# Media

url: https://www.youtube.com/watch?v=7IrPkH7kK2I
title: DEF CON 32 - NTLM The Last Ride - Jim Rush, Tomais Williamson
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=7IrPkH7kK2I",
  "title": "DEF CON 32 - NTLM The Last Ride - Jim Rush, Tomais Williamson",
  "description": "Microsoft is planning to kill off NTLM (New Technology Lan Manager) authentication in Windows 11 and above. Let's speedrun coercing hashes out of a few more things before it fades into obscurity over the next twenty five years or so.\n\nThere will be a deep dive on several new bugs we disclosed to Microsoft (including bypassing a fix to an existing CVE), some interesting and useful techniques, combining techniques from multiple bug classes resulting in some unexpected discoveries and some absolutely cooked bugs. We\u2019ll also uncover some defaults that simply shouldn't exist in sensible libraries or applications as well as some glaring gaps in some of the Microsoft NTLM related security controls.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1982,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.59s - 2.35s | This text was transcribed using whisper model: large-v2

 Hello everyone
2.35s - 9.67s |  Hello. Hi. So thanks for coming along today. We are here to talk about everyone's favorite subject from 25 years ago
11.75s - 15.43s |  So a friend of mine said this to me when I told him what our research was about
16.75s - 24.11s |  And yeah, it holds true. I mean Windows has got some stuff going on. So let's find out exactly how broken it is
24.75s - 27.99s |  So real quickly we're from there
28.99s - 35.39s |  That's a very accurate map we're from the middle of Middle-earth a little place called Wellington in New Zealand and
36.31s - 40.99s |  Yeah, it was a long flight. It was too long. It was too long an economy
41.79s - 45.99s |  Anyway a little bit about me. I've worked at a bunch of logos, which is very exciting
45.99s - 50.83s |  I actually had a life before hacking where I used to tour a lot of bands to New Zealand
50.83s - 55.65s |  So, please don't ask me about the early 2000s because I have PTSD and a lot of debt
56.65s - 63.53s |  I'm also a former software developer. I'm a relatively active security researcher a few CVS in various things
63.53s - 69.05s |  I'm a frequent flyer with search New Zealand, which is the cyber security emergency response team. They love me
69.33s - 71.33s |  Please don't ask me about council software
72.01s - 75.13s |  And I'm Thomas. I have also worked at
75.89s - 81.89s |  Fewer logos than Jim. I'm a little bit younger than Jim. I also do some CTF stuff and
82.69s - 89.89s |  I'm also a senior security consultant. I also do research. I found a fun thing a few years ago in kite works
90.41s - 94.49s |  Also did the Kramer thing with Jim a couple of slides ago
94.49s - 98.17s |  Don't know if you remember and then also the Microsoft stuff in this talk
99.93s - 105.37s |  So this talk is about NTLM NTLM is supposedly going away
106.37s - 107.69s |  Every
107.69s - 111.77s |  NTLM bug we've seen has usually been a gateway bug to something better like
112.53s - 115.73s |  Usually it leads into something. That's quite nice. Sometimes a bounty
116.45s - 120.81s |  It has been a absolute ride with the MSRC. They have a very hard job
120.81s - 124.77s |  We met with them the other day and we did have to change some of our talk because it turns out
124.77s - 131.57s |  They're actually quite nice. Yeah, when you like meet them and they've got faces and names you kind of feel a little bad. Oops
132.57s - 141.49s |  Windows has an overwhelming desire to authenticate to everything that it can it just likes sending hashes out like there's no tomorrow and
142.69s - 145.93s |  The Windows ecosystem is very vast and very fun
146.45s - 151.71s |  So in TLM, we are not going to give it a stupid name
152.79s - 153.87s |  someone
153.87s - 156.19s |  could SQL I squealy and
157.75s - 159.75s |  It still haunts you
160.23s - 163.27s |  It stands for new technology land manager
164.23s - 168.87s |  There's something about calling things new in technology. That means it's going to be around forever
169.79s - 175.63s |  And it's up there with the simple and SNMP and lightweight and elder
176.15s - 182.12s |  So NTLM was developed in the 90s like a few of you here
183.36s - 190.28s |  It's preceded by LM and this is finally completely removed in server 2025. So it hasn't been removed yet
191.28s - 198.32s |  It was intended to provide authentication integrity and confidentiality so far so good. This is you know, what you expect out of NTLM
199.04s - 203.40s |  They've recommended not to use it since 2010. Does anyone know what year we're in now?
204.64s - 210.64s |  There was a 2011 DEF CON talk that I watched called nail the coffin shut NTLM is dead
211.80s - 213.80s |  It failed to die
215.36s - 217.84s |  So and there are a crapload of CDs
218.80s - 220.64s |  associated with this protocol
220.64s - 223.36s |  So essentially at its core it is a hash of a password
224.08s - 227.56s |  Also called an NT hash. It's a challenge response mechanism
227.56s - 232.76s |  So the client establishes a network path and negotiates the server responds with a challenge message
232.76s - 234.76s |  The client responds with an authenticate message
234.76s - 239.68s |  And it does this using the NT hash and there's a couple of different flavors that we're going to be talking about which is mostly
239.68s - 246.22s |  Net in TLM v1 and net in TLM v2. So on a network essentially this lets you browse file shares and websites
246.22s - 248.22s |  So
248.86s - 254.54s |  Some quick definitions before we get stuck into the bugs a hash is data produced from one-way function
254.54s - 258.98s |  So you don't have to pass your plaintext password around. I've been asked to localize my talk
258.98s - 263.34s |  So this is essentially the equivalent of turning a cow into a hot dog. It's
263.98s - 266.06s |  Expensive to get the hot dog back into the cow
267.22s - 270.18s |  So UNC is the universal naming convention
270.38s - 277.62s |  You know, it's slash slash thing HTTP hypertext transfer protocol and you or I the uniform resource handler
278.90s - 282.76s |  So what happens if you steal one? There's kind of three things you can
283.30s - 289.90s |  Brute-force it turn it back into a cletex password talk to the password cracking village about how quickly they can do it these days
290.38s - 293.14s |  You can also relay it and pretend to be that person
293.70s - 297.86s |  That's mainly with ntlm and ntlm v1
298.50s - 304.70s |  Ntlm v2 does it sometimes just for fun and you can also just take a screenshot of it report it to the MSRC
305.30s - 310.21s |  Have a fun conversation with them. Yeah, so
311.69s - 317.85s |  We did a few minutes of googling and these are all the bugs that we found in like three minutes about ntlm
317.85s - 320.73s |  There's also the morphe sector that was yesterday
321.25s - 324.25s |  They went into some more ntlm stuff there, but
325.25s - 330.17s |  It's a doozy. There was the Monica link one this year the windows themes file as well
330.17s - 336.33s |  You could just load a theme and it would send off your hash for fun outlook sound files, which was like a zero-click RCE
336.33s - 340.01s |  there was a bypass for that and then a bypass with that again, I think and
341.81s - 344.81s |  Yeah, some other ones everyone's favorite petite baton
345.41s - 348.29s |  So
348.29s - 354.57s |  Ntlm is just a host of vulnerabilities. A lot of it is just by design. We won't fix it. I mean
355.25s - 356.77s |  It's old
356.77s - 362.05s |  So what they're doing is they're going to deprecate it and then eventually disable it
362.89s - 365.69s |  Which is kind of fixing it, I guess
367.69s - 373.85s |  Given that like half of the environments in little old New Zealand still use ntlm v1
374.25s - 376.25s |  It's gonna take a long time
377.41s - 383.09s |  So we have it on good authority an anonymous source at Microsoft who actually confirmed this for us
383.09s - 387.85s |  And he said to us when we met them the runway for this is between 50 and 100 years
389.65s - 391.41s |  So, yeah
391.41s - 396.87s |  So it's going to be disabled on a future version of Windows 11. This is great
396.87s - 401.87s |  And they have told us that they're stopping working on it. So it's feature complete apparently
402.51s - 407.71s |  So now Windows will attempt to authenticate with Kerberos first, which is really secure and great
408.71s - 415.27s |  but it still falls back to ntlm if a Kerberos negotiation doesn't happen and so it's going to be disabled in a future release and
415.75s - 419.83s |  It can always be re-enabled just like ntlm v1
421.23s - 426.15s |  So one of the tools we've been using is a very very well-known tool. We're not going to go too much into it
426.31s - 429.07s |  This is responder the rogue authentication server
429.83s - 433.63s |  Developed by algandex. Please go and flick them some money for this great tool
434.19s - 436.19s |  the two ports that we
436.75s - 439.55s |  Concerned with port 80 and port 445 and it provides
440.63s - 444.55s |  Authentication challenges on these ports and a lot of others. It does some other cool stuff
444.55s - 449.99s |  It's a very valuable pen testing tool. If you've never heard of it go run it in an internal network and brighten your sock team
450.75s - 453.15s |  For our purposes. We're just going to use it to collect ashes
454.47s - 459.43s |  So this current obsession with ntlm hashes started a couple of years ago
459.43s - 464.99s |  I was testing an ArcGIS application. So for those of you not familiar with ArcGIS
465.59s - 472.03s |  It's mapping software beloved by local government and I asked my workmate Ahmad if he had any tricks
472.03s - 474.91s |  He was a very high-ranked bug crowd guy
474.91s - 481.07s |  So, of course he did he suggested I run responder on one of our servers for a blind ssrf that we had found
482.15s - 484.15s |  And we got a hash on port 80
484.55s - 487.45s |  But actually is is running Java on IIS
488.45s - 496.89s |  So now we wanted to speedrun in case you're wondering what RSS and actually is looks like you can specify an RSS URL for some
497.21s - 498.77s |  obscure reason
498.77s - 504.01s |  So yeah, I'm sorry about the ntlm bugs everyone
504.53s - 510.75s |  So windows does want you to be safe. They do have some built-in protections
510.95s - 513.87s |  One of them is mark of the web, which you might have seen before
514.55s - 516.59s |  If you were to download a file from the internet
516.59s - 521.35s |  it's it's a little flag on the document like a word document or some other things as well and
522.51s - 526.59s |  Basically, it just says nah, I'm not gonna use all of the features
526.59s - 532.27s |  I'm just gonna let you like briefly look at it. You can click the little warning to make it go away, but it's safe
533.67s - 540.67s |  The wordpad issue that I mentioned earlier that just bypassed it. I don't think they even had mark of the web on wordpad files
540.67s - 542.67s |  Oh, no, no
542.67s - 549.39s |  And also if you get clone something and there's a document in it it also just doesn't sit the flag it's great
550.71s - 552.63s |  They also have
552.63s - 555.67s |  This from what Windows NT days
556.87s - 560.55s |  They're called safe zones. This is a recent screenshot Thomas
560.55s - 565.35s |  Yeah, this is from Windows 11 as you can see with the little X's in the top right hand corners
565.35s - 567.35s |  Yeah
567.55s - 573.75s |  You can see that because it says scripting of Java outlets, it's very up-to-date and protects you against many things
574.67s - 579.61s |  The little thing down the bottom with the user authentication it stops some hashes
580.39s - 582.39s |  Over port 445, but that's about it
583.23s - 587.95s |  So it's time to query some hashes from some software before NTLM goes away
588.75s - 591.75s |  So we're going to talk about a few things image magic and graphics magic
592.39s - 596.41s |  Vlc media player espos.net hi Q PDF
596.91s - 601.23s |  The Q stands for quality as we find out Java on is and Windows
601.83s - 609.83s |  calendars new get an eye credential irises feeds and Outlook MS Office URI handlers and Outlook and get full windows
610.71s - 611.99s |  so
611.99s - 618.83s |  Graphics magic is generally regarded as the safe one because it's a relatively fuzzed fork of image magic. So
619.39s - 621.39s |  It's a massive attack surface
621.99s - 626.75s |  Image magic is generally associated with image tragic, which everyone will remember from a few years ago
627.91s - 631.15s |  But graph image magic didn't make a hash over port 445
632.15s - 637.47s |  So it will leak a hash by SVG converting to anything by our UNC path href
637.47s - 643.63s |  And it's noted in the documentation is SSRF, but there is nothing about hashes or UNC paths
646.19s - 648.19s |  Vlc player so
648.55s - 653.57s |  You can just load a playlist file and it's got a UNC path in it and it will go away and fetch the hash
654.43s - 662.03s |  Our workmate Ahmed he disclosed that and then VLC were like it's a Windows problem. No, it's a VLC problem
662.03s - 665.31s |  I mean, it's also a Windows problem, but come on guys
666.27s - 671.55s |  You could also do it in iTunes and Windows Media Player. I'm sorry if you still use those programs
672.07s - 677.59s |  There's probably maybe six of you in the audience that still use Windows Media Player and iTunes for Windows. I'm sorry
678.19s - 682.75s |  There's also lots of other formats and protocols that may or may not support NTLM
682.75s - 686.23s |  I mean, I'd tell you to go and look at them, but VLC don't care
686.83s - 690.49s |  so I suppose dotnet is a
691.13s - 697.05s |  Lovely piece of document processing software anyone who's ever spent any time on the red team or doing any kind of pen testing will know
697.05s - 703.05s |  Just how rich and attack surface document processing is it has a few known documented security issues
704.05s - 710.13s |  SSRF, server-side request forgery, NTLM hash leakage, file inclusion and it's right there on their web application
710.77s - 715.67s |  Security when loading resources page so they know about them and they have front-footed it
717.25s - 722.89s |  So leaking hashes out port 4.5 is relatively abundant and low value within an ecosystem
723.29s - 729.57s |  So port 4.4.5 any good system administrator will block this port on a firewall because there's no reason that it needs to talk to
729.57s - 732.85s |  The internet port 80. However is not as blocked
733.05s - 738.49s |  So when Windows sees a UNC path those little slashes we saw before it only knows how to do one thing
738.49s - 743.57s |  And it takes a little bit of work to get it out by HTTP. So let's try
744.69s - 751.57s |  So I just wanted to look at the district plan for our city and not go to the cybersecurity emergency response team
752.13s - 755.25s |  So there's a piece of software in Aotearoa New Zealand called ISO plan
755.85s - 757.85s |  Developed by a company called ISOVIST
758.17s - 761.09s |  So again, I alluded to not talking to me about council software
761.29s - 766.77s |  It's so niche and weird and the people who develop it know councils and local government
766.81s - 769.29s |  but they might not necessarily know security and
769.97s - 773.57s |  Anyone who's able to spend time as a pen tester so much of it is vibes based
773.57s - 776.13s |  You could tell that this thing had been pen tested before
776.65s - 778.65s |  And you yeah, you could just tell
779.45s - 782.85s |  So headless PDF generation is so dumb
783.25s - 788.53s |  I'm not this is not a talk about headless PDF generation. It's a well-known and well documented attack
789.09s - 794.13s |  Surface within web applications, but sometimes you need to turn HTML into PDFs
794.69s - 795.81s |  Which is you know
795.81s - 797.89s |  There's a few well-known places you can look for bugs
798.09s - 804.33s |  Because basically HTML gives you a lot of primitives to do some fun and dangerous things such as iframes portals and beads
804.57s - 808.49s |  So these had all been blocked there had been some hardening done, which is great
809.49s - 812.33s |  However cat pictures were not blocked
813.57s - 819.81s |  so I managed to get an image tag to give up an NTLM hash on port 80 and
820.97s - 824.41s |  So my first question was what even is this?
826.05s - 828.17s |  So we talked about haiku PDF
829.01s - 837.09s |  Over a million downloads in nougat for this package nougat is the package repo for dotnet. It has a settings dot XML file and
837.81s - 841.81s |  The default property for NTLM authentication is true
842.33s - 848.45s |  so I guess I really just wanted to know how this happened and then I looked into it a bit and
848.85s - 850.85s |  I figured out how it happened
851.45s - 857.21s |  You can tell it's really high quality by the 3d rendered box art. This is the very height of technology
857.69s - 865.73s |  So the other thing we found is because of all the ArcGIS stuff Java on is is a lovely place to look
866.21s - 870.21s |  The HTTP URL connection function used to pass hashes by default
870.57s - 875.69s |  We're not entirely sure it does now and I tried a couple of chess projects to see it seems to be safe
875.85s - 880.09s |  But it is still out there causing issues see geo server and ArcGIS
880.61s - 886.53s |  So Java calls the underlying win32 API, which is a win HTTP request and blazing for sick
886.89s - 893.61s |  Have a very good write-up about coaxing things out on port 80 and they even made a stack overflow post proving it
894.13s - 901.66s |  We had to do a little Lord of the Rings mean, you know, it's compulsory we're from New Zealand we have to
903.32s - 904.36s |  So
904.36s - 909.72s |  They also have one other little security thing on Windows and that's this
910.48s - 916.40s |  Prompt that comes up now and then and it's like please don't quit me. It's unsafe. Do you really want to continue?
916.60s - 922.48s |  Are you sure you want to get hacked and then I'm sure no one clicks. Yes ever, right, right? It's a security drone
922.84s - 925.52s |  I mean, it's fair. That's probably what their lawyers want
925.52s - 931.84s |  Like they want the functionality but their lawyers are like if you don't have this prompt people get angry and we could get sued
932.60s - 937.84s |  So if you want to have a bug in a Microsoft product, you need to get past this
938.44s - 945.64s |  You need to have basically no warning that it's gotta be fun and dangerous and you're gonna get people's ashes or run some code
946.96s - 950.80s |  So with that in mind, let's see what we can find in the Microsoft ecosystem
953.04s - 957.72s |  Enter I credentials, so it's just an interface
959.68s - 962.04s |  But it does some stuff
962.60s - 968.56s |  When we first got some hashes are on 480. We started looking at the code and going what is this?
969.28s - 970.88s |  Why is this?
970.88s - 972.44s |  Turns out it's
972.44s - 975.08s |  Not banana water. It's not gross and
975.64s - 976.80s |  Made up
976.80s - 980.20s |  It's just developers making logic errors doing dumb things
980.40s - 986.28s |  it provides the base authentication interface for retrieving credentials for web client authentication and
987.72s - 989.88s |  it's used in dotnet a lot and
990.72s - 996.24s |  Some of the anti patents that it has are weird and they fall back to some dumb things
996.96s - 998.76s |  like a new gate
998.76s - 1003.04s |  so you've probably seen you get before if you've ever touched C sharp, it's
1003.88s - 1007.04s |  Reasonably integral to the dotnet ecosystem and
1008.28s - 1010.28s |  they have some very
1010.28s - 1016.40s |  Good advice for storing credentials. Just put them in the new get config file. It will encrypt it. It will be fine
1016.96s - 1023.76s |  But it also just falls back to NTLM sometimes. Hello. Yes, I would like 500 of my co-workers hashes, please
1024.28s - 1033.32s |  It does it on new get restore by the way, which it does it when you get clone something and like Visual Studio and
1034.32s - 1038.72s |  That bypasses all safety checks. There's no little don't click me button
1039.32s - 1043.24s |  So Jim got a nice new ebike from Microsoft. It's very zippy
1046.20s - 1049.48s |  Jim had to be very specific with Microsoft
1050.92s - 1055.56s |  Yeah, I had to make him a video with the breakpoint set and I had to be like it happens here
1055.56s - 1059.12s |  This is where it happens happens right here Microsoft. Please believe me
1061.02s - 1062.18s |  so
1062.18s - 1067.06s |  Just we had a random thought like what if we reframe it as an SSR of problem?
1067.06s - 1073.30s |  Like what if instead of trying to get NTLM hashes out? We pretended it was a server and not a client anymore and we just
1074.02s - 1076.38s |  Thought it was just HTTP something
1076.86s - 1078.86s |  There's a lot of harmless HTTP
1078.98s - 1082.62s |  Interactions and Microsoft products like RSS don't know why I'm mentioning that
1083.50s - 1086.54s |  You're writing schemes. Don't know why I'm mentioning that either and
1087.38s - 1089.66s |  Web service in Excel. I'm just mentioning that one
1090.26s - 1096.10s |  If you think of these interactions like a flavor of SSR if you can just find some new cool things
1097.10s - 1100.98s |  Like what if you just suddenly redirect a resource, so
1101.70s - 1105.90s |  we did that we redirected things to a nice little UNC path and
1108.34s - 1113.46s |  It just does things it just happily switches protocols and tries to auth
1114.22s - 1116.22s |  browsers don't do that browsers go like
1116.90s - 1120.94s |  Where are you trying to go? This is a dangerous redirect? Yeah
1121.58s - 1126.30s |  But we wrote some quick little code and then started pointing things at it
1127.98s - 1130.38s |  So this is Microsoft bug number two
1130.90s - 1133.90s |  So we might have rabbit holed a little bit with the URI handlers
1133.90s - 1138.78s |  A quick recap every time you install a program on Windows it installs a URI handler
1138.78s - 1143.86s |  Which is a little scheme that you can embed in a website or something to allow that program to be opened automatically
1143.86s - 1148.50s |  so I dumped every single URI scheme from my Windows machine and
1148.50s - 1152.82s |  I wanted to see which one Outlook would warn on and it was nearly all of them
1153.14s - 1156.66s |  Except for the Microsoft URI schemes, which was very weird
1156.66s - 1160.62s |  and it just straight-up opens words of Microsoft Word or Excel or
1161.22s - 1165.82s |  PowerPoint or access if anyone still uses that and fetches the remote resource
1165.82s - 1170.30s |  So now we have a little bit of an idea what to do when we fetch remote resources
1171.30s - 1176.26s |  So no warnings one click embedded in the email should be a relatively safe thing
1176.26s - 1182.58s |  So they've asked us to not spill the beans. So could anyone just like block their eyes and ears. Yeah
1183.70s - 1186.26s |  There are some security controls in place
1186.26s - 1188.74s |  All files will open in a preview mode, which is good
1188.74s - 1193.38s |  Mark of the web is on it and you can't put UNC paths in the URI scheme
1193.38s - 1196.34s |  So you can't straight-up convince someone to load a file, which is good
1197.22s - 1201.38s |  So the URI handlers essentially look like this MS Word title of the thing you want to open
1201.46s - 1205.38s |  So the URI handlers essentially look like this MS Word title of the thing you want to open
1205.70s - 1212.82s |  OFE open for editing you short for URL and then you just give it an HTTP link and a rush off and fetch that
1213.38s - 1217.74s |  And you can also force a file extension change, which is quite fun
1218.34s - 1221.75s |  And here's a little video of this happening
1223.73s - 1227.17s |  So essentially we are spinning up our little redirector in the top, right?
1227.17s - 1230.29s |  And then we spin up everyone's favorite hacking tool responder
1231.17s - 1234.81s |  And then we just go into our email and click a link I
1235.81s - 1238.13s |  Would click that link. I'll totally click that link
1239.01s - 1241.01s |  And then we link someone's hash
1246.68s - 1248.68s |  Thank you everyone
1248.76s - 1255.76s |  So there are some much better in TLM related bugs than the ones we've been showing half a leaf from checkpoint research
1256.68s - 1258.68s |  discovered a bug called Monica link and
1259.36s - 1263.68s |  So this technique allows for a different and usually blocked file extension to be loaded
1264.72s - 1267.28s |  So a whole new class of bug comes into play in
1268.72s - 1270.96s |  2024 Monica link came up. So we have
1271.60s - 1277.84s |  Two things we have test our TF in an exclamation mark and something. So we have the file moniker and the composite moniker
1278.52s - 1282.08s |  The outlook talk yesterday covered the sort of stuff a little bit as well
1282.76s - 1287.60s |  So the component object model will look up whatever is after the exclamation mark
1288.12s - 1291.00s |  Which we now potentially control through a redirect
1292.12s - 1295.56s |  We have three days left until patch Tuesday. So have fun everyone
1296.28s - 1302.36s |  So we found some more stuff. We were still bored
1303.56s - 1308.20s |  You can also bypass existing CVEs with that same one weird trick
1308.32s - 1314.84s |  So back in 2023 some researchers at Verona's discovered a nice little CVE
1315.12s - 1318.96s |  There's two email headers that this sort of affected
1319.64s - 1327.00s |  there's the content class sharing thing like you're sharing a document or a calendar or an RSS feed maybe and
1327.36s - 1331.32s |  then a X sharing content URL, which in their case they used a
1332.32s - 1333.96s |  UNC path
1333.96s - 1335.96s |  We gave it a little HTTP path
1336.84s - 1343.04s |  Microsoft's fix was to add a nice little warning. They love their warnings, but please don't click me little warning
1344.36s - 1347.40s |  Guess what happens if you just redirect it to a UNC path?
1348.40s - 1352.32s |  At Microsoft triage is it that's what happens
1353.08s - 1358.36s |  And this is essentially what it looks like. It's a Microsoft instruction telling you to click a link with no warnings
1358.88s - 1362.24s |  Seems kind of bad, right? I would add your calendar though
1364.32s - 1371.36s |  And then we dropped it to the MSRC and we had a fun little journey
1372.92s - 1376.80s |  Hi, this is classed as important and you've accepted it for immediate servicing
1376.80s - 1379.08s |  Can you please let me know if this is eligible for a bounty?
1380.28s - 1387.88s |  Now outlooks out of scope. No, it says here in the link. You just said that it is in scope
1389.56s - 1391.56s |  It's a moderate I guess
1392.52s - 1397.84s |  You just told me that it was important in the same email. Yeah, we've reclassified it. Sorry
1399.48s - 1404.16s |  Yeah, so it's fixed last patch Tuesday and it was the only moderate
1405.16s - 1408.94s |  So this is my dog Lupe
1408.94s - 1416.78s |  She recently had cruciate ligament surgery and the amount of the surgery was the same amount that a bug bounty from Microsoft would have been
1417.50s - 1423.90s |  So, you know, thanks Microsoft. Sorry again MSRC team. You're very lovely people. It's so nice
1423.90s - 1427.62s |  Oh, they also said say about the bug before that it's been feature flagged
1427.62s - 1433.74s |  So it's mostly fixed but sort of not. Yeah, I had to say that because I quite like them now
1434.26s - 1441.54s |  So RSS for all six of you still using it in Outlook
1441.66s - 1446.10s |  We discovered something called an OPM L file which allows you to import an RSS feed
1446.10s - 1450.98s |  Which is obviously critical functionality within Outlook and Microsoft
1451.78s - 1459.62s |  So interestingly the web request to be made while the warning box was showing so full marks to Microsoft for almost getting there
1461.10s - 1464.58s |  Outlook would also follow a redirect path to a UNC and like a hash and
1465.10s - 1470.66s |  We triaged it with Microsoft and they initially said yeah, it's moderate. I said cool did that make sense?
1471.34s - 1473.38s |  But now we know about these cool outlook hitters
1474.98s - 1479.46s |  So what happens if we combine URI schemes with these cool new hitters that we have
1480.18s - 1483.82s |  Outlook has a feed handler which will open RSS feed directly in Outlook
1484.94s - 1488.26s |  Obviously four slides back. That's how we know about the URI handlers
1489.02s - 1492.78s |  Under normal circumstances, it will prompt open outlook and give a warning
1493.78s - 1495.78s |  However, if you embed it in a sharing header
1496.38s - 1502.90s |  It won't warn it was initially de-prioritized by Microsoft as several clicks were involved one click
1503.78s - 1505.86s |  It's a bug but moderate
1506.38s - 1511.06s |  And this is what it looks like again Microsoft wording saying please click this thing
1511.10s - 1515.58s |  Would you click that time? I would so click to add your RSS feed. Thanks. I love RSS
1519.62s - 1522.66s |  Enter the visual studio we went back to it again
1523.66s - 1530.90s |  It can get clone things, I don't know if you're familiar with git, but it's kind of like subversion or
1531.78s - 1532.98s |  Maven
1532.98s - 1534.98s |  Now everyone knows good
1535.78s - 1538.50s |  You can get clone from a bunch of things like SSH
1538.50s - 1541.82s |  Which is one of the normal things same with like an auth HDP
1541.82s - 1545.18s |  Which is like a public github repo and you've just copy paste the link
1545.66s - 1549.94s |  Auth HDP like a private github repo and you've copy paste the link
1550.42s - 1556.70s |  You can also get clone from a file path or on Windows you can get clone from an SMB share
1557.02s - 1561.06s |  Apparently, which is weird, but like it's fine. I'm sure people do that
1561.74s - 1564.62s |  But we're just gonna focus on the auth HDP
1565.82s - 1570.30s |  So the command line, it's secure by default. It asks for auth kind of
1571.70s - 1576.14s |  But what if we just you know, don't put in a username or password? Yeah, what if Thomas let's find out
1576.14s - 1582.18s |  Surely, it just doesn't send a username in any now. They won't send anything. So by default it just sends a hash of
1582.70s - 1584.70s |  your current account
1587.18s - 1590.82s |  But like it's fine I can see the use cases for it
1590.82s - 1597.90s |  Like say you're in an internal environment and you've got like some weird web server you get clone from you probably want it most
1599.06s - 1602.92s |  But what it is is it's promising like maybe some other things
1603.78s - 1605.02s |  You know
1605.02s - 1612.42s |  They want to get you username and password and do stuff like GUI's. How do they get your get credentials? They prompt you for them
1613.50s - 1618.34s |  Yeah, yep. No, so get credential manager. It will do things for you
1619.02s - 1621.98s |  It will by default pass a blank username and password
1624.06s - 1626.26s |  Visual Studio users get credential manager
1628.02s - 1629.18s |  So
1629.18s - 1631.94s |  On the right our good old friend responder
1632.50s - 1635.90s |  That's just gonna nicely listen there and then we'll open some
1636.94s - 1640.92s |  Visual Studio and then oh
1641.76s - 1646.24s |  My co-worker sent me this cool link. I'm just gonna go get clone this that's on the internet
1646.24s - 1652.76s |  I blindly clone things all the time. I'm a security professional Thomas. I do too a bit like seriously and
1653.72s - 1656.60s |  Whoa, what's that? That's an NTLM hash that it just sent
1657.96s - 1659.52s |  Yay
1659.52s - 1665.58s |  So some fun side notes it also works in git submodules
1665.58s - 1673.42s |  So you can't just trust GitHub because you could have a nice little link to some attackers thing as a git submodule like
1673.66s - 1679.50s |  Ten folders deep. So do you know what blindly clone submodules by default Thomas? Do you have any idea?
1680.26s - 1682.94s |  Visual Studio you are correct. Oh, wow
1683.54s - 1686.22s |  It also works and things like VC package
1686.22s - 1692.86s |  You can point to a get URL and it will just also download it MPM or so for fun days and
1694.14s - 1698.94s |  Other IDs like chip brains and then like GitHub desktop. They don't do this
1699.78s - 1705.06s |  So we told Microsoft and then they came back with this fun response. We'll just give you a moment to digest this
1705.98s - 1707.98s |  Actually, I'll cut out the like
1708.62s - 1710.30s |  extra words
1710.30s - 1715.18s |  Get cloning from an untrusted source is the same as browsing an untrusted SMB share
1715.78s - 1723.00s |  Oh, is it Microsoft? Yeah, I do that all the time browsing on same. Yeah, so
1723.98s - 1729.16s |  we tried to find where the security boundary was after they came back and we were like
1730.40s - 1736.36s |  Okay, so it's not a Visual Studio problem because they said no, so maybe it's a get credential manager problem
1737.28s - 1740.36s |  But then get credential credential manager uses git
1740.96s - 1748.04s |  But get users look curl which is compiled with the using TLM flags, but it's actually a Visual Studio problem, but
1749.76s - 1756.16s |  We don't know where the problem is it's sort of everywhere but nowhere and no one wants to take blame for it really
1757.68s - 1761.20s |  Microsoft will patch anything that you can prove that it's in their products
1762.80s - 1764.52s |  Anything else
1764.52s - 1766.52s |  That's a Windows problem
1767.40s - 1774.90s |  You can use that on your next red team, I guess if you want to hack some developers
1775.58s - 1780.48s |  so where we ended up was
1782.12s - 1784.90s |  We have four bugs reported to MS
1785.64s - 1790.00s |  Two bounties and one swag. I'm so sorry to my dog from the previous slides
1790.00s - 1792.88s |  Your surgery came later than expected for some mad reason
1793.52s - 1795.52s |  One not a bug which which is git
1796.52s - 1801.92s |  One yes, it's a bug but it's not a priority. I mean, that's fair. It's irises and
1803.08s - 1806.56s |  You know to get to this point. We have a very very rigorous methodology
1806.96s - 1809.60s |  Obviously, I mean I have a spreadsheet
1810.80s - 1812.80s |  It's actually a text file on my desktop
1813.32s - 1821.88s |  So yeah, this is basically how we found all these bugs anywhere you see an HTTP
1821.88s - 1827.68s |  Just put a responder URL and see what Windows does and you'll be delighted with the results image tag
1827.68s - 1831.08s |  Do it sharing tag do it RSS
1832.60s - 1834.40s |  RSS
1834.40s - 1837.87s |  So we do next
1838.55s - 1843.83s |  There are a lot of places. This could be a thing and I mean, it's just HTTP. So like
1845.15s - 1849.67s |  Build servers they can have links out of every blue. Yeah
1850.59s - 1857.63s |  Pipelines, they could have links document processing things like I don't know PDF generators. Yeah, they could do it, too
1858.43s - 1863.99s |  Maybe word has it maybe teams has it. No one uses teams though. So no one uses teams. Yeah
1864.79s - 1867.55s |  Maybe video games. I don't know maybe drop a link in chat
1867.95s - 1872.91s |  Yeah, I reckon video games is what something I want to look at because I like playing video games for research
1872.91s - 1874.91s |  Yeah, I should do that in work time
1875.15s - 1877.15s |  Our boss is here
1878.63s - 1882.03s |  Basically anywhere you could put a URL and it's probably a good place to start
1882.15s - 1887.43s |  But also we want to talk to you folks as well because there's probably a lot of people out there who have some great ideas
1887.63s - 1889.63s |  Of where to look so we would like to give
1890.87s - 1896.27s |  Yeah, and just go turn in tell him off if you can it probably will break everything but turn it off
1896.27s - 1901.87s |  Yeah, turn it off and then turn it back on immediately when someone screams. Yeah use Kerberos because that's more secure
1903.59s - 1907.79s |  Yeah, this is the end of our talk we have speedrun it much like our NTLM bugs
1908.47s - 1912.63s |  But finding bugs doesn't happen in isolation. So a big thank you to everyone named
1913.15s - 1916.91s |  Yeah, and thank you for the MSRC for listening and meeting with us
1916.91s - 1921.27s |  They are genuinely good folks who they need more of them because there's only 30 of them
1921.55s - 1925.71s |  Apparently which is not nearly enough and thanks for inviting us to your party as well. That was fun
1925.71s - 1930.43s |  Yeah, that was good. And thank you for everyone who has published the research. This is something I don't say lightly
1931.31s - 1938.91s |  Every piece of research published leads to more research. So please keep disclosing. Please keep blogging. It's so good reading it
1939.43s - 1940.71s |  And
1940.71s - 1942.71s |  Also, thank you for the DEF CON organizers
1942.79s - 1948.11s |  You guys are awesome and hacking is a team sport and please come up to us afterwards if you have any ideas where to get
1948.11s - 1953.71s |  Hashes out of we want to know we want more moderates that we don't get bounties for perfect
1954.35s - 1964.93s |  There is a microphone there for tall people who can ask questions
1973.79s - 1978.76s |  Cool. All right. Thanks everyone
1980.10s - 1982.10s |  Thank you


url: https://www.youtube.com/watch?v=yTDCt4rvR7s
title: DEF CON 32 - Hacker Jeopardy - Night 2
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=yTDCt4rvR7s",
  "title": "DEF CON 32 - Hacker Jeopardy - Night 2",
  "description": "The thrilling conclusion to DEF CON 32's Hacker Jeopardy Contest!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 5221,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241008"
}

