 366.17s |  So I created this platform along with my educational partners,
366.17s - 371.45s |  Victory XR, to make sure that we had a tool that teachers could
371.45s - 374.53s |  use so that they wouldn't say, oh, we're
374.53s - 377.49s |  going to erase human beings out of the classroom.
377.49s - 380.25s |  Because literally, human intelligence
380.25s - 382.29s |  created artificial intelligence.
382.29s - 385.01s |  And I know all of you all in the room know this.
385.01s - 390.51s |  But for some reason, it didn't trickle down to education.
390.51s - 394.87s |  So we are building an emotionally intelligent
394.87s - 397.95s |  conversational AITA model.
397.95s - 400.11s |  And I'm going to show you what that looks like.
400.11s - 401.63s |  I'm going to do a demo of it.
401.63s - 405.63s |  But let me get through just the meat of this conversation.
405.63s - 410.35s |  Because I want you to see it in order to understand it.
410.35s - 414.91s |  But who remembers Homework Helpline as just me?
414.91s - 417.11s |  Homework Hotline, call.
417.11s - 418.51s |  OK, for help, just me.
418.51s - 421.55s |  OK, we failed y'all, the rest of y'all in here.
421.55s - 423.47s |  We should have had Homework Helpline for you.
423.47s - 426.27s |  But anyway, you used to be able to pick up your phone
426.27s - 428.59s |  and call for help.
428.59s - 429.87s |  Uh-oh.
429.87s - 432.27s |  See, it's not going to act right.
432.27s - 433.11s |  Come on, Canva.
433.11s - 435.99s |  Don't act wrong.
435.99s - 439.45s |  OK, don't worry about it.
439.45s - 440.77s |  It's not going to, my thing.
440.77s - 444.29s |  OK, so AI is a new TA.
444.29s - 446.21s |  And if you remember Homework Helpline,
446.21s - 450.61s |  then you remember that it was access to information 24-7.
450.61s - 452.49s |  If your students came home from school,
452.49s - 455.17s |  they could call up somebody and get help.
455.17s - 457.01s |  Now, the thing about Homework Helpline
457.01s - 459.21s |  is there used to be a teacher on the other line.
459.21s - 461.01s |  And there used to be a teacher sitting there
461.01s - 462.69s |  with all their books behind them,
462.69s - 465.53s |  trying to figure out what the heck your homework talking
465.53s - 467.57s |  about, which is also hard.
467.57s - 469.89s |  And that's the problem with tutoring in general,
469.89s - 471.61s |  is that you don't know where the learning
471.61s - 472.73s |  losses are for students.
472.73s - 475.25s |  You don't know where the gaps in understanding are.
475.25s - 479.65s |  But in the back end of our interface of this AI teaching
479.65s - 482.09s |  assistant, this kind of like Homework Helpline,
482.09s - 484.01s |  we actually do have formative assessment.
484.01s - 485.53s |  So I can track and see.
485.53s - 488.97s |  And I can see the transcript of all my students on the back end.
488.97s - 493.21s |  And it's closed off to go into my lessons first and all
493.21s - 495.01s |  of the resources that I put up there,
495.01s - 497.65s |  open educational resources that I have put together
497.65s - 501.25s |  and cultivated over years of my craft.
501.25s - 504.37s |  And it's going to go there and lead them and guide them
504.37s - 507.17s |  through scripted lessons that I've created.
507.17s - 512.21s |  So now, it's going to force them to go through the resources
512.21s - 516.29s |  that I've created first and then go back.
516.29s - 518.65s |  And it also then detracts them.
518.65s - 522.29s |  So if they get off the topic and just say, hey,
522.29s - 524.77s |  well, I want to know, how do you make blue earrings?
524.77s - 525.93s |  And it's a chemistry class.
525.93s - 528.21s |  It's going to say, hmm, the color blue
528.21s - 529.49s |  is going to think for a while.
529.49s - 531.85s |  And it'll probably come back with something like, well,
531.85s - 535.93s |  the color blue is a reflection of blah, blah, blah, blah, blah.
535.93s - 537.69s |  But we're talking about chemistry.
537.69s - 540.53s |  And the lesson is about atomic number.
540.53s - 542.17s |  So let's shift back.
542.17s - 544.17s |  And it's going to do that for students, which
544.17s - 546.33s |  is a great way to redirect them.
546.33s - 549.05s |  Students can also interrupt and answer questions
549.05s - 551.49s |  and ask questions in the middle.
551.49s - 557.17s |  And it recognizes different dialects as well as languages.
557.17s - 559.41s |  So how do I think I can do this?
559.41s - 562.09s |  So somebody said, we're not ready for it.
562.09s - 564.01s |  Somebody said, we can't do it.
564.01s - 564.97s |  It's going to fail.
564.97s - 568.45s |  But I have already proved a model will work in the hardest
568.45s - 569.49s |  time possible.
569.49s - 571.65s |  During a pandemic in the spring of 2021,
571.65s - 573.29s |  I launched Morehouse in the metaverse
573.29s - 575.69s |  along with three other professors of mine
575.69s - 577.73s |  in English, history, and biology.
577.73s - 579.01s |  And I'm the only chemist.
579.01s - 582.89s |  And I'm launching in advanced inorganic chemistry.
582.89s - 586.17s |  There was no chemistry content at all,
586.17s - 589.53s |  no 3D spatial assets, hardly anything.
589.53s - 593.17s |  So all of what I was creating was created along
593.17s - 595.53s |  with software developers, along with everybody.
595.53s - 600.17s |  And I had to learn how to use my techies across
600.17s - 602.53s |  to be more interdisciplinary than I've ever been,
602.53s - 604.57s |  to be more cross-disciplinary than ever.
604.57s - 609.33s |  So I can proudly tell you all that since spring of 2021,
609.33s - 613.81s |  we have taught 44 courses fully in virtual reality.
613.81s - 616.89s |  We have over 550 headsets at Morehouse College
616.89s - 618.25s |  in Atlanta, Georgia.
618.25s - 620.29s |  It's a historically Black college and university
620.29s - 622.73s |  that educates young Black men to be
622.73s - 626.01s |  leaders in their community.
626.01s - 628.33s |  So I am so excited.
628.33s - 633.01s |  We have seen outcomes of up to 11.9% increase
633.01s - 634.53s |  in student achievement.
634.53s - 637.61s |  We also saw that our students came to class more.
637.61s - 642.01s |  And we increased attendance rates by 10 percentage points.
642.01s - 644.17s |  Students come to class more when
644.17s - 649.65s |  they have access to technology that engages them.
649.65s - 652.41s |  So we saw this.
652.41s - 655.97s |  We've published it in peer-reviewed journals.
655.97s - 659.89s |  And this is the next best step.
659.89s - 663.49s |  The next step is to increase the number of student interactions
663.49s - 665.73s |  and engagement, the length of their interactions.
665.73s - 670.13s |  And this is available on the Chrome browser, the AITTAs.
670.13s - 671.53s |  They don't have to have a headset.
671.53s - 673.97s |  We have 2,200 Morehouse students.
673.97s - 676.61s |  And not everybody has a headset.
676.61s - 679.17s |  Well, I'm doing my best to fundraise to get us headsets.
679.17s - 681.85s |  But in the meanwhile, educational institutions
681.85s - 684.65s |  have a friction point when it comes to the technology.
684.65s - 687.69s |  And so putting it on a Chrome browser for interaction
687.69s - 691.37s |  and to help allows teachers to, one, be able to create easily
691.37s - 696.17s |  and also students to be able to access content easily too.
696.17s - 698.77s |  But what we're looking for is, are we
698.77s - 701.53s |  increasing the number of engagements or interactions
701.53s - 702.89s |  that students are having?
702.89s - 705.81s |  Are they maintaining these interactions?
705.81s - 709.01s |  And then, are their grades actually increasing?
709.01s - 713.13s |  And do they see a future in their careers
713.13s - 715.25s |  that can be pegged out using this technology?
715.25s - 717.25s |  Because all career pathways now are
717.25s - 719.13s |  going to have to be tech-adjacent,
719.13s - 720.45s |  every single one of them.
720.45s - 723.57s |  There is no such thing as an English professor that
723.57s - 725.37s |  does not use technology.
725.37s - 731.13s |  There is no such thing now as a journalist or a humanities
731.13s - 734.89s |  professor or anybody in any other field
734.89s - 735.93s |  that doesn't use tech.
735.93s - 737.65s |  That ship has sailed.
737.65s - 740.01s |  But I think everyone in this room knows that.
740.01s - 743.73s |  So I'm going to bust some myths real quick about AI and AITA.
743.73s - 746.21s |  So some of the things that you all said,
746.21s - 748.13s |  AI will replace teachers.
748.13s - 750.25s |  No, it will augment the classroom
750.25s - 752.13s |  because we don't really have capacity.
752.13s - 756.69s |  And imagine having to serve even all of you all in this room
756.69s - 759.45s |  and all of the questions that you all may have had
759.45s - 762.13s |  individually and give you all a personalized experience.
762.13s - 764.65s |  And I have to do that in 50 minutes.
764.65s - 766.81s |  And I have to teach you complex information.
766.81s - 771.21s |  And I only get to see you two to three times a week.
771.21s - 774.85s |  That's a huge responsibility and task to put on just the teacher.
774.85s - 777.57s |  And while I know that I am gifted,
777.57s - 780.69s |  if I could put it in their heads, I would do it.
780.69s - 785.45s |  But I need something for students to be able to access
785.45s - 788.53s |  when it's 3 a.m. and they're studying,
788.53s - 792.21s |  Dr. Morris' cell phone is on silent,
792.21s - 795.57s |  I'm getting ready so I can serve them in the morning.
795.57s - 797.81s |  But you know how it is in college.
797.81s - 801.25s |  They went out before they studied and they got a test in the morning.
801.25s - 803.29s |  So it's 3 a.m.
803.29s - 806.41s |  And the question is,
806.41s - 808.97s |  I don't know how to find math number,
808.97s - 812.45s |  but Dr. Morris has a lesson on math number
812.45s - 817.93s |  straight from the content directly to the key standards that we want to hit.
817.93s - 821.49s |  I'm going to go run that playback and then I'm going to ask it the question.
821.49s - 824.25s |  And now I ain't got to go filter through Google.
824.25s - 826.05s |  I ain't got to go filtering through.
826.05s - 828.73s |  I ain't got to go figuring out, oh, Lord, like what?
828.73s - 832.41s |  I can go directly to a resource and use it.
832.41s - 836.69s |  And I didn't have to log into 3460 interfaces to get there.
837.45s - 840.45s |  So we're not replacing teachers,
840.45s - 843.45s |  we're increasing the capacity of teachers for
843.45s - 846.33s |  students who need more personalized instruction.
846.33s - 849.33s |  We're also implementing AI because,
849.33s - 855.77s |  oh, it says implementing AI requires extensive technical expertise.
855.97s - 858.57s |  Not so much.
858.57s - 861.81s |  What it does require is grit.
861.81s - 867.33s |  So the teacher dashboard is as user-friendly as any social media platform.
867.49s - 872.61s |  But people still think teachers have to code.
872.61s - 874.85s |  I'm not asking you to take on another task.
874.85s - 876.53s |  I'm not asking you to pick up another craft.
876.53s - 881.81s |  I'm asking you to just know how to help students.
881.81s - 885.81s |  So AI is detrimental to students' learning and encourages cheating.
885.81s - 887.97s |  Somebody over here said that, right?
887.97s - 891.09s |  Well, you teach students how to use it appropriately.
891.09s - 894.49s |  You teach them how to use AI appropriately by introducing
894.53s - 898.65s |  it to them and showing them the right workflow.
898.65s - 901.69s |  So that is how you do it.
901.69s - 904.01s |  AI-driven education is for older students.
904.01s - 907.13s |  Lifelong learning is very necessary.
907.13s - 911.25s |  But what we really need to do is integrate this education at the smallest,
911.25s - 914.25s |  at the youngest levels, with Generation Alpha, right?
914.25s - 917.69s |  We need these young babies to really understand the evolution
917.69s - 919.81s |  and take part in the creation.
919.81s - 922.41s |  They have wonderful, amazing ideas.
922.45s - 928.09s |  We participated in XPRIZE Connect over this past spring with my college students,
928.09s - 930.25s |  but it's usually for our high school students.
930.25s - 934.37s |  And these students are just fabulous at coming up and constructing ideas.
934.37s - 938.93s |  So when you integrate it early, you can demystify the technology.
938.93s - 941.57s |  AI in schools compromises privacy and security.
941.57s - 944.13s |  And I know that is a huge thing for people.
944.13s - 950.09s |  But the platform that we use, even though it does access AI,
950.09s - 953.85s |  open AI, we have it carted off and their parameters set
953.85s - 956.81s |  so that our information does not flow back to them.
956.81s - 959.29s |  So you all understand that.
959.29s - 961.73s |  But in this digital age, we have taken all precautions
961.73s - 963.89s |  to make sure that privacy and security are paramount.
963.89s - 968.49s |  We have the same platform as any learning management system would.
968.49s - 970.69s |  So students have used these learning management systems,
970.69s - 975.65s |  and they follow FERPA laws, federal laws, to protect students' privacy and security.
975.65s - 977.41s |  And we've done it with our metaversity.
977.41s - 983.85s |  So I'm pretty confident that we can do it and do our best job first in this pilot this fall.
983.85s - 986.57s |  And so these are the hypothesized outcomes.
986.57s - 991.17s |  We hope to improve academic performance, obviously, to engage students more
991.17s - 994.81s |  and to create higher levels of motivation for them.
994.81s - 996.13s |  Better retention rates.
996.13s - 1000.73s |  So we have a huge problem with stopouts in terms of education.
1000.73s - 1003.41s |  For young black males, they run out of money, they run out of funding,
1003.41s - 1005.09s |  they run out of time, whatever.
1005.09s - 1008.09s |  They have other pressing issues that happen in their lives.
1008.09s - 1009.57s |  And life happens to all of us, right?
1009.57s - 1012.05s |  So that's what's happening.
1012.05s - 1013.33s |  And so students stop out.
1013.33s - 1017.13s |  And so we want to make sure that we are giving them continuous support
1017.13s - 1020.33s |  and personalized learning experience that can be accessed anywhere.
1020.33s - 1024.53s |  And then enhance their skill development because they need these four Cs.
1024.53s - 1029.05s |  They need collaboration, creativity, critical thinking skills, and communication.
1029.05s - 1032.81s |  They need these interactions, and they need them with AI tools.
1032.85s - 1038.21s |  So the Department of Education will be using them to train pre-service teachers
1038.21s - 1043.61s |  at Morehouse, the History Department, Sociology, our Student Success Center in areas
1043.61s - 1045.93s |  of math, physics, and foreign language.
1045.93s - 1050.01s |  And we will be doing peer-to-peer tutoring support and study group support as well.
1050.01s - 1054.97s |  I'm also training 1,000 educators and 1,000 student creators to use our tool
1054.97s - 1056.41s |  and create their own lessons.
1056.41s - 1058.41s |  And it doesn't matter what it's about.
1058.41s - 1060.85s |  And it's going to be like a teachers pay teachers model for them.
1060.85s - 1065.13s |  So they'll be incentivized to create in this space.
1065.13s - 1069.05s |  But what we really want to know is, will students ask more questions?
1069.05s - 1074.57s |  You know, there's a student that sits in the classroom for an entire year.
1074.57s - 1076.69s |  And they'll never ask a question.
1076.69s - 1080.73s |  And they'll never ask a question because they feel like their question doesn't matter.
1080.73s - 1084.41s |  That the person right next to them isn't thinking the exact same thing
1084.41s - 1085.65s |  that they are thinking.
1085.65s - 1087.01s |  And that's not true.
1087.01s - 1091.01s |  But they will ask it to these AITAs because they can ask it anything.
1091.01s - 1095.21s |  And it gives them that privacy, safety, and security to ask those questions
1095.21s - 1100.93s |  that will then get them back to the answer that they need and close those learning gaps.
1100.93s - 1106.69s |  So my predicted effect is that student engagement will definitely increase.
1106.69s - 1110.81s |  And students don't have to come to the professor to be retaught a lesson
1110.81s - 1114.01s |  if they miss for whatever reason.
1114.41s - 1116.49s |  I have a whole lot of peer-reviewed journals.
1116.49s - 1119.53s |  And this is for the people that just really want peer-reviewed journals.
1119.53s - 1122.05s |  Find me and I'll send it to you.
1122.05s - 1123.29s |  But I thank you.
1123.29s - 1124.57s |  My image won't pop up.
1124.57s - 1125.73s |  I don't know why.
1125.73s - 1128.93s |  Oh, the girl with the connection left.
1128.93s - 1132.37s |  I was connected to somebody's Wi-Fi and they walked out.
1132.37s - 1134.01s |  That's hilarious.
1134.01s - 1137.57s |  So you can stay connected with me, Dr. Morris.
1137.57s - 1140.53s |  I guess my QR code will not show up there.
1140.53s - 1142.49s |  But that's fine.
1142.49s - 1145.41s |  What I want to show you, though, let me see if I can.
1145.41s - 1147.45s |  I don't have a Wi-Fi connection.
1147.45s - 1148.93s |  That is hilarious.
1148.93s - 1150.01s |  I just realized that.
1150.01s - 1152.73s |  At least I got to the end of my talk.
1152.73s - 1156.01s |  So you can stay connected with me at UniteTheMetaverse.com.
1156.01s - 1158.97s |  I had a real cute picture to show y'all to say thank you.
1158.97s - 1161.73s |  I was standing like a superhero.
1161.73s - 1167.77s |  So anyway, I really wish that you all could see the demo.
1167.77s - 1171.85s |  But for whatever reason, I don't have Wi-Fi connection
1171.85s - 1175.09s |  now in the middle of the talk.
1175.09s - 1178.53s |  So thank you so much for your attentiveness.
