# MediaChunks

chunk_id: 172_chunk_14
chunk_text:
vibes to get to the right goal. You know, when we're running CTFs, you need to have 1013.36s - 1020.36s | some epic gamer music. Shout out to EDM for powering us through many a late night coding 1021.00s - 1034.28s | sesh. So today it is my honor to talk about who might in the last year have generated those rare 1034.64s - 1040.64s | vibes that we needed in moments of difficulty. So without further ado, the nominees for best song 1045.44s - 1051.44s | are the nominees for best song 2024 touch some grass by UWU underground. Kids out here believing 1054.92s - 1060.92s | what they're told. The X on the ground, code snail loads by Lava Dose. It's falling back. It's 1064.52s - 1070.52s | right through them. That works too. And the pony for best song goes to UWU for touch some grass. 1093.08s - 1100.08s | Let's go. A good reminder for us all. Do we have someone? Yes. I think we have someone to 1100.08s - 1107.33s | accept the award. I mean, who wouldn't want to take credit for this, you know? Nice. Awesome. 1109.33s - 1114.83s | Hi, my name is Int 80. I'm the rapper in a group called dual core and also in a group called the 1114.83s - 1120.83s | troubleshooters and also in a group called no friends and I am not magical malware girls. However, 1123.37s - 1129.37s | we do have a collaboration in the mix and I have been nominated by UWU underground to accept this 1129.37s - 1135.37s | award on their behalf. I will say I get asked a lot as a rapper, what do you think about AI 1138.13s - 1144.03s | generated music? And as a rapper, I do not consider myself a real musician because rapping does not 1144.03s - 1150.03s | require talent. And I actually genuinely love the music that UWU underground makes and so that is 1151.25s - 1156.07s | why I reached out to them to collaborate. So I'm very excited that they have won this award. 1156.11s - 1162.11s | Jonathan Scott can eat my butt from the front. Man wipes his phone and calls it a POC. Hack all the 1164.85s - 1170.85s | things, touch some grass and get off the screen. Speaking of mobile researchers, damn. Thank you so 1172.77s


chunk_id: 172_chunk_15
chunk_text:
is Int 80. I'm the rapper in a group called dual core and also in a group called the 1114.83s - 1120.83s | troubleshooters and also in a group called no friends and I am not magical malware girls. However, 1123.37s - 1129.37s | we do have a collaboration in the mix and I have been nominated by UWU underground to accept this 1129.37s - 1135.37s | award on their behalf. I will say I get asked a lot as a rapper, what do you think about AI 1138.13s - 1144.03s | generated music? And as a rapper, I do not consider myself a real musician because rapping does not 1144.03s - 1150.03s | require talent. And I actually genuinely love the music that UWU underground makes and so that is 1151.25s - 1156.07s | why I reached out to them to collaborate. So I'm very excited that they have won this award. 1156.11s - 1162.11s | Jonathan Scott can eat my butt from the front. Man wipes his phone and calls it a POC. Hack all the 1164.85s - 1170.85s | things, touch some grass and get off the screen. Speaking of mobile researchers, damn. Thank you so 1172.77s - 1178.77s | much. Would you like to select? Yes. Oh, no. It's dealer's choice. Okay. And I will somehow, I 1179.77s - 1186.23s | don't know the identity of UWU underground but I will ship internationally if needed. This speaks 1186.23s - 1198.28s | UWU underground to me. Touch grass. Very good point. Thank you so much. All right, wonderful. 1201.25s - 1207.25s | Next up, we have the pony for most innovative research being presented by Ryan Spears. Welcome 1209.33s - 1219.99s | to the stage. Good morning everyone. This category is pretty fun to see. When we go through the 1219.99s - 1226.69s | nominations for these and basically take away your democratic process behind the scenes, we get to 1226.69s - 1233.99s | see some truly innovative ideas as well as, I guess I wasn't supposed to say that part. Some truly 1233.99s - 1239.99s | innovative ideas. We talked about this. And those ideas that were already done 20 years ago and you 1241.57s - 1248.37s | all are self-nominating and claiming they're still innovative. That's true. There were some in 1248.37s - 1253.03s | this category of exploiting IP facing protocols and that's not


chunk_id: 172_chunk_16
chunk_text:
- 1178.77s | much. Would you like to select? Yes. Oh, no. It's dealer's choice. Okay. And I will somehow, I 1179.77s - 1186.23s | don't know the identity of UWU underground but I will ship internationally if needed. This speaks 1186.23s - 1198.28s | UWU underground to me. Touch grass. Very good point. Thank you so much. All right, wonderful. 1201.25s - 1207.25s | Next up, we have the pony for most innovative research being presented by Ryan Spears. Welcome 1209.33s - 1219.99s | to the stage. Good morning everyone. This category is pretty fun to see. When we go through the 1219.99s - 1226.69s | nominations for these and basically take away your democratic process behind the scenes, we get to 1226.69s - 1233.99s | see some truly innovative ideas as well as, I guess I wasn't supposed to say that part. Some truly 1233.99s - 1239.99s | innovative ideas. We talked about this. And those ideas that were already done 20 years ago and you 1241.57s - 1248.37s | all are self-nominating and claiming they're still innovative. That's true. There were some in 1248.37s - 1253.03s | this category of exploiting IP facing protocols and that's not innovative but some of the 1253.03s - 1260.25s | approaches this year truly were. We had a long section of DNS bugs uh that somebody had fun I 1260.25s - 1266.45s | think making 30 plus CVEs so good scoring for yourself. There were other attacks against 1266.45s - 1272.07s | security infrastructure and the new features. Which is good. It shows the circle of life in this 1272.07s - 1278.49s | community. Right? Some of you worked hard all of last year since the last ponies to help add 1278.49s - 1285.35s | attack surface in the name of security features. And that's important because otherwise I'd be 1285.35s - 1291.31s | worried about the future of this category. But thanks to your hard work, we continue to have new 1291.31s - 1298.19s | innovative attack surface and so let's see this year's nominations. Here are the nominees for most 1298.19s - 1307.07s | innovative research. Ahoy Attacks by Benedict Schluter. Introducing a novel method of injecting 1307.07s - 1313.33s | virtual interrupts into confidential VMs, CVMs, to alter their execution state and break 1313.33s - 1319.25s | confidentiality. Two-door attack. Systematically exploring and exploiting logic, 1319.29s - 1324.87s


chunk_id: 172_chunk_17
chunk_text:
innovative but some of the 1253.03s - 1260.25s | approaches this year truly were. We had a long section of DNS bugs uh that somebody had fun I 1260.25s - 1266.45s | think making 30 plus CVEs so good scoring for yourself. There were other attacks against 1266.45s - 1272.07s | security infrastructure and the new features. Which is good. It shows the circle of life in this 1272.07s - 1278.49s | community. Right? Some of you worked hard all of last year since the last ponies to help add 1278.49s - 1285.35s | attack surface in the name of security features. And that's important because otherwise I'd be 1285.35s - 1291.31s | worried about the future of this category. But thanks to your hard work, we continue to have new 1291.31s - 1298.19s | innovative attack surface and so let's see this year's nominations. Here are the nominees for most 1298.19s - 1307.07s | innovative research. Ahoy Attacks by Benedict Schluter. Introducing a novel method of injecting 1307.07s - 1313.33s | virtual interrupts into confidential VMs, CVMs, to alter their execution state and break 1313.33s - 1319.25s | confidentiality. Two-door attack. Systematically exploring and exploiting logic, 1319.29s - 1324.87s | vulnerabilities, and DNS response. Pre-processing with malformed packets by IDEALEAR. 1325.67s - 1331.03s | Exploiting DNS response pre-processing vulnerabilities to perform DNS cache poisoning within 1331.03s - 1338.67s | one second. Leading to the assignment of 33 CVE IDs. Let the cache cache and let the web assembly 1338.67s - 1345.79s | assemble. Knocking on Chrome's shell by Eduard Bochin and Tao Yan. Successfully demonstrated a 1345.79s - 1353.71s | novel V8 sandbox escape technique at Pwn2Own Vancouver 2024. Setting a new precedent in V8 1353.71s - 1366.76s | exploitation. So let's see. And the pony goes to, for most innovative research, Edward and Tao for 1366.76s - 1375.26s | let the cache cache and let the web assembly assemble. Knocking on Chrome's shell. I think 1375.26s - 1380.34s | someone stood up back there. Are you going to the bathroom? Are you coming up? Oh shoot, they're 1380.34s - 1389.65s | here. This is so exciting. Congrats, come on. 1389.65s - 1396.55s | Thank you so much. You can, you can give a talk. 1396.55s - 1404.57s | I wouldn't want to come on. 1409.57s - 1418.21s | Hey, hi everyone. Um, so yeah, basically, uh, uh, our


chunk_id: 172_chunk_18
chunk_text:
| vulnerabilities, and DNS response. Pre-processing with malformed packets by IDEALEAR. 1325.67s - 1331.03s | Exploiting DNS response pre-processing vulnerabilities to perform DNS cache poisoning within 1331.03s - 1338.67s | one second. Leading to the assignment of 33 CVE IDs. Let the cache cache and let the web assembly 1338.67s - 1345.79s | assemble. Knocking on Chrome's shell by Eduard Bochin and Tao Yan. Successfully demonstrated a 1345.79s - 1353.71s | novel V8 sandbox escape technique at Pwn2Own Vancouver 2024. Setting a new precedent in V8 1353.71s - 1366.76s | exploitation. So let's see. And the pony goes to, for most innovative research, Edward and Tao for 1366.76s - 1375.26s | let the cache cache and let the web assembly assemble. Knocking on Chrome's shell. I think 1375.26s - 1380.34s | someone stood up back there. Are you going to the bathroom? Are you coming up? Oh shoot, they're 1380.34s - 1389.65s | here. This is so exciting. Congrats, come on. 1389.65s - 1396.55s | Thank you so much. You can, you can give a talk. 1396.55s - 1404.57s | I wouldn't want to come on. 1409.57s - 1418.21s | Hey, hi everyone. Um, so yeah, basically, uh, uh, our research is based on, uh, the release of a new 1418.21s - 1424.61s | sandbox for the V8 JavaScript engine. Uh, that was, uh, the beta release was actually, uh, 1424.61s - 1436.17s | released in March of this year. So, uh, we needed to actually bypass it for Pwn2Own and, um, uh, so 1436.17s - 1441.61s | new features were involved and we need to actually find new ways to bypass that sandbox. That's 1441.61s - 1447.81s | what we did at Pwn2Own. We did a talk to Black Hat, uh, a couple of days ago. Uh, the slides are 1447.81s - 1453.65s | available on the Black Hat website and, uh, the video will be available also soon, I guess. So, 1453.65s - 1455.65s | uh, just check it out and yeah, thanks. 1455.65s - 1463.28s | Thank you. 1463.28s - 1476.25s | Thank you so much. Oh, I'm next. How about that? Oh, this is a fun one. I'm really excited for 1476.25s - 1483.66s | this one. You guys don't even know what's about to happen. Next up, we have the Pony Award for 1483.66s - 1491.86s | Most Epic Fail. Now we kind of snitched


chunk_id: 172_chunk_19
chunk_text:
research is based on, uh, the release of a new 1418.21s - 1424.61s | sandbox for the V8 JavaScript engine. Uh, that was, uh, the beta release was actually, uh, 1424.61s - 1436.17s | released in March of this year. So, uh, we needed to actually bypass it for Pwn2Own and, um, uh, so 1436.17s - 1441.61s | new features were involved and we need to actually find new ways to bypass that sandbox. That's 1441.61s - 1447.81s | what we did at Pwn2Own. We did a talk to Black Hat, uh, a couple of days ago. Uh, the slides are 1447.81s - 1453.65s | available on the Black Hat website and, uh, the video will be available also soon, I guess. So, 1453.65s - 1455.65s | uh, just check it out and yeah, thanks. 1455.65s - 1463.28s | Thank you. 1463.28s - 1476.25s | Thank you so much. Oh, I'm next. How about that? Oh, this is a fun one. I'm really excited for 1476.25s - 1483.66s | this one. You guys don't even know what's about to happen. Next up, we have the Pony Award for 1483.66s - 1491.86s | Most Epic Fail. Now we kind of snitched on ourselves because I really couldn't help myself. 1491.86s - 1498.50s | Um, the, the, if you're following on Twitter, you know who the winner is already. Uh, that ended 1498.50s - 1504.34s | up happening because, uh, normally we present the nominees, as Mark said earlier, at SummerCon and 1504.34s - 1510.58s | this happened like a day beforehand. And so we kind of just ended up scrapping all the nominees 1510.58s - 1515.70s | and, uh, made an executive decision, uh, when you knock off like every airline. 1515.86s - 1522.10s | And now here are the nominees for Most Epic Fail. 1523.22s - 1539.97s | LOL. Today's adversaries move fast. CrowdStrike moves fast. CrowdStrike, we stop breaches. 1540.93s - 1552.11s | Wow, you're a winner. How about that? Well, do we have anyone here who would like to accept this 1552.11s - 1567.06s | Pony Award? Oh my goodness gracious. We do. Uh, which, uh, I don't know if these, yeah, I think 1567.06s - 1579.50s | these are too small. I think we need another, I think we might need a different award. Look at 1579.50s - 1589.39s | that. I can open the envelope if


chunk_id: 172_chunk_20
chunk_text:
on ourselves because I really couldn't help myself. 1491.86s - 1498.50s | Um, the, the, if you're following on Twitter, you know who the winner is already. Uh, that ended 1498.50s - 1504.34s | up happening because, uh, normally we present the nominees, as Mark said earlier, at SummerCon and 1504.34s - 1510.58s | this happened like a day beforehand. And so we kind of just ended up scrapping all the nominees 1510.58s - 1515.70s | and, uh, made an executive decision, uh, when you knock off like every airline. 1515.86s - 1522.10s | And now here are the nominees for Most Epic Fail. 1523.22s - 1539.97s | LOL. Today's adversaries move fast. CrowdStrike moves fast. CrowdStrike, we stop breaches. 1540.93s - 1552.11s | Wow, you're a winner. How about that? Well, do we have anyone here who would like to accept this 1552.11s - 1567.06s | Pony Award? Oh my goodness gracious. We do. Uh, which, uh, I don't know if these, yeah, I think 1567.06s - 1579.50s | these are too small. I think we need another, I think we might need a different award. Look at 1579.50s - 1589.39s | that. I can open the envelope if we need to, but it's all yours. Can I put it down there? Yeah. 1589.47s - 1596.13s | That's a big trophy. Uh, hey everyone, Mike Santonis, president of CrowdStrike. 1602.13s - 1607.25s | Definitely, uh, not the award to be proud of receiving, but, uh, I think the team was 1607.25s - 1611.65s | surprised when I said straight away that I would come and get it because we got this horribly wrong. 1611.65s - 1616.85s | We've said that a number of different times and it's, uh, super important to own it when you do 1616.85s - 1620.53s | things well. It's super important to own it when you do things, uh, horribly wrong, which we did in 1620.53s - 1626.45s | this case. Uh, the reason why I wanted the trophy is I'm heading back to headquarters. Uh, I'm going 1626.45s - 1630.93s | to take the trophy with me. It's going to sit pride of place because I want every CrowdStriker 1630.93s - 1636.85s | who comes to work to see it because, you know, our goal is to protect people and, uh, we got this 1636.85s - 1639.97s | wrong and I want to make


chunk_id: 172_chunk_21
chunk_text:
we need to, but it's all yours. Can I put it down there? Yeah. 1589.47s - 1596.13s | That's a big trophy. Uh, hey everyone, Mike Santonis, president of CrowdStrike. 1602.13s - 1607.25s | Definitely, uh, not the award to be proud of receiving, but, uh, I think the team was 1607.25s - 1611.65s | surprised when I said straight away that I would come and get it because we got this horribly wrong. 1611.65s - 1616.85s | We've said that a number of different times and it's, uh, super important to own it when you do 1616.85s - 1620.53s | things well. It's super important to own it when you do things, uh, horribly wrong, which we did in 1620.53s - 1626.45s | this case. Uh, the reason why I wanted the trophy is I'm heading back to headquarters. Uh, I'm going 1626.45s - 1630.93s | to take the trophy with me. It's going to sit pride of place because I want every CrowdStriker 1630.93s - 1636.85s | who comes to work to see it because, you know, our goal is to protect people and, uh, we got this 1636.85s - 1639.97s | wrong and I want to make sure that everybody understands these things can't happen and that's 1639.97s - 1644.13s | what this community is about. So from that perspective, I will say thank you and I will 1644.13s - 1649.25s | take the trophy and we'll put it in the right place and, uh, make sure everybody sees it. So 1649.25s - 1664.69s | thank you. See, people are mad at us for giving out like negative awards, but then you get people 1664.69s - 1672.77s | like really, you know, taking it and speaking to it. It's good. I'm very happy. Um, all right, let's 1672.77s - 1678.85s | keep moving along. Next up, we have the pony for most underhyped research being presented by 1678.85s - 1686.37s | Ong Kwee, the CEO of RedBlue Insecurity and one of our sponsors. All right, all right. I am Ong 1686.37s - 1694.05s | and, um, this is the award for the best research, right? No, it's the most underrated research. Um, 1694.05s - 1700.61s | as a recipient of, of this years and years ago, I have some things to say, but in the audience, 1700.61s - 1707.62s | show of hands, has anyone else received


chunk_id: 172_chunk_22
chunk_text:
sure that everybody understands these things can't happen and that's 1639.97s - 1644.13s | what this community is about. So from that perspective, I will say thank you and I will 1644.13s - 1649.25s | take the trophy and we'll put it in the right place and, uh, make sure everybody sees it. So 1649.25s - 1664.69s | thank you. See, people are mad at us for giving out like negative awards, but then you get people 1664.69s - 1672.77s | like really, you know, taking it and speaking to it. It's good. I'm very happy. Um, all right, let's 1672.77s - 1678.85s | keep moving along. Next up, we have the pony for most underhyped research being presented by 1678.85s - 1686.37s | Ong Kwee, the CEO of RedBlue Insecurity and one of our sponsors. All right, all right. I am Ong 1686.37s - 1694.05s | and, um, this is the award for the best research, right? No, it's the most underrated research. Um, 1694.05s - 1700.61s | as a recipient of, of this years and years ago, I have some things to say, but in the audience, 1700.61s - 1707.62s | show of hands, has anyone else received this award in the past? Nope. We all work at Wendy's. We got 1707.62s - 1713.54s | jobs, you losers. All right. Um, so some of the things that I want to, you know, for example, I 1713.54s - 1717.94s | want to give examples of really innovative, impactful things that have changed our lives 1718.50s - 1724.82s | that most of us don't even care or know about. So I was reading this paper that is also very 1724.82s - 1731.94s | underrated. It's the breeding behavior of blind Mexican cave fish, uh, in river dwelling cavities 1731.94s - 1737.06s | of, of types, right? That's important. That's literally going to change the world and stuff. 1737.06s - 1743.46s | Um, some other examples, Gregor Mandel, right? He like made peas, you know, do their business, 1743.46s - 1750.58s | uh, and created the theory behind genetics and hybridization. Awesome, important work. Uh, people 1750.58s - 1756.90s | gave him a high five for that 16 years after he died. So, you know, there's always something to 1756.90s - 1762.18s | look forward to. And then, uh, you know, not all, well, also the plate tectonics, right? Remember 1762.18s


chunk_id: 172_chunk_23
chunk_text:
this award in the past? Nope. We all work at Wendy's. We got 1707.62s - 1713.54s | jobs, you losers. All right. Um, so some of the things that I want to, you know, for example, I 1713.54s - 1717.94s | want to give examples of really innovative, impactful things that have changed our lives 1718.50s - 1724.82s | that most of us don't even care or know about. So I was reading this paper that is also very 1724.82s - 1731.94s | underrated. It's the breeding behavior of blind Mexican cave fish, uh, in river dwelling cavities 1731.94s - 1737.06s | of, of types, right? That's important. That's literally going to change the world and stuff. 1737.06s - 1743.46s | Um, some other examples, Gregor Mandel, right? He like made peas, you know, do their business, 1743.46s - 1750.58s | uh, and created the theory behind genetics and hybridization. Awesome, important work. Uh, people 1750.58s - 1756.90s | gave him a high five for that 16 years after he died. So, you know, there's always something to 1756.90s - 1762.18s | look forward to. And then, uh, you know, not all, well, also the plate tectonics, right? Remember 1762.18s - 1768.90s | for the thousands of years, uh, 2000, a thousand people thought the world was always the way it is, 1768.90s - 1772.74s | even though, you know, even any five-year-old can look at like all the continents and say, like, 1772.74s - 1778.26s | if I squish them together, don't they all kind of fit? Right. So yeah, that was the paper that 1778.26s - 1788.58s | was written. Let me check in, uh, in 1596. And it was officially accepted in 1959 that plates move 1788.58s - 1795.14s | and the round thing, you know, they shift and there used to be Pangea, right? So, uh, last example, 1795.14s - 1802.58s | um, the wonderful man, very, very, very underrated, uh, Thomas Midgley, Midgley. Does anybody know who 1802.58s - 1809.14s | Thomas Midgley is? Show of hands. All right. Underrated indeed. This is a man in one decade 1809.14s - 1816.26s | invented leaded gasoline and chlorofluorocarbons, right? To make the world kick ass. So, you know, 1816.26s - 1823.22s | he's pretty underrated too, right? So in that context, um, let's look at some of the most 1823.22s - 1833.20s | underrated research of


chunk_id: 172_chunk_24
chunk_text:
- 1768.90s | for the thousands of years, uh, 2000, a thousand people thought the world was always the way it is, 1768.90s - 1772.74s | even though, you know, even any five-year-old can look at like all the continents and say, like, 1772.74s - 1778.26s | if I squish them together, don't they all kind of fit? Right. So yeah, that was the paper that 1778.26s - 1788.58s | was written. Let me check in, uh, in 1596. And it was officially accepted in 1959 that plates move 1788.58s - 1795.14s | and the round thing, you know, they shift and there used to be Pangea, right? So, uh, last example, 1795.14s - 1802.58s | um, the wonderful man, very, very, very underrated, uh, Thomas Midgley, Midgley. Does anybody know who 1802.58s - 1809.14s | Thomas Midgley is? Show of hands. All right. Underrated indeed. This is a man in one decade 1809.14s - 1816.26s | invented leaded gasoline and chlorofluorocarbons, right? To make the world kick ass. So, you know, 1816.26s - 1823.22s | he's pretty underrated too, right? So in that context, um, let's look at some of the most 1823.22s - 1833.20s | underrated research of this year. And finally, the nominees for most underhyped research. 1833.36s - 1840.16s | See no eval. Runtime dynamic code execution in Objective-C by CodeColorist. Highlighting 1840.16s - 1846.96s | a technique for dynamic code execution in Objective-C used in several iOS exploits since 2021. 1848.72s - 1856.08s | Dangerous import. SourceForge patches. Critical code vulnerability by Scry. Vulnerability in 1856.08s - 1861.20s | Apache Allura. Potentially compromising SourceForge and spreading malware to millions of users. 1862.00s - 1871.04s | Flexo by Ping-Lun Wang, Ricardo Paganiella, Riyadh Wabai, and Fraser Brown. Showcasing a 1871.04s - 1878.16s | binary unpacker operating within a microarchitectural weird machine making malware analysis significantly 1878.16s - 1889.65s | harder. All right. And uh, Pony goes to uh, ch-ch-ch-ch-ch-ch-ch-ch-ch-ch. One second, 1889.65s - 1894.65s | One second. One second. Uh, C, no, C, no eval. 1898.09s - 1904.70s | Runtime dynamic code execution. Objective C. Anybody? Uh, 1904.74s - 1908.78s | anybody here? Anybody here? Uh, bathroom? 1909.02s - 1912.06s | He's going to the bathroom. Yes. Yes. Oh my gosh. Let's go. 1914.41s - 1915.45s | What are you forgetting? 1917.01s - 1919.25s | No running at the pool, sir. Picture. Yeah. Yeah. Yeah. 1920.29s


chunk_id: 172_chunk_25
chunk_text:
this year. And finally, the nominees for most underhyped research. 1833.36s - 1840.16s | See no eval. Runtime dynamic code execution in Objective-C by CodeColorist. Highlighting 1840.16s - 1846.96s | a technique for dynamic code execution in Objective-C used in several iOS exploits since 2021. 1848.72s - 1856.08s | Dangerous import. SourceForge patches. Critical code vulnerability by Scry. Vulnerability in 1856.08s - 1861.20s | Apache Allura. Potentially compromising SourceForge and spreading malware to millions of users. 1862.00s - 1871.04s | Flexo by Ping-Lun Wang, Ricardo Paganiella, Riyadh Wabai, and Fraser Brown. Showcasing a 1871.04s - 1878.16s | binary unpacker operating within a microarchitectural weird machine making malware analysis significantly 1878.16s - 1889.65s | harder. All right. And uh, Pony goes to uh, ch-ch-ch-ch-ch-ch-ch-ch-ch-ch. One second, 1889.65s - 1894.65s | One second. One second. Uh, C, no, C, no eval. 1898.09s - 1904.70s | Runtime dynamic code execution. Objective C. Anybody? Uh, 1904.74s - 1908.78s | anybody here? Anybody here? Uh, bathroom? 1909.02s - 1912.06s | He's going to the bathroom. Yes. Yes. Oh my gosh. Let's go. 1914.41s - 1915.45s | What are you forgetting? 1917.01s - 1919.25s | No running at the pool, sir. Picture. Yeah. Yeah. Yeah. 1920.29s - 1923.41s | I think they're recording this, so it's all right. Come on. 1926.59s - 1929.11s | I'm not sure what order if you want to talk about it cause you're excited or 1929.11s - 1930.95s | you want to grab a pony. Yeah. Talk, talk, talk, go, go. 1931.43s - 1934.99s | Actually I'm taking it. I'm a friend of my behave. Yeah. 1934.99s - 1939.83s | They told you the Georgia win the award and I'm taking it on and behave of him. 1940.51s - 1945.51s | Yeah. Actually I was a previously winner in the 2022 and I'm taking this on 1947.75s - 1951.87s | behavioral with the, or my friend. Yeah. He win this. Congratulations to him. 1953.07s - 1955.03s | Yeah. Thank you. Thank you so much. 1955.15s - 1973.10s | Yeah. He also says, thanks mom. Thank you. All right. Thank you so much. 1973.34s - 1976.38s | That's another thing. Like I love it when like, you know, 1976.50s - 1978.30s | except on a friend's behalf, you know, 1979.06s - 1983.50s | make it so we don't have to mail a horse. Fun fact, um, 1983.54s - 1987.34s | designing these


chunk_id: 172_chunk_26
chunk_text:
- 1923.41s | I think they're recording this, so it's all right. Come on. 1926.59s - 1929.11s | I'm not sure what order if you want to talk about it cause you're excited or 1929.11s - 1930.95s | you want to grab a pony. Yeah. Talk, talk, talk, go, go. 1931.43s - 1934.99s | Actually I'm taking it. I'm a friend of my behave. Yeah. 1934.99s - 1939.83s | They told you the Georgia win the award and I'm taking it on and behave of him. 1940.51s - 1945.51s | Yeah. Actually I was a previously winner in the 2022 and I'm taking this on 1947.75s - 1951.87s | behavioral with the, or my friend. Yeah. He win this. Congratulations to him. 1953.07s - 1955.03s | Yeah. Thank you. Thank you so much. 1955.15s - 1973.10s | Yeah. He also says, thanks mom. Thank you. All right. Thank you so much. 1973.34s - 1976.38s | That's another thing. Like I love it when like, you know, 1976.50s - 1978.30s | except on a friend's behalf, you know, 1979.06s - 1983.50s | make it so we don't have to mail a horse. Fun fact, um, 1983.54s - 1987.34s | designing these things. So, uh, these were all manufactured, 1987.50s - 1991.58s | certainly not using any type of child labor and a undisclosed basement in the DC 1991.58s - 1995.66s | metro area. Um, paint fumes, uh, 1996.66s - 2000.50s | the, um, I'm in New York. 2001.86s - 2004.34s | Have you ever had to buy 11 my little ponies off Amazon? 2005.42s - 2009.58s | Do you know what that does to your ad targeting? I do. 2009.94s - 2014.58s | It's not great. Um, uh, and then the, the best part was, uh, 2014.62s - 2016.78s | I taking all of them and shoving 11, 2016.78s - 2020.42s | my little ponies into a backpack and then taking the train down cause I really 2020.42s - 2023.38s | didn't want to explain it to a TSA agent. Uh, 2023.78s - 2027.54s | but you get a really weird thrill just thinking like nobody on this train knows I 2027.54s - 2032.34s | have 11 my little pony horses in my backpack right now up until 2032.82s - 2036.58s | they were buying podiums for it and demanded that I open it up and pull one out 2036.58s -


chunk_id: 172_chunk_27
chunk_text:
things. So, uh, these were all manufactured, 1987.50s - 1991.58s | certainly not using any type of child labor and a undisclosed basement in the DC 1991.58s - 1995.66s | metro area. Um, paint fumes, uh, 1996.66s - 2000.50s | the, um, I'm in New York. 2001.86s - 2004.34s | Have you ever had to buy 11 my little ponies off Amazon? 2005.42s - 2009.58s | Do you know what that does to your ad targeting? I do. 2009.94s - 2014.58s | It's not great. Um, uh, and then the, the best part was, uh, 2014.62s - 2016.78s | I taking all of them and shoving 11, 2016.78s - 2020.42s | my little ponies into a backpack and then taking the train down cause I really 2020.42s - 2023.38s | didn't want to explain it to a TSA agent. Uh, 2023.78s - 2027.54s | but you get a really weird thrill just thinking like nobody on this train knows I 2027.54s - 2032.34s | have 11 my little pony horses in my backpack right now up until 2032.82s - 2036.58s | they were buying podiums for it and demanded that I open it up and pull one out 2036.58s - 2040.82s | and start measuring it on the train, which I had to do. So thanks guys. 2042.06s - 2044.50s | All right. Um, moving right along. 2044.50s - 2047.94s | We have the pony for best privilege escalation being presented by Nika. 2057.00s - 2057.84s | Hi Defcon. 2058.84s - 2060.40s | Standing here today, 2060.48s - 2064.24s | I feel very privileged to present this category, 2064.92s - 2068.24s | but it's this category that takes that to a new level, 2068.56s - 2070.88s | a level we're told we're not allowed to reach, 2071.52s - 2076.36s | but rules are for suckers and this year's nominees are rule breakers. 2077.76s - 2080.68s | Privilege escalation. There we go. 2081.48s - 2085.60s | Privilege escalation is an exploitation technique that is used to gain access to 2085.60s - 2089.28s | resources or functionality. A user should be restricted from accessing. 2090.04s - 2093.88s | It's like when you make friends with the bouncer and cut the line at Burkheim. 2095.36s - 2096.20s | Yeah. 2097.28s - 2102.28s | The bouncer is the trust boundary and you and your crew look at each other and go 2103.12s - 2104.56s


chunk_id: 172_chunk_28
chunk_text:
2040.82s | and start measuring it on the train, which I had to do. So thanks guys. 2042.06s - 2044.50s | All right. Um, moving right along. 2044.50s - 2047.94s | We have the pony for best privilege escalation being presented by Nika. 2057.00s - 2057.84s | Hi Defcon. 2058.84s - 2060.40s | Standing here today, 2060.48s - 2064.24s | I feel very privileged to present this category, 2064.92s - 2068.24s | but it's this category that takes that to a new level, 2068.56s - 2070.88s | a level we're told we're not allowed to reach, 2071.52s - 2076.36s | but rules are for suckers and this year's nominees are rule breakers. 2077.76s - 2080.68s | Privilege escalation. There we go. 2081.48s - 2085.60s | Privilege escalation is an exploitation technique that is used to gain access to 2085.60s - 2089.28s | resources or functionality. A user should be restricted from accessing. 2090.04s - 2093.88s | It's like when you make friends with the bouncer and cut the line at Burkheim. 2095.36s - 2096.20s | Yeah. 2097.28s - 2102.28s | The bouncer is the trust boundary and you and your crew look at each other and go 2103.12s - 2104.56s | low. We're going in anyway. 2106.24s - 2110.88s | It's about saying fuck you and showing that your ex boy is sicker than whatever 2110.88s - 2112.96s | code the devs push to prod. 2113.08s - 2113.92s | Yeah. 2114.64s - 2118.52s | Privilege escalation is about breaking into spaces where the doors are locked. 2118.72s - 2123.04s | The glass ceiling feels stratospherically high and the guards are ruthless. 2124.12s - 2126.92s | In the Olympics, people always want to reach the next level, 2127.52s - 2129.52s | earn the privilege of a gold medal. 2130.32s - 2133.04s | Here we have people who can cheat the best, 2133.36s - 2135.60s | whisper the best incantations, 2136.00s - 2137.48s | cast the best spells. 2138.36s - 2142.72s | This category is for those who put in the best effort to slide the scale in 2142.76s - 2147.76s | their favor for best privilege escalation for staying lifted by any means 2148.16s - 2150.44s | possible. Scored on style. 2151.88s - 2156.40s | I'm going to defer to the artist known as D noise for some spiritually 2156.40s - 2159.96s | enlightening verse on the hollow topic of per


chunk_id: 172_chunk_29
chunk_text:
| low. We're going in anyway. 2106.24s - 2110.88s | It's about saying fuck you and showing that your ex boy is sicker than whatever 2110.88s - 2112.96s | code the devs push to prod. 2113.08s - 2113.92s | Yeah. 2114.64s - 2118.52s | Privilege escalation is about breaking into spaces where the doors are locked. 2118.72s - 2123.04s | The glass ceiling feels stratospherically high and the guards are ruthless. 2124.12s - 2126.92s | In the Olympics, people always want to reach the next level, 2127.52s - 2129.52s | earn the privilege of a gold medal. 2130.32s - 2133.04s | Here we have people who can cheat the best, 2133.36s - 2135.60s | whisper the best incantations, 2136.00s - 2137.48s | cast the best spells. 2138.36s - 2142.72s | This category is for those who put in the best effort to slide the scale in 2142.76s - 2147.76s | their favor for best privilege escalation for staying lifted by any means 2148.16s - 2150.44s | possible. Scored on style. 2151.88s - 2156.40s | I'm going to defer to the artist known as D noise for some spiritually 2156.40s - 2159.96s | enlightening verse on the hollow topic of per desk. 2163.80s - 2165.76s | When I'm told I'm offensive, 2166.16s - 2170.72s | I need to check my privilege and T authority system. 2171.68s - 2174.12s | Here are the nominees for best progress. 2174.88s - 2184.61s | And now the nominees for best privilege escalation, 2185.33s - 2192.31s | unplugging XHCI and enabling step on the road to VMware VM 2192.31s - 2197.31s | escape by Victor V detailing a successful VMware workstation escape exploit 2198.55s - 2203.55s | from the TN for cup 2023 by removing the XHCI USB controller within the virtual 2205.03s - 2208.39s | machine, triggering a use after free vulnerability. 2209.79s - 2213.11s | A registry window to kernel memory by M jerk sick, 2214.27s - 2217.43s | highlighting memory corruption in windows registry handling, 2217.91s - 2222.51s | providing direct access to kernel memory and turning rigid eat into a kernel 2222.51s - 2223.35s | memory editor. 2224.79s - 2229.79s | Windows streaming service UAF used at home to own Vancouver by chompy, 2230.55s - 2234.91s | exploiting an improper object reference count update in the Microsoft kernel 2234.91s - 2235.75s | streaming server, 2236.19s - 2241.19s | causing a use after


chunk_id: 172_chunk_30
chunk_text:
desk. 2163.80s - 2165.76s | When I'm told I'm offensive, 2166.16s - 2170.72s | I need to check my privilege and T authority system. 2171.68s - 2174.12s | Here are the nominees for best progress. 2174.88s - 2184.61s | And now the nominees for best privilege escalation, 2185.33s - 2192.31s | unplugging XHCI and enabling step on the road to VMware VM 2192.31s - 2197.31s | escape by Victor V detailing a successful VMware workstation escape exploit 2198.55s - 2203.55s | from the TN for cup 2023 by removing the XHCI USB controller within the virtual 2205.03s - 2208.39s | machine, triggering a use after free vulnerability. 2209.79s - 2213.11s | A registry window to kernel memory by M jerk sick, 2214.27s - 2217.43s | highlighting memory corruption in windows registry handling, 2217.91s - 2222.51s | providing direct access to kernel memory and turning rigid eat into a kernel 2222.51s - 2223.35s | memory editor. 2224.79s - 2229.79s | Windows streaming service UAF used at home to own Vancouver by chompy, 2230.55s - 2234.91s | exploiting an improper object reference count update in the Microsoft kernel 2234.91s - 2235.75s | streaming server, 2236.19s - 2241.19s | causing a use after free for a virtual table call earning $15,000 at the 2241.23s - 2242.07s | competition. 2246.14s - 2257.30s | And the pony goes to chompy for windows streaming service. 2275.78s - 2278.10s | Okay. I don't have anything prepared. Uh, 2279.22s - 2282.34s | didn't even know if I was going to come. I, uh, 2282.98s - 2286.78s | I don't know who decided to make this at 10am on Saturday after Defcon, 2286.78s - 2290.74s | but I'm here a little underdressed. Everyone looks amazing. Um, 2291.10s - 2295.66s | don't have that much to say other than I'm super grateful for my, uh, 2295.70s - 2300.22s | management and my team that support me and allowing me to do public research. 2300.26s - 2303.54s | I know that's not a common thing. So I get to share, uh, 2303.54s - 2308.54s | all my work publicly and a shout out to the other people that were nominated. 2308.82s - 2313.02s | Victor V and drew were legends, uh, stiff competition. 2313.34s - 2317.86s | And also to, uh, my husband that puts up with me when I don't, 2317.94s - 2320.14s | on the days I don't find


chunk_id: 172_chunk_31
chunk_text:
free for a virtual table call earning $15,000 at the 2241.23s - 2242.07s | competition. 2246.14s - 2257.30s | And the pony goes to chompy for windows streaming service. 2275.78s - 2278.10s | Okay. I don't have anything prepared. Uh, 2279.22s - 2282.34s | didn't even know if I was going to come. I, uh, 2282.98s - 2286.78s | I don't know who decided to make this at 10am on Saturday after Defcon, 2286.78s - 2290.74s | but I'm here a little underdressed. Everyone looks amazing. Um, 2291.10s - 2295.66s | don't have that much to say other than I'm super grateful for my, uh, 2295.70s - 2300.22s | management and my team that support me and allowing me to do public research. 2300.26s - 2303.54s | I know that's not a common thing. So I get to share, uh, 2303.54s - 2308.54s | all my work publicly and a shout out to the other people that were nominated. 2308.82s - 2313.02s | Victor V and drew were legends, uh, stiff competition. 2313.34s - 2317.86s | And also to, uh, my husband that puts up with me when I don't, 2317.94s - 2320.14s | on the days I don't find bugs. So. 2320.74s - 2321.58s | Thank you. 2338.31s - 2342.83s | Thank you so much. Chompy. Um, all right. 2342.99s - 2344.95s | I could tell there was a crowd favorite out there too. 2345.07s - 2349.55s | Like you guys kind of lay your souls away. Um, let's see. 2349.55s - 2354.27s | Next up we have the pony award for best remote code execution being presented by 2354.27s - 2355.11s | Ryan again. 2361.74s - 2367.99s | I'm so glad this is still a category as well. And I'm told I can't say much. 2368.03s - 2373.03s | So there's all types of RC and there were a lot of logic and web app bypasses 2373.63s - 2378.39s | this year. And a lot of people asked me, do those count yet? Yes. 2378.39s - 2381.91s | They're remotes. That's fine. But we also, um, 2381.95s - 2385.67s | all too often talk about web drive buys and zero and one clicks. 2385.67s - 2390.47s | And this year we had a lot of nominations that luckily took advantage of things 2390.47s - 2394.47s | like exchange and just parked it in your inbox and let the


chunk_id: 172_chunk_32
chunk_text:
bugs. So. 2320.74s - 2321.58s | Thank you. 2338.31s - 2342.83s | Thank you so much. Chompy. Um, all right. 2342.99s - 2344.95s | I could tell there was a crowd favorite out there too. 2345.07s - 2349.55s | Like you guys kind of lay your souls away. Um, let's see. 2349.55s - 2354.27s | Next up we have the pony award for best remote code execution being presented by 2354.27s - 2355.11s | Ryan again. 2361.74s - 2367.99s | I'm so glad this is still a category as well. And I'm told I can't say much. 2368.03s - 2373.03s | So there's all types of RC and there were a lot of logic and web app bypasses 2373.63s - 2378.39s | this year. And a lot of people asked me, do those count yet? Yes. 2378.39s - 2381.91s | They're remotes. That's fine. But we also, um, 2381.95s - 2385.67s | all too often talk about web drive buys and zero and one clicks. 2385.67s - 2390.47s | And this year we had a lot of nominations that luckily took advantage of things 2390.47s - 2394.47s | like exchange and just parked it in your inbox and let the computer click it over 2394.47s - 2396.31s | and over and over for you. 2397.87s - 2402.51s | And then we of course had nominations of the classic patterns and everyone made 2402.51s - 2403.95s | sure this year, again, 2403.95s - 2408.95s | thank you to the community for leaving in buffer overflows use after freeze. 2409.67s - 2414.11s | We and the nominees appreciate your dedication to these patterns. 2415.31s - 2417.87s | Otherwise this could get boring or more interesting. 2418.31s - 2419.91s | So now let's see for the nominees. 2421.59s - 2425.71s | Next up here are the nominees for best remote code execution. 2428.30s - 2433.18s | Jump server pre-auth RCE exploit full chain by Lolliot and Jin Yang Peng. 2434.10s - 2438.50s | Exploiting insecure random number logic in Python to achieve authentication 2438.50s - 2441.50s | bypass resulting in pre-auth RCE. 2442.78s - 2447.78s | Half measures and full compromise chain of three vulnerabilities to PwnExchange 2448.42s - 2449.58s | by Piotr Bazidlo. 2450.66s - 2455.66s | This Microsoft exchange RCE chain consists of three vulnerabilities enabling 2455.86s - 2457.98s | RCE by any domain user. 2458.78s - 2463.78s | The overlooked


chunk_id: 172_chunk_33
chunk_text:
computer click it over 2394.47s - 2396.31s | and over and over for you. 2397.87s - 2402.51s | And then we of course had nominations of the classic patterns and everyone made 2402.51s - 2403.95s | sure this year, again, 2403.95s - 2408.95s | thank you to the community for leaving in buffer overflows use after freeze. 2409.67s - 2414.11s | We and the nominees appreciate your dedication to these patterns. 2415.31s - 2417.87s | Otherwise this could get boring or more interesting. 2418.31s - 2419.91s | So now let's see for the nominees. 2421.59s - 2425.71s | Next up here are the nominees for best remote code execution. 2428.30s - 2433.18s | Jump server pre-auth RCE exploit full chain by Lolliot and Jin Yang Peng. 2434.10s - 2438.50s | Exploiting insecure random number logic in Python to achieve authentication 2438.50s - 2441.50s | bypass resulting in pre-auth RCE. 2442.78s - 2447.78s | Half measures and full compromise chain of three vulnerabilities to PwnExchange 2448.42s - 2449.58s | by Piotr Bazidlo. 2450.66s - 2455.66s | This Microsoft exchange RCE chain consists of three vulnerabilities enabling 2455.86s - 2457.98s | RCE by any domain user. 2458.78s - 2463.78s | The overlooked pattern path to pre-auth RCE by root OX Koshell a critical 2464.90s - 2469.26s | pre-authenticated remote code execution vulnerability affecting all windows 2469.26s - 2474.26s | versions from server 2008 to server 2022 and windows 10 and 11. 2479.41s - 2483.93s | So the pony for best remote code execution goes to, 2483.93s - 2488.93s | let's see root OX Koshell for the overlooked pattern CVE 2024 380 path to 2491.73s - 2493.21s | pre-auth RCE. 2499.98s - 2503.66s | I stopped using it. Are we back now? Okay. I stopped using it so I don't blame them. 2503.70s - 2506.82s | Um, the, are you here? No, 2506.86s - 2509.54s | that's maybe good because we're running short on time. All right, 2509.54s - 2517.18s | let's move right along. We'll send it over to them. All right. 2517.18s - 2520.74s | Next up for the lamest vendor response, we have Winona. 2524.89s - 2527.17s | Hey, what's up guys? Um, my name is Winona. 2527.17s - 2531.45s | I'm a former reverse engineer now in law school, but I am not anyone's lawyer yet. 2531.93s - 2536.93s | Um, don't, don't tell me all the shit you


chunk_id: 172_chunk_34
chunk_text:
pattern path to pre-auth RCE by root OX Koshell a critical 2464.90s - 2469.26s | pre-authenticated remote code execution vulnerability affecting all windows 2469.26s - 2474.26s | versions from server 2008 to server 2022 and windows 10 and 11. 2479.41s - 2483.93s | So the pony for best remote code execution goes to, 2483.93s - 2488.93s | let's see root OX Koshell for the overlooked pattern CVE 2024 380 path to 2491.73s - 2493.21s | pre-auth RCE. 2499.98s - 2503.66s | I stopped using it. Are we back now? Okay. I stopped using it so I don't blame them. 2503.70s - 2506.82s | Um, the, are you here? No, 2506.86s - 2509.54s | that's maybe good because we're running short on time. All right, 2509.54s - 2517.18s | let's move right along. We'll send it over to them. All right. 2517.18s - 2520.74s | Next up for the lamest vendor response, we have Winona. 2524.89s - 2527.17s | Hey, what's up guys? Um, my name is Winona. 2527.17s - 2531.45s | I'm a former reverse engineer now in law school, but I am not anyone's lawyer yet. 2531.93s - 2536.93s | Um, don't, don't tell me all the shit you do Ian. Um, so first off, um, 2537.25s - 2540.57s | I have the distinct pleasure of introducing the lamest vendor response. 2540.77s - 2543.33s | Although I do want to say thank you guys all for coming. 2543.53s - 2545.53s | Like the hacker community is so wonderful. 2545.53s - 2549.69s | Like who else is going to come all the way out to the devil's armpit of America 2550.01s - 2554.77s | and go party all night and then show up at 10 AM for an award show with people 2554.77s - 2558.69s | who are as hungover as you guys are. Um, so, uh, 2558.73s - 2561.45s | there's also Gatorades up here if y'all want them. Uh, 2561.45s - 2566.45s | I brought some of them just for you. Um, on the lamest vendor response, 2566.53s - 2570.65s | the reason why we give this award out is that when a company makes business 2570.65s - 2574.53s | decisions that runs against the hacker ethos, we want to call that out. 2574.69s - 2576.33s | Things that are damaging, 2576.49s - 2580.97s | things that actively result in us having to clean up their stuff or


chunk_id: 172_chunk_35
chunk_text:
do Ian. Um, so first off, um, 2537.25s - 2540.57s | I have the distinct pleasure of introducing the lamest vendor response. 2540.77s - 2543.33s | Although I do want to say thank you guys all for coming. 2543.53s - 2545.53s | Like the hacker community is so wonderful. 2545.53s - 2549.69s | Like who else is going to come all the way out to the devil's armpit of America 2550.01s - 2554.77s | and go party all night and then show up at 10 AM for an award show with people 2554.77s - 2558.69s | who are as hungover as you guys are. Um, so, uh, 2558.73s - 2561.45s | there's also Gatorades up here if y'all want them. Uh, 2561.45s - 2566.45s | I brought some of them just for you. Um, on the lamest vendor response, 2566.53s - 2570.65s | the reason why we give this award out is that when a company makes business 2570.65s - 2574.53s | decisions that runs against the hacker ethos, we want to call that out. 2574.69s - 2576.33s | Things that are damaging, 2576.49s - 2580.97s | things that actively result in us having to clean up their stuff or even just 2580.97s - 2585.77s | things that are just in poor form. Um, that being said, uh, you know, 2585.77s - 2587.61s | it says, Hey guys, not cool. 2587.61s - 2590.33s | And it hopefully will pressure them to change their habits a little bit. 2590.85s - 2593.69s | Of course the hacker community is super diverse. 2593.73s - 2597.89s | We have a lot of different opinions and if you don't agree with some of the 2597.89s - 2601.29s | nominees up here, I truly hope that we hear from you next year. 2601.41s - 2605.25s | Please tell us who you think your lamest vendor is and we will gladly bring them 2605.25s - 2613.21s | up here. Um, so now let's hear the nominees. Hit what? Arrow? Okay. 2615.24s - 2622.74s | The nominees for lamest vendor response are Linux CVE CNA, 2623.46s - 2628.26s | the Linux kernel team is giving every bug CVE, not just the vulnerabilities. 2628.82s - 2633.86s | What could go wrong? Xiaomi's pwn2own infrastructure fail. 2634.66s - 2637.06s | Xiaomi disabled parts of its infrastructure, 2637.38s - 2641.54s | including its global app store to stop pwn2own contestants from