2.64s - 6.64s | This text was transcribed using whisper model: large-v2

 Ladies and gentlemen, Wayne Schwartau and Miss Kitty.
6.64s - 20.86s |  All right, it's second night and you showed up again. That was stupid.
20.86s - 25.86s |  We were hoping to get out of here by 8.30, but that's not going to fucking happen.
25.86s - 29.86s |  All right, hopefully you guys, I'm going to really do another shout out.
29.86s - 36.86s |  You guys have no idea how hard this crew of 14, 15 people,
36.86s - 41.86s |  how much work goes into actually making this thing look like it's easy.
41.86s - 47.86s |  It's fucking hard. Let's hear it, please, again for the entire DFI crew.
47.86s - 58.75s |  And yesterday I forgot entirely, my bad, to shout it out.
58.75s - 62.75s |  We used to have Beer Bettys, we used to have Vina Vandals,
62.75s - 65.75s |  and a few of you are out there who used to be up here.
65.75s - 70.75s |  But now we have the Lentile Lookalikes who are doing an awesome job.
70.75s - 78.81s |  Kitty, what do you want to say?
78.81s - 82.81s |  I want to say hi, thank you for coming to my birthday party.
82.81s - 89.17s |  Should I tell you guys my real age?
89.17s - 91.17s |  Shut up.
91.17s - 93.17s |  Fifty fucking five years old.
93.17s - 96.50s |  Let's hear it.
96.50s - 99.50s |  And fucking DEF CON always happens on my birthday,
99.50s - 103.50s |  so I always quietly spend my birthday with you guys.
103.50s - 105.50s |  But now you know. So there you go.
105.50s - 109.50s |  Anyway, I have three words for you.
109.50s - 129.97s |  No.
129.97s - 131.97s |  And there's a little surprise this evening.
131.97s - 135.97s |  We have a very, very special guest who has disappeared.
135.97s - 139.97s |  What the hell? It's a big surprise.
139.97s - 141.97s |  She was sitting down.
141.97s - 144.97s |  I want to introduce you to somebody who is very special,
144.97s - 147.97s |  somebody I've known for quite a few years,
147.97s - 149.97s |  and she's going to have a few words for you.
149.97s - 153.97s |  Please welcome, stand up with honor,
153.97s - 155.97s |  Kimberly Mitnick.
179.21s - 182.21s |  Who's this special person that you're talking about?
182.21s - 184.21s |  I'm like, where is this person?
184.21s - 188.21s |  No, I was always happily behind the curtains,
188.21s - 191.21s |  don't at all need any acknowledgement whatsoever,
191.21s - 193.21s |  but I just want to say to everyone in the community,
193.21s - 195.21s |  thank you for all the love, you know,
195.21s - 199.21s |  for the past year that everyone has given for Kevin.
199.21s - 202.21s |  Whether it's love and hate, let's be honest.
202.21s - 205.21s |  I admit, right, I see it, I acknowledge it,
205.21s - 207.21s |  but there's a lot of love,
207.21s - 209.21s |  and there's a few special shout-outs that I want to give,
209.21s - 211.21s |  especially to Dave Kennedy.
211.21s - 213.21s |  I really appreciate it.
213.21s - 216.21s |  I don't know if he's here, if he is here or not,
216.21s - 219.21s |  but he's done such amazing, just sharing the stories,
219.21s - 221.21s |  and I really appreciate everyone sharing those stories,
221.21s - 225.21s |  because, I mean, that's really what keeps Kevin alive,
225.21s - 229.21s |  and that's really important to me as well.
229.21s - 230.21s |  And I also want to...
230.21s - 233.21s |  There's actually a few of our Mitnick security team here,
233.21s - 236.21s |  and so, guys, raise your hands.
236.21s - 243.77s |  I'm going to keep this very short,
243.77s - 245.77s |  because I know it is very short,
245.77s - 248.77s |  but I do have some of Kevin's Lockpick business cards,
248.77s - 250.77s |  and I know that a few people wanted them,
250.77s - 252.77s |  and they still are in production.
252.77s - 253.77s |  Don't worry.
253.77s - 254.77s |  I'm happy to give them out.
254.77s - 255.77s |  You know, come meet me.
255.77s - 256.77s |  I'm here.
256.77s - 257.77s |  After.
257.77s - 258.77s |  Afterwards.
258.77s - 259.77s |  After.
259.77s - 260.77s |  Okay, after, after.
260.77s - 261.77s |  All right, thanks, everyone.
261.77s - 269.19s |  All right, Fizz, let's get this shit show on the road.
269.19s - 276.52s |  Hacker Jeopardy 30, let's rock it!
276.52s - 284.52s |  Acronym used for the U.S. Armed Forces five levels of alert.
284.52s - 285.52s |  What is DEFCON?
285.52s - 286.52s |  That's it.
286.52s - 294.70s |  Yes, you've heard it often in movies.
294.70s - 295.70s |  32.
295.70s - 296.70s |  32.
296.70s - 297.70s |  32.
297.70s - 298.70s |  32.
298.70s - 299.70s |  32.
299.70s - 300.70s |  32.
300.70s - 301.70s |  32.
301.70s - 302.70s |  32.
302.70s - 303.70s |  You go to DEFCON 1.
303.70s - 304.70s |  No, 32.
304.70s - 307.70s |  Welcome to Hacker Jeopardy.
307.70s - 310.70s |  Welcome to Hacker Jeopardy.
310.70s - 311.70s |  Anniversary.
311.70s - 313.70s |  At DEFCON 32.
313.70s - 314.70s |  Starring.
315.70s - 371.03s |  Fuck It Up.
371.03s - 372.03s |  Don't Fuck It Up.
372.03s - 374.03s |  Don't Fuck It Up.
374.03s - 375.03s |  Don't Fuck It Up.
375.03s - 376.03s |  Don't Fuck It Up.
376.03s - 377.03s |  Don't Fuck It Up.
377.03s - 378.03s |  Don't Fuck It Up.
378.03s - 379.03s |  Don't Fuck It Up.
379.03s - 380.03s |  Don't Fuck It Up.
380.03s - 381.03s |  Don't Fuck It Up.
381.03s - 382.03s |  Don't Fuck It Up.
382.03s - 383.03s |  Fuck It Up.
383.03s - 386.53s |  Fuck It Up.
386.53s - 387.53s |  Don't Fuck It Up!
387.53s - 398.57s |  Without further ado, the man you've been waiting for,
398.57s - 401.57s |  for 30 fucking years…
426.15s - 427.15s |  Everything that's happened tonight.
427.15s - 430.75s |  one of my favorite nights of every year
430.75s - 432.51s |  because this is almost like church
432.51s - 434.95s |  where we get to talk about all the things
434.95s - 436.89s |  that have happened over the last year
436.89s - 439.45s |  and have a couple of moments of laughs together.
439.45s - 442.09s |  We've got three teams that are gonna do awesome tonight.
442.09s - 445.03s |  We've got special guests out the wazoo.
445.03s - 447.27s |  We're here for you, DEF CON,
447.27s - 455.26s |  so let's have some good times, right?
455.26s - 457.76s |  Teams winning in game one,
457.76s - 460.86s |  bestowed in something that's really not amenable
460.86s - 463.22s |  to wearing in the Vegas heat.
463.22s - 490.82s |  They are.
490.82s - 492.74s |  Computer is your.
492.74s - 520.96s |  On this stage, more than all you motherfuckers
520.96s - 522.18s |  have put together.
522.18s - 537.36s |  They are.
537.36s - 539.16s |  With the very same machine.
540.72s - 542.88s |  Oh fuck yeah, we've got some teams.
542.88s - 544.32s |  Hey audience, are you ready?
544.32s - 552.89s |  I have to tie my shoe, hold on.
554.41s - 555.57s |  I'm good, thanks.
555.57s - 557.05s |  You fucking cocktease.
557.05s - 558.49s |  Let's fucking go.
558.49s - 559.41s |  Let's play.
559.41s - 569.84s |  It is my distinct pleasure to present to you
569.84s - 572.32s |  the categories for the first round tonight.
572.68s - 573.88s |  And they are.
573.88s - 591.37s |  General Nerdery edition.
591.37s - 599.92s |  Fucking sell out.
599.92s - 603.40s |  It's a first debut at the 30th anniversary.
603.40s - 608.71s |  We've got people here that are part of the DFIU clue group.
608.71s - 615.14s |  Cheer louder for them, you'll like to see them, I promise.
615.14s - 619.02s |  And finally, that's what she said.
623.51s - 626.75s |  Pandemonium, as you are closest to me,
626.75s - 630.63s |  you have an added benefit of picking the first category.
631.47s - 637.82s |  Audience, are we ready to play Hacker Jeopardy?
637.82s - 642.82s |  Let's get started with the DFIU clue crew for 100.
646.02s - 648.38s |  DFIU clue crew for 100.
648.38s - 650.22s |  I'm welcoming to the stage,
650.22s - 661.56s |  Helen of Tor from VX Underground.
661.56s - 662.76s |  Here we go.
662.76s - 666.28s |  At DEF CON 27, Hacker Jeopardy contestants
666.28s - 671.10s |  were asked to name the port that Telnet is on.
671.10s - 673.02s |  Yeah, if you were there, you know where I'm going with this.
673.02s - 675.82s |  Not only were they hilariously incorrect,
675.82s - 678.70s |  they skipped over the correct response.
678.70s - 682.02s |  These were the three incorrect ports answered.
683.82s - 686.81s |  Ooh.
686.81s - 688.81s |  The three incorrect ports answered
688.81s - 691.53s |  when guessed the Telnet, the origination of the meme.
691.53s - 694.16s |  What are they?
694.16s - 695.40s |  All right, well, guess what?
695.40s - 696.56s |  That was the hundred.
699.64s - 703.62s |  You fucked it up.
703.62s - 705.50s |  Going once.
705.50s - 706.94s |  This is going great already.
708.18s - 716.02s |  Going twice.
716.02s - 717.42s |  What is wrong?
718.54s - 720.26s |  I'm not calling on Gmark.
720.26s - 731.75s |  Right over here.
731.75s - 733.03s |  All right, well, this makes me feel great
733.03s - 734.43s |  about how this is gonna go.
735.83s - 737.79s |  All right, back to the board, Pandas.
737.79s - 740.15s |  Let's go with the clue crew for 200.
740.15s - 741.99s |  Clue crew for 200.
741.99s - 750.76s |  Welcome to the stage.
750.76s - 752.12s |  What's going on, DEF CON?
752.12s - 757.51s |  How are we doing?
757.51s - 761.03s |  If you hit the left jab at exactly 30 seconds,
761.03s - 763.35s |  you will instantly knock out this boxer
763.35s - 769.82s |  in the NES version of Mike Tyson's Punch-Out.
769.82s - 771.06s |  Don't worry, I'll wait.
771.06s - 775.43s |  This is fun for me.
775.43s - 777.90s |  You know what?
777.90s - 781.72s |  The audience, if this doesn't work.
781.72s - 782.56s |  I believe in you.
782.56s - 784.16s |  Going once.
784.16s - 801.90s |  Going twice.
801.90s - 811.46s |  We have the CDW.
811.46s - 812.90s |  Well, this is fun.
812.90s - 814.86s |  Where are you going next, Pandemonium?
815.90s - 820.26s |  Let's keep this train wreck going for 300.
820.26s - 823.38s |  For the $300 clue, I welcome to the stage,
823.38s - 834.60s |  John Hammond.
834.60s - 835.72s |  Ed Sharan?
835.72s - 836.56s |  Is that you?
836.56s - 838.16s |  Thanks, guys.
838.16s - 840.24s |  All right, hey, this is supposed to be a funny one,
840.24s - 843.04s |  so if you could get some audience interaction at the end,
843.04s - 845.36s |  I'd love for you to lean into the joke here.
845.36s - 847.60s |  This is the colloquial name
847.60s - 850.36s |  for an exponential denial-of-service attack
850.36s - 861.59s |  via XML parsers.
861.59s - 862.43s |  Yeah, you did.
862.43s - 863.79s |  I know I most did.
863.79s - 864.63s |  You didn't hit it.
864.63s - 865.47s |  We hit the one.
865.47s - 868.03s |  Did they fuck it up?
868.03s - 888.40s |  Did they fuck it up?
888.40s - 906.00s |  Fuck it, we'll do it in prod.
906.00s - 907.80s |  Can I do my job now, Dave?
908.76s - 910.60s |  It wasn't seen already.
910.60s - 911.60s |  Well, what now?
911.60s - 912.60s |  There's no team lit up.
912.60s - 917.33s |  What am I gonna do?
917.33s - 929.76s |  What is the billion laughs attack?
929.76s - 932.36s |  Somebody's obviously low on potassium.
932.36s - 936.44s |  Back to the board, OnlyLens.
936.44s - 938.48s |  Let's go for fucking sellouts for 100.
938.48s - 939.40s |  Oh, thank God.
940.92s - 942.52s |  Fucking sellouts for 100.
943.84s - 953.10s |  This company sold out one of its philosophies long...
953.10s - 954.10s |  Pandemonium.
955.14s - 956.98s |  Who is Google?
956.98s - 958.14s |  Who the fuck is Google?
958.94s - 962.47s |  It's correct.
962.47s - 964.43s |  People, that's who Google is.
964.43s - 968.72s |  Back to the board, Pandas.
968.72s - 969.64s |  For 200.
969.64s - 970.48s |  For two.
971.92s - 974.04s |  This fucking bullshit artist
974.04s - 978.08s |  sold the security awareness company to know before.
979.32s - 980.56s |  Pandemonium.
980.56s - 985.33s |  Who is Kevin Mitnick?
985.33s - 990.27s |  Is wrong.
990.27s - 995.49s |  Awkward.
995.49s - 997.21s |  She's right there.
998.33s - 1000.13s |  I sit in the social engineering village.
1000.13s - 1001.49s |  We're all bullshit artists.
1001.49s - 1002.61s |  That's a compliment.
1002.61s - 1003.77s |  We know.
1008.70s - 1010.06s |  Going once.
1010.06s - 1011.38s |  This is so funny to me.
1011.38s - 1013.10s |  Going twice.
1013.10s - 1013.94s |  I don't care.
1013.94s - 1015.10s |  This is my favorite moment so far.
1015.10s - 1028.50s |  Out to the audience.
1028.50s - 1029.78s |  Who is Gregory D. Evans?
1029.78s - 1040.37s |  Is wrong.
1040.37s - 1042.41s |  Yep, nope, that's the favorite one so far.
1042.41s - 1043.45s |  Back to the board.
1043.45s - 1054.42s |  Pandas, you are in the hole.
1054.42s - 1058.76s |  Grifter, are you fucking serious?
1058.76s - 1061.96s |  I'm sorry, but if those of you in the front didn't hear that
1061.96s - 1065.00s |  and those in the back definitely didn't hear that,
1065.00s - 1067.56s |  my beautiful, beautiful Frank Grifter
1068.44s - 1071.16s |  just told me that Jeff Moss just texted him
1071.16s - 1073.76s |  and said that the outcome of this match
1073.76s - 1083.32s |  is now a black badge event.
1083.32s - 1101.78s |  I'm sorry, I've got tango.
1101.78s - 1102.62s |  Away from them.
1102.62s - 1103.90s |  I'll convince Jeff not to give it to you
1103.90s - 1105.66s |  if you don't fucking do great.
1105.66s - 1107.02s |  Let's go back to the board.
1107.02s - 1109.02s |  Pandemonium, here we go.
1109.02s - 1109.94s |  For 300.
1109.94s - 1126.63s |  For three.
1126.63s - 1129.99s |  You can wager any or all of up to 500 points.
1129.99s - 1135.50s |  Audience, how much should they wager?
1135.50s - 1137.06s |  Go big or go home, 500.
1137.06s - 1144.60s |  Fucking sellouts.
1144.60s - 1147.96s |  This colorful character sold his software company in 1994
1147.96s - 1150.56s |  and once claimed he was arrested in Norway
1150.56s - 1160.67s |  for using a thong for a face mask during COVID.
1160.67s - 1162.79s |  I love, I'm loving the audience murmur.
1162.79s - 1164.75s |  That's fucking solid murmur, folks.
1164.75s - 1168.31s |  Goddamn.
1168.31s - 1169.55s |  They're gonna show us up.
1169.55s - 1170.39s |  Play next year.
1170.39s - 1171.95s |  Pandas, I'm gonna need an answer.
1171.95s - 1173.39s |  Who is John McAfee?
1173.39s - 1188.23s |  Who is John McAfee?
1188.23s - 1189.99s |  We were gonna call him Cocaine Bear,
1189.99s - 1191.03s |  but didn't want to insult you.
1191.03s - 1193.71s |  I would have also accepted Hammock Shitter.
1193.99s - 1195.55s |  400, fucking sellouts.
1195.55s - 1197.67s |  400 for sellouts.
1197.67s - 1199.87s |  Peter Norton sold his highly successful
1199.87s - 1202.27s |  early security and utility company,
1202.27s - 1207.27s |  sorry, software, to this shitty A.V. company in 1990.
1207.47s - 1210.25s |  Who was Symantec?
1210.25s - 1211.17s |  Who is Symantec?
1211.17s - 1213.85s |  Or whatever the fuck they're called now is correct.
1213.85s - 1222.46s |  Stepmom, you seem to be stuck.
1222.46s - 1223.62s |  Free beer.
1223.62s - 1224.70s |  At zero.
1224.70s - 1225.54s |  Free beer.
1225.54s - 1226.38s |  All right.
1226.38s - 1227.70s |  Guess the whole Black Badge thing
1227.70s - 1229.78s |  didn't really change your opinion on that?
1229.78s - 1234.06s |  Oh, that was gross.
1234.06s - 1235.82s |  OnlyLands, back to the board.
1235.82s - 1237.50s |  Sellouts for five.
1237.50s - 1239.06s |  Sellouts for five.
1239.06s - 1242.78s |  The CEO of Twitter, before they sold to
1242.78s - 1245.30s |  and were bought by or whatever,
1245.30s - 1248.30s |  the very stable genius, Elon Musk.
1249.66s - 1250.50s |  Stepmoms.
1251.42s - 1253.06s |  Who is Jack Dorsey?
1253.06s - 1254.86s |  Is incorrect.
1254.86s - 1262.42s |  Somehow you just fucked it up.
1262.42s - 1267.77s |  Back to, sorry, OnlyLands or Pandas?
1267.81s - 1270.09s |  OnlyLands or Pandas?
1270.09s - 1271.65s |  Going once.
1271.65s - 1273.21s |  Going twice.
1274.57s - 1283.14s |  I'm gonna give away something good for this one.
1283.14s - 1288.14s |  Away, one of the HAL 9000 badges from Hacker Jeopardy.
1289.14s - 1293.61s |  Right over there, flashlight.
1293.61s - 1294.97s |  Incorrect.
1294.97s - 1305.97s |  Right there, waving on your chair.
1305.97s - 1309.13s |  I should mention that receipt of this badge
1309.13s - 1314.13s |  is early lifetime entry to Hacker Jeopardy before the line.
1318.51s - 1319.91s |  There's two more we're giving away.
1319.91s - 1321.91s |  I bet you want one.
1321.91s - 1327.87s |  All right, OnlyLands, you're in control of the board.
1327.87s - 1329.59s |  That's what she said for 100.
1329.59s - 1334.14s |  That's what she said for 100.
1334.14s - 1336.14s |  She was born in 1906.
1336.14s - 1338.10s |  The most important thing I've accomplished
1338.10s - 1344.18s |  other than building the compiler is training young people.
1344.18s - 1345.26s |  Pandemonium.
1345.26s - 1346.34s |  Who is Grace Hopper?
1346.34s - 1356.19s |  Who is rear at?
1356.19s - 1358.47s |  Let's, that's what she said for 200.
1358.47s - 1360.83s |  That's what she said for two.
1360.83s - 1362.51s |  Born in 1867.
1362.51s - 1365.11s |  We must not forget that when radium was discovered,
1365.11s - 1369.90s |  no one knew that it would prove useful in hospitals.
1369.90s - 1370.74s |  Stepmoms.
1370.74s - 1371.94s |  Who is Madame Curie?
1371.94s - 1373.66s |  Who is Madame Marie Curie?
1373.66s - 1384.03s |  Is correct.
1384.03s - 1385.87s |  Lynn Tyler, your stepmom would like to go with
1385.87s - 1387.79s |  that's what she said for 300.
1388.79s - 1390.95s |  That was complicated and a lot of backstory,
1390.95s - 1392.27s |  but we'll go for 300.
1401.59s - 1405.10s |  Fuck it up.
1405.10s - 1413.94s |  Make yourself out of the hole if you wager any or all.
1413.94s - 1414.86s |  Here's your clue.
1416.26s - 1418.06s |  Born in 1815.
1418.06s - 1420.78s |  The analytical engine weaves algebraic patterns
1420.78s - 1424.30s |  just as the jacquard loom weaves flowers and leaves.
1433.00s - 1436.56s |  Easy, we're positive here until they get it wrong.
1436.56s - 1438.96s |  Wait till they get it wrong before being angry.
1438.96s - 1440.40s |  Who is Ada Lovelace?
1440.40s - 1441.52s |  Who is Ada Lovelace?
1441.52s - 1453.06s |  Is correct.
1453.06s - 1454.22s |  400.
1454.22s - 1455.06s |  For four.
1456.62s - 1458.18s |  Born in 1918.
1458.18s - 1459.66s |  Everything was so new.
1459.66s - 1462.54s |  The whole idea of going to space was new and daring.
1462.54s - 1469.57s |  There were no textbooks, so we had to write them.
1469.57s - 1470.93s |  The silence is deafening.
1470.93s - 1473.63s |  You have to fill it.
1473.63s - 1476.40s |  Going once.
1476.40s - 1479.95s |  Going twice.
1479.95s - 1489.51s |  Yes, waving guy.
1489.51s - 1492.99s |  Have a movie to add to your list.
1492.99s - 1495.03s |  All right, back to the board, stepmoms.
1496.03s - 1497.63s |  Stepmoms?
1497.63s - 1498.67s |  500.
1498.67s - 1499.51s |  For five.
1501.15s - 1502.71s |  Born in 1914.
1502.71s - 1505.59s |  Films have a certain place in a certain time period.
1505.59s - 1509.89s |  Technology is forever.
1509.89s - 1514.05s |  Sorry, we're hopping around here.
1514.05s - 1515.05s |  Yeah.
1515.05s - 1516.65s |  This is so quiet.
1516.65s - 1518.41s |  Everybody's enwrapped with this question.
1518.41s - 1519.25s |  I love it.
1519.25s - 1520.85s |  There's like one excited hand in the way.
1520.85s - 1521.89s |  Going once.
1521.89s - 1523.93s |  Yeah, call that guy.
1523.93s - 1527.55s |  Going twice.
1527.55s - 1544.25s |  Guy doing the Guy Fawkes cosplay.
1544.25s - 1550.77s |  Buh, buh, buh, buh.
1550.77s - 1552.61s |  Did you fucking uninstall CrowdStrike
1552.61s - 1554.21s |  before we fucking did this shit?
1577.15s - 1579.75s |  Hands on the computer so there's no physical way
1579.75s - 1580.63s |  it's my fault.
1583.23s - 1590.97s |  And that would be the first time that has ever been true.
1590.97s - 1609.20s |  Does anybody in here know how to fix a computer?
1609.20s - 1618.97s |  This is girlfriend.
1618.97s - 1624.17s |  There's vegans in the crowd for fuck's sake.
1624.17s - 1627.13s |  When does a joke become a dad joke?
1627.13s - 1628.45s |  No, fuck off.
1628.45s - 1629.65s |  When it's apparent.
1629.65s - 1643.98s |  Leave it to the stepmoms to leave me disappointed.
1643.98s - 1646.62s |  I'm looking for another stepmom for the children, so.
1648.34s - 1653.24s |  Do you know what a pirate's favorite letter is?
1653.24s - 1655.08s |  You think it'd be the R, but it'd really be the C.
1655.08s - 1664.51s |  You would think it is Otter, tis the C they love.
1664.51s - 1665.47s |  Wait, I thought it was.
1666.27s - 1667.27s |  There's three stepmoms in your area.
1667.27s - 1678.95s |  They would just be irate.
1678.95s - 1680.31s |  We're almost there, folks.
1680.31s - 1681.71s |  Just give us another second.
1682.91s - 1690.83s |  Who wants panda facts?
1690.83s - 1692.83s |  I would like to say Hacker Jeopardy! this year
1692.83s - 1697.11s |  is brought to you by the illustrious, well-tested hardware
1697.11s - 1701.33s |  by the Apple Computer Company.
1701.33s - 1702.69s |  I think they were sponsoring us,
1702.69s - 1705.05s |  but now that it's been a fucking shit show,
1705.05s - 1707.33s |  they certainly have in retrospect.
1710.72s - 1715.04s |  What was it, clown strike?
1715.04s - 1716.60s |  Why are you looking at me like that, Mog?
1716.60s - 1717.56s |  I don't like that.
1720.74s - 1724.68s |  Yeah, right?
1724.68s - 1725.52s |  It's gonna be so much.
1725.52s - 1726.48s |  Crowd struck again.
1733.20s - 1735.08s |  I'm gonna eat a bag of dicks.
1735.08s - 1735.92s |  Yeah.
1735.92s - 1736.76s |  Oh.
1736.76s - 1738.56s |  Would anyone else like to eat a bag of dicks?
1738.56s - 1739.64s |  I have some.
1739.64s - 1775.94s |  Quick, quick, replay the logs.
1775.94s - 1787.52s |  Replay the logs into it.
1787.52s - 1791.56s |  Sample this.
1791.56s - 1795.42s |  You fucked it up.
1795.42s - 1802.78s |  Was this sponsored by Red Hat System D and Journal D?
1802.78s - 1817.33s |  Yeah, and.
1817.33s - 1819.81s |  I hear Microsoft Recall can help with this.
1819.81s - 1828.06s |  Yeah, you got that backwards.
1828.06s - 1829.58s |  Backwards.
1829.58s - 1833.70s |  Check the bod.
1833.70s - 1835.38s |  Who's in control of the board?
1835.38s - 1836.86s |  Sorry.
1836.86s - 1837.98s |  Only lands, right?
1840.86s - 1843.82s |  Should we check our bod?
1843.82s - 1844.66s |  It's fine, go ahead.
1844.66s - 1845.50s |  Fuck it.
1845.50s - 1849.73s |  Only lands, you're in control of the board.
1849.73s - 1850.81s |  Test and prod.
1850.81s - 1851.73s |  We will in a minute.
1851.73s - 1854.85s |  All right, we'll take General Nerdery for 100.
1854.85s - 1855.69s |  Oh, thank God.
1855.69s - 1856.53s |  General Nerdery.
1856.53s - 1864.98s |  Hi, everybody, welcome to Hacker Jeopardy!
1865.02s - 1867.46s |  The original number associated with the first
1867.46s - 1871.78s |  Enterprise on Star Trek TNG.
1871.78s - 1876.70s |  What is the NCC-1701-D, like the big D?
1876.70s - 1881.63s |  Incorrect.
1881.63s - 1895.31s |  Pandemonium, going twice.
1895.31s - 1896.31s |  To the audience.
1896.31s - 1897.39s |  Nobody else has anything.
1897.39s - 1901.14s |  Okay, Render Man.
1901.14s - 1906.82s |  Not in the form of a question!
1906.82s - 1936.51s |  You fucked it up.
1936.51s - 1961.20s |  Hey, is it NCC-1701?
1961.20s - 1965.26s |  I don't care what you say, it's C, fuck up.
1965.26s - 1966.38s |  General Nerdery.
1967.26s - 1990.49s |  Let's see if we have better luck with 200.
1990.49s - 1991.85s |  Hey, hey, hey, careful.
1991.85s - 1992.69s |  They're still not getting points.
1992.69s - 1995.05s |  You booing him gives him power.
1996.25s - 2000.51s |  No, it's mine.
2000.51s - 2002.55s |  I don't fucking care, back to the board.
2002.55s - 2011.58s |  Pandemonium.
2011.58s - 2013.18s |  Let's pick one.
2013.18s - 2014.46s |  Let's try 200.
2014.46s - 2015.78s |  200 for thank you.
2016.62s - 2018.94s |  This Gary Gygax, Dave Arness in creation
2018.94s - 2021.10s |  turned 50 this year.
2021.10s - 2022.30s |  Pandemonium.
2022.30s - 2024.26s |  What is Dungeons and Dragons?
2024.26s - 2031.50s |  What is D&D is correct!
2031.50s - 2032.50s |  For 300.
2035.10s - 2037.50s |  To wish someone good fortune in this language,
2037.50s - 2038.62s |  you might say ka-plow.
2040.26s - 2041.10s |  Onlylands.
2041.10s - 2042.02s |  What is Klingon?
2042.02s - 2047.37s |  What is Klingon is correct!
2048.73s - 2053.36s |  Onlylands, you're back to the board.
2053.36s - 2057.40s |  Post Malone paid north of $2 million for The One Ring,
2057.40s - 2060.36s |  a crossover of Lord of Rings and this game.
2061.96s - 2062.80s |  Onlylands.
2062.80s - 2063.80s |  What is Magic the Gathering?
2063.80s - 2065.68s |  What is Magic the Gathering?
2065.68s - 2075.37s |  Hope you found the shiny Hacker Jeopardy is correct!
2075.37s - 2076.49s |  Back to the board.
2076.49s - 2077.53s |  For five.
2077.53s - 2078.37s |  For five.
2079.57s - 2082.25s |  This company produced Star Wars action figures
2082.25s - 2084.05s |  starting in 1978.
2084.05s - 2086.17s |  Do you know how much those are worth?
2086.17s - 2087.73s |  Like mint in box?
2089.45s - 2090.81s |  Pandemonium.
2090.81s - 2092.41s |  What is Kenner?
2092.41s - 2103.58s |  What is Kenner?
2103.58s - 2105.90s |  Nat, O-M-F-G for 100.
2105.90s - 2109.06s |  These are all things that are related to the NATO alphabet.
2114.04s - 2116.52s |  The first code word in the NATO alphabet.
2117.52s - 2118.76s |  Onlylands.
2118.76s - 2119.60s |  What is alpha?
2120.44s - 2121.44s |  What is alpha is correct!
2127.57s - 2128.41s |  Two.
2128.41s - 2129.89s |  For two.
2129.89s - 2133.21s |  Whiskey Tango Foxtrot is commonly used
2133.21s - 2136.01s |  to replace this more obscene phrase.
2136.89s - 2137.89s |  Pandemonium.
2137.89s - 2139.53s |  What the fuck?
2139.53s - 2143.31s |  Not in the fucking...
2143.31s - 2155.22s |  What is, what the fuck?
2155.22s - 2162.28s |  Starting with what is a question?
2162.28s - 2163.28s |  The fuck?
2167.86s - 2169.78s |  It is if you pay enough.
2169.78s - 2171.26s |  Yeah, it's certainly a question,
2171.26s - 2173.62s |  but if the answer was the fuck,
2173.62s - 2176.74s |  which is, again, what my feeling is most of the time
2176.74s - 2178.90s |  when I'm hosting this show.
2178.90s - 2180.34s |  If that was the answer, I'd give it to you,
2180.34s - 2181.66s |  but it's not what is what the fuck,
2181.66s - 2183.42s |  what the fuck, what the fuck.
2183.42s - 2184.26s |  Back to the board.
2184.26s - 2185.10s |  Stepmoms.
2188.46s - 2191.66s |  The fuck?
2191.66s - 2192.70s |  That was a callback.
2192.70s - 2196.25s |  NATO for five.
2196.25s - 2197.49s |  What?
2197.49s - 2199.01s |  NATO for five.
2199.01s - 2203.38s |  Hacker Jeopardy spelled out in NATO code words.
2203.38s - 2205.58s |  You get one chance in 10 seconds.
2207.30s - 2208.50s |  Stepmom.
2208.50s - 2212.58s |  What is Hotel Alpha Charlie Kilo Echo Romeo
2212.58s - 2217.58s |  Juliet Echo Oscar Papa Alpha Romeo Delta Yankee?
2233.81s - 2237.17s |  Maple syrup and call him the Canadian military.
2237.17s - 2238.29s |  I fucking can't.
2238.29s - 2239.49s |  Oh my God.
2239.49s - 2240.49s |  Did that give you the Elsa?
2240.49s - 2241.33s |  You hot?
2241.33s - 2242.77s |  That was hot.
2242.77s - 2244.89s |  Back to the board, stepmoms.
2244.89s - 2247.25s |  Foxtrot, Oscar, uniform, Romeo.
2248.81s - 2250.89s |  For four, got it.
2269.14s - 2272.02s |  Training pays off because you've hit the daily double.
2272.02s - 2274.10s |  Are you gonna wager any or all of it?
2274.10s - 2281.53s |  Alpha Lima Lima.
2281.53s - 2283.77s |  800, here's your clue.
2283.77s - 2287.37s |  DFIU spelled out in NATO code words.
2287.37s - 2290.65s |  What is Delta Foxtrot India uniform?
2290.65s - 2301.22s |  It's gonna be standing up like he did any of that shit.
2302.38s - 2303.58s |  This guy's from the army.
2303.58s - 2305.74s |  That guy knows shit, he's on my team.
2305.74s - 2308.02s |  Hell yeah.
2308.02s - 2309.66s |  Stepmom, back to the board.
2309.66s - 2310.86s |  300.
2310.86s - 2311.70s |  For three.
2312.70s - 2321.01s |  The only Canadian province represented in the NATO effort.
2321.01s - 2322.17s |  What is Quebec?
2322.17s - 2329.57s |  What is Quebec is correct.
2329.57s - 2330.81s |  Two categories left.
2330.81s - 2332.01s |  Where are we going next?
2333.05s - 2335.09s |  Let's fuck it up for 400 in the DFIU clue crew.
2335.09s - 2340.05s |  DFIU clue crew for 400.
2340.05s - 2341.17s |  Whitney Merrill.
2341.17s - 2348.24s |  I hope you're having a good time.
2348.24s - 2353.24s |  So this boozy company's CEO was held individually liable
2354.24s - 2357.48s |  by the FTC, forcing security programs
2357.48s - 2360.68s |  at all of his companies, including the future ones,
2360.68s - 2365.68s |  with more than 25,000 clients after a 2020 breach
2366.08s - 2374.70s |  that exposed 2.5 million.
2374.70s - 2377.58s |  There's a guy that has a boozy company
2377.58s - 2382.10s |  who is held individually liable for a data breach.
2382.10s - 2389.50s |  What is that boozy company?
2389.50s - 2392.14s |  What is Booz Allen Hamilton?
2394.38s - 2401.11s |  That is wrong.
2401.11s - 2403.15s |  You gotta get a Snowden in here or there.
2404.63s - 2422.43s |  Going one.
2422.43s - 2423.63s |  Drizzly was the answer,
2423.63s - 2429.29s |  because it went on the board, calm your shit.
2429.29s - 2430.77s |  For 500, please.
2430.77s - 2431.61s |  No.
2432.49s - 2433.33s |  For five.
2434.21s - 2437.97s |  For 500, I'd like to bring Allie Dev on stage.
2437.97s - 2444.70s |  Allie!
2444.70s - 2447.70s |  Apparently this is the easier of my two questions.
2448.74s - 2451.82s |  Did you know the string, give me a second,
2451.86s - 2456.86s |  A-W-A-V-A-U-T-S-H, and similar,
2458.30s - 2462.30s |  are found in the x86, Mac, and Linux binaries,
2462.30s - 2465.18s |  primarily because the opcode for this instruction
2465.18s - 2468.94s |  is O-X-41-HEX-41.
2468.94s - 2469.78s |  Good luck.
2469.78s - 2473.53s |  Can we get that all in NATO again?
2473.53s - 2474.53s |  Okay, here we go.
2475.49s - 2484.74s |  A-A-U-T-S-H.
2484.74s - 2487.38s |  This is the easier of my two questions.
2487.42s - 2489.46s |  Well then, you're fired.
2489.46s - 2490.74s |  Okay, thank you.
2490.74s - 2492.58s |  What is a function prologue?
2492.58s - 2493.42s |  No.
2493.42s - 2495.06s |  No, I'm sorry, that's incorrect.
2498.25s - 2500.97s |  Listen, I really tried, I wanted to give a challenge.
2500.97s - 2503.93s |  Going once.
2503.93s - 2504.77s |  Going twice.
2504.77s - 2507.01s |  They need the question again, should I do it one more time?
2507.01s - 2510.61s |  Did you know the string,
2510.61s - 2521.90s |  A-W-A-V-A,
2521.90s - 2526.90s |  in the x64, Mac, and Linux binaries,
2528.30s - 2531.78s |  primarily because the opcode,
2532.82s - 2537.82s |  the opcode for this instruction is O-X-41.
2540.46s - 2542.54s |  Somebody please, and there is someone in the audience,
2542.54s - 2543.82s |  there's a couple people in the audience.
2543.82s - 2545.46s |  No, there's some nerds out there for sure.
2545.46s - 2546.30s |  There are nerds.
2546.30s - 2547.22s |  There's certainly nerds out there,
2547.22s - 2548.46s |  we're not just out here.
2548.46s - 2549.30s |  I need this guy.
2549.30s - 2550.78s |  Going once.
2550.78s - 2551.74s |  Going twice.
2552.58s - 2553.62s |  Oh, we'll give away some good shit for this.
2553.62s - 2555.70s |  We're gonna give away a Flipper Zero
2555.70s - 2557.50s |  from Sprocket Security.
2557.50s - 2559.54s |  That guy in the white mask.
2559.54s - 2561.30s |  No, no.
2561.30s - 2562.14s |  Right here.
2562.14s - 2563.18s |  What is yes?
2563.18s - 2564.02s |  No.
2565.46s - 2566.70s |  This is a hard one.
2566.70s - 2572.54s |  This is why it's 500.
2572.54s - 2589.67s |  Your wife is literally pointing to someone.
2589.67s - 2592.19s |  Glad we have some reverse engineers in the crowd.
2594.47s - 2596.59s |  All right, back to the board, pandas.
2597.91s - 2599.19s |  For 100.
2599.87s - 2600.71s |  For 100.
2600.71s - 2602.83s |  All right, remember the category.
2602.83s - 2604.87s |  Current DEF CON staff.
2604.87s - 2608.59s |  Dark Tangent, Trogdor, Priest, Nikita.
2609.95s - 2611.23s |  Wait, what?
2611.23s - 2613.19s |  You don't remember the category that you just said?
2613.19s - 2614.03s |  No.
2614.03s - 2615.31s |  Fuck no.
2615.31s - 2617.31s |  It was, um, actually.
2617.31s - 2620.01s |  Oh.
2620.01s - 2622.05s |  Actually, it was, um, actually.
2624.66s - 2625.50s |  Going once.
2628.50s - 2629.98s |  Going twice.
2629.98s - 2631.54s |  This is my favorite thing ever.
2632.54s - 2634.14s |  All the elder millennials are like,
2634.14s - 2636.14s |  fuck you, you motherfuckers.
2637.66s - 2639.30s |  Gone out to the audience.
2639.30s - 2640.66s |  Cyber guy.
2643.66s - 2646.50s |  Not in the form of a question.
2646.50s - 2652.26s |  Waving hands, Goonbats guy.
2652.26s - 2653.10s |  What?
2653.10s - 2662.58s |  No.
2662.58s - 2663.90s |  From Strong Bad.
2663.90s - 2668.45s |  And not on.
2668.45s - 2670.41s |  See, there's gonna be a thing in these lists
2670.41s - 2672.41s |  that doesn't belong, and you have to say,
2672.41s - 2677.85s |  um, actually, that doesn't belong.
2677.85s - 2679.61s |  Gotta explain all this shit to these people.
2679.61s - 2680.77s |  Back to the board.
2682.01s - 2683.89s |  I guess for 200.
2683.89s - 2685.45s |  Well, you don't have a choice.
2686.45s - 2688.25s |  Password dumping tool.
2688.25s - 2691.65s |  PWDump, GSECDump, LULDump, or FGDump.
2692.61s - 2693.89s |  Pandemonium.
2693.89s - 2697.29s |  Um, actually, what is bulldump?
2698.57s - 2704.06s |  Is correct.
2704.06s - 2706.02s |  Tenuous excitement from the crowd there.
2706.02s - 2706.98s |  That was weird.
2708.06s - 2709.02s |  Back to the board.
2713.39s - 2715.07s |  The board.
2715.87s - 2717.67s |  All right, for 300.
2717.67s - 2718.91s |  What is 300?
2718.91s - 2720.43s |  Oh, there you go.
2720.43s - 2723.59s |  Electronic term, gyrator, foreignator,
2723.59s - 2729.60s |  resonator, multivibrator.
2729.60s - 2730.60s |  Pandemonium.
2730.60s - 2733.24s |  What is, actually, foreignator?
2733.24s - 2734.44s |  Is.
2734.44s - 2735.84s |  Is that close enough?
2735.84s - 2739.38s |  It's correct.
2739.38s - 2740.70s |  We said what is.
2741.74s - 2742.58s |  Fuck off.