1178.53s - 1181.13s |  And I will leave more room for questions
1181.13s - 1183.49s |  if anybody wants to ask me any questions.
1183.49s - 1186.73s |  But you can find me at UniteTheMetaverse.com.
1186.73s - 1189.97s |  And I am Dr. Messina Morris or Dr. Ma,
1189.97s - 1192.33s |  motor of minds, first metaversity director
1192.33s - 1196.57s |  in the world, first to introduce these type of spatial 3D AI
1196.57s - 1199.97s |  customizable TAs, happy to do it,
1199.97s - 1204.01s |  working in conjunction with multiple partners in tech
1204.01s - 1206.57s |  and EdTech partners, Victory XR to do it,
1206.57s - 1207.73s |  and Morehouse College.
1207.73s - 1213.27s |  So thank you.
1213.27s - 1214.03s |  Any questions?
1214.03s - 1215.19s |  Everybody raise your hand.
1215.19s - 1218.43s |  There's no dumb questions here.
1218.43s - 1228.15s |  Yes.
1228.15s - 1235.25s |  Yes.
1235.25s - 1240.17s |  OK, so network, ability to handle it on the network,
1240.17s - 1243.58s |  is that what you asked me?
1243.58s - 1245.90s |  Oh, IT support, just IT support.
1245.98s - 1248.50s |  OK, so I'm my IT support.
1248.50s - 1249.90s |  It is challenging.
1249.90s - 1253.10s |  The blessing in this is that I'm married to a network design
1253.10s - 1255.10s |  engineer.
1255.10s - 1258.86s |  So I kind of had a cheat code with me.
1258.86s - 1263.82s |  He's my husband, and I would be like, what do we do?
1263.82s - 1270.54s |  But I do say this, you always have an ally in a space.
1270.54s - 1272.66s |  I always walk over to IT because I
1272.66s - 1275.06s |  did get one person to really help me and help me figure out
1275.10s - 1277.10s |  the network and help me figure out the firewalls
1277.10s - 1278.58s |  and help me figure out everything.
1278.58s - 1281.22s |  And some institutions like medical schools,
1281.22s - 1283.98s |  graduate schools that have information
1283.98s - 1286.90s |  that they keep in databases definitely
1286.90s - 1290.38s |  have to have a separate network for connecting for this.
1290.38s - 1292.94s |  So we got another separate connection
1292.94s - 1297.26s |  for network devices just so that students can get on devices.
1297.26s - 1298.86s |  I also have a partnership with T-Mobile.
1298.86s - 1300.74s |  So I got a lot of hot spots, and I
1300.74s - 1303.06s |  won their unconventional innovation of the year award.
1303.06s - 1308.82s |  So that too, allies.
1308.82s - 1311.02s |  You're welcome.
1311.02s - 1312.02s |  Anybody else?
1312.02s - 1317.67s |  There's no dumb question here.
1317.67s - 1318.51s |  Yes.
1318.51s - 1361.52s |  All right, so his question is, when should you ask AI for?
1361.52s - 1364.08s |  When should you ask AI a question,
1364.08s - 1366.84s |  or when should you ask a teacher the question?
1366.84s - 1371.80s |  I think that you should always, always ask your instructor.
1371.80s - 1373.60s |  But let me tell you something, human beings
1373.60s - 1375.08s |  don't know everything.
1375.08s - 1377.84s |  And what we're going to do is go do the same thing
1377.84s - 1381.48s |  that you're going to do, but with more trained expert eyes.
1381.48s - 1383.80s |  I'm going to go comb through all of the resources
1383.80s - 1385.60s |  that I know to comb through, and I'm
1385.60s - 1387.28s |  going to go reteach myself things
1387.28s - 1388.96s |  that I forgot long ago.
1388.96s - 1392.12s |  And then I'm going to come back, and I'm going to teach you.
1392.12s - 1393.56s |  That's how it goes.
1393.56s - 1395.84s |  So when do you ask your teacher a question?
1395.84s - 1398.64s |  I think that you should always go to your instructor first.
1398.64s - 1402.36s |  But if you're in a bind, and you don't have the answers,
1402.40s - 1406.36s |  and you need to access information, use your resources.
1406.36s - 1407.60s |  This is a resource.
1407.60s - 1409.16s |  So ask it any question.
1409.16s - 1410.68s |  Ask it what to wear for class.
1410.68s - 1413.24s |  I don't care what you ask it, but ask it questions
1413.24s - 1415.84s |  because that's what it's there for.
1415.84s - 1419.88s |  And you will learn how to close your own learning gaps
1419.88s - 1423.28s |  and ask relevant questions to get you to what answer
1423.28s - 1424.92s |  you need to understand.
1424.92s - 1427.08s |  And that's what we're trying to measure,
1427.08s - 1432.24s |  is do students begin to ask questions also more effectively?
1432.24s - 1435.16s |  Because they're asking more questions.
1435.16s - 1436.56s |  They're not just asking.
1436.56s - 1438.24s |  There's a difference between a question
1438.24s - 1440.72s |  that gets you the answer that you're looking for
1440.72s - 1442.36s |  and a question that doesn't.
1442.36s - 1444.48s |  So thank you so much.
1444.48s - 1446.52s |  I appreciate that.
1446.52s - 1449.64s |  Thank you for your time and for listening so attentively.
1449.64s - 1450.88s |  All of y'all get a gold star.
1450.88s - 1452.68s |  I'm going to come back to you in the back
1452.68s - 1455.08s |  because they've given me the red flag.
1455.08s - 1456.44s |  All right, take care.
1456.44s - 1459.48s |  Find me at UniteTheMurderVerse.com.


url: https://www.youtube.com/watch?v=_wUsM0Mlenc
title: DEF CON 32 - Reverse engineering and hacking Ecovacs robots - Dennis Giese, Braelynn Hacker
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=_wUsM0Mlenc",
  "title": "DEF CON 32 - Reverse engineering and hacking Ecovacs robots - Dennis Giese, Braelynn Hacker",
  "description": "Were you ever wondering why a vacuum robot or a smart air purifier needs multiple cameras and microphones? How secure are these devices? Can the devices be used to potentially spy on you?\n\nFor the past 5 years we have been presenting ways to hack and root vacuum robots at various events like the c3 or the DEFCON. In all these cases it covered vacuum robots by Roborock, Dreame, Xiaomi and some smaller companies. However, did we ever take a look at other vendors and maybe some new interesting device classes? In this talk we do exactly that, and will take a deep dive into Ecovacs robots! Ecovacs is the current market leader for smart home robots and recently expanded in other areas of home robotics.\n\nYou will be surprised how many worrisome things we found: broken crypto, missing TLS certificate verification, honor-system based ACLs, lots of RCEs, broken factory resets and unauthorized live camera access.\n\nWe will discuss our and other researchers experience with reporting bugs to the company and why one cannot trust third party certification agencies. In regard to trust, we will also address why you need to be careful with the choice of your spouse or flatmates.\n\nCome with us on a journey of having fun hacking interesting devices while exploring bad oversights, real problems and the ignorance of the manufacturer. Learn what ways there are to root these devices and to use them in a privacy-preserving way.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2500,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 1.12s | This text was transcribed using whisper model: large-v2

 Hello, everyone.
1.12s - 3.44s |  Welcome to our talk about the reverse engineering
3.44s - 6.20s |  of and hacking of Ecovacs robots.
6.20s - 8.24s |  Thank you for being here at this time.
8.24s - 11.12s |  I know it's kind of loud, but I hope we figured it out.
11.12s - 14.80s |  So before we start, I would like to introduce ourselves.
14.80s - 16.60s |  So first, I'm Dennis.
16.60s - 21.56s |  I'm a security researcher or also a hardware hacker.
21.56s - 24.36s |  And I'm primarily looking into wireless and embedded security
24.36s - 25.44s |  and privacy.
25.44s - 27.32s |  So I try to look at any device which
27.32s - 28.56s |  kind of is interesting for me.
28.56s - 30.26s |  So I try to reverse engineer everything,
30.26s - 32.48s |  which is kind of basically around us.
32.48s - 36.56s |  You might know me as a vacuum and IoT collector.
36.56s - 39.72s |  So I have like probably over 600, 700 IoT devices
39.72s - 43.64s |  and 60 or 70 vacuum robots to start counting.
43.64s - 47.24s |  And my general goal is to get root access and root
47.24s - 48.84s |  vacuum robots.
48.84s - 51.08s |  I have also a website, which is called robotinfo.dev,
51.08s - 53.52s |  where I try to kind of document what kind of hardware
53.52s - 55.48s |  is in robots, what kind of software is running,
55.48s - 61.07s |  what kind of methods exist for routing.
61.07s - 61.59s |  Cool.
61.59s - 63.95s |  Hi, I'm Braylin.
63.95s - 66.87s |  I hack things for the Leviathan Security Group during the day.
66.87s - 69.01s |  But this talk is entirely personal research
69.01s - 71.75s |  and does not reflect their views.
71.75s - 74.35s |  My general focus has been application security and APIs
74.35s - 75.67s |  for quite a few years now.
75.67s - 78.59s |  But I started robot hacking during COVID.
78.59s - 81.09s |  Just for fun, I took apart a broken robot vacuum
81.09s - 83.27s |  and tried to hack it.
83.27s - 86.19s |  So now I am hardware hacking for fun,
86.19s - 91.31s |  mostly looking at robots, cameras, and smart locks.
91.31s - 94.03s |  All right, so let's talk about the goals of this talk.
94.03s - 95.79s |  So generally, what we try to do is
95.79s - 97.75s |  that we want to give you some understanding
97.75s - 100.67s |  about the security and privacy risks of IoT devices.
100.67s - 102.27s |  We want to give you some overview on how
102.27s - 104.99s |  we did vacuum robot hacking.
104.99s - 106.87s |  We want to show you the vulnerabilities
106.87s - 108.27s |  and how to find them.
108.27s - 110.23s |  And typically, our general goal is
110.23s - 112.55s |  to get somehow root access without to disassemble
112.55s - 114.27s |  the device.
114.27s - 116.63s |  So there has been some past research on that.
116.63s - 119.43s |  So if you hack this kind of niche products,
119.43s - 121.47s |  the good thing is you can probably get every year
121.47s - 123.09s |  or every two years a nice DEF CON talk.
123.09s - 125.79s |  So basically, over the last five, six years,
125.79s - 130.83s |  we kind of used the topic, and it keeps giving.
130.83s - 133.19s |  So if you find your niche product,
133.19s - 134.51s |  just go ahead with that.
134.51s - 136.27s |  This will be very rewarding.
136.27s - 138.15s |  Some disclaimers.
138.15s - 141.03s |  So we don't claim that vendors are using the sensors
141.03s - 144.51s |  to spy on you, but we could technically do that.
144.51s - 146.47s |  The other thing which we do is that we primarily
146.47s - 149.57s |  cover physical attacks or proximity attacks.
149.57s - 153.67s |  So we don't necessarily attack devices through the cloud.
153.67s - 155.35s |  One thing which we want to stress always
155.35s - 157.19s |  is many vendors have problems.
157.19s - 160.27s |  And it's basically independent of origin, size, market share.
160.27s - 164.67s |  But in this talk, we especially focus on Ecovacs.
164.67s - 166.19s |  And all this research is basically
166.19s - 167.55s |  part of private projects.
167.55s - 169.39s |  So there's no sponsorships by companies.
169.39s - 171.67s |  There's no organizations behind that.
171.67s - 173.43s |  Any statements are our own opinion,
173.43s - 175.87s |  and we are not representing anyone.
175.87s - 178.63s |  So what kind of devices are we covering in this talk?
178.63s - 181.03s |  So basically, we're covering Ecovacs robots,
181.03s - 184.11s |  which you see on the left side, up to the X2.
184.11s - 186.43s |  And we're also covering lawn mowing robots
186.43s - 189.67s |  and the air purifiers, so the AirBot series.
189.67s - 193.03s |  Technically, all the stuff which we do also applies to Yidi,
193.03s - 197.63s |  because Yidi is basically a sub-brand of Ecovacs.
197.63s - 199.63s |  And we only focus on devices which run Linux,
199.63s - 203.19s |  so no dumb robots, only cool stuff.
203.19s - 204.39s |  So about the stock.
204.39s - 206.43s |  Well, this is basically a result of five years
206.43s - 207.83s |  of research and experiments.
207.83s - 210.71s |  And technically, we are not the first ones or the only ones
210.71s - 212.83s |  who do research on Ecovacs.
212.83s - 215.59s |  The vendor knows about most of our findings.
215.59s - 217.91s |  They tried to fix some of them, but failed.
217.91s - 220.95s |  So they failed very sadly.
220.95s - 222.39s |  And for other vulnerabilities, which
222.39s - 224.81s |  are really, really, really bad, they, for whatever reason,
224.81s - 226.51s |  have chosen to ignore them.
226.51s - 228.83s |  Also here, I want to give a shout-out to Chris Anderson,
228.83s - 231.19s |  who also found independently all this stuff.
231.19s - 233.15s |  And we, at some point, connected to each other.
233.15s - 234.07s |  We're like, oh, wait.
234.07s - 235.07s |  We know about this vulnerability.
235.07s - 236.47s |  We know about this vulnerability.
236.47s - 238.35s |  So there's probably way more people out there
238.35s - 240.75s |  who know about that stuff.
240.75s - 242.95s |  Typically, that kind of things are like a collaborative
242.95s - 243.45s |  effort.
243.45s - 244.91s |  So on the right, you see a picture
244.91s - 246.77s |  where we were at a CCC camp in Germany,
246.77s - 249.75s |  and we're just messing with the lawnmowing robots.
249.75s - 254.59s |  Or we were hacking the cameras of the robots in India.
254.59s - 256.39s |  So let's start with the motivation.
256.39s - 258.91s |  Why do we want to root devices at all?
258.91s - 260.79s |  Well, one of the things for us as hackers
260.79s - 262.67s |  is, well, we want to play with cool hardware,
262.67s - 264.11s |  because stuff is kind of cheap.
264.11s - 267.11s |  The other thing is, we want to obviously stop the devices
267.11s - 270.07s |  from constantly phoning home.
270.07s - 273.75s |  A lot of people have a very good smart home automation system,
273.75s - 274.63s |  like Home Assistant.
274.63s - 277.51s |  And they want to use that instead of the cloud.
277.51s - 279.67s |  Also, one thing which becomes more and more important
279.67s - 280.75s |  is the rate to repair.
280.75s - 282.87s |  So basically, if the device is broken,
282.87s - 284.59s |  we want to figure out what the reason is.
284.59s - 288.75s |  And it's easier to figure it out if you have root access.
288.75s - 290.99s |  Also, we want to verify the privacy claims of vendors.
290.99s - 293.43s |  Because vendors, they say a lot of things,
293.43s - 296.19s |  but it's not necessarily true.
296.19s - 298.79s |  So why don't we trust the companies?
298.79s - 300.59s |  So one of the things with IoT devices
300.59s - 302.39s |  is they are connected to your home network,
302.39s - 304.55s |  and they have internet all the time.
304.55s - 306.79s |  The communication to the cloud is typically encrypted,
306.79s - 309.79s |  and you have no idea what they're actually sending out.
309.79s - 312.79s |  From our own experience, we know that developing secure hardware
312.79s - 315.23s |  and software is extremely difficult.
315.23s - 317.15s |  And in the past, we caught vendors basically
317.15s - 319.39s |  with some shady behavior.
319.39s - 320.91s |  The other thing is these devices,
320.91s - 322.51s |  I mean, they not only have cameras,
322.51s - 325.23s |  but nowadays, they more and more have microphones.
325.23s - 327.91s |  And the question is, why do we need that?
327.91s - 329.55s |  Generally, if you have cameras, well,
329.55s - 331.11s |  there's some risk with that.
331.11s - 334.55s |  And devices might store pictures indefinitely.
334.55s - 337.23s |  And from our own research, we know that some of them
337.23s - 340.33s |  do, both in the cloud and locally.
340.33s - 341.91s |  And the other thing which we run into
341.91s - 345.23s |  is if you buy used devices from eBay or Amazon,
345.23s - 347.39s |  you don't know if the previous owner installed a root
347.39s - 347.99s |  kit onto that.
347.99s - 350.87s |  So as a new owner, you have no way to verify the software.
350.87s - 352.95s |  And as a result, you might have a malicious device
352.95s - 355.07s |  in your home which spies on you.
355.07s - 358.03s |  So basically, root access is more or less the only way
358.03s - 361.15s |  to figure out that the device is clean.
361.15s - 364.27s |  Speaking of vendors, we have this story around, I think,
364.27s - 366.27s |  one and a half years ago, where basically iRobot
366.27s - 368.99s |  got caught that they were making pictures of people
368.99s - 372.87s |  and selling them to Venezuela from labeling them
372.87s - 374.07s |  by gig workers.
374.07s - 375.75s |  And the other thing is, well, this device
375.75s - 376.75s |  contains a lot of data.
376.75s - 379.99s |  So companies are very interested in collecting data
379.99s - 380.95s |  about your homes.
380.95s - 384.03s |  And one of the rumors was that Amazon was trying to buy iRobot
384.03s - 387.67s |  not because of the great robots, but because of the data.
387.67s - 389.67s |  One question which we will answer later,
389.67s - 392.59s |  if you can rely on certifications,
392.59s - 394.59s |  because all the devices which we have analyzed
394.59s - 397.07s |  in the last two or three years have certifications,
397.07s - 399.43s |  including EchoVax.
399.43s - 403.23s |  So I want to give you a very brief overview of our hacking
403.23s - 404.47s |  journey so far.
404.47s - 406.07s |  And for me personally, everything
406.11s - 408.15s |  started back in 2017.
408.15s - 411.31s |  I was giving a talk at the CCC and at DEF CON.
411.31s - 413.77s |  And this was a work together back then with Danny Vigema.