chunk_id: 172_chunk_36
chunk_text:
even just 2580.97s - 2585.77s | things that are just in poor form. Um, that being said, uh, you know, 2585.77s - 2587.61s | it says, Hey guys, not cool. 2587.61s - 2590.33s | And it hopefully will pressure them to change their habits a little bit. 2590.85s - 2593.69s | Of course the hacker community is super diverse. 2593.73s - 2597.89s | We have a lot of different opinions and if you don't agree with some of the 2597.89s - 2601.29s | nominees up here, I truly hope that we hear from you next year. 2601.41s - 2605.25s | Please tell us who you think your lamest vendor is and we will gladly bring them 2605.25s - 2613.21s | up here. Um, so now let's hear the nominees. Hit what? Arrow? Okay. 2615.24s - 2622.74s | The nominees for lamest vendor response are Linux CVE CNA, 2623.46s - 2628.26s | the Linux kernel team is giving every bug CVE, not just the vulnerabilities. 2628.82s - 2633.86s | What could go wrong? Xiaomi's pwn2own infrastructure fail. 2634.66s - 2637.06s | Xiaomi disabled parts of its infrastructure, 2637.38s - 2641.54s | including its global app store to stop pwn2own contestants from honing. 2643.02s - 2647.74s | Kaspersky antivirus trying to claim a bug bounty from Apple for triangulation. 2648.22s - 2651.98s | Can't pay out sanctioned entities, guys. Sorry. Sucks to suck. 2654.48s - 2659.48s | And the pony award goes to Xiaomi for their pwn2own infrastructure fail. 2664.24s - 2668.40s | Come on up, please. No, nobody. 2668.64s - 2670.80s | Nobody. All right. We're really running low on time, 2670.80s - 2672.40s | so we're just going to keep moving. 2673.16s - 2676.48s | All right. I also have the distinct honor. Yeah, it's me again. Uh, 2676.48s - 2681.24s | I also have the distinct honor of giving out the Epic achievement award. Um, 2681.28s - 2682.12s | which again, 2682.64s - 2686.40s | this is such an awesome group of people and we're all out here trying to do the 2686.40s - 2690.72s | best that we can, uh, to protect or not. And, um, 2691.52s - 2693.84s | what? Oh, we're gonna, we're just gonna move it. 2695.16s - 2697.40s | Here are the nominees for Epic achievement. 2701.10s - 2704.46s | Discovery of the XZ backdoor by Andres Freund. 2705.30s - 2709.62s | Discover the


chunk_id: 172_chunk_37
chunk_text:
honing. 2643.02s - 2647.74s | Kaspersky antivirus trying to claim a bug bounty from Apple for triangulation. 2648.22s - 2651.98s | Can't pay out sanctioned entities, guys. Sorry. Sucks to suck. 2654.48s - 2659.48s | And the pony award goes to Xiaomi for their pwn2own infrastructure fail. 2664.24s - 2668.40s | Come on up, please. No, nobody. 2668.64s - 2670.80s | Nobody. All right. We're really running low on time, 2670.80s - 2672.40s | so we're just going to keep moving. 2673.16s - 2676.48s | All right. I also have the distinct honor. Yeah, it's me again. Uh, 2676.48s - 2681.24s | I also have the distinct honor of giving out the Epic achievement award. Um, 2681.28s - 2682.12s | which again, 2682.64s - 2686.40s | this is such an awesome group of people and we're all out here trying to do the 2686.40s - 2690.72s | best that we can, uh, to protect or not. And, um, 2691.52s - 2693.84s | what? Oh, we're gonna, we're just gonna move it. 2695.16s - 2697.40s | Here are the nominees for Epic achievement. 2701.10s - 2704.46s | Discovery of the XZ backdoor by Andres Freund. 2705.30s - 2709.62s | Discover the backdoor in XZ oodles while troubleshooting performance issues, 2709.98s - 2714.06s | ultimately saving several Linux distros. Windows downdate, 2714.38s - 2718.18s | downgrade attacks using windows updates by Alon Leviev. 2718.94s - 2723.38s | Uncovered a critical flaw in windows updates that allows attackers to downgrade 2723.38s - 2727.78s | files, enabling privilege escalation and disabling VBS. 2728.66s - 2731.86s | Flexo by Ping Lun Wang, Ricardo Pacaniela, 2732.18s - 2734.66s | Riyad S. Wabi and Fraser Brown. 2735.50s - 2740.30s | Showcasing a binary unpacker operating within a micro architectural weird 2740.30s - 2743.74s | machine, making malware analysis significantly harder. 2745.98s - 2750.02s | And the most Epic achievement award of the ponies goes to Andres Freund for the 2750.02s - 2752.10s | discovery of the XZ backdoor. 2756.23s - 2759.83s | I really hope you would be here cause I really like this work. Uh, by the way, 2760.35s - 2762.39s | um, honorable shout out to the windows downdate guys. 2762.39s - 2765.99s | I like was really actually pretty cool research. Um, 2766.99s - 2771.99s | uh, okay. So, um, we are getting towards the end. Uh, 2772.67s - 2776.99s | we don't always


chunk_id: 172_chunk_38
chunk_text:
backdoor in XZ oodles while troubleshooting performance issues, 2709.98s - 2714.06s | ultimately saving several Linux distros. Windows downdate, 2714.38s - 2718.18s | downgrade attacks using windows updates by Alon Leviev. 2718.94s - 2723.38s | Uncovered a critical flaw in windows updates that allows attackers to downgrade 2723.38s - 2727.78s | files, enabling privilege escalation and disabling VBS. 2728.66s - 2731.86s | Flexo by Ping Lun Wang, Ricardo Pacaniela, 2732.18s - 2734.66s | Riyad S. Wabi and Fraser Brown. 2735.50s - 2740.30s | Showcasing a binary unpacker operating within a micro architectural weird 2740.30s - 2743.74s | machine, making malware analysis significantly harder. 2745.98s - 2750.02s | And the most Epic achievement award of the ponies goes to Andres Freund for the 2750.02s - 2752.10s | discovery of the XZ backdoor. 2756.23s - 2759.83s | I really hope you would be here cause I really like this work. Uh, by the way, 2760.35s - 2762.39s | um, honorable shout out to the windows downdate guys. 2762.39s - 2765.99s | I like was really actually pretty cool research. Um, 2766.99s - 2771.99s | uh, okay. So, um, we are getting towards the end. Uh, 2772.67s - 2776.99s | we don't always give out, uh, this award, 2777.03s - 2780.07s | but due to extenuating circumstances, um, 2780.51s - 2785.51s | this year we are giving out a pony awards, lifetime achievement award. Uh, 2786.27s - 2794.80s | and we are giving it to Sophia Danton. Uh, 2796.32s - 2800.24s | many of you may be unaware, uh, but, uh, Sophia, uh, 2800.32s - 2802.92s | passed away earlier this year. Um, 2802.96s - 2806.56s | those of you familiar with the margin research or the pony awards are likely 2806.56s - 2810.96s | aware that it wasn't just me doing this these past few years as doing it with 2810.96s - 2815.72s | Sophia. Um, and I can confidently say that myself, the community, 2815.76s - 2818.60s | the country, and quite unironically, 2818.60s - 2823.12s | the world would be a worse place if not for what she achieved in her life. 2824.64s - 2827.00s | Uh, I can't talk about some of them, but, uh, 2827.00s - 2830.16s | the ones I can are too numerous to detail. So, uh, 2830.16s - 2833.64s | I will simply ask that you all take a lesson with you that I received


chunk_id: 172_chunk_39
chunk_text:
give out, uh, this award, 2777.03s - 2780.07s | but due to extenuating circumstances, um, 2780.51s - 2785.51s | this year we are giving out a pony awards, lifetime achievement award. Uh, 2786.27s - 2794.80s | and we are giving it to Sophia Danton. Uh, 2796.32s - 2800.24s | many of you may be unaware, uh, but, uh, Sophia, uh, 2800.32s - 2802.92s | passed away earlier this year. Um, 2802.96s - 2806.56s | those of you familiar with the margin research or the pony awards are likely 2806.56s - 2810.96s | aware that it wasn't just me doing this these past few years as doing it with 2810.96s - 2815.72s | Sophia. Um, and I can confidently say that myself, the community, 2815.76s - 2818.60s | the country, and quite unironically, 2818.60s - 2823.12s | the world would be a worse place if not for what she achieved in her life. 2824.64s - 2827.00s | Uh, I can't talk about some of them, but, uh, 2827.00s - 2830.16s | the ones I can are too numerous to detail. So, uh, 2830.16s - 2833.64s | I will simply ask that you all take a lesson with you that I received from her, 2834.08s - 2837.84s | which is to take care of each other and stay curious. Uh, 2838.16s - 2840.28s | so speaking of, uh, curiosity, 2840.32s - 2844.76s | here is a curious and delightful and smart, uh, individual. 2844.92s - 2848.72s | I'd like to welcome Sophia's sister and the president of margin research, 2848.72s - 2852.08s | Claudia Danton up to accept the lifetime achievement award. 2862.82s - 2866.58s | Thank you everyone. Um, I know we're running a little short on time, 2866.58s - 2871.42s | but I just wanted to thank everyone here at probably the 2871.42s - 2875.14s | largest conference I've been to in the last couple of months following my 2875.14s - 2877.50s | sister's death. Um, 2877.70s - 2882.34s | whether any of you knew her as Sophia, as Kalakwendi, um, 2882.38s - 2885.34s | through her work and hacking for soju, um, 2885.50s - 2889.66s | doing training with the folks at binary Ninja, um, 2889.86s - 2893.14s | or even her work on a lot of policy stuff. Um, 2893.66s - 2896.46s | she interacted with most, 2896.46s - 2899.86s | if not all elements of what this


chunk_id: 172_chunk_40
chunk_text:
from her, 2834.08s - 2837.84s | which is to take care of each other and stay curious. Uh, 2838.16s - 2840.28s | so speaking of, uh, curiosity, 2840.32s - 2844.76s | here is a curious and delightful and smart, uh, individual. 2844.92s - 2848.72s | I'd like to welcome Sophia's sister and the president of margin research, 2848.72s - 2852.08s | Claudia Danton up to accept the lifetime achievement award. 2862.82s - 2866.58s | Thank you everyone. Um, I know we're running a little short on time, 2866.58s - 2871.42s | but I just wanted to thank everyone here at probably the 2871.42s - 2875.14s | largest conference I've been to in the last couple of months following my 2875.14s - 2877.50s | sister's death. Um, 2877.70s - 2882.34s | whether any of you knew her as Sophia, as Kalakwendi, um, 2882.38s - 2885.34s | through her work and hacking for soju, um, 2885.50s - 2889.66s | doing training with the folks at binary Ninja, um, 2889.86s - 2893.14s | or even her work on a lot of policy stuff. Um, 2893.66s - 2896.46s | she interacted with most, 2896.46s - 2899.86s | if not all elements of what this conference stands for. 2900.10s - 2905.18s | And it's a great honor to be accepting this on her behalf. Um, 2905.26s - 2906.38s | thank you all very much. 2919.26s - 2924.30s | All right. Well, um, that's, uh, that's all folks. 2924.42s - 2928.82s | Uh, thank you so much for coming to the, uh, 2024 pony awards, 2929.54s - 2931.02s | uh, for you head out. 2931.02s - 2934.58s | I do really want to call out and thank, uh, our sponsors, 2934.62s - 2938.42s | margin research, red balloon security, and the summer con foundation, 2938.70s - 2942.70s | as well as the multitude of people who helped out. Uh, you know, folks, 2943.14s - 2947.94s | come on. Hey, come on. Heard, heard, heard the cats. Let's go. 2947.94s - 2950.86s | Alpha as well. Um, 2951.46s - 2955.50s | we've got a Neil Durkin, Claudia Danton, Mark Trump, or Dawn Bolsonaro, 2955.54s - 2960.06s | the entire pony awards construction crew, every presenter, uh, 2960.06s - 2964.74s | the nominees, the winners, uh, and honestly, most of all, 2964.78s - 2968.70s | all of you, uh, for coming out at 10 AM on a Saturday


chunk_id: 172_chunk_41
chunk_text:
conference stands for. 2900.10s - 2905.18s | And it's a great honor to be accepting this on her behalf. Um, 2905.26s - 2906.38s | thank you all very much. 2919.26s - 2924.30s | All right. Well, um, that's, uh, that's all folks. 2924.42s - 2928.82s | Uh, thank you so much for coming to the, uh, 2024 pony awards, 2929.54s - 2931.02s | uh, for you head out. 2931.02s - 2934.58s | I do really want to call out and thank, uh, our sponsors, 2934.62s - 2938.42s | margin research, red balloon security, and the summer con foundation, 2938.70s - 2942.70s | as well as the multitude of people who helped out. Uh, you know, folks, 2943.14s - 2947.94s | come on. Hey, come on. Heard, heard, heard the cats. Let's go. 2947.94s - 2950.86s | Alpha as well. Um, 2951.46s - 2955.50s | we've got a Neil Durkin, Claudia Danton, Mark Trump, or Dawn Bolsonaro, 2955.54s - 2960.06s | the entire pony awards construction crew, every presenter, uh, 2960.06s - 2964.74s | the nominees, the winners, uh, and honestly, most of all, 2964.78s - 2968.70s | all of you, uh, for coming out at 10 AM on a Saturday DEF CON. 2970.18s - 2974.02s | Uh, so thank you so much. We hope to see you next year. Have a good DEF CON.


chunk_id: 172_chunk_42
chunk_text:
DEF CON. 2970.18s - 2974.02s | Uh, so thank you so much. We hope to see you next year. Have a good DEF CON.


chunk_id: 173_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=dLOUzF6_Y54", "title": "DEF CON 32 - Behind Enemy Lines: Going undercover to breach LockBit Ransomware Op- Jon DiMaggio", "description": "Delve into the clandestine world of the LockBit ransomware gang! In this revealing presentation, I will recount my two-year journey spent infiltrating the inner ranks of the LockBit crime syndicate. Learn about the strategies employed to earn the trust of key individuals within the syndicate, including the gang's leader, LockBitSupp.\n\nYou will see firsthand accounts of these exchanges, and I will detail the intricacies of my relationship with LockBit's leadership and its network of affiliate hackers. You will also gain insight into the unintended consequences of my actions, including how my perceived breach of their infrastructure impacted the syndicate's operations. More importantly, I will share how I assisted in unmasking the real-world person behind the mask of LockBitSupp.\n\nJoin me as I illustrate the pivotal role of human intelligence in tandem with cyber threat intelligence to combat ransomware threats. This talk offers a compelling narrative of real-world efforts to thwart ransomware activities and safeguard organizations from LockBit ransomware attacks.\n\n60 min (full episode): 4/14/2024: Scattered Spider; Knife; Tasmanian Tiger - CBS News\n60 Min Overtime (additional footage from my interview about LockBit): Infiltrating ransomware gangs on the dark web - CBS News\nRansomware Diaries\nRansomware Diaries: Volume 1 | Analyst1\nRansomware Diaries V. 2: A Ransomware Hacker Origin Story (analyst1.com)\nRansomware Diaries V. 3: LockBit's Secrets (analyst1.com)\nRansomware Diaries Volume 5: Unmasking LockBit (analyst1.com)", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2180, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.26s | This text was transcribed using whisper model: large-v2 All right. 2.26s - 4.40s | OSI model troubleshooting. 4.40s - 7.40s | It's always physical layer. 7.40s - 9.56s | So I wasn't planning on giving an intro, 9.56s - 10.74s | but I'm going to do that. 10.74s - 15.40s | It's an honor to intro my friend John DiMaggio with AnalystOne. 15.40s - 17.80s | Most of you probably are here because you've 17.80s - 19.84s | read some of the work he has done, 19.84s - 22.72s | either his book, The Art of Cyberwarfare, 22.72s - 25.36s | or the Ransomware Diaries series that's 25.36s - 28.32s | pretty popular that sort of culminated in this talk. 28.32s - 30.12s | This is his first DEF CON talk. 30.12s - 31.92s | It's way overdue. 31.92s - 34.80s | He's one of the top cyber espionage


chunk_id: 173_chunk_1
chunk_text:
ransomware gangs on the dark web - CBS News\nRansomware Diaries\nRansomware Diaries: Volume 1 | Analyst1\nRansomware Diaries V. 2: A Ransomware Hacker Origin Story (analyst1.com)\nRansomware Diaries V. 3: LockBit's Secrets (analyst1.com)\nRansomware Diaries Volume 5: Unmasking LockBit (analyst1.com)", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2180, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.26s | This text was transcribed using whisper model: large-v2 All right. 2.26s - 4.40s | OSI model troubleshooting. 4.40s - 7.40s | It's always physical layer. 7.40s - 9.56s | So I wasn't planning on giving an intro, 9.56s - 10.74s | but I'm going to do that. 10.74s - 15.40s | It's an honor to intro my friend John DiMaggio with AnalystOne. 15.40s - 17.80s | Most of you probably are here because you've 17.80s - 19.84s | read some of the work he has done, 19.84s - 22.72s | either his book, The Art of Cyberwarfare, 22.72s - 25.36s | or the Ransomware Diaries series that's 25.36s - 28.32s | pretty popular that sort of culminated in this talk. 28.32s - 30.12s | This is his first DEF CON talk. 30.12s - 31.92s | It's way overdue. 31.92s - 34.80s | He's one of the top cyber espionage practitioners 34.80s - 36.00s | on the planet. 36.00s - 38.22s | And with that, I'll turn it over to John. 38.22s - 38.92s | Here you go, man. 38.92s - 39.42s | Thanks, man. 39.42s - 40.40s | Appreciate you, brother. 44.82s - 45.86s | Thank you. 45.86s - 47.62s | Where there's a will, there's a way. 47.62s - 48.86s | I'm glad we got this started. 48.86s - 50.62s | Let me get this mic adjusted. 50.62s - 51.22s | All right. 51.22s - 52.90s | Everybody hear me? 52.90s - 53.78s | All right. 53.78s - 55.14s | Well, hear what he said in my name. 55.14s - 56.06s | Yep, I'm an author. 56.06s - 56.94s | That's all great. 56.94s - 58.90s | I'm not here to talk to you about that today. 58.90s - 60.74s | I do write the Ransomware Diaries. 60.74s - 62.98s | That is not what this is about, but the output 62.98s - 65.18s | of what I'm going to talk to you about today is there. 65.18s - 68.18s | But this is a story. 68.18s - 71.14s | I am a storyteller, and this is like


chunk_id: 173_chunk_2
chunk_text:
practitioners 34.80s - 36.00s | on the planet. 36.00s - 38.22s | And with that, I'll turn it over to John. 38.22s - 38.92s | Here you go, man. 38.92s - 39.42s | Thanks, man. 39.42s - 40.40s | Appreciate you, brother. 44.82s - 45.86s | Thank you. 45.86s - 47.62s | Where there's a will, there's a way. 47.62s - 48.86s | I'm glad we got this started. 48.86s - 50.62s | Let me get this mic adjusted. 50.62s - 51.22s | All right. 51.22s - 52.90s | Everybody hear me? 52.90s - 53.78s | All right. 53.78s - 55.14s | Well, hear what he said in my name. 55.14s - 56.06s | Yep, I'm an author. 56.06s - 56.94s | That's all great. 56.94s - 58.90s | I'm not here to talk to you about that today. 58.90s - 60.74s | I do write the Ransomware Diaries. 60.74s - 62.98s | That is not what this is about, but the output 62.98s - 65.18s | of what I'm going to talk to you about today is there. 65.18s - 68.18s | But this is a story. 68.18s - 71.14s | I am a storyteller, and this is like a once-in-a-lifetime 71.14s - 73.78s | story, and I'm just so excited to be able to be up here 73.78s - 77.46s | and tell you this story today. 77.46s - 80.34s | This is a ransomware story, but it's also 80.34s - 83.02s | a story of friendship, it's a story of love, 83.02s - 88.18s | it's a story of betrayal, and it's a story of deceit. 88.18s - 89.74s | I'm going to be honest with you guys. 89.74s - 93.58s | When I started to create the content for this, 93.58s - 97.18s | I found that there was a particular similarity 97.18s - 99.94s | between my relationship with LockBit, 99.94s - 104.90s | the man behind LockBit, and the horrific dating love story 104.90s - 107.66s | shows that my girlfriend tortures me with. 107.66s - 109.54s | So I'm going to share some of that 109.54s - 111.30s | and add that element into this today. 111.30s - 115.86s | So anyway, on that note, let's kick this shit off. 115.86s - 119.46s | So when I began this, I knew that if I 119.46s - 122.10s | was going to get LockBit


chunk_id: 173_chunk_3
chunk_text:
a once-in-a-lifetime 71.14s - 73.78s | story, and I'm just so excited to be able to be up here 73.78s - 77.46s | and tell you this story today. 77.46s - 80.34s | This is a ransomware story, but it's also 80.34s - 83.02s | a story of friendship, it's a story of love, 83.02s - 88.18s | it's a story of betrayal, and it's a story of deceit. 88.18s - 89.74s | I'm going to be honest with you guys. 89.74s - 93.58s | When I started to create the content for this, 93.58s - 97.18s | I found that there was a particular similarity 97.18s - 99.94s | between my relationship with LockBit, 99.94s - 104.90s | the man behind LockBit, and the horrific dating love story 104.90s - 107.66s | shows that my girlfriend tortures me with. 107.66s - 109.54s | So I'm going to share some of that 109.54s - 111.30s | and add that element into this today. 111.30s - 115.86s | So anyway, on that note, let's kick this shit off. 115.86s - 119.46s | So when I began this, I knew that if I 119.46s - 122.10s | was going to get LockBit to like me, 122.10s - 124.86s | I was going to have to talk to him as someone besides myself. 124.86s - 126.70s | LockBit was sort of the prom queen. 126.70s - 130.30s | Everybody talking about wanted LockBit to like them, 130.30s - 133.58s | and he's sort of the top dog. 133.58s - 136.08s | This was two years ago, though, so it wasn't the number one 136.08s - 138.38s | ransomware group at the time, but he was moving up. 138.38s - 140.38s | I knew he wasn't going to talk to me as me, 140.38s - 142.70s | so I put on a puppet show. 142.70s - 146.94s | Spent a lot of time developing sock puppets. 146.94s - 150.70s | I cultivated these puppets, but still, at the same time, 150.70s - 153.42s | I could only use them if they were believable 153.42s - 156.58s | and if other people around him believed it. 156.58s - 158.30s | So the first thing that I had to do 158.30s - 160.34s | was I needed to hang out at his spots. 160.34s - 162.70s | What I mean, his favorite spots, what I mean


chunk_id: 173_chunk_4
chunk_text:
to like me, 122.10s - 124.86s | I was going to have to talk to him as someone besides myself. 124.86s - 126.70s | LockBit was sort of the prom queen. 126.70s - 130.30s | Everybody talking about wanted LockBit to like them, 130.30s - 133.58s | and he's sort of the top dog. 133.58s - 136.08s | This was two years ago, though, so it wasn't the number one 136.08s - 138.38s | ransomware group at the time, but he was moving up. 138.38s - 140.38s | I knew he wasn't going to talk to me as me, 140.38s - 142.70s | so I put on a puppet show. 142.70s - 146.94s | Spent a lot of time developing sock puppets. 146.94s - 150.70s | I cultivated these puppets, but still, at the same time, 150.70s - 153.42s | I could only use them if they were believable 153.42s - 156.58s | and if other people around him believed it. 156.58s - 158.30s | So the first thing that I had to do 158.30s - 160.34s | was I needed to hang out at his spots. 160.34s - 162.70s | What I mean, his favorite spots, what I mean by this, 162.70s - 164.66s | though, is the places online where 164.66s - 166.94s | he would go to recruit, the places online where 166.94s - 169.14s | he would go to socialize, the places where 169.14s - 172.14s | he'd go to talk with other criminals and other hackers. 172.14s - 173.46s | This isn't his infrastructure. 173.46s - 175.46s | These are the places where he spends his time. 175.46s - 178.62s | So once I found those, I needed to find his accounts. 178.62s - 179.82s | That was pretty easy. 179.82s - 182.90s | This dude calls himself LockBit or variations of LockBit 182.90s - 186.18s | in all of his accounts, so it didn't take too much work. 186.18s - 187.70s | And once I'd sort of profiled that 187.70s - 190.58s | and gotten into these various forums that he was on, 190.58s - 192.50s | I stalked his business partners. 192.50s - 195.30s | Now, what I mean by that is I looked at the people 195.30s - 197.30s | he was buying attack resources from, 197.30s - 200.14s | but I also looked at the conversations 200.14s - 201.26s | that


chunk_id: 173_chunk_5
chunk_text:
by this, 162.70s - 164.66s | though, is the places online where 164.66s - 166.94s | he would go to recruit, the places online where 166.94s - 169.14s | he would go to socialize, the places where 169.14s - 172.14s | he'd go to talk with other criminals and other hackers. 172.14s - 173.46s | This isn't his infrastructure. 173.46s - 175.46s | These are the places where he spends his time. 175.46s - 178.62s | So once I found those, I needed to find his accounts. 178.62s - 179.82s | That was pretty easy. 179.82s - 182.90s | This dude calls himself LockBit or variations of LockBit 182.90s - 186.18s | in all of his accounts, so it didn't take too much work. 186.18s - 187.70s | And once I'd sort of profiled that 187.70s - 190.58s | and gotten into these various forums that he was on, 190.58s - 192.50s | I stalked his business partners. 192.50s - 195.30s | Now, what I mean by that is I looked at the people 195.30s - 197.30s | he was buying attack resources from, 197.30s - 200.14s | but I also looked at the conversations 200.14s - 201.26s | that he was having. 201.30s - 204.10s | I was looking at the affiliates he was talking to, 204.10s - 206.38s | but this dude talked to a lot of people. 206.38s - 210.18s | He is an extreme extrovert when it comes to these forums, 210.18s - 211.94s | and there was a lot of conversations. 211.94s - 214.02s | So I needed to figure out who was relevant. 214.02s - 216.94s | I needed to find those high-value targets. 216.94s - 218.70s | So I started to look for the people 218.70s - 220.94s | that he talked to the most, and I started to look 220.94s - 223.90s | for affiliates that had relationships with not just him, 223.90s - 226.26s | but with other ransomware groups, 226.26s - 228.46s | and sort of vetted that list. 228.46s - 232.02s | Once I had that list and I knew who they were, 232.02s - 235.70s | that allowed me to spy on them. 235.70s - 238.42s | So I spent a lot of time going through these forums, 238.42s - 241.30s | and I mean, I stalked the shit out of these dudes. 241.30s - 243.54s | I


chunk_id: 173_chunk_6
chunk_text:
he was having. 201.30s - 204.10s | I was looking at the affiliates he was talking to, 204.10s - 206.38s | but this dude talked to a lot of people. 206.38s - 210.18s | He is an extreme extrovert when it comes to these forums, 210.18s - 211.94s | and there was a lot of conversations. 211.94s - 214.02s | So I needed to figure out who was relevant. 214.02s - 216.94s | I needed to find those high-value targets. 216.94s - 218.70s | So I started to look for the people 218.70s - 220.94s | that he talked to the most, and I started to look 220.94s - 223.90s | for affiliates that had relationships with not just him, 223.90s - 226.26s | but with other ransomware groups, 226.26s - 228.46s | and sort of vetted that list. 228.46s - 232.02s | Once I had that list and I knew who they were, 232.02s - 235.70s | that allowed me to spy on them. 235.70s - 238.42s | So I spent a lot of time going through these forums, 238.42s - 241.30s | and I mean, I stalked the shit out of these dudes. 241.30s - 243.54s | I read everything they ever wrote. 243.54s - 246.86s | Now, taking that information, what I had to do 246.86s - 250.06s | was sort of overlay that going backwards in time 250.06s - 252.94s | to see what attacks were taking place in the world 252.94s - 255.66s | and what significant events were happening. 255.66s - 257.54s | But that wasn't the important thing. 257.58s - 259.78s | The important thing was the conversations 259.78s - 261.78s | that had nothing to do with that. 261.78s - 262.62s | Think about it. 262.62s - 263.82s | If you wanna date somebody, 263.82s - 265.50s | you wanna know their personality, 265.50s - 267.46s | you gotta know the things that make them tick. 267.46s - 269.26s | You gotta know the things they find funny. 269.26s - 272.38s | You gotta know the music they like, their politics, 272.38s - 274.62s | whatever it might be, if they're religious. 274.62s - 277.34s | So I really focused on those aspects 277.34s - 279.86s | of his conversations with other people, 279.86s - 284.14s | sort of profiled him before I ever engaged or talked to him. 284.14s - 285.78s


chunk_id: 173_chunk_7
chunk_text:
read everything they ever wrote. 243.54s - 246.86s | Now, taking that information, what I had to do 246.86s - 250.06s | was sort of overlay that going backwards in time 250.06s - 252.94s | to see what attacks were taking place in the world 252.94s - 255.66s | and what significant events were happening. 255.66s - 257.54s | But that wasn't the important thing. 257.58s - 259.78s | The important thing was the conversations 259.78s - 261.78s | that had nothing to do with that. 261.78s - 262.62s | Think about it. 262.62s - 263.82s | If you wanna date somebody, 263.82s - 265.50s | you wanna know their personality, 265.50s - 267.46s | you gotta know the things that make them tick. 267.46s - 269.26s | You gotta know the things they find funny. 269.26s - 272.38s | You gotta know the music they like, their politics, 272.38s - 274.62s | whatever it might be, if they're religious. 274.62s - 277.34s | So I really focused on those aspects 277.34s - 279.86s | of his conversations with other people, 279.86s - 284.14s | sort of profiled him before I ever engaged or talked to him. 284.14s - 285.78s | And this helped me a lot by going 285.78s - 287.74s | and looking through all these resources 287.74s - 290.62s | and identifying these conversations. 290.62s - 292.54s | I mean, the attack elements are what everybody read 292.54s - 295.34s | in the ransomware diaries, but this part, 295.34s - 297.14s | the stuff that wasn't anything about that 297.14s - 300.70s | was really the resource that helped me 300.70s - 302.22s | to get to that end result. 303.54s - 306.98s | So after that, I stole all of his friends. 306.98s - 310.34s | So what I mean by that is he talked to a lot of people, 310.34s - 312.34s | but those people that he had those conversations 312.34s - 313.18s | that I just mentioned, 313.18s - 315.14s | those non-work-related conversations, 315.14s - 317.10s | people he talked to a lot, 317.10s - 318.22s | those are the people that I wanted 318.22s - 319.90s | to spend my time talking to. 319.90s - 321.02s | So I did. 321.02s - 323.90s | This is Matt Veve, or as I used to know him, Boris, 323.90s - 326.90s | and


chunk_id: 173_chunk_8
chunk_text:
| And this helped me a lot by going 285.78s - 287.74s | and looking through all these resources 287.74s - 290.62s | and identifying these conversations. 290.62s - 292.54s | I mean, the attack elements are what everybody read 292.54s - 295.34s | in the ransomware diaries, but this part, 295.34s - 297.14s | the stuff that wasn't anything about that 297.14s - 300.70s | was really the resource that helped me 300.70s - 302.22s | to get to that end result. 303.54s - 306.98s | So after that, I stole all of his friends. 306.98s - 310.34s | So what I mean by that is he talked to a lot of people, 310.34s - 312.34s | but those people that he had those conversations 312.34s - 313.18s | that I just mentioned, 313.18s - 315.14s | those non-work-related conversations, 315.14s - 317.10s | people he talked to a lot, 317.10s - 318.22s | those are the people that I wanted 318.22s - 319.90s | to spend my time talking to. 319.90s - 321.02s | So I did. 321.02s - 323.90s | This is Matt Veve, or as I used to know him, Boris, 323.90s - 326.90s | and as most of you guys know him, Wazowaka. 326.90s - 329.50s | This was him getting married last year. 329.50s - 332.26s | This is one of his laptops that he uses to commit crimes. 332.26s - 334.74s | I guess it's kind of cool to have your name written on that. 334.74s - 336.46s | He's got me, some other researchers, 336.46s - 338.56s | and some other criminals written on there. 339.74s - 341.46s | He's an interesting guy. 343.14s - 344.64s | Putting a researcher's name on an attack 345.04s - 346.48s | that you do crimes on, I mean, I don't know, 346.48s - 348.64s | that's just, what do you say to that? 348.64s - 349.48s | Thank you? 350.88s - 353.52s | But getting to become friends with these guys 353.52s - 358.20s | was important because as I was going to approach LockBit, 358.20s - 360.84s | I needed to have sort of that validation 360.84s - 363.68s | from the people who were important to him. 363.68s - 365.96s | This is Buster, again, most of one knows him 365.96s - 369.16s | as Basterlord, wrote The Ransomware Diaries 369.16s - 370.84s


chunk_id: 173_chunk_9
chunk_text:
as most of you guys know him, Wazowaka. 326.90s - 329.50s | This was him getting married last year. 329.50s - 332.26s | This is one of his laptops that he uses to commit crimes. 332.26s - 334.74s | I guess it's kind of cool to have your name written on that. 334.74s - 336.46s | He's got me, some other researchers, 336.46s - 338.56s | and some other criminals written on there. 339.74s - 341.46s | He's an interesting guy. 343.14s - 344.64s | Putting a researcher's name on an attack 345.04s - 346.48s | that you do crimes on, I mean, I don't know, 346.48s - 348.64s | that's just, what do you say to that? 348.64s - 349.48s | Thank you? 350.88s - 353.52s | But getting to become friends with these guys 353.52s - 358.20s | was important because as I was going to approach LockBit, 358.20s - 360.84s | I needed to have sort of that validation 360.84s - 363.68s | from the people who were important to him. 363.68s - 365.96s | This is Buster, again, most of one knows him 365.96s - 369.16s | as Basterlord, wrote The Ransomware Diaries 369.16s - 370.84s | volume two about him. 370.84s - 372.96s | He'll be upset that I posted this picture. 372.96s - 375.92s | He got indicted, kind of all knew who he was now, 376.76s - 379.76s | but he says it's not him, of course it's not. 379.76s - 382.04s | The funny thing about this picture is, as you see, 382.04s - 384.08s | I asked him to sign The Ransomware Diaries, 384.08s - 386.56s | so he did, he signed it APT. 386.56s - 389.08s | What's so ironic about this is the very first time 389.08s - 392.48s | I ever talked to him was through Talks, 392.48s - 394.24s | cryptic communication app, and I said, 394.24s - 396.48s | hey, Basterlord, how's it going, man, let's talk, 396.48s - 399.04s | and he said to me, call me Ivan. 399.04s - 401.08s | Fast forward two years, he's indicted, 401.08s - 402.88s | this motherfucker's real name's Ivan. 402.88s - 407.88s | Can't make that shit up, can't make that up. 408.72s - 409.72s | But yeah, we became friends. 409.72s - 412.04s | I still like the guy, I mean, you know, 412.04s - 413.72s


chunk_id: 173_chunk_10
chunk_text:
| volume two about him. 370.84s - 372.96s | He'll be upset that I posted this picture. 372.96s - 375.92s | He got indicted, kind of all knew who he was now, 376.76s - 379.76s | but he says it's not him, of course it's not. 379.76s - 382.04s | The funny thing about this picture is, as you see, 382.04s - 384.08s | I asked him to sign The Ransomware Diaries, 384.08s - 386.56s | so he did, he signed it APT. 386.56s - 389.08s | What's so ironic about this is the very first time 389.08s - 392.48s | I ever talked to him was through Talks, 392.48s - 394.24s | cryptic communication app, and I said, 394.24s - 396.48s | hey, Basterlord, how's it going, man, let's talk, 396.48s - 399.04s | and he said to me, call me Ivan. 399.04s - 401.08s | Fast forward two years, he's indicted, 401.08s - 402.88s | this motherfucker's real name's Ivan. 402.88s - 407.88s | Can't make that shit up, can't make that up. 408.72s - 409.72s | But yeah, we became friends. 409.72s - 412.04s | I still like the guy, I mean, you know, 412.04s - 413.72s | I spend more time talking to criminals 413.72s - 416.72s | than I do corporate people, maybe that's something about me, 416.72s - 419.40s | but I enjoy talking to hackers, criminals, 419.40s - 421.78s | I mean, that's kind of like the culture that I love, 421.78s - 424.82s | so this dude, you know, I do consider him to be a friend, 424.82s - 427.08s | wish he chose a different life, but you know, 427.08s - 430.00s | interesting guy, and then Mr. B brought, 430.00s - 431.80s | well, lots of people probably hate this guy, 431.80s - 434.40s | but he's always been respectful to me. 434.40s - 438.72s | Sometimes he likes to be really sarcastic, poke fun, 438.72s - 440.72s | but again, this is somebody who's close to LockBit 440.72s - 443.32s | and spends a lot of time being close to LockBit, 443.32s - 446.20s | so you know, I wanted to be friends with him. 446.20s - 450.28s | I had a conversation, me, Azeem from Cisco Talos, 450.28s - 453.70s | we were joking around with Brava and Wazowaka, 453.70s - 455.92s | and just to give you


chunk_id: 173_chunk_11
chunk_text:
| I spend more time talking to criminals 413.72s - 416.72s | than I do corporate people, maybe that's something about me, 416.72s - 419.40s | but I enjoy talking to hackers, criminals, 419.40s - 421.78s | I mean, that's kind of like the culture that I love, 421.78s - 424.82s | so this dude, you know, I do consider him to be a friend, 424.82s - 427.08s | wish he chose a different life, but you know, 427.08s - 430.00s | interesting guy, and then Mr. B brought, 430.00s - 431.80s | well, lots of people probably hate this guy, 431.80s - 434.40s | but he's always been respectful to me. 434.40s - 438.72s | Sometimes he likes to be really sarcastic, poke fun, 438.72s - 440.72s | but again, this is somebody who's close to LockBit 440.72s - 443.32s | and spends a lot of time being close to LockBit, 443.32s - 446.20s | so you know, I wanted to be friends with him. 446.20s - 450.28s | I had a conversation, me, Azeem from Cisco Talos, 450.28s - 453.70s | we were joking around with Brava and Wazowaka, 453.70s - 455.92s | and just to give you an idea of the things 455.92s - 458.28s | that we talked about, you know, they're not always a source. 458.28s - 459.68s | Some of the dumb things we talked about 460.36s - 461.88s | were so silly and fictitious, we were talking about 461.88s - 463.40s | getting on a boat between, you know, 463.40s - 465.76s | on international waters between Russia and Poland, 465.76s - 467.96s | and I was gonna bring a copy of my book, 467.96s - 470.64s | and Azeem was gonna bring some vodka, 470.64s - 473.40s | and Wazowaka was gonna cook some food for us, 473.40s - 474.64s | and we were gonna hang out, I mean, 474.64s - 476.24s | dumbass conversations just like you'd have 476.24s - 477.16s | with your regular friends, 477.16s - 479.12s | but these guys are regular people too, 479.12s - 481.60s | so when I say, like, I wanna get close to their friends, 481.60s - 483.40s | that doesn't mean they're like sources 483.40s - 484.98s | or they're betraying anybody, 484.98s - 488.20s | it literally means you just became friends with them. 488.20s - 489.88s | Again, but important


chunk_id: 173_chunk_12
chunk_text:
an idea of the things 455.92s - 458.28s | that we talked about, you know, they're not always a source. 458.28s - 459.68s | Some of the dumb things we talked about 460.36s - 461.88s | were so silly and fictitious, we were talking about 461.88s - 463.40s | getting on a boat between, you know, 463.40s - 465.76s | on international waters between Russia and Poland, 465.76s - 467.96s | and I was gonna bring a copy of my book, 467.96s - 470.64s | and Azeem was gonna bring some vodka, 470.64s - 473.40s | and Wazowaka was gonna cook some food for us, 473.40s - 474.64s | and we were gonna hang out, I mean, 474.64s - 476.24s | dumbass conversations just like you'd have 476.24s - 477.16s | with your regular friends, 477.16s - 479.12s | but these guys are regular people too, 479.12s - 481.60s | so when I say, like, I wanna get close to their friends, 481.60s - 483.40s | that doesn't mean they're like sources 483.40s - 484.98s | or they're betraying anybody, 484.98s - 488.20s | it literally means you just became friends with them. 488.20s - 489.88s | Again, but important to the bigger picture 489.88s - 491.98s | of my real target, who was LockBit. 492.94s - 495.36s | Okay, so after I did that, I needed to check out their place, 495.36s - 497.12s | this is DataLeak's site, obviously, 497.12s - 498.64s | it's where victims are posted, 498.64s - 500.64s | but the important thing for this operation 500.64s - 502.12s | was the affiliate rules, 502.12s - 504.16s | and the reason that was important to me 504.16s - 508.04s | was because I wanted to join their gang, 508.04s - 509.88s | and I tried to do just that. 509.88s - 512.18s | Now, I knew I wasn't gonna make it all the way through, 512.18s - 515.24s | because, well, I'm not actually a ransomware criminal, 515.52s - 518.84s | but I wanted to see what I could learn, 518.84s - 520.40s | and I figured, fuck it, why not? 520.40s - 522.20s | It sounded like fun at the time. 522.20s - 524.20s | So I went through the process, 524.20s - 525.84s | talked to LockBit on Talks, 525.84s - 527.76s | he asked me a bunch of technical questions, 527.76s -


chunk_id: 173_chunk_13
chunk_text:
to the bigger picture 489.88s - 491.98s | of my real target, who was LockBit. 492.94s - 495.36s | Okay, so after I did that, I needed to check out their place, 495.36s - 497.12s | this is DataLeak's site, obviously, 497.12s - 498.64s | it's where victims are posted, 498.64s - 500.64s | but the important thing for this operation 500.64s - 502.12s | was the affiliate rules, 502.12s - 504.16s | and the reason that was important to me 504.16s - 508.04s | was because I wanted to join their gang, 508.04s - 509.88s | and I tried to do just that. 509.88s - 512.18s | Now, I knew I wasn't gonna make it all the way through, 512.18s - 515.24s | because, well, I'm not actually a ransomware criminal, 515.52s - 518.84s | but I wanted to see what I could learn, 518.84s - 520.40s | and I figured, fuck it, why not? 520.40s - 522.20s | It sounded like fun at the time. 522.20s - 524.20s | So I went through the process, 524.20s - 525.84s | talked to LockBit on Talks, 525.84s - 527.76s | he asked me a bunch of technical questions, 527.76s - 529.92s | now this was my puppet, to be clear, 529.92s - 531.88s | asked me a bunch of technical questions, 531.88s - 533.88s | wanted to know who I knew, 533.88s - 536.28s | what ransomware groups I was affiliated with, 536.28s - 539.24s | and I had a puppet, I had hijacked another account, 539.24s - 541.92s | I had somebody that people would vouch for, 541.92s - 543.64s | but I hadn't committed enough crimes 543.96s - 545.92s | for his ransomware operations, 545.92s - 548.84s | so didn't get in, again, knew that, 548.84s - 551.40s | but something unexpected happened. 551.40s - 554.00s | You know, with Talks, you have to sort of approve the access 554.00s - 555.80s | in order to be able to have those conversations 555.80s - 557.00s | and be in that channel. 558.20s - 560.76s | After he did not let me into the group, 560.76s - 561.68s | he kept that open, 561.68s - 564.92s | he kept that line of communication open. 564.92s - 567.82s | So what I quickly realized was, this is great, 567.82s - 569.36s | I can talk to this dude every day


chunk_id: 173_chunk_14
chunk_text:
529.92s | now this was my puppet, to be clear, 529.92s - 531.88s | asked me a bunch of technical questions, 531.88s - 533.88s | wanted to know who I knew, 533.88s - 536.28s | what ransomware groups I was affiliated with, 536.28s - 539.24s | and I had a puppet, I had hijacked another account, 539.24s - 541.92s | I had somebody that people would vouch for, 541.92s - 543.64s | but I hadn't committed enough crimes 543.96s - 545.92s | for his ransomware operations, 545.92s - 548.84s | so didn't get in, again, knew that, 548.84s - 551.40s | but something unexpected happened. 551.40s - 554.00s | You know, with Talks, you have to sort of approve the access 554.00s - 555.80s | in order to be able to have those conversations 555.80s - 557.00s | and be in that channel. 558.20s - 560.76s | After he did not let me into the group, 560.76s - 561.68s | he kept that open, 561.68s - 564.92s | he kept that line of communication open. 564.92s - 567.82s | So what I quickly realized was, this is great, 567.82s - 569.36s | I can talk to this dude every day now, 569.36s - 571.90s | if he'll respond to me, 571.90s - 575.82s | so I did that, and I tried to have conversations with him, 575.82s - 578.30s | and I acted like I was an upcoming hacker 578.30s - 580.54s | who looked at him like a mentor 580.54s - 583.94s | and was asking questions to get better at what I did 583.94s - 586.18s | and pretended that I was trying to join these other groups 586.18s - 588.06s | and what he thought and how I should approach them 588.06s - 589.06s | and things like that, 589.06s - 592.70s | and he was really receptive to that sort of treatment 592.70s - 594.70s | of him being this idol in me looking, 594.70s - 596.66s | or my puppet looking up to him, 596.66s - 597.98s | and that was pretty effective, 597.98s - 599.98s | and that's where I got a lot of the intel 600.18s - 603.38s | that you see in the first volume of the Ransomware Diaries, 603.38s - 606.30s | but once I got through all of this, 606.30s - 609.70s | the best part was because LockBit was


chunk_id: 173_chunk_15
chunk_text:
now, 569.36s - 571.90s | if he'll respond to me, 571.90s - 575.82s | so I did that, and I tried to have conversations with him, 575.82s - 578.30s | and I acted like I was an upcoming hacker 578.30s - 580.54s | who looked at him like a mentor 580.54s - 583.94s | and was asking questions to get better at what I did 583.94s - 586.18s | and pretended that I was trying to join these other groups 586.18s - 588.06s | and what he thought and how I should approach them 588.06s - 589.06s | and things like that, 589.06s - 592.70s | and he was really receptive to that sort of treatment 592.70s - 594.70s | of him being this idol in me looking, 594.70s - 596.66s | or my puppet looking up to him, 596.66s - 597.98s | and that was pretty effective, 597.98s - 599.98s | and that's where I got a lot of the intel 600.18s - 603.38s | that you see in the first volume of the Ransomware Diaries, 603.38s - 606.30s | but once I got through all of this, 606.30s - 609.70s | the best part was because LockBit was still talking to me, 609.70s - 611.66s | he let me play with his toys, 611.66s - 613.40s | and that was pretty fucking awesome 613.40s - 617.38s | because LockBit 3.0 did not exist at the time, 617.38s - 620.46s | he shared some of these pictures with me, 620.46s - 622.94s | he shared some with VXUnderground and a couple people, 622.94s - 625.72s | but this was like January, February, 2022, 625.72s - 628.30s | this didn't come out to be used in attacks 628.30s - 630.50s | until June of 2022, 630.50s - 631.66s | so getting to see this, 631.66s - 634.34s | it allowed me to compare it to the previous panel 634.34s - 637.54s | and identify what new capabilities we were gonna see. 637.54s - 638.62s | Now this was significant, 638.62s - 640.36s | everybody knows how this story ends, 640.36s - 642.64s | LockBit made a lot of the attacks 642.64s - 645.10s | that previously required technical expertise 645.10s - 646.62s | and hands-on keyboard, 646.62s - 648.26s | he made a lot of those automated. 648.26s - 649.70s | Seeing that that was coming, 649.70s - 651.78s |