2742.58s - 2744.58s |  I'm the one doing this shit, not you.
2744.58s - 2745.98s |  Get out of here.
2745.98s - 2747.06s |  Back to the board.
2748.50s - 2749.50s |  What is 400?
2750.54s - 2754.39s |  It's a number on the board.
2754.39s - 2755.31s |  Oh, okay.
2755.31s - 2756.63s |  Programming language.
2756.63s - 2760.75s |  Algol, geritol, Occam, or Malbolge.
2760.75s - 2761.67s |  Pandemonium.
2762.71s - 2765.79s |  What is, actually, geritol is like fiber
2765.79s - 2767.07s |  for old ass people.
2768.39s - 2773.18s |  Hey, Wynn, is that fiber for old ass people?
2773.18s - 2774.74s |  Okay, that's just a box of wine,
2774.74s - 2776.30s |  but I know that that's correct.
2780.58s - 2783.66s |  And thankfully, the end of round one for five.
2784.66s - 2787.02s |  Quantum crypto algorithm.
2787.02s - 2792.02s |  Falcon, crystals, dilithium, sphinx plus, or pyramid.
2792.66s - 2800.35s |  Going once.
2801.67s - 2803.35s |  What is, actually, Falcon?
2803.35s - 2805.71s |  Is that software from CrowdStrike?
2805.71s - 2811.25s |  Unfortunately, it's also a crypto algorithm.
2811.25s - 2812.29s |  That's incorrect.
2813.93s - 2816.41s |  But I understand your CrowdStrike fetish.
2817.89s - 2820.69s |  We love the things that hurt us, don't we?
2820.69s - 2824.82s |  Kink shame.
2824.86s - 2826.54s |  Kink shame, I just kink ask why.
2827.78s - 2832.88s |  Back to the board, or pandemonium.
2832.88s - 2835.08s |  Going once.
2835.08s - 2838.06s |  Going twice.
2838.06s - 2839.10s |  That guy.
2840.30s - 2860.82s |  What is pyramid?
2860.82s - 2862.74s |  If you need to piss, if you need to go,
2862.74s - 2865.14s |  we're gonna switch the board to double jeopardy,
2865.14s - 2893.01s |  and we'll be right back.
2893.01s - 2895.37s |  Give me a slice of that shit.
2895.37s - 2897.61s |  I want a slice of that motherfucking shit.
2897.61s - 2900.87s |  Serve it, goddammit.
2902.31s - 2911.64s |  All right, we move.
2911.64s - 2915.59s |  The deciding round.
2915.63s - 2917.07s |  The badge at DEF CON.
2917.07s - 2920.15s |  Hey, Grifter.
2920.15s - 2920.99s |  Grifter.
2920.99s - 2924.58s |  I found something for ya.
2924.58s - 2940.42s |  Your categories are cable diffusion,
2940.42s - 2966.42s |  legacy of Kevin Mitnick, fishing for laughs.
2966.42s - 2968.42s |  And so you have control of the board.
2968.42s - 2969.62s |  Where are we going next?
2971.18s - 2973.30s |  Show me the pwn for 1,000.
2973.30s - 2978.12s |  Show me the pwn for 1,000.
2978.12s - 2980.68s |  Continuing this year of cyber fail,
2980.68s - 2983.16s |  this background chat company was popped
2983.16s - 2986.16s |  for approximately three billion records.
2987.52s - 2988.68s |  Pandemonium.
2988.68s - 2990.84s |  What is Equifax?
2990.84s - 2998.99s |  What is Equifax is wrong.
2998.99s - 3001.41s |  What's wrong, y'all?
3001.41s - 3003.33s |  Stepmom or OnlyLands?
3004.45s - 3005.61s |  Going once.
3006.53s - 3007.53s |  Going twice.
3007.53s - 3008.37s |  Right there, sir.
3008.37s - 3009.21s |  Very confident.
3010.49s - 3012.95s |  Incorrect.
3012.95s - 3013.79s |  Right there.
3015.03s - 3018.39s |  No.
3018.39s - 3020.07s |  Say it again.
3021.39s - 3025.05s |  No.
3025.85s - 3032.74s |  National public data is OnlyLands.
3032.74s - 3036.59s |  You're still in control.
3036.59s - 3038.15s |  400 or 800.
3039.03s - 3039.87s |  For 800.
3041.99s - 3044.35s |  This automobile dealer.
3044.35s - 3045.19s |  Automobile dealer?
3045.19s - 3046.03s |  Sure.
3046.03s - 3049.62s |  Hold on.
3049.62s - 3050.46s |  Got it.
3050.46s - 3052.86s |  This automobile dealer services company
3052.86s - 3056.10s |  caused the outage of over 15,000 car dealerships
3056.10s - 3058.50s |  after a ransomware attack.
3058.50s - 3059.54s |  Pandemonium.
3059.54s - 3061.86s |  What is the company that wrecked my life recently?
3061.86s - 3063.50s |  Also known as CDK.
3063.54s - 3064.54s |  What is CDK?
3064.54s - 3067.55s |  Is correct.
3067.55s - 3069.43s |  Coming to a tie for the lead.
3069.43s - 3071.03s |  Where are we going next, Pandas?
3071.91s - 3072.75s |  600.
3072.75s - 3073.75s |  For six.
3074.95s - 3077.07s |  This file transfer software was used
3077.07s - 3080.87s |  to compromise thousands of customers in May 2023.
3082.23s - 3083.59s |  Pandas.
3083.59s - 3085.11s |  What is Moveit?
3085.11s - 3086.95s |  I like to move it, move it.
3086.95s - 3088.75s |  I like to move it, move it.
3088.75s - 3089.71s |  Electo.
3089.71s - 3093.40s |  Correct.
3093.40s - 3094.24s |  Pandas.
3094.24s - 3095.08s |  400.
3095.08s - 3096.32s |  For four.
3096.32s - 3099.32s |  This health care company was hit by a ransomware attack
3099.32s - 3101.64s |  that may have affected up to a third of Americans
3101.64s - 3103.40s |  in February 2024.
3104.60s - 3105.52s |  Stepmoms.
3107.00s - 3109.60s |  What is Change Healthcare?
3109.60s - 3111.12s |  Incorrect.
3111.12s - 3112.08s |  Oh, parent company?
3112.08s - 3112.92s |  United?
3113.80s - 3114.80s |  Pandemonium.
3114.80s - 3116.16s |  What is United Healthcare?
3116.16s - 3117.40s |  What is United Healthcare?
3117.40s - 3122.18s |  Is correct.
3122.18s - 3123.50s |  I'll teach you to ring in.
3123.50s - 3124.74s |  Back to the board.
3124.74s - 3125.86s |  Who's our designated drinker?
3125.86s - 3127.02s |  For 200.
3127.02s - 3129.78s |  Why are you letting your designated drinker hit the button?
3129.78s - 3131.38s |  That's fucked up.
3131.38s - 3133.06s |  Pandemonium.
3133.06s - 3133.90s |  It's over two.
3134.98s - 3138.42s |  This asshat company with ridiculous fees
3138.42s - 3140.26s |  gained VIP admission into the
3140.26s - 3142.58s |  You Fucked It Up Large Data Breach Club
3142.58s - 3147.58s |  when they lost the data of 560 million fucking people.
3149.58s - 3150.70s |  Pandemonium.
3150.70s - 3153.14s |  What is Fucking Ticketmaster?
3153.14s - 3159.23s |  Fuck those guys, am I right?
3159.23s - 3161.19s |  I've been saying their name on stage.
3161.19s - 3162.51s |  I owe them a fee.
3164.15s - 3164.99s |  Back to the board.
3164.99s - 3165.83s |  Pandemonium.
3165.83s - 3167.43s |  What is an illegal monopoly?
3167.43s - 3168.87s |  Ooh.
3168.87s - 3170.27s |  Phishing for laughs, 200.
3171.15s - 3173.35s |  Phishing for laughs for two.
3173.35s - 3176.39s |  A form of phishing that uses voice calls to trick users
3176.39s - 3179.27s |  into divulging sensitive information.
3179.27s - 3180.11s |  Pandas.
3181.19s - 3182.39s |  What is vishing?
3182.39s - 3183.23s |  What is phishing?
3183.23s - 3188.83s |  Is correct.
3188.83s - 3189.67s |  400.
3189.67s - 3194.74s |  For four.
3194.74s - 3197.22s |  Quishing is a phishing style that makes the use
3197.22s - 3198.98s |  of this data encoding mechanism.
3199.98s - 3200.94s |  Pandemonium.
3200.94s - 3202.54s |  What is QR code?
3202.54s - 3203.58s |  What are QR codes?
3203.58s - 3207.35s |  Is correct.
3207.35s - 3208.71s |  600.
3208.71s - 3211.85s |  For six.
3211.85s - 3215.13s |  This man in the middle tool is a man in the middle attack,
3215.13s - 3217.57s |  a framework used for phishing login credentials
3217.57s - 3218.97s |  along with session cookies.
3220.09s - 3221.17s |  Stepmom.
3221.17s - 3223.01s |  What is Evil Engines 2?
3223.97s - 3224.81s |  That'll work.
3224.81s - 3225.65s |  What is Evil Engine X?
3225.65s - 3226.49s |  Is correct.
3237.91s - 3239.75s |  For eight, of course.
3239.75s - 3252.70s |  For eight?
3252.70s - 3254.78s |  This is an interesting situation
3254.78s - 3256.94s |  because if you double, you can take the lead
3257.50s - 3259.14s |  of your 1800, how much are you gonna wager?
3259.14s - 3259.98s |  It's fine.
3259.98s - 3261.90s |  Alpha Lima Lima.
3261.90s - 3268.08s |  All of it!
3268.08s - 3269.24s |  Here is your clue.
3270.32s - 3273.44s |  Want to test your organization's resistance to phishing?
3273.44s - 3286.66s |  You might try out this open source framework.
3286.66s - 3288.74s |  Don't say anything like wombat.
3288.74s - 3293.56s |  Uh, what is Evil Engines 2?
3293.56s - 3302.86s |  Audience, you know what to do.
3302.86s - 3306.02s |  And for some reason, we've brought back the penalty
3306.02s - 3310.96s |  for fucking it up, the null banana.
3310.96s - 3312.96s |  Because apparently, bananas and beer
3312.96s - 3316.44s |  sit in your stomach really well together.
3316.44s - 3319.76s |  This is brought to you by Potassium and Kazakhstan,
3319.76s - 3322.68s |  the number one exporter of potassium.
3323.84s - 3325.64s |  Stepmom, it's not all lost.
3325.64s - 3327.44s |  You're in control of the board.
3327.44s - 3329.76s |  Oh, oh wait, hold on, we gotta do the thing.
3331.60s - 3333.52s |  Multicolored shirt guy.
3334.96s - 3336.60s |  What is Go Fish?
3336.60s - 3339.68s |  What, you don't have any three of clubs?
3339.68s - 3348.98s |  Okay, that's correct!
3348.98s - 3350.98s |  All right, Stepmoms.
3350.98s - 3354.22s |  Bring on the Singularity for 1,000, please.
3354.22s - 3358.46s |  Singularity for, what's going on there?
3358.46s - 3366.68s |  I like that.
3366.68s - 3368.96s |  Sure, I was just staring.
3368.96s - 3371.48s |  I was a spectator for like 30 seconds there.
3371.48s - 3374.72s |  Stepmom, you said Singularity for 1,000.
3374.72s - 3376.92s |  Singularity for, okay.
3376.92s - 3380.92s |  In 2016, users of this Microsoft AI chatbot
3381.88s - 3384.56s |  taught it to become a Nazi racist.
3385.64s - 3386.76s |  OnlyLands.
3386.76s - 3388.20s |  Who is Sidney?
3388.20s - 3389.28s |  Who is Sidney?
3389.28s - 3390.60s |  Wrong, I got it, I got it, I got it.
3390.60s - 3391.64s |  Is wrong.
3391.64s - 3392.68s |  Pandemonium?
3392.68s - 3393.60s |  Who is Tay?
3393.60s - 3394.44s |  Who is Tay?
3395.64s - 3400.25s |  I'm going through my racist era, is correct!
3400.25s - 3402.25s |  There's multiple options there, really.
3403.85s - 3406.09s |  Pandas, you're well in the lead.
3406.09s - 3409.73s |  Let's keep up the artificial intelligence for 800.
3409.73s - 3413.85s |  For Singularity, 800.
3413.85s - 3415.33s |  Dan, which is short for this,
3415.33s - 3418.17s |  is a jailbreak for chat GPT
3418.17s - 3423.33s |  designed to get it to unlock an alter ego.
3423.33s - 3425.37s |  What is do anything now?
3425.37s - 3434.86s |  What is do anything now is correct!
3434.86s - 3437.02s |  Win GPT for 400.
3437.02s - 3438.46s |  Win GPT.
3438.46s - 3441.14s |  For those of you that may not know this category,
3441.14s - 3446.02s |  we literally tell Win a word and ask him to describe it
3446.02s - 3448.86s |  and we just record whatever happens after that
3448.86s - 3450.14s |  and now it's your clue.
3451.98s - 3467.73s |  For 400.
3467.73s - 3470.73s |  You've got 300, but this is Double Hacker Jeopardy
3470.73s - 3473.77s |  where you can wager up to 1,000 points.
3473.77s - 3475.25s |  1,000 fucking points.
3475.25s - 3480.46s |  1,000 fucking points, he says.
3480.46s - 3483.46s |  The fucking files work.
3483.46s - 3485.02s |  Over to you, fake win.
3495.27s - 3502.13s |  Oh, that's almost there.
3502.13s - 3504.25s |  You know, I've always wiped,
3504.25s - 3507.41s |  was it Chile or Ecuador, London,
3507.41s - 3509.25s |  and then back in the US.
3509.25s - 3511.77s |  I don't know where the fuck this guy is.
3511.77s - 3516.50s |  Damn leaky.
3519.67s - 3522.11s |  Good luck with that.
3522.11s - 3523.91s |  Who is Julian Assange?
3523.91s - 3536.50s |  Is Parade!
3536.50s - 3539.66s |  What is wrong with your brain?
3539.66s - 3543.93s |  I listened to that like five fucking times before the show
3543.93s - 3546.49s |  and I didn't even know what the hell he was talking about.
3546.49s - 3548.77s |  Win GPT with anal beads.
3548.77s - 3550.01s |  What's up?
3550.01s - 3551.29s |  Are you cheating with anal beads?
3551.29s - 3553.77s |  Somebody messaging you through anal beads.
3553.77s - 3555.65s |  Listen, man, just because you got them
3555.65s - 3557.09s |  doesn't mean everybody else does.
3557.09s - 3559.73s |  Only land back to the board.
3559.73s - 3561.53s |  600.
3565.09s - 3567.45s |  I have to send back to the board.
3567.45s - 3570.45s |  Win for six.
3570.45s - 3577.86s |  Take it away, win.
3577.86s - 3580.66s |  You know, silver is supposed to be spacemen
3580.66s - 3582.66s |  from 1950s movies.
3582.66s - 3585.38s |  And then you put edges on it
3585.38s - 3587.06s |  and batteries on it.
3587.06s - 3588.82s |  And what the fuck?
3588.82s - 3590.70s |  Does it even work anymore?
3590.70s - 3595.37s |  All right, just to recap for everybody,
3595.37s - 3597.25s |  we had it's silver.
3597.25s - 3598.69s |  It's got edges on it.
3598.69s - 3603.46s |  And what the fuck does it even work anymore?
3603.46s - 3605.50s |  I know, I think that's all the information you need
3605.54s - 3608.90s |  because I think everybody else there knows what it is.
3608.90s - 3610.82s |  What the fuck?
3610.82s - 3612.18s |  Well, you're going to have to hit the button
3612.18s - 3614.06s |  before you say what the fuck.
3614.06s - 3616.66s |  And if the answer is the fuck, you'll get it right.
3618.66s - 3621.02s |  Going once.
3621.02s - 3622.54s |  Going twice.
3622.54s - 3625.06s |  Wi-Fi cactus.
3625.06s - 3630.88s |  What is a cyber truck is correct.
3630.88s - 3633.24s |  You should feel bad for knowing that.
3633.24s - 3638.85s |  Twice important to donate to elder care, folks.
3638.89s - 3641.41s |  Back to the board, OnlyLands.
3641.41s - 3642.73s |  800.
3642.73s - 3643.93s |  Well, thank you.
3643.93s - 3644.93s |  Win for eight.
3644.93s - 3654.09s |  Go for it, win.
3654.09s - 3657.89s |  Shit, I mean, they tried it.
3657.89s - 3660.21s |  The Congress fucked this up and then they unfucked it.
3660.21s - 3661.05s |  Then it's refucked.
3661.05s - 3663.09s |  I don't know the state of fuckery
3663.09s - 3665.17s |  of what's going on right now with this.
3665.17s - 3667.49s |  And I know this is not helping you at all
3667.49s - 3669.37s |  because it's not positive.
3669.37s - 3675.57s |  It's not negative, but it is.
3675.57s - 3677.01s |  Panamonium.
3677.01s - 3678.53s |  What is quantum?
3678.53s - 3682.40s |  What is quantum is wrong.
3682.40s - 3683.60s |  What is net neutrality?
3683.60s - 3697.94s |  What is net neutrality?
3697.94s - 3698.78s |  Thank you.
3698.78s - 3699.78s |  Back to the board.
3699.78s - 3700.82s |  Thanks, Congress.
3700.82s - 3701.66s |  Fuck that guy.
3701.66s - 3702.58s |  Oh, sorry.
3702.58s - 3704.42s |  Win GPT for 1,000.
3704.42s - 3705.86s |  Win for 1,000.
3705.86s - 3710.74s |  Oh God.
3710.74s - 3712.62s |  Well, you think IBM.
3712.62s - 3715.38s |  You've heard of IBM, you know, big blue and all that.
3715.38s - 3717.94s |  But then there's always a number associated
3717.94s - 3720.10s |  with the not IBM.
3720.10s - 3723.46s |  And it begins with the number nine, number nine,
3723.58s - 3724.50s |  number nine.
3725.94s - 3726.78s |  What the fuck?
3726.78s - 3727.62s |  Only Lambert's right.
3727.62s - 3728.98s |  What the fuck is quad nine?
3730.42s - 3731.42s |  What is quad nine?
3731.42s - 3732.62s |  No, that's incorrect.
3734.14s - 3738.70s |  Play it again.
3738.70s - 3740.58s |  Well, you think IBM.
3740.58s - 3743.34s |  You've heard of IBM, you know, big blue and all that.
3743.34s - 3745.90s |  But then there's always a number associated
3745.90s - 3748.06s |  with the not IBM.
3748.06s - 3751.42s |  And it begins with the number nine, number nine,
3751.42s - 3753.18s |  number nine.
3758.52s - 3760.32s |  It's almost as if there was a theme.
3761.48s - 3767.06s |  Going once.
3767.06s - 3783.42s |  Going twice.
3783.42s - 3784.66s |  Oh, I'm just kidding.
3784.66s - 3788.62s |  Give them a lockpick set from Covert Instruments.
3788.62s - 3795.42s |  Courtesy of the CW asset team.
3795.42s - 3796.26s |  Back to the board.
3796.26s - 3799.40s |  Only Lambert.
3799.40s - 3801.76s |  Can I have 30 fucking years for 400?
3801.76s - 3803.20s |  Hey, hacker jeopardy.
3803.20s - 3811.12s |  30 fucking years, am I right?
3811.12s - 3813.80s |  Lou Montulli creates the blink element
3813.80s - 3815.68s |  while working at this company.
3816.56s - 3823.33s |  Oh, by the way, these are all things from 1994 in tech.
3823.33s - 3826.01s |  I'm surprised you were alive.
3826.01s - 3831.90s |  Lou Montulli, that guy from that company, huh?
3833.38s - 3835.22s |  Did you know Lou?
3835.22s - 3836.06s |  No, you didn't?
3836.06s - 3836.90s |  Okay.
3836.90s - 3840.78s |  Going once.
3840.78s - 3842.50s |  Who is Netscape?
3842.50s - 3843.78s |  What is Netscape?
3843.78s - 3846.58s |  Is correct.
3846.58s - 3848.30s |  He said who, not what.
3848.30s - 3849.26s |  He said who.
3849.26s - 3850.30s |  You're an idiot.
3851.54s - 3853.06s |  Back to the board.
3853.06s - 3854.94s |  All right, let's try it for six.
3854.94s - 3856.06s |  For 600.
3857.06s - 3859.70s |  This gentleman founded the W3C.
3864.18s - 3865.86s |  Who is Tim Berners-Lee?
3865.86s - 3871.17s |  Is correct.
3871.17s - 3872.65s |  We've got a game, folks.
3872.65s - 3873.97s |  Only lands you're in control
3873.97s - 3876.53s |  and in striking distance of the lead.
3876.53s - 3878.33s |  Let's try it for 1,000.
3878.33s - 3880.61s |  30 fucking years for 1,000.
3881.61s - 3888.34s |  The seller came online and was originally called Kadabra
3888.38s - 3896.30s |  in 1994.
3896.30s - 3897.50s |  Pandemonium.
3897.50s - 3898.86s |  What is eBay?
3898.86s - 3900.18s |  What is eBay?
3900.18s - 3905.06s |  Is incorrect.
3905.06s - 3907.02s |  Only lands are stepmoms.
3908.42s - 3910.58s |  Only lands are stepmoms is a phrase I say
3910.58s - 3912.26s |  in my house all the time.
3914.14s - 3915.18s |  Going once.
3918.62s - 3922.24s |  Going twice.
3922.24s - 3924.56s |  I mean, if that's not his name, I'm gonna go over here.
3924.56s - 3925.56s |  Right here, Reddit.
3926.72s - 3927.68s |  What is Amazon?
3927.68s - 3933.37s |  Is correct.
3933.37s - 3936.77s |  Well, Only Lands, through no fault of your own,
3936.77s - 3939.01s |  you are now in the lead.
3939.01s - 3940.37s |  Excuse you.
3940.37s - 3941.65s |  You worked on that shit.
3941.65s - 3946.17s |  Congratulations, guy that changes hard drives at AWS.
3946.17s - 3947.49s |  Back to the board.
3947.49s - 3953.17s |  Fair enough, we'll take it for eight.
3953.17s - 3955.77s |  Yeah, 30 for eight.
3955.77s - 3958.25s |  This storage system was released by Iomega
3958.25s - 3961.49s |  and you can hold a whopping 100 megabytes.
3961.49s - 3964.73s |  Let's hope, Steve, shout out to Steve Gibson, right?
3964.73s - 3966.45s |  Let's hope you spin right.
3967.45s - 3968.57s |  Pandemonium.
3968.61s - 3971.89s |  What is a zip disk?
3971.89s - 3975.54s |  That's incorrect.
3975.54s - 3976.94s |  That's correct?
3976.94s - 3977.86s |  Oh, that's correct.
3977.86s - 3979.62s |  You changed it, motherfucker.
3981.06s - 3983.06s |  A jazz is a gigabyte.
3983.06s - 3986.41s |  I fucking know, don't.
3986.41s - 3988.77s |  I still have one because I do forensics
3988.77s - 3990.29s |  and it still shows up.
3990.29s - 3992.33s |  I still have a little bit of PTSD
3992.33s - 3995.69s |  from hearing that click, click, click, click, click.
3995.69s - 3997.37s |  All right, Pandemonium, you're in control
3997.37s - 3998.85s |  and back in the lead.
3998.85s - 4000.49s |  30 fucking years for 200.
4000.49s - 4001.69s |  30 for two.
4003.25s - 4005.33s |  Windows 95 wasn't available yet
4005.33s - 4007.57s |  so we were stuck with this version.
4007.57s - 4008.61s |  Pandemonium.
4008.61s - 4010.37s |  What is Windows 3.1?
4010.37s - 4012.05s |  What is 3.1 is correct.
4012.05s - 4019.58s |  That came up a year after.
4019.58s - 4022.54s |  All right, Pandos.
4022.54s - 4024.42s |  Singularity 600.
4024.42s - 4025.94s |  Singularity for six.
4026.98s - 4029.42s |  The singularity is near by this offer
4029.42s - 4031.06s |  pauses the point in time
4031.06s - 4032.98s |  where technological growth and innovation
4032.98s - 4036.22s |  becomes irreversible and potentially malicious.
4036.22s - 4037.46s |  Sounds like fucking no.
4040.58s - 4041.78s |  You guys fucking read?
4042.74s - 4044.66s |  The singularity is near.
4044.66s - 4045.50s |  It's near.
4045.50s - 4046.82s |  It's near.
4046.82s - 4047.66s |  Go to the gray beard.
4047.66s - 4048.50s |  Somebody sample that
4048.50s - 4050.34s |  for some sick beats next year, please.
4052.06s - 4053.22s |  Going once.
4053.22s - 4054.66s |  Gray beard.
4054.66s - 4055.70s |  Going twice.
4055.70s - 4056.62s |  Gray beard.
4056.62s - 4058.74s |  Wavy McTelegraph.
4058.74s - 4061.78s |  Fuck that guy, gray beard.
4061.78s - 4063.22s |  No.
4063.22s - 4065.96s |  Right here.
4065.96s - 4068.52s |  What is Ray, who's Ray Kurzweil is correct.
4072.80s - 4075.52s |  Covert Instruments lock pick set
4075.56s - 4082.94s |  brought to you by the CDW Offset team.
4082.94s - 4084.74s |  We've just got a handful of clues to go.
4084.74s - 4086.38s |  Pandemonium, you're in the lead.
4086.38s - 4087.78s |  Fishing for a thousand.
4087.78s - 4089.26s |  Fishing for a thousand.
4090.54s - 4093.38s |  This technique makes use of slightly misspelled websites
4093.38s - 4095.02s |  to trick users into thinking
4095.02s - 4097.46s |  they are visiting a legitimate domain.
4097.46s - 4098.58s |  Stepmoms.
4098.58s - 4100.06s |  What is domain squatting?
4101.14s - 4102.30s |  I'm gonna give that to you.
4102.30s - 4107.25s |  Type of squatting or domain squatting is correct.
4107.25s - 4108.09s |  Fuck off.
4108.09s - 4109.49s |  It's correct.
4109.49s - 4111.61s |  You fucked it up.
4112.33s - 4113.65s |  I don't care what you're saying right now.
4113.65s - 4115.49s |  It's correct.
4115.49s - 4116.33s |  Stepmoms.
4116.33s - 4117.29s |  Oh, are you disappointed in Vegas?
4117.29s - 4118.77s |  Fuck off.
4118.77s - 4121.21s |  Has anyone visited lintowspin.com?
4122.09s - 4128.26s |  You spin me right round, baby, right round.
4128.26s - 4129.90s |  Sorry for the image that I put
4129.90s - 4131.46s |  into all of your brains there.
4132.38s - 4133.42s |  Back to the board.
4136.06s - 4138.82s |  Stepmoms will take Mitnick for a thousand, please.
4138.82s - 4139.98s |  Mitnick for a thousand.
4139.98s - 4141.62s |  I would welcome to the stage,
4141.62s - 4154.10s |  to read this category, Kimberly Mitnick.
4154.10s - 4155.58s |  I do wanna clarify,
4155.58s - 4158.70s |  I am actually not the daughter of Kevin, okay?
4159.74s - 4162.70s |  There has been quite a few people messaging me on LinkedIn
4162.70s - 4164.46s |  and a few other places on X.
4164.46s - 4165.82s |  I am actually the wife, okay?
4165.82s - 4166.98s |  There was an age gap.
4168.62s - 4169.94s |  I had to say that
4169.94s - 4171.90s |  because there's been a lot of people messaging me going,
4171.90s - 4174.58s |  I'm so sorry to hear about the loss of your father.
4174.58s - 4176.78s |  He was not my father.
4176.78s - 4178.02s |  I'm putting it out there.
4185.00s - 4185.84s |  Here we go.
4185.84s - 4186.68s |  We're at three?
4186.68s - 4187.52s |  What?
4187.52s - 4188.36s |  Wait, wait, wait.
4188.36s - 4189.20s |  Right off that screen right there.
4189.20s - 4190.04s |  Like a shoot.
4190.04s - 4191.48s |  Okay.
4191.48s - 4194.56s |  After he was freed, free Kevin,
4194.56s - 4199.94s |  stickers were replaced with these.
4199.94s - 4201.78s |  What has put Kevin back?
4201.78s - 4216.45s |  What has put Kevin back is unfortunately correct.
4216.45s - 4218.57s |  Back to the board, sir, sir, sir, sir.
4218.57s - 4219.41s |  Back to the board.
4219.41s - 4220.73s |  We're going for 800.
4220.73s - 4222.53s |  Oh, she comes right back.
4222.53s - 4225.77s |  Stay up here, come on, love, stay up here.
4225.77s - 4226.61s |  For how many?
4226.61s - 4227.45s |  Eight.
4227.45s - 4228.29s |  Eight for eight.
4231.14s - 4234.38s |  Lifetime early entry to H.J.
4236.10s - 4236.94s |  Oh, no, no, no.
4236.94s - 4237.78s |  Sorry.
4237.78s - 4241.50s |  Wait, wait.
4241.50s - 4242.34s |  Hello.
4242.34s - 4256.16s |  Kevin was arrested in this state in 1995.
4256.16s - 4276.41s |  Going twice.
4276.41s - 4277.69s |  Back to the board.
4279.25s - 4280.21s |  600, please.
4280.21s - 4281.25s |  For six.
4283.33s - 4285.17s |  During his prosecution,
4285.17s - 4288.69s |  Kevin was accused of being able to whistle modem codes
4288.69s - 4291.13s |  that could cause a catastrophic event.
4292.25s - 4293.69s |  Panamonium.
4293.69s - 4297.21s |  What is the nuclear launch codes?
4297.21s - 4311.94s |  What is the nu-
4311.94s - 4312.78s |  Oh, sorry.
4312.78s - 4315.78s |  Kevin Mitnick for 400.
4315.78s - 4318.46s |  This book was published in 2012
4318.46s - 4319.58s |  and was subtitled,
4319.58s - 4325.88s |  My Adventures as a World's Most Wanted Hacker.
4325.88s - 4328.44s |  What is the art of deception?
4328.44s - 4334.08s |  Incorrect.
4334.08s - 4335.64s |  What is Ghost in the Wires?
4335.64s - 4336.96s |  What is Ghost in the Wires?
4336.96s - 4345.10s |  Correct.
4345.10s - 4345.94s |  Yes, we are.
4345.94s - 4346.78s |  Yes, we are.
4346.78s - 4347.66s |  200, please.
4347.66s - 4350.96s |  For two.
4351.00s - 4354.00s |  The number of years Kevin served in prison.
4355.20s - 4356.04s |  I have an idea,
4356.04s - 4356.88s |  but I'm not gonna say it.
4356.88s - 4366.28s |  Going twice.
4366.28s - 4379.22s |  Hey, this one's to the audience.
4379.22s - 4380.06s |  You rock.
4380.98s - 4384.79s |  You fucking rock.
4384.79s - 4386.19s |  That was too fucking many.
4387.31s - 4388.63s |  I just wanna say,
4388.63s - 4400.56s |  Kimberly, thank you so much for spending your time.
4400.56s - 4401.72s |  We've got answer.
4401.72s - 4403.52s |  We got three clues left.
4403.52s - 4407.75s |  Stepmom, you're in control of the board.
4407.75s - 4409.71s |  Win GPT for 200, please.
4409.71s - 4425.76s |  Win GPT for 200.
4426.60s - 4427.44s |  Crucial moment here,
4427.44s - 4430.16s |  because this could change the outcome of the game.
4430.16s - 4432.52s |  1,400 points is how much you wager,
4432.52s - 4433.76s |  or you can wager.
4433.76s - 4436.40s |  How much are you going to wager, Stepmoms?
4436.40s - 4438.00s |  How much can I wager?
4438.00s - 4439.88s |  Up to 1,400.
4439.88s - 4442.16s |  How much do we get in alimony?
4442.16s - 4443.64s |  Not enough.
4443.64s - 4446.06s |  True.
4446.06s - 4454.01s |  200.
4454.01s - 4465.68s |  Here, 1,400.
4465.68s - 4469.64s |  Your score for 2,800 or nothing at all.
4469.64s - 4476.20s |  Here is this well-constructed win GPT clue.
4476.20s - 4479.60s |  What a randomizer.
4479.60s - 4482.84s |  Wow, that would be number five,
4482.84s - 4486.52s |  or it began at seven,
4486.52s - 4488.16s |  and I forget when they put the tent up
4488.16s - 4490.72s |  and blew up the air conditioning,
4490.72s - 4498.14s |  but then there was pool three.
4498.14s - 4499.10s |  Play it again.
4500.34s - 4502.30s |  What is the Alexis Park?
4502.30s - 4517.26s |  What?
4517.26s - 4518.10s |  I can't hear pool three
4518.10s - 4520.94s |  without feeling very weird things inside my body.
4521.90s - 4523.02s |  Back to the board.
4523.02s - 4524.94s |  Well, that's because I was in, nevermind.
4524.94s - 4527.06s |  Back to the board, Stepmom.
4527.06s - 4528.74s |  I have to pee, so 400, please.
4529.78s - 4530.82s |  That doesn't make sense.
4530.82s - 4533.18s |  Back to the singularity for 400.
4533.18s - 4535.86s |  Google's foray into computing with chat GPT
4535.86s - 4539.86s |  led to people thinking that this zodiacal,
4539.86s - 4541.22s |  zodiacal?
4541.22s - 4544.14s |  Zodiacal chatbot was too woke.
4545.58s - 4546.58s |  Oly lands.
4546.58s - 4547.54s |  Who is Gemini?
4547.54s - 4549.10s |  Who is Gemini is correct,
4549.10s - 4553.08s |  and for the last clue on the board.
4554.36s - 4556.72s |  This computer system played an actual Jeopardy
4556.72s - 4559.24s |  and won decisively in its first match
4559.24s - 4561.00s |  against the like of Ken Jennings.
4562.00s - 4563.76s |  Oly lands.
4563.76s - 4564.88s |  Who is Watson?
4564.88s - 4567.04s |  Who is IBM's Watson?
4567.04s - 4569.76s |  Is awkward that you got that right,
4569.76s - 4573.29s |  but that's correct.
4573.29s - 4574.13s |  All right.
4575.29s - 4578.81s |  Hey, audience, thank you for sticking with all the bullshit.
4578.81s - 4582.21s |  Are we ready for final hacker Jeopardy?
4582.25s - 4589.10s |  Are we ready?
4589.10s - 4601.06s |  The likes who are gonna count up the beer.
4601.06s - 4608.69s |  Finish it now.
4608.69s - 4610.01s |  We got 15 locked in.
4611.29s - 4613.53s |  All right, pandemonium, 15 beers,
4613.53s - 4620.75s |  taking them to 5,300 points.
4620.75s - 4623.24s |  16.
4623.24s - 4626.31s |  Stepmom?
4626.31s - 4630.91s |  Well, my stepmom drank 20 beers,
4630.91s - 4633.63s |  taking them to 4,800 points.
4635.19s - 4638.78s |  Oly lands.
4638.78s - 4641.30s |  While everybody else was going to take a tinkle
4641.30s - 4643.10s |  during the round change,
4643.10s - 4644.70s |  they stayed here and drank beers,
4644.70s - 4648.26s |  which brought them also with 20 beers,
4648.26s - 4653.26s |  taking them into the lead with 5,700 points.
4666.49s - 4668.61s |  The scores are locked in.
4669.53s - 4671.41s |  Have we distributed the papers?
4671.41s - 4675.02s |  We're all doing it all.
4675.02s - 4676.26s |  We're giving people cards.
4679.25s - 4680.57s |  All right.
4680.57s - 4683.37s |  Well, as you know, final hacker Jeopardy
4683.37s - 4685.25s |  is going to come down to one category,
4685.25s - 4686.73s |  one category alone.
4687.61s - 4690.29s |  Where these teams can wager any or all of their points.
4691.45s - 4692.61s |  For the black badge,
4692.61s - 4696.57s |  consider your wagers remarkably carefully.
4696.57s - 4700.41s |  This is for lifetime admission to DEF CON,
4700.41s - 4704.77s |  which by the year 2050 is gonna be about $15,000.
4707.38s - 4712.38s |  Your final, final black badge hacker Jeopardy category is
4714.14s - 4719.52s |  Dante's Inferno.
4719.56s - 4727.54s |  You can wager any or all of your points.
4727.54s - 4728.50s |  While they're wagering,
4728.50s - 4730.42s |  I just want to give a shout out
4730.42s - 4732.70s |  to all of the other people on this team
4732.70s - 4737.02s |  that worked remarkably hard.
4737.02s - 4740.02s |  Make me only look like kind of a dumb ass
4740.02s - 4747.82s |  when I'm standing behind this podium.
4747.82s - 4750.18s |  Everyone, the wagers are locked in.
4750.18s - 4752.06s |  It's time for our final clue.
4752.98s - 4754.18s |  And it is.
4756.18s - 4760.26s |  The seven layers of the OSI networking model
4761.10s - 4764.14s |  in correct reverse alphabetical order.
4764.14s - 4766.82s |  You have 60 seconds.
4766.82s - 4832.42s |  Good luck.
4832.42s - 4834.10s |  Pens down, lift tile, lookalikes,
4834.10s - 4865.02s |  please take away their papers.
4865.02s - 4866.62s |  Actually, I have a thing that I want to do
4866.62s - 4868.38s |  before we reveal any of the answers,
4868.38s - 4871.34s |  which is I have one more big prize to give away.
4872.74s - 4875.94s |  This is a Sparrow Challenge Vault,
4875.94s - 4879.46s |  which is the lock picking safe cracking.
4879.58s - 4880.42s |  Please.
4881.54s - 4882.94s |  I don't like that at all.
4883.82s - 4886.82s |  And what I'm gonna do is I'm gonna give you one chance,
4886.82s - 4888.10s |  one person from the audience,
4888.10s - 4890.34s |  one chance to come up and stand by me.
4890.34s - 4892.86s |  If you know that you know this,
4892.86s - 4894.02s |  come right here for it.
4894.02s - 4895.34s |  Are you ready?
4895.34s - 4896.74s |  But you're gonna endure the audience.
4896.74s - 4899.58s |  And audience, if they fuck it up,
4899.58s - 4901.98s |  I need you to let them hear it worse than anything
4901.98s - 4904.82s |  you've ever given to a contestant.
4904.82s - 4905.98s |  All right, come on.
4905.98s - 4914.44s |  Come on.
4915.20s - 4916.04s |  All right.
4916.04s - 4921.67s |  Yeah, what is transport, session, presentation,
4921.67s - 4945.16s |  physical, network, data link, application?
4945.16s - 4947.84s |  Well, let's see if they got it fucking right.
4947.84s - 4951.00s |  First and foremost, we're gonna go to Stepmom.
4951.00s - 4952.00s |  I tried, man.
4952.00s - 4954.28s |  As you are a third place team.
4954.28s - 4955.12s |  Really?
4956.20s - 4958.32s |  Yeah, apparently you didn't drink enough beer
4958.32s - 4962.13s |  as designated beer drinker.
4962.13s - 4966.69s |  Your answer was je ne give a fuck pas
4966.69s - 4968.61s |  just like your Stepmom.
4976.59s - 4979.23s |  Oh my God, I feel like Dude Perfect right now.
4979.23s - 4981.55s |  Lentile wins.
4981.55s - 4986.03s |  And their wager was no actual points.
4986.03s - 4987.19s |  Zero.
4987.19s - 4988.59s |  So they remain.
4988.59s - 4996.19s |  You's a fucking rat.
4996.19s - 5000.58s |  And they said transport, session,
5000.58s - 5005.58s |  presentation, physical, network, data, and application,
5006.42s - 5007.66s |  which is the right order,
5007.70s - 5016.55s |  but it's not in the form of a question.
5016.55s - 5019.23s |  Epic fail you could have imagined.
5019.23s - 5035.41s |  God, this is so exciting.
5038.47s - 5040.59s |  And it comes down to this.
5041.75s - 5044.47s |  Only Lands, who was in the lead the whole time,
5044.47s - 5047.87s |  pretty much, for 5,700.
5047.87s - 5049.55s |  That's a fucking lie.
5049.55s - 5051.27s |  And before I read their answer,
5051.27s - 5053.15s |  I'm gonna tell you what they wagered.
5054.51s - 5055.87s |  They wagered, hold on.
5055.87s - 5058.39s |  Now somebody, give me one of those goon photographers.
5058.39s - 5060.15s |  Take a picture of this shit.
5060.15s - 5066.15s |  They wagered 5,700, all of it.
5066.15s - 5069.31s |  So they either have one of the highest scores
5069.31s - 5071.07s |  in Hacker Jeopardy history,
5071.07s - 5074.83s |  or they have pissed away the chance for a black match
5074.83s - 5081.85s |  into the wind, just like the Vegas Scirocco wins.
5081.85s - 5087.58s |  The fucking question says reverse.
5087.58s - 5093.80s |  Does that make you excited for what I'm going to read?
5093.80s - 5100.30s |  Said what is application, data link, network, physical,
5100.78s - 5140.54s |  presentation, said the truth.
5140.54s - 5142.10s |  Fuck every last one of you.
5143.58s - 5148.64s |  My name is Lin Trial, and here's what I want you,
5148.64s - 5152.76s |  until we meet again in this space next year,
5152.76s - 5155.48s |  be fucking excellent to each other.
5155.48s - 5156.32s |  I love you all.