413.77s - 415.43s |  And we targeted the Xiaomi vacuum robots,
415.43s - 417.27s |  the first generation, and the Roborock.
417.27s - 420.03s |  And the over-the-air update system was completely broken.
420.03s - 423.31s |  So we were able to just push local firmware updates.
423.31s - 425.23s |  Then it became a little bit more complicated.
425.23s - 427.23s |  So the vendors kind of locked on things.
427.23s - 428.91s |  For the newer Roborock devices, we
428.91s - 430.91s |  had to basically figure out a custom bootloader
430.91s - 433.11s |  tool, which required teardown.
433.11s - 435.99s |  And we were kind of slightly annoyed about that.
435.99s - 438.91s |  So back then, we took a first look at EchoVax.
438.91s - 441.79s |  And after my CCC talk back then, some influencer
441.79s - 444.95s |  gave me an EchoVax D-Board 900, which he got from EchoVax.
444.95s - 446.83s |  And this had the very, very early firmware
446.83s - 449.71s |  with the bug symbols in there, which was very, very helpful.
449.71s - 451.33s |  One thing which I figured out back then
451.33s - 452.87s |  is that the firmware is unprotected.
452.87s - 453.91s |  TLS is completely broken.
453.91s - 455.43s |  There's no integrity protections.
455.43s - 457.67s |  You can root a device via man-in-the-middle.
457.67s - 460.23s |  And you can just push malicious OT updates.
460.23s - 462.75s |  But one of the problems was the hardware was extremely weak.
462.75s - 464.79s |  So it wasn't really interesting for us.
464.79s - 467.11s |  And as a result, we never published the results on that,
467.11s - 469.15s |  because, I mean, why would we?
469.15s - 471.35s |  So over time, we had to develop new methods,
471.35s - 475.35s |  because it became more and more difficult to root Roborock
475.35s - 476.75s |  and Xiaomi devices.
476.75s - 482.35s |  So in 2021, I released a method for newer Roborock devices
482.35s - 483.95s |  and also Dreamy.
483.95s - 486.27s |  By the way, the CyberDog is a Dreamy device technically,
486.27s - 489.11s |  where we were able to bypass secure boot and some security
489.11s - 491.11s |  features and be able to root it again.
491.11s - 494.79s |  And it became, again, complicated in 2023.
494.79s - 497.79s |  We were looking again at Dreamy, Roborock, Navel, and Shark
497.79s - 501.87s |  and figured out a secure bypass for some bootloader magic.
501.87s - 505.67s |  The issue with all of these is finding new rooting methods
505.67s - 507.87s |  become very annoying, and it takes a long time.
507.87s - 510.27s |  For the last one, we need basically multiple months.
510.27s - 511.75s |  So we tried to find a new vendor,
511.75s - 514.35s |  which we would attack again.
514.35s - 516.83s |  So we went back to EchoVax.
516.83s - 518.55s |  And by that time, EchoVax started
518.55s - 521.31s |  to release more and more powerful devices.
521.31s - 523.71s |  And they were very similar to other devices,
523.71s - 524.87s |  but they were lower priced.
524.87s - 525.83s |  So this is perfect.
525.83s - 528.03s |  So one of the first devices which I analyzed back then
528.03s - 530.59s |  was then the D-Bot X1.
530.59s - 532.67s |  And basically, as soon as I unpacked it from the box,
532.67s - 535.15s |  it took me exactly 30 minutes to basically get root access
535.15s - 537.35s |  and have a modified file system on it.
537.35s - 540.19s |  So this was a perfect target for future endeavors
540.19s - 542.55s |  in the Fed company.
542.55s - 544.47s |  In the penalty of that, as mentioned before,
544.47s - 548.35s |  Braylin was messing with EchoVax and Yeti robots.
548.35s - 551.15s |  And so it found very similar things.
551.15s - 552.55s |  One thing which I need to address
552.55s - 554.75s |  is a lot of vendors, they saw my talks,
554.75s - 557.83s |  and they started to obfuscate or introducing countermeasures
557.83s - 559.23s |  against our rooting attempts.
559.23s - 561.91s |  For example, Shark Robot, or their contractor,
561.91s - 564.99s |  they kind of just were hiding vias and everything.
564.99s - 565.87s |  So they upgraded.
565.87s - 566.79s |  We upgraded, too.
566.79s - 568.27s |  Basically, we got an x-ray machine.
568.27s - 570.27s |  And now, we started to just x-ray things
570.27s - 574.43s |  because it's faster than just measuring through traces.
574.43s - 578.55s |  So let's talk about the EchoVax ecosystem.
578.55s - 581.07s |  So why are we looking at EchoVax generally?
581.07s - 583.51s |  It turns out that this company is fairly old.
583.51s - 586.47s |  They were founded back then in 1998 in China.
586.47s - 591.15s |  And they produced initially OEM vacuum cleaners.
591.15s - 593.11s |  Introduced their own brand of vacuum robot
593.11s - 595.63s |  in 2007 with a D-Bot.
595.63s - 598.23s |  And in 2020, we had the market share of 17%.
598.23s - 600.07s |  So this was basically the latest number
600.07s - 601.95s |  which we were able to find.
601.95s - 603.53s |  We couldn't find a newer number.
603.53s - 605.61s |  And so back then, we were second to iRobot.
605.61s - 607.89s |  But their global market share is way higher nowadays.
607.89s - 610.45s |  So we assume that they're probably
610.45s - 613.93s |  the top two or top three manufacturers.
613.93s - 618.73s |  So their market cap is five times higher as iRobot.
618.73s - 620.81s |  They produce a bunch of different products.
620.81s - 622.31s |  So for example, vacuum robots, which
622.31s - 623.81s |  is kind of what you would expect.
623.81s - 625.31s |  But they have also window cleaners,
625.31s - 626.41s |  which clean your window.
626.41s - 628.33s |  They have mobile air purifiers.
628.33s - 629.53s |  They have lawn mowing robots.
629.53s - 632.37s |  And they have some other products.
632.37s - 633.97s |  So let's take a look at the hardware.
633.97s - 635.57s |  Well, so typically, if you look at the hardware,
635.57s - 636.93s |  we kind of try to figure out, OK,
636.93s - 638.45s |  what's going on in the device.
638.45s - 641.21s |  And so what we have on one side is the SoC, which
641.21s - 643.05s |  is basically running Linux.
643.05s - 646.09s |  It's responsible for navigation, mapping, and connectivity.
646.09s - 647.53s |  So it's connected to the storage.
647.53s - 650.97s |  It has access to sensors like LiDAR, camera, microphones.
650.97s - 653.25s |  It has the connectivity, so Wi-Fi, Bluetooth,
653.25s - 655.49s |  and Ultra Wideband in some devices.
655.49s - 658.45s |  On the other side, we have the MCU, the microcontroller,
658.45s - 660.85s |  which is responsible for all the retail operation stuff.
660.85s - 664.13s |  So controlling the wheels, infrared sensors, fans,
664.13s - 665.41s |  and drop sensors.
665.41s - 668.49s |  Typically, you want to have your drop centers real-time operated
668.49s - 671.53s |  because you don't want to wait one second until the robot is
671.53s - 672.89s |  already flying down the stairs.
672.89s - 675.65s |  So you want to do that real-time.
675.65s - 677.37s |  All right, so one of the first devices
677.37s - 680.01s |  which I saw, I mentioned back in 2018,
680.01s - 681.37s |  was the D-Bot 900 series.
681.37s - 683.09s |  This was basically like a rocket ship
683.09s - 685.73s |  with one core, 128 megabyte of RAM,
685.73s - 687.49s |  and 256 megabyte of NAND flash.
687.49s - 689.73s |  So not great.
689.73s - 692.33s |  Sensor-wise, we had back then LiDAR already, infrared sensors,
692.33s - 693.41s |  but it was just too weak.
693.41s - 695.25s |  So even if you have root access, there's
695.25s - 696.79s |  literally nothing we can run on that
696.79s - 699.13s |  because it runs out of memory.
699.13s - 700.45s |  Thankfully, later on, they started
700.45s - 702.33s |  to put more performance chips into it.
702.33s - 707.97s |  So the X1, in this case, was interesting and cheap.
707.97s - 710.73s |  And they recycled from there on the hardware
710.73s - 711.81s |  for multiple generations.
711.81s - 714.13s |  So for us, it makes sense to look into that
714.13s - 716.09s |  because we basically could repeat our knowledge
716.09s - 718.21s |  on newer models.
718.21s - 722.49s |  In our example, the X1 was also interesting
722.49s - 724.13s |  because it had a station.
724.13s - 726.41s |  So both station and robot were creating
726.41s - 727.49s |  their own Wi-Fi network.
727.49s - 729.17s |  We had a voice assistant, so microphones,
729.17s - 730.33s |  which is always good.
730.33s - 731.93s |  And we had the remote view feature,
731.93s - 733.65s |  so you could access the camera remotely,
733.65s - 736.09s |  which is always great for hacking.
736.09s - 737.93s |  If you take a look at the hardware,
737.93s - 739.85s |  it's more or less the same hardware as the X2,
739.85s - 742.13s |  so the newer generations, which we have here.
742.13s - 745.05s |  And it's based on the Horizon X3 SoC.
745.05s - 748.77s |  So this is a quad-core ARM Cortex-A
748.77s - 750.37s |  with a Cortex-R in it.
750.37s - 753.97s |  And it has also AI acceleration on the same chip.
753.97s - 757.37s |  They used 2 gigabyte of RAM, 512 megabyte of SPI flash,
757.37s - 759.57s |  and a GD32 MCU, which is basically
759.57s - 762.17s |  like a copycat SDM32.
762.17s - 763.89s |  The X2, by the way, they used EMMC flash
763.89s - 766.17s |  because they figured out they don't have enough flash,
766.17s - 767.49s |  so we needed more stuff.
767.49s - 769.57s |  One chip which was especially interesting for us
769.57s - 773.05s |  is they have a special chip for voice processing, which
773.05s - 774.85s |  is the Baidu AI chip.
774.85s - 777.33s |  And it has its own firmware, and they supposedly
777.33s - 782.01s |  use it for regular detection, but who knows.
782.01s - 784.29s |  So let's talk about the sensors.
784.29s - 786.85s |  Well, the X1 has a LiDAR sensor, which is kind of cool.
786.85s - 789.01s |  It has a microphone array for whatever reason,
789.01s - 792.41s |  or for the voice assistant, but I mean, why would you use it?
792.41s - 793.89s |  And it has camera and line lasers,
793.89s - 796.77s |  so basically to detect objects in front of it.
796.77s - 798.69s |  And it has obviously a lot of infrared sensors
798.69s - 800.53s |  to kind of detect if it runs into something,
800.53s - 803.05s |  if it drops from somewhere, or if it runs over your cat.
804.85s - 806.49s |  A device which is very, very similar
806.49s - 811.57s |  is the AirBot Z1, which we call the SpyBot out of reasons.
811.57s - 813.49s |  It was released last year.
813.49s - 816.13s |  It's based on the same design like as the X1,
816.13s - 819.13s |  but it has one additional camera and six microphones.
819.13s - 820.73s |  And the features of that is, well,
820.73s - 824.33s |  you can use it as a Bluetooth speaker, which follows you.
824.33s - 827.09s |  It's an air filter and humidifier,
827.09s - 829.81s |  and it has a home patrol mode, so it
829.81s - 831.61s |  will drive around in your home.
831.61s - 834.61s |  And if an intruder gets in, it will kind of alarm you.
834.61s - 837.49s |  The thing is, you can also use it to talk to someone at home.
837.49s - 839.25s |  And basically, if you walk away, the robot
839.25s - 842.21s |  will kind of follow you and kind of focus on your face.
842.21s - 843.93s |  The cool thing here is you basically
843.93s - 846.37s |  get two robots for the price of one.
846.37s - 849.25s |  What they did is they basically recycled their old robots.
849.25s - 851.85s |  So the top part of the air purifier
851.85s - 854.37s |  is basically an X1, a vacuum robot.
854.37s - 858.13s |  The bottom part is an old 900 series device.
858.13s - 859.53s |  And there's an ethernet cable which
859.53s - 862.21s |  runs through the whole big thing, which connects
862.21s - 864.21s |  both of them via ethernet.
864.21s - 867.01s |  So very efficient.
867.01s - 871.09s |  So let's talk about the lawn mowings, lawn mowing robots.
871.09s - 873.85s |  They have been released in 2023 in Europe.
873.85s - 878.25s |  And this year, I think recently post-CES, this year in US.
878.25s - 880.77s |  It's kind of cool because they have for navigation GPS,
880.77s - 883.57s |  but also they used visual and time-of-flight cameras,
883.57s - 885.61s |  so they can kind of create a point cloud.
885.61s - 890.13s |  And they use ultra-wide-band beacons to kind of navigate.
890.13s - 892.85s |  And feature-wise, you can put an LTE module into them,
892.85s - 895.57s |  so you can connect them even if the Wi-Fi doesn't
895.57s - 897.65s |  have connectivity.
897.65s - 900.05s |  And again, they have a remote view and patrol function,
900.05s - 902.69s |  so they will patrol your garden.
902.69s - 904.45s |  Now, you might be paranoid and say, wait,
904.45s - 907.93s |  I don't want a company to watch my garden.
907.93s - 908.93s |  Of course, don't worry.
908.93s - 909.73s |  They're certified.
909.73s - 912.61s |  They say, yeah, you can watch your garden, patrol your garden,
912.61s - 914.65s |  but your data stays safe.
914.65s - 918.89s |  And we are certified because we use encryption and stuff.
918.89s - 921.93s |  If you ever run into the issue to reverse engineer devices
921.97s - 925.13s |  like that, be prepared that you need a lot of space.
925.13s - 928.73s |  So this has been a lot of screws.
928.73s - 931.77s |  And it took hours and hours and hours to disassemble it,
931.77s - 933.49s |  and even more hours to reassemble it.
933.49s - 935.21s |  And two screws were missing, and I still
935.21s - 936.45s |  don't know where they are.
936.45s - 940.05s |  So always keep track of your screws.
940.05s - 943.09s |  So if you take a look at the lawnmower,
943.09s - 947.53s |  it has an octa-core Rockchip SoC with an AI accelerator,
947.53s - 949.09s |  like a GPU, basically.
949.09s - 952.53s |  4 gigabyte of RAM, 16 gigabyte of eMMC flash,
952.53s - 954.01s |  and it has multiple MCUs.
954.01s - 956.25s |  So it has a display, which you can control.
956.25s - 958.45s |  It has its own STM32-like display.
958.45s - 962.61s |  I tried to run Doom, but it doesn't have enough flash.
962.61s - 964.01s |  And also, even the knife assembly,
964.01s - 968.53s |  which controls the cutting, it has also its own MCU.
968.53s - 971.17s |  Sensor-wise, it has a 360-degree camera on top.
971.17s - 972.13s |  It has a front camera.
972.13s - 973.93s |  It has a time-of-flight sensor.
973.93s - 975.05s |  It has rain detectors.
975.05s - 975.97s |  It has bump switches.
975.97s - 979.85s |  So they put every sensor in there, which you can have.
979.85s - 982.81s |  Thankfully, they gave us a lot of debug ports.
982.81s - 986.85s |  So all the models since 2019 have very similar debug ports,
986.85s - 990.73s |  which give you UART, 3.3 volt, SWG, and USB.
990.73s - 993.97s |  And it's easy to debug, and you can root a device
993.97s - 996.65s |  or get a root shell, basically, without breaking
996.65s - 998.17s |  any of the warranty seals.
998.17s - 1002.14s |  Cool.
1002.14s - 1003.86s |  Now let's talk about some of the software
1003.86s - 1005.26s |  that Ecovacs employs.
1005.26s - 1007.94s |  So these things run on Linux OS.
1007.94s - 1011.74s |  They're basically just a mobile Linux server.
1011.74s - 1013.66s |  They are using ROS, Melodic Merenia,
1013.66s - 1016.46s |  for the robotics portion or handling.
1016.46s - 1020.02s |  They also have a custom software suite called Medusa.
1020.02s - 1022.38s |  And there's a couple of interesting software packages
1022.38s - 1027.06s |  that are on the robot, including Python 2.7, which
1027.06s - 1029.10s |  is very handy for hackers.
1029.10s - 1034.06s |  They also use the AWS Kinesis SDK for remote camera access
1034.06s - 1036.58s |  outside of China and the Alibaba Aliyun
1036.58s - 1039.98s |  SDK for remote camera access inside of China.
1039.98s - 1042.94s |  So the good thing is that there are little to no protections
1042.94s - 1046.22s |  against rooting, which is what hackers like.
1046.22s - 1049.10s |  So let's briefly touch on some AI models that they're using.
1049.10s - 1052.58s |  They use TensorFlow and OpenCV for detection.
1052.58s - 1056.78s |  Some of the typical objects include furniture, cables,
1056.78s - 1059.86s |  pets, and pet remains.
1059.86s - 1062.66s |  The lawnmower also can detect small animals and face recon.
1062.70s - 1068.34s |  But on the right is a screenshot of our favorite object
1068.34s - 1071.74s |  that it can detect.
1071.74s - 1074.62s |  So just wanted to touch on firmware updates.
1074.62s - 1076.74s |  We've been keeping track of their firmware updates
1076.74s - 1080.26s |  since we've obtained the robot.
1080.26s - 1084.10s |  The US version was released in 2023.
1084.10s - 1089.50s |  And they have, why did that go so quick?
1089.50s - 1093.46s |  They had been putting out monthly firmware updates
1093.46s - 1095.26s |  since then.
1095.26s - 1098.38s |  And they stopped in March 2024.
1098.38s - 1099.94s |  So we're kind of questioning if this
1099.94s - 1104.30s |  is the end of life for this pretty new product.
1104.30s - 1106.58s |  Their changelogs are also not very informative.
1106.58s - 1110.10s |  So we have a theory that they are dropping device support
1110.10s - 1113.78s |  very quickly, which is unfortunate.