chunk_id: 173_chunk_16
chunk_text:
still talking to me, 609.70s - 611.66s | he let me play with his toys, 611.66s - 613.40s | and that was pretty fucking awesome 613.40s - 617.38s | because LockBit 3.0 did not exist at the time, 617.38s - 620.46s | he shared some of these pictures with me, 620.46s - 622.94s | he shared some with VXUnderground and a couple people, 622.94s - 625.72s | but this was like January, February, 2022, 625.72s - 628.30s | this didn't come out to be used in attacks 628.30s - 630.50s | until June of 2022, 630.50s - 631.66s | so getting to see this, 631.66s - 634.34s | it allowed me to compare it to the previous panel 634.34s - 637.54s | and identify what new capabilities we were gonna see. 637.54s - 638.62s | Now this was significant, 638.62s - 640.36s | everybody knows how this story ends, 640.36s - 642.64s | LockBit made a lot of the attacks 642.64s - 645.10s | that previously required technical expertise 645.10s - 646.62s | and hands-on keyboard, 646.62s - 648.26s | he made a lot of those automated. 648.26s - 649.70s | Seeing that that was coming, 649.70s - 651.78s | I knew attacks were gonna be quicker, 651.78s - 653.22s | there was gonna be a higher volume, 653.22s - 656.44s | and LockBit was gonna move up to the top of the ranks 656.48s - 658.52s | as far as attack volume, 658.52s - 663.40s | and that's exactly what happened starting in June of 2022, 663.40s - 665.64s | but if I hadn't got in there and done all that bullshit 665.64s - 667.80s | and pretended to be someone else and been friends with him, 667.80s - 669.16s | I never would have got to see this, 669.16s - 673.16s | so that was very helpful in this operation. 674.68s - 677.44s | And then everything has to come to an end, 677.44s - 679.76s | I wrote up everything that I found, 679.76s - 681.40s | I exposed him publicly, 681.40s - 683.36s | and being the smart guy that I am, 683.36s - 685.24s | I put my name and face on my work, 687.20s - 689.44s | made for an interesting week, I assure you, 690.64s - 692.28s | but when you do things like that, 692.28s - 693.96s | you gotta ask yourself,


chunk_id: 173_chunk_17
chunk_text:
I knew attacks were gonna be quicker, 651.78s - 653.22s | there was gonna be a higher volume, 653.22s - 656.44s | and LockBit was gonna move up to the top of the ranks 656.48s - 658.52s | as far as attack volume, 658.52s - 663.40s | and that's exactly what happened starting in June of 2022, 663.40s - 665.64s | but if I hadn't got in there and done all that bullshit 665.64s - 667.80s | and pretended to be someone else and been friends with him, 667.80s - 669.16s | I never would have got to see this, 669.16s - 673.16s | so that was very helpful in this operation. 674.68s - 677.44s | And then everything has to come to an end, 677.44s - 679.76s | I wrote up everything that I found, 679.76s - 681.40s | I exposed him publicly, 681.40s - 683.36s | and being the smart guy that I am, 683.36s - 685.24s | I put my name and face on my work, 687.20s - 689.44s | made for an interesting week, I assure you, 690.64s - 692.28s | but when you do things like that, 692.28s - 693.96s | you gotta ask yourself, 693.96s - 695.32s | are these guys gonna be pissed, 695.32s - 697.52s | are they gonna be upset? 697.52s - 699.20s | Either way, I knew those sock puppets 699.20s - 701.84s | that I spent all that time crafting, 701.84s - 702.80s | I knew they were burnt, 702.80s - 706.28s | so this was supposed to be the end of the story, 706.28s - 707.76s | but it wasn't. 707.76s - 710.60s | So I asked Azeem from Cisco Talos, 710.60s - 711.72s | a researcher that I'm friends with, 711.72s - 715.40s | I asked him to ask LockBit what he thought of my work, 715.40s - 717.08s | and he did that, 717.08s - 721.44s | and LockBit says, of course I read it, 721.44s - 723.56s | I was hoping that there would be a photo 723.56s - 725.40s | of my yacht, girls, and marijuana. 725.40s - 728.52s | Now, this is important, this is funny, 728.52s - 730.92s | the guy that I know is not the guy 730.92s - 733.92s | that we all see on these forums, 733.92s - 736.92s | the guy in the forums is like Tony Montana


chunk_id: 173_chunk_18
chunk_text:
693.96s - 695.32s | are these guys gonna be pissed, 695.32s - 697.52s | are they gonna be upset? 697.52s - 699.20s | Either way, I knew those sock puppets 699.20s - 701.84s | that I spent all that time crafting, 701.84s - 702.80s | I knew they were burnt, 702.80s - 706.28s | so this was supposed to be the end of the story, 706.28s - 707.76s | but it wasn't. 707.76s - 710.60s | So I asked Azeem from Cisco Talos, 710.60s - 711.72s | a researcher that I'm friends with, 711.72s - 715.40s | I asked him to ask LockBit what he thought of my work, 715.40s - 717.08s | and he did that, 717.08s - 721.44s | and LockBit says, of course I read it, 721.44s - 723.56s | I was hoping that there would be a photo 723.56s - 725.40s | of my yacht, girls, and marijuana. 725.40s - 728.52s | Now, this is important, this is funny, 728.52s - 730.92s | the guy that I know is not the guy 730.92s - 733.92s | that we all see on these forums, 733.92s - 736.92s | the guy in the forums is like Tony Montana from Scarface, 736.92s - 738.60s | I think LockBit saw these movies 738.60s - 740.60s | and just decided he needed to be this badass 740.60s - 742.40s | and portray himself that way, 742.40s - 745.40s | because the guy I know, yeah, he loves money, 745.40s - 747.52s | but he's not flashy. 747.52s - 750.32s | This is a guy who is more to himself, 750.32s - 753.52s | more about gardening than yachts. 753.52s - 756.36s | Okay, so I found it funny 756.36s - 758.56s | the way he portrayed himself to other people. 758.56s - 760.12s | And then, of course, he called me Johnny, 760.12s - 761.52s | which nobody used to call me, 761.52s - 762.80s | but ever since he started doing it, 762.80s - 764.76s | it's become the new cool, 764.76s - 766.96s | it seems that's now what all the criminals like to call me, 766.96s - 769.20s | so I guess there's worse things to be called. 770.12s - 771.88s | But knowing what he thought of my work, 771.88s - 774.36s | which is still kind of a bullshit answer, 774.36s - 776.56s | I wanted


chunk_id: 173_chunk_19
chunk_text:
from Scarface, 736.92s - 738.60s | I think LockBit saw these movies 738.60s - 740.60s | and just decided he needed to be this badass 740.60s - 742.40s | and portray himself that way, 742.40s - 745.40s | because the guy I know, yeah, he loves money, 745.40s - 747.52s | but he's not flashy. 747.52s - 750.32s | This is a guy who is more to himself, 750.32s - 753.52s | more about gardening than yachts. 753.52s - 756.36s | Okay, so I found it funny 756.36s - 758.56s | the way he portrayed himself to other people. 758.56s - 760.12s | And then, of course, he called me Johnny, 760.12s - 761.52s | which nobody used to call me, 761.52s - 762.80s | but ever since he started doing it, 762.80s - 764.76s | it's become the new cool, 764.76s - 766.96s | it seems that's now what all the criminals like to call me, 766.96s - 769.20s | so I guess there's worse things to be called. 770.12s - 771.88s | But knowing what he thought of my work, 771.88s - 774.36s | which is still kind of a bullshit answer, 774.36s - 776.56s | I wanted to know what he thought about me. 776.56s - 778.48s | Well, I didn't have to wait very long. 780.12s - 784.12s | A few days later, LockBit updated his profile 784.12s - 787.64s | on one of those forums that I've mentioned that I was on. 787.64s - 790.08s | Now, you know, he went to my LinkedIn profile, 790.08s - 791.04s | he took my headshot, 791.04s - 793.64s | and I remember logging in and seeing this, 793.64s - 797.16s | and it was, it was a no shit, you know, 797.16s - 799.28s | asshole fucker moment, I'm not gonna lie. 799.28s - 801.80s | It was like milliseconds, but it was like in slow motion, 802.56s - 803.88s | it was like, did I somehow do this? 803.88s - 805.56s | Like, how is this on here? 805.56s - 808.52s | And then it clicked, oh my God, this dude's using my face. 809.60s - 812.20s | I thought it was maybe a threat at first. 812.20s - 813.04s | It wasn't. 813.04s - 815.60s | What I've learned about the Russian hacking culture, 815.60s - 817.96s | it's very different than the US hacking


chunk_id: 173_chunk_20
chunk_text:
to know what he thought about me. 776.56s - 778.48s | Well, I didn't have to wait very long. 780.12s - 784.12s | A few days later, LockBit updated his profile 784.12s - 787.64s | on one of those forums that I've mentioned that I was on. 787.64s - 790.08s | Now, you know, he went to my LinkedIn profile, 790.08s - 791.04s | he took my headshot, 791.04s - 793.64s | and I remember logging in and seeing this, 793.64s - 797.16s | and it was, it was a no shit, you know, 797.16s - 799.28s | asshole fucker moment, I'm not gonna lie. 799.28s - 801.80s | It was like milliseconds, but it was like in slow motion, 802.56s - 803.88s | it was like, did I somehow do this? 803.88s - 805.56s | Like, how is this on here? 805.56s - 808.52s | And then it clicked, oh my God, this dude's using my face. 809.60s - 812.20s | I thought it was maybe a threat at first. 812.20s - 813.04s | It wasn't. 813.04s - 815.60s | What I've learned about the Russian hacking culture, 815.60s - 817.96s | it's very different than the US hacking culture. 817.96s - 820.88s | It kind of reminds me, let me use this analogy, 820.88s - 822.48s | if you guys have seen like the Godfather movies 822.48s - 824.84s | back in the day, the Italian mob, 824.84s - 826.12s | they did bad things to each other, 826.12s - 828.04s | but there was sort of this respect, 828.04s - 829.48s | and there were guidelines. 829.48s - 830.48s | They might kill you, 830.48s - 833.32s | but they're not gonna kill your kid or your wife. 833.32s - 834.84s | You know, we got street gangs today, 834.84s - 836.60s | they'll kill women, children, it doesn't matter, 836.60s - 838.48s | you piss them off, they're gonna come after you. 838.48s - 840.96s | Well, the Russian hacking culture is not like that. 840.96s - 843.52s | There is still a base level of respect 843.52s - 845.52s | amongst one another in things they do. 845.52s - 849.08s | LockBit looked at it like, hey, you got me, motherfucker. 849.08s - 850.52s | Good on ya, respect. 850.52s - 852.88s | And I can appreciate that. 852.88s - 854.36s | So that's what


chunk_id: 173_chunk_21
chunk_text:
culture. 817.96s - 820.88s | It kind of reminds me, let me use this analogy, 820.88s - 822.48s | if you guys have seen like the Godfather movies 822.48s - 824.84s | back in the day, the Italian mob, 824.84s - 826.12s | they did bad things to each other, 826.12s - 828.04s | but there was sort of this respect, 828.04s - 829.48s | and there were guidelines. 829.48s - 830.48s | They might kill you, 830.48s - 833.32s | but they're not gonna kill your kid or your wife. 833.32s - 834.84s | You know, we got street gangs today, 834.84s - 836.60s | they'll kill women, children, it doesn't matter, 836.60s - 838.48s | you piss them off, they're gonna come after you. 838.48s - 840.96s | Well, the Russian hacking culture is not like that. 840.96s - 843.52s | There is still a base level of respect 843.52s - 845.52s | amongst one another in things they do. 845.52s - 849.08s | LockBit looked at it like, hey, you got me, motherfucker. 849.08s - 850.52s | Good on ya, respect. 850.52s - 852.88s | And I can appreciate that. 852.88s - 854.36s | So that's what this was. 854.36s - 857.92s | So thankfully, it wasn't a threat like I had first thought. 857.92s - 859.24s | But it made for an interesting few days. 860.00s - 860.96s | And he kept this on there 860.96s - 863.48s | until the account got banned this year. 863.48s - 866.94s | So it was there for a long time. 866.94s - 869.94s | So I figured if he likes me or respected my work, 869.94s - 872.22s | maybe we could still talk, you know? 872.22s - 874.30s | Maybe we could still hang out. 874.30s - 877.74s | So I said, hey, man, you know, I just wrote about you. 877.74s - 879.22s | You know who I am? 879.22s - 880.18s | Let's talk. 880.18s - 882.78s | And I still thought he might tell me to fuck off 882.78s - 885.42s | because direct messages are very different 885.42s - 889.86s | than how you tell people, perceive people publicly. 889.86s - 891.02s | But I didn't know what to expect, 891.02s - 892.74s | but I sure shit didn't expect him to tell me 892.74s - 895.30s | that he loved me and


chunk_id: 173_chunk_22
chunk_text:
this was. 854.36s - 857.92s | So thankfully, it wasn't a threat like I had first thought. 857.92s - 859.24s | But it made for an interesting few days. 860.00s - 860.96s | And he kept this on there 860.96s - 863.48s | until the account got banned this year. 863.48s - 866.94s | So it was there for a long time. 866.94s - 869.94s | So I figured if he likes me or respected my work, 869.94s - 872.22s | maybe we could still talk, you know? 872.22s - 874.30s | Maybe we could still hang out. 874.30s - 877.74s | So I said, hey, man, you know, I just wrote about you. 877.74s - 879.22s | You know who I am? 879.22s - 880.18s | Let's talk. 880.18s - 882.78s | And I still thought he might tell me to fuck off 882.78s - 885.42s | because direct messages are very different 885.42s - 889.86s | than how you tell people, perceive people publicly. 889.86s - 891.02s | But I didn't know what to expect, 891.02s - 892.74s | but I sure shit didn't expect him to tell me 892.74s - 895.30s | that he loved me and that I was the best researcher. 896.38s - 897.82s | That made me laugh. 897.82s - 900.30s | And, you know, I'm actually not showing stuff like this 900.30s - 901.38s | to embarrass the dude. 901.38s - 902.46s | I'm showing this to you guys 902.46s - 905.10s | because he is a human being just like you and me. 905.10s - 908.58s | And I legitimately did like a version of him 908.58s - 910.02s | for a while anyway. 911.22s - 912.10s | And you can't help that. 912.10s - 913.38s | You know, you do human engagements. 913.38s - 914.94s | You can't help how you feel about somebody. 914.94s - 916.34s | You may not like what they do. 916.34s - 918.38s | You've got an objective and a mission. 918.38s - 920.94s | You do that, but you can't help how you feel about it. 920.94s - 922.82s | But it was cool that the dude liked me back 922.82s - 923.78s | and seemed to respect me. 923.78s - 925.50s | I really didn't expect it to go the way, 925.50s - 927.26s | but this shit made me laugh when I read


chunk_id: 173_chunk_23
chunk_text:
that I was the best researcher. 896.38s - 897.82s | That made me laugh. 897.82s - 900.30s | And, you know, I'm actually not showing stuff like this 900.30s - 901.38s | to embarrass the dude. 901.38s - 902.46s | I'm showing this to you guys 902.46s - 905.10s | because he is a human being just like you and me. 905.10s - 908.58s | And I legitimately did like a version of him 908.58s - 910.02s | for a while anyway. 911.22s - 912.10s | And you can't help that. 912.10s - 913.38s | You know, you do human engagements. 913.38s - 914.94s | You can't help how you feel about somebody. 914.94s - 916.34s | You may not like what they do. 916.34s - 918.38s | You've got an objective and a mission. 918.38s - 920.94s | You do that, but you can't help how you feel about it. 920.94s - 922.82s | But it was cool that the dude liked me back 922.82s - 923.78s | and seemed to respect me. 923.78s - 925.50s | I really didn't expect it to go the way, 925.50s - 927.26s | but this shit made me laugh when I read it. 927.26s - 928.82s | I was like, what the fuck, man? 930.50s - 933.38s | So going back to this whole thing 933.38s - 934.94s | where I really wanted him to like me 934.94s - 939.94s | and my wooing of LockBit, you know, I asked him questions. 940.34s - 942.38s | I knew he wasn't gonna tell me a lot, 942.38s - 943.54s | but I asked him about what he did 943.54s - 944.98s | before he was in LockBit. 944.98s - 946.94s | And I'm just showing this part of the conversation 946.98s - 948.34s | because it's kind of interesting. 948.34s - 949.82s | You know, he told me that he basically 949.82s - 952.22s | always wanted to be a cyber criminal. 952.22s - 953.86s | So he started learning OPSEC 953.86s - 955.78s | long before he committed crimes. 955.78s - 957.94s | That way, when he became a criminal, 957.94s - 961.62s | he didn't have to worry about the FBI arresting him. 961.62s - 963.06s | Really hasn't worked out that well. 963.06s - 964.86s | Not arrested, but they clearly 964.86s - 967.26s | have gotten a lot closer


chunk_id: 173_chunk_24
chunk_text:
it. 927.26s - 928.82s | I was like, what the fuck, man? 930.50s - 933.38s | So going back to this whole thing 933.38s - 934.94s | where I really wanted him to like me 934.94s - 939.94s | and my wooing of LockBit, you know, I asked him questions. 940.34s - 942.38s | I knew he wasn't gonna tell me a lot, 942.38s - 943.54s | but I asked him about what he did 943.54s - 944.98s | before he was in LockBit. 944.98s - 946.94s | And I'm just showing this part of the conversation 946.98s - 948.34s | because it's kind of interesting. 948.34s - 949.82s | You know, he told me that he basically 949.82s - 952.22s | always wanted to be a cyber criminal. 952.22s - 953.86s | So he started learning OPSEC 953.86s - 955.78s | long before he committed crimes. 955.78s - 957.94s | That way, when he became a criminal, 957.94s - 961.62s | he didn't have to worry about the FBI arresting him. 961.62s - 963.06s | Really hasn't worked out that well. 963.06s - 964.86s | Not arrested, but they clearly 964.86s - 967.26s | have gotten a lot closer to him. 967.26s - 968.78s | But I thought this was interesting, 968.78s - 972.14s | especially now that I know more about him and his past. 973.38s - 975.42s | So the next thing I needed to do 975.46s - 977.02s | was I needed to send him gifts. 977.02s - 978.78s | I mean, if we're gonna go out and date, 978.78s - 981.06s | you know, I gotta send him some gifts. 981.06s - 983.30s | And again, this picture, 983.30s - 984.62s | let me break this down for you guys 984.62s - 986.26s | because it may not seem like much, 986.26s - 989.94s | but from an operational standpoint, 989.94s - 991.22s | this is in my office. 991.22s - 992.54s | I'm not blurring the background. 992.54s - 993.62s | I'm showing me. 993.62s - 995.18s | He knows my book is something 995.18s - 997.38s | I put a lot of work into that was important. 997.38s - 999.14s | And this note's handwritten. 999.14s - 999.98s | I signed it. 999.98s - 1001.62s | It's got the date. 1001.62s - 1003.34s | Before I took this picture, I asked him, 1003.34s


chunk_id: 173_chunk_25
chunk_text:
to him. 967.26s - 968.78s | But I thought this was interesting, 968.78s - 972.14s | especially now that I know more about him and his past. 973.38s - 975.42s | So the next thing I needed to do 975.46s - 977.02s | was I needed to send him gifts. 977.02s - 978.78s | I mean, if we're gonna go out and date, 978.78s - 981.06s | you know, I gotta send him some gifts. 981.06s - 983.30s | And again, this picture, 983.30s - 984.62s | let me break this down for you guys 984.62s - 986.26s | because it may not seem like much, 986.26s - 989.94s | but from an operational standpoint, 989.94s - 991.22s | this is in my office. 991.22s - 992.54s | I'm not blurring the background. 992.54s - 993.62s | I'm showing me. 993.62s - 995.18s | He knows my book is something 995.18s - 997.38s | I put a lot of work into that was important. 997.38s - 999.14s | And this note's handwritten. 999.14s - 999.98s | I signed it. 999.98s - 1001.62s | It's got the date. 1001.62s - 1003.34s | Before I took this picture, I asked him, 1003.34s - 1006.38s | I said, hey man, I just need your real world name 1006.38s - 1007.66s | and your home address. 1007.66s - 1009.54s | I'm gonna send you this awesome gift. 1009.54s - 1011.74s | And he, I did. 1011.74s - 1014.38s | And he laughed and, you know, he said to me, 1014.38s - 1015.90s | yeah, Johnny, I can't do that. 1015.90s - 1018.38s | If I do that, you're gonna get me arrested. 1018.38s - 1021.42s | But I'm sharing that because this was very much 1021.42s - 1024.30s | a cat and mouse chase relationship. 1024.30s - 1027.82s | And he enjoyed this as much as I did. 1027.82s - 1031.98s | There's a, I mean, I wrote over 400 pages of content 1032.18s - 1033.98s | about this dude in the past two years 1033.98s - 1036.74s | amongst all the Ransomware Diaries volumes. 1036.74s - 1038.62s | Every time something would come out, he'd get pissed, 1038.62s - 1039.86s | but he'd always come back 1039.86s - 1042.50s | because he loved the game as much as I did. 1043.50s - 1045.42s | And I was obsessed with this motherfucker. 1045.42s -


chunk_id: 173_chunk_26
chunk_text:
- 1006.38s | I said, hey man, I just need your real world name 1006.38s - 1007.66s | and your home address. 1007.66s - 1009.54s | I'm gonna send you this awesome gift. 1009.54s - 1011.74s | And he, I did. 1011.74s - 1014.38s | And he laughed and, you know, he said to me, 1014.38s - 1015.90s | yeah, Johnny, I can't do that. 1015.90s - 1018.38s | If I do that, you're gonna get me arrested. 1018.38s - 1021.42s | But I'm sharing that because this was very much 1021.42s - 1024.30s | a cat and mouse chase relationship. 1024.30s - 1027.82s | And he enjoyed this as much as I did. 1027.82s - 1031.98s | There's a, I mean, I wrote over 400 pages of content 1032.18s - 1033.98s | about this dude in the past two years 1033.98s - 1036.74s | amongst all the Ransomware Diaries volumes. 1036.74s - 1038.62s | Every time something would come out, he'd get pissed, 1038.62s - 1039.86s | but he'd always come back 1039.86s - 1042.50s | because he loved the game as much as I did. 1043.50s - 1045.42s | And I was obsessed with this motherfucker. 1045.42s - 1046.26s | I'm not gonna lie. 1046.26s - 1048.34s | Like, this is where I spent every waking moment 1048.34s - 1049.22s | was doing this stuff. 1049.22s - 1051.58s | Like, I really, really was obsessed. 1051.58s - 1052.98s | But back to this picture. 1052.98s - 1054.62s | There's the most important part of it 1054.62s - 1056.30s | that I want you guys to pay attention to 1056.30s - 1060.18s | is this seductive look in my eyes. 1060.30s - 1064.42s | That was not an accident, okay? 1064.42s - 1067.38s | I sent him that picture and he responded, 1067.38s - 1068.70s | thank you for the photo. 1068.70s - 1070.30s | You're a very handsome man, right? 1070.30s - 1071.78s | Yeah, yeah. 1071.78s - 1074.46s | You look like Bruce Willis and Chuck Norris. 1076.30s - 1078.42s | I see Chuck, you know, the hair. 1078.42s - 1079.30s | I don't know about Bruce, 1079.30s - 1081.50s | but you guys tell me what you think. 1084.82s - 1086.46s | It was crazy, this was a crazy experience 1086.46s - 1087.30s | I had with this dude, man. 1087.30s - 1089.26s | I'll never


chunk_id: 173_chunk_27
chunk_text:
1046.26s | I'm not gonna lie. 1046.26s - 1048.34s | Like, this is where I spent every waking moment 1048.34s - 1049.22s | was doing this stuff. 1049.22s - 1051.58s | Like, I really, really was obsessed. 1051.58s - 1052.98s | But back to this picture. 1052.98s - 1054.62s | There's the most important part of it 1054.62s - 1056.30s | that I want you guys to pay attention to 1056.30s - 1060.18s | is this seductive look in my eyes. 1060.30s - 1064.42s | That was not an accident, okay? 1064.42s - 1067.38s | I sent him that picture and he responded, 1067.38s - 1068.70s | thank you for the photo. 1068.70s - 1070.30s | You're a very handsome man, right? 1070.30s - 1071.78s | Yeah, yeah. 1071.78s - 1074.46s | You look like Bruce Willis and Chuck Norris. 1076.30s - 1078.42s | I see Chuck, you know, the hair. 1078.42s - 1079.30s | I don't know about Bruce, 1079.30s - 1081.50s | but you guys tell me what you think. 1084.82s - 1086.46s | It was crazy, this was a crazy experience 1086.46s - 1087.30s | I had with this dude, man. 1087.30s - 1089.26s | I'll never have a story like this in the rest of my career, 1089.26s - 1091.86s | but this was what happened. 1091.86s - 1093.50s | You know, we were cool with each other, we were joking. 1093.50s - 1096.10s | You know, this wasn't a thing where he's like, 1096.10s - 1097.26s | oh, you're hot type of thing. 1097.26s - 1098.42s | I'm making that a joke. 1098.42s - 1100.42s | But we were just shooting the shit, you know? 1100.42s - 1101.54s | We were just cool with each other. 1101.54s - 1106.10s | But all of those things built up to the output 1106.10s - 1107.70s | of all that information over the years 1107.70s - 1108.98s | that I've put out on LockBit 1108.98s - 1111.50s | and nobody's just ever gotten to see this stuff. 1112.74s - 1115.78s | So after that, we went on our first date. 1115.78s - 1118.10s | So LockBit and I had the opportunity 1118.10s - 1119.70s | to go on this show Trafficked 1119.70s - 1122.94s | and got them to agree to it. 1122.94s - 1126.38s | And it took about six months to produce this show 1126.38s -


chunk_id: 173_chunk_28
chunk_text:
have a story like this in the rest of my career, 1089.26s - 1091.86s | but this was what happened. 1091.86s - 1093.50s | You know, we were cool with each other, we were joking. 1093.50s - 1096.10s | You know, this wasn't a thing where he's like, 1096.10s - 1097.26s | oh, you're hot type of thing. 1097.26s - 1098.42s | I'm making that a joke. 1098.42s - 1100.42s | But we were just shooting the shit, you know? 1100.42s - 1101.54s | We were just cool with each other. 1101.54s - 1106.10s | But all of those things built up to the output 1106.10s - 1107.70s | of all that information over the years 1107.70s - 1108.98s | that I've put out on LockBit 1108.98s - 1111.50s | and nobody's just ever gotten to see this stuff. 1112.74s - 1115.78s | So after that, we went on our first date. 1115.78s - 1118.10s | So LockBit and I had the opportunity 1118.10s - 1119.70s | to go on this show Trafficked 1119.70s - 1122.94s | and got them to agree to it. 1122.94s - 1126.38s | And it took about six months to produce this show 1126.38s - 1127.42s | from where they started 1127.42s - 1129.46s | to when it was actually put on the air. 1129.46s - 1131.86s | And that was important because it gave us stuff 1131.86s - 1134.10s | to talk about and to bond 1134.10s - 1137.14s | that was not related to their criminal operation. 1137.14s - 1138.66s | If all I do is ask this dude 1138.66s - 1140.22s | about stuff with his criminal operation, 1140.22s - 1142.46s | this would have been a pretty short relationship. 1142.46s - 1145.54s | And there's only so much content you can have 1145.54s - 1147.02s | outside of the crimes. 1147.02s - 1149.50s | So this gave us lots of stuff to talk to. 1149.50s - 1150.58s | We were both pretty upset. 1150.58s - 1152.78s | We spent all this time working with these people 1152.78s - 1155.14s | and we actually got about two minutes on the show. 1155.14s - 1156.94s | Him too, not just me. 1156.94s - 1158.94s | Anyway, it gave us something to bitch about. 1158.94s - 1159.98s | But it was good 1159.98s - 1161.90s | because we really sort of formed this bond.


chunk_id: 173_chunk_29
chunk_text:
1127.42s | from where they started 1127.42s - 1129.46s | to when it was actually put on the air. 1129.46s - 1131.86s | And that was important because it gave us stuff 1131.86s - 1134.10s | to talk about and to bond 1134.10s - 1137.14s | that was not related to their criminal operation. 1137.14s - 1138.66s | If all I do is ask this dude 1138.66s - 1140.22s | about stuff with his criminal operation, 1140.22s - 1142.46s | this would have been a pretty short relationship. 1142.46s - 1145.54s | And there's only so much content you can have 1145.54s - 1147.02s | outside of the crimes. 1147.02s - 1149.50s | So this gave us lots of stuff to talk to. 1149.50s - 1150.58s | We were both pretty upset. 1150.58s - 1152.78s | We spent all this time working with these people 1152.78s - 1155.14s | and we actually got about two minutes on the show. 1155.14s - 1156.94s | Him too, not just me. 1156.94s - 1158.94s | Anyway, it gave us something to bitch about. 1158.94s - 1159.98s | But it was good 1159.98s - 1161.90s | because we really sort of formed this bond. 1161.90s - 1164.06s | And our relationship got strong 1164.06s - 1166.02s | and we were talking so much 1166.02s - 1167.98s | that I couldn't go on vacation 1167.98s - 1170.10s | without bringing my second laptop 1170.10s - 1172.34s | to have conversations with this dude. 1172.34s - 1175.10s | And I can't be like, hey, it's after 5 p.m. dude 1175.14s - 1178.58s | or hey, it's a Saturday, I'm off, I'm not gonna talk 1178.58s - 1181.30s | because this is supposed to be a real relationship. 1181.30s - 1183.10s | I'm supposed to really be his friend. 1183.10s - 1186.30s | So again, and when I say this was an obsession, 1186.30s - 1188.30s | I really mean this was an obsession for me. 1188.30s - 1191.02s | I really got, I lived for this work. 1191.02s - 1193.82s | I wanted this dude, I wanted to get this dude. 1193.82s - 1196.02s | So it took over my life. 1196.02s - 1198.26s | It took time away from my family. 1198.26s - 1201.50s | It was not healthy, but it's what I chose to do. 1201.50s - 1204.06s | And it was very effective,


chunk_id: 173_chunk_30
chunk_text:
1161.90s - 1164.06s | And our relationship got strong 1164.06s - 1166.02s | and we were talking so much 1166.02s - 1167.98s | that I couldn't go on vacation 1167.98s - 1170.10s | without bringing my second laptop 1170.10s - 1172.34s | to have conversations with this dude. 1172.34s - 1175.10s | And I can't be like, hey, it's after 5 p.m. dude 1175.14s - 1178.58s | or hey, it's a Saturday, I'm off, I'm not gonna talk 1178.58s - 1181.30s | because this is supposed to be a real relationship. 1181.30s - 1183.10s | I'm supposed to really be his friend. 1183.10s - 1186.30s | So again, and when I say this was an obsession, 1186.30s - 1188.30s | I really mean this was an obsession for me. 1188.30s - 1191.02s | I really got, I lived for this work. 1191.02s - 1193.82s | I wanted this dude, I wanted to get this dude. 1193.82s - 1196.02s | So it took over my life. 1196.02s - 1198.26s | It took time away from my family. 1198.26s - 1201.50s | It was not healthy, but it's what I chose to do. 1201.50s - 1204.06s | And it was very effective, 1204.06s - 1205.70s | but it was very time consuming. 1205.70s - 1208.62s | And I needed to take a step back from it. 1208.62s - 1212.26s | And things started to get awkward between us. 1212.26s - 1214.26s | And the reason it got awkward is, 1214.26s - 1217.30s | and it's not so much, this is just one example of many, 1217.30s - 1219.54s | but LockBit on the forums 1219.54s - 1222.66s | is extremely confrontational and dramatic. 1223.58s - 1224.86s | So, and this is just an example. 1224.86s - 1227.10s | He's talking to Batty, who's one of the leads 1227.10s - 1229.58s | for what was Royal Ransomware 1229.58s - 1231.46s | at the time of this conversation. 1231.46s - 1233.42s | He was trying to get into their panel. 1233.46s - 1235.18s | He wanted to take their builder. 1235.18s - 1236.38s | Batty was pissed and was like, 1236.38s - 1239.70s | why are you trying to get my guys to give you access? 1239.70s - 1242.30s | LockBit's accusing of being in the FSB. 1242.30s - 1244.02s | He's always getting into these heated arguments, 1244.02s - 1246.34s | but he's


chunk_id: 173_chunk_31
chunk_text:
1204.06s - 1205.70s | but it was very time consuming. 1205.70s - 1208.62s | And I needed to take a step back from it. 1208.62s - 1212.26s | And things started to get awkward between us. 1212.26s - 1214.26s | And the reason it got awkward is, 1214.26s - 1217.30s | and it's not so much, this is just one example of many, 1217.30s - 1219.54s | but LockBit on the forums 1219.54s - 1222.66s | is extremely confrontational and dramatic. 1223.58s - 1224.86s | So, and this is just an example. 1224.86s - 1227.10s | He's talking to Batty, who's one of the leads 1227.10s - 1229.58s | for what was Royal Ransomware 1229.58s - 1231.46s | at the time of this conversation. 1231.46s - 1233.42s | He was trying to get into their panel. 1233.46s - 1235.18s | He wanted to take their builder. 1235.18s - 1236.38s | Batty was pissed and was like, 1236.38s - 1239.70s | why are you trying to get my guys to give you access? 1239.70s - 1242.30s | LockBit's accusing of being in the FSB. 1242.30s - 1244.02s | He's always getting into these heated arguments, 1244.02s - 1246.34s | but he's doing it, at least on this particular forum, 1246.34s - 1247.42s | with my face. 1247.42s - 1249.10s | So you've got all these criminals. 1249.10s - 1251.54s | You've probably got the FSB out there looking at stuff 1251.54s - 1254.18s | and somebody's gonna ask, who the fuck is this guy? 1256.18s - 1258.50s | So I needed things to take a step back 1258.50s - 1261.46s | and I needed to find a way to do that gracefully 1261.46s - 1262.62s | and with style. 1262.66s - 1265.22s | So, I started the motherfucker. 1267.22s - 1268.50s | I actually did this. 1268.50s - 1270.02s | I knew, he knew me, I knew him. 1270.02s - 1271.58s | I knew he'd know I was fucking with him 1271.58s - 1273.34s | or I thought he'd know I was fucking with him. 1273.34s - 1275.06s | So I made this post. 1275.06s - 1278.02s | I made myself the bad guy, JohnBit3.0. 1278.02s - 1279.74s | I made him the victim 1279.74s - 1281.94s | and I put in there LockBit Ransomware Gang 1281.94s - 1285.22s | being a pain in my ass since September 3rd, 2019 1285.22s


chunk_id: 173_chunk_32
chunk_text:
doing it, at least on this particular forum, 1246.34s - 1247.42s | with my face. 1247.42s - 1249.10s | So you've got all these criminals. 1249.10s - 1251.54s | You've probably got the FSB out there looking at stuff 1251.54s - 1254.18s | and somebody's gonna ask, who the fuck is this guy? 1256.18s - 1258.50s | So I needed things to take a step back 1258.50s - 1261.46s | and I needed to find a way to do that gracefully 1261.46s - 1262.62s | and with style. 1262.66s - 1265.22s | So, I started the motherfucker. 1267.22s - 1268.50s | I actually did this. 1268.50s - 1270.02s | I knew, he knew me, I knew him. 1270.02s - 1271.58s | I knew he'd know I was fucking with him 1271.58s - 1273.34s | or I thought he'd know I was fucking with him. 1273.34s - 1275.06s | So I made this post. 1275.06s - 1278.02s | I made myself the bad guy, JohnBit3.0. 1278.02s - 1279.74s | I made him the victim 1279.74s - 1281.94s | and I put in there LockBit Ransomware Gang 1281.94s - 1285.22s | being a pain in my ass since September 3rd, 2019 1285.22s - 1287.38s | and told him if he didn't pay me $10 million, 1287.38s - 1289.10s | I was gonna release his secrets. 1289.10s - 1290.78s | Now, that was just the fucking report. 1290.78s - 1293.22s | It was the Ransomware Diaries called LockBit Secrets. 1293.22s - 1294.38s | Yes, there were secrets. 1294.38s - 1297.26s | They were like stuff he'd lied to his business partners about 1297.26s - 1298.90s | and problems in his operation 1298.90s - 1300.02s | that he didn't want people to know 1300.02s - 1302.18s | but nobody was paying $10 million. 1302.18s - 1303.14s | It was a joke. 1303.14s - 1305.46s | But to make sure he took me seriously, 1305.46s - 1307.34s | I posted this the next day. 1307.34s - 1308.18s | All right? 1312.26s - 1314.98s | Now, I went to go talk to him about it 1314.98s - 1318.18s | to see what he would say when I didn't hear from him 1318.18s - 1319.90s | but something interesting happened. 1319.90s - 1321.66s | He went offline. 1321.66s - 1323.06s | I thought he blocked me. 1323.06s - 1325.06s | He didn't, nobody could access him 1325.06s


chunk_id: 173_chunk_33
chunk_text:
- 1287.38s | and told him if he didn't pay me $10 million, 1287.38s - 1289.10s | I was gonna release his secrets. 1289.10s - 1290.78s | Now, that was just the fucking report. 1290.78s - 1293.22s | It was the Ransomware Diaries called LockBit Secrets. 1293.22s - 1294.38s | Yes, there were secrets. 1294.38s - 1297.26s | They were like stuff he'd lied to his business partners about 1297.26s - 1298.90s | and problems in his operation 1298.90s - 1300.02s | that he didn't want people to know 1300.02s - 1302.18s | but nobody was paying $10 million. 1302.18s - 1303.14s | It was a joke. 1303.14s - 1305.46s | But to make sure he took me seriously, 1305.46s - 1307.34s | I posted this the next day. 1307.34s - 1308.18s | All right? 1312.26s - 1314.98s | Now, I went to go talk to him about it 1314.98s - 1318.18s | to see what he would say when I didn't hear from him 1318.18s - 1319.90s | but something interesting happened. 1319.90s - 1321.66s | He went offline. 1321.66s - 1323.06s | I thought he blocked me. 1323.06s - 1325.06s | He didn't, nobody could access him 1325.06s - 1326.18s | and it was both his accounts, 1326.18s - 1329.02s | his support account and his private account were offline 1329.02s - 1331.30s | and then I started getting messages from his affiliates 1331.30s - 1332.74s | and from security researchers too 1332.74s - 1336.22s | but the important part of that is the affiliates 1336.22s - 1338.58s | saying, you know, he's been offline. 1338.58s - 1339.74s | We're beginning to worry. 1339.74s - 1341.78s | We think he's in prison or dead. 1341.78s - 1343.14s | Are you part of this? 1344.86s - 1347.14s | Look guys, that's cool you think I'm like, 1347.14s - 1348.66s | you know, that effective 1348.66s - 1350.50s | but I'm not kicking anybody's door in. 1350.50s - 1352.22s | I'm not jumping out of planes in Russia 1352.22s - 1353.70s | and pulling you out in the middle of the night. 1353.70s - 1355.78s | You know, I was just fucking around. 1355.78s - 1356.62s | It was a post. 1356.62s - 1359.34s | I couldn't believe that people were believing this. 1359.34s - 1360.66s | This is another one. 1360.66s - 1361.50s | Bastard Lord, you know, 1361.50s


chunk_id: 173_chunk_34
chunk_text:
- 1326.18s | and it was both his accounts, 1326.18s - 1329.02s | his support account and his private account were offline 1329.02s - 1331.30s | and then I started getting messages from his affiliates 1331.30s - 1332.74s | and from security researchers too 1332.74s - 1336.22s | but the important part of that is the affiliates 1336.22s - 1338.58s | saying, you know, he's been offline. 1338.58s - 1339.74s | We're beginning to worry. 1339.74s - 1341.78s | We think he's in prison or dead. 1341.78s - 1343.14s | Are you part of this? 1344.86s - 1347.14s | Look guys, that's cool you think I'm like, 1347.14s - 1348.66s | you know, that effective 1348.66s - 1350.50s | but I'm not kicking anybody's door in. 1350.50s - 1352.22s | I'm not jumping out of planes in Russia 1352.22s - 1353.70s | and pulling you out in the middle of the night. 1353.70s - 1355.78s | You know, I was just fucking around. 1355.78s - 1356.62s | It was a post. 1356.62s - 1359.34s | I couldn't believe that people were believing this. 1359.34s - 1360.66s | This is another one. 1360.66s - 1361.50s | Bastard Lord, you know, 1361.50s - 1363.10s | you actually found a way to de-anonymize 1363.10s - 1364.06s | everyone from LockBit. 1364.06s - 1367.02s | Like guys, I wish I was a badass hacker to that level. 1367.02s - 1368.70s | Like, you know, I can fuck around a little bit 1368.70s - 1370.78s | but damn, no, no, this was a joke. 1370.78s - 1373.38s | I wouldn't have used Twitter to do it if it was real. 1375.10s - 1377.46s | But I found out why. 1377.46s - 1380.34s | I got this DM with this image 1380.34s - 1382.06s | and I cut off the top of this 1382.06s - 1383.66s | because it had the URL. 1383.66s - 1385.82s | But anyway, it was to the admin page 1385.82s - 1387.86s | and it said, it was the old URL. 1387.86s - 1390.10s | But anyway, it said, do we really have to? 1390.10s - 1392.62s | And it was referencing the authentication 1392.62s - 1394.54s | part of the page for the panel. 1394.54s - 1395.78s | So obviously it insinuates, okay, 1395.78s - 1397.94s | we bypassed it and we got in. 1397.94s - 1399.50s | Now things


chunk_id: 173_chunk_35
chunk_text:
- 1363.10s | you actually found a way to de-anonymize 1363.10s - 1364.06s | everyone from LockBit. 1364.06s - 1367.02s | Like guys, I wish I was a badass hacker to that level. 1367.02s - 1368.70s | Like, you know, I can fuck around a little bit 1368.70s - 1370.78s | but damn, no, no, this was a joke. 1370.78s - 1373.38s | I wouldn't have used Twitter to do it if it was real. 1375.10s - 1377.46s | But I found out why. 1377.46s - 1380.34s | I got this DM with this image 1380.34s - 1382.06s | and I cut off the top of this 1382.06s - 1383.66s | because it had the URL. 1383.66s - 1385.82s | But anyway, it was to the admin page 1385.82s - 1387.86s | and it said, it was the old URL. 1387.86s - 1390.10s | But anyway, it said, do we really have to? 1390.10s - 1392.62s | And it was referencing the authentication 1392.62s - 1394.54s | part of the page for the panel. 1394.54s - 1395.78s | So obviously it insinuates, okay, 1395.78s - 1397.94s | we bypassed it and we got in. 1397.94s - 1399.50s | Now things were making sense. 1399.50s - 1401.02s | I threatened the dude. 1401.02s - 1404.30s | He finds out somebody's really trying to hack him. 1404.34s - 1407.42s | He starts to believe maybe I actually did 1407.42s - 1409.26s | and thinks that I'm in his, in his, 1409.26s - 1411.70s | in his infrastructure fucking around. 1411.70s - 1413.86s | I found out pretty quickly what happened. 1413.86s - 1415.78s | Thank you, ProDaft. 1415.78s - 1416.90s | They actually did an op 1416.90s - 1419.22s | and apparently they're the ones who hacked him. 1419.22s - 1422.14s | I was just there, good timing to, to, 1422.14s - 1426.30s | to make that threat and, and, and fit into that situation. 1426.30s - 1427.78s | But it made for fun. 1427.78s - 1429.34s | It made for, that happened last summer 1429.34s - 1432.14s | and that made for a really fun DEF CON for me, trust me. 1432.18s - 1436.54s | Uh, so after that, uh, LockBit did come back 1436.54s - 1437.82s | about two weeks later. 1437.82s - 1440.46s | Uh, you know, we hugged it out, we were good, 1440.46s - 1443.18s | but


chunk_id: 173_chunk_36
chunk_text:
were making sense. 1399.50s - 1401.02s | I threatened the dude. 1401.02s - 1404.30s | He finds out somebody's really trying to hack him. 1404.34s - 1407.42s | He starts to believe maybe I actually did 1407.42s - 1409.26s | and thinks that I'm in his, in his, 1409.26s - 1411.70s | in his infrastructure fucking around. 1411.70s - 1413.86s | I found out pretty quickly what happened. 1413.86s - 1415.78s | Thank you, ProDaft. 1415.78s - 1416.90s | They actually did an op 1416.90s - 1419.22s | and apparently they're the ones who hacked him. 1419.22s - 1422.14s | I was just there, good timing to, to, 1422.14s - 1426.30s | to make that threat and, and, and fit into that situation. 1426.30s - 1427.78s | But it made for fun. 1427.78s - 1429.34s | It made for, that happened last summer 1429.34s - 1432.14s | and that made for a really fun DEF CON for me, trust me. 1432.18s - 1436.54s | Uh, so after that, uh, LockBit did come back 1436.54s - 1437.82s | about two weeks later. 1437.82s - 1440.46s | Uh, you know, we hugged it out, we were good, 1440.46s - 1443.18s | but things were off still, all right? 1443.18s - 1445.66s | This is how I know things were off. 1445.66s - 1448.90s | I said, sorry, um, told him I'm glad he wasn't dead 1448.90s - 1450.54s | or anything like that. 1450.54s - 1452.70s | He didn't send me a cat emoji. 1452.70s - 1455.38s | He always sent me cat emojis and stickers. 1455.38s - 1457.02s | This is a very passive aggressive way 1457.02s - 1458.70s | of him telling me that he's mad at me. 1458.70s - 1462.30s | Uh, but, and our conversation started to dwindle 1462.30s - 1465.42s | and, um, it didn't take long. 1465.42s - 1468.30s | He was having an emotional relationship with someone else. 1468.30s - 1469.78s | He was. 1469.78s - 1471.98s | Uh, I drove by his house one night, 1471.98s - 1475.06s | by his house I mean his, uh, his infrastructure. 1475.06s - 1477.42s | And this new bitch left their shit all over. 1477.42s - 1480.46s | The hairbrush was on the kitchen sink, okay? 1480.46s - 1481.92s | Their hair tie is on the door. 1481.92s - 1484.34s | They wanted me to know they


chunk_id: 173_chunk_37
chunk_text:
things were off still, all right? 1443.18s - 1445.66s | This is how I know things were off. 1445.66s - 1448.90s | I said, sorry, um, told him I'm glad he wasn't dead 1448.90s - 1450.54s | or anything like that. 1450.54s - 1452.70s | He didn't send me a cat emoji. 1452.70s - 1455.38s | He always sent me cat emojis and stickers. 1455.38s - 1457.02s | This is a very passive aggressive way 1457.02s - 1458.70s | of him telling me that he's mad at me. 1458.70s - 1462.30s | Uh, but, and our conversation started to dwindle 1462.30s - 1465.42s | and, um, it didn't take long. 1465.42s - 1468.30s | He was having an emotional relationship with someone else. 1468.30s - 1469.78s | He was. 1469.78s - 1471.98s | Uh, I drove by his house one night, 1471.98s - 1475.06s | by his house I mean his, uh, his infrastructure. 1475.06s - 1477.42s | And this new bitch left their shit all over. 1477.42s - 1480.46s | The hairbrush was on the kitchen sink, okay? 1480.46s - 1481.92s | Their hair tie is on the door. 1481.92s - 1484.34s | They wanted me to know they had been there. 1484.34s - 1488.66s | Uh, so the NCA had locked down LockBit's infrastructure, 1488.66s - 1491.86s | um, put their shit up everywhere. 1491.86s - 1494.90s | So, you know, I was upset and I didn't like that. 1494.90s - 1498.14s | Uh, but then when, when you go to log into the panel, 1498.14s - 1500.14s | there's this new message and it's basically saying, 1500.14s - 1504.06s | hey, uh, we, we've got all of your, your chat logs. 1504.06s - 1507.14s | We know what victims you're responsible for 1507.14s - 1508.68s | and we've got your wallets. 1508.68s - 1513.68s | Now, this is meant for criminals to see and they did. 1513.88s - 1516.52s | And it was meant to play a psychological role 1516.52s - 1517.80s | and it certainly did. 1517.80s - 1518.88s | But you guys got to remember, 1518.88s - 1521.80s | they're also looking at my conversations. 1521.80s - 1522.64s | They're looking at all the, 1522.64s - 1524.04s | all the conversations that I'm having. 1524.04s - 1525.98s | They're probably seeing my account in there 1525.98s - 1526.82s | and everything else. 1526.82s - 1528.56s