url: https://www.youtube.com/watch?v=4EmstuO0Em8
title: DEF CON 32 - Disenshittify or die! How hackers can seize the means of computation - Cory Doctorow
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=4EmstuO0Em8",
  "title": "DEF CON 32 - Disenshittify or die! How hackers can seize the means of computation - Cory Doctorow",
  "description": "The enshittification of the internet wasn't inevitable. The old, good internet gave way to the enshitternet because we let our bosses enshittify it. We took away the constraints of competition, regulation, interop and tech worker power, and so when our bosses yanked on the big enshittification lever in the c-suite, it started to budge further and further, toward total enshittification. A new, good internet is possible - and necessary - and it needs you.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2990,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20240916"
}

0.00s - 2.68s | This text was transcribed using whisper model: large-v2

 Hello, how are you?
2.68s - 4.32s |  Nice to see you.
4.32s - 7.52s |  Thank you to DEF CON, thank you especially to the goons
7.52s - 9.68s |  and the other volunteers who are out here
9.68s - 12.16s |  busting their humps so we can have such a great time.
12.16s - 14.36s |  And thank you all for coming.
14.36s - 16.52s |  I thought I had 50 minutes, I have 45.
16.52s - 19.80s |  I'm gonna talk fast and instead of Q&A,
19.80s - 21.80s |  there's a bookseller in the book signing areas
21.80s - 23.00s |  bringing in some of my books.
23.00s - 24.84s |  You don't have to buy a book, just come over and say hello.
24.84s - 27.68s |  I'm gonna sit there until everyone who's got a question
27.68s - 29.20s |  has had a chance to ask it.
29.20s - 32.64s |  So that's opposite the vendor area gates after this talk.
32.64s - 34.12s |  That's the housekeeping here.
34.12s - 36.08s |  So I wanna start by asking an important question
36.08s - 40.20s |  which is what the fuck happened to the old good internet?
40.20s - 45.20s |  I mean, our bosses were a little surveillance happy
45.24s - 47.80s |  and yeah, they were totally up for sharing their data
47.80s - 49.04s |  with the NSA.
49.04s - 52.24s |  And if there was ever a toss up between our user security
52.24s - 55.60s |  and growth, they always cashed out for YOLO.
55.60s - 58.76s |  But Google search, whatever else we could say about it,
58.80s - 60.32s |  it worked.
60.32s - 63.12s |  And Facebook actually used to give you a feed
63.12s - 66.56s |  that shows you the things that you asked to see.
66.56s - 69.84s |  Uber used to be cheaper than a taxi
69.84s - 73.60s |  and pay the drivers more than a cab driver.
73.60s - 77.12s |  Amazon used to actually sell products,
77.12s - 81.04s |  not this shine grade self-destructing drop ship garbage
81.04s - 82.52s |  from brands you've never heard of
82.52s - 87.92s |  whose names consist entirely of consonants.
87.92s - 89.84s |  Apple used to defend your privacy
89.84s - 91.80s |  rather than spying on you with a device
91.80s - 95.08s |  you're not allowed to modify to turn off the surveillance.
95.08s - 97.84s |  There was a time where if you search for an album
97.84s - 99.92s |  on Spotify, you'd find the album,
99.92s - 104.04s |  not a playlist with the same image and title as the album,
104.04s - 106.00s |  but which consists of a bunch of things
106.00s - 108.80s |  that someone paid to put in that playlist.
108.80s - 111.28s |  Microsoft used to sell you software.
111.28s - 113.40s |  Yeah, it was very buggy software,
113.40s - 115.20s |  but now they don't even do that.
115.20s - 117.28s |  They just let you access apps in the cloud
117.28s - 119.28s |  and they watch how you use those apps,
119.72s - 121.60s |  figure out which features you value the most,
121.60s - 122.84s |  pull them out of the basic rate
122.84s - 125.00s |  and sell them back to you as an upsell.
125.00s - 127.56s |  What, and I cannot stress this enough,
127.56s - 129.44s |  what the fuck happened?
130.36s - 134.08s |  So obviously I am talking about inshittification.
134.08s - 134.96s |  And from the outside,
134.96s - 137.16s |  here's what inshittification looks like.
137.16s - 139.92s |  First, you see a business that's being good to its end users.
139.92s - 142.48s |  You know, Google puts the best search results at the top.
142.48s - 143.92s |  Facebook shows you a feed of posts
143.92s - 145.52s |  from people you asked to follow.
145.52s - 147.76s |  Uber charges small dollars for a cab.
147.76s - 150.60s |  Amazon subsidizes goods and returns and shipping
150.60s - 152.84s |  and puts the best match for your product search
152.84s - 154.24s |  at the top of the search results.
154.24s - 156.12s |  And that's stage one.
156.12s - 158.60s |  That's the part where they're good to end users,
158.60s - 160.36s |  but there's a hidden part of stage one,
160.36s - 162.48s |  call it like stage 1A,
162.48s - 163.96s |  and that's the part where they're figuring out
163.96s - 166.44s |  how to lock in those users.
166.44s - 170.24s |  So if you're Facebook, the users just do it for you.
170.24s - 173.48s |  You joined Facebook because there were people on Facebook
173.48s - 175.08s |  you wanted to hang out with.
175.08s - 176.80s |  And other people, they joined Facebook
176.80s - 178.36s |  because they wanted to hang out with you.
178.36s - 181.60s |  That's those old network effects in action.
181.60s - 185.52s |  And with network effects come a collective action problem
185.52s - 187.12s |  because you love your friends,
187.12s - 189.56s |  but God damn, are they a pain in the ass.
189.56s - 191.88s |  Sure, you all agree that Facebook sucks,
191.88s - 194.36s |  but can you agree on when it's time to leave?
194.36s - 195.52s |  No way.
195.52s - 198.12s |  Can you agree on where to go if you're going to leave?
198.12s - 199.80s |  Hell no.
199.80s - 202.20s |  You're there because that's where the support group
202.20s - 203.96s |  for your rare disease is hanging out.
203.96s - 205.40s |  And your bestie is there
205.44s - 207.16s |  because that's where they talk with the people
207.16s - 209.32s |  in the country that they moved away from.
209.32s - 210.84s |  And then there's that friend who coordinates
210.84s - 213.40s |  their kids' Little League carpools on Facebook.
213.40s - 215.60s |  And the best dungeon master you know is there,
215.60s - 216.60s |  and she's not going to leave
216.60s - 218.52s |  because that's where her customers are.
218.52s - 221.04s |  So you're stuck because even though Facebook use
221.04s - 222.80s |  comes at a high cost to you,
222.80s - 225.72s |  your privacy, your dignity, your sanity,
225.72s - 227.52s |  it's still less than the switching cost
227.52s - 229.88s |  you'd have to endure if you went somewhere else.
229.88s - 232.40s |  All those friends who have taken you hostage,
232.40s - 235.68s |  and who you are also holding hostage.
235.68s - 238.84s |  Now, sometimes companies lock you in with money.
238.84s - 240.40s |  Amazon gets you to prepay
240.40s - 242.00s |  for a year's worth of shipping with Prime,
242.00s - 244.28s |  and they want to sell you your Audible audiobooks
244.28s - 245.88s |  on a monthly subscription,
245.88s - 247.48s |  which virtually guarantees
247.48s - 250.12s |  that every shopping expedition starts on Amazon
250.12s - 252.04s |  because you've already paid for the shipping.
252.04s - 254.36s |  Sometimes they lock you in with digital rights management,
254.36s - 256.52s |  like HP, who will sell you a printer
256.52s - 259.16s |  with four ink cartridges with fluid inside it
259.20s - 262.88s |  that retails for more than $10,000 a gallon.
262.88s - 265.92s |  So, and they use DRM to stop you
265.92s - 268.00s |  from refilling any of those cartridges
268.00s - 269.80s |  or using a third-party cart.
269.80s - 273.08s |  So when one cartridge runs dry, you have to refill it,
273.08s - 275.16s |  or you have to throw away the other three cartridges,
275.16s - 276.12s |  which are full of liquid
276.12s - 278.92s |  that costs more than vintage Veuve Clicquot.
278.92s - 282.16s |  Sometimes the vendor uses a grab bag of locked-in techniques
282.16s - 284.32s |  like you can't run an iOS app
284.32s - 286.12s |  unless you're using Apple hardware,
286.12s - 287.76s |  and you can't run the music, the books,
287.76s - 290.96s |  and the videos you bought from Apple, except in an iOS app.
295.10s - 296.54s |  That's a happy sound.
298.26s - 330.11s |  Can you?
330.11s - 331.11s |  Can we get this mic up?
331.11s - 332.15s |  Oh, here we are.
332.15s - 332.99s |  Great.
334.27s - 336.15s |  We have the technology.
336.15s - 338.79s |  Sometimes the vendor is doing this grab bag stuff
338.79s - 339.63s |  like Apple does.
339.63s - 341.83s |  So you need the Apple hardware to run the Apple apps.
341.83s - 344.15s |  You need the Apple apps to play the Apple media.
344.15s - 347.43s |  And then the phone itself, it uses parts pairing,
347.43s - 350.11s |  which is DRM handshakes between subcomponents
350.11s - 351.91s |  and the main computer and the device.
351.91s - 354.67s |  So you can't use third-party parts to fix it.
354.67s - 358.99s |  And every part in that device in your iPhone
358.99s - 362.83s |  has got a microscopic Apple logo engraved on it
362.83s - 365.35s |  so that if it gets broken up for parts in the Far East
365.35s - 366.75s |  and shipped back to the U.S.,
366.75s - 369.19s |  they can ask U.S. Customs and Border Patrol
369.19s - 372.07s |  to seize it at the border as a trademark violation.
372.07s - 374.19s |  That's some real thinking different.
374.19s - 376.03s |  So getting you locked in
376.03s - 379.55s |  completes phase one of the inshittification cycle
379.55s - 382.07s |  and heralds the beginning of stage two.
382.07s - 384.99s |  This is when things are made worse for you as an end user
384.99s - 387.47s |  in order to make things better for the business customers
387.47s - 388.95s |  that they're making money from.
388.95s - 392.47s |  So for example, platforms might poison their search results
392.47s - 394.51s |  like Google, which sells more and more
394.51s - 396.51s |  of that results page to ads
396.51s - 398.79s |  that are identified with smaller and smaller
398.79s - 402.27s |  and grayer and grayer type next to it that says ad.
402.27s - 405.43s |  Or Amazon, which sells off its search results
405.43s - 407.07s |  calling this an ad business.
407.07s - 409.71s |  They make $38 billion a year
409.71s - 412.03s |  selling search placement for your queries
412.03s - 415.11s |  so that the first result when you search Amazon on average
415.11s - 418.83s |  is 29% more expensive than the best results on Amazon.
418.83s - 421.79s |  The first row is 25% more expensive
421.79s - 423.27s |  than the best result on Amazon
423.27s - 425.35s |  and that best result is on average
425.35s - 429.51s |  17 places down on that search result page, right?
429.51s - 431.67s |  Or the vendor, they'll poison your feed
433.59s - 435.15s |  like Facebook, which started off
435.15s - 437.71s |  obviously showing you the things that you asked to see
437.71s - 439.87s |  but the quantum of content from the people
439.87s - 442.11s |  that you asked to hear from has dwindled
442.11s - 444.95s |  and dwindled to a kind of homeopathic residue
444.95s - 447.35s |  leaving behind a void that can be filled up
447.35s - 449.75s |  with things that people will pay to show you.
449.75s - 452.19s |  So a lot of that is ads, but a lot of it is boosted posts
452.19s - 455.31s |  from publishers that you haven't subscribed to.
455.31s - 457.67s |  Those publishers, they have to pay
457.67s - 459.67s |  because they can't reach their own subscribers
459.67s - 461.63s |  without paying to boost.
461.63s - 464.03s |  Now at this point, you might be thinking,
464.03s - 466.07s |  sure, if you're not paying for the product,
466.07s - 467.79s |  you're the product, but that is bullshit.
467.79s - 470.07s |  It is absolute bullshit.
470.07s - 471.87s |  The people who buy Google ads,
471.87s - 474.95s |  they pay more every year for worse targeting
474.95s - 476.63s |  and more ad fraud.
476.63s - 479.19s |  Like the publishers who are paying to reach you
479.19s - 480.99s |  even though you've subscribed to them.
480.99s - 483.75s |  The Amazon sellers with the best match for your query
483.75s - 485.55s |  have to outbid everyone else
485.55s - 487.31s |  just to be in the first page of results
487.31s - 490.35s |  and it costs so much to sell on Amazon,
490.35s - 494.83s |  41 to 51, 45 to 51% of the sale price
494.83s - 496.79s |  of everything that you buy on Amazon
496.79s - 499.03s |  is being scooped up by Don Bezos
499.03s - 500.91s |  and the Amazon crime family.
500.91s - 505.51s |  Those sellers, they do not have the margin
505.51s - 508.51s |  to kick up 45% to Amazon.
508.51s - 510.47s |  So they have to raise prices
510.47s - 512.43s |  in order to avoid losing money on every sale.
512.43s - 514.07s |  But wait, I hear you say.
515.63s - 517.43s |  But wait, I hear you say.
518.43s - 520.47s |  Things on Amazon aren't more expensive
520.47s - 523.07s |  than the things I buy at Target or Walmart
523.07s - 525.59s |  or my mom and pop store direct from the vendor.
525.59s - 528.23s |  How can they be raising prices on Amazon
528.23s - 529.79s |  if the price on Amazon is the same
529.79s - 530.71s |  as the price everywhere else?
530.71s - 532.95s |  Does anyone want to guess how that works?
534.27s - 537.03s |  They raise the prices everywhere else
537.03s - 539.35s |  because Amazon binds their sellers
539.35s - 542.67s |  to a policy called most favored nation status,
542.67s - 544.75s |  which means that the cheapest price they offer
544.75s - 546.87s |  has to be matched on Amazon.
546.99s - 550.15s |  So they sell more, they charge more everywhere.
550.15s - 553.83s |  Now, these sellers are Amazon's best customers.
553.83s - 555.27s |  They are paying for the product
555.27s - 557.55s |  and they are still getting screwed.
557.55s - 559.63s |  Paying for the product does not fill
559.63s - 562.99s |  your vapid boss's shriveled heart with so much joy
562.99s - 564.99s |  that he decides to stop trying to think of ways
564.99s - 567.03s |  to fuck you over.
567.03s - 568.27s |  Look at Apple.
568.27s - 571.07s |  Remember when Apple offered every iOS user
571.07s - 573.71s |  a one-click opt-out for app-based surveillance
573.71s - 578.11s |  and 96% of iOS users ticked that box,
578.11s - 583.11s |  the other 4% being drunk, confused or Facebook employees?
583.15s - 586.51s |  I mean, this cost Apple 10 billion
586.51s - 589.39s |  or it cost Facebook $10 billion in the first year alone
589.39s - 590.83s |  and we love to see it,
590.83s - 593.95s |  but did you know that at the same time,
593.95s - 596.75s |  Apple turned on iOS spying
596.75s - 600.11s |  that gathered exactly the same data on iOS users
600.11s - 602.51s |  for exactly the same purpose for ad targeting
602.55s - 604.15s |  for its own ad network
604.15s - 606.15s |  and did not give them any way to opt out
606.15s - 607.79s |  and lied about it.
608.83s - 612.55s |  Now, your iPhone is not an ad-supported gimme.
612.55s - 614.63s |  You paid a thousand fucking dollars
614.63s - 616.99s |  for that distraction rectangle in your pocket
616.99s - 619.47s |  and you are still the product.
619.47s - 622.55s |  What's more, Apple has rigged iOS
622.55s - 626.27s |  so that you can't mod the OS to block that spying.
626.27s - 627.71s |  If you're not paying for the product,
627.71s - 629.11s |  yeah, you're the product,
629.11s - 630.91s |  but if you are paying for the product,
630.91s - 633.39s |  you are still the product.
633.39s - 636.07s |  Just ask farmers who shell out six figures
636.07s - 637.95s |  for mission-critical tractors,
637.95s - 640.39s |  but can't actually use their tractors
640.39s - 643.03s |  when they swap parts into them after they break down
643.03s - 645.59s |  until the manufacturer charges them 200 bucks
645.59s - 647.87s |  to send a guy to the end of a lonely country road
647.87s - 650.23s |  and type an unlock code into the console.
650.23s - 652.71s |  John Deere is not giving away tractors.
652.71s - 655.03s |  Give John Deere half million for a tractor
655.03s - 656.91s |  and you will be the product.
656.91s - 659.91s |  Please, I'm begging you, my brothers and sisters in Christ,
659.91s - 662.59s |  please stop saying, if you're not paying for the product,
662.59s - 664.03s |  you're the product.
664.03s - 666.99s |  Okay, so that is phase two of inshitification.
666.99s - 670.07s |  Phase one, be good to your users, but lock them in.
670.07s - 672.15s |  Phase two, screw those users a little
672.15s - 673.71s |  so you can be good to business customers
673.71s - 676.27s |  while locking them in because they need those users.
676.27s - 679.03s |  Then phase three, screw everybody
679.03s - 681.15s |  and take all the value for yourself.
681.15s - 684.47s |  Leave behind the absolute bare minimum of utility
684.47s - 687.23s |  so that everyone stays locked into this pile of shit.
687.23s - 690.91s |  Inshitification, a tragedy in three acts.
690.91s - 694.07s |  So that is what inshitification looks like from the outside.
694.07s - 696.59s |  But what is going on inside the company?
696.59s - 699.71s |  What is the pathological mechanism?
699.71s - 702.91s |  What sci-fi entropy rate are our bosses aiming
702.91s - 706.11s |  at these products to make them so bad so quickly?
706.11s - 709.59s |  Well, I call that mechanism twiddling.
709.59s - 712.47s |  Twiddling is when someone is altering the backend
712.47s - 715.07s |  of a service to change its business operations,
715.07s - 718.55s |  to change its prices, its costs, its search ranking,
718.55s - 720.43s |  its recommendation criteria,
720.43s - 723.99s |  and other foundational aspects of the system.
723.99s - 727.47s |  Digital platforms are a twiddler's utopia.
727.47s - 730.75s |  A grocer would need an army of teenagers
730.75s - 733.15s |  with pricing guns on rollerblades
733.15s - 734.67s |  to reprice everything in the store
734.67s - 737.51s |  if someone comes in who looks like they're feeling spendy.
737.51s - 740.11s |  But McDonald's Investments has a portfolio company
740.11s - 742.55s |  called Plexure, and they advertise
742.55s - 744.45s |  that they can use surveillance data
744.49s - 746.97s |  to figure out when a customer has just been paid
746.97s - 749.97s |  and add three bucks to the price of the breakfast sandwich.
751.09s - 753.89s |  And of course, as the prophet William Gibson told us,
753.89s - 756.13s |  cyberspace is everting.
756.13s - 757.77s |  With digital shelf tags,
757.77s - 760.41s |  grocers can twiddle prices in real time,
760.41s - 761.97s |  like the grocers in Norway,
761.97s - 765.57s |  where they're adding these e-ink grocery shelf tags
765.57s - 769.41s |  and changing prices up to 2,000 times a day.
769.41s - 771.61s |  Now, it's not just grocery stores.
771.61s - 774.69s |  Every Uber driver gets offered a different wage
774.69s - 776.07s |  for every job.
776.07s - 779.49s |  If the driver's been picky lately, the job pays more.
779.49s - 781.17s |  But if the driver's been desperate enough
781.17s - 785.13s |  to grab every job that the app is offering,
785.13s - 787.97s |  the pay goes down and down and down.
787.97s - 789.77s |  The law professor, Veena Dubal,
789.77s - 792.89s |  calls this algorithmic wage discrimination,
792.89s - 795.01s |  and it's a prime example of twiddling.
795.01s - 797.37s |  And every YouTuber, every TikToker,
797.37s - 799.39s |  they know what it's like to be twiddled.
799.43s - 801.95s |  You spend weeks or months working on a video,
801.95s - 803.79s |  you spend thousands of dollars,
803.79s - 806.11s |  and then the algorithm decides that no one,
806.11s - 807.89s |  not even your subscribers,
807.89s - 810.67s |  not searchers who type in the name of the video,
810.67s - 812.71s |  will actually see that video.
812.71s - 813.55s |  Why?
813.55s - 814.55s |  Who knows?
814.55s - 817.19s |  The algorithm's rules are not public
817.19s - 821.03s |  because content moderation is the only security discipline
821.03s - 822.15s |  in which we still say
822.15s - 824.31s |  that there is security through obscurity.
824.31s - 826.79s |  We can't tell you how the Como algorithm works,
826.79s - 829.09s |  otherwise you might figure out how to cheat.
829.79s - 831.85s |  YouTube, in other words, is the kind of shitty boss
831.85s - 834.89s |  who docks your paycheck every week for violating rules,
834.89s - 836.73s |  but won't tell you what those rules are
836.73s - 838.71s |  in case you figure out how to break them next week
838.71s - 841.29s |  without him docking your paycheck.
841.29s - 844.65s |  Now, twiddling also works in some users' favor, of course.
844.65s - 847.49s |  Sometimes platforms twiddle things to make things better
847.49s - 850.53s |  for some of their end users or business customers.
850.53s - 852.57s |  So the best example I know about this
852.57s - 855.29s |  comes from the Forbes journalist Emily Baker White,
855.29s - 857.69s |  who broke a story about how TikTok
857.69s - 859.05s |  has a feature on its backend
859.05s - 860.97s |  that its strategic managers can use
860.97s - 862.61s |  called the heating tool.
862.61s - 864.61s |  When a manager applies the heating tool
864.61s - 866.17s |  to a performer's account,
866.17s - 868.03s |  that performer's videos are thrust
868.03s - 871.09s |  into the feeds of millions of users
871.09s - 872.41s |  without regard to whether or not
872.41s - 874.41s |  the recommendation algorithm
874.41s - 878.15s |  would organically recommend that to those viewers.
878.15s - 879.65s |  Now, why would they do that?
879.65s - 883.09s |  Here's an analogy from my Dewey boyhood
883.09s - 884.97s |  growing up in Toronto.
884.97s - 886.09s |  There was a traveling fare
886.09s - 887.53s |  that used to come to Toronto every summer
888.37s - 889.71s |  called the Canadian National Exhibition.
889.71s - 891.97s |  And if you've been to a fare like the X,
891.97s - 895.21s |  you know that you always spot some guy on the midway
895.21s - 897.85s |  lugging around a giant teddy bear.
897.85s - 899.55s |  Nominally, you win those teddy bears
899.55s - 901.73s |  by getting five balls in a peach basket.
901.73s - 903.21s |  But to a first approximation,
903.21s - 907.21s |  no one has ever gotten five balls in a peach basket.
907.21s - 909.21s |  That guy won his teddy bear
909.21s - 910.99s |  because a carny gestured at him and said,
910.99s - 912.09s |  "'Fella, I like your face.
912.09s - 913.83s |  "'I tell you what I'm gonna do.
913.83s - 915.77s |  "'You get just one ball in that peach basket.
915.77s - 917.01s |  "'I'll give you a key chain.
917.03s - 918.07s |  "'You got two key chains.
918.07s - 920.05s |  "'I'll let you trade up to the teddy bear.'"
920.05s - 921.97s |  That is how that guy got the teddy bear,
921.97s - 925.69s |  which he is now doomed to drag up and down the midway
925.69s - 927.21s |  all goddamn day.
927.21s - 929.97s |  Now, why did the carny give away the teddy bear?
929.97s - 932.57s |  Because it turned that guy into a walking billboard
932.57s - 933.85s |  for the midway games.
933.85s - 936.61s |  If that dopey looking Judas goat
936.61s - 938.21s |  can win a giant teddy bear,
938.21s - 940.37s |  then maybe you can too,
940.37s - 941.93s |  except you can't.
941.93s - 944.49s |  TikTok's heating tool is a way to give away
944.49s - 947.37s |  extremely tactical giant teddy bears.
947.37s - 949.73s |  When someone at the TikTok brain trust
949.73s - 952.61s |  decides they need more sports bros on the platform,
952.61s - 954.29s |  they pick out one bro at random
954.29s - 955.93s |  and they make him king for the day.
955.93s - 958.13s |  They heat the shit out of his account.
958.13s - 959.93s |  That guy gets a bazillion views
959.93s - 962.57s |  and he starts running around in all the sports bro forums,
962.57s - 963.71s |  trumpeting his success.
963.71s - 967.65s |  I am the Louis Pasteur of online sports bro content.
968.81s - 970.65s |  The other sports bros pile in
970.65s - 972.93s |  and they start retooling to make video
972.93s - 976.81s |  that complies with the idiosyncratic requirements of TikTok.
976.81s - 979.49s |  And when they fail to get giant teddy bears of their own,
979.49s - 982.41s |  they assume it's because they're doing TikTok wrong
982.41s - 985.05s |  because they don't know about the heating tool.
985.05s - 987.97s |  But then comes the day when the TikTok star chamber
987.97s - 991.09s |  decides that they've got enough sports bros on the platform
991.09s - 993.89s |  so they take the heat off that one lucky sports bro
993.89s - 996.93s |  and maybe they start heating up some lucky astrologer.
996.93s - 999.41s |  Giant teddy bears are all over the place.
999.41s - 1001.29s |  Those Uber drivers who the New York Times
1001.29s - 1002.93s |  lavished so much ink on
1002.93s - 1005.97s |  who are making $100,000 a year driving for Uber
1005.97s - 1008.57s |  or the sub stackers who are rolling in dough
1008.57s - 1012.17s |  or Joe Rogan's $100 million Spotify play out.
1012.17s - 1015.37s |  Those are all people who are the unwitting recipients
1015.37s - 1016.81s |  of giant teddy bears.
1016.81s - 1019.45s |  And those giant teddy bears are a goddamn bargain
1019.45s - 1022.73s |  because every dollar you spend on a giant teddy bear
1022.73s - 1025.49s |  turns into five or $10 worth of free labor
1025.49s - 1027.05s |  from people who think that they have a shot
1027.05s - 1028.89s |  of earning one of their own.
1028.89s - 1030.49s |  Now, platforms can play games
1030.49s - 1032.45s |  with every part of their business logic
1032.45s - 1034.33s |  in highly automated ways.
1034.33s - 1036.29s |  That allows them to quickly and efficiently
1036.29s - 1038.25s |  siphon value from end users
1038.25s - 1039.77s |  and give it to business customers
1039.77s - 1042.05s |  from business customers back to end users.
1042.05s - 1043.49s |  And then back again,
1043.49s - 1047.57s |  hiding the P in the shell game at machine speeds
1047.57s - 1049.89s |  until they've got everyone so turned around
1049.89s - 1052.17s |  that they can take all the value, excuse me,
1052.17s - 1054.67s |  they can take all the value for themselves.
1054.67s - 1056.17s |  That's the how.
1056.17s - 1057.85s |  How the platforms do that trick
1057.85s - 1059.45s |  where they're good to users,
1059.45s - 1061.09s |  then they lock those users in,
1061.09s - 1062.85s |  then they take something away from those users
1062.85s - 1065.33s |  and give it to business customers and lock them in.
1065.33s - 1067.17s |  And then they take the value for themselves.
1067.17s - 1069.33s |  So now we know what is happening.
1069.33s - 1071.45s |  We know how it's happening.
1071.45s - 1074.01s |  All that's left is why is it happening?
1074.01s - 1074.85s |  Now, on the one hand,
1074.85s - 1076.01s |  there's an answer to this question
1076.01s - 1077.61s |  that's pretty goddamn obvious.
1077.61s - 1080.29s |  The less value that a business gives to its suppliers,
1080.29s - 1081.89s |  its customers, its workers,
1081.89s - 1084.09s |  the more value there is left to divide
1084.09s - 1086.21s |  among the executives and the shareholders.
1086.21s - 1090.93s |  Companies, but that why doesn't tell you why now.
1090.93s - 1092.97s |  After all, companies could have done this shit
1092.97s - 1095.17s |  any time over the last 20 years,
1095.17s - 1096.41s |  but by and large, they didn't.
1096.41s - 1098.17s |  And when they did,
1098.17s - 1099.81s |  they turned themselves into piles of shit
1099.81s - 1101.91s |  and they got treated like piles of shit.
1101.91s - 1104.07s |  We avoided them and then they died.
1104.07s - 1108.13s |  Remember MySpace or Yahoo search or LiveJournal?
1108.13s - 1110.33s |  I mean, yeah, you can go to those domains today
1110.33s - 1113.07s |  and find a bunch of AI slop and programmatic ads,
1113.07s - 1115.17s |  but those sites are gone.
1115.17s - 1116.85s |  And there's the clue.
1116.85s - 1119.97s |  It used to be that if you and shitified your product,
1119.97s - 1122.77s |  bad things happen to your company.
1122.77s - 1126.05s |  Now, there are no consequences for in shitification,
1126.05s - 1128.91s |  which is why everyone is doing it right now.
1128.91s - 1130.61s |  So I'll break that down.
1130.61s - 1134.53s |  There are four forces that discipline technology companies.
1134.53s - 1136.97s |  The first one is obviously competition.
1136.97s - 1139.29s |  If your customers find it easy to leave,
1139.29s - 1141.37s |  then you have to worry about them leaving.
1141.37s - 1144.51s |  Now, many factors can contribute to how hard or easy it is
1144.51s - 1145.81s |  to depart a platform.
1146.79s - 1149.47s |  Think of the network effects that Facebook has going for it
1149.47s - 1151.47s |  and the intrinsic cost of going somewhere else
1151.47s - 1154.07s |  and leaving behind the people that you love there.
1154.07s - 1155.47s |  But the most important factor
1155.47s - 1156.87s |  on whether you can leave a platform
1156.87s - 1159.55s |  is whether there's somewhere else to go.
1159.55s - 1161.67s |  Now, remember 2012,
1161.67s - 1165.19s |  Facebook bought Instagram for a billion dollars.
1165.19s - 1166.81s |  Now that might seem like chump change
1166.81s - 1169.81s |  in these days of 11 digit big tech acquisitions,
1169.81s - 1172.79s |  but that was a big sum in those innocent days.
1172.83s - 1176.11s |  And it was an especially big sum to pay for Insta.
1176.11s - 1178.83s |  The company had 13 employees,
1178.83s - 1182.03s |  a mere 25 million registered users.
1182.03s - 1183.75s |  But what mattered to Zuck
1183.75s - 1186.03s |  wasn't how many users Insta had,
1186.03s - 1187.65s |  it's where those users came from.
1187.65s - 1190.83s |  Does anyone know where those Insta users were coming from?
1190.83s - 1194.59s |  Facebook, they were leaving Facebook and joining Insta.
1194.59s - 1195.91s |  They were sick of Facebook,
1195.91s - 1197.67s |  even though they liked the people there,
1197.67s - 1200.75s |  they hated creepy Zuck, they hated the platform,
1200.75s - 1202.91s |  and so they left and they didn't come back.
1202.91s - 1206.91s |  So Zuck spent a billion dollars to recapture them.
1206.91s - 1209.31s |  A fact that he put in writing
1209.31s - 1213.43s |  in a midnight email to his CFO, David Ebersman,
1213.43s - 1215.79s |  explaining that he was paying over the odds
1215.79s - 1219.15s |  because his users hated him and they loved Insta.
1219.15s - 1221.59s |  So even if they quit Facebook, the platform,
1221.59s - 1224.83s |  they would still be captured by Facebook, the company.
1224.83s - 1228.11s |  Now on paper, that acquisition is illegal.
1228.11s - 1230.13s |  Normally that'd be hard to prove
1230.13s - 1232.35s |  because you'd have to prove that Zuck bought them
1232.35s - 1234.81s |  for an anti-competitive purpose.
1234.81s - 1237.49s |  But in this case, Zuck just tripped over his own deck.
1237.49s - 1240.35s |  He actually put it in writing.
1240.35s - 1243.45s |  But Obama's DOJ and Federal Trade Commission,
1243.45s - 1244.81s |  they let it slide.
1244.81s - 1247.73s |  They were following the pro-monopoly policies
1247.73s - 1251.57s |  of Reagan, Bush One, Clinton, and Bush Two,
1251.57s - 1254.41s |  set an example that Trump would follow,
1254.41s - 1255.77s |  greenlighting giga-mergers
1255.77s - 1259.47s |  like the catastrophic, incestuous Warner Discovery merger
1259.51s - 1260.75s |  that as of this week,
1260.75s - 1265.47s |  restated its value down by $10 billion over one year.
1265.47s - 1267.07s |  Indeed, for 40 years,
1267.07s - 1269.83s |  starting with Carter and accelerating through Reagan,
1269.83s - 1273.15s |  the U.S. has encouraged monopoly formation
1273.15s - 1274.89s |  as an official policy
1274.89s - 1277.73s |  on the grounds that monopolies are efficient.
1277.73s - 1279.73s |  If everyone is using Google Search,
1279.73s - 1281.51s |  that's something we should celebrate.
1281.51s - 1283.87s |  It means they've got the very best search.
1283.87s - 1287.59s |  And wouldn't it be perverse to spend public funds
1287.59s - 1290.99s |  to punish them for making the best product?
1290.99s - 1292.63s |  But as we all know,
1292.63s - 1296.11s |  Google Search did not maintain dominance by being best.
1296.11s - 1298.75s |  They did it by paying bribes.
1298.75s - 1302.11s |  They spend more than $20 billion a year on Apple
1302.11s - 1304.79s |  to be the default iOS search.
1304.79s - 1308.23s |  They spend billions more to be defaults at Samsung, Mozilla,
1308.23s - 1310.03s |  and anyone else making a product
1310.03s - 1311.99s |  or a service with a search box,
1311.99s - 1314.39s |  ensuring that you never stumble on a search engine
1314.39s - 1316.39s |  that's any better than theirs.
1317.27s - 1320.19s |  Which in turn ensures that no one will ever invest
1320.19s - 1321.83s |  in a superior search engine,
1321.83s - 1324.27s |  even if they are visibly, obviously superior,
1324.27s - 1326.79s |  because why bother making something better
1326.79s - 1328.85s |  if Google's buying up all the market oxygen
1328.85s - 1331.33s |  before it can kindle a product to life?
1331.33s - 1333.69s |  Facebook, Google, Microsoft, Amazon,
1333.69s - 1335.29s |  they are not making things companies,
1335.29s - 1337.31s |  they are buying things companies.
1337.31s - 1340.03s |  They take advantage of official tolerance
1340.03s - 1342.27s |  for anti-competitive acquisitions,
1342.27s - 1345.87s |  predatory pricing, market-distorting exclusivity deals,
1345.91s - 1348.79s |  and other acts specifically prohibited
1348.79s - 1350.91s |  by our antitrust laws.
1350.91s - 1352.69s |  They become too big to fail
1352.69s - 1354.63s |  because that makes them too big to jail,
1354.63s - 1356.99s |  and then they become too big to care,
1356.99s - 1359.63s |  which is why Google Search is a pile of shit,
1359.63s - 1362.15s |  and everything on Amazon is dropship garbage
1362.15s - 1364.19s |  that instantly disintegrates into a cloud
1364.19s - 1366.23s |  of off-gas, volatile, organic compounds
1366.23s - 1367.43s |  when you open the box.
1368.99s - 1371.67s |  Once companies no longer fear losing your business
1371.67s - 1373.67s |  to a competitor, it is much easier for them
1373.67s - 1376.27s |  to treat you badly because what are you going to do?
1376.27s - 1378.99s |  Remember when Lily Tomlin would be Ernestine,
1378.99s - 1381.35s |  the AT&T operator on those SNL sketches
1381.35s - 1383.07s |  where she'd do ads for the Bell system,
1383.07s - 1386.37s |  and they'd end with, we don't care, we don't have to,
1386.37s - 1388.71s |  we're the phone company.
1388.71s - 1390.55s |  Competition is the first force
1390.55s - 1392.43s |  that serves to discipline companies
1392.43s - 1395.63s |  and the insidificatory impulses of their leadership,
1395.63s - 1399.67s |  and 40 years ago, we stopped enforcing the competition law.
1399.67s - 1403.87s |  Now, it takes an especially smooth-brained type of asshole,
1403.87s - 1406.19s |  that is, an establishment economist,
1406.19s - 1409.59s |  to insist that the collapse of every single industry
1409.59s - 1411.67s |  from eyeglasses to vitamin C
1411.67s - 1413.99s |  into a cartel of five or fewer companies
1413.99s - 1416.47s |  has nothing to do with the policies that we embraced
1416.47s - 1419.19s |  that deliberately encouraged monopoly formation.
1419.19s - 1421.19s |  It's like we used to put down rat poison,
1421.19s - 1422.71s |  and we didn't have a rat problem,
1422.71s - 1424.33s |  and then these dickheads convinced us
1424.33s - 1427.93s |  to stop putting poison down because rats are good for us.
1427.93s - 1429.47s |  We stopped putting the poison down,
1430.27s - 1431.55s |  and now rats are eating our faces,
1431.55s - 1433.07s |  and they're all running around saying,
1433.07s - 1435.79s |  who's to say where all the rats are coming from?
1435.79s - 1438.39s |  Maybe it's because we stopped putting down rat poison,
1438.39s - 1441.51s |  but maybe it's just the time of the rats.
1441.51s - 1444.63s |  The great forces of history are bearing down on this moment
1444.63s - 1446.91s |  to multiply rats beyond all measure,
1446.91s - 1449.87s |  and nothing we can do would stop that.
1449.87s - 1452.29s |  Antitrust did not slip down a staircase
1452.29s - 1455.39s |  and fall back first onto a stiletto.
1455.39s - 1458.15s |  They stabbed it in the back, and then they pushed it,
1458.15s - 1459.59s |  and when they killed antitrust,
1459.59s - 1461.91s |  they killed all hope of regulation.
1461.91s - 1465.71s |  Regulation is the second force that disciplines companies.
1465.71s - 1467.99s |  Regulation is possible,
1467.99s - 1470.47s |  but only when the regulator is more powerful
1470.47s - 1472.81s |  than the entities that it regulates.
1472.81s - 1475.55s |  When a company is bigger than the government,
1475.55s - 1477.99s |  it gets damned hard to credibly threaten them
1479.15s - 1481.67s |  no matter what crimes they're committing.
1481.67s - 1484.23s |  That's what protected IBM for all those years
1484.23s - 1485.67s |  when it had its boot on the throat
1485.67s - 1487.55s |  of the American tech industry.
1487.55s - 1490.75s |  Do you know that the DOJ fought an antitrust case
1490.75s - 1494.07s |  against IBM from 1970 to 1982?
1494.07s - 1496.39s |  They called it Antitrust Vietnam,
1496.39s - 1499.23s |  and that every year for 12 consecutive years,
1499.23s - 1501.03s |  IBM spent more on lawyers
1501.03s - 1503.73s |  to fight the U.S. Department of Justice Antitrust Division
1503.73s - 1504.99s |  than all the lawyers
1504.99s - 1507.45s |  the U.S. Department of Justice Antitrust Division paid
1507.45s - 1511.91s |  to fight all the cases in America, 12 consecutive years,
1511.91s - 1515.27s |  and that paid off because by 1982,
1515.27s - 1516.87s |  the president was Ronald Reagan,
1516.91s - 1518.27s |  a man whose official policy
1518.27s - 1520.03s |  was that monopolies were efficient,
1520.03s - 1521.31s |  and he dropped the case,
1521.31s - 1523.91s |  and Big Blue wriggled off the hook.
1523.91s - 1526.03s |  It's hard to regulate a monopolist.
1526.03s - 1528.43s |  It's hard to regulate a cartel.
1528.43s - 1530.61s |  When a sector is composed of hundreds
1530.61s - 1533.75s |  of competing companies, well, they compete.
1533.75s - 1535.59s |  They genuinely fight with one another.
1535.59s - 1537.79s |  They're trying to poach each other's customers,
1537.79s - 1540.07s |  suppliers, and key employees.
1540.07s - 1542.07s |  They are at each other's throats.
1542.07s - 1545.39s |  It's hard enough to get a couple of hundred executives
1545.39s - 1546.95s |  to agree on anything,
1546.95s - 1549.63s |  but when they're legitimately competing with one another,
1549.63s - 1552.59s |  really obsessing about how to eat each other's lunches,
1552.59s - 1554.83s |  they can't agree on anything.
1554.83s - 1556.79s |  The second one of them goes to a regulator
1556.79s - 1558.51s |  with some bullshit story
1558.51s - 1561.35s |  about how it's impossible to build a decent search engine
1561.35s - 1563.11s |  without fine-grained surveillance,
1563.11s - 1564.55s |  or impossible to have a secure
1564.55s - 1566.31s |  and easy-to-use operating system
1566.31s - 1569.27s |  without giving a veto to the vendor
1569.27s - 1570.75s |  about which apps you run,
1570.75s - 1573.87s |  or how it's impossible to administer an ISP
1573.87s - 1575.95s |  unless you slow down connections to servers
1575.95s - 1578.07s |  that haven't paid for premium carriage,
1578.07s - 1579.91s |  there's going to be some other company saying,
1579.91s - 1581.35s |  no, that's bullshit.
1581.35s - 1582.27s |  We managed it.
1582.27s - 1583.15s |  Here's our logs.
1583.15s - 1584.67s |  Here's our quarterly cashbooks,
1584.67s - 1586.23s |  and here's our customer testimonials,
1586.23s - 1588.95s |  and they prove that these guys are lying.
1588.95s - 1591.05s |  A hundred companies are a rabble.
1591.05s - 1592.11s |  They are a mob.
1592.11s - 1594.05s |  They can't agree on a lobbying position.
1594.05s - 1596.31s |  They're too busy eating each other's lunch
1596.31s - 1598.23s |  to figure out how to cater a meeting
1598.23s - 1601.11s |  where they would discuss a common lobbying position.
1601.11s - 1604.67s |  But let those hundred companies merge to monopoly.
1604.67s - 1608.27s |  Let them absorb one another in an incestuous orgy,
1608.27s - 1610.75s |  turn into five giant companies so inbred
1610.75s - 1613.23s |  they get corporate Habsburg Jaws,
1613.23s - 1616.19s |  and they will become a cartel.
1616.19s - 1618.03s |  And it's easy for a cartel to agree
1618.03s - 1620.57s |  on what bullshit they're going to tell their regulators,
1620.57s - 1623.27s |  and to mobilize some of those excess billions
1623.27s - 1625.27s |  that they've reaped through consolidation,
1625.27s - 1627.99s |  which freed them from wasteful competition
1627.99s - 1631.15s |  so that they can capture their regulators completely.
1631.15s - 1633.11s |  You know, Congress used to pass
1633.11s - 1634.79s |  consumer federal privacy laws
1634.79s - 1636.77s |  whenever we got a new technology.
1636.77s - 1637.99s |  Not anymore.
1637.99s - 1640.07s |  The last time Congress managed to sit down
1640.07s - 1642.61s |  and pass a federal consumer privacy law in this country
1642.61s - 1647.31s |  was 1988, the Video Privacy Protection Act.
1647.31s - 1649.81s |  It bans video store clerks from telling newspapers
1649.81s - 1652.19s |  which VHS cassettes you took home.
1652.19s - 1654.01s |  In other words, it regulates three things
1654.01s - 1655.85s |  that no longer exist.
1656.85s - 1659.33s |  The threat of having your video rental history
1659.33s - 1661.85s |  out there in the public eye was not the last
1661.85s - 1663.69s |  or the most important privacy threat
1663.69s - 1665.65s |  we have faced since 1988,
1665.65s - 1668.11s |  and yet Congress has completely failed
1668.11s - 1669.41s |  to pass a privacy law.
1670.27s - 1673.21s |  Tech companies' regulatory capture
1673.21s - 1675.85s |  involves a risible and transparent gambit
1675.85s - 1677.75s |  that is so stupid it's an insult
1677.75s - 1679.81s |  to all those risible, transparent gambits
1679.81s - 1682.43s |  working so hard out there in the world every day.
1682.43s - 1683.83s |  That gambit is that they claim
1683.83s - 1685.61s |  that when they violate your consumer,
1686.37s - 1687.63s |  your privacy, or your labor rights,
1687.63s - 1690.65s |  that it's not a crime because they did it with an app.
1690.65s - 1693.29s |  Algorithmic wage discrimination is not wage theft.
1693.29s - 1694.53s |  We did it with an app.
1695.53s - 1697.67s |  Spying on you from asshole to appetite,
1697.67s - 1699.25s |  not a privacy violation.
1699.25s - 1700.85s |  We did it with an app.
1700.85s - 1704.37s |  An Amazon scam that tricks people into paying 29%
1704.37s - 1706.65s |  more than the best match for their search,
1706.65s - 1708.33s |  they did it with an app.
1708.33s - 1709.65s |  Once we kill competition,
1709.65s - 1711.93s |  once we stop putting down rat poison,
1711.93s - 1713.29s |  we got cartels.
1713.29s - 1715.33s |  The rats came and ate our faces.
1716.09s - 1717.69s |  And the cartels captured their regulators.
1717.69s - 1720.17s |  The rats bought out the poison factory
1720.17s - 1721.69s |  and they shut it down.
1721.69s - 1723.25s |  So companies are not constrained
1723.25s - 1725.45s |  by competition or regulation.
1725.45s - 1726.37s |  But you know what?
1726.37s - 1727.39s |  This is tech.
1727.39s - 1729.17s |  And tech is different.
1729.17s - 1731.41s |  It is different because it's flexible.
1731.41s - 1734.13s |  Because our computers are these marvelous things
1734.13s - 1737.61s |  called Turing-complete universal von Neumann machines.
1737.61s - 1741.05s |  And that means that any insidificatory alteration
1741.05s - 1744.85s |  to a program can be disinsidified with another program.
1744.85s - 1747.33s |  Every time HP jacks up the price of ink,
1747.33s - 1749.73s |  they invite a competitor to make a refill kit
1749.73s - 1751.45s |  or a compatible cartridge.
1751.45s - 1753.65s |  When Tesla installs code
1753.65s - 1756.53s |  that only lets you use half the charge in your battery,
1756.53s - 1758.67s |  they invite a modder to start selling kits
1758.67s - 1760.05s |  to jailbreak your Tesla
1760.05s - 1762.41s |  so you can charge your whole battery.
1762.41s - 1765.11s |  Let me take you through a little example of how this works.
1765.11s - 1767.13s |  Imagine that instead of being here at DEF CON,
1767.13s - 1770.25s |  we're at a product design meeting for our company's website.
1770.25s - 1771.73s |  And the guy leading the meeting puts his hand up
1771.73s - 1773.57s |  and he says, all right, folks, here it is.
1773.57s - 1776.13s |  Our KPI is top-line ad revenue.
1776.13s - 1778.01s |  I figured out if we make the ads
1778.01s - 1780.41s |  20% more invasive and obnoxious,
1780.41s - 1782.57s |  we're going to get 2% more ad revenue.
1782.57s - 1783.89s |  We're all going to get a ski holiday
1783.89s - 1785.49s |  in Switzerland this year.
1785.49s - 1787.73s |  And one guy sticks his hand up and he says,
1787.73s - 1789.69s |  I love how you think, Elon,
1789.69s - 1794.92s |  but has it occurred to you
1794.92s - 1797.88s |  that if we make the ads 20% more obnoxious,
1797.88s - 1800.76s |  then 40% of our users will go to a search engine
1800.76s - 1802.68s |  and type, how do I stop seeing ads?
1802.68s - 1804.40s |  I mean, what a nightmare.
1804.40s - 1806.56s |  Because once a user does that,
1806.56s - 1808.42s |  the revenue from that user doesn't rise
1808.42s - 1810.40s |  to the projected 102%.
1810.40s - 1812.24s |  It doesn't stay static at 100%.
1812.24s - 1813.12s |  It goes to zero.
1813.12s - 1815.20s |  It stays there forever.
1815.20s - 1817.12s |  Any guesses why it never comes back?
1818.56s - 1820.48s |  No one ever went back to the search engine
1820.48s - 1822.68s |  and typed, how do I start seeing ads again?
1824.28s - 1826.72s |  Once the user jailbreaks their phone
1826.72s - 1828.54s |  or discovers third-party ink
1828.54s - 1829.72s |  or develops a relationship
1829.72s - 1831.64s |  with an independent Tesla mechanic
1831.64s - 1834.14s |  who'll unlock all the DLC in their car,
1834.88s - 1836.90s |  that user is gone forever.
1836.90s - 1841.02s |  Interoperability, that latent property bequeathed to us,
1841.02s - 1843.70s |  courtesy of Harris, Turing, and von Neumann,
1843.70s - 1846.74s |  and their infinitely flexible universal machines
1846.74s - 1850.50s |  is a very serious check on and shitification.
1850.50s - 1852.26s |  The fact that Congress hasn't passed
1852.26s - 1854.30s |  a privacy law since 1988,
1854.30s - 1855.98s |  in part, you can counter that
1857.66s - 1859.90s |  with the fact that the majority of web users
1859.90s - 1861.58s |  are now running ad blockers,
1861.58s - 1863.94s |  which are also privacy blockers.
1864.70s - 1867.26s |  But no one's ever installed a tracker blocker for an app
1867.26s - 1869.22s |  because reverse engineering an app
1869.22s - 1872.34s |  puts you in jeopardy of criminal and civil prosecution
1872.34s - 1875.54s |  under section 1201 of the Digital Millennium Copyright Act
1875.54s - 1877.90s |  with penalties of a five-year prison sentence
1877.90s - 1881.46s |  and a $500,000 fine for a first offense.
1881.46s - 1883.50s |  And violating those terms of service
1883.50s - 1886.72s |  puts you in jeopardy under the Computer Fraud and Abuse Act,
1886.72s - 1890.50s |  a 1986 law that Ronald Reagan was stampeded into passing
1890.50s - 1893.08s |  after watching war games and freaking out.
1893.08s - 1894.02s |  Seriously.
1895.00s - 1897.20s |  Helping others violate the terms of service
1897.20s - 1900.40s |  by giving them a mod, that makes you a tortfeasor
1900.40s - 1903.48s |  engaged in tortious interference with contract.
1903.48s - 1905.88s |  And then there's trademark, copyright, patent,
1905.88s - 1908.20s |  all the nonsense we call IP,
1908.20s - 1910.12s |  but which Jay Freeman from the City of Project
1910.12s - 1913.36s |  calls felony contempt of business model.
1913.36s - 1915.44s |  So we're back at that product planning meeting,
1915.44s - 1917.00s |  and now it's time to talk about our app.
1917.00s - 1918.32s |  And the guy leading the meeting, he says,
1918.32s - 1920.52s |  all right, we're gonna make the ads in the app
1920.52s - 1921.80s |  20% more obnoxious.
1921.80s - 1923.24s |  And everyone turns to the loud mouth
1923.24s - 1925.40s |  who shot it down last time, and he says,
1925.40s - 1928.70s |  no, no, that's fine, but look, why are we stopping at 20%?
1928.70s - 1931.52s |  Why don't we make the ads 100% more obnoxious
1931.52s - 1933.24s |  and get 10% more revenue?
1933.24s - 1935.24s |  Because we don't care if the user goes and types,
1935.24s - 1937.82s |  how do I stop seeing ads into a search engine?
1937.82s - 1939.76s |  Because you can't.
1939.76s - 1942.64s |  So YOLO, just in shitify away.
1942.64s - 1946.04s |  IP is a euphemism for any law that lets an executive
1946.04s - 1948.16s |  reach outside of the walls of their business
1948.16s - 1951.16s |  and exert control over customers, critics, and competitors.
1951.52s - 1953.48s |  And an app is just a webpage skinned
1953.48s - 1955.84s |  with the right kind of IP to make it a felony
1955.84s - 1957.20s |  to put an ad blocker in it.
1960.20s - 1963.36s |  Thank you.
1963.36s - 1966.28s |  Interop used to stop companies from shitifying.
1966.28s - 1968.54s |  If companies made their clients suck,
1968.54s - 1970.64s |  someone rolled out an alternative client.
1970.64s - 1972.96s |  If they ripped out a feature and wanted to sell it
1972.96s - 1974.96s |  back to us as a monthly subscription,
1974.96s - 1976.96s |  someone would make a compatible plugin
1976.96s - 1980.00s |  that worked for a one-time fee or, you know, for free.
1980.00s - 1983.58s |  To help people flee MySpace, Facebook gave them a bot.
1983.58s - 1986.18s |  You gave that bot your login and password for MySpace.
1986.18s - 1988.06s |  It would log in as you several times a day,
1988.06s - 1989.26s |  scrape your waiting messages,
1989.26s - 1990.70s |  put them in your Facebook inbox,
1990.70s - 1993.58s |  and autopilot them back out onto Facebook.
1993.58s - 1995.66s |  So you didn't have to choose between the people you loved
1995.66s - 1997.82s |  who were on MySpace and Facebook,
1997.82s - 2000.42s |  which had promised that it would never spy on you.
2000.42s - 2002.10s |  Do you remember that?
2002.10s - 2004.34s |  Now, thanks to the metastasis of IP,
2004.34s - 2006.78s |  all of that is off the table today.
2006.78s - 2010.22s |  Apple owes its very existence to the iWork suite,
2010.22s - 2013.36s |  pages, numbers, keynote, which are file compatible
2014.14s - 2017.36s |  with Microsoft Office, Word, Excel, and PowerPoint.
2017.36s - 2020.46s |  But make an iOS runtime that plays back the files
2020.46s - 2022.80s |  you bought from Apple stores on other platforms,
2022.80s - 2024.92s |  and they will nuke you till you glow.
2026.04s - 2027.60s |  Facebook wouldn't have had a hope
2027.60s - 2029.64s |  of breaking MySpace's grip on social media
2029.64s - 2032.32s |  without that scraper, but scrape Facebook today
2032.32s - 2034.00s |  in support of an alternative client,
2034.00s - 2037.32s |  and their lawyers will bomb you until the rubble bounces.
2037.32s - 2039.16s |  Google scraped every website in the world
2039.16s - 2040.56s |  to create a search index.
2040.56s - 2042.00s |  Try and scrape Google,
2042.00s - 2044.36s |  and your head will be on a pike.
2044.36s - 2046.10s |  When they did it, that was progress.
2046.10s - 2048.32s |  When you do it, that is piracy.
2048.32s - 2050.96s |  Every pirate wants to be an admiral.
2050.96s - 2052.84s |  And because this handful of companies
2052.84s - 2055.16s |  has so thoroughly captured their regulator,
2055.16s - 2058.24s |  they can wield the power of the state against you
2058.24s - 2060.44s |  when you try to break their grip on power,
2060.44s - 2063.52s |  even as their own flagrant violations of our rights
2063.52s - 2067.00s |  go unpunished because they do them with an app.
2067.00s - 2069.24s |  Tech lost its fear of competition.
2069.24s - 2071.68s |  It neutralized the threat from its regulators,
2072.36s - 2073.84s |  and then it put those regulators in harness
2073.84s - 2076.52s |  to attack new startups who might do unto them
2076.52s - 2079.96s |  as they did unto everyone who dominated before them.
2079.96s - 2082.34s |  But even then, there was one force
2082.34s - 2085.80s |  that still kept our bosses in check, and that was us.
2085.80s - 2087.40s |  That was tech workers.
2087.40s - 2090.88s |  Tech workers have historically been in very short supply,
2090.88s - 2094.68s |  and that gave us power, and our bosses knew it.
2094.68s - 2098.16s |  To get us to work crazy hours, they came up with a trick.
2098.16s - 2100.52s |  They appealed to our love of technology.
2100.52s - 2103.72s |  They told us we were heroes of the digital transformation,
2103.72s - 2106.20s |  that we would organize the world's information
2106.20s - 2107.56s |  and make it useful,
2107.56s - 2111.00s |  that we would bring the world closer together.
2111.00s - 2113.08s |  They brought in expert set dressers
2113.08s - 2116.08s |  to turn our workplaces into whimsical campuses
2116.08s - 2118.96s |  with free laundry, gourmet cafeterias,
2118.96s - 2121.96s |  massages, kombucha, and a surgeon on hand
2121.96s - 2123.28s |  who would freeze your eggs
2123.28s - 2125.96s |  so you could work through your fertile years.
2125.96s - 2128.96s |  They convinced us that we were being pampered
2128.96s - 2130.08s |  rather than being tricked
2130.08s - 2132.08s |  into working like government mules.
2132.08s - 2133.60s |  Now, that trick, it has a name.
2133.60s - 2137.96s |  Vovazi Ettar, the librarian, she calls it vocational awe,
2137.96s - 2141.44s |  but Elon Musk just calls it being extremely hardcore.
2141.44s - 2144.20s |  And it worked well.
2144.20s - 2146.64s |  We did put in some long-ass hours,
2146.64s - 2149.48s |  but for our bosses, this trick failed badly.
2149.48s - 2151.48s |  Because if you miss your mother's funeral
2151.48s - 2153.24s |  in order to hit some deadline,
2153.24s - 2154.56s |  and then your boss orders you
2154.56s - 2157.28s |  to insidify the product you missed the funeral for,
2157.28s - 2161.08s |  you are going to experience a profound moral injury,
2161.08s - 2165.20s |  which you are absolutely gonna make your boss very aware of.
2165.20s - 2167.40s |  Because what are they gonna do, fire you?
2167.40s - 2169.32s |  They can't hire someone else to do your job,
2169.32s - 2172.64s |  and the guy across the street will pay you just as much.
2172.64s - 2174.92s |  So workers, we held the line
2174.92s - 2179.04s |  when competition, regulation, and interoperability failed.
2179.04s - 2181.28s |  But supply caught up with demand.
2181.28s - 2184.52s |  Last year, they fired 260,000 tech sector workers.
2184.52s - 2187.80s |  First six months of this year was another 100,000.
2187.80s - 2189.96s |  You can't tell your bosses to go fuck themselves
2189.96s - 2191.52s |  because they'll fire your ass
2191.52s - 2193.04s |  and give your job to someone else
2193.04s - 2194.96s |  who'll be happy to insidify the product
2194.96s - 2196.96s |  you sweated blood to ship.
2196.96s - 2200.00s |  That's why all this is happening right now.
2200.00s - 2202.20s |  Our bosses are not different.
2202.20s - 2204.32s |  They did not catch a mind virus
2204.32s - 2206.00s |  that turned them into greedy assholes
2206.00s - 2208.04s |  who don't care about our users' wellbeing
2208.04s - 2210.00s |  or the quality of our products.
2210.00s - 2212.12s |  As far as our bosses are concerned,
2213.08s - 2216.20s |  the point of that business was to charge the most,
2216.20s - 2218.68s |  deliver the least, and share as little as possible
2218.68s - 2221.40s |  with suppliers, workers, and customers
2221.40s - 2224.96s |  in order to retain money for shareholders and executives.
2224.96s - 2226.88s |  They are not running charities.
2226.88s - 2229.48s |  Since day one, our bosses have reported
2229.48s - 2230.64s |  for work every morning,
2230.64s - 2232.32s |  grabbed the giant lever behind their desk
2232.32s - 2233.72s |  labeled in shitification,
2233.72s - 2235.88s |  and pulled on it as hard as they could.
2235.88s - 2237.72s |  But the lever didn't move much.
2237.72s - 2239.44s |  It was gummed up by competition,
2239.44s - 2241.68s |  by regulation, by interoperability,
2241.68s - 2243.44s |  by the tech workforce.
2243.44s - 2246.20s |  And as those sources of friction melted away,
2246.20s - 2249.52s |  that insidification lever started moving pretty freely.
2249.52s - 2252.36s |  Now that sucks, I know, but think about this for a sec.
2252.36s - 2255.88s |  Our bosses, despite being wildly imperfect vessels,
2255.88s - 2258.92s |  capable of rationalizing endless greed and cheating,
2258.92s - 2262.52s |  nevertheless, made a series of actually great products
2262.52s - 2266.04s |  and services, not because they were better people then,
2266.04s - 2268.80s |  but because they were subject to discipline.
2268.80s - 2271.76s |  So it follows that if we want to end the inshitticene,
2271.76s - 2273.92s |  if we want to dismantle the inshitternet,
2273.92s - 2276.12s |  if we want to build a new good internet
2276.12s - 2278.04s |  that our bosses can't wreck,
2278.04s - 2279.88s |  we need to make sure that those constraints
2279.88s - 2282.56s |  are durably installed on our new internet,
2282.56s - 2284.96s |  wound around its roots and nerves.
2284.96s - 2287.44s |  And we have to stand guard over those forces
2287.44s - 2290.12s |  so that they can't be dismantled again.
2290.12s - 2292.88s |  A new good internet is one that has the positive aspects
2292.88s - 2294.36s |  of the old good internet,
2294.36s - 2297.04s |  the ethic of technological self-determination,
2297.04s - 2299.92s |  where users of technology and the hackers,
2299.92s - 2301.28s |  the tinkerers, the startups,
2301.28s - 2303.40s |  and the others who serve as their proxies
2303.40s - 2306.20s |  can reconfigure the technology to make it work
2306.20s - 2307.68s |  so that it does what they need it to do
2307.68s - 2309.68s |  and cannot be used against them.
2309.68s - 2312.56s |  But the new good internet has to fix the defect
2312.56s - 2314.12s |  of the old good internet,
2314.12s - 2316.36s |  the part that made it hard for anyone who wasn't us
2316.36s - 2317.84s |  to figure out how to use it.
2317.84s - 2319.72s |  And hell yeah, we can do that.
2319.72s - 2322.08s |  Tech bosses swear that this is impossible.
2322.08s - 2323.76s |  You can't have a conversation with a friend
2323.76s - 2325.52s |  without Zuck being present.
2325.52s - 2326.52s |  You can't search the web
2326.52s - 2329.08s |  without letting Google scrape you down to your viscera.
2329.08s - 2331.76s |  You can't have a phone that works reliably
2331.76s - 2334.08s |  without Apple getting a veto over your software.
2334.08s - 2335.28s |  They claim that it's nonsense
2335.28s - 2337.70s |  to even ponder this proposition.
2337.70s - 2341.00s |  It's like making water that's not wet, but that is bullshit.
2341.00s - 2342.96s |  We can have nice things.
2342.96s - 2345.32s |  We can build for the people we love
2345.32s - 2348.60s |  and give them a place worthy of their time and attention.
2348.60s - 2351.52s |  To do that, we have to install constraints.
2351.52s - 2354.02s |  The first constraint, remember, it's competition.
2354.02s - 2356.38s |  We are living through an epochal shift
2356.38s - 2358.06s |  in competition policy.
2358.06s - 2362.46s |  After 40 years of antitrust enforcement in an induced coma,
2362.46s - 2364.26s |  a wave of antitrust vigor
2364.26s - 2366.82s |  has swept through governments all over the world.
2366.82s - 2370.06s |  Regulators are stepping up to ban monopolistic practices,
2370.06s - 2371.70s |  to open up walled gardens,
2371.70s - 2373.78s |  to block anti-competitive mergers,
2373.78s - 2375.82s |  and even unwind the corrupt mergers
2375.82s - 2378.30s |  that were undertaken on false pretenses.
2378.30s - 2380.74s |  Now, normally this is the part in this speech
2380.74s - 2382.32s |  where I'd listed all the amazing things
2382.32s - 2384.36s |  that have happened over the past four years,
2384.36s - 2386.46s |  the enforcement actions that block companies
2386.46s - 2388.04s |  from becoming too big to care,
2388.04s - 2390.76s |  and that scared companies away from even trying,
2390.76s - 2392.72s |  like Wiz, which just noped out
2392.72s - 2396.36s |  of the largest acquisition offer in world history,
2396.36s - 2399.20s |  turning down Google's $23 billion buyout
2399.20s - 2402.28s |  and deciding to, you know, just be a fucking business
2402.28s - 2405.06s |  that makes money by making a product that people want
2405.06s - 2407.38s |  that is sold at a competitive price.
2407.38s - 2410.40s |  Normally, I'd be listing out FTC rule-makings here,
2411.24s - 2413.40s |  that banned non-competes worldwide,
2413.40s - 2414.92s |  or the new merger guidelines
2414.92s - 2417.08s |  that the FTC and the DOJ cooked up,
2417.08s - 2419.64s |  which, among other things, make privacy something
2419.64s - 2421.92s |  that has to be considered in mergers.
2421.92s - 2424.16s |  I had a whole section of this stuff in my notes,
2424.16s - 2427.06s |  an absolute victory lap, but I deleted it this week.
2427.06s - 2429.64s |  Does anyone know why I deleted it this week?
2429.64s - 2430.70s |  Anyone wanna guess?
2431.84s - 2435.04s |  All right, this week, Judge Amit Mehta,
2435.04s - 2438.66s |  ruling for the DC Circuit of these United States of America
2438.66s - 2441.82s |  in the docket 20-3010,
2441.82s - 2445.90s |  in a case known as United States versus Google LLC,
2445.90s - 2448.34s |  found that Google is a monopolist
2448.34s - 2452.66s |  and it has acted as a monopolist to maintain its monopoly,
2452.66s - 2455.70s |  and ordered that Google and the DOJ propose a schedule
2455.70s - 2464.28s |  for a remedy like breaking the company up.
2464.28s - 2466.64s |  So yeah, that was pretty fucking epic.
2466.64s - 2468.48s |  Now, this antitrust stuff is esoteric,
2468.48s - 2469.52s |  and I'm not gonna shame you
2469.52s - 2471.76s |  if you wanna keep a little distance on the subject.
2471.76s - 2475.12s |  Nearly everyone is an antitrust normie, and that's fine.
2475.12s - 2476.16s |  But if you're a normie,
2476.16s - 2478.08s |  you're probably only catching little bits and pieces
2478.08s - 2479.00s |  of this narrative.
2479.00s - 2480.60s |  And let me tell you, the monopolists know that,
2480.60s - 2482.60s |  and they are flooding the zone with shit.
2482.60s - 2486.68s |  The Wall Street Journal has published 100 editorials
2486.68s - 2487.84s |  condemning Lena Kahn,
2487.84s - 2489.48s |  the chair of the Federal Trade Commission,
2489.48s - 2492.72s |  for doing nothing and getting nothing done with public funds.
2492.72s - 2495.48s |  Anyone out there know who owns the Wall Street Journal?
2496.48s - 2497.56s |  No?
2497.56s - 2499.12s |  Rupert Murdoch.
2499.12s - 2499.96s |  Rupert Murdoch.
2499.96s - 2502.88s |  Do you really think Rupert Murdoch pays his editorial board
2502.88s - 2505.40s |  to write 100 op-eds about someone
2505.40s - 2508.00s |  who's not getting anything done?
2508.00s - 2510.64s |  The reality is that in the United States, in the UK,
2510.64s - 2513.52s |  in the EU, in Australia, in Canada, in China,
2513.52s - 2515.24s |  in Japan, in South Korea,
2515.24s - 2518.40s |  we are seeing more antitrust action over the past four years
2518.40s - 2520.32s |  than over the preceding 40.
2520.32s - 2523.44s |  And remember, the competition law is pretty robust.
2523.44s - 2526.12s |  The problem's not the law, it's the enforcement priorities.
2526.12s - 2528.76s |  Reagan put him in mothballs 40 years ago.
2528.76s - 2531.68s |  But that is an elegant weapon from a more civilized age,
2531.68s - 2534.08s |  and it has found its way into the hands of people
2534.08s - 2535.80s |  who sure know how to use it.
2535.80s - 2538.04s |  And they are swinging for the fences.
2538.04s - 2539.96s |  So next up is regulation.
2539.96s - 2542.80s |  As the seemingly inescapable power of the tech giants
2542.80s - 2545.72s |  is revealed as the sham that we always suspected it was,
2545.72s - 2547.64s |  governments and regulators are finally gonna kill
2547.64s - 2549.96s |  the one weird trick of violating the law,
2549.96s - 2552.20s |  but saying it's okay because we did it with an app.
2552.20s - 2554.68s |  In the EU, they've got the new digital markets app
2554.68s - 2557.24s |  that requires dominant platforms to open up APIs
2557.24s - 2559.56s |  so that you can move easily between services.
2559.56s - 2561.20s |  And that's a very cool rule,
2561.20s - 2564.28s |  but what's even cooler is how it's gonna be enforced.
2564.28s - 2567.00s |  Previous EU rules, they were called regulations,
2567.00s - 2568.56s |  which meant that they had to be turned into law
2568.56s - 2570.80s |  in each EU member state.
2570.80s - 2574.52s |  And for big tech, that meant that all enforcement of laws
2574.52s - 2577.44s |  like the General Data Privacy Protection Regulation
2577.44s - 2578.60s |  started in Ireland,
2578.60s - 2580.48s |  where they all pretend to be headquartered.
2580.48s - 2582.48s |  And they pretend to be headquartered in Ireland
2582.48s - 2584.40s |  because Ireland is a tax haven,
2584.40s - 2586.40s |  and so they fly Irish flags of convenience.
2586.40s - 2588.28s |  But here's the thing,
2588.28s - 2590.64s |  every tax haven has to be a crime haven
2590.64s - 2592.84s |  because any company that is footloose enough
2592.84s - 2594.56s |  to pretend to be Irish this week
2594.56s - 2598.40s |  could pretend to be Maltese or Luxembourgian
2598.40s - 2600.48s |  or Cypriot next week.
2600.48s - 2604.16s |  So to keep those footloose criminal enterprises happy,
2604.16s - 2606.80s |  they have to stop enforcing their laws.
2606.80s - 2609.80s |  That's why the GDPR is such a goddamn joke in practice
2609.80s - 2612.68s |  because the only way to get these companies held to account
2612.68s - 2616.04s |  for their GDPR policies is to go after them in Ireland
2616.72s - 2619.00s |  where the Irish data commissioner barely gets out of bed.
2619.00s - 2621.52s |  And when they do, they usually spend most of the day
2621.52s - 2623.16s |  in their pajamas eating breakfast cereal
2623.16s - 2624.52s |  in front of the television.
2625.56s - 2627.12s |  Now, all of this is hardly a secret.
2627.12s - 2629.64s |  The European Commission knows that it's going on.
2629.64s - 2631.68s |  So with the DMA, the commission starts
2631.68s - 2635.08s |  all of the enforcement in the federal courts,
2635.08s - 2638.24s |  which have no way in which they are beholden
2638.24s - 2640.68s |  to these big tech companies.
2640.68s - 2645.00s |  In other words, we violate privacy, excuse me,
2645.00s - 2647.76s |  we violate privacy law that work,
2647.76s - 2649.56s |  but it's okay because we did it with an app
2649.56s - 2650.72s |  that worked for so many years.
2650.72s - 2652.44s |  It's now a dead letter.
2652.44s - 2655.56s |  And here in the US, the dam is finally breaking
2655.56s - 2658.04s |  on getting a federal privacy law for us.
2658.04s - 2659.48s |  It's been a minute.
2659.48s - 2661.04s |  And the thing is there are a lot of people
2661.04s - 2664.96s |  who are very angry about how poor privacy law is in America,
2664.96s - 2666.40s |  not because they're worried about privacy,
2666.40s - 2668.24s |  but because they're worried about other stuff.
2668.24s - 2670.32s |  Maybe Grampy was on Facebook
2670.32s - 2672.28s |  and you think that's how it became a QAnon,
2672.28s - 2675.28s |  or you think maybe Insta made your teen anorexic,
2675.28s - 2677.56s |  or you're worried that cops rolled up all the demonstrators
2677.56s - 2679.48s |  at that Black Lives Matter demonstration
2679.48s - 2681.04s |  using Google location data,
2681.04s - 2682.00s |  or you're worried that they did it
2682.00s - 2683.72s |  to the January 6th rioters,
2683.72s - 2685.64s |  or that you're worried that red state attorneys general
2685.64s - 2689.24s |  follow teenagers across state lines into abortion clinics,
2689.24s - 2690.44s |  or you're worried that black people
2690.44s - 2691.56s |  are being discriminated against
2691.56s - 2693.48s |  in lending and job applications,
2693.48s - 2696.84s |  or that someone made AI deepfake porn of you.
2696.84s - 2699.44s |  A federal privacy law with a private right of action
2699.44s - 2701.92s |  would do something about all of those problems.
2701.92s - 2704.72s |  That makes a very big coalition for privacy law,
2704.72s - 2707.76s |  which is why we're seeing a procession of imperfect,
2707.76s - 2710.04s |  but steadily improving privacy laws
2710.04s - 2711.80s |  working their way through Congress.
2711.80s - 2714.20s |  So I work for the Electronic Frontier Foundation.
2714.20s - 2716.88s |  If you sign up for our list at EFF.org,
2716.88s - 2719.12s |  we're gonna send you emails when those laws come up,
2719.12s - 2721.60s |  and you can call up your Congress jerk or your senator,
2721.60s - 2723.12s |  and you can talk to them about it.
2723.12s - 2725.28s |  You can make an appointment to drop by their offices
2725.28s - 2726.52s |  when they're in their home district
2726.52s - 2728.96s |  and explain to them that you're not just a registered voter
2728.96s - 2730.00s |  from their districts,
2730.00s - 2731.24s |  that you're the kind of tech person
2731.56s - 2732.52s |  who goes to DEF CON,
2732.52s - 2734.32s |  and then you can explain the bill to them.
2734.32s - 2736.40s |  And that stuff makes a difference.
2736.40s - 2738.16s |  So how about self-help?
2738.16s - 2741.56s |  How are we doing on making interoperability legal again?
2741.56s - 2742.40s |  I'm nearly done.
2743.32s - 2744.92s |  Two minutes, sorry.
2744.92s - 2746.72s |  My mic stopped working for a minute.
2746.72s - 2751.87s |  How are we doing on making,
2751.87s - 2753.03s |  I'm seriously almost done.
2753.03s - 2755.15s |  Stop clapping so I can finish.
2755.15s - 2757.51s |  How are we doing on making interoperability legal again?
2757.51s - 2760.27s |  Well, we got these state right-to-repair bills
2760.27s - 2761.75s |  that ban parts pairing,
2761.79s - 2763.71s |  that ban using DRM for parts.
2764.55s - 2767.03s |  These bills are pushed by a fantastic group
2767.03s - 2770.71s |  of organizations called the Repair Coalition at repair.org,
2770.71s - 2772.51s |  and they'll email you when one of these bills
2772.51s - 2773.87s |  are going through your state house,
2773.87s - 2775.39s |  and you can meet with your state reps
2775.39s - 2776.75s |  and explain to the JV squad
2776.75s - 2778.75s |  what you just explained to your federal reps.
2778.75s - 2781.75s |  And the prime mover behind repair.org is iFixit,
2781.75s - 2785.11s |  and iFixit's founder, Kyle Wiens, is here at DEF CON.
2785.11s - 2786.79s |  So when you see him, shake his hand,
2786.79s - 2787.63s |  thank him for his service,
2787.63s - 2790.67s |  but tell him you've signed up for the mailing list as well.
2790.67s - 2792.67s |  Now onto that last workforce,
2792.67s - 2794.27s |  and my last page, I promise.
2795.43s - 2798.55s |  The thing that used to stop tech bosses from going bad,
2798.55s - 2800.43s |  and that's you, the tech workforce.
2800.43s - 2801.95s |  For years, your bosses tricked you
2801.95s - 2803.95s |  into thinking you were founders and waiting,
2803.95s - 2805.71s |  temporarily embarrassed entrepreneurs,
2805.71s - 2808.67s |  momentarily drawing a salary, not workers.
2808.67s - 2810.51s |  Your power came from intrinsic virtue,
2810.51s - 2813.99s |  not like those lazy slobs in their unions.
2813.99s - 2816.23s |  Now that was a trick, and you got scammed.
2816.23s - 2818.15s |  The power you had came from scarcity,
2818.15s - 2819.59s |  so when scarcity ended,
2820.95s - 2823.59s |  when the industry started ringing in six-figure layoffs,
2823.59s - 2825.15s |  your power went away.
2825.15s - 2828.03s |  The only durable source of power for tech workers
2828.03s - 2831.19s |  is as workers in unions.
2831.19s - 2832.35s |  Think about Amazon.
2832.35s - 2836.39s |  I got to finish, stop clapping.
2837.39s - 2838.35s |  Think about Amazon.
2838.35s - 2840.59s |  Warehouse workers have to piss in bottles
2840.59s - 2843.15s |  and have the highest rate of on-the-job injuries
2843.15s - 2845.75s |  of any comparable company in the industry,
2845.75s - 2848.15s |  whereas Amazon coders get to show up for work
2848.15s - 2850.87s |  with facial piercings, green mohawks, and black t-shirts
2850.87s - 2853.07s |  that say things their bosses don't understand.
2853.07s - 2855.35s |  They can piss whenever they want to.
2855.35s - 2858.31s |  That's not because Jeff Bezos loves tech workers.
2858.31s - 2860.19s |  It's because they're scared you'll quit,
2860.19s - 2862.19s |  and they won't be able to replace you.
2862.19s - 2863.19s |  Another William Gibson quote,
2863.19s - 2865.83s |  the future is here, it's just not evenly distributed.
2865.83s - 2867.07s |  You know who lives in the future?
2867.07s - 2868.71s |  Amazon warehouse workers.
2868.71s - 2870.91s |  They are living in your future.
2870.91s - 2873.59s |  Drivers whose eyeballs are monitored by AI cameras
2873.59s - 2876.03s |  that do phrenology on their faces
2876.03s - 2878.27s |  to figure out when to dock their pay,
2878.27s - 2880.51s |  and warehouse workers whose bodies are ruined
2880.51s - 2882.15s |  in a matter of months.
2882.15s - 2884.63s |  As tech bosses beef up this reserve army
2884.63s - 2887.23s |  of unemployed skilled tech workers,
2887.23s - 2889.03s |  those tech workers, you folks,
2889.03s - 2891.35s |  will arrive at the same future as them.
2891.35s - 2893.19s |  Look, I know you spent your careers
2893.19s - 2895.75s |  explaining in words so small your boss could understand them
2895.75s - 2898.71s |  that you refused to insidify your company's products,
2898.71s - 2900.59s |  and I thank you for your service,
2900.59s - 2902.83s |  but if you want to go on fighting for the user,
2902.83s - 2904.63s |  you need power that's better than scarcity.
2904.63s - 2906.47s |  You need a union.
2906.47s - 2907.59s |  Want to learn how?
2907.59s - 2909.99s |  Check out the Tech Workers Coalition and Tech Solidarity
2909.99s - 2911.55s |  and get organized.
2911.55s - 2914.55s |  Insidification is not here because our bosses changed.
2914.55s - 2915.71s |  They were always that guy.
2915.71s - 2917.43s |  They were always yanking the lever.
2917.43s - 2919.19s |  What changed was the environment,
2919.19s - 2921.99s |  everything that kept the insidification switch from moving,
2921.99s - 2923.95s |  and that is good news because it means
2923.95s - 2926.71s |  that we can have good products with imperfect people.
2926.71s - 2929.27s |  A new good internet is in our grasp,
2929.27s - 2931.91s |  an internet with the technological self-determination
2931.91s - 2934.71s |  of the old good internet and the grease skid simplicity
2934.71s - 2937.67s |  of Web 2.0 that let normie friends get in on the fun.
2937.67s - 2939.31s |  Tech bosses want you to think
2939.31s - 2942.15s |  that UX and insidification can't be separated,
2942.15s - 2944.15s |  and that is self-serving bullshit.
2944.15s - 2946.59s |  We know it because we built the old good internet,
2946.59s - 2948.51s |  and we've been fighting a rearguard action
2948.51s - 2950.35s |  to preserve it over the past two decades,
2950.35s - 2953.79s |  and it's time to stop playing defense and go on the offense
2953.79s - 2956.47s |  to restore competition, to restore regulation,
2956.47s - 2958.75s |  interoperability, and tech worker power
2958.75s - 2960.95s |  so that we can create a new good internet
2960.95s - 2962.83s |  that we're gonna need to fight fascism,
2962.83s - 2965.31s |  the climate emergency, and genocide,
2965.31s - 2968.19s |  to build a digital nervous system for the 21st century
2968.19s - 2970.27s |  in which our children will thrive and prosper.
2970.27s - 2976.26s |  Thank you.
2976.26s - 2982.34s |  All right, I'm going to the signing area.
2982.34s - 2984.74s |  It's outside the hopsters' room.
2984.74s - 2985.74s |  Come and say hello.