1113.78s - 1117.34s |  So the mobile app structure, there's
1117.46s - 1120.74s |  a core app, the EchoVax Home app.
1120.74s - 1124.98s |  And then when you add robots, plugins
1124.98s - 1126.38s |  are downloaded dynamically every time
1126.38s - 1129.78s |  you add one to your account.
1129.78s - 1131.86s |  Now we'll talk about security and privacy.
1131.86s - 1135.42s |  So when we first started researching EchoVax robots,
1135.42s - 1137.74s |  we wanted to see if they had a bug bounty program.
1137.74s - 1141.54s |  And this is the only page that we found for their security
1141.54s - 1142.62s |  program.
1142.62s - 1144.78s |  They claim that they have a public bulletin board
1144.78s - 1148.22s |  if you report bugs to their just kind of email address.
1148.22s - 1149.98s |  They want you to email bugs to them,
1149.98s - 1152.98s |  which is not a secure method to do that generally.
1152.98s - 1156.10s |  So yeah, there's no real collaborative bug bounty
1156.10s - 1156.82s |  program.
1156.82s - 1159.22s |  And they don't respond to our reports or emails.
1159.22s - 1161.74s |  They just kind of ignore us.
1161.74s - 1165.82s |  Some bugs are silently patched, we've noted.
1165.82s - 1168.30s |  But their privacy policy, it doesn't,
1168.30s - 1170.78s |  there's no guarantees that the data stays in your locale,
1170.78s - 1173.66s |  which is kind of scary.
1173.66s - 1177.62s |  Regional AWS services are used for the EU and US and China,
1177.62s - 1178.86s |  of course.
1178.86s - 1181.62s |  Some photos and videos are sent to Ali Cloud Video
1181.62s - 1182.94s |  for AI analysis.
1182.94s - 1186.02s |  In certain models, they claim that you have to opt in.
1186.02s - 1189.46s |  I'm not sure if they honor that, but more research is needed.
1189.46s - 1191.58s |  But of course, lots of telemetry data
1191.58s - 1195.50s |  is collected, as with most IoT devices these days.
1195.50s - 1197.70s |  So what are we concerned about?
1197.70s - 1200.46s |  These vacuums have microphones and cameras.
1200.46s - 1203.06s |  So can they be enabled remotely without user notice?
1203.06s - 1206.62s |  And where's the data sent to?
1206.62s - 1209.54s |  And of course, we need to be concerned with AI and privacy.
1209.54s - 1213.26s |  So why do these robots need face recon AI models?
1213.26s - 1218.98s |  And is this telemetry data being used to train their AI?
1218.98s - 1224.18s |  So after Dennis's DEF CON talk last year
1224.18s - 1228.18s |  about Roborock vacuums, they posted this really interesting
1228.18s - 1232.34s |  blog post titled, Can Robot Vacuum Cameras Be Hacked?
1232.38s - 1236.38s |  And they claim that their cameras are encrypting all data
1236.38s - 1237.50s |  gathered by the device.
1237.50s - 1243.38s |  But who knows?
1243.38s - 1246.10s |  So they post a bunch of certifications
1246.10s - 1249.30s |  from 2 Vineland, which costs quite a bit of money.
1249.30s - 1252.86s |  And they claim to be meeting and exceeding all standards.
1252.86s - 1254.74s |  They even have a splash screen when
1254.74s - 1256.62s |  you load their mobile app, claiming
1256.62s - 1258.54s |  that they meet ISO standards.
1258.54s - 1261.74s |  Again, not in line with our findings,
1261.74s - 1263.82s |  which we will talk about now.
1263.82s - 1268.82s |  So data harvesting, the mobile apps and the robot
1268.82s - 1270.18s |  are pretty chatty.
1270.18s - 1272.98s |  Just a lot of communication with the EchoVox servers.
1272.98s - 1274.86s |  Their key data collection API endpoints
1274.86s - 1277.10s |  are called Big Data and Data Upload.
1277.10s - 1280.06s |  So it's not like they're hiding what they're doing.
1280.06s - 1282.30s |  They're pretty upfront about it.
1282.30s - 1284.86s |  So some example of telemetry data that's collected
1284.86s - 1288.18s |  are live coordinates of the robot location in your home,
1288.26s - 1290.74s |  Wi-Fi access points, network data,
1290.74s - 1294.10s |  and additional debug information is sent to EchoVox servers
1294.10s - 1296.98s |  if the robot gets stuck somewhere,
1296.98s - 1300.26s |  and possibly AI pictures, even if not opted in.
1300.26s - 1302.62s |  So what are they retaining in their cloud?
1302.62s - 1305.34s |  Maps and pictures are stored in a NoSQL database.
1305.34s - 1308.98s |  So anyone who knows the object ID of the map
1308.98s - 1310.06s |  can access that data.
1310.06s - 1314.18s |  There's no access controls on these points of information,
1314.18s - 1315.46s |  which is, I don't know.
1315.46s - 1317.34s |  I don't want random people with an EchoVox account
1317.38s - 1319.18s |  to be able to see a map of my house.
1320.10s - 1322.62s |  The maps associated with the robots,
1322.62s - 1324.54s |  they seem to remain on servers,
1324.54s - 1326.66s |  even if you do a factory reset
1326.66s - 1328.98s |  or repair the device to a different account.
1328.98s - 1331.82s |  Also deleting your actual EchoVox account has no effect.
1331.82s - 1334.26s |  The map remains indefinitely on their servers,
1334.26s - 1338.50s |  even if you supposedly remove all of your information
1338.50s - 1340.10s |  from your account.
1341.26s - 1343.74s |  So, oh, what's wrong?
1344.70s - 1346.98s |  Oh, sorry, skipped over one point.
1348.18s - 1352.18s |  Oh, the JWTs that are used for authentication are also,
1352.18s - 1354.50s |  they also remain valid after you delete your account,
1354.50s - 1356.26s |  so you can continue using your account
1356.26s - 1357.74s |  even though you deleted it.
1359.70s - 1361.98s |  And access to the robot is still possible.
1361.98s - 1363.94s |  So not ideal security.
1365.30s - 1367.54s |  So what are they storing on the device?
1367.54s - 1369.10s |  There's a user data partition,
1369.10s - 1370.98s |  and it's not encrypted, of course.
1370.98s - 1372.98s |  Why would they encrypt that?
1372.98s - 1375.14s |  There's lots of logs, configs, maps,
1375.14s - 1377.54s |  and pictures that are stored on this partition,
1377.54s - 1379.18s |  including the live video pin,
1379.18s - 1381.34s |  which is stored in an MD5 hash,
1381.34s - 1383.30s |  and the robot lawnmower,
1383.30s - 1386.50s |  the lawnmower robot pin, which is stored in plain text.
1386.50s - 1388.02s |  There's also Wi-Fi credentials
1388.02s - 1390.86s |  and your neighbor's Wi-Fi access points,
1390.86s - 1392.70s |  so they're kind of just mapping the whole world
1392.70s - 1394.78s |  with their robot vacuums.
1394.78s - 1398.62s |  There's also the HelloYiku traffic logs,
1398.62s - 1401.42s |  which are, that's their voice assistant.
1401.46s - 1404.98s |  So keeping track of what you say to your robot.
1404.98s - 1407.86s |  So always keep in mind that if you're selling a used device
1407.86s - 1409.82s |  that even if you factory reset it,
1409.82s - 1413.70s |  there's a risk to your privacy.
1413.70s - 1417.50s |  And additionally, Flashware leveling will always be a problem
1417.50s - 1419.10s |  but that's for a different talk.
1420.02s - 1423.38s |  So one of our big findings was that
1423.38s - 1427.22s |  they did not configure their TLS properly.
1427.22s - 1429.14s |  So the EchoVax home app
1429.14s - 1432.18s |  mobile application correctly checks certificates,
1432.18s - 1435.78s |  but the robot specific plugins don't always do that.
1435.78s - 1439.74s |  So the plugins sometimes accept self-signed certificates,
1439.74s - 1443.30s |  which is very risky to use on an insecure Wi-Fi network,
1443.30s - 1446.66s |  like at an airport, hotel, or the DEF CON open Wi-Fi,
1446.66s - 1447.90s |  please don't do that.
1448.90s - 1451.90s |  There's no warning or error shown in the app.
1451.90s - 1456.90s |  And this traffic will leak your authentication tokens
1456.98s - 1458.66s |  and will allow the attacker to have access
1458.66s - 1461.18s |  to your account for up to seven days
1461.18s - 1463.70s |  and access to video feeds, like everything.
1464.82s - 1466.02s |  Here's an example of the traffic
1466.02s - 1467.38s |  that we were able to intercept.
1467.38s - 1472.02s |  We've redacted the authentication token
1472.02s - 1473.74s |  just for good measure.
1475.66s - 1477.82s |  And additionally, they misconfigured TLS
1477.82s - 1480.18s |  in their robots themselves as well.
1480.18s - 1481.98s |  The MQTT and TLS connections,
1481.98s - 1484.90s |  they accept self-signed certificates on some devices,
1485.86s - 1489.98s |  which allows for man in the middle attacks
1490.02s - 1493.70s |  and over the OTA updates can be injected.
1496.30s - 1498.98s |  The tool that we use for this is CertMidim by Apple Oxman.
1498.98s - 1500.38s |  It's highly recommended.
1500.38s - 1503.63s |  It's pretty fun.
1503.63s - 1506.07s |  And this is partially one of the reasons
1506.07s - 1506.99s |  why this is happening.
1506.99s - 1510.03s |  They are running bash scripts from the robot
1510.03s - 1515.03s |  with no check certificate on WGIT, not ideal.
1516.93s - 1519.19s |  So another thing that we found was that
1519.75s - 1521.83s |  the robots have audio warnings
1521.83s - 1523.91s |  when the camera is accessed from the mobile app
1523.91s - 1527.27s |  at the start of access and every five minutes afterwards,
1527.27s - 1528.75s |  a sound file is played.
1529.67s - 1532.43s |  So the problem is that local sound files
1532.43s - 1534.23s |  are stored on the data partition,
1534.23s - 1537.39s |  which isn't encrypted and can just generally be accessed.
1537.39s - 1540.07s |  So the sound files can be deleted and replaced.
1541.71s - 1546.03s |  So we can replace the warning audio with an empty file.
1546.03s - 1549.07s |  So nothing will happen when you access the live video feed,
1549.95s - 1552.79s |  we'll tell you why that's a huge problem in a second.
1552.79s - 1560.22s |  So this finding was reported at CCC last year,
1560.54s - 1562.94s |  but they fixed it and then we broke it again.
1562.94s - 1565.14s |  So we're going to tell you about it again.
1565.14s - 1567.10s |  So the app allows for live video
1567.10s - 1569.18s |  and audio access on the robot.
1569.18s - 1572.42s |  And this functionality is provided by AWS Kinesis.
1572.42s - 1574.98s |  The owner and shared users of the EchoVax account
1574.98s - 1577.02s |  can access this feature.
1577.02s - 1578.78s |  It is protected by a pin
1578.82s - 1581.90s |  and the pin will be asked for before connecting.
1581.90s - 1584.82s |  And it can only be changed and reset by the account owner.
1584.82s - 1587.58s |  And the reset requires account credentials.
1587.58s - 1589.90s |  So here's how the pin works.
1589.90s - 1592.50s |  Mobile app will ask the user for the pin.
1593.94s - 1596.94s |  The EchoVax cloud will act as a kind of broker.
1596.94s - 1598.74s |  So now we ask the robot,
1598.74s - 1601.86s |  hey, does this pin hash match with your local hash
1601.86s - 1603.22s |  that's stored on the robot?
1603.22s - 1607.10s |  If yes, the robot decides that it is correct,
1607.10s - 1609.22s |  sends that response to the mobile app,
1610.10s - 1615.10s |  and then the WebRTC session over AWS Kinesis will be started
1616.14s - 1621.29s |  and both will join the AWS Kinesis session.
1621.29s - 1623.85s |  So what happens if the pin is incorrect?
1623.85s - 1626.81s |  We go through that same process, but with an incorrect pin.
1627.97s - 1631.52s |  Why?
1631.52s - 1636.41s |  Sorry, I don't know how to use PowerPoint.
1636.41s - 1641.33s |  Okay, so what is it doing?
1642.21s - 1647.21s |  Okay, sorry about that.
1653.91s - 1656.91s |  Okay, so we asked ourselves,
1656.91s - 1660.19s |  are the pin verification and WebRTC session tied together?
1660.19s - 1666.27s |  So why is it, this is truly annoying.
1667.35s - 1668.55s |  Why is it doing this?
1673.57s - 1681.90s |  Okay, sorry, animations have a mind of their own right now.
1681.94s - 1684.14s |  It's fine, just continue.
1684.14s - 1686.02s |  It's slides by themselves.
1686.02s - 1689.05s |  I can't stop it.
1689.05s - 1690.65s |  This is entirely automated.
1690.65s - 1691.49s |  There's like a button
1691.49s - 1694.25s |  that's pressed down right now automatically.
1694.25s - 1695.09s |  Sorry for that.
1706.15s - 1707.51s |  You need to turn animations on.
1707.51s - 1715.39s |  I don't know how to.
1715.39s - 1716.31s |  Okay, it's just.
1716.31s - 1717.51s |  No, it's not.
1726.28s - 1728.24s |  Anyway, the takeaway message here is,
1728.24s - 1729.52s |  we don't know why the animations are broken,
1729.52s - 1732.16s |  but basically it doesn't matter
1732.16s - 1733.64s |  if the pin is correct or not correct.
1733.64s - 1735.76s |  You can convince the app that the pin is still correct
1735.76s - 1738.08s |  and we'll just establish a session.
1738.08s - 1739.44s |  And we have a demo here.
1743.88s - 1745.64s |  Do you know how to disable?
1745.64s - 1760.72s |  Sorry.
1760.72s - 1761.72s |  Dennis, disable the track.
1761.72s - 1779.10s |  Sorry, I swear it worked before.
1779.10s - 1780.06s |  Have you seen that?
1780.06s - 1786.36s |  It might be on our slides.
1786.36s - 1788.36s |  Just try the slideshow again.
1790.36s - 1791.20s |  I mean, they're fine.
1791.20s - 1792.04s |  I think there's something to that.
1792.04s - 1794.04s |  Yeah, just try the slideshow.
1794.04s - 1797.38s |  See something?
1797.38s - 1798.82s |  That starts from the beginning.
1798.82s - 1800.06s |  No, no, just wait.
1800.06s - 1800.90s |  This one?
1800.90s - 1801.74s |  Yeah.
1801.74s - 1806.90s |  Okay.
1807.74s - 1808.70s |  Okay, we have automated slides for some reason,
1808.70s - 1810.30s |  so we're just gonna work with it.
1810.30s - 1812.50s |  Okay, we can't work with this.
1812.50s - 1814.06s |  Fuck me.
1814.06s - 1815.78s |  Why is this happening?
1815.78s - 1834.05s |  This is really awful.
1834.05s - 1834.89s |  Okay, now it's working.
1834.89s - 1835.85s |  Okay.
1835.85s - 1836.85s |  Trust Microsoft.
1838.65s - 1839.61s |  Sorry about that.
1839.61s - 1840.81s |  Okay, so.
1842.21s - 1843.05s |  Right.
1843.05s - 1845.61s |  So, as we were trying to go through.
1849.32s - 1861.88s |  Oh my God.
1861.88s - 1863.60s |  Okay, so we're trying to verify the pin,
1863.60s - 1865.16s |  but the pin is incorrect.
1865.16s - 1867.88s |  So, are these tied together?
1867.88s - 1869.04s |  The WebRTC session.
1869.04s - 1872.28s |  So, can we intercept this request
1872.28s - 1875.04s |  or the response that pin is incorrect
1875.04s - 1878.52s |  and tell the app that the pin is actually correct?
1878.52s - 1880.72s |  And the answer was yes, we were able to do that.
1880.72s - 1883.04s |  So, now we have a malicious session
1883.04s - 1885.52s |  and we have an AWS Kinesis stream.
1886.56s - 1888.96s |  So, can we bypass that altogether
1888.96s - 1891.00s |  and just patch the pin query out of the app?
1891.00s - 1893.24s |  And again, yes, we were able to do that,
1893.24s - 1895.08s |  but we just wanna make it abundantly clear
1896.00s - 1898.48s |  that this is an issue with Echo of Access implementation.
1898.48s - 1900.24s |  This is not an issue with AWS.
1900.24s - 1903.24s |  So, don't sue us AWS, please.
1903.24s - 1905.64s |  So, in short, the pin protection.
1905.64s - 1907.52s |  Pin protection is implemented in the app,
1907.52s - 1910.76s |  but it's client-based authentication and ACL enforcement.
1910.76s - 1912.04s |  So, the robot doesn't keep track
1912.04s - 1913.84s |  of successful authentications.
1913.84s - 1915.36s |  The log of the video stream access
1915.36s - 1917.36s |  relies on the honesty of the app.
1917.36s - 1919.56s |  And this is really bad in combination
1919.56s - 1922.68s |  with the TLS issues that we just touched upon.
1922.68s - 1924.28s |  And it's even worse if the sound files
1924.28s - 1925.68s |  have been tampered with.
1925.68s - 1927.48s |  So, here's just a video demo.
1927.48s - 1929.56s |  This was reported in 2023.
1929.56s - 1931.84s |  An unsuccessful fix was pushed.
1931.84s - 1935.16s |  Some plugins were updated and no firmware fixes,
1935.16s - 1937.64s |  which is where the real problem was.
1937.64s - 1942.28s |  So, we can downgrade the app with a bad plugin
1942.28s - 1943.72s |  and it still works.
1943.72s - 1945.20s |  So, here's just a quick video demo.
1945.20s - 1946.60s |  This is just Burp Suite.
1946.60s - 1949.24s |  We have some find and replace queries to simplify it.