chunk_id: 173_chunk_38
chunk_text:
had been there. 1484.34s - 1488.66s | Uh, so the NCA had locked down LockBit's infrastructure, 1488.66s - 1491.86s | um, put their shit up everywhere. 1491.86s - 1494.90s | So, you know, I was upset and I didn't like that. 1494.90s - 1498.14s | Uh, but then when, when you go to log into the panel, 1498.14s - 1500.14s | there's this new message and it's basically saying, 1500.14s - 1504.06s | hey, uh, we, we've got all of your, your chat logs. 1504.06s - 1507.14s | We know what victims you're responsible for 1507.14s - 1508.68s | and we've got your wallets. 1508.68s - 1513.68s | Now, this is meant for criminals to see and they did. 1513.88s - 1516.52s | And it was meant to play a psychological role 1516.52s - 1517.80s | and it certainly did. 1517.80s - 1518.88s | But you guys got to remember, 1518.88s - 1521.80s | they're also looking at my conversations. 1521.80s - 1522.64s | They're looking at all the, 1522.64s - 1524.04s | all the conversations that I'm having. 1524.04s - 1525.98s | They're probably seeing my account in there 1525.98s - 1526.82s | and everything else. 1526.82s - 1528.56s | So, um, that was a little bit like, 1528.56s - 1530.28s | oh boy, I might be in some trouble here. 1530.28s - 1533.96s | Uh, but again, they were fucking with my man. 1533.96s - 1534.84s | So I was upset. 1535.84s - 1538.06s | Uh, but LockBit wasn't going to go down, uh, 1538.06s - 1538.90s | without swinging. 1538.90s - 1540.56s | I knew he wasn't going to rebrand. 1540.56s - 1543.80s | He stood a new, his new, uh, infrastructure up, 1543.80s - 1546.56s | made, made the FBI his first victim. 1546.56s - 1547.68s | But when you click on it, 1547.68s - 1550.56s | he's got like this three page long ass letter 1550.56s - 1552.78s | that nobody wants to fucking read about what happened. 1552.78s - 1554.48s | Basically saying he got fat and lazy 1554.48s - 1557.92s | and forgot to upgrade some stuff and they came in 1557.92s - 1559.88s | and it wouldn't happen again. 1559.88s - 1562.04s | And that business would continue as usual. 1563.12s - 1566.86s | Um, but like I said, our relationship was now affected. 1566.86s - 1571.46s | And like all things,


chunk_id: 173_chunk_39
chunk_text:
| So, um, that was a little bit like, 1528.56s - 1530.28s | oh boy, I might be in some trouble here. 1530.28s - 1533.96s | Uh, but again, they were fucking with my man. 1533.96s - 1534.84s | So I was upset. 1535.84s - 1538.06s | Uh, but LockBit wasn't going to go down, uh, 1538.06s - 1538.90s | without swinging. 1538.90s - 1540.56s | I knew he wasn't going to rebrand. 1540.56s - 1543.80s | He stood a new, his new, uh, infrastructure up, 1543.80s - 1546.56s | made, made the FBI his first victim. 1546.56s - 1547.68s | But when you click on it, 1547.68s - 1550.56s | he's got like this three page long ass letter 1550.56s - 1552.78s | that nobody wants to fucking read about what happened. 1552.78s - 1554.48s | Basically saying he got fat and lazy 1554.48s - 1557.92s | and forgot to upgrade some stuff and they came in 1557.92s - 1559.88s | and it wouldn't happen again. 1559.88s - 1562.04s | And that business would continue as usual. 1563.12s - 1566.86s | Um, but like I said, our relationship was now affected. 1566.86s - 1571.46s | And like all things, um, you know, 1571.46s - 1572.50s | they do come to an end. 1572.50s - 1574.02s | And, and hitting pause on the jokes, 1574.02s - 1575.54s | like we really did have a relationship 1575.54s - 1577.18s | and it really did have ups and downs. 1577.18s - 1579.14s | I, I'm just kind of adding some, 1579.14s - 1581.94s | some theatrics to it to make it a, a fun talk. 1581.94s - 1584.54s | But, but we really did have this, this long-term, 1584.54s - 1587.30s | this was like over two years, this long-term relationship. 1587.30s - 1590.94s | Um, and I did actually get to like the guy a little bit 1590.94s - 1592.02s | and then this happened 1592.02s - 1594.82s | and this got me really, really upset. 1594.86s - 1597.70s | Uh, so LockBit hit St. Anthony's Hospital 1597.70s - 1599.38s | and I'm talking to him about it. 1599.38s - 1602.22s | And I truly believed that I could get him 1602.22s - 1603.74s | to give them decryption key. 1603.74s - 1606.66s | And the reason I believe that is because, you know, 1606.66s - 1610.10s | sick kids, which,


chunk_id: 173_chunk_40
chunk_text:
um, you know, 1571.46s - 1572.50s | they do come to an end. 1572.50s - 1574.02s | And, and hitting pause on the jokes, 1574.02s - 1575.54s | like we really did have a relationship 1575.54s - 1577.18s | and it really did have ups and downs. 1577.18s - 1579.14s | I, I'm just kind of adding some, 1579.14s - 1581.94s | some theatrics to it to make it a, a fun talk. 1581.94s - 1584.54s | But, but we really did have this, this long-term, 1584.54s - 1587.30s | this was like over two years, this long-term relationship. 1587.30s - 1590.94s | Um, and I did actually get to like the guy a little bit 1590.94s - 1592.02s | and then this happened 1592.02s - 1594.82s | and this got me really, really upset. 1594.86s - 1597.70s | Uh, so LockBit hit St. Anthony's Hospital 1597.70s - 1599.38s | and I'm talking to him about it. 1599.38s - 1602.22s | And I truly believed that I could get him 1602.22s - 1603.74s | to give them decryption key. 1603.74s - 1606.66s | And the reason I believe that is because, you know, 1606.66s - 1610.10s | sick kids, which, uh, it deals with, with kids with cancer, 1610.10s - 1613.34s | um, he did the right thing and, and gave the key back to them. 1613.34s - 1614.78s | Well, St. Anthony's Hospital 1614.78s - 1617.30s | has a large children's cancer ward. 1618.18s - 1620.78s | So I talked to him about it and I said, look, man, uh, 1620.78s - 1621.62s | give them back the key. 1621.62s - 1622.78s | You've still got their data. 1622.78s - 1624.62s | If you're going to extort them, you're going to extort them. 1624.62s - 1626.94s | You know, you're greedy, but you're not a monster. 1626.94s - 1627.94s | Just do the right thing. 1627.94s - 1629.82s | And he wouldn't do it and kept telling me, you know, 1629.82s - 1632.30s | when he, he, when I saw the data, I'd understand. 1632.30s - 1633.70s | Well, unless you're going to show me 1633.70s - 1636.58s | that they hired a bunch of kids to pretend they had cancer, 1636.58s - 1637.78s | I'm not going to change my mind. 1637.78s - 1639.34s | I don't give a shit what they do with their money. 1639.34s -


chunk_id: 173_chunk_41
chunk_text:
uh, it deals with, with kids with cancer, 1610.10s - 1613.34s | um, he did the right thing and, and gave the key back to them. 1613.34s - 1614.78s | Well, St. Anthony's Hospital 1614.78s - 1617.30s | has a large children's cancer ward. 1618.18s - 1620.78s | So I talked to him about it and I said, look, man, uh, 1620.78s - 1621.62s | give them back the key. 1621.62s - 1622.78s | You've still got their data. 1622.78s - 1624.62s | If you're going to extort them, you're going to extort them. 1624.62s - 1626.94s | You know, you're greedy, but you're not a monster. 1626.94s - 1627.94s | Just do the right thing. 1627.94s - 1629.82s | And he wouldn't do it and kept telling me, you know, 1629.82s - 1632.30s | when he, he, when I saw the data, I'd understand. 1632.30s - 1633.70s | Well, unless you're going to show me 1633.70s - 1636.58s | that they hired a bunch of kids to pretend they had cancer, 1636.58s - 1637.78s | I'm not going to change my mind. 1637.78s - 1639.34s | I don't give a shit what they do with their money. 1639.34s - 1641.70s | Like these are kids suffering. 1641.70s - 1643.86s | And, uh, I started to realize, you know, 1643.86s - 1645.62s | I'd gotten too close to this. 1645.62s - 1647.50s | You know, this guy's a fucking cockroach. 1647.50s - 1649.58s | Anybody that fucks with kids, like, I mean, 1649.58s - 1651.90s | I, I guess I got too close cause I, I didn't see it. 1651.90s - 1653.58s | And I, I naively believed I'd get, 1653.58s - 1655.30s | I could get him to give the key back. 1655.30s - 1658.42s | Um, and I couldn't, and I sat there for, 1658.42s - 1660.50s | I was in my office and I sat there for a good hour 1660.50s - 1662.06s | and I typed this message up, 1662.06s - 1663.42s | telling him to go fuck himself, 1663.42s - 1665.18s | telling him that I was coming for him. 1665.18s - 1667.74s | Think I even had the fucking taking quotes in there. 1667.74s - 1670.86s | Uh, but if you do this type of work, 1670.86s - 1672.50s | there's some rules that you have to play by. 1672.50s - 1674.10s | And


chunk_id: 173_chunk_42
chunk_text:
1641.70s | Like these are kids suffering. 1641.70s - 1643.86s | And, uh, I started to realize, you know, 1643.86s - 1645.62s | I'd gotten too close to this. 1645.62s - 1647.50s | You know, this guy's a fucking cockroach. 1647.50s - 1649.58s | Anybody that fucks with kids, like, I mean, 1649.58s - 1651.90s | I, I guess I got too close cause I, I didn't see it. 1651.90s - 1653.58s | And I, I naively believed I'd get, 1653.58s - 1655.30s | I could get him to give the key back. 1655.30s - 1658.42s | Um, and I couldn't, and I sat there for, 1658.42s - 1660.50s | I was in my office and I sat there for a good hour 1660.50s - 1662.06s | and I typed this message up, 1662.06s - 1663.42s | telling him to go fuck himself, 1663.42s - 1665.18s | telling him that I was coming for him. 1665.18s - 1667.74s | Think I even had the fucking taking quotes in there. 1667.74s - 1670.86s | Uh, but if you do this type of work, 1670.86s - 1672.50s | there's some rules that you have to play by. 1672.50s - 1674.10s | And that's that you never let your emotions 1674.10s - 1675.30s | affect what you do. 1675.30s - 1677.06s | And the day that I do let that happen 1677.06s - 1678.30s | is the day that I need to go back 1678.30s - 1682.10s | to being a CTI straight zeros and ones researcher. 1682.10s - 1684.54s | Um, so I didn't, I didn't click send on that. 1684.54s - 1688.46s | Instead, I, I just sent a thumbs up and, and I regrouped. 1688.46s - 1690.42s | But I was, I, I was legitimately, 1690.42s - 1692.18s | personally like affected by this. 1692.18s - 1694.46s | Like it really, really bothered me. 1694.46s - 1697.38s | And, you know, making things worse. 1697.38s - 1700.06s | Um, I know I kind of catfished him 1700.06s - 1701.90s | at the beginning with sock puppets, 1701.90s - 1704.26s | but you know, Lockwood had told me that, 1704.26s - 1706.26s | you know, he lived in New York. 1706.26s - 1707.70s | Sounds legitimate, right? 1707.70s - 1709.86s | Uh, he told me he owned two restaurants 1709.90s - 1713.06s | and he told me he drove a Ferrari.


chunk_id: 173_chunk_43
chunk_text:
that's that you never let your emotions 1674.10s - 1675.30s | affect what you do. 1675.30s - 1677.06s | And the day that I do let that happen 1677.06s - 1678.30s | is the day that I need to go back 1678.30s - 1682.10s | to being a CTI straight zeros and ones researcher. 1682.10s - 1684.54s | Um, so I didn't, I didn't click send on that. 1684.54s - 1688.46s | Instead, I, I just sent a thumbs up and, and I regrouped. 1688.46s - 1690.42s | But I was, I, I was legitimately, 1690.42s - 1692.18s | personally like affected by this. 1692.18s - 1694.46s | Like it really, really bothered me. 1694.46s - 1697.38s | And, you know, making things worse. 1697.38s - 1700.06s | Um, I know I kind of catfished him 1700.06s - 1701.90s | at the beginning with sock puppets, 1701.90s - 1704.26s | but you know, Lockwood had told me that, 1704.26s - 1706.26s | you know, he lived in New York. 1706.26s - 1707.70s | Sounds legitimate, right? 1707.70s - 1709.86s | Uh, he told me he owned two restaurants 1709.90s - 1713.06s | and he told me he drove a Ferrari. 1713.06s - 1717.30s | And now that me and the other man were talking, 1717.30s - 1720.02s | uh, apparently he didn't live in the United States. 1720.02s - 1722.18s | Uh, obviously I knew he lives in Russia. 1722.18s - 1723.42s | I'm being facetious, 1723.42s - 1725.06s | but they said he didn't drive a Lamborghini 1725.06s - 1726.38s | and he drives a Mercedes. 1726.38s - 1727.66s | Now I was pissed. 1727.66s - 1729.70s | Do I look like I'm going to fuck around 1729.70s - 1732.06s | with some dude that's picking me up in a Mercedes? 1732.06s - 1733.02s | That shit better be, 1733.02s - 1735.30s | you better be rolling up in at least a quarter mil. 1735.30s - 1736.98s | I want a Bugatti something. 1736.98s - 1738.26s | I'm not fucking riding around 1738.26s - 1739.58s | with some dude in a Mercedes. 1739.58s - 1740.66s | Get the fuck out of here. 1740.66s - 1742.10s | That shit's a dime a dozen. 1742.10s - 1743.06s | So I was upset. 1743.06s - 1744.46s | I didn't like being lied to. 1744.46s - 1748.22s | So, now shit was, was


chunk_id: 173_chunk_44
chunk_text:
1713.06s - 1717.30s | And now that me and the other man were talking, 1717.30s - 1720.02s | uh, apparently he didn't live in the United States. 1720.02s - 1722.18s | Uh, obviously I knew he lives in Russia. 1722.18s - 1723.42s | I'm being facetious, 1723.42s - 1725.06s | but they said he didn't drive a Lamborghini 1725.06s - 1726.38s | and he drives a Mercedes. 1726.38s - 1727.66s | Now I was pissed. 1727.66s - 1729.70s | Do I look like I'm going to fuck around 1729.70s - 1732.06s | with some dude that's picking me up in a Mercedes? 1732.06s - 1733.02s | That shit better be, 1733.02s - 1735.30s | you better be rolling up in at least a quarter mil. 1735.30s - 1736.98s | I want a Bugatti something. 1736.98s - 1738.26s | I'm not fucking riding around 1738.26s - 1739.58s | with some dude in a Mercedes. 1739.58s - 1740.66s | Get the fuck out of here. 1740.66s - 1742.10s | That shit's a dime a dozen. 1742.10s - 1743.06s | So I was upset. 1743.06s - 1744.46s | I didn't like being lied to. 1744.46s - 1748.22s | So, now shit was, was gonna, was up. 1748.22s - 1750.58s | You know, we, he had both me pissed, 1750.58s - 1752.38s | he had law enforcement pissed, 1752.38s - 1754.22s | and, and I really did want to get him. 1754.22s - 1755.38s | Now that he fucked with kids, 1755.38s - 1757.38s | like, like before I was just fucking around. 1757.38s - 1758.78s | I wanted to get shit so I could write, 1758.78s - 1760.06s | you know, interesting stories. 1760.06s - 1762.42s | As I said, I love telling stories and I love writing. 1762.42s - 1764.42s | But now I was like, it was, it was personal. 1764.42s - 1766.46s | Like I wanted to get this guy. 1766.46s - 1768.54s | Uh, so that shit was on. 1768.58s - 1771.98s | And I was reaching out to, to all my resources. 1771.98s - 1774.78s | Now remember, I built a vast network of, 1774.78s - 1776.42s | of relationships with criminals, 1776.42s - 1779.38s | with affiliates, and with security researchers. 1779.38s - 1781.42s | And I mean, I'm calling in favors 1781.42s - 1783.74s | and I'm, I'm, I'm using myself 1783.74s - 1786.70s | and


chunk_id: 173_chunk_45
chunk_text:
gonna, was up. 1748.22s - 1750.58s | You know, we, he had both me pissed, 1750.58s - 1752.38s | he had law enforcement pissed, 1752.38s - 1754.22s | and, and I really did want to get him. 1754.22s - 1755.38s | Now that he fucked with kids, 1755.38s - 1757.38s | like, like before I was just fucking around. 1757.38s - 1758.78s | I wanted to get shit so I could write, 1758.78s - 1760.06s | you know, interesting stories. 1760.06s - 1762.42s | As I said, I love telling stories and I love writing. 1762.42s - 1764.42s | But now I was like, it was, it was personal. 1764.42s - 1766.46s | Like I wanted to get this guy. 1766.46s - 1768.54s | Uh, so that shit was on. 1768.58s - 1771.98s | And I was reaching out to, to all my resources. 1771.98s - 1774.78s | Now remember, I built a vast network of, 1774.78s - 1776.42s | of relationships with criminals, 1776.42s - 1779.38s | with affiliates, and with security researchers. 1779.38s - 1781.42s | And I mean, I'm calling in favors 1781.42s - 1783.74s | and I'm, I'm, I'm using myself 1783.74s - 1786.70s | and I'm using also sock puppets all at the same time. 1786.70s - 1788.38s | And I'm trying to extract data 1788.38s - 1789.90s | and, and trying to do everything I can 1789.90s - 1791.74s | to figure out who this dude is. 1791.74s - 1794.74s | And LockBin knew what I was doing at this point. 1794.74s - 1796.54s | He started hearing the rumors, you know, 1796.54s - 1798.70s | that I was asking all these questions. 1798.70s - 1801.06s | Um, and I often get tips from people. 1801.06s - 1802.98s | I'll be honest, before the Ransomware Diaries, 1802.98s - 1804.82s | there were probably like 10 of you to who I was, 1804.82s - 1807.62s | uh, unless you were into nation state work. 1807.62s - 1810.54s | Um, but, but once the Ransomware Diaries kicked off, 1810.54s - 1812.58s | uh, you know, it was like being the hot new kid, 1812.58s - 1815.02s | like a hot new, new, new girl at school. 1815.02s - 1816.50s | Like I was getting a lot of attention. 1816.50s - 1819.14s | So I get tips a lot, but often they're bullshit. 1819.14s - 1820.78s |


chunk_id: 173_chunk_46
chunk_text:
I'm using also sock puppets all at the same time. 1786.70s - 1788.38s | And I'm trying to extract data 1788.38s - 1789.90s | and, and trying to do everything I can 1789.90s - 1791.74s | to figure out who this dude is. 1791.74s - 1794.74s | And LockBin knew what I was doing at this point. 1794.74s - 1796.54s | He started hearing the rumors, you know, 1796.54s - 1798.70s | that I was asking all these questions. 1798.70s - 1801.06s | Um, and I often get tips from people. 1801.06s - 1802.98s | I'll be honest, before the Ransomware Diaries, 1802.98s - 1804.82s | there were probably like 10 of you to who I was, 1804.82s - 1807.62s | uh, unless you were into nation state work. 1807.62s - 1810.54s | Um, but, but once the Ransomware Diaries kicked off, 1810.54s - 1812.58s | uh, you know, it was like being the hot new kid, 1812.58s - 1815.02s | like a hot new, new, new girl at school. 1815.02s - 1816.50s | Like I was getting a lot of attention. 1816.50s - 1819.14s | So I get tips a lot, but often they're bullshit. 1819.14s - 1820.78s | So I wasn't exactly sure, 1820.78s - 1823.90s | but I got one saying that follow this email address, 1823.94s - 1828.26s | sitedev5index.ru, and you will find that person 1828.26s - 1831.62s | is the guy behind the LockBitSup persona. 1831.62s - 1833.18s | Um, so I started to look into it, 1833.18s - 1835.86s | but this guy owned two legitimate businesses. 1835.86s - 1838.14s | He owned a handful of websites. 1838.14s - 1840.42s | Every one of them were legitimate businesses. 1840.42s - 1843.46s | So I almost thought this was, was, was, 1843.46s - 1845.42s | was bullshit and walked away. 1845.42s - 1847.18s | And then I saw this. 1847.18s - 1849.26s | Now, most of you have seen this, but you gotta remember, 1849.26s - 1851.42s | this was before the indictment 1851.42s - 1853.10s | and all that other shit that's taken place in the, 1853.10s - 1854.10s | in real world. 1854.10s - 1855.46s | This was before all of that. 1855.46s - 1858.18s | So I saw this and I remember that the, uh, 1858.18s - 1860.58s | the NCA had said, you know, he drove a Mercedes. 1860.58s -


chunk_id: 173_chunk_47
chunk_text:
So I wasn't exactly sure, 1820.78s - 1823.90s | but I got one saying that follow this email address, 1823.94s - 1828.26s | sitedev5index.ru, and you will find that person 1828.26s - 1831.62s | is the guy behind the LockBitSup persona. 1831.62s - 1833.18s | Um, so I started to look into it, 1833.18s - 1835.86s | but this guy owned two legitimate businesses. 1835.86s - 1838.14s | He owned a handful of websites. 1838.14s - 1840.42s | Every one of them were legitimate businesses. 1840.42s - 1843.46s | So I almost thought this was, was, was, 1843.46s - 1845.42s | was bullshit and walked away. 1845.42s - 1847.18s | And then I saw this. 1847.18s - 1849.26s | Now, most of you have seen this, but you gotta remember, 1849.26s - 1851.42s | this was before the indictment 1851.42s - 1853.10s | and all that other shit that's taken place in the, 1853.10s - 1854.10s | in real world. 1854.10s - 1855.46s | This was before all of that. 1855.46s - 1858.18s | So I saw this and I remember that the, uh, 1858.18s - 1860.58s | the NCA had said, you know, he drove a Mercedes. 1860.58s - 1863.30s | So when I saw this in combination with that tip, 1863.30s - 1866.10s | it was just enough to, for me to decide, okay, 1866.10s - 1868.06s | I need to dig in a little further. 1868.06s - 1869.70s | I almost walked away right here. 1869.70s - 1871.58s | And that, again, that would have been the end of the story 1871.58s - 1873.66s | if I had, um, but I didn't. 1873.66s - 1875.58s | And it brought me to this guy, uh, 1875.58s - 1878.02s | Dimitri Horoshevev, if I'm saying that right. 1878.02s - 1880.54s | Uh, and I found these accounts 1880.54s - 1883.66s | and they were all related to malicious things. 1883.66s - 1886.34s | Uh, ransomware, botnets, malware. 1886.34s - 1889.82s | And one of his accounts was even on the same forum 1889.82s - 1892.62s | where he now has my, or used to have my picture 1892.62s - 1893.86s | before he got banned. 1893.86s - 1895.98s | Um, so there are lots of similarities. 1895.98s - 1898.34s | Uh, so I, I wasn't sure I had the right guy, 1898.34s - 1899.94s | but I definitely was


chunk_id: 173_chunk_48
chunk_text:
1863.30s | So when I saw this in combination with that tip, 1863.30s - 1866.10s | it was just enough to, for me to decide, okay, 1866.10s - 1868.06s | I need to dig in a little further. 1868.06s - 1869.70s | I almost walked away right here. 1869.70s - 1871.58s | And that, again, that would have been the end of the story 1871.58s - 1873.66s | if I had, um, but I didn't. 1873.66s - 1875.58s | And it brought me to this guy, uh, 1875.58s - 1878.02s | Dimitri Horoshevev, if I'm saying that right. 1878.02s - 1880.54s | Uh, and I found these accounts 1880.54s - 1883.66s | and they were all related to malicious things. 1883.66s - 1886.34s | Uh, ransomware, botnets, malware. 1886.34s - 1889.82s | And one of his accounts was even on the same forum 1889.82s - 1892.62s | where he now has my, or used to have my picture 1892.62s - 1893.86s | before he got banned. 1893.86s - 1895.98s | Um, so there are lots of similarities. 1895.98s - 1898.34s | Uh, so I, I wasn't sure I had the right guy, 1898.34s - 1899.94s | but I definitely was interested 1899.94s - 1902.38s | and was, was continuing to dig on him. 1903.42s - 1906.66s | So then it was a Sunday and, uh, I got this alert. 1906.66s - 1908.58s | Most people watch TV. 1908.58s - 1910.02s | I watch LockBit. 1910.50s - 1912.10s | Uh, I got this alert to his, 1912.10s - 1914.26s | that said that the site, the site was up. 1914.26s - 1916.74s | And remember the site had been taken over by the NCA. 1916.74s - 1918.42s | He created a new one. 1918.42s - 1920.46s | And I got this alert saying it was online 1920.46s - 1922.34s | and I thought it was a false positive. 1922.34s - 1924.98s | I log in and I see it is online 1924.98s - 1926.70s | and it's populated with, you know, 1926.70s - 1928.90s | all this law enforcement propaganda, 1928.90s - 1930.70s | but I see this who is LockBit sup 1930.70s - 1932.94s | and it's got a countdown timer. 1932.94s - 1934.18s | And I go check social media. 1934.18s - 1936.26s | Like nobody else has said anything about this. 1936.26s - 1937.94s | And I'm like,


chunk_id: 173_chunk_49
chunk_text:
interested 1899.94s - 1902.38s | and was, was continuing to dig on him. 1903.42s - 1906.66s | So then it was a Sunday and, uh, I got this alert. 1906.66s - 1908.58s | Most people watch TV. 1908.58s - 1910.02s | I watch LockBit. 1910.50s - 1912.10s | Uh, I got this alert to his, 1912.10s - 1914.26s | that said that the site, the site was up. 1914.26s - 1916.74s | And remember the site had been taken over by the NCA. 1916.74s - 1918.42s | He created a new one. 1918.42s - 1920.46s | And I got this alert saying it was online 1920.46s - 1922.34s | and I thought it was a false positive. 1922.34s - 1924.98s | I log in and I see it is online 1924.98s - 1926.70s | and it's populated with, you know, 1926.70s - 1928.90s | all this law enforcement propaganda, 1928.90s - 1930.70s | but I see this who is LockBit sup 1930.70s - 1932.94s | and it's got a countdown timer. 1932.94s - 1934.18s | And I go check social media. 1934.18s - 1936.26s | Like nobody else has said anything about this. 1936.26s - 1937.94s | And I'm like, can I really be the only person 1937.94s - 1938.86s | that's seen this? 1938.90s - 1940.14s | And apparently I was, 1940.14s - 1942.18s | cause I posted it and people went nuts. 1942.18s - 1945.14s | Um, but this, this, this was pretty crazy 1945.14s - 1946.54s | because I'm, now I'm in this position 1946.54s - 1947.62s | where I'm like, fuck man, 1947.62s - 1949.30s | I got to put this report together. 1949.30s - 1950.34s | I might have the right guy. 1950.34s - 1952.18s | I might not, but if they're going to name him, 1952.18s - 1954.54s | you know, this is, this is my opportunity. 1954.54s - 1955.94s | Uh, but I had a problem. 1955.94s - 1957.86s | I had to get on a plane and fly to RSA. 1957.86s - 1960.98s | So, um, I couldn't take my research box with me. 1960.98s - 1963.62s | Um, I remember landing, going to my hotel room 1963.62s - 1965.90s | and that next 24 hours, I didn't leave. 1965.90s - 1966.74s | I didn't eat. 1966.74s - 1967.82s | I didn't order food. 1967.82s - 1970.82s | I just sat and


chunk_id: 173_chunk_50
chunk_text:
can I really be the only person 1937.94s - 1938.86s | that's seen this? 1938.90s - 1940.14s | And apparently I was, 1940.14s - 1942.18s | cause I posted it and people went nuts. 1942.18s - 1945.14s | Um, but this, this, this was pretty crazy 1945.14s - 1946.54s | because I'm, now I'm in this position 1946.54s - 1947.62s | where I'm like, fuck man, 1947.62s - 1949.30s | I got to put this report together. 1949.30s - 1950.34s | I might have the right guy. 1950.34s - 1952.18s | I might not, but if they're going to name him, 1952.18s - 1954.54s | you know, this is, this is my opportunity. 1954.54s - 1955.94s | Uh, but I had a problem. 1955.94s - 1957.86s | I had to get on a plane and fly to RSA. 1957.86s - 1960.98s | So, um, I couldn't take my research box with me. 1960.98s - 1963.62s | Um, I remember landing, going to my hotel room 1963.62s - 1965.90s | and that next 24 hours, I didn't leave. 1965.90s - 1966.74s | I didn't eat. 1966.74s - 1967.82s | I didn't order food. 1967.82s - 1970.82s | I just sat and wrote and I wrote 25 pages of content. 1970.82s - 1972.74s | Now, remember, I couldn't tell anybody 1972.74s - 1973.94s | in my company about this. 1973.94s - 1975.70s | Okay. I didn't, couldn't take the chance 1975.70s - 1978.02s | that if I had the right guy, it getting leaked. 1978.02s - 1982.38s | Um, so I wrote it and I sat quietly and I waited. 1982.38s - 1985.78s | And the next morning, May 7th, 1985.78s - 1987.26s | they do the identity reveal 1987.26s - 1989.70s | and it's the same fucking dude. 1989.70s - 1993.54s | So I was like, there's no way that could be a coincidence. 1993.54s - 1994.86s | Um, the problem is they didn't release 1994.86s - 1996.34s | a lot of information about him. 1996.34s - 1997.62s | You know, there's an email address, 1997.62s - 1999.82s | some passport numbers and a picture, 1999.82s - 2001.98s | but there's not a lot of info about him. 2001.98s - 2005.26s | So I had to wait a little bit 2005.26s - 2007.02s | cause nobody knew I had to get the web team. 2007.02s - 2008.78s | I'm like, you


chunk_id: 173_chunk_51
chunk_text:
wrote and I wrote 25 pages of content. 1970.82s - 1972.74s | Now, remember, I couldn't tell anybody 1972.74s - 1973.94s | in my company about this. 1973.94s - 1975.70s | Okay. I didn't, couldn't take the chance 1975.70s - 1978.02s | that if I had the right guy, it getting leaked. 1978.02s - 1982.38s | Um, so I wrote it and I sat quietly and I waited. 1982.38s - 1985.78s | And the next morning, May 7th, 1985.78s - 1987.26s | they do the identity reveal 1987.26s - 1989.70s | and it's the same fucking dude. 1989.70s - 1993.54s | So I was like, there's no way that could be a coincidence. 1993.54s - 1994.86s | Um, the problem is they didn't release 1994.86s - 1996.34s | a lot of information about him. 1996.34s - 1997.62s | You know, there's an email address, 1997.62s - 1999.82s | some passport numbers and a picture, 1999.82s - 2001.98s | but there's not a lot of info about him. 2001.98s - 2005.26s | So I had to wait a little bit 2005.26s - 2007.02s | cause nobody knew I had to get the web team. 2007.02s - 2008.78s | I'm like, you gotta get this thing published. 2008.78s - 2010.58s | Like move, it has to be now. 2010.58s - 2014.66s | Uh, so an hour later, uh, my first, 2014.66s - 2017.50s | I helped in doxing the shit out of this motherfucker. 2017.50s - 2018.82s | I knew where he lived. 2018.82s - 2019.90s | I had his phone number. 2019.90s - 2022.18s | You know how hard it was for me to not call this guy? 2022.18s - 2024.30s | Uh, I had his phone number. 2024.30s - 2025.50s | I had his email addresses. 2025.50s - 2028.14s | I even had like the pictures of his apartment building 2028.14s - 2029.58s | before he rented it out. 2029.58s - 2032.66s | Um, his door, his pin code from his door, 2032.66s - 2034.18s | the beautiful multi-ego graph 2034.18s - 2037.54s | with all this information on him, social media accounts. 2037.54s - 2039.90s | You know, I knew a lot about his family, 2039.90s - 2041.98s | though I would never include that in any of this. 2041.98s - 2045.18s | But my point is, is that, uh, I put all that shit out there 2045.18s -


chunk_id: 173_chunk_52
chunk_text:
gotta get this thing published. 2008.78s - 2010.58s | Like move, it has to be now. 2010.58s - 2014.66s | Uh, so an hour later, uh, my first, 2014.66s - 2017.50s | I helped in doxing the shit out of this motherfucker. 2017.50s - 2018.82s | I knew where he lived. 2018.82s - 2019.90s | I had his phone number. 2019.90s - 2022.18s | You know how hard it was for me to not call this guy? 2022.18s - 2024.30s | Uh, I had his phone number. 2024.30s - 2025.50s | I had his email addresses. 2025.50s - 2028.14s | I even had like the pictures of his apartment building 2028.14s - 2029.58s | before he rented it out. 2029.58s - 2032.66s | Um, his door, his pin code from his door, 2032.66s - 2034.18s | the beautiful multi-ego graph 2034.18s - 2037.54s | with all this information on him, social media accounts. 2037.54s - 2039.90s | You know, I knew a lot about his family, 2039.90s - 2041.98s | though I would never include that in any of this. 2041.98s - 2045.18s | But my point is, is that, uh, I put all that shit out there 2045.18s - 2047.42s | and, uh, the one part of the story 2047.42s - 2048.42s | I didn't share with you guys, 2048.42s - 2050.30s | I probably wouldn't have done this. 2050.30s - 2053.66s | The reason that I did this is what I found out 2053.70s - 2055.74s | when I was really digging into this at the end 2055.74s - 2056.90s | after the NCA came in, 2056.90s - 2058.70s | when I was trying to find out who he was, 2058.70s - 2061.18s | he caught wind of me asking all these questions 2061.18s - 2064.46s | to the affiliates, um, and some affiliates told me 2064.46s - 2067.54s | that he was pissed and he was coming after me, 2067.54s - 2069.82s | um, and that he wanted revenge against me. 2069.82s - 2071.10s | Um, if that hadn't happened, 2071.10s - 2073.38s | I probably wouldn't have blown his shit up, 2073.38s - 2075.58s | but I wanted him to know if he knew where I lived, 2075.58s - 2077.02s | I knew where he did too. 2077.02s - 2078.26s | Game on, motherfucker. 2078.26s - 2079.50s | You know, I wanted to make sure 2079.50s


chunk_id: 173_chunk_53
chunk_text:
2047.42s | and, uh, the one part of the story 2047.42s - 2048.42s | I didn't share with you guys, 2048.42s - 2050.30s | I probably wouldn't have done this. 2050.30s - 2053.66s | The reason that I did this is what I found out 2053.70s - 2055.74s | when I was really digging into this at the end 2055.74s - 2056.90s | after the NCA came in, 2056.90s - 2058.70s | when I was trying to find out who he was, 2058.70s - 2061.18s | he caught wind of me asking all these questions 2061.18s - 2064.46s | to the affiliates, um, and some affiliates told me 2064.46s - 2067.54s | that he was pissed and he was coming after me, 2067.54s - 2069.82s | um, and that he wanted revenge against me. 2069.82s - 2071.10s | Um, if that hadn't happened, 2071.10s - 2073.38s | I probably wouldn't have blown his shit up, 2073.38s - 2075.58s | but I wanted him to know if he knew where I lived, 2075.58s - 2077.02s | I knew where he did too. 2077.02s - 2078.26s | Game on, motherfucker. 2078.26s - 2079.50s | You know, I wanted to make sure 2079.50s - 2080.94s | everybody knew where he lived. 2080.94s - 2082.50s | Uh, he needs to be so busy, 2082.50s - 2084.86s | he doesn't have time to worry about me, so. 2084.86s - 2088.22s | Anyway, the perfect ending to the story, however, 2088.22s - 2089.98s | uh, we couldn't end it here. 2089.98s - 2092.54s | I needed to say goodbye to him, so I did. 2092.54s - 2095.98s | I know he reads all my stuff, so I wanted him to know 2095.98s - 2097.82s | I had too much respect for him 2097.82s - 2099.94s | to let somebody else do this, and that's true. 2099.94s - 2101.74s | Uh, all these people that say, 2101.74s - 2104.94s | oh, well, he has horrible, uh, OSINT practices, 2104.94s - 2106.82s | uh, it was so easy for- to find him. 2106.82s - 2108.86s | This guy, you know, it's amateur hour. 2108.86s - 2110.06s | Okay, these are all people that say that 2110.06s - 2112.34s | after his name and address and everything else 2112.34s - 2114.98s | were released, it's really easy to work backwards 2114.98s - 2117.14s | and be like, oh, yeah,


chunk_id: 173_chunk_54
chunk_text:
- 2080.94s | everybody knew where he lived. 2080.94s - 2082.50s | Uh, he needs to be so busy, 2082.50s - 2084.86s | he doesn't have time to worry about me, so. 2084.86s - 2088.22s | Anyway, the perfect ending to the story, however, 2088.22s - 2089.98s | uh, we couldn't end it here. 2089.98s - 2092.54s | I needed to say goodbye to him, so I did. 2092.54s - 2095.98s | I know he reads all my stuff, so I wanted him to know 2095.98s - 2097.82s | I had too much respect for him 2097.82s - 2099.94s | to let somebody else do this, and that's true. 2099.94s - 2101.74s | Uh, all these people that say, 2101.74s - 2104.94s | oh, well, he has horrible, uh, OSINT practices, 2104.94s - 2106.82s | uh, it was so easy for- to find him. 2106.82s - 2108.86s | This guy, you know, it's amateur hour. 2108.86s - 2110.06s | Okay, these are all people that say that 2110.06s - 2112.34s | after his name and address and everything else 2112.34s - 2114.98s | were released, it's really easy to work backwards 2114.98s - 2117.14s | and be like, oh, yeah, it's easy to figure this guy out. 2117.14s - 2119.06s | Well, nobody was finding him before 2119.06s - 2121.14s | they put his name on an indictment. 2121.14s - 2123.78s | Um, I- I did, but- but what I'm saying 2123.78s - 2125.18s | is the general public hadn't. 2125.18s - 2127.38s | So I needed him to know it needed to be me, 2127.38s - 2130.74s | it was time to go, I needed to say my goodbyes, 2130.74s - 2131.74s | but before this could end, 2131.74s - 2134.78s | I had one final thing I needed to do, 2134.78s - 2137.62s | and that was to come to DEF CON 2137.62s - 2140.90s | and troll the shit out of that motherfucker. 2140.90s - 2142.66s | So that's happening today. 2142.66s - 2144.38s | And this is our memory reel. 2144.38s - 2146.30s | Dimitri, if you're out there watching this, 2146.30s - 2148.54s | the kids wanna know when you're coming home, baby. 2148.54s - 2149.38s | I miss you. 2151.02s - 2152.90s | These are my two favorite Dimitris, by the way. 2152.90s - 2155.18s | The- the other guy is Dimitri Smolatos, 2155.18s


chunk_id: 173_chunk_55
chunk_text:
it's easy to figure this guy out. 2117.14s - 2119.06s | Well, nobody was finding him before 2119.06s - 2121.14s | they put his name on an indictment. 2121.14s - 2123.78s | Um, I- I did, but- but what I'm saying 2123.78s - 2125.18s | is the general public hadn't. 2125.18s - 2127.38s | So I needed him to know it needed to be me, 2127.38s - 2130.74s | it was time to go, I needed to say my goodbyes, 2130.74s - 2131.74s | but before this could end, 2131.74s - 2134.78s | I had one final thing I needed to do, 2134.78s - 2137.62s | and that was to come to DEF CON 2137.62s - 2140.90s | and troll the shit out of that motherfucker. 2140.90s - 2142.66s | So that's happening today. 2142.66s - 2144.38s | And this is our memory reel. 2144.38s - 2146.30s | Dimitri, if you're out there watching this, 2146.30s - 2148.54s | the kids wanna know when you're coming home, baby. 2148.54s - 2149.38s | I miss you. 2151.02s - 2152.90s | These are my two favorite Dimitris, by the way. 2152.90s - 2155.18s | The- the other guy is Dimitri Smolatos, 2155.18s - 2156.46s | uh, from Recorded Future. 2156.46s - 2159.18s | But, uh, this is- this is LockBit, this is me. 2159.18s - 2160.34s | I've been having fun with this. 2160.34s - 2163.38s | Uh, I really appreciate you guys being patient with us. 2163.38s - 2165.22s | Um, if I have time for questions, 2165.22s - 2167.38s | I don't think that we do, because we started late, 2167.38s - 2169.02s | you guys tell me, but if- if not, 2169.02s - 2171.22s | I'll be happy to hang around and answer them. 2171.22s - 2172.06s | Um, but thank you. 2172.06s - 2173.94s | This is my first DEF CON talk. 2173.94s - 2174.94s | It's always been a dream. 2174.94s - 2177.18s | Thanks for- for being here with me. 2177.18s - 2178.02s | Thank you.


chunk_id: 173_chunk_56
chunk_text:
- 2156.46s | uh, from Recorded Future. 2156.46s - 2159.18s | But, uh, this is- this is LockBit, this is me. 2159.18s - 2160.34s | I've been having fun with this. 2160.34s - 2163.38s | Uh, I really appreciate you guys being patient with us. 2163.38s - 2165.22s | Um, if I have time for questions, 2165.22s - 2167.38s | I don't think that we do, because we started late, 2167.38s - 2169.02s | you guys tell me, but if- if not, 2169.02s - 2171.22s | I'll be happy to hang around and answer them. 2171.22s - 2172.06s | Um, but thank you. 2172.06s - 2173.94s | This is my first DEF CON talk. 2173.94s - 2174.94s | It's always been a dream. 2174.94s - 2177.18s | Thanks for- for being here with me. 2177.18s - 2178.02s | Thank you.