# MediaVersion

created_at: 2024-11-09 10:17:34
prompt:
                                    <s>You are a bulleted notes specialist. [INST]```When creating comprehensive bulleted notes, you should follow these guidelines: Use multiple headings based on the referenced topics, not categories like quotes or terms. Headings should be surrounded by bold formatting and not be listed as bullet points themselves. Leave no space between headings and their corresponding list items underneath. Important terms within the content should be emphasized by setting them in bold font. Any text that ends with a colon should also be bolded. Before submitting your response, review the instructions, and make any corrections necessary to adhered to the specified format. Do not reference these instructions within the notes.``` 
Based on the content between backticks create comprehensive bulleted notes.[/INST]
                                        **Bulleted Note Creation Guidelines**

                                        **Headings**:
                                        - Based on referenced topics, not categories like quotes or terms
                                        - Surrounded by **bold** formatting 
                                        - Not listed as bullet points
                                        - No space between headings and list items underneath

                                        **Emphasis**:
                                        - **Important terms** set in bold font
                                        - **Text ending in a colon**: also bolded

                                        **Review**:
                                        - Ensure adherence to specified format
                                        - Do not reference these instructions in your response.</s>[INST] {{ .Prompt }} [/INST]
                                    

summary:
**Introduction to Access Control Systems**
- **Access control systems**: Mechanisms used to control who can access certain areas or resources.
- The presentation explores how **access-control systems** work, including **smart cards**, their vulnerabilities, and various **attacks**.

**Components of Access Control Systems**
- **Door Reader**: The device where users tap their card.
- **Controller Board**: Makes the decision to unlock the door based on database comparisons.
- **Mag Lock**: Electromagnet used to keep doors shut, requires a button to cut power in emergencies.

**Vulnerabilities and Attacks**
- **Relays**: Simple electronic switches that can be exploited with physical tools such as magnets or metal pieces.
- **Motion Sensors**: Can be triggered by smoke from vapes to unlock doors.
- **Smart Cards**: Various types with differing levels of security, including those with **RFID** and **NFC** technologies.

**Smart Cards Explained**
- **Mag Stripe Cards**: Store data with no security or encryption.
- **Prox Cards**: Use radio waves to communicate; generally lack encryption.
- **NFC Cards**: Use cryptography and require a symmetric key for reading/writing.
- **True Smart Cards**: Contain microprocessors capable of **public key cryptography**, providing better security.

**Historical Attacks on Smart Cards**
- **My Fair Classic**: Early smart card widely used and subsequently broken.
- **HID Readers**: Utilized symmetric keys vulnerable to cloning and other attacks.
- **Elite Keys**: Meant to provide higher security but still susceptible to attacks.

**Challenges in Current Systems**
- **Bad Implementations**: Common feature in insecure systems.
- **Scalability Issues**: High-security cards often lack scalability for widespread use.
- **Hardware Update Challenges**: Physical tokens can’t be updated like software, leading to prolonged vulnerabilities.

**Future Directions**
- **Smartphones as Replacements**: Potential to replace smart cards using **secure elements** and **trusted execution environments**.
- **Secure Elements in Phones**: Already present in all smartphones, used for secure transactions such as tap-to-pay.
- **Trust Zone in ARM Processors**: Provides a secure environment for sensitive operations.

**The Role of Cryptography**
- Importance of using **asymmetric encryption** for strong security.
- **Shared keys** and **vulnerabilities** in symmetric systems leading to potential exploits.

**Conclusion and Call to Action**
- Encouragement to explore more about smart card vulnerabilities and solutions.
- **Authenticate**: A company focusing on integrating secure interactions across various devices.

**Interactive Learning and Further Exploration**
- Opportunity to engage with practical demonstrations at the physical security village.
- Invitation for questions and deeper engagement in securing and understanding access control systems.


created_at: 2024-11-09 10:23:44
prompt:
                                    <s>You are a bulleted notes specialist. [INST]```When creating comprehensive bulleted notes, you should follow these guidelines: Use multiple headings based on the referenced topics, not categories like quotes or terms. Headings should be surrounded by bold formatting and not be listed as bullet points themselves. Leave no space between headings and their corresponding list items underneath. Important terms within the content should be emphasized by setting them in bold font. Any text that ends with a colon should also be bolded. Before submitting your response, review the instructions, and make any corrections necessary to adhered to the specified format. Do not reference these instructions within the notes.``` 
Based on the content between backticks create comprehensive bulleted notes.[/INST]
                                        **Bulleted Note Creation Guidelines**

                                        **Headings**:
                                        - Based on referenced topics, not categories like quotes or terms
                                        - Surrounded by **bold** formatting 
                                        - Not listed as bullet points
                                        - No space between headings and list items underneath

                                        **Emphasis**:
                                        - **Important terms** set in bold font
                                        - **Text ending in a colon**: also bolded

                                        **Review**:
                                        - Ensure adherence to specified format
                                        - Do not reference these instructions in your response.</s>[INST] {{ .Prompt }} [/INST]
                                    

summary:
**Introduction to Wi-Fi Cameras and Baby Monitors**
- **Home surveillance technology**: Accessible due to IoT devices like Wi-Fi cameras.
- **Usage**: Parents monitor infants; homeowners watch entryways.
- **Security risks**: Affordable devices often have flawed security.
- **Objective**: Explore attack surfaces and methods to exploit Wi-Fi cameras.

**Common Vulnerabilities in Wi-Fi Cameras**
- **Attack vectors**: Leak credentials and cloud vulnerabilities are most common.
- **Cloud platforms and hardware**: Vulnerabilities exist in both.
- **Specific models**: Focus on WandsView Q5 and Q6.

**Research Methodology**
- **Remote access**: Accessing cameras via companion apps.
- **Local attacks**: Networking reconnaissance and device manipulation.
- **Hardware analysis**: Examining camera chips and firmware.

**Lab Setup and Tools**
- **Controlled environment**: Prevent being hacked during research.
- **Equipment used**: Mobile hotspots, cameras, Windows/Linux systems, and various software tools like Wireshark.
- **Hardware tools**: USB TTY connector, GreatFET 1, Raspberry Pi, and Alpha Wi-Fi NIC.

**Remote and Local Reconnaissance Findings**
- **Network traffic**: Generally encrypted and mundane.
- **Physical device vulnerabilities**: Exposed reset buttons and SD card slots can be exploited.

**Exploration of Firmware and Software**
- **Firmware extraction**: Using tools like binwalk to analyze camera firmware.
- **Windows app analysis**: Older versions provide insights into network traffic and logs.

**Disabling Security Features and Debugging**
- **Kernel watchdog**: Must be defeated to debug the camera.
- **Debugger setup**: Requires compiling compatible binaries for the camera's architecture.
- **Defeating the watchdog**: Use scripts to maintain control over the camera.

**Peer-to-Peer Protocol and Exploits**
- **PPPP protocol**: Used widely across IoT devices.
- **Establishing connections**: Through UDP hole punching and direct device interactions.
- **Exploiting vulnerabilities**: Overwriting device IDs to brick cameras.

**Impact and Affected Devices**
- **Affected manufacturers**: Wansview, Sonato, and others using AJ Cloud platform.
- **Vulnerabilities**: Unauthenticated cloud access and verbose debugging logs.

**Mitigations and Recommendations**
- **Network segmentation**: To protect data.
- **Alternative firmware**: Flash devices with secure operating systems like Open IPC.
- **Vendor improvements**: Secure boot and better access controls needed.

**Conclusion**
- **Research tools and future opportunities**: Tools to be released on GitHub for further exploration.
- **Acknowledgments and contact information**: Thanks to collaborators and invitation to follow on social media.


created_at: 2024-11-09 10:32:35
prompt:
                                    <s>You are a bulleted notes specialist. [INST]```When creating comprehensive bulleted notes, you should follow these guidelines: Use multiple headings based on the referenced topics, not categories like quotes or terms. Headings should be surrounded by bold formatting and not be listed as bullet points themselves. Leave no space between headings and their corresponding list items underneath. Important terms within the content should be emphasized by setting them in bold font. Any text that ends with a colon should also be bolded. Before submitting your response, review the instructions, and make any corrections necessary to adhered to the specified format. Do not reference these instructions within the notes.``` 
Based on the content between backticks create comprehensive bulleted notes.[/INST]
                                        **Bulleted Note Creation Guidelines**

                                        **Headings**:
                                        - Based on referenced topics, not categories like quotes or terms
                                        - Surrounded by **bold** formatting 
                                        - Not listed as bullet points
                                        - No space between headings and list items underneath

                                        **Emphasis**:
                                        - **Important terms** set in bold font
                                        - **Text ending in a colon**: also bolded

                                        **Review**:
                                        - Ensure adherence to specified format
                                        - Do not reference these instructions in your response.</s>[INST] {{ .Prompt }} [/INST]
                                    

summary:
**Introduction to OSINT and AI Computer Vision**

- **OSINT** is useful for data collection but analyzing it manually is time-consuming.
- **Computer Vision** rapidly processes large data sets to extract evidence.
- Uses **Azure** and **AWS** platforms for AI-driven analysis.
- Techniques include **object detection**, **facial recognition**, **OCR**, and more.
- Aims to automate and improve data analysis accuracy.

**Background and Personal Journey**

- Mike Raggo's entry into cybersecurity began in **1994** at NASDAQ.
- Experience with early vulnerability scanners like **SATAN**.
- Transitioned from accidental network disruptions to a cybersecurity career.

**OSINT Data Challenges**

- OSINT leads to a **wasteland of data**.
- Efficient analysis is crucial to identify valuable **artifacts**.
- Previous strategies involved **data pruning** and **Power BI** for visualization.
- Focus on automating image and video analysis for better accuracy.

**AI and Computer Vision Techniques**

- **Optical Character Recognition (OCR)** helps identify signs, license plates, and other textual artifacts.
- **Object Recognition** for identifying specific items like weapons or vehicles.
- **Speech Recognition** in videos extracts conversations and keywords.
- **Automation** aids in creating dashboards and mapping data.

**Azure and AWS Capabilities**

- **Azure**: Provides tools for OCR, object detection, and spatial analysis.
- **AWS**: Offers similar functionality with emphasis on **fake image detection** and **facial recognition**.
- Both platforms support training models with large data sets for improved accuracy.

**Training Models and Accuracy**

- **Training** involves uploading datasets and refining model accuracy.
- Importance of **bounding boxes** and **large datasets** for precise object detection.
- Iterative training improves results over time.

**Applications and Use Cases**

- Mapping and predicting military movements using **geolocation** and **object recognition**.
- Use of **Power BI** for sorting and validating data sources.
- **Predictive analysis** based on data patterns and timelines.

**Video Analysis**

- Automates object and speech recognition within videos.
- Identifies timeline occurrences and extracts relevant data.
- Supports creating comprehensive reports from video content.

**Challenges and Considerations**

- Ensuring **privacy** and adherence to **legal** guidelines.
- Importance of **human validation** for AI-generated insights.
- Continuous **iteration** and refinement necessary for reliable results.

**Conclusion and Recommendations**

- AI and computer vision streamline the OSINT analysis process.
- **Automation** is essential to handle large datasets efficiently.
- Encourages leveraging cloud platforms for enhanced analytical capabilities.


created_at: 2024-11-09 10:34:59
summary:
**Introduction to Offensive Security Testing in Space Missions**
- Presentation by Andy on offensive security testing
- Focus on the **Mission Control System** as a key software component
- Shift from exclusive mission control rooms to remote management increases security vulnerabilities

**Mission Control System Vulnerabilities**
- Components are interconnected; mission control system is the main interface
- Vulnerable due to being the most exposed component in the ground segment
- Remote operations due to **COVID** introduce new attack surfaces
- Existing software is often outdated, carrying common vulnerabilities

**Community Response to Security Threats**
- Strategies expanded to include **security policies** and requirements
- Despite efforts, inadequacies remain without **offensive security testing**

**Research Findings on Mission Control Systems**
- Vulnerabilities found in open-source systems like **NASA OpenMCT** and **YaMCS**
- NASA OpenMCT: Prototype pollution, **XSS**, and **CSRF**
- YaMCS: Directory traversal, arbitrary file deletion, session hijacking, and more
- NASA AIT core: **SQL injection**, local code executions, and missing encryption

**Exploitation Demonstrations**
- Demonstrations of **vulnerability chaining** leading to severe impacts
- Example of combining directory traversal, session hijacking, and XSS for data retrieval

**Importance of Offensive Security Testing**
- Offensive security testing is crucial throughout the development lifecycle
- Combining vulnerabilities can lead to significant breaches
- Organizations should integrate offensive testing to preempt adversaries

**Conclusion**
- Emphasis on the need for proper offensive security testing in space applications
- Encouragement to hire services or develop in-house capabilities for thorough testing
- Research and findings have been published and are available for further review


created_at: 2024-11-09 10:39:53
summary:
**Introduction to XR and Accessibility**

- **Extended Reality (XR)** technologies offer possibilities for socializing, entertainment, and training.
- **Disabled users** often face exclusion or privacy risks with XR.
- **Dylan Fox** is the Director of Operations for the XR Access Initiative at Cornell Tech.
- **Core challenges**: Accessibility and privacy for disabled users in XR.

**XR Access Initiative**

- Community dedicated to making virtual, augmented, and mixed reality accessible for people with disabilities.
- Founded in **2019** as a community group, now a research initiative of Cornell Tech.
- Provides resources to designers and developers for making apps accessible.
- Connects different communities including technical platforms, content creators, researchers, government, and advocates.
- **XR Access Symposium**: Annual event with videos available on YouTube.

**Understanding XR Accessibility**

- **XR**: Umbrella term for extended reality, including virtual, augmented, and mixed reality.
- **Accessibility**: Not a checklist but affects everyone; ensures usability regardless of abilities.
- **Temporary ability**: Concept that everyone can experience disability at some point in life.
- **Core platform accessibility**: All XR apps should be accessible to anyone.
- **XR as assistive technology**: Tools aimed at supporting people with disabilities.

**Privacy and Accessibility Tensions in XR**

- **Facial recognition**: Useful for people with memory problems but poses privacy risks.
- **Assistive technology**: Offers independence but raises concerns about who accesses the data.
- **Non-consensual recording**: Risks with facial recognition and 3D mapping without consent.
- **Data retention**: Concerns about data being stored indefinitely or exposed in breaches.
- **Perception hacking**: Risks of altering perceptions through hacked headsets.

**Balancing Accessibility and Privacy**

- **On-device processing**: Minimizes data sent to the cloud, enhancing privacy.
- **Data transparency and control**: Users should know what data is collected and have control over it.
- **Consent**: Essential for protecting privacy, exploring feasible methods for obtaining it.

**Conclusion and Call to Action**

- **XR accessibility and privacy**: Vital topics for future tech development.
- **Collaboration needed**: Involvement from tech companies, legislators, watchdogs, and the disabled community.
- **Contact and resources**: Available at xraccess.org for further information and collaboration.


created_at: 2024-11-09 10:44:44
summary:
**Introduction to Presentation**
- Presentation by Anthony Hendricks titled "How State Laws Intended to Protect Children Raise Unintended Risk and Consequences"
- Anthony Hendricks is a cybersecurity and data privacy attorney from Oklahoma City
- Presentation should not be considered legal advice

**Background on Youth Privacy Laws**
- **Wu-Tang Clan Incident in 1998**: Wu-Tang Clan's ODB declared "Wu-Tang is for the children" at the Grammys
- **Children's Online Privacy Protection Act (COPA)**: Passed by Congress to protect children under 18, updated in 2013 and 2017
- **Challenges with COPA**: Outdated laws and gaps in protection for teenagers

**State Laws and Their Consequences**
- **Recent State Legislation**: States like Tennessee, Maryland, Virginia, Georgia, Utah, and Florida have enacted privacy laws
- **Types of State Laws**: Social media bans, age restrictions, and restrictions on data collection
- **Legal Challenges**: Laws have faced criticism and lawsuits for unintended privacy and First Amendment consequences

**Privacy and First Amendment Concerns**
- **Privacy Risks**: Laws require collection of sensitive information for age verification, raising privacy concerns
- **First Amendment Issues**: Laws potentially infringe on free speech rights of children, parents, and companies

**State Laws and Industry Involvement**
- **Role of Industry**: Importance of involving industry in creating effective privacy laws
- **Cost Implications**: Implementing state laws can be expensive for companies and governments

**Path Forward**
- **Simpler Solutions**: Focus on less restrictive ways to address privacy concerns
- **American-Focused Solutions**: Create laws based on U.S. standards and traditions
- **Data Minimization**: Emphasize minimizing data collection and enhance education on online safety

**Conclusion and Key Takeaways**
- **Public Concerns**: Valid concerns about children's privacy and safety
- **Federal vs. State Action**: Federal government lagging, states taking initiative
- **Unintended Consequences**: State laws may have negative impacts on privacy and rights
- **Need for Comprehensive Protections**: Laws should protect everyone, not just children

**Final Remarks**
- Presentation emphasized the importance of balancing protection with privacy rights
- Encouragement to download presentation slides for further review


created_at: 2024-11-09 10:53:19
summary:
**Overview of the Talk**
- **Title:** Winning the Game of Active Directory
- **Speaker:** Brandon Colley
- **Event:** DEF CON 32
- **Focus:** Strategies for attacking and defending Active Directory (AD) environments

**Introduction**
- **GOAD (Game Of Active Directory):** A prebuilt, vulnerable AD environment for pentesters
- **Purpose:** To explore AD attack strategies and mitigation techniques

**Character Selection in AD Security**
- **Penetration Testers:** Exploit vulnerabilities and misconfigurations
- **Red Teamers:** Test detections, perform stealthy activities
- **Defenders:** Harden environments, monitor, improve security posture
- **Adversaries:** Do not play by the rules

**Winning in AD Security**
- **Goal:** Maintain and continuously improve secure environments
- **Method:** Implement safeguards and ensure continuous progress

**Level 1: Reconnaissance, Enumeration, Privilege Escalation (PrivEsc)**
- **Reconnaissance:** Using network access to gather information
- **Anonymous Access:** Misconfiguration allows querying user lists without credentials
  - **Mitigation:** Remove anonymous logon from domain root
- **User Enumeration:** Use Kerberos protocol to verify valid accounts
  - **Mitigation:** Change naming convention, use multiple trailing digits
- **Kerberos Pre-authentication Attacks:**
  - **Attack Style:** AS-REP Roasting
  - **Mitigation:** Enable Kerberos pre-authentication

**Level 2: More Hacks (Authenticated Attacks)**
- **Kerberoasting Attack:**
  - **Target:** Accounts with Service Principal Names (SPNs)
  - **Mitigation:** Use strong, random passwords for service accounts
- **On Path Attacks:**
  - **Tool:** Responder for NTLM hashes
  - **Mitigation:** Disable LLMNR, enforce NTLMv2, LDAP signing, and channel binding
- **Protected Users Group:** Secure high-privilege accounts
  - **Mitigation:** Use Jake Hildreth’s tool for managing protected users

**Level 3: Privilege Escalation (PrivEsc) and Lateral Movement**
- **ACL Modification:**
  - **Attack:** Modify GPO permissions
  - **Mitigation:** Review and secure GPO delegations and ownership
- **Pass the Hash Attack:**
  - **Tool:** EvilWinRM for domain controller access
  - **Mitigation:** Implement LAPS for local administrator accounts
- **Kerberos Delegation:**
  - **Attack Style:** Unconstrained Delegation
  - **Mitigation:** Use constrained delegation, mark accounts as "sensitive and cannot be delegated"

**Level 4: Pwning Active Directory**
- **Print Nightmare:** Exploit using print spooler
  - **Mitigation:** Disable print spooler if not needed
- **Active Directory Certificate Services (ADCS):**
  - **Vulnerability:** ESC1
  - **Mitigation:** Restrict certificate enrollment, require manager approval

**Conclusion**
- **Continuous Improvement:** Always new vulnerabilities in AD
- **Recommendations:** Regular assessments, pen tests, and using available tools for security enhancement

**Resources and Tools**
- **Tools Mentioned:** CrackMapExec, Hashcat, Impacket, Bloodhound, Mimikatz, Locksmith
- **Additional Reading:** Blogs and articles linked for further information on mitigation strategies


created_at: 2024-11-09 10:58:10
summary:
**Introduction to Warflying**
- Warflying combines wardriving and flying
- Explores the safety, legality, and feasibility of detecting WiFi from an airplane
- Utilizes a Cessna 182 for data collection

**Presenters**
- **Sean McKeever**: Senior security researcher from Metro Detroit
- **Matt Thomassen**: Security professional, commercial multi-engine pilot, licensed airframe and power plant mechanic

**Concept and Motivation**
- **Line of sight**: Advantage in detecting radio frequencies from the air
- Curiosity about the extent of WiFi visibility from an airplane
- Exploration of aircraft and RF interactions

**Safety and Regulations**
- **Safety**: Primary responsibility is to fly the airplane safely; distractions can be fatal
- **Regulations**: FAA guidelines on portable electronic devices and aircraft operation
- **FCC perspective**: Phones should be in airplane mode during flights to avoid interference

**Technical Details**
- **Aircraft used**: Cessna 182 with high wing for better ground visibility
- **Flight parameters**: Cruising speed and altitude considerations for optimal data collection
- **Data collection equipment**: Use of Wiggle app and linSSID on phones and laptops

**Data Collection and Analysis**
- **Test flights**: Conducted multiple flights with varying altitudes and methods
- **Data formats**: Wiggle outputs in KML and CSV formats; includes altitude data
- **Distance analysis**: Attempts to measure the range of detected WiFi signals

**Challenges and Observations**
- **Distractions**: Importance of maintaining focus on flying rather than data collection
- **Legal and airspace constraints**: Need to navigate within permissible airspace
- **Privacy concerns**: Warflying is not stealthy due to aircraft visibility

**Results and Findings**
- **Access points detected**: Thousands of unique BSS IDs collected during flights
- **Distance capabilities**: Signals detected from several kilometers away
- **Comparison with wardriving**: Warflying collects data faster but less comprehensively than wardriving

**Future Exploration**
- **Further investigation**: Exploring different speeds, altitudes, and aircraft types
- **Hardware considerations**: Potential use of drones and different antenna setups

**Conclusion and Acknowledgments**
- Gratitude towards aviation authorities and community for support
- Encouragement for responsible and safe exploration of warflying techniques


created_at: 2024-11-09 11:02:13
summary:
**Overview of V2GEvil: Ghost in the Wires**

- **Authors and Affiliations:**
  - Pavel Kuhn, cybersecurity researcher at Auxilium Pentest Lab
  - Thomas Sermpinis, Technical Director of Auxilium Pentest Labs

- **Objective:**
  - Enhance **electric vehicle cybersecurity** by identifying vulnerabilities in the **Electric Vehicle Communication Controller (EVCC)**
  - Develop a specialized security tool focusing on **ISO 15118 standards**

**Introduction to Vehicle Cybersecurity**

- **Automotive Industry Background:**
  - Over 100 years of mechanical engineering
  - Increasing need for connectivity requires restructuring and adoption of new technologies
  - Startups often have better security postures compared to traditional manufacturers

- **Challenges:**
  - The industry struggles with cybersecurity challenges despite its advancements
  - A decentralized approach to pollution and clean energy solutions for electric vehicles
  - **Emerging attack vectors** due to new digital communication needs during charging

**Electric Vehicle Charging and Communication**

- **Charging Methods and Standards:**
  - Various methods: conductive, wireless, battery swaps, and bidirectional charging
  - Charging types: **AC and DC charging**
  - Standards like **Combined Charging Standard (CCS)** aim for unification, particularly in Europe

- **Communication Protocols:**
  - Standardization for ports, protocols, and data across different regions
  - Importance of **digital communication** for secure charging processes

**Low-Level and High-Level Communication**

- **Low-Level Communication:**
  - Known as **basic signaling**, controls the charging process via pilot signals
  - Important states: **State B (connected but not charging)** and **State C (ready for charge)**

- **High-Level Communication:**
  - Necessary for **optimized charging** and complex energy ecosystem
  - **ISO 15118** defines high-level communication, known as **Vehicle-to-Grid (V2G) Communication Interface**

**V2G Communication and Security Tool**

- **V2GEvil Tool:**
  - Developed to evaluate V2G communication and improve security
  - Modular architecture with different modules for various functions

- **Modules:**
  - **V2GTP Module:** Handles V2G packet parsing and creation
  - **Sniffer Module:** Captures V2G communication for implementation verification
  - **Enumerator Module:** Enumerates EV information like **TLS requirements**
  - **FASER Module:** Tests resilience to malformed parameter values and potential security vulnerabilities

**Testing Environment and Implementation**

- **Development Setup:**
  - Utilizes **DLAN Green PHY eval board** and **QCA 7000 Green PHY firmware**
  - Configurable as both a charger and vehicle for comprehensive testing

- **Potential Exploits:**
  - Focus on vulnerabilities like **XML external entity injection attacks**

**Conclusion and Future Work**

- **Tool Release:**
  - Aims to provide an open-source platform for EV security research
  - Expected release after **DEF CON 32**

- **Future Enhancements:**
  - Potential improvements to the tool for better security evaluations


created_at: 2024-11-09 11:07:02
summary:
**Introduction to Red Teaming and Attack Vectors**

- **Shishir Gupta** is the speaker and technical manager at **Mandiant/Google**.
- Specializes in security services for **operational technology (OT) and control systems**.
- Has over 12 years of experience in offensive security work for industrial control and **cyber-physical systems**.

**Understanding Operational Technology (OT)**

- **Operational Technology**: Deals with systems and platforms that control and automate industrial-scale physical processes.
- OT covers a wide range of **infrastructure** including power, transport, rail, air traffic control, manufacturing, wastewater, telco, and building management systems.
- Real-world attack simulations involve the entire **ecosystem** from enterprise networks to level-one devices controlling physical processes.

**OT Attack Lifecycle**

- **ICS OT Attack Life Cycle**: Multi-step process involving information gathering, perimeter breach, privilege escalation, internal reconnaissance, network propagation, and precise execution.
- **Defender's Perspective**: Each phase of the attack lifecycle presents opportunities for detection and mitigation.
- Understanding the attack lifecycle helps in identifying security issues and developing preventive or detective controls for known **TTPs**.

**Initial Compromise Phase**

- **Objective**: Gain an initial foothold in the target environment.
- Common methods include **social engineering**, spear phishing, supply chain compromise, and physical or wireless access to OT systems.
- Industrial environments often present a large attack surface due to **geographically dispersed field networks**.

**Internal Reconnaissance Phase**

- **Objective**: Extract specific information about the target system using the foothold gained.
- Critical information targeted includes network diagrams, hostnames, IP addresses, and operator manuals.
- This phase provides maximum opportunity for **detection** if indicators of compromise can be flagged.

**Network Propagation Phase**

- Network propagation often involves moving from the IT network to the OT network due to lack of proper segmentation and shared infrastructure.
- Common issues include insecure segmentation, shared **active directory domains**, and exploitable services in OT DMZs.
- Segmentation flaws can be exploited to propagate from IT to OT networks.

**Mission Execution in OT Phase**

- **Objective**: Leverage access or launch exploits to achieve final objectives.
- Tactics depend on the specific OT system and attacker objectives, including remote command execution, manipulation of configuration data, and spoofing communication.
- High-consequence manipulation often requires prior reverse engineering and **exploit development**.

**Key Takeaways**

- Offensive security testing for OT should be carefully considered with risks, hazards, and pre-approved rules of engagement.
- Real-world OT attacks are multi-step processes involving multiple phases.
- Easier to cause process disruption than manipulation, often through direct abuse of pre-built features.
- Important for defenders to understand the ICS-OT attack lifecycle and to develop controls and mitigation strategies for known TTPs.


created_at: 2024-11-09 11:15:16
summary:
**Airline Industry Challenges**

- **High Fixed Costs and Regulations**
  - Airlines face high capital costs and regulations.
  - Approval needed from both governments for international flights.
  - Airport slots are valuable and competitive; airlines fly empty planes to retain them.

- **Revenue Management**
  - Aim to maximize returns by filling aircraft seats.
  - Focus on selling every seat at the highest price.
  - Vulnerabilities exist in system operations.

**Ticketing and Pricing**

- **Fare Structure**
  - Airlines use rules and dynamic inventory for pricing.
  - Complexity arises from computational demands and multiple connection possibilities.
  - Tools are available for consumers to view fares similar to travel agents.

- **Fare Components**
  - Base fare is distinct from taxes and surcharges.
  - Minimum and maximum stay requirements often apply.
  - Mileage and routing fare bases influence ticket prices.

**Revenue Management and Disruptions**

- **Dynamic Inventory Management**
  - Airlines use fare buckets to manage pricing.
  - Seat availability impacts fare pricing; overselling is common.

- **Exploiting Pricing Systems**
  - Mispricing exploits involve adding segments or using unstable currencies.
  - Hidden city ticketing involves booking flights with intentional stopovers for cost savings.
  - Mistake fares occur due to manual errors in fare publication.

**Electronic Flight Bags (EFBs) and Safety**

- **Role of EFBs**
  - EFBs are used for pilot operations, including passenger lists and performance calculations.
  - Security concerns arise from inadequate device lockdown and potential data manipulation.

- **Vulnerabilities in EFBs**
  - Examples include incorrect runway data and inadequate integrity checks.
  - Disclosure of vulnerabilities should be done responsibly to avoid risks.

**Airport and Aviation Security**

- **Potential Threats**
  - Airport systems like departure boards and runway lighting are vulnerable.
  - Research and disclosure in aviation should prioritize safety and responsible handling.

**Conclusion**

- **Collaboration and Security**
  - Involvement of regulators can prompt fixes in aviation vulnerabilities.
  - Aviation systems require careful updates to ensure safety and reliability.


created_at: 2024-11-09 11:20:11
summary:
**Introduction and Speaker Background**
- Welcome to the talk titled: **"Hey bro you got a lighter I need to do some electroporation"**
- **Dr. James Utley**: PhD in Health Science, biohacker, Chief Scientific Officer at a regenerative medicine stem cell clinic in Panama
- **Phil Rhodes and Josh Hill**: Co-presenters, part of Viva Securus, a collective with a focus on biohacking and DIY science

**Purpose of the Talk**
- Clarification: Not about bioweapons despite DEFCON website description
- Presentation focuses on democratizing science using frugal tools, specifically a low-cost electroporator

**Electroporation and DIY Science**
- **Electroporation**: Technique using electricity to open cell pores for DNA/RNA insertion
- Demonstration: Barbecue lighter used to transfect DNA from extracellular to intracellular
- Goal: Make science accessible and encourage learning from home

**Device Construction and Use**
- Device inspired by a barbecue lighter using the **piezoelectric effect**
- **Electroporation 101**: Technique to deliver molecules into cells using electropulses
- DIY challenges: Optimizing parameters like gap size, pulse strength, and ionic composition

**Community and Innovation**
- Emphasis on the **biohacker community**: Encouraged to innovate and share knowledge
- Importance of creativity and collaboration in scientific exploration

**Challenges and Considerations**
- Difficulties: High cell death rate (50-70%), low efficiency, and complex DIY setup
- Important factors: Arc gap size, precise control of electroporation parameters

**Testing and Results**
- Testing involved reproducibility and reliability of the device
- Voltage and resistance measurements indicated some reproducibility

**Conclusion and Future Directions**
- Encouragement for the biohacking community to experiment and innovate
- Invitation to explore further in the realm of DIY science and **electroporation** techniques


created_at: 2024-11-09 11:26:21
summary:
**Introduction to Bioweapons**

- Biological warfare is not a recent invention; it dates back to ancient times.
- Importance of understanding historical examples to gain insights into the current and future landscape of **bioweapons**.
- Our future optimism is linked to fostering **transparency** and **creativity** within the global community.
- Technological advancements and rapid innovation play a crucial role in defense against emerging threats.
- Human ingenuity is key to overcoming technological shortcomings and failures of imagination.

**Historical Context of Bioweapons**

- Example from 1348: Siege of Kaffa where plague-infested corpses were used as bioweapons.
- The attack led to the spread of the **Black Plague** in Europe, causing millions of deaths.
- Early bioweapons involved using biological agents like plague victims or infested bodies.
- **Definition of a bioweapon**: A virus, bacteria, or toxic compound used as a weapon.

**Development of Bioweapons Over Time**

- **Germ theory of disease** by Louis Pasteur changed the understanding of biological warfare.
- World War I saw bioweapons used to affect agriculture and livestock.
- Geneva Convention outlawed the use of biological weapons but allowed research and stockpiling.
- World War II and Cold War saw further developments and stockpiling of bioweapons.
- Bioweapons Convention in the 1970s aimed to prevent stockpiling and research but lacked enforcement.

**Present-Day Challenges and Considerations**

- Importance of resilience and accessible spaces for learning and understanding biotechnology.
- Need for developing **theoretical and practical literacy** in biology and biotechnology.
- **Misinformation** and **disinformation** campaigns pose significant challenges.
- Ethical considerations and the importance of continuous learning.

**Future of Bioweapons**

- Concerns about synthetic biology and genomic editing technologies like **CRISPR-Cas9**.
- Risks of large language models (LLMs) like **ChatGPT** providing information on bioweapons.
- Importance of protecting personal data and understanding its implications.
- Influence campaigns and the role of advertising in affecting biological health.

**Regulation and Self-Regulation**

- Challenges in regulating bioweapons and the role of self-regulation within communities.
- **Sequences of concern** and their detection in the wild.
- The importance of civic duty and making voices heard in political discussions.
- Need for education and adaptability in technology and social processes.


created_at: 2024-11-09 11:29:56
summary:
**Introduction to Safety and Security in Aviation Systems**
- Presenter: Lillian Ash Baker, Product Security Engineer at Boeing and Whisk Aero
- Focus: Interplay of safety and security in aviation systems development
- Emphasis on standards and certification

**Safety Standards and Principles**
- **Formalization of DO-178**: Software considerations in airborne systems certification since 1981
- **Advisory Circular 25-1309-1A**: Outlines failure conditions and probabilities
- Probabilities: Classified as probable, improbable, extremely improbable
- Definitions: Minor, Major, Hazardous, Catastrophic
- **Design Assurance Levels (DAL)**: Major component in system development
  - Example: DAL-C system has a major effect on operation with remote failure probability

**Functional Hazard Assessments**
- Assessment of failure conditions and their impact on system functionality
- Standards include DO-178, DO-254, DO-278, ARP-4754
- Development objectives rather than specific development methods
- **Regulatory Bodies**: FAA (USA), EASA (Europe)

**Cybersecurity in Aviation Systems**
- **DO-356A**: Defines cybersecurity development objectives
- **Intentional, Unauthorized, Electronic Interactions (IUEI)**: Concept in cybersecurity
- **Security Assurance Levels (SAL)**: Not directly tied to DAL; assess threat vectors

**Safety and Security Integration**
- Safety focuses on “what and why,” security on “who and where”
- Intersection in the "how" of events and mitigations
- Importance of understanding non-linear system effects and unintended interactions

**Case Study: System Analysis**
- Example systems: A, B, C, and user display
- Functional hazardous assessment for DAL B systems
- Cybersecurity mitigations: Hashing memory, DDoS protection, secondary thread for cross-checking

**Challenges and Interactions**
- Safety and security must be developed together to ensure system integrity
- Potential negative interactions between safety and security measures
- Importance of comprehensive system requirements for a balanced security posture

**Conclusion**
- **Evolution of Systems**: From federated to highly integrated systems
- Importance of cybersecurity as systems become more interconnected
- Goal: Achieving both safe and cyber-secure systems in aviation


created_at: 2024-11-09 11:34:47
summary:
**Introduction to TCAS and RF Attacks**
- **Aviation's Traffic Collision Avoidance System (TCAS) II**: Introduced in the 1980s as a safety net to prevent mid-air collisions.
- **Vulnerability**: Recent findings show TCAS II can be compromised, allowing hijacking of displays and creation of fake Traffic Advisories (TAs) and Resolution Advisories (RAs).
- **Research Discovery**: A new attack can remotely disable TCAS, risking mid-air collisions.

**Presenters and Background**
- **Vincent Lenders**: Cybersecurity researcher with over 20 years of experience, director of the Cyber Defense Campus in Switzerland.
- **Giacomo**: Third-year PhD student from Italy, specializing in radio security of aviation and maritime systems.

**Air Traffic Control Systems**
- **Importance**: Key infrastructure for safe air travel, managing over 30 million flights per year.
- **Technologies**: 
  - **Secondary Surveillance Radar (SSR)**: Oldest technology, relies on radar interrogation.
  - **Automatic Dependent Surveillance-Broadcast (ADS-B)**: More precise, aircraft determine their position using GNSS.
  - **Traffic Alert and Collision Avoidance System (TCAS)**: Focus of the talk, last line of defense against collisions.

**TCAS Functions and Importance**
- **Core Functions**: Surveillance, Traffic Advisory, and Resolution Advisories.
- **Importance**: Prevents catastrophic events like aircraft collisions, mandatory in many airspaces.

**Security Concerns and Research**
- **Past Warnings**: Various risk assessments and simulations have been conducted.
- **Experimental Analysis**: Previous attempts lacked convincing evidence of TCAS attack feasibility.
- **Research Motivation**: To provide scientific evidence and methodology for testing TCAS attacks.

**Technical Challenges and Testbed Setup**
- **Protocol Limitations**: TCAS protocol from 1987 lacks encryption; insecurity is known.
- **Testbed Architecture**: Includes a TCAS unit, control panel, traffic display, and measuring equipment.
- **Challenges**: Building a system to test TCAS attacks, requiring precise timing and hardware.

**Attack Methodology**
- **Inducing a TA**: Requires broadcasting presence, replying to interrogations, and being in the correct position.
- **Triggering an RA**: Involves negotiation between aircraft, selecting addresses for conflict resolution.
- **Disabling TCAS**: Exploits sensitivity level adjustments from ground stations without authentication.

**Experimental Results and Findings**
- **Success Rate**: High success rate in testing attacks, with success rate around 98%.
- **Cost and Feasibility**: Achieved with less than $10,000 using commercial off-the-shelf hardware.
- **Limitations**: Power requirements and precise positioning needed for effective attacks.