1950.28s - 1953.20s |  We enter a wrong pin, 111, a couple of times.
1954.76s - 1956.24s |  Not the right pin.
1956.24s - 1957.72s |  So, we continue.
1957.72s - 1961.48s |  Then we enable our find and replace queries in Burp Suite.
1961.48s - 1963.68s |  Enter again the wrong pin.
1963.68s - 1967.12s |  And we are dropped into a video streaming session
1967.12s - 1971.72s |  and successfully bypass the pin mechanism.
1971.72s - 1975.66s |  And here we are.
1975.66s - 1976.50s |  Cool.
1976.50s - 1978.79s |  So?
1978.79s - 1979.63s |  All right.
1979.63s - 1981.19s |  So, let's talk about free lawnmowers.
1981.19s - 1983.15s |  Who wants a free lawnmower?
1983.15s - 1984.59s |  Okay, now you learn how.
1984.59s - 1985.87s |  Actually, please don't.
1985.87s - 1987.15s |  We're not free.
1987.19s - 1990.63s |  So, the ECOWAS G1 has an anti-theft mechanism
1990.63s - 1992.71s |  where, basically, if you pick up the robot
1992.71s - 1997.27s |  and you don't trigger the alarm, basically,
1997.27s - 1999.47s |  you need to enter a pin to unlock it.
1999.47s - 2001.15s |  As an owner, you can also enable alarms.
2001.15s - 2002.07s |  So, basically, if you pick it up,
2002.07s - 2004.55s |  or if someone picks it up, some alarm will go off.
2004.55s - 2006.67s |  The problem here is, well, the pin is implemented
2006.67s - 2008.67s |  basically in the SOC in the Linux operation system
2008.67s - 2012.03s |  and the pin is stored just on a plain text file on the robot.
2012.87s - 2014.99s |  The thing, generally, with lawnmowers
2014.99s - 2018.31s |  is that other lawnmowers have the same issue.
2018.31s - 2020.07s |  So, as a general recommendation,
2020.07s - 2022.79s |  do not keep your mowers outside unprotected.
2022.79s - 2026.31s |  And, you know, we kind of hope that Equivax
2026.31s - 2027.75s |  and other vendors would somehow find
2027.75s - 2030.19s |  a more secure location for the pin,
2030.19s - 2031.83s |  for example, like in one of the MCUs,
2031.83s - 2035.39s |  so to kind of, you know, have a better locking mechanism.
2035.39s - 2037.99s |  So, let's talk about our main point today
2037.99s - 2040.47s |  and this is the Bluetooth remote code execution,
2040.47s - 2042.91s |  which we found at some point last year,
2042.91s - 2044.91s |  which we were hoping that we would patch until today,
2045.87s - 2046.87s |  but we didn't.
2046.87s - 2048.63s |  So, what's it about?
2048.63s - 2051.99s |  So, newer vacuum robots and all lawnmowing robots so far
2051.99s - 2054.91s |  use BLE, Bluetooth LE, basically for their provisioning.
2054.91s - 2056.67s |  So, if you initially, like, kind of pushed
2056.67s - 2057.83s |  your Wi-Fi credentials onto it,
2057.83s - 2059.35s |  they have a mechanism for that.
2060.87s - 2063.31s |  For lawnmowers in particular, the Bluetooth is always active
2063.31s - 2066.31s |  because we use it as a fallback way to control them.
2066.31s - 2068.35s |  And for vacuums, it's typically active
2068.35s - 2070.19s |  for the first 20 minutes after booting.
2070.19s - 2073.19s |  And every time they reboot in the middle of the night
2073.19s - 2076.23s |  for, like, memory cleaning purposes.
2076.23s - 2077.07s |  There's also a different way
2077.07s - 2078.75s |  to kind of force a robot to reboot remotely,
2078.75s - 2081.15s |  but we don't want to talk about that yet.
2081.15s - 2083.39s |  So, the communication between the app
2083.39s - 2085.23s |  and the robots over Bluetooth
2085.23s - 2088.95s |  is done by the GAT protocol, basically.
2088.95s - 2091.19s |  And the payload is encrypted with a static AES key,
2091.19s - 2093.39s |  which is something similar, it's not exactly that one,
2093.39s - 2095.35s |  but it's like one, two, three, four, five, six, seven,
2095.35s - 2098.15s |  eight ECOVACs, like something of that nature.
2099.23s - 2101.75s |  And the input validation of whatever happens
2101.75s - 2105.31s |  with the data afterwards is, let's say, not great.
2105.31s - 2107.15s |  And that's kind of bad if you think about
2107.15s - 2108.07s |  that they kind of say like,
2108.07s - 2109.55s |  oh, hey, our robots have cameras,
2109.55s - 2113.11s |  but trust us because we have been certified by the TÜV.
2114.47s - 2115.91s |  So, and as a quick reminder,
2115.91s - 2118.43s |  these devices have cameras and microphones.
2118.43s - 2120.51s |  So, let's create a payload.
2120.51s - 2122.67s |  First, what do we want to execute is basically,
2122.67s - 2124.83s |  we want to play the boot music,
2124.83s - 2126.83s |  which you heard before, on the robot.
2126.83s - 2129.03s |  So, we take the command which causes that,
2129.03s - 2131.03s |  be embedded in some JSON payload,
2131.03s - 2134.15s |  and we generate encrypted payload.
2134.15s - 2135.83s |  The payload looks something like this.
2135.83s - 2138.75s |  Basically, there's some, a bunch of tech stuff.
2138.75s - 2141.79s |  What happens if you send it to one of the robots,
2141.79s - 2144.11s |  basically, it will receive the payload,
2144.11s - 2147.95s |  it will decrypt it, it will basically extract
2147.95s - 2150.43s |  one particular argument from there,
2150.43s - 2151.75s |  and will generate a command line
2151.75s - 2154.19s |  and put the argument which is extracted
2154.19s - 2156.59s |  into the environment variable there.
2156.59s - 2158.35s |  So, the command line which we get at the end of the day
2158.35s - 2159.23s |  is something like this.
2159.23s - 2161.79s |  As you see, we basically use command injection there.
2161.79s - 2164.39s |  And then, it will happily execute a thing as root.
2165.47s - 2166.75s |  And we tested this attack, basically,
2166.75s - 2168.63s |  over a 50 meters distance,
2168.63s - 2171.59s |  and even longer, like 100 meters for lawnmowers
2171.59s - 2174.31s |  because we have a more powerful Bluetooth antenna.
2174.31s - 2177.91s |  So, and we have a demo here for like the G1,
2177.91s - 2179.91s |  which is like the lawnmowing robot.
2179.91s - 2184.59s |  What we do here is we send the payload from an Android phone
2184.59s - 2187.27s |  and you will see that we will get a succession back
2187.27s - 2188.11s |  in a second.
2188.11s - 2189.35s |  So, we're sending a payload now.
2189.35s - 2191.71s |  You saw it connected back to us, a reverse shell,
2191.71s - 2193.91s |  and now we can type on the robot
2193.91s - 2196.51s |  and we see that we are root,
2196.51s - 2198.23s |  we see what kind of version we're running,
2198.23s - 2200.63s |  and so the robot basically connected back to us.
2201.51s - 2203.15s |  We have also another demo,
2204.55s - 2206.11s |  more of the robot,
2206.11s - 2208.23s |  but I will skip that out of timing issues.
2209.15s - 2211.55s |  And we have also a live demo, potentially.
2212.71s - 2213.55s |  It takes one.
2213.55s - 2214.39s |  Okay, I skipped that too.
2214.39s - 2215.39s |  I will do it.
2215.39s - 2216.83s |  Okay, we have three minutes left.
2217.83s - 2218.75s |  So, what can you do with that
2218.75s - 2222.51s |  if you have a BLE code execution fail?
2222.51s - 2223.95s |  So, what we thought about is like,
2223.95s - 2225.35s |  hey, how can we chain that?
2225.35s - 2227.99s |  So, generally, if you live in a very close populated area,
2227.99s - 2229.27s |  there might be more Equivax users
2229.27s - 2230.47s |  because especially like Equivax
2230.47s - 2232.03s |  is like one of the market leaders.
2232.03s - 2234.47s |  So, what we can do is like we just attack an initial object
2234.47s - 2237.27s |  like a vacuum robot, sorry, lawnmowing robot,
2237.27s - 2238.31s |  put a payload onto that,
2238.31s - 2240.11s |  and then the robot has all the tools
2240.11s - 2241.75s |  which it needs to talk to other devices.
2241.75s - 2244.23s |  So, it can infect the next robot which has some distance
2244.23s - 2246.55s |  and that one can infect again the next one.
2247.23s - 2248.07s |  And then it becomes a problem
2248.07s - 2248.95s |  because the third one might start
2248.95s - 2251.47s |  to infect back the lawnmower.
2251.47s - 2253.67s |  So, we just had it as a proof of concept.
2253.67s - 2255.59s |  We didn't want to have a whole routing protocol
2255.59s - 2256.43s |  to figure it out.
2256.43s - 2258.35s |  So, you know, sorry about that.
2259.55s - 2261.75s |  Let's talk about routing very, very quickly.
2261.75s - 2264.39s |  So, there is a lot of countermeasures in there
2264.39s - 2265.23s |  in the software.
2265.23s - 2268.19s |  They use a lot of XOR and byte shifting to hide strings.
2268.19s - 2269.55s |  They have a lot of anti-debugging features.
2269.55s - 2272.11s |  For example, they detect LD preload in the buggers
2272.11s - 2274.79s |  and they use, for some of the device, not all of them,
2274.79s - 2277.51s |  Secure Boot and Android Verified Boot.
2277.51s - 2278.83s |  So, to get a root shell,
2278.83s - 2280.51s |  well, you can connect over UART,
2280.51s - 2282.83s |  but the problem is every device has a different password
2282.83s - 2284.71s |  and it's hard-coded and it's, sorry,
2284.71s - 2287.15s |  it's not hard-coded, it's set at boot time.
2287.15s - 2289.23s |  And the function is very obfuscated,
2290.11s - 2291.83s |  but there's one particular tool which generates that
2291.83s - 2293.23s |  and this is how it's basically generated.
2293.23s - 2295.47s |  So, they take a bunch of like random MAC addresses
2295.47s - 2297.59s |  probably from the developer's computer at some point,
2297.59s - 2299.43s |  put the serial number in there, the model number,
2299.43s - 2301.95s |  create a SHA-256 and then make it base64
2301.95s - 2303.99s |  and that's the root password.
2303.99s - 2305.87s |  If you want to generate it for your own robot,
2305.87s - 2307.15s |  there's a tool, you can just go there,
2307.15s - 2308.15s |  just enter your serial number,
2308.15s - 2310.15s |  it will kind of give you a password.
2310.15s - 2313.15s |  For firmware updates, they're encrypted but not signed.
2313.15s - 2315.59s |  The key is kind of dynamically generated
2315.59s - 2317.03s |  and it's like, was kind of very difficult
2317.03s - 2320.43s |  to reverse engineer it, but it's basically AS128.
2320.43s - 2322.03s |  And this is the format string which we use
2322.03s - 2323.71s |  to kind of generate a key,
2323.71s - 2325.95s |  which is like someone's random email address.
2325.95s - 2327.51s |  So, we use like a bunch of random stuff,
2327.51s - 2329.39s |  mix it together and that's the AS key.
2330.43s - 2333.75s |  So, as mentioned, some root file systems
2334.51s - 2335.51s |  are not protected, so we can just modify them,
2335.51s - 2337.75s |  especially on X1 and Z1.
2337.75s - 2340.15s |  We can just repack it and have like our own system.
2340.15s - 2341.75s |  One thing which was kind of interesting for us
2341.75s - 2344.83s |  is we can get persistence in autostart.
2344.83s - 2347.03s |  We left the debugging feature on some of the devices
2347.03s - 2349.91s |  where if there's autostart folder exists on data,
2349.91s - 2352.31s |  which is not protected, you can put a shell file into it
2352.31s - 2354.47s |  and it will just happily execute it next time.
2354.47s - 2355.87s |  So, it's not protected in any way,
2355.87s - 2357.83s |  so it's persistent forever.
2358.95s - 2360.39s |  Problem is, for whatever reason,
2360.39s - 2361.87s |  on some of the devices, we disabled it
2361.87s - 2364.99s |  and some of them not, I mean, it's kind of random.
2364.99s - 2367.43s |  If you wanna be persistent over factory sets,
2367.43s - 2370.03s |  well, they only delete the files,
2370.03s - 2372.55s |  so what you think you can do is like basically,
2372.55s - 2374.43s |  because we don't recreate the file system,
2374.43s - 2377.07s |  just make files immutable with chatter
2377.07s - 2380.07s |  and that way, you know, they will stay there forever.
2380.07s - 2382.63s |  Okay, I will talk really quick about the takeaway lessons.
2382.63s - 2384.91s |  First, can you rely on certifications?
2384.91s - 2387.31s |  No, you can't, bad news.
2387.31s - 2389.43s |  If you have vulnerable devices,
2389.43s - 2391.67s |  like the lawnmower, make sure that you turn it off
2392.47s - 2394.03s |  until we push a fix.
2394.03s - 2396.67s |  Don't use them, turn them off if you don't use them.
2396.67s - 2398.87s |  For devices which don't have BLE,
2398.87s - 2401.31s |  just don't update them if you wanna keep root access.
2401.31s - 2404.15s |  For vulnerable apps, don't connect to DEF CON Open.
2404.15s - 2405.75s |  Bad idea.
2405.75s - 2407.95s |  Used devices, be very careful with used devices.
2407.95s - 2409.99s |  They might come with a compromised firmware.
2409.99s - 2412.07s |  It's very difficult to verify.
2412.07s - 2413.75s |  If you do factory set before selling,
2413.75s - 2415.47s |  you know, do that definitely,
2415.47s - 2418.27s |  but be aware that it might not help against everything.
2419.35s - 2420.99s |  One thing, choose your partners wisely.
2420.99s - 2422.95s |  You can use those things as stalker tools.
2422.95s - 2423.99s |  I will skip that really quick
2423.99s - 2425.87s |  and just finish with the summary.
2425.87s - 2428.91s |  So we have a root access on most of the released,
2428.91s - 2431.35s |  or I think actually all of the released Ecovacs robots.
2431.35s - 2433.15s |  So we can use the UART interface
2433.15s - 2435.15s |  and authentication to get into the device.
2435.15s - 2437.59s |  We can use the BLE remote code execution right now
2437.59s - 2440.31s |  to get initial access on devices remotely,
2440.31s - 2441.59s |  hopefully your own.
2441.59s - 2444.91s |  You can get persistence and run some custom firmware
2444.91s - 2447.31s |  on some of the devices which don't have protections.
2447.31s - 2450.83s |  We were able to verify the claims of the vendors
2451.67s - 2454.63s |  and we found a lot of like security and privacy issues.
2454.63s - 2457.27s |  And this both applies to the app, robots, clouds,
2457.27s - 2459.19s |  and the certification for whatever reason
2459.19s - 2460.43s |  even didn't prevent that.
2460.43s - 2464.27s |  So I am not a firm believer in certifications nowadays.
2464.27s - 2468.11s |  And, but this allows you to look further into IoT devices
2468.11s - 2469.15s |  and into AI.
2469.15s - 2472.55s |  And so hopefully this will be for our security,
2472.55s - 2474.11s |  for everyone's security.
2474.11s - 2475.19s |  Some quick acknowledgements.
2475.19s - 2476.99s |  I would like to thank Daniel, Chris,
2476.99s - 2478.71s |  as well as Timster and Apple.
2478.71s - 2479.83s |  And if you have any questions,
2479.83s - 2481.23s |  I think we have time.
2481.23s - 2482.31s |  Maybe we have time.
2482.31s - 2483.15s |  Actually, okay.
2483.15s - 2485.39s |  You can ask us questions when we are basically done.
2485.39s - 2486.83s |  Sorry for the problems.
2486.83s - 2488.83s |  Thank you for being here.
2488.83s - 2491.71s |  If you have any other questions like remote,
2491.71s - 2492.67s |  this is our email addresses.
2492.67s - 2493.83s |  Feel free to reach out.
2494.87s - 2496.19s |  Yeah, thank you very much.


url: https://www.youtube.com/watch?v=h86p7pcZmL8
title: DEF CON 32 - Reflections on a Decade in Bug Bounties - Nikhil Shrivastava & Charlie Waterhouse
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=h86p7pcZmL8",
  "title": "DEF CON 32 - Reflections on a Decade in Bug Bounties  - Nikhil Shrivastava & Charlie Waterhouse",
  "description": "In this talk, I will share my journey from a novice to a seasoned hunter. I will explore how I used to report low-impact, informative bugs when I first started, and how I progressively improved by learning from the community, embracing failures/duplicates, and incorporating feedback from triage teams and clients. This journey of continuous learning and adaptation led me from reporting low vulnerabilities to effectively chaining and converting them into critical impacts.\n\nThis session is designed for both aspiring and experienced bug bounty hunters. By reflecting on a decade of lessons learned, I will aim to provide valuable takeaways that can help others navigate their own paths in bug bounty hunting and enhance their skills.\n\nAdditionally, one Synack triage team member will join me on this talk to help differentiate triage thinking from bug bounty hunters' thinking, providing valuable insights into the collaborative process of vulnerability reporting to acceptance.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3552,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 3.92s | This text was transcribed using whisper model: large-v2

 Okay guys, we'd like to welcome you and thank you guys for showing up. Hopefully everybody's
3.92s - 8.72s |  having a really great DEF CON. A lot of great talks out there. We're hoping that ours is at
8.72s - 13.60s |  least mediocre for you guys. We're going to be discussing 10 years in bug bounties
14.24s - 20.32s |  and what we've learned, how we've learned from my perspective as a triage and the enemy, so to speak.
21.36s - 24.88s |  If anybody has submitted stuff, who all has submitted stuff to bug bounties?