chunk_id: 174_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=cFW0sYSo7ZM", "title": "DEF CON 32 - From getting JTAG on the iPhone 15 to hacking Apple's USB-C Controller - Stacksmashing", "description": "With the iPhone 15 & iPhone 15 Pro Apple switched their iPhone to USB-C - and introduced a new proprietary USB-C controller: The ACE3.\n\nBut the ACE3 does more than just handle USB power delivery: It's a full microcontroller running a full USB stack connected to some of the internal busses of the device, and we even managed to access JTAG on the iPhone 15 through it. It also provides access to UART, the internal SPMI bus, etc. Previous variants of the ACE, namely the ACE2 found in MacBooks, could easily be dumped and analyzed using SWD - and even be persistently backdoored through a software vulnerability we found.\n\nOn the ACE3 however, Apple upped their game: Firmware updates are personalized, debug interfaces seem to be disabled, and the external flash is validated and does not contain all the firmware. However using a combination of reverse-engineering, RF side-channel analysis and electro-magnetic fault-injection it was possible to gain code-execution on the ACE3 - allowing dumping of the ROM, and analysis of the functionality.\n\nThis talk will show how to use a combination of hardware, firmware, reverse-engineering, side-channel analysis and fault-injection to gain code-execution on a completely custom chip, enabling further security research on an under-explored but security relevant part of Apple devices.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2214, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.24s - 7.02s | This text was transcribed using whisper model: large-v2 Hey everyone, welcome to my talk, Ace of the Sleeve, hacking into Apple's new USB-C controller. 7.02s - 8.02s | First off, who am I? 8.02s - 10.48s | My name is Thomas Roth, aka Stack Smashing. 10.48s - 14.64s | I'm a security researcher for hardware and firmware, and I'm also a co-founder at this 14.64s - 17.44s | online training platform called Hackstreet.io. 17.44s - 21.00s | You can find me on Twitter, YouTube, and so on. 21.00s - 26.02s | Now, as always, like any research, it's built on top of other people's work, right? 26.02s - 31.90s | And so I want to thank, for example, Sigusa, who built a kernel module we will use, Oli 31.90s - 37.34s | for the Thunderbolt patcher, the Azahi Linux team, without whose reverse engineering work 37.34s - 42.46s | I couldn't do anything, Carlo


chunk_id: 174_chunk_1
chunk_text:
combination of hardware, firmware, reverse-engineering, side-channel analysis and fault-injection to gain code-execution on a completely custom chip, enabling further security research on an under-explored but security relevant part of Apple devices.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2214, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.24s - 7.02s | This text was transcribed using whisper model: large-v2 Hey everyone, welcome to my talk, Ace of the Sleeve, hacking into Apple's new USB-C controller. 7.02s - 8.02s | First off, who am I? 8.02s - 10.48s | My name is Thomas Roth, aka Stack Smashing. 10.48s - 14.64s | I'm a security researcher for hardware and firmware, and I'm also a co-founder at this 14.64s - 17.44s | online training platform called Hackstreet.io. 17.44s - 21.00s | You can find me on Twitter, YouTube, and so on. 21.00s - 26.02s | Now, as always, like any research, it's built on top of other people's work, right? 26.02s - 31.90s | And so I want to thank, for example, Sigusa, who built a kernel module we will use, Oli 31.90s - 37.34s | for the Thunderbolt patcher, the Azahi Linux team, without whose reverse engineering work 37.34s - 42.46s | I couldn't do anything, Carlo Maragni, who just always was there when I talked and had 42.46s - 49.50s | to rant about fault injection, Biasca, Fabian, and Caro, Mark Zingier for the central scrutinizer, 49.50s - 54.10s | and also the TAD12 dev team, who did some awesome work. 54.18s - 56.14s | Now, a bit on the backstory. 56.14s - 61.66s | Apple used to have this proprietary connector called Lightning, and it could do fairly obvious 61.66s - 65.62s | things such as charging, USB, video, and audio. 65.62s - 71.14s | But it could also do some really cool stuff, for example, JTAG, UART, SDQ, and so on. 71.14s - 77.14s | And you could buy cables for this on the black market, and there was also the Bonobo cable, 77.14s - 81.18s | but we decided we want to build an open-source version of this, and we called it the Tamarind 81.18s - 82.18s | Cable. 82.18s - 87.50s | And the Tamarind Cable is essentially a $20 Lightning debugging interface that we introduced 87.50s - 90.86s | two years ago at DEF CON, so it's good to be back. 90.86s - 96.46s | However, Apple decided to throw all


chunk_id: 174_chunk_2
chunk_text:
Maragni, who just always was there when I talked and had 42.46s - 49.50s | to rant about fault injection, Biasca, Fabian, and Caro, Mark Zingier for the central scrutinizer, 49.50s - 54.10s | and also the TAD12 dev team, who did some awesome work. 54.18s - 56.14s | Now, a bit on the backstory. 56.14s - 61.66s | Apple used to have this proprietary connector called Lightning, and it could do fairly obvious 61.66s - 65.62s | things such as charging, USB, video, and audio. 65.62s - 71.14s | But it could also do some really cool stuff, for example, JTAG, UART, SDQ, and so on. 71.14s - 77.14s | And you could buy cables for this on the black market, and there was also the Bonobo cable, 77.14s - 81.18s | but we decided we want to build an open-source version of this, and we called it the Tamarind 81.18s - 82.18s | Cable. 82.18s - 87.50s | And the Tamarind Cable is essentially a $20 Lightning debugging interface that we introduced 87.50s - 90.86s | two years ago at DEF CON, so it's good to be back. 90.86s - 96.46s | However, Apple decided to throw all of my work away by switching from Lightning to, 96.46s - 107.24s | you know, this thing here, that was supposed to be audio here, but she's talking that we 107.24s - 109.68s | can do charging, data, audio, and video. 109.68s - 113.60s | But I think they made a mistake during the keynote, because they forgot, you know, all 113.60s - 114.60s | the cool stuff. 114.60s - 115.60s | Like, who cares about charging? 115.60s - 118.40s | We want JTAG on the iPhone. 118.40s - 123.88s | And you know, if you look at the USB-C connector, it has a ton of pins, and so surely we can 123.88s - 129.88s | somehow get some of these to speak JTAG, UART, or, you know, anything interesting, not just 129.88s - 131.24s | charging. 131.24s - 136.00s | And then I realized that the iPhone is not the first USB-C device that, you know, Apple 136.00s - 137.00s | made. 137.00s - 140.56s | And I never looked at any of these, but luckily for me, other people did. 140.56s - 146.72s | And they figured out that Apple essentially uses the USB power delivery negotiation to


chunk_id: 174_chunk_3
chunk_text:
of my work away by switching from Lightning to, 96.46s - 107.24s | you know, this thing here, that was supposed to be audio here, but she's talking that we 107.24s - 109.68s | can do charging, data, audio, and video. 109.68s - 113.60s | But I think they made a mistake during the keynote, because they forgot, you know, all 113.60s - 114.60s | the cool stuff. 114.60s - 115.60s | Like, who cares about charging? 115.60s - 118.40s | We want JTAG on the iPhone. 118.40s - 123.88s | And you know, if you look at the USB-C connector, it has a ton of pins, and so surely we can 123.88s - 129.88s | somehow get some of these to speak JTAG, UART, or, you know, anything interesting, not just 129.88s - 131.24s | charging. 131.24s - 136.00s | And then I realized that the iPhone is not the first USB-C device that, you know, Apple 136.00s - 137.00s | made. 137.00s - 140.56s | And I never looked at any of these, but luckily for me, other people did. 140.56s - 146.72s | And they figured out that Apple essentially uses the USB power delivery negotiation to 146.72s - 148.64s | do some cool stuff. 148.64s - 153.24s | And it turns out that this power delivery negotiation is happening in something called 153.24s - 155.32s | the USB-C port controller. 155.32s - 162.28s | It's essentially a tiny microcontroller in the MacBook, and that one handles all of this. 162.28s - 166.92s | And essentially, the charger communicates with it through these two lines, the configuration 166.92s - 173.64s | lines, and this is all handled by a microcontroller that sits close to the USB-C ports. 173.64s - 177.40s | And you know, a microcontroller will have some kind of firmware, and some smart people 177.40s - 180.96s | years ago figured out you can just dump that firmware. 180.96s - 186.48s | So you solder a couple of wires into your very expensive MacBook, dump the firmware, 186.48s - 190.96s | and then they wrote an awesome blog post because they reverse-engineered the firmware, and 190.96s - 196.44s | they figured out that the Apple Type-C port controller, which we call Ace, actually contains 196.48s - 199.36s | a lot of secret functionality. 199.36s - 205.04s | And they found that Apple uses something called


chunk_id: 174_chunk_4
chunk_text:
146.72s - 148.64s | do some cool stuff. 148.64s - 153.24s | And it turns out that this power delivery negotiation is happening in something called 153.24s - 155.32s | the USB-C port controller. 155.32s - 162.28s | It's essentially a tiny microcontroller in the MacBook, and that one handles all of this. 162.28s - 166.92s | And essentially, the charger communicates with it through these two lines, the configuration 166.92s - 173.64s | lines, and this is all handled by a microcontroller that sits close to the USB-C ports. 173.64s - 177.40s | And you know, a microcontroller will have some kind of firmware, and some smart people 177.40s - 180.96s | years ago figured out you can just dump that firmware. 180.96s - 186.48s | So you solder a couple of wires into your very expensive MacBook, dump the firmware, 186.48s - 190.96s | and then they wrote an awesome blog post because they reverse-engineered the firmware, and 190.96s - 196.44s | they figured out that the Apple Type-C port controller, which we call Ace, actually contains 196.48s - 199.36s | a lot of secret functionality. 199.36s - 205.04s | And they found that Apple uses something called VDM, or Vendor Defined Messages, to let us 205.04s - 208.88s | change the configuration of certain pins on the USB-C connector. 208.88s - 215.72s | And so for example, we can change the SBU, the Sideband Use Pins, to be serial. 215.72s - 222.56s | And so we can, you know, send the VDM action 306 to the Ace controller, and then we get 222.56s - 225.92s | a serial console on the MacBook. 225.92s - 229.72s | And it turns out that to this Ace, there's much more connected than just serial. 229.72s - 236.64s | You can also do JTAG, Thunderbolt, even I2C, or on the iPhone there's SPMI and so on. 236.64s - 241.92s | And so that's kind of cool, but how can we actually send these Vendor Defined Messages? 241.92s - 244.92s | Because this is not just like regular USB. 244.92s - 250.56s | Instead we actually have to use special tooling to be able to send these messages. 250.60s - 256.44s | And again, some very smart people from the Asahi Linux team found out that the back left 256.44s - 261.40s | port on the MacBook Pro is special, and can


chunk_id: 174_chunk_5
chunk_text:
VDM, or Vendor Defined Messages, to let us 205.04s - 208.88s | change the configuration of certain pins on the USB-C connector. 208.88s - 215.72s | And so for example, we can change the SBU, the Sideband Use Pins, to be serial. 215.72s - 222.56s | And so we can, you know, send the VDM action 306 to the Ace controller, and then we get 222.56s - 225.92s | a serial console on the MacBook. 225.92s - 229.72s | And it turns out that to this Ace, there's much more connected than just serial. 229.72s - 236.64s | You can also do JTAG, Thunderbolt, even I2C, or on the iPhone there's SPMI and so on. 236.64s - 241.92s | And so that's kind of cool, but how can we actually send these Vendor Defined Messages? 241.92s - 244.92s | Because this is not just like regular USB. 244.92s - 250.56s | Instead we actually have to use special tooling to be able to send these messages. 250.60s - 256.44s | And again, some very smart people from the Asahi Linux team found out that the back left 256.44s - 261.40s | port on the MacBook Pro is special, and can actually send those commands, and they reverse 261.40s - 263.16s | engineered all of that stuff. 263.16s - 268.56s | And so there's a nice tool that you can just use to send these commands from a Mac to another Mac. 268.56s - 272.92s | Also, Marc Zenier built this thing called the Central Scrutinizer, which is essentially 272.92s - 277.80s | a serial adapter that is able to send all of these things, and can give you, you know, 277.80s - 282.28s | a UART shell on a MacBook, and so on and so forth. 282.28s - 283.28s | Now I saw this. 283.28s - 284.28s | It's Pico based. 284.28s - 289.88s | I love the Pico, and so I ordered a couple of PCBs and started experimenting with this. 289.88s - 295.16s | And essentially all it contains is a small USB-C controller and a couple of level shifters. 295.16s - 300.60s | Now I wanted to try to get serial on the iPhone 15 that was freshly released, because everyone 300.60s - 306.68s | was harassing me that my stuff doesn't work anymore, so I had to get with the times. 306.68s - 309.88s | Now


chunk_id: 174_chunk_6
chunk_text:
actually send those commands, and they reverse 261.40s - 263.16s | engineered all of that stuff. 263.16s - 268.56s | And so there's a nice tool that you can just use to send these commands from a Mac to another Mac. 268.56s - 272.92s | Also, Marc Zenier built this thing called the Central Scrutinizer, which is essentially 272.92s - 277.80s | a serial adapter that is able to send all of these things, and can give you, you know, 277.80s - 282.28s | a UART shell on a MacBook, and so on and so forth. 282.28s - 283.28s | Now I saw this. 283.28s - 284.28s | It's Pico based. 284.28s - 289.88s | I love the Pico, and so I ordered a couple of PCBs and started experimenting with this. 289.88s - 295.16s | And essentially all it contains is a small USB-C controller and a couple of level shifters. 295.16s - 300.60s | Now I wanted to try to get serial on the iPhone 15 that was freshly released, because everyone 300.60s - 306.68s | was harassing me that my stuff doesn't work anymore, so I had to get with the times. 306.68s - 309.88s | Now unfortunately, it didn't work on the iPhone 15 out of the box. 309.88s - 315.20s | I had to actually solder on a small USB switch and provide power to the iPhone and so on. 315.20s - 320.24s | Now this might just be my incompetence, because this is the first time I ever touched USB-C, 320.24s - 323.16s | and so I just tried random stuff until it happened to work. 323.16s - 330.80s | And so if you know USB-C better than me, feel free to tell me what I'm doing right or wrong. 330.80s - 335.64s | But after doing all of this, I essentially had the Central Scrutinizer working on the 335.64s - 345.32s | iPhone, and so I can hit some keys, and suddenly I get the serial console on the iPhone 15. 345.32s - 351.28s | That's pretty cool, but also pretty useless, because what do we do with serial output? 351.28s - 355.72s | We want to get JTAG or SPMI or something interesting, right? 355.72s - 360.56s | And again, the Asahi Linux people did a ton of cool reverse engineering work on all of 360.56s - 365.96s | that USB PD


chunk_id: 174_chunk_7
chunk_text:
unfortunately, it didn't work on the iPhone 15 out of the box. 309.88s - 315.20s | I had to actually solder on a small USB switch and provide power to the iPhone and so on. 315.20s - 320.24s | Now this might just be my incompetence, because this is the first time I ever touched USB-C, 320.24s - 323.16s | and so I just tried random stuff until it happened to work. 323.16s - 330.80s | And so if you know USB-C better than me, feel free to tell me what I'm doing right or wrong. 330.80s - 335.64s | But after doing all of this, I essentially had the Central Scrutinizer working on the 335.64s - 345.32s | iPhone, and so I can hit some keys, and suddenly I get the serial console on the iPhone 15. 345.32s - 351.28s | That's pretty cool, but also pretty useless, because what do we do with serial output? 351.28s - 355.72s | We want to get JTAG or SPMI or something interesting, right? 355.72s - 360.56s | And again, the Asahi Linux people did a ton of cool reverse engineering work on all of 360.56s - 365.96s | that USB PD stuff, and they have a gigantic document where they document all the actions 365.96s - 370.44s | and so on and so forth, and if you keep scrolling and scrolling and scrolling, you will find 370.44s - 375.96s | a small note that says, by the way, there's this action called 0206, and there's a good 375.96s - 382.08s | chance this is SWD, but nobody ever seems to have like publicly tried this. 382.08s - 388.04s | So I took my Central Scrutinizer, hooked my oscilloscope debugger and so on up to this, 388.04s - 393.80s | and tried to connect to it, and it didn't work. 393.80s - 399.72s | But you know, turns out there are two cables, so I just reversed them, gave it another try, 399.72s - 403.64s | and suddenly we get a success message. 403.64s - 409.86s | We found the debug port with the ID 4BA02477. 409.86s - 414.36s | We just got JTAG on the iPhone 15 by just sending 206. 414.36s - 418.60s | Awesome. 418.60s - 424.28s | Unfortunately, this is a production device, and so JTAG is locked. 424.28s - 428.08s | So essentially, we can't debug it


chunk_id: 174_chunk_8
chunk_text:
stuff, and they have a gigantic document where they document all the actions 365.96s - 370.44s | and so on and so forth, and if you keep scrolling and scrolling and scrolling, you will find 370.44s - 375.96s | a small note that says, by the way, there's this action called 0206, and there's a good 375.96s - 382.08s | chance this is SWD, but nobody ever seems to have like publicly tried this. 382.08s - 388.04s | So I took my Central Scrutinizer, hooked my oscilloscope debugger and so on up to this, 388.04s - 393.80s | and tried to connect to it, and it didn't work. 393.80s - 399.72s | But you know, turns out there are two cables, so I just reversed them, gave it another try, 399.72s - 403.64s | and suddenly we get a success message. 403.64s - 409.86s | We found the debug port with the ID 4BA02477. 409.86s - 414.36s | We just got JTAG on the iPhone 15 by just sending 206. 414.36s - 418.60s | Awesome. 418.60s - 424.28s | Unfortunately, this is a production device, and so JTAG is locked. 424.28s - 428.08s | So essentially, we can't debug it because it's a production device. 428.08s - 431.70s | On the black market, you can probably find an iPhone that is not locked, but it will 431.70s - 436.24s | run you like 100K or something, so I can't do that. 436.24s - 440.84s | But we got JTAG, useless JTAG. 440.84s - 445.00s | You know, but we can still explore some other buses, and so it turns out that on the iPhone 445.00s - 450.72s | 15, there's actually more than just UART and so on on this connector, but also SPMI 450.72s - 451.72s | and other things. 451.72s - 457.64s | And so in December last year, we released a PCB called the Tamron C adapter, which is 457.64s - 463.44s | essentially a fork of the Central Scrutinizer with bidirectional level shifters, a USB power 463.44s - 466.96s | switch that can actually charge the iPhone if you want to let it run for a long time 466.96s - 468.24s | for research. 468.24s - 472.84s | And we can use it to explore all the buses on the iPhone 15, including SPMI, which I 472.84s - 478.56s | think we released the first public


chunk_id: 174_chunk_9
chunk_text:
because it's a production device. 428.08s - 431.70s | On the black market, you can probably find an iPhone that is not locked, but it will 431.70s - 436.24s | run you like 100K or something, so I can't do that. 436.24s - 440.84s | But we got JTAG, useless JTAG. 440.84s - 445.00s | You know, but we can still explore some other buses, and so it turns out that on the iPhone 445.00s - 450.72s | 15, there's actually more than just UART and so on on this connector, but also SPMI 450.72s - 451.72s | and other things. 451.72s - 457.64s | And so in December last year, we released a PCB called the Tamron C adapter, which is 457.64s - 463.44s | essentially a fork of the Central Scrutinizer with bidirectional level shifters, a USB power 463.44s - 466.96s | switch that can actually charge the iPhone if you want to let it run for a long time 466.96s - 468.24s | for research. 468.24s - 472.84s | And we can use it to explore all the buses on the iPhone 15, including SPMI, which I 472.84s - 478.56s | think we released the first public analyzer for, and it also runs a full JTAG probe. 478.56s - 480.36s | And so you can experiment with this. 480.36s - 482.60s | It's fully open source. 482.60s - 484.60s | And if you use it, it looks like this. 484.60s - 487.88s | Now, this is cool, but again, also kind of useless. 487.88s - 494.40s | However, what's interesting is that all this stuff is implemented on the iPhone side in 494.40s - 497.02s | this chip called the ACE3. 497.02s - 501.64s | And the ACE3 essentially sits between the USB port and the system on a chip, and it 501.64s - 506.76s | makes for a very interesting target, because on the iPhone 15, the ACE3 can actually run 506.76s - 511.20s | a full USB port, like it can come up as a USB device. 511.20s - 515.96s | If you go into recovery and plug your iPhone in, you're actually communicating with the 515.96s - 521.60s | ACE3, and that makes it an interesting target, because imagine if you compromise this part 521.60s - 526.68s | of the device, you could do attacks on the system on a chip without any way


chunk_id: 174_chunk_10
chunk_text:
analyzer for, and it also runs a full JTAG probe. 478.56s - 480.36s | And so you can experiment with this. 480.36s - 482.60s | It's fully open source. 482.60s - 484.60s | And if you use it, it looks like this. 484.60s - 487.88s | Now, this is cool, but again, also kind of useless. 487.88s - 494.40s | However, what's interesting is that all this stuff is implemented on the iPhone side in 494.40s - 497.02s | this chip called the ACE3. 497.02s - 501.64s | And the ACE3 essentially sits between the USB port and the system on a chip, and it 501.64s - 506.76s | makes for a very interesting target, because on the iPhone 15, the ACE3 can actually run 506.76s - 511.20s | a full USB port, like it can come up as a USB device. 511.20s - 515.96s | If you go into recovery and plug your iPhone in, you're actually communicating with the 515.96s - 521.60s | ACE3, and that makes it an interesting target, because imagine if you compromise this part 521.60s - 526.68s | of the device, you could do attacks on the system on a chip without any way for anyone 526.68s - 531.16s | to know, like there would be essentially zero traces. 531.16s - 537.36s | So I was interested in this, but I wanted to first understand the predecessor, the ACE2, 537.36s - 540.16s | because there's a lot of public work on the ACE2 already. 540.16s - 547.32s | And the ACE2 is essentially a custom Texas Instruments USB-C controller. 547.32s - 549.00s | It's an ARM chip. 549.00s - 553.52s | It's connected to the SoC via I2C, and you can find it on all MacBooks, starting with 553.52s - 559.88s | the T2 Macs up to the M3 Macs, and so very recent Macs even still use this. 559.88s - 569.00s | It turns out that it's just essentially a re-labeled TPS65986 with a custom ROM, essentially. 569.00s - 575.60s | Now, I opened up my MacBook, I recreated the work by the TAD12 dev team, I dumped this 575.60s - 580.56s | on an M1 MacBook, and so I got an up-to-date firmware, started reverse engineering it, 580.56s - 585.28s | and found the command handling, built tooling to talk to it, and so on and so forth. 585.28s - 589.80s |


chunk_id: 174_chunk_11
chunk_text:
for anyone 526.68s - 531.16s | to know, like there would be essentially zero traces. 531.16s - 537.36s | So I was interested in this, but I wanted to first understand the predecessor, the ACE2, 537.36s - 540.16s | because there's a lot of public work on the ACE2 already. 540.16s - 547.32s | And the ACE2 is essentially a custom Texas Instruments USB-C controller. 547.32s - 549.00s | It's an ARM chip. 549.00s - 553.52s | It's connected to the SoC via I2C, and you can find it on all MacBooks, starting with 553.52s - 559.88s | the T2 Macs up to the M3 Macs, and so very recent Macs even still use this. 559.88s - 569.00s | It turns out that it's just essentially a re-labeled TPS65986 with a custom ROM, essentially. 569.00s - 575.60s | Now, I opened up my MacBook, I recreated the work by the TAD12 dev team, I dumped this 575.60s - 580.56s | on an M1 MacBook, and so I got an up-to-date firmware, started reverse engineering it, 580.56s - 585.28s | and found the command handling, built tooling to talk to it, and so on and so forth. 585.28s - 589.80s | And interestingly, the firmware even contains some privileged commands, such as memory read 589.80s - 591.68s | write, modify, and so on. 591.68s - 595.96s | It's like peek and poke, but unfortunately those are locked on production devices, but 595.96s - 599.60s | if you manage to change a single bit, you can unlock them. 599.60s - 605.08s | And so, yeah, that's kind of cool. 605.08s - 609.68s | The way we communicate from the system on a chip, like from macOS with the ACE, is using 609.68s - 616.32s | a bus called Apple HPM bus, which stands for Host Port Microcontroller, and we communicate 616.32s - 620.24s | with it by sending these 4-byte commands, they're called 4CC. 620.24s - 625.16s | It's essentially a 4-byte integer, but it happens to be ASCII, and so they're like commands 625.16s - 630.24s | such as, you know, GAID, or, you know, reset, and so on and so forth. 630.24s - 633.64s | And we built a small tool called ACE Tool to communicate with that, and so if you want 633.64s - 639.08s | to, we have the full list of commands online, we have a tool


chunk_id: 174_chunk_12
chunk_text:
And interestingly, the firmware even contains some privileged commands, such as memory read 589.80s - 591.68s | write, modify, and so on. 591.68s - 595.96s | It's like peek and poke, but unfortunately those are locked on production devices, but 595.96s - 599.60s | if you manage to change a single bit, you can unlock them. 599.60s - 605.08s | And so, yeah, that's kind of cool. 605.08s - 609.68s | The way we communicate from the system on a chip, like from macOS with the ACE, is using 609.68s - 616.32s | a bus called Apple HPM bus, which stands for Host Port Microcontroller, and we communicate 616.32s - 620.24s | with it by sending these 4-byte commands, they're called 4CC. 620.24s - 625.16s | It's essentially a 4-byte integer, but it happens to be ASCII, and so they're like commands 625.16s - 630.24s | such as, you know, GAID, or, you know, reset, and so on and so forth. 630.24s - 633.64s | And we built a small tool called ACE Tool to communicate with that, and so if you want 633.64s - 639.08s | to, we have the full list of commands online, we have a tool online to try them out, so 639.08s - 640.20s | it makes for fun. 640.20s - 644.50s | But the reason I'm telling you this is that we can do one very important thing. 644.50s - 646.38s | We can read the status of the chip. 646.38s - 650.62s | We can determine whether it's in application mode, or whether it's in boot mode. 650.62s - 654.58s | And we can also determine whether it's in DFU mode and so on, and so if the chip fails 654.58s - 656.18s | to boot, we can measure it. 656.18s - 659.20s | If the chip successfully boots, we can also measure this. 659.20s - 662.76s | This will become important later, so yeah. 662.76s - 668.22s | The ACE 2 also has an external flash connected, and this SPI flash does not actually contain 668.22s - 673.46s | the full firmware, but it actually just contains patches for the ROM. 673.46s - 679.46s | And so essentially, you can patch every single function in the ROM using this flash. 679.46s - 683.46s | This makes reverse engineering terribly annoying, because when you start reversing the firmware, 683.46s - 685.38s | you


chunk_id: 174_chunk_13
chunk_text:
online to try them out, so 639.08s - 640.20s | it makes for fun. 640.20s - 644.50s | But the reason I'm telling you this is that we can do one very important thing. 644.50s - 646.38s | We can read the status of the chip. 646.38s - 650.62s | We can determine whether it's in application mode, or whether it's in boot mode. 650.62s - 654.58s | And we can also determine whether it's in DFU mode and so on, and so if the chip fails 654.58s - 656.18s | to boot, we can measure it. 656.18s - 659.20s | If the chip successfully boots, we can also measure this. 659.20s - 662.76s | This will become important later, so yeah. 662.76s - 668.22s | The ACE 2 also has an external flash connected, and this SPI flash does not actually contain 668.22s - 673.46s | the full firmware, but it actually just contains patches for the ROM. 673.46s - 679.46s | And so essentially, you can patch every single function in the ROM using this flash. 679.46s - 683.46s | This makes reverse engineering terribly annoying, because when you start reversing the firmware, 683.46s - 685.38s | you have like a function call. 685.38s - 691.34s | That function call goes to another segue function, which does like stupid stuff with the registers. 691.34s - 698.30s | Then it dereferences a pointer list, which will be loaded from the flash. 698.30s - 701.86s | And then it actually jumps to the function, and so everything has like three layers of 701.90s - 706.90s | indirection, which breaks all your tooling for cross-referencing, and so on and so forth. 706.90s - 711.26s | And so we built some scripts to make this easier, but there are thousands of these functions, 711.26s - 715.86s | and so it's terribly annoying to reverse without additional tooling. 715.86s - 719.46s | But because it has an external flash, this chip is getting updates. 719.46s - 725.78s | And so on macOS, there's a tool called USB-C Firmware Flasher, and with this, it gets regular 725.78s - 727.24s | updates and so on. 727.32s - 734.24s | These updates are unfortunately protected using RSA-3072, but that signature is only 734.24s - 738.96s | checked during updates, so there's no secure boot on the chip whatsoever. 738.96s - 743.80s | So if you find


chunk_id: 174_chunk_14
chunk_text:
have like a function call. 685.38s - 691.34s | That function call goes to another segue function, which does like stupid stuff with the registers. 691.34s - 698.30s | Then it dereferences a pointer list, which will be loaded from the flash. 698.30s - 701.86s | And then it actually jumps to the function, and so everything has like three layers of 701.90s - 706.90s | indirection, which breaks all your tooling for cross-referencing, and so on and so forth. 706.90s - 711.26s | And so we built some scripts to make this easier, but there are thousands of these functions, 711.26s - 715.86s | and so it's terribly annoying to reverse without additional tooling. 715.86s - 719.46s | But because it has an external flash, this chip is getting updates. 719.46s - 725.78s | And so on macOS, there's a tool called USB-C Firmware Flasher, and with this, it gets regular 725.78s - 727.24s | updates and so on. 727.32s - 734.24s | These updates are unfortunately protected using RSA-3072, but that signature is only 734.24s - 738.96s | checked during updates, so there's no secure boot on the chip whatsoever. 738.96s - 743.80s | So if you find code execution and can modify the external flash contents, you get persistence 743.80s - 747.60s | for free, like you don't have to do anything. 747.60s - 752.12s | And so I found a vulnerability in the ACE2, as you do. 752.12s - 756.60s | Well, it's not actually, you will see, it's complicated. 756.60s - 761.60s | And I got told it would be fixed in fall, so in the submission report, I can see fall 761.60s - 762.60s | 2024. 762.60s - 770.48s | However, after I said that at BlackHat, I got told by Apple, oh yeah, that's a mistake. 770.48s - 772.40s | We are not going to fix it. 772.40s - 777.28s | And so I learned two days ago that I can actually drop a vulnerability here. 777.28s - 786.76s | So I'm doing, thank you, so I spent the last two hours writing slides, so this is going 786.76s - 790.00s | to be a bit of PowerPoint karaoke. 790.00s - 796.12s | But essentially, it turns out that not only does the ACE have SWD to the system on a chip, 796.12s - 800.36s | but the system on a chip also


chunk_id: 174_chunk_15
chunk_text:
code execution and can modify the external flash contents, you get persistence 743.80s - 747.60s | for free, like you don't have to do anything. 747.60s - 752.12s | And so I found a vulnerability in the ACE2, as you do. 752.12s - 756.60s | Well, it's not actually, you will see, it's complicated. 756.60s - 761.60s | And I got told it would be fixed in fall, so in the submission report, I can see fall 761.60s - 762.60s | 2024. 762.60s - 770.48s | However, after I said that at BlackHat, I got told by Apple, oh yeah, that's a mistake. 770.48s - 772.40s | We are not going to fix it. 772.40s - 777.28s | And so I learned two days ago that I can actually drop a vulnerability here. 777.28s - 786.76s | So I'm doing, thank you, so I spent the last two hours writing slides, so this is going 786.76s - 790.00s | to be a bit of PowerPoint karaoke. 790.00s - 796.12s | But essentially, it turns out that not only does the ACE have SWD to the system on a chip, 796.12s - 800.36s | but the system on a chip also has SWD to the ACE2. 800.36s - 804.94s | And so the SoC can debug the ACE2. 804.94s - 809.08s | And the way this works is that there are the two lines that you need for SWD, SWD.IO and 809.08s - 815.36s | SWD.CLOCK are general purpose IOs on the SoC. 815.36s - 819.32s | And GPIO on Apple SoC is basically just a memory range. 819.32s - 822.32s | And if you write to it, you can fiddle with the IOs. 822.32s - 827.04s | You can put them into read mode, output mode, high, low, and so on and so forth. 827.04s - 830.56s | And thanks to the Asahi Linux team, we know how to talk to them. 830.56s - 836.24s | And thanks to Segusa's IO kernel read-write module, we can actually do writes to those 836.24s - 841.56s | pages using a kernel module, which requires disabling SIP and so on. 841.56s - 849.04s | And so we can control the pins that talk to the debug port of the ACE through the kernel. 849.04s - 855.80s | And so let's bitbang SWD through the macOS kernel, because, you know, I don't have enough


chunk_id: 174_chunk_16
chunk_text:
has SWD to the ACE2. 800.36s - 804.94s | And so the SoC can debug the ACE2. 804.94s - 809.08s | And the way this works is that there are the two lines that you need for SWD, SWD.IO and 809.08s - 815.36s | SWD.CLOCK are general purpose IOs on the SoC. 815.36s - 819.32s | And GPIO on Apple SoC is basically just a memory range. 819.32s - 822.32s | And if you write to it, you can fiddle with the IOs. 822.32s - 827.04s | You can put them into read mode, output mode, high, low, and so on and so forth. 827.04s - 830.56s | And thanks to the Asahi Linux team, we know how to talk to them. 830.56s - 836.24s | And thanks to Segusa's IO kernel read-write module, we can actually do writes to those 836.24s - 841.56s | pages using a kernel module, which requires disabling SIP and so on. 841.56s - 849.04s | And so we can control the pins that talk to the debug port of the ACE through the kernel. 849.04s - 855.80s | And so let's bitbang SWD through the macOS kernel, because, you know, I don't have enough 855.80s - 857.24s | stuff to debug or something. 857.24s - 858.24s | I don't know. 858.24s - 862.64s | Anyway, and so basically, we have our user space application. 862.64s - 867.28s | That user space application talks to the IO kernel read-write module that I loaded 867.28s - 872.64s | into the macOS kernel, which talks to the memory-mapped IO peripherals, which toggles 872.64s - 877.52s | the physical pins, which then talk to the ACE2. 877.52s - 882.72s | And I implemented a debug probe over this that lets us dump and modify the ACE2 from 882.72s - 885.70s | user space and looks like this. 885.70s - 892.00s | So you can just essentially call .h2 dump, assuming you have this kernel module loaded. 892.00s - 894.88s | It will dump the firmware of the ACE2. 894.88s - 899.08s | Now the problem with this is I wanted to, you know, build some payloads, and I want 899.08s - 903.16s | to debug those payloads, and I don't always want to have my MacBook open to debug the 903.16s - 904.44s | payload. 904.44s - 907.68s | And so I want to debug. 907.68s - 910.52s


chunk_id: 174_chunk_17
chunk_text:
855.80s - 857.24s | stuff to debug or something. 857.24s - 858.24s | I don't know. 858.24s - 862.64s | Anyway, and so basically, we have our user space application. 862.64s - 867.28s | That user space application talks to the IO kernel read-write module that I loaded 867.28s - 872.64s | into the macOS kernel, which talks to the memory-mapped IO peripherals, which toggles 872.64s - 877.52s | the physical pins, which then talk to the ACE2. 877.52s - 882.72s | And I implemented a debug probe over this that lets us dump and modify the ACE2 from 882.72s - 885.70s | user space and looks like this. 885.70s - 892.00s | So you can just essentially call .h2 dump, assuming you have this kernel module loaded. 892.00s - 894.88s | It will dump the firmware of the ACE2. 894.88s - 899.08s | Now the problem with this is I wanted to, you know, build some payloads, and I want 899.08s - 903.16s | to debug those payloads, and I don't always want to have my MacBook open to debug the 903.16s - 904.44s | payload. 904.44s - 907.68s | And so I want to debug. 907.68s - 910.52s | So I ported this entire thing into OpenOCD. 910.52s - 917.68s | And so introducing Tamarin kernel, which is essentially an OpenOCD driver that bitbangs 917.68s - 922.00s | SWD on Apple SoCs through the IO kernel read-write module. 922.00s - 927.32s | And so you can actually debug more than just the ACE2. 927.32s - 933.32s | There are other peripherals that have debug enabled, thank you. 933.32s - 937.64s | And also I found a way to disable the signature verification, because it's, you know, patchable 937.64s - 938.64s | from external. 938.64s - 945.64s | I can just, if I get code execution, it turns out that, remember how all functions are patchable? 945.64s - 949.20s | Also the signature verification functions are patchable, and so you can just disable 949.20s - 954.36s | them from the external flash, and afterwards you can actually just load your own firmware 954.36s - 955.92s | through user space. 955.92s - 960.52s | And all modifications survive a full system restore, so even if you wipe your Mac, the 960.52s - 962.56s | ACE2 will still be compromised. 962.56s - 964.92s | And so we can backdraw the ACE2,


chunk_id: 174_chunk_18
chunk_text:
| So I ported this entire thing into OpenOCD. 910.52s - 917.68s | And so introducing Tamarin kernel, which is essentially an OpenOCD driver that bitbangs 917.68s - 922.00s | SWD on Apple SoCs through the IO kernel read-write module. 922.00s - 927.32s | And so you can actually debug more than just the ACE2. 927.32s - 933.32s | There are other peripherals that have debug enabled, thank you. 933.32s - 937.64s | And also I found a way to disable the signature verification, because it's, you know, patchable 937.64s - 938.64s | from external. 938.64s - 945.64s | I can just, if I get code execution, it turns out that, remember how all functions are patchable? 945.64s - 949.20s | Also the signature verification functions are patchable, and so you can just disable 949.20s - 954.36s | them from the external flash, and afterwards you can actually just load your own firmware 954.36s - 955.92s | through user space. 955.92s - 960.52s | And all modifications survive a full system restore, so even if you wipe your Mac, the 960.52s - 962.56s | ACE2 will still be compromised. 962.56s - 964.92s | And so we can backdraw the ACE2, yeah. 964.92s - 969.04s | And I'm going to, like all these things I have to release, like today, as I learned 969.04s - 973.52s | I can release this two days ago, so I don't have this packaged nicely, and there's still 973.52s - 979.64s | a lot of swear words in the code, let's say, so I'll fix that and publish it on GitHub. 979.64s - 983.48s | But we have the ACE2, which is on the way out. 983.48s - 985.68s | It's an old chip, it doesn't do a whole lot. 985.68s - 990.96s | The iPhone 15 Pro uses the successor, which is far cooler. 990.96s - 993.60s | And so we have to check the ACE3. 993.60s - 1000.20s | The ACE3 is actually a Texas Instruments SN25A12, and when I started this, there was zero public 1000.20s - 1002.52s | information on this, literally zero. 1002.52s - 1006.72s | In fact, I started tweeting about the chip, and afterwards I got emails from like the 1006.72s - 1011.20s | gray market salespeople who sell like the stolen chips online, and they were like, hey, 1011.20s - 1015.46s | can we pay you to


chunk_id: 174_chunk_19
chunk_text:
yeah. 964.92s - 969.04s | And I'm going to, like all these things I have to release, like today, as I learned 969.04s - 973.52s | I can release this two days ago, so I don't have this packaged nicely, and there's still 973.52s - 979.64s | a lot of swear words in the code, let's say, so I'll fix that and publish it on GitHub. 979.64s - 983.48s | But we have the ACE2, which is on the way out. 983.48s - 985.68s | It's an old chip, it doesn't do a whole lot. 985.68s - 990.96s | The iPhone 15 Pro uses the successor, which is far cooler. 990.96s - 993.60s | And so we have to check the ACE3. 993.60s - 1000.20s | The ACE3 is actually a Texas Instruments SN25A12, and when I started this, there was zero public 1000.20s - 1002.52s | information on this, literally zero. 1002.52s - 1006.72s | In fact, I started tweeting about the chip, and afterwards I got emails from like the 1006.72s - 1011.20s | gray market salespeople who sell like the stolen chips online, and they were like, hey, 1011.20s - 1015.46s | can we pay you to write a product description for this chip, because we can't find anyone 1015.46s - 1017.68s | else who ever talked about it. 1017.68s - 1024.96s | And so the ACE3 is used in the iPhone 15 and on the MacBook Pro M3 with Pro and Max processors. 1024.96s - 1028.28s | And the ACE3 is far more complex than the ACE2. 1028.28s - 1031.16s | It runs a full USB stack called Port DFU. 1031.16s - 1033.66s | It has access to some more internal buses. 1033.66s - 1039.00s | It has very interesting potential, because it's so, because it can run full USB, if we 1039.00s - 1045.18s | managed to, you know, find another checkmate-style boot ROM issue, we could in theory get persistence 1045.18s - 1049.94s | for a jailbreak by just putting it in the ACE3 instead of having to gain persistence 1049.94s - 1051.86s | in the SOC itself. 1051.86s - 1055.74s | I haven't done any of that, it's just some of the motivation that drove me to hack this 1055.74s - 1058.06s | chip. 1058.06s - 1063.22s | So I started looking at how is this chip protected, like what's different, and it


chunk_id: 174_chunk_20
chunk_text:
write a product description for this chip, because we can't find anyone 1015.46s - 1017.68s | else who ever talked about it. 1017.68s - 1024.96s | And so the ACE3 is used in the iPhone 15 and on the MacBook Pro M3 with Pro and Max processors. 1024.96s - 1028.28s | And the ACE3 is far more complex than the ACE2. 1028.28s - 1031.16s | It runs a full USB stack called Port DFU. 1031.16s - 1033.66s | It has access to some more internal buses. 1033.66s - 1039.00s | It has very interesting potential, because it's so, because it can run full USB, if we 1039.00s - 1045.18s | managed to, you know, find another checkmate-style boot ROM issue, we could in theory get persistence 1045.18s - 1049.94s | for a jailbreak by just putting it in the ACE3 instead of having to gain persistence 1049.94s - 1051.86s | in the SOC itself. 1051.86s - 1055.74s | I haven't done any of that, it's just some of the motivation that drove me to hack this 1055.74s - 1058.06s | chip. 1058.06s - 1063.22s | So I started looking at how is this chip protected, like what's different, and it turns out that 1063.22s - 1064.70s | everything has changed. 1064.70s - 1069.66s | It doesn't use the USB-C firmware flasher anymore, it uses different upgrade mechanisms 1069.66s - 1072.10s | between the iPhone 15 and the MacBook. 1072.10s - 1077.36s | In fact, I believe on the iPhone 15, it actually uses SWD to update the chip, which is kind 1077.36s - 1078.54s | of cool. 1078.54s - 1083.58s | And the updates are fully personalized, so each chip will get their own firmware. 1083.58s - 1087.42s | But you know, I still had this vulnerability that I think, you know, I can theoretically, 1087.42s - 1092.18s | I now can debug the ACE3, so I wanted to try it on the ACE3, so I ordered a MacBook 1092.18s - 1097.38s | M3, and the trick didn't work. 1097.38s - 1104.22s | So easy select, easy choice, send it back, or, you know, I'm a hardware hacker, open 1104.22s - 1105.98s | it up. 1105.98s - 1110.70s | So I opened up the MacBook, and remember I had to do this quickly, because the Amazon 1110.70s - 1116.30s | return window for this machine was just 30 days. 1116.30s


chunk_id: 174_chunk_21
chunk_text:
turns out that 1063.22s - 1064.70s | everything has changed. 1064.70s - 1069.66s | It doesn't use the USB-C firmware flasher anymore, it uses different upgrade mechanisms 1069.66s - 1072.10s | between the iPhone 15 and the MacBook. 1072.10s - 1077.36s | In fact, I believe on the iPhone 15, it actually uses SWD to update the chip, which is kind 1077.36s - 1078.54s | of cool. 1078.54s - 1083.58s | And the updates are fully personalized, so each chip will get their own firmware. 1083.58s - 1087.42s | But you know, I still had this vulnerability that I think, you know, I can theoretically, 1087.42s - 1092.18s | I now can debug the ACE3, so I wanted to try it on the ACE3, so I ordered a MacBook 1092.18s - 1097.38s | M3, and the trick didn't work. 1097.38s - 1104.22s | So easy select, easy choice, send it back, or, you know, I'm a hardware hacker, open 1104.22s - 1105.98s | it up. 1105.98s - 1110.70s | So I opened up the MacBook, and remember I had to do this quickly, because the Amazon 1110.70s - 1116.30s | return window for this machine was just 30 days. 1116.30s - 1121.10s | And the first thing you will notice is that there are again the same debug ports that 1121.10s - 1126.90s | we already saw on the previous MacBooks, and on the previous MacBooks, we could dump the 1126.90s - 1128.22s | chip this way. 1128.22s - 1132.62s | And so just for labeling, this is the ACE3, it's much bigger than the ACE2, and there's 1132.62s - 1137.66s | no Texas Instruments chip that looks similar to this one, and so we really have zero idea 1137.66s - 1139.26s | what this chip does. 1139.26s - 1143.78s | There's again an external SPI flash, and these nice debug connectors. 1143.78s - 1150.30s | Now I started probing these, and in combination with the terminal, with the tamering kernel, 1150.30s - 1157.54s | I could essentially see that yes, I'm talking SWD on the right lines, but it seems like 1157.54s - 1161.96s | the debug port is disabled, so no luck. 1161.96s - 1166.14s | So instead I decided to dump the external flash, so again, like I couldn't solder in 1166.14s - 1170.10s | this, because again, Amazon return window, so I used these needle probes


chunk_id: 174_chunk_22
chunk_text:
- 1121.10s | And the first thing you will notice is that there are again the same debug ports that 1121.10s - 1126.90s | we already saw on the previous MacBooks, and on the previous MacBooks, we could dump the 1126.90s - 1128.22s | chip this way. 1128.22s - 1132.62s | And so just for labeling, this is the ACE3, it's much bigger than the ACE2, and there's 1132.62s - 1137.66s | no Texas Instruments chip that looks similar to this one, and so we really have zero idea 1137.66s - 1139.26s | what this chip does. 1139.26s - 1143.78s | There's again an external SPI flash, and these nice debug connectors. 1143.78s - 1150.30s | Now I started probing these, and in combination with the terminal, with the tamering kernel, 1150.30s - 1157.54s | I could essentially see that yes, I'm talking SWD on the right lines, but it seems like 1157.54s - 1161.96s | the debug port is disabled, so no luck. 1161.96s - 1166.14s | So instead I decided to dump the external flash, so again, like I couldn't solder in 1166.14s - 1170.10s | this, because again, Amazon return window, so I used these needle probes to just like 1170.10s - 1171.90s | probe the flash lines. 1171.90s - 1176.42s | And eventually I got a full firmware dump. 1176.42s - 1177.42s | Reversing time. 1177.42s - 1179.26s | Turns out, it's essentially the same. 1179.26s - 1184.42s | Only patches get loaded from the external flash, and everything seems to be different 1184.42s - 1189.02s | on the hardware side, so for example the CRC peripheral is at a different address as far 1189.02s - 1190.78s | as I can tell. 1190.78s - 1192.10s | It's just patches. 1192.10s - 1196.02s | And there's some weird regions with high entropy, which is always a bad sign, because that means 1196.02s - 1199.34s | that there's some cryptography very likely going on. 1199.34s - 1203.70s | And yeah, that will spoil our day if they implemented secure boot. 1203.70s - 1207.90s | However, some successful things was that I was able to reverse engineer the firmware 1207.90s - 1213.70s | header, and so I found a couple of CRCs and so on, and my naive hope was, okay, I just 1213.70s - 1219.06s | you know, patch the firmware, fix the CRCs, and surely this chip


chunk_id: 174_chunk_23
chunk_text:
to just like 1170.10s - 1171.90s | probe the flash lines. 1171.90s - 1176.42s | And eventually I got a full firmware dump. 1176.42s - 1177.42s | Reversing time. 1177.42s - 1179.26s | Turns out, it's essentially the same. 1179.26s - 1184.42s | Only patches get loaded from the external flash, and everything seems to be different 1184.42s - 1189.02s | on the hardware side, so for example the CRC peripheral is at a different address as far 1189.02s - 1190.78s | as I can tell. 1190.78s - 1192.10s | It's just patches. 1192.10s - 1196.02s | And there's some weird regions with high entropy, which is always a bad sign, because that means 1196.02s - 1199.34s | that there's some cryptography very likely going on. 1199.34s - 1203.70s | And yeah, that will spoil our day if they implemented secure boot. 1203.70s - 1207.90s | However, some successful things was that I was able to reverse engineer the firmware 1207.90s - 1213.70s | header, and so I found a couple of CRCs and so on, and my naive hope was, okay, I just 1213.70s - 1219.06s | you know, patch the firmware, fix the CRCs, and surely this chip will boot, and so let's 1219.06s - 1222.82s | flip a bit in a $3,000 MacBook. 1222.82s - 1228.78s | Unfortunately, I couldn't get it to boot a modified firmware, but at least I didn't fully 1228.78s - 1229.78s | brick it. 1229.78s - 1235.98s | So in the end, what I tried, I tried my software vulnerability, I tried physical SWD access, 1235.98s - 1239.82s | I tried modifying and switching the flash contents, even like between the different 1239.82s - 1244.98s | ACE chips, but they all seem to have a unique signature, like even you can't take the left 1244.98s - 1248.82s | ACE and put it on the right ACE and so on and so forth. 1248.82s - 1253.58s | I tried fuzzing, and I actually found a timing side channel that lets me enumerate the commands 1253.58s - 1257.58s | that the ACE3 supports, but that doesn't really give me anything. 1257.58s - 1264.98s | So yeah, essentially we have a completely undocumented, not documented, apologies, chip, 1264.98s - 1268.98s | we have no firmware, and only some simple commands. 1268.98s - 1274.58s | Time to give up, or do we try fault injection? 1274.58s


chunk_id: 174_chunk_24
chunk_text:
will boot, and so let's 1219.06s - 1222.82s | flip a bit in a $3,000 MacBook. 1222.82s - 1228.78s | Unfortunately, I couldn't get it to boot a modified firmware, but at least I didn't fully 1228.78s - 1229.78s | brick it. 1229.78s - 1235.98s | So in the end, what I tried, I tried my software vulnerability, I tried physical SWD access, 1235.98s - 1239.82s | I tried modifying and switching the flash contents, even like between the different 1239.82s - 1244.98s | ACE chips, but they all seem to have a unique signature, like even you can't take the left 1244.98s - 1248.82s | ACE and put it on the right ACE and so on and so forth. 1248.82s - 1253.58s | I tried fuzzing, and I actually found a timing side channel that lets me enumerate the commands 1253.58s - 1257.58s | that the ACE3 supports, but that doesn't really give me anything. 1257.58s - 1264.98s | So yeah, essentially we have a completely undocumented, not documented, apologies, chip, 1264.98s - 1268.98s | we have no firmware, and only some simple commands. 1268.98s - 1274.58s | Time to give up, or do we try fault injection? 1274.58s - 1279.30s | So fault injection is an awesome technique, because essentially we can introduce faults 1279.30s - 1283.92s | into a chip, which allows us to modify the behavior of the running software. 1283.92s - 1288.36s | So for example, we might be able to flip bits in registers and memory, we might be 1288.36s - 1292.44s | able to skip instructions and so on, and there are a lot of different techniques for this. 1292.44s - 1297.04s | There's voltage glitching, laser, BBI, electromagnetic, and so on. 1297.04s - 1302.56s | They all have one thing in common, which is that they very easily break chips. 1302.56s - 1307.90s | The most common way to do glitching is using voltage fault injection, and there you essentially 1307.90s - 1313.08s | drop the power to the chip for a very short amount of time, at just the right point in 1313.08s - 1314.36s | time. 1314.36s - 1318.80s | And the problem is, this pretty much requires soldering and removal of a ton of capacitors 1318.80s - 1322.80s | and so on, and it's best performed if you know what's going on. 1322.80s - 1326.32s | We don't even


chunk_id: 174_chunk_25
chunk_text:
- 1279.30s | So fault injection is an awesome technique, because essentially we can introduce faults 1279.30s - 1283.92s | into a chip, which allows us to modify the behavior of the running software. 1283.92s - 1288.36s | So for example, we might be able to flip bits in registers and memory, we might be 1288.36s - 1292.44s | able to skip instructions and so on, and there are a lot of different techniques for this. 1292.44s - 1297.04s | There's voltage glitching, laser, BBI, electromagnetic, and so on. 1297.04s - 1302.56s | They all have one thing in common, which is that they very easily break chips. 1302.56s - 1307.90s | The most common way to do glitching is using voltage fault injection, and there you essentially 1307.90s - 1313.08s | drop the power to the chip for a very short amount of time, at just the right point in 1313.08s - 1314.36s | time. 1314.36s - 1318.80s | And the problem is, this pretty much requires soldering and removal of a ton of capacitors 1318.80s - 1322.80s | and so on, and it's best performed if you know what's going on. 1322.80s - 1326.32s | We don't even know the pinout, we don't know what is the core voltage, what is the main 1326.32s - 1331.74s | voltage rail, we don't know what other chips are on there, and so on and so forth. 1331.74s - 1336.92s | But there's an alternative called EMFI, electromagnetic fault injection. 1336.92s - 1342.24s | The idea is we create a high voltage pulse into a coil, and this lets us inject current 1342.24s - 1345.56s | directly into precise locations in the chip. 1345.56s - 1350.64s | And this again can let us skip instructions, change register values, and so on. 1350.64s - 1353.84s | And we don't really need target preparation for this. 1353.84s - 1361.12s | It's just we point our chip shouter at the chip, we zap it, and the chip is hacked. 1361.12s - 1363.26s | Wonderful, in theory. 1363.26s - 1369.36s | The problem is, we need to know the very precise timing on when we need to glitch, because 1369.36s - 1373.96s | otherwise we're just going to glitch something else. 1373.96s - 1377.28s | How do we figure out the timing on something that we know nothing about? 1377.28s - 1380.00s | We just