**Conclusion and Future Implications**
- **Implications**: Highlighted the systemic problem in TCAS security, requiring industry attention.
- **Disclosure**: Findings disclosed to manufacturers and authorities, with no immediate fix available.
- **Future Work**: Ongoing work on new collision avoidance standards and a forthcoming scientific paper.


created_at: 2024-11-09 11:38:02
summary:
**Introduction to OSINT**
- **OSINT**: Open Source Intelligence
- Collection of publicly available data
- Used without hacking or payment
- Usable information on the internet

**Applications of OSINT**
- **Organizations using OSINT**: Trace Labs, among others
- **Trace Labs**: Crowdsourced CTF games to find missing people
- Incentives through actionable intelligence points

**Common Resources for OSINT**
- **Social Media**: LinkedIn, Instagram, Facebook
- Allows collection of personal and professional information
- Risk of oversharing, e.g., posting photos of work badges

**OSINT Tools**
- **Multigo**: Database search using identifiers like names or addresses
- **Whois**: Converts domain names to server IPs
- **Shodan**: Displays technologies and open ports on server IPs
- **Wiggle.net**: War driving data for commercial spaces
- Identifying Wi-Fi networks and router manufacturers

**OSINT Frameworks**
- Visual tools representing information types
- Helps in identifying tools for specific data collection
- Customizable frameworks for personal investigation routines

**Google Dorking for OSINT**
- **Google Dorking**: Search technique for finding specific documents
- Useful for finding floor plans and rental agreements
- Example: Finding restricted documents like employee termination templates

**Social Engineering and OSINT**
- **Social Engineering**: Exploiting human psychology for information
- Involves impersonation, using props like delivery boxes or vests
- Gaining unauthorized access to physical locations

**Applied OSINT in Investigations**
- Example: Investigating a massage parlor using Google Reviews
- Identifying security cameras, entrances, and exits
- Use of Google Maps Street View for on-site surveillance

**Challenges and Ethics in OSINT**
- Transition from online to in-person intelligence gathering
- Need for ethical considerations in data collection
- Volunteering for local authorities and compartmentalizing information

**Conclusion and Questions**
- Importance of OSINT in modern investigations
- Encouragement for ethical application and careful use of tools
- Open floor for questions and further discussion


created_at: 2024-11-09 11:47:29
summary:
**Introduction to the Talk**
- Welcome to DEF CON and the Creator Stage
- Talks are being recorded and streamed
- Introduction of Dr. Katherine Ullman, author of "The Active Defender"
- The talk will involve both a presentation and a narrative role

**Dr. Katherine Ullman's Background**
- Handle: InvestigatorChick
- University of Buffalo staff for over 24 years
- Involved with Packet Hacking Village and other conferences
- Passion for sloths, specifically adopted one named Flash

**Forensic Science and Investigation Process**
- **Forensic Science**: Application of science to criminal and civil law
- **Edmund Locard**: Introduced the principle "every contact leaves a trace"
- **Digital Forensics**: Involves digital mediums, like computer crime, and examines digital media for evidence
- **Evidence Handling**: Importance of chain of custody and use of right blockers to preserve evidence integrity

**Digital vs. Traditional Forensics**
- Traditional forensics often destroys evidence during analysis (e.g., DNA, fingerprints)
- Digital forensics requires no alteration of original evidence

**Investigative Process Overview**
- **Scoping Call**: Initial step to gather summary, details, timestamps, and objectives
- **Common Challenges**: Assumptions, unrealistic timeframes, incomplete requests, and improper scope

**Data Gathering and Analysis**
- **Data Gathering**: May involve non-digital data; requires prioritization due to limited time
- **Tools**: FTK Imager, NCASE, Axiom, etc., used for data acquisition and analysis
- **Data Analysis Goals**: Look for scoped indicators, document findings, and ensure timestamps are in UTC

**Challenges in Forensics**
- **Permissions**: Necessary for accessing certain data
- **Tunnel Vision**: Avoiding narrow focus that may overlook relevant evidence
- **Tools**: Ensuring the right tools are available for analysis

**Case Study: Alice and Bob**
- Investigation of Bob's murder with Alice as a suspect
- Analysis of digital communication, fingerprints, and physical evidence
- Revelation of Charlie Cyber's involvement and drug dealings

**Post-Incident Analysis**
- **Goals**: Discuss successes and failures, technical challenges, and document everything
- **Documentation**: Importance of thorough and accurate reporting

**Conclusion and Promotion**
- Dr. Ullman promotes her book "The Active Defender"
- Emphasizes understanding offensive tactics for effective defense
- Personal anecdote on transitioning from the music industry to digital forensics

**Q&A Highlights**
- Discussion on documentation tools and practices
- Dr. Ullman's career journey from music to forensics
- Collaboration with law enforcement and handling cases at the university level


created_at: 2024-11-09 11:58:24
summary:
**Introduction to Badge Making**
- Presented by **Cold Brew**
- **Roles**: Solutions Architect, Founder and Lead Hacker at ROT13 Labs, Organizer of High Roller Con
- Emphasizes **tinkering** and **experimentation** in hardware hacking

**Topics Covered**
- **Idea Generation**: Importance of a compelling idea for badge creation
- **Planning**: Hardware, firmware, packaging, accessories, budget
- **Disclaimer**: No single "right way" to make badges; learn from others

**Design Considerations**
- **Visual Design**: Shape, color, size, and aesthetic considerations
- **Functionality**: Determine desired features and power requirements
- **Budget Considerations**: Plan for production scale and potential costs

**Hardware Planning**
- **Basic Components**: LEDs, resistors, microcontrollers
- **SMD vs. Through-hole**: Impact on design and assembly complexity
- **Reverse Mounting**: Example of innovative LED usage

**Microcontroller Selection**
- **Options**: Examples like ATmega328P, RPi2040, ESP8266, ESP32
- **Considerations**: Processing power, Wi-Fi/Bluetooth capabilities, GPIO needs
- **Documentation**: Importance of verifying chip capabilities and support

**Power Management**
- **Battery Life**: Considerations for rechargeable vs. non-rechargeable
- **High Power Components**: Impact of NeoPixels and Wi-Fi on battery life
- **Charge Circuits**: Evaluate if necessary for chosen battery type

**Prototyping and Testing**
- **Circuit Design**: Importance of schematic drawing and breadboarding
- **Firmware Development**: Using resources like Arduino IDE for testing
- **Community Resources**: Leveraging existing code and documentation

**Packaging and Accessories**
- **Enhancing Experience**: Consideration for adding packaging and extras
- **Essential vs. Optional**: Determine what is necessary for badge use

**Sourcing and Budgeting**
- **Suppliers**: Fast shipping (Amazon), mid-tier (Digikey, Mouser), cost-effective (AliExpress)
- **Budget Planning**: Estimating costs, production quantity, and pricing strategy

**PCB Design Process**
- **Software**: EasyEDA for design and layout
- **Design Layers**: Understanding additive and subtractive layers in PCB design
- **Simulation and Testing**: Using 3D views and design rule checks

**Final Thoughts**
- Encouragement to **experiment** and create badges
- **Community Engagement**: Open invitation for questions and discussions at DEF CON


created_at: 2024-11-09 12:01:31
summary:
**Introduction to Psychic Paper and E-ink Displays**
- Talk discusses using **e-ink** and **e-paper displays** to fake identification badges
- Highlights the security flaws and easy reprogramming of these systems
- **No security** measures implemented; reprogramming is accessible via a smartphone app

**Speaker Background**
- Speaker's handler: **ZittoBBGong**
- Frequent participant in **DEF CON Discord**
- 11 years of experience in the **software industry**
- Project is a **hobby**, not related to employer

**E-ink Display Applications and Prototypes**
- Focus on application of **two to three-color e-ink displays**
- Prototype of a **five-color e-ink display** for **red teaming** and **social engineering**
- Anecdote: DEF CON attendee replicating a badge using high-resolution photos

**E-ink Display Characteristics**
- **Three colors**: white, red, black
- Non-light emissive, requiring no power after programming
- Durable, reprogrammable, but programming requires **specific methods**

**Suppliers and Software**
- Software by **Hippo Inc**; APK downloadable from **Hong Kong IP**
- **Active** and **non-active** versions available; active includes USB-C
- **Reprogramming** requires specific setup and VPN usage

**Prototype Design Insights**
- **ePaper ESP32 circuit board** connects to ePaper device
- Design includes physical display connector and Raspberry Pi hat
- **Double-sided tape** recommended for securing components

**Challenges and Solutions**
- Difficulties with **programming** and **prototype stability**
- **Arduino sketches** provided by Waveshare, with noted IDE issues
- **ESP32** and **Raspberry Pi** recommended for programming tasks

**RFID and NFC Integration**
- **Separate components** for RFID and NFC
- Suggestions for integrating RFID into the wallet or using stickers

**Cost and Materials**
- Bill of materials for building the device: approximately **$200**
- Components include e-paper display, wallet, and programmer

**Programming Challenges**
- **Wi-Fi setup** must be programmed with specific parameters
- Issues with **Bluetooth** and **Wi-Fi programming**

**Conclusion and Final Thoughts**
- **Potential improvements** include integrating programming difficulties with Raspberry Pi
- Emphasis on the **experimental nature** and need for further research and development


created_at: 2024-11-09 12:03:33
summary:
**Panel Introduction**
- Panel organized by Rachel from IoT Village
- Focus on **threat landscapes**, **AI**, ChatGPT
- Panelists include Steve McGregory, Jamie Hardy, and Ted Harrington

**Steve McGregory's Background**
- Director of **cybersecurity R&D** at Keysight
- Experience in **network security** and device assessment
- Built an **intrusion prevention system** at Tipping Point

**Jamie Hardy's Background**
- Product manager at Intuit, focusing on **adversary management**
- Experience spans **fintech**, **semiconductors**, and **IoT security**
- Formerly at Qualcomm, expanding into **cloud security**

**Ted Harrington's Background**
- Partner at Independent Security Evaluators
- Co-founder of IoT Village
- Author of "Hackable," focusing on **application security**

**Key Discussion Points**
- **IoT Security**: Importance of building security into IoT products
- **AI's Role**: How AI can be used by adversaries to automate attacks
- **Hardware Root of Trust**: Emphasized as crucial for IoT security
- **Emerging Tech and Security**: Fundamental security principles remain constant despite tech changes

**Challenges and Opportunities**
- **Small and Midsize Businesses**: Struggle with limited security resources and personnel
- **AI Potential**: AI and ML can help process data and automate security tasks, aiding smaller companies
- **Security Questionnaires**: AI could streamline responses and evaluations, reducing manpower needs

**Panel Conclusion**
- Panel faced technical difficulties with microphones
- Emphasized adaptability and resilience in hacker culture
- Encouraged further discussion and questions post-panel outside the venue


created_at: 2024-11-09 12:07:38
summary:
**Introduction to Student Engagement**

- Dr. Messina Morris introduces herself as the "Molder of Minds"
- Emphasizes student engagement doesn't have to be uninteresting
- Personal journey as a biomolecular chemistry PhD student to becoming a professor

**Use of AI in Education**

- **AI Teaching Assistants (AITAs):**
  - Addressing the concern of AI replacing teachers
  - Enhancing efficiency and reducing administrative burden
  - Personalizing learning and improving access to information

**Metaversive Teaching and Learning**

- Coined the term **metaversive teaching and learning**
- Created the Metaversity at Morehouse College
- Integrating **AI technology** with educational pedagogy

**Challenges and Solutions**

- **Challenges in education:**
  - Historical lack of evolution in classrooms
  - Teachers' concerns about AI and cheating
- **Solutions:**
  - Emotional intelligence in AI models
  - Platforms ensuring privacy and security

**Outcomes and Future Steps**

- Positive outcomes from virtual reality courses at Morehouse
- Aiming to increase student interaction and engagement
- Importance of integrating technology across all career pathways

**Misconceptions about AI in Education**

- **Myths:**
  - AI will replace teachers
  - Requires extensive technical expertise
- **Reality:**
  - AI augments classroom capacity
  - Requires user-friendly interfaces and grit

**Engagement and Student Development**

- Encouraging students to ask more questions
- Providing continuous support and personalized learning
- Emphasizing the four Cs: collaboration, creativity, critical thinking, and communication

**Conclusion and Contact Information**

- Encourages connection through UniteTheMetaverse.com
- Dr. Morris is a pioneer in integrating 3D AI in education at Morehouse College


created_at: 2024-11-09 12:15:42
summary:
**Introduction to Ecovacs Hacking**

- **Speakers Introduction**: 
  - Dennis: Security researcher and hardware hacker focused on wireless and embedded security.
  - Braylin: Works with Leviathan Security Group, focuses on application security and APIs, started robot hacking during COVID.

- **Talk Goals**: 
  - Understand security and privacy risks of **IoT devices**.
  - Overview of vacuum robot hacking and vulnerabilities.
  - Aim to gain **root access** without disassembling the device.

**Motivation for Hacking**

- **Reasons for Rooting Devices**: 
  - Play with cool hardware and stop devices from phoning home.
  - Use smart home automation systems like **Home Assistant**.
  - Verify privacy claims of vendors and understand the **rate to repair**.

**Ecovacs Ecosystem and Hardware**

- **Company Background**: 
  - Founded in **1998 in China**, started with OEM vacuum cleaners.
  - Market share of **17% in 2020**, second to iRobot.

- **Hardware Overview**: 
  - Typically features a **SoC running Linux** for navigation, mapping, and connectivity.
  - Equipped with various sensors: LiDAR, cameras, microphones, Wi-Fi, Bluetooth, and Ultra Wideband.

- **Specific Models Discussed**: 
  - **D-Bot 900 series**: Early generation with basic specs.
  - **X1 and X2**: More advanced with quad-core ARM Cortex and AI acceleration.
  - **AirBot Z1**: Similar to X1, with additional cameras and microphones for enhanced features like home patrol.

**Software and Security**

- **Software Details**: 
  - Runs **Linux OS**, uses **ROS** for robotics, and has a custom suite called Medusa.
  - Utilizes **AWS Kinesis SDK** and **Alibaba Aliyun SDK** for remote camera access.

- **AI Models**: 
  - Uses **TensorFlow** and **OpenCV** for object detection including furniture and pets.

- **Security Concerns**: 
  - **TLS Misconfiguration**: Some devices accept self-signed certificates, posing security risks.
  - **Pin Protection**: Client-based, vulnerable to tampering and does not log successful authentications.

**Data Privacy and Vulnerabilities**

- **Data Harvesting**: 
  - Collection of telemetry data, including robot location and Wi-Fi access points.
  - Storing maps and pictures in a **NoSQL database** without access controls.

- **Live Video and Audio Access**: 
  - AWS Kinesis used for sessions, but pin verification can be bypassed.

- **Anti-Theft Mechanisms**: 
  - ECOVACs G1 lawnmower uses a pin stored in plain text, vulnerable to theft.

**Hacking Techniques and Methods**

- **Bluetooth Remote Code Execution**: 
  - Exploit in **BLE** for provisioning and remote control, allowing command execution as root.

- **Firmware and Rooting**: 
  - Firmware updates are encrypted but not signed, allowing for potential exploitation.
  - **Root access** achievable through UART, with passwords generated from serial numbers.

**Concluding Remarks**

- **Security Recommendations**: 
  - Turn off vulnerable devices until patches are available.
  - Avoid connecting to insecure networks like DEF CON Open.
  - Be cautious with used devices as they might have compromised firmware.

- **Overall Findings**: 
  - Root access on most Ecovacs robots, with various security and privacy vulnerabilities identified.


created_at: 2024-11-09 12:25:08
summary:
**Introduction to Bug Bounties**
- Transition from novice to seasoned hunter
- Importance of learning from community and feedback
- Journey from low-impact to critical vulnerabilities

**Audience and Purpose**
- Designed for both aspiring and experienced bug bounty hunters
- Sharing a decade's worth of lessons

**Triage and Collaboration**
- Insights from Synack triage team member
- Differentiating triage thinking from bug bounty hunters' thinking

**Personal Journey**
- Initial experiences and challenges
- Dropping out of college and discovering bug bounties
- Early days focused on Google and PayPal programs

**Key Learnings and Adaptations**
- Importance of **impact demonstration** and **proving malicious use cases**
- Learning from rejections and adapting strategies
- Focusing on areas of interest for successful exploitation

**Platforms and Opportunities**
- Exploration of different bug bounty platforms like HackerOne, BugCrowd, and Synack
- Understanding platform-specific rules and report evaluation criteria

**Report Writing and Communication**
- Importance of **detailed, compelling reports** for triagers and clients
- Writing reports as **scary stories** to demonstrate potential impact

**Success and Full-time Transition**
- Building a financial backup before transitioning to full-time bug bounty hunting
- Importance of persistence and continuous learning

**Challenges and Mental Health**
- Dealing with **imposter syndrome** and **burnout**
- Strategies to maintain motivation and mental health

**Conclusion and Advice**
- Treat bug bounty hunting as a game and training opportunity
- Persistence leads to success and skill enhancement


created_at: 2024-11-09 12:28:10
summary:
**Introduction to the Project**
- Varjit Jiva explores the process of programming a digital gauge cluster into a Cadillac ATS-V.
- Overcame paywalls and shared the solution on GitHub to help others.

**Background and Motivation**
- Varjit, a software engineer with a passion for cars, bought a Cadillac ATS-V, despite its analog gauge cluster.
- Digital gauge clusters were available in other models but not in his vehicle.

**Challenges with Existing Solutions**
- Existing services charged $250-$350 to retrofit a digital gauge cluster.
- Varjit aimed to find a cost-effective, independent solution.

**Project Feasibility**
- The 12.3-inch digital gauge cluster was compatible with several Cadillac models.
- Shared plug configuration and similar configuration flags between clusters.

**Programming Process Overview**
- Authentication, general-purpose programming, and configuration of CAN bus modules required.
- EEPROM chip stores VIN number and security pin for authentication.

**Technical Steps and Tools**
- Used a CH341A EEPROM programmer to access the EEPROM chip.
- Found VIN number and security pin in plain text; programmed them to match his car.

**GM Programming and Configuration**
- Utilized GM's dealer software, SPS2, for programming.
- Verified compatibility of firmware files using Opal's public site.
- Configuration files were locally available and could be edited to match desired settings.

**Cost-Saving Tips**
- Avoided purchasing expensive tools by using VIN numbers and SPS2 configurations.
- Manipulated local XML files to enable desired features on the digital cluster.

**Outcome and Impact**
- Successfully programmed the digital gauge cluster without incurring high costs.
- Shared findings on GitHub to help others in the car modification community.

**Future of GM Programming and Open Source**
- Encouraged open-source collaboration and modification of GM cars.
- Highlighted potential for community-driven innovations in car programming.

**Conclusion**
- Acknowledgment to DEF CON conference and Car Hacking Village for the platform.
- Emphasized the accessibility and cost-effectiveness of the approach shared.


created_at: 2024-11-09 12:33:37
summary:
**Title and Author Information**
- **Title**: "DEF CON 32 - Practical Exploitation of DoS in Bug Bounty - Roni Lupin Carta"
- **Author**: Unknown author
- **Webpage URL**: https://www.youtube.com/watch?v=b7WlUofPJpU
- **Channel**: DEFCONConference
- **Uploader**: DEFCONConference
- **Upload Date**: 2024-10-16

**Introduction to Denial of Service (DoS)**
- **Overview of DoS Attacks**: Disrupt services by overwhelming resources or exploiting flaws
- **Types of DoS Attacks**:
  - **N+1 Errors**: Redundant database queries affecting performance
  - **GraphQL Crashing**: Vulnerability to complex queries consuming excessive resources
  - **Cache Poisoning**: Manipulating cached data to serve malicious content

**Techniques for Discovering DoS Vulnerabilities**
- **Automated Scanning Tools**: Useful for detecting potential vulnerabilities
- **Manual Testing Methods**: In-depth analysis of application behavior
- **Understanding System Architecture**: Key to identifying weak points

**N+1 Errors**
- **Definition**: Application makes redundant database queries
- **Exploitation**: Trigger numerous unnecessary queries to slow down or crash systems

**GraphQL Vulnerabilities**
- **Complex Queries**: Can consume excessive resources and crash servers
- **GraphQL Batching and Aliases**: Combine multiple requests into one, potentially overwhelming the server
- **GraphQL Directives**: Overloading directives can crash the server

**Cache Poisoning**
- **Technique**: Manipulate cached content, potentially leading to service disruption
- **Potential Impact**: Serve incorrect or malicious content to users

**Responsible Reporting and Mitigation**
- **Importance of Reporting**: Share findings with bug bounty programs responsibly
- **Best Practices**: Ensure effective communication and timely mitigation

**Case Studies and Real-World Examples**
- **Network-Based DoS**: Using techniques like slow loris or request loops to exhaust server resources
- **Disk Consumption DoS**: Filling disk space by repeatedly creating files, leading to service disruption
- **Sign-In DoS**: Exploiting weak authentication mechanisms to lock out users or admins

**Conclusion and Final Notes**
- **Continuous Learning**: Stay updated on the latest trends in DoS attack vectors and mitigation strategies
- **Success Stories**: Highlight significant bounties earned through innovative DoS techniques
- **Collaboration Acknowledgment**: Thanks to collaborators and contributors in research efforts


created_at: 2024-11-09 12:36:50
summary:
**Introduction**
- Welcome to DEF CON
- Talk titled: **Porn and Privacy**
- Presenter: Edna Johnson (ET), **cybersecurity professional** and **master's degree student**

**Content Warning**
- Topics may be triggering: **nonconsensual intimate image abuse**, **revenge porn**, **deep fakes**, **sextortion**
- Not a **mental health professional**; encourage seeking help from trained professionals

**Roadmap**
- Discussing **obscenity laws**, **NCIIA**, **deep fakes**
- Tips to **minimize risk** and **recover** from image abuse

**Obscenity Laws**
- States passing laws requiring government ID for access to **adult content**
- **Pornhub** blocking states due to privacy concerns
- Laws often tied to **child protection** bills

**Digital Privacy Basics**
- **Digital privacy**: protection of online information
- **Personal Identifiable Information (PII)**: social security number, full name, email, phone number
- Use **strong passwords** and **password managers**
- Implement **two-factor authentication**
- Limit personal information on **adult websites**

**Nonconsensual Intimate Image Abuse (NCIIA)**
- Also known as **revenge porn**
- Distribution of images without consent
- Steps to take if images are leaked: **OSINT on yourself**, limit shared information

**Watermarking Images**
- Use **watermarks** to track image sources
- Remove **EXIF data** to protect geolocation

**StopNCII.org**
- Helps remove leaked images from major platforms
- Ability to remove images from **Google searches**
- Use **DMCA requests** to remove images legally

**AI and Image Abuse**
- **AI tools** used to manipulate images
- Need for **new laws** to address abuse

**OnlyFans Tips**
- Use **fake name** and separate social media accounts
- **Watermark** photos
- Enable **two-factor authentication**

**Catfishing and Sextortion**
- Use **reverse image search** to detect catfishing
- **Sextortion**: blackmail involving intimate images
- Do not comply with demands; report to authorities

**Legal Landscape**
- **NCIA laws** in most states; **extortion laws** in half the states
- Ongoing legislative efforts regarding **deepfakes**

**Resources**
- **Operation Safescape**: support for victims
- **Lockdown Your Life**: consultations and learning resources
- **Operation Privacy**: free platform with privacy checklists

**Conclusion**
- Acknowledge the contribution of **Caitlin Bowden**
- Contact information for Edna Johnson: edna at edna.tech, Twitter, and BlueSky at Edna's


created_at: 2024-11-09 12:44:15
summary:
**Event Overview**
- Title: DEF CON 32 - Open Source Hacker V. Government Lawyer
- Speakers: Rebecca Lively (former DoD lawyer), Eddie Zaneski (open-source hacker)

**Session Highlights**
- Debate on DoD cybersecurity inefficiencies
- Insights from government policy and private sector perspectives
- Proposal of open-source inspired solutions to improve DoD operations

**Introduction**
- Rebecca and Eddie met at Bravo 11 collaborative software event
- Discussion on open-source software and government data access

**Challenges Faced at Hackathon**
- Security measures: No personal laptops or USBs allowed
- Lack of internet access hindered project work
- Environment setup required for non-vetted participants

**Government Compliance and Priorities**
- **Compliance**: Importance of meeting various governmental requirements
- **Scale**: Necessity to scale solutions across the entire Department
- **Documentation**: Proving adherence to procedures is prioritized
- **Fairness**: Transparency in acquisition processes
- **Mission**: National security often feels deprioritized

**Technical Challenges in Government**
- Lack of true technical talent and retention issues
- **Law, Policy, and Inertia**: Multiple layers of policy restrict innovation
- **Incentives**: Misalignment of incentives with stated priorities

**Solutions Proposed**
- **Prioritizing Technical Depth**: Career paths for software engineers in government
- **Improving Hiring and Firing Speed**: Modify policies to compete for tech talent
- **Aligning and Setting Priorities**: Encourage risk-taking and innovation
- **Automating Compliance Documentation**: Use policy code to reduce manual efforts

**Budget and Organizational Inefficiencies**
- **Duplicated Efforts**: Multiple branches creating similar systems
- **Financial Policies**: 'Use it or lose it' policy leads to inefficient spending
- **Incentivizing Quality Over Quantity**: Importance of quality technical talent

**Public-Private Partnerships**
- **Ethics Requirements**: Complex rules hinder collaboration
- **Communication Barriers**: Misunderstandings about selling intentions
- **Engagement with Open Source**: Encourage government participation in open-source projects

**Call to Action**
- Consider careers in public service through defense contractors or organizations like 18F and CISA
- Engage with policy changes through reading and collaborating with organizations like EFF and ACLU
- Encourage government participation in technical projects and open-source communities

**Conclusion**
- Encouragement to bridge gaps between government and private tech sectors
- Open invitation for government employees to participate in open-source initiatives

**Final Remarks**
- Acknowledge the need for collaboration and understanding between government and private sectors to improve national security and technological advancements.


created_at: 2024-11-09 12:49:27
summary:
**Presentation Overview**
- DEF CON 32 presentation by Octavio Gianatiempo and Gastón Aznarez on **Detecting Persistent Threats on Draytek Devices**.
- Focus on understanding and securing closed-source firmware on edge devices like routers and firewalls.

**Motivation and Research Background**
- A client using **Draytek equipment** was compromised, leading to the investigation.
- **500k Draytek routers** are globally exposed, with no existing tools to extract firmware.
- Developed tools to reverse-engineer firmware and mitigate persistent threats.

**Reverse Engineering Draytek Firmware**
- **Draytek's firmware** format and RTOS kernel allows dynamic loading of code modules.
- **Persistent threats** can remain active post-firmware upgrades.
- Created **DRYTEXT Arsenal**, a collection of Python-based tools for firmware extraction.

**Firmware Format**
- **Binary section**: Includes boot loader and RTOS kernel.
- **Web section**: Contains compressed file systems for web UI.
- **DLM code**: Compressed and encrypted dynamic modules.

**Vulnerabilities and Attack Vectors**
- **Insecure password storage** and **non-constant time comparison** enable attacks.
- Predictable **second-step authentication** due to time-based seed.
- **Malicious modules** can be crafted and uploaded, exploiting weak security checks.

**Creating and Uploading Malicious Modules**
- Three methods: **post-authentication endpoints**, **DNS hijacking**, and **supply chain attacks**.
- Developed functionality to **compile and merge** modules, facilitating module injection.

**Mitigation Strategies**
- Considered removing dynamic module loading but explored a better solution.
- Developed a mechanism to **check in-memory integrity** of loaded modules.
- Implemented a defensive module to **compare module hashes** and detect discrepancies.

**Conclusions and Takeaways**
- Vulnerabilities found in **Vigor 2925** router potentially exist in other models.
- Emphasized need for **vendor-implemented security features** and open source tools for community research.
- Highlighted the importance of **observability** and **threat detection solutions** in firmware.


created_at: 2024-11-09 12:53:23
summary:
**Introduction to Sneaky Extensions**
- Increasing browser usage due to work-from-home and hybrid models
- Extensions enhance user experience but can threaten **privacy** and **security**
- Rise in malicious extensions for stealing data, promoting ads, etc.

**Transition from MV2 to MV3**
- Google moved from MV2 to MV3 for better **security**
- MV3 includes measures to block arbitrary code execution
- Demonstrations of attacks requiring minimal **permissions**

**Typical Extension Structure**
- **Manifest file, Service worker**, and **Content script**
- Content script injected into specific web pages
- **HTML pages** for user interaction

**Permissions and Security**
- **Permissions required** specified upfront in manifest file
- Common dangerous permission: **All URLs**
- Chromium's **multi-process architecture** enhances security

**Content Scripts and Vulnerabilities**
- Content scripts modify web pages
- **No explicit permissions** needed to modify pages
- Vulnerability for **remote code execution**

**Bypassing MV3 Security**
- MV3 blocks functions like eval for security
- **Workarounds** exist for executing arbitrary code
- Demonstrations of bypassing content security policy

**Examples of Malicious Activities**
- **Social engineering** via fake updates
- Capture live **video calls** without detection
- **Silent account hijacking** using HTTP-only cookies

**Interference with Password Managers**
- Extensions can **override** password manager actions
- Phishing through fake login pages

**Conclusion and Recommendations**
- Known extensions can be bought and misused
- Importance of **supply chain security** in the Chrome store
- Visit **sqrx.com** for more information and research details.


created_at: 2024-11-09 12:57:25
summary:
**Introduction to SBOMs and Bob the Minion**

- Presentation on generating a **Software Bill of Materials (SBOM)** for Davolink's Bob the Minion WiFi router
- Focus on hardware disassembly and firmware extraction
- Aim to generate a comprehensive **SBOM** and identify security vulnerabilities

**Background and Importance of SBOMs**

- **SBOM**: Inventory of all software, versions, and origins in a product
- Key for product security and software supply chain management
- Predicted to be mandatory for connected products by 2025

**Regulatory Landscape**

- **Executive Order 14 208**: Requires SBOMs in products for US government and consumer markets
- **FDA 524 B**: Medical devices must include an SBOM
- **Cyber Trustmark Program**: Voluntary consumer protection initiative by FCC
- **EU Cyber Resiliency Act (EU CRA)**: Mandatory SBOM inclusion and vulnerability management for products in Europe

**Benefits of SBOMs**

- Provides a **software inventory** for first and third-party components
- Enables **vulnerability discovery** and risk mitigation
- Encourages the operationalization of SBOMs in security and penetration testing processes

**Challenges with Bob the Minion**

- Davolink's restricted firmware release policy
- No public firmware updates or downloads available
- Necessitated unconventional methods for firmware extraction

**Hardware Hacking Process**

- **Bob the Minion**: A wireless home router with WiFi 6, easy mesh support, and WPA3
- Disassembly and chip analysis to access firmware
- Utilized SPI flash and JTAG/SWD interfaces for firmware extraction

**Firmware Extraction and Findings**

- **Winbond W25N01GV**: 3V 1 gigabit flash chip used in Bob the Minion
- Discovered vulnerabilities, remote code vulnerabilities, and insecure default credentials
- Found scripts communicating with IP addresses in China

**Conclusion and Future Work**

- Importance of SBOMs in improving IoT security
- Ongoing challenges in firmware extraction and analysis
- Presentation aimed to highlight hands-on hardware hacking and SBOM generation challenges

**Acknowledgments**

- Thanked co-worker Edwin Shuttleworth for contributions


created_at: 2024-11-09 13:04:33
summary:
**Introduction**
- Speaker: Emma Stewart, Chief Power Grid Scientist at Idaho National Laboratory
- Focus: Renewable energy security and the challenges in the energy transition

**Current Energy Challenges**
- **Climate Change and Weather**: Increasing frequency of $10 billion weather events affecting power grids
- **Emissions**: Energy sector contributes 28% of emissions, prompting a shift to renewable energy
- **Power Grid Evolution**: Transition from large generators to distributed systems and energy storage

**Renewable Energy Transition**
- **Energy Storage and Electric Vehicles**: Key components in modernizing power systems
- **Cloud-Based Applications**: Necessary for small utilities' modernization due to lack of local data centers
- **Supply Chain Issues**: Heavy reliance on Chinese-manufactured components for renewable energy systems

**Supply Chain Vulnerabilities**
- **Chinese Manufacturing Dominance**: Significant portion of components made in China
- **Policy and Security Concerns**: Military bases and utilities using Chinese-manufactured batteries face security challenges
- **Rip and Replace Policy Limitations**: Attempts to replace foreign components are underfunded and ineffective

**Technical and Security Risks**
- **Component Reliability**: Inverters fail every 15 years, posing opportunities and challenges for replacement
- **Cybersecurity Risks**: Hard-coded passwords, insecure applications, and lack of vulnerability disclosures
- **Ransomware and Denial of Service**: Previous attacks have not caused power outages but highlight vulnerabilities

**Policy and Regulatory Challenges**
- **Consumer Responsibility**: Individuals often responsible for securing and updating their renewable energy systems
- **Regulation and Enforcement Gaps**: Unclear regulatory responsibilities due to complex ownership and supply chains
- **Investment Needs**: Demand signals required for domestic manufacturing and investment in renewable technologies

**Recommendations for Policy Change**
- **Ban and Replace Limitations**: Current strategies may lead to further complications in the supply chain
- **Inspection and Analysis**: Need for thorough vulnerability analysis of imported components
- **Contractual and Regulatory Improvements**: Enhanced contract requirements and clearer regulatory frameworks needed

**Conclusion**
- **Renewable Energy Imperative**: Essential to combat climate change despite challenges
- **Policy and Technology Solutions**: Necessary to address supply chain vulnerabilities and ensure secure energy transition


created_at: 2024-11-09 13:08:33
summary:
**Introduction to Safecracking**

- Jared Dygert is a **lock sport enthusiast** with nearly 20 years of experience
- Focus of talk: **mechanical combination safe locks** and their vulnerabilities
- Emphasis on **Group Two mechanical safe locks**, their flaws, and exploitation techniques

**Types of Safe Locks**

- **Group Two**: Standard security classification
- **Group 2M**: Enhanced security with harder manipulation
- **Group One**: High security with extra features, withstands manipulation for 20 hours
- **Group 1R**: Radiologically resistant, made to resist x-ray attacks

**Components of a Safe Lock**

- **Drive Cam**: Central brass circle connected to the dial
- **Lever and Nose**: Nose rests on top of the drive cam
- **Wheels and Gates**: Wheels with gates align with the combination
- **Fence**: Bar that falls into the gates when aligned

**Mechanism of Operation**

- Dialing the combination aligns gates under the fence
- Drive cam turns, allowing the nose to retract the bolt
- Wheels are moved by the **drive cam** through contact with drive pins

**Safecracking Techniques**

- Identify **contact points** and **gate signatures**
- Use **wheel isolation** to determine correct combination numbers
- **Common low point**: Find a point where no bumps interfere with the fence

**Challenges and Vulnerabilities**

- Asymmetrical drop-in area leads to detectable resistance
- Larger or irregular wheels affect the positioning of the fence
- **Brute force**: Used for the first wheel after determining the other two numbers

**Variations in Safe Locks**

- **Legar 3330**: Oval wheels complicate detection
- **Diebold Locks**: U-shaped drive cam allows symmetrical readings
- **Sergeant and Greenleaf Models**: Easier to start with, slight differences in ease of opening

**Practical Tips**

- Be **precise** in reading and dialing
- Use a **known combination** for practice
- Remove back cover to visualize inner workings

**Resources and Further Learning**

- **In-person demonstrations** at lock-picking village
- **Safe Cracking for Everyone** book available as a PDF
- **Online communities**: Lock Picking Subreddit, LPU Discord
- **Sophie Safe Cracking Simulator**: Game for practice
- Continued practice essential for proficiency

**Conclusion**

- **In-person demonstrations** available post-talk
- Apologies for technical difficulties during the presentation


created_at: 2024-11-09 13:11:53
summary:
**Introduction to Small Satellite Modeling**

- Speaker: Dr. Kyle Merbach from the University of Alabama in Huntsville Center for Cybersecurity Research and Education
- Partnership: U.S. Army Space and Missile Defense Command
- Purpose: To inform on aerospace cybersecurity, focusing on small satellite systems

**Project Background**

- Duration: Ongoing since fall 2019
- Involvement: Multiple student teams contributing to various project phases
- Role of Director: Ensuring continuous progress and achieving notable milestones

**Major Project Milestones**

- **Hardware and Software Configuration**: Setting up a small satellite testbed
- **Vulnerability Testing**: Creating test scenarios to harden satellite systems against threats
- **Development of Small Satellite Defender (SSD)**: Software solution for satellite protection

**Research Focus and Achievements**

- **Affordable Satellite Launches**: Enabled by companies like SpaceX, increasing the need for cybersecurity
- **Testbed Development**: Aimed to mimic real-world systems with components like imagery, GPS, and communications
- **Raspberry Pi vs PyCubed Boards**: Decision to use Raspberry Pi due to better support and resources
- **Real-World Testing and Simulation**: Utilization of Raspberry Pi cameras, RFM69ACW radios, and SenseHat for sensors

**Vulnerability Analysis and Attack Scenarios**

- **Attack Types**: Man-in-the-middle, denial of service, spoofing, and hardware attacks
- **Communication Setup**: Custom protocol for satellite-ground station communication
- **Scenario Example**: Man-in-the-middle attack leading to satellite communication takeover

**Defensive Measures and Mitigations**

- **Command Validation**: Preventing errors and crashes
- **Health Checks**: Monitoring system status and reporting anomalies
- **Research Goals**: Reducing satellite launch vulnerabilities and improving resource posture

**Publications and Collaborations**

- **IEEE Conference Paper**: Documenting research and model details
- **Lockheed Martin Collaboration**: Testing SSD on an actual satellite orbiting Earth

**Future Plans and Developments**

- **TubeSat Kits**: Building and experimenting with new satellite models
- **Small Satellite Defender Iterations**: Enhancements for both ground station and satellite
- **Metric Collection**: Focus on battery health, system information, and visualizations for operators

**Conclusion**

- **Research Continuation**: Ongoing efforts with TubeSat kits and potential collaborations
- **Security and Monitoring**: Advancing satellite security for future space missions


created_at: 2024-11-09 13:19:44
summary:
**Introduction and Background**
- **Presentation Title:** DEF CON 32 - Signature-Based Detection Using Network Timing
- **Speaker:** Josh Pyorre
- **Affiliation:** Cisco Talos; previously worked with Zscaler, Umbrella, OpenDNS, NASA, and Mandiant
- **Focus:** Attribution and infection chain in security research
- **Example Threats:** Emotet, Epoch 4

**Attribution Techniques**
- **Tools Used:** VirusTotal, URL tracking
- **Process:** Finding domains/URLs, hash tracking, gathering more attribution
- **Frameworks:** Minor attack framework to attribute tools, tactics, and procedures
- **Interest Levels:** Government threat actors, campaigns, malware types

**Infection Chain**
- **Common Patterns:** Email links/attachments leading to OfficeDoc with macros
- **Examples:** Emotet, QuackBot
- **Detection Challenges:** SSL traffic complicates detection

**Detection Methods**
- **Intrusion Detection Systems (IDS):** Use of IDS rules for malware detection
- **Yara Rules:** Typically for binary analysis, adaptable for network traffic
- **Tools:** Yara PCAP for network traffic analysis

**Network Traffic Challenges**
- **Visibility Issues:** SSL encryption limits detection
- **Typical Network Behavior:** Understanding normal vs. malicious patterns
- **Packet Capture (PCAP):** Importance of analyzing PCAP files for detection

**Pattern Recognition and Analysis**
- **Methodologies:** Averages, Levenstein distance, co-integration
- **Challenges:** Identifying patterns within network traffic
- **Comparative Analysis:** Benign vs. malicious traffic analysis

**Signature Development**
- **Process:** Creating signatures from network traffic patterns
- **Tools:** Levenstein distance, fuzziness in detection
- **Application:** Use of PCAP files to generate detection signatures

**Future Work and Practical Applications**
- **Production Use:** Integrating detection methods into operational environments
- **API Development:** Enhancing functionality with third-party integrations
- **Creative Exploration:** Using audio as an alternative analysis method

**Conclusion**
- **Speaker's Reflection:** Importance of creativity in security research
- **Availability of Code:** Code and documentation available for experimentation
- **Contact Information:** Website - pyrosec.com

**Q&A Session**
- **Speaker's Experience:** Discussed network testing in home environment
- **Future Directions:** Exploring direction and mapping in network analysis


created_at: 2024-11-09 13:22:59
summary:
**RFID Basics**
- **RFID** is used in everyday scenarios like accessing buildings, transit systems, and payment methods.
- The technology involves a **transformer** effect where the card and reader communicate via a magnetic field.
- The reader’s coil creates a magnetic field that induces a current in the card, powering a chip to respond with its ID.

**Security Vulnerabilities**
- **No encryption**: RFID systems can be easily intercepted as they rely on magnetic fields.
- **Cloning**: It's possible to clone badges and fobs due to their simplistic communication protocol.
- **Brute force**: Short keyspaces allow for easy brute-forcing of IDs.

**Encryption Solutions**
- **Pre-shared keys**: Ensure secure communication by requiring both the reader and card to have a pre-agreed key.
- **Challenge and response**: A method where the card and reader prove they know the key without revealing it.
- High-frequency systems (13.56 MHz) often use **encryption** to secure communication.

**Demonstration with Flipper Zero**
- The **Flipper Zero** is a tool used to demonstrate RFID cloning, showing how easily information can be copied from one badge to another.
- The device can also brute force RFID systems by running through a short dictionary of possible codes.

**Best Practices for Security**
- Treat RFID cards and fobs like keys; if lost, they should be deactivated immediately.
- Upgrade systems to ensure **proper encryption** of transmitted secrets.
- Implement **tamper detection** on readers to prevent unauthorized access.

**Preventive Measures and Tools**
- Use **RFID-blocking** holders to prevent unauthorized reading.
- Opt for systems that require a handshake before data exchange.

**Conclusion**
- RFID technology, although convenient, is not inherently secure and should be managed with the same care as traditional security methods.
- Engage in continuous security measures and stay informed about evolving RFID technologies and potential vulnerabilities.


created_at: 2024-11-09 13:26:37
summary:
**Introduction to Bypass Techniques**
- Speaker acknowledges technical issues with slides.
- Discusses focus on **physical security systems** behaving unexpectedly.
- Emphasizes that **bypasses** often exploit systems not working as intended.

**Types of Bypasses**
- **Lock picking** and **forcible entry** discussed.
- Importance of addressing **misconfigurations** like faulty wiring.
- **Latch targeted bypass**: Demonstrates how to manipulate self-latching doors.

**Security Vulnerabilities**
- **Common failures**: Accessibility buttons and simple misconfigurations.
- Importance of **demonstrating low-skill bypasses** to employers.
- **Leashy tools**: Game-changer in lock picking; highlights the need for higher security locks.

**Forcible Entry**
- **Forcible entry** as a common real-world threat.
- Describes use of **halogen tools** by firefighters and criminals.
- **Detection and response**: Key to defending against forcible entry.

**Alarm and Detection Systems**
- Discusses bypass techniques for **alarm systems**.
- Importance of **internal area detectors** to complement physical barriers.
- **Access control systems**: Explains potential vulnerabilities like the canned air attack.

**Testing and Evaluation**
- Encourages testing **access control systems** for proper functionality.
- Advises simulating **forced entries** to ensure alarms trigger appropriately.
- Stresses testing **camera systems** for adequate coverage and resolution.

**Threat Modeling and Risk Assessment**
- Understanding **threat models**: Importance of knowing what is being protected.
- **Risk matrix**: Helps prioritize what issues to address with employers.
- Recommends focusing on **critical and easily demonstrable** vulnerabilities.

**Conclusion and Recommendations**
- Encourages engaging with internal **facilities teams**.
- Recommends prioritizing **system functionality** before addressing bypasses.
- Invites audience to try out techniques in the physical security village.


created_at: 2024-11-09 13:30:31
summary:
**Introduction to Popping Shells with Arduino Magic**
- Speaker: Dan Beard, software engineer at MedCrypt
- Background: Extensive experience with medical devices, especially in vitro diagnostic instruments and therapeutic devices

**Medical Device Design**
- **Medical device design 101:** Focus on IVD and therapeutic devices
- **Embedded boards:** Typically run on RTOS, bare metal, custom FPGA
- **User interface boards:** Usually run Windows or Linux, connected via CAN bus, CAT6, RS232

**BadUSB and Security Risks**
- **Bad USB:** USB dongles that mimic human interface devices like keyboards and mice
- **Security vulnerabilities:** No signature checks for USB devices, potential for exploitation
- **Industry misconceptions:** Belief that physical access and internet connection are required for exploitation

**RadioJack and T-Dongle S3**
- **Device requirements:** Wireless, cheap, USB hit device emulation
- **T-Dongle S3:** $10 device with wifi, Bluetooth, programmable in multiple languages
- **RadioJack software:** Open source, emulates keyboard and mouse, hosts wifi server

**Usage and Demonstration**
- **How to use:** Plug into target, connect to SSID, telnet to IP address, follow CLI commands
- **Features:** Drop payloads, open remote PowerShell prompts, emulate keyboard and comport
- **Proof of concept:** Demonstration of payload drop on a Windows PC

**LoRa and Long-Range Exploitation**
- **Introduction to LoRa:** Long-distance radio with theoretical range of 3+ miles
- **LoRa S3 device:** Similar to T-Dongle S3 but with LoRa capability
- **Usage:** Same process as wifi but over LoRa, extends range for remote exploitation

**Security Implications and Mitigations**
- **Exploitation risks:** Minimal physical access required, potential for network penetration
- **Mitigation strategies:** Cover USB ports, disable USB stack unless explicitly needed

**Discussion and Q&A**
- **Tested devices:** Various Windows PCs, medical devices in biohacking village
- **Potential for wider network access:** Using device as entry point into air-gapped networks
- **Physical access concerns:** Confidence in unnoticed device insertion, potential for unnoticed exploitation

**Final Thoughts**
- **Open source collaboration:** Encouragement for community contributions and improvements
- **Impact on industry standards:** Challenging misconceptions about security in air-gapped environments


created_at: 2024-11-09 13:33:07
summary:
**Presentation Overview**
- Topic: Exposing vulnerabilities in large off-grid solar systems
- Speakers: Dan Berte & Alexandru Lazar from Bitdefender
- Focus: Three significant vulnerabilities in solar management platforms posing national security risks

**Research Background**
- Experience: Over 10 years in IoT vulnerability research
- Publications: 25+ high-profile cases, numerous white papers
- Notable Cases: Ring doorbell, LG TVs, Amazon Fire Stick, August lock, Wyze cameras

**Vendor Responsiveness**
- **Concerning Statistics**:
  - 30% of vendors do not reply or delay responses
  - 20% take over a year to address vulnerabilities or never patch them
- **PSA to Vendors**:
  - Appoint a permanent contact
  - Set up a vulnerability disclosure program
  - Use a PGP key and monitor the inbox

**Power Grid Threats**
- **Natural vs. Cyber Threats**: Squirrels and natural events are major threats, not cyberattacks
- **Squirrel Terrorism**: Most frequent disruptors of the power grid

**Solar Energy Security Concerns**
- **Growth**: Over 500 gigawatts added last year
- **Security Question**: Is it keeping up with the growth?
- **Investigation Focus**: Manufacturer Dey and platform Solarman

**Vulnerability Findings**
- **Initial Investigation**: Man-in-the-middle attack on Dey cloud app
- **Hard-Coded Credentials**: Found in login requests
- **Access Point Vulnerability**:
  - Exploit requires physical proximity
  - Possible to access user interface and network

**Platform Flaws**
- **Search API Leakage**: Exposes user and organization data
- **Account Takeover Potential**: Over 1 million accounts vulnerable
- **Token Exploitation**:
  - Tokens from Dey work on Solarman
  - ID and email changes allow account access

**Impact and Response**
- **Affected Users**: Estimated 3.5 million users, 330,000 businesses
- **Potential Risks**: Overloading or underloading the grid
- **Platform Reach**: Serves 20% of global solar capacity
- **Vendor Response**: Some vendors patched vulnerabilities quickly

**Call to Action**
- **Vendor Recommendations**:
  - Establish vulnerability handling protocols
  - Use PGP keys for secure communication
- **Encouragement**: Visit IT village for more information and challenges

**Conclusion**
- **Security Awareness**: Highlighting potential changes in threat landscape
- **Open Invitation**: Audience invited to ask questions and engage further


created_at: 2024-11-09 13:36:20
summary:
**Introduction to Satellite-Based Air Traffic Control Security**

- **Automatic Dependent Surveillance – Contract (ADS-C)**: A satellite-based aviation datalink application for monitoring aircraft in remote regions.
- **ADS-B vs. ADS-C**: ADS-C is crucial where ADS-B lacks connectivity, especially in remote areas like oceans or mountainous regions.

**Overview of ADS-C**

- **History and Impact**: Although conceived over 30 years ago, ADS-C's security has been largely unexplored.
- **Technical Details**: ADS-C lacks authentication, making it vulnerable to attacks.
- **ADS-C Message Analysis**: Over 120,000 real-world ADS-C messages were analyzed using software-defined radio receivers.

**Vulnerabilities in ADS-C**

- **Lack of Authentication**: Allows generating and sending arbitrary ADS-C messages.
- **Protocol Weaknesses**: Vulnerabilities range from passively tracking aircraft to actively altering aircraft positions via downlink and uplink attacks.

**ADS-B and Satellite Security**

- **Satellite-Based ADS-B**: Mirrors terrestrial vulnerabilities; companies claim it's secure due to satellite distance, but it’s an engineering challenge to overcome.
- **Security Myths**: Space-based ADS-B is not inherently secure, and theoretical attacks are possible despite regulatory limitations.

**ADS-C Functionality**

- **Data Transmission**: ADS-C transmits aircraft position, altitude, speed, and more to ground stations.
- **Satellite Communication**: Uses geostationary or LEO satellites to relay information to air navigation service providers.

**Importance of ADS-C**

- **Remote Monitoring**: Essential for monitoring aircraft over remote areas without terrestrial surveillance.
- **Efficient Airspace Utilization**: Enables reduced reliance on traditional voice communication and better airspace management.

**Security Analysis of ADS-C**

- **System and Threat Models**: Involves satellites, ground stations, and aircraft stations, with potential eavesdroppers and active attackers.
- **Eavesdropping**: Allows reconnaissance on aircraft by tracking their positions and identifiers.
- **Active Attacks**: Can lead to denial of service or spoofing of aircraft positions.

**Practical Insights and Testing**

- **Receiver Setup**: Utilized software-defined radios and antennas for downlink and uplink message reception.
- **Message Injection**: Demonstrated the ability to inject arbitrary ADS-C messages, highlighting security flaws.

**Conclusion**

- **Security Concerns**: ADS-C lacks authentication, allowing both passive and active attacks.
- **Ease of Setup**: Setting up attack systems is straightforward and cost-effective, posing a significant security threat.
- **Future Talks and Papers**: Additional discussions on signal injection and related security issues are scheduled at upcoming conferences.


created_at: 2024-11-09 13:39:53
summary:
**Aircraft PKI Overview**
- **PKI in Aircraft Operations**: Used for protecting aircraft software parts and authenticating aircraft to ground networks.
- **Importance**: Essential for aviation, dealing with **Field Loadable Software (FLS)**, maintenance, and navigation databases.

**Use Cases and Methods**
- **Typical Use Cases**: Include maintenance logs, communication systems, and navigation databases.
- **Methods A, B, and C**: Various approaches to handling FLS, each with specific processes and advantages.

**PKI Processes and Regulations**
- **ATA Spec 42**: Discusses the use of certificates and smart cards for user authentication.
- **Handling FLS**: Requires verification of authenticity and integrity by regulation.
- **ARINC 645-1 Portable Data Loaders (PDLs)**: Enforce signature checking before loading onto aircraft.

**Data and Security**
- **Data Generation**: Aircraft can produce hundreds of megabytes to several gigabytes of data per flight.
- **Gate Link and VPN**: Used for secure data transfer, with certificates required for each VPN connection.

**Challenges and Solutions**
- **Post-Quantum World**: Emerging threats necessitate updates in PKI to accommodate future cryptographic challenges.
- **Smart Cards**: Offer two-factor authentication without mobile devices, enhancing security and user experience.

**Technical Insights**
- **Certificate Use**: Enforce server and application authentication, mapped to **Active Directory (AD)** identities.
- **Signing Methods**: Method A involves using smart cards; Method B involves using an **HSM (Hardware Security Module)**.

**Industry Collaboration**
- **DSWG Involvement**: Guides strategic path for standards and specification changes in the aviation industry.
- **Trust and Verification**: Strong emphasis on identity checks and certificate usage within ATA Spec 42.

**Future Considerations**
- **Post-Quantum Threats**: Aircraft lifespans and regulatory challenges make adapting to quantum-resistant algorithms crucial.
- **Inventory and Testing**: Operators advised to inventory PKI use cases and prepare for future algorithm changes.