25.84s - 31.44s |  Right. Now who all has been frustrated with triage? Okay. So yeah, I'll be the bad guy today.
32.64s - 37.12s |  Nick's here. He is one of the top hackers. He'll introduce himself and his credentials also.
37.12s - 41.12s |  And he's going to be speaking from the researcher side that said, I'm also a researcher. So we're
41.12s - 46.96s |  going to be kind of having a discussion as to how can you have the best experience as a bug bounty
46.96s - 52.08s |  hunter and have the best chance of success and what does success look like? So that's going to
52.16s - 55.04s |  be what we're going through with this talk. So hopefully you guys get something out of it.
57.09s - 63.09s |  So how many of you are full-time bug bounty hunter here? Just one.
63.09s - 63.49s |  Sort of.
66.29s - 74.69s |  So we kind of doing this talk because I've been into bug bounty since a decade. So
75.49s - 82.61s |  I'm just trying to explain all the experiences and how a bug bounty can be a full-time carrier
82.61s - 92.45s |  for you as well. So it's kind of a daytime job as well and nighttime too. So I've been
94.45s - 103.25s |  doing a lot of bug bounties on SYNAC platform. And I recently been awarded as a SYNAC Red Team
103.25s - 110.93s |  legend. I also a founder of B-Sides Ahmedabad. It's the conference and it's biggest conference
110.93s - 118.85s |  in India. And I also have been advisor to an ASM product. So Charlie.
119.73s - 126.69s |  Guys, generally I'd like to say hi. I have a really unusual background. A lot of people in
126.69s - 130.85s |  the security space do. A lot of us are not just coming straight out of school as bug bounty
130.85s - 137.17s |  hunters, as Red Team. I spent over two decades in customer service and dealing with as an
137.17s - 142.53s |  international translator and international manager for an airline. Then decided I love
142.53s - 148.45s |  technology. It's always been a passion of mine. I was the guy who built Napster servers. I got my
148.45s - 154.85s |  MCSE for amusement one time. So I was that guy who grew up with these old systems and
154.85s - 158.85s |  just loved it enough that then I started really studying coming back into the field
158.85s - 164.13s |  and was really, really blessed to have an opportunity to come in as a triager
164.13s - 172.05s |  and in SYNAC's vulnerability operations team. I have also helped go over 2,400 different
172.05s - 178.29s |  assessments and have probably, I think last poll was somewhere around 40,000 individual reports.
178.85s - 182.93s |  So I've seen quite a few things. I've talked to some people who I have actually triaged their
182.93s - 191.33s |  reports. So few of them in the audience. I have headed developments on some products around OWASP,
191.33s - 197.17s |  NIST, OSINT, API, headless API, and most recently some AI testing.
197.17s - 200.53s |  So a lot of breadth on our testing and how we go about these things.
202.13s - 211.73s |  So I'll walk you through my journey, how I started and how I continue my full-time bug bounty
212.45s - 224.05s |  stuff, and what are my experiences and what are my failures, how I keep on continuing and finding
224.05s - 237.81s |  bugs and earning from it. So I started in 2013. So I wasn't aware about bug bounties at that time
237.81s - 246.93s |  because there is not much exposures of bug bounties at that time. Only Google and PayPal
246.93s - 257.17s |  was running bug bounty programs at that time. And it's not that much visible to anybody like
257.73s - 271.81s |  a non-bug bounty person. So I dropped out from college because I do not like much of, I do not
271.81s - 282.05s |  have much interest in their knowledge and stuff like that. So I dropped in 2012 and I started
282.05s - 293.09s |  looking for the job. So I accidentally joined an ethical hacking training company. And I usually
293.09s - 303.09s |  go out of money like in less than a month. And I had no idea about bug bounties and stuff.
303.09s - 315.57s |  And so one day, one of my co-workers, he was sitting on a computer and he was submitting some
315.57s - 325.41s |  accesses to PayPal. And after a few days, he got some bounty from the PayPal. So he posted an image
325.41s - 333.17s |  on Facebook. So Facebook was quite used application at that time. So he posted a photo on
333.17s - 342.37s |  Facebook. And after a few days, I've seen that photo. And next day, I went to the office and asked
342.37s - 352.93s |  him what exactly is this. So he described me that some companies pay bounties if you submit some
352.93s - 367.97s |  vulnerabilities to them. So then from there, I got introduced to bug bounties. And since then, I
367.97s - 374.77s |  started doing a lot of research on what other companies are there to, which is running the
374.85s - 384.53s |  independent programs. And I only get like two companies, Google and PayPal during that time. And
384.53s - 390.85s |  no other companies was running an independent program. So there was no, there was, right now,
390.85s - 403.01s |  there is a lot of bug bounty platforms that are running a lot of programs over them. But there was
403.01s - 412.85s |  not much, not much exposure of bug bounty platforms during that time. But more of independent
412.85s - 416.61s |  programs running on, running their bug bounty themselves.
418.85s - 424.61s |  I think there was an interesting point you made there is that the bug bounty space is very much a
424.61s - 431.81s |  show me thing. You can be the guy who is a doctorate, cert it up, has every cert out there, you've run
431.81s - 437.81s |  SANS, you've been the SANS instructor. But if you can't put rubber on the road, the guy who doesn't
437.81s - 443.01s |  even have a high school degree is going to beat you. This is a very egalitarian space. I can say
443.01s - 447.89s |  on our end as a triage team, we don't look at that. I don't care what your certs are. I care what you
447.89s - 453.49s |  found. So this is a space that all that stuff is a matter of your skill set and what you do.
454.05s - 458.77s |  And so I think there's a really good thought there is that none of that matters. And this is a chance
458.77s - 462.53s |  for you guys to start working and get some of the best in the world at biting Google engineers and
462.53s - 466.93s |  seeing if you're smarter. The good news is they have to be right 100%. We only have to be right
466.93s - 479.46s |  once. So when I was searching for Google bug bounties, I came across a lot of blogs. And there
479.46s - 487.22s |  was one blog and this guy, this guy is a good friend of mine now. But at that time, it was
487.22s - 496.02s |  unknown. But he just went to the some Google application and he writes some
499.06s - 505.38s |  simple access payload and the payload got triggered. So he got bounty out of it. So I was
505.38s - 516.66s |  like, he got a very simple bug, simple bug from the Google and got a bounty out of it. So I got
516.74s - 523.86s |  really motivated out of it. So I thought that let's try, let's try these things on other Google
523.86s - 534.26s |  products as well. But I later realized that these, these stuff looks simple, but you have to dig a
534.26s - 542.10s |  lot deeper and you have to know about Google products and services to actually, actually get
542.10s - 550.10s |  these issues. But these are, I mean, these are just old stuff. You can't find them nowadays.
551.30s - 563.46s |  Only if you are lucky. So, so I thought of give it a try to Google bug bounty first. So I was,
564.26s - 569.78s |  during that time I was no idea about the bug, just submitting a simple, any random stuff
570.42s - 582.42s |  without any logic and simply getting either rejected, no impact, duplicates or Hall of Fame
582.42s - 593.70s |  only. So I reported like whole year to Google and I just got duplicates or rejected reports.
594.58s - 599.78s |  So one of the interesting things on this is that when we're out hunting and I'm just as guilty of
599.78s - 604.74s |  it as anybody else, you see something, you get excited. Let me ask this. How many blue teamers
604.74s - 612.10s |  do we have in developers on the backend that are in the room? Few guys, right? As a researcher,
612.10s - 616.34s |  it's really easy to sit and say, oh my gosh, I just found this and go, it's not a duplicate.
616.34s - 620.02s |  It's another path. But you got to ask yourself, is that the same code on the backend? Because
620.50s - 625.54s |  Amazon doesn't code each product separately, guys. We know that. So it's the same things.
625.54s - 628.82s |  We've got to kind of ask ourselves as a researcher, wait a minute, is this really a duplicate? Is the
628.82s - 632.90s |  same code on the backend? You've got to get a little critical. You've also got to think,
632.90s - 638.66s |  and he'd said about impact. The problem with this is, let me ask this. If you're looking at say an
638.66s - 645.30s |  HSTS flag missing, what's the malicious use case? What are you going to do with it? Probably
645.30s - 651.14s |  nothing. If you can do something, show me. And so very much when you talk to a triager,
651.14s - 655.54s |  show me the malicious use case. If you've got a cross-site scripting, but it's unauthenticated,
655.54s - 659.54s |  what are you going to really do with that? Show me that you can pop a document.cookie,
659.54s - 666.02s |  document.domain, and then explain to me, yeah, that way I can get their credentials out. I would
666.02s - 670.74s |  just have to send that to my server. That way I can clearly see the malicious use. Make sure you
670.74s - 676.26s |  show that impact. I would say 80% of our rejections are probably because of low impact.
677.06s - 680.58s |  And that it's just, you haven't proven what that malicious use case is,
680.58s - 684.18s |  that now I need to go to my client and tell them, I need you to spend engineering time,
684.74s - 688.82s |  not only money on this bounty, but now I need you to spend cycles off your engineering
688.82s - 694.50s |  to fix this. And that's my business use case I need to make as a triage or isn't this worth fixing.
695.78s - 699.78s |  So whenever you're looking at these things, we can't just look at it as a pure security thing.
700.98s - 707.06s |  As security practitioners, we want every last I dot and D crossed and perfection. But some of
707.06s - 710.98s |  these things are just acceptable risk and we have to think about it and go, is it really okay?
710.98s - 715.86s |  It might be. Unfortunately, we've had to look at it and say Google API keys are very similar
715.86s - 721.38s |  to this process. The fix is extremely expensive. Google has said it's not something that they're
721.38s - 725.62s |  particularly interested in and nobody's done it and it's going to cost them a lot of money to fix it
726.58s - 732.10s |  when the risk is pretty minimal. So we have to kind of consider those things as security
732.10s - 736.66s |  practitioners and just not say we have to fix everything. Let's fix the important things.
736.66s - 741.78s |  And so when we're looking at a report, I always have to ask myself, and I'm as guilty as anybody
741.78s - 746.90s |  when I'm doing my own reports is getting excited about the flaw. I have to come back and go,
746.90s - 752.50s |  is this really a risk? What's my impact? And so a lot of what Nick was saying here at the beginning
752.74s - 759.62s |  is duplicate, no impact. And those are what people run into all the time as beginning bounty hunters.
761.14s - 765.22s |  I know a couple of people in this room that have had the same experience as me.
765.22s - 769.14s |  Somebody new will come in. They'll get excited. They're going to submit a dozen reports.
769.14s - 772.18s |  That's Friday night. They're going out with their buddies going, I'm going to quit my job because I
772.18s - 779.46s |  just wanted $6,000 in bounties. I am the most badass mofo on this planet. I'm quitting my job.
779.94s - 783.78s |  He goes out, he parties Saturday, he parties, he maxes out the credit card because I've got
783.78s - 792.02s |  $7,000 in bounties and money I rejected all in 10 minutes. He does not have happy words for me.
792.58s - 795.78s |  And I'm going, yeah, this is all on our low impact list. Did you read the documentation?
797.46s - 802.26s |  And so these are the things you have to think through is just slow down and ask yourself,
803.54s - 806.98s |  what do I need to do? What is that triage you're going to do? Because their job is to be a little
806.98s - 810.34s |  critical and to force you to get better. So show the impact.
814.64s - 824.40s |  So if something didn't work out, you have to move on from that particular thing. And you have to,
824.40s - 830.40s |  I mean, there are a lot of stuff in the world, so you can move on and do other stuff too.
830.40s - 839.04s |  So maybe you will get lucky to have more success on that particular program
839.04s - 850.64s |  rather than the previous one. So I moved on at that time and I heard about Nokia phone was,
851.28s - 858.80s |  there was a Nokia phone coming at that time. So they were running a VDP program, but their VDP
858.80s - 863.92s |  program is something like that. If you're finding any critical vulnerabilities on their program,
863.92s - 874.24s |  so they're giving out their smartphones to hackers. So what I did, I listed out all their
875.20s - 883.36s |  assets and I started fuzzing for just for a SQLite because I was kind of more proficient
883.36s - 890.48s |  into finding a SQLite at that time. So this is how we react when a new program, when we see a
890.48s - 902.00s |  new program. So like I said, I listed all their assets and started testing the SQLite. And one of
902.00s - 911.60s |  their assets I got a SQL error and further I went ahead and just one or two commands and I was able
911.60s - 920.80s |  to dump their whole DB. So from here they actually sent me some Lumia 820 devices.
924.08s - 928.72s |  So I think the one thing that we can take from this part of what Nix did and you heard him say
928.72s - 934.64s |  this was an area I was interested in. If you have an area that you have an interest in or that you
934.64s - 940.88s |  have experience in your full-time job, if you're a SQL database engineer, you're in good shape
941.76s - 949.20s |  because you know what to do with those databases to get SQL injections. If you are a web designer,
949.20s - 955.36s |  you've got a lot of that stuff to understand how to abuse HTML. So use the stuff that you're
955.36s - 959.84s |  interested in and all of a sudden he said, I focus on just SQLite. Focus on that one thing.
960.88s - 965.44s |  Then take that one thing, run with it until you become the expert at it. You're going to start
965.44s - 969.60s |  getting to where you feel it. I've heard these guys a lot of times just say, I felt this,
969.60s - 974.72s |  I just knew it was there. That sixth sense is developed by repetition and doing it over and
974.72s - 980.08s |  over. And when you do that, you become really proficient in that thing. And so what you're
980.08s - 986.24s |  seeing, I think that Nix is describing is focus on that subject. Don't let yourself go for
986.24s - 991.04s |  everything. The field is huge. Focus on one or two things until you get proficient at it,
991.04s - 995.76s |  then you can add a new thing. And so yeah, smartphones are not bad. Also he's shifted
995.76s - 1000.32s |  to a program that had less competition. Sometimes, especially if you're new,
1001.12s - 1007.20s |  going up against guys like this, it's going to be a tough road. If you can go against the people
1007.20s - 1010.72s |  who are a little less skilled because he's not going out for smartphones today,
1011.68s - 1017.68s |  maybe their recognition programs, there may be a good point to going there and learning
1017.68s - 1027.73s |  and using that as an education tool. So key takeaways from this is don't give up
1027.73s - 1040.21s |  anytime. And when one opportunity closes, another opens up. So if you find any critical
1040.21s - 1052.37s |  vulnerabilities on any of the assets and if you get a good bug and a good reward, so you will get
1052.37s - 1061.33s |  a lot of motivation out of it. So what motivation do? Motivation actually do a lot of big things.
1063.89s - 1069.97s |  In bug bounties, motivation counts a lot because if you are motivated, then you will be able to
1069.97s - 1080.45s |  find more impactful vulnerabilities. So I got motivated because of the last critical bug I
1080.45s - 1092.61s |  found on the Nokia program. And I continued. So in mid-2013, there was more programs come up
1093.57s - 1106.05s |  such as Mozilla started their web services bug bounties. Baracuda Labs also has a web application
1106.05s - 1116.13s |  firewall bug bounties running. And they actually given out live devices on a virtual platform. And
1117.17s - 1128.93s |  the PayPal is running since 2009. All of these running independent programs. So I was able to get
1129.33s - 1142.05s |  some issues on these programs and get some bounties out of it. So like I said, these are all
1142.61s - 1153.41s |  things which I did when I got some motivation from the last bugs. So it's kind of thing that if I
1153.41s - 1163.01s |  continue doing Google, I might get about $500 or $1,000 bounty after two or three years. But I
1163.01s - 1171.09s |  lost, I can loss all my motivation until then because you are doing bug bounties till three years
1171.09s - 1181.09s |  and you are only getting $500 or $1,000 or something like that. But what I did, I keep on
1181.09s - 1191.81s |  learning things from my rejections. So I get a failure from Google but I also ask them why you
1191.81s - 1202.69s |  rejected my bug. So they actually explain you that why we rejected. So they also tells you that if
1202.69s - 1214.53s |  you can do this, then we can accept that bug and move it to the award category. So that is how the
1214.53s - 1215.57s |  motivation works. Yeah.
1216.21s - 1221.89s |  Yeah. One important note here from the triage side, it's your triagers are always happy to tell
1221.89s - 1226.93s |  you why something wasn't accepted. I don't think any of our triagers just go, I don't have time,
1226.93s - 1233.25s |  go away. Because what we're trying to do is show you what number one did not work. So that way,
1233.25s - 1237.65s |  quite frankly, you don't fill up my inbox with junk and keep doing the same thing again.
1238.77s - 1244.29s |  So if you get a rejection, ask and try and understand why. And a lot of times they'll be
1244.29s - 1250.85s |  able to tell you, but if you can do this, now I'll take it. So that's your kind of explanation. And
1250.85s - 1255.57s |  this usually resolves around impact, but they'll be able to tell you, hey, this is just, we're
1255.57s - 1260.13s |  going to be low impact. We kind of don't care about this. You had an eye door. Yeah. You could
1260.13s - 1264.21s |  get into somebody else's account, but you know what? You weren't logged in. You're just changing
1264.21s - 1270.29s |  their basket at the pizza place and get rid of a pizza. Who cares? You're not getting them to pay
1270.29s - 1276.13s |  for your pizza. So understand why they're looking at it the way they are. For example, cross-site
1276.13s - 1280.29s |  scripting. If you're not logged in, there's no data to come out of it. No, there's no malicious
1280.29s - 1286.13s |  use. And they'll be clearly just happy to say, hey, it's an unauthenticated cross-site scripting.
1286.13s - 1291.09s |  I can't take that. There's no impact. So ask them, communicate. They are very happy to communicate
1291.09s - 1295.73s |  these things. And part of their job is to think through them and go, okay, why won't I accept
1295.73s - 1301.81s |  this? So they know the reason. So talk to them, take that feedback and learn. I've seen way too
1301.81s - 1307.49s |  many people come in and just say, I submit the flaw. It gets rejected. And I tell you why.