chunk_id: 174_chunk_26
chunk_text:
know the pinout, we don't know what is the core voltage, what is the main 1326.32s - 1331.74s | voltage rail, we don't know what other chips are on there, and so on and so forth. 1331.74s - 1336.92s | But there's an alternative called EMFI, electromagnetic fault injection. 1336.92s - 1342.24s | The idea is we create a high voltage pulse into a coil, and this lets us inject current 1342.24s - 1345.56s | directly into precise locations in the chip. 1345.56s - 1350.64s | And this again can let us skip instructions, change register values, and so on. 1350.64s - 1353.84s | And we don't really need target preparation for this. 1353.84s - 1361.12s | It's just we point our chip shouter at the chip, we zap it, and the chip is hacked. 1361.12s - 1363.26s | Wonderful, in theory. 1363.26s - 1369.36s | The problem is, we need to know the very precise timing on when we need to glitch, because 1369.36s - 1373.96s | otherwise we're just going to glitch something else. 1373.96s - 1377.28s | How do we figure out the timing on something that we know nothing about? 1377.28s - 1380.00s | We just know it doesn't boot, period. 1380.00s - 1387.44s | Brute force, I thought about it, but the boot is so slow that it would take forever to try. 1387.44s - 1391.84s | And the more we try to glitch at the wrong point in time, the more likely we are to break 1391.84s - 1392.84s | the chip. 1392.84s - 1396.16s | So we really want to get this right. 1396.16s - 1402.08s | I had another idea, which is, what if we find a side channel? 1402.08s - 1408.24s | What if we find a side channel to get this precise timing on when to inject our glitch? 1408.24s - 1411.76s | Normally, now I decided to use an EM side channel. 1411.76s - 1415.60s | So I used an EM probe to measure the chip. 1415.60s - 1419.08s | And normally you would use a very high-end oscilloscope for this, but I wanted to use 1419.08s - 1422.76s | a cheap, affordable hacker to make this more accessible. 1422.76s - 1428.36s | And I just glued a random coil onto a PC-byte probe and just dropped it onto the chip. 1428.36s - 1430.80s | So this is just


chunk_id: 174_chunk_27
chunk_text:
know it doesn't boot, period. 1380.00s - 1387.44s | Brute force, I thought about it, but the boot is so slow that it would take forever to try. 1387.44s - 1391.84s | And the more we try to glitch at the wrong point in time, the more likely we are to break 1391.84s - 1392.84s | the chip. 1392.84s - 1396.16s | So we really want to get this right. 1396.16s - 1402.08s | I had another idea, which is, what if we find a side channel? 1402.08s - 1408.24s | What if we find a side channel to get this precise timing on when to inject our glitch? 1408.24s - 1411.76s | Normally, now I decided to use an EM side channel. 1411.76s - 1415.60s | So I used an EM probe to measure the chip. 1415.60s - 1419.08s | And normally you would use a very high-end oscilloscope for this, but I wanted to use 1419.08s - 1422.76s | a cheap, affordable hacker to make this more accessible. 1422.76s - 1428.36s | And I just glued a random coil onto a PC-byte probe and just dropped it onto the chip. 1428.36s - 1430.80s | So this is just held with gravity. 1430.80s - 1433.80s | And this way we can capture the magic chip waves. 1433.80s - 1435.24s | And we can actually see this. 1435.24s - 1440.48s | As we restart the chip, we can actually see that there is activity on the spectrum at 1440.48s - 1442.68s | around 48 megahertz. 1442.68s - 1444.68s | Now this activity could be anything, right? 1444.68s - 1450.64s | This could be the power rail, this could just be the spy flash line or so, but it's something. 1450.64s - 1452.80s | And so the idea is simple. 1452.80s - 1455.72s | We start recording the spectrum on the hackRF. 1455.72s - 1459.00s | We reboot the ACE3 using the ACE tool I showed earlier. 1459.00s - 1465.96s | We get the electromagnetic recording, and then we just do some very simple DSP. 1465.96s - 1472.00s | Which just took the better half of a week to generate a ton of different measurements 1472.00s - 1474.60s | and so on and so forth, filtering this and that. 1474.60s - 1478.48s | But eventually I had a line that I thought, okay, this looks like it might tell us something


chunk_id: 174_chunk_28
chunk_text:
held with gravity. 1430.80s - 1433.80s | And this way we can capture the magic chip waves. 1433.80s - 1435.24s | And we can actually see this. 1435.24s - 1440.48s | As we restart the chip, we can actually see that there is activity on the spectrum at 1440.48s - 1442.68s | around 48 megahertz. 1442.68s - 1444.68s | Now this activity could be anything, right? 1444.68s - 1450.64s | This could be the power rail, this could just be the spy flash line or so, but it's something. 1450.64s - 1452.80s | And so the idea is simple. 1452.80s - 1455.72s | We start recording the spectrum on the hackRF. 1455.72s - 1459.00s | We reboot the ACE3 using the ACE tool I showed earlier. 1459.00s - 1465.96s | We get the electromagnetic recording, and then we just do some very simple DSP. 1465.96s - 1472.00s | Which just took the better half of a week to generate a ton of different measurements 1472.00s - 1474.60s | and so on and so forth, filtering this and that. 1474.60s - 1478.48s | But eventually I had a line that I thought, okay, this looks like it might tell us something 1478.48s - 1479.76s | about the chip. 1479.76s - 1483.48s | And this is completely gut feeling, like I didn't do any science here, I just tried 1483.48s - 1487.88s | to play with filters, and eventually I got this line. 1487.88s - 1493.52s | Now the problem with this recording is that you want to collect a lot of traces and average 1493.52s - 1495.02s | them together. 1495.02s - 1499.84s | The problem is they will all be at different offsets in time, because we don't have a precise 1499.84s - 1503.00s | way on how to start the recording. 1503.00s - 1508.36s | And so we could align these in software, however the hackRF actually has a nice feature, which 1508.36s - 1511.20s | is it has hardware trigger inputs. 1511.20s - 1515.38s | And so we can actually trigger the recording using a hardware signal. 1515.38s - 1519.64s | This doesn't work in the latest hackRF firmware, so it was again like hours of trying different 1519.64s - 1523.68s | firmwares until one would actually trigger correctly. 1523.68s - 1525.72s | And now we just need a trigger. 1525.72s - 1531.12s | Now remember that we


chunk_id: 174_chunk_29
chunk_text:
1478.48s - 1479.76s | about the chip. 1479.76s - 1483.48s | And this is completely gut feeling, like I didn't do any science here, I just tried 1483.48s - 1487.88s | to play with filters, and eventually I got this line. 1487.88s - 1493.52s | Now the problem with this recording is that you want to collect a lot of traces and average 1493.52s - 1495.02s | them together. 1495.02s - 1499.84s | The problem is they will all be at different offsets in time, because we don't have a precise 1499.84s - 1503.00s | way on how to start the recording. 1503.00s - 1508.36s | And so we could align these in software, however the hackRF actually has a nice feature, which 1508.36s - 1511.20s | is it has hardware trigger inputs. 1511.20s - 1515.38s | And so we can actually trigger the recording using a hardware signal. 1515.38s - 1519.64s | This doesn't work in the latest hackRF firmware, so it was again like hours of trying different 1519.64s - 1523.68s | firmwares until one would actually trigger correctly. 1523.68s - 1525.72s | And now we just need a trigger. 1525.72s - 1531.12s | Now remember that we have access to the flash lines, and the flash lines have a line called 1531.12s - 1532.60s | chip select. 1532.60s - 1538.96s | And the chip select line will go low just as our firmware is being loaded. 1538.96s - 1543.40s | And so this is perfect to offset a glitch from if we want to bypass secure boot of what 1543.40s - 1546.24s | just got loaded from flash. 1546.24s - 1554.64s | So easy plan, we start recording on the hackRF, we reboot the ACE3, the hackRF gets triggered 1554.64s - 1558.80s | by the chip select line, and we get a perfectly aligned recording. 1558.80s - 1564.68s | And in theory it should look like this, if you take pictures for presentation, in reality 1564.68s - 1570.00s | your desk will look like this, and it will just be a gigantic mess. 1570.00s - 1575.04s | So in the end, we have perfectly aligned recordings, and we can actually average them together 1575.04s - 1580.40s | to get a nice, meaningful signal where if anything else put in noise, we can just filter 1580.40s - 1582.80s | it away essentially. 1582.80s - 1588.76s | But you


chunk_id: 174_chunk_30
chunk_text:
have access to the flash lines, and the flash lines have a line called 1531.12s - 1532.60s | chip select. 1532.60s - 1538.96s | And the chip select line will go low just as our firmware is being loaded. 1538.96s - 1543.40s | And so this is perfect to offset a glitch from if we want to bypass secure boot of what 1543.40s - 1546.24s | just got loaded from flash. 1546.24s - 1554.64s | So easy plan, we start recording on the hackRF, we reboot the ACE3, the hackRF gets triggered 1554.64s - 1558.80s | by the chip select line, and we get a perfectly aligned recording. 1558.80s - 1564.68s | And in theory it should look like this, if you take pictures for presentation, in reality 1564.68s - 1570.00s | your desk will look like this, and it will just be a gigantic mess. 1570.00s - 1575.04s | So in the end, we have perfectly aligned recordings, and we can actually average them together 1575.04s - 1580.40s | to get a nice, meaningful signal where if anything else put in noise, we can just filter 1580.40s - 1582.80s | it away essentially. 1582.80s - 1588.76s | But you know, now we just have a fancy line, how do we actually use this to time our glitch? 1588.76s - 1594.32s | Well, we can change the flash contents to be invalid, so that the boot fails. 1594.32s - 1600.04s | We reboot the ACE3 and record the EM emissions, and then we compare the differences. 1600.04s - 1605.04s | Sounds easy, but in reality this takes hours, because you have to set up these needle probes, 1605.04s - 1607.80s | which takes like, you know, 20 minutes. 1607.80s - 1613.04s | You try to flash the chip until it works, then you do the capture, and measure, and 1613.04s - 1614.24s | so on. 1614.24s - 1617.76s | And then you do this again, and again, and again, until you get everything right. 1617.76s - 1621.88s | And in the end, you end up with a trace that might look like this, where you have the original 1621.88s - 1625.20s | firmware, and the modified firmware. 1625.20s - 1629.04s | And we can see that this trace looks super different, right, like there's a clear point 1629.04s - 1632.24s | in time where they start to differ. 1632.24s -


chunk_id: 174_chunk_31
chunk_text:
know, now we just have a fancy line, how do we actually use this to time our glitch? 1588.76s - 1594.32s | Well, we can change the flash contents to be invalid, so that the boot fails. 1594.32s - 1600.04s | We reboot the ACE3 and record the EM emissions, and then we compare the differences. 1600.04s - 1605.04s | Sounds easy, but in reality this takes hours, because you have to set up these needle probes, 1605.04s - 1607.80s | which takes like, you know, 20 minutes. 1607.80s - 1613.04s | You try to flash the chip until it works, then you do the capture, and measure, and 1613.04s - 1614.24s | so on. 1614.24s - 1617.76s | And then you do this again, and again, and again, until you get everything right. 1617.76s - 1621.88s | And in the end, you end up with a trace that might look like this, where you have the original 1621.88s - 1625.20s | firmware, and the modified firmware. 1625.20s - 1629.04s | And we can see that this trace looks super different, right, like there's a clear point 1629.04s - 1632.24s | in time where they start to differ. 1632.24s - 1637.92s | What's even better is we can test our hypothesis by modifying the CRCs. 1637.92s - 1644.68s | So remember that we have these three CRCs, and so in theory, if we fix just some of them, 1644.68s - 1647.20s | we should see a delay in our boot, in our EM trace. 1647.20s - 1653.00s | Like, we should see that our trace changes at a later point in time. 1653.00s - 1660.08s | So I tried this, so I have the original firmware, then I set one of three CRCs to be correct, 1660.08s - 1663.00s | and you can see we have exactly the same signal as before. 1663.00s - 1669.52s | Then I tried two of three CRCs to be correct, and no change, so I was worried that this 1669.52s - 1671.36s | might not actually work. 1671.36s - 1676.60s | But then when I set the third CRC to be correct, we can see that the boot actually goes much 1676.60s - 1682.08s | further, and that the boot fails at a much later point in time. 1682.08s - 1685.60s | And so why not just glitch here, right? 1685.60s - 1687.36s |


chunk_id: 174_chunk_32
chunk_text:
1637.92s | What's even better is we can test our hypothesis by modifying the CRCs. 1637.92s - 1644.68s | So remember that we have these three CRCs, and so in theory, if we fix just some of them, 1644.68s - 1647.20s | we should see a delay in our boot, in our EM trace. 1647.20s - 1653.00s | Like, we should see that our trace changes at a later point in time. 1653.00s - 1660.08s | So I tried this, so I have the original firmware, then I set one of three CRCs to be correct, 1660.08s - 1663.00s | and you can see we have exactly the same signal as before. 1663.00s - 1669.52s | Then I tried two of three CRCs to be correct, and no change, so I was worried that this 1669.52s - 1671.36s | might not actually work. 1671.36s - 1676.60s | But then when I set the third CRC to be correct, we can see that the boot actually goes much 1676.60s - 1682.08s | further, and that the boot fails at a much later point in time. 1682.08s - 1685.60s | And so why not just glitch here, right? 1685.60s - 1687.36s | So simple enough. 1687.36s - 1688.76s | We now have some timing. 1688.76s - 1694.24s | Now we just need to position our chip shoulder, because normally for EMFI, it's very important 1694.24s - 1696.72s | where you are glitching. 1696.72s - 1702.46s | And so if you were doing this professionally, to give a talk at big security conferences, 1702.46s - 1705.84s | you would use a big XY table to scan the chip. 1706.08s - 1710.12s | Unfortunately, like literally the week before I did this, I had a small accident with my 1710.12s - 1716.36s | CNC, and I got 230 volts onto the ground line, and completely bricked my computer, my screen, 1716.36s - 1720.04s | and my CNC controller. 1720.04s - 1721.04s | That was fun. 1721.04s - 1724.36s | And so I couldn't do this, but I really wanted to try this attack. 1724.36s - 1729.24s | So I just did the dumbest thing you probably could have done, which is I choose the biggest 1729.24s - 1734.56s | tip I had, I just placed it on the chip. 1734.56s - 1740.36s | So that way I was sure that I was at least


chunk_id: 174_chunk_33
chunk_text:
So simple enough. 1687.36s - 1688.76s | We now have some timing. 1688.76s - 1694.24s | Now we just need to position our chip shoulder, because normally for EMFI, it's very important 1694.24s - 1696.72s | where you are glitching. 1696.72s - 1702.46s | And so if you were doing this professionally, to give a talk at big security conferences, 1702.46s - 1705.84s | you would use a big XY table to scan the chip. 1706.08s - 1710.12s | Unfortunately, like literally the week before I did this, I had a small accident with my 1710.12s - 1716.36s | CNC, and I got 230 volts onto the ground line, and completely bricked my computer, my screen, 1716.36s - 1720.04s | and my CNC controller. 1720.04s - 1721.04s | That was fun. 1721.04s - 1724.36s | And so I couldn't do this, but I really wanted to try this attack. 1724.36s - 1729.24s | So I just did the dumbest thing you probably could have done, which is I choose the biggest 1729.24s - 1734.56s | tip I had, I just placed it on the chip. 1734.56s - 1740.36s | So that way I was sure that I was at least hitting something in there. 1740.36s - 1744.36s | And so I had this nice setup with the chip shoulder. 1744.36s - 1748.64s | Then the triggering was done by a chip whisperer, Husky. 1748.64s - 1753.62s | The trigger connection is just the chip's leg line, using a PC byte, and a connection 1753.62s - 1755.08s | to ground. 1755.08s - 1758.08s | What's not shown is the days of debugging this took. 1758.08s - 1761.28s | And again, this is a photo op, reality looked like this. 1761.28s - 1765.20s | And like as soon as you bump the table, everything would just drop off. 1765.20s - 1768.84s | So yeah. 1768.84s - 1771.12s | So we are ready to glitch essentially. 1771.12s - 1775.16s | So my first attempt was, I would just change the version string. 1775.16s - 1780.32s | So from Mac OS, I can read out the version of the firmware that is running on the ACE. 1780.32s - 1785.36s | And so on my MacBook, this was 2.45. 1785.36s - 1790.60s | And so I decided in the flash, I would just change that single byte. 1790.60s - 1794.40s | And I fixed all


chunk_id: 174_chunk_34
chunk_text:
hitting something in there. 1740.36s - 1744.36s | And so I had this nice setup with the chip shoulder. 1744.36s - 1748.64s | Then the triggering was done by a chip whisperer, Husky. 1748.64s - 1753.62s | The trigger connection is just the chip's leg line, using a PC byte, and a connection 1753.62s - 1755.08s | to ground. 1755.08s - 1758.08s | What's not shown is the days of debugging this took. 1758.08s - 1761.28s | And again, this is a photo op, reality looked like this. 1761.28s - 1765.20s | And like as soon as you bump the table, everything would just drop off. 1765.20s - 1768.84s | So yeah. 1768.84s - 1771.12s | So we are ready to glitch essentially. 1771.12s - 1775.16s | So my first attempt was, I would just change the version string. 1775.16s - 1780.32s | So from Mac OS, I can read out the version of the firmware that is running on the ACE. 1780.32s - 1785.36s | And so on my MacBook, this was 2.45. 1785.36s - 1790.60s | And so I decided in the flash, I would just change that single byte. 1790.60s - 1794.40s | And I fixed all the other CRCs around it. 1794.40s - 1797.04s | And then I armed the Husky and the chip shouter. 1797.04s - 1800.12s | I reboot the ACE3 via ACE tool. 1800.12s - 1802.12s | I wait for the glitch. 1802.12s - 1807.36s | And then remember earlier, I told you that we can check what the status of the chip is. 1807.36s - 1810.72s | I just check whether it's successfully booted. 1810.72s - 1812.92s | And this worked wonderfully, right? 1812.92s - 1816.00s | So I just, I can just try again and again and again. 1816.00s - 1819.20s | And in theory, we should eventually get successful. 1819.20s - 1826.20s | And so I built this tiny Jupyter notebook to do all of this and started it. 1826.20s - 1829.16s | And you can see we got like 1.6 attempts per second. 1829.16s - 1834.16s | So each reboot takes like 1.6 seconds. 1834.16s - 1836.12s | That's when the trouble started. 1836.12s - 1840.60s | The problem is sometimes the ACE completely stops responding and I can't get it to boot 1840.60s - 1841.60s | again. 1841.60s - 1842.60s | I don't get any output. 1842.60s -


chunk_id: 174_chunk_35
chunk_text:
the other CRCs around it. 1794.40s - 1797.04s | And then I armed the Husky and the chip shouter. 1797.04s - 1800.12s | I reboot the ACE3 via ACE tool. 1800.12s - 1802.12s | I wait for the glitch. 1802.12s - 1807.36s | And then remember earlier, I told you that we can check what the status of the chip is. 1807.36s - 1810.72s | I just check whether it's successfully booted. 1810.72s - 1812.92s | And this worked wonderfully, right? 1812.92s - 1816.00s | So I just, I can just try again and again and again. 1816.00s - 1819.20s | And in theory, we should eventually get successful. 1819.20s - 1826.20s | And so I built this tiny Jupyter notebook to do all of this and started it. 1826.20s - 1829.16s | And you can see we got like 1.6 attempts per second. 1829.16s - 1834.16s | So each reboot takes like 1.6 seconds. 1834.16s - 1836.12s | That's when the trouble started. 1836.12s - 1840.60s | The problem is sometimes the ACE completely stops responding and I can't get it to boot 1840.60s - 1841.60s | again. 1841.60s - 1842.60s | I don't get any output. 1842.60s - 1845.16s | So I need to reboot the machine. 1845.16s - 1851.04s | The problem is if I reboot the machine while the charging controller doesn't have a firmware, 1851.04s - 1853.68s | the MacBook will stop charging. 1853.68s - 1857.68s | And essentially, I have eight hours of trying to glitch the chip. 1857.68s - 1861.64s | And then the battery runs out, then I have to restore the flash, which takes hours again 1861.64s - 1866.52s | with the probes, restore the firmware, charge it up, and then do the whole thing opposite 1866.52s - 1869.20s | again. 1869.20s - 1872.84s | So I did that for a couple of days. 1873.52s - 1875.00s | It was like sunken cost fallacy. 1875.00s - 1879.68s | I started, then I thought like, hey, maybe I should build a battery emulator and just 1879.68s - 1881.68s | like feed it externally. 1881.68s - 1883.48s | But I thought, ah, no, I'm so close. 1883.48s - 1886.84s | I'm sure it will happen any minute now. 1886.84s - 1889.88s | So I kept doing this, but eventually I got success. 1889.88s - 1896.48s | I managed to get into the app


chunk_id: 174_chunk_36
chunk_text:
1845.16s | So I need to reboot the machine. 1845.16s - 1851.04s | The problem is if I reboot the machine while the charging controller doesn't have a firmware, 1851.04s - 1853.68s | the MacBook will stop charging. 1853.68s - 1857.68s | And essentially, I have eight hours of trying to glitch the chip. 1857.68s - 1861.64s | And then the battery runs out, then I have to restore the flash, which takes hours again 1861.64s - 1866.52s | with the probes, restore the firmware, charge it up, and then do the whole thing opposite 1866.52s - 1869.20s | again. 1869.20s - 1872.84s | So I did that for a couple of days. 1873.52s - 1875.00s | It was like sunken cost fallacy. 1875.00s - 1879.68s | I started, then I thought like, hey, maybe I should build a battery emulator and just 1879.68s - 1881.68s | like feed it externally. 1881.68s - 1883.48s | But I thought, ah, no, I'm so close. 1883.48s - 1886.84s | I'm sure it will happen any minute now. 1886.84s - 1889.88s | So I kept doing this, but eventually I got success. 1889.88s - 1896.48s | I managed to get into the app mode on the ACE3. 1896.48s - 1906.96s | And by checking the version number, I can actually see I was successful. 1906.96s - 1911.16s | I changed it to version 42, and we glitched the ACE3. 1911.16s - 1917.28s | But the problem is we only changed the external patches. 1917.28s - 1921.24s | And we don't actually know what these patches patch because we don't know the actual ROM. 1921.24s - 1926.12s | And so essentially, we have this flash, which is full of random functions, but we don't 1926.12s - 1927.56s | ever know what they do. 1928.20s - 1930.48s | We don't know, how can I trigger them? 1930.48s - 1932.32s | Will they actually be executed? 1932.32s - 1936.44s | And then even if you manage to execute them, we don't have any input or output. 1936.44s - 1939.24s | We don't even have a driver to wiggle a pin or something. 1939.24s - 1945.32s | So I was considering, oh, can I do maybe some looping that I can measure via EM or so? 1945.32s - 1947.60s | But yeah, essentially, we can replace functions. 1947.60s - 1949.10s | We don't know what they do.


chunk_id: 174_chunk_37
chunk_text:
mode on the ACE3. 1896.48s - 1906.96s | And by checking the version number, I can actually see I was successful. 1906.96s - 1911.16s | I changed it to version 42, and we glitched the ACE3. 1911.16s - 1917.28s | But the problem is we only changed the external patches. 1917.28s - 1921.24s | And we don't actually know what these patches patch because we don't know the actual ROM. 1921.24s - 1926.12s | And so essentially, we have this flash, which is full of random functions, but we don't 1926.12s - 1927.56s | ever know what they do. 1928.20s - 1930.48s | We don't know, how can I trigger them? 1930.48s - 1932.32s | Will they actually be executed? 1932.32s - 1936.44s | And then even if you manage to execute them, we don't have any input or output. 1936.44s - 1939.24s | We don't even have a driver to wiggle a pin or something. 1939.24s - 1945.32s | So I was considering, oh, can I do maybe some looping that I can measure via EM or so? 1945.32s - 1947.60s | But yeah, essentially, we can replace functions. 1947.60s - 1949.10s | We don't know what they do. 1949.10s - 1954.92s | And even if we execute them, even if we 100% know we get them to execute, we have no way 1954.92s - 1956.60s | to get data out. 1957.24s - 1962.00s | However, I started looking around a lot through the ACE3 flash, and you can see that there 1962.00s - 1969.96s | are a lot of 4CC strings here again, like this, UFPF, DFUF, USBW, and so on and so forth. 1969.96s - 1975.56s | And I thought probably there are some similarities between the ACE3 firmware and the ACE2 firmware. 1975.56s - 1980.48s | And maybe I get lucky and they patched a function in both chips, the old one and the new one. 1980.48s - 1987.04s | And so after hours of staring in Binary Ninja, I found a function that is actually almost 1987.04s - 1990.04s | identical between the two. 1990.04s - 1992.04s | And this is the USBW command handler. 1992.04s - 1998.00s | And USBW command handler, I have no idea what that does, but it's a command that I can send 1998.00s - 2001.20s | to the ACE that will get executed. 2001.20s - 2003.60s | And remember,


chunk_id: 174_chunk_38
chunk_text:
1949.10s - 1954.92s | And even if we execute them, even if we 100% know we get them to execute, we have no way 1954.92s - 1956.60s | to get data out. 1957.24s - 1962.00s | However, I started looking around a lot through the ACE3 flash, and you can see that there 1962.00s - 1969.96s | are a lot of 4CC strings here again, like this, UFPF, DFUF, USBW, and so on and so forth. 1969.96s - 1975.56s | And I thought probably there are some similarities between the ACE3 firmware and the ACE2 firmware. 1975.56s - 1980.48s | And maybe I get lucky and they patched a function in both chips, the old one and the new one. 1980.48s - 1987.04s | And so after hours of staring in Binary Ninja, I found a function that is actually almost 1987.04s - 1990.04s | identical between the two. 1990.04s - 1992.04s | And this is the USBW command handler. 1992.04s - 1998.00s | And USBW command handler, I have no idea what that does, but it's a command that I can send 1998.00s - 2001.20s | to the ACE that will get executed. 2001.20s - 2003.60s | And remember, and so I can replace it. 2003.60s - 2007.52s | And remember how earlier I saw the memread function? 2007.56s - 2012.48s | I essentially took that implementation from the ACE2, modified it, simplified it slightly, 2012.48s - 2017.16s | and then had a function that was by Apple built to give me memory. 2017.16s - 2020.52s | And so I essentially Apple built my exploit payload. 2020.52s - 2023.08s | So I'm very thankful for that. 2023.08s - 2028.20s | And so in the end, I essentially had a very simple payload that is a trivial memory reader 2028.20s - 2032.32s | that takes in an address and returns four bytes at that address. 2032.32s - 2037.76s | So again, attempt two, we replaced the USBW command handler. 2037.76s - 2039.16s | And we start glitching. 2039.16s - 2043.48s | And we again, you know, wait for the battery to run out, start over, and so on and so forth. 2043.48s - 2046.80s | The glitch was not very stable at this point in time. 2046.80s - 2052.00s | And so, but eventually, I got a success. 2052.00s - 2058.88s | And so I decided I will just send


chunk_id: 174_chunk_39
chunk_text:
and so I can replace it. 2003.60s - 2007.52s | And remember how earlier I saw the memread function? 2007.56s - 2012.48s | I essentially took that implementation from the ACE2, modified it, simplified it slightly, 2012.48s - 2017.16s | and then had a function that was by Apple built to give me memory. 2017.16s - 2020.52s | And so I essentially Apple built my exploit payload. 2020.52s - 2023.08s | So I'm very thankful for that. 2023.08s - 2028.20s | And so in the end, I essentially had a very simple payload that is a trivial memory reader 2028.20s - 2032.32s | that takes in an address and returns four bytes at that address. 2032.32s - 2037.76s | So again, attempt two, we replaced the USBW command handler. 2037.76s - 2039.16s | And we start glitching. 2039.16s - 2043.48s | And we again, you know, wait for the battery to run out, start over, and so on and so forth. 2043.48s - 2046.80s | The glitch was not very stable at this point in time. 2046.80s - 2052.00s | And so, but eventually, I got a success. 2052.00s - 2058.88s | And so I decided I will just send the USBW command with the address 0000. 2058.88s - 2063.76s | And I got this back, 000620. 2063.76s - 2065.80s | And you know, this is a little endian machine. 2065.80s - 2067.28s | So you reverse it. 2067.28s - 2072.56s | And if you do a lot of arm reversing, you will immediately spot why this indicates success. 2072.56s - 2074.32s | This is the stack pointer reset value. 2074.32s - 2078.12s | We just read address zero of the physical memory of the chip. 2078.12s - 2083.16s | And so we can read and also write arbitrary memory on the ACE3. 2083.16s - 2092.13s | So time to dump. 2092.13s - 2094.81s | And again, like I, my payload was not the greatest. 2094.81s - 2097.77s | And so I could dump four bytes at a time. 2097.77s - 2101.37s | And so it took hours and the battery ran out. 2101.37s - 2110.13s | And I had to reflash, restore, recharge, glitch again, and then dump it again. 2110.13s - 2113.17s | But eventually, I had the full firmware. 2113.17s - 2117.17s | A full dump of the ACE3, ROM and RAM, and so on and so


chunk_id: 174_chunk_40
chunk_text:
the USBW command with the address 0000. 2058.88s - 2063.76s | And I got this back, 000620. 2063.76s - 2065.80s | And you know, this is a little endian machine. 2065.80s - 2067.28s | So you reverse it. 2067.28s - 2072.56s | And if you do a lot of arm reversing, you will immediately spot why this indicates success. 2072.56s - 2074.32s | This is the stack pointer reset value. 2074.32s - 2078.12s | We just read address zero of the physical memory of the chip. 2078.12s - 2083.16s | And so we can read and also write arbitrary memory on the ACE3. 2083.16s - 2092.13s | So time to dump. 2092.13s - 2094.81s | And again, like I, my payload was not the greatest. 2094.81s - 2097.77s | And so I could dump four bytes at a time. 2097.77s - 2101.37s | And so it took hours and the battery ran out. 2101.37s - 2110.13s | And I had to reflash, restore, recharge, glitch again, and then dump it again. 2110.13s - 2113.17s | But eventually, I had the full firmware. 2113.17s - 2117.17s | A full dump of the ACE3, ROM and RAM, and so on and so forth. 2117.17s - 2118.41s | So awesome. 2118.41s - 2122.37s | We can actually start reverse engineering this chip. 2122.37s - 2127.41s | And the main thing that I learned during this is dumping unknown silicon is actually possible. 2127.41s - 2130.05s | Like, I knew almost nothing about this chip, right? 2130.05s - 2131.77s | And it's not super difficult. 2131.77s - 2135.61s | It just takes a lot of persistence and, you know, dealing with annoyances. 2135.61s - 2141.33s | And we can actually get code execution without having firmware, even on a microcontroller. 2141.37s - 2143.29s | I thought that was really cool. 2143.29s - 2147.25s | And now we can actually start researching the ACE3. 2147.25s - 2152.37s | Now, the equipment I used with like the chip shoulder, Husky and so on, this is all very 2152.37s - 2153.37s | expensive, right? 2153.37s - 2156.65s | Like the total is probably like 8k or something. 2156.65s - 2158.77s | And you know, so let's make it cheaper. 2158.77s - 2164.81s | So I imported the entire attack onto the Pico MP, which is like a super low cost electromagnetic 2164.81s - 2166.97s | fault injection


chunk_id: 174_chunk_41
chunk_text:
forth. 2117.17s - 2118.41s | So awesome. 2118.41s - 2122.37s | We can actually start reverse engineering this chip. 2122.37s - 2127.41s | And the main thing that I learned during this is dumping unknown silicon is actually possible. 2127.41s - 2130.05s | Like, I knew almost nothing about this chip, right? 2130.05s - 2131.77s | And it's not super difficult. 2131.77s - 2135.61s | It just takes a lot of persistence and, you know, dealing with annoyances. 2135.61s - 2141.33s | And we can actually get code execution without having firmware, even on a microcontroller. 2141.37s - 2143.29s | I thought that was really cool. 2143.29s - 2147.25s | And now we can actually start researching the ACE3. 2147.25s - 2152.37s | Now, the equipment I used with like the chip shoulder, Husky and so on, this is all very 2152.37s - 2153.37s | expensive, right? 2153.37s - 2156.65s | Like the total is probably like 8k or something. 2156.65s - 2158.77s | And you know, so let's make it cheaper. 2158.77s - 2164.81s | So I imported the entire attack onto the Pico MP, which is like a super low cost electromagnetic 2164.81s - 2166.97s | fault injection tool. 2166.97s - 2172.17s | And I put a firmware on the chip shoulder that does all the triggering on the chip select 2172.17s - 2174.65s | line and so on and so forth automatically. 2174.65s - 2180.61s | And so you can now attack the ACE3 and dump it for $60, which I think is pretty fair. 2180.61s - 2186.18s | And so, yeah. 2186.18s - 2189.34s | With that said, that's all I have for you today. 2189.34s - 2192.50s | We have a bit of time for Q&A, but thank you. 2192.50s - 2196.04s | And also, if you're interested in actually trying some fault injection, we are running 2196.04s - 2198.42s | a glitching lab over at the Embedded Systems Village. 2198.42s - 2203.50s | And so come by and you can actually bypass some protections on chips by zapping them 2203.50s - 2206.06s | or fiddling with the voltage rails and so on. 2206.06s - 2206.90s | So yeah, thank you.


chunk_id: 174_chunk_42
chunk_text:
tool. 2166.97s - 2172.17s | And I put a firmware on the chip shoulder that does all the triggering on the chip select 2172.17s - 2174.65s | line and so on and so forth automatically. 2174.65s - 2180.61s | And so you can now attack the ACE3 and dump it for $60, which I think is pretty fair. 2180.61s - 2186.18s | And so, yeah. 2186.18s - 2189.34s | With that said, that's all I have for you today. 2189.34s - 2192.50s | We have a bit of time for Q&A, but thank you. 2192.50s - 2196.04s | And also, if you're interested in actually trying some fault injection, we are running 2196.04s - 2198.42s | a glitching lab over at the Embedded Systems Village. 2198.42s - 2203.50s | And so come by and you can actually bypass some protections on chips by zapping them 2203.50s - 2206.06s | or fiddling with the voltage rails and so on. 2206.06s - 2206.90s | So yeah, thank you.


chunk_id: 175_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=cHsRxkfxvq8", "title": "DEF CON 32 - The Rise and Fall of Binary Exploitation - Stephen Sims", "description": "For the past 20+ years binary exploitation has been seen as the ultimate challenge and prize, when exploiting large applications and operating systems. During this period, the question of \"How much longer will we be able to do this?\" has been asked countless times, and with good reason. Memory safety and corruption issues with low-level languages have been an enormous challenge for OS and application developers. There are certainly efforts to move to \"safer\" languages such as Rust, but those languages need to mature a bit longer before they're able to stand up to the capabilities of a language like C++.\n\nThanks to exploit mitigations and memory protections, a large number of these vulnerabilities are not exploitable. There are the mature mitigations, such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), and then newer ones such as Control-flow Enforcement Technology (CET) and Virtualization Based Security (VBS). A large number of these mitigations are not enabled by default on the Windows OS, due to the fact that many need to be tested to ensure they do not break production applications. In this presentation, we will take a technical dive into the state of binary exploitation and the effectiveness of the many available mitigations, by looking at the way they're enforced.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2860, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.76s | This text was transcribed using whisper model: large-v2 So, thank you so much for coming. Uh, I know it's early on a Saturday at DEF CON. I talked to 4.76s - 8.24s | some people last night, they're like, when are you talking? It's at 11 AM. I don't get up 8.24s - 13.24s | till 3, sorry. So, I appreciate the effort. Or maybe you're still up. So, I wanna move pretty 15.78s - 19.88s | quickly here. I've got a handheld mic, I might walk around a bit. I don't have a lapel mic 19.88s - 24.58s | because flippers and stuff like that. So, we'll see what we do. But, uh, I've got a lot of 24.58s - 28.36s | slides and I wanna make sure I get through everything. So, I've got a quick agenda that I 28.38s - 33.42s | will start with. Let me quickly introduce myself for those


chunk_id: 175_chunk_1
chunk_text:
In this presentation, we will take a technical dive into the state of binary exploitation and the effectiveness of the many available mitigations, by looking at the way they're enforced.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2860, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.76s | This text was transcribed using whisper model: large-v2 So, thank you so much for coming. Uh, I know it's early on a Saturday at DEF CON. I talked to 4.76s - 8.24s | some people last night, they're like, when are you talking? It's at 11 AM. I don't get up 8.24s - 13.24s | till 3, sorry. So, I appreciate the effort. Or maybe you're still up. So, I wanna move pretty 15.78s - 19.88s | quickly here. I've got a handheld mic, I might walk around a bit. I don't have a lapel mic 19.88s - 24.58s | because flippers and stuff like that. So, we'll see what we do. But, uh, I've got a lot of 24.58s - 28.36s | slides and I wanna make sure I get through everything. So, I've got a quick agenda that I 28.38s - 33.42s | will start with. Let me quickly introduce myself for those of you who may not be familiar with 33.42s - 39.52s | who I am or my work. So, my name is Stephen Sims. I've been a vulnerability researcher for 39.52s - 44.54s | going on 20 years now. I've, was lucky enough early on, uh, to have computers in the house and 47.44s - 52.24s | be able to have access to video gaming and all the fun things early on and editing hex edit, 52.24s - 56.34s | you know, using a hex editor and hacking, all the things you guys have already done. So, 56.36s - 63.10s | let's move on beyond that. I've sold a lot of exploits over the past couple decades. I 63.10s - 68.64s | corrected myself there. I thought it was over 30 browser exploits but I didn't wanna fib so I 68.64s - 73.88s | went back and counted and it ends up being 29 of them. Um, those are mostly used after free 73.88s - 79.48s | and tight confusion vulnerabilities. I've always been someone who sells exploits. I don't 79.48s - 85.76s | typically disclose them publicly or through other programs. I will talk a little bit about 85.78s


chunk_id: 175_chunk_2
chunk_text:
of you who may not be familiar with 33.42s - 39.52s | who I am or my work. So, my name is Stephen Sims. I've been a vulnerability researcher for 39.52s - 44.54s | going on 20 years now. I've, was lucky enough early on, uh, to have computers in the house and 47.44s - 52.24s | be able to have access to video gaming and all the fun things early on and editing hex edit, 52.24s - 56.34s | you know, using a hex editor and hacking, all the things you guys have already done. So, 56.36s - 63.10s | let's move on beyond that. I've sold a lot of exploits over the past couple decades. I 63.10s - 68.64s | corrected myself there. I thought it was over 30 browser exploits but I didn't wanna fib so I 68.64s - 73.88s | went back and counted and it ends up being 29 of them. Um, those are mostly used after free 73.88s - 79.48s | and tight confusion vulnerabilities. I've always been someone who sells exploits. I don't 79.48s - 85.76s | typically disclose them publicly or through other programs. I will talk a little bit about 85.78s - 89.24s | that because obviously there are ethics associated with exploit sales so I'll give you my 89.24s - 95.12s | position when we get there. I found a couple kernel vulnerabilities on Windows 1 RCE which 95.12s - 98.82s | you can get a lot of money for nowadays. Had I known a little bit more when I sold it, it 98.82s - 102.46s | would have been better. But lots of other vulnerabilities in different applications and 102.46s - 105.60s | hardware out there over the years. I've been lucky enough to have a lot of great relationships 105.60s - 111.00s | and such. I moved to San Francisco early on in the 2000s and lived on Treasure Island where 111.00s - 114.78s | we used to joke and call it Hacker Island because there was so many hackers there. People 114.82s - 119.52s | from Burning Man, people from all kinds of different backgrounds but it was just a free for 119.52s - 124.36s | all and it was pretty incredible. Lots of people from CDC lived out there and others and you 124.36s - 129.24s | know you learn pretty early on to uh how


chunk_id: 175_chunk_3
chunk_text:
- 89.24s | that because obviously there are ethics associated with exploit sales so I'll give you my 89.24s - 95.12s | position when we get there. I found a couple kernel vulnerabilities on Windows 1 RCE which 95.12s - 98.82s | you can get a lot of money for nowadays. Had I known a little bit more when I sold it, it 98.82s - 102.46s | would have been better. But lots of other vulnerabilities in different applications and 102.46s - 105.60s | hardware out there over the years. I've been lucky enough to have a lot of great relationships 105.60s - 111.00s | and such. I moved to San Francisco early on in the 2000s and lived on Treasure Island where 111.00s - 114.78s | we used to joke and call it Hacker Island because there was so many hackers there. People 114.82s - 119.52s | from Burning Man, people from all kinds of different backgrounds but it was just a free for 119.52s - 124.36s | all and it was pretty incredible. Lots of people from CDC lived out there and others and you 124.36s - 129.24s | know you learn pretty early on to uh how to properly use a handle and not get yourself doxxed 129.24s - 134.24s | out there. I'm also uh like I said a musician at the Sands Institute on the offensive 134.24s - 138.94s | operations curriculum lead and I have a couple courses there on advanced exploit development. I 138.94s - 142.48s | am one of the co-authors of Grey Hat Hacking if you've heard of that book series. We're 142.48s - 147.82s | talking right now about doing a 7th edition so hopefully that comes to fruition. And then I 147.82s - 152.16s | also run a weekly stream you might have heard of called Off By One Security where I do my 152.16s - 156.10s | own stream solo and I also have a lot of guests on and I've been lucky enough to have some 156.10s - 161.06s | really amazing people on and uh that just makes it all great. And I appreciate so many of 161.06s - 164.24s | you have come up and say thank you for the stream cause that means a lot to me and that's 164.24s - 167.44s | what I do it for is to give back to the


chunk_id: 175_chunk_4
chunk_text:
to properly use a handle and not get yourself doxxed 129.24s - 134.24s | out there. I'm also uh like I said a musician at the Sands Institute on the offensive 134.24s - 138.94s | operations curriculum lead and I have a couple courses there on advanced exploit development. I 138.94s - 142.48s | am one of the co-authors of Grey Hat Hacking if you've heard of that book series. We're 142.48s - 147.82s | talking right now about doing a 7th edition so hopefully that comes to fruition. And then I 147.82s - 152.16s | also run a weekly stream you might have heard of called Off By One Security where I do my 152.16s - 156.10s | own stream solo and I also have a lot of guests on and I've been lucky enough to have some 156.10s - 161.06s | really amazing people on and uh that just makes it all great. And I appreciate so many of 161.06s - 164.24s | you have come up and say thank you for the stream cause that means a lot to me and that's 164.24s - 167.44s | what I do it for is to give back to the community. And if any of you are ever interested in 167.44s - 172.98s | being a guest I'd love to uh hear from you. Alright so quick agenda we're gonna start off 172.98s - 178.58s | doing a quick history of mitigations. We're not gonna cover all of them there's dozens and 178.58s - 182.68s | dozens of them so we can't get through them all but we'll touch briefly on them kinda show you 182.68s - 187.82s | where we were where we are today. Microsoft MSRC was generous enough to get me some really 187.82s - 192.40s | cool cutting edge data that uh has not been published yet so you'll get to see some 192.40s - 196.90s | vulnerability information from Microsoft's perspective in relation to RCEs and local 196.90s - 201.76s | priv and other types of bugs. Then we'll quickly go through payouts. I did a stream last 201.76s - 206.50s | Friday on nothing but payouts and all the different types of buyers out there and uh I 206.50s - 211.74s | got a lot of hate and a lot of love from that one which I expected because again it's it 211.74s -


chunk_id: 175_chunk_5
chunk_text:
community. And if any of you are ever interested in 167.44s - 172.98s | being a guest I'd love to uh hear from you. Alright so quick agenda we're gonna start off 172.98s - 178.58s | doing a quick history of mitigations. We're not gonna cover all of them there's dozens and 178.58s - 182.68s | dozens of them so we can't get through them all but we'll touch briefly on them kinda show you 182.68s - 187.82s | where we were where we are today. Microsoft MSRC was generous enough to get me some really 187.82s - 192.40s | cool cutting edge data that uh has not been published yet so you'll get to see some 192.40s - 196.90s | vulnerability information from Microsoft's perspective in relation to RCEs and local 196.90s - 201.76s | priv and other types of bugs. Then we'll quickly go through payouts. I did a stream last 201.76s - 206.50s | Friday on nothing but payouts and all the different types of buyers out there and uh I 206.50s - 211.74s | got a lot of hate and a lot of love from that one which I expected because again it's it 211.74s - 217.64s | involves your morals and it's very ethical you know considerations to have. The we'll 217.64s - 221.72s | quickly look at the role of machine learning and AI in general in vulnerability research 221.72s - 226.28s | because that's obviously a hot topic as of late and will continue to be. And then we're 226.30s - 230.74s | gonna switch over into being technical cause I don't wanna do a talk without being technical 230.74s - 235.54s | and we'll get into looking at one specific mitigation that is implemented in the Windows 235.54s - 241.32s | kernel. And my main point of wanting to show you that is so that if you yourself wanna 241.32s - 245.48s | understand how a new mitigation works that comes out. If you wanna figure out how to 245.48s - 250.52s | bypass it how to work around it or other things or how effective it is if you're a defender 250.52s - 255.10s | you need to go and debug it. It's really the only way you can learn other than taking other 255.12s - 259.72s | people's published information. So every time a new mitigation comes out I love


chunk_id: 175_chunk_6
chunk_text:
217.64s | involves your morals and it's very ethical you know considerations to have. The we'll 217.64s - 221.72s | quickly look at the role of machine learning and AI in general in vulnerability research 221.72s - 226.28s | because that's obviously a hot topic as of late and will continue to be. And then we're 226.30s - 230.74s | gonna switch over into being technical cause I don't wanna do a talk without being technical 230.74s - 235.54s | and we'll get into looking at one specific mitigation that is implemented in the Windows 235.54s - 241.32s | kernel. And my main point of wanting to show you that is so that if you yourself wanna 241.32s - 245.48s | understand how a new mitigation works that comes out. If you wanna figure out how to 245.48s - 250.52s | bypass it how to work around it or other things or how effective it is if you're a defender 250.52s - 255.10s | you need to go and debug it. It's really the only way you can learn other than taking other 255.12s - 259.72s | people's published information. So every time a new mitigation comes out I love to jump in to 259.72s - 263.92s | debuggers and disassemblers and go and understand it as best I can. And then we'll do some 263.92s - 270.00s | takeaways. That is the agenda. So the golden years I'm not one you know it's it's not my right 270.00s - 273.74s | to say what the golden years of hacking is but I have been doing it long enough and I 273.74s - 278.84s | remember you know reading it was before my time but I left one smash in the stack for fun and 278.84s - 283.92s | profit and other papers released around that time. Open wall, work that Brad Spengler was 283.94s - 289.90s | doing so many other brilliant researchers and when you when when I personally think about 289.90s - 294.78s | what the golden years is it's before all these mitigations became really effective. You'll see 294.78s - 299.48s | on a diagram that I put together coming up in a moment that there are certain years where 299.48s - 304.42s | stuff got real serious and it's only gotten harder and harder since then. So I would say the 304.42s - 309.66s |