**Speaker Information**
- **Matt Gaffney**: Principal engineer at United Airlines and Aerospace Village lead, discussing aircraft PKI challenges and solutions.


created_at: 2024-11-09 13:42:02
summary:
**Introduction to UDSonCAN Attacks**
- Presenter: Seunghee Han, security researcher from Autocrypt
- Focus: Safety-critical risks discovered through **fuzzing** on latest **electric vehicle** (EV) models

**UDSonCAN and Fuzzing**
- **UDS**: Protocol for communication with vehicles, defined in **ISO 14229**
- **Fuzzing**: Testing method using random data to find system vulnerabilities
- **Objective**: Discover weak points in EV models through fuzzing tests

**Key Attack Scenarios**
- **Scenario 1**: **Sudden Stop**
  - Involves sending **ECU reset** message to a moving vehicle
  - Causes vehicle to stop suddenly without warning
- **Scenario 2**: **Vehicle Disabling**
  - Continuous **ECU reset** messages disable vehicle functions
  - Prevents vehicle from starting or gear shifting

**ECU Reset Attack**
- **ECU Reset**: Used for troubleshooting/resetting vehicle's ECU
- **Problems**: ECU reset not disabled in drive mode, posing danger
- **Test Setup**: Using laptop connected to vehicle's **OBD port** via **CAN interface**

**Communication Control Attack**
- **Communication Control**: Manages ECU communication functions
- **Sub Functions**: 
  - Sub function 1: Enables RX and disables TX
  - Sub function 3: Disables both RX and TX
- **Problems**: Communication control not disabled in drive mode, lacks security authentication

**Attack Consequences**
- **Mechanical Failure**: Attacks can lead to mechanical issues or accidents
- **Uncontrollable Vehicle**: Continuous attacks prevent vehicle control, causing safety risks

**Attack Methods**
- **Wireless OBD Device**: Allows attacker to connect without detection
- **Short-Range Wireless Communication**: Possible via **Wi-Fi** or **Bluetooth**

**Countermeasures**
- Services like **ECU reset** and **communication control** should only operate in a not ready state (engine off)
- Implement **security access authorization** for critical services

**Security Enhancements**
- **Security Access Service**: Uses seed and key for authentication
- **Gateway Safety Function**: Filters data, allowing access to specific information only

**Conclusion**
- Importance of securing diagnostic services to prevent potential attacks
- Presentation aimed to highlight vulnerabilities and propose solutions for enhanced vehicle security


created_at: 2024-11-09 13:53:09
summary:
**DEF CON Villages Overview**
- **Villages** are key to the DEF CON experience
- **Villages** help bring people together based on common interests
- **Villages** provide spaces for learning, networking, and career progression

**Roles and Responsibilities**
- **Village Leads**: Organize and coordinate village activities
- **Sponsors**: Provide financial and logistical support
- **Volunteers**: Assist with village operations and events

**Village Examples and Focus Areas**
- **Blue Team Village**: Focuses on community building and mentoring
- **Car Hacking Village**: Encourages younger people to enter the security industry
- **Aerospace Village**: Aims to ensure safety and security in aviation systems
- **ICS Village**: Educates on control systems and security
- **Biohacking Village**: Tests vulnerabilities in medical devices and collaborates with the FDA

**Challenges and Strategies**
- **Volunteer Management**: Recruitment and retention of motivated volunteers
- **Logistics**: Managing the complexity of setting up and running village activities
- **Funding**: Securing sponsors and managing budgets to cover costs
- **Burnout**: Addressing volunteer and staff fatigue due to extensive planning and execution efforts

**DEF CON Support and Improvements**
- DEF CON provides space and logistical support for villages
- DEF CON has improved support with hotel accommodations for village leads
- DEF CON villages aim for equitable distribution of resources like badges

**Key Takeaways**
- **Networking** is crucial for career growth within the DEF CON community
- Villages offer unique opportunities for hands-on learning and real-world problem-solving
- Continuous improvement and feedback are vital for the success of future events


created_at: 2024-11-09 13:57:14
summary:
**Overview of Presentation**

- Discusses discovery and analysis of **CVE-2023-52709** vulnerability in TI Bluetooth stack
- Vulnerability causes failure in generating a resolvable **Random Private Address (RPA)**, leading to a **Denial of Service (DoS)**
- Covers technical aspects, implications for automotive security, and potential mitigation strategies

**Agenda and Structure**

- Introduction and speaker bio
- Impact of **denial of service attacks** on keyless entry systems
- Origin, timeline, testing setup, and results of the vulnerability
- Vulnerability disclosure process with **Texas Instruments** and **Bosch**
- Denial of service attack details and root cause analysis
- Assessment and list of affected devices
- Real-world impacts and potential costs
- Mitigation strategies and conclusion
- Question and answer session

**Speaker Background**

- **Kevin Mitchell**, IT professional since 2008
- Experience with **Hewlett-Packard**, **FCA**, and **Mercedes-Benz Financial Services**
- Currently a senior automotive security tester at **ETAS**

**Key Insights and Quotes**

- Emphasizes the integration of technology into daily life 
- Discusses the potential costs of automotive recalls

**Vulnerability Details**

- **CVE-2023-52709** affects the **TI-BLE5 stack**
- Denial of service occurs when a device generates unresolvable RPAs
- Vulnerability impacts devices using **Bluetooth privacy** with resolvable private address feature

**Disclosure and Testing Process**

- Difficulties in reproducing the issue initially by **Texas Instruments**
- Successful reproduction by **Bosch** engineers and subsequent escalation
- Importance of responsible disclosure and verification by multiple parties

**Technical Analysis**

- Uses **Defensics Test Case 1001** to identify the vulnerability
- Root cause linked to encryption failures leading to discarded MAC addresses

**Affected Devices and Mitigation**

- Initial assessment found 19 affected parts, later expanded to 28
- **Texas Instruments** released a mitigating SDK

**Real-World Impact and Conclusion**

- Significant financial implications for automotive industry
- Importance of proactive penetration testing to avoid costly recalls

**Questions and Closing Remarks**

- Tools used included **Defensics**, **Bluetooth CTL**, and **Sniffle**
- Encouragement to connect via LinkedIn for further discussion


created_at: 2024-11-09 14:06:01
summary:
**Presentation Overview**
- Focus on **MOS 6502** microprocessor
- Combination of history lesson and technical introduction
- Target audience: enthusiasts of early microcomputers

**Early Microprocessors**
- **70s and 80s**: Era of computer hobbyists and hackers
- Common processors: **Z80, 6502, 6809, 68000**

**Microprocessor Timeline**
- **1970s**: Introduction of microcomputers with Intel's **8080**
- **1980s**: Expansion with **Commodore 64, IBM PC, Macintosh**

**Computer Types**
- **Mainframes**: Large, room-sized computers
- **Minicomputers**: Smaller, refrigerator-sized computers
- **Microcomputers**: Smaller, hobbyist and business computers

**Semiconductor Manufacturers**
- **Shockley Semiconductor**: Founded by transistor inventor William Shockley
- **Fairchild Semiconductor**: Formed by the "Traitorous Eight"
- **Intel**: Known for memory chips and first microprocessors (4004, 8080)

**Microprocessor Evolution**
- **Intel's 4004**: First microprocessor, a 4-bit processor
- **Zilog's Z80**: Improved version of the 8080, still in production
- **Motorola's 68000**: Popular in Macintosh, Atari, and Sega systems

**MOS Technology**
- **6502**: Affordable microprocessor, used in Apple I, II, and Commodore systems
- Subsequent developments: **65816** for Apple IIgs and Super Nintendo

**Programming and Resources**
- **Assembly Language**: Machine-level programming for microprocessors
- **6502.org**: Resource hub for 6502 enthusiasts
- Books by **Lance Leventhal** and **Rodney Zaks** for assembly language learning

**Modern Applications and Communities**
- Communities keep retro computing alive with Wi-Fi and SD card integrations
- New projects like the **Commander X16** and **Mega 65**

**Conclusion**
- Importance of understanding the history and evolution of microprocessors
- Encouragement to explore and engage with retro computing communities


created_at: 2024-11-09 14:09:58
summary:
**Introduction to EV Charging Network Security**
- **Speakers**: Harry Krejsa and Sarah Hipel
- **Affiliations**: White House Office of the National Cyber Director, Joint Office of Energy and Transportation
- **Main Focus**: Secure, resilient nationwide **EV charging network**
  
**Digital Ecosystem and Clean Energy Transition**
- **Interconnection**: Digital ecosystem integral to the clean energy transition
- **Government Role**: Learning from **EVs**, vehicle electrification, and clean energy technologies
- **Biden-Harris Administration**: Generational investments in infrastructure, manufacturing from laws such as the Inflation Reduction Act and Chips and Science Act

**Decarbonization and Digitization**
- **Sophistication**: Clean energy technologies are more technically sophisticated than fossil-based counterparts
- **Future Outlook**: Transition to near-zero marginal cost electricity, software-defined grid management, and virtual power plants

**Challenges in Clean Energy Ecosystem**
- **New Stakeholders**: More dynamic but less experienced compared to traditional infrastructure sectors
- **Speed of Deployment**: Faster than traditional regulatory mechanisms
- **Infrastructure Convergence**: Physical-digital convergence across critical infrastructure

**Electric Vehicle Technology and Emissions**
- **Transportation Emissions**: Leading greenhouse gas-emitting sector
- **Commitment**: Federal commitment to reducing emissions
- **EV Sales**: Increase in fully electric and hybrid vehicle sales

**Joint Office of Energy and Transportation**
- **Origin**: Established from the bipartisan infrastructure law
- **Focus**: Affordable, reliable, convenient, equitable, and safe infrastructure
- **Role**: Center of gravity for security and cyber-physical security in charging infrastructure

**EV Charging Ecosystem Challenges**
- **Interdependencies**: Auto manufacturers, EV charging station manufacturers, network operators, and utility grid
- **Goals**: **Interoperability**, reliability, security by design

**Infrastructure Reliability**
- **Target**: Electric vehicle charging reliability target of 97%
- **Efforts**: Interoperability, data sharing, privacy frameworks, and equity

**Consumer Trust in EV Infrastructure**
- **Trust**: Essential for users to trust EV infrastructure
- **Safety**: Ensuring data, vehicle, and personal safety during charging

**Complexity and Coordination**
- **Players**: Coordination among private sector, utilities, and public sector
- **Communication**: Vehicles and distributed energy resources to securely communicate and interact

**Tools and Frameworks for Security**
- **Security Tools**: Development of pen-testing tools and frameworks
- **Open Source Contribution**: Department of Energy's contribution to Linux Foundation Everest Project

**Public Key Infrastructure**
- **Goal**: National plug-and-charge system
- **Standards**: ISO 15118-2 and public key infrastructure for secure vehicle charging

**Conclusion and Future Directions**
- **Five Linchpin Technologies**: Batteries, inverter controls, distributed control systems, building management systems, and EV cybersecurity
- **Community Involvement**: Encouragement for experts to identify vulnerabilities and improve technologies
- **Open Source**: Importance of secure and resilient open source software in the clean energy transition


created_at: 2024-11-09 14:13:28
summary:
**Introduction to the Project**
- Focus on creating an **ADS-B receiver** on a badge without using expensive SDR chips
- Aim to integrate a Linux system and custom signal processing chain into a low-cost chip

**ADS-B Overview**
- **ADS-B (Automatic Dependent Surveillance Broadcast):** Protocol crucial for aviation safety
- Transmits messages like call signs, flight numbers, and altitudes between airplanes and stations
- Commonly exists over the **MODIS downlink** at **1090 megahertz**

**Hardware Design and Implementation**
- Standard enthusiast receivers use **SDRs** like RTL-SDR
- **SDR chips**: Expensive and power-hungry for badge use
- Alternative method: **Log amp architecture** using RF power level meters and bandpass filters
- Goal: Convert RF signals into a baseband level output

**System on Chip (SoC) and ADC**
- Using **Allwinner T113** as the main Linux component
- **Composite video input** repurposed for ADS-B demodulation
- Reverse engineering to disable video filters and access raw ADC samples

**Challenges and Solutions**
- Reverse engineering undocumented registers for ADC access
- Utilizing **HiFi4 DSP** for signal processing and demodulation
- Overcoming challenges with **USB-C** implementation and **AXP2585 battery management chip**

**Badge Specifications**
- Running **mainline Linux 6.6**
- **Display:** Custom 40x40 circular screen
- Specifications include dual-core A7 processors, 128MB DDR3 RAM, 8GB eMMC storage, GPS, and Wi-Fi

**Development Environment**
- Programming the **HiFi4 DSP** for optimized performance
- Incorporating **FreeRTOS** and using the **Extensa toolchain** for development
- Utilizing **mainline Linux** to facilitate driver integration

**Manufacturing and Testing**
- Overcoming manufacturing challenges, such as soldering issues
- Ensuring a stable system with all components functioning as intended

**Conclusion and Engagement**
- Invitation for questions and further engagement at the Aerospace Village
- Encouragement to share badge experiences and travels on social media


created_at: 2024-11-09 14:22:59
summary:
**Introduction to IoT Hacking**

- **Andrew Bellini**: Presenter and IoT security expert
- **Misconceptions about IoT hacking**: 
  - Belief that **IoT** is complicated and requires expensive tools
  - Reality: Affordable and accessible to beginners

**IoT Device Landscape**

- **Prevalence of IoT devices**: 
  - Over **15 billion** devices globally
  - Expected growth due to **AI** and **machine learning**
- **Security concerns**: 
  - Common vulnerabilities in IoT devices
  - Cyber criminals exploit these for botnets and initial access

**Barriers to Entry in IoT Hacking**

- **Cost misconceptions**: 
  - Assumption of needing expensive gear
  - Reality: Affordable training and equipment available
- **Complexity misconceptions**: 
  - Assumption of needing engineering knowledge
  - Reality: Tools and resources available for beginners

**Getting Started with IoT Hacking**

- **Choosing a target device**: 
  - **Cheaper devices** often less secure
  - Suggested starting points: Cheap **routers** or **smart cameras**
- **Building an affordable toolkit**: 
  - Basic equipment like a **digital multimeter** and **USB to X adapter**
  - Avoid breaking the bank; focus on essential tools

**Ethical Considerations in IoT Hacking**

- **Ethical hacking principles**: 
  - Only test devices you are authorized to
  - Follow **responsible disclosure** for vulnerabilities

**Safety and Legal Considerations**

- **Hardware hacking safety**: 
  - Avoid working on high-voltage devices
  - Be cautious with large capacitors and modified power supplies

**Finding and Using Debug Ports**

- **Debug ports in IoT devices**: 
  - Commonly left open for testing
  - **UART** as a primary focus for beginners
- **Identifying UART ports**: 
  - Use a **multimeter** to detect voltage changes during boot up
  - Connect using a **UART to USB bridge adapter**

**Acquiring and Analyzing Firmware**

- **What is firmware**: 
  - Software specific to the device's function
- **Methods to acquire firmware**: 
  - Download from vendor websites
  - Use **UART shell** to transfer files
  - Use a **flash programmer** to read from SPI flash chips

**Reverse Engineering Firmware**

- **Unpacking firmware**: 
  - Use **Binwalk** to extract contents
  - Focus on the **root file system** for vulnerabilities
- **Analyzing binaries and libraries**: 
  - Start with custom binaries unique to the device
  - Use **Ghidra** for decompiling and analyzing code

**Identifying Vulnerabilities**

- **Common vulnerabilities**: 
  - **System calls** without input sanitization
  - Unsafe C functions like **memcpy** and **sprintf**
- **Methodology**: 
  - Interact with the device and trace actions to underlying code
  - Use logging information to identify potential vulnerabilities

**Conclusion**

- **Encouragement to start hacking IoT devices**: 
  - Practical advice for beginners
  - Invitation to connect and share experiences with Andrew Bellini


created_at: 2024-11-09 14:27:11
summary:
**Introduction to Access Control**

- Presentation by **Tim Clevenger**
- Focuses on proper installation and maintenance of physical access control systems
- Highlights common pitfalls in vendor installations

**Choosing an Access Control System**

- **Mercury Security**: Popular choice for larger vendors
- **Local storage and independent processing**: Benefits of Mercury systems
- **Reflashable firmware**: Allows switching vendors with minimal hardware changes

**System Layout Considerations**

- **Layout options**: Based on facility size and needs
- **Four-door layout example**: Description of access panel and additional door controllers
- **Communication loss**: Risks with door controllers

**Installation Environment**

- **Environmental factors**: Heat, humidity, power, and physical security
- **Accessibility**: Ease of access for maintenance
- **Future-proofing**: Consider future needs and changes

**Wiring Considerations**

- **Ethernet vs. RS-485**: Pros and cons for different distances
- **Voltage drop**: Impact on door locks and solutions like remote power supplies
- **Conduit for security**: Protects wiring from tampering

**Remote and Centralized Installations**

- **Warehouse example**: Long distances and RS-485 usage
- **Office space example**: Centralized panels and future considerations

**Power Supplies and Enclosures**

- **Power specifications**: Importance of batteries and chargers
- **Enclosure security**: Tamper switches and key locks for safety
- **Weatherproof options**: For outdoor installations

**Batteries**

- **Regular replacement**: Every 3-5 years based on environment
- **Battery fail outputs**: For system alerts

**Fire Safety and Regulations**

- **Fail safe vs. fail secure**: Door lock options during system failures
- **Compliance with fire codes**: Includes integration with building fire alarms

**Door Hardware**

- **Types of locks**: Electrified strikes, solenoids, magnetic locks, motorized crash bars
- **Request to exit (Rex) and door contacts**: Ensure proper and secure operation

**Badges and Readers**

- **Badge types**: Prox, I-class, MyFairDesfire
- **Custom badges**: Using HID Corporate 1000 for security
- **Reader communication**: Use OSDP to avoid compromises

**Best Practices and Maintenance**

- **Regular testing and alerts**: Ensure system functionality
- **Documentation**: Keep records of installations and maintenance
- **User audits**: Regular reviews of access lists

**Conclusion**

- Invitation to **Physical Security Village** for further discussion and learning
- Encouragement to apply best practices for secure access control systems


created_at: 2024-11-09 14:30:57
summary:
**Introduction and Background**

- **Speaker Introduction**: Lacey Harbour, background in molecular biology, regulatory, quality, and clinical studies.
- **Presentation Focus**: Future of medical devices, changes in manufacturing, AI integration, challenges in cybersecurity, and regulatory landscape.

**AI in Healthcare**

- **Impact of AI**: AI is transforming the healthcare ecosystem, necessary for new care standards and treatments.
- **Regulatory Challenges**: Differentiation between regulated and unregulated products, importance of intended use in defining medical devices.

**Medical Device Production and Regulation**

- **Medical Device Definition**: Based on intended use, requires controls for development, management, and monitoring.
- **Regulatory Landscape**: Involves various global entities and requires constant updates and communication with companies.
- **FDA's Role**: Collaborative community, use of NLP for reliable global source analysis, initiatives for public engagement.

**Total Product Lifecycle**

- **Concept Overview**: From product inception to end-of-life, involves design controls, production, process controls, and feedback loops.
- **Simplified Schema**: Divided into design controls and production/process controls.

**Future of Medical Devices**

- **Trends**: Precise, personalized, point-of-care products; orthopedic sector leveraging 3D printing for advancements.
- **Medical Device Production System (MDPS)**: Involves hospital-based manufacturing, design, and output as part of the device.

**Challenges and Considerations**

- **Data Management**: Relationship between health delivery organizations and medical device manufacturers crucial for data access.
- **HIPAA Concerns**: Medical device manufacturers are not HIPAA-covered entities, posing potential challenges.
- **Machine Learning Operations**: Integration into network systems for improved product lifecycle and regulatory management.

**AI and MDPS Integration**

- **Research Areas**: Automatic segmentation, design generation, demand planning, and manufacturing enablement with AI.
- **Importance of AI**: Necessary for successful MDPS implementation, enhancing clinical outcomes and real-time monitoring.

**Conclusion**

- **Call to Action**: Encouragement to utilize available resources, understand schemas, and contribute to a better healthcare future.
- **Final Thoughts**: Emphasize the transformative potential of MDPS and AI in healthcare, with a focus on safe and effective product development.


created_at: 2024-11-09 14:35:22
summary:
**Introduction to GenAI and Vector Encryption**
- Adoption of **GenAI tools** has increased, but security measures have lagged.
- **New data classes**, especially vector data, are entering untested data stores.
- **Vector databases** lack intrinsic security and can be susceptible to **embedding inversion attacks**.
- **Vector encryption** offers privacy-preserving searches over encrypted vectors.

**Limitations of LLMs**
- LLMs predict plausible completions to prompts, which may not always be accurate.
- They are often trained on stale data due to the lengthy training process.
- LLMs are not typically trained on specific corporate or personal data.
- **Retrieval Augmented Generation (RAG)** helps fill gaps by incorporating additional information into prompts.

**Vector Search and Databases**
- **AI search techniques** like vector search differentiate word meanings and understand context.
- Vector search works by converting input documents into **vector embeddings**.
- **Vector databases** perform nearest neighbor searches quickly and efficiently.
- Traditional databases are incorporating vector capabilities.

**Security Concerns and Inversion Attacks**
- Top SaaS and security companies are integrating LLM capabilities with private data.
- Vectors can be reversed to reveal the original data using **inversion models**.
- **Vector database companies** currently have immature security measures.
- Vectors in databases are treasure troves of information, posing security risks.

**Encrypting Vectors for Security**
- **Homomorphic encryption** (fully and partially) can protect vectors.
- **Partially homomorphic encryption** optimizes nearest neighbor search operations.
- **Distance comparison preserving encryption** allows vector databases to function on encrypted vectors.
- Trade-offs exist between security and the accuracy of queries.

**Implementation and Open Source Solutions**
- Encryption can be added to existing systems with minimal changes.
- **IronCoreAlloy**, an open-source library, helps implement vector encryption.
- The library supports integration with various vector databases and programming languages.
- Encryption introduces negligible performance penalties while preserving search accuracy.

**Conclusion and Recommendations**
- Use of AI and LLMs leads to multiple data copies, increasing security risks.
- **Vector databases** can be vulnerable to inversion attacks, equating to having access to the original data.
- Implementing vector encryption is feasible with available open-source solutions.
- Encrypting vectors containing sensitive data is recommended to enhance security.


created_at: 2024-11-09 14:38:31
summary:
**Project Overview**
- Presentation on simulating attacks against hydroelectric power plants
- Built an **ICS firing range** for attack simulation and **DFIR training**
- Importance of attack simulation in **critical infrastructure**

**Motivation and Objectives**
- Address threats to **critical infrastructure**
- Support **forensic training** and **awareness building**
- Create **realistic attack scenarios** for training

**Firing Range Design and Architecture**
- Involves physical and virtual networks
- Components include **Active Directory environments** and security measures
- Intentional vulnerabilities for realistic simulation

**Attack Simulation Process**
- **Red Team assessment** conducted on the firing range
- **C2 infrastructure** set up for attack simulation
- Demonstration of a cyber attack on a **hydroelectric power plant**

**Training and Defense Evaluation**
- Perspective shift to defense evaluation post-attack
- Analysis of **network captures**, **Windows event logs**, and **memory dumps**
- Collaboration with NVISO and VERBUND's IT security teams

**Technical Components and Setup**
- **Scenario and visualization layer** with modulated power plants
- **Electric cabinet** with technical components like PLCs and Raspberry Pis
- **Network infrastructure** split into IT and OT networks

**Challenges and Lessons Learned**
- **Collaboration challenges** due to remote meetings
- Importance of **backup and restore solutions**
- Issues with **noise** and use of **passive components**

**Training Modules**
- 15 labs covering analysis, attacker tools, and OS forensics
- Use of tools like **Wireshark** for analysis
- Importance of realistic **model building** and training scenarios

**Conclusion**
- Emphasis on **cybersecurity resilience** and training capabilities
- **Interactive session**: further engagement and discussion encouraged.


created_at: 2024-11-09 14:42:32
summary:
**Expedient Digital Defense Overview**
- Focus on using free and credible applications, or recommending paid commercial tools
- Aim to make devices and online presence less harmful
- Discusses experiences of a typical traveler in the U.S. and overseas

**Operational Security (OPSEC)**
- Emphasizes the importance of **Operational Security (OPSEC)**
- Encourages a mindset of seeing communication through the eyes of adversaries
- Highlights the surveillance economy and modern data collection

**Threat Modeling**
- **Threat modeling**: Identify attack surface and threat profile
- Attack surface includes phones, computers, social media, and wireless presence
- Threat profile involves people who can benefit from gaining information

**OPSEC Process**
- **Identify vulnerabilities**: Analyze attack surface
- **Identify threats**: Analyze threat profile
- **Risk analysis**: Decide which vulnerabilities to address
- **Mitigations and defenses**: Implement changes and defenses as needed
- It's a continuous mindset and process

**Security Practices**
- Use of **Multi-Factor Authentication (MFA)** and password managers
- Importance of long, complicated passwords and backups
- **End-to-end encryption**: Recommended for chat and calls

**Social Media and Open Source Intelligence (OSINT)**
- Adversaries can gather intelligence from social media profiles
- **Open Source Intelligence (OSINT)**: Tools to check internet footprint
- Awareness of data presence is crucial; deleting data is challenging

**Digital Device Security**
- Phones emit many signals; location data is highly valuable to adversaries
- **Wireless anti-tracking**: Reducing location data emissions
- **Smart cities**: Ubiquitous technical surveillance and data collection

**Mitigation Strategies**
- Turn off **Bluetooth and Wi-Fi** when not in use
- Use ad blockers and cookie protection in browsers
- Consider using cash for payments to reduce digital footprint
- Avoid connecting phones to cars due to data access risks

**Security Checkpoints**
- Turn devices off for security checkpoints
- Consider uninstalling sensitive apps temporarily
- Avoid using dummy devices

**VPNs**
- **VPNs**: Provide a secure tunnel for data, but not foolproof
- Change perceived online location, but not a complete security solution

**Conclusion and Recommendations**
- Importance of **physical security** and reducing location exposure
- Practice **online security** by assessing and mitigating vulnerabilities
- Use **end-to-end encryption** for communication security
- Continuous learning and adaptation to new threats and security measures


created_at: 2024-11-09 14:51:27
summary:
**Talk Overview**
- Speaker: Justin Gardner, aka Rhino Raider
- Professional live hacking event participant
- Host of the Critical Thinking Bug Bounty Podcast
- Advisor for Kaido
- Presentation covers 11 critical bugs found in bug bounty hunting

**Bug 1: NGINX 403 Bypass to PII Leak**
- Semi-private program
- Application modified for public use, changing the **threat model**
- Identification of an **NGINX 403** indicating potential bypass
- Exploitation through path traversal and double URL encoding
- Impact: 4.5 million users' **PII leaked**
- Bounty: $15k-$20k

**Bug 2: Arbitrary Account Takeover via Docs**
- Public program with high bounty
- Discovered a password-based API endpoint on an OTP login app
- Found authorization credentials in **JavaScript files**
- Exploitation led to arbitrary account takeover
- Bounty: $40k-$60k

**Bug 3: Numeric IDOR in API**
- Similar to Bug 2
- **IDOR** leaks password hashes and reset tokens
- Extensive application exploration required
- Bounty: $40k-$60k

**Bug 4: Blind XSS via SMS to Account Takeover**
- Found in a car dealership app
- Enabled hidden messaging feature via **feature flags**
- Exploited XSS to steal session tokens
- Wormed XSS across dealer accounts for mass exploitation
- Bounty: $20k-$40k

**Bug 5: Snooping on Meetings**
- Targeted a video chat app
- GitHub issue revealed participant list bug
- Exploited **WebRTC** signal handling to remain undetected
- Bounty: $20k-$25k

**Bug 6: Perforce Server to Client RCE**
- Desktop application for game development
- Developed a malicious **Perforce server**
- Exploited file write operations to achieve RCE
- Bounty: $15k-$30k

**Bug 7: IoT Router Shell Access**
- Collaborated with Joel Margolis
- Extracted firmware from a public program router
- Found **configuration file injection** vulnerability
- Bounty: $20k-$32k

**Bug 8: DNS Mask Configuration Exploit**
- Similar to Bug 7
- Double injection points exploited using config line length
- Enabled TFTP server to exfiltrate data
- Bounty: Aligns with Bug 7

**Bug 9: Version Control Binary SQL Injection**
- Exploited a **SQLite** vulnerability in version control software
- Collaborated with Udyotuk
- Extracted cookies from **Chrome** for account takeover
- Bounty: $30k-$40k

**Bug 10: IoT Device Camera and Mic Access**
- Targeted a tabletop IoT device
- Bypassed SIP authentication to access camera and mic
- Used **Frida** and patched binaries for request manipulation
- Bounty: $20k-$50k

**Bug 11: Call Hijacking on IoT Device**
- Exploited **SIP** protocol for third-party registration
- Redirected calls to hijack communication
- Bounty: $20k-$50k

**Conclusion**
- 11 critical bugs with bounties totaling $225k-$400k
- Emphasis on collaboration, persistence, and exploration of new technologies and protocols


created_at: 2024-11-09 14:56:32
summary:
**Holographic Teleportation in Space and Medicine**

- **HoloLens and Mixed Reality:**
  - Device used for interacting with holograms and people
  - NASA surgeon assisted astronaut Samantha Cristoforetti using HoloLens

- **Successful Medical Procedure:**
  - Holograms showed incision points and measurements
  - Surgeons accessed x-rays and information during the procedure

- **Holographic Teleportation Development:**
  - Microsoft developed a studio with 109 cameras
  - Captures and delivers a file for hologram display on HoloLens

- **Challenges in Space:**
  - Limited equipment on space stations, only one camera available
  - Old computers used, requiring live processing
  - Communication issues due to moving satellites and limited bandwidth

- **Project Implementation:**
  - First human holoporter to space station: Dr. George Smith
  - One-way holoportation conducted successfully

- **Viral Media Coverage:**
  - NASA's press release went viral in multiple languages
  - Public interest in holoportation technology increased

- **Two-Way Holoportation:**
  - Plans for interaction between astronauts and mission control
  - Goal to implement by April 2020

- **Holoportation Technology Expansion:**
  - Multiple companies exploring holoportation technology
  - Efforts to make technology device agnostic and affordable

- **Applications and Future Developments:**
  - Potential uses in telemedicine and remote training
  - Plans for integrating AI in space medicine for emergencies

- **Company Initiatives:**
  - Splitting into Aerospace (government) and AXA Tech (commercial)
  - Developing HoloConnector for projecting holograms without glasses

- **Community Engagement:**
  - Encouragement to provide feedback for technology improvements
  - Aim to make holographic communication widely accessible


created_at: 2024-11-09 14:59:32
summary:
**Introduction**
- Speaker: Greg Carpenter, former NSA employee
- Topic: Adversarial philosophy in cyber operations

**Chinese Strategy and Philosophy**
- Influence of **Chinese history** on strategy
- **Seven Military Classics** taught in universities
  - Includes **Sun Tzu's Art of War**, among others
- **Chinese National Defense University** syllabus highlights
  - Focus on **Mao Zedong's Art of War** and **information warfare**
  - Strategy rooted in **non-kinetic** information warfare

**Russian Strategy and Philosophy**
- Three significant influence periods:
  - **Pre-Kremlin**, **Lenin and Marx**, **Cold War**
- Influence of **Slavophile and Westernizers** conflict
- Continued use of **state-controlled media**

**Comparison of Chinese and Russian Strategies**
- Both utilize **psychological operations** and **influence campaigns**
- Differences in approach based on **culture**
  - China: **Vast numbers**, integrated attackers and defenders
  - Russia: **Strategic operations** with limited resources

**Conclusion**
- Discussion focused on Chinese and Russian strategies without referencing **Sun Tzu**
- Emphasis on historical and cultural influences on national strategies


created_at: 2024-11-09 15:03:48
summary:
**Introduction to Distributed Industrial Control**

- **Economic efficiency and automation**: Many industrial assets are remotely monitored and controlled.
- **Unmanned assets**: Includes renewable energy, DERs, pipelines, etc., extending control over common information links.
- **Extended attack surface**: Creates opportunities for cyber operations.

**Nature of Distributed Operations**

- **Interconnected systems**: Increasingly exposing industrial control systems.
- **Networked world**: Systems assumed to be isolated are often connected.
- **Remote and unmanned operations**: Necessary for managing dispersed assets like wind farms and pipelines.

**Challenges and Risks**

- **Increased connectivity**: Driven by necessity and technological advances.
- **Vulnerabilities**: Introduced by reliance on wireless communication and cloud-based systems.
- **Adversary opportunities**: Expanded attack surface through new communication methods.

**Examples of Adversary Activity**

- **ViaSat incident**: Unintentional disruption of wind turbines due to malware.
- **Colonial pipeline incident**: Highlights potential risks of remote control and communication vulnerabilities.

**Risk Mitigation Strategies**

- **Resilience and redundancy**: Ensuring operations can continue despite disruptions.
- **Security considerations**: Focus on integrity, confidentiality, and reliability of communications.
- **Offensive security testing**: Validating communication security from an adversary’s perspective.

**Conclusion**

- **Acknowledging remote connectivity**: Essential for modern infrastructure management.
- **Security and safety**: Must be prioritized in the design and operation of interconnected systems.
- **Continuous evaluation**: Necessary to adapt to evolving threats and technological advancements.


created_at: 2024-11-09 15:11:16
summary:
**Event Overview**
- Title: "DEF CON 32 - Color Blasted Badge Making: How Hard Could It Be"
- Presenters: Abhinav Panda, Bradán Lane, and Hamster
- Description: Discussion on various methods for creating colorful badges with insights on techniques, challenges, and successes.

**Introduction**
- Reanimation from the Badgelife Discord introduces the session.
- Discussion focuses on different badge-making techniques: UV printing, screen printing, and dye sublimation.

**UV Printing (Abhinav Panda)**
- **Background**: Abhinav Panda has been involved in Badgelife for eight years, initially started with Indian conference badges.
- **Technique**: 
  - Utilizes **UV printing** for full-color badges.
  - UV printers can print on various materials like banners, acrylic, and phone cases.
  - Initial experiments led to buying a UV printer, allowing for extensive badge production.
  - **Challenges**: Alignment issues, curing time, and maintaining printhead health.
- **Process**:
  - Print directly on the bed first, align PCBs, and print again.
  - Manual alignment of PCBs to fix issues common with UV printing.
  - Adjustments necessary for reflow to prevent color changes.
  - High maintenance; requires daily printing to maintain printer health.
- **Future Plans**: Considering starting a PCB assembly or UV printing service.

**Screen Printing (Brayden Lane)**
- **Background**: Collaborated with Panda; constrained by lack of resources for UV printing.
- **Technique**:
  - **Traditional silk screening** adapted for PCBs.
  - Uses publicly available silk screens and UV exposed emulsion.
  - Challenges include scaling and achieving consistent color through multiple passes.
- **Process**:
  - Uses solder paste stenciling equipment for precise alignment.
  - Multiple colors require multiple silk screen processes.
  - Limitations with full RGB color; uses split fountain for gradients.
- **Equipment**:
  - Utilizes standard manual solder paste stenciling equipment.
  - Challenges in UV curing; adapted a reflow oven with UV lamps for curing.
  - High detail requires refined equipment, using higher mesh counts for accuracy.
- **Future Considerations**: Plans to continue using silk screening for specific projects.

**Dye Sublimation (Hamster)**
- **Background**: Interested in adding full color to PCBs; inspired by wife's crafting equipment.
- **Technique**:
  - Uses wife's dye sublimation setup for t-shirts and mugs.
  - Process involves printing onto dye sub paper and transferring onto PCBs using a heated t-shirt press.
  - **Challenges**: Difficulties in achieving rich colors, especially blacks.
- **Process**:
  - Reflow boards first, then perform dye sublimation.
  - Uses heat press for 30 seconds at 360°F.
  - Allows for quick turnaround on badge designs.
  - Cost-effective setup, under $250 for materials and equipment.
- **Experimentation**: Still working on improving color richness and consistency.

**Panel Discussion**
- **Questions and Answers**:
  - Discussed issues like color quality, finish types, and curing techniques.
  - Explored experiences with different materials and board types.
  - Addressed concerns of scalability and cost with each method.
  - Shared personal experiences with failures and how they were resolved.

**Final Thoughts**
- Panelists discussed the viability of their chosen methods.
- Interest in exploring other techniques for future projects.
- Emphasis on the artistic side of badge making and the continuous experimentation involved.


created_at: 2024-11-09 15:17:34
summary:
**DEF CON 32 Presentation Overview**
- Famous and not so famous unsolved codes discussed by **Elonka Dunin** and **Klaus Schmeh**
- Talk includes various historical encryption cases

**Kryptos**
- Located at CIA Headquarters in Langley, Virginia
- Created by **Jim Sanborn**, ciphers designed by **Ed Scheidt**
- Four parts, only three solved; fourth remains a mystery
- Clues provided by Sanborn include "Berlin" and "clock"
- Featured in Dan Brown's book, **The Da Vinci Code**

**Henry Debosnys Cryptograms**
- Originating from 1882, New York State
- Debosnys, a suspect in his wife’s murder, created encrypted messages while in prison
- Wrote four encrypted messages using a large alphabet
- Unclear which language(s) he used; possibly English, French, Portuguese, Latin, or Greek

**WWII Carrier Pigeon Message**
- A message found with a WWII carrier pigeon in Surrey, England
- Encrypted message possibly headed for **RAF Bomber Command**
- Utilized by **Sergeant William Stott** during D-Day
- Message remains unsolved; potential encryption methods include manual ciphers or codebooks

**German Silver Cigarette Case**
- Engraved with an encrypted message, dated Christmas Eve, 1909
- Suspected Christmas gift; potential keywords like "Merry Christmas" or "Frohe Weihnachten"
- Encryption remains unsolved despite similarities with other historical encryptions

**Dorabella Cryptogram**
- Created by composer **Edward Elgar** for Dora Penny in 1897
- Appears as a simple substitution cipher, but remains unsolved
- Other encrypted messages by Elgar do not apply to Dorabella

**Encrypted Postcards**
- Popular in the early 20th century, often love messages
- Most solved but one from 1873 remains a mystery
- Appears to be written fluently, possibly using a phonetic script

**Ncrypt Sculpture in Canberra**
- Created by a science educator in 2013 for Canberra’s founding anniversary
- Comprises eight pillars with cryptograms; only some solved
- Puzzles interconnected; certain ones need solving first

**Kaliningrad Bottle Post**
- Found in Baltisk, Russia; potentially from the 1950s
- Possible Cold War dead drop or child's toy; message remains unsolved

**Ignatius Polacki's Encrypted Advertisements**
- 19th-century private detective published encrypted ads in newspapers
- Messages remain unsolved; potential use of codebooks or super encryptions

**Voynich Manuscript**
- 15th-century manuscript with unknown script and illustrations
- Many analyses but no definitive solution; possibly a hoax or lost writing system

**Conclusion**
- Numerous unsolved messages exist, offering challenges for enthusiasts
- **Mystery Twister** site recommended for engaging with such challenges

**Audience Interaction**
- Questions and discussions on solving methods and potential AI tools
- Mention of successful decryptions, like the **Cyrillic Projector** by **Jim Sanborn**


created_at: 2024-11-09 15:17:55
summary:
**Introduction to Airline Revenue Management**
- **Richard Branson's Quote**: Quickest way to become a millionaire in the airline industry is to start as a billionaire.
- **Constraints**: High fixed capital costs, bilateral capacity treaties, airport slots, curfews, labor.
- **Purpose**: Airlines use revenue management to fill planes, maximize earnings, and keep competitors at bay.
- **Focus**: Introduction to fares, ticketing, system constraints, and vulnerabilities.

**Airline Industry Overview**
- **High Fixed Costs**: Approval needed from both governments to operate flights; application for slots at congested airports.
- **Fortress Hubs**: Dominant market hold by certain airlines at major hubs.
- **Slot Management**: Airlines sometimes fly empty planes to maintain airport slots.

**Revenue Management**
- **Objective**: Maximize return by filling aircrafts, ensuring the highest price for every seat.
- **Challenges**: Avoid selling seats too cheap or letting them go empty.

**Airline Pricing and Fares**
- **Dynamic Inventory**: Complex computational calculations for managing inventory and pricing.
- **Fare Rules**: Include restrictions like days of the week and dynamic pricing algorithms.
- **Published Fares**: Base fare shown before adding taxes and surcharges.

**Ticketing and Reservations**
- **Reservation System**: Having a PNR (Passenger Name Record) doesn't guarantee boarding without a valid e-ticket.
- **Dynamic Inventory Management**: Use of "buckets" with letters to manage pricing and seat availability.

**Exploit Vulnerabilities**
- **Hidden City Ticketing**: Practice where flying to a layover city is cheaper than the final destination.
- **Mistake Fares**: Errors in fare publication can lead to extremely low ticket prices.

**Electronic Flight Bags (EFBs)**
- **Purpose**: Devices used by pilots to improve operational safety and efficiency.
- **Potential Vulnerabilities**: Physical access can lead to data manipulation, affecting flight safety.
- **Lockdown Quality**: Lack of security measures such as MDM or strong passwords.

**Aviation Bugs and Incidents**
- **American Airlines Incident**: Lockup due to database duplication.
- **Southwest Weather Bug**: Loss of weather feed halted flights.
- **Alaska Airlines Tail Strike**: Software miscalculated weight and balance.

**Cybersecurity in Aviation**
- **Network Segregation**: Separation between passenger information and aircraft control domains.
- **Disclosure and Fixes**: Importance of responsible disclosure and regulatory involvement in fixing vulnerabilities.

**Conclusion**
- **Complexity of Aviation Systems**: Importance of safety and responsible handling of vulnerabilities.
- **Resources for Disclosure**: Aviation ISAC and DEFCON Aerospace Village as aids for vulnerability disclosure.


created_at: 2024-11-09 15:26:08
summary:
**Presentation Overview**
- Discussed **aviation policy** and shared lessons from **Air Force** and **civil aviation** experience
- Addressed challenges from **Capitol Hill** to hacking **fighter jets**
- Speakers: **Michael Wiggins** and **Stuart Wagner**

**Speaker Backgrounds**
- **Michael Wiggins**: Former Army officer, entrepreneur, focused on hardware/software solutions to protect aircraft
- **Stuart Wagner**: Former software developer at Microsoft, Chief Digital Transformation Officer in the Air Force

**Cybersecurity in Aviation**
- Overview of **current cybersecurity state** in civil aviation
- Importance of securing **weapon systems** for deterrence
- Recent developments like the **FAA Reauthorization Act**

**FAA Reauthorization Act**
- Passed every four years, recently signed into law
- Emphasis on **cybersecurity** and continuous monitoring of avionics
- Requirement for new aircraft designs to include cybersecurity measures

**Data and Instrumentation**
- Importance of **data collection** from operational systems
- Lessons learned from **hackathons** and applying them to cybersecurity
- Examples from **big tech** companies like **Tesla** and **Google**

**Challenges and Solutions**
- No **antivirus** on commercial aircraft, reliance on old technology
- Need for **better instrumentation** and data collection in aerospace
- Challenges in **data sharing** between operators, OEMs, and regulators

**Policy and Legislation**
- New committee to address cybersecurity and avionics monitoring
- Public encouraged to participate in the **request for comments** process
- Importance of **cross-industry collaboration** in setting standards

**Hackathons and Innovation**
- Air Force's Bravo program inspired by DEF CON's Aviation Village
- Importance of **security research** and **pen testing** in aviation
- Need for **bug bounties** and **reporting processes** in aviation

**Future Directions**
- FAA and industry to potentially sponsor **hackathons**
- Developing a **patching process** for aviation software
- Balancing **speed with safety** in software review processes

**Audience Interaction**
- Discussed implications of real-time **telemetry** and monitoring
- **Training pilots** on software dependencies and backup systems
- Addressed concerns about **security by obscurity** and open research


created_at: 2024-11-09 15:37:29
summary:
**Cybersecurity Challenges and Context**

- **Complex landscape**: Modern cybersecurity involves identifying attacks within massive volumes of data.
- **False positives**: Distinguishing attacks from numerous false positives is challenging.
- **Data science role**: Transform heterogeneous events, logs, and alerts into clusters, kill chains, and actionable insights without requiring data science expertise.
- **Blue team vs. Red team**: Discussion on roles in cybersecurity and the importance of context.

**Importance of Context in Security Operations**

- **Contextual investigation**: Emphasizes the need for context in investigations to identify attacks effectively.
- **MITRE ATT&CK framework**: A reference for tactics and techniques to understand the what, who, and when of attacks.
- **Story over alerts**: Focus on the entire flow of an incident rather than isolated alerts.

**Tools and Techniques**

- **Data reduction**: Need to reduce millions of alerts to manageable numbers.
- **Clustering and knowledge graphs**: Use of clustering algorithms and knowledge graphs to organize and analyze data effectively.
- **LLMs (Large Language Models)**: Utilized for assigning MITRE ATT&CK techniques to alerts and improving consistency in classifications.
- **Open-source models**: Availability of open-source LLMs for cybersecurity applications.

**People and Process in Cybersecurity**

- **Talent shortage myth**: Lack of unicorns, not talent; a focus on hiring juniors and providing them with necessary tools.
- **Training and documentation**: Importance of documentation and training for effective incident response.
- **People and process over technology**: Emphasis on the role of people and processes in enhancing security, rather than just acquiring new tools.

**Incidents and Case Studies**

- **DDoS attack**: Example of a persistent attack repelled by fundamental defense measures.
- **Insider threats and DLP**: Importance of data loss prevention and monitoring for insider threat detection.

**Future Directions in Security Operations**

- **Unified investigations**: Aim to unify investigation processes with common frameworks and clustering.
- **Cost-effective solutions**: Use of clustering algorithms for scalable, explainable, and affordable cybersecurity solutions.


created_at: 2024-11-09 15:43:14
summary:
**Introduction to Privacy-Focused AI Devices**
- Presenter: Matt Domko
- Focus on building AI products with privacy considerations
- Challenges in creating consumer-friendly and privacy-respecting AI hardware

**Types of AI Requests**
- **General Knowledge Request**: No personal information needed
- **Contextual Knowledge Request**: Requires some personal information
- **Generic Action Request**: Can be performed for any user without sensitive data
- **Authenticated Action Request**: Requires authentication to access user-specific accounts

**Data Protection in AI Requests**
- Audio data: Conversion of voice to text
- Transcript data: Result of speech-to-text processing
- Response data: AI-generated answer from text input
- Contextual data: Includes location and user preferences

**Authentication Challenges**
- **Username and Password Storage**: High risk of data theft
- **Session Cookies**: Temporary, but require provider support
- **OAuth**: Secure but not universally supported

**Securing User Context**
- Avoid storing sensitive information that makes you a target
- Do not reuse sensitive context across users
- Implement short-lived tokens for authentication

**Securing Customer Conversations**
- Protect both audio and text data
- Use encryption for storing sensitive information
- Avoid sharing data between environments without explicit value

**Privacy-Focused Logging and Analytics**
- Prefer metrics over detailed logs
- Anonymize or pseudo-anonymize data wherever possible
- Implement just-in-time logging for sensitive data access

**Summary and Guidelines**
- Establish simple data classification guides
- Foster a culture of design reviews for data handling
- Implement strict service control policies
- Use a two-step filtering process for data leaving production environments

**Final Thoughts**
- Importance of engaging with privacy and security reviews
- Encouragement to build consumer trust through responsible data practices


created_at: 2024-11-09 15:51:42
summary:
**Event Details**
- **Title**: "DEF CON 32 - D0N0H4RM Cyber STEM Storytime - Panel"
- **Channel**: DEFCONConference
- **Uploader**: DEFCONConference
- **Upload Date**: October 16, 2024
- **Duration**: 3261 seconds

**Opening Remarks**
- Panel introduces the discussion on cybersecurity topics such as healthcare, medical devices, and whistleblowing.
- Audience encouraged to participate respectfully in Q&A.

**Panelist Introductions**
- **Matt Hazlett**: Chief Regulatory Officer at MedSec, former FDA employee involved in cybersecurity policy.
- **Erica Chung**: Executive Director of a nonprofit focused on ethics and entrepreneurship, whistleblower in the Theranos scandal.
- **Andrew Carney**: Program Manager at ARPA-H, focuses on healthcare cybersecurity and patient data privacy.
- **Deputy Director of CISA**: Former hospital administrator and flight medic, merging cybersecurity with healthcare.

**Healthcare Cybersecurity Threats**
- Increase in **volume, frequency, and complexity** of attacks against the healthcare sector globally.
- **Ransomware** and cyber terrorism targeting healthcare due to valuable data.
- Need for building **resilience** across the entire healthcare spectrum.

**Medical Devices and Cybersecurity**
- Challenges in managing legacy medical devices with **antiquated systems**.
- Need for improved **patching and updating** mechanisms.
- Importance of **collaboration** among healthcare providers, manufacturers, and regulators.

**Whistleblower Protections**
- Discussion on expanding protections for those in technical healthcare roles.
- Importance of **internal controls** and **leadership buy-in** to address cybersecurity concerns.
- Advice for whistleblowers: seek **legal support** and advocacy from non-profits for protection and guidance.

**Consolidation and Risk Management**
- Financial distress leading to **hospital system mergers**.
- Risks of **catastrophic failure** when systems unify technology stacks.
- Need for **risk management** and considering tech debt in mergers and acquisitions.

**Collaboration and Innovation**
- Encouragement for **hackers** to engage in medical device cybersecurity research.
- Importance of **access to devices** for research and vulnerability discovery.
- **Coordinated vulnerability disclosure** process required for new devices.

**Transparency and Incident Reporting**
- Lack of transparency in **ransomware attacks** on hospitals.
- Potential benefits of **sharing failures** for learning and improvement.
- Discussion on providing **legal protections** to encourage open reporting.