1307.49s - 1313.41s |  And next week you submit the same flaw and it gets rejected. And I tell you why. And a few days
1313.41s - 1319.25s |  later, you submit a flaw. So just the same. And we go through this process and it keeps knocking
1319.25s - 1324.05s |  down the researcher's motivation, which is not at all what we want to do, but it's taking that
1324.05s - 1329.57s |  feedback and understanding what they're saying. They are now your teachers to help educate you
1329.57s - 1334.29s |  to how to make yourself a better pen tester in your normal day job, how to become a better bug
1334.29s - 1339.41s |  bounty hunter, how to do, how to improve overall. It may be that we're saying, improve your reporting
1339.41s - 1343.73s |  techniques, you know, that I need more detailed steps. A lot of times you guys will be in that
1343.73s - 1350.05s |  app for hours. I have never seen it before. I'm walking into a blind to reproduce your volume
1350.05s - 1353.97s |  and try and understand, does it have impact? If you haven't clearly explained it clearly showed me,
1355.57s - 1359.33s |  maybe I can't do it because I don't have the details and the knowledge of, oh, I redid this.
1360.13s - 1365.01s |  So make sure you're very clear to us, explain it, understand why we rejected it and ask questions.
1367.97s - 1376.45s |  So, uh, so in, uh, in 2014 or mid 2014, there was, uh, uh, I got to know about, uh, these three
1376.45s - 1385.25s |  platforms running, uh, some bug bounty programs on their platform. And, uh, um, and, uh, well,
1385.25s - 1391.01s |  well, uh, HackerOne and BugCrowd was available to sign up directly. And, uh, and the SINAC was
1391.01s - 1396.61s |  doing some, uh, hands-on assessment, uh, which includes, uh, written and, uh, ID verification
1396.61s - 1405.60s |  or something like that. And, uh, uh, and, uh, uh, once you, uh, once you, uh, once you passed on
1405.60s - 1411.04s |  the written and, uh, ID verification, you, uh, you will be onboarded on the, on the platform.
1411.04s - 1417.12s |  But, uh, but, but, uh, other two platforms, uh, they are, uh, directly available for signup. I
1417.12s - 1425.28s |  guess, uh, HackerOne, HackerOne do not have, uh, uh, do not have, uh, uh, uh, a web application
1425.28s - 1433.04s |  bug bounty platform, bug bounty program until, uh, the Yahoo comes in, uh, in 2014 end, I guess.
1433.04s - 1435.68s |  It just knows it's vintage logo. I haven't seen that forever.
1436.56s - 1442.00s |  So one of the things that kind of is interesting about the bug bounty model, and a lot of you guys
1442.00s - 1446.16s |  are kind of like, why did those companies exist? First of all, for you guys, it consolidates it.
1446.72s - 1449.84s |  Gives you one place you can find a bunch of targets instead of having to Google all over the
1449.84s - 1454.32s |  place. Additionally, you don't have to send it to the company and hope that they don't just go,
1454.32s - 1457.92s |  yeah, I'm going to reject that, but, uh, thank you. And I'm going to fix it anyway.
1457.92s - 1461.68s |  You know, we're kind of your middleman there to protect you. Um, but that said,
1461.68s - 1467.28s |  we're also hired for the company's protection to reduce the noise, um, and go through and say,
1467.28s - 1471.28s |  is this valid for them on their behalf? And we're an impartial third party.
1471.28s - 1475.36s |  I can tell you that when I paid a vol, there was nothing. It doesn't come out of my pocket.
1475.36s - 1479.28s |  Um, it was a big joke to a lot of people like, oh, they're lowering my CVSS. They don't want to
1479.28s - 1483.84s |  pay this. They don't want to pay that. We're in the business to pay vols. If I don't pay any vols
1483.84s - 1489.28s |  on the target, my client gets mad. So I need to pay these volts. I need, if I've got a bonus out
1489.28s - 1494.00s |  there, I need to kind of pay it. That's why I'm putting a bonus on it. The money it becomes,
1494.00s - 1499.04s |  I can say this after paying thousands and thousands, probably well over a couple,
1499.04s - 1504.00s |  probably half a million dollars out that I've spent personally. It's monopoly money to me.
1504.00s - 1509.68s |  I press that button. It's not 500. It's not a thousand. It's not $4,000. It's just a button.
1511.04s - 1514.72s |  It doesn't matter to me. It never processes in my head that I just spent $10,000.
1515.12s - 1520.16s |  So your triagers are not sitting and thinking, you go, I need to hold on to this money.
1520.16s - 1524.00s |  That's not how it works for us. We don't even get really accountable for it. It's just,
1524.00s - 1528.24s |  do we do it right? Was it a valid vol? Yeah. Did you pay what it's supposed to be paid? Yep. Okay,
1528.24s - 1533.52s |  good. So your triagers are not trying to hold this money back. We don't get bonuses based off
1533.52s - 1538.96s |  what I didn't pay you guys. You know, that's not the whole different game if it was, but
1539.60s - 1543.60s |  so understand that the bounty platforms are actually here to number one,
1543.68s - 1547.52s |  show you where everything's at so that you can be efficient with your time and not have to search
1547.52s - 1552.64s |  new projects. Number two, we're your impartial third party to make sure that what you're
1552.64s - 1556.56s |  submitting is good for our clients and that the clients are being fair to you.
1559.50s - 1568.14s |  So when HackerOne started their first program, that is Yahoo. So I got the first book and that
1568.14s - 1575.42s |  is, uh, uh, Yahoo mail, uh, Yahoo mobile mail accesses. And, uh, uh, they paid me only two,
1575.42s - 1582.94s |  seven, seven dollars. And, uh, so I was, I was confused at why it is paid so low because it was
1582.94s - 1590.86s |  under their, uh, Yahoo mobile email. That is their main application. So, uh, I think, uh, then,
1590.86s - 1596.46s |  then, uh, I thought I, I probably lacked that demonstrating the impact here. And, uh, that's
1596.46s - 1605.58s |  why, uh, the bounty was so low. Then, uh, the bug crowd, I submitted like, uh, uh, 48 plus 29.
1605.58s - 1612.86s |  I don't know how, how much it is. And, uh, uh, so just 29 accepted and 48 was duplicate. So
1613.74s - 1620.54s |  when you do a bug bounty, duplicates are part of it. And, uh, uh, you, uh, you just have to,
1620.54s - 1626.06s |  uh, take, uh, take into consideration that you will get the duplicates because someone will
1626.14s - 1630.70s |  be faster than you, uh, in submitted vulnerabilities. If, if someone has automation,
1630.70s - 1639.42s |  uh, automation, they will be more faster than you. And then the last, the report writing. So,
1639.42s - 1648.14s |  so, uh, I had a worst report writing, uh, at that time. And, uh, uh, it was, it was causing,
1648.14s - 1655.58s |  uh, it was causing a lot of problems to me. Uh, so, uh, that, that is, that is the struggle. So
1656.54s - 1662.78s |  yeah, I'm going to say this on report writing. Um, I've worked with a lot of our top guys. Um,
1662.78s - 1668.38s |  and if said, some of them come back and said, at first I hated y'all, you know, I thought y'all
1668.38s - 1671.50s |  were just running me through the ringer. I felt you were going to have to do all this stuff,
1671.50s - 1677.50s |  jumping through all the hoops. And later they said, you know, at my day job, I'm now 10 times
1677.50s - 1682.46s |  better at writing a report because of what you made me do. Um, we don't want these reports that
1682.46s - 1690.70s |  say there's an injection. Here's your line impact. I took your stuff. I got to give me
1690.70s - 1695.82s |  more than that. You've got to write it as a compelling story. Because when I go to a CISO
1696.46s - 1701.50s |  and particularly if I go to a CEO, I hate to tell you guys, he doesn't know, nor care what an idol
1701.50s - 1707.18s |  is. He doesn't care what SQL is. He doesn't know. That's not his job to know those things. He goes
1707.18s - 1712.22s |  to SQL. I don't whatever. If I tell him, I just downloaded your entire database and could delete
1712.22s - 1717.90s |  your entire production database. And I know who all your customers are. Are you caring now? Now
1717.90s - 1724.54s |  he cares because he knows that that's a newsworthy item. Tell me that scary story. Do this in detail.
1724.54s - 1728.62s |  Show me what can happen. You don't have to actually go out and publish it on the dark web,
1728.62s - 1734.22s |  of course, that wouldn't work out well for us. Um, but if you go ahead and you just say, look,
1734.22s - 1741.34s |  cross-site scripting, I've got document.cookie. I can send this out to my server and now harvest
1741.34s - 1745.82s |  credentials. And it's, you know, now it's persistent. Any logged in user, I can pull
1745.82s - 1750.22s |  that from them. If they go to that page, I can get your leads. I can get your engineers. I can
1750.22s - 1755.66s |  get your creds too. Now you've told me a scary story that I can take to the client. You've also
1755.66s - 1760.70s |  made it clear to the triage team who may not be as clear on that type of bond as you are, because
1760.70s - 1765.34s |  like we said, you're working to become that world-class expert in it. You may actually know
1765.34s - 1770.94s |  more about that impact. So clarify your impact, write those reports, take a little bit longer and
1770.94s - 1776.86s |  write a more verbose story, really give us extremely detailed steps as our reproduce,
1778.14s - 1781.98s |  and then give us some good feedback on how to fix this thing. Because you may know more than
1781.98s - 1785.26s |  the engineering team because to be blunt, they screwed it up in the first place.
1786.30s - 1791.42s |  So tell us, talk to us, be that story writer. I know as technical people, we want to keep it
1791.42s - 1796.54s |  concise to the point and no extra fat. In this case, sometimes getting a little wordier is worth
1796.62s - 1802.06s |  time and will significantly improve your reporting. When you have a report that I love,
1803.42s - 1807.82s |  it's clear to me, and now I can start accepting it a lot more. If you start giving me garbage
1807.82s - 1811.58s |  reports that are real brief and real short, it's real easy for me to miss your point
1812.54s - 1815.90s |  and what you're actually getting at. So make sure you explain it,
1815.90s - 1819.26s |  over explain it a little bit. Tell me those scary stories and the impact.
1820.14s - 1827.26s |  Yeah. So I figured out that whatever the shortcomings, it's like always looking,
1827.26s - 1833.26s |  I'm always looking for low-hanging fruits. Worst report writing, like in chaining the report to
1833.26s - 1839.66s |  make it more impactful, and obviously not so fast in reporting and the target approach.
1840.38s - 1844.70s |  Nix, I'm going to say one thing about low-hanging fruit. When I first started,
1844.70s - 1848.70s |  I thought Metasploit was the answer to everything. Great tool, a lot of fun,
1849.82s - 1853.42s |  in two and a half years, I saw exactly one ball that was found with Metasploit. I was doing
1853.42s - 1859.02s |  dozens a day. It's a very well-known tool that's a low-hanging fruit. Your dev team should be
1859.02s - 1864.30s |  using it. If they're not, they need to be, right? These scanners, we're going to have to go deeper.
1865.42s - 1869.58s |  You're going to have to really learn about the exploit, not just depend on the low-hanging
1869.58s - 1874.54s |  fruit popping from the scanners. If that's what you're depending on, you got a long road.
1875.34s - 1880.46s |  You've got to get a little more creative and do a little more. Some things are easy. Yeah,
1880.46s - 1885.18s |  there's a few. Sometimes things are really simple, but sometimes they're not. You've got to go a
1885.18s - 1889.10s |  little farther and the scanners may not point it out to you. You may have to start thinking
1889.10s - 1896.14s |  through it and get a little more creative. I kind of started taking things a little
1896.14s - 1903.10s |  seriously and I was delving into more impactful findings and blogs by other researchers,
1903.10s - 1909.02s |  learning from the community, and exploring other pen test reports, excellently written reports
1909.02s - 1915.58s |  to figure out what's actually going wrong from my end, and adapting the platforms,
1915.58s - 1926.38s |  how platforms are working, what are the target rotations, and what programs are less eyes and
1926.38s - 1934.70s |  what programs has more eyes. Obviously, the CTF and labs are quite helpful because
1934.70s - 1941.82s |  you will get to learn how the exploits is working. The one more thing, the one target,
1941.82s - 1949.42s |  you have to target one at a time, so you will get a better idea about how the target is working and
1950.22s - 1956.54s |  how their business logic is. Yeah, so learning from the community,
1956.54s - 1960.22s |  one of the big things I've seen, and I'm going to say something a little blasphemous right now,
1961.34s - 1964.30s |  if you come into bug bounty hunting and you're looking for the money,
1965.58s - 1970.22s |  you're probably going to have a hard road. If you come into it and say, I have paid thousands
1970.22s - 1975.34s |  on courses, I have paid thousands for school, and I paid a lot of money to get certifications,
1975.34s - 1980.38s |  this is free. You're going to be in the right mind space. Let the money come when it will,
1980.38s - 1985.18s |  right? That's a bonus. This is free training that you may actually get a little bit of money for.
1986.38s - 1989.98s |  As you start seeing that, you're going to start finding success. The people who I know who came
1989.98s - 1994.46s |  into it who said, I just want to sharpen my skills are very successful. The people who come
1994.46s - 1999.50s |  into it and immediately I'm like, I need to pay a bill next weekend. I need to have beer for Friday.
2000.14s - 2003.74s |  You're going to have a hard time. You're going to get frustrated. So come into it
2003.82s - 2010.30s |  mind space wise and say, I'm wanting to learn and use the community. Whether it is Discord,
2011.02s - 2015.58s |  the different channels that we have set up, we have Slack channels that you can actually just
2015.58s - 2019.98s |  reach out and say, hey, Nix, I'm kind of stuck. Now he's not going to go and say, hey, here's
2019.98s - 2024.62s |  a cross that script and go find it because he's also looking for it, right? But if you're stuck
2024.62s - 2028.62s |  and you have a good idea, you're like, I just don't have this payload. Where can I look for
2028.62s - 2033.98s |  more info? That's where you can reach out for help from the community. Nobody's going to give
2033.98s - 2039.26s |  you the free answer, but you can start getting, figure out how to get better. And you've got
2039.26s - 2045.02s |  access to world-class trainers because they are doing it. So reach out, educate yourself,
2045.02s - 2051.10s |  use this as an education tool, use the community. Each of the platforms has a community person
2051.74s - 2055.74s |  who is there to help you succeed. That's their job. So use that.
2056.54s - 2067.02s |  So in my previous point, I delve into target approach and platform adoption. So what I mean
2067.02s - 2074.38s |  to say from the platform adoption is, let's say H1, HackerOne and Buckrowd was accepting reports
2074.46s - 2081.82s |  on first come first services, but the other platform like Sennac is using a quality rule
2082.38s - 2090.14s |  during 2016 to 2023. And the quality rule is something like that, that you have, they choose
2090.14s - 2101.34s |  the best written report during that time. And even if you submitted last and the report is fine,
2101.34s - 2109.58s |  then they submit the last report on the basis of just the report writing. But this has been
2109.58s - 2117.42s |  remote now and they start using first come first serve only. So that is the platform adoption
2117.42s - 2128.62s |  because you have to know what is going on on the platform and how to work on the particular
2129.34s - 2134.86s |  platform. Yeah, each platform is a little different. And so when you're working with
2134.86s - 2139.42s |  them, make sure you know what your rules are. The first thing when you get on a platform,
2139.42s - 2145.50s |  read all the rules. And that's really kind of simple. I'll say this Sennac setup is fairly
2145.50s - 2150.38s |  complicated because you've got a VPN, you've got a VM, and you've got dedicated IPs that you're
2150.38s - 2155.90s |  coming from. When you're going with some others, maybe you need to note, I'm a researcher in there
2155.90s - 2160.46s |  because you're not on that secured network. They don't know who you are. And you're sending
2160.46s - 2165.42s |  attack traffic and live target guys. If they don't know who you are, that may alarm them.
2165.42s - 2169.66s |  So go and find out the rules. Make sure you're really clear before you go start sending attack
2169.66s - 2174.22s |  traffic and figure out which platform works for you. There is no one answer. There is different
2174.22s - 2178.54s |  platforms because they have different strengths and weaknesses. So find out what works for you.
2178.54s - 2184.38s |  And a lot of people work on all of them. There's no downside to that. One interesting note,
2184.38s - 2190.62s |  even though the quality rule, the QR is now not a thing. The reason why that happened was to make
2190.62s - 2198.38s |  sure that the reports had good quality and that they were written well. So you go back to remember
2198.38s - 2203.42s |  what I said about write the report well. That was what we were trying to get out there. So it was
2203.42s - 2209.34s |  that important that we actually had an entire rule around this and have platform-based stuff on it.
2209.34s - 2214.14s |  So just remember that the triage is going to very favorably respond to that good report writing.
2215.02s - 2224.70s |  So when I have all of this in mind and I refine my skills, I actually able to find some good
2224.70s - 2233.58s |  vulnerabilities starting from the HelloSign one. This was found in 2015. It was straight
2234.62s - 2241.18s |  an SSRF that is called through the event callback functionality. And I was able to
2241.18s - 2250.86s |  call back their past WD file. So and the Microsoft started their bug bounty program
2250.86s - 2261.18s |  for online services in 2014, late 2014. I submitted multiple reports and 90% reports
2261.18s - 2273.58s |  got accepted while 10% got duplicate only. So I was pretty fast. I understand what to do
2274.46s - 2282.30s |  for a particular program. And I target only one program at a time. And I focus more on
2282.86s - 2292.62s |  high-impact vulnerabilities. And then later I got listed into MSRC top 100 and also
2293.98s - 2303.39s |  awarded with this laptop. Then I came in full-time pursuit because I created a
2303.39s - 2309.87s |  financial backup out of whatever bug bounties I have got. I stepped away from 9-to-5 job.