chunk_id: 175_chunk_7
chunk_text:
to jump in to 259.72s - 263.92s | debuggers and disassemblers and go and understand it as best I can. And then we'll do some 263.92s - 270.00s | takeaways. That is the agenda. So the golden years I'm not one you know it's it's not my right 270.00s - 273.74s | to say what the golden years of hacking is but I have been doing it long enough and I 273.74s - 278.84s | remember you know reading it was before my time but I left one smash in the stack for fun and 278.84s - 283.92s | profit and other papers released around that time. Open wall, work that Brad Spengler was 283.94s - 289.90s | doing so many other brilliant researchers and when you when when I personally think about 289.90s - 294.78s | what the golden years is it's before all these mitigations became really effective. You'll see 294.78s - 299.48s | on a diagram that I put together coming up in a moment that there are certain years where 299.48s - 304.42s | stuff got real serious and it's only gotten harder and harder since then. So I would say the 304.42s - 309.66s | golden years of memory corruption bugs is long over but still possible and those bugs are 309.66s - 315.88s | very valuable now and you'll see that in a moment. But you see here Windows up at the top 315.88s - 321.34s | and we can go way back to when trust from escape and wag that was what became Emmet or at 321.34s - 325.42s | least some of the controls and mitigations there became the enhanced mitigation experience 325.42s - 330.32s | toolkit which of course now today is exploit guard. But Windows it wasn't until XP service 330.32s - 334.76s | pack 2 where mitigations were a thing. I remember when that dropped and admins were 334.76s - 339.00s | freaking out because it was over a gigabyte update and there were a lot of new mitigations 339.04s - 342.44s | published. You can see them listed there. I'm not going to go through every one of them but 342.44s - 347.68s | notable ones like data execution prevention that's huge and in stack canaries. Linux down 347.68s - 352.32s | below I was doing some uh research and thankfully Brad Spangler pointed me to some a


chunk_id: 175_chunk_8
chunk_text:
golden years of memory corruption bugs is long over but still possible and those bugs are 309.66s - 315.88s | very valuable now and you'll see that in a moment. But you see here Windows up at the top 315.88s - 321.34s | and we can go way back to when trust from escape and wag that was what became Emmet or at 321.34s - 325.42s | least some of the controls and mitigations there became the enhanced mitigation experience 325.42s - 330.32s | toolkit which of course now today is exploit guard. But Windows it wasn't until XP service 330.32s - 334.76s | pack 2 where mitigations were a thing. I remember when that dropped and admins were 334.76s - 339.00s | freaking out because it was over a gigabyte update and there were a lot of new mitigations 339.04s - 342.44s | published. You can see them listed there. I'm not going to go through every one of them but 342.44s - 347.68s | notable ones like data execution prevention that's huge and in stack canaries. Linux down 347.68s - 352.32s | below I was doing some uh research and thankfully Brad Spangler pointed me to some a great 352.32s - 357.32s | talk from uh maybe a decade or so ago that really went through every single mitigation when it 359.76s - 364.70s | came out the bug classes and gave credit where credit is due to all the brilliant researchers 364.70s - 368.70s | and that's a really hard thing to do. There's a lot of confusion when you go out there 368.70s - 373.44s | trying to find out who the original source was that published a technique for 373.44s - 379.74s | exploitation or some documentation and I try my best to give that credit. So the information 379.74s - 386.18s | there under Linux all the way back to 1997 I mean people were thinking about security way 386.18s - 391.92s | back in 1997 especially on the Linux side of the house which as expected is always first in 391.92s - 397.46s | that realm. But open wall was a big one for that one. Uh Mac OS you can see was a bit late to 397.46s - 402.66s | the game. ASLR like randomization didn't come out until like 2011. That's way behind 402.66s - 409.70s | Vista even. So all


chunk_id: 175_chunk_9
chunk_text:
great 352.32s - 357.32s | talk from uh maybe a decade or so ago that really went through every single mitigation when it 359.76s - 364.70s | came out the bug classes and gave credit where credit is due to all the brilliant researchers 364.70s - 368.70s | and that's a really hard thing to do. There's a lot of confusion when you go out there 368.70s - 373.44s | trying to find out who the original source was that published a technique for 373.44s - 379.74s | exploitation or some documentation and I try my best to give that credit. So the information 379.74s - 386.18s | there under Linux all the way back to 1997 I mean people were thinking about security way 386.18s - 391.92s | back in 1997 especially on the Linux side of the house which as expected is always first in 391.92s - 397.46s | that realm. But open wall was a big one for that one. Uh Mac OS you can see was a bit late to 397.46s - 402.66s | the game. ASLR like randomization didn't come out until like 2011. That's way behind 402.66s - 409.70s | Vista even. So all the operating systems now though are at a pretty good state. Some notable 409.70s - 413.94s | mitigations this is not complete by any means. I put this together there's always 413.94s - 418.68s | possibilities there's mistakes. A lot of times mitigations come out like before the 418.68s - 423.28s | official OS release of that mitigation. You might hear well low fragmentation heap that 423.28s - 428.04s | was around during XP service pack 2 or 3 but it didn't fully get implemented to replace the 428.04s - 432.72s | front end heap allocator until Windows Vista. And then they got rid of the look aside list 432.72s - 436.86s | except for in the kernel. So like a lot of this stuff can be fuzzy. So if the arrow is going 436.86s - 440.80s | back that means back ported. A lot of times mitigations come out some of them get back 440.80s - 444.76s | ported some of them don't get back ported. But you can see some other notable ones like 444.76s - 449.56s | Windows 10 obviously came out uh control flow guard was a significant one. Microsoft was 449.56s - 453.46s | pretty


chunk_id: 175_chunk_10
chunk_text:
the operating systems now though are at a pretty good state. Some notable 409.70s - 413.94s | mitigations this is not complete by any means. I put this together there's always 413.94s - 418.68s | possibilities there's mistakes. A lot of times mitigations come out like before the 418.68s - 423.28s | official OS release of that mitigation. You might hear well low fragmentation heap that 423.28s - 428.04s | was around during XP service pack 2 or 3 but it didn't fully get implemented to replace the 428.04s - 432.72s | front end heap allocator until Windows Vista. And then they got rid of the look aside list 432.72s - 436.86s | except for in the kernel. So like a lot of this stuff can be fuzzy. So if the arrow is going 436.86s - 440.80s | back that means back ported. A lot of times mitigations come out some of them get back 440.80s - 444.76s | ported some of them don't get back ported. But you can see some other notable ones like 444.76s - 449.56s | Windows 10 obviously came out uh control flow guard was a significant one. Microsoft was 449.56s - 453.46s | pretty proud of that one and made some pretty bold claims about it. But none of these 453.46s - 459.62s | mitigations by themselves are a one stop shop. They are complementary to one another. If 459.62s - 465.16s | there's one weak link in the chain if one single mitigation is not working properly or if one 465.16s - 471.34s | library is not compiled to participate in a mitigation it breaks the whole thing. So it can 471.34s - 476.28s | be difficult to get all of them there. I usually put up like a Venn diagram that shows 476.30s - 481.28s | overlapping circles where you've got different categories of mitigations like those enforced 481.28s - 486.32s | by the operating system, those enforced by the compiler, those enforced by a tool kit like 486.32s - 490.92s | exploit guard or malware bytes or whatever you might be using. And if you get to the merged 490.92s - 495.32s | areas in the circles you're taking advantage of multiple categories and that's where things 495.32s - 500.10s | become much more effective. Because depending on the type of exploit you're using or you're 500.10s - 505.46s | writing


chunk_id: 175_chunk_11
chunk_text:
proud of that one and made some pretty bold claims about it. But none of these 453.46s - 459.62s | mitigations by themselves are a one stop shop. They are complementary to one another. If 459.62s - 465.16s | there's one weak link in the chain if one single mitigation is not working properly or if one 465.16s - 471.34s | library is not compiled to participate in a mitigation it breaks the whole thing. So it can 471.34s - 476.28s | be difficult to get all of them there. I usually put up like a Venn diagram that shows 476.30s - 481.28s | overlapping circles where you've got different categories of mitigations like those enforced 481.28s - 486.32s | by the operating system, those enforced by the compiler, those enforced by a tool kit like 486.32s - 490.92s | exploit guard or malware bytes or whatever you might be using. And if you get to the merged 490.92s - 495.32s | areas in the circles you're taking advantage of multiple categories and that's where things 495.32s - 500.10s | become much more effective. Because depending on the type of exploit you're using or you're 500.10s - 505.46s | writing a mitigation might not even matter. For example font protection. Like they 505.48s - 509.56s | introduced font protection because I think it was Dooku or Stuxnet. It was a font based 509.56s - 514.76s | vulnerability. It was a sign extension bug and it affected the Windows kernel and was a 514.76s - 521.86s | brilliant exploit. That font mitigation just says you can't use any fonts unless it's in the 521.86s - 527.04s | system 32 fonts folder. So no third party fonts to come along. But obviously that only 527.04s - 532.64s | targets a very specific thing. So some of these mitigations don't matter when you're exploiting 532.66s - 538.30s | things. So this is not something we're going to walk through. It's a pretty ugly slide but 538.30s - 542.54s | it's something you can take a picture of. All it's showing is that with all of those 542.54s - 548.24s | mitigations and that was not comprehensive by any means. It's a cat and mouse game where 548.24s - 555.04s | you've got a mitigation that comes out due to a bug class or an exploit technique. For 555.04s - 561.22s | example look


chunk_id: 175_chunk_12
chunk_text:
a mitigation might not even matter. For example font protection. Like they 505.48s - 509.56s | introduced font protection because I think it was Dooku or Stuxnet. It was a font based 509.56s - 514.76s | vulnerability. It was a sign extension bug and it affected the Windows kernel and was a 514.76s - 521.86s | brilliant exploit. That font mitigation just says you can't use any fonts unless it's in the 521.86s - 527.04s | system 32 fonts folder. So no third party fonts to come along. But obviously that only 527.04s - 532.64s | targets a very specific thing. So some of these mitigations don't matter when you're exploiting 532.66s - 538.30s | things. So this is not something we're going to walk through. It's a pretty ugly slide but 538.30s - 542.54s | it's something you can take a picture of. All it's showing is that with all of those 542.54s - 548.24s | mitigations and that was not comprehensive by any means. It's a cat and mouse game where 548.24s - 555.04s | you've got a mitigation that comes out due to a bug class or an exploit technique. For 555.04s - 561.22s | example look at arbitrary code guard or export address table filtering. EAF specifically 561.24s - 568.34s | targets shellcode and how it accesses the exports table inside libraries like kernel 32. So 568.34s - 572.88s | they target very specific things and it's that cat and mouse game because when a new exploit 572.88s - 577.88s | technique comes out or a new bug class a mitigation goes in to try to kill it. And then a 577.88s - 582.72s | work around comes out and then they update the mitigation. A perfect example is back in 582.72s - 588.02s | 2014 and I was just hanging out with Corlan Coder like a week ago in Amsterdam at Hackfest 588.02s - 592.90s | that we had out there. And he and I have something very in common with each other. Actually 592.90s - 597.84s | I'll show you in a diagram coming up very soon. It might be the next one. It is the next one. 597.84s - 603.50s | So this is the last version that Microsoft published outwardly that I've seen anyway from 603.50s - 609.82s | Matt Miller and other folks at MSRC. And you notice it only goes


chunk_id: 175_chunk_13
chunk_text:
at arbitrary code guard or export address table filtering. EAF specifically 561.24s - 568.34s | targets shellcode and how it accesses the exports table inside libraries like kernel 32. So 568.34s - 572.88s | they target very specific things and it's that cat and mouse game because when a new exploit 572.88s - 577.88s | technique comes out or a new bug class a mitigation goes in to try to kill it. And then a 577.88s - 582.72s | work around comes out and then they update the mitigation. A perfect example is back in 582.72s - 588.02s | 2014 and I was just hanging out with Corlan Coder like a week ago in Amsterdam at Hackfest 588.02s - 592.90s | that we had out there. And he and I have something very in common with each other. Actually 592.90s - 597.84s | I'll show you in a diagram coming up very soon. It might be the next one. It is the next one. 597.84s - 603.50s | So this is the last version that Microsoft published outwardly that I've seen anyway from 603.50s - 609.82s | Matt Miller and other folks at MSRC. And you notice it only goes up to like 2013 or so or 609.82s - 615.22s | 2015, 16. I can't even see it. But what I want you to look at here is and unfortunately I 615.22s - 619.82s | don't have a laser pointer on this thing. But look at the grey area to the right side and see 619.82s - 626.06s | how it's a very wide gap. And then all of a sudden after that it shrinks down. The reason that 626.06s - 632.60s | happened is because Microsoft in 2014 introduced a couple mitigations that really killed 632.60s - 639.48s | specific types of bug classes in the browser like type confusion, use after free. I brought up 639.48s - 644.82s | Corlan Coder because he and I both were writing quite a few exploits per year against a 644.82s - 650.62s | browser and then all of a sudden in June, July 2014 they stopped working. The exploits 650.62s - 656.00s | stopped working because they put in deferred free, isolated heaps and then MemGC came 656.00s - 660.70s | shortly after. And I remember even seeing people like Skylines who was releasing lots of 660.70s - 666.60s | vulnerabilities


chunk_id: 175_chunk_14
chunk_text:
up to like 2013 or so or 609.82s - 615.22s | 2015, 16. I can't even see it. But what I want you to look at here is and unfortunately I 615.22s - 619.82s | don't have a laser pointer on this thing. But look at the grey area to the right side and see 619.82s - 626.06s | how it's a very wide gap. And then all of a sudden after that it shrinks down. The reason that 626.06s - 632.60s | happened is because Microsoft in 2014 introduced a couple mitigations that really killed 632.60s - 639.48s | specific types of bug classes in the browser like type confusion, use after free. I brought up 639.48s - 644.82s | Corlan Coder because he and I both were writing quite a few exploits per year against a 644.82s - 650.62s | browser and then all of a sudden in June, July 2014 they stopped working. The exploits 650.62s - 656.00s | stopped working because they put in deferred free, isolated heaps and then MemGC came 656.00s - 660.70s | shortly after. And I remember even seeing people like Skylines who was releasing lots of 660.70s - 666.60s | vulnerabilities or selling exploits or disclosing them saying one time in a tweet, hey does 666.60s - 671.50s | anybody have a MemGC bypass? I'm literally sitting on a bunch of edge vulnerabilities that I 671.52s - 677.40s | can't exploit. So that's the job of the OS developers who work with mitigations is to 677.40s - 683.84s | identify and understand a specific exploit technique or bug class and try to kill it. 683.84s - 689.68s | Deferred free is or MemGC I should say is so effective because it does validation of 689.68s - 694.92s | references. Microsoft used C++ smart pointers to do dynamic tracking of objects and 694.92s - 699.72s | reference tracking and the way in which they chose to track references allowed for a certain 699.74s - 705.18s | type of exploit to be quite possible. So by adding the MemGC control in deferred free, 705.18s - 709.32s | there's validation going on to make sure that there are other, there are no other references 709.32s - 713.82s | to the object that's about to get freed before giving it back to garbage collector for reuse 713.82s - 719.50s | to get recycled. And that's


chunk_id: 175_chunk_15
chunk_text:
or selling exploits or disclosing them saying one time in a tweet, hey does 666.60s - 671.50s | anybody have a MemGC bypass? I'm literally sitting on a bunch of edge vulnerabilities that I 671.52s - 677.40s | can't exploit. So that's the job of the OS developers who work with mitigations is to 677.40s - 683.84s | identify and understand a specific exploit technique or bug class and try to kill it. 683.84s - 689.68s | Deferred free is or MemGC I should say is so effective because it does validation of 689.68s - 694.92s | references. Microsoft used C++ smart pointers to do dynamic tracking of objects and 694.92s - 699.72s | reference tracking and the way in which they chose to track references allowed for a certain 699.74s - 705.18s | type of exploit to be quite possible. So by adding the MemGC control in deferred free, 705.18s - 709.32s | there's validation going on to make sure that there are other, there are no other references 709.32s - 713.82s | to the object that's about to get freed before giving it back to garbage collector for reuse 713.82s - 719.50s | to get recycled. And that's why it shrinks down so much. So Microsoft is very kind as I 719.50s - 724.34s | said before in getting me this diagram and the next one. This one is remote code 724.36s - 730.66s | execution CVEs by patch year. So you have to imagine that the majority of CVEs that come out 730.66s - 735.04s | are privately disclosed. Meaning that there is no public exploit code. And that's why 735.04s - 740.54s | there's a lot of exploit framework vendors out there like Rapid 7 with Metasploit and 740.54s - 746.48s | Core Impact and Immunity Canvas and Saint. There's all these different frameworks and what 746.48s - 753.48s | they want to be able to say is we have the most exploits for privately disclosed CVEs. 753.50s - 758.06s | Because if you're a red team or some other offensive group and you want to be able to break 758.06s - 765.06s | in obviously the targets, most companies are terrible about patching. So if we can get 765.06s - 770.60s | some really smart people to do things like patch diffing, identify the delta in the code 770.60s - 775.34s | and weaponize these


chunk_id: 175_chunk_16
chunk_text:
why it shrinks down so much. So Microsoft is very kind as I 719.50s - 724.34s | said before in getting me this diagram and the next one. This one is remote code 724.36s - 730.66s | execution CVEs by patch year. So you have to imagine that the majority of CVEs that come out 730.66s - 735.04s | are privately disclosed. Meaning that there is no public exploit code. And that's why 735.04s - 740.54s | there's a lot of exploit framework vendors out there like Rapid 7 with Metasploit and 740.54s - 746.48s | Core Impact and Immunity Canvas and Saint. There's all these different frameworks and what 746.48s - 753.48s | they want to be able to say is we have the most exploits for privately disclosed CVEs. 753.50s - 758.06s | Because if you're a red team or some other offensive group and you want to be able to break 758.06s - 765.06s | in obviously the targets, most companies are terrible about patching. So if we can get 765.06s - 770.60s | some really smart people to do things like patch diffing, identify the delta in the code 770.60s - 775.34s | and weaponize these end day vulnerabilities, then we're going to have a much more valuable 775.34s - 780.02s | framework because we're able to allow you to exploit things that no one else can. I would 780.02s - 785.80s | say close to like 90 percent of CVEs are privately disclosed. No public exploit code. So 785.80s - 791.44s | that is absolutely a profitable business to go and write or weaponize end day 791.44s - 795.54s | vulnerabilities. Because again organizations are terrible about patching. But you can see 795.54s - 799.24s | we're not going to walk through all the data. I'm going to tweet this afterward and the slides 799.24s - 803.52s | obviously will come out. But this is great stuff to use internally with your teams and your 803.52s - 808.52s | threat intel folks and SOC and everyone else to say hey these are some things we should be 808.52s - 813.06s | considering. Uh how effective are the mitigations? What bug classes are the most popular right 813.06s - 819.26s | now? And this specifically is for RCE and you can see the number in the middle. The uh next 819.26s - 825.80s | one here


chunk_id: 175_chunk_17
chunk_text:
end day vulnerabilities, then we're going to have a much more valuable 775.34s - 780.02s | framework because we're able to allow you to exploit things that no one else can. I would 780.02s - 785.80s | say close to like 90 percent of CVEs are privately disclosed. No public exploit code. So 785.80s - 791.44s | that is absolutely a profitable business to go and write or weaponize end day 791.44s - 795.54s | vulnerabilities. Because again organizations are terrible about patching. But you can see 795.54s - 799.24s | we're not going to walk through all the data. I'm going to tweet this afterward and the slides 799.24s - 803.52s | obviously will come out. But this is great stuff to use internally with your teams and your 803.52s - 808.52s | threat intel folks and SOC and everyone else to say hey these are some things we should be 808.52s - 813.06s | considering. Uh how effective are the mitigations? What bug classes are the most popular right 813.06s - 819.26s | now? And this specifically is for RCE and you can see the number in the middle. The uh next 819.26s - 825.80s | one here is overall CVEs by patch here. So this is not just memory safety or if you go back to 825.80s - 830.88s | that initial slide that I had up, that was all memory corruption for the most part. All of it. 830.88s - 836.84s | And I remember some patch Tuesdays there'd be like 50 patch, 50 patches coming out for 836.84s - 841.54s | Internet Explorer and Edge alone. It was a serious problem and they had to solve it with 841.54s - 846.28s | these mitigations and did a quite an effective job. But this shows you no memory corruption. 846.28s - 849.92s | If you look at the left, that's the big green one in the middle. And if you look to the left 849.92s - 855.28s | it's getting less and less and sometimes it gets bigger and smaller. But that is happening 855.28s - 860.06s | because obviously secured code initiatives, introducing rust into the kernel to protect 860.06s - 864.36s | critical components, the mitigations being very effective. That is what changes the 864.38s - 869.26s | trajectory here. And you can see things like deserialization and other types of bugs start to


chunk_id: 175_chunk_18
chunk_text:
is overall CVEs by patch here. So this is not just memory safety or if you go back to 825.80s - 830.88s | that initial slide that I had up, that was all memory corruption for the most part. All of it. 830.88s - 836.84s | And I remember some patch Tuesdays there'd be like 50 patch, 50 patches coming out for 836.84s - 841.54s | Internet Explorer and Edge alone. It was a serious problem and they had to solve it with 841.54s - 846.28s | these mitigations and did a quite an effective job. But this shows you no memory corruption. 846.28s - 849.92s | If you look at the left, that's the big green one in the middle. And if you look to the left 849.92s - 855.28s | it's getting less and less and sometimes it gets bigger and smaller. But that is happening 855.28s - 860.06s | because obviously secured code initiatives, introducing rust into the kernel to protect 860.06s - 864.36s | critical components, the mitigations being very effective. That is what changes the 864.38s - 869.26s | trajectory here. And you can see things like deserialization and other types of bugs start to 869.26s - 873.26s | pop up and get more popular. Again, cat and mouse game and we're always trying to find new 873.26s - 878.44s | ways of getting in. So how mitigations have affected payouts. I'll quickly go through this 878.44s - 882.40s | one because again I want to make sure I have enough time. But and if you want more 882.40s - 886.48s | information on this, if you go to the Off By One security channel on YouTube, look at last 886.48s - 892.02s | week's stream. I spent like 2 hours almost talking specifically about this process. But 892.04s - 895.62s | quickly going through, there are different categories of buyers. You can always go to the 895.62s - 901.42s | vendor themselves, like Microsoft, Google, Apple and they will pay you. Some companies have 901.42s - 906.12s | bounties, some don't. But they typically don't pay as much as third party buyers out there 906.12s - 910.40s | depending where they sit on the realm of ethical boundaries. But they'll pay you and it's 910.40s - 915.14s | gotten better. Then you go a little bit further. Okay, we can go to ZDI, the


chunk_id: 175_chunk_19
chunk_text:
869.26s - 873.26s | pop up and get more popular. Again, cat and mouse game and we're always trying to find new 873.26s - 878.44s | ways of getting in. So how mitigations have affected payouts. I'll quickly go through this 878.44s - 882.40s | one because again I want to make sure I have enough time. But and if you want more 882.40s - 886.48s | information on this, if you go to the Off By One security channel on YouTube, look at last 886.48s - 892.02s | week's stream. I spent like 2 hours almost talking specifically about this process. But 892.04s - 895.62s | quickly going through, there are different categories of buyers. You can always go to the 895.62s - 901.42s | vendor themselves, like Microsoft, Google, Apple and they will pay you. Some companies have 901.42s - 906.12s | bounties, some don't. But they typically don't pay as much as third party buyers out there 906.12s - 910.40s | depending where they sit on the realm of ethical boundaries. But they'll pay you and it's 910.40s - 915.14s | gotten better. Then you go a little bit further. Okay, we can go to ZDI, the Zero Day 915.14s - 919.80s | Initiative or go out to CanSec West and participate in Pwn2Own or you know Bug Crowd, 919.82s - 924.36s | HackerOne, iDefense which I don't think are buying exploits anymore. But those are third 924.36s - 928.80s | parties who do work with the vendor and they get it patched. The exploit code never goes 928.80s - 934.56s | public. When you sell an exploit, it's no longer your exploit. Typically they don't pay you. 934.56s - 938.88s | The money gets put into an escrow and you have to wait to get paid because they want to make 938.88s - 942.64s | sure you're not trying to double dip and sell it to multiple buyers out there until you 942.64s - 946.48s | build up a good trust. So we go out further and I'm not going to name any names because they 946.50s - 951.10s | get mad. But there are all kinds of different third party buyers on behalf of different 951.10s - 956.78s | intelligence agencies and governments around the world. Believe me, I've sat with them many 956.78s - 961.08s | times and they are looking for bugs from


chunk_id: 175_chunk_20
chunk_text:
Zero Day 915.14s - 919.80s | Initiative or go out to CanSec West and participate in Pwn2Own or you know Bug Crowd, 919.82s - 924.36s | HackerOne, iDefense which I don't think are buying exploits anymore. But those are third 924.36s - 928.80s | parties who do work with the vendor and they get it patched. The exploit code never goes 928.80s - 934.56s | public. When you sell an exploit, it's no longer your exploit. Typically they don't pay you. 934.56s - 938.88s | The money gets put into an escrow and you have to wait to get paid because they want to make 938.88s - 942.64s | sure you're not trying to double dip and sell it to multiple buyers out there until you 942.64s - 946.48s | build up a good trust. So we go out further and I'm not going to name any names because they 946.50s - 951.10s | get mad. But there are all kinds of different third party buyers on behalf of different 951.10s - 956.78s | intelligence agencies and governments around the world. Believe me, I've sat with them many 956.78s - 961.08s | times and they are looking for bugs from you. Now you typically don't go knock on the front 961.08s - 965.82s | door of the NSA, I don't advise that. But there are third parties out there and they will pay 965.82s - 971.22s | more than the below ones that we just talked about. How much? We'll talk about some money 971.30s - 977.44s | here in a moment. You go further than that, there are these third party companies that are 977.44s - 982.24s | exploit acquisition companies. They refer to themselves as crowd fences, a relatively new 982.24s - 985.72s | one. You heard of Zerodium? I don't think they're buying anymore. They used to be Voopin. 985.72s - 991.92s | And there's Volnpoint. I don't know anything about Volnpoint but there's some hefty amounts 991.92s - 997.46s | of money that you can make there. Millions. I think up to 9 million US dollars for an iOS 997.50s - 1003.78s | bug. I mean full chain, obviously. It's got to be all the things. And then you've got kind of 1003.78s - 1009.54s | the most unethical place you can go, which are random people. This is where you've got to be 1009.54s -


chunk_id: 175_chunk_21
chunk_text:
you. Now you typically don't go knock on the front 961.08s - 965.82s | door of the NSA, I don't advise that. But there are third parties out there and they will pay 965.82s - 971.22s | more than the below ones that we just talked about. How much? We'll talk about some money 971.30s - 977.44s | here in a moment. You go further than that, there are these third party companies that are 977.44s - 982.24s | exploit acquisition companies. They refer to themselves as crowd fences, a relatively new 982.24s - 985.72s | one. You heard of Zerodium? I don't think they're buying anymore. They used to be Voopin. 985.72s - 991.92s | And there's Volnpoint. I don't know anything about Volnpoint but there's some hefty amounts 991.92s - 997.46s | of money that you can make there. Millions. I think up to 9 million US dollars for an iOS 997.50s - 1003.78s | bug. I mean full chain, obviously. It's got to be all the things. And then you've got kind of 1003.78s - 1009.54s | the most unethical place you can go, which are random people. This is where you've got to be 1009.54s - 1012.52s | really careful because you don't know who you're selling to and you don't know who they're 1012.52s - 1017.72s | selling it to. You don't know who the buyer is. But this could be over Tor, Telegram, people. 1017.72s - 1022.96s | If you start getting known for selling exploits or having the skills to find zero days and 1022.96s - 1028.30s | weaponize them, especially in today's climate with how hard it is, they will find you. But 1028.30s - 1031.90s | you've got to be really careful when you're selling this stuff to protect you and your family 1031.90s - 1036.44s | and other things. I really again recommend watching that stream if you're interested in that 1036.44s - 1042.48s | space because I go into some good detail about that. So examples of how much you get paid for 1042.48s - 1048.28s | some of this stuff. Now this example is one from me personally. I've always sold things. I 1048.28s - 1052.66s | don't sell to unethical buyers though. Personally that's my choice. Yes you get paid less but 1052.66s - 1057.66s | that's you know, your choice. So someone like iDefense or uh


chunk_id: 175_chunk_22
chunk_text:
1012.52s | really careful because you don't know who you're selling to and you don't know who they're 1012.52s - 1017.72s | selling it to. You don't know who the buyer is. But this could be over Tor, Telegram, people. 1017.72s - 1022.96s | If you start getting known for selling exploits or having the skills to find zero days and 1022.96s - 1028.30s | weaponize them, especially in today's climate with how hard it is, they will find you. But 1028.30s - 1031.90s | you've got to be really careful when you're selling this stuff to protect you and your family 1031.90s - 1036.44s | and other things. I really again recommend watching that stream if you're interested in that 1036.44s - 1042.48s | space because I go into some good detail about that. So examples of how much you get paid for 1042.48s - 1048.28s | some of this stuff. Now this example is one from me personally. I've always sold things. I 1048.28s - 1052.66s | don't sell to unethical buyers though. Personally that's my choice. Yes you get paid less but 1052.66s - 1057.66s | that's you know, your choice. So someone like iDefense or uh ZDI back in 2014 before those 1060.30s - 1065.16s | mitigations I told you about dropped, you could expect to get 10 to 30 thousand US dollars for 1065.16s - 1071.38s | like a USAPTA free exploit. And back then you typically didn't need a big chain. Maybe one 1071.38s - 1076.48s | exploit or two, like an information disclosure bug to bypass ASLR if you needed it. But if 1076.48s - 1082.18s | anyone remembers and I'm sure some of you do, JRE6, the Java Runtime Environment 6, MSV CR 1082.70s - 1089.38s | 71.dll. That made me a lot of money because they didn't add dynamic rebasing to that module and 1089.38s - 1093.64s | it also had all the gadgets you need to get around data execution prevention. So it's a 1093.64s - 1100.52s | beautiful thing. So if you found one remote code execution uh USAPTA free against a browser 1100.52s - 1105.86s | that's all you needed. There was no sandboxing on Internet Explorer Edge back then. And so you 1105.86s - 1111.74s | could expect to get paid that amount but now it's a lot harder. On the more unethical side of 1111.76s -


chunk_id: 175_chunk_23
chunk_text:
ZDI back in 2014 before those 1060.30s - 1065.16s | mitigations I told you about dropped, you could expect to get 10 to 30 thousand US dollars for 1065.16s - 1071.38s | like a USAPTA free exploit. And back then you typically didn't need a big chain. Maybe one 1071.38s - 1076.48s | exploit or two, like an information disclosure bug to bypass ASLR if you needed it. But if 1076.48s - 1082.18s | anyone remembers and I'm sure some of you do, JRE6, the Java Runtime Environment 6, MSV CR 1082.70s - 1089.38s | 71.dll. That made me a lot of money because they didn't add dynamic rebasing to that module and 1089.38s - 1093.64s | it also had all the gadgets you need to get around data execution prevention. So it's a 1093.64s - 1100.52s | beautiful thing. So if you found one remote code execution uh USAPTA free against a browser 1100.52s - 1105.86s | that's all you needed. There was no sandboxing on Internet Explorer Edge back then. And so you 1105.86s - 1111.74s | could expect to get paid that amount but now it's a lot harder. On the more unethical side of 1111.76s - 1118.54s | it, you can expect to get paid 10 to 20 times more. So you can see an example there from 1118.54s - 1123.48s | CrowdFence. They say offering up to 400,000. That's straight from the website. Another 1123.48s - 1130.54s | example is IOS. Zero click. Apple created something called Blastor to try to triage text 1130.54s - 1135.52s | messages coming in to make sure code execution isn't occurring. Like it's gonna be a lot 1135.52s - 1141.42s | harder to jailbreak or root that phone because of Blastor. So you gotta have like 4 to 6 1141.44s - 1146.50s | zero days chained together at least. And it's not one person out there doing this anymore. 1146.50s - 1152.32s | Back in 2014 you and yourself could find enough to get around all the things and get code 1152.32s - 1157.28s | execution. But nowadays especially like in the kernel with HVCI and other cutting edge 1157.28s - 1161.72s | mitigations you could say. It's hard. The execute primitive is gone. You get read write 1161.72s - 1165.16s | opportunities but even that can be challenging with code signing and all kinds of other 1165.16s -


chunk_id: 175_chunk_24
chunk_text:
1118.54s | it, you can expect to get paid 10 to 20 times more. So you can see an example there from 1118.54s - 1123.48s | CrowdFence. They say offering up to 400,000. That's straight from the website. Another 1123.48s - 1130.54s | example is IOS. Zero click. Apple created something called Blastor to try to triage text 1130.54s - 1135.52s | messages coming in to make sure code execution isn't occurring. Like it's gonna be a lot 1135.52s - 1141.42s | harder to jailbreak or root that phone because of Blastor. So you gotta have like 4 to 6 1141.44s - 1146.50s | zero days chained together at least. And it's not one person out there doing this anymore. 1146.50s - 1152.32s | Back in 2014 you and yourself could find enough to get around all the things and get code 1152.32s - 1157.28s | execution. But nowadays especially like in the kernel with HVCI and other cutting edge 1157.28s - 1161.72s | mitigations you could say. It's hard. The execute primitive is gone. You get read write 1161.72s - 1165.16s | opportunities but even that can be challenging with code signing and all kinds of other 1165.16s - 1170.70s | things. But that is why the price tag goes up so much. So you can see 2014 I remember 1170.74s - 1175.68s | Zerodium was offering up to 2 million, 2.5 million for IOS and Android full chain zero 1175.68s - 1182.36s | clicks. Now you can get up to 9 million with VulnPoint and CrowdFence I think I saw. And 1182.36s - 1186.86s | then this example here if you've ever seen Operation Zero it literally says on the Twitter 1186.86s - 1192.50s | page on their home page the only Russian backed exploit acquisition program. And it 1192.50s - 1197.50s | literally says we are non-NATO friendly. But 20 million US dollars you could retire. That's 1197.64s - 1203.54s | amazing. But look who you're selling. You are literally doing treason at that point. I'll 1203.54s - 1207.92s | stop saying literally. And they will use that to attack your country. So I don't know if you 1207.92s - 1213.22s | want to be in that position but it's an option for you. So we'll jump now into machine 1213.22s - 1219.66s | learning for vulnerability research. This one is one that I have a lot


chunk_id: 175_chunk_25
chunk_text:
1170.70s | things. But that is why the price tag goes up so much. So you can see 2014 I remember 1170.74s - 1175.68s | Zerodium was offering up to 2 million, 2.5 million for IOS and Android full chain zero 1175.68s - 1182.36s | clicks. Now you can get up to 9 million with VulnPoint and CrowdFence I think I saw. And 1182.36s - 1186.86s | then this example here if you've ever seen Operation Zero it literally says on the Twitter 1186.86s - 1192.50s | page on their home page the only Russian backed exploit acquisition program. And it 1192.50s - 1197.50s | literally says we are non-NATO friendly. But 20 million US dollars you could retire. That's 1197.64s - 1203.54s | amazing. But look who you're selling. You are literally doing treason at that point. I'll 1203.54s - 1207.92s | stop saying literally. And they will use that to attack your country. So I don't know if you 1207.92s - 1213.22s | want to be in that position but it's an option for you. So we'll jump now into machine 1213.22s - 1219.66s | learning for vulnerability research. This one is one that I have a lot of interest in 1219.66s - 1224.66s | because it saves you time. You already know but automation and machine learning or 1227.64s - 1233.04s | the umbrella of AI in general are things that aren't going away. And we don't want to 1233.04s - 1237.62s | fight it. We want to leverage it and use it to complement our skills. If you fight it you 1237.62s - 1242.62s | will lose. When ChatGPT was made public I think it was November, December 2022 shortly 1246.86s - 1252.46s | after that spring I believe Project Zero started an initiative of course to go and see 1252.46s - 1258.36s | how AI in general, machine learning, can help with vulnerability research. Specifically 1258.36s - 1265.04s | for memory corruption bugs. If you remember a long time ago DARPA back in like 2016 they 1265.04s - 1270.04s | had a a challenge. And they paid I think 2 or 3 million US dollars to the winning team. And 1272.32s - 1278.56s | the challenge was we want you to write basically machine wars. Automated hacking, 1278.56s - 1282.42s | automated detection and defense. Where the machines are fighting each other. Almost 1282.42s -


chunk_id: 175_chunk_26
chunk_text:
of interest in 1219.66s - 1224.66s | because it saves you time. You already know but automation and machine learning or 1227.64s - 1233.04s | the umbrella of AI in general are things that aren't going away. And we don't want to 1233.04s - 1237.62s | fight it. We want to leverage it and use it to complement our skills. If you fight it you 1237.62s - 1242.62s | will lose. When ChatGPT was made public I think it was November, December 2022 shortly 1246.86s - 1252.46s | after that spring I believe Project Zero started an initiative of course to go and see 1252.46s - 1258.36s | how AI in general, machine learning, can help with vulnerability research. Specifically 1258.36s - 1265.04s | for memory corruption bugs. If you remember a long time ago DARPA back in like 2016 they 1265.04s - 1270.04s | had a a challenge. And they paid I think 2 or 3 million US dollars to the winning team. And 1272.32s - 1278.56s | the challenge was we want you to write basically machine wars. Automated hacking, 1278.56s - 1282.42s | automated detection and defense. Where the machines are fighting each other. Almost 1282.42s - 1286.70s | like a capture the flag. And back then there was a lot of universities looking into very 1286.70s - 1291.44s | basic exploitation techniques like stack overflows. That's a pretty easy thing to 1291.44s - 1295.90s | weaponize. Okay the buffer is overrun and you overwrite a return point like that's very 1295.90s - 1302.14s | basic. So it's not so hard to write something that will do that for you automatically. But 1302.14s - 1307.98s | when you're getting into harder bug classes, I gave a couple examples like type confusion. 1308.00s - 1313.24s | Those are difficult to find. Static analysis, dynamic analysis, manual code inspection, it 1313.24s - 1318.68s | doesn't matter. Those are tough to find. Because as a developer you can't possibly get your 1318.68s - 1324.76s | code into the context for every possible situation where it might be run. Different 1324.76s - 1328.72s | libraries, different patch levels, different things people do to their computers. A 1328.72s - 1333.60s | developer can't anticipate what that code might run into in the future. So these 1333.62s - 1339.22s | vulnerabilities manifest thanks to things like C++. A lot of people ask well


chunk_id: 175_chunk_27
chunk_text:
1286.70s | like a capture the flag. And back then there was a lot of universities looking into very 1286.70s - 1291.44s | basic exploitation techniques like stack overflows. That's a pretty easy thing to 1291.44s - 1295.90s | weaponize. Okay the buffer is overrun and you overwrite a return point like that's very 1295.90s - 1302.14s | basic. So it's not so hard to write something that will do that for you automatically. But 1302.14s - 1307.98s | when you're getting into harder bug classes, I gave a couple examples like type confusion. 1308.00s - 1313.24s | Those are difficult to find. Static analysis, dynamic analysis, manual code inspection, it 1313.24s - 1318.68s | doesn't matter. Those are tough to find. Because as a developer you can't possibly get your 1318.68s - 1324.76s | code into the context for every possible situation where it might be run. Different 1324.76s - 1328.72s | libraries, different patch levels, different things people do to their computers. A 1328.72s - 1333.60s | developer can't anticipate what that code might run into in the future. So these 1333.62s - 1339.22s | vulnerabilities manifest thanks to things like C++. A lot of people ask well why aren't we 1339.22s - 1344.70s | already on Rust? Why isn't the Windows kernel rewritten entirely in Rust? I can't answer 1344.70s - 1349.70s | that 100% but I can give my opinion which is wow. Theirs is louder than mine, it's amazing. 1352.64s - 1357.64s | Alright I'll, okay. Cutting me off. So Rust, remember when HD more and the Metasploit team 1358.02s - 1363.02s | they were on Perl early on. Metasploit came out in 2003. And at one point they said we need to 1368.16s - 1372.60s | get off Perl because the language wasn't growing at the same pace that they needed it to. And 1372.60s - 1378.44s | so they were going to choose between Python and what's the other one? Ruby right? And they 1378.44s - 1383.48s | chose Ruby. And I remember talking to HD more at Defcon a long time ago and I believe it was 1383.48s - 1388.16s | the Ruby developers were willing to work with that project because it became the largest 1388.16s - 1393.66s | open source Ruby project to improve the language to meet the needs of the developers. So the 1393.66s - 1398.40s | language


chunk_id: 175_chunk_28
chunk_text:
why aren't we 1339.22s - 1344.70s | already on Rust? Why isn't the Windows kernel rewritten entirely in Rust? I can't answer 1344.70s - 1349.70s | that 100% but I can give my opinion which is wow. Theirs is louder than mine, it's amazing. 1352.64s - 1357.64s | Alright I'll, okay. Cutting me off. So Rust, remember when HD more and the Metasploit team 1358.02s - 1363.02s | they were on Perl early on. Metasploit came out in 2003. And at one point they said we need to 1368.16s - 1372.60s | get off Perl because the language wasn't growing at the same pace that they needed it to. And 1372.60s - 1378.44s | so they were going to choose between Python and what's the other one? Ruby right? And they 1378.44s - 1383.48s | chose Ruby. And I remember talking to HD more at Defcon a long time ago and I believe it was 1383.48s - 1388.16s | the Ruby developers were willing to work with that project because it became the largest 1388.16s - 1393.66s | open source Ruby project to improve the language to meet the needs of the developers. So the 1393.66s - 1398.40s | language developers working with the developers of the framework. I imagine it's a similar 1398.40s - 1405.10s | thing where C++ has been around for a long time. It's very mature, it's very powerful. So a 1405.10s - 1409.72s | couple things you get from that. You've got developers with decades of experience who can't 1409.72s - 1414.20s | just overnight over to Rust. And you've got limitations in the language that might not allow 1414.20s - 1420.60s | it to do the things that C++ can do. And yes, Rust is mimicking like low level behavior with 1420.60s - 1426.20s | the speed and the power of being able to directly manipulate processor registers and memory but 1426.20s - 1432.28s | unsafe languages tend to be extremely powerful. So it's, those memory corruption bugs they're 1432.28s - 1435.78s | just, they're difficult to squash. And it's not going to be overnight where we replace 1435.78s - 1439.16s | everything. But it is slowly happening. I believe the first thing you saw in the Windows 1439.16s - 1444.60s | kernel was when 32k.sys driver, some implementation of that got put over to Rust. So 1444.60s - 1448.06s | anyway, from a


chunk_id: 175_chunk_29
chunk_text:
developers working with the developers of the framework. I imagine it's a similar 1398.40s - 1405.10s | thing where C++ has been around for a long time. It's very mature, it's very powerful. So a 1405.10s - 1409.72s | couple things you get from that. You've got developers with decades of experience who can't 1409.72s - 1414.20s | just overnight over to Rust. And you've got limitations in the language that might not allow 1414.20s - 1420.60s | it to do the things that C++ can do. And yes, Rust is mimicking like low level behavior with 1420.60s - 1426.20s | the speed and the power of being able to directly manipulate processor registers and memory but 1426.20s - 1432.28s | unsafe languages tend to be extremely powerful. So it's, those memory corruption bugs they're 1432.28s - 1435.78s | just, they're difficult to squash. And it's not going to be overnight where we replace 1435.78s - 1439.16s | everything. But it is slowly happening. I believe the first thing you saw in the Windows 1439.16s - 1444.60s | kernel was when 32k.sys driver, some implementation of that got put over to Rust. So 1444.60s - 1448.06s | anyway, from a high level, because I can't really go into what Google's doing at nap time, I 1448.06s - 1451.78s | read the paper, that's what they called it was project nap time. And I had been working on a 1451.78s - 1455.88s | similar thing but as a single person so they've got a team of people. I've also talked to 1455.88s - 1460.82s | multiple other teams out there who are doing the same thing. And that is how do we create 1460.82s - 1466.58s | agents, different agents that serve different roles. They do different things. Because just 1466.58s - 1472.18s | like humans, if you try to give AI in general, and again that's an umbrella encompassing 1472.18s - 1478.86s | term, for everything underneath it. If you ask a single agent or LLM to do everything for you 1478.86s - 1483.46s | it's, it's not going to do a great job. But if you break it down, just like humans, don't ask 1483.46s - 1488.70s | one developer to go rewrite Microsoft Office suite. That's too much. Break it down into 1488.70s - 1493.54s | different groups, different agents and roles, it's going to be a lot


chunk_id: 175_chunk_30
chunk_text:
high level, because I can't really go into what Google's doing at nap time, I 1448.06s - 1451.78s | read the paper, that's what they called it was project nap time. And I had been working on a 1451.78s - 1455.88s | similar thing but as a single person so they've got a team of people. I've also talked to 1455.88s - 1460.82s | multiple other teams out there who are doing the same thing. And that is how do we create 1460.82s - 1466.58s | agents, different agents that serve different roles. They do different things. Because just 1466.58s - 1472.18s | like humans, if you try to give AI in general, and again that's an umbrella encompassing 1472.18s - 1478.86s | term, for everything underneath it. If you ask a single agent or LLM to do everything for you 1478.86s - 1483.46s | it's, it's not going to do a great job. But if you break it down, just like humans, don't ask 1483.46s - 1488.70s | one developer to go rewrite Microsoft Office suite. That's too much. Break it down into 1488.70s - 1493.54s | different groups, different agents and roles, it's going to be a lot more possible. And the 1493.56s - 1498.10s | gist of that, they did make some really impressive progress and they're going to continue 1498.10s - 1503.18s | working on it of course. But said, as it quotes on the slide, there's still a long way to go. 1503.18s - 1507.88s | We're not going to be replaced anytime soon because there's so much nuance that it can't 1507.88s - 1513.88s | have, like humans can have the way we think. It'll get better of course. But going into that 1513.88s - 1518.40s | a little bit more, this is an example of something called crew AI, if you've heard of that. 1518.40s - 1523.40s | There's multiple frameworks out there for such, open source. And it has this concept of the 1523.42s - 1527.46s | agents and these roles that things serve. So you can see on the right, we're saying we want you 1527.46s - 1532.80s | to be a threat intelligence analyst. This is what your job is. And you feed it information, it 1532.80s - 1538.90s | uses RAG and other cool technology to ingest all kinds of threat intel data and other. And 1538.90s - 1544.78s


chunk_id: 175_chunk_31
chunk_text:
more possible. And the 1493.56s - 1498.10s | gist of that, they did make some really impressive progress and they're going to continue 1498.10s - 1503.18s | working on it of course. But said, as it quotes on the slide, there's still a long way to go. 1503.18s - 1507.88s | We're not going to be replaced anytime soon because there's so much nuance that it can't 1507.88s - 1513.88s | have, like humans can have the way we think. It'll get better of course. But going into that 1513.88s - 1518.40s | a little bit more, this is an example of something called crew AI, if you've heard of that. 1518.40s - 1523.40s | There's multiple frameworks out there for such, open source. And it has this concept of the 1523.42s - 1527.46s | agents and these roles that things serve. So you can see on the right, we're saying we want you 1527.46s - 1532.80s | to be a threat intelligence analyst. This is what your job is. And you feed it information, it 1532.80s - 1538.90s | uses RAG and other cool technology to ingest all kinds of threat intel data and other. And 1538.90s - 1544.78s | then it does a thing. And to put that in like a, a chain, you've got over on the left, like an 1544.78s - 1550.68s | agent that is the threat intel agent. And it's ingesting things like PDF documents and just 1550.70s - 1556.04s | threat intel data. Everything it can get its hands on. And then the result of that, the output, 1556.04s - 1560.98s | like the list of MITRE ATT&CK TTPs as an example, because everyone knows that one, gets fed 1560.98s - 1565.88s | into two other agents. One's the red team side and one's the blue team side. One's doing 1565.88s - 1572.52s | detection engineering and generating Sigma or some kind of other rules out there. And the red 1572.52s - 1576.86s | team side is using it for continuous automated red teaming and patent testing. So they're 1576.88s - 1581.18s | consuming and ingesting the same data, using it for different purposes. A lot of companies are 1581.18s - 1585.48s | getting into this now. A lot of managed socks out there are doing exactly that. Here's your 1585.48s - 1590.90s | Yara rules, here's your Sigma rules, whatever from it.