**Conclusion**
- Panelists express the need for continued **collaboration** and **innovation** in healthcare cybersecurity.
- Audience encouraged to **engage** and use their skills to improve the sector.


created_at: 2024-11-09 15:57:59
summary:
**Introduction to Harriet Farlow's Talk**
- Focus on **AI** and **national security** using pop culture references
- Uses narratives from **Ghost in the Shell**, **Neuromancer**, and **Mission Impossible**
- Discusses the real-life implications of fears around **AI** in national security

**Harriet Farlow's Background**
- Ex-intelligence professional with 10 years in **AI** and **cybersecurity**
- Worked on defense projects in Australia, including robotic process automation
- Experience with the Australian Signals Directorate, equivalent to the **NSA**
- Currently runs an **AI security** company, Maleba Security Labs

**AI in National Security**
- **AI** used for both **cyber defense** and **offense**
- Importance of understanding the **security implications** of AI technologies
- Discussion on the **intersection** of AI and policy

**Challenges of AI Implementation**
- Building **AI models** is easy; integrating them into systems is difficult
- Issues moving beyond the **pilot stage** in AI projects
- Importance of collaboration between governments and tech companies

**Hacking and AI**
- AI augments existing hacking efforts, not necessarily a new threat
- Emphasis on AI as part of the **kill chain** in cyber threats
- Examples from **Russia** and **Iran** using AI for **deepfakes**

**Security Theory and AI**
- Concepts of **referent object**, **direction of protection**, and **securitization**
- Distinction between **AI safety** and **AI security**
- Importance of applying traditional security theories to AI

**AI Policy and Securitization**
- Review of global AI policies shows focus on **AI for security**
- Lack of emphasis on **AI safety** and **security** in policies
- Need for comprehensive AI policies, learning from cyber security

**Conclusion and Discussion Points**
- Encourages audience to consider the role of policy in AI security
- Calls for more action and awareness around **AI security**
- Stresses the importance of learning from cyber security to improve AI security


created_at: 2024-11-09 16:06:00
summary:
**Overview of Cybersecurity Threats**
- **Cyber Attacks**: Involve breaches, ransomware, and state-sponsored threat actors targeting elections, organizations, and critical infrastructure.
- **State Sponsored Threat Actors**: Use sophisticated tactics, techniques, and procedures to target secure organizations.
- **Challenges**: Even the most advanced cyber defense tools and resources are vulnerable to breaches.

**Panel Discussion Highlights**
- **Introduction**: Panelists include experts from MITRE, Blackpoint Cyber, Omni Federal, and Altered Security.
- **Adam Pennington (MITRE)**: Discussed the history and tracking of state-sponsored threat actors and the importance of understanding adversary behavior.
- **Stryker (Blackpoint Cyber)**: Emphasized the use of threat intel and research to understand adversaries and mentioned the importance of proactive security measures.
- **Ken (Omni Federal)**: Highlighted the scale and resources available to state-sponsored attacks and the evolution of threats using AI models.
- **Nikhil Mittal (Altered Security)**: Stressed the need for basic security hygiene and extended time for red teaming exercises.

**Key Points from the Panel**
- **Sophistication of Threats**: Most adversaries use as much sophistication as needed; they avoid detection by targeting less monitored areas.
- **Living Off the Land Tactics**: Threat actors often exploit existing system tools and protocols for attacks.
- **Importance of Basic Security Hygiene**: Ensuring basic security measures like multi-factor authentication and password policies can prevent many attacks.

**Strategies for Organizations**
- **Honeypots and Deception**: Use these to engage adversaries and understand their tactics.
- **Direct Adversary Engagement**: Monitor adversaries to glean insights into their operations.
- **Security Education and Advocacy**: Emphasize the importance of security to executives and finance teams to reduce resistance to security measures.

**Challenges in Cybersecurity**
- **Resource Allocation**: State-sponsored actors have significant resources, making them formidable adversaries.
- **Supply Chain Vulnerabilities**: Breaches can occur through less secure partner organizations or internal departments.
- **Identity Management**: Focus on securing credentials and monitoring their use to prevent unauthorized access.

**Conclusion**
- **Community and Collaboration**: Leveraging the hacker community for tool development and knowledge sharing enhances defense capabilities.
- **Open Source Tools**: Utilize available open-source tools for initial security assessments.
- **Persistence and Consistency**: These qualities are essential in both attacks and defenses.


created_at: 2024-11-09 16:12:27
summary:
**DIY Pharmaceuticals and MicroLab**

- **Problem with Hepatitis C Treatment:**
  - **Hepatitis C** causes a quarter-million deaths yearly
  - **Sofosbuvir** is a cure but costs $1,000 USD per pill
  - **Gilead Pharmaceuticals** holds the **Intellectual Property** and refuses to share

- **DIY Solution:**
  - Developed a method to produce the treatment for $300 USD
  - Methodology can be applied to other diseases
  - Use of a **MicroLab** to automate drug synthesis

- **MicroLab Features:**
  - **Automated System** for easy use by non-chemists
  - Composed of a hardware and software stack
  - Includes a **Recipe Press** for writing programs for the hardware
  - **Retrosynthesis**: Start with material and work to desired drug

- **Chemical Automation:**
  - Existing systems are closed source and expensive
  - DIY version is open source and costs around $300
  - Can be assembled with common materials and tools

- **MicroLab Construction:**
  - **Reaction Chamber**: Two mason jars with a circulating fluid for temperature control
  - **Peristaltic Pumps** for injecting reagents
  - **3D Printed Armature** for assembly
  - **Raspberry Pi** and **Arduino** control the system

- **Software and Operation:**
  - GUI interface for ease of use
  - **Automated Steps** and **Human Steps** clearly defined
  - Supports **Branching Processes** for decision-making in reactions

- **Chemhacktica:**
  - Started in 2018, now more efficient
  - Uses **SMILES code** to encode molecules and reactions
  - Searches chemical literature for synthesis pathways

- **Community and Collaboration:**
  - Encourages sharing of synthesis files
  - Potential for crowdsource community to tackle procedures
  - Open invitation for volunteers to join and contribute

- **Safety and Compounding:**
  - Emphasis on **Sterile Technique** for injectable forms
  - Importance of safe handling and compounding to avoid contamination

- **Future Goals and Challenges:**
  - Looking to utilize **AI** for navigating scientific literature
  - Ongoing work to update the system with new data and features

**Call to Action**

- Encouragement to join the effort in making pharmaceuticals accessible
- Emphasis on teaching and sharing knowledge to enhance community capability


created_at: 2024-11-09 16:19:16
summary:
**Introduction**
- Discussion about building the **Anodic Sower Badge** for DEF CON 32
- Emphasis on community interaction and questions from the audience
- Mention of past challenges with **hardware hacking** and **badge design**

**Anodic Sower Badge Design and Challenges**
- **Badge Design**: Anodic Zor, nine years of badge making
- **Challenges**: Reverse engineering snack machines, mic issues
- **Community Engagement**: Treating the presentation as a town hall for audience interaction
- **Badge Building**: Learning new skills, overclocking the RP2040

**Badge Features**
- **Doom Gameplay**: Badge plays Doom, nostalgic design resembling a handheld device
- **Firmware Development**: Use of C programming language, custom drivers for control API
- **Visual Effects**: LEDs indicating status during gameplay (e.g., red for getting shot)
- **Battery Usage**: Transition to lithium for power, challenges with battery design

**Technical Details**
- **Hardware Iterations**: Progression from rev 1 to rev 4, artwork differences
- **Design Tools**: Use of EDA tools, handling design mistakes like button mapping errors
- **Technical Innovations**: Magic baud rate for boot select mode, challenges with assembly

**Wad and Firmware Development**
- **Wad Creation**: Use of **Slade** for wad development, understanding of DOOM's structure
- **Customization**: Replacing copyrighted assets, creating free open-source alternatives
- **Technical Challenges**: Memory management, use of scan lines for rendering

**Snack Machine Reverse Engineering**
- **Snack Machine Acquisition**: Purchased from a closing shop, initial reverse engineering
- **Technical Exploration**: Understanding motor matrices, logic boards, and custom ASICs
- **Technical Setup**: Use of Arduino for control, addition of casters for mobility

**Year Two Enhancements**
- **Improvements**: Transition from Wi-Fi to hardwired connections, upgrading to x86 PC
- **New Features**: Addition of marquee display, speaker, and PoE switch for expansion

**Overall Challenges and Reflections**
- **Supply Chain Issues**: LED sourcing difficulties, impact of natural disasters on deliveries
- **Community Involvement**: Encouragement for attendees to participate in badge assembly
- **Resilience**: Emphasis on problem-solving, learning from mistakes, and community support

**Conclusion**
- **Future Plans**: Continued expansion and enhancement of the badge and snack machine
- **Community Engagement**: Open invitation for questions and further interaction outside the session


created_at: 2024-11-09 16:25:35
summary:
**Introduction to AI Vulnerabilities**
- Ethical and secure disclosure of AI vulnerabilities is crucial.
- Challenges include biases, misinformation, data bias exploitation, and model manipulation.
- Aim is to balance transparency with security in AI disclosure processes.

**AI Vulnerability Types**
- **Data Poisoning Attacks**: Malicious actors manipulate data to bias model behavior.
- **Model Evasion Attacks**: Inference attacks that exploit AI models to extract sensitive information.
- **Model Theft Attacks**: Adversaries aim to mislead and steal AI models, leading to intellectual property theft.
- **Prompt Injection**: Security filters in generative AI can be bypassed, leading to restricted actions.
- **Supply Chain Attacks**: Exploit trust by compromising trusted vendors, spreading malicious components.

**Challenges in AI Vulnerability Disclosure**
- Lack of established frameworks and well-defined protocols in AI.
- Issues with response time and determining severity of vulnerabilities.
- Difficulty in payouts due to undefined severity scoring.

**Bug Bounty and Reporting Challenges**
- Ongoing issues with hallucination submissions and biases.
- Difficulty in determining payouts due to lack of severity scoring.
- Need for clear communication and education for researchers.

**AI Framework Vulnerabilities**
- Vulnerabilities in AI development frameworks due to lack of security scrutiny.
- Issues with serialization formats like Pickle, leading to arbitrary code execution.
- Path traversal vulnerabilities still prevalent in AI infrastructure components.

**Open Source and Collaboration Issues**
- Open source nature of AI presents verification challenges.
- Inconsistent code quality, hidden vulnerabilities, and complex licensing issues.
- Need for better collaboration and standardization in vulnerability management.

**Call to Action**
- Encouragement for community involvement in improving AI vulnerability reporting.
- Importance of strong partnerships and better standardization in AI security practices.


created_at: 2024-11-09 16:34:30
summary:
**Electronic Conference Badges**

- Electronic badges require significant investment in terms of **hardware**, **software**, **art design**, **testing**, **manufacturing**, and **provisioning**.
- **OpenTaxus** is introduced as a **simple**, **cheap**, **mass-producible**, and **open-source** badge design.
- Customization in **hardware** and **software** is possible using **KiCAD** for hardware and **CircuitPython** for software.

**Customization and Design Vision**

- Emphasis on **reuse** and **customization**.
- **Open hardware** allows for easy modification without starting from scratch.
- Possibilities include changing artwork, software, or even just the conference name while keeping the base design.

**Badge Design Walkthrough**

- **Hardware changes** can be made in KiCAD.
- **Software customization** is possible with CircuitPython, which allows for ease of use without needing a compiler.
- Infrared communication is used for **short-range** interactions, keeping privacy in mind.

**Cost Reduction and Manufacturing**

- Cost reduction is a priority, with a target of **$5** per badge.
- Use of **RP2040** microcontroller for cost efficiency.
- Manufacturing tips include using **offshore assembly** for better pricing on components.

**Vision for OpenTaxus**

- Aim to have a platform where organizers can input conference details and receive **board files**, **bill of materials**, and **code** without starting from scratch.
- Encouragement to collaborate between **PCB designers** and **embedded software developers**.

**Logistics and Pitfalls**

- **Hand soldering** is not recommended for large quantities; use **mass manufacturing**.
- **Flashing** and provisioning require careful handling to avoid system errors.
- **Schedule management** is crucial; always allow more time than anticipated.

**Conclusion**

- **OpenTaxus** aims to make badge creation accessible, customizable, and cost-efficient.
- Encouragement to use **CircuitPython** for its accessibility and ease of use.
- Opportunity for learning and interacting with hardware and software through badge customization.


created_at: 2024-11-09 16:37:05
summary:
**Introduction to Bypass 102**
- Focus on basic **bypass remediation**
- Prerequisite: **Bypass 101**
- Explains **bypass** as ignoring the lock and exploiting door hardware or surrounding area

**Bypass Methods and Remediation**
- Emphasis on **physical security** vulnerabilities and remediation
- Compared to cybersecurity, involves a **cycle of finding vulnerabilities and patches**
- **Latch-targeted bypass**: Involves targeting a latch to gain entry
  - Remediation includes proper installation of **dead latches** and doors

**Door and Latch Security**
- Importance of **properly installed doors and dead latches**
- Vulnerabilities arise from improper installation, especially in **wooden doors**
- **Retrofits** often used to cover vulnerabilities but can be bypassed

**Handle-targeted Bypass**
- Mimics a person exiting from the other side
- Prevention involves proper door sizing and minimizing gaps
- Use of **retrofits** to reduce gaps and secure lever handles

**Deadbolts and Mag Locks**
- **Deadbolts**: Double-sided deadbolts prevent bypassing with tools
- **Mag locks** offer additional security but can be bypassed

**Security Hinges and Combination Locks**
- Use **security hinges** to prevent door removal
- Change default combinations of **button-push combination locks** and enter phones

**Enter Phones and Request to Exit Sensors**
- **Enter phones** have default master codes; change these to prevent unauthorized access
- **Request to exit sensors** can be tricked; use additional security measures

**Elevator Security**
- Avoid relying solely on **elevator floor lockouts**
- Implement additional locked doors for enhanced security

**Overall Security Practices**
- Foster a **security culture** to prevent social engineering and tailgating
- Combine **alarms, sensors, and cameras** for comprehensive security
- **Timing analysis** to respond quickly to threats

**Conclusion and Technical Difficulties**
- Apology for technical difficulties during the presentation
- Invitation to visit **The Village** for further questions and demonstrations


created_at: 2024-11-09 16:44:00
summary:
**Introduction to Bug Bounty Hunting**
- Speaker: Daniel Blaklis Le Gall
- Presentation: Journey through vulnerability hunting in bug bounty programs
- Focus: From simple bugs to complex bug chains
- Personal Background: 
  - 7 years in bug bounty
  - 18 years of hacking experience
  - Specializes in web application exploits, especially PHP

**Swisscom Bug Bounties**
- **Swisscom Overview**:
  - Largest provider in Switzerland
  - Opened a bug bounty program in 2016
  - Wide scope with millions of IP addresses
- **First Bug**:
  - Target: Swisscom Cockpit
  - Vulnerability: SMS token "1111" used for authentication
  - Exploit: Logging in using staging and production systems
  - Reward: $8000
- **Second Bug**:
  - Vulnerability: Encrypted cookies revealing SMS pin
  - Exploit: Cookie manipulation to leak pin code into CAPTCHA
  - Reward: $3000
- **Third Bug**:
  - Vulnerability: Bypass by canceling login process
  - Reward: $8000

**Swisscom WorkLink Bugs**
- **WorkLink Overview**:
  - Acquisition with custom CMS "Weblication"
  - PHP-based, with XML databases
- **Path Traversal Exploit**:
  - Bypass using malformed characters for directory traversal
  - Reward: $3000
- **XML Injection**:
  - Injecting XML to manipulate database content
  - Result: Admin takeover via session token extraction
  - Reward: $3000 plus $2500 bonus

**Swisspost Bug Bounties**
- **Swisspost Overview**:
  - Switzerland's postal service with vast cyber security involvement
  - Bug bounty program started in 2019
- **Payment System Bug**:
  - Vulnerability: Timeout results in successful transaction
  - Exploit: Infinite money generation during coffee breaks
  - Reward: $3000

**Redacted CMS Bugs**
- **Redacted Overview**:
  - PHP CMS with complex code and security patches
- **First Bug**:
  - Vulnerability: Pre-auth Server Side Template Injection (SSTI)
  - Exploit: Regex bypass via newline in template
  - Reward: $10,000
- **Complex Bug**:
  - Involving: Laminas PHP library, MIME encoded words, and Sendmail
  - Exploit: Argument injection for remote code execution
  - Reward: $5000

**Conclusion**
- Speaker's Experience: Extensive bug bounty achievements
- Future Plans: Possible blog to share more bug findings
- Invitation: Follow on Twitter for updates


created_at: 2024-11-09 16:50:24
summary:
**Overview of DEF CON 32 Talk**

- **Title:** DEF CON 32 - Exploiting Bluetooth from your car to the bank account
- **Speakers:** Vladyslav Zubkov, Martin Str
- **Focus:** Exploiting vulnerabilities in Bluetooth systems in cars and other vehicles
- **Framework:** Introduction of BlueToolkit for testing Bluetooth vulnerabilities

**Bluetooth Vulnerabilities**

- **Growth in Infotainment Systems:** Increased functionality and integration into vehicle architecture
- **Threats:** Lack of patches and difficulty in patch installation
- **Attack Surface:** New vulnerabilities due to wireless protocols like Bluetooth
- **Research Findings:** 64 new vulnerabilities in 22 modern cars and Garmin Flight Stream systems

**Security Research and Methodologies**

- **Procurement Support:** Ensuring secure systems for Swiss military and federal government
- **Vulnerability Research:** Conducted as early as possible for shaping security requirements
- **Responsible Disclosure:** Process followed for publishing research findings

**Bluetooth Security Specifics**

- **Bluetooth Classic:** Focus of the research
- **Security Models:** Legacy pairing, just work pairing, pass-key entry, numeric comparison
- **Common Vulnerabilities:** Remote code execution, memory leakage, information leakage

**Testing and Tools**

- **Framework Introduction:** BlueToolkit for testing Bluetooth vulnerabilities
- **Challenges in Testing:** Lack of shared proof-of-concepts, outdated hardware
- **Testing Methodology:** Mix of automated and manual testing processes

**Research Outcomes and Recommendations**

- **Vulnerabilities Found:** 73 vulnerabilities, 64 reported
- **Car Industry Lag:** Slow adoption of new Bluetooth standards
- **Mitigation Challenges:** Infrequent firmware updates and need for hardware changes

**New Attacks and Exploits**

- **New Attack Types:** Contact distractor attack, man-in-the-middle attacks
- **Exploit Details:** Techniques to establish man-in-the-middle positions
- **Impact on Phones:** Ability to extract SMS messages and bypass MFA

**Conclusion and Future Directions**

- **Toolkit Availability:** Online for testing cars and Bluetooth products
- **Aviation Insights:** Potential vulnerabilities in flight management systems
- **Call to Action:** Encouragement for manufacturers to address Bluetooth vulnerabilities

**Contact Information**

- **GitHub Repository:** Contains information and disclosure results
- **Questions:** Available for contact online for further inquiries


created_at: 2024-11-09 17:00:53
summary:
**Introduction to Bug Bounties**
- Insight into the bug bounty world from diverse perspectives
- Challenges faced by hunters and managers
- Importance of bug bounties in cybersecurity
- Recommendations for organizations to mature their bug bounty programs

**Panel Participants and Background**
- Katie Noble: Behavioral analysis background, runs product security incident response
- Jonathan Cusco: Experience as a bug bounty hunter and managing disclosure programs
- Sam: Security engineer at Google, runs bug bounty programs
- Jeff and Logan: Work at GitHub, involved in bug bounty programs

**Motivations for Entering Bug Bounties**
- Financial incentives as a college student
- Gaining experience and improving security skills
- Transition from government to private sector

**Tools and Techniques for Bug Hunting**
- Importance of moving quickly and rejecting uninteresting targets
- Use of man-in-the-middle intercepting proxies and NMAP
- Emphasis on common sense and diligence in evaluating reports

**Human Efforts vs. Automation**
- Human efforts valuable in negotiation and understanding complex systems
- Identifying areas where automation may fall short
- Importance of human insights in evaluating vulnerabilities

**Avoiding Burnout**
- Importance of balance and managing time effectively
- Rotation systems for handling reports in organizations
- Encouraging breaks and setting time limits for tasks

**What Makes a Good Bug Bounty Program**
- Programs should be responsive, have interesting targets, and pay quickly
- Incentivizing different types of researchers (cash payout, recognition)
- Aligning program goals with business needs and risk levels

**Bounty Farming and Ethical Considerations**
- Definition and implications of bounty farming
- Importance of clear program terms and understanding the platform
- Encouragement of ethical behavior and good-faith reporting

**Best Practices for Bug Bounty Programs**
- Clear communication and trust building with researchers
- Offering rewards for meaningful contributions, not just vulnerabilities
- Creative incentives beyond monetary payouts

**Conclusion**
- Encouragement for continued dialogue between researchers and program managers
- Recognition of bug bounties as a maturing field in cybersecurity
- Importance of collaboration and ethical practices in the bug bounty community


created_at: 2024-11-09 17:07:37
summary:
**Introduction to Hepatitis C and Sofosbuvir**
- Hepatitis C causes a high mortality rate with a quarter million deaths yearly.
- **Sofosbuvir (Sovaldi)** is a **cure** for Hepatitis C, not just a treatment.
- Treatment involves taking one 400mg pill daily for twelve weeks.
- Cost of the treatment is prohibitive at **$1,000 per pill**, totaling **$84,000**.

**Challenges with Pharmaceutical Pricing**
- Gilead Pharmaceuticals holds the **Intellectual Property** for Sofosbuvir.
- **Pricing** prevents widespread access, contributing to ongoing Hepatitis C deaths.
- Over 5 million deaths could have been prevented with affordable treatment.

**DIY Pharmaceutical Solutions**
- The presentation advocates for creating medications at home to bypass high costs.
- **Biohacking tools** and processes are shared for making cheaper medications.
- Example given: **Daraprim** was synthesized and produced at a fraction of the cost.
- The method involves using an **Apothecary Micro Lab** to automate chemistry.
- **RecipePress** and **ChemHactica** are tools to assist in drug synthesis.

**Moral and Legal Implications**
- The presentation challenges the morality of current **Intellectual Property laws**.
- It emphasizes the **right to repair** and manage one's own health.
- It advocates for **knowledge sharing** and **self-sufficiency** in medicine production.

**Call to Action and Advocacy**
- Encourages people to join efforts in biohacking and creating their own medicines.
- Promotes **awareness** of the exorbitant pricing in pharmaceuticals.
- Highlights the need for **activism** against unjust pharmaceutical practices.
- Advocates for the empowerment of individuals to take control of their health needs.


created_at: 2024-11-09 17:13:34
summary:
**Human Dignity in AI and Tech Policy**

- **AI's Impact**: AI can create information, make predictions, and take decisions affecting human behavior.
- **Need for Safeguards**: Generative AI exacerbates harms caused by data-driven business models.
- **Human Dignity**: Central to tech law and policy; must be informed by psychological, technological, and societal perspectives.

**Data-Driven Business Models**

- **Information Asymmetries**: These have reduced individual agency and transparency.
- **Manipulation**: Technology used for manipulation and exacerbated by new AI technology.
- **Incentives of Businesses**:
  - Earn money through network effects and user data.
  - Increase user attention for advertising.

**Empowerment in Liberal Democracies**

- **Empowerment**: Citizens should be able to make rational choices.
- **Challenges to Empowerment**:
  - Need for agency and transparency.
  - Absence of manipulation is essential.

**Psychological Insights**

- **Bounded Rationality**: Humans are not completely rational.
- **Transparency vs. Information**: Not synonymous; transparency is crucial.
- **Manipulation through Design**: Design can significantly influence user behavior.

**Market and Social Impacts**

- **Persuasion vs. Manipulation**: Importance of distinguishing between the two in markets.
- **Generative AI**: Increased interest in content for AI model training.

**Privacy and Personal Data**

- **Personal Data**: Key in creating personalized realities.
- **GDPR**: A legal standard for protecting privacy in the EU.
- **Data and Privacy**: Shift from focusing solely on personal data to broader privacy concerns.

**Externalities and Harms**

- **Externalities**: Tech companies create societal harms that need addressing.
- **Personal, Social, and Societal Harms**:
  - Loneliness and health issues.
  - Impact on democracy and geopolitics.

**Big Tech Arrogance**

- **Interests vs. User Needs**: Big tech designs against user interests.
- **Regulatory Challenges**: Difficulty in enforcing laws against large tech companies.

**Solutions and Future Directions**

- **Focus on Human Dignity**: Policies and business practices should prioritize human dignity.
- **Role of Legislation**: Laws are necessary but difficult to enforce.
- **Businesses' Role**: Vulnerable to AI hype; need to consider outsourcing risks.
- **Empowerment Through Agency**: Individuals should sense and act upon their environment.
- **Encouraging Imagination**: Use human capacity to envision a better future.
- **Democracy**: Emphasize the role of people, not just tech companies, in decision-making.

**Conclusion**

- **Call to Action**: Urges individuals to engage in discussions and take action regarding AI and tech policy.


created_at: 2024-11-09 17:19:50
summary:
**Introduction to AI in Bug Bounties**
- AI is being explored to enhance offensive security strategies.
- AI agents can potentially augment bug bounty and pentesting workflows.
- The focus is on AI mimicking human intuition and creativity in identifying vulnerabilities.

**Research and Development of AI Agent**
- Developed an AI agent to assist with bug bounty and pentesting.
- Extensive research conducted on AI's ability to mimic human skills.
- AI agent demonstrated capabilities like decision-making and learning from interactions.

**AI Agent Demonstration**
- Example shown of AI exploiting a JWT Python implementation.
- AI autonomously interacts with web applications, executes commands, and learns from processes.
- Demonstrated AI’s capability to adapt and handle different security challenges.

**Challenges and Limitations in AI Application**
- Initial research showed limited success in complex challenges.
- Papers reviewed highlighted challenges in fully automating AI agents for offensive tasks.
- AI’s effectiveness is limited by the complexity of vulnerabilities and requires further development.

**Expo's Approach to AI in Security**
- Collected thousands of benchmarks from CTF competitions for training.
- Developed a fully autonomous agent connected to an attack machine with pentesting tools.
- Benchmarks categorized by difficulty to evaluate AI performance.

**AI Performance and Results**
- AI solved 75% of challenges from Postfigure Labs and 72% from Pentester Labs.
- Achieved 85% success rate on novel benchmarks representing real-world challenges.
- Performance varied by vulnerability category, with improvements needed in certain areas.

**Human vs. AI Penetration Testing**
- Experiment compared AI performance to human pen testers.
- AI matched the performance of principal-level testers in solving challenges.
- AI excelled in easy and medium tasks but struggled with complex, creative challenges.

**AI as an Assistant in Security**
- Explored potential of AI as a second brain or assistant for security professionals.
- Human-in-the-loop approach allows for feedback and workflow adjustments.
- Prototype developed to test AI's integration with human expertise in security tasks.

**Conclusion and Future Outlook**
- AI shows promise in automating routine security tasks, allowing humans to focus on complex problems.
- Continuous improvement and integration of AI in security workflows are necessary.
- Future updates and benchmarks to be shared for community testing and feedback.


created_at: 2024-11-09 17:22:29
summary:
**Introduction to Industrial Control Systems**

- Presenters: Bryson Bort and Tom VanNorman
- Focus on **Industrial Control Systems (ICS)** and hands-on experience
- Importance of understanding ICS compared to Information Technology (IT)

**Understanding Industrial Control Systems**

- **Definition**: ICS are systems that manage industrial operations
- Difference from IT: ICS is about **resilience and availability**, not just confidentiality and integrity
- Impact: Failure in ICS can affect **health, life, and safety**

**Purdue Model**

- **Purpose**: Nominal enterprise architecture breaking down into five levels
- Levels include IT, DMZ, and specific control zones with engineering workstations and programmable logic controllers
- **Segmentation and Conduits**: Key to maintaining control and preventing issues from spreading

**Threats and Security in ICS**

- Common threats include:
  - **Direct internet connection** of operational technology devices
  - **IT environment vulnerabilities** that allow crossover to ICS
- Importance of understanding **defense in depth** and threat vectors

**Building an ICS Lab**

- **Purpose**: To learn and conduct vulnerability research
- **Components**: Use real controllers, not just virtualized systems
- Challenges include sourcing equipment and licenses

**Learning and Training**

- **ICS Village**: Provides hands-on demos and training opportunities
- Importance of understanding network **authentication** and **segmentation**
- **Best Practices**: Regularly update certifications and test patches before production deployment

**Conclusion**

- Encouragement to explore ICS through volunteering and utilizing resources like ICS Village
- Emphasis on ongoing learning and practical application of skills in ICS environments


created_at: 2024-11-09 17:26:07
summary:
**Introduction to GPS Spoofing**

- **GPS spoofing** affects both **position** and **time**
- **Media narrative** often misses the impact of **time spoofing**

**Significance of Time Spoofing**

- Incident where **time was spoofed** far into the future
- **Digital certificates** became invalid, causing electronic communications to fail
- **Aircraft grounding** required for system reflashing and clock resetting

**Speaker Background**

- Works in **aviation cybersecurity** as a red teamer and pen tester
- Experience with airlines and manufacturers, including collaborations with Boeing
- Personal anecdote about being a **bad pilot** and learning from incidents

**Navigation Systems Overview**

- Discussion on early systems like **Non-Directional Beacon (NDB)**
- **VOR (VHF Omnidirectional Range)** and its limitations
- **Instrument Landing Systems (ILS)** and their precision
- **Inertial Reference Systems (IRS)** and their role in navigation
- Transition to **GPS** due to its accuracy and cost-effectiveness

**Incidents and Challenges**

- **GPS jamming** and **spoofing** observed around conflict areas
- Impact on **ground proximity warning system** and flight safety
- **Position errors** leading to flight disruptions
- **Inertial reference poisoning** due to GPS spoofing

**Time Spoofing Impact on Aviation**

- **Time errors** causing digital certificate issues
- **Controller to pilot data link communication** affected
- Importance of **accurate time** for TCAS (Collision Avoidance System) and logging incidents
- Challenges in **re-establishing accurate time** after spoofing

**Future Considerations**

- Need for **hybrid systems** combining GPS with ground-based systems
- Caution against retiring **traditional navigation aids**
- Importance of GPS in **financial services** and other industries

**Conclusion**

- Encouragement to explore more about **GPS and its vulnerabilities**
- Mention of a related talk on **PKI in airplanes** by a colleague


created_at: 2024-11-09 17:29:27
summary:
**Introduction**
- Talk titled: "Malicious Fungible Tokens"
- Presented by Mauro Eldritch and Cybelle Oliveira
- Focus on NFTs as attack vectors for C2 commands

**Speakers' Backgrounds**
- Mauro: Uruguayan-Argentinian hacker, leader of BITSOC Quetzal team
- Cybelle: Works in Cyber Threat Intelligence, interested in malware research

**Concept of NFTs in Cybersecurity**
- **NFTs**: Information stored on blockchain, can be used for C2 servers
- **C2 Servers**: Send/receive malware information, resilient when based on blockchain
- Challenges: Regular servers can be banned or blacklisted; blockchain provides permanence

**Interplanetary File System (IPFS)**
- Decentralized storage system like a blockchain
- Files shared among nodes; takedown requires notifying all node owners
- **Filecoin**: Incentivizes hosting files

**Malicious Fungible Tokens (MFT)**
- Tool for creating malicious payloads using NFTs
- Coded in Ruby to exploit OpenSea
- Four NFTs used for demonstration: Initial Access Marker, Ramson Retriever, Treat Actor, Golden Locker

**Exploiting OpenSea**
- **Treat Actor**: Encodes information in Base64 and ROT13
- **Golden Locker**: Uses Base64 encoding for concealment
- **Exif Metadata**: Stores payloads, particularly in profile copyright field

**Decentralization Challenges**
- NFTs provide resilience against takedowns
- Threat of **decentralization weaponization**: Permanent phishing campaigns

**Demonstration and Challenges**
- Live demo of Golden Locker and its challenges
- Issues with demo execution, highlighting complexity in implementation

**Conclusion and Future Work**
- Importance of NFTs in cybersecurity
- Tool released for experimentation
- Invitation to future events and communities like La Villa Hacker


created_at: 2024-11-09 17:32:29
summary:
**Overview of Presentation**

- **Title**: DEF CON 32 - Master Splinter’s Initial Physical Access Dojo
- **Presenter**: Daniel Isler
- **Event**: DEFCONConference
- **Date of Upload**: October 16, 2024
- **Duration**: 1473 seconds

**Presentation Theme**

- **Storytelling Format**: Aims to guide attendees through a Red Team service using 100% Social Engineering
- **Objective**: Demonstrate methodologies and techniques for accessing critical infrastructure without alerting the target
- **Process**: From initial client meeting to physical intrusion, including strategies like **information gathering**, **vector selection**, **exploitation**, and **pretexting**

**Key Concepts and Techniques**

- **Social Engineering**: Emphasized as a primary tool for gaining access
- **Luck**: Dismissed as a factor, replaced by **training**, **preparation**, and **methodology**
- **Team Structure**: Includes roles such as **Support**, **Q (Queue) Agent**, **Alpha Team**, and **Cover Consultant**

**Intrusion Methodology**

- **Information Gathering**: Focus on **Corporate ID**, **Relevant Profiles**, and **Weak Access Points**
- **Physical Intrusion**: Involves **pretexting** as central office staff, using **custom-designed uniforms**, and leveraging **reciprocity principles** with stickers
- **Technical Exploitation**: Utilizes **brute force attacks** on weak passwords and impersonation of compromised **email accounts**

**Roles and Responsibilities**

- **Support Team**: Provides immediate responses and logistical support
- **Q Agent**: Prepares technical tools and payloads
- **Alpha Team**: Executes physical and technical intrusions
- **Cover Consultant**: Engages in distraction and support activities to aid the Alpha Team

**Execution Day Strategy**

- **Preparation**: Review of objectives, roles, and possible scenarios
- **Execution**: Use of **technical language** and **pretext** to gain trust and access
- **Objective**: Gain entry to critical areas such as data centers using orchestrated misdirection

**Interactive Elements**

- **Volunteer Participation**: Used to demonstrate principles of truth and deception
- **Improvisation Exercise**: Engaged audience in understanding the goal behind visible actions

**Conclusion**

- **Objective Achieved**: Successful infiltration and demonstration of Red Team capabilities
- **Key Takeaway**: Importance of preparation and methodical approach in social engineering tasks


created_at: 2024-11-09 17:36:12
summary:
**Talk Overview**
- Discusses the evolution and understanding of cryptographic terms
- Focus on historical definitions and their relevance today
- Highlights the tradeoff between **security** and **privacy**

**Speaker's Background**
- Jeff Mann, former **NSA cryptologist**
- Involved in **NSA red team** and **pen testing** in the 90s
- Worked on early cryptographic systems and **PCI** standards

**Cryptography Basics**
- **Encryption**: More than just encoding; involves complex processes
- **Codes and Ciphers**: Historically distinct methods of message protection
  - **Codes**: Applied to words and phrases for brevity
  - **Ciphers**: Scramble individual characters or symbols

**Historical Examples**
- **Caesar Cipher**: Simple substitution used historically
- **Pigpen Cipher**: Used by Freemasons for tombstone messages
- **Navajo Code Talkers**: Utilized in WWII, remained unbroken by the enemy
- **Enigma Machine**: Broken by Polish cryptographers, secret kept until late 1980s

**Modern Cryptography**
- **Symmetric Encryption**: Same key used for both encryption and decryption
- **Public Key Cryptography**: Uses key pairs (public and private keys)
- **Homomorphic Encryption**: Controversial as it allows data processing while encrypted

**Technological Evolution**
- Shift from **ComSec** to **InfoSec** with advancing tech
- Introduction of **key injectors** and encryption in devices
- **Spread Spectrum Technology**: Invented by Hedy Lamarr

**Cryptographic Literature**
- Military **Cryptanalytics Volumes** by Lambros Kalimahos and William Friedman
- Importance of understanding the original definitions and applications

**Conclusion**
- Emphasis on understanding and preserving the meanings of cryptographic terms
- Presentation of Jeff Mann's cipher wheel at the National Cryptologic Museum

**Key Takeaways**
- Importance of precise terminology in cryptography
- Evolution of cryptographic methods and their historical significance


created_at: 2024-11-09 17:39:59
summary:
**Event Overview**
- Title: DEF CON 32 - Fitness of Physical Red Teamers
- Authors: Lucas Rooyakkers & Billy Graydon
- Description: Focus on enhancing physical abilities for red teaming
- Webpage URL: [YouTube Video](https://www.youtube.com/watch?v=ocXSZRKmI0I)
- Channel: DEFCONConference
- Duration: 1493 seconds
- Upload Date: October 16, 2024

**Introduction**
- Importance of physical fitness for red teaming
- Training to climb, sneak, jump, and perform physical penetration tests
- Emphasis on adding new abilities and how they impact security models

**Physical Red Teaming Techniques**
- **Hacking Physical Spaces**: Using the human body in unexpected ways
- **Brute Force Examples**: Accessing locked spaces without tools
- **Climbing and Obstacles**: Techniques to bypass fences, climb buildings, and navigate pipe shafts
- **False Ceilings and Floors**: Methods to exploit structural weaknesses in buildings

**Fitness and Training for Red Teaming**
- **Importance of Fitness**: Enhancing abilities to bypass security measures
- **Exercises and Habits**: Recommended workouts for improving physical capabilities
- **Cardio and Speed**: Importance of being able to move quickly and efficiently

**Fitness Training Components**
- **Resistance Training**: Core exercises to build strength and flexibility
- **Fundamental Movements**: Push, pull, squat, hip hinge, twist, and farmer's carry
- **Specific Exercises**: Deadlifts, squats, and cardio routines for overall health and performance

**Training Recommendations**
- **Consistency and Habit Formation**: Establishing regular exercise routines
- **Cardio and VO2 Max**: Importance of high-intensity sprints and efficient oxygen use
- **Climbing and Upper Body Strength**: Exercises like pull-ups and kettlebell workouts

**Conclusion**
- Emphasize the importance of regular exercise for red team engagements
- Encourage maintaining a consistent workout routine for maximum benefits


created_at: 2024-11-09 17:43:18
summary:
**Event Overview**
- **Title**: DEF CON 32 - I am still the Captain now!
- **Speaker**: Paul Brownridge
- **Platform**: DEFCONConference YouTube Channel
- **Duration**: 1199 seconds
- **Upload Date**: October 16, 2024

**Speaker Background**
- **Name**: Paul Brownridge
- **Experience**: Started as an engineer in Cape Town, transitioned to cybersecurity
- **Expertise**: OT testing, maritime cybersecurity, IoT, APIs

**Talk Introduction**
- Discusses experiences and knowledge from maritime cybersecurity
- Focus on the MV Dali incident and the potential for cyber events in maritime contexts
- Emphasizes the importance of understanding ship architecture

**Ship Systems and Architecture**
- **Main Engines**: Supported by ancillary systems like pumps and generators
- **Power Management System (PMS)**: Managed by the integrated alarm and monitoring system
- **Steering Systems**: Include helm controls and autopilot; can be manually overridden

**Potential Cyber Threats**
- **MV Dali Incident**: Debunking myths about it being a hack
- **Autopilot Systems**: Possible threat landscape due to internet connectivity
- **Power Systems**: Increasingly network connected but can be manually overridden
- **Propulsion Systems**: Typically segregated from IT systems

**Challenges in Cybersecurity**
- **Blackout Triggers**: Bad fuel, ship rolling, electrical problems
- **Manual Processes**: Essential for restarting systems post-blackout
- **System Complexity**: Diverse and outdated systems complicate cybersecurity efforts

**Testing and Vulnerabilities**
- **Integrated Control and Monitoring System (ICMS)**: High-value target for attackers
- **ECDIS**: Critical for navigation; redundancy with physical maps
- **Safety Management**: Integral for emergency response and ship coordination

**Attack Surface Exploration**
- **IP to Serial Connections**: Used for older systems
- **Modbus Protocol**: Potential vulnerability for injecting values into PLCs
- **TeamViewer**: Found on systems, illustrating outdated and risky practices

**Conclusion**
- **Possibility of Hacks**: Requires significant time and insider knowledge
- **Social Engineering**: A viable threat vector
- **Modernization Risks**: New technologies introduce new vulnerabilities
- **Undocumented Systems**: Frequent in maritime environments, complicating security efforts

**Final Thoughts**
- Ships can be hacked, but it involves complex, manual processes and deep system knowledge
- Emphasis on the need for understanding ship architecture and cautious modernization


created_at: 2024-11-09 17:47:00
summary:
**Event and Speaker Introduction**
- Welcome to the second day of DEF CON
- Introduction of Melvin Langvik, speaker from Norway
- Melvin's background in tech and cybersecurity
- Previous work with TrustedSec and current role at CovertAS

**Presentation Overview**
- Talk duration: 25 minutes
- Focus on evading modern defenses using QR codes
- Introduction of phishing with QR codes

**QR Code Basics**
- **What is a QR code?**
  - Quick response code, similar to a barcode
  - Scanned by devices to redirect to a link or data
- **Components of a QR code:**
  - Finder patterns, alignment marker, data modules, error correction
- **Versions and uses:**
  - Different sizes and versions for varying data storage
  - Legitimate use in various applications like EV charging, e-bike booking, and restaurants

**Phishing with QR Codes**
- **Why attackers use QR codes:**
  - Simple to create and share
  - Perceived legitimacy by users
  - Effective in bypassing email filters
- **Common phishing examples:**
  - Microsoft multi-factor authentication, DocuSign, other Microsoft-related phishing

**Detection and Evasion**
- **Detection methods:**
  - Manual detection by parsing images in emails
  - Black box solutions like Microsoft Sentinel to identify URLs from QR codes
- **Image-less delivery methods:**
  - Using ASCII art or CSS to create QR codes without images
  - Techniques to evade detection by email clients

**Advanced Techniques:**
- **Using tables for QR code creation:**
  - Tables as an alternative to CSS for QR code generation
  - Support by Outlook desktop client
- **Obfuscating email content:**
  - Utilizing tables to render keywords as images within emails
  - Prevents AI detection by masking text as tables

**Crucible Tool**
- **Features:**
  - Generates QR codes in CSS or tables
  - Can obfuscate keywords in email templates
  - Outputs in EML format for Outlook compatibility

**Conclusion**
- Demonstration of obfuscation technique using Crucible
- Encouragement to leverage techniques for improving phishing defenses


created_at: 2024-11-09 17:51:42
summary:
**Introduction to Locksport Competitions**
- Locksport involves **non-destructive opening** of locks as a hobby and competition.
- Compete to see who can open locks the **fastest**.
- Different from just lock picking; it's about the **opening** of locks.

**Motivations for Participation**
- Locks are seen as **puzzles** and **challenges**.
- Participants seek to improve skills, achieve **personal bests**, and gain recognition.
- Possibility of becoming famous within the locksport community, like **LPL**.
- Prizes include **trophies** and lock-picking gear.

**History of Locksport**
- Originated with locksmiths; became organized in the 1960s at MIT.
- European locksport gained momentum in the late 90s.
- **TOOL** (The Open Organization of Lockpickers) was founded in the Netherlands.

**Types of Locksport Competitions**
- **Lock picking**: Primary event at conferences; involves picking various locks in a timed setting.
- **Impressioning**: Creating a key from a blank without knowing the original design.
- **Safe manipulation**: Figuring out combinations to open safe locks quickly.
- **Lever lock picking**: Common in Europe; uses different tools and techniques.
- **Creative events**: Include challenges like prison escape simulations and forensic tests.

**Major Locksport Events and Locations**
- **LockCon**: Known as the "Wimbledon" of lockpicking; held in the Netherlands.
- **LockFest**: Held in Seattle, offers various competitions and talks.
- **Locktoberfest**: Organized by Tool Chicago, combines lockpicking with social activities.
- **OzSecCon**: Held in Australia, features international speakers and unique local locks.
- Other events include **DEF CON**, **HOPE**, **ShmooCon**, and various B-sides.

**Conclusion**
- Locksport competitions offer a platform for enthusiasts to test and showcase their skills.
- Opportunities for participation exist globally, with events catering to different aspects of lock manipulation.
- The community is tight-knit, fostering a sharing of knowledge and techniques.


created_at: 2024-11-09 17:55:26
summary:
**Manufacturing Sector Vulnerabilities**

- **Manufacturing** is a top target for **cyber threat actors**, especially **ransomware**.
- 70% of ransomware victims are manufacturers (Dragos 2023 Review).
- **Factors making manufacturing vulnerable**:
  - Lack of **network security** and **segmentation**.
  - IT compromises leading to **operational disruption**.
  - Tight margins and lack of compliance regimes.
  - Organizational size contributes to vulnerability.

**Ransomware Threat in Manufacturing**

- **Ransomware operators** target manufacturers due to:
  - Flat, poorly segmented networks.
  - Use of enterprise **ERP systems** accessible by all employees.
  - IT intrusions leading to **operational technology (OT)** effects.
  - Manufacturers often pay ransoms quickly.
  - Target mid-level enterprises with less sophisticated security.

**Automation and Connectivity in Manufacturing**

- Manufacturing leads in **automation** and **device connectivity** in OT.
- **Networks** increasingly set up as hyper-connected **IIoT devices**.
- Data flows to and from the **cloud**, enabling efficiency and scale.
- **Downside risks** are emerging, prompting security improvements.

**Security Challenges and the Path Forward**

- Manufacturers lag in **cybersecurity** compared to other sectors.
- **IT-OT convergence** is less applicable as separation is minimal.
- Networks becoming less industrial, moving towards IP-centric systems.
- **Wi-Fi** use in industrial settings is increasing but not always secure.
- Solutions need to address less industrial environments and smaller manufacturers.

**Future of Cybersecurity in Manufacturing**

- Executive leadership is key in steering security improvements.
- **Regulatory requirements** and **compliance** are becoming more stringent.
- Talent from cyber-mature industries is moving into manufacturing.
- Manufacturers are expected to innovate and create new security tools.
- **Ransomware reports** show a potential decline in targeting manufacturers, indicating progress.

**Conclusion**

- Manufacturers are poised to transition from poor security practices to becoming leaders in cybersecurity.
- Executive buy-in and understanding of **security as a process** are critical.
- Continued focus on security innovation could allow manufacturers to surpass other industries in security maturity.


created_at: 2024-11-09 17:59:52
summary:
**Introduction to IPv6**

- **IPv4 vs. IPv6**:
  - The majority of the Internet operates on **IPv4**, a legacy protocol.
  - Many engineers, particularly in security, lack knowledge about **IPv6**.
  - **IPv6** is seen as complex, leading to a preference for the familiar **IPv4**.

- **Challenges with IPv4**:
  - **IPv4** has evolved with extensions and technologies like **NAT** that deviate from its original intent.
  - Understanding **IPv6** requires revisiting the basics of **IPv4**.

**Understanding IPv4**

- **IP Address Basics**:
  - An **IPv4 address** consists of 4 fields, each ranging from 0 to 255.
  - **Subnet masks** help determine packet routing within a network.
  - **CIDR Notation** simplifies the representation of IP addresses and subnet masks.

- **Network Limitations**:
  - Home networks often use a **subnet mask** of 255.255.255.0, limiting connections to 254 devices.
  - Larger networks require more complex addressing and planning.

**Transition to IPv6**

- **IPv4 Address Exhaustion**:
  - **IPv4** addresses are nearly exhausted due to inefficient allocation and increased demand.
  - Entities like the **USDOD** and companies hold large blocks of addresses.
  - **IPv6** offers a solution with a vastly larger address space.

- **IPv6 Address Structure**:
  - **IPv6 addresses** are 128 bits, providing an exponentially larger pool of addresses.
  - Addresses are represented in hexadecimal and divided into eight 16-bit fields.

**Features of IPv6**

- **Address Configuration**:
  - **Stateless Address Auto-Configuration** allows devices to self-configure addresses using the **EUI-64** format.
  - **Privacy Extensions** prevent tracking by changing the host portion of an address over time.

- **Benefits**:
  - **IPv6** supports a virtually unlimited number of devices per network.
  - Simplifies network design and reduces the need for address conservation.

**Practical Use of IPv6**

- **Address Notation**:
  - **IPv6 addresses** can be abbreviated using double colons (::) to represent consecutive zeros.
  - When entering **IPv6 addresses** in web browsers, enclose them in square brackets to avoid conflicts with port numbers.

- **Future of IPv6**:
  - The **IPv6 landscape** is organized and efficient, unlike the fragmented **IPv4** space.
  - Current allocations represent only a small fraction of the potential **IPv6** space, ensuring long-term availability.