2310.43s - 2318.83s |  And I turned into the full-time bug bounty hunter. So that's how you can start being a
2318.83s - 2325.63s |  full-time bug bounty hunter. You create a backup for yourself. And then only you can step away
2325.63s - 2334.91s |  from a daily job and start doing a full-time bug bounty. Because bug bounty has a lot of money.
2334.91s - 2341.71s |  But it also gives you a lot of stress too. Yeah. So one thing I'll say is that we've noticed
2341.71s - 2346.83s |  that first of all, he started incorporating these techniques of listening, improving his reporting,
2346.83s - 2351.95s |  focusing, and starting to see success. One thing really important to notice, and I've told people
2351.95s - 2355.55s |  this a lot of times, if you're going to go out and Saturday you're going to go, yep, I'm going
2355.55s - 2358.91s |  to go bug hunt. I'm going to spend four hours on it. And I'm going to do a few hours on Sunday
2358.91s - 2364.27s |  and see what happens. Your odds of success are almost zero, okay? If that's your first time
2364.27s - 2369.23s |  out there, it's going to take you a while, guys. Average vols come in. Your first average vol is
2369.23s - 2374.27s |  20 hours of research, okay? But then as he said, it keeps getting faster. Then it becomes 10. Then
2374.27s - 2378.11s |  it becomes five. Then it becomes two. Then it becomes 30 minutes. Then it becomes 10 minutes
2378.11s - 2384.11s |  to find a single lie. But you have to put in the time. If you're planning on doing this, I'd say
2384.11s - 2389.95s |  there's a 40-hour rule here. Then if you're going to have a 98% chance of success, plan on spending
2389.95s - 2396.67s |  40 hours dedicated and have most of it on one to two targets. Get to know that thing really well.
2397.47s - 2401.87s |  You know, spend that 40 hours, then assess whether this is for you or not. Because if you quit too
2401.87s - 2406.67s |  soon, you're not going to really benefit from it. You've got to be persistent. You're going to start
2406.67s - 2411.31s |  doing that and start seeing income coming in. Now, you may have a little shoebox of income
2411.31s - 2415.95s |  that you're like, okay, I'm making enough to take my family to a really nice dinner this month.
2415.95s - 2421.39s |  That's what I got off bug bounty is that really nice dinner, you know, great steakhouse, great.
2421.95s - 2425.63s |  And you may be happy with that. Maybe that's the, you want the little bucket that's enough
2425.63s - 2431.87s |  to make a car payment. Maybe you start realizing it's getting bigger. We had one of our analysts,
2432.91s - 2437.87s |  really bright guy, senior analyst, paid him fairly well, of course. And he was bug hunting on the
2437.87s - 2444.59s |  side. And on very limited, very hardened targets, we started seeing he was making a lot of money
2444.59s - 2450.19s |  to the point that he was making more as a bug hunter than he was as a full-time security analyst.
2450.19s - 2453.23s |  And everybody asked him, why don't you quit? He goes, well, I like this, you know,
2453.23s - 2458.51s |  guaranteed income, right? Okay. Fair enough. Finally, he got to the point that, and he had
2458.51s - 2464.43s |  the money bank back sitting in the bank to float him for a while. But he realized that he was
2464.43s - 2469.47s |  actually losing money by working full-time as a security analyst. And that was when he decided
2469.47s - 2476.27s |  to quit and go full-time. So wait on the money and use the education time and start watching
2476.27s - 2480.27s |  where that bucket of money is doing, how often it comes in, and then you can make those decisions.
2480.99s - 2486.91s |  Please do not jump off next week and go, I'm that good. I've got my OSCP. I've got my OSCE.
2486.91s - 2491.15s |  I'm going to become a full-time bounty hunter because that very well may turn out to be a
2491.15s - 2495.47s |  very bad financial decision. Even if you're the best out there, you've got to have some
2495.47s - 2499.87s |  time to figure out what is your income going to look like from this. And so use that time to spin
2499.87s - 2504.35s |  up and figure that out. And that's when you can start stepping aside from the nine to five with
2504.35s - 2510.91s |  this. So when you've got motivation and some confidence, you can do better in the longer
2510.91s - 2519.79s |  terms, but you need to back by some good findings in order to keep those, keep those bounty hunter
2520.19s - 2528.75s |  running. So I'm moving on to some key discoveries that I've found during my bug bounty hunting.
2529.63s - 2537.47s |  A couple of them, like first one is a SQL injection in a biggest e-commerce solution
2537.47s - 2548.75s |  in the world. So you can guess about it. So I was onboarded on a target at this e-commerce solution
2548.83s - 2563.14s |  and while modifying the profile, I came across a country ID. And just a second. Okay. Sorry. I
2563.14s - 2575.97s |  think this slide, I don't know how it comes. So yeah. So it was an online car marketplace.
2575.97s - 2587.73s |  And I start, so I started running brute force on directories and files. And the application
2587.73s - 2595.65s |  keep redirecting me to the login page on each directory and file brute force. Like that.
2596.61s - 2608.77s |  Each hit getting redirected to 302 and it was kind of loop. And I tried to change the methods,
2608.77s - 2616.37s |  but I got the same result out of it. So what I do, I notice the application is using a third
2616.37s - 2625.01s |  party solutions. So what I do, I went to the third party solution and found it was a hosted
2625.49s - 2636.29s |  invoice solution they are using. So what I do, I went ahead and see if there are any demo version
2636.29s - 2641.41s |  available of the application. I couldn't find any demo version available anywhere.
2641.41s - 2654.13s |  So what I did, I did a subdomain brute force of the third party provider. And I found a demo
2654.13s - 2664.69s |  version running. And the demo version, these are all the demo version that are available for that
2664.69s - 2675.49s |  application. And after exploring a bit, and watching the YouTube videos, I found that once,
2676.45s - 2695.10s |  I mean, there was a, I found like, I was looking for a path from the application, which I couldn't
2695.10s - 2704.06s |  get. But after getting the demo version of it, I found that the application do not have any
2704.06s - 2714.94s |  authentication, but it was totally unauthenticated. They have added some rules in the path that was
2714.94s - 2723.02s |  denying me to actually accessing the direct path in the application. So what I did, I just
2724.70s - 2733.18s |  used that demo version to retract all the paths. And I just changed the domain name from the
2733.18s - 2741.42s |  application. And I started fuzzing for SQLi vulnerability on all the parameters that has been
2741.42s - 2752.22s |  into, that has been used into the application. And I found that I was able to dump all of their
2753.02s - 2765.74s |  databases because one parameter was vulnerable to SQLi. Then this is one of the banking asset that
2766.62s - 2776.86s |  I got. So what they're doing that they are fetching one JavaScript file from a CDN file name
2776.86s - 2789.10s |  parameter. And what I did, so CDN file name takes file input from file input such as user
2789.50s - 2799.90s |  underscore tools.bundle. So in the comment, I have seen there was a comment that the file comment,
2799.90s - 2811.02s |  which is having an API.github.com. And that user underscore tools.bundle was printed in that
2811.02s - 2819.50s |  particular path. So I thought that let's do one thing. That's user dot dot slash to come on to
2819.50s - 2836.86s |  the root path and then try to use API.github.com to query the internal data from the GitHub API.
2837.66s - 2849.02s |  So I just used their events query and I was able to dump their internal events, all the events
2850.38s - 2861.18s |  from the CDN file parameters only. Because the dot dot slash was taking all the file path to
2861.18s - 2867.02s |  API.github.com only. Do you want to add something?
2867.98s - 2872.22s |  Right now, this is your vault. So I'm going to let you go with that. You know, some of the things
2872.22s - 2876.62s |  that I'm thinking about in the back of my head right now is just the persistence. And some of
2876.62s - 2881.74s |  the things that we're kind of looking at is how do we succeed? You know, and so I'd say the
2881.74s - 2886.70s |  persistence, keeping at it, learning, those are some of your key takeaways for how you start doing
2886.70s - 2892.86s |  this and how you start making money. How do we start succeeding in bug bounty? And just understanding
2892.86s - 2898.06s |  that there is a learning path. So that's kind of where I'm thinking right now. But keep running
2898.06s - 2905.34s |  with the bolts, man. I always like bolts. So this was an account takeover vulnerability.
2905.34s - 2913.10s |  So after doing subdomain discovery, I stumbled across a subdomain and it was giving a 403
2913.82s - 2921.50s |  forbidden error. So the 404 written error looks interesting to me. So what I did, I just did
2922.14s - 2928.38s |  quick Google search. And it was listing out a lot of applications. But one of the applications
2928.38s - 2935.90s |  looks interesting. So but it was asking for some deviant ID, which I do not know because
2936.70s - 2945.66s |  that is some unique thing. So I searched everywhere deviant ID was not available anywhere.
2946.06s - 2954.70s |  So I just did a simple, simple Google search on deviant ID on images, images section,
2954.70s - 2963.98s |  and I got I got some jumbo.com having a lot of contract IDs available under the
2964.94s - 2974.06s |  under under the papers and they have them as a deviant ID as as a deviant ID field.
2974.78s - 2982.38s |  So I collected those all all those deviant IDs from the Google images section on the and all
2982.38s - 2989.90s |  those all those images are available on some jumbo.com site. I don't know how to how to get it.
2990.38s - 2997.26s |  So I so I in the in the subject section, they have a lot of these deviant IDs available. I
2997.26s - 3004.38s |  use those deviant IDs. And I went to the application, I just use the forget password.
3004.38s - 3012.38s |  And I have seen that the the past the application was actually fetching the password for that
3012.38s - 3018.86s |  particular deviant ID and sending to me sending to the user in the plain text format in the in
3018.86s - 3025.10s |  one request itself. So I just use that particular password and deviant ID to log into the application.
3028.32s - 3032.72s |  So one thing I'm going to point out here is that you said something really interesting.
3032.72s - 3036.96s |  I didn't know what it was. So I started looking for it. Google it. Google is your friend, right?
3037.60s - 3040.64s |  I don't know how we would ever begin to hack before Google was what it is now.
3042.08s - 3045.84s |  A lot of your time is going to be spent researching. Nobody in this room knows
3045.84s - 3049.84s |  everything about everything in cyber. And if you think you do, I would love to talk to you.
3051.68s - 3054.96s |  Look at these things. When you see something you don't understand, take a curiosity.
3054.96s - 3059.68s |  I many times I've seen something that I've been like, OK, what is it? All of a sudden,
3059.68s - 3064.64s |  I find out that is a key piece of information that is not supposed to be shared. This is a
3064.64s - 3068.64s |  private something that is really sensitive. All of a sudden, I can start finding a way.
3068.64s - 3072.96s |  These are used for that. Really? OK, now I'm interested that parameter.
3072.96s - 3077.84s |  That was just something weird beforehand. So take the time to really understand the apps.
3078.64s - 3082.72s |  This is why earlier we said stop. Look at that one target. Get to know it.
3083.36s - 3088.72s |  Go and spend five, 10 hours on that target to really know it in depth. And part of that's
3088.72s - 3091.76s |  just going to be your research time to understand what all these parameters are.
3092.32s - 3095.52s |  DVM means something. They didn't just come up with that randomly.
3096.24s - 3100.08s |  So what is it? What are they trying to communicate with that number? Understand that,
3100.08s - 3103.68s |  and you're going to have a lot better chance of success and finding the right places to
3103.68s - 3108.72s |  manipulate and poke. So when you said I went and I Googled it, I wasn't familiar with it,
3108.72s - 3113.04s |  that's part of that time we said spend a lot of time on that target. Use that curiosity.
3113.68s - 3117.44s |  Of course, a lot of them are going to be nothing interesting. But it's when you find that one
3117.44s - 3121.60s |  interesting that you're like, oh, really, that whole parameter crawls the entire account for
3121.60s - 3128.16s |  admins. Interesting. Now I want to play with that one. So it's going to help you focus whenever you
3128.16s - 3132.16s |  start doing these researches on things you don't understand and see it's kind of weirdness.
3132.80s - 3140.96s |  This was another one was an SSR of an ASM solution. The target launched and there was no
3140.96s - 3148.08s |  vulnerability submitted on it. No vulnerability accepted on it. So this makes me curious why.
3148.08s - 3155.28s |  So I started digging into the application. So what application is doing? It starts doing
3155.84s - 3162.32s |  recon for subdomain IP address and all the certs. And it also creates a screenshot of
3162.32s - 3168.00s |  a parent domain too. So I got interested that if it is creating a screenshot of that parent too,
3168.88s - 3181.92s |  maybe I can use maybe I can use some domains and redirect that domains to my custom payload.
3181.92s - 3191.36s |  And that custom payload might comes up might extract some information from their internal
3192.24s - 3203.36s |  system and capture it as a screenshot. So what I did, I so that is their application. And
3203.84s - 3214.16s |  they're just creating a screenshot of whatever application is. So what I did, they were using
3215.84s - 3224.80s |  Amazon. Amazon has infrastructure services. So what I did, I just put this and tried to extract
3225.20s - 3239.60s |  the data from their screenshots. So that's how the screenshot is. It was all empty. There was
3239.60s - 3250.56s |  nothing on it. So I was curious that why it's not coming as a screenshot. So I was researching
3250.56s - 3257.52s |  more on this application and I found out that they are not using an EC2 but they are using the
3257.52s - 3267.76s |  Lambda. So I went to the Twitter and I searched for what exactly the what how exactly I can do
3267.76s - 3276.08s |  SSR with the Lambda. So I got a got a tweet that if you're if someone is using the Lambda function,
3276.08s - 3285.20s |  you can particularly use this particular request to actually query the internal data. So next I
3285.20s - 3294.48s |  created another redirect request and it actually it actually extracting the data from the Lambda
3294.48s - 3304.88s |  function as a screenshot. So I again passed it into for the execution. And what I did, it
3304.88s - 3312.96s |  actually captures their Lambda, Lambda, whatever Lambda event is running internally as a screenshot.
3313.68s - 3322.08s |  So that's these are all key discoveries that I found in this solution.
3322.64s - 3326.24s |  So as we're getting to write up, there's been one question that I've asked you before,
3326.24s - 3330.24s |  but I thought it was really kind of an interesting answer. And I think a lot of people here,
3331.12s - 3338.88s |  you are globally known, you're on the Microsoft Hall of Fame, SYNAC Legends, you do well. We're up
3338.88s - 3344.24s |  here today. Talk to me a little bit about imposter syndrome. Do you have it still?
3345.36s - 3351.84s |  Yeah, I mean, I regularly I mean, if you go to go to Twitter, and you will find a lot of bug bounty
3352.64s - 3360.96s |  tips. So you will get those imposter syndrome because, because looking at those, because,
3361.84s - 3367.60s |  I mean, you will find someone like, like, you must you must be missing something, you must be
3367.60s - 3374.80s |  missing something out from somewhere. I mean, someone is more skilled than you, and you are
3374.80s - 3381.04s |  lacking some some of the skills because they are getting more bounties, more impactful bugs. So
3381.04s - 3386.00s |  obviously that that's coming out and into your mind, but maybe that person has,
3387.60s - 3394.08s |  has been doing like research from last three, four months, and then he found that impactful
3394.08s - 3399.60s |  vulnerability. So it's, it's depends on total situation. And you do not have to panic from that.
3400.72s - 3404.32s |  I think that's the key there is don't panic just because you missed something or because
3404.32s - 3410.80s |  you didn't succeed. It doesn't mean you're wrong, right? It just means that, hey, let's keep going.
3410.80s - 3414.64s |  You know, and I think one of the things you said on that one time that really stuck with me,
3414.64s - 3420.08s |  and was that you woke up in the morning and kind of goes, am I really here? Am I? This is what I'm
3420.08s - 3427.04s |  doing for my job. And you get scared. And he said, you sit down, start typing, start working,
3427.04s - 3431.20s |  start to get in that mindset, life starts running well, okay, things are going good. Now find a flaw
3431.20s - 3434.72s |  now find a second flaw. You know, things are getting rejected, things are getting accepted
3434.72s - 3438.72s |  things. All that's going on any of the day you go, yeah, I got this. And the next morning,
3438.72s - 3444.40s |  you wake up and feel like you're fake again. Yeah. So I can say this, that stuck with me,
3444.40s - 3448.40s |  because I'm like, if he's doing it, then it's not a problem. If I'm doing it, too. These are
3448.40s - 3453.20s |  normal things for us, especially when you add the full time aspect of bug bounty and the pressure.
3453.84s - 3461.28s |  So just understand that the middle game is a lot in it. And the persistence and understanding that's
3461.28s - 3467.12s |  where you're going to succeed in bug bounty is by being mental, persistent, smart, intelligent,
3467.12s - 3471.60s |  go after it. Because yeah, you're competing against him, but he's also here to help you.
3472.56s - 3480.56s |  So like, like, Charlie said that there are a lot of a lot of challenges while running the long,
3480.56s - 3486.56s |  long time into bug bounties. So imposter syndrome is one of them, then if you are,
3486.56s - 3493.36s |  if you're, if you're not earning one or two months, you will start doubting yourself that
3493.36s - 3500.56s |  then the burnouts comes in. And the frustration of if reports are rejecting or getting duplicated,
3500.56s - 3507.52s |  the frustration comes comes in as well. And all of these comes as a stress on you. So
3508.40s - 3514.16s |  mental, your mental health gets impacted. So we're getting the signal to wrap it up, I think.
3515.20s - 3520.64s |  Yeah, he's not back there. So we will have these slides posted. So you can go through see some of
3520.64s - 3525.60s |  the details on this and cover it. But I think the basic thing is number one, treat this like a game.
3526.16s - 3530.64s |  Understand that it's a puzzle on that puzzle and try and just keep it in that mindset.
3531.20s - 3537.36s |  Treat it as fun training and enjoy the process. Keep at it. You're going to get success if you
3537.36s - 3541.60s |  keep at it. It's one of those things, the more you work at it, the more likely you are to succeed.
3543.20s - 3548.40s |  Anything else to add? All right. Well, thank you, guys. Appreciate it. Hope you had a good time.