chunk_id: 175_chunk_32
chunk_text:
| then it does a thing. And to put that in like a, a chain, you've got over on the left, like an 1544.78s - 1550.68s | agent that is the threat intel agent. And it's ingesting things like PDF documents and just 1550.70s - 1556.04s | threat intel data. Everything it can get its hands on. And then the result of that, the output, 1556.04s - 1560.98s | like the list of MITRE ATT&CK TTPs as an example, because everyone knows that one, gets fed 1560.98s - 1565.88s | into two other agents. One's the red team side and one's the blue team side. One's doing 1565.88s - 1572.52s | detection engineering and generating Sigma or some kind of other rules out there. And the red 1572.52s - 1576.86s | team side is using it for continuous automated red teaming and patent testing. So they're 1576.88s - 1581.18s | consuming and ingesting the same data, using it for different purposes. A lot of companies are 1581.18s - 1585.48s | getting into this now. A lot of managed socks out there are doing exactly that. Here's your 1585.48s - 1590.90s | Yara rules, here's your Sigma rules, whatever from it. This is a pretty ugly slide but it's one 1590.90s - 1595.06s | that I put together because this is what I'm working on personally and I have been for some 1595.06s - 1601.44s | time now. I, I am not anywhere close to where I want to be and if Google's not getting the, the 1601.46s - 1605.46s | best results in the world, like meaning it can replace humans with VR or the other way around, 1605.46s - 1610.26s | um, then I'm certainly not going to be able to do it alone. But I have made some good progress 1610.26s - 1616.54s | which is I feed into an LLM all the different CVEs, all the project zero or other public 1616.54s - 1621.54s | research out there, all GitHub, at pastebin, anything I can feed it around exploits and patch 1624.04s - 1630.28s | diffing, binary diffing and all that, all that data. So one thing I do a lot is end day 1630.28s - 1635.36s | vulnerability weaponization. I download on patch Tuesday unless I don't have time. You get 1635.36s - 1638.82s | used to looking at this stuff. You look at all the


chunk_id: 175_chunk_33
chunk_text:
This is a pretty ugly slide but it's one 1590.90s - 1595.06s | that I put together because this is what I'm working on personally and I have been for some 1595.06s - 1601.44s | time now. I, I am not anywhere close to where I want to be and if Google's not getting the, the 1601.46s - 1605.46s | best results in the world, like meaning it can replace humans with VR or the other way around, 1605.46s - 1610.26s | um, then I'm certainly not going to be able to do it alone. But I have made some good progress 1610.26s - 1616.54s | which is I feed into an LLM all the different CVEs, all the project zero or other public 1616.54s - 1621.54s | research out there, all GitHub, at pastebin, anything I can feed it around exploits and patch 1624.04s - 1630.28s | diffing, binary diffing and all that, all that data. So one thing I do a lot is end day 1630.28s - 1635.36s | vulnerability weaponization. I download on patch Tuesday unless I don't have time. You get 1635.36s - 1638.82s | used to looking at this stuff. You look at all the CVEs, you look at the knowledge base 1638.82s - 1643.94s | articles, you try to figure out which ones are most likely exploitable. And you're probably 1643.94s - 1647.24s | still wrong and you learn a lot so you got to keep telling yourself because it's very 1647.24s - 1651.24s | frustrating when you spend two weeks looking at a patch vulnerability that you realize you 1651.24s - 1656.38s | cannot weaponize because of mitigations or some other factors. Because even if a 1656.38s - 1661.98s | mitigation can 100 percent stop a vulnerability from being exploitable, they're still 1661.98s - 1666.90s | going to patch it. Because what if somebody turns a mitigation off? Or it's just, you know, 1666.90s - 1671.90s | it's good, it's good habit to, to clean that stuff up. So when you do a patch diff and you look 1674.26s - 1680.08s | at the delta of the code, use something like diaphora or bin diff and you take a look at the 1680.08s - 1686.34s | changes at the function or the code level, you can give that information to the LLM and 1686.34s - 1691.52s | teach it how and why it's


chunk_id: 175_chunk_34
chunk_text:
CVEs, you look at the knowledge base 1638.82s - 1643.94s | articles, you try to figure out which ones are most likely exploitable. And you're probably 1643.94s - 1647.24s | still wrong and you learn a lot so you got to keep telling yourself because it's very 1647.24s - 1651.24s | frustrating when you spend two weeks looking at a patch vulnerability that you realize you 1651.24s - 1656.38s | cannot weaponize because of mitigations or some other factors. Because even if a 1656.38s - 1661.98s | mitigation can 100 percent stop a vulnerability from being exploitable, they're still 1661.98s - 1666.90s | going to patch it. Because what if somebody turns a mitigation off? Or it's just, you know, 1666.90s - 1671.90s | it's good, it's good habit to, to clean that stuff up. So when you do a patch diff and you look 1674.26s - 1680.08s | at the delta of the code, use something like diaphora or bin diff and you take a look at the 1680.08s - 1686.34s | changes at the function or the code level, you can give that information to the LLM and 1686.34s - 1691.52s | teach it how and why it's a certain type of vulnerability. And then the output from that can 1691.52s - 1696.62s | go into the next agent which is really doing the patch diffing for new vulnerabilities that 1696.62s - 1701.36s | got patched. So it's taking the patch, it's extracting it or grabbing it from Winbindex, 1701.36s - 1707.30s | doing the diffing and it's looking at the delta and it's knowledge of all the prior diffs that 1707.30s - 1712.36s | it has learned about and all the information about exploits that are public or private. It's 1712.40s - 1718.70s | using that to make a good guess as to what most likely is the vulnerability type. And then we 1718.70s - 1723.64s | have a corpus generation agent which is trying to generate trigger files that you can then 1723.64s - 1728.24s | feed to whatever it is and hopefully trigger the vulnerability. And then of course you would 1728.24s - 1733.74s | have to go in and see if you can actually weaponize it. So it's automating the process of 1733.74s - 1740.36s | binary diffing and trying to find where the bug is and trying to help you generate malformed 1740.36s


chunk_id: 175_chunk_35
chunk_text:
a certain type of vulnerability. And then the output from that can 1691.52s - 1696.62s | go into the next agent which is really doing the patch diffing for new vulnerabilities that 1696.62s - 1701.36s | got patched. So it's taking the patch, it's extracting it or grabbing it from Winbindex, 1701.36s - 1707.30s | doing the diffing and it's looking at the delta and it's knowledge of all the prior diffs that 1707.30s - 1712.36s | it has learned about and all the information about exploits that are public or private. It's 1712.40s - 1718.70s | using that to make a good guess as to what most likely is the vulnerability type. And then we 1718.70s - 1723.64s | have a corpus generation agent which is trying to generate trigger files that you can then 1723.64s - 1728.24s | feed to whatever it is and hopefully trigger the vulnerability. And then of course you would 1728.24s - 1733.74s | have to go in and see if you can actually weaponize it. So it's automating the process of 1733.74s - 1740.36s | binary diffing and trying to find where the bug is and trying to help you generate malformed 1740.36s - 1744.62s | documents or whatever you need to send to the target to try and get it to crash. I've got 1744.62s - 1749.84s | this working pretty good. It's not great but it's pretty, it's saving me a ton of time. I 1749.84s - 1756.54s | would say probably like 10 to 20 times it's saving me on that research effort which is pretty 1756.54s - 1761.18s | damn good for me anyway. So understanding how mitigations work, we're going to jump into a 1761.18s - 1767.26s | more technical part now. I, there's so many mitigations so I just chose one random one and 1767.28s - 1771.96s | also on my channel I do a lot of exploit mitigation reversing. If you're interested in 1771.96s - 1776.56s | that stuff there's videos on that. But a lot of these mitigations especially the more 1776.56s - 1782.40s | classic ones that came out with emits and the initial exploit guard. What they do is they 1782.40s - 1787.30s | will hook something. So for example there are things called critical functions on Windows. 1787.30s - 1791.72s | Critical function of one type will be any function that can


chunk_id: 175_chunk_36
chunk_text:
- 1744.62s | documents or whatever you need to send to the target to try and get it to crash. I've got 1744.62s - 1749.84s | this working pretty good. It's not great but it's pretty, it's saving me a ton of time. I 1749.84s - 1756.54s | would say probably like 10 to 20 times it's saving me on that research effort which is pretty 1756.54s - 1761.18s | damn good for me anyway. So understanding how mitigations work, we're going to jump into a 1761.18s - 1767.26s | more technical part now. I, there's so many mitigations so I just chose one random one and 1767.28s - 1771.96s | also on my channel I do a lot of exploit mitigation reversing. If you're interested in 1771.96s - 1776.56s | that stuff there's videos on that. But a lot of these mitigations especially the more 1776.56s - 1782.40s | classic ones that came out with emits and the initial exploit guard. What they do is they 1782.40s - 1787.30s | will hook something. So for example there are things called critical functions on Windows. 1787.30s - 1791.72s | Critical function of one type will be any function that can change permissions in memory. Like 1791.74s - 1797.24s | virtual alloc, virtual protect, heap create, write process memory. Those are critical APIs. 1797.24s - 1802.18s | So we want to monitor those. So if we understand things about different bug classes out there 1802.18s - 1807.56s | and different ways in which people exploit vulnerabilities then we can hook the flow of 1807.56s - 1812.72s | execution and before we allow the function to be called that will in fact change permissions in 1812.72s - 1818.14s | memory, we inspect it. And they can do that, you could do that by overwriting an entry in the 1818.16s - 1823.26s | imports table so when it calls that function where it's linked it'll actually call your code 1823.26s - 1827.40s | first or more likely they're going to hot patch or put a patch in the very beginning of the 1827.40s - 1832.98s | function entry point and it will first jump to another location, execute some code, typically 1832.98s - 1838.68s | points into something called payload restrictions dot DLL and it evaluates the environment to 1838.68s - 1841.78s | make sure things look good. I'll give you one simple


chunk_id: 175_chunk_37
chunk_text:
change permissions in memory. Like 1791.74s - 1797.24s | virtual alloc, virtual protect, heap create, write process memory. Those are critical APIs. 1797.24s - 1802.18s | So we want to monitor those. So if we understand things about different bug classes out there 1802.18s - 1807.56s | and different ways in which people exploit vulnerabilities then we can hook the flow of 1807.56s - 1812.72s | execution and before we allow the function to be called that will in fact change permissions in 1812.72s - 1818.14s | memory, we inspect it. And they can do that, you could do that by overwriting an entry in the 1818.16s - 1823.26s | imports table so when it calls that function where it's linked it'll actually call your code 1823.26s - 1827.40s | first or more likely they're going to hot patch or put a patch in the very beginning of the 1827.40s - 1832.98s | function entry point and it will first jump to another location, execute some code, typically 1832.98s - 1838.68s | points into something called payload restrictions dot DLL and it evaluates the environment to 1838.68s - 1841.78s | make sure things look good. I'll give you one simple example. If you've heard of stack 1841.80s - 1848.24s | pivoting before, Microsoft had the blue hat challenge and that was 2012, it was a long time 1848.24s - 1854.24s | ago. But they paid over a million dollars US to the first place winner and then they had three 1854.24s - 1859.28s | places, first, second, third and uh what they were looking for is help from the community to 1859.28s - 1864.48s | stop return oriented programming. And one of the main things that we would do in use after free 1864.48s - 1869.76s | exploits on browsers is we would pivot the stack pointer out to the heap because the stack 1869.78s - 1874.02s | pointer is a register that only is supposed to point to the current thread stack to the top of 1874.02s - 1878.52s | it. Let's not get into speculative execution and such but you know what I mean. And we like the 1878.52s - 1882.92s | stack pointer because of three powerful instructions, push, pop, ret. That's the only 1882.92s - 1889.06s | register that those instructions exist for. So that power, we want that in other places in 1889.06s - 1894.00s


chunk_id: 175_chunk_38
chunk_text:
example. If you've heard of stack 1841.80s - 1848.24s | pivoting before, Microsoft had the blue hat challenge and that was 2012, it was a long time 1848.24s - 1854.24s | ago. But they paid over a million dollars US to the first place winner and then they had three 1854.24s - 1859.28s | places, first, second, third and uh what they were looking for is help from the community to 1859.28s - 1864.48s | stop return oriented programming. And one of the main things that we would do in use after free 1864.48s - 1869.76s | exploits on browsers is we would pivot the stack pointer out to the heap because the stack 1869.78s - 1874.02s | pointer is a register that only is supposed to point to the current thread stack to the top of 1874.02s - 1878.52s | it. Let's not get into speculative execution and such but you know what I mean. And we like the 1878.52s - 1882.92s | stack pointer because of three powerful instructions, push, pop, ret. That's the only 1882.92s - 1889.06s | register that those instructions exist for. So that power, we want that in other places in 1889.06s - 1894.00s | memory so what we would do is use an exchange gadget and it would exchange or pivot the stack 1894.00s - 1898.04s | pointer with another register like the accumulator register. That would make it so the 1898.06s - 1902.52s | stack pointer points out on the heap somewhere where maybe our ROP chain is, our exploit code 1902.52s - 1909.00s | is. So great, it works. So anti-ROP which came out of right before Blue Hat was when Windows 8 1909.00s - 1913.60s | all it did was it looked at something called the thread information block at the stack 1913.60s - 1918.14s | boundaries, the stack high and stack low limits to make sure that the stack pointer points where 1918.14s - 1924.24s | it's supposed to before allowing a critical API to be called. Very simple thing and it was very 1924.28s - 1928.28s | easy to get around but it showed you Microsoft was taking return oriented programming 1928.28s - 1935.02s | seriously. And then after that a whole suite of mitigations came out like 6, 7, 8 simulate the 1935.02s - 1941.26s | execution flow, just many others. So again a lot of these


chunk_id: 175_chunk_39
chunk_text:
| memory so what we would do is use an exchange gadget and it would exchange or pivot the stack 1894.00s - 1898.04s | pointer with another register like the accumulator register. That would make it so the 1898.06s - 1902.52s | stack pointer points out on the heap somewhere where maybe our ROP chain is, our exploit code 1902.52s - 1909.00s | is. So great, it works. So anti-ROP which came out of right before Blue Hat was when Windows 8 1909.00s - 1913.60s | all it did was it looked at something called the thread information block at the stack 1913.60s - 1918.14s | boundaries, the stack high and stack low limits to make sure that the stack pointer points where 1918.14s - 1924.24s | it's supposed to before allowing a critical API to be called. Very simple thing and it was very 1924.28s - 1928.28s | easy to get around but it showed you Microsoft was taking return oriented programming 1928.28s - 1935.02s | seriously. And then after that a whole suite of mitigations came out like 6, 7, 8 simulate the 1935.02s - 1941.26s | execution flow, just many others. So again a lot of these hook and then they inspect and you 1941.26s - 1946.00s | move on. Not all of them though. Some of them are enforced in user LAN, some of them are 1946.00s - 1952.74s | enforced in the kernel and other factors. So let's look at one more more closely. So create 1952.74s - 1958.58s | process, a little C++ program I put together. Lifted code of course too. And all it does is 1958.58s - 1965.32s | it calls create process. There was a mitigation that Microsoft came out with called do not 1965.32s - 1970.62s | allow child processes. And that was called the calculator killer because obviously a lot of 1970.62s - 1975.50s | times people would use shell code to pop a calculator to prove that it worked. Well this 1975.50s - 1979.30s | mitigation would kill that and prevent it from happening. So a lot of times if you're 1979.30s - 1984.60s | exploiting like Microsoft Word or a browser or anything else you you want to create a new 1984.60s - 1990.60s | process. This mitigation would stop you from being able to do it. So when I first saw the 1990.60s - 1996.44s |


chunk_id: 175_chunk_40
chunk_text:
hook and then they inspect and you 1941.26s - 1946.00s | move on. Not all of them though. Some of them are enforced in user LAN, some of them are 1946.00s - 1952.74s | enforced in the kernel and other factors. So let's look at one more more closely. So create 1952.74s - 1958.58s | process, a little C++ program I put together. Lifted code of course too. And all it does is 1958.58s - 1965.32s | it calls create process. There was a mitigation that Microsoft came out with called do not 1965.32s - 1970.62s | allow child processes. And that was called the calculator killer because obviously a lot of 1970.62s - 1975.50s | times people would use shell code to pop a calculator to prove that it worked. Well this 1975.50s - 1979.30s | mitigation would kill that and prevent it from happening. So a lot of times if you're 1979.30s - 1984.60s | exploiting like Microsoft Word or a browser or anything else you you want to create a new 1984.60s - 1990.60s | process. This mitigation would stop you from being able to do it. So when I first saw the 1990.60s - 1996.44s | mitigation I just assumed that it hooked create process in user LAN somewhere around NTDLL or 1996.44s - 2000.62s | something it grabbed it and then payload restrictions would just inspect it and it would 2000.62s - 2004.62s | just prevent you from being able to do it. But this one ended up being a kernel enforced 2004.64s - 2016.74s | protection. So first off this is the code you compile it and great simple. When you run it so I'm 2016.74s - 2026.90s | make sure this seems to be uh acting weird here. Alright there we go. So when you run it you can 2026.90s - 2031.22s | see on command line right there a calculator pops up. We are exciting right? But that's that's 2031.22s - 2035.24s | what it's job was. It's what it was supposed to do is just pass in an argument and it executes 2035.24s - 2040.60s | and creates a process with that argument. Simple. Then I go into exploit guard that's a little 2040.62s - 2046.42s | snippet on the top right and I turn that specific mitigation on. You can see there's audit mode 2046.42s - 2051.10s | and then


chunk_id: 175_chunk_41
chunk_text:
mitigation I just assumed that it hooked create process in user LAN somewhere around NTDLL or 1996.44s - 2000.62s | something it grabbed it and then payload restrictions would just inspect it and it would 2000.62s - 2004.62s | just prevent you from being able to do it. But this one ended up being a kernel enforced 2004.64s - 2016.74s | protection. So first off this is the code you compile it and great simple. When you run it so I'm 2016.74s - 2026.90s | make sure this seems to be uh acting weird here. Alright there we go. So when you run it you can 2026.90s - 2031.22s | see on command line right there a calculator pops up. We are exciting right? But that's that's 2031.22s - 2035.24s | what it's job was. It's what it was supposed to do is just pass in an argument and it executes 2035.24s - 2040.60s | and creates a process with that argument. Simple. Then I go into exploit guard that's a little 2040.62s - 2046.42s | snippet on the top right and I turn that specific mitigation on. You can see there's audit mode 2046.42s - 2051.10s | and then there's enabled mode and I I just enabled it. And then when we try to run it you can see 2051.10s - 2056.50s | the command prompt in the middle it said create process failed. Okay the mitigation is working. 2056.50s - 2061.88s | Down at the bottom you can see that as a defender you want to watch these things as so here's one 2061.88s - 2066.78s | thing I'll take a step back. A lot of administrators are afraid to turn on these mitigations the 2066.80s - 2071.30s | ones that aren't turned on by default by Microsoft. And Microsoft's kind of in a catch 22 2071.30s - 2075.08s | situation because if they turn all the mitigations on that are available they might break your 2075.08s - 2079.18s | applications. Because some of your developers have to adhere to the way in which these 2079.18s - 2083.42s | mitigations work. But if they don't turn them on then you're mad at them because they didn't 2083.42s - 2087.92s | protect you like so they're kind of in a bad spot. So they wait till things are mature enough. A 2087.92s - 2092.80s | perfect example would be


chunk_id: 175_chunk_42
chunk_text:
there's enabled mode and I I just enabled it. And then when we try to run it you can see 2051.10s - 2056.50s | the command prompt in the middle it said create process failed. Okay the mitigation is working. 2056.50s - 2061.88s | Down at the bottom you can see that as a defender you want to watch these things as so here's one 2061.88s - 2066.78s | thing I'll take a step back. A lot of administrators are afraid to turn on these mitigations the 2066.80s - 2071.30s | ones that aren't turned on by default by Microsoft. And Microsoft's kind of in a catch 22 2071.30s - 2075.08s | situation because if they turn all the mitigations on that are available they might break your 2075.08s - 2079.18s | applications. Because some of your developers have to adhere to the way in which these 2079.18s - 2083.42s | mitigations work. But if they don't turn them on then you're mad at them because they didn't 2083.42s - 2087.92s | protect you like so they're kind of in a bad spot. So they wait till things are mature enough. A 2087.92s - 2092.80s | perfect example would be shadow stacks. If you've heard of shadow stack it's a relatively newer 2092.82s - 2098.32s | mitigation though not in theory. Early 2000's someone mentioned the idea of that. It creates a 2098.32s - 2103.34s | copy of return pointers and it requires at least an Intel Tiger Lake CPU. So obviously not 2106.80s - 2110.30s | everybody's running one of the newest processors and they're not just going to turn that on by 2110.30s - 2115.24s | default. So they have to wait. So a lot of these you do have to go on and turn them on. I 2115.24s - 2120.18s | remember Microsoft released a paper a long time ago and said the adoption rate for the enhanced 2120.20s - 2126.60s | mitigation experience tool kit, Emmet, was under 5%. So under 5% of organizations were 2126.60s - 2132.24s | actually using Emmet in any way shape or form. Because the admins maybe don't understand how 2132.24s - 2135.84s | the mitigations work at a very technical level and they don't want to do the screen test. 2135.84s - 2140.24s | There's also performance hits associated with these mitigations. One nice thing you can do 2140.24s -


chunk_id: 175_chunk_43
chunk_text:
shadow stacks. If you've heard of shadow stack it's a relatively newer 2092.82s - 2098.32s | mitigation though not in theory. Early 2000's someone mentioned the idea of that. It creates a 2098.32s - 2103.34s | copy of return pointers and it requires at least an Intel Tiger Lake CPU. So obviously not 2106.80s - 2110.30s | everybody's running one of the newest processors and they're not just going to turn that on by 2110.30s - 2115.24s | default. So they have to wait. So a lot of these you do have to go on and turn them on. I 2115.24s - 2120.18s | remember Microsoft released a paper a long time ago and said the adoption rate for the enhanced 2120.20s - 2126.60s | mitigation experience tool kit, Emmet, was under 5%. So under 5% of organizations were 2126.60s - 2132.24s | actually using Emmet in any way shape or form. Because the admins maybe don't understand how 2132.24s - 2135.84s | the mitigations work at a very technical level and they don't want to do the screen test. 2135.84s - 2140.24s | There's also performance hits associated with these mitigations. One nice thing you can do 2140.24s - 2144.62s | though is turn on that audit mode. It's almost like an intrusion detection versus intrusion 2144.62s - 2150.46s | prevention. Where it tells you about a potential problem but it doesn't actually block it. So 2150.46s - 2154.74s | you've got the power to do that and then you can look in the event logs. There's a specific 2154.74s - 2159.50s | event log area for user LAN mitigations and kernel LAN mitigations. And that's what you're 2159.50s - 2164.48s | seeing at the bottom there. When I ran that program to execute the calculator that new log 2164.48s - 2169.32s | popped up that said a mitigation was blocking it. That's right there what told me it was 2169.32s - 2175.96s | kernel enforced. So looking at the NTOS kernel here. When I set a break point on create 2175.96s - 2181.50s | process and let it continue it went straight into the kernel. So it told me right there 2181.50s - 2186.84s | validated that this is not a kernel uh sorry user LAN enforced mitigation. So I went into 2186.84s - 2192.58s | hex or I used hex rays obviously and I used win debug


chunk_id: 175_chunk_44
chunk_text:
2144.62s | though is turn on that audit mode. It's almost like an intrusion detection versus intrusion 2144.62s - 2150.46s | prevention. Where it tells you about a potential problem but it doesn't actually block it. So 2150.46s - 2154.74s | you've got the power to do that and then you can look in the event logs. There's a specific 2154.74s - 2159.50s | event log area for user LAN mitigations and kernel LAN mitigations. And that's what you're 2159.50s - 2164.48s | seeing at the bottom there. When I ran that program to execute the calculator that new log 2164.48s - 2169.32s | popped up that said a mitigation was blocking it. That's right there what told me it was 2169.32s - 2175.96s | kernel enforced. So looking at the NTOS kernel here. When I set a break point on create 2175.96s - 2181.50s | process and let it continue it went straight into the kernel. So it told me right there 2181.50s - 2186.84s | validated that this is not a kernel uh sorry user LAN enforced mitigation. So I went into 2186.84s - 2192.58s | hex or I used hex rays obviously and I used win debug and went in and set some break points on 2192.58s - 2197.58s | those functions right there. Like PSP get no child process restricted pro- policy or SC token 2200.46s - 2205.90s | is no child process restriction enforced. These are by symbol name because thankfully 2205.90s - 2210.90s | Microsoft gives us the symbols the PDB files. We can go and look for things that look like they 2210.90s - 2215.10s | might be associated with the mitigation that we're curious about. So I set the break points 2215.10s - 2221.08s | on there and then we run it. It immediately gets hit. But look where it gets hit. It gets hit 2221.08s - 2227.32s | when I'm in the command prompt trying to start that C++ wrapper program. The create process 2227.32s - 2233.86s | program. Because that's the program we turned exploit guard mitigation on. In the settings as 2233.86s - 2240.66s | you saw in the last slide. So it makes sense. So we hit a break point on the setting API. The 2240.66s - 2245.54s | one that sets the mitigation. Over on the right there if you're not familiar with the Virgilious 2245.54s -


chunk_id: 175_chunk_45
chunk_text:
and went in and set some break points on 2192.58s - 2197.58s | those functions right there. Like PSP get no child process restricted pro- policy or SC token 2200.46s - 2205.90s | is no child process restriction enforced. These are by symbol name because thankfully 2205.90s - 2210.90s | Microsoft gives us the symbols the PDB files. We can go and look for things that look like they 2210.90s - 2215.10s | might be associated with the mitigation that we're curious about. So I set the break points 2215.10s - 2221.08s | on there and then we run it. It immediately gets hit. But look where it gets hit. It gets hit 2221.08s - 2227.32s | when I'm in the command prompt trying to start that C++ wrapper program. The create process 2227.32s - 2233.86s | program. Because that's the program we turned exploit guard mitigation on. In the settings as 2233.86s - 2240.66s | you saw in the last slide. So it makes sense. So we hit a break point on the setting API. The 2240.66s - 2245.54s | one that sets the mitigation. Over on the right there if you're not familiar with the Virgilious 2245.54s - 2250.70s | project. It's everybody I know's go to if you're looking at kernel structures. It is a 2250.70s - 2255.78s | brilliant resource and every single Windows version, kernel version, every build, every 2255.78s - 2260.32s | creators update whatever is tracked there. Because a lot of times when you're doing things 2260.32s - 2265.76s | like token stealing in the kernel you need to make sure that your offsets are correct. There 2265.76s - 2270.42s | might be a structure like E process or K process, K thread, E thread and you need to make sure 2270.42s - 2275.20s | that what you think like AP links at a certain offset is still there depending on the kernel 2275.22s - 2278.76s | version. So you can look at these structures, look at the members and you can update your 2278.76s - 2285.10s | shellcode accordingly. But either way I saw an instruction and you can see in the code in the 2285.10s - 2290.10s | top middle in the white area it says move into racks GS segment register offset 188 hex. So 2292.70s - 2297.04s | the GS register while under the context of the kernel points


chunk_id: 175_chunk_46
chunk_text:
2250.70s | project. It's everybody I know's go to if you're looking at kernel structures. It is a 2250.70s - 2255.78s | brilliant resource and every single Windows version, kernel version, every build, every 2255.78s - 2260.32s | creators update whatever is tracked there. Because a lot of times when you're doing things 2260.32s - 2265.76s | like token stealing in the kernel you need to make sure that your offsets are correct. There 2265.76s - 2270.42s | might be a structure like E process or K process, K thread, E thread and you need to make sure 2270.42s - 2275.20s | that what you think like AP links at a certain offset is still there depending on the kernel 2275.22s - 2278.76s | version. So you can look at these structures, look at the members and you can update your 2278.76s - 2285.10s | shellcode accordingly. But either way I saw an instruction and you can see in the code in the 2285.10s - 2290.10s | top middle in the white area it says move into racks GS segment register offset 188 hex. So 2292.70s - 2297.04s | the GS register while under the context of the kernel points to a structure called the kernel 2297.04s - 2302.04s | processor control region. A very large kernel structure. And nested inside of that is 2302.06s - 2306.16s | something called KPRCB. The kernel processor region control block which is a mega 2306.16s - 2312.50s | structure. Well it's telling us at offset 8 within that nested structure is what we're 2312.50s - 2318.70s | dereferencing. It ends up being the K thread pointer. K thread and E thread and K process and 2318.70s - 2322.64s | E process are kernel things. If you've ever heard of the process environment block in user 2322.64s - 2327.18s | land, the peb. E process is like the equivalent in the kernel. If you've ever heard of the 2327.22s - 2331.90s | TIB, the thread information block. K thread, E thread, the executive and kernel thread. 2331.90s - 2336.60s | Those are the relative entries in the kernel. Not one to one but it's pretty close. So either 2336.60s - 2342.84s | way we're dereferencing and grabbing the K thread pointer for the current thread. So let me 2342.84s - 2348.08s | go in further and we're checking out our progress here. You can


chunk_id: 175_chunk_47
chunk_text:
to a structure called the kernel 2297.04s - 2302.04s | processor control region. A very large kernel structure. And nested inside of that is 2302.06s - 2306.16s | something called KPRCB. The kernel processor region control block which is a mega 2306.16s - 2312.50s | structure. Well it's telling us at offset 8 within that nested structure is what we're 2312.50s - 2318.70s | dereferencing. It ends up being the K thread pointer. K thread and E thread and K process and 2318.70s - 2322.64s | E process are kernel things. If you've ever heard of the process environment block in user 2322.64s - 2327.18s | land, the peb. E process is like the equivalent in the kernel. If you've ever heard of the 2327.22s - 2331.90s | TIB, the thread information block. K thread, E thread, the executive and kernel thread. 2331.90s - 2336.60s | Those are the relative entries in the kernel. Not one to one but it's pretty close. So either 2336.60s - 2342.84s | way we're dereferencing and grabbing the K thread pointer for the current thread. So let me 2342.84s - 2348.08s | go in further and we're checking out our progress here. You can see that I run this fancy 2348.08s - 2352.58s | window bug command and we're basically saying what is our current process? And it tells us 2352.58s - 2358.30s | that the current process is the uh which one? Command dot EXE. That's not the process I 2358.30s - 2362.70s | want to be in. So we let it continue. We hit the breakpoint again and then we look at the 2362.70s - 2367.20s | current process and now we're in the create process C++ program where we want to be. So now 2367.20s - 2371.30s | we know where we want to be. We're at where we want to be. It's important to mention that 2371.30s - 2375.54s | because when you set these types of breakpoints they will get hit often unless you set 2375.54s - 2379.68s | process specific breakpoints as a kernel debugging session. So you want to make sure you 2379.68s - 2384.92s | understand what context you're under for each you know process. And then we hit our 2384.92s - 2391.06s | breakpoint on the SE token set no child process restricted function. So this means that 2391.06s - 2396.54s | we're under the


chunk_id: 175_chunk_48
chunk_text:
see that I run this fancy 2348.08s - 2352.58s | window bug command and we're basically saying what is our current process? And it tells us 2352.58s - 2358.30s | that the current process is the uh which one? Command dot EXE. That's not the process I 2358.30s - 2362.70s | want to be in. So we let it continue. We hit the breakpoint again and then we look at the 2362.70s - 2367.20s | current process and now we're in the create process C++ program where we want to be. So now 2367.20s - 2371.30s | we know where we want to be. We're at where we want to be. It's important to mention that 2371.30s - 2375.54s | because when you set these types of breakpoints they will get hit often unless you set 2375.54s - 2379.68s | process specific breakpoints as a kernel debugging session. So you want to make sure you 2379.68s - 2384.92s | understand what context you're under for each you know process. And then we hit our 2384.92s - 2391.06s | breakpoint on the SE token set no child process restricted function. So this means that 2391.06s - 2396.54s | we're under the context of the create process C++ program and that mitigation function has 2396.54s - 2403.34s | just been called. And it says set no child process restricted. So you go into hex rays and 2403.34s - 2407.38s | you decompile it and you say hey let's take a look at this function and that's what you're 2407.38s - 2411.72s | seeing on the right there. I know it's kind of small again slides will be released. Put some 2411.72s - 2416.16s | circles around some variables because we don't know what those variables are. Thankfully we 2416.16s - 2420.66s | get symbols from Microsoft. Thankfully hex rays and IDA pro are brilliant. It's a brilliant 2420.66s - 2424.96s | disassembler and we get the function prototype data. As long as you know what the structure 2424.96s - 2430.00s | is you can say hey I know this is a token structure because MSDN told me on the left on the 2430.00s - 2436.08s | top there. And then once you do that you see that it's able to then go in and add all the 2436.08s - 2441.78s | symbols. Define everything that you want to see. On the right


chunk_id: 175_chunk_49
chunk_text:
context of the create process C++ program and that mitigation function has 2396.54s - 2403.34s | just been called. And it says set no child process restricted. So you go into hex rays and 2403.34s - 2407.38s | you decompile it and you say hey let's take a look at this function and that's what you're 2407.38s - 2411.72s | seeing on the right there. I know it's kind of small again slides will be released. Put some 2411.72s - 2416.16s | circles around some variables because we don't know what those variables are. Thankfully we 2416.16s - 2420.66s | get symbols from Microsoft. Thankfully hex rays and IDA pro are brilliant. It's a brilliant 2420.66s - 2424.96s | disassembler and we get the function prototype data. As long as you know what the structure 2424.96s - 2430.00s | is you can say hey I know this is a token structure because MSDN told me on the left on the 2430.00s - 2436.08s | top there. And then once you do that you see that it's able to then go in and add all the 2436.08s - 2441.78s | symbols. Define everything that you want to see. On the right there I did a stream a while 2441.78s - 2447.82s | ago on documenting undocumented structures and it was all about looking at different bitmasks 2447.82s - 2452.46s | in the kernel and e-process and the token structure to understand what the mitigation bits 2452.46s - 2457.76s | are and to show you kind of how to do that. This is a reference from Google that shows us that 2457.76s - 2462.60s | these different bitmask numbers you'll see lots of booleans like ands and ors and those are 2462.62s - 2467.76s | either turning on or clearing bits in the bitmask so that the mitigation flags are set to the 2467.76s - 2472.04s | state that they're supposed to be in. So I went through here and I added a bunch of comments 2472.04s - 2475.74s | because obviously it's helpful especially if you're not used to debugging uh or 2475.74s - 2480.28s | disassembling and decompiling kernel structures. But that defines everything that's 2480.28s - 2484.18s | happening. Basically we're getting a token or acquiring a lock on the token. We're 2484.18s - 2488.62s | initializing a variable which ends up being the token, the current token. And


chunk_id: 175_chunk_50
chunk_text:
there I did a stream a while 2441.78s - 2447.82s | ago on documenting undocumented structures and it was all about looking at different bitmasks 2447.82s - 2452.46s | in the kernel and e-process and the token structure to understand what the mitigation bits 2452.46s - 2457.76s | are and to show you kind of how to do that. This is a reference from Google that shows us that 2457.76s - 2462.60s | these different bitmask numbers you'll see lots of booleans like ands and ors and those are 2462.62s - 2467.76s | either turning on or clearing bits in the bitmask so that the mitigation flags are set to the 2467.76s - 2472.04s | state that they're supposed to be in. So I went through here and I added a bunch of comments 2472.04s - 2475.74s | because obviously it's helpful especially if you're not used to debugging uh or 2475.74s - 2480.28s | disassembling and decompiling kernel structures. But that defines everything that's 2480.28s - 2484.18s | happening. Basically we're getting a token or acquiring a lock on the token. We're 2484.18s - 2488.62s | initializing a variable which ends up being the token, the current token. And then we're 2488.64s - 2494.44s | going in and we're checking bits that are set in the bitmask. And these bitmasks bits are 2494.44s - 2500.18s | things like is it in audit only mode? Should it be turned on and enforced? Is the low box 2500.18s - 2504.46s | token thing associated with it? What what setting should I do? And through the boolean 2504.46s - 2509.46s | operations it turns on the appropriate bit which then sets the mitigation on. That is pretty 2511.70s - 2515.74s | much how that mitigation works and that's why it's being blocked. Because the next thing 2515.76s - 2520.60s | that would have happened had we kept going the get function would have gotten called and it 2520.60s - 2525.40s | would have checked that bit to see if that program has the authority to spawn a new 2525.40s - 2529.84s | process. So that's kind of what we learned by going through that and that's how easy it can 2529.84s - 2534.44s | be to understand mitigations to see if you can get around them. So from that you're like well 2534.44s - 2540.48s | then can I get around this


chunk_id: 175_chunk_51
chunk_text:
then we're 2488.64s - 2494.44s | going in and we're checking bits that are set in the bitmask. And these bitmasks bits are 2494.44s - 2500.18s | things like is it in audit only mode? Should it be turned on and enforced? Is the low box 2500.18s - 2504.46s | token thing associated with it? What what setting should I do? And through the boolean 2504.46s - 2509.46s | operations it turns on the appropriate bit which then sets the mitigation on. That is pretty 2511.70s - 2515.74s | much how that mitigation works and that's why it's being blocked. Because the next thing 2515.76s - 2520.60s | that would have happened had we kept going the get function would have gotten called and it 2520.60s - 2525.40s | would have checked that bit to see if that program has the authority to spawn a new 2525.40s - 2529.84s | process. So that's kind of what we learned by going through that and that's how easy it can 2529.84s - 2534.44s | be to understand mitigations to see if you can get around them. So from that you're like well 2534.44s - 2540.48s | then can I get around this somehow? Obviously the first thing you want to do is Google go to 2540.48s - 2545.32s | chat GPT or your favorite AI LLM whatever and say hey can you tell me about any bypass 2545.34s - 2549.54s | techniques that may be publicly available? But if there are no publicly available ones, 2549.54s - 2553.68s | hey you've got a great opportunity to do some cool research and make it public if you can find 2553.68s - 2558.98s | something. Some examples down there towards the bottom. There was a technique I forget who 2558.98s - 2563.28s | discovered it but I put the link there where you can you can impersonate the anonymous token to 2563.28s - 2567.16s | get around the mitigation and spawn a new process. I don't think that still works but it was an 2567.16s - 2574.26s | option. You can use WMI like if you're in the context of Microsoft Office and you can use some 2574.30s - 2578.88s | cool PowerShell or WMI to get around the mitigation that way. There's a process migration 2578.88s - 2583.18s | potentially. You can use reflexive DLL loading where you load from memory something into


chunk_id: 175_chunk_52
chunk_text:
somehow? Obviously the first thing you want to do is Google go to 2540.48s - 2545.32s | chat GPT or your favorite AI LLM whatever and say hey can you tell me about any bypass 2545.34s - 2549.54s | techniques that may be publicly available? But if there are no publicly available ones, 2549.54s - 2553.68s | hey you've got a great opportunity to do some cool research and make it public if you can find 2553.68s - 2558.98s | something. Some examples down there towards the bottom. There was a technique I forget who 2558.98s - 2563.28s | discovered it but I put the link there where you can you can impersonate the anonymous token to 2563.28s - 2567.16s | get around the mitigation and spawn a new process. I don't think that still works but it was an 2567.16s - 2574.26s | option. You can use WMI like if you're in the context of Microsoft Office and you can use some 2574.30s - 2578.88s | cool PowerShell or WMI to get around the mitigation that way. There's a process migration 2578.88s - 2583.18s | potentially. You can use reflexive DLL loading where you load from memory something into 2583.18s - 2588.82s | memory. That also gets you around other mitigations like CIT. Ones that are preventing you 2588.82s - 2593.82s | from loading an unsigned DLL from your Windows box and again setting it accordingly, 2596.12s - 2600.12s | enforcing the protection and getting around it with things like reflexive DLL. So there's a 2600.12s - 2604.10s | bunch of ways we can potentially get around it and that's why it's so important that you put 2604.10s - 2609.04s | a bunch of these together. That you're not just relying on any one mitigation. I remember 2609.04s - 2614.32s | Microsoft made a pretty bold claim somebody there said CFG control flow guard should be a 2614.32s - 2620.28s | strong enough mitigation that it can prevent the majority of exploitation techniques where 2620.28s - 2624.90s | Emmet may not be needed as much. That ends up not being entirely true because CFG is 2624.90s - 2629.76s | another one you could potentially get around. People have demonstrated that even with V8 2629.76s - 2634.76s | on Chrome. So this right here I just wanted to point it out. There are two fields and rest 2637.80s - 2642.14s


chunk_id: 175_chunk_53
chunk_text:
2583.18s - 2588.82s | memory. That also gets you around other mitigations like CIT. Ones that are preventing you 2588.82s - 2593.82s | from loading an unsigned DLL from your Windows box and again setting it accordingly, 2596.12s - 2600.12s | enforcing the protection and getting around it with things like reflexive DLL. So there's a 2600.12s - 2604.10s | bunch of ways we can potentially get around it and that's why it's so important that you put 2604.10s - 2609.04s | a bunch of these together. That you're not just relying on any one mitigation. I remember 2609.04s - 2614.32s | Microsoft made a pretty bold claim somebody there said CFG control flow guard should be a 2614.32s - 2620.28s | strong enough mitigation that it can prevent the majority of exploitation techniques where 2620.28s - 2624.90s | Emmet may not be needed as much. That ends up not being entirely true because CFG is 2624.90s - 2629.76s | another one you could potentially get around. People have demonstrated that even with V8 2629.76s - 2634.76s | on Chrome. So this right here I just wanted to point it out. There are two fields and rest 2637.80s - 2642.14s | in peace to Jeff Chappelle brilliant individual passed away recently sadly but he 2642.14s - 2647.14s | maintained this site and I hope it stays up forever because every time Microsoft would make a 2647.14s - 2652.04s | structural change or add a new mitigation like if you can see the ones towards the bottom on 2652.04s - 2657.02s | the right and mitigation flags too. You see things like control flow enforcement technology 2657.02s - 2661.92s | and shadow stacks. Those are relatively new mitigations and these are bit masks that are set 2661.92s - 2667.76s | as a member of the e-process structure and those are the things that are being checked. That's 2667.76s - 2671.92s | why a lot of times you might heard people getting around SMAP like supervisor mode execution 2671.92s - 2677.10s | prevention by setting a bit or flipping a bit inside a control register while under a certain 2677.10s - 2682.48s | context. Getting around patch guard by doing it fast and doing a race condition. So the more 2682.50s - 2687.10s | you understand from an offensive perspective about these mitigations the more you'll be able to 2687.10s - 2691.98s


chunk_id: 175_chunk_54
chunk_text:
| in peace to Jeff Chappelle brilliant individual passed away recently sadly but he 2642.14s - 2647.14s | maintained this site and I hope it stays up forever because every time Microsoft would make a 2647.14s - 2652.04s | structural change or add a new mitigation like if you can see the ones towards the bottom on 2652.04s - 2657.02s | the right and mitigation flags too. You see things like control flow enforcement technology 2657.02s - 2661.92s | and shadow stacks. Those are relatively new mitigations and these are bit masks that are set 2661.92s - 2667.76s | as a member of the e-process structure and those are the things that are being checked. That's 2667.76s - 2671.92s | why a lot of times you might heard people getting around SMAP like supervisor mode execution 2671.92s - 2677.10s | prevention by setting a bit or flipping a bit inside a control register while under a certain 2677.10s - 2682.48s | context. Getting around patch guard by doing it fast and doing a race condition. So the more 2682.50s - 2687.10s | you understand from an offensive perspective about these mitigations the more you'll be able to 2687.10s - 2691.98s | get around them potentially or know when to call it a day. For me it's all about saving time. If I 2691.98s - 2696.74s | know a mitigation is likely on and I'm doing a patch dip or find a zero day and I think it's not 2696.74s - 2701.28s | going to be fruitful for me to continue down that path. You gotta pay your dues though. You will 2701.28s - 2706.06s | have those harsh you know frustrating days. I still have them all the time. From a defensive 2706.06s - 2711.40s | perspective it really helps you to understand how these mitigations work so that if you don't 2711.42s - 2715.72s | want to turn all of them on you know which ones are going to be more beneficial. Which ones 2715.72s - 2721.40s | have less overhead. Which ones actually do stop an exploit technique and which ones are pretty 2721.40s - 2728.04s | useless. So some takeaways I think I went through some already but it's it's a lot of nuance and I 2728.04s - 2734.54s | think that that gives us power where AI won't take over our jobs anytime soon because the


chunk_id: 175_chunk_55
chunk_text:
| get around them potentially or know when to call it a day. For me it's all about saving time. If I 2691.98s - 2696.74s | know a mitigation is likely on and I'm doing a patch dip or find a zero day and I think it's not 2696.74s - 2701.28s | going to be fruitful for me to continue down that path. You gotta pay your dues though. You will 2701.28s - 2706.06s | have those harsh you know frustrating days. I still have them all the time. From a defensive 2706.06s - 2711.40s | perspective it really helps you to understand how these mitigations work so that if you don't 2711.42s - 2715.72s | want to turn all of them on you know which ones are going to be more beneficial. Which ones 2715.72s - 2721.40s | have less overhead. Which ones actually do stop an exploit technique and which ones are pretty 2721.40s - 2728.04s | useless. So some takeaways I think I went through some already but it's it's a lot of nuance and I 2728.04s - 2734.54s | think that that gives us power where AI won't take over our jobs anytime soon because the 2734.54s - 2739.14s | circumstances in which you will be doing your research requires something that machine 2739.16s - 2743.82s | learning just can't do right now. And there's synergy there as well when working with other 2743.82s - 2748.70s | researchers. The golden years of binary exploitation can be behind us but um it's not 2748.70s - 2752.44s | going away anytime soon. People ask me they probably ask you all the time for how much 2752.44s - 2757.40s | longer am I going to be able to do this? As long as it's possible. People are going to keep 2757.40s - 2761.68s | doing it. It's a lot harder now but I use an analogy like Tony Hawk the skateboarder. What he 2761.68s - 2766.38s | was doing in the 1990s there's like a 8 year old kid able to do that today. We're just all 2766.38s - 2771.20s | this information is out there to get you up to speed from all the research done in the past 2771.20s - 2776.90s | fast so that you can then go and bring about novel exploitation techniques and new zero days. 2776.90s - 2781.70s | And the ethical considerations


chunk_id: 175_chunk_56
chunk_text:
2734.54s - 2739.14s | circumstances in which you will be doing your research requires something that machine 2739.16s - 2743.82s | learning just can't do right now. And there's synergy there as well when working with other 2743.82s - 2748.70s | researchers. The golden years of binary exploitation can be behind us but um it's not 2748.70s - 2752.44s | going away anytime soon. People ask me they probably ask you all the time for how much 2752.44s - 2757.40s | longer am I going to be able to do this? As long as it's possible. People are going to keep 2757.40s - 2761.68s | doing it. It's a lot harder now but I use an analogy like Tony Hawk the skateboarder. What he 2761.68s - 2766.38s | was doing in the 1990s there's like a 8 year old kid able to do that today. We're just all 2766.38s - 2771.20s | this information is out there to get you up to speed from all the research done in the past 2771.20s - 2776.90s | fast so that you can then go and bring about novel exploitation techniques and new zero days. 2776.90s - 2781.70s | And the ethical considerations are something that you have to understand and think about. Um 2781.70s - 2787.44s | there's new acts and new legislation out there. Like palm oil and such that we have to worry 2787.44s - 2792.54s | about. But as you probably know the more you push researchers and say you can't do 2792.58s - 2796.62s | something the more likely they're going to go unethical route and sell it on the dark net and 2796.62s - 2803.08s | make money that way. So mitigations are uh a real thing. They're hard but they're not going 2803.08s - 2806.66s | away and you just have to deal with it. And they're how you have to think about it as if 2806.66s - 2812.96s | there's always a way around it. And the prize will continue to grow. What was $10,000 is 2812.96s - 2818.90s | $500,000 now. So it is worth your time putting months into research. So references and 2818.90s - 2823.10s | thanks. I there's always more people than I can remember to thank but lots of researchers 2823.10s - 2826.34s | out there in the past. Uh Jeremy Tinder just a shout out to him for getting


